diff --git a/.bazelrc b/.bazelrc
index 9a58b60c3ef..a304a7b0e1a 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,3 +1,3 @@
-build --repo_env=CC=clang --repo_env=CXX=clang++ --copt="-std=c++17"
+build --repo_env=CC=clang --repo_env=CXX=clang++ --cxxopt="-std=c++17"
 
 try-import %workspace%/local.bazelrc
diff --git a/.github/workflows/check-qldoc.yml b/.github/workflows/check-qldoc.yml
index cc7523162aa..85249fbd92a 100644
--- a/.github/workflows/check-qldoc.yml
+++ b/.github/workflows/check-qldoc.yml
@@ -27,7 +27,8 @@ jobs:
         run: |
           EXIT_CODE=0
           # TODO: remove the swift exception from the regex when we fix generated QLdoc
-          changed_lib_packs="$(git diff --name-only --diff-filter=ACMRT HEAD^ HEAD | { grep -Po '^(?!swift)[a-z]*/ql/lib' || true; } | sort -u)"
+          # TODO: remove the shared exception from the regex when coverage of qlpacks without dbschemes is supported
+          changed_lib_packs="$(git diff --name-only --diff-filter=ACMRT HEAD^ HEAD | { grep -Po '^(?!(swift|shared))[a-z]*/ql/lib' || true; } | sort -u)"
           for pack_dir in ${changed_lib_packs}; do
             lang="${pack_dir%/ql/lib}"
             codeql generate library-doc-coverage --output="${RUNNER_TEMP}/${lang}-current.txt" --dir="${pack_dir}"
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 73826e30f9e..fa17f4d6742 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -56,7 +56,7 @@ jobs:
     #    uses a compiled language
 
     - run: |
-       dotnet build csharp /p:UseSharedCompilation=false
+       dotnet build csharp
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@main
diff --git a/.github/workflows/csv-coverage-metrics.yml b/.github/workflows/csv-coverage-metrics.yml
index 7555533ab98..f18671441cd 100644
--- a/.github/workflows/csv-coverage-metrics.yml
+++ b/.github/workflows/csv-coverage-metrics.yml
@@ -55,7 +55,7 @@ jobs:
           DATABASE="${{ runner.temp }}/csharp-database"
           PROJECT="${{ runner.temp }}/csharp-project"
           dotnet new classlib --language=C# --output="$PROJECT"
-          codeql database create "$DATABASE" --language=csharp --source-root="$PROJECT" --command 'dotnet build /t:rebuild csharp-project.csproj /p:UseSharedCompilation=false'
+          codeql database create "$DATABASE" --language=csharp --source-root="$PROJECT" --command 'dotnet build /t:rebuild csharp-project.csproj'
       - name: Capture coverage information
         run: |
           DATABASE="${{ runner.temp }}/csharp-database"
diff --git a/.github/workflows/ql-for-ql-build.yml b/.github/workflows/ql-for-ql-build.yml
index 99370014505..53a4157973d 100644
--- a/.github/workflows/ql-for-ql-build.yml
+++ b/.github/workflows/ql-for-ql-build.yml
@@ -5,6 +5,13 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+    paths:
+      - "ql/**"
+      - "**.qll"
+      - "**.ql"
+      - "**.dbscheme"
+      - "**/qlpack.yml"
+      - ".github/workflows/ql-for-ql-build.yml"
 
 env:
   CARGO_TERM_COLOR: always
@@ -54,7 +61,7 @@ jobs:
           cp -r ${{ runner.temp }}/queries ${{ runner.temp }}/pack
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
-      
+
       ### Build the extractor ###
       - name: Cache entire extractor
         if: steps.cache-pack.outputs.cache-hit != 'true'
@@ -108,7 +115,7 @@ jobs:
       ### Run the analysis ###
       - name: Hack codeql-action options
         run: |
-          JSON=$(jq -nc --arg pack "${PACK}" '.database."run-queries"=["--search-path", $pack] | .resolve.queries=["--search-path", $pack] | .resolve.extractor=["--search-path", $pack] | .database.init=["--search-path", $pack]')
+          JSON=$(jq -nc --arg pack "${PACK}" '.database."run-queries"=["--search-path", $pack] | .resolve.queries=["--search-path", $pack] | .resolve.extractor=["--search-path", $pack] | .resolve.languages=["--search-path", $pack] | .database.init=["--search-path", $pack]')
           echo "CODEQL_ACTION_EXTRA_OPTIONS=${JSON}" >> ${GITHUB_ENV}
         env:
           PACK: ${{ runner.temp }}/pack
@@ -116,14 +123,14 @@ jobs:
       - name: Create CodeQL config file
         run: |
           echo "paths-ignore:" >> ${CONF}
-          echo "  - ql/ql/test" >> ${CONF} 
-          echo "  - \"*/ql/lib/upgrades/\"" >> ${CONF} 
+          echo "  - ql/ql/test" >> ${CONF}
+          echo "  - \"*/ql/lib/upgrades/\"" >> ${CONF}
           echo "disable-default-queries: true" >> ${CONF}
           echo "queries:" >> ${CONF}
           echo "  - uses: ./ql/ql/src/codeql-suites/ql-code-scanning.qls" >> ${CONF}
           echo "Config file: "
           cat ${CONF}
-        env: 
+        env:
           CONF: ./ql-for-ql-config.yml
       - name: Initialize CodeQL
         uses: github/codeql-action/init@71a8b35ff4c80fcfcd05bc1cd932fe3c08f943ca
@@ -139,13 +146,13 @@ jobs:
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@71a8b35ff4c80fcfcd05bc1cd932fe3c08f943ca
-        with: 
+        with:
           category: "ql-for-ql"
       - name: Copy sarif file to CWD
         run: cp ../results/ql.sarif ./ql-for-ql.sarif
       - name: Fixup the $scema in sarif  # Until https://github.com/microsoft/sarif-vscode-extension/pull/436/ is part in a stable release
         run: |
-          sed -i 's/\$schema.*/\$schema": "https:\/\/raw.githubusercontent.com\/oasis-tcs\/sarif-spec\/master\/Schemata\/sarif-schema-2.1.0",/' ql-for-ql.sarif 
+          sed -i 's/\$schema.*/\$schema": "https:\/\/raw.githubusercontent.com\/oasis-tcs\/sarif-spec\/master\/Schemata\/sarif-schema-2.1.0",/' ql-for-ql.sarif
       - name: Sarif as artifact
         uses: actions/upload-artifact@v3
         with:
diff --git a/.github/workflows/ruby-build.yml b/.github/workflows/ruby-build.yml
index 6ad627aab48..08e2b0b4ab6 100644
--- a/.github/workflows/ruby-build.yml
+++ b/.github/workflows/ruby-build.yml
@@ -95,6 +95,7 @@ jobs:
         uses: ./.github/actions/fetch-codeql
       - name: Build Query Pack
         run: |
+          codeql pack create ../shared/ssa --output target/packs
           codeql pack create ql/lib --output target/packs
           codeql pack install ql/src
           codeql pack create ql/src --output target/packs
diff --git a/.github/workflows/swift-codegen.yml b/.github/workflows/swift-codegen.yml
index 5700045430d..0ce0cc91c21 100644
--- a/.github/workflows/swift-codegen.yml
+++ b/.github/workflows/swift-codegen.yml
@@ -4,6 +4,8 @@ on:
   pull_request:
     paths:
       - "swift/**"
+      - "misc/bazel/**"
+      - "*.bazel*"
       - .github/workflows/swift-codegen.yml
       - .github/actions/fetch-codeql/action.yml
     branches:
diff --git a/.github/workflows/swift-integration-tests.yml b/.github/workflows/swift-integration-tests.yml
index 4d4248b64e3..b81969f3502 100644
--- a/.github/workflows/swift-integration-tests.yml
+++ b/.github/workflows/swift-integration-tests.yml
@@ -4,6 +4,8 @@ on:
   pull_request:
     paths:
       - "swift/**"
+      - "misc/bazel/**"
+      - "*.bazel*"
       - .github/workflows/swift-integration-tests.yml
       - .github/actions/fetch-codeql/action.yml
       - codeql-workspace.yml
@@ -30,6 +32,14 @@ jobs:
       - name: Build Swift extractor
         run: |
           bazel run //swift:create-extractor-pack
+      - name: Get Swift version
+        id: get_swift_version
+        run: |
+          VERSION=$(bazel run //swift/extractor -- --version | sed -ne 's/.*version \(\S*\).*/\1/p')
+          echo "::set-output name=version::$VERSION"
+      - uses: swift-actions/setup-swift@v1
+        with:
+          swift-version: "${{steps.get_swift_version.outputs.version}}"
       - name: Run integration tests
         run: |
           python integration-tests/runner.py
diff --git a/.github/workflows/swift-qltest.yml b/.github/workflows/swift-qltest.yml
index 3cbcf629c98..ab74e96cd57 100644
--- a/.github/workflows/swift-qltest.yml
+++ b/.github/workflows/swift-qltest.yml
@@ -4,6 +4,8 @@ on:
   pull_request:
     paths:
       - "swift/**"
+      - "misc/bazel/**"
+      - "*.bazel*"
       - .github/workflows/swift-qltest.yml
       - .github/actions/fetch-codeql/action.yml
       - codeql-workspace.yml
diff --git a/CODEOWNERS b/CODEOWNERS
index 1754d58af63..d5ec29f0b93 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -30,6 +30,8 @@
 
 # Bazel (excluding BUILD.bazel files)
 WORKSPACE.bazel @github/codeql-ci-reviewers
+.bazelversion @github/codeql-ci-reviewers
+.bazelrc @github/codeql-ci-reviewers
 **/*.bzl @github/codeql-ci-reviewers
 
 # Documentation etc
diff --git a/codeql-workspace.yml b/codeql-workspace.yml
index 1bf0510af50..8a7f2bd7a74 100644
--- a/codeql-workspace.yml
+++ b/codeql-workspace.yml
@@ -4,6 +4,7 @@ provide:
   - "*/ql/test/qlpack.yml"
   - "*/ql/examples/qlpack.yml"
   - "*/ql/consistency-queries/qlpack.yml"
+  - "shared/*/qlpack.yml"
   - "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml"
   - "go/ql/config/legacy-support/qlpack.yml"
   - "go/build/codeql-extractor-go/codeql-extractor.yml"
diff --git a/config/identical-files.json b/config/identical-files.json
index b05629f9e96..de7b75c5d48 100644
--- a/config/identical-files.json
+++ b/config/identical-files.json
@@ -17,6 +17,10 @@
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll",
+    "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll",
+    "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll",
+    "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll",
+    "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll",
@@ -30,12 +34,14 @@
     "ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll",
     "ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll",
     "ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForLibraries.qll",
+    "ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForHttpClientLibraries.qll",
     "swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl.qll"
   ],
   "DataFlow Java/C++/C#/Python Common": [
     "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
     "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
+    "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll",
     "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll",
     "ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplCommon.qll",
@@ -47,6 +53,9 @@
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
+    "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
@@ -67,15 +76,17 @@
     "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
     "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
+    "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
     "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll",
     "ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplConsistency.qll",
     "swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImplConsistency.qll"
   ],
-  "DataFlow Java/C# Flow Summaries": [
+  "DataFlow Java/C#/Ruby/Python/Swift Flow Summaries": [
     "java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll",
     "ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll",
+    "python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll",
     "swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll"
   ],
   "SsaReadPosition Java/C#": [
@@ -460,15 +471,6 @@
     "javascript/ql/lib/IDEContextual.qll",
     "python/ql/lib/analysis/IDEContextual.qll"
   ],
-  "SSA C#": [
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll",
-    "ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll",
-    "swift/ql/lib/codeql/swift/dataflow/internal/SsaImplCommon.qll"
-  ],
   "CryptoAlgorithms Python/JS/Ruby": [
     "javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll",
     "python/ql/lib/semmle/python/concepts/CryptoAlgorithms.qll",
@@ -540,7 +542,7 @@
     "java/ql/lib/semmle/code/java/dataflow/internal/AccessPathSyntax.qll",
     "javascript/ql/lib/semmle/javascript/frameworks/data/internal/AccessPathSyntax.qll",
     "ruby/ql/lib/codeql/ruby/dataflow/internal/AccessPathSyntax.qll",
-    "python/ql/lib/semmle/python/frameworks/data/internal/AccessPathSyntax.qll",
+    "python/ql/lib/semmle/python/dataflow/new/internal/AccessPathSyntax.qll",
     "swift/ql/lib/codeql/swift/dataflow/internal/AccessPathSyntax.qll"
   ],
   "IncompleteUrlSubstringSanitization": [
@@ -584,22 +586,22 @@
   ],
   "Swift declarations test file": [
     "swift/ql/test/extractor-tests/declarations/declarations.swift",
-    "swift/ql/test/library-tests/parent/declarations.swift"
+    "swift/ql/test/library-tests/ast/declarations.swift"
   ],
   "Swift statements test file": [
     "swift/ql/test/extractor-tests/statements/statements.swift",
-    "swift/ql/test/library-tests/parent/statements.swift"
+    "swift/ql/test/library-tests/ast/statements.swift"
   ],
   "Swift expressions test file": [
     "swift/ql/test/extractor-tests/expressions/expressions.swift",
-    "swift/ql/test/library-tests/parent/expressions.swift"
+    "swift/ql/test/library-tests/ast/expressions.swift"
   ],
   "Swift patterns test file": [
     "swift/ql/test/extractor-tests/patterns/patterns.swift",
-    "swift/ql/test/library-tests/parent/patterns.swift"
+    "swift/ql/test/library-tests/ast/patterns.swift"
   ],
   "IncompleteMultiCharacterSanitization JS/Ruby": [
     "javascript/ql/lib/semmle/javascript/security/IncompleteMultiCharacterSanitizationQuery.qll",
     "ruby/ql/lib/codeql/ruby/security/IncompleteMultiCharacterSanitizationQuery.qll"
   ]
-}
+}
\ No newline at end of file
diff --git a/cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs b/cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs
index d37f3e30e66..76acba2eee4 100644
--- a/cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs
+++ b/cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs
@@ -299,7 +299,7 @@ namespace Semmle.Autobuild.Cpp.Tests
         {
             Actions.RunProcess[@"cmd.exe /C nuget restore C:\Project\test.sln -DisableParallelProcessing"] = 1;
             Actions.RunProcess[@"cmd.exe /C C:\Project\.nuget\nuget.exe restore C:\Project\test.sln -DisableParallelProcessing"] = 0;
-            Actions.RunProcess[@"cmd.exe /C CALL ^""C:\Program Files ^(x86^)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat^"" && set Platform=&& type NUL && C:\odasa\tools\odasa index --auto msbuild C:\Project\test.sln /p:UseSharedCompilation=false /t:rebuild /p:Platform=""x86"" /p:Configuration=""Release"" /p:MvcBuildViews=true"] = 0;
+            Actions.RunProcess[@"cmd.exe /C CALL ^""C:\Program Files ^(x86^)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat^"" && set Platform=&& type NUL && C:\odasa\tools\odasa index --auto msbuild C:\Project\test.sln /t:rebuild /p:Platform=""x86"" /p:Configuration=""Release"" /p:MvcBuildViews=true"] = 0;
             Actions.RunProcessOut[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe -prerelease -legacy -property installationPath"] = "";
             Actions.RunProcess[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe -prerelease -legacy -property installationPath"] = 1;
             Actions.RunProcess[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe -prerelease -legacy -property installationVersion"] = 0;
diff --git a/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/exprs.ql b/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/exprs.ql
new file mode 100644
index 00000000000..26f95414fde
--- /dev/null
+++ b/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/exprs.ql
@@ -0,0 +1,17 @@
+class Expr extends @expr {
+  string toString() { none() }
+}
+
+class Location extends @location_expr {
+  string toString() { none() }
+}
+
+predicate isExprWithNewBuiltin(Expr expr) {
+  exists(int kind | exprs(expr, kind, _) | 336 <= kind and kind <= 362)
+}
+
+from Expr expr, int kind, int kind_new, Location location
+where
+  exprs(expr, kind, location) and
+  if isExprWithNewBuiltin(expr) then kind_new = 1 else kind_new = kind
+select expr, kind_new, location
diff --git a/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/old.dbscheme b/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/old.dbscheme
new file mode 100644
index 00000000000..625f706f2a4
--- /dev/null
+++ b/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/old.dbscheme
@@ -0,0 +1,2190 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    /**
+     * An invocation of the compiler. Note that more than one file may
+     * be compiled per invocation. For example, this command compiles
+     * three source files:
+     *
+     *   gcc -c f1.c f2.c f3.c
+     */
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | *path to extractor*
+ * 1   | `--mimic`
+ * 2   | `/usr/bin/gcc`
+ * 3   | `-c`
+ * 4   | f1.c
+ * 5   | f2.c
+ * 6   | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.c
+ * 1   | f2.c
+ * 2   | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+    int id : @externalDataElement,
+    string path : string ref,
+    int column: int ref,
+    string value : string ref
+);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Information about packages that provide code used during compilation.
+ * The `id` is just a unique identifier.
+ * The `namespace` is typically the name of the package manager that
+ * provided the package (e.g. "dpkg" or "yum").
+ * The `package_name` is the name of the package, and `version` is its
+ * version (as a string).
+ */
+external_packages(
+    unique int id: @external_package,
+    string namespace : string ref,
+    string package_name : string ref,
+    string version : string ref
+);
+
+/**
+ * Holds if File `fileid` was provided by package `package`.
+ */
+header_to_external_package(
+    int fileid : @file ref,
+    int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+    unique int id : @svnentry,
+    string revision : string ref,
+    string author : string ref,
+    date revisionDate : date ref,
+    int changeSize : int ref
+)
+
+svnaffectedfiles(
+    int id : @svnentry ref,
+    int file : @file ref,
+    string action : string ref
+)
+
+svnentrymsg(
+    unique int id : @svnentry ref,
+    string message : string ref
+)
+
+svnchurn(
+    int commit : @svnentry ref,
+    int file : @file ref,
+    int addedLines : int ref,
+    int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+    /** The location of an element that is not an expression or a statement. */
+    unique int id: @location_default,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_stmt(
+    /** The location of a statement. */
+    unique int id: @location_stmt,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_expr(
+    /** The location of an expression. */
+    unique int id: @location_expr,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+    int element_id: @sourceline ref,
+    int num_lines: int ref,
+    int num_code: int ref,
+    int num_comment: int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+files(
+    unique int id: @file,
+    string name: string ref
+);
+
+folders(
+    unique int id: @folder,
+    string name: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+    int parent: @container ref,
+    unique int child: @container ref
+);
+
+fileannotations(
+    int id: @file ref,
+    int kind: int ref,
+    string name: string ref,
+    string value: string ref
+);
+
+inmacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+/*
+  case @macroinvocations.kind of
+    1 = macro expansion
+  | 2 = other macro reference
+  ;
+*/
+macroinvocations(
+    unique int id: @macroinvocation,
+    int macro_id: @ppd_define ref,
+    int location: @location_default ref,
+    int kind: int ref
+);
+
+macroparent(
+    unique int id: @macroinvocation ref,
+    int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+    int id: @macroinvocation ref,
+    int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+/*
+  case @function.kind of
+    1 = normal
+  | 2 = constructor
+  | 3 = destructor
+  | 4 = conversion
+  | 5 = operator
+  | 6 = builtin     // GCC built-in functions, e.g. __builtin___memcpy_chk
+  ;
+*/
+functions(
+    unique int id: @function,
+    string name: string ref,
+    int kind: int ref
+);
+
+function_entry_point(int id: @function ref, unique int entry_point: @stmt ref);
+
+function_return_type(int id: @function ref, int return_type: @type ref);
+
+/** If `function` is a coroutine, then this gives the
+    std::experimental::resumable_traits instance associated with it,
+    and the variables representing the `handle` and `promise` for it. */
+coroutine(
+  unique int function: @function ref,
+  int traits: @type ref,
+  int handle: @variable ref,
+  int promise: @variable ref
+);
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+  unique int function: @function ref,
+  int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+  unique int function: @function ref,
+  int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+member_function_this_type(unique int id: @function ref, int this_type: @type ref);
+
+#keyset[id, type_id]
+fun_decls(
+    int id: @fun_decl,
+    int function: @function ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+    int id: @fun_decl ref,
+    string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+    int fun_decl: @fun_decl ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+    int fun_decl: @fun_decl ref,
+    int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+    unique int fun_decl: @fun_decl ref,
+    int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+    unique int id: @var_decl ref,
+    int index: int ref,
+    int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+    int id: @var_decl,
+    int variable: @variable ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+    int id: @var_decl ref,
+    string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+
+type_decls(
+    unique int id: @type_decl,
+    int type_id: @type ref,
+    int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+    unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+    unique int id: @namespace_decl,
+    int namespace_id: @namespace ref,
+    int location: @location_default ref,
+    int bodylocation: @location_default ref
+);
+
+usings(
+    unique int id: @using,
+    int element_id: @element ref,
+    int location: @location_default ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+    int parent: @element ref,
+    int child: @using ref
+);
+
+static_asserts(
+    unique int id: @static_assert,
+    int condition : @expr ref,
+    string message : string ref,
+    int location: @location_default ref,
+    int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+    int id: @parameter,
+    int function: @functionorblock ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+overrides(int new: @function ref, int old: @function ref);
+
+#keyset[id, type_id]
+membervariables(
+    int id: @membervariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+    int id: @globalvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+    int id: @localvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+autoderivation(
+    unique int var: @variable ref,
+    int derivation_type: @type ref
+);
+
+orphaned_variables(
+    int var: @localvariable ref,
+    int function: @function ref
+)
+
+enumconstants(
+    unique int id: @enumconstant,
+    int parent: @usertype ref,
+    int index: int ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/*
+  Built-in types are the fundamental types, e.g., integral, floating, and void.
+
+  case @builtintype.kind of
+    1 = error
+  | 2 = unknown
+  | 3 = void
+  | 4 = boolean
+  | 5 = char
+  | 6 = unsigned_char
+  | 7 = signed_char
+  | 8 = short
+  | 9 = unsigned_short
+  | 10 = signed_short
+  | 11 = int
+  | 12 = unsigned_int
+  | 13 = signed_int
+  | 14 = long
+  | 15 = unsigned_long
+  | 16 = signed_long
+  | 17 = long_long
+  | 18 = unsigned_long_long
+  | 19 = signed_long_long
+  | 20 = __int8                 // Microsoft-specific
+  | 21 = __int16                // Microsoft-specific
+  | 22 = __int32                // Microsoft-specific
+  | 23 = __int64                // Microsoft-specific
+  | 24 = float
+  | 25 = double
+  | 26 = long_double
+  | 27 = _Complex_float         // C99-specific
+  | 28 = _Complex_double        // C99-specific
+  | 29 = _Complex_long double   // C99-specific
+  | 30 = _Imaginary_float       // C99-specific
+  | 31 = _Imaginary_double      // C99-specific
+  | 32 = _Imaginary_long_double // C99-specific
+  | 33 = wchar_t                // Microsoft-specific
+  | 34 = decltype_nullptr       // C++11
+  | 35 = __int128
+  | 36 = unsigned___int128
+  | 37 = signed___int128
+  | 38 = __float128
+  | 39 = _Complex___float128
+  | 40 = _Decimal32
+  | 41 = _Decimal64
+  | 42 = _Decimal128
+  | 43 = char16_t
+  | 44 = char32_t
+  | 45 = _Float32
+  | 46 = _Float32x
+  | 47 = _Float64
+  | 48 = _Float64x
+  | 49 = _Float128
+  | 50 = _Float128x
+  | 51 = char8_t
+  ;
+*/
+builtintypes(
+    unique int id: @builtintype,
+    string name: string ref,
+    int kind: int ref,
+    int size: int ref,
+    int sign: int ref,
+    int alignment: int ref
+);
+
+/*
+  Derived types are types that are directly derived from existing types and
+  point to, refer to, transform type data to return a new type.
+
+  case @derivedtype.kind of
+    1 = pointer
+  | 2 = reference
+  | 3 = type_with_specifiers
+  | 4 = array
+  | 5 = gnu_vector
+  | 6 = routineptr
+  | 7 = routinereference
+  | 8 = rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+  | 10 = block
+  ;
+*/
+derivedtypes(
+    unique int id: @derivedtype,
+    string name: string ref,
+    int kind: int ref,
+    int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+    int size: int ref,
+    int alignment: int ref);
+
+arraysizes(
+    unique int id: @derivedtype ref,
+    int num_elements: int ref,
+    int bytesize: int ref,
+    int alignment: int ref
+);
+
+typedefbase(
+    unique int id: @usertype ref,
+    int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator.  For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * would change the semantics of this decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+#keyset[id, expr]
+decltypes(
+    int id: @decltype,
+    int expr: @expr ref,
+    int base_type: @type ref,
+    boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+  case @usertype.kind of
+    1 = struct
+  | 2 = class
+  | 3 = union
+  | 4 = enum
+  | 5 = typedef                       // classic C: typedef typedef type name
+  | 6 = template
+  | 7 = template_parameter
+  | 8 = template_template_parameter
+  | 9 = proxy_class                   // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+  | 13 = scoped_enum
+  | 14 = using_alias                  // a using name = type style typedef
+  ;
+*/
+usertypes(
+    unique int id: @usertype,
+    string name: string ref,
+    int kind: int ref
+);
+
+usertypesize(
+    unique int id: @usertype ref,
+    int size: int ref,
+    int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+    unique int id: @usertype ref,
+    string uuid: string ref
+);
+
+mangled_name(
+    unique int id: @declaration ref,
+    int mangled_name : @mangledname
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+    int to: @usertype ref,
+    int from: @usertype ref
+);
+class_template_argument(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+class_template_argument_value(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+is_proxy_class_for(
+    unique int id: @usertype ref,
+    unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+    unique int id: @type_mention,
+    int type_id: @type ref,
+    int location: @location ref,
+    // a_symbol_reference_kind from the frontend.
+    int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+    unique int to: @function ref,
+    int from: @function ref
+);
+function_template_argument(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+function_template_argument_value(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+    unique int to: @variable ref,
+    int from: @variable ref
+);
+variable_template_argument(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+variable_template_argument_value(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+/*
+  Fixed point types
+  precision(1) = short, precision(2) = default, precision(3) = long
+  is_unsigned(1) = unsigned is_unsigned(2) = signed
+  is_fract_type(1) = declared with _Fract
+  saturating(1) = declared with _Sat
+*/
+/* TODO
+fixedpointtypes(
+    unique int id: @fixedpointtype,
+    int precision: int ref,
+    int is_unsigned: int ref,
+    int is_fract_type: int ref,
+    int saturating: int ref);
+*/
+
+routinetypes(
+    unique int id: @routinetype,
+    int return_type: @type ref
+);
+
+routinetypeargs(
+    int routine: @routinetype ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+ptrtomembers(
+    unique int id: @ptrtomember,
+    int type_id: @type ref,
+    int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+    "public",
+    "protected",
+    "private",
+
+    "const",
+    "volatile",
+    "static",
+
+    "pure",
+    "virtual",
+    "sealed", // Microsoft
+    "__interface", // Microsoft
+    "inline",
+    "explicit",
+
+    "near", // near far extension
+    "far", // near far extension
+    "__ptr32", // Microsoft
+    "__ptr64", // Microsoft
+    "__sptr", // Microsoft
+    "__uptr", // Microsoft
+    "dllimport", // Microsoft
+    "dllexport", // Microsoft
+    "thread", // Microsoft
+    "naked", // Microsoft
+    "microsoft_inline", // Microsoft
+    "forceinline", // Microsoft
+    "selectany", // Microsoft
+    "nothrow", // Microsoft
+    "novtable", // Microsoft
+    "noreturn", // Microsoft
+    "noinline", // Microsoft
+    "noalias", // Microsoft
+    "restrict", // Microsoft
+*/
+
+specifiers(
+    unique int id: @specifier,
+    unique string str: string ref
+);
+
+typespecifiers(
+    int type_id: @type ref,
+    int spec_id: @specifier ref
+);
+
+funspecifiers(
+    int func_id: @function ref,
+    int spec_id: @specifier ref
+);
+
+varspecifiers(
+    int var_id: @accessible ref,
+    int spec_id: @specifier ref
+);
+
+attributes(
+    unique int id: @attribute,
+    int kind: int ref,
+    string name: string ref,
+    string name_space: string ref,
+    int location: @location_default ref
+);
+
+case @attribute.kind of
+  0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+    unique int id: @attribute_arg,
+    int kind: int ref,
+    int attribute: @attribute ref,
+    int index: int ref,
+    int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+  0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+;
+
+attribute_arg_value(
+    unique int arg: @attribute_arg ref,
+    string value: string ref
+);
+attribute_arg_type(
+    unique int arg: @attribute_arg ref,
+    int type_id: @type ref
+);
+attribute_arg_constant(
+    unique int arg: @attribute_arg ref,
+    int constant: @expr ref
+)
+attribute_arg_name(
+    unique int arg: @attribute_arg ref,
+    string name: string ref
+);
+
+typeattributes(
+    int type_id: @type ref,
+    int spec_id: @attribute ref
+);
+
+funcattributes(
+    int func_id: @function ref,
+    int spec_id: @attribute ref
+);
+
+varattributes(
+    int var_id: @accessible ref,
+    int spec_id: @attribute ref
+);
+
+stmtattributes(
+    int stmt_id: @stmt ref,
+    int spec_id: @attribute ref
+);
+
+@type = @builtintype
+      | @derivedtype
+      | @usertype
+      /* TODO | @fixedpointtype */
+      | @routinetype
+      | @ptrtomember
+      | @decltype;
+
+unspecifiedtype(
+    unique int type_id: @type ref,
+    int unspecified_type_id: @type ref
+);
+
+member(
+    int parent: @type ref,
+    int index: int ref,
+    int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+    unique int child: @enclosingfunction_child ref,
+    int parent: @function ref
+);
+
+derivations(
+    unique int derivation: @derivation,
+    int sub: @type ref,
+    int index: int ref,
+    int super: @type ref,
+    int location: @location_default ref
+);
+
+derspecifiers(
+    int der_id: @derivation ref,
+    int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+    unique int der_id: @derivation ref,
+    int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+    int sub: @usertype ref,
+    int super: @usertype ref,
+    int offset: int ref
+);
+
+frienddecls(
+    unique int id: @frienddecl,
+    int type_id: @type ref,
+    int decl_id: @declaration ref,
+    int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+             | @declaredtype
+             | @variable
+             | @enumconstant
+             | @frienddecl;
+
+@member = @membervariable
+        | @function
+        | @declaredtype
+        | @enumconstant;
+
+@locatable = @diagnostic
+           | @declaration
+           | @ppd_include
+           | @ppd_define
+           | @macroinvocation
+           /*| @funcall*/
+           | @xmllocatable
+           | @attribute
+           | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+         | @file
+         | @folder
+         | @specifier
+         | @type
+         | @expr
+         | @namespace
+         | @initialiser
+         | @stmt
+         | @derivation
+         | @comment
+         | @preprocdirect
+         | @fun_decl
+         | @var_decl
+         | @type_decl
+         | @namespace_decl
+         | @using
+         | @namequalifier
+         | @specialnamequalifyingelement
+         | @static_assert
+         | @type_mention
+         | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+    unique int id: @comment,
+    string contents: string ref,
+    int location: @location_default ref
+);
+
+commentbinding(
+    int id: @comment ref,
+    int element: @element ref
+);
+
+exprconv(
+    int converted: @expr ref,
+    unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+    int element: @element ref,
+    int i: int ref,
+    int destructor_call: @routineexpr ref
+);
+
+namespaces(
+    unique int id: @namespace,
+    string name: string ref
+);
+
+namespace_inline(
+    unique int id: @namespace ref
+);
+
+namespacembrs(
+    int parentid: @namespace ref,
+    unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+    int expr_id: @expr ref,
+    int child_index: int ref,
+    int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+      | @const_cast
+      | @dynamic_cast
+      | @reinterpret_cast
+      | @static_cast
+      ;
+
+/*
+case @conversion.kind of
+  0 = @simple_conversion           // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion             // conversion to 'bool'
+| 2 = @base_class_conversion       // a derived-to-base conversion
+| 3 = @derived_class_conversion    // a base-to-derived conversion
+| 4 = @pm_base_class_conversion    // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust              // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust              // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+    unique int expr_id: @cast ref,
+    int kind: int ref
+);
+
+@conversion = @cast
+            | @array_to_pointer
+            | @parexpr
+            | @reference_to
+            | @ref_indirect
+            | @temp_init
+            ;
+
+/*
+case @funbindexpr.kind of
+  0 = @normal_call  // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call     // a call whose target is only found by ADL
+;
+*/
+iscall(unique int caller: @funbindexpr ref, int kind: int ref);
+
+numtemplatearguments(
+    unique int expr_id: @expr ref,
+    int num: int ref
+);
+
+specialnamequalifyingelements(
+    unique int id: @specialnamequalifyingelement,
+    unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+                       | @specialnamequalifyingelement
+                       | @usertype;
+
+namequalifiers(
+    unique int id: @namequalifier,
+    unique int qualifiableelement: @namequalifiableelement ref,
+    int qualifyingelement: @namequalifyingelement ref,
+    int location: @location_default ref
+);
+
+varbind(
+    int expr: @varbindexpr ref,
+    int var: @accessible ref
+);
+
+funbind(
+    int expr: @funbindexpr ref,
+    int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+              | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+                    | @delete_expr
+                    | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+                  | @unaryplusexpr
+                  | @conjugation
+                  | @realpartexpr
+                  | @imagpartexpr
+                  | @crement_expr
+                  ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+            | @indirect
+            | @un_arith_op_expr
+            | @un_bitwise_op_expr
+            | @builtinaddressof
+            | @vec_fill
+            | @un_log_op_expr
+            | @co_await
+            | @co_yield
+            ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+             | @ltexpr
+             | @geexpr
+             | @leexpr
+             | @spaceshipexpr
+             ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+                     | @rshiftexpr
+                     | @andexpr
+                     | @orexpr
+                     | @xorexpr
+                     ;
+
+@p_arith_op_expr = @paddexpr
+                 | @psubexpr
+                 | @pdiffexpr
+                 ;
+
+@bin_arith_op_expr = @addexpr
+                   | @subexpr
+                   | @mulexpr
+                   | @divexpr
+                   | @remexpr
+                   | @jmulexpr
+                   | @jdivexpr
+                   | @fjaddexpr
+                   | @jfaddexpr
+                   | @fjsubexpr
+                   | @jfsubexpr
+                   | @minexpr
+                   | @maxexpr
+                   | @p_arith_op_expr
+                   ;
+
+@bin_op_expr = @bin_arith_op_expr
+             | @bin_bitwise_op_expr
+             | @cmp_op_expr
+             | @bin_log_op_expr
+             ;
+
+@op_expr = @un_op_expr
+         | @bin_op_expr
+         | @assign_expr
+         | @conditionalexpr
+         ;
+
+@assign_arith_expr = @assignaddexpr
+                   | @assignsubexpr
+                   | @assignmulexpr
+                   | @assigndivexpr
+                   | @assignremexpr
+                   ;
+
+@assign_bitwise_expr = @assignandexpr
+                     | @assignorexpr
+                     | @assignxorexpr
+                     | @assignlshiftexpr
+                     | @assignrshiftexpr
+                     | @assignpaddexpr
+                     | @assignpsubexpr
+                     ;
+
+@assign_op_expr = @assign_arith_expr | @assign_bitwise_expr
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+  case @allocator.form of
+    0 = plain
+  | 1 = alignment
+  ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+    unique int expr: @any_new_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/*
+  case @deallocator.form of
+    0 = plain
+  | 1 = size
+  | 2 = alignment
+  | 3 = size_and_alignment
+  ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+    unique int expr: @new_or_delete_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+    unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+    unique int cond: @conditionalexpr ref,
+    int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+    unique int cond: @conditionalexpr ref,
+    int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+    unique int cond: @conditionalexpr ref,
+    int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+    unique int id: @value,
+    string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+    unique int id: @value ref,
+    string text: string ref
+);
+
+valuebind(
+    int val: @value ref,
+    unique int expr: @expr ref
+);
+
+fieldoffsets(
+    unique int id: @variable ref,
+    int byteoffset: int ref,
+    int bitoffset: int ref
+);
+
+bitfield(
+    unique int id: @variable ref,
+    int bits: int ref,
+    int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+    int member: @expr ref,
+    int prefix: @expr ref
+);
+*/
+
+/*
+   kind(1) = mbrcallexpr
+   kind(2) = mbrptrcallexpr
+   kind(3) = mbrptrmbrcallexpr
+   kind(4) = ptrmbrptrmbrcallexpr
+   kind(5) = mbrreadexpr // x.y
+   kind(6) = mbrptrreadexpr // p->y
+   kind(7) = mbrptrmbrreadexpr // x.*pm
+   kind(8) = mbrptrmbrptrreadexpr // x->*pm
+   kind(9) = staticmbrreadexpr // static x.y
+   kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+    int member: @expr ref,
+    int kind: int ref
+);
+*/
+
+initialisers(
+    unique int init: @initialiser,
+    int var: @accessible ref,
+    unique int expr: @expr ref,
+    int location: @location_expr ref
+);
+
+braced_initialisers(
+    int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+    int exp: @expr ref,
+    int ancestor: @element ref
+);
+
+exprs(
+    unique int id: @expr,
+    int kind: int ref,
+    int location: @location_expr ref
+);
+
+/*
+  case @value.category of
+    1 = prval
+  | 2 = xval
+  | 3 = lval
+  ;
+*/
+expr_types(
+    int id: @expr ref,
+    int typeid: @type ref,
+    int value_category: int ref
+);
+
+case @expr.kind of
+    1 = @errorexpr
+|   2 = @address_of // & AddressOfExpr
+|   3 = @reference_to // ReferenceToExpr (implicit?)
+|   4 = @indirect // * PointerDereferenceExpr
+|   5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+|   8 = @array_to_pointer // (???)
+|   9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+|  11 = @assume // Microsoft
+|  12 = @parexpr
+|  13 = @arithnegexpr
+|  14 = @unaryplusexpr
+|  15 = @complementexpr
+|  16 = @notexpr
+|  17 = @conjugation // GNU ~ operator
+|  18 = @realpartexpr // GNU __real
+|  19 = @imagpartexpr // GNU __imag
+|  20 = @postincrexpr
+|  21 = @postdecrexpr
+|  22 = @preincrexpr
+|  23 = @predecrexpr
+|  24 = @conditionalexpr
+|  25 = @addexpr
+|  26 = @subexpr
+|  27 = @mulexpr
+|  28 = @divexpr
+|  29 = @remexpr
+|  30 = @jmulexpr // C99 mul imaginary
+|  31 = @jdivexpr // C99 div imaginary
+|  32 = @fjaddexpr // C99 add real + imaginary
+|  33 = @jfaddexpr // C99 add imaginary + real
+|  34 = @fjsubexpr // C99 sub real - imaginary
+|  35 = @jfsubexpr // C99 sub imaginary - real
+|  36 = @paddexpr // pointer add (pointer + int or int + pointer)
+|  37 = @psubexpr // pointer sub (pointer - integer)
+|  38 = @pdiffexpr // difference between two pointers
+|  39 = @lshiftexpr
+|  40 = @rshiftexpr
+|  41 = @andexpr
+|  42 = @orexpr
+|  43 = @xorexpr
+|  44 = @eqexpr
+|  45 = @neexpr
+|  46 = @gtexpr
+|  47 = @ltexpr
+|  48 = @geexpr
+|  49 = @leexpr
+|  50 = @minexpr // GNU minimum
+|  51 = @maxexpr // GNU maximum
+|  52 = @assignexpr
+|  53 = @assignaddexpr
+|  54 = @assignsubexpr
+|  55 = @assignmulexpr
+|  56 = @assigndivexpr
+|  57 = @assignremexpr
+|  58 = @assignlshiftexpr
+|  59 = @assignrshiftexpr
+|  60 = @assignandexpr
+|  61 = @assignorexpr
+|  62 = @assignxorexpr
+|  63 = @assignpaddexpr // assign pointer add
+|  64 = @assignpsubexpr // assign pointer sub
+|  65 = @andlogicalexpr
+|  66 = @orlogicalexpr
+|  67 = @commaexpr
+|  68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ...  69 @objc_subscriptexpr deprecated
+// ...  70 @cmdaccess deprecated
+// ...
+|  73 = @virtfunptrexpr
+|  74 = @callexpr
+// ...  75 @msgexpr_normal deprecated
+// ...  76 @msgexpr_super deprecated
+// ...  77 @atselectorexpr deprecated
+// ...  78 @atprotocolexpr deprecated
+|  79 = @vastartexpr
+|  80 = @vaargexpr
+|  81 = @vaendexpr
+|  82 = @vacopyexpr
+// ...  83 @atencodeexpr deprecated
+|  84 = @varaccess
+|  85 = @thisaccess
+// ...  86 @objc_box_expr deprecated
+|  87 = @new_expr
+|  88 = @delete_expr
+|  89 = @throw_expr
+|  90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+|  91 = @braced_init_list
+|  92 = @type_id
+|  93 = @runtime_sizeof
+|  94 = @runtime_alignof
+|  95 = @sizeof_pack
+|  96 = @expr_stmt // GNU extension
+|  97 = @routineexpr
+|  98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+|  99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
+;
+
+@var_args_expr = @vastartexpr
+               | @vaendexpr
+               | @vaargexpr
+               | @vacopyexpr
+               ;
+
+@builtin_op = @var_args_expr
+            | @noopexpr
+            | @offsetofexpr
+            | @intaddrexpr
+            | @hasassignexpr
+            | @hascopyexpr
+            | @hasnothrowassign
+            | @hasnothrowconstr
+            | @hasnothrowcopy
+            | @hastrivialassign
+            | @hastrivialconstr
+            | @hastrivialcopy
+            | @hastrivialdestructor
+            | @hasuserdestr
+            | @hasvirtualdestr
+            | @isabstractexpr
+            | @isbaseofexpr
+            | @isclassexpr
+            | @isconvtoexpr
+            | @isemptyexpr
+            | @isenumexpr
+            | @ispodexpr
+            | @ispolyexpr
+            | @isunionexpr
+            | @typescompexpr
+            | @builtinshufflevector
+            | @builtinconvertvector
+            | @builtinaddressof
+            | @istriviallyconstructibleexpr
+            | @isdestructibleexpr
+            | @isnothrowdestructibleexpr
+            | @istriviallydestructibleexpr
+            | @istriviallyassignableexpr
+            | @isnothrowassignableexpr
+            | @isstandardlayoutexpr
+            | @istriviallycopyableexpr
+            | @isliteraltypeexpr
+            | @hastrivialmoveconstructorexpr
+            | @hastrivialmoveassignexpr
+            | @hasnothrowmoveassignexpr
+            | @isconstructibleexpr
+            | @isnothrowconstructibleexpr
+            | @hasfinalizerexpr
+            | @isdelegateexpr
+            | @isinterfaceclassexpr
+            | @isrefarrayexpr
+            | @isrefclassexpr
+            | @issealedexpr
+            | @issimplevalueclassexpr
+            | @isvalueclassexpr
+            | @isfinalexpr
+            | @builtinchooseexpr
+            | @builtincomplex
+            | @isassignable
+            | @isaggregate
+            | @hasuniqueobjectrepresentations
+            | @builtinbitcast
+            | @builtinshuffle
+            | @issame
+            | @isfunction
+            | @islayoutcompatible
+            | @ispointerinterconvertiblebaseof
+            | @isarray
+            | @arrayrank
+            | @arrayextent
+            | @isarithmetic
+            | @iscompletetype
+            | @iscompound
+            | @isconst
+            | @isfloatingpoint
+            | @isfundamental
+            | @isintegral
+            | @islvaluereference
+            | @ismemberfunctionpointer
+            | @ismemberobjectpointer
+            | @ismemberpointer
+            | @isobject
+            | @ispointer
+            | @isreference
+            | @isrvaluereference
+            | @isscalar
+            | @issigned
+            | @isunsigned
+            | @isvoid
+            | @isvolatile
+            ;
+
+new_allocated_type(
+    unique int expr: @new_expr ref,
+    int type_id: @type ref
+);
+
+new_array_allocated_type(
+    unique int expr: @new_array_expr ref,
+    int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union.
+ */
+#keyset[aggregate, field]
+aggregate_field_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int field: @membervariable ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array.
+ */
+#keyset[aggregate, element_index]
+aggregate_array_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int element_index: int ref
+);
+
+@ctorinit = @ctordirectinit
+          | @ctorvirtualinit
+          | @ctorfieldinit
+          | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+              | @dtorvirtualdestruct
+              | @dtorfielddestruct;
+
+
+condition_decl_bind(
+    unique int expr: @condition_decl ref,
+    unique int decl: @declaration ref
+);
+
+typeid_bind(
+    unique int expr: @type_id ref,
+    int type_id: @type ref
+);
+
+uuidof_bind(
+    unique int expr: @uuidof ref,
+    int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof;
+
+sizeof_bind(
+    unique int expr: @runtime_sizeof_or_alignof ref,
+    int type_id: @type ref
+);
+
+code_block(
+    unique int block: @literal ref,
+    unique int routine: @function ref
+);
+
+lambdas(
+    unique int expr: @lambdaexpr ref,
+    string default_capture: string ref,
+    boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+    unique int id: @lambdacapture,
+    int lambda: @lambdaexpr ref,
+    int index: int ref,
+    int field: @membervariable ref,
+    boolean captured_by_reference: boolean ref,
+    boolean is_implicit: boolean ref,
+    int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+             | @new_expr
+             | @delete_expr
+             | @delete_array_expr
+             | @ctordirectinit
+             | @ctorvirtualinit
+             | @ctordelegatinginit
+             | @dtordirectdestruct
+             | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+    int expr: @foldexpr ref,
+    string operator: string ref,
+    boolean is_left_fold: boolean ref
+);
+
+stmts(
+    unique int id: @stmt,
+    int kind: int ref,
+    int location: @location_stmt ref
+);
+
+case @stmt.kind of
+    1 = @stmt_expr
+|   2 = @stmt_if
+|   3 = @stmt_while
+|   4 = @stmt_goto
+|   5 = @stmt_label
+|   6 = @stmt_return
+|   7 = @stmt_block
+|   8 = @stmt_end_test_while // do { ... } while ( ... )
+|   9 = @stmt_for
+|  10 = @stmt_switch_case
+|  11 = @stmt_switch
+|  13 = @stmt_asm // "asm" statement or the body of an asm function
+|  15 = @stmt_try_block
+|  16 = @stmt_microsoft_try // Microsoft
+|  17 = @stmt_decl
+|  18 = @stmt_set_vla_size // C99
+|  19 = @stmt_vla_decl // C99
+|  25 = @stmt_assigned_goto // GNU
+|  26 = @stmt_empty
+|  27 = @stmt_continue
+|  28 = @stmt_break
+|  29 = @stmt_range_based_for // C++11
+// ...  30 @stmt_at_autoreleasepool_block deprecated
+// ...  31 @stmt_objc_for_in deprecated
+// ...  32 @stmt_at_synchronized deprecated
+|  33 = @stmt_handler
+// ...  34 @stmt_finally_end deprecated
+|  35 = @stmt_constexpr_if
+|  37 = @stmt_co_return
+;
+
+type_vla(
+    int type_id: @type ref,
+    int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+    int var: @variable ref,
+    int decl: @stmt_vla_decl ref
+);
+
+if_initialization(
+    unique int if_stmt: @stmt_if ref,
+    int init_id: @stmt ref
+);
+
+if_then(
+    unique int if_stmt: @stmt_if ref,
+    int then_id: @stmt ref
+);
+
+if_else(
+    unique int if_stmt: @stmt_if ref,
+    int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int init_id: @stmt ref
+);
+
+constexpr_if_then(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int then_id: @stmt ref
+);
+
+constexpr_if_else(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int else_id: @stmt ref
+);
+
+while_body(
+    unique int while_stmt: @stmt_while ref,
+    int body_id: @stmt ref
+);
+
+do_body(
+    unique int do_stmt: @stmt_end_test_while ref,
+    int body_id: @stmt ref
+);
+
+switch_initialization(
+    unique int switch_stmt: @stmt_switch ref,
+    int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+    int switch_stmt: @stmt_switch ref,
+    int index: int ref,
+    int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+    unique int switch_stmt: @stmt_switch ref,
+    int body_id: @stmt ref
+);
+
+for_initialization(
+    unique int for_stmt: @stmt_for ref,
+    int init_id: @stmt ref
+);
+
+for_condition(
+    unique int for_stmt: @stmt_for ref,
+    int condition_id: @expr ref
+);
+
+for_update(
+    unique int for_stmt: @stmt_for ref,
+    int update_id: @expr ref
+);
+
+for_body(
+    unique int for_stmt: @stmt_for ref,
+    int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+    unique int id: @stmt ref,
+    int index: int ref,
+    int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+    unique int block: @stmt_block ref,
+    int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+    unique int id: @jumporlabel ref,
+    string str: string ref,
+    int target: @stmt ref
+);
+
+preprocdirects(
+    unique int id: @preprocdirect,
+    int kind: int ref,
+    int location: @location_default ref
+);
+case @preprocdirect.kind of
+   0 = @ppd_if
+|  1 = @ppd_ifdef
+|  2 = @ppd_ifndef
+|  3 = @ppd_elif
+|  4 = @ppd_else
+|  5 = @ppd_endif
+|  6 = @ppd_plain_include
+|  7 = @ppd_define
+|  8 = @ppd_undef
+|  9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+    int begin : @ppd_branch ref,
+    int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+    unique int id: @preprocdirect ref,
+    string head: string ref,
+    string body: string ref
+);
+
+includes(
+    unique int id: @ppd_include ref,
+    int included: @file ref
+);
+
+link_targets(
+    unique int id: @link_target,
+    int binary: @file ref
+);
+
+link_parent(
+    int element : @element ref,
+    int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+    unique int id: @xmldtd,
+    string root: string ref,
+    string publicId: string ref,
+    string systemId: string ref,
+    int fileid: @file ref
+);
+
+xmlElements(
+    unique int id: @xmlelement,
+    string name: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlAttrs(
+    unique int id: @xmlattribute,
+    int elementid: @xmlelement ref,
+    string name: string ref,
+    string value: string ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlNs(
+    int id: @xmlnamespace,
+    string prefixName: string ref,
+    string URI: string ref,
+    int fileid: @file ref
+);
+
+xmlHasNs(
+    int elementId: @xmlnamespaceable ref,
+    int nsId: @xmlnamespace ref,
+    int fileid: @file ref
+);
+
+xmlComments(
+    unique int id: @xmlcomment,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int fileid: @file ref
+);
+
+xmlChars(
+    unique int id: @xmlcharacters,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int isCDATA: int ref,
+    int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+    int xmlElement: @xmllocatable ref,
+    int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+              | @xmlelement
+              | @xmlcomment
+              | @xmlattribute
+              | @xmldtd
+              | @file
+              | @xmlnamespace;
diff --git a/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/semmlecode.cpp.dbscheme b/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/semmlecode.cpp.dbscheme
new file mode 100644
index 00000000000..f96ad9b2da4
--- /dev/null
+++ b/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/semmlecode.cpp.dbscheme
@@ -0,0 +1,2136 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    /**
+     * An invocation of the compiler. Note that more than one file may
+     * be compiled per invocation. For example, this command compiles
+     * three source files:
+     *
+     *   gcc -c f1.c f2.c f3.c
+     */
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | *path to extractor*
+ * 1   | `--mimic`
+ * 2   | `/usr/bin/gcc`
+ * 3   | `-c`
+ * 4   | f1.c
+ * 5   | f2.c
+ * 6   | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.c
+ * 1   | f2.c
+ * 2   | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+    int id : @externalDataElement,
+    string path : string ref,
+    int column: int ref,
+    string value : string ref
+);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Information about packages that provide code used during compilation.
+ * The `id` is just a unique identifier.
+ * The `namespace` is typically the name of the package manager that
+ * provided the package (e.g. "dpkg" or "yum").
+ * The `package_name` is the name of the package, and `version` is its
+ * version (as a string).
+ */
+external_packages(
+    unique int id: @external_package,
+    string namespace : string ref,
+    string package_name : string ref,
+    string version : string ref
+);
+
+/**
+ * Holds if File `fileid` was provided by package `package`.
+ */
+header_to_external_package(
+    int fileid : @file ref,
+    int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+    unique int id : @svnentry,
+    string revision : string ref,
+    string author : string ref,
+    date revisionDate : date ref,
+    int changeSize : int ref
+)
+
+svnaffectedfiles(
+    int id : @svnentry ref,
+    int file : @file ref,
+    string action : string ref
+)
+
+svnentrymsg(
+    unique int id : @svnentry ref,
+    string message : string ref
+)
+
+svnchurn(
+    int commit : @svnentry ref,
+    int file : @file ref,
+    int addedLines : int ref,
+    int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+    /** The location of an element that is not an expression or a statement. */
+    unique int id: @location_default,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_stmt(
+    /** The location of a statement. */
+    unique int id: @location_stmt,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_expr(
+    /** The location of an expression. */
+    unique int id: @location_expr,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+    int element_id: @sourceline ref,
+    int num_lines: int ref,
+    int num_code: int ref,
+    int num_comment: int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+files(
+    unique int id: @file,
+    string name: string ref
+);
+
+folders(
+    unique int id: @folder,
+    string name: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+    int parent: @container ref,
+    unique int child: @container ref
+);
+
+fileannotations(
+    int id: @file ref,
+    int kind: int ref,
+    string name: string ref,
+    string value: string ref
+);
+
+inmacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+/*
+  case @macroinvocations.kind of
+    1 = macro expansion
+  | 2 = other macro reference
+  ;
+*/
+macroinvocations(
+    unique int id: @macroinvocation,
+    int macro_id: @ppd_define ref,
+    int location: @location_default ref,
+    int kind: int ref
+);
+
+macroparent(
+    unique int id: @macroinvocation ref,
+    int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+    int id: @macroinvocation ref,
+    int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+/*
+  case @function.kind of
+    1 = normal
+  | 2 = constructor
+  | 3 = destructor
+  | 4 = conversion
+  | 5 = operator
+  | 6 = builtin     // GCC built-in functions, e.g. __builtin___memcpy_chk
+  ;
+*/
+functions(
+    unique int id: @function,
+    string name: string ref,
+    int kind: int ref
+);
+
+function_entry_point(int id: @function ref, unique int entry_point: @stmt ref);
+
+function_return_type(int id: @function ref, int return_type: @type ref);
+
+/** If `function` is a coroutine, then this gives the
+    std::experimental::resumable_traits instance associated with it,
+    and the variables representing the `handle` and `promise` for it. */
+coroutine(
+  unique int function: @function ref,
+  int traits: @type ref,
+  int handle: @variable ref,
+  int promise: @variable ref
+);
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+  unique int function: @function ref,
+  int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+  unique int function: @function ref,
+  int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+member_function_this_type(unique int id: @function ref, int this_type: @type ref);
+
+#keyset[id, type_id]
+fun_decls(
+    int id: @fun_decl,
+    int function: @function ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+    int id: @fun_decl ref,
+    string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+    int fun_decl: @fun_decl ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+    int fun_decl: @fun_decl ref,
+    int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+    unique int fun_decl: @fun_decl ref,
+    int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+    unique int id: @var_decl ref,
+    int index: int ref,
+    int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+    int id: @var_decl,
+    int variable: @variable ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+    int id: @var_decl ref,
+    string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+
+type_decls(
+    unique int id: @type_decl,
+    int type_id: @type ref,
+    int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+    unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+    unique int id: @namespace_decl,
+    int namespace_id: @namespace ref,
+    int location: @location_default ref,
+    int bodylocation: @location_default ref
+);
+
+usings(
+    unique int id: @using,
+    int element_id: @element ref,
+    int location: @location_default ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+    int parent: @element ref,
+    int child: @using ref
+);
+
+static_asserts(
+    unique int id: @static_assert,
+    int condition : @expr ref,
+    string message : string ref,
+    int location: @location_default ref,
+    int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+    int id: @parameter,
+    int function: @functionorblock ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+overrides(int new: @function ref, int old: @function ref);
+
+#keyset[id, type_id]
+membervariables(
+    int id: @membervariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+    int id: @globalvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+    int id: @localvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+autoderivation(
+    unique int var: @variable ref,
+    int derivation_type: @type ref
+);
+
+orphaned_variables(
+    int var: @localvariable ref,
+    int function: @function ref
+)
+
+enumconstants(
+    unique int id: @enumconstant,
+    int parent: @usertype ref,
+    int index: int ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/*
+  Built-in types are the fundamental types, e.g., integral, floating, and void.
+
+  case @builtintype.kind of
+    1 = error
+  | 2 = unknown
+  | 3 = void
+  | 4 = boolean
+  | 5 = char
+  | 6 = unsigned_char
+  | 7 = signed_char
+  | 8 = short
+  | 9 = unsigned_short
+  | 10 = signed_short
+  | 11 = int
+  | 12 = unsigned_int
+  | 13 = signed_int
+  | 14 = long
+  | 15 = unsigned_long
+  | 16 = signed_long
+  | 17 = long_long
+  | 18 = unsigned_long_long
+  | 19 = signed_long_long
+  | 20 = __int8                 // Microsoft-specific
+  | 21 = __int16                // Microsoft-specific
+  | 22 = __int32                // Microsoft-specific
+  | 23 = __int64                // Microsoft-specific
+  | 24 = float
+  | 25 = double
+  | 26 = long_double
+  | 27 = _Complex_float         // C99-specific
+  | 28 = _Complex_double        // C99-specific
+  | 29 = _Complex_long double   // C99-specific
+  | 30 = _Imaginary_float       // C99-specific
+  | 31 = _Imaginary_double      // C99-specific
+  | 32 = _Imaginary_long_double // C99-specific
+  | 33 = wchar_t                // Microsoft-specific
+  | 34 = decltype_nullptr       // C++11
+  | 35 = __int128
+  | 36 = unsigned___int128
+  | 37 = signed___int128
+  | 38 = __float128
+  | 39 = _Complex___float128
+  | 40 = _Decimal32
+  | 41 = _Decimal64
+  | 42 = _Decimal128
+  | 43 = char16_t
+  | 44 = char32_t
+  | 45 = _Float32
+  | 46 = _Float32x
+  | 47 = _Float64
+  | 48 = _Float64x
+  | 49 = _Float128
+  | 50 = _Float128x
+  | 51 = char8_t
+  ;
+*/
+builtintypes(
+    unique int id: @builtintype,
+    string name: string ref,
+    int kind: int ref,
+    int size: int ref,
+    int sign: int ref,
+    int alignment: int ref
+);
+
+/*
+  Derived types are types that are directly derived from existing types and
+  point to, refer to, transform type data to return a new type.
+
+  case @derivedtype.kind of
+    1 = pointer
+  | 2 = reference
+  | 3 = type_with_specifiers
+  | 4 = array
+  | 5 = gnu_vector
+  | 6 = routineptr
+  | 7 = routinereference
+  | 8 = rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+  | 10 = block
+  ;
+*/
+derivedtypes(
+    unique int id: @derivedtype,
+    string name: string ref,
+    int kind: int ref,
+    int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+    int size: int ref,
+    int alignment: int ref);
+
+arraysizes(
+    unique int id: @derivedtype ref,
+    int num_elements: int ref,
+    int bytesize: int ref,
+    int alignment: int ref
+);
+
+typedefbase(
+    unique int id: @usertype ref,
+    int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator.  For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * would change the semantics of this decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+#keyset[id, expr]
+decltypes(
+    int id: @decltype,
+    int expr: @expr ref,
+    int base_type: @type ref,
+    boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+  case @usertype.kind of
+    1 = struct
+  | 2 = class
+  | 3 = union
+  | 4 = enum
+  | 5 = typedef                       // classic C: typedef typedef type name
+  | 6 = template
+  | 7 = template_parameter
+  | 8 = template_template_parameter
+  | 9 = proxy_class                   // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+  | 13 = scoped_enum
+  | 14 = using_alias                  // a using name = type style typedef
+  ;
+*/
+usertypes(
+    unique int id: @usertype,
+    string name: string ref,
+    int kind: int ref
+);
+
+usertypesize(
+    unique int id: @usertype ref,
+    int size: int ref,
+    int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+    unique int id: @usertype ref,
+    string uuid: string ref
+);
+
+mangled_name(
+    unique int id: @declaration ref,
+    int mangled_name : @mangledname
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+    int to: @usertype ref,
+    int from: @usertype ref
+);
+class_template_argument(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+class_template_argument_value(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+is_proxy_class_for(
+    unique int id: @usertype ref,
+    unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+    unique int id: @type_mention,
+    int type_id: @type ref,
+    int location: @location ref,
+    // a_symbol_reference_kind from the EDG frontend.  See symbol_ref.h there.
+    int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+    unique int to: @function ref,
+    int from: @function ref
+);
+function_template_argument(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+function_template_argument_value(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+    unique int to: @variable ref,
+    int from: @variable ref
+);
+variable_template_argument(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+variable_template_argument_value(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+/*
+  Fixed point types
+  precision(1) = short, precision(2) = default, precision(3) = long
+  is_unsigned(1) = unsigned is_unsigned(2) = signed
+  is_fract_type(1) = declared with _Fract
+  saturating(1) = declared with _Sat
+*/
+/* TODO
+fixedpointtypes(
+    unique int id: @fixedpointtype,
+    int precision: int ref,
+    int is_unsigned: int ref,
+    int is_fract_type: int ref,
+    int saturating: int ref);
+*/
+
+routinetypes(
+    unique int id: @routinetype,
+    int return_type: @type ref
+);
+
+routinetypeargs(
+    int routine: @routinetype ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+ptrtomembers(
+    unique int id: @ptrtomember,
+    int type_id: @type ref,
+    int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+    "public",
+    "protected",
+    "private",
+
+    "const",
+    "volatile",
+    "static",
+
+    "pure",
+    "virtual",
+    "sealed", // Microsoft
+    "__interface", // Microsoft
+    "inline",
+    "explicit",
+
+    "near", // near far extension
+    "far", // near far extension
+    "__ptr32", // Microsoft
+    "__ptr64", // Microsoft
+    "__sptr", // Microsoft
+    "__uptr", // Microsoft
+    "dllimport", // Microsoft
+    "dllexport", // Microsoft
+    "thread", // Microsoft
+    "naked", // Microsoft
+    "microsoft_inline", // Microsoft
+    "forceinline", // Microsoft
+    "selectany", // Microsoft
+    "nothrow", // Microsoft
+    "novtable", // Microsoft
+    "noreturn", // Microsoft
+    "noinline", // Microsoft
+    "noalias", // Microsoft
+    "restrict", // Microsoft
+*/
+
+specifiers(
+    unique int id: @specifier,
+    unique string str: string ref
+);
+
+typespecifiers(
+    int type_id: @type ref,
+    int spec_id: @specifier ref
+);
+
+funspecifiers(
+    int func_id: @function ref,
+    int spec_id: @specifier ref
+);
+
+varspecifiers(
+    int var_id: @accessible ref,
+    int spec_id: @specifier ref
+);
+
+attributes(
+    unique int id: @attribute,
+    int kind: int ref,
+    string name: string ref,
+    string name_space: string ref,
+    int location: @location_default ref
+);
+
+case @attribute.kind of
+  0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+    unique int id: @attribute_arg,
+    int kind: int ref,
+    int attribute: @attribute ref,
+    int index: int ref,
+    int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+  0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+;
+
+attribute_arg_value(
+    unique int arg: @attribute_arg ref,
+    string value: string ref
+);
+attribute_arg_type(
+    unique int arg: @attribute_arg ref,
+    int type_id: @type ref
+);
+attribute_arg_constant(
+    unique int arg: @attribute_arg ref,
+    int constant: @expr ref
+)
+attribute_arg_name(
+    unique int arg: @attribute_arg ref,
+    string name: string ref
+);
+
+typeattributes(
+    int type_id: @type ref,
+    int spec_id: @attribute ref
+);
+
+funcattributes(
+    int func_id: @function ref,
+    int spec_id: @attribute ref
+);
+
+varattributes(
+    int var_id: @accessible ref,
+    int spec_id: @attribute ref
+);
+
+stmtattributes(
+    int stmt_id: @stmt ref,
+    int spec_id: @attribute ref
+);
+
+@type = @builtintype
+      | @derivedtype
+      | @usertype
+      /* TODO | @fixedpointtype */
+      | @routinetype
+      | @ptrtomember
+      | @decltype;
+
+unspecifiedtype(
+    unique int type_id: @type ref,
+    int unspecified_type_id: @type ref
+);
+
+member(
+    int parent: @type ref,
+    int index: int ref,
+    int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+    unique int child: @enclosingfunction_child ref,
+    int parent: @function ref
+);
+
+derivations(
+    unique int derivation: @derivation,
+    int sub: @type ref,
+    int index: int ref,
+    int super: @type ref,
+    int location: @location_default ref
+);
+
+derspecifiers(
+    int der_id: @derivation ref,
+    int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+    unique int der_id: @derivation ref,
+    int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+    int sub: @usertype ref,
+    int super: @usertype ref,
+    int offset: int ref
+);
+
+frienddecls(
+    unique int id: @frienddecl,
+    int type_id: @type ref,
+    int decl_id: @declaration ref,
+    int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+             | @declaredtype
+             | @variable
+             | @enumconstant
+             | @frienddecl;
+
+@member = @membervariable
+        | @function
+        | @declaredtype
+        | @enumconstant;
+
+@locatable = @diagnostic
+           | @declaration
+           | @ppd_include
+           | @ppd_define
+           | @macroinvocation
+           /*| @funcall*/
+           | @xmllocatable
+           | @attribute
+           | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+         | @file
+         | @folder
+         | @specifier
+         | @type
+         | @expr
+         | @namespace
+         | @initialiser
+         | @stmt
+         | @derivation
+         | @comment
+         | @preprocdirect
+         | @fun_decl
+         | @var_decl
+         | @type_decl
+         | @namespace_decl
+         | @using
+         | @namequalifier
+         | @specialnamequalifyingelement
+         | @static_assert
+         | @type_mention
+         | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+    unique int id: @comment,
+    string contents: string ref,
+    int location: @location_default ref
+);
+
+commentbinding(
+    int id: @comment ref,
+    int element: @element ref
+);
+
+exprconv(
+    int converted: @expr ref,
+    unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+    int element: @element ref,
+    int i: int ref,
+    int destructor_call: @routineexpr ref
+);
+
+namespaces(
+    unique int id: @namespace,
+    string name: string ref
+);
+
+namespace_inline(
+    unique int id: @namespace ref
+);
+
+namespacembrs(
+    int parentid: @namespace ref,
+    unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+    int expr_id: @expr ref,
+    int child_index: int ref,
+    int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+      | @const_cast
+      | @dynamic_cast
+      | @reinterpret_cast
+      | @static_cast
+      ;
+
+/*
+case @conversion.kind of
+  0 = @simple_conversion           // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion             // conversion to 'bool'
+| 2 = @base_class_conversion       // a derived-to-base conversion
+| 3 = @derived_class_conversion    // a base-to-derived conversion
+| 4 = @pm_base_class_conversion    // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust              // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust              // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+    unique int expr_id: @cast ref,
+    int kind: int ref
+);
+
+@conversion = @cast
+            | @array_to_pointer
+            | @parexpr
+            | @reference_to
+            | @ref_indirect
+            | @temp_init
+            ;
+
+/*
+case @funbindexpr.kind of
+  0 = @normal_call  // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call     // a call whose target is only found by ADL
+;
+*/
+iscall(unique int caller: @funbindexpr ref, int kind: int ref);
+
+numtemplatearguments(
+    unique int expr_id: @expr ref,
+    int num: int ref
+);
+
+specialnamequalifyingelements(
+    unique int id: @specialnamequalifyingelement,
+    unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+                       | @specialnamequalifyingelement
+                       | @usertype;
+
+namequalifiers(
+    unique int id: @namequalifier,
+    unique int qualifiableelement: @namequalifiableelement ref,
+    int qualifyingelement: @namequalifyingelement ref,
+    int location: @location_default ref
+);
+
+varbind(
+    int expr: @varbindexpr ref,
+    int var: @accessible ref
+);
+
+funbind(
+    int expr: @funbindexpr ref,
+    int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+              | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+                    | @delete_expr
+                    | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+                  | @unaryplusexpr
+                  | @conjugation
+                  | @realpartexpr
+                  | @imagpartexpr
+                  | @crement_expr
+                  ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+            | @indirect
+            | @un_arith_op_expr
+            | @un_bitwise_op_expr
+            | @builtinaddressof
+            | @vec_fill
+            | @un_log_op_expr
+            | @co_await
+            | @co_yield
+            ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+             | @ltexpr
+             | @geexpr
+             | @leexpr
+             | @spaceshipexpr
+             ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+                     | @rshiftexpr
+                     | @andexpr
+                     | @orexpr
+                     | @xorexpr
+                     ;
+
+@p_arith_op_expr = @paddexpr
+                 | @psubexpr
+                 | @pdiffexpr
+                 ;
+
+@bin_arith_op_expr = @addexpr
+                   | @subexpr
+                   | @mulexpr
+                   | @divexpr
+                   | @remexpr
+                   | @jmulexpr
+                   | @jdivexpr
+                   | @fjaddexpr
+                   | @jfaddexpr
+                   | @fjsubexpr
+                   | @jfsubexpr
+                   | @minexpr
+                   | @maxexpr
+                   | @p_arith_op_expr
+                   ;
+
+@bin_op_expr = @bin_arith_op_expr
+             | @bin_bitwise_op_expr
+             | @cmp_op_expr
+             | @bin_log_op_expr
+             ;
+
+@op_expr = @un_op_expr
+         | @bin_op_expr
+         | @assign_expr
+         | @conditionalexpr
+         ;
+
+@assign_arith_expr = @assignaddexpr
+                   | @assignsubexpr
+                   | @assignmulexpr
+                   | @assigndivexpr
+                   | @assignremexpr
+                   ;
+
+@assign_bitwise_expr = @assignandexpr
+                     | @assignorexpr
+                     | @assignxorexpr
+                     | @assignlshiftexpr
+                     | @assignrshiftexpr
+                     | @assignpaddexpr
+                     | @assignpsubexpr
+                     ;
+
+@assign_op_expr = @assign_arith_expr | @assign_bitwise_expr
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+  case @allocator.form of
+    0 = plain
+  | 1 = alignment
+  ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+    unique int expr: @any_new_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/*
+  case @deallocator.form of
+    0 = plain
+  | 1 = size
+  | 2 = alignment
+  | 3 = size_and_alignment
+  ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+    unique int expr: @new_or_delete_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+    unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+    unique int cond: @conditionalexpr ref,
+    int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+    unique int cond: @conditionalexpr ref,
+    int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+    unique int cond: @conditionalexpr ref,
+    int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+    unique int id: @value,
+    string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+    unique int id: @value ref,
+    string text: string ref
+);
+
+valuebind(
+    int val: @value ref,
+    unique int expr: @expr ref
+);
+
+fieldoffsets(
+    unique int id: @variable ref,
+    int byteoffset: int ref,
+    int bitoffset: int ref
+);
+
+bitfield(
+    unique int id: @variable ref,
+    int bits: int ref,
+    int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+    int member: @expr ref,
+    int prefix: @expr ref
+);
+*/
+
+/*
+   kind(1) = mbrcallexpr
+   kind(2) = mbrptrcallexpr
+   kind(3) = mbrptrmbrcallexpr
+   kind(4) = ptrmbrptrmbrcallexpr
+   kind(5) = mbrreadexpr // x.y
+   kind(6) = mbrptrreadexpr // p->y
+   kind(7) = mbrptrmbrreadexpr // x.*pm
+   kind(8) = mbrptrmbrptrreadexpr // x->*pm
+   kind(9) = staticmbrreadexpr // static x.y
+   kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+    int member: @expr ref,
+    int kind: int ref
+);
+*/
+
+initialisers(
+    unique int init: @initialiser,
+    int var: @accessible ref,
+    unique int expr: @expr ref,
+    int location: @location_expr ref
+);
+
+braced_initialisers(
+    int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+    int exp: @expr ref,
+    int ancestor: @element ref
+);
+
+exprs(
+    unique int id: @expr,
+    int kind: int ref,
+    int location: @location_expr ref
+);
+
+/*
+  case @value.category of
+    1 = prval
+  | 2 = xval
+  | 3 = lval
+  ;
+*/
+expr_types(
+    int id: @expr ref,
+    int typeid: @type ref,
+    int value_category: int ref
+);
+
+case @expr.kind of
+    1 = @errorexpr
+|   2 = @address_of // & AddressOfExpr
+|   3 = @reference_to // ReferenceToExpr (implicit?)
+|   4 = @indirect // * PointerDereferenceExpr
+|   5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+|   8 = @array_to_pointer // (???)
+|   9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+|  11 = @assume // Microsoft
+|  12 = @parexpr
+|  13 = @arithnegexpr
+|  14 = @unaryplusexpr
+|  15 = @complementexpr
+|  16 = @notexpr
+|  17 = @conjugation // GNU ~ operator
+|  18 = @realpartexpr // GNU __real
+|  19 = @imagpartexpr // GNU __imag
+|  20 = @postincrexpr
+|  21 = @postdecrexpr
+|  22 = @preincrexpr
+|  23 = @predecrexpr
+|  24 = @conditionalexpr
+|  25 = @addexpr
+|  26 = @subexpr
+|  27 = @mulexpr
+|  28 = @divexpr
+|  29 = @remexpr
+|  30 = @jmulexpr // C99 mul imaginary
+|  31 = @jdivexpr // C99 div imaginary
+|  32 = @fjaddexpr // C99 add real + imaginary
+|  33 = @jfaddexpr // C99 add imaginary + real
+|  34 = @fjsubexpr // C99 sub real - imaginary
+|  35 = @jfsubexpr // C99 sub imaginary - real
+|  36 = @paddexpr // pointer add (pointer + int or int + pointer)
+|  37 = @psubexpr // pointer sub (pointer - integer)
+|  38 = @pdiffexpr // difference between two pointers
+|  39 = @lshiftexpr
+|  40 = @rshiftexpr
+|  41 = @andexpr
+|  42 = @orexpr
+|  43 = @xorexpr
+|  44 = @eqexpr
+|  45 = @neexpr
+|  46 = @gtexpr
+|  47 = @ltexpr
+|  48 = @geexpr
+|  49 = @leexpr
+|  50 = @minexpr // GNU minimum
+|  51 = @maxexpr // GNU maximum
+|  52 = @assignexpr
+|  53 = @assignaddexpr
+|  54 = @assignsubexpr
+|  55 = @assignmulexpr
+|  56 = @assigndivexpr
+|  57 = @assignremexpr
+|  58 = @assignlshiftexpr
+|  59 = @assignrshiftexpr
+|  60 = @assignandexpr
+|  61 = @assignorexpr
+|  62 = @assignxorexpr
+|  63 = @assignpaddexpr // assign pointer add
+|  64 = @assignpsubexpr // assign pointer sub
+|  65 = @andlogicalexpr
+|  66 = @orlogicalexpr
+|  67 = @commaexpr
+|  68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ...  69 @objc_subscriptexpr deprecated
+// ...  70 @cmdaccess deprecated
+// ...
+|  73 = @virtfunptrexpr
+|  74 = @callexpr
+// ...  75 @msgexpr_normal deprecated
+// ...  76 @msgexpr_super deprecated
+// ...  77 @atselectorexpr deprecated
+// ...  78 @atprotocolexpr deprecated
+|  79 = @vastartexpr
+|  80 = @vaargexpr
+|  81 = @vaendexpr
+|  82 = @vacopyexpr
+// ...  83 @atencodeexpr deprecated
+|  84 = @varaccess
+|  85 = @thisaccess
+// ...  86 @objc_box_expr deprecated
+|  87 = @new_expr
+|  88 = @delete_expr
+|  89 = @throw_expr
+|  90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+|  91 = @braced_init_list
+|  92 = @type_id
+|  93 = @runtime_sizeof
+|  94 = @runtime_alignof
+|  95 = @sizeof_pack
+|  96 = @expr_stmt // GNU extension
+|  97 = @routineexpr
+|  98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+|  99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // EDG internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+;
+
+@var_args_expr = @vastartexpr
+               | @vaendexpr
+               | @vaargexpr
+               | @vacopyexpr
+               ;
+
+@builtin_op = @var_args_expr
+            | @noopexpr
+            | @offsetofexpr
+            | @intaddrexpr
+            | @hasassignexpr
+            | @hascopyexpr
+            | @hasnothrowassign
+            | @hasnothrowconstr
+            | @hasnothrowcopy
+            | @hastrivialassign
+            | @hastrivialconstr
+            | @hastrivialcopy
+            | @hastrivialdestructor
+            | @hasuserdestr
+            | @hasvirtualdestr
+            | @isabstractexpr
+            | @isbaseofexpr
+            | @isclassexpr
+            | @isconvtoexpr
+            | @isemptyexpr
+            | @isenumexpr
+            | @ispodexpr
+            | @ispolyexpr
+            | @isunionexpr
+            | @typescompexpr
+            | @builtinshufflevector
+            | @builtinconvertvector
+            | @builtinaddressof
+            | @istriviallyconstructibleexpr
+            | @isdestructibleexpr
+            | @isnothrowdestructibleexpr
+            | @istriviallydestructibleexpr
+            | @istriviallyassignableexpr
+            | @isnothrowassignableexpr
+            | @isstandardlayoutexpr
+            | @istriviallycopyableexpr
+            | @isliteraltypeexpr
+            | @hastrivialmoveconstructorexpr
+            | @hastrivialmoveassignexpr
+            | @hasnothrowmoveassignexpr
+            | @isconstructibleexpr
+            | @isnothrowconstructibleexpr
+            | @hasfinalizerexpr
+            | @isdelegateexpr
+            | @isinterfaceclassexpr
+            | @isrefarrayexpr
+            | @isrefclassexpr
+            | @issealedexpr
+            | @issimplevalueclassexpr
+            | @isvalueclassexpr
+            | @isfinalexpr
+            | @builtinchooseexpr
+            | @builtincomplex
+            | @isassignable
+            | @isaggregate
+            | @hasuniqueobjectrepresentations
+            | @builtinbitcast
+            | @builtinshuffle
+            ;
+
+new_allocated_type(
+    unique int expr: @new_expr ref,
+    int type_id: @type ref
+);
+
+new_array_allocated_type(
+    unique int expr: @new_array_expr ref,
+    int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union.
+ */
+#keyset[aggregate, field]
+aggregate_field_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int field: @membervariable ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array.
+ */
+#keyset[aggregate, element_index]
+aggregate_array_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int element_index: int ref
+);
+
+@ctorinit = @ctordirectinit
+          | @ctorvirtualinit
+          | @ctorfieldinit
+          | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+              | @dtorvirtualdestruct
+              | @dtorfielddestruct;
+
+
+condition_decl_bind(
+    unique int expr: @condition_decl ref,
+    unique int decl: @declaration ref
+);
+
+typeid_bind(
+    unique int expr: @type_id ref,
+    int type_id: @type ref
+);
+
+uuidof_bind(
+    unique int expr: @uuidof ref,
+    int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof;
+
+sizeof_bind(
+    unique int expr: @runtime_sizeof_or_alignof ref,
+    int type_id: @type ref
+);
+
+code_block(
+    unique int block: @literal ref,
+    unique int routine: @function ref
+);
+
+lambdas(
+    unique int expr: @lambdaexpr ref,
+    string default_capture: string ref,
+    boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+    unique int id: @lambdacapture,
+    int lambda: @lambdaexpr ref,
+    int index: int ref,
+    int field: @membervariable ref,
+    boolean captured_by_reference: boolean ref,
+    boolean is_implicit: boolean ref,
+    int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+             | @new_expr
+             | @delete_expr
+             | @delete_array_expr
+             | @ctordirectinit
+             | @ctorvirtualinit
+             | @ctordelegatinginit
+             | @dtordirectdestruct
+             | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+    int expr: @foldexpr ref,
+    string operator: string ref,
+    boolean is_left_fold: boolean ref
+);
+
+stmts(
+    unique int id: @stmt,
+    int kind: int ref,
+    int location: @location_stmt ref
+);
+
+case @stmt.kind of
+    1 = @stmt_expr
+|   2 = @stmt_if
+|   3 = @stmt_while
+|   4 = @stmt_goto
+|   5 = @stmt_label
+|   6 = @stmt_return
+|   7 = @stmt_block
+|   8 = @stmt_end_test_while // do { ... } while ( ... )
+|   9 = @stmt_for
+|  10 = @stmt_switch_case
+|  11 = @stmt_switch
+|  13 = @stmt_asm // "asm" statement or the body of an asm function
+|  15 = @stmt_try_block
+|  16 = @stmt_microsoft_try // Microsoft
+|  17 = @stmt_decl
+|  18 = @stmt_set_vla_size // C99
+|  19 = @stmt_vla_decl // C99
+|  25 = @stmt_assigned_goto // GNU
+|  26 = @stmt_empty
+|  27 = @stmt_continue
+|  28 = @stmt_break
+|  29 = @stmt_range_based_for // C++11
+// ...  30 @stmt_at_autoreleasepool_block deprecated
+// ...  31 @stmt_objc_for_in deprecated
+// ...  32 @stmt_at_synchronized deprecated
+|  33 = @stmt_handler
+// ...  34 @stmt_finally_end deprecated
+|  35 = @stmt_constexpr_if
+|  37 = @stmt_co_return
+;
+
+type_vla(
+    int type_id: @type ref,
+    int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+    int var: @variable ref,
+    int decl: @stmt_vla_decl ref
+);
+
+if_initialization(
+    unique int if_stmt: @stmt_if ref,
+    int init_id: @stmt ref
+);
+
+if_then(
+    unique int if_stmt: @stmt_if ref,
+    int then_id: @stmt ref
+);
+
+if_else(
+    unique int if_stmt: @stmt_if ref,
+    int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int init_id: @stmt ref
+);
+
+constexpr_if_then(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int then_id: @stmt ref
+);
+
+constexpr_if_else(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int else_id: @stmt ref
+);
+
+while_body(
+    unique int while_stmt: @stmt_while ref,
+    int body_id: @stmt ref
+);
+
+do_body(
+    unique int do_stmt: @stmt_end_test_while ref,
+    int body_id: @stmt ref
+);
+
+switch_initialization(
+    unique int switch_stmt: @stmt_switch ref,
+    int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+    int switch_stmt: @stmt_switch ref,
+    int index: int ref,
+    int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+    unique int switch_stmt: @stmt_switch ref,
+    int body_id: @stmt ref
+);
+
+for_initialization(
+    unique int for_stmt: @stmt_for ref,
+    int init_id: @stmt ref
+);
+
+for_condition(
+    unique int for_stmt: @stmt_for ref,
+    int condition_id: @expr ref
+);
+
+for_update(
+    unique int for_stmt: @stmt_for ref,
+    int update_id: @expr ref
+);
+
+for_body(
+    unique int for_stmt: @stmt_for ref,
+    int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+    unique int id: @stmt ref,
+    int index: int ref,
+    int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+    unique int block: @stmt_block ref,
+    int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+    unique int id: @jumporlabel ref,
+    string str: string ref,
+    int target: @stmt ref
+);
+
+preprocdirects(
+    unique int id: @preprocdirect,
+    int kind: int ref,
+    int location: @location_default ref
+);
+case @preprocdirect.kind of
+   0 = @ppd_if
+|  1 = @ppd_ifdef
+|  2 = @ppd_ifndef
+|  3 = @ppd_elif
+|  4 = @ppd_else
+|  5 = @ppd_endif
+|  6 = @ppd_plain_include
+|  7 = @ppd_define
+|  8 = @ppd_undef
+|  9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+    int begin : @ppd_branch ref,
+    int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+    unique int id: @preprocdirect ref,
+    string head: string ref,
+    string body: string ref
+);
+
+includes(
+    unique int id: @ppd_include ref,
+    int included: @file ref
+);
+
+link_targets(
+    unique int id: @link_target,
+    int binary: @file ref
+);
+
+link_parent(
+    int element : @element ref,
+    int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+    unique int id: @xmldtd,
+    string root: string ref,
+    string publicId: string ref,
+    string systemId: string ref,
+    int fileid: @file ref
+);
+
+xmlElements(
+    unique int id: @xmlelement,
+    string name: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlAttrs(
+    unique int id: @xmlattribute,
+    int elementid: @xmlelement ref,
+    string name: string ref,
+    string value: string ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlNs(
+    int id: @xmlnamespace,
+    string prefixName: string ref,
+    string URI: string ref,
+    int fileid: @file ref
+);
+
+xmlHasNs(
+    int elementId: @xmlnamespaceable ref,
+    int nsId: @xmlnamespace ref,
+    int fileid: @file ref
+);
+
+xmlComments(
+    unique int id: @xmlcomment,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int fileid: @file ref
+);
+
+xmlChars(
+    unique int id: @xmlcharacters,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int isCDATA: int ref,
+    int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+    int xmlElement: @xmllocatable ref,
+    int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+              | @xmlelement
+              | @xmlcomment
+              | @xmlattribute
+              | @xmldtd
+              | @file
+              | @xmlnamespace;
diff --git a/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/upgrade.properties b/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/upgrade.properties
new file mode 100644
index 00000000000..d697a16a42f
--- /dev/null
+++ b/cpp/downgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/upgrade.properties
@@ -0,0 +1,3 @@
+description: Add new builtin operations
+compatibility: partial
+exprs.rel: run exprs.qlo
diff --git a/cpp/ql/lib/change-notes/2022-09-06-additional-builtin-support.md b/cpp/ql/lib/change-notes/2022-09-06-additional-builtin-support.md
new file mode 100644
index 00000000000..625f5001b6e
--- /dev/null
+++ b/cpp/ql/lib/change-notes/2022-09-06-additional-builtin-support.md
@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added subclasses of `BuiltInOperations` for `__is_same`, `__is_function`, `__is_layout_compatible`, `__is_pointer_interconvertible_base_of`, `__is_array`, `__array_rank`, `__array_extent`, `__is_arithmetic`, `__is_complete_type`, `__is_compound`, `__is_const`, `__is_floating_point`, `__is_fundamental`, `__is_integral`, `__is_lvalue_reference`, `__is_member_function_pointer`, `__is_member_object_pointer`, `__is_member_pointer`, `__is_object`, `__is_pointer`, `__is_reference`, `__is_rvalue_reference`, `__is_scalar`, `__is_signed`, `__is_unsigned`, `__is_void`, and `__is_volatile`.
diff --git a/cpp/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md b/cpp/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md
new file mode 100644
index 00000000000..efdaf85f2ed
--- /dev/null
+++ b/cpp/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed an issue in the taint tracking analysis where implicit reads were not allowed by default in sinks or additional taint steps that used flow states.
\ No newline at end of file
diff --git a/cpp/ql/lib/change-notes/2022-09-12-uppercase.md b/cpp/ql/lib/change-notes/2022-09-12-uppercase.md
new file mode 100644
index 00000000000..996861f1c2c
--- /dev/null
+++ b/cpp/ql/lib/change-notes/2022-09-12-uppercase.md
@@ -0,0 +1,5 @@
+---
+category: deprecated
+---
+* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
+  The old name still exists as a deprecated alias.
\ No newline at end of file
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/dataflow/ProductFlow.qll b/cpp/ql/lib/experimental/semmle/code/cpp/dataflow/ProductFlow.qll
new file mode 100644
index 00000000000..2a6066e1b80
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/dataflow/ProductFlow.qll
@@ -0,0 +1,165 @@
+import experimental.semmle.code.cpp.ir.dataflow.DataFlow
+import experimental.semmle.code.cpp.ir.dataflow.DataFlow2
+
+module ProductFlow {
+  abstract class Configuration extends string {
+    bindingset[this]
+    Configuration() { any() }
+
+    /**
+     * Holds if `(source1, source2)` is a relevant data flow source.
+     *
+     * `source1` and `source2` must belong to the same callable.
+     */
+    predicate isSourcePair(DataFlow::Node source1, DataFlow::Node source2) { none() }
+
+    /**
+     * Holds if `(source1, source2)` is a relevant data flow source with initial states `state1`
+     * and `state2`, respectively.
+     *
+     * `source1` and `source2` must belong to the same callable.
+     */
+    predicate isSourcePair(
+      DataFlow::Node source1, string state1, DataFlow::Node source2, string state2
+    ) {
+      state1 = "" and
+      state2 = "" and
+      this.isSourcePair(source1, source2)
+    }
+
+    /**
+     * Holds if `(sink1, sink2)` is a relevant data flow sink.
+     *
+     * `sink1` and `sink2` must belong to the same callable.
+     */
+    predicate isSinkPair(DataFlow::Node sink1, DataFlow::Node sink2) { none() }
+
+    /**
+     * Holds if `(sink1, sink2)` is a relevant data flow sink with final states `state1`
+     * and `state2`, respectively.
+     *
+     * `sink1` and `sink2` must belong to the same callable.
+     */
+    predicate isSinkPair(
+      DataFlow::Node sink1, DataFlow::FlowState state1, DataFlow::Node sink2,
+      DataFlow::FlowState state2
+    ) {
+      state1 = "" and
+      state2 = "" and
+      this.isSinkPair(sink1, sink2)
+    }
+
+    predicate hasFlowPath(
+      DataFlow::PathNode source1, DataFlow2::PathNode source2, DataFlow::PathNode sink1,
+      DataFlow2::PathNode sink2
+    ) {
+      reachable(this, source1, source2, sink1, sink2)
+    }
+  }
+
+  private import Internal
+
+  module Internal {
+    class Conf1 extends DataFlow::Configuration {
+      Conf1() { this = "Conf1" }
+
+      override predicate isSource(DataFlow::Node source, string state) {
+        exists(Configuration conf | conf.isSourcePair(source, state, _, _))
+      }
+
+      override predicate isSink(DataFlow::Node sink, string state) {
+        exists(Configuration conf | conf.isSinkPair(sink, state, _, _))
+      }
+    }
+
+    class Conf2 extends DataFlow2::Configuration {
+      Conf2() { this = "Conf2" }
+
+      override predicate isSource(DataFlow::Node source, string state) {
+        exists(Configuration conf, DataFlow::Node source1 |
+          conf.isSourcePair(source1, _, source, state) and
+          any(Conf1 c).hasFlow(source1, _)
+        )
+      }
+
+      override predicate isSink(DataFlow::Node sink, string state) {
+        exists(Configuration conf, DataFlow::Node sink1 |
+          conf.isSinkPair(sink1, _, sink, state) and any(Conf1 c).hasFlow(_, sink1)
+        )
+      }
+    }
+  }
+
+  private predicate reachableInterprocEntry(
+    Configuration conf, DataFlow::PathNode source1, DataFlow2::PathNode source2,
+    DataFlow::PathNode node1, DataFlow2::PathNode node2
+  ) {
+    conf.isSourcePair(node1.getNode(), _, node2.getNode(), _) and
+    node1 = source1 and
+    node2 = source2
+    or
+    exists(
+      DataFlow::PathNode midEntry1, DataFlow2::PathNode midEntry2, DataFlow::PathNode midExit1,
+      DataFlow2::PathNode midExit2
+    |
+      reachableInterprocEntry(conf, source1, source2, midEntry1, midEntry2) and
+      interprocEdgePair(midExit1, midExit2, node1, node2) and
+      localPathStep1*(midEntry1, midExit1) and
+      localPathStep2*(midEntry2, midExit2)
+    )
+  }
+
+  private predicate localPathStep1(DataFlow::PathNode pred, DataFlow::PathNode succ) {
+    DataFlow::PathGraph::edges(pred, succ) and
+    pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
+      pragma[only_bind_out](succ.getNode().getEnclosingCallable())
+  }
+
+  private predicate localPathStep2(DataFlow2::PathNode pred, DataFlow2::PathNode succ) {
+    DataFlow2::PathGraph::edges(pred, succ) and
+    pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
+      pragma[only_bind_out](succ.getNode().getEnclosingCallable())
+  }
+
+  pragma[nomagic]
+  private predicate interprocEdge1(
+    Declaration predDecl, Declaration succDecl, DataFlow::PathNode pred1, DataFlow::PathNode succ1
+  ) {
+    DataFlow::PathGraph::edges(pred1, succ1) and
+    predDecl != succDecl and
+    pred1.getNode().getEnclosingCallable() = predDecl and
+    succ1.getNode().getEnclosingCallable() = succDecl
+  }
+
+  pragma[nomagic]
+  private predicate interprocEdge2(
+    Declaration predDecl, Declaration succDecl, DataFlow2::PathNode pred2, DataFlow2::PathNode succ2
+  ) {
+    DataFlow2::PathGraph::edges(pred2, succ2) and
+    predDecl != succDecl and
+    pred2.getNode().getEnclosingCallable() = predDecl and
+    succ2.getNode().getEnclosingCallable() = succDecl
+  }
+
+  private predicate interprocEdgePair(
+    DataFlow::PathNode pred1, DataFlow2::PathNode pred2, DataFlow::PathNode succ1,
+    DataFlow2::PathNode succ2
+  ) {
+    exists(Declaration predDecl, Declaration succDecl |
+      interprocEdge1(predDecl, succDecl, pred1, succ1) and
+      interprocEdge2(predDecl, succDecl, pred2, succ2)
+    )
+  }
+
+  private predicate reachable(
+    Configuration conf, DataFlow::PathNode source1, DataFlow2::PathNode source2,
+    DataFlow::PathNode sink1, DataFlow2::PathNode sink2
+  ) {
+    exists(DataFlow::PathNode mid1, DataFlow2::PathNode mid2 |
+      reachableInterprocEntry(conf, source1, source2, mid1, mid2) and
+      conf.isSinkPair(sink1.getNode(), _, sink2.getNode(), _) and
+      localPathStep1*(mid1, sink1) and
+      localPathStep2*(mid2, sink2)
+    )
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow.qll
new file mode 100644
index 00000000000..acb2fbc6808
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow.qll
@@ -0,0 +1,26 @@
+/**
+ * Provides a library for local (intra-procedural) and global (inter-procedural)
+ * data flow analysis: deciding whether data can flow from a _source_ to a
+ * _sink_. This library differs from the one in `semmle.code.cpp.dataflow` in that
+ * this library uses the IR (Intermediate Representation) library, which provides
+ * a more precise semantic representation of the program, whereas the other dataflow
+ * library uses the more syntax-oriented ASTs. This library should provide more accurate
+ * results than the AST-based library in most scenarios.
+ *
+ * Unless configured otherwise, _flow_ means that the exact value of
+ * the source may reach the sink. We do not track flow across pointer
+ * dereferences or array indexing.
+ *
+ * To use global (interprocedural) data flow, extend the class
+ * `DataFlow::Configuration` as documented on that class. To use local
+ * (intraprocedural) data flow between expressions, call
+ * `DataFlow::localExprFlow`. For more general cases of local data flow, call
+ * `DataFlow::localFlow` or `DataFlow::localFlowStep` with arguments of type
+ * `DataFlow::Node`.
+ */
+
+import cpp
+
+module DataFlow {
+  import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowImpl
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow2.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow2.qll
new file mode 100644
index 00000000000..0513bd4ebcb
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow2.qll
@@ -0,0 +1,16 @@
+/**
+ * Provides a `DataFlow2` module, which is a copy of the `DataFlow` module. Use
+ * this class when data-flow configurations must depend on each other. Two
+ * classes extending `DataFlow::Configuration` should never depend on each
+ * other, but one of them should instead depend on a
+ * `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
+ * `DataFlow4::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.DataFlow` for the full documentation.
+ */
+
+import cpp
+
+module DataFlow2 {
+  import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowImpl2
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow3.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow3.qll
new file mode 100644
index 00000000000..571b75b37c4
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow3.qll
@@ -0,0 +1,16 @@
+/**
+ * Provides a `DataFlow3` module, which is a copy of the `DataFlow` module. Use
+ * this class when data-flow configurations must depend on each other. Two
+ * classes extending `DataFlow::Configuration` should never depend on each
+ * other, but one of them should instead depend on a
+ * `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
+ * `DataFlow4::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.DataFlow` for the full documentation.
+ */
+
+import cpp
+
+module DataFlow3 {
+  import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowImpl3
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow4.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow4.qll
new file mode 100644
index 00000000000..18c21e554f6
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/DataFlow4.qll
@@ -0,0 +1,16 @@
+/**
+ * Provides a `DataFlow4` module, which is a copy of the `DataFlow` module. Use
+ * this class when data-flow configurations must depend on each other. Two
+ * classes extending `DataFlow::Configuration` should never depend on each
+ * other, but one of them should instead depend on a
+ * `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
+ * `DataFlow4::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.DataFlow` for the full documentation.
+ */
+
+import cpp
+
+module DataFlow4 {
+  import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowImpl4
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/ResolveCall.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/ResolveCall.qll
new file mode 100644
index 00000000000..bcf2fa8c7db
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/ResolveCall.qll
@@ -0,0 +1,23 @@
+/**
+ * Provides a predicate for non-contextual virtual dispatch and function
+ * pointer resolution.
+ */
+
+import cpp
+private import semmle.code.cpp.ir.ValueNumbering
+private import internal.DataFlowDispatch
+private import semmle.code.cpp.ir.IR
+
+/**
+ * Resolve potential target function(s) for `call`.
+ *
+ * If `call` is a call through a function pointer (`ExprCall`) or its target is
+ * a virtual member function, simple data flow analysis is performed in order
+ * to identify the possible target(s).
+ */
+Function resolveCall(Call call) {
+  exists(CallInstruction callInstruction |
+    callInstruction.getAst() = call and
+    result = viableCallable(callInstruction)
+  )
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/TaintTracking.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/TaintTracking.qll
new file mode 100644
index 00000000000..43064116499
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/TaintTracking.qll
@@ -0,0 +1,23 @@
+/**
+ * Provides classes for performing local (intra-procedural) and
+ * global (inter-procedural) taint-tracking analyses.
+ *
+ * We define _taint propagation_ informally to mean that a substantial part of
+ * the information from the source is preserved at the sink. For example, taint
+ * propagates from `x` to `x + 100`, but it does not propagate from `x` to `x >
+ * 100` since we consider a single bit of information to be too little.
+ *
+ * To use global (interprocedural) taint tracking, extend the class
+ * `TaintTracking::Configuration` as documented on that class. To use local
+ * (intraprocedural) taint tracking between expressions, call
+ * `TaintTracking::localExprTaint`. For more general cases of local taint
+ * tracking, call `TaintTracking::localTaint` or
+ * `TaintTracking::localTaintStep` with arguments of type `DataFlow::Node`.
+ */
+
+import semmle.code.cpp.ir.dataflow.DataFlow
+import semmle.code.cpp.ir.dataflow.DataFlow2
+
+module TaintTracking {
+  import experimental.semmle.code.cpp.ir.dataflow.internal.tainttracking1.TaintTrackingImpl
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/TaintTracking2.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/TaintTracking2.qll
new file mode 100644
index 00000000000..aa9fd392803
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/TaintTracking2.qll
@@ -0,0 +1,15 @@
+/**
+ * Provides a `TaintTracking2` module, which is a copy of the `TaintTracking`
+ * module. Use this class when data-flow configurations or taint-tracking
+ * configurations must depend on each other. Two classes extending
+ * `DataFlow::Configuration` should never depend on each other, but one of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`. The
+ * `TaintTracking::Configuration` class extends `DataFlow::Configuration`, and
+ * `TaintTracking2::Configuration` extends `DataFlow2::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.TaintTracking` for the full documentation.
+ */
+module TaintTracking2 {
+  import experimental.semmle.code.cpp.ir.dataflow.internal.tainttracking2.TaintTrackingImpl
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/TaintTracking3.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/TaintTracking3.qll
new file mode 100644
index 00000000000..bcd35ccd02f
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/TaintTracking3.qll
@@ -0,0 +1,15 @@
+/**
+ * Provides a `TaintTracking3` module, which is a copy of the `TaintTracking`
+ * module. Use this class when data-flow configurations or taint-tracking
+ * configurations must depend on each other. Two classes extending
+ * `DataFlow::Configuration` should never depend on each other, but one of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`. The
+ * `TaintTracking::Configuration` class extends `DataFlow::Configuration`, and
+ * `TaintTracking2::Configuration` extends `DataFlow2::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.TaintTracking` for the full documentation.
+ */
+module TaintTracking3 {
+  import experimental.semmle.code.cpp.ir.dataflow.internal.tainttracking3.TaintTrackingImpl
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
new file mode 100644
index 00000000000..f92612e77af
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
@@ -0,0 +1,273 @@
+private import cpp
+private import semmle.code.cpp.ir.IR
+private import experimental.semmle.code.cpp.ir.dataflow.DataFlow
+private import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
+private import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import DataFlowImplCommon as DataFlowImplCommon
+
+/**
+ * Gets a function that might be called by `call`.
+ */
+cached
+Function viableCallable(CallInstruction call) {
+  DataFlowImplCommon::forceCachingInSameStage() and
+  result = call.getStaticCallTarget()
+  or
+  // If the target of the call does not have a body in the snapshot, it might
+  // be because the target is just a header declaration, and the real target
+  // will be determined at run time when the caller and callee are linked
+  // together by the operating system's dynamic linker. In case a _unique_
+  // function with the right signature is present in the database, we return
+  // that as a potential callee.
+  exists(string qualifiedName, int nparams |
+    callSignatureWithoutBody(qualifiedName, nparams, call) and
+    functionSignatureWithBody(qualifiedName, nparams, result) and
+    strictcount(Function other | functionSignatureWithBody(qualifiedName, nparams, other)) = 1
+  )
+  or
+  // Virtual dispatch
+  result = call.(VirtualDispatch::DataSensitiveCall).resolve()
+}
+
+/**
+ * Provides virtual dispatch support compatible with the original
+ * implementation of `semmle.code.cpp.security.TaintTracking`.
+ */
+private module VirtualDispatch {
+  /** A call that may dispatch differently depending on the qualifier value. */
+  abstract class DataSensitiveCall extends DataFlowCall {
+    /**
+     * Gets the node whose value determines the target of this call. This node
+     * could be the qualifier of a virtual dispatch or the function-pointer
+     * expression in a call to a function pointer. What they have in common is
+     * that we need to find out which data flows there, and then it's up to the
+     * `resolve` predicate to stitch that information together and resolve the
+     * call.
+     */
+    abstract DataFlow::Node getDispatchValue();
+
+    /** Gets a candidate target for this call. */
+    abstract Function resolve();
+
+    /**
+     * Whether `src` can flow to this call.
+     *
+     * Searches backwards from `getDispatchValue()` to `src`. The `allowFromArg`
+     * parameter is true when the search is allowed to continue backwards into
+     * a parameter; non-recursive callers should pass `_` for `allowFromArg`.
+     */
+    predicate flowsFrom(DataFlow::Node src, boolean allowFromArg) {
+      src = this.getDispatchValue() and allowFromArg = true
+      or
+      exists(DataFlow::Node other, boolean allowOtherFromArg |
+        this.flowsFrom(other, allowOtherFromArg)
+      |
+        // Call argument
+        exists(DataFlowCall call, Position i |
+          other
+              .(DataFlow::ParameterNode)
+              .isParameterOf(pragma[only_bind_into](call).getStaticCallTarget(), i) and
+          src.(ArgumentNode).argumentOf(call, pragma[only_bind_into](pragma[only_bind_out](i)))
+        ) and
+        allowOtherFromArg = true and
+        allowFromArg = true
+        or
+        // Call return
+        exists(DataFlowCall call, ReturnKind returnKind |
+          other = getAnOutNode(call, returnKind) and
+          returnNodeWithKindAndEnclosingCallable(src, returnKind, call.getStaticCallTarget())
+        ) and
+        allowFromArg = false
+        or
+        // Local flow
+        DataFlow::localFlowStep(src, other) and
+        allowFromArg = allowOtherFromArg
+        or
+        // Flow from global variable to load.
+        exists(LoadInstruction load, GlobalOrNamespaceVariable var |
+          var = src.asVariable() and
+          other.asInstruction() = load and
+          addressOfGlobal(load.getSourceAddress(), var) and
+          // The `allowFromArg` concept doesn't play a role when `src` is a
+          // global variable, so we just set it to a single arbitrary value for
+          // performance.
+          allowFromArg = true
+        )
+        or
+        // Flow from store to global variable.
+        exists(StoreInstruction store, GlobalOrNamespaceVariable var |
+          var = other.asVariable() and
+          store = src.asInstruction() and
+          storeIntoGlobal(store, var) and
+          // Setting `allowFromArg` to `true` like in the base case means we
+          // treat a store to a global variable like the dispatch itself: flow
+          // may come from anywhere.
+          allowFromArg = true
+        )
+      )
+    }
+  }
+
+  pragma[noinline]
+  private predicate storeIntoGlobal(StoreInstruction store, GlobalOrNamespaceVariable var) {
+    addressOfGlobal(store.getDestinationAddress(), var)
+  }
+
+  /** Holds if `addressInstr` is an instruction that produces the address of `var`. */
+  private predicate addressOfGlobal(Instruction addressInstr, GlobalOrNamespaceVariable var) {
+    // Access directly to the global variable
+    addressInstr.(VariableAddressInstruction).getAstVariable() = var
+    or
+    // Access to a field on a global union
+    exists(FieldAddressInstruction fa |
+      fa = addressInstr and
+      fa.getObjectAddress().(VariableAddressInstruction).getAstVariable() = var and
+      fa.getField().getDeclaringType() instanceof Union
+    )
+  }
+
+  /**
+   * A ReturnNode with its ReturnKind and its enclosing callable.
+   *
+   * Used to fix a join ordering issue in flowsFrom.
+   */
+  pragma[noinline]
+  private predicate returnNodeWithKindAndEnclosingCallable(
+    ReturnNode node, ReturnKind kind, DataFlowCallable callable
+  ) {
+    node.getKind() = kind and
+    node.getEnclosingCallable() = callable
+  }
+
+  /** Call through a function pointer. */
+  private class DataSensitiveExprCall extends DataSensitiveCall {
+    DataSensitiveExprCall() { not exists(this.getStaticCallTarget()) }
+
+    override DataFlow::Node getDispatchValue() { result.asInstruction() = this.getCallTarget() }
+
+    override Function resolve() {
+      exists(FunctionInstruction fi |
+        this.flowsFrom(DataFlow::instructionNode(fi), _) and
+        result = fi.getFunctionSymbol()
+      ) and
+      (
+        this.getNumberOfArguments() <= result.getEffectiveNumberOfParameters() and
+        this.getNumberOfArguments() >= result.getEffectiveNumberOfParameters()
+        or
+        result.isVarargs()
+      )
+    }
+  }
+
+  /** Call to a virtual function. */
+  private class DataSensitiveOverriddenFunctionCall extends DataSensitiveCall {
+    DataSensitiveOverriddenFunctionCall() {
+      exists(this.getStaticCallTarget().(VirtualFunction).getAnOverridingFunction())
+    }
+
+    override DataFlow::Node getDispatchValue() { result.asInstruction() = this.getThisArgument() }
+
+    override MemberFunction resolve() {
+      exists(Class overridingClass |
+        this.overrideMayAffectCall(overridingClass, result) and
+        this.hasFlowFromCastFrom(overridingClass)
+      )
+    }
+
+    /**
+     * Holds if `this` is a virtual function call whose static target is
+     * overridden by `overridingFunction` in `overridingClass`.
+     */
+    pragma[noinline]
+    private predicate overrideMayAffectCall(Class overridingClass, MemberFunction overridingFunction) {
+      overridingFunction.getAnOverriddenFunction+() = this.getStaticCallTarget().(VirtualFunction) and
+      overridingFunction.getDeclaringType() = overridingClass
+    }
+
+    /**
+     * Holds if the qualifier of `this` has flow from an upcast from
+     * `derivedClass`.
+     */
+    pragma[noinline]
+    private predicate hasFlowFromCastFrom(Class derivedClass) {
+      exists(ConvertToBaseInstruction toBase |
+        this.flowsFrom(DataFlow::instructionNode(toBase), _) and
+        derivedClass = toBase.getDerivedClass()
+      )
+    }
+  }
+}
+
+/**
+ * Holds if `f` is a function with a body that has name `qualifiedName` and
+ * `nparams` parameter count. See `functionSignature`.
+ */
+private predicate functionSignatureWithBody(string qualifiedName, int nparams, Function f) {
+  functionSignature(f, qualifiedName, nparams) and
+  exists(f.getBlock())
+}
+
+/**
+ * Holds if the target of `call` is a function _with no definition_ that has
+ * name `qualifiedName` and `nparams` parameter count. See `functionSignature`.
+ */
+pragma[noinline]
+private predicate callSignatureWithoutBody(string qualifiedName, int nparams, CallInstruction call) {
+  exists(Function target |
+    target = call.getStaticCallTarget() and
+    not exists(target.getBlock()) and
+    functionSignature(target, qualifiedName, nparams)
+  )
+}
+
+/**
+ * Holds if `f` has name `qualifiedName` and `nparams` parameter count. This is
+ * an approximation of its signature for the purpose of matching functions that
+ * might be the same across link targets.
+ */
+private predicate functionSignature(Function f, string qualifiedName, int nparams) {
+  qualifiedName = f.getQualifiedName() and
+  nparams = f.getNumberOfParameters() and
+  not f.isStatic()
+}
+
+/**
+ * Holds if the set of viable implementations that can be called by `call`
+ * might be improved by knowing the call context.
+ */
+predicate mayBenefitFromCallContext(CallInstruction call, Function f) {
+  mayBenefitFromCallContext(call, f, _)
+}
+
+/**
+ * Holds if `call` is a call through a function pointer, and the pointer
+ * value is given as the `arg`'th argument to `f`.
+ */
+private predicate mayBenefitFromCallContext(
+  VirtualDispatch::DataSensitiveCall call, Function f, int arg
+) {
+  f = pragma[only_bind_out](call).getEnclosingCallable() and
+  exists(InitializeParameterInstruction init |
+    not exists(call.getStaticCallTarget()) and
+    init.getEnclosingFunction() = f and
+    call.flowsFrom(DataFlow::instructionNode(init), _) and
+    init.getParameter().getIndex() = arg
+  )
+}
+
+/**
+ * Gets a viable dispatch target of `call` in the context `ctx`. This is
+ * restricted to those `call`s for which a context might make a difference.
+ */
+Function viableImplInCallContext(CallInstruction call, CallInstruction ctx) {
+  result = viableCallable(call) and
+  exists(int i, Function f |
+    mayBenefitFromCallContext(pragma[only_bind_into](call), f, i) and
+    f = ctx.getStaticCallTarget() and
+    result = ctx.getArgument(i).getUnconvertedResultExpression().(FunctionAccess).getTarget()
+  )
+}
+
+/** Holds if arguments at position `apos` match parameters at position `ppos`. */
+pragma[inline]
+predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { ppos = apos }
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
new file mode 100644
index 00000000000..468f8640a78
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
@@ -0,0 +1,4450 @@
+/**
+ * Provides an implementation of global (interprocedural) data flow. This file
+ * re-exports the local (intraprocedural) data flow analysis from
+ * `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
+ * through the `Configuration` class. This file exists in several identical
+ * copies, allowing queries to use multiple `Configuration` classes that depend
+ * on each other without introducing mutual recursion among those configurations.
+ */
+
+private import DataFlowImplCommon
+private import DataFlowImplSpecific::Private
+import DataFlowImplSpecific::Public
+import DataFlowImplCommonPublic
+
+/**
+ * A configuration of interprocedural data flow analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the global data flow library must define its own unique extension
+ * of this abstract class. To create a configuration, extend this class with
+ * a subclass whose characteristic predicate is a unique singleton string.
+ * For example, write
+ *
+ * ```ql
+ * class MyAnalysisConfiguration extends DataFlow::Configuration {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Optionally override `isBarrier`.
+ *   // Optionally override `isAdditionalFlowStep`.
+ * }
+ * ```
+ * Conceptually, this defines a graph where the nodes are `DataFlow::Node`s and
+ * the edges are those data-flow steps that preserve the value of the node
+ * along with any additional edges defined by `isAdditionalFlowStep`.
+ * Specifying nodes in `isBarrier` will remove those nodes from the graph, and
+ * specifying nodes in `isBarrierIn` and/or `isBarrierOut` will remove in-going
+ * and/or out-going edges from those nodes, respectively.
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```ql
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but two classes extending
+ * `DataFlow::Configuration` should never depend on each other. One of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`.
+ */
+abstract class Configuration extends string {
+  bindingset[this]
+  Configuration() { any() }
+
+  /**
+   * Holds if `source` is a relevant data flow source.
+   */
+  predicate isSource(Node source) { none() }
+
+  /**
+   * Holds if `source` is a relevant data flow source with the given initial
+   * `state`.
+   */
+  predicate isSource(Node source, FlowState state) { none() }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink.
+   */
+  predicate isSink(Node sink) { none() }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink accepting `state`.
+   */
+  predicate isSink(Node source, FlowState state) { none() }
+
+  /**
+   * Holds if data flow through `node` is prohibited. This completely removes
+   * `node` from the data flow graph.
+   */
+  predicate isBarrier(Node node) { none() }
+
+  /**
+   * Holds if data flow through `node` is prohibited when the flow state is
+   * `state`.
+   */
+  predicate isBarrier(Node node, FlowState state) { none() }
+
+  /** Holds if data flow into `node` is prohibited. */
+  predicate isBarrierIn(Node node) { none() }
+
+  /** Holds if data flow out of `node` is prohibited. */
+  predicate isBarrierOut(Node node) { none() }
+
+  /**
+   * DEPRECATED: Use `isBarrier` and `BarrierGuard` module instead.
+   *
+   * Holds if data flow through nodes guarded by `guard` is prohibited.
+   */
+  deprecated predicate isBarrierGuard(BarrierGuard guard) { none() }
+
+  /**
+   * DEPRECATED: Use `isBarrier` and `BarrierGuard` module instead.
+   *
+   * Holds if data flow through nodes guarded by `guard` is prohibited when
+   * the flow state is `state`
+   */
+  deprecated predicate isBarrierGuard(BarrierGuard guard, FlowState state) { none() }
+
+  /**
+   * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
+   */
+  predicate isAdditionalFlowStep(Node node1, Node node2) { none() }
+
+  /**
+   * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
+   * This step is only applicable in `state1` and updates the flow state to `state2`.
+   */
+  predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
+    none()
+  }
+
+  /**
+   * Holds if an arbitrary number of implicit read steps of content `c` may be
+   * taken at `node`.
+   */
+  predicate allowImplicitRead(Node node, ContentSet c) { none() }
+
+  /**
+   * Gets the virtual dispatch branching limit when calculating field flow.
+   * This can be overridden to a smaller value to improve performance (a
+   * value of 0 disables field flow), or a larger value to get more results.
+   */
+  int fieldFlowBranchLimit() { result = 2 }
+
+  /**
+   * Gets a data flow configuration feature to add restrictions to the set of
+   * valid flow paths.
+   *
+   * - `FeatureHasSourceCallContext`:
+   *    Assume that sources have some existing call context to disallow
+   *    conflicting return-flow directly following the source.
+   * - `FeatureHasSinkCallContext`:
+   *    Assume that sinks have some existing call context to disallow
+   *    conflicting argument-to-parameter flow directly preceding the sink.
+   * - `FeatureEqualSourceSinkCallContext`:
+   *    Implies both of the above and additionally ensures that the entire flow
+   *    path preserves the call context.
+   */
+  FlowFeature getAFeature() { none() }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   */
+  predicate hasFlow(Node source, Node sink) { flowsTo(source, sink, this) }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   *
+   * The corresponding paths are generated from the end-points and the graph
+   * included in the module `PathGraph`.
+   */
+  predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowTo(Node sink) { this.hasFlow(_, sink) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowToExpr(DataFlowExpr sink) { this.hasFlowTo(exprNode(sink)) }
+
+  /**
+   * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
+   * measured in approximate number of interprocedural steps.
+   */
+  int explorationLimit() { none() }
+
+  /**
+   * Holds if hidden nodes should be included in the data flow graph.
+   *
+   * This feature should only be used for debugging or when the data flow graph
+   * is not visualized (for example in a `path-problem` query).
+   */
+  predicate includeHiddenNodes() { none() }
+
+  /**
+   * Holds if there is a partial data flow path from `source` to `node`. The
+   * approximate distance between `node` and the closest source is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards sink definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sources is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   */
+  final predicate hasPartialFlow(PartialPathNode source, PartialPathNode node, int dist) {
+    partialFlow(source, node, this) and
+    dist = node.getSourceDistance()
+  }
+
+  /**
+   * Holds if there is a partial data flow path from `node` to `sink`. The
+   * approximate distance between `node` and the closest sink is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards source definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sinks is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   *
+   * Note that reverse flow has slightly lower precision than the corresponding
+   * forward flow, as reverse flow disregards type pruning among other features.
+   */
+  final predicate hasPartialFlowRev(PartialPathNode node, PartialPathNode sink, int dist) {
+    revPartialFlow(node, sink, this) and
+    dist = node.getSinkDistance()
+  }
+}
+
+/**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ */
+abstract private class ConfigurationRecursionPrevention extends Configuration {
+  bindingset[this]
+  ConfigurationRecursionPrevention() { any() }
+
+  override predicate hasFlow(Node source, Node sink) {
+    strictcount(Node n | this.isSource(n)) < 0
+    or
+    strictcount(Node n | this.isSource(n, _)) < 0
+    or
+    strictcount(Node n | this.isSink(n)) < 0
+    or
+    strictcount(Node n | this.isSink(n, _)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, _, n2, _)) < 0
+    or
+    super.hasFlow(source, sink)
+  }
+}
+
+private newtype TNodeEx =
+  TNodeNormal(Node n) or
+  TNodeImplicitRead(Node n, boolean hasRead) {
+    any(Configuration c).allowImplicitRead(n, _) and hasRead = [false, true]
+  }
+
+private class NodeEx extends TNodeEx {
+  string toString() {
+    result = this.asNode().toString()
+    or
+    exists(Node n | this.isImplicitReadNode(n, _) | result = n.toString() + " [Ext]")
+  }
+
+  Node asNode() { this = TNodeNormal(result) }
+
+  predicate isImplicitReadNode(Node n, boolean hasRead) { this = TNodeImplicitRead(n, hasRead) }
+
+  Node projectToNode() { this = TNodeNormal(result) or this = TNodeImplicitRead(result, _) }
+
+  pragma[nomagic]
+  private DataFlowCallable getEnclosingCallable0() {
+    nodeEnclosingCallable(this.projectToNode(), result)
+  }
+
+  pragma[inline]
+  DataFlowCallable getEnclosingCallable() {
+    pragma[only_bind_out](this).getEnclosingCallable0() = pragma[only_bind_into](result)
+  }
+
+  pragma[nomagic]
+  private DataFlowType getDataFlowType0() { nodeDataFlowType(this.asNode(), result) }
+
+  pragma[inline]
+  DataFlowType getDataFlowType() {
+    pragma[only_bind_out](this).getDataFlowType0() = pragma[only_bind_into](result)
+  }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.projectToNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+private class ArgNodeEx extends NodeEx {
+  ArgNodeEx() { this.asNode() instanceof ArgNode }
+}
+
+private class ParamNodeEx extends NodeEx {
+  ParamNodeEx() { this.asNode() instanceof ParamNode }
+
+  predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) {
+    this.asNode().(ParamNode).isParameterOf(c, pos)
+  }
+
+  ParameterPosition getPosition() { this.isParameterOf(_, result) }
+
+  predicate allowParameterReturnInSelf() { allowParameterReturnInSelfCached(this.asNode()) }
+}
+
+private class RetNodeEx extends NodeEx {
+  RetNodeEx() { this.asNode() instanceof ReturnNodeExt }
+
+  ReturnPosition getReturnPosition() { result = getReturnPosition(this.asNode()) }
+
+  ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
+}
+
+private predicate inBarrier(NodeEx node, Configuration config) {
+  exists(Node n |
+    node.asNode() = n and
+    config.isBarrierIn(n)
+  |
+    config.isSource(n) or config.isSource(n, _)
+  )
+}
+
+private predicate outBarrier(NodeEx node, Configuration config) {
+  exists(Node n |
+    node.asNode() = n and
+    config.isBarrierOut(n)
+  |
+    config.isSink(n) or config.isSink(n, _)
+  )
+}
+
+/** A bridge class to access the deprecated `isBarrierGuard`. */
+private class BarrierGuardGuardedNodeBridge extends Unit {
+  abstract predicate guardedNode(Node n, Configuration config);
+
+  abstract predicate guardedNode(Node n, FlowState state, Configuration config);
+}
+
+private class BarrierGuardGuardedNode extends BarrierGuardGuardedNodeBridge {
+  deprecated override predicate guardedNode(Node n, Configuration config) {
+    exists(BarrierGuard g |
+      config.isBarrierGuard(g) and
+      n = g.getAGuardedNode()
+    )
+  }
+
+  deprecated override predicate guardedNode(Node n, FlowState state, Configuration config) {
+    exists(BarrierGuard g |
+      config.isBarrierGuard(g, state) and
+      n = g.getAGuardedNode()
+    )
+  }
+}
+
+pragma[nomagic]
+private predicate fullBarrier(NodeEx node, Configuration config) {
+  exists(Node n | node.asNode() = n |
+    config.isBarrier(n)
+    or
+    config.isBarrierIn(n) and
+    not config.isSource(n) and
+    not config.isSource(n, _)
+    or
+    config.isBarrierOut(n) and
+    not config.isSink(n) and
+    not config.isSink(n, _)
+    or
+    any(BarrierGuardGuardedNodeBridge b).guardedNode(n, config)
+  )
+}
+
+pragma[nomagic]
+private predicate stateBarrier(NodeEx node, FlowState state, Configuration config) {
+  exists(Node n | node.asNode() = n |
+    config.isBarrier(n, state)
+    or
+    any(BarrierGuardGuardedNodeBridge b).guardedNode(n, state, config)
+  )
+}
+
+pragma[nomagic]
+private predicate sourceNode(NodeEx node, FlowState state, Configuration config) {
+  (
+    config.isSource(node.asNode()) and state instanceof FlowStateEmpty
+    or
+    config.isSource(node.asNode(), state)
+  ) and
+  not fullBarrier(node, config) and
+  not stateBarrier(node, state, config)
+}
+
+pragma[nomagic]
+private predicate sinkNode(NodeEx node, FlowState state, Configuration config) {
+  (
+    config.isSink(node.asNode()) and state instanceof FlowStateEmpty
+    or
+    config.isSink(node.asNode(), state)
+  ) and
+  not fullBarrier(node, config) and
+  not stateBarrier(node, state, config)
+}
+
+/** Provides the relevant barriers for a step from `node1` to `node2`. */
+pragma[inline]
+private predicate stepFilter(NodeEx node1, NodeEx node2, Configuration config) {
+  not outBarrier(node1, config) and
+  not inBarrier(node2, config) and
+  not fullBarrier(node1, config) and
+  not fullBarrier(node2, config)
+}
+
+/**
+ * Holds if data can flow in one local step from `node1` to `node2`.
+ */
+private predicate localFlowStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    simpleLocalFlowStepExt(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    stepFilter(node1, node2, config)
+  )
+  or
+  exists(Node n |
+    config.allowImplicitRead(n, _) and
+    node1.asNode() = n and
+    node2.isImplicitReadNode(n, false) and
+    not fullBarrier(node1, config)
+  )
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` does not jump between callables.
+ */
+private predicate additionalLocalFlowStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config)
+  )
+  or
+  exists(Node n |
+    config.allowImplicitRead(n, _) and
+    node1.isImplicitReadNode(n, true) and
+    node2.asNode() = n and
+    not fullBarrier(node2, config)
+  )
+}
+
+private predicate additionalLocalStateStep(
+  NodeEx node1, FlowState s1, NodeEx node2, FlowState s2, Configuration config
+) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), s1, pragma[only_bind_into](n2), s2) and
+    getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not stateBarrier(node1, s1, config) and
+    not stateBarrier(node2, s2, config)
+  )
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` in a way that discards call contexts.
+ */
+private predicate jumpStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    jumpStepCached(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    stepFilter(node1, node2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` jumps between callables.
+ */
+private predicate additionalJumpStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private predicate additionalJumpStateStep(
+  NodeEx node1, FlowState s1, NodeEx node2, FlowState s2, Configuration config
+) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), s1, pragma[only_bind_into](n2), s2) and
+    getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not stateBarrier(node1, s1, config) and
+    not stateBarrier(node2, s2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+pragma[nomagic]
+private predicate readSet(NodeEx node1, ContentSet c, NodeEx node2, Configuration config) {
+  readSet(pragma[only_bind_into](node1.asNode()), c, pragma[only_bind_into](node2.asNode())) and
+  stepFilter(node1, node2, config)
+  or
+  exists(Node n |
+    node2.isImplicitReadNode(n, true) and
+    node1.isImplicitReadNode(n, _) and
+    config.allowImplicitRead(n, c)
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate read(NodeEx node1, Content c, NodeEx node2, Configuration config) {
+  exists(ContentSet cs |
+    readSet(node1, cs, node2, config) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate clearsContentEx(NodeEx n, Content c) {
+  exists(ContentSet cs |
+    clearsContentCached(n.asNode(), cs) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate expectsContentEx(NodeEx n, Content c) {
+  exists(ContentSet cs |
+    expectsContentCached(n.asNode(), cs) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+pragma[nomagic]
+private predicate notExpectsContent(NodeEx n) { not expectsContentCached(n.asNode(), _) }
+
+pragma[nomagic]
+private predicate store(
+  NodeEx node1, TypedContent tc, NodeEx node2, DataFlowType contentType, Configuration config
+) {
+  store(pragma[only_bind_into](node1.asNode()), tc, pragma[only_bind_into](node2.asNode()),
+    contentType) and
+  read(_, tc.getContent(), _, config) and
+  stepFilter(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutEx(DataFlowCall call, ReturnPosition pos, NodeEx out) {
+  viableReturnPosOut(call, pos, out.asNode())
+}
+
+pragma[nomagic]
+private predicate viableParamArgEx(DataFlowCall call, ParamNodeEx p, ArgNodeEx arg) {
+  viableParamArg(call, p.asNode(), arg.asNode())
+}
+
+/**
+ * Holds if field flow should be used for the given configuration.
+ */
+private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
+
+private predicate hasSourceCallCtx(Configuration config) {
+  exists(FlowFeature feature | feature = config.getAFeature() |
+    feature instanceof FeatureHasSourceCallContext or
+    feature instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private predicate hasSinkCallCtx(Configuration config) {
+  exists(FlowFeature feature | feature = config.getAFeature() |
+    feature instanceof FeatureHasSinkCallContext or
+    feature instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private module Stage1 implements StageSig {
+  class ApApprox = Unit;
+
+  class Ap = Unit;
+
+  class ApOption = Unit;
+
+  class Cc = boolean;
+
+  /* Begin: Stage 1 logic. */
+  /**
+   * Holds if `node` is reachable from a source in the configuration `config`.
+   *
+   * The Boolean `cc` records whether the node is reached through an
+   * argument in a call.
+   */
+  predicate fwdFlow(NodeEx node, Cc cc, Configuration config) {
+    sourceNode(node, _, config) and
+    if hasSourceCallCtx(config) then cc = true else cc = false
+    or
+    exists(NodeEx mid | fwdFlow(mid, cc, config) |
+      localFlowStep(mid, node, config) or
+      additionalLocalFlowStep(mid, node, config) or
+      additionalLocalStateStep(mid, _, node, _, config)
+    )
+    or
+    exists(NodeEx mid | fwdFlow(mid, _, config) and cc = false |
+      jumpStep(mid, node, config) or
+      additionalJumpStep(mid, node, config) or
+      additionalJumpStateStep(mid, _, node, _, config)
+    )
+    or
+    // store
+    exists(NodeEx mid |
+      useFieldFlow(config) and
+      fwdFlow(mid, cc, config) and
+      store(mid, _, node, _, config)
+    )
+    or
+    // read
+    exists(ContentSet c |
+      fwdFlowReadSet(c, node, cc, config) and
+      fwdFlowConsCandSet(c, _, config)
+    )
+    or
+    // flow into a callable
+    exists(NodeEx arg |
+      fwdFlow(arg, _, config) and
+      viableParamArgEx(_, node, arg) and
+      cc = true and
+      not fullBarrier(node, config)
+    )
+    or
+    // flow out of a callable
+    exists(DataFlowCall call |
+      fwdFlowOut(call, node, false, config) and
+      cc = false
+      or
+      fwdFlowOutFromArg(call, node, config) and
+      fwdFlowIsEntered(call, cc, config)
+    )
+  }
+
+  private predicate fwdFlow(NodeEx node, Configuration config) { fwdFlow(node, _, config) }
+
+  pragma[nomagic]
+  private predicate fwdFlowReadSet(ContentSet c, NodeEx node, Cc cc, Configuration config) {
+    exists(NodeEx mid |
+      fwdFlow(mid, cc, config) and
+      readSet(mid, c, node, config)
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a store in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCand(Content c, Configuration config) {
+    exists(NodeEx mid, NodeEx node, TypedContent tc |
+      not fullBarrier(node, config) and
+      useFieldFlow(config) and
+      fwdFlow(mid, _, config) and
+      store(mid, tc, node, _, config) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `cs` may be interpreted in a read as the target of some store
+   * into `c`, in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCandSet(ContentSet cs, Content c, Configuration config) {
+    fwdFlowConsCand(c, config) and
+    c = cs.getAReadContent()
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowReturnPosition(ReturnPosition pos, Cc cc, Configuration config) {
+    exists(RetNodeEx ret |
+      fwdFlow(ret, cc, config) and
+      ret.getReturnPosition() = pos
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOut(DataFlowCall call, NodeEx out, Cc cc, Configuration config) {
+    exists(ReturnPosition pos |
+      fwdFlowReturnPosition(pos, cc, config) and
+      viableReturnPosOutEx(call, pos, out) and
+      not fullBarrier(out, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOutFromArg(DataFlowCall call, NodeEx out, Configuration config) {
+    fwdFlowOut(call, out, true, config)
+  }
+
+  /**
+   * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowIsEntered(DataFlowCall call, Cc cc, Configuration config) {
+    exists(ArgNodeEx arg |
+      fwdFlow(arg, cc, config) and
+      viableParamArgEx(call, _, arg)
+    )
+  }
+
+  private predicate stateStepFwd(FlowState state1, FlowState state2, Configuration config) {
+    exists(NodeEx node1 |
+      additionalLocalStateStep(node1, state1, _, state2, config) or
+      additionalJumpStateStep(node1, state1, _, state2, config)
+    |
+      fwdFlow(node1, config)
+    )
+  }
+
+  private predicate fwdFlowState(FlowState state, Configuration config) {
+    sourceNode(_, state, config)
+    or
+    exists(FlowState state0 |
+      fwdFlowState(state0, config) and
+      stateStepFwd(state0, state, config)
+    )
+  }
+
+  /**
+   * Holds if `node` is part of a path from a source to a sink in the
+   * configuration `config`.
+   *
+   * The Boolean `toReturn` records whether the node must be returned from
+   * the enclosing callable in order to reach a sink.
+   */
+  pragma[nomagic]
+  predicate revFlow(NodeEx node, boolean toReturn, Configuration config) {
+    revFlow0(node, toReturn, config) and
+    fwdFlow(node, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlow0(NodeEx node, boolean toReturn, Configuration config) {
+    exists(FlowState state |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      sinkNode(node, state, config) and
+      fwdFlowState(state, pragma[only_bind_into](config)) and
+      if hasSinkCallCtx(config) then toReturn = true else toReturn = false
+    )
+    or
+    exists(NodeEx mid | revFlow(mid, toReturn, config) |
+      localFlowStep(node, mid, config) or
+      additionalLocalFlowStep(node, mid, config) or
+      additionalLocalStateStep(node, _, mid, _, config)
+    )
+    or
+    exists(NodeEx mid | revFlow(mid, _, config) and toReturn = false |
+      jumpStep(node, mid, config) or
+      additionalJumpStep(node, mid, config) or
+      additionalJumpStateStep(node, _, mid, _, config)
+    )
+    or
+    // store
+    exists(Content c |
+      revFlowStore(c, node, toReturn, config) and
+      revFlowConsCand(c, config)
+    )
+    or
+    // read
+    exists(NodeEx mid, ContentSet c |
+      readSet(node, c, mid, config) and
+      fwdFlowConsCandSet(c, _, pragma[only_bind_into](config)) and
+      revFlow(mid, toReturn, pragma[only_bind_into](config))
+    )
+    or
+    // flow into a callable
+    exists(DataFlowCall call |
+      revFlowIn(call, node, false, config) and
+      toReturn = false
+      or
+      revFlowInToReturn(call, node, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+    or
+    // flow out of a callable
+    exists(ReturnPosition pos |
+      revFlowOut(pos, config) and
+      node.(RetNodeEx).getReturnPosition() = pos and
+      toReturn = true
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a read in the flow covered by `revFlow`.
+   */
+  pragma[nomagic]
+  private predicate revFlowConsCand(Content c, Configuration config) {
+    exists(NodeEx mid, NodeEx node, ContentSet cs |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      readSet(node, cs, mid, config) and
+      fwdFlowConsCandSet(cs, c, pragma[only_bind_into](config)) and
+      revFlow(pragma[only_bind_into](mid), _, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowStore(Content c, NodeEx node, boolean toReturn, Configuration config) {
+    exists(NodeEx mid, TypedContent tc |
+      revFlow(mid, toReturn, pragma[only_bind_into](config)) and
+      fwdFlowConsCand(c, pragma[only_bind_into](config)) and
+      store(node, tc, mid, _, config) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of both a read and a store in the flow covered
+   * by `revFlow`.
+   */
+  pragma[nomagic]
+  predicate revFlowIsReadAndStored(Content c, Configuration conf) {
+    revFlowConsCand(c, conf) and
+    revFlowStore(c, _, _, conf)
+  }
+
+  pragma[nomagic]
+  predicate viableReturnPosOutNodeCandFwd1(
+    DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
+  ) {
+    fwdFlowReturnPosition(pos, _, config) and
+    viableReturnPosOutEx(call, pos, out)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
+    exists(DataFlowCall call, NodeEx out |
+      revFlow(out, _, config) and
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate viableParamArgNodeCandFwd1(
+    DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
+  ) {
+    viableParamArgEx(call, p, arg) and
+    fwdFlow(arg, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowIn(
+    DataFlowCall call, ArgNodeEx arg, boolean toReturn, Configuration config
+  ) {
+    exists(ParamNodeEx p |
+      revFlow(p, toReturn, config) and
+      viableParamArgNodeCandFwd1(call, p, arg, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowInToReturn(DataFlowCall call, ArgNodeEx arg, Configuration config) {
+    revFlowIn(call, arg, true, config)
+  }
+
+  /**
+   * Holds if an output from `call` is reached in the flow covered by `revFlow`
+   * and data might flow through the target callable resulting in reverse flow
+   * reaching an argument of `call`.
+   */
+  pragma[nomagic]
+  private predicate revFlowIsReturned(DataFlowCall call, boolean toReturn, Configuration config) {
+    exists(NodeEx out |
+      revFlow(out, toReturn, config) and
+      fwdFlowOutFromArg(call, out, config)
+    )
+  }
+
+  private predicate stateStepRev(FlowState state1, FlowState state2, Configuration config) {
+    exists(NodeEx node1, NodeEx node2 |
+      additionalLocalStateStep(node1, state1, node2, state2, config) or
+      additionalJumpStateStep(node1, state1, node2, state2, config)
+    |
+      revFlow(node1, _, pragma[only_bind_into](config)) and
+      revFlow(node2, _, pragma[only_bind_into](config)) and
+      fwdFlowState(state1, pragma[only_bind_into](config)) and
+      fwdFlowState(state2, pragma[only_bind_into](config))
+    )
+  }
+
+  predicate revFlowState(FlowState state, Configuration config) {
+    exists(NodeEx node |
+      sinkNode(node, state, config) and
+      revFlow(node, _, pragma[only_bind_into](config)) and
+      fwdFlowState(state, pragma[only_bind_into](config))
+    )
+    or
+    exists(FlowState state0 |
+      revFlowState(state0, config) and
+      stateStepRev(state, state0, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate storeStepCand(
+    NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+    Configuration config
+  ) {
+    exists(Content c |
+      revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      revFlow(node2, pragma[only_bind_into](config)) and
+      store(node1, tc, node2, contentType, config) and
+      c = tc.getContent() and
+      exists(ap1)
+    )
+  }
+
+  pragma[nomagic]
+  predicate readStepCand(NodeEx n1, Content c, NodeEx n2, Configuration config) {
+    revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+    read(n1, c, n2, pragma[only_bind_into](config)) and
+    revFlow(n2, pragma[only_bind_into](config))
+  }
+
+  pragma[nomagic]
+  predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, config) }
+
+  bindingset[node, state, config]
+  predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    revFlow(node, _, pragma[only_bind_into](config)) and
+    exists(state) and
+    exists(ap)
+  }
+
+  private predicate throughFlowNodeCand(NodeEx node, Configuration config) {
+    revFlow(node, true, config) and
+    fwdFlow(node, true, config) and
+    not inBarrier(node, config) and
+    not outBarrier(node, config)
+  }
+
+  /** Holds if flow may return from `callable`. */
+  pragma[nomagic]
+  private predicate returnFlowCallableNodeCand(
+    DataFlowCallable callable, ReturnKindExt kind, Configuration config
+  ) {
+    exists(RetNodeEx ret |
+      throughFlowNodeCand(ret, config) and
+      callable = ret.getEnclosingCallable() and
+      kind = ret.getKind()
+    )
+  }
+
+  /**
+   * Holds if flow may enter through `p` and reach a return node making `p` a
+   * candidate for the origin of a summary.
+   */
+  pragma[nomagic]
+  predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
+    exists(ReturnKindExt kind |
+      throughFlowNodeCand(p, config) and
+      returnFlowCallableNodeCand(c, kind, config) and
+      p.getEnclosingCallable() = c and
+      exists(ap) and
+      // we don't expect a parameter to return stored in itself, unless explicitly allowed
+      (
+        not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
+        or
+        p.allowParameterReturnInSelf()
+      )
+    )
+  }
+
+  pragma[nomagic]
+  predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
+    exists(ArgNodeEx arg, boolean toReturn |
+      revFlow(arg, toReturn, config) and
+      revFlowInToReturn(call, arg, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+  }
+
+  predicate stats(
+    boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
+  ) {
+    fwd = true and
+    nodes = count(NodeEx node | fwdFlow(node, config)) and
+    fields = count(Content f0 | fwdFlowConsCand(f0, config)) and
+    conscand = -1 and
+    states = count(FlowState state | fwdFlowState(state, config)) and
+    tuples = count(NodeEx n, boolean b | fwdFlow(n, b, config))
+    or
+    fwd = false and
+    nodes = count(NodeEx node | revFlow(node, _, config)) and
+    fields = count(Content f0 | revFlowConsCand(f0, config)) and
+    conscand = -1 and
+    states = count(FlowState state | revFlowState(state, config)) and
+    tuples = count(NodeEx n, boolean b | revFlow(n, b, config))
+  }
+  /* End: Stage 1 logic. */
+}
+
+pragma[noinline]
+private predicate localFlowStepNodeCand1(NodeEx node1, NodeEx node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  localFlowStep(node1, node2, config)
+}
+
+pragma[noinline]
+private predicate additionalLocalFlowStepNodeCand1(NodeEx node1, NodeEx node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  additionalLocalFlowStep(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutNodeCand1(
+  DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
+) {
+  Stage1::revFlow(out, config) and
+  Stage1::viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, RetNodeEx ret, NodeEx out, Configuration config
+) {
+  viableReturnPosOutNodeCand1(call, ret.getReturnPosition(), out, config) and
+  Stage1::revFlow(ret, config) and
+  not outBarrier(ret, config) and
+  not inBarrier(out, config)
+}
+
+pragma[nomagic]
+private predicate viableParamArgNodeCand1(
+  DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
+) {
+  Stage1::viableParamArgNodeCandFwd1(call, p, arg, config) and
+  Stage1::revFlow(arg, config)
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, Configuration config
+) {
+  viableParamArgNodeCand1(call, p, arg, config) and
+  Stage1::revFlow(p, config) and
+  not outBarrier(arg, config) and
+  not inBarrier(p, config)
+}
+
+/**
+ * Gets the amount of forward branching on the origin of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int branch(NodeEx n1, Configuration conf) {
+  result =
+    strictcount(NodeEx n |
+      flowOutOfCallNodeCand1(_, n1, n, conf) or flowIntoCallNodeCand1(_, n1, n, conf)
+    )
+}
+
+/**
+ * Gets the amount of backward branching on the target of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int join(NodeEx n2, Configuration conf) {
+  result =
+    strictcount(NodeEx n |
+      flowOutOfCallNodeCand1(_, n, n2, conf) or flowIntoCallNodeCand1(_, n, n2, conf)
+    )
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink. The
+ * `allowsFieldFlow` flag indicates whether the branching is within the limit
+ * specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, ret, out, config) and
+  exists(int b, int j |
+    b = branch(ret, config) and
+    j = join(out, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink. The `allowsFieldFlow` flag indicates whether
+ * the branching is within the limit specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+) {
+  flowIntoCallNodeCand1(call, arg, p, config) and
+  exists(int b, int j |
+    b = branch(arg, config) and
+    j = join(p, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+private signature module StageSig {
+  class Ap;
+
+  predicate revFlow(NodeEx node, Configuration config);
+
+  bindingset[node, state, config]
+  predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config);
+
+  predicate callMayFlowThroughRev(DataFlowCall call, Configuration config);
+
+  predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config);
+
+  predicate storeStepCand(
+    NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+    Configuration config
+  );
+
+  predicate readStepCand(NodeEx n1, Content c, NodeEx n2, Configuration config);
+}
+
+private module MkStage<StageSig PrevStage> {
+  class ApApprox = PrevStage::Ap;
+
+  signature module StageParam {
+    class Ap;
+
+    class ApNil extends Ap;
+
+    bindingset[result, ap]
+    ApApprox getApprox(Ap ap);
+
+    ApNil getApNil(NodeEx node);
+
+    bindingset[tc, tail]
+    Ap apCons(TypedContent tc, Ap tail);
+
+    Content getHeadContent(Ap ap);
+
+    class ApOption;
+
+    ApOption apNone();
+
+    ApOption apSome(Ap ap);
+
+    class Cc;
+
+    class CcCall extends Cc;
+
+    // TODO: member predicate on CcCall
+    predicate matchesCall(CcCall cc, DataFlowCall call);
+
+    class CcNoCall extends Cc;
+
+    Cc ccNone();
+
+    CcCall ccSomeCall();
+
+    class LocalCc;
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc);
+
+    bindingset[call, c, innercc]
+    CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc);
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc);
+
+    bindingset[node1, state1, config]
+    bindingset[node2, state2, config]
+    predicate localStep(
+      NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+      ApNil ap, Configuration config, LocalCc lcc
+    );
+
+    predicate flowOutOfCall(
+      DataFlowCall call, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow, Configuration config
+    );
+
+    predicate flowIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+    );
+
+    bindingset[node, state, ap, config]
+    predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config);
+
+    bindingset[ap, contentType]
+    predicate typecheckStore(Ap ap, DataFlowType contentType);
+  }
+
+  module Stage<StageParam Param> implements StageSig {
+    import Param
+
+    /* Begin: Stage logic. */
+    bindingset[result, apa]
+    private ApApprox unbindApa(ApApprox apa) {
+      pragma[only_bind_out](apa) = pragma[only_bind_out](result)
+    }
+
+    pragma[nomagic]
+    private predicate flowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      Configuration config
+    ) {
+      flowOutOfCall(call, ret, out, allowsFieldFlow, pragma[only_bind_into](config)) and
+      PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(_, ret.getEnclosingCallable(), _,
+        pragma[only_bind_into](config)) and
+      matchesCall(ccc, call)
+    }
+
+    /**
+     * Holds if `node` is reachable with access path `ap` from a source in the
+     * configuration `config`.
+     *
+     * The call context `cc` records whether the node is reached through an
+     * argument in a call, and if so, `argAp` records the access path of that
+     * argument.
+     */
+    pragma[nomagic]
+    predicate fwdFlow(
+      NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      fwdFlow0(node, state, cc, argAp, ap, config) and
+      PrevStage::revFlow(node, state, unbindApa(getApprox(ap)), config) and
+      filter(node, state, ap, config)
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlow0(
+      NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      sourceNode(node, state, config) and
+      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
+      argAp = apNone() and
+      ap = getApNil(node)
+      or
+      exists(NodeEx mid, FlowState state0, Ap ap0, LocalCc localCc |
+        fwdFlow(mid, state0, cc, argAp, ap0, config) and
+        localCc = getLocalCc(mid, cc)
+      |
+        localStep(mid, state0, node, state, true, _, config, localCc) and
+        ap = ap0
+        or
+        localStep(mid, state0, node, state, false, ap, config, localCc) and
+        ap0 instanceof ApNil
+      )
+      or
+      exists(NodeEx mid |
+        fwdFlow(mid, pragma[only_bind_into](state), _, _, ap, pragma[only_bind_into](config)) and
+        jumpStep(mid, node, config) and
+        cc = ccNone() and
+        argAp = apNone()
+      )
+      or
+      exists(NodeEx mid, ApNil nil |
+        fwdFlow(mid, state, _, _, nil, pragma[only_bind_into](config)) and
+        additionalJumpStep(mid, node, config) and
+        cc = ccNone() and
+        argAp = apNone() and
+        ap = getApNil(node)
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(mid, state0, _, _, nil, pragma[only_bind_into](config)) and
+        additionalJumpStateStep(mid, state0, node, state, config) and
+        cc = ccNone() and
+        argAp = apNone() and
+        ap = getApNil(node)
+      )
+      or
+      // store
+      exists(TypedContent tc, Ap ap0 |
+        fwdFlowStore(_, ap0, tc, node, state, cc, argAp, config) and
+        ap = apCons(tc, ap0)
+      )
+      or
+      // read
+      exists(Ap ap0, Content c |
+        fwdFlowRead(ap0, c, _, node, state, cc, argAp, config) and
+        fwdFlowConsCand(ap0, c, ap, config)
+      )
+      or
+      // flow into a callable
+      exists(ApApprox apa |
+        fwdFlowIn(_, node, state, _, cc, _, ap, config) and
+        apa = getApprox(ap) and
+        if PrevStage::parameterMayFlowThrough(node, _, apa, config)
+        then argAp = apSome(ap)
+        else argAp = apNone()
+      )
+      or
+      // flow out of a callable
+      fwdFlowOutNotFromArg(node, state, cc, argAp, ap, config)
+      or
+      exists(DataFlowCall call, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, argAp0, ap, config) and
+        fwdFlowIsEntered(call, cc, argAp, argAp0, config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowStore(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc, ApOption argAp,
+      Configuration config
+    ) {
+      exists(DataFlowType contentType |
+        fwdFlow(node1, state, cc, argAp, ap1, config) and
+        PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
+        typecheckStore(ap1, contentType)
+      )
+    }
+
+    /**
+     * Holds if forward flow with access path `tail` reaches a store of `c`
+     * resulting in access path `cons`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+      exists(TypedContent tc |
+        fwdFlowStore(_, tail, tc, _, _, _, _, config) and
+        tc.getContent() = c and
+        cons = apCons(tc, tail)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowRead(
+      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc, ApOption argAp,
+      Configuration config
+    ) {
+      fwdFlow(node1, state, cc, argAp, ap, config) and
+      PrevStage::readStepCand(node1, c, node2, config) and
+      getHeadContent(ap) = c
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowIn(
+      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, Cc innercc, ApOption argAp,
+      Ap ap, Configuration config
+    ) {
+      exists(ArgNodeEx arg, boolean allowsFieldFlow |
+        fwdFlow(arg, state, outercc, argAp, ap, config) and
+        flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+        innercc = getCallContextCall(call, p.getEnclosingCallable(), outercc) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowOutNotFromArg(
+      NodeEx out, FlowState state, Cc ccOut, ApOption argAp, Ap ap, Configuration config
+    ) {
+      exists(
+        DataFlowCall call, RetNodeEx ret, boolean allowsFieldFlow, CcNoCall innercc,
+        DataFlowCallable inner
+      |
+        fwdFlow(ret, state, innercc, argAp, ap, config) and
+        flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+        inner = ret.getEnclosingCallable() and
+        ccOut = getCallContextReturn(inner, call, innercc) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, Ap argAp, Ap ap, Configuration config
+    ) {
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc |
+        fwdFlow(ret, state, ccc, apSome(argAp), ap, config) and
+        flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    /**
+     * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`
+     * and data might flow through the target callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowIsEntered(
+      DataFlowCall call, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p |
+        fwdFlowIn(call, p, _, cc, _, argAp, ap, config) and
+        PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate storeStepFwd(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, Ap ap2, Configuration config
+    ) {
+      fwdFlowStore(node1, ap1, tc, node2, _, _, _, config) and
+      ap2 = apCons(tc, ap1) and
+      fwdFlowRead(ap2, tc.getContent(), _, _, _, _, _, config)
+    }
+
+    private predicate readStepFwd(
+      NodeEx n1, Ap ap1, Content c, NodeEx n2, Ap ap2, Configuration config
+    ) {
+      fwdFlowRead(ap1, c, n1, n2, _, _, _, config) and
+      fwdFlowConsCand(ap1, c, ap2, config)
+    }
+
+    pragma[nomagic]
+    private predicate callMayFlowThroughFwd(DataFlowCall call, Configuration config) {
+      exists(Ap argAp0, NodeEx out, FlowState state, Cc cc, ApOption argAp, Ap ap |
+        fwdFlow(out, state, pragma[only_bind_into](cc), pragma[only_bind_into](argAp), ap,
+          pragma[only_bind_into](config)) and
+        fwdFlowOutFromArg(call, out, state, argAp0, ap, config) and
+        fwdFlowIsEntered(pragma[only_bind_into](call), pragma[only_bind_into](cc),
+          pragma[only_bind_into](argAp), pragma[only_bind_into](argAp0),
+          pragma[only_bind_into](config))
+      )
+    }
+
+    pragma[nomagic]
+    private predicate flowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+    ) {
+      flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+      fwdFlow(arg, _, _, _, _, pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(p, _, _, pragma[only_bind_into](config)) and
+      callMayFlowThroughFwd(call, pragma[only_bind_into](config))
+    }
+
+    pragma[nomagic]
+    private predicate returnNodeMayFlowThrough(
+      RetNodeEx ret, FlowState state, Ap ap, Configuration config
+    ) {
+      fwdFlow(ret, state, any(CcCall ccc), apSome(_), ap, config)
+    }
+
+    /**
+     * Holds if `node` with access path `ap` is part of a path from a source to a
+     * sink in the configuration `config`.
+     *
+     * The Boolean `toReturn` records whether the node must be returned from the
+     * enclosing callable in order to reach a sink, and if so, `returnAp` records
+     * the access path of the returned value.
+     */
+    pragma[nomagic]
+    predicate revFlow(
+      NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      revFlow0(node, state, toReturn, returnAp, ap, config) and
+      fwdFlow(node, state, _, _, ap, config)
+    }
+
+    pragma[nomagic]
+    private predicate revFlow0(
+      NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      fwdFlow(node, state, _, _, ap, config) and
+      sinkNode(node, state, config) and
+      (if hasSinkCallCtx(config) then toReturn = true else toReturn = false) and
+      returnAp = apNone() and
+      ap instanceof ApNil
+      or
+      exists(NodeEx mid, FlowState state0 |
+        localStep(node, state, mid, state0, true, _, config, _) and
+        revFlow(mid, state0, toReturn, returnAp, ap, config)
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(node, pragma[only_bind_into](state), _, _, ap, pragma[only_bind_into](config)) and
+        localStep(node, pragma[only_bind_into](state), mid, state0, false, _, config, _) and
+        revFlow(mid, state0, toReturn, returnAp, nil, pragma[only_bind_into](config)) and
+        ap instanceof ApNil
+      )
+      or
+      exists(NodeEx mid |
+        jumpStep(node, mid, config) and
+        revFlow(mid, state, _, _, ap, config) and
+        toReturn = false and
+        returnAp = apNone()
+      )
+      or
+      exists(NodeEx mid, ApNil nil |
+        fwdFlow(node, _, _, _, ap, pragma[only_bind_into](config)) and
+        additionalJumpStep(node, mid, config) and
+        revFlow(pragma[only_bind_into](mid), state, _, _, nil, pragma[only_bind_into](config)) and
+        toReturn = false and
+        returnAp = apNone() and
+        ap instanceof ApNil
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(node, _, _, _, ap, pragma[only_bind_into](config)) and
+        additionalJumpStateStep(node, state, mid, state0, config) and
+        revFlow(pragma[only_bind_into](mid), pragma[only_bind_into](state0), _, _, nil,
+          pragma[only_bind_into](config)) and
+        toReturn = false and
+        returnAp = apNone() and
+        ap instanceof ApNil
+      )
+      or
+      // store
+      exists(Ap ap0, Content c |
+        revFlowStore(ap0, c, ap, node, state, _, _, toReturn, returnAp, config) and
+        revFlowConsCand(ap0, c, ap, config)
+      )
+      or
+      // read
+      exists(NodeEx mid, Ap ap0 |
+        revFlow(mid, state, toReturn, returnAp, ap0, config) and
+        readStepFwd(node, ap, _, mid, ap0, config)
+      )
+      or
+      // flow into a callable
+      revFlowInNotToReturn(node, state, returnAp, ap, config) and
+      toReturn = false
+      or
+      exists(DataFlowCall call, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+      or
+      // flow out of a callable
+      revFlowOut(_, node, state, _, _, ap, config) and
+      toReturn = true and
+      if returnNodeMayFlowThrough(node, state, ap, config)
+      then returnAp = apSome(ap)
+      else returnAp = apNone()
+    }
+
+    pragma[nomagic]
+    private predicate revFlowStore(
+      Ap ap0, Content c, Ap ap, NodeEx node, FlowState state, TypedContent tc, NodeEx mid,
+      boolean toReturn, ApOption returnAp, Configuration config
+    ) {
+      revFlow(mid, state, toReturn, returnAp, ap0, config) and
+      storeStepFwd(node, ap, tc, mid, ap0, config) and
+      tc.getContent() = c
+    }
+
+    /**
+     * Holds if reverse flow with access path `tail` reaches a read of `c`
+     * resulting in access path `cons`.
+     */
+    pragma[nomagic]
+    private predicate revFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+      exists(NodeEx mid, Ap tail0 |
+        revFlow(mid, _, _, _, tail, config) and
+        tail = pragma[only_bind_into](tail0) and
+        readStepFwd(_, cons, c, mid, tail0, config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowOut(
+      DataFlowCall call, RetNodeEx ret, FlowState state, boolean toReturn, ApOption returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(NodeEx out, boolean allowsFieldFlow |
+        revFlow(out, state, toReturn, returnAp, ap, config) and
+        flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInNotToReturn(
+      ArgNodeEx arg, FlowState state, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlow(p, state, false, returnAp, ap, config) and
+        flowIntoCall(_, arg, p, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, Ap returnAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlow(p, state, true, apSome(returnAp), ap, config) and
+        flowThroughIntoCall(call, arg, p, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    /**
+     * Holds if an output from `call` is reached in the flow covered by `revFlow`
+     * and data might flow through the target callable resulting in reverse flow
+     * reaching an argument of `call`.
+     */
+    pragma[nomagic]
+    private predicate revFlowIsReturned(
+      DataFlowCall call, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      exists(RetNodeEx ret, FlowState state, CcCall ccc |
+        revFlowOut(call, ret, state, toReturn, returnAp, ap, config) and
+        fwdFlow(ret, state, ccc, apSome(_), ap, config) and
+        matchesCall(ccc, call)
+      )
+    }
+
+    pragma[nomagic]
+    predicate storeStepCand(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+      Configuration config
+    ) {
+      exists(Ap ap2, Content c |
+        PrevStage::storeStepCand(node1, _, tc, node2, contentType, config) and
+        revFlowStore(ap2, c, ap1, node1, _, tc, node2, _, _, config) and
+        revFlowConsCand(ap2, c, ap1, config)
+      )
+    }
+
+    predicate readStepCand(NodeEx node1, Content c, NodeEx node2, Configuration config) {
+      exists(Ap ap1, Ap ap2 |
+        revFlow(node2, _, _, _, pragma[only_bind_into](ap2), pragma[only_bind_into](config)) and
+        readStepFwd(node1, ap1, c, node2, ap2, config) and
+        revFlowStore(ap1, c, pragma[only_bind_into](ap2), _, _, _, _, _, _,
+          pragma[only_bind_into](config))
+      )
+    }
+
+    predicate revFlow(NodeEx node, FlowState state, Configuration config) {
+      revFlow(node, state, _, _, _, config)
+    }
+
+    predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config) {
+      revFlow(node, state, _, _, ap, config)
+    }
+
+    pragma[nomagic]
+    predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
+
+    // use an alias as a workaround for bad functionality-induced joins
+    pragma[nomagic]
+    predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
+
+    // use an alias as a workaround for bad functionality-induced joins
+    pragma[nomagic]
+    predicate revFlowAlias(NodeEx node, FlowState state, Ap ap, Configuration config) {
+      revFlow(node, state, ap, config)
+    }
+
+    private predicate fwdConsCand(TypedContent tc, Ap ap, Configuration config) {
+      storeStepFwd(_, ap, tc, _, _, config)
+    }
+
+    private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
+      storeStepCand(_, ap, tc, _, _, config)
+    }
+
+    private predicate validAp(Ap ap, Configuration config) {
+      revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
+      or
+      exists(TypedContent head, Ap tail |
+        consCand(head, tail, config) and
+        ap = apCons(head, tail)
+      )
+    }
+
+    predicate consCand(TypedContent tc, Ap ap, Configuration config) {
+      revConsCand(tc, ap, config) and
+      validAp(ap, config)
+    }
+
+    pragma[noinline]
+    private predicate parameterFlow(
+      ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
+    ) {
+      revFlow(p, _, true, apSome(ap0), ap, config) and
+      c = p.getEnclosingCallable()
+    }
+
+    predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
+      exists(RetNodeEx ret, FlowState state, Ap ap0, ReturnKindExt kind, ParameterPosition pos |
+        parameterFlow(p, ap, ap0, c, config) and
+        c = ret.getEnclosingCallable() and
+        revFlow(pragma[only_bind_into](ret), pragma[only_bind_into](state), true, apSome(_),
+          pragma[only_bind_into](ap0), pragma[only_bind_into](config)) and
+        fwdFlow(ret, state, any(CcCall ccc), apSome(ap), ap0, config) and
+        kind = ret.getKind() and
+        p.getPosition() = pos and
+        // we don't expect a parameter to return stored in itself, unless explicitly allowed
+        (
+          not kind.(ParamUpdateReturnKind).getPosition() = pos
+          or
+          p.allowParameterReturnInSelf()
+        )
+      )
+    }
+
+    pragma[nomagic]
+    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
+      exists(
+        Ap returnAp0, ArgNodeEx arg, FlowState state, boolean toReturn, ApOption returnAp, Ap ap
+      |
+        revFlow(arg, state, toReturn, returnAp, ap, config) and
+        revFlowInToReturn(call, arg, state, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+    }
+
+    predicate stats(
+      boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
+    ) {
+      fwd = true and
+      nodes = count(NodeEx node | fwdFlow(node, _, _, _, _, config)) and
+      fields = count(TypedContent f0 | fwdConsCand(f0, _, config)) and
+      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
+      states = count(FlowState state | fwdFlow(_, state, _, _, _, config)) and
+      tuples =
+        count(NodeEx n, FlowState state, Cc cc, ApOption argAp, Ap ap |
+          fwdFlow(n, state, cc, argAp, ap, config)
+        )
+      or
+      fwd = false and
+      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
+      fields = count(TypedContent f0 | consCand(f0, _, config)) and
+      conscand = count(TypedContent f0, Ap ap | consCand(f0, ap, config)) and
+      states = count(FlowState state | revFlow(_, state, _, _, _, config)) and
+      tuples =
+        count(NodeEx n, FlowState state, boolean b, ApOption retAp, Ap ap |
+          revFlow(n, state, b, retAp, ap, config)
+        )
+    }
+    /* End: Stage logic. */
+  }
+}
+
+private module BooleanCallContext {
+  class Cc extends boolean {
+    Cc() { this in [true, false] }
+  }
+
+  class CcCall extends Cc {
+    CcCall() { this = true }
+  }
+
+  /** Holds if the call context may be `call`. */
+  predicate matchesCall(CcCall cc, DataFlowCall call) { any() }
+
+  class CcNoCall extends Cc {
+    CcNoCall() { this = false }
+  }
+
+  Cc ccNone() { result = false }
+
+  CcCall ccSomeCall() { result = true }
+
+  class LocalCc = Unit;
+
+  bindingset[node, cc]
+  LocalCc getLocalCc(NodeEx node, Cc cc) { any() }
+
+  bindingset[call, c, outercc]
+  CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) { any() }
+
+  bindingset[call, c, innercc]
+  CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) { any() }
+}
+
+private module Level1CallContext {
+  class Cc = CallContext;
+
+  class CcCall = CallContextCall;
+
+  pragma[inline]
+  predicate matchesCall(CcCall cc, DataFlowCall call) { cc.matchesCall(call) }
+
+  class CcNoCall = CallContextNoCall;
+
+  Cc ccNone() { result instanceof CallContextAny }
+
+  CcCall ccSomeCall() { result instanceof CallContextSomeCall }
+
+  module NoLocalCallContext {
+    class LocalCc = Unit;
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc) { any() }
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+      checkCallContextCall(outercc, call, c) and
+      if recordDataFlowCallSiteDispatch(call, c)
+      then result = TSpecificCall(call)
+      else result = TSomeCall()
+    }
+  }
+
+  module LocalCallContext {
+    class LocalCc = LocalCallContext;
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc) {
+      result =
+        getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
+          node.getEnclosingCallable())
+    }
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+      checkCallContextCall(outercc, call, c) and
+      if recordDataFlowCallSite(call, c) then result = TSpecificCall(call) else result = TSomeCall()
+    }
+  }
+
+  bindingset[call, c, innercc]
+  CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) {
+    checkCallContextReturn(innercc, c, call) and
+    if reducedViableImplInReturn(c, call) then result = TReturn(c, call) else result = ccNone()
+  }
+}
+
+private module Stage2Param implements MkStage<Stage1>::StageParam {
+  private module PrevStage = Stage1;
+
+  class Ap extends boolean {
+    Ap() { this in [true, false] }
+  }
+
+  class ApNil extends Ap {
+    ApNil() { this = false }
+  }
+
+  bindingset[result, ap]
+  PrevStage::Ap getApprox(Ap ap) { any() }
+
+  ApNil getApNil(NodeEx node) { Stage1::revFlow(node, _) and exists(result) }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result = true and exists(tc) and exists(tail) }
+
+  pragma[inline]
+  Content getHeadContent(Ap ap) { exists(result) and ap = true }
+
+  class ApOption = BooleanOption;
+
+  ApOption apNone() { result = TBooleanNone() }
+
+  ApOption apSome(Ap ap) { result = TBooleanSome(ap) }
+
+  import Level1CallContext
+  import NoLocalCallContext
+
+  bindingset[node1, state1, config]
+  bindingset[node2, state2, config]
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    (
+      preservesValue = true and
+      localFlowStepNodeCand1(node1, node2, config) and
+      state1 = state2
+      or
+      preservesValue = false and
+      additionalLocalFlowStepNodeCand1(node1, node2, config) and
+      state1 = state2
+      or
+      preservesValue = false and
+      additionalLocalStateStep(node1, state1, node2, state2, config)
+    ) and
+    exists(ap) and
+    exists(lcc)
+  }
+
+  predicate flowOutOfCall = flowOutOfCallNodeCand1/5;
+
+  predicate flowIntoCall = flowIntoCallNodeCand1/5;
+
+  pragma[nomagic]
+  private predicate expectsContentCand(NodeEx node, Configuration config) {
+    exists(Content c |
+      PrevStage::revFlow(node, pragma[only_bind_into](config)) and
+      PrevStage::revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      expectsContentEx(node, c)
+    )
+  }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    PrevStage::revFlowState(state, pragma[only_bind_into](config)) and
+    exists(ap) and
+    not stateBarrier(node, state, config) and
+    (
+      notExpectsContent(node)
+      or
+      ap = true and
+      expectsContentCand(node, config)
+    )
+  }
+
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+}
+
+private module Stage2 implements StageSig {
+  import MkStage<Stage1>::Stage<Stage2Param>
+}
+
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand2(
+  DataFlowCall call, RetNodeEx node1, NodeEx node2, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlowAlias(node1, pragma[only_bind_into](config))
+}
+
+pragma[nomagic]
+private predicate flowIntoCallNodeCand2(
+  DataFlowCall call, ArgNodeEx node1, ParamNodeEx node2, boolean allowsFieldFlow,
+  Configuration config
+) {
+  flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlowAlias(node1, pragma[only_bind_into](config))
+}
+
+private module LocalFlowBigStep {
+  /**
+   * A node where some checking is required, and hence the big-step relation
+   * is not allowed to step over.
+   */
+  private class FlowCheckNode extends NodeEx {
+    FlowCheckNode() {
+      castNode(this.asNode()) or
+      clearsContentCached(this.asNode(), _) or
+      expectsContentCached(this.asNode(), _)
+    }
+  }
+
+  /**
+   * Holds if `node` can be the first node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowEntry(NodeEx node, FlowState state, Configuration config) {
+    Stage2::revFlow(node, state, config) and
+    (
+      sourceNode(node, state, config)
+      or
+      jumpStep(_, node, config)
+      or
+      additionalJumpStep(_, node, config)
+      or
+      additionalJumpStateStep(_, _, node, state, config)
+      or
+      node instanceof ParamNodeEx
+      or
+      node.asNode() instanceof OutNodeExt
+      or
+      Stage2::storeStepCand(_, _, _, node, _, config)
+      or
+      Stage2::readStepCand(_, _, node, config)
+      or
+      node instanceof FlowCheckNode
+      or
+      exists(FlowState s |
+        additionalLocalStateStep(_, s, node, state, config) and
+        s != state
+      )
+    )
+  }
+
+  /**
+   * Holds if `node` can be the last node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowExit(NodeEx node, FlowState state, Configuration config) {
+    exists(NodeEx next | Stage2::revFlow(next, state, config) |
+      jumpStep(node, next, config) or
+      additionalJumpStep(node, next, config) or
+      flowIntoCallNodeCand1(_, node, next, config) or
+      flowOutOfCallNodeCand1(_, node, next, config) or
+      Stage2::storeStepCand(node, _, _, next, _, config) or
+      Stage2::readStepCand(node, _, next, config)
+    )
+    or
+    exists(NodeEx next, FlowState s | Stage2::revFlow(next, s, config) |
+      additionalJumpStateStep(node, state, next, s, config)
+      or
+      additionalLocalStateStep(node, state, next, s, config) and
+      s != state
+    )
+    or
+    Stage2::revFlow(node, state, config) and
+    node instanceof FlowCheckNode
+    or
+    sinkNode(node, state, config)
+  }
+
+  pragma[noinline]
+  private predicate additionalLocalFlowStepNodeCand2(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, Configuration config
+  ) {
+    additionalLocalFlowStepNodeCand1(node1, node2, config) and
+    state1 = state2 and
+    Stage2::revFlow(node1, pragma[only_bind_into](state1), false, pragma[only_bind_into](config)) and
+    Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false,
+      pragma[only_bind_into](config))
+    or
+    additionalLocalStateStep(node1, state1, node2, state2, config) and
+    Stage2::revFlow(node1, state1, false, pragma[only_bind_into](config)) and
+    Stage2::revFlowAlias(node2, state2, false, pragma[only_bind_into](config))
+  }
+
+  /**
+   * Holds if the local path from `node1` to `node2` is a prefix of a maximal
+   * subsequence of local flow steps in a dataflow path.
+   *
+   * This is the transitive closure of `[additional]localFlowStep` beginning
+   * at `localFlowEntry`.
+   */
+  pragma[nomagic]
+  private predicate localFlowStepPlus(
+    NodeEx node1, FlowState state, NodeEx node2, boolean preservesValue, DataFlowType t,
+    Configuration config, LocalCallContext cc
+  ) {
+    not isUnreachableInCallCached(node2.asNode(), cc.(LocalCallContextSpecificCall).getCall()) and
+    (
+      localFlowEntry(node1, pragma[only_bind_into](state), pragma[only_bind_into](config)) and
+      (
+        localFlowStepNodeCand1(node1, node2, config) and
+        preservesValue = true and
+        t = node1.getDataFlowType() and // irrelevant dummy value
+        Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
+        or
+        additionalLocalFlowStepNodeCand2(node1, state, node2, state, config) and
+        preservesValue = false and
+        t = node2.getDataFlowType()
+      ) and
+      node1 != node2 and
+      cc.relevantFor(node1.getEnclosingCallable()) and
+      not isUnreachableInCallCached(node1.asNode(), cc.(LocalCallContextSpecificCall).getCall())
+      or
+      exists(NodeEx mid |
+        localFlowStepPlus(node1, pragma[only_bind_into](state), mid, preservesValue, t,
+          pragma[only_bind_into](config), cc) and
+        localFlowStepNodeCand1(mid, node2, config) and
+        not mid instanceof FlowCheckNode and
+        Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
+      )
+      or
+      exists(NodeEx mid |
+        localFlowStepPlus(node1, state, mid, _, _, pragma[only_bind_into](config), cc) and
+        additionalLocalFlowStepNodeCand2(mid, state, node2, state, config) and
+        not mid instanceof FlowCheckNode and
+        preservesValue = false and
+        t = node2.getDataFlowType()
+      )
+    )
+  }
+
+  /**
+   * Holds if `node1` can step to `node2` in one or more local steps and this
+   * path can occur as a maximal subsequence of local steps in a dataflow path.
+   */
+  pragma[nomagic]
+  predicate localFlowBigStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    AccessPathFrontNil apf, Configuration config, LocalCallContext callContext
+  ) {
+    localFlowStepPlus(node1, state1, node2, preservesValue, apf.getType(), config, callContext) and
+    localFlowExit(node2, state1, config) and
+    state1 = state2
+    or
+    additionalLocalFlowStepNodeCand2(node1, state1, node2, state2, config) and
+    state1 != state2 and
+    preservesValue = false and
+    apf = TFrontNil(node2.getDataFlowType()) and
+    callContext.relevantFor(node1.getEnclosingCallable()) and
+    not exists(DataFlowCall call | call = callContext.(LocalCallContextSpecificCall).getCall() |
+      isUnreachableInCallCached(node1.asNode(), call) or
+      isUnreachableInCallCached(node2.asNode(), call)
+    )
+  }
+}
+
+private import LocalFlowBigStep
+
+private module Stage3Param implements MkStage<Stage2>::StageParam {
+  private module PrevStage = Stage2;
+
+  class Ap = AccessPathFront;
+
+  class ApNil = AccessPathFrontNil;
+
+  PrevStage::Ap getApprox(Ap ap) { result = ap.toBoolNonEmpty() }
+
+  ApNil getApNil(NodeEx node) {
+    PrevStage::revFlow(node, _) and result = TFrontNil(node.getDataFlowType())
+  }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result.getHead() = tc and exists(tail) }
+
+  pragma[noinline]
+  Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathFrontOption;
+
+  ApOption apNone() { result = TAccessPathFrontNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathFrontSome(ap) }
+
+  import BooleanCallContext
+
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, state1, node2, state2, preservesValue, ap, config, _) and exists(lcc)
+  }
+
+  predicate flowOutOfCall = flowOutOfCallNodeCand2/5;
+
+  predicate flowIntoCall = flowIntoCallNodeCand2/5;
+
+  pragma[nomagic]
+  private predicate clearSet(NodeEx node, ContentSet c, Configuration config) {
+    PrevStage::revFlow(node, config) and
+    clearsContentCached(node.asNode(), c)
+  }
+
+  pragma[nomagic]
+  private predicate clearContent(NodeEx node, Content c, Configuration config) {
+    exists(ContentSet cs |
+      PrevStage::readStepCand(_, pragma[only_bind_into](c), _, pragma[only_bind_into](config)) and
+      c = cs.getAReadContent() and
+      clearSet(node, cs, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate clear(NodeEx node, Ap ap, Configuration config) {
+    clearContent(node, ap.getHead().getContent(), config)
+  }
+
+  pragma[nomagic]
+  private predicate expectsContentCand(NodeEx node, Ap ap, Configuration config) {
+    exists(Content c |
+      PrevStage::revFlow(node, pragma[only_bind_into](config)) and
+      PrevStage::readStepCand(_, c, _, pragma[only_bind_into](config)) and
+      expectsContentEx(node, c) and
+      c = ap.getHead().getContent()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate castingNodeEx(NodeEx node) { node.asNode() instanceof CastingNode }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    exists(state) and
+    exists(config) and
+    not clear(node, ap, config) and
+    (if castingNodeEx(node) then compatibleTypes(node.getDataFlowType(), ap.getType()) else any()) and
+    (
+      notExpectsContent(node)
+      or
+      expectsContentCand(node, ap, config)
+    )
+  }
+
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) {
+    // We need to typecheck stores here, since reverse flow through a getter
+    // might have a different type here compared to inside the getter.
+    compatibleTypes(ap.getType(), contentType)
+  }
+}
+
+private module Stage3 implements StageSig {
+  import MkStage<Stage2>::Stage<Stage3Param>
+}
+
+/**
+ * Holds if `argApf` is recorded as the summary context for flow reaching `node`
+ * and remains relevant for the following pruning stage.
+ */
+private predicate flowCandSummaryCtx(
+  NodeEx node, FlowState state, AccessPathFront argApf, Configuration config
+) {
+  exists(AccessPathFront apf |
+    Stage3::revFlow(node, state, true, _, apf, config) and
+    Stage3::fwdFlow(node, state, any(Stage3::CcCall ccc), TAccessPathFrontSome(argApf), apf, config)
+  )
+}
+
+/**
+ * Holds if a length 2 access path approximation with the head `tc` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen2unfolding(TypedContent tc, Configuration config) {
+  exists(int tails, int nodes, int apLimit, int tupleLimit |
+    tails = strictcount(AccessPathFront apf | Stage3::consCand(tc, apf, config)) and
+    nodes =
+      strictcount(NodeEx n, FlowState state |
+        Stage3::revFlow(n, state, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+        or
+        flowCandSummaryCtx(n, state, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+      ) and
+    accessPathApproxCostLimits(apLimit, tupleLimit) and
+    apLimit < tails and
+    tupleLimit < (tails - 1) * nodes and
+    not tc.forceHighPrecision()
+  )
+}
+
+private newtype TAccessPathApprox =
+  TNil(DataFlowType t) or
+  TConsNil(TypedContent tc, DataFlowType t) {
+    Stage3::consCand(tc, TFrontNil(t), _) and
+    not expensiveLen2unfolding(tc, _)
+  } or
+  TConsCons(TypedContent tc1, TypedContent tc2, int len) {
+    Stage3::consCand(tc1, TFrontHead(tc2), _) and
+    len in [2 .. accessPathLimit()] and
+    not expensiveLen2unfolding(tc1, _)
+  } or
+  TCons1(TypedContent tc, int len) {
+    len in [1 .. accessPathLimit()] and
+    expensiveLen2unfolding(tc, _)
+  }
+
+/**
+ * Conceptually a list of `TypedContent`s followed by a `DataFlowType`, but only
+ * the first two elements of the list and its length are tracked. If data flows
+ * from a source to a given node with a given `AccessPathApprox`, this indicates
+ * the sequence of dereference operations needed to get from the value in the node
+ * to the tracked object. The final type indicates the type of the tracked object.
+ */
+abstract private class AccessPathApprox extends TAccessPathApprox {
+  abstract string toString();
+
+  abstract TypedContent getHead();
+
+  abstract int len();
+
+  abstract DataFlowType getType();
+
+  abstract AccessPathFront getFront();
+
+  /** Gets the access path obtained by popping `head` from this path, if any. */
+  abstract AccessPathApprox pop(TypedContent head);
+}
+
+private class AccessPathApproxNil extends AccessPathApprox, TNil {
+  private DataFlowType t;
+
+  AccessPathApproxNil() { this = TNil(t) }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+
+  override TypedContent getHead() { none() }
+
+  override int len() { result = 0 }
+
+  override DataFlowType getType() { result = t }
+
+  override AccessPathFront getFront() { result = TFrontNil(t) }
+
+  override AccessPathApprox pop(TypedContent head) { none() }
+}
+
+abstract private class AccessPathApproxCons extends AccessPathApprox { }
+
+private class AccessPathApproxConsNil extends AccessPathApproxCons, TConsNil {
+  private TypedContent tc;
+  private DataFlowType t;
+
+  AccessPathApproxConsNil() { this = TConsNil(tc, t) }
+
+  override string toString() {
+    // The `concat` becomes "" if `ppReprType` has no result.
+    result = "[" + tc.toString() + "]" + concat(" : " + ppReprType(t))
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = 1 }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) { head = tc and result = TNil(t) }
+}
+
+private class AccessPathApproxConsCons extends AccessPathApproxCons, TConsCons {
+  private TypedContent tc1;
+  private TypedContent tc2;
+  private int len;
+
+  AccessPathApproxConsCons() { this = TConsCons(tc1, tc2, len) }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + tc1.toString() + ", " + tc2.toString() + "]"
+    else result = "[" + tc1.toString() + ", " + tc2.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc1 }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc1.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc1) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc1 and
+    (
+      result = TConsCons(tc2, _, len - 1)
+      or
+      len = 2 and
+      result = TConsNil(tc2, _)
+      or
+      result = TCons1(tc2, len - 1)
+    )
+  }
+}
+
+private class AccessPathApproxCons1 extends AccessPathApproxCons, TCons1 {
+  private TypedContent tc;
+  private int len;
+
+  AccessPathApproxCons1() { this = TCons1(tc, len) }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + tc.toString() + "]"
+    else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc and
+    (
+      exists(TypedContent tc2 | Stage3::consCand(tc, TFrontHead(tc2), _) |
+        result = TConsCons(tc2, _, len - 1)
+        or
+        len = 2 and
+        result = TConsNil(tc2, _)
+        or
+        result = TCons1(tc2, len - 1)
+      )
+      or
+      exists(DataFlowType t |
+        len = 1 and
+        Stage3::consCand(tc, TFrontNil(t), _) and
+        result = TNil(t)
+      )
+    )
+  }
+}
+
+/** Gets the access path obtained by popping `tc` from `ap`, if any. */
+private AccessPathApprox pop(TypedContent tc, AccessPathApprox apa) { result = apa.pop(tc) }
+
+/** Gets the access path obtained by pushing `tc` onto `ap`. */
+private AccessPathApprox push(TypedContent tc, AccessPathApprox apa) { apa = pop(tc, result) }
+
+private newtype TAccessPathApproxOption =
+  TAccessPathApproxNone() or
+  TAccessPathApproxSome(AccessPathApprox apa)
+
+private class AccessPathApproxOption extends TAccessPathApproxOption {
+  string toString() {
+    this = TAccessPathApproxNone() and result = "<none>"
+    or
+    this = TAccessPathApproxSome(any(AccessPathApprox apa | result = apa.toString()))
+  }
+}
+
+private module Stage4Param implements MkStage<Stage3>::StageParam {
+  private module PrevStage = Stage3;
+
+  class Ap = AccessPathApprox;
+
+  class ApNil = AccessPathApproxNil;
+
+  PrevStage::Ap getApprox(Ap ap) { result = ap.getFront() }
+
+  ApNil getApNil(NodeEx node) {
+    PrevStage::revFlow(node, _) and result = TNil(node.getDataFlowType())
+  }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result = push(tc, tail) }
+
+  pragma[noinline]
+  Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathApproxOption;
+
+  ApOption apNone() { result = TAccessPathApproxNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathApproxSome(ap) }
+
+  import Level1CallContext
+  import LocalCallContext
+
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getFront(), config, lcc)
+  }
+
+  pragma[nomagic]
+  predicate flowOutOfCall(
+    DataFlowCall call, RetNodeEx node1, NodeEx node2, boolean allowsFieldFlow, Configuration config
+  ) {
+    exists(FlowState state |
+      flowOutOfCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+      PrevStage::revFlow(node2, pragma[only_bind_into](state), _, pragma[only_bind_into](config)) and
+      PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  predicate flowIntoCall(
+    DataFlowCall call, ArgNodeEx node1, ParamNodeEx node2, boolean allowsFieldFlow,
+    Configuration config
+  ) {
+    exists(FlowState state |
+      flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+      PrevStage::revFlow(node2, pragma[only_bind_into](state), _, pragma[only_bind_into](config)) and
+      PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) { any() }
+
+  // Type checking is not necessary here as it has already been done in stage 3.
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+}
+
+private module Stage4 = MkStage<Stage3>::Stage<Stage4Param>;
+
+bindingset[conf, result]
+private Configuration unbindConf(Configuration conf) {
+  exists(Configuration c | result = pragma[only_bind_into](c) and conf = pragma[only_bind_into](c))
+}
+
+pragma[nomagic]
+private predicate nodeMayUseSummary0(
+  NodeEx n, DataFlowCallable c, FlowState state, AccessPathApprox apa, Configuration config
+) {
+  exists(AccessPathApprox apa0 |
+    Stage4::parameterMayFlowThrough(_, c, _, _) and
+    Stage4::revFlow(n, state, true, _, apa0, config) and
+    Stage4::fwdFlow(n, state, any(CallContextCall ccc), TAccessPathApproxSome(apa), apa0, config) and
+    n.getEnclosingCallable() = c
+  )
+}
+
+pragma[nomagic]
+private predicate nodeMayUseSummary(
+  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
+) {
+  exists(DataFlowCallable c |
+    Stage4::parameterMayFlowThrough(_, c, apa, config) and
+    nodeMayUseSummary0(n, c, state, apa, config)
+  )
+}
+
+private newtype TSummaryCtx =
+  TSummaryCtxNone() or
+  TSummaryCtxSome(ParamNodeEx p, FlowState state, AccessPath ap) {
+    exists(Configuration config |
+      Stage4::parameterMayFlowThrough(p, _, ap.getApprox(), config) and
+      Stage4::revFlow(p, state, _, config)
+    )
+  }
+
+/**
+ * A context for generating flow summaries. This represents flow entry through
+ * a specific parameter with an access path of a specific shape.
+ *
+ * Summaries are only created for parameters that may flow through.
+ */
+abstract private class SummaryCtx extends TSummaryCtx {
+  abstract string toString();
+}
+
+/** A summary context from which no flow summary can be generated. */
+private class SummaryCtxNone extends SummaryCtx, TSummaryCtxNone {
+  override string toString() { result = "<none>" }
+}
+
+/** A summary context from which a flow summary can be generated. */
+private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
+  private ParamNodeEx p;
+  private FlowState s;
+  private AccessPath ap;
+
+  SummaryCtxSome() { this = TSummaryCtxSome(p, s, ap) }
+
+  ParameterPosition getParameterPos() { p.isParameterOf(_, result) }
+
+  ParamNodeEx getParamNode() { result = p }
+
+  override string toString() { result = p + ": " + ap }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    p.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/**
+ * Gets the number of length 2 access path approximations that correspond to `apa`.
+ */
+private int count1to2unfold(AccessPathApproxCons1 apa, Configuration config) {
+  exists(TypedContent tc, int len |
+    tc = apa.getHead() and
+    len = apa.len() and
+    result =
+      strictcount(AccessPathFront apf |
+        Stage4::consCand(tc, any(AccessPathApprox ap | ap.getFront() = apf and ap.len() = len - 1),
+          config)
+      )
+  )
+}
+
+private int countNodesUsingAccessPath(AccessPathApprox apa, Configuration config) {
+  result =
+    strictcount(NodeEx n, FlowState state |
+      Stage4::revFlow(n, state, apa, config) or nodeMayUseSummary(n, state, apa, config)
+    )
+}
+
+/**
+ * Holds if a length 2 access path approximation matching `apa` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen1to2unfolding(AccessPathApproxCons1 apa, Configuration config) {
+  exists(int aps, int nodes, int apLimit, int tupleLimit |
+    aps = count1to2unfold(apa, config) and
+    nodes = countNodesUsingAccessPath(apa, config) and
+    accessPathCostLimits(apLimit, tupleLimit) and
+    apLimit < aps and
+    tupleLimit < (aps - 1) * nodes
+  )
+}
+
+private AccessPathApprox getATail(AccessPathApprox apa, Configuration config) {
+  exists(TypedContent head |
+    apa.pop(head) = result and
+    Stage4::consCand(head, result, config)
+  )
+}
+
+/**
+ * Holds with `unfold = false` if a precise head-tail representation of `apa` is
+ * expected to be expensive. Holds with `unfold = true` otherwise.
+ */
+private predicate evalUnfold(AccessPathApprox apa, boolean unfold, Configuration config) {
+  if apa.getHead().forceHighPrecision()
+  then unfold = true
+  else
+    exists(int aps, int nodes, int apLimit, int tupleLimit |
+      aps = countPotentialAps(apa, config) and
+      nodes = countNodesUsingAccessPath(apa, config) and
+      accessPathCostLimits(apLimit, tupleLimit) and
+      if apLimit < aps and tupleLimit < (aps - 1) * nodes then unfold = false else unfold = true
+    )
+}
+
+/**
+ * Gets the number of `AccessPath`s that correspond to `apa`.
+ */
+private int countAps(AccessPathApprox apa, Configuration config) {
+  evalUnfold(apa, false, config) and
+  result = 1 and
+  (not apa instanceof AccessPathApproxCons1 or expensiveLen1to2unfolding(apa, config))
+  or
+  evalUnfold(apa, false, config) and
+  result = count1to2unfold(apa, config) and
+  not expensiveLen1to2unfolding(apa, config)
+  or
+  evalUnfold(apa, true, config) and
+  result = countPotentialAps(apa, config)
+}
+
+/**
+ * Gets the number of `AccessPath`s that would correspond to `apa` assuming
+ * that it is expanded to a precise head-tail representation.
+ */
+language[monotonicAggregates]
+private int countPotentialAps(AccessPathApprox apa, Configuration config) {
+  apa instanceof AccessPathApproxNil and result = 1
+  or
+  result = strictsum(AccessPathApprox tail | tail = getATail(apa, config) | countAps(tail, config))
+}
+
+private newtype TAccessPath =
+  TAccessPathNil(DataFlowType t) or
+  TAccessPathCons(TypedContent head, AccessPath tail) {
+    exists(AccessPathApproxCons apa |
+      not evalUnfold(apa, false, _) and
+      head = apa.getHead() and
+      tail.getApprox() = getATail(apa, _)
+    )
+  } or
+  TAccessPathCons2(TypedContent head1, TypedContent head2, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      not expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head1 = apa.getHead() and
+      head2 = getATail(apa, _).getHead()
+    )
+  } or
+  TAccessPathCons1(TypedContent head, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head = apa.getHead()
+    )
+  }
+
+private newtype TPathNode =
+  TPathNodeMid(
+    NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap, Configuration config
+  ) {
+    // A PathNode is introduced by a source ...
+    Stage4::revFlow(node, state, config) and
+    sourceNode(node, state, config) and
+    (
+      if hasSourceCallCtx(config)
+      then cc instanceof CallContextSomeCall
+      else cc instanceof CallContextAny
+    ) and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(node.getDataFlowType())
+    or
+    // ... or a step from an existing PathNode to another node.
+    exists(PathNodeMid mid |
+      pathStep(mid, node, state, cc, sc, ap) and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      Stage4::revFlow(node, state, ap.getApprox(), pragma[only_bind_into](config))
+    )
+  } or
+  TPathNodeSink(NodeEx node, FlowState state, Configuration config) {
+    exists(PathNodeMid sink |
+      sink.isAtSink() and
+      node = sink.getNodeEx() and
+      state = sink.getState() and
+      config = sink.getConfiguration()
+    )
+  }
+
+/**
+ * A list of `TypedContent`s followed by a `DataFlowType`. If data flows from a
+ * source to a given node with a given `AccessPath`, this indicates the sequence
+ * of dereference operations needed to get from the value in the node to the
+ * tracked object. The final type indicates the type of the tracked object.
+ */
+private class AccessPath extends TAccessPath {
+  /** Gets the head of this access path, if any. */
+  abstract TypedContent getHead();
+
+  /** Gets the tail of this access path, if any. */
+  abstract AccessPath getTail();
+
+  /** Gets the front of this access path. */
+  abstract AccessPathFront getFront();
+
+  /** Gets the approximation of this access path. */
+  abstract AccessPathApprox getApprox();
+
+  /** Gets the length of this access path. */
+  abstract int length();
+
+  /** Gets a textual representation of this access path. */
+  abstract string toString();
+
+  /** Gets the access path obtained by popping `tc` from this access path, if any. */
+  final AccessPath pop(TypedContent tc) {
+    result = this.getTail() and
+    tc = this.getHead()
+  }
+
+  /** Gets the access path obtained by pushing `tc` onto this access path. */
+  final AccessPath push(TypedContent tc) { this = result.pop(tc) }
+}
+
+private class AccessPathNil extends AccessPath, TAccessPathNil {
+  private DataFlowType t;
+
+  AccessPathNil() { this = TAccessPathNil(t) }
+
+  DataFlowType getType() { result = t }
+
+  override TypedContent getHead() { none() }
+
+  override AccessPath getTail() { none() }
+
+  override AccessPathFrontNil getFront() { result = TFrontNil(t) }
+
+  override AccessPathApproxNil getApprox() { result = TNil(t) }
+
+  override int length() { result = 0 }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+}
+
+private class AccessPathCons extends AccessPath, TAccessPathCons {
+  private TypedContent head;
+  private AccessPath tail;
+
+  AccessPathCons() { this = TAccessPathCons(head, tail) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() { result = tail }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsNil(head, tail.(AccessPathNil).getType())
+    or
+    result = TConsCons(head, tail.getHead(), this.length())
+    or
+    result = TCons1(head, this.length())
+  }
+
+  override int length() { result = 1 + tail.length() }
+
+  private string toStringImpl(boolean needsSuffix) {
+    exists(DataFlowType t |
+      tail = TAccessPathNil(t) and
+      needsSuffix = false and
+      result = head.toString() + "]" + concat(" : " + ppReprType(t))
+    )
+    or
+    result = head + ", " + tail.(AccessPathCons).toStringImpl(needsSuffix)
+    or
+    exists(TypedContent tc2, TypedContent tc3, int len | tail = TAccessPathCons2(tc2, tc3, len) |
+      result = head + ", " + tc2 + ", " + tc3 + ", ... (" and len > 2 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + ", " + tc3 + "]" and len = 2 and needsSuffix = false
+    )
+    or
+    exists(TypedContent tc2, int len | tail = TAccessPathCons1(tc2, len) |
+      result = head + ", " + tc2 + ", ... (" and len > 1 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + "]" and len = 1 and needsSuffix = false
+    )
+  }
+
+  override string toString() {
+    result = "[" + this.toStringImpl(true) + this.length().toString() + ")]"
+    or
+    result = "[" + this.toStringImpl(false)
+  }
+}
+
+private class AccessPathCons2 extends AccessPath, TAccessPathCons2 {
+  private TypedContent head1;
+  private TypedContent head2;
+  private int len;
+
+  AccessPathCons2() { this = TAccessPathCons2(head1, head2, len) }
+
+  override TypedContent getHead() { result = head1 }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head1, result.getApprox(), _) and
+    result.getHead() = head2 and
+    result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head1) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsCons(head1, head2, len) or
+    result = TCons1(head1, len)
+  }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + head1.toString() + ", " + head2.toString() + "]"
+    else
+      result = "[" + head1.toString() + ", " + head2.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+private class AccessPathCons1 extends AccessPath, TAccessPathCons1 {
+  private TypedContent head;
+  private int len;
+
+  AccessPathCons1() { this = TAccessPathCons1(head, len) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head, result.getApprox(), _) and result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() { result = TCons1(head, len) }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + head.toString() + "]"
+    else result = "[" + head.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+/**
+ * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
+ * Only those `PathNode`s that are reachable from a source are generated.
+ */
+class PathNode extends TPathNode {
+  /** Gets a textual representation of this element. */
+  string toString() { none() }
+
+  /**
+   * Gets a textual representation of this element, including a textual
+   * representation of the call context.
+   */
+  string toStringWithContext() { none() }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    none()
+  }
+
+  /** Gets the underlying `Node`. */
+  final Node getNode() { this.(PathNodeImpl).getNodeEx().projectToNode() = result }
+
+  /** Gets the `FlowState` of this node. */
+  FlowState getState() { none() }
+
+  /** Gets the associated configuration. */
+  Configuration getConfiguration() { none() }
+
+  /** Gets a successor of this node, if any. */
+  final PathNode getASuccessor() {
+    result = this.(PathNodeImpl).getANonHiddenSuccessor() and
+    reach(this) and
+    reach(result)
+  }
+
+  /** Holds if this node is a source. */
+  predicate isSource() { none() }
+}
+
+abstract private class PathNodeImpl extends PathNode {
+  abstract PathNodeImpl getASuccessorImpl();
+
+  private PathNodeImpl getASuccessorIfHidden() {
+    this.isHidden() and
+    result = this.getASuccessorImpl()
+  }
+
+  final PathNodeImpl getANonHiddenSuccessor() {
+    result = this.getASuccessorImpl().getASuccessorIfHidden*() and
+    not this.isHidden() and
+    not result.isHidden()
+  }
+
+  abstract NodeEx getNodeEx();
+
+  predicate isHidden() {
+    not this.getConfiguration().includeHiddenNodes() and
+    (
+      hiddenNode(this.getNodeEx().asNode()) and
+      not this.isSource() and
+      not this instanceof PathNodeSink
+      or
+      this.getNodeEx() instanceof TNodeImplicitRead
+    )
+  }
+
+  private string ppAp() {
+    this instanceof PathNodeSink and result = ""
+    or
+    exists(string s | s = this.(PathNodeMid).getAp().toString() |
+      if s = "" then result = "" else result = " " + s
+    )
+  }
+
+  private string ppCtx() {
+    this instanceof PathNodeSink and result = ""
+    or
+    result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
+  }
+
+  override string toString() { result = this.getNodeEx().toString() + this.ppAp() }
+
+  override string toStringWithContext() {
+    result = this.getNodeEx().toString() + this.ppAp() + this.ppCtx()
+  }
+
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/** Holds if `n` can reach a sink. */
+private predicate directReach(PathNodeImpl n) {
+  n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
+}
+
+/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
+private predicate reach(PathNode n) { directReach(n) or Subpaths::retReach(n) }
+
+/** Holds if `n1.getASuccessor() = n2` and `n2` can reach a sink. */
+private predicate pathSucc(PathNodeImpl n1, PathNode n2) {
+  n1.getANonHiddenSuccessor() = n2 and directReach(n2)
+}
+
+private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
+
+/**
+ * Provides the query predicates needed to include a graph in a path-problem query.
+ */
+module PathGraph {
+  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+  query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }
+
+  /** Holds if `n` is a node in the graph of data flow path explanations. */
+  query predicate nodes(PathNode n, string key, string val) {
+    reach(n) and key = "semmle.label" and val = n.toString()
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {
+    Subpaths::subpaths(arg, par, ret, out) and
+    reach(arg) and
+    reach(par) and
+    reach(ret) and
+    reach(out)
+  }
+}
+
+/**
+ * An intermediate flow graph node. This is a triple consisting of a `Node`,
+ * a `CallContext`, and a `Configuration`.
+ */
+private class PathNodeMid extends PathNodeImpl, TPathNodeMid {
+  NodeEx node;
+  FlowState state;
+  CallContext cc;
+  SummaryCtx sc;
+  AccessPath ap;
+  Configuration config;
+
+  PathNodeMid() { this = TPathNodeMid(node, state, cc, sc, ap, config) }
+
+  override NodeEx getNodeEx() { result = node }
+
+  override FlowState getState() { result = state }
+
+  CallContext getCallContext() { result = cc }
+
+  SummaryCtx getSummaryCtx() { result = sc }
+
+  AccessPath getAp() { result = ap }
+
+  override Configuration getConfiguration() { result = config }
+
+  private PathNodeMid getSuccMid() {
+    pathStep(this, result.getNodeEx(), result.getState(), result.getCallContext(),
+      result.getSummaryCtx(), result.getAp()) and
+    result.getConfiguration() = unbindConf(this.getConfiguration())
+  }
+
+  override PathNodeImpl getASuccessorImpl() {
+    // an intermediate step to another intermediate node
+    result = this.getSuccMid()
+    or
+    // a final step to a sink
+    result = this.getSuccMid().projectToSink()
+  }
+
+  override predicate isSource() {
+    sourceNode(node, state, config) and
+    (
+      if hasSourceCallCtx(config)
+      then cc instanceof CallContextSomeCall
+      else cc instanceof CallContextAny
+    ) and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(node.getDataFlowType())
+  }
+
+  predicate isAtSink() {
+    sinkNode(node, state, config) and
+    ap instanceof AccessPathNil and
+    if hasSinkCallCtx(config)
+    then
+      // For `FeatureHasSinkCallContext` the condition `cc instanceof CallContextNoCall`
+      // is exactly what we need to check. This also implies
+      // `sc instanceof SummaryCtxNone`.
+      // For `FeatureEqualSourceSinkCallContext` the initial call context was
+      // set to `CallContextSomeCall` and jumps are disallowed, so
+      // `cc instanceof CallContextNoCall` never holds. On the other hand,
+      // in this case there's never any need to enter a call except to identify
+      // a summary, so the condition in `pathIntoCallable` enforces this, which
+      // means that `sc instanceof SummaryCtxNone` holds if and only if we are
+      // in the call context of the source.
+      sc instanceof SummaryCtxNone or
+      cc instanceof CallContextNoCall
+    else any()
+  }
+
+  PathNodeSink projectToSink() {
+    this.isAtSink() and
+    result.getNodeEx() = node and
+    result.getState() = state and
+    result.getConfiguration() = unbindConf(config)
+  }
+}
+
+/**
+ * A flow graph node corresponding to a sink. This is disjoint from the
+ * intermediate nodes in order to uniquely correspond to a given sink by
+ * excluding the `CallContext`.
+ */
+private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
+  NodeEx node;
+  FlowState state;
+  Configuration config;
+
+  PathNodeSink() { this = TPathNodeSink(node, state, config) }
+
+  override NodeEx getNodeEx() { result = node }
+
+  override FlowState getState() { result = state }
+
+  override Configuration getConfiguration() { result = config }
+
+  override PathNodeImpl getASuccessorImpl() { none() }
+
+  override predicate isSource() { sourceNode(node, state, config) }
+}
+
+private predicate pathNode(
+  PathNodeMid mid, NodeEx midnode, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap,
+  Configuration conf, LocalCallContext localCC
+) {
+  midnode = mid.getNodeEx() and
+  state = mid.getState() and
+  conf = mid.getConfiguration() and
+  cc = mid.getCallContext() and
+  sc = mid.getSummaryCtx() and
+  localCC =
+    getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
+      midnode.getEnclosingCallable()) and
+  ap = mid.getAp()
+}
+
+/**
+ * Holds if data may flow from `mid` to `node`. The last step in or out of
+ * a callable is recorded by `cc`.
+ */
+pragma[nomagic]
+private predicate pathStep(
+  PathNodeMid mid, NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap
+) {
+  exists(NodeEx midnode, FlowState state0, Configuration conf, LocalCallContext localCC |
+    pathNode(mid, midnode, state0, cc, sc, ap, conf, localCC) and
+    localFlowBigStep(midnode, state0, node, state, true, _, conf, localCC)
+  )
+  or
+  exists(
+    AccessPath ap0, NodeEx midnode, FlowState state0, Configuration conf, LocalCallContext localCC
+  |
+    pathNode(mid, midnode, state0, cc, sc, ap0, conf, localCC) and
+    localFlowBigStep(midnode, state0, node, state, false, ap.getFront(), conf, localCC) and
+    ap0 instanceof AccessPathNil
+  )
+  or
+  jumpStep(mid.getNodeEx(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  ap = mid.getAp()
+  or
+  additionalJumpStep(mid.getNodeEx(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(node.getDataFlowType())
+  or
+  additionalJumpStateStep(mid.getNodeEx(), mid.getState(), node, state, mid.getConfiguration()) and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(node.getDataFlowType())
+  or
+  exists(TypedContent tc | pathStoreStep(mid, node, state, ap.pop(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  exists(TypedContent tc | pathReadStep(mid, node, state, ap.push(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  pathIntoCallable(mid, node, state, _, cc, sc, _, _) and ap = mid.getAp()
+  or
+  pathOutOfCallable(mid, node, state, cc) and ap = mid.getAp() and sc instanceof SummaryCtxNone
+  or
+  pathThroughCallable(mid, node, state, cc, ap) and sc = mid.getSummaryCtx()
+}
+
+pragma[nomagic]
+private predicate pathReadStep(
+  PathNodeMid mid, NodeEx node, FlowState state, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  tc = ap0.getHead() and
+  Stage4::readStepCand(mid.getNodeEx(), tc.getContent(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc = mid.getCallContext()
+}
+
+pragma[nomagic]
+private predicate pathStoreStep(
+  PathNodeMid mid, NodeEx node, FlowState state, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  Stage4::storeStepCand(mid.getNodeEx(), _, tc, node, _, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc = mid.getCallContext()
+}
+
+private predicate pathOutOfCallable0(
+  PathNodeMid mid, ReturnPosition pos, FlowState state, CallContext innercc, AccessPathApprox apa,
+  Configuration config
+) {
+  pos = mid.getNodeEx().(RetNodeEx).getReturnPosition() and
+  state = mid.getState() and
+  innercc = mid.getCallContext() and
+  innercc instanceof CallContextNoCall and
+  apa = mid.getAp().getApprox() and
+  config = mid.getConfiguration()
+}
+
+pragma[nomagic]
+private predicate pathOutOfCallable1(
+  PathNodeMid mid, DataFlowCall call, ReturnKindExt kind, FlowState state, CallContext cc,
+  AccessPathApprox apa, Configuration config
+) {
+  exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+    pathOutOfCallable0(mid, pos, state, innercc, apa, config) and
+    c = pos.getCallable() and
+    kind = pos.getKind() and
+    resolveReturn(innercc, c, call)
+  |
+    if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+  )
+}
+
+pragma[noinline]
+private NodeEx getAnOutNodeFlow(
+  ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config
+) {
+  result.asNode() = kind.getAnOutNode(call) and
+  Stage4::revFlow(result, _, apa, config)
+}
+
+/**
+ * Holds if data may flow from `mid` to `out`. The last step of this path
+ * is a return from a callable and is recorded by `cc`, if needed.
+ */
+pragma[noinline]
+private predicate pathOutOfCallable(PathNodeMid mid, NodeEx out, FlowState state, CallContext cc) {
+  exists(ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config |
+    pathOutOfCallable1(mid, call, kind, state, cc, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
+ */
+pragma[noinline]
+private predicate pathIntoArg(
+  PathNodeMid mid, ParameterPosition ppos, FlowState state, CallContext cc, DataFlowCall call,
+  AccessPath ap, AccessPathApprox apa, Configuration config
+) {
+  exists(ArgNodeEx arg, ArgumentPosition apos |
+    pathNode(mid, arg, state, cc, _, ap, config, _) and
+    arg.asNode().(ArgNode).argumentOf(call, apos) and
+    apa = ap.getApprox() and
+    parameterMatch(ppos, apos)
+  )
+}
+
+pragma[nomagic]
+private predicate parameterCand(
+  DataFlowCallable callable, ParameterPosition pos, AccessPathApprox apa, Configuration config
+) {
+  exists(ParamNodeEx p |
+    Stage4::revFlow(p, _, apa, config) and
+    p.isParameterOf(callable, pos)
+  )
+}
+
+pragma[nomagic]
+private predicate pathIntoCallable0(
+  PathNodeMid mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+  CallContext outercc, DataFlowCall call, AccessPath ap, Configuration config
+) {
+  exists(AccessPathApprox apa |
+    pathIntoArg(mid, pragma[only_bind_into](pos), state, outercc, call, ap,
+      pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+    callable = resolveCall(call, outercc) and
+    parameterCand(callable, pragma[only_bind_into](pos), pragma[only_bind_into](apa),
+      pragma[only_bind_into](config))
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to `p` through `call`. The contexts
+ * before and after entering the callable are `outercc` and `innercc`,
+ * respectively.
+ */
+pragma[nomagic]
+private predicate pathIntoCallable(
+  PathNodeMid mid, ParamNodeEx p, FlowState state, CallContext outercc, CallContextCall innercc,
+  SummaryCtx sc, DataFlowCall call, Configuration config
+) {
+  exists(ParameterPosition pos, DataFlowCallable callable, AccessPath ap |
+    pathIntoCallable0(mid, callable, pos, state, outercc, call, ap, config) and
+    p.isParameterOf(callable, pos) and
+    (
+      sc = TSummaryCtxSome(p, state, ap)
+      or
+      not exists(TSummaryCtxSome(p, state, ap)) and
+      sc = TSummaryCtxNone() and
+      // When the call contexts of source and sink needs to match then there's
+      // never any reason to enter a callable except to find a summary. See also
+      // the comment in `PathNodeMid::isAtSink`.
+      not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+    )
+  |
+    if recordDataFlowCallSite(call, callable)
+    then innercc = TSpecificCall(call)
+    else innercc = TSomeCall()
+  )
+}
+
+/** Holds if data may flow from a parameter given by `sc` to a return of kind `kind`. */
+pragma[nomagic]
+private predicate paramFlowsThrough(
+  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
+  AccessPathApprox apa, Configuration config
+) {
+  exists(PathNodeMid mid, RetNodeEx ret, ParameterPosition pos |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    kind = ret.getKind() and
+    apa = ap.getApprox() and
+    pos = sc.getParameterPos() and
+    // we don't expect a parameter to return stored in itself, unless explicitly allowed
+    (
+      not kind.(ParamUpdateReturnKind).getPosition() = pos
+      or
+      sc.getParamNode().allowParameterReturnInSelf()
+    )
+  )
+}
+
+pragma[nomagic]
+private predicate pathThroughCallable0(
+  DataFlowCall call, PathNodeMid mid, ReturnKindExt kind, FlowState state, CallContext cc,
+  AccessPath ap, AccessPathApprox apa, Configuration config
+) {
+  exists(CallContext innercc, SummaryCtx sc |
+    pathIntoCallable(mid, _, _, cc, innercc, sc, call, config) and
+    paramFlowsThrough(kind, state, innercc, sc, ap, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` through a callable to the node `out`.
+ * The context `cc` is restored to its value prior to entering the callable.
+ */
+pragma[noinline]
+private predicate pathThroughCallable(
+  PathNodeMid mid, NodeEx out, FlowState state, CallContext cc, AccessPath ap
+) {
+  exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa, Configuration config |
+    pathThroughCallable0(call, mid, kind, state, cc, ap, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+private module Subpaths {
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple and `ret` is determined by
+   * `kind`, `sc`, `apout`, and `innercc`.
+   */
+  pragma[nomagic]
+  private predicate subpaths01(
+    PathNodeImpl arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
+    NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    exists(Configuration config |
+      pathThroughCallable(arg, out, pragma[only_bind_into](sout), _, pragma[only_bind_into](apout)) and
+      pathIntoCallable(arg, par, _, _, innercc, sc, _, config) and
+      paramFlowsThrough(kind, pragma[only_bind_into](sout), innercc, sc,
+        pragma[only_bind_into](apout), _, unbindConf(config)) and
+      not arg.isHidden()
+    )
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple and `ret` is determined by
+   * `kind`, `sc`, `sout`, `apout`, and `innercc`.
+   */
+  pragma[nomagic]
+  private predicate subpaths02(
+    PathNode arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
+    NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    subpaths01(arg, par, sc, innercc, kind, out, sout, apout) and
+    out.asNode() = kind.getAnOutNode(_)
+  }
+
+  pragma[nomagic]
+  private Configuration getPathNodeConf(PathNode n) { result = n.getConfiguration() }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple.
+   */
+  pragma[nomagic]
+  private predicate subpaths03(
+    PathNode arg, ParamNodeEx par, PathNodeMid ret, NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    exists(SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind, RetNodeEx retnode |
+      subpaths02(arg, par, sc, innercc, kind, out, sout, apout) and
+      pathNode(ret, retnode, sout, innercc, sc, apout, unbindConf(getPathNodeConf(arg)), _) and
+      kind = retnode.getKind()
+    )
+  }
+
+  private PathNodeImpl localStepToHidden(PathNodeImpl n) {
+    n.getASuccessorImpl() = result and
+    result.isHidden() and
+    exists(NodeEx n1, NodeEx n2 | n1 = n.getNodeEx() and n2 = result.getNodeEx() |
+      localFlowBigStep(n1, _, n2, _, _, _, _, _) or
+      store(n1, _, n2, _, _) or
+      readSet(n1, _, n2, _)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate hasSuccessor(PathNodeImpl pred, PathNodeMid succ, NodeEx succNode) {
+    succ = pred.getANonHiddenSuccessor() and
+    succNode = succ.getNodeEx()
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  predicate subpaths(PathNodeImpl arg, PathNodeImpl par, PathNodeImpl ret, PathNode out) {
+    exists(ParamNodeEx p, NodeEx o, FlowState sout, AccessPath apout, PathNodeMid out0 |
+      pragma[only_bind_into](arg).getANonHiddenSuccessor() = pragma[only_bind_into](out0) and
+      subpaths03(pragma[only_bind_into](arg), p, localStepToHidden*(ret), o, sout, apout) and
+      hasSuccessor(pragma[only_bind_into](arg), par, p) and
+      not ret.isHidden() and
+      pathNode(out0, o, sout, _, _, apout, _, _)
+    |
+      out = out0 or out = out0.projectToSink()
+    )
+  }
+
+  /**
+   * Holds if `n` can reach a return node in a summarized subpath that can reach a sink.
+   */
+  predicate retReach(PathNodeImpl n) {
+    exists(PathNode out | subpaths(_, _, n, out) | directReach(out) or retReach(out))
+    or
+    exists(PathNodeImpl mid |
+      retReach(mid) and
+      n.getANonHiddenSuccessor() = mid and
+      not subpaths(_, mid, _, _)
+    )
+  }
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+private predicate flowsTo(
+  PathNode flowsource, PathNodeSink flowsink, Node source, Node sink, Configuration configuration
+) {
+  flowsource.isSource() and
+  flowsource.getConfiguration() = configuration and
+  flowsource.(PathNodeImpl).getNodeEx().asNode() = source and
+  (flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
+  flowsink.getNodeEx().asNode() = sink
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+predicate flowsTo(Node source, Node sink, Configuration configuration) {
+  flowsTo(_, _, source, sink, configuration)
+}
+
+private predicate finalStats(
+  boolean fwd, int nodes, int fields, int conscand, int states, int tuples
+) {
+  fwd = true and
+  nodes = count(NodeEx n0 | exists(PathNodeImpl pn | pn.getNodeEx() = n0)) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0)) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap)) and
+  states = count(FlowState state | exists(PathNodeMid pn | pn.getState() = state)) and
+  tuples = count(PathNode pn)
+  or
+  fwd = false and
+  nodes = count(NodeEx n0 | exists(PathNodeImpl pn | pn.getNodeEx() = n0 and reach(pn))) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0 and reach(pn))) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap and reach(pn))) and
+  states = count(FlowState state | exists(PathNodeMid pn | pn.getState() = state and reach(pn))) and
+  tuples = count(PathNode pn | reach(pn))
+}
+
+/**
+ * INTERNAL: Only for debugging.
+ *
+ * Calculates per-stage metrics for data flow.
+ */
+predicate stageStats(
+  int n, string stage, int nodes, int fields, int conscand, int states, int tuples,
+  Configuration config
+) {
+  stage = "1 Fwd" and
+  n = 10 and
+  Stage1::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "1 Rev" and
+  n = 15 and
+  Stage1::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "2 Fwd" and
+  n = 20 and
+  Stage2::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "2 Rev" and
+  n = 25 and
+  Stage2::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "3 Fwd" and
+  n = 30 and
+  Stage3::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "3 Rev" and
+  n = 35 and
+  Stage3::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "4 Fwd" and
+  n = 40 and
+  Stage4::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "4 Rev" and
+  n = 45 and
+  Stage4::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "5 Fwd" and n = 50 and finalStats(true, nodes, fields, conscand, states, tuples)
+  or
+  stage = "5 Rev" and n = 55 and finalStats(false, nodes, fields, conscand, states, tuples)
+}
+
+private module FlowExploration {
+  private predicate callableStep(DataFlowCallable c1, DataFlowCallable c2, Configuration config) {
+    exists(NodeEx node1, NodeEx node2 |
+      jumpStep(node1, node2, config)
+      or
+      additionalJumpStep(node1, node2, config)
+      or
+      additionalJumpStateStep(node1, _, node2, _, config)
+      or
+      // flow into callable
+      viableParamArgEx(_, node2, node1)
+      or
+      // flow out of a callable
+      viableReturnPosOutEx(_, node1.(RetNodeEx).getReturnPosition(), node2)
+    |
+      c1 = node1.getEnclosingCallable() and
+      c2 = node2.getEnclosingCallable() and
+      c1 != c2
+    )
+  }
+
+  private predicate interestingCallableSrc(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSource(n) or config.isSource(n, _) | c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSrc(mid, config) and callableStep(mid, c, config)
+    )
+  }
+
+  private predicate interestingCallableSink(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSink(n) or config.isSink(n, _) | c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSink(mid, config) and callableStep(c, mid, config)
+    )
+  }
+
+  private newtype TCallableExt =
+    TCallable(DataFlowCallable c, Configuration config) {
+      interestingCallableSrc(c, config) or
+      interestingCallableSink(c, config)
+    } or
+    TCallableSrc() or
+    TCallableSink()
+
+  private predicate callableExtSrc(TCallableSrc src) { any() }
+
+  private predicate callableExtSink(TCallableSink sink) { any() }
+
+  private predicate callableExtStepFwd(TCallableExt ce1, TCallableExt ce2) {
+    exists(DataFlowCallable c1, DataFlowCallable c2, Configuration config |
+      callableStep(c1, c2, config) and
+      ce1 = TCallable(c1, pragma[only_bind_into](config)) and
+      ce2 = TCallable(c2, pragma[only_bind_into](config))
+    )
+    or
+    exists(Node n, Configuration config |
+      ce1 = TCallableSrc() and
+      (config.isSource(n) or config.isSource(n, _)) and
+      ce2 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+    or
+    exists(Node n, Configuration config |
+      ce2 = TCallableSink() and
+      (config.isSink(n) or config.isSink(n, _)) and
+      ce1 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+  }
+
+  private predicate callableExtStepRev(TCallableExt ce1, TCallableExt ce2) {
+    callableExtStepFwd(ce2, ce1)
+  }
+
+  private int distSrcExt(TCallableExt c) =
+    shortestDistances(callableExtSrc/1, callableExtStepFwd/2)(_, c, result)
+
+  private int distSinkExt(TCallableExt c) =
+    shortestDistances(callableExtSink/1, callableExtStepRev/2)(_, c, result)
+
+  private int distSrc(DataFlowCallable c, Configuration config) {
+    result = distSrcExt(TCallable(c, config)) - 1
+  }
+
+  private int distSink(DataFlowCallable c, Configuration config) {
+    result = distSinkExt(TCallable(c, config)) - 1
+  }
+
+  private newtype TPartialAccessPath =
+    TPartialNil(DataFlowType t) or
+    TPartialCons(TypedContent tc, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `TypedContent`s followed by a `Type`, but only the first
+   * element of the list and its length are tracked. If data flows from a source to
+   * a given node with a given `AccessPath`, this indicates the sequence of
+   * dereference operations needed to get from the value in the node to the
+   * tracked object. The final type indicates the type of the tracked object.
+   */
+  private class PartialAccessPath extends TPartialAccessPath {
+    abstract string toString();
+
+    TypedContent getHead() { this = TPartialCons(result, _) }
+
+    int len() {
+      this = TPartialNil(_) and result = 0
+      or
+      this = TPartialCons(_, result)
+    }
+
+    DataFlowType getType() {
+      this = TPartialNil(result)
+      or
+      exists(TypedContent head | this = TPartialCons(head, _) | result = head.getContainerType())
+    }
+  }
+
+  private class PartialAccessPathNil extends PartialAccessPath, TPartialNil {
+    override string toString() {
+      exists(DataFlowType t | this = TPartialNil(t) | result = concat(": " + ppReprType(t)))
+    }
+  }
+
+  private class PartialAccessPathCons extends PartialAccessPath, TPartialCons {
+    override string toString() {
+      exists(TypedContent tc, int len | this = TPartialCons(tc, len) |
+        if len = 1
+        then result = "[" + tc.toString() + "]"
+        else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private newtype TRevPartialAccessPath =
+    TRevPartialNil() or
+    TRevPartialCons(Content c, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `Content`s, but only the first
+   * element of the list and its length are tracked.
+   */
+  private class RevPartialAccessPath extends TRevPartialAccessPath {
+    abstract string toString();
+
+    Content getHead() { this = TRevPartialCons(result, _) }
+
+    int len() {
+      this = TRevPartialNil() and result = 0
+      or
+      this = TRevPartialCons(_, result)
+    }
+  }
+
+  private class RevPartialAccessPathNil extends RevPartialAccessPath, TRevPartialNil {
+    override string toString() { result = "" }
+  }
+
+  private class RevPartialAccessPathCons extends RevPartialAccessPath, TRevPartialCons {
+    override string toString() {
+      exists(Content c, int len | this = TRevPartialCons(c, len) |
+        if len = 1
+        then result = "[" + c.toString() + "]"
+        else result = "[" + c.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private predicate relevantState(FlowState state) {
+    sourceNode(_, state, _) or
+    sinkNode(_, state, _) or
+    additionalLocalStateStep(_, state, _, _, _) or
+    additionalLocalStateStep(_, _, _, state, _) or
+    additionalJumpStateStep(_, state, _, _, _) or
+    additionalJumpStateStep(_, _, _, state, _)
+  }
+
+  private newtype TSummaryCtx1 =
+    TSummaryCtx1None() or
+    TSummaryCtx1Param(ParamNodeEx p)
+
+  private newtype TSummaryCtx2 =
+    TSummaryCtx2None() or
+    TSummaryCtx2Some(FlowState s) { relevantState(s) }
+
+  private newtype TSummaryCtx3 =
+    TSummaryCtx3None() or
+    TSummaryCtx3Some(PartialAccessPath ap)
+
+  private newtype TRevSummaryCtx1 =
+    TRevSummaryCtx1None() or
+    TRevSummaryCtx1Some(ReturnPosition pos)
+
+  private newtype TRevSummaryCtx2 =
+    TRevSummaryCtx2None() or
+    TRevSummaryCtx2Some(FlowState s) { relevantState(s) }
+
+  private newtype TRevSummaryCtx3 =
+    TRevSummaryCtx3None() or
+    TRevSummaryCtx3Some(RevPartialAccessPath ap)
+
+  private newtype TPartialPathNode =
+    TPartialPathNodeFwd(
+      NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+      TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+    ) {
+      sourceNode(node, state, config) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      sc3 = TSummaryCtx3None() and
+      ap = TPartialNil(node.getDataFlowType()) and
+      exists(config.explorationLimit())
+      or
+      partialPathNodeMk0(node, state, cc, sc1, sc2, sc3, ap, config) and
+      distSrc(node.getEnclosingCallable(), config) <= config.explorationLimit()
+    } or
+    TPartialPathNodeRev(
+      NodeEx node, FlowState state, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2, TRevSummaryCtx3 sc3,
+      RevPartialAccessPath ap, Configuration config
+    ) {
+      sinkNode(node, state, config) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = TRevPartialNil() and
+      exists(config.explorationLimit())
+      or
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
+    }
+
+  pragma[nomagic]
+  private predicate partialPathNodeMk0(
+    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
+  }
+
+  /**
+   * A `Node` augmented with a call context, an access path, and a configuration.
+   */
+  class PartialPathNode extends TPartialPathNode {
+    /** Gets a textual representation of this element. */
+    string toString() { result = this.getNodeEx().toString() + this.ppAp() }
+
+    /**
+     * Gets a textual representation of this element, including a textual
+     * representation of the call context.
+     */
+    string toStringWithContext() {
+      result = this.getNodeEx().toString() + this.ppAp() + this.ppCtx()
+    }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+
+    /** Gets the underlying `Node`. */
+    final Node getNode() { this.getNodeEx().projectToNode() = result }
+
+    FlowState getState() { none() }
+
+    private NodeEx getNodeEx() {
+      result = this.(PartialPathNodeFwd).getNodeEx() or
+      result = this.(PartialPathNodeRev).getNodeEx()
+    }
+
+    /** Gets the associated configuration. */
+    Configuration getConfiguration() { none() }
+
+    /** Gets a successor of this node, if any. */
+    PartialPathNode getASuccessor() { none() }
+
+    /**
+     * Gets the approximate distance to the nearest source measured in number
+     * of interprocedural steps.
+     */
+    int getSourceDistance() {
+      result = distSrc(this.getNodeEx().getEnclosingCallable(), this.getConfiguration())
+    }
+
+    /**
+     * Gets the approximate distance to the nearest sink measured in number
+     * of interprocedural steps.
+     */
+    int getSinkDistance() {
+      result = distSink(this.getNodeEx().getEnclosingCallable(), this.getConfiguration())
+    }
+
+    private string ppAp() {
+      exists(string s |
+        s = this.(PartialPathNodeFwd).getAp().toString() or
+        s = this.(PartialPathNodeRev).getAp().toString()
+      |
+        if s = "" then result = "" else result = " " + s
+      )
+    }
+
+    private string ppCtx() {
+      result = " <" + this.(PartialPathNodeFwd).getCallContext().toString() + ">"
+    }
+
+    /** Holds if this is a source in a forward-flow path. */
+    predicate isFwdSource() { this.(PartialPathNodeFwd).isSource() }
+
+    /** Holds if this is a sink in a reverse-flow path. */
+    predicate isRevSink() { this.(PartialPathNodeRev).isSink() }
+  }
+
+  /**
+   * Provides the query predicates needed to include a graph in a path-problem query.
+   */
+  module PartialPathGraph {
+    /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+    query predicate edges(PartialPathNode a, PartialPathNode b) { a.getASuccessor() = b }
+  }
+
+  private class PartialPathNodeFwd extends PartialPathNode, TPartialPathNodeFwd {
+    NodeEx node;
+    FlowState state;
+    CallContext cc;
+    TSummaryCtx1 sc1;
+    TSummaryCtx2 sc2;
+    TSummaryCtx3 sc3;
+    PartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeFwd() { this = TPartialPathNodeFwd(node, state, cc, sc1, sc2, sc3, ap, config) }
+
+    NodeEx getNodeEx() { result = node }
+
+    override FlowState getState() { result = state }
+
+    CallContext getCallContext() { result = cc }
+
+    TSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    TSummaryCtx3 getSummaryCtx3() { result = sc3 }
+
+    PartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeFwd getASuccessor() {
+      partialPathStep(this, result.getNodeEx(), result.getState(), result.getCallContext(),
+        result.getSummaryCtx1(), result.getSummaryCtx2(), result.getSummaryCtx3(), result.getAp(),
+        result.getConfiguration())
+    }
+
+    predicate isSource() {
+      sourceNode(node, state, config) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      sc3 = TSummaryCtx3None() and
+      ap instanceof TPartialNil
+    }
+  }
+
+  private class PartialPathNodeRev extends PartialPathNode, TPartialPathNodeRev {
+    NodeEx node;
+    FlowState state;
+    TRevSummaryCtx1 sc1;
+    TRevSummaryCtx2 sc2;
+    TRevSummaryCtx3 sc3;
+    RevPartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeRev() { this = TPartialPathNodeRev(node, state, sc1, sc2, sc3, ap, config) }
+
+    NodeEx getNodeEx() { result = node }
+
+    override FlowState getState() { result = state }
+
+    TRevSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TRevSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    TRevSummaryCtx3 getSummaryCtx3() { result = sc3 }
+
+    RevPartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeRev getASuccessor() {
+      revPartialPathStep(result, this.getNodeEx(), this.getState(), this.getSummaryCtx1(),
+        this.getSummaryCtx2(), this.getSummaryCtx3(), this.getAp(), this.getConfiguration())
+    }
+
+    predicate isSink() {
+      sinkNode(node, state, config) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = TRevPartialNil()
+    }
+  }
+
+  private predicate partialPathStep(
+    PartialPathNodeFwd mid, NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1,
+    TSummaryCtx2 sc2, TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    not isUnreachableInCallCached(node.asNode(), cc.(CallContextSpecificCall).getCall()) and
+    (
+      localFlowStep(mid.getNodeEx(), node, config) and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+      or
+      additionalLocalFlowStep(mid.getNodeEx(), node, config) and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(node.getDataFlowType()) and
+      config = mid.getConfiguration()
+      or
+      additionalLocalStateStep(mid.getNodeEx(), mid.getState(), node, state, config) and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(node.getDataFlowType()) and
+      config = mid.getConfiguration()
+    )
+    or
+    jumpStep(mid.getNodeEx(), node, config) and
+    state = mid.getState() and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(mid.getNodeEx(), node, config) and
+    state = mid.getState() and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(node.getDataFlowType()) and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStateStep(mid.getNodeEx(), mid.getState(), node, state, config) and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(node.getDataFlowType()) and
+    config = mid.getConfiguration()
+    or
+    partialPathStoreStep(mid, _, _, node, ap) and
+    state = mid.getState() and
+    cc = mid.getCallContext() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    config = mid.getConfiguration()
+    or
+    exists(PartialAccessPath ap0, TypedContent tc |
+      partialPathReadStep(mid, ap0, tc, node, cc, config) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      apConsFwd(ap, tc, ap0, config)
+    )
+    or
+    partialPathIntoCallable(mid, node, state, _, cc, sc1, sc2, sc3, _, ap, config)
+    or
+    partialPathOutOfCallable(mid, node, state, cc, ap, config) and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None()
+    or
+    partialPathThroughCallable(mid, node, state, cc, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3()
+  }
+
+  bindingset[result, i]
+  private int unbindInt(int i) { pragma[only_bind_out](i) = pragma[only_bind_out](result) }
+
+  pragma[inline]
+  private predicate partialPathStoreStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap1, TypedContent tc, NodeEx node,
+    PartialAccessPath ap2
+  ) {
+    exists(NodeEx midNode, DataFlowType contentType |
+      midNode = mid.getNodeEx() and
+      ap1 = mid.getAp() and
+      store(midNode, tc, node, contentType, mid.getConfiguration()) and
+      ap2.getHead() = tc and
+      ap2.len() = unbindInt(ap1.len() + 1) and
+      compatibleTypes(ap1.getType(), contentType)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsFwd(
+    PartialAccessPath ap1, TypedContent tc, PartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStoreStep(mid, ap1, tc, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathReadStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap, TypedContent tc, NodeEx node, CallContext cc,
+    Configuration config
+  ) {
+    exists(NodeEx midNode |
+      midNode = mid.getNodeEx() and
+      ap = mid.getAp() and
+      read(midNode, tc.getContent(), node, pragma[only_bind_into](config)) and
+      ap.getHead() = tc and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      cc = mid.getCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable0(
+    PartialPathNodeFwd mid, ReturnPosition pos, FlowState state, CallContext innercc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    pos = mid.getNodeEx().(RetNodeEx).getReturnPosition() and
+    state = mid.getState() and
+    innercc = mid.getCallContext() and
+    innercc instanceof CallContextNoCall and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+  }
+
+  pragma[nomagic]
+  private predicate partialPathOutOfCallable1(
+    PartialPathNodeFwd mid, DataFlowCall call, ReturnKindExt kind, FlowState state, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+      partialPathOutOfCallable0(mid, pos, state, innercc, ap, config) and
+      c = pos.getCallable() and
+      kind = pos.getKind() and
+      resolveReturn(innercc, c, call)
+    |
+      if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable(
+    PartialPathNodeFwd mid, NodeEx out, FlowState state, CallContext cc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(ReturnKindExt kind, DataFlowCall call |
+      partialPathOutOfCallable1(mid, call, kind, state, cc, ap, config)
+    |
+      out.asNode() = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathIntoArg(
+    PartialPathNodeFwd mid, ParameterPosition ppos, FlowState state, CallContext cc,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ArgNode arg, ArgumentPosition apos |
+      arg = mid.getNodeEx().asNode() and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      arg.argumentOf(call, apos) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration() and
+      parameterMatch(ppos, apos)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathIntoCallable0(
+    PartialPathNodeFwd mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+    CallContext outercc, DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    partialPathIntoArg(mid, pos, state, outercc, call, ap, config) and
+    callable = resolveCall(call, outercc)
+  }
+
+  private predicate partialPathIntoCallable(
+    PartialPathNodeFwd mid, ParamNodeEx p, FlowState state, CallContext outercc,
+    CallContextCall innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ParameterPosition pos, DataFlowCallable callable |
+      partialPathIntoCallable0(mid, callable, pos, state, outercc, call, ap, config) and
+      p.isParameterOf(callable, pos) and
+      sc1 = TSummaryCtx1Param(p) and
+      sc2 = TSummaryCtx2Some(state) and
+      sc3 = TSummaryCtx3Some(ap)
+    |
+      if recordDataFlowCallSite(call, callable)
+      then innercc = TSpecificCall(call)
+      else innercc = TSomeCall()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate paramFlowsThroughInPartialPath(
+    ReturnKindExt kind, FlowState state, CallContextCall cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid, RetNodeEx ret |
+      mid.getNodeEx() = ret and
+      kind = ret.getKind() and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      config = mid.getConfiguration() and
+      ap = mid.getAp()
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeFwd mid, ReturnKindExt kind, FlowState state, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(CallContext innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3 |
+      partialPathIntoCallable(mid, _, _, cc, innercc, sc1, sc2, sc3, call, _, config) and
+      paramFlowsThroughInPartialPath(kind, state, innercc, sc1, sc2, sc3, ap, config)
+    )
+  }
+
+  private predicate partialPathThroughCallable(
+    PartialPathNodeFwd mid, NodeEx out, FlowState state, CallContext cc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(DataFlowCall call, ReturnKindExt kind |
+      partialPathThroughCallable0(call, mid, kind, state, cc, ap, config) and
+      out.asNode() = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStep(
+    PartialPathNodeRev mid, NodeEx node, FlowState state, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2,
+    TRevSummaryCtx3 sc3, RevPartialAccessPath ap, Configuration config
+  ) {
+    localFlowStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalFlowStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalStateStep(node, state, mid.getNodeEx(), mid.getState(), config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    jumpStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStateStep(node, state, mid.getNodeEx(), mid.getState(), config) and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    revPartialPathReadStep(mid, _, _, node, ap) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    config = mid.getConfiguration()
+    or
+    exists(RevPartialAccessPath ap0, Content c |
+      revPartialPathStoreStep(mid, ap0, c, node, config) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      apConsRev(ap, c, ap0, config)
+    )
+    or
+    exists(ParamNodeEx p |
+      mid.getNodeEx() = p and
+      viableParamArgEx(_, p, node) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+    or
+    exists(ReturnPosition pos |
+      revPartialPathIntoReturn(mid, pos, state, sc1, sc2, sc3, _, ap, config) and
+      pos = getReturnPosition(node.asNode())
+    )
+    or
+    revPartialPathThroughCallable(mid, node, state, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3()
+  }
+
+  pragma[inline]
+  private predicate revPartialPathReadStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap1, Content c, NodeEx node,
+    RevPartialAccessPath ap2
+  ) {
+    exists(NodeEx midNode |
+      midNode = mid.getNodeEx() and
+      ap1 = mid.getAp() and
+      read(node, c, midNode, mid.getConfiguration()) and
+      ap2.getHead() = c and
+      ap2.len() = unbindInt(ap1.len() + 1)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsRev(
+    RevPartialAccessPath ap1, Content c, RevPartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid |
+      revPartialPathReadStep(mid, ap1, c, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStoreStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap, Content c, NodeEx node, Configuration config
+  ) {
+    exists(NodeEx midNode, TypedContent tc |
+      midNode = mid.getNodeEx() and
+      ap = mid.getAp() and
+      store(node, tc, midNode, _, config) and
+      ap.getHead() = c and
+      config = mid.getConfiguration() and
+      tc.getContent() = c
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathIntoReturn(
+    PartialPathNodeRev mid, ReturnPosition pos, FlowState state, TRevSummaryCtx1Some sc1,
+    TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3, DataFlowCall call, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(NodeEx out |
+      mid.getNodeEx() = out and
+      mid.getState() = state and
+      viableReturnPosOutEx(call, pos, out) and
+      sc1 = TRevSummaryCtx1Some(pos) and
+      sc2 = TRevSummaryCtx2Some(state) and
+      sc3 = TRevSummaryCtx3Some(ap) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathFlowsThrough(
+    ArgumentPosition apos, FlowState state, TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2,
+    TRevSummaryCtx3Some sc3, RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid, ParamNodeEx p, ParameterPosition ppos |
+      mid.getNodeEx() = p and
+      mid.getState() = state and
+      p.getPosition() = ppos and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration() and
+      parameterMatch(ppos, apos)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeRev mid, ArgumentPosition pos, FlowState state,
+    RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3 |
+      revPartialPathIntoReturn(mid, _, _, sc1, sc2, sc3, call, _, config) and
+      revPartialPathFlowsThrough(pos, state, sc1, sc2, sc3, ap, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable(
+    PartialPathNodeRev mid, ArgNodeEx node, FlowState state, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(DataFlowCall call, ArgumentPosition pos |
+      revPartialPathThroughCallable0(call, mid, pos, state, ap, config) and
+      node.asNode().(ArgNode).argumentOf(call, pos)
+    )
+  }
+}
+
+import FlowExploration
+
+private predicate partialFlow(
+  PartialPathNode source, PartialPathNode node, Configuration configuration
+) {
+  source.getConfiguration() = configuration and
+  source.isFwdSource() and
+  node = source.getASuccessor+()
+}
+
+private predicate revPartialFlow(
+  PartialPathNode node, PartialPathNode sink, Configuration configuration
+) {
+  sink.getConfiguration() = configuration and
+  sink.isRevSink() and
+  node.getASuccessor+() = sink
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
new file mode 100644
index 00000000000..468f8640a78
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
@@ -0,0 +1,4450 @@
+/**
+ * Provides an implementation of global (interprocedural) data flow. This file
+ * re-exports the local (intraprocedural) data flow analysis from
+ * `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
+ * through the `Configuration` class. This file exists in several identical
+ * copies, allowing queries to use multiple `Configuration` classes that depend
+ * on each other without introducing mutual recursion among those configurations.
+ */
+
+private import DataFlowImplCommon
+private import DataFlowImplSpecific::Private
+import DataFlowImplSpecific::Public
+import DataFlowImplCommonPublic
+
+/**
+ * A configuration of interprocedural data flow analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the global data flow library must define its own unique extension
+ * of this abstract class. To create a configuration, extend this class with
+ * a subclass whose characteristic predicate is a unique singleton string.
+ * For example, write
+ *
+ * ```ql
+ * class MyAnalysisConfiguration extends DataFlow::Configuration {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Optionally override `isBarrier`.
+ *   // Optionally override `isAdditionalFlowStep`.
+ * }
+ * ```
+ * Conceptually, this defines a graph where the nodes are `DataFlow::Node`s and
+ * the edges are those data-flow steps that preserve the value of the node
+ * along with any additional edges defined by `isAdditionalFlowStep`.
+ * Specifying nodes in `isBarrier` will remove those nodes from the graph, and
+ * specifying nodes in `isBarrierIn` and/or `isBarrierOut` will remove in-going
+ * and/or out-going edges from those nodes, respectively.
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```ql
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but two classes extending
+ * `DataFlow::Configuration` should never depend on each other. One of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`.
+ */
+abstract class Configuration extends string {
+  bindingset[this]
+  Configuration() { any() }
+
+  /**
+   * Holds if `source` is a relevant data flow source.
+   */
+  predicate isSource(Node source) { none() }
+
+  /**
+   * Holds if `source` is a relevant data flow source with the given initial
+   * `state`.
+   */
+  predicate isSource(Node source, FlowState state) { none() }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink.
+   */
+  predicate isSink(Node sink) { none() }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink accepting `state`.
+   */
+  predicate isSink(Node source, FlowState state) { none() }
+
+  /**
+   * Holds if data flow through `node` is prohibited. This completely removes
+   * `node` from the data flow graph.
+   */
+  predicate isBarrier(Node node) { none() }
+
+  /**
+   * Holds if data flow through `node` is prohibited when the flow state is
+   * `state`.
+   */
+  predicate isBarrier(Node node, FlowState state) { none() }
+
+  /** Holds if data flow into `node` is prohibited. */
+  predicate isBarrierIn(Node node) { none() }
+
+  /** Holds if data flow out of `node` is prohibited. */
+  predicate isBarrierOut(Node node) { none() }
+
+  /**
+   * DEPRECATED: Use `isBarrier` and `BarrierGuard` module instead.
+   *
+   * Holds if data flow through nodes guarded by `guard` is prohibited.
+   */
+  deprecated predicate isBarrierGuard(BarrierGuard guard) { none() }
+
+  /**
+   * DEPRECATED: Use `isBarrier` and `BarrierGuard` module instead.
+   *
+   * Holds if data flow through nodes guarded by `guard` is prohibited when
+   * the flow state is `state`
+   */
+  deprecated predicate isBarrierGuard(BarrierGuard guard, FlowState state) { none() }
+
+  /**
+   * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
+   */
+  predicate isAdditionalFlowStep(Node node1, Node node2) { none() }
+
+  /**
+   * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
+   * This step is only applicable in `state1` and updates the flow state to `state2`.
+   */
+  predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
+    none()
+  }
+
+  /**
+   * Holds if an arbitrary number of implicit read steps of content `c` may be
+   * taken at `node`.
+   */
+  predicate allowImplicitRead(Node node, ContentSet c) { none() }
+
+  /**
+   * Gets the virtual dispatch branching limit when calculating field flow.
+   * This can be overridden to a smaller value to improve performance (a
+   * value of 0 disables field flow), or a larger value to get more results.
+   */
+  int fieldFlowBranchLimit() { result = 2 }
+
+  /**
+   * Gets a data flow configuration feature to add restrictions to the set of
+   * valid flow paths.
+   *
+   * - `FeatureHasSourceCallContext`:
+   *    Assume that sources have some existing call context to disallow
+   *    conflicting return-flow directly following the source.
+   * - `FeatureHasSinkCallContext`:
+   *    Assume that sinks have some existing call context to disallow
+   *    conflicting argument-to-parameter flow directly preceding the sink.
+   * - `FeatureEqualSourceSinkCallContext`:
+   *    Implies both of the above and additionally ensures that the entire flow
+   *    path preserves the call context.
+   */
+  FlowFeature getAFeature() { none() }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   */
+  predicate hasFlow(Node source, Node sink) { flowsTo(source, sink, this) }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   *
+   * The corresponding paths are generated from the end-points and the graph
+   * included in the module `PathGraph`.
+   */
+  predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowTo(Node sink) { this.hasFlow(_, sink) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowToExpr(DataFlowExpr sink) { this.hasFlowTo(exprNode(sink)) }
+
+  /**
+   * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
+   * measured in approximate number of interprocedural steps.
+   */
+  int explorationLimit() { none() }
+
+  /**
+   * Holds if hidden nodes should be included in the data flow graph.
+   *
+   * This feature should only be used for debugging or when the data flow graph
+   * is not visualized (for example in a `path-problem` query).
+   */
+  predicate includeHiddenNodes() { none() }
+
+  /**
+   * Holds if there is a partial data flow path from `source` to `node`. The
+   * approximate distance between `node` and the closest source is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards sink definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sources is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   */
+  final predicate hasPartialFlow(PartialPathNode source, PartialPathNode node, int dist) {
+    partialFlow(source, node, this) and
+    dist = node.getSourceDistance()
+  }
+
+  /**
+   * Holds if there is a partial data flow path from `node` to `sink`. The
+   * approximate distance between `node` and the closest sink is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards source definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sinks is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   *
+   * Note that reverse flow has slightly lower precision than the corresponding
+   * forward flow, as reverse flow disregards type pruning among other features.
+   */
+  final predicate hasPartialFlowRev(PartialPathNode node, PartialPathNode sink, int dist) {
+    revPartialFlow(node, sink, this) and
+    dist = node.getSinkDistance()
+  }
+}
+
+/**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ */
+abstract private class ConfigurationRecursionPrevention extends Configuration {
+  bindingset[this]
+  ConfigurationRecursionPrevention() { any() }
+
+  override predicate hasFlow(Node source, Node sink) {
+    strictcount(Node n | this.isSource(n)) < 0
+    or
+    strictcount(Node n | this.isSource(n, _)) < 0
+    or
+    strictcount(Node n | this.isSink(n)) < 0
+    or
+    strictcount(Node n | this.isSink(n, _)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, _, n2, _)) < 0
+    or
+    super.hasFlow(source, sink)
+  }
+}
+
+private newtype TNodeEx =
+  TNodeNormal(Node n) or
+  TNodeImplicitRead(Node n, boolean hasRead) {
+    any(Configuration c).allowImplicitRead(n, _) and hasRead = [false, true]
+  }
+
+private class NodeEx extends TNodeEx {
+  string toString() {
+    result = this.asNode().toString()
+    or
+    exists(Node n | this.isImplicitReadNode(n, _) | result = n.toString() + " [Ext]")
+  }
+
+  Node asNode() { this = TNodeNormal(result) }
+
+  predicate isImplicitReadNode(Node n, boolean hasRead) { this = TNodeImplicitRead(n, hasRead) }
+
+  Node projectToNode() { this = TNodeNormal(result) or this = TNodeImplicitRead(result, _) }
+
+  pragma[nomagic]
+  private DataFlowCallable getEnclosingCallable0() {
+    nodeEnclosingCallable(this.projectToNode(), result)
+  }
+
+  pragma[inline]
+  DataFlowCallable getEnclosingCallable() {
+    pragma[only_bind_out](this).getEnclosingCallable0() = pragma[only_bind_into](result)
+  }
+
+  pragma[nomagic]
+  private DataFlowType getDataFlowType0() { nodeDataFlowType(this.asNode(), result) }
+
+  pragma[inline]
+  DataFlowType getDataFlowType() {
+    pragma[only_bind_out](this).getDataFlowType0() = pragma[only_bind_into](result)
+  }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.projectToNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+private class ArgNodeEx extends NodeEx {
+  ArgNodeEx() { this.asNode() instanceof ArgNode }
+}
+
+private class ParamNodeEx extends NodeEx {
+  ParamNodeEx() { this.asNode() instanceof ParamNode }
+
+  predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) {
+    this.asNode().(ParamNode).isParameterOf(c, pos)
+  }
+
+  ParameterPosition getPosition() { this.isParameterOf(_, result) }
+
+  predicate allowParameterReturnInSelf() { allowParameterReturnInSelfCached(this.asNode()) }
+}
+
+private class RetNodeEx extends NodeEx {
+  RetNodeEx() { this.asNode() instanceof ReturnNodeExt }
+
+  ReturnPosition getReturnPosition() { result = getReturnPosition(this.asNode()) }
+
+  ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
+}
+
+private predicate inBarrier(NodeEx node, Configuration config) {
+  exists(Node n |
+    node.asNode() = n and
+    config.isBarrierIn(n)
+  |
+    config.isSource(n) or config.isSource(n, _)
+  )
+}
+
+private predicate outBarrier(NodeEx node, Configuration config) {
+  exists(Node n |
+    node.asNode() = n and
+    config.isBarrierOut(n)
+  |
+    config.isSink(n) or config.isSink(n, _)
+  )
+}
+
+/** A bridge class to access the deprecated `isBarrierGuard`. */
+private class BarrierGuardGuardedNodeBridge extends Unit {
+  abstract predicate guardedNode(Node n, Configuration config);
+
+  abstract predicate guardedNode(Node n, FlowState state, Configuration config);
+}
+
+private class BarrierGuardGuardedNode extends BarrierGuardGuardedNodeBridge {
+  deprecated override predicate guardedNode(Node n, Configuration config) {
+    exists(BarrierGuard g |
+      config.isBarrierGuard(g) and
+      n = g.getAGuardedNode()
+    )
+  }
+
+  deprecated override predicate guardedNode(Node n, FlowState state, Configuration config) {
+    exists(BarrierGuard g |
+      config.isBarrierGuard(g, state) and
+      n = g.getAGuardedNode()
+    )
+  }
+}
+
+pragma[nomagic]
+private predicate fullBarrier(NodeEx node, Configuration config) {
+  exists(Node n | node.asNode() = n |
+    config.isBarrier(n)
+    or
+    config.isBarrierIn(n) and
+    not config.isSource(n) and
+    not config.isSource(n, _)
+    or
+    config.isBarrierOut(n) and
+    not config.isSink(n) and
+    not config.isSink(n, _)
+    or
+    any(BarrierGuardGuardedNodeBridge b).guardedNode(n, config)
+  )
+}
+
+pragma[nomagic]
+private predicate stateBarrier(NodeEx node, FlowState state, Configuration config) {
+  exists(Node n | node.asNode() = n |
+    config.isBarrier(n, state)
+    or
+    any(BarrierGuardGuardedNodeBridge b).guardedNode(n, state, config)
+  )
+}
+
+pragma[nomagic]
+private predicate sourceNode(NodeEx node, FlowState state, Configuration config) {
+  (
+    config.isSource(node.asNode()) and state instanceof FlowStateEmpty
+    or
+    config.isSource(node.asNode(), state)
+  ) and
+  not fullBarrier(node, config) and
+  not stateBarrier(node, state, config)
+}
+
+pragma[nomagic]
+private predicate sinkNode(NodeEx node, FlowState state, Configuration config) {
+  (
+    config.isSink(node.asNode()) and state instanceof FlowStateEmpty
+    or
+    config.isSink(node.asNode(), state)
+  ) and
+  not fullBarrier(node, config) and
+  not stateBarrier(node, state, config)
+}
+
+/** Provides the relevant barriers for a step from `node1` to `node2`. */
+pragma[inline]
+private predicate stepFilter(NodeEx node1, NodeEx node2, Configuration config) {
+  not outBarrier(node1, config) and
+  not inBarrier(node2, config) and
+  not fullBarrier(node1, config) and
+  not fullBarrier(node2, config)
+}
+
+/**
+ * Holds if data can flow in one local step from `node1` to `node2`.
+ */
+private predicate localFlowStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    simpleLocalFlowStepExt(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    stepFilter(node1, node2, config)
+  )
+  or
+  exists(Node n |
+    config.allowImplicitRead(n, _) and
+    node1.asNode() = n and
+    node2.isImplicitReadNode(n, false) and
+    not fullBarrier(node1, config)
+  )
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` does not jump between callables.
+ */
+private predicate additionalLocalFlowStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config)
+  )
+  or
+  exists(Node n |
+    config.allowImplicitRead(n, _) and
+    node1.isImplicitReadNode(n, true) and
+    node2.asNode() = n and
+    not fullBarrier(node2, config)
+  )
+}
+
+private predicate additionalLocalStateStep(
+  NodeEx node1, FlowState s1, NodeEx node2, FlowState s2, Configuration config
+) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), s1, pragma[only_bind_into](n2), s2) and
+    getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not stateBarrier(node1, s1, config) and
+    not stateBarrier(node2, s2, config)
+  )
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` in a way that discards call contexts.
+ */
+private predicate jumpStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    jumpStepCached(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    stepFilter(node1, node2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` jumps between callables.
+ */
+private predicate additionalJumpStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private predicate additionalJumpStateStep(
+  NodeEx node1, FlowState s1, NodeEx node2, FlowState s2, Configuration config
+) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), s1, pragma[only_bind_into](n2), s2) and
+    getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not stateBarrier(node1, s1, config) and
+    not stateBarrier(node2, s2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+pragma[nomagic]
+private predicate readSet(NodeEx node1, ContentSet c, NodeEx node2, Configuration config) {
+  readSet(pragma[only_bind_into](node1.asNode()), c, pragma[only_bind_into](node2.asNode())) and
+  stepFilter(node1, node2, config)
+  or
+  exists(Node n |
+    node2.isImplicitReadNode(n, true) and
+    node1.isImplicitReadNode(n, _) and
+    config.allowImplicitRead(n, c)
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate read(NodeEx node1, Content c, NodeEx node2, Configuration config) {
+  exists(ContentSet cs |
+    readSet(node1, cs, node2, config) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate clearsContentEx(NodeEx n, Content c) {
+  exists(ContentSet cs |
+    clearsContentCached(n.asNode(), cs) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate expectsContentEx(NodeEx n, Content c) {
+  exists(ContentSet cs |
+    expectsContentCached(n.asNode(), cs) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+pragma[nomagic]
+private predicate notExpectsContent(NodeEx n) { not expectsContentCached(n.asNode(), _) }
+
+pragma[nomagic]
+private predicate store(
+  NodeEx node1, TypedContent tc, NodeEx node2, DataFlowType contentType, Configuration config
+) {
+  store(pragma[only_bind_into](node1.asNode()), tc, pragma[only_bind_into](node2.asNode()),
+    contentType) and
+  read(_, tc.getContent(), _, config) and
+  stepFilter(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutEx(DataFlowCall call, ReturnPosition pos, NodeEx out) {
+  viableReturnPosOut(call, pos, out.asNode())
+}
+
+pragma[nomagic]
+private predicate viableParamArgEx(DataFlowCall call, ParamNodeEx p, ArgNodeEx arg) {
+  viableParamArg(call, p.asNode(), arg.asNode())
+}
+
+/**
+ * Holds if field flow should be used for the given configuration.
+ */
+private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
+
+private predicate hasSourceCallCtx(Configuration config) {
+  exists(FlowFeature feature | feature = config.getAFeature() |
+    feature instanceof FeatureHasSourceCallContext or
+    feature instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private predicate hasSinkCallCtx(Configuration config) {
+  exists(FlowFeature feature | feature = config.getAFeature() |
+    feature instanceof FeatureHasSinkCallContext or
+    feature instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private module Stage1 implements StageSig {
+  class ApApprox = Unit;
+
+  class Ap = Unit;
+
+  class ApOption = Unit;
+
+  class Cc = boolean;
+
+  /* Begin: Stage 1 logic. */
+  /**
+   * Holds if `node` is reachable from a source in the configuration `config`.
+   *
+   * The Boolean `cc` records whether the node is reached through an
+   * argument in a call.
+   */
+  predicate fwdFlow(NodeEx node, Cc cc, Configuration config) {
+    sourceNode(node, _, config) and
+    if hasSourceCallCtx(config) then cc = true else cc = false
+    or
+    exists(NodeEx mid | fwdFlow(mid, cc, config) |
+      localFlowStep(mid, node, config) or
+      additionalLocalFlowStep(mid, node, config) or
+      additionalLocalStateStep(mid, _, node, _, config)
+    )
+    or
+    exists(NodeEx mid | fwdFlow(mid, _, config) and cc = false |
+      jumpStep(mid, node, config) or
+      additionalJumpStep(mid, node, config) or
+      additionalJumpStateStep(mid, _, node, _, config)
+    )
+    or
+    // store
+    exists(NodeEx mid |
+      useFieldFlow(config) and
+      fwdFlow(mid, cc, config) and
+      store(mid, _, node, _, config)
+    )
+    or
+    // read
+    exists(ContentSet c |
+      fwdFlowReadSet(c, node, cc, config) and
+      fwdFlowConsCandSet(c, _, config)
+    )
+    or
+    // flow into a callable
+    exists(NodeEx arg |
+      fwdFlow(arg, _, config) and
+      viableParamArgEx(_, node, arg) and
+      cc = true and
+      not fullBarrier(node, config)
+    )
+    or
+    // flow out of a callable
+    exists(DataFlowCall call |
+      fwdFlowOut(call, node, false, config) and
+      cc = false
+      or
+      fwdFlowOutFromArg(call, node, config) and
+      fwdFlowIsEntered(call, cc, config)
+    )
+  }
+
+  private predicate fwdFlow(NodeEx node, Configuration config) { fwdFlow(node, _, config) }
+
+  pragma[nomagic]
+  private predicate fwdFlowReadSet(ContentSet c, NodeEx node, Cc cc, Configuration config) {
+    exists(NodeEx mid |
+      fwdFlow(mid, cc, config) and
+      readSet(mid, c, node, config)
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a store in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCand(Content c, Configuration config) {
+    exists(NodeEx mid, NodeEx node, TypedContent tc |
+      not fullBarrier(node, config) and
+      useFieldFlow(config) and
+      fwdFlow(mid, _, config) and
+      store(mid, tc, node, _, config) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `cs` may be interpreted in a read as the target of some store
+   * into `c`, in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCandSet(ContentSet cs, Content c, Configuration config) {
+    fwdFlowConsCand(c, config) and
+    c = cs.getAReadContent()
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowReturnPosition(ReturnPosition pos, Cc cc, Configuration config) {
+    exists(RetNodeEx ret |
+      fwdFlow(ret, cc, config) and
+      ret.getReturnPosition() = pos
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOut(DataFlowCall call, NodeEx out, Cc cc, Configuration config) {
+    exists(ReturnPosition pos |
+      fwdFlowReturnPosition(pos, cc, config) and
+      viableReturnPosOutEx(call, pos, out) and
+      not fullBarrier(out, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOutFromArg(DataFlowCall call, NodeEx out, Configuration config) {
+    fwdFlowOut(call, out, true, config)
+  }
+
+  /**
+   * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowIsEntered(DataFlowCall call, Cc cc, Configuration config) {
+    exists(ArgNodeEx arg |
+      fwdFlow(arg, cc, config) and
+      viableParamArgEx(call, _, arg)
+    )
+  }
+
+  private predicate stateStepFwd(FlowState state1, FlowState state2, Configuration config) {
+    exists(NodeEx node1 |
+      additionalLocalStateStep(node1, state1, _, state2, config) or
+      additionalJumpStateStep(node1, state1, _, state2, config)
+    |
+      fwdFlow(node1, config)
+    )
+  }
+
+  private predicate fwdFlowState(FlowState state, Configuration config) {
+    sourceNode(_, state, config)
+    or
+    exists(FlowState state0 |
+      fwdFlowState(state0, config) and
+      stateStepFwd(state0, state, config)
+    )
+  }
+
+  /**
+   * Holds if `node` is part of a path from a source to a sink in the
+   * configuration `config`.
+   *
+   * The Boolean `toReturn` records whether the node must be returned from
+   * the enclosing callable in order to reach a sink.
+   */
+  pragma[nomagic]
+  predicate revFlow(NodeEx node, boolean toReturn, Configuration config) {
+    revFlow0(node, toReturn, config) and
+    fwdFlow(node, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlow0(NodeEx node, boolean toReturn, Configuration config) {
+    exists(FlowState state |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      sinkNode(node, state, config) and
+      fwdFlowState(state, pragma[only_bind_into](config)) and
+      if hasSinkCallCtx(config) then toReturn = true else toReturn = false
+    )
+    or
+    exists(NodeEx mid | revFlow(mid, toReturn, config) |
+      localFlowStep(node, mid, config) or
+      additionalLocalFlowStep(node, mid, config) or
+      additionalLocalStateStep(node, _, mid, _, config)
+    )
+    or
+    exists(NodeEx mid | revFlow(mid, _, config) and toReturn = false |
+      jumpStep(node, mid, config) or
+      additionalJumpStep(node, mid, config) or
+      additionalJumpStateStep(node, _, mid, _, config)
+    )
+    or
+    // store
+    exists(Content c |
+      revFlowStore(c, node, toReturn, config) and
+      revFlowConsCand(c, config)
+    )
+    or
+    // read
+    exists(NodeEx mid, ContentSet c |
+      readSet(node, c, mid, config) and
+      fwdFlowConsCandSet(c, _, pragma[only_bind_into](config)) and
+      revFlow(mid, toReturn, pragma[only_bind_into](config))
+    )
+    or
+    // flow into a callable
+    exists(DataFlowCall call |
+      revFlowIn(call, node, false, config) and
+      toReturn = false
+      or
+      revFlowInToReturn(call, node, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+    or
+    // flow out of a callable
+    exists(ReturnPosition pos |
+      revFlowOut(pos, config) and
+      node.(RetNodeEx).getReturnPosition() = pos and
+      toReturn = true
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a read in the flow covered by `revFlow`.
+   */
+  pragma[nomagic]
+  private predicate revFlowConsCand(Content c, Configuration config) {
+    exists(NodeEx mid, NodeEx node, ContentSet cs |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      readSet(node, cs, mid, config) and
+      fwdFlowConsCandSet(cs, c, pragma[only_bind_into](config)) and
+      revFlow(pragma[only_bind_into](mid), _, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowStore(Content c, NodeEx node, boolean toReturn, Configuration config) {
+    exists(NodeEx mid, TypedContent tc |
+      revFlow(mid, toReturn, pragma[only_bind_into](config)) and
+      fwdFlowConsCand(c, pragma[only_bind_into](config)) and
+      store(node, tc, mid, _, config) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of both a read and a store in the flow covered
+   * by `revFlow`.
+   */
+  pragma[nomagic]
+  predicate revFlowIsReadAndStored(Content c, Configuration conf) {
+    revFlowConsCand(c, conf) and
+    revFlowStore(c, _, _, conf)
+  }
+
+  pragma[nomagic]
+  predicate viableReturnPosOutNodeCandFwd1(
+    DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
+  ) {
+    fwdFlowReturnPosition(pos, _, config) and
+    viableReturnPosOutEx(call, pos, out)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
+    exists(DataFlowCall call, NodeEx out |
+      revFlow(out, _, config) and
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate viableParamArgNodeCandFwd1(
+    DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
+  ) {
+    viableParamArgEx(call, p, arg) and
+    fwdFlow(arg, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowIn(
+    DataFlowCall call, ArgNodeEx arg, boolean toReturn, Configuration config
+  ) {
+    exists(ParamNodeEx p |
+      revFlow(p, toReturn, config) and
+      viableParamArgNodeCandFwd1(call, p, arg, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowInToReturn(DataFlowCall call, ArgNodeEx arg, Configuration config) {
+    revFlowIn(call, arg, true, config)
+  }
+
+  /**
+   * Holds if an output from `call` is reached in the flow covered by `revFlow`
+   * and data might flow through the target callable resulting in reverse flow
+   * reaching an argument of `call`.
+   */
+  pragma[nomagic]
+  private predicate revFlowIsReturned(DataFlowCall call, boolean toReturn, Configuration config) {
+    exists(NodeEx out |
+      revFlow(out, toReturn, config) and
+      fwdFlowOutFromArg(call, out, config)
+    )
+  }
+
+  private predicate stateStepRev(FlowState state1, FlowState state2, Configuration config) {
+    exists(NodeEx node1, NodeEx node2 |
+      additionalLocalStateStep(node1, state1, node2, state2, config) or
+      additionalJumpStateStep(node1, state1, node2, state2, config)
+    |
+      revFlow(node1, _, pragma[only_bind_into](config)) and
+      revFlow(node2, _, pragma[only_bind_into](config)) and
+      fwdFlowState(state1, pragma[only_bind_into](config)) and
+      fwdFlowState(state2, pragma[only_bind_into](config))
+    )
+  }
+
+  predicate revFlowState(FlowState state, Configuration config) {
+    exists(NodeEx node |
+      sinkNode(node, state, config) and
+      revFlow(node, _, pragma[only_bind_into](config)) and
+      fwdFlowState(state, pragma[only_bind_into](config))
+    )
+    or
+    exists(FlowState state0 |
+      revFlowState(state0, config) and
+      stateStepRev(state, state0, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate storeStepCand(
+    NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+    Configuration config
+  ) {
+    exists(Content c |
+      revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      revFlow(node2, pragma[only_bind_into](config)) and
+      store(node1, tc, node2, contentType, config) and
+      c = tc.getContent() and
+      exists(ap1)
+    )
+  }
+
+  pragma[nomagic]
+  predicate readStepCand(NodeEx n1, Content c, NodeEx n2, Configuration config) {
+    revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+    read(n1, c, n2, pragma[only_bind_into](config)) and
+    revFlow(n2, pragma[only_bind_into](config))
+  }
+
+  pragma[nomagic]
+  predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, config) }
+
+  bindingset[node, state, config]
+  predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    revFlow(node, _, pragma[only_bind_into](config)) and
+    exists(state) and
+    exists(ap)
+  }
+
+  private predicate throughFlowNodeCand(NodeEx node, Configuration config) {
+    revFlow(node, true, config) and
+    fwdFlow(node, true, config) and
+    not inBarrier(node, config) and
+    not outBarrier(node, config)
+  }
+
+  /** Holds if flow may return from `callable`. */
+  pragma[nomagic]
+  private predicate returnFlowCallableNodeCand(
+    DataFlowCallable callable, ReturnKindExt kind, Configuration config
+  ) {
+    exists(RetNodeEx ret |
+      throughFlowNodeCand(ret, config) and
+      callable = ret.getEnclosingCallable() and
+      kind = ret.getKind()
+    )
+  }
+
+  /**
+   * Holds if flow may enter through `p` and reach a return node making `p` a
+   * candidate for the origin of a summary.
+   */
+  pragma[nomagic]
+  predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
+    exists(ReturnKindExt kind |
+      throughFlowNodeCand(p, config) and
+      returnFlowCallableNodeCand(c, kind, config) and
+      p.getEnclosingCallable() = c and
+      exists(ap) and
+      // we don't expect a parameter to return stored in itself, unless explicitly allowed
+      (
+        not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
+        or
+        p.allowParameterReturnInSelf()
+      )
+    )
+  }
+
+  pragma[nomagic]
+  predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
+    exists(ArgNodeEx arg, boolean toReturn |
+      revFlow(arg, toReturn, config) and
+      revFlowInToReturn(call, arg, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+  }
+
+  predicate stats(
+    boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
+  ) {
+    fwd = true and
+    nodes = count(NodeEx node | fwdFlow(node, config)) and
+    fields = count(Content f0 | fwdFlowConsCand(f0, config)) and
+    conscand = -1 and
+    states = count(FlowState state | fwdFlowState(state, config)) and
+    tuples = count(NodeEx n, boolean b | fwdFlow(n, b, config))
+    or
+    fwd = false and
+    nodes = count(NodeEx node | revFlow(node, _, config)) and
+    fields = count(Content f0 | revFlowConsCand(f0, config)) and
+    conscand = -1 and
+    states = count(FlowState state | revFlowState(state, config)) and
+    tuples = count(NodeEx n, boolean b | revFlow(n, b, config))
+  }
+  /* End: Stage 1 logic. */
+}
+
+pragma[noinline]
+private predicate localFlowStepNodeCand1(NodeEx node1, NodeEx node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  localFlowStep(node1, node2, config)
+}
+
+pragma[noinline]
+private predicate additionalLocalFlowStepNodeCand1(NodeEx node1, NodeEx node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  additionalLocalFlowStep(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutNodeCand1(
+  DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
+) {
+  Stage1::revFlow(out, config) and
+  Stage1::viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, RetNodeEx ret, NodeEx out, Configuration config
+) {
+  viableReturnPosOutNodeCand1(call, ret.getReturnPosition(), out, config) and
+  Stage1::revFlow(ret, config) and
+  not outBarrier(ret, config) and
+  not inBarrier(out, config)
+}
+
+pragma[nomagic]
+private predicate viableParamArgNodeCand1(
+  DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
+) {
+  Stage1::viableParamArgNodeCandFwd1(call, p, arg, config) and
+  Stage1::revFlow(arg, config)
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, Configuration config
+) {
+  viableParamArgNodeCand1(call, p, arg, config) and
+  Stage1::revFlow(p, config) and
+  not outBarrier(arg, config) and
+  not inBarrier(p, config)
+}
+
+/**
+ * Gets the amount of forward branching on the origin of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int branch(NodeEx n1, Configuration conf) {
+  result =
+    strictcount(NodeEx n |
+      flowOutOfCallNodeCand1(_, n1, n, conf) or flowIntoCallNodeCand1(_, n1, n, conf)
+    )
+}
+
+/**
+ * Gets the amount of backward branching on the target of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int join(NodeEx n2, Configuration conf) {
+  result =
+    strictcount(NodeEx n |
+      flowOutOfCallNodeCand1(_, n, n2, conf) or flowIntoCallNodeCand1(_, n, n2, conf)
+    )
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink. The
+ * `allowsFieldFlow` flag indicates whether the branching is within the limit
+ * specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, ret, out, config) and
+  exists(int b, int j |
+    b = branch(ret, config) and
+    j = join(out, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink. The `allowsFieldFlow` flag indicates whether
+ * the branching is within the limit specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+) {
+  flowIntoCallNodeCand1(call, arg, p, config) and
+  exists(int b, int j |
+    b = branch(arg, config) and
+    j = join(p, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+private signature module StageSig {
+  class Ap;
+
+  predicate revFlow(NodeEx node, Configuration config);
+
+  bindingset[node, state, config]
+  predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config);
+
+  predicate callMayFlowThroughRev(DataFlowCall call, Configuration config);
+
+  predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config);
+
+  predicate storeStepCand(
+    NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+    Configuration config
+  );
+
+  predicate readStepCand(NodeEx n1, Content c, NodeEx n2, Configuration config);
+}
+
+private module MkStage<StageSig PrevStage> {
+  class ApApprox = PrevStage::Ap;
+
+  signature module StageParam {
+    class Ap;
+
+    class ApNil extends Ap;
+
+    bindingset[result, ap]
+    ApApprox getApprox(Ap ap);
+
+    ApNil getApNil(NodeEx node);
+
+    bindingset[tc, tail]
+    Ap apCons(TypedContent tc, Ap tail);
+
+    Content getHeadContent(Ap ap);
+
+    class ApOption;
+
+    ApOption apNone();
+
+    ApOption apSome(Ap ap);
+
+    class Cc;
+
+    class CcCall extends Cc;
+
+    // TODO: member predicate on CcCall
+    predicate matchesCall(CcCall cc, DataFlowCall call);
+
+    class CcNoCall extends Cc;
+
+    Cc ccNone();
+
+    CcCall ccSomeCall();
+
+    class LocalCc;
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc);
+
+    bindingset[call, c, innercc]
+    CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc);
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc);
+
+    bindingset[node1, state1, config]
+    bindingset[node2, state2, config]
+    predicate localStep(
+      NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+      ApNil ap, Configuration config, LocalCc lcc
+    );
+
+    predicate flowOutOfCall(
+      DataFlowCall call, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow, Configuration config
+    );
+
+    predicate flowIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+    );
+
+    bindingset[node, state, ap, config]
+    predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config);
+
+    bindingset[ap, contentType]
+    predicate typecheckStore(Ap ap, DataFlowType contentType);
+  }
+
+  module Stage<StageParam Param> implements StageSig {
+    import Param
+
+    /* Begin: Stage logic. */
+    bindingset[result, apa]
+    private ApApprox unbindApa(ApApprox apa) {
+      pragma[only_bind_out](apa) = pragma[only_bind_out](result)
+    }
+
+    pragma[nomagic]
+    private predicate flowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      Configuration config
+    ) {
+      flowOutOfCall(call, ret, out, allowsFieldFlow, pragma[only_bind_into](config)) and
+      PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(_, ret.getEnclosingCallable(), _,
+        pragma[only_bind_into](config)) and
+      matchesCall(ccc, call)
+    }
+
+    /**
+     * Holds if `node` is reachable with access path `ap` from a source in the
+     * configuration `config`.
+     *
+     * The call context `cc` records whether the node is reached through an
+     * argument in a call, and if so, `argAp` records the access path of that
+     * argument.
+     */
+    pragma[nomagic]
+    predicate fwdFlow(
+      NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      fwdFlow0(node, state, cc, argAp, ap, config) and
+      PrevStage::revFlow(node, state, unbindApa(getApprox(ap)), config) and
+      filter(node, state, ap, config)
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlow0(
+      NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      sourceNode(node, state, config) and
+      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
+      argAp = apNone() and
+      ap = getApNil(node)
+      or
+      exists(NodeEx mid, FlowState state0, Ap ap0, LocalCc localCc |
+        fwdFlow(mid, state0, cc, argAp, ap0, config) and
+        localCc = getLocalCc(mid, cc)
+      |
+        localStep(mid, state0, node, state, true, _, config, localCc) and
+        ap = ap0
+        or
+        localStep(mid, state0, node, state, false, ap, config, localCc) and
+        ap0 instanceof ApNil
+      )
+      or
+      exists(NodeEx mid |
+        fwdFlow(mid, pragma[only_bind_into](state), _, _, ap, pragma[only_bind_into](config)) and
+        jumpStep(mid, node, config) and
+        cc = ccNone() and
+        argAp = apNone()
+      )
+      or
+      exists(NodeEx mid, ApNil nil |
+        fwdFlow(mid, state, _, _, nil, pragma[only_bind_into](config)) and
+        additionalJumpStep(mid, node, config) and
+        cc = ccNone() and
+        argAp = apNone() and
+        ap = getApNil(node)
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(mid, state0, _, _, nil, pragma[only_bind_into](config)) and
+        additionalJumpStateStep(mid, state0, node, state, config) and
+        cc = ccNone() and
+        argAp = apNone() and
+        ap = getApNil(node)
+      )
+      or
+      // store
+      exists(TypedContent tc, Ap ap0 |
+        fwdFlowStore(_, ap0, tc, node, state, cc, argAp, config) and
+        ap = apCons(tc, ap0)
+      )
+      or
+      // read
+      exists(Ap ap0, Content c |
+        fwdFlowRead(ap0, c, _, node, state, cc, argAp, config) and
+        fwdFlowConsCand(ap0, c, ap, config)
+      )
+      or
+      // flow into a callable
+      exists(ApApprox apa |
+        fwdFlowIn(_, node, state, _, cc, _, ap, config) and
+        apa = getApprox(ap) and
+        if PrevStage::parameterMayFlowThrough(node, _, apa, config)
+        then argAp = apSome(ap)
+        else argAp = apNone()
+      )
+      or
+      // flow out of a callable
+      fwdFlowOutNotFromArg(node, state, cc, argAp, ap, config)
+      or
+      exists(DataFlowCall call, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, argAp0, ap, config) and
+        fwdFlowIsEntered(call, cc, argAp, argAp0, config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowStore(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc, ApOption argAp,
+      Configuration config
+    ) {
+      exists(DataFlowType contentType |
+        fwdFlow(node1, state, cc, argAp, ap1, config) and
+        PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
+        typecheckStore(ap1, contentType)
+      )
+    }
+
+    /**
+     * Holds if forward flow with access path `tail` reaches a store of `c`
+     * resulting in access path `cons`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+      exists(TypedContent tc |
+        fwdFlowStore(_, tail, tc, _, _, _, _, config) and
+        tc.getContent() = c and
+        cons = apCons(tc, tail)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowRead(
+      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc, ApOption argAp,
+      Configuration config
+    ) {
+      fwdFlow(node1, state, cc, argAp, ap, config) and
+      PrevStage::readStepCand(node1, c, node2, config) and
+      getHeadContent(ap) = c
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowIn(
+      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, Cc innercc, ApOption argAp,
+      Ap ap, Configuration config
+    ) {
+      exists(ArgNodeEx arg, boolean allowsFieldFlow |
+        fwdFlow(arg, state, outercc, argAp, ap, config) and
+        flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+        innercc = getCallContextCall(call, p.getEnclosingCallable(), outercc) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowOutNotFromArg(
+      NodeEx out, FlowState state, Cc ccOut, ApOption argAp, Ap ap, Configuration config
+    ) {
+      exists(
+        DataFlowCall call, RetNodeEx ret, boolean allowsFieldFlow, CcNoCall innercc,
+        DataFlowCallable inner
+      |
+        fwdFlow(ret, state, innercc, argAp, ap, config) and
+        flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+        inner = ret.getEnclosingCallable() and
+        ccOut = getCallContextReturn(inner, call, innercc) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, Ap argAp, Ap ap, Configuration config
+    ) {
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc |
+        fwdFlow(ret, state, ccc, apSome(argAp), ap, config) and
+        flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    /**
+     * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`
+     * and data might flow through the target callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowIsEntered(
+      DataFlowCall call, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p |
+        fwdFlowIn(call, p, _, cc, _, argAp, ap, config) and
+        PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate storeStepFwd(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, Ap ap2, Configuration config
+    ) {
+      fwdFlowStore(node1, ap1, tc, node2, _, _, _, config) and
+      ap2 = apCons(tc, ap1) and
+      fwdFlowRead(ap2, tc.getContent(), _, _, _, _, _, config)
+    }
+
+    private predicate readStepFwd(
+      NodeEx n1, Ap ap1, Content c, NodeEx n2, Ap ap2, Configuration config
+    ) {
+      fwdFlowRead(ap1, c, n1, n2, _, _, _, config) and
+      fwdFlowConsCand(ap1, c, ap2, config)
+    }
+
+    pragma[nomagic]
+    private predicate callMayFlowThroughFwd(DataFlowCall call, Configuration config) {
+      exists(Ap argAp0, NodeEx out, FlowState state, Cc cc, ApOption argAp, Ap ap |
+        fwdFlow(out, state, pragma[only_bind_into](cc), pragma[only_bind_into](argAp), ap,
+          pragma[only_bind_into](config)) and
+        fwdFlowOutFromArg(call, out, state, argAp0, ap, config) and
+        fwdFlowIsEntered(pragma[only_bind_into](call), pragma[only_bind_into](cc),
+          pragma[only_bind_into](argAp), pragma[only_bind_into](argAp0),
+          pragma[only_bind_into](config))
+      )
+    }
+
+    pragma[nomagic]
+    private predicate flowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+    ) {
+      flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+      fwdFlow(arg, _, _, _, _, pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(p, _, _, pragma[only_bind_into](config)) and
+      callMayFlowThroughFwd(call, pragma[only_bind_into](config))
+    }
+
+    pragma[nomagic]
+    private predicate returnNodeMayFlowThrough(
+      RetNodeEx ret, FlowState state, Ap ap, Configuration config
+    ) {
+      fwdFlow(ret, state, any(CcCall ccc), apSome(_), ap, config)
+    }
+
+    /**
+     * Holds if `node` with access path `ap` is part of a path from a source to a
+     * sink in the configuration `config`.
+     *
+     * The Boolean `toReturn` records whether the node must be returned from the
+     * enclosing callable in order to reach a sink, and if so, `returnAp` records
+     * the access path of the returned value.
+     */
+    pragma[nomagic]
+    predicate revFlow(
+      NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      revFlow0(node, state, toReturn, returnAp, ap, config) and
+      fwdFlow(node, state, _, _, ap, config)
+    }
+
+    pragma[nomagic]
+    private predicate revFlow0(
+      NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      fwdFlow(node, state, _, _, ap, config) and
+      sinkNode(node, state, config) and
+      (if hasSinkCallCtx(config) then toReturn = true else toReturn = false) and
+      returnAp = apNone() and
+      ap instanceof ApNil
+      or
+      exists(NodeEx mid, FlowState state0 |
+        localStep(node, state, mid, state0, true, _, config, _) and
+        revFlow(mid, state0, toReturn, returnAp, ap, config)
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(node, pragma[only_bind_into](state), _, _, ap, pragma[only_bind_into](config)) and
+        localStep(node, pragma[only_bind_into](state), mid, state0, false, _, config, _) and
+        revFlow(mid, state0, toReturn, returnAp, nil, pragma[only_bind_into](config)) and
+        ap instanceof ApNil
+      )
+      or
+      exists(NodeEx mid |
+        jumpStep(node, mid, config) and
+        revFlow(mid, state, _, _, ap, config) and
+        toReturn = false and
+        returnAp = apNone()
+      )
+      or
+      exists(NodeEx mid, ApNil nil |
+        fwdFlow(node, _, _, _, ap, pragma[only_bind_into](config)) and
+        additionalJumpStep(node, mid, config) and
+        revFlow(pragma[only_bind_into](mid), state, _, _, nil, pragma[only_bind_into](config)) and
+        toReturn = false and
+        returnAp = apNone() and
+        ap instanceof ApNil
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(node, _, _, _, ap, pragma[only_bind_into](config)) and
+        additionalJumpStateStep(node, state, mid, state0, config) and
+        revFlow(pragma[only_bind_into](mid), pragma[only_bind_into](state0), _, _, nil,
+          pragma[only_bind_into](config)) and
+        toReturn = false and
+        returnAp = apNone() and
+        ap instanceof ApNil
+      )
+      or
+      // store
+      exists(Ap ap0, Content c |
+        revFlowStore(ap0, c, ap, node, state, _, _, toReturn, returnAp, config) and
+        revFlowConsCand(ap0, c, ap, config)
+      )
+      or
+      // read
+      exists(NodeEx mid, Ap ap0 |
+        revFlow(mid, state, toReturn, returnAp, ap0, config) and
+        readStepFwd(node, ap, _, mid, ap0, config)
+      )
+      or
+      // flow into a callable
+      revFlowInNotToReturn(node, state, returnAp, ap, config) and
+      toReturn = false
+      or
+      exists(DataFlowCall call, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+      or
+      // flow out of a callable
+      revFlowOut(_, node, state, _, _, ap, config) and
+      toReturn = true and
+      if returnNodeMayFlowThrough(node, state, ap, config)
+      then returnAp = apSome(ap)
+      else returnAp = apNone()
+    }
+
+    pragma[nomagic]
+    private predicate revFlowStore(
+      Ap ap0, Content c, Ap ap, NodeEx node, FlowState state, TypedContent tc, NodeEx mid,
+      boolean toReturn, ApOption returnAp, Configuration config
+    ) {
+      revFlow(mid, state, toReturn, returnAp, ap0, config) and
+      storeStepFwd(node, ap, tc, mid, ap0, config) and
+      tc.getContent() = c
+    }
+
+    /**
+     * Holds if reverse flow with access path `tail` reaches a read of `c`
+     * resulting in access path `cons`.
+     */
+    pragma[nomagic]
+    private predicate revFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+      exists(NodeEx mid, Ap tail0 |
+        revFlow(mid, _, _, _, tail, config) and
+        tail = pragma[only_bind_into](tail0) and
+        readStepFwd(_, cons, c, mid, tail0, config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowOut(
+      DataFlowCall call, RetNodeEx ret, FlowState state, boolean toReturn, ApOption returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(NodeEx out, boolean allowsFieldFlow |
+        revFlow(out, state, toReturn, returnAp, ap, config) and
+        flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInNotToReturn(
+      ArgNodeEx arg, FlowState state, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlow(p, state, false, returnAp, ap, config) and
+        flowIntoCall(_, arg, p, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, Ap returnAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlow(p, state, true, apSome(returnAp), ap, config) and
+        flowThroughIntoCall(call, arg, p, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    /**
+     * Holds if an output from `call` is reached in the flow covered by `revFlow`
+     * and data might flow through the target callable resulting in reverse flow
+     * reaching an argument of `call`.
+     */
+    pragma[nomagic]
+    private predicate revFlowIsReturned(
+      DataFlowCall call, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      exists(RetNodeEx ret, FlowState state, CcCall ccc |
+        revFlowOut(call, ret, state, toReturn, returnAp, ap, config) and
+        fwdFlow(ret, state, ccc, apSome(_), ap, config) and
+        matchesCall(ccc, call)
+      )
+    }
+
+    pragma[nomagic]
+    predicate storeStepCand(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+      Configuration config
+    ) {
+      exists(Ap ap2, Content c |
+        PrevStage::storeStepCand(node1, _, tc, node2, contentType, config) and
+        revFlowStore(ap2, c, ap1, node1, _, tc, node2, _, _, config) and
+        revFlowConsCand(ap2, c, ap1, config)
+      )
+    }
+
+    predicate readStepCand(NodeEx node1, Content c, NodeEx node2, Configuration config) {
+      exists(Ap ap1, Ap ap2 |
+        revFlow(node2, _, _, _, pragma[only_bind_into](ap2), pragma[only_bind_into](config)) and
+        readStepFwd(node1, ap1, c, node2, ap2, config) and
+        revFlowStore(ap1, c, pragma[only_bind_into](ap2), _, _, _, _, _, _,
+          pragma[only_bind_into](config))
+      )
+    }
+
+    predicate revFlow(NodeEx node, FlowState state, Configuration config) {
+      revFlow(node, state, _, _, _, config)
+    }
+
+    predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config) {
+      revFlow(node, state, _, _, ap, config)
+    }
+
+    pragma[nomagic]
+    predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
+
+    // use an alias as a workaround for bad functionality-induced joins
+    pragma[nomagic]
+    predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
+
+    // use an alias as a workaround for bad functionality-induced joins
+    pragma[nomagic]
+    predicate revFlowAlias(NodeEx node, FlowState state, Ap ap, Configuration config) {
+      revFlow(node, state, ap, config)
+    }
+
+    private predicate fwdConsCand(TypedContent tc, Ap ap, Configuration config) {
+      storeStepFwd(_, ap, tc, _, _, config)
+    }
+
+    private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
+      storeStepCand(_, ap, tc, _, _, config)
+    }
+
+    private predicate validAp(Ap ap, Configuration config) {
+      revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
+      or
+      exists(TypedContent head, Ap tail |
+        consCand(head, tail, config) and
+        ap = apCons(head, tail)
+      )
+    }
+
+    predicate consCand(TypedContent tc, Ap ap, Configuration config) {
+      revConsCand(tc, ap, config) and
+      validAp(ap, config)
+    }
+
+    pragma[noinline]
+    private predicate parameterFlow(
+      ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
+    ) {
+      revFlow(p, _, true, apSome(ap0), ap, config) and
+      c = p.getEnclosingCallable()
+    }
+
+    predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
+      exists(RetNodeEx ret, FlowState state, Ap ap0, ReturnKindExt kind, ParameterPosition pos |
+        parameterFlow(p, ap, ap0, c, config) and
+        c = ret.getEnclosingCallable() and
+        revFlow(pragma[only_bind_into](ret), pragma[only_bind_into](state), true, apSome(_),
+          pragma[only_bind_into](ap0), pragma[only_bind_into](config)) and
+        fwdFlow(ret, state, any(CcCall ccc), apSome(ap), ap0, config) and
+        kind = ret.getKind() and
+        p.getPosition() = pos and
+        // we don't expect a parameter to return stored in itself, unless explicitly allowed
+        (
+          not kind.(ParamUpdateReturnKind).getPosition() = pos
+          or
+          p.allowParameterReturnInSelf()
+        )
+      )
+    }
+
+    pragma[nomagic]
+    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
+      exists(
+        Ap returnAp0, ArgNodeEx arg, FlowState state, boolean toReturn, ApOption returnAp, Ap ap
+      |
+        revFlow(arg, state, toReturn, returnAp, ap, config) and
+        revFlowInToReturn(call, arg, state, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+    }
+
+    predicate stats(
+      boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
+    ) {
+      fwd = true and
+      nodes = count(NodeEx node | fwdFlow(node, _, _, _, _, config)) and
+      fields = count(TypedContent f0 | fwdConsCand(f0, _, config)) and
+      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
+      states = count(FlowState state | fwdFlow(_, state, _, _, _, config)) and
+      tuples =
+        count(NodeEx n, FlowState state, Cc cc, ApOption argAp, Ap ap |
+          fwdFlow(n, state, cc, argAp, ap, config)
+        )
+      or
+      fwd = false and
+      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
+      fields = count(TypedContent f0 | consCand(f0, _, config)) and
+      conscand = count(TypedContent f0, Ap ap | consCand(f0, ap, config)) and
+      states = count(FlowState state | revFlow(_, state, _, _, _, config)) and
+      tuples =
+        count(NodeEx n, FlowState state, boolean b, ApOption retAp, Ap ap |
+          revFlow(n, state, b, retAp, ap, config)
+        )
+    }
+    /* End: Stage logic. */
+  }
+}
+
+private module BooleanCallContext {
+  class Cc extends boolean {
+    Cc() { this in [true, false] }
+  }
+
+  class CcCall extends Cc {
+    CcCall() { this = true }
+  }
+
+  /** Holds if the call context may be `call`. */
+  predicate matchesCall(CcCall cc, DataFlowCall call) { any() }
+
+  class CcNoCall extends Cc {
+    CcNoCall() { this = false }
+  }
+
+  Cc ccNone() { result = false }
+
+  CcCall ccSomeCall() { result = true }
+
+  class LocalCc = Unit;
+
+  bindingset[node, cc]
+  LocalCc getLocalCc(NodeEx node, Cc cc) { any() }
+
+  bindingset[call, c, outercc]
+  CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) { any() }
+
+  bindingset[call, c, innercc]
+  CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) { any() }
+}
+
+private module Level1CallContext {
+  class Cc = CallContext;
+
+  class CcCall = CallContextCall;
+
+  pragma[inline]
+  predicate matchesCall(CcCall cc, DataFlowCall call) { cc.matchesCall(call) }
+
+  class CcNoCall = CallContextNoCall;
+
+  Cc ccNone() { result instanceof CallContextAny }
+
+  CcCall ccSomeCall() { result instanceof CallContextSomeCall }
+
+  module NoLocalCallContext {
+    class LocalCc = Unit;
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc) { any() }
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+      checkCallContextCall(outercc, call, c) and
+      if recordDataFlowCallSiteDispatch(call, c)
+      then result = TSpecificCall(call)
+      else result = TSomeCall()
+    }
+  }
+
+  module LocalCallContext {
+    class LocalCc = LocalCallContext;
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc) {
+      result =
+        getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
+          node.getEnclosingCallable())
+    }
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+      checkCallContextCall(outercc, call, c) and
+      if recordDataFlowCallSite(call, c) then result = TSpecificCall(call) else result = TSomeCall()
+    }
+  }
+
+  bindingset[call, c, innercc]
+  CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) {
+    checkCallContextReturn(innercc, c, call) and
+    if reducedViableImplInReturn(c, call) then result = TReturn(c, call) else result = ccNone()
+  }
+}
+
+private module Stage2Param implements MkStage<Stage1>::StageParam {
+  private module PrevStage = Stage1;
+
+  class Ap extends boolean {
+    Ap() { this in [true, false] }
+  }
+
+  class ApNil extends Ap {
+    ApNil() { this = false }
+  }
+
+  bindingset[result, ap]
+  PrevStage::Ap getApprox(Ap ap) { any() }
+
+  ApNil getApNil(NodeEx node) { Stage1::revFlow(node, _) and exists(result) }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result = true and exists(tc) and exists(tail) }
+
+  pragma[inline]
+  Content getHeadContent(Ap ap) { exists(result) and ap = true }
+
+  class ApOption = BooleanOption;
+
+  ApOption apNone() { result = TBooleanNone() }
+
+  ApOption apSome(Ap ap) { result = TBooleanSome(ap) }
+
+  import Level1CallContext
+  import NoLocalCallContext
+
+  bindingset[node1, state1, config]
+  bindingset[node2, state2, config]
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    (
+      preservesValue = true and
+      localFlowStepNodeCand1(node1, node2, config) and
+      state1 = state2
+      or
+      preservesValue = false and
+      additionalLocalFlowStepNodeCand1(node1, node2, config) and
+      state1 = state2
+      or
+      preservesValue = false and
+      additionalLocalStateStep(node1, state1, node2, state2, config)
+    ) and
+    exists(ap) and
+    exists(lcc)
+  }
+
+  predicate flowOutOfCall = flowOutOfCallNodeCand1/5;
+
+  predicate flowIntoCall = flowIntoCallNodeCand1/5;
+
+  pragma[nomagic]
+  private predicate expectsContentCand(NodeEx node, Configuration config) {
+    exists(Content c |
+      PrevStage::revFlow(node, pragma[only_bind_into](config)) and
+      PrevStage::revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      expectsContentEx(node, c)
+    )
+  }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    PrevStage::revFlowState(state, pragma[only_bind_into](config)) and
+    exists(ap) and
+    not stateBarrier(node, state, config) and
+    (
+      notExpectsContent(node)
+      or
+      ap = true and
+      expectsContentCand(node, config)
+    )
+  }
+
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+}
+
+private module Stage2 implements StageSig {
+  import MkStage<Stage1>::Stage<Stage2Param>
+}
+
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand2(
+  DataFlowCall call, RetNodeEx node1, NodeEx node2, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlowAlias(node1, pragma[only_bind_into](config))
+}
+
+pragma[nomagic]
+private predicate flowIntoCallNodeCand2(
+  DataFlowCall call, ArgNodeEx node1, ParamNodeEx node2, boolean allowsFieldFlow,
+  Configuration config
+) {
+  flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlowAlias(node1, pragma[only_bind_into](config))
+}
+
+private module LocalFlowBigStep {
+  /**
+   * A node where some checking is required, and hence the big-step relation
+   * is not allowed to step over.
+   */
+  private class FlowCheckNode extends NodeEx {
+    FlowCheckNode() {
+      castNode(this.asNode()) or
+      clearsContentCached(this.asNode(), _) or
+      expectsContentCached(this.asNode(), _)
+    }
+  }
+
+  /**
+   * Holds if `node` can be the first node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowEntry(NodeEx node, FlowState state, Configuration config) {
+    Stage2::revFlow(node, state, config) and
+    (
+      sourceNode(node, state, config)
+      or
+      jumpStep(_, node, config)
+      or
+      additionalJumpStep(_, node, config)
+      or
+      additionalJumpStateStep(_, _, node, state, config)
+      or
+      node instanceof ParamNodeEx
+      or
+      node.asNode() instanceof OutNodeExt
+      or
+      Stage2::storeStepCand(_, _, _, node, _, config)
+      or
+      Stage2::readStepCand(_, _, node, config)
+      or
+      node instanceof FlowCheckNode
+      or
+      exists(FlowState s |
+        additionalLocalStateStep(_, s, node, state, config) and
+        s != state
+      )
+    )
+  }
+
+  /**
+   * Holds if `node` can be the last node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowExit(NodeEx node, FlowState state, Configuration config) {
+    exists(NodeEx next | Stage2::revFlow(next, state, config) |
+      jumpStep(node, next, config) or
+      additionalJumpStep(node, next, config) or
+      flowIntoCallNodeCand1(_, node, next, config) or
+      flowOutOfCallNodeCand1(_, node, next, config) or
+      Stage2::storeStepCand(node, _, _, next, _, config) or
+      Stage2::readStepCand(node, _, next, config)
+    )
+    or
+    exists(NodeEx next, FlowState s | Stage2::revFlow(next, s, config) |
+      additionalJumpStateStep(node, state, next, s, config)
+      or
+      additionalLocalStateStep(node, state, next, s, config) and
+      s != state
+    )
+    or
+    Stage2::revFlow(node, state, config) and
+    node instanceof FlowCheckNode
+    or
+    sinkNode(node, state, config)
+  }
+
+  pragma[noinline]
+  private predicate additionalLocalFlowStepNodeCand2(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, Configuration config
+  ) {
+    additionalLocalFlowStepNodeCand1(node1, node2, config) and
+    state1 = state2 and
+    Stage2::revFlow(node1, pragma[only_bind_into](state1), false, pragma[only_bind_into](config)) and
+    Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false,
+      pragma[only_bind_into](config))
+    or
+    additionalLocalStateStep(node1, state1, node2, state2, config) and
+    Stage2::revFlow(node1, state1, false, pragma[only_bind_into](config)) and
+    Stage2::revFlowAlias(node2, state2, false, pragma[only_bind_into](config))
+  }
+
+  /**
+   * Holds if the local path from `node1` to `node2` is a prefix of a maximal
+   * subsequence of local flow steps in a dataflow path.
+   *
+   * This is the transitive closure of `[additional]localFlowStep` beginning
+   * at `localFlowEntry`.
+   */
+  pragma[nomagic]
+  private predicate localFlowStepPlus(
+    NodeEx node1, FlowState state, NodeEx node2, boolean preservesValue, DataFlowType t,
+    Configuration config, LocalCallContext cc
+  ) {
+    not isUnreachableInCallCached(node2.asNode(), cc.(LocalCallContextSpecificCall).getCall()) and
+    (
+      localFlowEntry(node1, pragma[only_bind_into](state), pragma[only_bind_into](config)) and
+      (
+        localFlowStepNodeCand1(node1, node2, config) and
+        preservesValue = true and
+        t = node1.getDataFlowType() and // irrelevant dummy value
+        Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
+        or
+        additionalLocalFlowStepNodeCand2(node1, state, node2, state, config) and
+        preservesValue = false and
+        t = node2.getDataFlowType()
+      ) and
+      node1 != node2 and
+      cc.relevantFor(node1.getEnclosingCallable()) and
+      not isUnreachableInCallCached(node1.asNode(), cc.(LocalCallContextSpecificCall).getCall())
+      or
+      exists(NodeEx mid |
+        localFlowStepPlus(node1, pragma[only_bind_into](state), mid, preservesValue, t,
+          pragma[only_bind_into](config), cc) and
+        localFlowStepNodeCand1(mid, node2, config) and
+        not mid instanceof FlowCheckNode and
+        Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
+      )
+      or
+      exists(NodeEx mid |
+        localFlowStepPlus(node1, state, mid, _, _, pragma[only_bind_into](config), cc) and
+        additionalLocalFlowStepNodeCand2(mid, state, node2, state, config) and
+        not mid instanceof FlowCheckNode and
+        preservesValue = false and
+        t = node2.getDataFlowType()
+      )
+    )
+  }
+
+  /**
+   * Holds if `node1` can step to `node2` in one or more local steps and this
+   * path can occur as a maximal subsequence of local steps in a dataflow path.
+   */
+  pragma[nomagic]
+  predicate localFlowBigStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    AccessPathFrontNil apf, Configuration config, LocalCallContext callContext
+  ) {
+    localFlowStepPlus(node1, state1, node2, preservesValue, apf.getType(), config, callContext) and
+    localFlowExit(node2, state1, config) and
+    state1 = state2
+    or
+    additionalLocalFlowStepNodeCand2(node1, state1, node2, state2, config) and
+    state1 != state2 and
+    preservesValue = false and
+    apf = TFrontNil(node2.getDataFlowType()) and
+    callContext.relevantFor(node1.getEnclosingCallable()) and
+    not exists(DataFlowCall call | call = callContext.(LocalCallContextSpecificCall).getCall() |
+      isUnreachableInCallCached(node1.asNode(), call) or
+      isUnreachableInCallCached(node2.asNode(), call)
+    )
+  }
+}
+
+private import LocalFlowBigStep
+
+private module Stage3Param implements MkStage<Stage2>::StageParam {
+  private module PrevStage = Stage2;
+
+  class Ap = AccessPathFront;
+
+  class ApNil = AccessPathFrontNil;
+
+  PrevStage::Ap getApprox(Ap ap) { result = ap.toBoolNonEmpty() }
+
+  ApNil getApNil(NodeEx node) {
+    PrevStage::revFlow(node, _) and result = TFrontNil(node.getDataFlowType())
+  }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result.getHead() = tc and exists(tail) }
+
+  pragma[noinline]
+  Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathFrontOption;
+
+  ApOption apNone() { result = TAccessPathFrontNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathFrontSome(ap) }
+
+  import BooleanCallContext
+
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, state1, node2, state2, preservesValue, ap, config, _) and exists(lcc)
+  }
+
+  predicate flowOutOfCall = flowOutOfCallNodeCand2/5;
+
+  predicate flowIntoCall = flowIntoCallNodeCand2/5;
+
+  pragma[nomagic]
+  private predicate clearSet(NodeEx node, ContentSet c, Configuration config) {
+    PrevStage::revFlow(node, config) and
+    clearsContentCached(node.asNode(), c)
+  }
+
+  pragma[nomagic]
+  private predicate clearContent(NodeEx node, Content c, Configuration config) {
+    exists(ContentSet cs |
+      PrevStage::readStepCand(_, pragma[only_bind_into](c), _, pragma[only_bind_into](config)) and
+      c = cs.getAReadContent() and
+      clearSet(node, cs, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate clear(NodeEx node, Ap ap, Configuration config) {
+    clearContent(node, ap.getHead().getContent(), config)
+  }
+
+  pragma[nomagic]
+  private predicate expectsContentCand(NodeEx node, Ap ap, Configuration config) {
+    exists(Content c |
+      PrevStage::revFlow(node, pragma[only_bind_into](config)) and
+      PrevStage::readStepCand(_, c, _, pragma[only_bind_into](config)) and
+      expectsContentEx(node, c) and
+      c = ap.getHead().getContent()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate castingNodeEx(NodeEx node) { node.asNode() instanceof CastingNode }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    exists(state) and
+    exists(config) and
+    not clear(node, ap, config) and
+    (if castingNodeEx(node) then compatibleTypes(node.getDataFlowType(), ap.getType()) else any()) and
+    (
+      notExpectsContent(node)
+      or
+      expectsContentCand(node, ap, config)
+    )
+  }
+
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) {
+    // We need to typecheck stores here, since reverse flow through a getter
+    // might have a different type here compared to inside the getter.
+    compatibleTypes(ap.getType(), contentType)
+  }
+}
+
+private module Stage3 implements StageSig {
+  import MkStage<Stage2>::Stage<Stage3Param>
+}
+
+/**
+ * Holds if `argApf` is recorded as the summary context for flow reaching `node`
+ * and remains relevant for the following pruning stage.
+ */
+private predicate flowCandSummaryCtx(
+  NodeEx node, FlowState state, AccessPathFront argApf, Configuration config
+) {
+  exists(AccessPathFront apf |
+    Stage3::revFlow(node, state, true, _, apf, config) and
+    Stage3::fwdFlow(node, state, any(Stage3::CcCall ccc), TAccessPathFrontSome(argApf), apf, config)
+  )
+}
+
+/**
+ * Holds if a length 2 access path approximation with the head `tc` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen2unfolding(TypedContent tc, Configuration config) {
+  exists(int tails, int nodes, int apLimit, int tupleLimit |
+    tails = strictcount(AccessPathFront apf | Stage3::consCand(tc, apf, config)) and
+    nodes =
+      strictcount(NodeEx n, FlowState state |
+        Stage3::revFlow(n, state, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+        or
+        flowCandSummaryCtx(n, state, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+      ) and
+    accessPathApproxCostLimits(apLimit, tupleLimit) and
+    apLimit < tails and
+    tupleLimit < (tails - 1) * nodes and
+    not tc.forceHighPrecision()
+  )
+}
+
+private newtype TAccessPathApprox =
+  TNil(DataFlowType t) or
+  TConsNil(TypedContent tc, DataFlowType t) {
+    Stage3::consCand(tc, TFrontNil(t), _) and
+    not expensiveLen2unfolding(tc, _)
+  } or
+  TConsCons(TypedContent tc1, TypedContent tc2, int len) {
+    Stage3::consCand(tc1, TFrontHead(tc2), _) and
+    len in [2 .. accessPathLimit()] and
+    not expensiveLen2unfolding(tc1, _)
+  } or
+  TCons1(TypedContent tc, int len) {
+    len in [1 .. accessPathLimit()] and
+    expensiveLen2unfolding(tc, _)
+  }
+
+/**
+ * Conceptually a list of `TypedContent`s followed by a `DataFlowType`, but only
+ * the first two elements of the list and its length are tracked. If data flows
+ * from a source to a given node with a given `AccessPathApprox`, this indicates
+ * the sequence of dereference operations needed to get from the value in the node
+ * to the tracked object. The final type indicates the type of the tracked object.
+ */
+abstract private class AccessPathApprox extends TAccessPathApprox {
+  abstract string toString();
+
+  abstract TypedContent getHead();
+
+  abstract int len();
+
+  abstract DataFlowType getType();
+
+  abstract AccessPathFront getFront();
+
+  /** Gets the access path obtained by popping `head` from this path, if any. */
+  abstract AccessPathApprox pop(TypedContent head);
+}
+
+private class AccessPathApproxNil extends AccessPathApprox, TNil {
+  private DataFlowType t;
+
+  AccessPathApproxNil() { this = TNil(t) }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+
+  override TypedContent getHead() { none() }
+
+  override int len() { result = 0 }
+
+  override DataFlowType getType() { result = t }
+
+  override AccessPathFront getFront() { result = TFrontNil(t) }
+
+  override AccessPathApprox pop(TypedContent head) { none() }
+}
+
+abstract private class AccessPathApproxCons extends AccessPathApprox { }
+
+private class AccessPathApproxConsNil extends AccessPathApproxCons, TConsNil {
+  private TypedContent tc;
+  private DataFlowType t;
+
+  AccessPathApproxConsNil() { this = TConsNil(tc, t) }
+
+  override string toString() {
+    // The `concat` becomes "" if `ppReprType` has no result.
+    result = "[" + tc.toString() + "]" + concat(" : " + ppReprType(t))
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = 1 }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) { head = tc and result = TNil(t) }
+}
+
+private class AccessPathApproxConsCons extends AccessPathApproxCons, TConsCons {
+  private TypedContent tc1;
+  private TypedContent tc2;
+  private int len;
+
+  AccessPathApproxConsCons() { this = TConsCons(tc1, tc2, len) }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + tc1.toString() + ", " + tc2.toString() + "]"
+    else result = "[" + tc1.toString() + ", " + tc2.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc1 }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc1.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc1) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc1 and
+    (
+      result = TConsCons(tc2, _, len - 1)
+      or
+      len = 2 and
+      result = TConsNil(tc2, _)
+      or
+      result = TCons1(tc2, len - 1)
+    )
+  }
+}
+
+private class AccessPathApproxCons1 extends AccessPathApproxCons, TCons1 {
+  private TypedContent tc;
+  private int len;
+
+  AccessPathApproxCons1() { this = TCons1(tc, len) }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + tc.toString() + "]"
+    else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc and
+    (
+      exists(TypedContent tc2 | Stage3::consCand(tc, TFrontHead(tc2), _) |
+        result = TConsCons(tc2, _, len - 1)
+        or
+        len = 2 and
+        result = TConsNil(tc2, _)
+        or
+        result = TCons1(tc2, len - 1)
+      )
+      or
+      exists(DataFlowType t |
+        len = 1 and
+        Stage3::consCand(tc, TFrontNil(t), _) and
+        result = TNil(t)
+      )
+    )
+  }
+}
+
+/** Gets the access path obtained by popping `tc` from `ap`, if any. */
+private AccessPathApprox pop(TypedContent tc, AccessPathApprox apa) { result = apa.pop(tc) }
+
+/** Gets the access path obtained by pushing `tc` onto `ap`. */
+private AccessPathApprox push(TypedContent tc, AccessPathApprox apa) { apa = pop(tc, result) }
+
+private newtype TAccessPathApproxOption =
+  TAccessPathApproxNone() or
+  TAccessPathApproxSome(AccessPathApprox apa)
+
+private class AccessPathApproxOption extends TAccessPathApproxOption {
+  string toString() {
+    this = TAccessPathApproxNone() and result = "<none>"
+    or
+    this = TAccessPathApproxSome(any(AccessPathApprox apa | result = apa.toString()))
+  }
+}
+
+private module Stage4Param implements MkStage<Stage3>::StageParam {
+  private module PrevStage = Stage3;
+
+  class Ap = AccessPathApprox;
+
+  class ApNil = AccessPathApproxNil;
+
+  PrevStage::Ap getApprox(Ap ap) { result = ap.getFront() }
+
+  ApNil getApNil(NodeEx node) {
+    PrevStage::revFlow(node, _) and result = TNil(node.getDataFlowType())
+  }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result = push(tc, tail) }
+
+  pragma[noinline]
+  Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathApproxOption;
+
+  ApOption apNone() { result = TAccessPathApproxNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathApproxSome(ap) }
+
+  import Level1CallContext
+  import LocalCallContext
+
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getFront(), config, lcc)
+  }
+
+  pragma[nomagic]
+  predicate flowOutOfCall(
+    DataFlowCall call, RetNodeEx node1, NodeEx node2, boolean allowsFieldFlow, Configuration config
+  ) {
+    exists(FlowState state |
+      flowOutOfCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+      PrevStage::revFlow(node2, pragma[only_bind_into](state), _, pragma[only_bind_into](config)) and
+      PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  predicate flowIntoCall(
+    DataFlowCall call, ArgNodeEx node1, ParamNodeEx node2, boolean allowsFieldFlow,
+    Configuration config
+  ) {
+    exists(FlowState state |
+      flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+      PrevStage::revFlow(node2, pragma[only_bind_into](state), _, pragma[only_bind_into](config)) and
+      PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) { any() }
+
+  // Type checking is not necessary here as it has already been done in stage 3.
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+}
+
+private module Stage4 = MkStage<Stage3>::Stage<Stage4Param>;
+
+bindingset[conf, result]
+private Configuration unbindConf(Configuration conf) {
+  exists(Configuration c | result = pragma[only_bind_into](c) and conf = pragma[only_bind_into](c))
+}
+
+pragma[nomagic]
+private predicate nodeMayUseSummary0(
+  NodeEx n, DataFlowCallable c, FlowState state, AccessPathApprox apa, Configuration config
+) {
+  exists(AccessPathApprox apa0 |
+    Stage4::parameterMayFlowThrough(_, c, _, _) and
+    Stage4::revFlow(n, state, true, _, apa0, config) and
+    Stage4::fwdFlow(n, state, any(CallContextCall ccc), TAccessPathApproxSome(apa), apa0, config) and
+    n.getEnclosingCallable() = c
+  )
+}
+
+pragma[nomagic]
+private predicate nodeMayUseSummary(
+  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
+) {
+  exists(DataFlowCallable c |
+    Stage4::parameterMayFlowThrough(_, c, apa, config) and
+    nodeMayUseSummary0(n, c, state, apa, config)
+  )
+}
+
+private newtype TSummaryCtx =
+  TSummaryCtxNone() or
+  TSummaryCtxSome(ParamNodeEx p, FlowState state, AccessPath ap) {
+    exists(Configuration config |
+      Stage4::parameterMayFlowThrough(p, _, ap.getApprox(), config) and
+      Stage4::revFlow(p, state, _, config)
+    )
+  }
+
+/**
+ * A context for generating flow summaries. This represents flow entry through
+ * a specific parameter with an access path of a specific shape.
+ *
+ * Summaries are only created for parameters that may flow through.
+ */
+abstract private class SummaryCtx extends TSummaryCtx {
+  abstract string toString();
+}
+
+/** A summary context from which no flow summary can be generated. */
+private class SummaryCtxNone extends SummaryCtx, TSummaryCtxNone {
+  override string toString() { result = "<none>" }
+}
+
+/** A summary context from which a flow summary can be generated. */
+private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
+  private ParamNodeEx p;
+  private FlowState s;
+  private AccessPath ap;
+
+  SummaryCtxSome() { this = TSummaryCtxSome(p, s, ap) }
+
+  ParameterPosition getParameterPos() { p.isParameterOf(_, result) }
+
+  ParamNodeEx getParamNode() { result = p }
+
+  override string toString() { result = p + ": " + ap }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    p.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/**
+ * Gets the number of length 2 access path approximations that correspond to `apa`.
+ */
+private int count1to2unfold(AccessPathApproxCons1 apa, Configuration config) {
+  exists(TypedContent tc, int len |
+    tc = apa.getHead() and
+    len = apa.len() and
+    result =
+      strictcount(AccessPathFront apf |
+        Stage4::consCand(tc, any(AccessPathApprox ap | ap.getFront() = apf and ap.len() = len - 1),
+          config)
+      )
+  )
+}
+
+private int countNodesUsingAccessPath(AccessPathApprox apa, Configuration config) {
+  result =
+    strictcount(NodeEx n, FlowState state |
+      Stage4::revFlow(n, state, apa, config) or nodeMayUseSummary(n, state, apa, config)
+    )
+}
+
+/**
+ * Holds if a length 2 access path approximation matching `apa` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen1to2unfolding(AccessPathApproxCons1 apa, Configuration config) {
+  exists(int aps, int nodes, int apLimit, int tupleLimit |
+    aps = count1to2unfold(apa, config) and
+    nodes = countNodesUsingAccessPath(apa, config) and
+    accessPathCostLimits(apLimit, tupleLimit) and
+    apLimit < aps and
+    tupleLimit < (aps - 1) * nodes
+  )
+}
+
+private AccessPathApprox getATail(AccessPathApprox apa, Configuration config) {
+  exists(TypedContent head |
+    apa.pop(head) = result and
+    Stage4::consCand(head, result, config)
+  )
+}
+
+/**
+ * Holds with `unfold = false` if a precise head-tail representation of `apa` is
+ * expected to be expensive. Holds with `unfold = true` otherwise.
+ */
+private predicate evalUnfold(AccessPathApprox apa, boolean unfold, Configuration config) {
+  if apa.getHead().forceHighPrecision()
+  then unfold = true
+  else
+    exists(int aps, int nodes, int apLimit, int tupleLimit |
+      aps = countPotentialAps(apa, config) and
+      nodes = countNodesUsingAccessPath(apa, config) and
+      accessPathCostLimits(apLimit, tupleLimit) and
+      if apLimit < aps and tupleLimit < (aps - 1) * nodes then unfold = false else unfold = true
+    )
+}
+
+/**
+ * Gets the number of `AccessPath`s that correspond to `apa`.
+ */
+private int countAps(AccessPathApprox apa, Configuration config) {
+  evalUnfold(apa, false, config) and
+  result = 1 and
+  (not apa instanceof AccessPathApproxCons1 or expensiveLen1to2unfolding(apa, config))
+  or
+  evalUnfold(apa, false, config) and
+  result = count1to2unfold(apa, config) and
+  not expensiveLen1to2unfolding(apa, config)
+  or
+  evalUnfold(apa, true, config) and
+  result = countPotentialAps(apa, config)
+}
+
+/**
+ * Gets the number of `AccessPath`s that would correspond to `apa` assuming
+ * that it is expanded to a precise head-tail representation.
+ */
+language[monotonicAggregates]
+private int countPotentialAps(AccessPathApprox apa, Configuration config) {
+  apa instanceof AccessPathApproxNil and result = 1
+  or
+  result = strictsum(AccessPathApprox tail | tail = getATail(apa, config) | countAps(tail, config))
+}
+
+private newtype TAccessPath =
+  TAccessPathNil(DataFlowType t) or
+  TAccessPathCons(TypedContent head, AccessPath tail) {
+    exists(AccessPathApproxCons apa |
+      not evalUnfold(apa, false, _) and
+      head = apa.getHead() and
+      tail.getApprox() = getATail(apa, _)
+    )
+  } or
+  TAccessPathCons2(TypedContent head1, TypedContent head2, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      not expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head1 = apa.getHead() and
+      head2 = getATail(apa, _).getHead()
+    )
+  } or
+  TAccessPathCons1(TypedContent head, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head = apa.getHead()
+    )
+  }
+
+private newtype TPathNode =
+  TPathNodeMid(
+    NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap, Configuration config
+  ) {
+    // A PathNode is introduced by a source ...
+    Stage4::revFlow(node, state, config) and
+    sourceNode(node, state, config) and
+    (
+      if hasSourceCallCtx(config)
+      then cc instanceof CallContextSomeCall
+      else cc instanceof CallContextAny
+    ) and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(node.getDataFlowType())
+    or
+    // ... or a step from an existing PathNode to another node.
+    exists(PathNodeMid mid |
+      pathStep(mid, node, state, cc, sc, ap) and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      Stage4::revFlow(node, state, ap.getApprox(), pragma[only_bind_into](config))
+    )
+  } or
+  TPathNodeSink(NodeEx node, FlowState state, Configuration config) {
+    exists(PathNodeMid sink |
+      sink.isAtSink() and
+      node = sink.getNodeEx() and
+      state = sink.getState() and
+      config = sink.getConfiguration()
+    )
+  }
+
+/**
+ * A list of `TypedContent`s followed by a `DataFlowType`. If data flows from a
+ * source to a given node with a given `AccessPath`, this indicates the sequence
+ * of dereference operations needed to get from the value in the node to the
+ * tracked object. The final type indicates the type of the tracked object.
+ */
+private class AccessPath extends TAccessPath {
+  /** Gets the head of this access path, if any. */
+  abstract TypedContent getHead();
+
+  /** Gets the tail of this access path, if any. */
+  abstract AccessPath getTail();
+
+  /** Gets the front of this access path. */
+  abstract AccessPathFront getFront();
+
+  /** Gets the approximation of this access path. */
+  abstract AccessPathApprox getApprox();
+
+  /** Gets the length of this access path. */
+  abstract int length();
+
+  /** Gets a textual representation of this access path. */
+  abstract string toString();
+
+  /** Gets the access path obtained by popping `tc` from this access path, if any. */
+  final AccessPath pop(TypedContent tc) {
+    result = this.getTail() and
+    tc = this.getHead()
+  }
+
+  /** Gets the access path obtained by pushing `tc` onto this access path. */
+  final AccessPath push(TypedContent tc) { this = result.pop(tc) }
+}
+
+private class AccessPathNil extends AccessPath, TAccessPathNil {
+  private DataFlowType t;
+
+  AccessPathNil() { this = TAccessPathNil(t) }
+
+  DataFlowType getType() { result = t }
+
+  override TypedContent getHead() { none() }
+
+  override AccessPath getTail() { none() }
+
+  override AccessPathFrontNil getFront() { result = TFrontNil(t) }
+
+  override AccessPathApproxNil getApprox() { result = TNil(t) }
+
+  override int length() { result = 0 }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+}
+
+private class AccessPathCons extends AccessPath, TAccessPathCons {
+  private TypedContent head;
+  private AccessPath tail;
+
+  AccessPathCons() { this = TAccessPathCons(head, tail) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() { result = tail }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsNil(head, tail.(AccessPathNil).getType())
+    or
+    result = TConsCons(head, tail.getHead(), this.length())
+    or
+    result = TCons1(head, this.length())
+  }
+
+  override int length() { result = 1 + tail.length() }
+
+  private string toStringImpl(boolean needsSuffix) {
+    exists(DataFlowType t |
+      tail = TAccessPathNil(t) and
+      needsSuffix = false and
+      result = head.toString() + "]" + concat(" : " + ppReprType(t))
+    )
+    or
+    result = head + ", " + tail.(AccessPathCons).toStringImpl(needsSuffix)
+    or
+    exists(TypedContent tc2, TypedContent tc3, int len | tail = TAccessPathCons2(tc2, tc3, len) |
+      result = head + ", " + tc2 + ", " + tc3 + ", ... (" and len > 2 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + ", " + tc3 + "]" and len = 2 and needsSuffix = false
+    )
+    or
+    exists(TypedContent tc2, int len | tail = TAccessPathCons1(tc2, len) |
+      result = head + ", " + tc2 + ", ... (" and len > 1 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + "]" and len = 1 and needsSuffix = false
+    )
+  }
+
+  override string toString() {
+    result = "[" + this.toStringImpl(true) + this.length().toString() + ")]"
+    or
+    result = "[" + this.toStringImpl(false)
+  }
+}
+
+private class AccessPathCons2 extends AccessPath, TAccessPathCons2 {
+  private TypedContent head1;
+  private TypedContent head2;
+  private int len;
+
+  AccessPathCons2() { this = TAccessPathCons2(head1, head2, len) }
+
+  override TypedContent getHead() { result = head1 }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head1, result.getApprox(), _) and
+    result.getHead() = head2 and
+    result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head1) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsCons(head1, head2, len) or
+    result = TCons1(head1, len)
+  }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + head1.toString() + ", " + head2.toString() + "]"
+    else
+      result = "[" + head1.toString() + ", " + head2.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+private class AccessPathCons1 extends AccessPath, TAccessPathCons1 {
+  private TypedContent head;
+  private int len;
+
+  AccessPathCons1() { this = TAccessPathCons1(head, len) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head, result.getApprox(), _) and result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() { result = TCons1(head, len) }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + head.toString() + "]"
+    else result = "[" + head.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+/**
+ * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
+ * Only those `PathNode`s that are reachable from a source are generated.
+ */
+class PathNode extends TPathNode {
+  /** Gets a textual representation of this element. */
+  string toString() { none() }
+
+  /**
+   * Gets a textual representation of this element, including a textual
+   * representation of the call context.
+   */
+  string toStringWithContext() { none() }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    none()
+  }
+
+  /** Gets the underlying `Node`. */
+  final Node getNode() { this.(PathNodeImpl).getNodeEx().projectToNode() = result }
+
+  /** Gets the `FlowState` of this node. */
+  FlowState getState() { none() }
+
+  /** Gets the associated configuration. */
+  Configuration getConfiguration() { none() }
+
+  /** Gets a successor of this node, if any. */
+  final PathNode getASuccessor() {
+    result = this.(PathNodeImpl).getANonHiddenSuccessor() and
+    reach(this) and
+    reach(result)
+  }
+
+  /** Holds if this node is a source. */
+  predicate isSource() { none() }
+}
+
+abstract private class PathNodeImpl extends PathNode {
+  abstract PathNodeImpl getASuccessorImpl();
+
+  private PathNodeImpl getASuccessorIfHidden() {
+    this.isHidden() and
+    result = this.getASuccessorImpl()
+  }
+
+  final PathNodeImpl getANonHiddenSuccessor() {
+    result = this.getASuccessorImpl().getASuccessorIfHidden*() and
+    not this.isHidden() and
+    not result.isHidden()
+  }
+
+  abstract NodeEx getNodeEx();
+
+  predicate isHidden() {
+    not this.getConfiguration().includeHiddenNodes() and
+    (
+      hiddenNode(this.getNodeEx().asNode()) and
+      not this.isSource() and
+      not this instanceof PathNodeSink
+      or
+      this.getNodeEx() instanceof TNodeImplicitRead
+    )
+  }
+
+  private string ppAp() {
+    this instanceof PathNodeSink and result = ""
+    or
+    exists(string s | s = this.(PathNodeMid).getAp().toString() |
+      if s = "" then result = "" else result = " " + s
+    )
+  }
+
+  private string ppCtx() {
+    this instanceof PathNodeSink and result = ""
+    or
+    result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
+  }
+
+  override string toString() { result = this.getNodeEx().toString() + this.ppAp() }
+
+  override string toStringWithContext() {
+    result = this.getNodeEx().toString() + this.ppAp() + this.ppCtx()
+  }
+
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/** Holds if `n` can reach a sink. */
+private predicate directReach(PathNodeImpl n) {
+  n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
+}
+
+/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
+private predicate reach(PathNode n) { directReach(n) or Subpaths::retReach(n) }
+
+/** Holds if `n1.getASuccessor() = n2` and `n2` can reach a sink. */
+private predicate pathSucc(PathNodeImpl n1, PathNode n2) {
+  n1.getANonHiddenSuccessor() = n2 and directReach(n2)
+}
+
+private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
+
+/**
+ * Provides the query predicates needed to include a graph in a path-problem query.
+ */
+module PathGraph {
+  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+  query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }
+
+  /** Holds if `n` is a node in the graph of data flow path explanations. */
+  query predicate nodes(PathNode n, string key, string val) {
+    reach(n) and key = "semmle.label" and val = n.toString()
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {
+    Subpaths::subpaths(arg, par, ret, out) and
+    reach(arg) and
+    reach(par) and
+    reach(ret) and
+    reach(out)
+  }
+}
+
+/**
+ * An intermediate flow graph node. This is a triple consisting of a `Node`,
+ * a `CallContext`, and a `Configuration`.
+ */
+private class PathNodeMid extends PathNodeImpl, TPathNodeMid {
+  NodeEx node;
+  FlowState state;
+  CallContext cc;
+  SummaryCtx sc;
+  AccessPath ap;
+  Configuration config;
+
+  PathNodeMid() { this = TPathNodeMid(node, state, cc, sc, ap, config) }
+
+  override NodeEx getNodeEx() { result = node }
+
+  override FlowState getState() { result = state }
+
+  CallContext getCallContext() { result = cc }
+
+  SummaryCtx getSummaryCtx() { result = sc }
+
+  AccessPath getAp() { result = ap }
+
+  override Configuration getConfiguration() { result = config }
+
+  private PathNodeMid getSuccMid() {
+    pathStep(this, result.getNodeEx(), result.getState(), result.getCallContext(),
+      result.getSummaryCtx(), result.getAp()) and
+    result.getConfiguration() = unbindConf(this.getConfiguration())
+  }
+
+  override PathNodeImpl getASuccessorImpl() {
+    // an intermediate step to another intermediate node
+    result = this.getSuccMid()
+    or
+    // a final step to a sink
+    result = this.getSuccMid().projectToSink()
+  }
+
+  override predicate isSource() {
+    sourceNode(node, state, config) and
+    (
+      if hasSourceCallCtx(config)
+      then cc instanceof CallContextSomeCall
+      else cc instanceof CallContextAny
+    ) and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(node.getDataFlowType())
+  }
+
+  predicate isAtSink() {
+    sinkNode(node, state, config) and
+    ap instanceof AccessPathNil and
+    if hasSinkCallCtx(config)
+    then
+      // For `FeatureHasSinkCallContext` the condition `cc instanceof CallContextNoCall`
+      // is exactly what we need to check. This also implies
+      // `sc instanceof SummaryCtxNone`.
+      // For `FeatureEqualSourceSinkCallContext` the initial call context was
+      // set to `CallContextSomeCall` and jumps are disallowed, so
+      // `cc instanceof CallContextNoCall` never holds. On the other hand,
+      // in this case there's never any need to enter a call except to identify
+      // a summary, so the condition in `pathIntoCallable` enforces this, which
+      // means that `sc instanceof SummaryCtxNone` holds if and only if we are
+      // in the call context of the source.
+      sc instanceof SummaryCtxNone or
+      cc instanceof CallContextNoCall
+    else any()
+  }
+
+  PathNodeSink projectToSink() {
+    this.isAtSink() and
+    result.getNodeEx() = node and
+    result.getState() = state and
+    result.getConfiguration() = unbindConf(config)
+  }
+}
+
+/**
+ * A flow graph node corresponding to a sink. This is disjoint from the
+ * intermediate nodes in order to uniquely correspond to a given sink by
+ * excluding the `CallContext`.
+ */
+private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
+  NodeEx node;
+  FlowState state;
+  Configuration config;
+
+  PathNodeSink() { this = TPathNodeSink(node, state, config) }
+
+  override NodeEx getNodeEx() { result = node }
+
+  override FlowState getState() { result = state }
+
+  override Configuration getConfiguration() { result = config }
+
+  override PathNodeImpl getASuccessorImpl() { none() }
+
+  override predicate isSource() { sourceNode(node, state, config) }
+}
+
+private predicate pathNode(
+  PathNodeMid mid, NodeEx midnode, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap,
+  Configuration conf, LocalCallContext localCC
+) {
+  midnode = mid.getNodeEx() and
+  state = mid.getState() and
+  conf = mid.getConfiguration() and
+  cc = mid.getCallContext() and
+  sc = mid.getSummaryCtx() and
+  localCC =
+    getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
+      midnode.getEnclosingCallable()) and
+  ap = mid.getAp()
+}
+
+/**
+ * Holds if data may flow from `mid` to `node`. The last step in or out of
+ * a callable is recorded by `cc`.
+ */
+pragma[nomagic]
+private predicate pathStep(
+  PathNodeMid mid, NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap
+) {
+  exists(NodeEx midnode, FlowState state0, Configuration conf, LocalCallContext localCC |
+    pathNode(mid, midnode, state0, cc, sc, ap, conf, localCC) and
+    localFlowBigStep(midnode, state0, node, state, true, _, conf, localCC)
+  )
+  or
+  exists(
+    AccessPath ap0, NodeEx midnode, FlowState state0, Configuration conf, LocalCallContext localCC
+  |
+    pathNode(mid, midnode, state0, cc, sc, ap0, conf, localCC) and
+    localFlowBigStep(midnode, state0, node, state, false, ap.getFront(), conf, localCC) and
+    ap0 instanceof AccessPathNil
+  )
+  or
+  jumpStep(mid.getNodeEx(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  ap = mid.getAp()
+  or
+  additionalJumpStep(mid.getNodeEx(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(node.getDataFlowType())
+  or
+  additionalJumpStateStep(mid.getNodeEx(), mid.getState(), node, state, mid.getConfiguration()) and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(node.getDataFlowType())
+  or
+  exists(TypedContent tc | pathStoreStep(mid, node, state, ap.pop(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  exists(TypedContent tc | pathReadStep(mid, node, state, ap.push(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  pathIntoCallable(mid, node, state, _, cc, sc, _, _) and ap = mid.getAp()
+  or
+  pathOutOfCallable(mid, node, state, cc) and ap = mid.getAp() and sc instanceof SummaryCtxNone
+  or
+  pathThroughCallable(mid, node, state, cc, ap) and sc = mid.getSummaryCtx()
+}
+
+pragma[nomagic]
+private predicate pathReadStep(
+  PathNodeMid mid, NodeEx node, FlowState state, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  tc = ap0.getHead() and
+  Stage4::readStepCand(mid.getNodeEx(), tc.getContent(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc = mid.getCallContext()
+}
+
+pragma[nomagic]
+private predicate pathStoreStep(
+  PathNodeMid mid, NodeEx node, FlowState state, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  Stage4::storeStepCand(mid.getNodeEx(), _, tc, node, _, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc = mid.getCallContext()
+}
+
+private predicate pathOutOfCallable0(
+  PathNodeMid mid, ReturnPosition pos, FlowState state, CallContext innercc, AccessPathApprox apa,
+  Configuration config
+) {
+  pos = mid.getNodeEx().(RetNodeEx).getReturnPosition() and
+  state = mid.getState() and
+  innercc = mid.getCallContext() and
+  innercc instanceof CallContextNoCall and
+  apa = mid.getAp().getApprox() and
+  config = mid.getConfiguration()
+}
+
+pragma[nomagic]
+private predicate pathOutOfCallable1(
+  PathNodeMid mid, DataFlowCall call, ReturnKindExt kind, FlowState state, CallContext cc,
+  AccessPathApprox apa, Configuration config
+) {
+  exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+    pathOutOfCallable0(mid, pos, state, innercc, apa, config) and
+    c = pos.getCallable() and
+    kind = pos.getKind() and
+    resolveReturn(innercc, c, call)
+  |
+    if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+  )
+}
+
+pragma[noinline]
+private NodeEx getAnOutNodeFlow(
+  ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config
+) {
+  result.asNode() = kind.getAnOutNode(call) and
+  Stage4::revFlow(result, _, apa, config)
+}
+
+/**
+ * Holds if data may flow from `mid` to `out`. The last step of this path
+ * is a return from a callable and is recorded by `cc`, if needed.
+ */
+pragma[noinline]
+private predicate pathOutOfCallable(PathNodeMid mid, NodeEx out, FlowState state, CallContext cc) {
+  exists(ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config |
+    pathOutOfCallable1(mid, call, kind, state, cc, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
+ */
+pragma[noinline]
+private predicate pathIntoArg(
+  PathNodeMid mid, ParameterPosition ppos, FlowState state, CallContext cc, DataFlowCall call,
+  AccessPath ap, AccessPathApprox apa, Configuration config
+) {
+  exists(ArgNodeEx arg, ArgumentPosition apos |
+    pathNode(mid, arg, state, cc, _, ap, config, _) and
+    arg.asNode().(ArgNode).argumentOf(call, apos) and
+    apa = ap.getApprox() and
+    parameterMatch(ppos, apos)
+  )
+}
+
+pragma[nomagic]
+private predicate parameterCand(
+  DataFlowCallable callable, ParameterPosition pos, AccessPathApprox apa, Configuration config
+) {
+  exists(ParamNodeEx p |
+    Stage4::revFlow(p, _, apa, config) and
+    p.isParameterOf(callable, pos)
+  )
+}
+
+pragma[nomagic]
+private predicate pathIntoCallable0(
+  PathNodeMid mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+  CallContext outercc, DataFlowCall call, AccessPath ap, Configuration config
+) {
+  exists(AccessPathApprox apa |
+    pathIntoArg(mid, pragma[only_bind_into](pos), state, outercc, call, ap,
+      pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+    callable = resolveCall(call, outercc) and
+    parameterCand(callable, pragma[only_bind_into](pos), pragma[only_bind_into](apa),
+      pragma[only_bind_into](config))
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to `p` through `call`. The contexts
+ * before and after entering the callable are `outercc` and `innercc`,
+ * respectively.
+ */
+pragma[nomagic]
+private predicate pathIntoCallable(
+  PathNodeMid mid, ParamNodeEx p, FlowState state, CallContext outercc, CallContextCall innercc,
+  SummaryCtx sc, DataFlowCall call, Configuration config
+) {
+  exists(ParameterPosition pos, DataFlowCallable callable, AccessPath ap |
+    pathIntoCallable0(mid, callable, pos, state, outercc, call, ap, config) and
+    p.isParameterOf(callable, pos) and
+    (
+      sc = TSummaryCtxSome(p, state, ap)
+      or
+      not exists(TSummaryCtxSome(p, state, ap)) and
+      sc = TSummaryCtxNone() and
+      // When the call contexts of source and sink needs to match then there's
+      // never any reason to enter a callable except to find a summary. See also
+      // the comment in `PathNodeMid::isAtSink`.
+      not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+    )
+  |
+    if recordDataFlowCallSite(call, callable)
+    then innercc = TSpecificCall(call)
+    else innercc = TSomeCall()
+  )
+}
+
+/** Holds if data may flow from a parameter given by `sc` to a return of kind `kind`. */
+pragma[nomagic]
+private predicate paramFlowsThrough(
+  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
+  AccessPathApprox apa, Configuration config
+) {
+  exists(PathNodeMid mid, RetNodeEx ret, ParameterPosition pos |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    kind = ret.getKind() and
+    apa = ap.getApprox() and
+    pos = sc.getParameterPos() and
+    // we don't expect a parameter to return stored in itself, unless explicitly allowed
+    (
+      not kind.(ParamUpdateReturnKind).getPosition() = pos
+      or
+      sc.getParamNode().allowParameterReturnInSelf()
+    )
+  )
+}
+
+pragma[nomagic]
+private predicate pathThroughCallable0(
+  DataFlowCall call, PathNodeMid mid, ReturnKindExt kind, FlowState state, CallContext cc,
+  AccessPath ap, AccessPathApprox apa, Configuration config
+) {
+  exists(CallContext innercc, SummaryCtx sc |
+    pathIntoCallable(mid, _, _, cc, innercc, sc, call, config) and
+    paramFlowsThrough(kind, state, innercc, sc, ap, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` through a callable to the node `out`.
+ * The context `cc` is restored to its value prior to entering the callable.
+ */
+pragma[noinline]
+private predicate pathThroughCallable(
+  PathNodeMid mid, NodeEx out, FlowState state, CallContext cc, AccessPath ap
+) {
+  exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa, Configuration config |
+    pathThroughCallable0(call, mid, kind, state, cc, ap, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+private module Subpaths {
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple and `ret` is determined by
+   * `kind`, `sc`, `apout`, and `innercc`.
+   */
+  pragma[nomagic]
+  private predicate subpaths01(
+    PathNodeImpl arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
+    NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    exists(Configuration config |
+      pathThroughCallable(arg, out, pragma[only_bind_into](sout), _, pragma[only_bind_into](apout)) and
+      pathIntoCallable(arg, par, _, _, innercc, sc, _, config) and
+      paramFlowsThrough(kind, pragma[only_bind_into](sout), innercc, sc,
+        pragma[only_bind_into](apout), _, unbindConf(config)) and
+      not arg.isHidden()
+    )
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple and `ret` is determined by
+   * `kind`, `sc`, `sout`, `apout`, and `innercc`.
+   */
+  pragma[nomagic]
+  private predicate subpaths02(
+    PathNode arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
+    NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    subpaths01(arg, par, sc, innercc, kind, out, sout, apout) and
+    out.asNode() = kind.getAnOutNode(_)
+  }
+
+  pragma[nomagic]
+  private Configuration getPathNodeConf(PathNode n) { result = n.getConfiguration() }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple.
+   */
+  pragma[nomagic]
+  private predicate subpaths03(
+    PathNode arg, ParamNodeEx par, PathNodeMid ret, NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    exists(SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind, RetNodeEx retnode |
+      subpaths02(arg, par, sc, innercc, kind, out, sout, apout) and
+      pathNode(ret, retnode, sout, innercc, sc, apout, unbindConf(getPathNodeConf(arg)), _) and
+      kind = retnode.getKind()
+    )
+  }
+
+  private PathNodeImpl localStepToHidden(PathNodeImpl n) {
+    n.getASuccessorImpl() = result and
+    result.isHidden() and
+    exists(NodeEx n1, NodeEx n2 | n1 = n.getNodeEx() and n2 = result.getNodeEx() |
+      localFlowBigStep(n1, _, n2, _, _, _, _, _) or
+      store(n1, _, n2, _, _) or
+      readSet(n1, _, n2, _)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate hasSuccessor(PathNodeImpl pred, PathNodeMid succ, NodeEx succNode) {
+    succ = pred.getANonHiddenSuccessor() and
+    succNode = succ.getNodeEx()
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  predicate subpaths(PathNodeImpl arg, PathNodeImpl par, PathNodeImpl ret, PathNode out) {
+    exists(ParamNodeEx p, NodeEx o, FlowState sout, AccessPath apout, PathNodeMid out0 |
+      pragma[only_bind_into](arg).getANonHiddenSuccessor() = pragma[only_bind_into](out0) and
+      subpaths03(pragma[only_bind_into](arg), p, localStepToHidden*(ret), o, sout, apout) and
+      hasSuccessor(pragma[only_bind_into](arg), par, p) and
+      not ret.isHidden() and
+      pathNode(out0, o, sout, _, _, apout, _, _)
+    |
+      out = out0 or out = out0.projectToSink()
+    )
+  }
+
+  /**
+   * Holds if `n` can reach a return node in a summarized subpath that can reach a sink.
+   */
+  predicate retReach(PathNodeImpl n) {
+    exists(PathNode out | subpaths(_, _, n, out) | directReach(out) or retReach(out))
+    or
+    exists(PathNodeImpl mid |
+      retReach(mid) and
+      n.getANonHiddenSuccessor() = mid and
+      not subpaths(_, mid, _, _)
+    )
+  }
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+private predicate flowsTo(
+  PathNode flowsource, PathNodeSink flowsink, Node source, Node sink, Configuration configuration
+) {
+  flowsource.isSource() and
+  flowsource.getConfiguration() = configuration and
+  flowsource.(PathNodeImpl).getNodeEx().asNode() = source and
+  (flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
+  flowsink.getNodeEx().asNode() = sink
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+predicate flowsTo(Node source, Node sink, Configuration configuration) {
+  flowsTo(_, _, source, sink, configuration)
+}
+
+private predicate finalStats(
+  boolean fwd, int nodes, int fields, int conscand, int states, int tuples
+) {
+  fwd = true and
+  nodes = count(NodeEx n0 | exists(PathNodeImpl pn | pn.getNodeEx() = n0)) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0)) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap)) and
+  states = count(FlowState state | exists(PathNodeMid pn | pn.getState() = state)) and
+  tuples = count(PathNode pn)
+  or
+  fwd = false and
+  nodes = count(NodeEx n0 | exists(PathNodeImpl pn | pn.getNodeEx() = n0 and reach(pn))) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0 and reach(pn))) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap and reach(pn))) and
+  states = count(FlowState state | exists(PathNodeMid pn | pn.getState() = state and reach(pn))) and
+  tuples = count(PathNode pn | reach(pn))
+}
+
+/**
+ * INTERNAL: Only for debugging.
+ *
+ * Calculates per-stage metrics for data flow.
+ */
+predicate stageStats(
+  int n, string stage, int nodes, int fields, int conscand, int states, int tuples,
+  Configuration config
+) {
+  stage = "1 Fwd" and
+  n = 10 and
+  Stage1::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "1 Rev" and
+  n = 15 and
+  Stage1::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "2 Fwd" and
+  n = 20 and
+  Stage2::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "2 Rev" and
+  n = 25 and
+  Stage2::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "3 Fwd" and
+  n = 30 and
+  Stage3::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "3 Rev" and
+  n = 35 and
+  Stage3::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "4 Fwd" and
+  n = 40 and
+  Stage4::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "4 Rev" and
+  n = 45 and
+  Stage4::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "5 Fwd" and n = 50 and finalStats(true, nodes, fields, conscand, states, tuples)
+  or
+  stage = "5 Rev" and n = 55 and finalStats(false, nodes, fields, conscand, states, tuples)
+}
+
+private module FlowExploration {
+  private predicate callableStep(DataFlowCallable c1, DataFlowCallable c2, Configuration config) {
+    exists(NodeEx node1, NodeEx node2 |
+      jumpStep(node1, node2, config)
+      or
+      additionalJumpStep(node1, node2, config)
+      or
+      additionalJumpStateStep(node1, _, node2, _, config)
+      or
+      // flow into callable
+      viableParamArgEx(_, node2, node1)
+      or
+      // flow out of a callable
+      viableReturnPosOutEx(_, node1.(RetNodeEx).getReturnPosition(), node2)
+    |
+      c1 = node1.getEnclosingCallable() and
+      c2 = node2.getEnclosingCallable() and
+      c1 != c2
+    )
+  }
+
+  private predicate interestingCallableSrc(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSource(n) or config.isSource(n, _) | c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSrc(mid, config) and callableStep(mid, c, config)
+    )
+  }
+
+  private predicate interestingCallableSink(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSink(n) or config.isSink(n, _) | c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSink(mid, config) and callableStep(c, mid, config)
+    )
+  }
+
+  private newtype TCallableExt =
+    TCallable(DataFlowCallable c, Configuration config) {
+      interestingCallableSrc(c, config) or
+      interestingCallableSink(c, config)
+    } or
+    TCallableSrc() or
+    TCallableSink()
+
+  private predicate callableExtSrc(TCallableSrc src) { any() }
+
+  private predicate callableExtSink(TCallableSink sink) { any() }
+
+  private predicate callableExtStepFwd(TCallableExt ce1, TCallableExt ce2) {
+    exists(DataFlowCallable c1, DataFlowCallable c2, Configuration config |
+      callableStep(c1, c2, config) and
+      ce1 = TCallable(c1, pragma[only_bind_into](config)) and
+      ce2 = TCallable(c2, pragma[only_bind_into](config))
+    )
+    or
+    exists(Node n, Configuration config |
+      ce1 = TCallableSrc() and
+      (config.isSource(n) or config.isSource(n, _)) and
+      ce2 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+    or
+    exists(Node n, Configuration config |
+      ce2 = TCallableSink() and
+      (config.isSink(n) or config.isSink(n, _)) and
+      ce1 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+  }
+
+  private predicate callableExtStepRev(TCallableExt ce1, TCallableExt ce2) {
+    callableExtStepFwd(ce2, ce1)
+  }
+
+  private int distSrcExt(TCallableExt c) =
+    shortestDistances(callableExtSrc/1, callableExtStepFwd/2)(_, c, result)
+
+  private int distSinkExt(TCallableExt c) =
+    shortestDistances(callableExtSink/1, callableExtStepRev/2)(_, c, result)
+
+  private int distSrc(DataFlowCallable c, Configuration config) {
+    result = distSrcExt(TCallable(c, config)) - 1
+  }
+
+  private int distSink(DataFlowCallable c, Configuration config) {
+    result = distSinkExt(TCallable(c, config)) - 1
+  }
+
+  private newtype TPartialAccessPath =
+    TPartialNil(DataFlowType t) or
+    TPartialCons(TypedContent tc, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `TypedContent`s followed by a `Type`, but only the first
+   * element of the list and its length are tracked. If data flows from a source to
+   * a given node with a given `AccessPath`, this indicates the sequence of
+   * dereference operations needed to get from the value in the node to the
+   * tracked object. The final type indicates the type of the tracked object.
+   */
+  private class PartialAccessPath extends TPartialAccessPath {
+    abstract string toString();
+
+    TypedContent getHead() { this = TPartialCons(result, _) }
+
+    int len() {
+      this = TPartialNil(_) and result = 0
+      or
+      this = TPartialCons(_, result)
+    }
+
+    DataFlowType getType() {
+      this = TPartialNil(result)
+      or
+      exists(TypedContent head | this = TPartialCons(head, _) | result = head.getContainerType())
+    }
+  }
+
+  private class PartialAccessPathNil extends PartialAccessPath, TPartialNil {
+    override string toString() {
+      exists(DataFlowType t | this = TPartialNil(t) | result = concat(": " + ppReprType(t)))
+    }
+  }
+
+  private class PartialAccessPathCons extends PartialAccessPath, TPartialCons {
+    override string toString() {
+      exists(TypedContent tc, int len | this = TPartialCons(tc, len) |
+        if len = 1
+        then result = "[" + tc.toString() + "]"
+        else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private newtype TRevPartialAccessPath =
+    TRevPartialNil() or
+    TRevPartialCons(Content c, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `Content`s, but only the first
+   * element of the list and its length are tracked.
+   */
+  private class RevPartialAccessPath extends TRevPartialAccessPath {
+    abstract string toString();
+
+    Content getHead() { this = TRevPartialCons(result, _) }
+
+    int len() {
+      this = TRevPartialNil() and result = 0
+      or
+      this = TRevPartialCons(_, result)
+    }
+  }
+
+  private class RevPartialAccessPathNil extends RevPartialAccessPath, TRevPartialNil {
+    override string toString() { result = "" }
+  }
+
+  private class RevPartialAccessPathCons extends RevPartialAccessPath, TRevPartialCons {
+    override string toString() {
+      exists(Content c, int len | this = TRevPartialCons(c, len) |
+        if len = 1
+        then result = "[" + c.toString() + "]"
+        else result = "[" + c.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private predicate relevantState(FlowState state) {
+    sourceNode(_, state, _) or
+    sinkNode(_, state, _) or
+    additionalLocalStateStep(_, state, _, _, _) or
+    additionalLocalStateStep(_, _, _, state, _) or
+    additionalJumpStateStep(_, state, _, _, _) or
+    additionalJumpStateStep(_, _, _, state, _)
+  }
+
+  private newtype TSummaryCtx1 =
+    TSummaryCtx1None() or
+    TSummaryCtx1Param(ParamNodeEx p)
+
+  private newtype TSummaryCtx2 =
+    TSummaryCtx2None() or
+    TSummaryCtx2Some(FlowState s) { relevantState(s) }
+
+  private newtype TSummaryCtx3 =
+    TSummaryCtx3None() or
+    TSummaryCtx3Some(PartialAccessPath ap)
+
+  private newtype TRevSummaryCtx1 =
+    TRevSummaryCtx1None() or
+    TRevSummaryCtx1Some(ReturnPosition pos)
+
+  private newtype TRevSummaryCtx2 =
+    TRevSummaryCtx2None() or
+    TRevSummaryCtx2Some(FlowState s) { relevantState(s) }
+
+  private newtype TRevSummaryCtx3 =
+    TRevSummaryCtx3None() or
+    TRevSummaryCtx3Some(RevPartialAccessPath ap)
+
+  private newtype TPartialPathNode =
+    TPartialPathNodeFwd(
+      NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+      TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+    ) {
+      sourceNode(node, state, config) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      sc3 = TSummaryCtx3None() and
+      ap = TPartialNil(node.getDataFlowType()) and
+      exists(config.explorationLimit())
+      or
+      partialPathNodeMk0(node, state, cc, sc1, sc2, sc3, ap, config) and
+      distSrc(node.getEnclosingCallable(), config) <= config.explorationLimit()
+    } or
+    TPartialPathNodeRev(
+      NodeEx node, FlowState state, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2, TRevSummaryCtx3 sc3,
+      RevPartialAccessPath ap, Configuration config
+    ) {
+      sinkNode(node, state, config) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = TRevPartialNil() and
+      exists(config.explorationLimit())
+      or
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
+    }
+
+  pragma[nomagic]
+  private predicate partialPathNodeMk0(
+    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
+  }
+
+  /**
+   * A `Node` augmented with a call context, an access path, and a configuration.
+   */
+  class PartialPathNode extends TPartialPathNode {
+    /** Gets a textual representation of this element. */
+    string toString() { result = this.getNodeEx().toString() + this.ppAp() }
+
+    /**
+     * Gets a textual representation of this element, including a textual
+     * representation of the call context.
+     */
+    string toStringWithContext() {
+      result = this.getNodeEx().toString() + this.ppAp() + this.ppCtx()
+    }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+
+    /** Gets the underlying `Node`. */
+    final Node getNode() { this.getNodeEx().projectToNode() = result }
+
+    FlowState getState() { none() }
+
+    private NodeEx getNodeEx() {
+      result = this.(PartialPathNodeFwd).getNodeEx() or
+      result = this.(PartialPathNodeRev).getNodeEx()
+    }
+
+    /** Gets the associated configuration. */
+    Configuration getConfiguration() { none() }
+
+    /** Gets a successor of this node, if any. */
+    PartialPathNode getASuccessor() { none() }
+
+    /**
+     * Gets the approximate distance to the nearest source measured in number
+     * of interprocedural steps.
+     */
+    int getSourceDistance() {
+      result = distSrc(this.getNodeEx().getEnclosingCallable(), this.getConfiguration())
+    }
+
+    /**
+     * Gets the approximate distance to the nearest sink measured in number
+     * of interprocedural steps.
+     */
+    int getSinkDistance() {
+      result = distSink(this.getNodeEx().getEnclosingCallable(), this.getConfiguration())
+    }
+
+    private string ppAp() {
+      exists(string s |
+        s = this.(PartialPathNodeFwd).getAp().toString() or
+        s = this.(PartialPathNodeRev).getAp().toString()
+      |
+        if s = "" then result = "" else result = " " + s
+      )
+    }
+
+    private string ppCtx() {
+      result = " <" + this.(PartialPathNodeFwd).getCallContext().toString() + ">"
+    }
+
+    /** Holds if this is a source in a forward-flow path. */
+    predicate isFwdSource() { this.(PartialPathNodeFwd).isSource() }
+
+    /** Holds if this is a sink in a reverse-flow path. */
+    predicate isRevSink() { this.(PartialPathNodeRev).isSink() }
+  }
+
+  /**
+   * Provides the query predicates needed to include a graph in a path-problem query.
+   */
+  module PartialPathGraph {
+    /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+    query predicate edges(PartialPathNode a, PartialPathNode b) { a.getASuccessor() = b }
+  }
+
+  private class PartialPathNodeFwd extends PartialPathNode, TPartialPathNodeFwd {
+    NodeEx node;
+    FlowState state;
+    CallContext cc;
+    TSummaryCtx1 sc1;
+    TSummaryCtx2 sc2;
+    TSummaryCtx3 sc3;
+    PartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeFwd() { this = TPartialPathNodeFwd(node, state, cc, sc1, sc2, sc3, ap, config) }
+
+    NodeEx getNodeEx() { result = node }
+
+    override FlowState getState() { result = state }
+
+    CallContext getCallContext() { result = cc }
+
+    TSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    TSummaryCtx3 getSummaryCtx3() { result = sc3 }
+
+    PartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeFwd getASuccessor() {
+      partialPathStep(this, result.getNodeEx(), result.getState(), result.getCallContext(),
+        result.getSummaryCtx1(), result.getSummaryCtx2(), result.getSummaryCtx3(), result.getAp(),
+        result.getConfiguration())
+    }
+
+    predicate isSource() {
+      sourceNode(node, state, config) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      sc3 = TSummaryCtx3None() and
+      ap instanceof TPartialNil
+    }
+  }
+
+  private class PartialPathNodeRev extends PartialPathNode, TPartialPathNodeRev {
+    NodeEx node;
+    FlowState state;
+    TRevSummaryCtx1 sc1;
+    TRevSummaryCtx2 sc2;
+    TRevSummaryCtx3 sc3;
+    RevPartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeRev() { this = TPartialPathNodeRev(node, state, sc1, sc2, sc3, ap, config) }
+
+    NodeEx getNodeEx() { result = node }
+
+    override FlowState getState() { result = state }
+
+    TRevSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TRevSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    TRevSummaryCtx3 getSummaryCtx3() { result = sc3 }
+
+    RevPartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeRev getASuccessor() {
+      revPartialPathStep(result, this.getNodeEx(), this.getState(), this.getSummaryCtx1(),
+        this.getSummaryCtx2(), this.getSummaryCtx3(), this.getAp(), this.getConfiguration())
+    }
+
+    predicate isSink() {
+      sinkNode(node, state, config) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = TRevPartialNil()
+    }
+  }
+
+  private predicate partialPathStep(
+    PartialPathNodeFwd mid, NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1,
+    TSummaryCtx2 sc2, TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    not isUnreachableInCallCached(node.asNode(), cc.(CallContextSpecificCall).getCall()) and
+    (
+      localFlowStep(mid.getNodeEx(), node, config) and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+      or
+      additionalLocalFlowStep(mid.getNodeEx(), node, config) and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(node.getDataFlowType()) and
+      config = mid.getConfiguration()
+      or
+      additionalLocalStateStep(mid.getNodeEx(), mid.getState(), node, state, config) and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(node.getDataFlowType()) and
+      config = mid.getConfiguration()
+    )
+    or
+    jumpStep(mid.getNodeEx(), node, config) and
+    state = mid.getState() and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(mid.getNodeEx(), node, config) and
+    state = mid.getState() and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(node.getDataFlowType()) and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStateStep(mid.getNodeEx(), mid.getState(), node, state, config) and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(node.getDataFlowType()) and
+    config = mid.getConfiguration()
+    or
+    partialPathStoreStep(mid, _, _, node, ap) and
+    state = mid.getState() and
+    cc = mid.getCallContext() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    config = mid.getConfiguration()
+    or
+    exists(PartialAccessPath ap0, TypedContent tc |
+      partialPathReadStep(mid, ap0, tc, node, cc, config) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      apConsFwd(ap, tc, ap0, config)
+    )
+    or
+    partialPathIntoCallable(mid, node, state, _, cc, sc1, sc2, sc3, _, ap, config)
+    or
+    partialPathOutOfCallable(mid, node, state, cc, ap, config) and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None()
+    or
+    partialPathThroughCallable(mid, node, state, cc, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3()
+  }
+
+  bindingset[result, i]
+  private int unbindInt(int i) { pragma[only_bind_out](i) = pragma[only_bind_out](result) }
+
+  pragma[inline]
+  private predicate partialPathStoreStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap1, TypedContent tc, NodeEx node,
+    PartialAccessPath ap2
+  ) {
+    exists(NodeEx midNode, DataFlowType contentType |
+      midNode = mid.getNodeEx() and
+      ap1 = mid.getAp() and
+      store(midNode, tc, node, contentType, mid.getConfiguration()) and
+      ap2.getHead() = tc and
+      ap2.len() = unbindInt(ap1.len() + 1) and
+      compatibleTypes(ap1.getType(), contentType)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsFwd(
+    PartialAccessPath ap1, TypedContent tc, PartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStoreStep(mid, ap1, tc, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathReadStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap, TypedContent tc, NodeEx node, CallContext cc,
+    Configuration config
+  ) {
+    exists(NodeEx midNode |
+      midNode = mid.getNodeEx() and
+      ap = mid.getAp() and
+      read(midNode, tc.getContent(), node, pragma[only_bind_into](config)) and
+      ap.getHead() = tc and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      cc = mid.getCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable0(
+    PartialPathNodeFwd mid, ReturnPosition pos, FlowState state, CallContext innercc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    pos = mid.getNodeEx().(RetNodeEx).getReturnPosition() and
+    state = mid.getState() and
+    innercc = mid.getCallContext() and
+    innercc instanceof CallContextNoCall and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+  }
+
+  pragma[nomagic]
+  private predicate partialPathOutOfCallable1(
+    PartialPathNodeFwd mid, DataFlowCall call, ReturnKindExt kind, FlowState state, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+      partialPathOutOfCallable0(mid, pos, state, innercc, ap, config) and
+      c = pos.getCallable() and
+      kind = pos.getKind() and
+      resolveReturn(innercc, c, call)
+    |
+      if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable(
+    PartialPathNodeFwd mid, NodeEx out, FlowState state, CallContext cc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(ReturnKindExt kind, DataFlowCall call |
+      partialPathOutOfCallable1(mid, call, kind, state, cc, ap, config)
+    |
+      out.asNode() = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathIntoArg(
+    PartialPathNodeFwd mid, ParameterPosition ppos, FlowState state, CallContext cc,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ArgNode arg, ArgumentPosition apos |
+      arg = mid.getNodeEx().asNode() and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      arg.argumentOf(call, apos) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration() and
+      parameterMatch(ppos, apos)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathIntoCallable0(
+    PartialPathNodeFwd mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+    CallContext outercc, DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    partialPathIntoArg(mid, pos, state, outercc, call, ap, config) and
+    callable = resolveCall(call, outercc)
+  }
+
+  private predicate partialPathIntoCallable(
+    PartialPathNodeFwd mid, ParamNodeEx p, FlowState state, CallContext outercc,
+    CallContextCall innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ParameterPosition pos, DataFlowCallable callable |
+      partialPathIntoCallable0(mid, callable, pos, state, outercc, call, ap, config) and
+      p.isParameterOf(callable, pos) and
+      sc1 = TSummaryCtx1Param(p) and
+      sc2 = TSummaryCtx2Some(state) and
+      sc3 = TSummaryCtx3Some(ap)
+    |
+      if recordDataFlowCallSite(call, callable)
+      then innercc = TSpecificCall(call)
+      else innercc = TSomeCall()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate paramFlowsThroughInPartialPath(
+    ReturnKindExt kind, FlowState state, CallContextCall cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid, RetNodeEx ret |
+      mid.getNodeEx() = ret and
+      kind = ret.getKind() and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      config = mid.getConfiguration() and
+      ap = mid.getAp()
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeFwd mid, ReturnKindExt kind, FlowState state, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(CallContext innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3 |
+      partialPathIntoCallable(mid, _, _, cc, innercc, sc1, sc2, sc3, call, _, config) and
+      paramFlowsThroughInPartialPath(kind, state, innercc, sc1, sc2, sc3, ap, config)
+    )
+  }
+
+  private predicate partialPathThroughCallable(
+    PartialPathNodeFwd mid, NodeEx out, FlowState state, CallContext cc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(DataFlowCall call, ReturnKindExt kind |
+      partialPathThroughCallable0(call, mid, kind, state, cc, ap, config) and
+      out.asNode() = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStep(
+    PartialPathNodeRev mid, NodeEx node, FlowState state, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2,
+    TRevSummaryCtx3 sc3, RevPartialAccessPath ap, Configuration config
+  ) {
+    localFlowStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalFlowStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalStateStep(node, state, mid.getNodeEx(), mid.getState(), config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    jumpStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStateStep(node, state, mid.getNodeEx(), mid.getState(), config) and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    revPartialPathReadStep(mid, _, _, node, ap) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    config = mid.getConfiguration()
+    or
+    exists(RevPartialAccessPath ap0, Content c |
+      revPartialPathStoreStep(mid, ap0, c, node, config) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      apConsRev(ap, c, ap0, config)
+    )
+    or
+    exists(ParamNodeEx p |
+      mid.getNodeEx() = p and
+      viableParamArgEx(_, p, node) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+    or
+    exists(ReturnPosition pos |
+      revPartialPathIntoReturn(mid, pos, state, sc1, sc2, sc3, _, ap, config) and
+      pos = getReturnPosition(node.asNode())
+    )
+    or
+    revPartialPathThroughCallable(mid, node, state, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3()
+  }
+
+  pragma[inline]
+  private predicate revPartialPathReadStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap1, Content c, NodeEx node,
+    RevPartialAccessPath ap2
+  ) {
+    exists(NodeEx midNode |
+      midNode = mid.getNodeEx() and
+      ap1 = mid.getAp() and
+      read(node, c, midNode, mid.getConfiguration()) and
+      ap2.getHead() = c and
+      ap2.len() = unbindInt(ap1.len() + 1)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsRev(
+    RevPartialAccessPath ap1, Content c, RevPartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid |
+      revPartialPathReadStep(mid, ap1, c, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStoreStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap, Content c, NodeEx node, Configuration config
+  ) {
+    exists(NodeEx midNode, TypedContent tc |
+      midNode = mid.getNodeEx() and
+      ap = mid.getAp() and
+      store(node, tc, midNode, _, config) and
+      ap.getHead() = c and
+      config = mid.getConfiguration() and
+      tc.getContent() = c
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathIntoReturn(
+    PartialPathNodeRev mid, ReturnPosition pos, FlowState state, TRevSummaryCtx1Some sc1,
+    TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3, DataFlowCall call, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(NodeEx out |
+      mid.getNodeEx() = out and
+      mid.getState() = state and
+      viableReturnPosOutEx(call, pos, out) and
+      sc1 = TRevSummaryCtx1Some(pos) and
+      sc2 = TRevSummaryCtx2Some(state) and
+      sc3 = TRevSummaryCtx3Some(ap) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathFlowsThrough(
+    ArgumentPosition apos, FlowState state, TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2,
+    TRevSummaryCtx3Some sc3, RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid, ParamNodeEx p, ParameterPosition ppos |
+      mid.getNodeEx() = p and
+      mid.getState() = state and
+      p.getPosition() = ppos and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration() and
+      parameterMatch(ppos, apos)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeRev mid, ArgumentPosition pos, FlowState state,
+    RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3 |
+      revPartialPathIntoReturn(mid, _, _, sc1, sc2, sc3, call, _, config) and
+      revPartialPathFlowsThrough(pos, state, sc1, sc2, sc3, ap, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable(
+    PartialPathNodeRev mid, ArgNodeEx node, FlowState state, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(DataFlowCall call, ArgumentPosition pos |
+      revPartialPathThroughCallable0(call, mid, pos, state, ap, config) and
+      node.asNode().(ArgNode).argumentOf(call, pos)
+    )
+  }
+}
+
+import FlowExploration
+
+private predicate partialFlow(
+  PartialPathNode source, PartialPathNode node, Configuration configuration
+) {
+  source.getConfiguration() = configuration and
+  source.isFwdSource() and
+  node = source.getASuccessor+()
+}
+
+private predicate revPartialFlow(
+  PartialPathNode node, PartialPathNode sink, Configuration configuration
+) {
+  sink.getConfiguration() = configuration and
+  sink.isRevSink() and
+  node.getASuccessor+() = sink
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
new file mode 100644
index 00000000000..468f8640a78
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
@@ -0,0 +1,4450 @@
+/**
+ * Provides an implementation of global (interprocedural) data flow. This file
+ * re-exports the local (intraprocedural) data flow analysis from
+ * `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
+ * through the `Configuration` class. This file exists in several identical
+ * copies, allowing queries to use multiple `Configuration` classes that depend
+ * on each other without introducing mutual recursion among those configurations.
+ */
+
+private import DataFlowImplCommon
+private import DataFlowImplSpecific::Private
+import DataFlowImplSpecific::Public
+import DataFlowImplCommonPublic
+
+/**
+ * A configuration of interprocedural data flow analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the global data flow library must define its own unique extension
+ * of this abstract class. To create a configuration, extend this class with
+ * a subclass whose characteristic predicate is a unique singleton string.
+ * For example, write
+ *
+ * ```ql
+ * class MyAnalysisConfiguration extends DataFlow::Configuration {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Optionally override `isBarrier`.
+ *   // Optionally override `isAdditionalFlowStep`.
+ * }
+ * ```
+ * Conceptually, this defines a graph where the nodes are `DataFlow::Node`s and
+ * the edges are those data-flow steps that preserve the value of the node
+ * along with any additional edges defined by `isAdditionalFlowStep`.
+ * Specifying nodes in `isBarrier` will remove those nodes from the graph, and
+ * specifying nodes in `isBarrierIn` and/or `isBarrierOut` will remove in-going
+ * and/or out-going edges from those nodes, respectively.
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```ql
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but two classes extending
+ * `DataFlow::Configuration` should never depend on each other. One of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`.
+ */
+abstract class Configuration extends string {
+  bindingset[this]
+  Configuration() { any() }
+
+  /**
+   * Holds if `source` is a relevant data flow source.
+   */
+  predicate isSource(Node source) { none() }
+
+  /**
+   * Holds if `source` is a relevant data flow source with the given initial
+   * `state`.
+   */
+  predicate isSource(Node source, FlowState state) { none() }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink.
+   */
+  predicate isSink(Node sink) { none() }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink accepting `state`.
+   */
+  predicate isSink(Node source, FlowState state) { none() }
+
+  /**
+   * Holds if data flow through `node` is prohibited. This completely removes
+   * `node` from the data flow graph.
+   */
+  predicate isBarrier(Node node) { none() }
+
+  /**
+   * Holds if data flow through `node` is prohibited when the flow state is
+   * `state`.
+   */
+  predicate isBarrier(Node node, FlowState state) { none() }
+
+  /** Holds if data flow into `node` is prohibited. */
+  predicate isBarrierIn(Node node) { none() }
+
+  /** Holds if data flow out of `node` is prohibited. */
+  predicate isBarrierOut(Node node) { none() }
+
+  /**
+   * DEPRECATED: Use `isBarrier` and `BarrierGuard` module instead.
+   *
+   * Holds if data flow through nodes guarded by `guard` is prohibited.
+   */
+  deprecated predicate isBarrierGuard(BarrierGuard guard) { none() }
+
+  /**
+   * DEPRECATED: Use `isBarrier` and `BarrierGuard` module instead.
+   *
+   * Holds if data flow through nodes guarded by `guard` is prohibited when
+   * the flow state is `state`
+   */
+  deprecated predicate isBarrierGuard(BarrierGuard guard, FlowState state) { none() }
+
+  /**
+   * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
+   */
+  predicate isAdditionalFlowStep(Node node1, Node node2) { none() }
+
+  /**
+   * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
+   * This step is only applicable in `state1` and updates the flow state to `state2`.
+   */
+  predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
+    none()
+  }
+
+  /**
+   * Holds if an arbitrary number of implicit read steps of content `c` may be
+   * taken at `node`.
+   */
+  predicate allowImplicitRead(Node node, ContentSet c) { none() }
+
+  /**
+   * Gets the virtual dispatch branching limit when calculating field flow.
+   * This can be overridden to a smaller value to improve performance (a
+   * value of 0 disables field flow), or a larger value to get more results.
+   */
+  int fieldFlowBranchLimit() { result = 2 }
+
+  /**
+   * Gets a data flow configuration feature to add restrictions to the set of
+   * valid flow paths.
+   *
+   * - `FeatureHasSourceCallContext`:
+   *    Assume that sources have some existing call context to disallow
+   *    conflicting return-flow directly following the source.
+   * - `FeatureHasSinkCallContext`:
+   *    Assume that sinks have some existing call context to disallow
+   *    conflicting argument-to-parameter flow directly preceding the sink.
+   * - `FeatureEqualSourceSinkCallContext`:
+   *    Implies both of the above and additionally ensures that the entire flow
+   *    path preserves the call context.
+   */
+  FlowFeature getAFeature() { none() }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   */
+  predicate hasFlow(Node source, Node sink) { flowsTo(source, sink, this) }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   *
+   * The corresponding paths are generated from the end-points and the graph
+   * included in the module `PathGraph`.
+   */
+  predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowTo(Node sink) { this.hasFlow(_, sink) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowToExpr(DataFlowExpr sink) { this.hasFlowTo(exprNode(sink)) }
+
+  /**
+   * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
+   * measured in approximate number of interprocedural steps.
+   */
+  int explorationLimit() { none() }
+
+  /**
+   * Holds if hidden nodes should be included in the data flow graph.
+   *
+   * This feature should only be used for debugging or when the data flow graph
+   * is not visualized (for example in a `path-problem` query).
+   */
+  predicate includeHiddenNodes() { none() }
+
+  /**
+   * Holds if there is a partial data flow path from `source` to `node`. The
+   * approximate distance between `node` and the closest source is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards sink definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sources is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   */
+  final predicate hasPartialFlow(PartialPathNode source, PartialPathNode node, int dist) {
+    partialFlow(source, node, this) and
+    dist = node.getSourceDistance()
+  }
+
+  /**
+   * Holds if there is a partial data flow path from `node` to `sink`. The
+   * approximate distance between `node` and the closest sink is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards source definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sinks is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   *
+   * Note that reverse flow has slightly lower precision than the corresponding
+   * forward flow, as reverse flow disregards type pruning among other features.
+   */
+  final predicate hasPartialFlowRev(PartialPathNode node, PartialPathNode sink, int dist) {
+    revPartialFlow(node, sink, this) and
+    dist = node.getSinkDistance()
+  }
+}
+
+/**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ */
+abstract private class ConfigurationRecursionPrevention extends Configuration {
+  bindingset[this]
+  ConfigurationRecursionPrevention() { any() }
+
+  override predicate hasFlow(Node source, Node sink) {
+    strictcount(Node n | this.isSource(n)) < 0
+    or
+    strictcount(Node n | this.isSource(n, _)) < 0
+    or
+    strictcount(Node n | this.isSink(n)) < 0
+    or
+    strictcount(Node n | this.isSink(n, _)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, _, n2, _)) < 0
+    or
+    super.hasFlow(source, sink)
+  }
+}
+
+private newtype TNodeEx =
+  TNodeNormal(Node n) or
+  TNodeImplicitRead(Node n, boolean hasRead) {
+    any(Configuration c).allowImplicitRead(n, _) and hasRead = [false, true]
+  }
+
+private class NodeEx extends TNodeEx {
+  string toString() {
+    result = this.asNode().toString()
+    or
+    exists(Node n | this.isImplicitReadNode(n, _) | result = n.toString() + " [Ext]")
+  }
+
+  Node asNode() { this = TNodeNormal(result) }
+
+  predicate isImplicitReadNode(Node n, boolean hasRead) { this = TNodeImplicitRead(n, hasRead) }
+
+  Node projectToNode() { this = TNodeNormal(result) or this = TNodeImplicitRead(result, _) }
+
+  pragma[nomagic]
+  private DataFlowCallable getEnclosingCallable0() {
+    nodeEnclosingCallable(this.projectToNode(), result)
+  }
+
+  pragma[inline]
+  DataFlowCallable getEnclosingCallable() {
+    pragma[only_bind_out](this).getEnclosingCallable0() = pragma[only_bind_into](result)
+  }
+
+  pragma[nomagic]
+  private DataFlowType getDataFlowType0() { nodeDataFlowType(this.asNode(), result) }
+
+  pragma[inline]
+  DataFlowType getDataFlowType() {
+    pragma[only_bind_out](this).getDataFlowType0() = pragma[only_bind_into](result)
+  }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.projectToNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+private class ArgNodeEx extends NodeEx {
+  ArgNodeEx() { this.asNode() instanceof ArgNode }
+}
+
+private class ParamNodeEx extends NodeEx {
+  ParamNodeEx() { this.asNode() instanceof ParamNode }
+
+  predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) {
+    this.asNode().(ParamNode).isParameterOf(c, pos)
+  }
+
+  ParameterPosition getPosition() { this.isParameterOf(_, result) }
+
+  predicate allowParameterReturnInSelf() { allowParameterReturnInSelfCached(this.asNode()) }
+}
+
+private class RetNodeEx extends NodeEx {
+  RetNodeEx() { this.asNode() instanceof ReturnNodeExt }
+
+  ReturnPosition getReturnPosition() { result = getReturnPosition(this.asNode()) }
+
+  ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
+}
+
+private predicate inBarrier(NodeEx node, Configuration config) {
+  exists(Node n |
+    node.asNode() = n and
+    config.isBarrierIn(n)
+  |
+    config.isSource(n) or config.isSource(n, _)
+  )
+}
+
+private predicate outBarrier(NodeEx node, Configuration config) {
+  exists(Node n |
+    node.asNode() = n and
+    config.isBarrierOut(n)
+  |
+    config.isSink(n) or config.isSink(n, _)
+  )
+}
+
+/** A bridge class to access the deprecated `isBarrierGuard`. */
+private class BarrierGuardGuardedNodeBridge extends Unit {
+  abstract predicate guardedNode(Node n, Configuration config);
+
+  abstract predicate guardedNode(Node n, FlowState state, Configuration config);
+}
+
+private class BarrierGuardGuardedNode extends BarrierGuardGuardedNodeBridge {
+  deprecated override predicate guardedNode(Node n, Configuration config) {
+    exists(BarrierGuard g |
+      config.isBarrierGuard(g) and
+      n = g.getAGuardedNode()
+    )
+  }
+
+  deprecated override predicate guardedNode(Node n, FlowState state, Configuration config) {
+    exists(BarrierGuard g |
+      config.isBarrierGuard(g, state) and
+      n = g.getAGuardedNode()
+    )
+  }
+}
+
+pragma[nomagic]
+private predicate fullBarrier(NodeEx node, Configuration config) {
+  exists(Node n | node.asNode() = n |
+    config.isBarrier(n)
+    or
+    config.isBarrierIn(n) and
+    not config.isSource(n) and
+    not config.isSource(n, _)
+    or
+    config.isBarrierOut(n) and
+    not config.isSink(n) and
+    not config.isSink(n, _)
+    or
+    any(BarrierGuardGuardedNodeBridge b).guardedNode(n, config)
+  )
+}
+
+pragma[nomagic]
+private predicate stateBarrier(NodeEx node, FlowState state, Configuration config) {
+  exists(Node n | node.asNode() = n |
+    config.isBarrier(n, state)
+    or
+    any(BarrierGuardGuardedNodeBridge b).guardedNode(n, state, config)
+  )
+}
+
+pragma[nomagic]
+private predicate sourceNode(NodeEx node, FlowState state, Configuration config) {
+  (
+    config.isSource(node.asNode()) and state instanceof FlowStateEmpty
+    or
+    config.isSource(node.asNode(), state)
+  ) and
+  not fullBarrier(node, config) and
+  not stateBarrier(node, state, config)
+}
+
+pragma[nomagic]
+private predicate sinkNode(NodeEx node, FlowState state, Configuration config) {
+  (
+    config.isSink(node.asNode()) and state instanceof FlowStateEmpty
+    or
+    config.isSink(node.asNode(), state)
+  ) and
+  not fullBarrier(node, config) and
+  not stateBarrier(node, state, config)
+}
+
+/** Provides the relevant barriers for a step from `node1` to `node2`. */
+pragma[inline]
+private predicate stepFilter(NodeEx node1, NodeEx node2, Configuration config) {
+  not outBarrier(node1, config) and
+  not inBarrier(node2, config) and
+  not fullBarrier(node1, config) and
+  not fullBarrier(node2, config)
+}
+
+/**
+ * Holds if data can flow in one local step from `node1` to `node2`.
+ */
+private predicate localFlowStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    simpleLocalFlowStepExt(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    stepFilter(node1, node2, config)
+  )
+  or
+  exists(Node n |
+    config.allowImplicitRead(n, _) and
+    node1.asNode() = n and
+    node2.isImplicitReadNode(n, false) and
+    not fullBarrier(node1, config)
+  )
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` does not jump between callables.
+ */
+private predicate additionalLocalFlowStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config)
+  )
+  or
+  exists(Node n |
+    config.allowImplicitRead(n, _) and
+    node1.isImplicitReadNode(n, true) and
+    node2.asNode() = n and
+    not fullBarrier(node2, config)
+  )
+}
+
+private predicate additionalLocalStateStep(
+  NodeEx node1, FlowState s1, NodeEx node2, FlowState s2, Configuration config
+) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), s1, pragma[only_bind_into](n2), s2) and
+    getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not stateBarrier(node1, s1, config) and
+    not stateBarrier(node2, s2, config)
+  )
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` in a way that discards call contexts.
+ */
+private predicate jumpStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    jumpStepCached(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    stepFilter(node1, node2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` jumps between callables.
+ */
+private predicate additionalJumpStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private predicate additionalJumpStateStep(
+  NodeEx node1, FlowState s1, NodeEx node2, FlowState s2, Configuration config
+) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), s1, pragma[only_bind_into](n2), s2) and
+    getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not stateBarrier(node1, s1, config) and
+    not stateBarrier(node2, s2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+pragma[nomagic]
+private predicate readSet(NodeEx node1, ContentSet c, NodeEx node2, Configuration config) {
+  readSet(pragma[only_bind_into](node1.asNode()), c, pragma[only_bind_into](node2.asNode())) and
+  stepFilter(node1, node2, config)
+  or
+  exists(Node n |
+    node2.isImplicitReadNode(n, true) and
+    node1.isImplicitReadNode(n, _) and
+    config.allowImplicitRead(n, c)
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate read(NodeEx node1, Content c, NodeEx node2, Configuration config) {
+  exists(ContentSet cs |
+    readSet(node1, cs, node2, config) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate clearsContentEx(NodeEx n, Content c) {
+  exists(ContentSet cs |
+    clearsContentCached(n.asNode(), cs) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate expectsContentEx(NodeEx n, Content c) {
+  exists(ContentSet cs |
+    expectsContentCached(n.asNode(), cs) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+pragma[nomagic]
+private predicate notExpectsContent(NodeEx n) { not expectsContentCached(n.asNode(), _) }
+
+pragma[nomagic]
+private predicate store(
+  NodeEx node1, TypedContent tc, NodeEx node2, DataFlowType contentType, Configuration config
+) {
+  store(pragma[only_bind_into](node1.asNode()), tc, pragma[only_bind_into](node2.asNode()),
+    contentType) and
+  read(_, tc.getContent(), _, config) and
+  stepFilter(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutEx(DataFlowCall call, ReturnPosition pos, NodeEx out) {
+  viableReturnPosOut(call, pos, out.asNode())
+}
+
+pragma[nomagic]
+private predicate viableParamArgEx(DataFlowCall call, ParamNodeEx p, ArgNodeEx arg) {
+  viableParamArg(call, p.asNode(), arg.asNode())
+}
+
+/**
+ * Holds if field flow should be used for the given configuration.
+ */
+private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
+
+private predicate hasSourceCallCtx(Configuration config) {
+  exists(FlowFeature feature | feature = config.getAFeature() |
+    feature instanceof FeatureHasSourceCallContext or
+    feature instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private predicate hasSinkCallCtx(Configuration config) {
+  exists(FlowFeature feature | feature = config.getAFeature() |
+    feature instanceof FeatureHasSinkCallContext or
+    feature instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private module Stage1 implements StageSig {
+  class ApApprox = Unit;
+
+  class Ap = Unit;
+
+  class ApOption = Unit;
+
+  class Cc = boolean;
+
+  /* Begin: Stage 1 logic. */
+  /**
+   * Holds if `node` is reachable from a source in the configuration `config`.
+   *
+   * The Boolean `cc` records whether the node is reached through an
+   * argument in a call.
+   */
+  predicate fwdFlow(NodeEx node, Cc cc, Configuration config) {
+    sourceNode(node, _, config) and
+    if hasSourceCallCtx(config) then cc = true else cc = false
+    or
+    exists(NodeEx mid | fwdFlow(mid, cc, config) |
+      localFlowStep(mid, node, config) or
+      additionalLocalFlowStep(mid, node, config) or
+      additionalLocalStateStep(mid, _, node, _, config)
+    )
+    or
+    exists(NodeEx mid | fwdFlow(mid, _, config) and cc = false |
+      jumpStep(mid, node, config) or
+      additionalJumpStep(mid, node, config) or
+      additionalJumpStateStep(mid, _, node, _, config)
+    )
+    or
+    // store
+    exists(NodeEx mid |
+      useFieldFlow(config) and
+      fwdFlow(mid, cc, config) and
+      store(mid, _, node, _, config)
+    )
+    or
+    // read
+    exists(ContentSet c |
+      fwdFlowReadSet(c, node, cc, config) and
+      fwdFlowConsCandSet(c, _, config)
+    )
+    or
+    // flow into a callable
+    exists(NodeEx arg |
+      fwdFlow(arg, _, config) and
+      viableParamArgEx(_, node, arg) and
+      cc = true and
+      not fullBarrier(node, config)
+    )
+    or
+    // flow out of a callable
+    exists(DataFlowCall call |
+      fwdFlowOut(call, node, false, config) and
+      cc = false
+      or
+      fwdFlowOutFromArg(call, node, config) and
+      fwdFlowIsEntered(call, cc, config)
+    )
+  }
+
+  private predicate fwdFlow(NodeEx node, Configuration config) { fwdFlow(node, _, config) }
+
+  pragma[nomagic]
+  private predicate fwdFlowReadSet(ContentSet c, NodeEx node, Cc cc, Configuration config) {
+    exists(NodeEx mid |
+      fwdFlow(mid, cc, config) and
+      readSet(mid, c, node, config)
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a store in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCand(Content c, Configuration config) {
+    exists(NodeEx mid, NodeEx node, TypedContent tc |
+      not fullBarrier(node, config) and
+      useFieldFlow(config) and
+      fwdFlow(mid, _, config) and
+      store(mid, tc, node, _, config) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `cs` may be interpreted in a read as the target of some store
+   * into `c`, in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCandSet(ContentSet cs, Content c, Configuration config) {
+    fwdFlowConsCand(c, config) and
+    c = cs.getAReadContent()
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowReturnPosition(ReturnPosition pos, Cc cc, Configuration config) {
+    exists(RetNodeEx ret |
+      fwdFlow(ret, cc, config) and
+      ret.getReturnPosition() = pos
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOut(DataFlowCall call, NodeEx out, Cc cc, Configuration config) {
+    exists(ReturnPosition pos |
+      fwdFlowReturnPosition(pos, cc, config) and
+      viableReturnPosOutEx(call, pos, out) and
+      not fullBarrier(out, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOutFromArg(DataFlowCall call, NodeEx out, Configuration config) {
+    fwdFlowOut(call, out, true, config)
+  }
+
+  /**
+   * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowIsEntered(DataFlowCall call, Cc cc, Configuration config) {
+    exists(ArgNodeEx arg |
+      fwdFlow(arg, cc, config) and
+      viableParamArgEx(call, _, arg)
+    )
+  }
+
+  private predicate stateStepFwd(FlowState state1, FlowState state2, Configuration config) {
+    exists(NodeEx node1 |
+      additionalLocalStateStep(node1, state1, _, state2, config) or
+      additionalJumpStateStep(node1, state1, _, state2, config)
+    |
+      fwdFlow(node1, config)
+    )
+  }
+
+  private predicate fwdFlowState(FlowState state, Configuration config) {
+    sourceNode(_, state, config)
+    or
+    exists(FlowState state0 |
+      fwdFlowState(state0, config) and
+      stateStepFwd(state0, state, config)
+    )
+  }
+
+  /**
+   * Holds if `node` is part of a path from a source to a sink in the
+   * configuration `config`.
+   *
+   * The Boolean `toReturn` records whether the node must be returned from
+   * the enclosing callable in order to reach a sink.
+   */
+  pragma[nomagic]
+  predicate revFlow(NodeEx node, boolean toReturn, Configuration config) {
+    revFlow0(node, toReturn, config) and
+    fwdFlow(node, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlow0(NodeEx node, boolean toReturn, Configuration config) {
+    exists(FlowState state |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      sinkNode(node, state, config) and
+      fwdFlowState(state, pragma[only_bind_into](config)) and
+      if hasSinkCallCtx(config) then toReturn = true else toReturn = false
+    )
+    or
+    exists(NodeEx mid | revFlow(mid, toReturn, config) |
+      localFlowStep(node, mid, config) or
+      additionalLocalFlowStep(node, mid, config) or
+      additionalLocalStateStep(node, _, mid, _, config)
+    )
+    or
+    exists(NodeEx mid | revFlow(mid, _, config) and toReturn = false |
+      jumpStep(node, mid, config) or
+      additionalJumpStep(node, mid, config) or
+      additionalJumpStateStep(node, _, mid, _, config)
+    )
+    or
+    // store
+    exists(Content c |
+      revFlowStore(c, node, toReturn, config) and
+      revFlowConsCand(c, config)
+    )
+    or
+    // read
+    exists(NodeEx mid, ContentSet c |
+      readSet(node, c, mid, config) and
+      fwdFlowConsCandSet(c, _, pragma[only_bind_into](config)) and
+      revFlow(mid, toReturn, pragma[only_bind_into](config))
+    )
+    or
+    // flow into a callable
+    exists(DataFlowCall call |
+      revFlowIn(call, node, false, config) and
+      toReturn = false
+      or
+      revFlowInToReturn(call, node, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+    or
+    // flow out of a callable
+    exists(ReturnPosition pos |
+      revFlowOut(pos, config) and
+      node.(RetNodeEx).getReturnPosition() = pos and
+      toReturn = true
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a read in the flow covered by `revFlow`.
+   */
+  pragma[nomagic]
+  private predicate revFlowConsCand(Content c, Configuration config) {
+    exists(NodeEx mid, NodeEx node, ContentSet cs |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      readSet(node, cs, mid, config) and
+      fwdFlowConsCandSet(cs, c, pragma[only_bind_into](config)) and
+      revFlow(pragma[only_bind_into](mid), _, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowStore(Content c, NodeEx node, boolean toReturn, Configuration config) {
+    exists(NodeEx mid, TypedContent tc |
+      revFlow(mid, toReturn, pragma[only_bind_into](config)) and
+      fwdFlowConsCand(c, pragma[only_bind_into](config)) and
+      store(node, tc, mid, _, config) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of both a read and a store in the flow covered
+   * by `revFlow`.
+   */
+  pragma[nomagic]
+  predicate revFlowIsReadAndStored(Content c, Configuration conf) {
+    revFlowConsCand(c, conf) and
+    revFlowStore(c, _, _, conf)
+  }
+
+  pragma[nomagic]
+  predicate viableReturnPosOutNodeCandFwd1(
+    DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
+  ) {
+    fwdFlowReturnPosition(pos, _, config) and
+    viableReturnPosOutEx(call, pos, out)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
+    exists(DataFlowCall call, NodeEx out |
+      revFlow(out, _, config) and
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate viableParamArgNodeCandFwd1(
+    DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
+  ) {
+    viableParamArgEx(call, p, arg) and
+    fwdFlow(arg, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowIn(
+    DataFlowCall call, ArgNodeEx arg, boolean toReturn, Configuration config
+  ) {
+    exists(ParamNodeEx p |
+      revFlow(p, toReturn, config) and
+      viableParamArgNodeCandFwd1(call, p, arg, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowInToReturn(DataFlowCall call, ArgNodeEx arg, Configuration config) {
+    revFlowIn(call, arg, true, config)
+  }
+
+  /**
+   * Holds if an output from `call` is reached in the flow covered by `revFlow`
+   * and data might flow through the target callable resulting in reverse flow
+   * reaching an argument of `call`.
+   */
+  pragma[nomagic]
+  private predicate revFlowIsReturned(DataFlowCall call, boolean toReturn, Configuration config) {
+    exists(NodeEx out |
+      revFlow(out, toReturn, config) and
+      fwdFlowOutFromArg(call, out, config)
+    )
+  }
+
+  private predicate stateStepRev(FlowState state1, FlowState state2, Configuration config) {
+    exists(NodeEx node1, NodeEx node2 |
+      additionalLocalStateStep(node1, state1, node2, state2, config) or
+      additionalJumpStateStep(node1, state1, node2, state2, config)
+    |
+      revFlow(node1, _, pragma[only_bind_into](config)) and
+      revFlow(node2, _, pragma[only_bind_into](config)) and
+      fwdFlowState(state1, pragma[only_bind_into](config)) and
+      fwdFlowState(state2, pragma[only_bind_into](config))
+    )
+  }
+
+  predicate revFlowState(FlowState state, Configuration config) {
+    exists(NodeEx node |
+      sinkNode(node, state, config) and
+      revFlow(node, _, pragma[only_bind_into](config)) and
+      fwdFlowState(state, pragma[only_bind_into](config))
+    )
+    or
+    exists(FlowState state0 |
+      revFlowState(state0, config) and
+      stateStepRev(state, state0, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate storeStepCand(
+    NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+    Configuration config
+  ) {
+    exists(Content c |
+      revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      revFlow(node2, pragma[only_bind_into](config)) and
+      store(node1, tc, node2, contentType, config) and
+      c = tc.getContent() and
+      exists(ap1)
+    )
+  }
+
+  pragma[nomagic]
+  predicate readStepCand(NodeEx n1, Content c, NodeEx n2, Configuration config) {
+    revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+    read(n1, c, n2, pragma[only_bind_into](config)) and
+    revFlow(n2, pragma[only_bind_into](config))
+  }
+
+  pragma[nomagic]
+  predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, config) }
+
+  bindingset[node, state, config]
+  predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    revFlow(node, _, pragma[only_bind_into](config)) and
+    exists(state) and
+    exists(ap)
+  }
+
+  private predicate throughFlowNodeCand(NodeEx node, Configuration config) {
+    revFlow(node, true, config) and
+    fwdFlow(node, true, config) and
+    not inBarrier(node, config) and
+    not outBarrier(node, config)
+  }
+
+  /** Holds if flow may return from `callable`. */
+  pragma[nomagic]
+  private predicate returnFlowCallableNodeCand(
+    DataFlowCallable callable, ReturnKindExt kind, Configuration config
+  ) {
+    exists(RetNodeEx ret |
+      throughFlowNodeCand(ret, config) and
+      callable = ret.getEnclosingCallable() and
+      kind = ret.getKind()
+    )
+  }
+
+  /**
+   * Holds if flow may enter through `p` and reach a return node making `p` a
+   * candidate for the origin of a summary.
+   */
+  pragma[nomagic]
+  predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
+    exists(ReturnKindExt kind |
+      throughFlowNodeCand(p, config) and
+      returnFlowCallableNodeCand(c, kind, config) and
+      p.getEnclosingCallable() = c and
+      exists(ap) and
+      // we don't expect a parameter to return stored in itself, unless explicitly allowed
+      (
+        not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
+        or
+        p.allowParameterReturnInSelf()
+      )
+    )
+  }
+
+  pragma[nomagic]
+  predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
+    exists(ArgNodeEx arg, boolean toReturn |
+      revFlow(arg, toReturn, config) and
+      revFlowInToReturn(call, arg, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+  }
+
+  predicate stats(
+    boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
+  ) {
+    fwd = true and
+    nodes = count(NodeEx node | fwdFlow(node, config)) and
+    fields = count(Content f0 | fwdFlowConsCand(f0, config)) and
+    conscand = -1 and
+    states = count(FlowState state | fwdFlowState(state, config)) and
+    tuples = count(NodeEx n, boolean b | fwdFlow(n, b, config))
+    or
+    fwd = false and
+    nodes = count(NodeEx node | revFlow(node, _, config)) and
+    fields = count(Content f0 | revFlowConsCand(f0, config)) and
+    conscand = -1 and
+    states = count(FlowState state | revFlowState(state, config)) and
+    tuples = count(NodeEx n, boolean b | revFlow(n, b, config))
+  }
+  /* End: Stage 1 logic. */
+}
+
+pragma[noinline]
+private predicate localFlowStepNodeCand1(NodeEx node1, NodeEx node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  localFlowStep(node1, node2, config)
+}
+
+pragma[noinline]
+private predicate additionalLocalFlowStepNodeCand1(NodeEx node1, NodeEx node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  additionalLocalFlowStep(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutNodeCand1(
+  DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
+) {
+  Stage1::revFlow(out, config) and
+  Stage1::viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, RetNodeEx ret, NodeEx out, Configuration config
+) {
+  viableReturnPosOutNodeCand1(call, ret.getReturnPosition(), out, config) and
+  Stage1::revFlow(ret, config) and
+  not outBarrier(ret, config) and
+  not inBarrier(out, config)
+}
+
+pragma[nomagic]
+private predicate viableParamArgNodeCand1(
+  DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
+) {
+  Stage1::viableParamArgNodeCandFwd1(call, p, arg, config) and
+  Stage1::revFlow(arg, config)
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, Configuration config
+) {
+  viableParamArgNodeCand1(call, p, arg, config) and
+  Stage1::revFlow(p, config) and
+  not outBarrier(arg, config) and
+  not inBarrier(p, config)
+}
+
+/**
+ * Gets the amount of forward branching on the origin of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int branch(NodeEx n1, Configuration conf) {
+  result =
+    strictcount(NodeEx n |
+      flowOutOfCallNodeCand1(_, n1, n, conf) or flowIntoCallNodeCand1(_, n1, n, conf)
+    )
+}
+
+/**
+ * Gets the amount of backward branching on the target of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int join(NodeEx n2, Configuration conf) {
+  result =
+    strictcount(NodeEx n |
+      flowOutOfCallNodeCand1(_, n, n2, conf) or flowIntoCallNodeCand1(_, n, n2, conf)
+    )
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink. The
+ * `allowsFieldFlow` flag indicates whether the branching is within the limit
+ * specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, ret, out, config) and
+  exists(int b, int j |
+    b = branch(ret, config) and
+    j = join(out, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink. The `allowsFieldFlow` flag indicates whether
+ * the branching is within the limit specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+) {
+  flowIntoCallNodeCand1(call, arg, p, config) and
+  exists(int b, int j |
+    b = branch(arg, config) and
+    j = join(p, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+private signature module StageSig {
+  class Ap;
+
+  predicate revFlow(NodeEx node, Configuration config);
+
+  bindingset[node, state, config]
+  predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config);
+
+  predicate callMayFlowThroughRev(DataFlowCall call, Configuration config);
+
+  predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config);
+
+  predicate storeStepCand(
+    NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+    Configuration config
+  );
+
+  predicate readStepCand(NodeEx n1, Content c, NodeEx n2, Configuration config);
+}
+
+private module MkStage<StageSig PrevStage> {
+  class ApApprox = PrevStage::Ap;
+
+  signature module StageParam {
+    class Ap;
+
+    class ApNil extends Ap;
+
+    bindingset[result, ap]
+    ApApprox getApprox(Ap ap);
+
+    ApNil getApNil(NodeEx node);
+
+    bindingset[tc, tail]
+    Ap apCons(TypedContent tc, Ap tail);
+
+    Content getHeadContent(Ap ap);
+
+    class ApOption;
+
+    ApOption apNone();
+
+    ApOption apSome(Ap ap);
+
+    class Cc;
+
+    class CcCall extends Cc;
+
+    // TODO: member predicate on CcCall
+    predicate matchesCall(CcCall cc, DataFlowCall call);
+
+    class CcNoCall extends Cc;
+
+    Cc ccNone();
+
+    CcCall ccSomeCall();
+
+    class LocalCc;
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc);
+
+    bindingset[call, c, innercc]
+    CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc);
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc);
+
+    bindingset[node1, state1, config]
+    bindingset[node2, state2, config]
+    predicate localStep(
+      NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+      ApNil ap, Configuration config, LocalCc lcc
+    );
+
+    predicate flowOutOfCall(
+      DataFlowCall call, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow, Configuration config
+    );
+
+    predicate flowIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+    );
+
+    bindingset[node, state, ap, config]
+    predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config);
+
+    bindingset[ap, contentType]
+    predicate typecheckStore(Ap ap, DataFlowType contentType);
+  }
+
+  module Stage<StageParam Param> implements StageSig {
+    import Param
+
+    /* Begin: Stage logic. */
+    bindingset[result, apa]
+    private ApApprox unbindApa(ApApprox apa) {
+      pragma[only_bind_out](apa) = pragma[only_bind_out](result)
+    }
+
+    pragma[nomagic]
+    private predicate flowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      Configuration config
+    ) {
+      flowOutOfCall(call, ret, out, allowsFieldFlow, pragma[only_bind_into](config)) and
+      PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(_, ret.getEnclosingCallable(), _,
+        pragma[only_bind_into](config)) and
+      matchesCall(ccc, call)
+    }
+
+    /**
+     * Holds if `node` is reachable with access path `ap` from a source in the
+     * configuration `config`.
+     *
+     * The call context `cc` records whether the node is reached through an
+     * argument in a call, and if so, `argAp` records the access path of that
+     * argument.
+     */
+    pragma[nomagic]
+    predicate fwdFlow(
+      NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      fwdFlow0(node, state, cc, argAp, ap, config) and
+      PrevStage::revFlow(node, state, unbindApa(getApprox(ap)), config) and
+      filter(node, state, ap, config)
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlow0(
+      NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      sourceNode(node, state, config) and
+      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
+      argAp = apNone() and
+      ap = getApNil(node)
+      or
+      exists(NodeEx mid, FlowState state0, Ap ap0, LocalCc localCc |
+        fwdFlow(mid, state0, cc, argAp, ap0, config) and
+        localCc = getLocalCc(mid, cc)
+      |
+        localStep(mid, state0, node, state, true, _, config, localCc) and
+        ap = ap0
+        or
+        localStep(mid, state0, node, state, false, ap, config, localCc) and
+        ap0 instanceof ApNil
+      )
+      or
+      exists(NodeEx mid |
+        fwdFlow(mid, pragma[only_bind_into](state), _, _, ap, pragma[only_bind_into](config)) and
+        jumpStep(mid, node, config) and
+        cc = ccNone() and
+        argAp = apNone()
+      )
+      or
+      exists(NodeEx mid, ApNil nil |
+        fwdFlow(mid, state, _, _, nil, pragma[only_bind_into](config)) and
+        additionalJumpStep(mid, node, config) and
+        cc = ccNone() and
+        argAp = apNone() and
+        ap = getApNil(node)
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(mid, state0, _, _, nil, pragma[only_bind_into](config)) and
+        additionalJumpStateStep(mid, state0, node, state, config) and
+        cc = ccNone() and
+        argAp = apNone() and
+        ap = getApNil(node)
+      )
+      or
+      // store
+      exists(TypedContent tc, Ap ap0 |
+        fwdFlowStore(_, ap0, tc, node, state, cc, argAp, config) and
+        ap = apCons(tc, ap0)
+      )
+      or
+      // read
+      exists(Ap ap0, Content c |
+        fwdFlowRead(ap0, c, _, node, state, cc, argAp, config) and
+        fwdFlowConsCand(ap0, c, ap, config)
+      )
+      or
+      // flow into a callable
+      exists(ApApprox apa |
+        fwdFlowIn(_, node, state, _, cc, _, ap, config) and
+        apa = getApprox(ap) and
+        if PrevStage::parameterMayFlowThrough(node, _, apa, config)
+        then argAp = apSome(ap)
+        else argAp = apNone()
+      )
+      or
+      // flow out of a callable
+      fwdFlowOutNotFromArg(node, state, cc, argAp, ap, config)
+      or
+      exists(DataFlowCall call, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, argAp0, ap, config) and
+        fwdFlowIsEntered(call, cc, argAp, argAp0, config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowStore(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc, ApOption argAp,
+      Configuration config
+    ) {
+      exists(DataFlowType contentType |
+        fwdFlow(node1, state, cc, argAp, ap1, config) and
+        PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
+        typecheckStore(ap1, contentType)
+      )
+    }
+
+    /**
+     * Holds if forward flow with access path `tail` reaches a store of `c`
+     * resulting in access path `cons`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+      exists(TypedContent tc |
+        fwdFlowStore(_, tail, tc, _, _, _, _, config) and
+        tc.getContent() = c and
+        cons = apCons(tc, tail)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowRead(
+      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc, ApOption argAp,
+      Configuration config
+    ) {
+      fwdFlow(node1, state, cc, argAp, ap, config) and
+      PrevStage::readStepCand(node1, c, node2, config) and
+      getHeadContent(ap) = c
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowIn(
+      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, Cc innercc, ApOption argAp,
+      Ap ap, Configuration config
+    ) {
+      exists(ArgNodeEx arg, boolean allowsFieldFlow |
+        fwdFlow(arg, state, outercc, argAp, ap, config) and
+        flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+        innercc = getCallContextCall(call, p.getEnclosingCallable(), outercc) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowOutNotFromArg(
+      NodeEx out, FlowState state, Cc ccOut, ApOption argAp, Ap ap, Configuration config
+    ) {
+      exists(
+        DataFlowCall call, RetNodeEx ret, boolean allowsFieldFlow, CcNoCall innercc,
+        DataFlowCallable inner
+      |
+        fwdFlow(ret, state, innercc, argAp, ap, config) and
+        flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+        inner = ret.getEnclosingCallable() and
+        ccOut = getCallContextReturn(inner, call, innercc) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, Ap argAp, Ap ap, Configuration config
+    ) {
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc |
+        fwdFlow(ret, state, ccc, apSome(argAp), ap, config) and
+        flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    /**
+     * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`
+     * and data might flow through the target callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowIsEntered(
+      DataFlowCall call, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p |
+        fwdFlowIn(call, p, _, cc, _, argAp, ap, config) and
+        PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate storeStepFwd(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, Ap ap2, Configuration config
+    ) {
+      fwdFlowStore(node1, ap1, tc, node2, _, _, _, config) and
+      ap2 = apCons(tc, ap1) and
+      fwdFlowRead(ap2, tc.getContent(), _, _, _, _, _, config)
+    }
+
+    private predicate readStepFwd(
+      NodeEx n1, Ap ap1, Content c, NodeEx n2, Ap ap2, Configuration config
+    ) {
+      fwdFlowRead(ap1, c, n1, n2, _, _, _, config) and
+      fwdFlowConsCand(ap1, c, ap2, config)
+    }
+
+    pragma[nomagic]
+    private predicate callMayFlowThroughFwd(DataFlowCall call, Configuration config) {
+      exists(Ap argAp0, NodeEx out, FlowState state, Cc cc, ApOption argAp, Ap ap |
+        fwdFlow(out, state, pragma[only_bind_into](cc), pragma[only_bind_into](argAp), ap,
+          pragma[only_bind_into](config)) and
+        fwdFlowOutFromArg(call, out, state, argAp0, ap, config) and
+        fwdFlowIsEntered(pragma[only_bind_into](call), pragma[only_bind_into](cc),
+          pragma[only_bind_into](argAp), pragma[only_bind_into](argAp0),
+          pragma[only_bind_into](config))
+      )
+    }
+
+    pragma[nomagic]
+    private predicate flowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+    ) {
+      flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+      fwdFlow(arg, _, _, _, _, pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(p, _, _, pragma[only_bind_into](config)) and
+      callMayFlowThroughFwd(call, pragma[only_bind_into](config))
+    }
+
+    pragma[nomagic]
+    private predicate returnNodeMayFlowThrough(
+      RetNodeEx ret, FlowState state, Ap ap, Configuration config
+    ) {
+      fwdFlow(ret, state, any(CcCall ccc), apSome(_), ap, config)
+    }
+
+    /**
+     * Holds if `node` with access path `ap` is part of a path from a source to a
+     * sink in the configuration `config`.
+     *
+     * The Boolean `toReturn` records whether the node must be returned from the
+     * enclosing callable in order to reach a sink, and if so, `returnAp` records
+     * the access path of the returned value.
+     */
+    pragma[nomagic]
+    predicate revFlow(
+      NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      revFlow0(node, state, toReturn, returnAp, ap, config) and
+      fwdFlow(node, state, _, _, ap, config)
+    }
+
+    pragma[nomagic]
+    private predicate revFlow0(
+      NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      fwdFlow(node, state, _, _, ap, config) and
+      sinkNode(node, state, config) and
+      (if hasSinkCallCtx(config) then toReturn = true else toReturn = false) and
+      returnAp = apNone() and
+      ap instanceof ApNil
+      or
+      exists(NodeEx mid, FlowState state0 |
+        localStep(node, state, mid, state0, true, _, config, _) and
+        revFlow(mid, state0, toReturn, returnAp, ap, config)
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(node, pragma[only_bind_into](state), _, _, ap, pragma[only_bind_into](config)) and
+        localStep(node, pragma[only_bind_into](state), mid, state0, false, _, config, _) and
+        revFlow(mid, state0, toReturn, returnAp, nil, pragma[only_bind_into](config)) and
+        ap instanceof ApNil
+      )
+      or
+      exists(NodeEx mid |
+        jumpStep(node, mid, config) and
+        revFlow(mid, state, _, _, ap, config) and
+        toReturn = false and
+        returnAp = apNone()
+      )
+      or
+      exists(NodeEx mid, ApNil nil |
+        fwdFlow(node, _, _, _, ap, pragma[only_bind_into](config)) and
+        additionalJumpStep(node, mid, config) and
+        revFlow(pragma[only_bind_into](mid), state, _, _, nil, pragma[only_bind_into](config)) and
+        toReturn = false and
+        returnAp = apNone() and
+        ap instanceof ApNil
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(node, _, _, _, ap, pragma[only_bind_into](config)) and
+        additionalJumpStateStep(node, state, mid, state0, config) and
+        revFlow(pragma[only_bind_into](mid), pragma[only_bind_into](state0), _, _, nil,
+          pragma[only_bind_into](config)) and
+        toReturn = false and
+        returnAp = apNone() and
+        ap instanceof ApNil
+      )
+      or
+      // store
+      exists(Ap ap0, Content c |
+        revFlowStore(ap0, c, ap, node, state, _, _, toReturn, returnAp, config) and
+        revFlowConsCand(ap0, c, ap, config)
+      )
+      or
+      // read
+      exists(NodeEx mid, Ap ap0 |
+        revFlow(mid, state, toReturn, returnAp, ap0, config) and
+        readStepFwd(node, ap, _, mid, ap0, config)
+      )
+      or
+      // flow into a callable
+      revFlowInNotToReturn(node, state, returnAp, ap, config) and
+      toReturn = false
+      or
+      exists(DataFlowCall call, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+      or
+      // flow out of a callable
+      revFlowOut(_, node, state, _, _, ap, config) and
+      toReturn = true and
+      if returnNodeMayFlowThrough(node, state, ap, config)
+      then returnAp = apSome(ap)
+      else returnAp = apNone()
+    }
+
+    pragma[nomagic]
+    private predicate revFlowStore(
+      Ap ap0, Content c, Ap ap, NodeEx node, FlowState state, TypedContent tc, NodeEx mid,
+      boolean toReturn, ApOption returnAp, Configuration config
+    ) {
+      revFlow(mid, state, toReturn, returnAp, ap0, config) and
+      storeStepFwd(node, ap, tc, mid, ap0, config) and
+      tc.getContent() = c
+    }
+
+    /**
+     * Holds if reverse flow with access path `tail` reaches a read of `c`
+     * resulting in access path `cons`.
+     */
+    pragma[nomagic]
+    private predicate revFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+      exists(NodeEx mid, Ap tail0 |
+        revFlow(mid, _, _, _, tail, config) and
+        tail = pragma[only_bind_into](tail0) and
+        readStepFwd(_, cons, c, mid, tail0, config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowOut(
+      DataFlowCall call, RetNodeEx ret, FlowState state, boolean toReturn, ApOption returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(NodeEx out, boolean allowsFieldFlow |
+        revFlow(out, state, toReturn, returnAp, ap, config) and
+        flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInNotToReturn(
+      ArgNodeEx arg, FlowState state, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlow(p, state, false, returnAp, ap, config) and
+        flowIntoCall(_, arg, p, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, Ap returnAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlow(p, state, true, apSome(returnAp), ap, config) and
+        flowThroughIntoCall(call, arg, p, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    /**
+     * Holds if an output from `call` is reached in the flow covered by `revFlow`
+     * and data might flow through the target callable resulting in reverse flow
+     * reaching an argument of `call`.
+     */
+    pragma[nomagic]
+    private predicate revFlowIsReturned(
+      DataFlowCall call, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      exists(RetNodeEx ret, FlowState state, CcCall ccc |
+        revFlowOut(call, ret, state, toReturn, returnAp, ap, config) and
+        fwdFlow(ret, state, ccc, apSome(_), ap, config) and
+        matchesCall(ccc, call)
+      )
+    }
+
+    pragma[nomagic]
+    predicate storeStepCand(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+      Configuration config
+    ) {
+      exists(Ap ap2, Content c |
+        PrevStage::storeStepCand(node1, _, tc, node2, contentType, config) and
+        revFlowStore(ap2, c, ap1, node1, _, tc, node2, _, _, config) and
+        revFlowConsCand(ap2, c, ap1, config)
+      )
+    }
+
+    predicate readStepCand(NodeEx node1, Content c, NodeEx node2, Configuration config) {
+      exists(Ap ap1, Ap ap2 |
+        revFlow(node2, _, _, _, pragma[only_bind_into](ap2), pragma[only_bind_into](config)) and
+        readStepFwd(node1, ap1, c, node2, ap2, config) and
+        revFlowStore(ap1, c, pragma[only_bind_into](ap2), _, _, _, _, _, _,
+          pragma[only_bind_into](config))
+      )
+    }
+
+    predicate revFlow(NodeEx node, FlowState state, Configuration config) {
+      revFlow(node, state, _, _, _, config)
+    }
+
+    predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config) {
+      revFlow(node, state, _, _, ap, config)
+    }
+
+    pragma[nomagic]
+    predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
+
+    // use an alias as a workaround for bad functionality-induced joins
+    pragma[nomagic]
+    predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
+
+    // use an alias as a workaround for bad functionality-induced joins
+    pragma[nomagic]
+    predicate revFlowAlias(NodeEx node, FlowState state, Ap ap, Configuration config) {
+      revFlow(node, state, ap, config)
+    }
+
+    private predicate fwdConsCand(TypedContent tc, Ap ap, Configuration config) {
+      storeStepFwd(_, ap, tc, _, _, config)
+    }
+
+    private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
+      storeStepCand(_, ap, tc, _, _, config)
+    }
+
+    private predicate validAp(Ap ap, Configuration config) {
+      revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
+      or
+      exists(TypedContent head, Ap tail |
+        consCand(head, tail, config) and
+        ap = apCons(head, tail)
+      )
+    }
+
+    predicate consCand(TypedContent tc, Ap ap, Configuration config) {
+      revConsCand(tc, ap, config) and
+      validAp(ap, config)
+    }
+
+    pragma[noinline]
+    private predicate parameterFlow(
+      ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
+    ) {
+      revFlow(p, _, true, apSome(ap0), ap, config) and
+      c = p.getEnclosingCallable()
+    }
+
+    predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
+      exists(RetNodeEx ret, FlowState state, Ap ap0, ReturnKindExt kind, ParameterPosition pos |
+        parameterFlow(p, ap, ap0, c, config) and
+        c = ret.getEnclosingCallable() and
+        revFlow(pragma[only_bind_into](ret), pragma[only_bind_into](state), true, apSome(_),
+          pragma[only_bind_into](ap0), pragma[only_bind_into](config)) and
+        fwdFlow(ret, state, any(CcCall ccc), apSome(ap), ap0, config) and
+        kind = ret.getKind() and
+        p.getPosition() = pos and
+        // we don't expect a parameter to return stored in itself, unless explicitly allowed
+        (
+          not kind.(ParamUpdateReturnKind).getPosition() = pos
+          or
+          p.allowParameterReturnInSelf()
+        )
+      )
+    }
+
+    pragma[nomagic]
+    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
+      exists(
+        Ap returnAp0, ArgNodeEx arg, FlowState state, boolean toReturn, ApOption returnAp, Ap ap
+      |
+        revFlow(arg, state, toReturn, returnAp, ap, config) and
+        revFlowInToReturn(call, arg, state, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+    }
+
+    predicate stats(
+      boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
+    ) {
+      fwd = true and
+      nodes = count(NodeEx node | fwdFlow(node, _, _, _, _, config)) and
+      fields = count(TypedContent f0 | fwdConsCand(f0, _, config)) and
+      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
+      states = count(FlowState state | fwdFlow(_, state, _, _, _, config)) and
+      tuples =
+        count(NodeEx n, FlowState state, Cc cc, ApOption argAp, Ap ap |
+          fwdFlow(n, state, cc, argAp, ap, config)
+        )
+      or
+      fwd = false and
+      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
+      fields = count(TypedContent f0 | consCand(f0, _, config)) and
+      conscand = count(TypedContent f0, Ap ap | consCand(f0, ap, config)) and
+      states = count(FlowState state | revFlow(_, state, _, _, _, config)) and
+      tuples =
+        count(NodeEx n, FlowState state, boolean b, ApOption retAp, Ap ap |
+          revFlow(n, state, b, retAp, ap, config)
+        )
+    }
+    /* End: Stage logic. */
+  }
+}
+
+private module BooleanCallContext {
+  class Cc extends boolean {
+    Cc() { this in [true, false] }
+  }
+
+  class CcCall extends Cc {
+    CcCall() { this = true }
+  }
+
+  /** Holds if the call context may be `call`. */
+  predicate matchesCall(CcCall cc, DataFlowCall call) { any() }
+
+  class CcNoCall extends Cc {
+    CcNoCall() { this = false }
+  }
+
+  Cc ccNone() { result = false }
+
+  CcCall ccSomeCall() { result = true }
+
+  class LocalCc = Unit;
+
+  bindingset[node, cc]
+  LocalCc getLocalCc(NodeEx node, Cc cc) { any() }
+
+  bindingset[call, c, outercc]
+  CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) { any() }
+
+  bindingset[call, c, innercc]
+  CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) { any() }
+}
+
+private module Level1CallContext {
+  class Cc = CallContext;
+
+  class CcCall = CallContextCall;
+
+  pragma[inline]
+  predicate matchesCall(CcCall cc, DataFlowCall call) { cc.matchesCall(call) }
+
+  class CcNoCall = CallContextNoCall;
+
+  Cc ccNone() { result instanceof CallContextAny }
+
+  CcCall ccSomeCall() { result instanceof CallContextSomeCall }
+
+  module NoLocalCallContext {
+    class LocalCc = Unit;
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc) { any() }
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+      checkCallContextCall(outercc, call, c) and
+      if recordDataFlowCallSiteDispatch(call, c)
+      then result = TSpecificCall(call)
+      else result = TSomeCall()
+    }
+  }
+
+  module LocalCallContext {
+    class LocalCc = LocalCallContext;
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc) {
+      result =
+        getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
+          node.getEnclosingCallable())
+    }
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+      checkCallContextCall(outercc, call, c) and
+      if recordDataFlowCallSite(call, c) then result = TSpecificCall(call) else result = TSomeCall()
+    }
+  }
+
+  bindingset[call, c, innercc]
+  CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) {
+    checkCallContextReturn(innercc, c, call) and
+    if reducedViableImplInReturn(c, call) then result = TReturn(c, call) else result = ccNone()
+  }
+}
+
+private module Stage2Param implements MkStage<Stage1>::StageParam {
+  private module PrevStage = Stage1;
+
+  class Ap extends boolean {
+    Ap() { this in [true, false] }
+  }
+
+  class ApNil extends Ap {
+    ApNil() { this = false }
+  }
+
+  bindingset[result, ap]
+  PrevStage::Ap getApprox(Ap ap) { any() }
+
+  ApNil getApNil(NodeEx node) { Stage1::revFlow(node, _) and exists(result) }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result = true and exists(tc) and exists(tail) }
+
+  pragma[inline]
+  Content getHeadContent(Ap ap) { exists(result) and ap = true }
+
+  class ApOption = BooleanOption;
+
+  ApOption apNone() { result = TBooleanNone() }
+
+  ApOption apSome(Ap ap) { result = TBooleanSome(ap) }
+
+  import Level1CallContext
+  import NoLocalCallContext
+
+  bindingset[node1, state1, config]
+  bindingset[node2, state2, config]
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    (
+      preservesValue = true and
+      localFlowStepNodeCand1(node1, node2, config) and
+      state1 = state2
+      or
+      preservesValue = false and
+      additionalLocalFlowStepNodeCand1(node1, node2, config) and
+      state1 = state2
+      or
+      preservesValue = false and
+      additionalLocalStateStep(node1, state1, node2, state2, config)
+    ) and
+    exists(ap) and
+    exists(lcc)
+  }
+
+  predicate flowOutOfCall = flowOutOfCallNodeCand1/5;
+
+  predicate flowIntoCall = flowIntoCallNodeCand1/5;
+
+  pragma[nomagic]
+  private predicate expectsContentCand(NodeEx node, Configuration config) {
+    exists(Content c |
+      PrevStage::revFlow(node, pragma[only_bind_into](config)) and
+      PrevStage::revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      expectsContentEx(node, c)
+    )
+  }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    PrevStage::revFlowState(state, pragma[only_bind_into](config)) and
+    exists(ap) and
+    not stateBarrier(node, state, config) and
+    (
+      notExpectsContent(node)
+      or
+      ap = true and
+      expectsContentCand(node, config)
+    )
+  }
+
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+}
+
+private module Stage2 implements StageSig {
+  import MkStage<Stage1>::Stage<Stage2Param>
+}
+
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand2(
+  DataFlowCall call, RetNodeEx node1, NodeEx node2, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlowAlias(node1, pragma[only_bind_into](config))
+}
+
+pragma[nomagic]
+private predicate flowIntoCallNodeCand2(
+  DataFlowCall call, ArgNodeEx node1, ParamNodeEx node2, boolean allowsFieldFlow,
+  Configuration config
+) {
+  flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlowAlias(node1, pragma[only_bind_into](config))
+}
+
+private module LocalFlowBigStep {
+  /**
+   * A node where some checking is required, and hence the big-step relation
+   * is not allowed to step over.
+   */
+  private class FlowCheckNode extends NodeEx {
+    FlowCheckNode() {
+      castNode(this.asNode()) or
+      clearsContentCached(this.asNode(), _) or
+      expectsContentCached(this.asNode(), _)
+    }
+  }
+
+  /**
+   * Holds if `node` can be the first node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowEntry(NodeEx node, FlowState state, Configuration config) {
+    Stage2::revFlow(node, state, config) and
+    (
+      sourceNode(node, state, config)
+      or
+      jumpStep(_, node, config)
+      or
+      additionalJumpStep(_, node, config)
+      or
+      additionalJumpStateStep(_, _, node, state, config)
+      or
+      node instanceof ParamNodeEx
+      or
+      node.asNode() instanceof OutNodeExt
+      or
+      Stage2::storeStepCand(_, _, _, node, _, config)
+      or
+      Stage2::readStepCand(_, _, node, config)
+      or
+      node instanceof FlowCheckNode
+      or
+      exists(FlowState s |
+        additionalLocalStateStep(_, s, node, state, config) and
+        s != state
+      )
+    )
+  }
+
+  /**
+   * Holds if `node` can be the last node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowExit(NodeEx node, FlowState state, Configuration config) {
+    exists(NodeEx next | Stage2::revFlow(next, state, config) |
+      jumpStep(node, next, config) or
+      additionalJumpStep(node, next, config) or
+      flowIntoCallNodeCand1(_, node, next, config) or
+      flowOutOfCallNodeCand1(_, node, next, config) or
+      Stage2::storeStepCand(node, _, _, next, _, config) or
+      Stage2::readStepCand(node, _, next, config)
+    )
+    or
+    exists(NodeEx next, FlowState s | Stage2::revFlow(next, s, config) |
+      additionalJumpStateStep(node, state, next, s, config)
+      or
+      additionalLocalStateStep(node, state, next, s, config) and
+      s != state
+    )
+    or
+    Stage2::revFlow(node, state, config) and
+    node instanceof FlowCheckNode
+    or
+    sinkNode(node, state, config)
+  }
+
+  pragma[noinline]
+  private predicate additionalLocalFlowStepNodeCand2(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, Configuration config
+  ) {
+    additionalLocalFlowStepNodeCand1(node1, node2, config) and
+    state1 = state2 and
+    Stage2::revFlow(node1, pragma[only_bind_into](state1), false, pragma[only_bind_into](config)) and
+    Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false,
+      pragma[only_bind_into](config))
+    or
+    additionalLocalStateStep(node1, state1, node2, state2, config) and
+    Stage2::revFlow(node1, state1, false, pragma[only_bind_into](config)) and
+    Stage2::revFlowAlias(node2, state2, false, pragma[only_bind_into](config))
+  }
+
+  /**
+   * Holds if the local path from `node1` to `node2` is a prefix of a maximal
+   * subsequence of local flow steps in a dataflow path.
+   *
+   * This is the transitive closure of `[additional]localFlowStep` beginning
+   * at `localFlowEntry`.
+   */
+  pragma[nomagic]
+  private predicate localFlowStepPlus(
+    NodeEx node1, FlowState state, NodeEx node2, boolean preservesValue, DataFlowType t,
+    Configuration config, LocalCallContext cc
+  ) {
+    not isUnreachableInCallCached(node2.asNode(), cc.(LocalCallContextSpecificCall).getCall()) and
+    (
+      localFlowEntry(node1, pragma[only_bind_into](state), pragma[only_bind_into](config)) and
+      (
+        localFlowStepNodeCand1(node1, node2, config) and
+        preservesValue = true and
+        t = node1.getDataFlowType() and // irrelevant dummy value
+        Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
+        or
+        additionalLocalFlowStepNodeCand2(node1, state, node2, state, config) and
+        preservesValue = false and
+        t = node2.getDataFlowType()
+      ) and
+      node1 != node2 and
+      cc.relevantFor(node1.getEnclosingCallable()) and
+      not isUnreachableInCallCached(node1.asNode(), cc.(LocalCallContextSpecificCall).getCall())
+      or
+      exists(NodeEx mid |
+        localFlowStepPlus(node1, pragma[only_bind_into](state), mid, preservesValue, t,
+          pragma[only_bind_into](config), cc) and
+        localFlowStepNodeCand1(mid, node2, config) and
+        not mid instanceof FlowCheckNode and
+        Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
+      )
+      or
+      exists(NodeEx mid |
+        localFlowStepPlus(node1, state, mid, _, _, pragma[only_bind_into](config), cc) and
+        additionalLocalFlowStepNodeCand2(mid, state, node2, state, config) and
+        not mid instanceof FlowCheckNode and
+        preservesValue = false and
+        t = node2.getDataFlowType()
+      )
+    )
+  }
+
+  /**
+   * Holds if `node1` can step to `node2` in one or more local steps and this
+   * path can occur as a maximal subsequence of local steps in a dataflow path.
+   */
+  pragma[nomagic]
+  predicate localFlowBigStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    AccessPathFrontNil apf, Configuration config, LocalCallContext callContext
+  ) {
+    localFlowStepPlus(node1, state1, node2, preservesValue, apf.getType(), config, callContext) and
+    localFlowExit(node2, state1, config) and
+    state1 = state2
+    or
+    additionalLocalFlowStepNodeCand2(node1, state1, node2, state2, config) and
+    state1 != state2 and
+    preservesValue = false and
+    apf = TFrontNil(node2.getDataFlowType()) and
+    callContext.relevantFor(node1.getEnclosingCallable()) and
+    not exists(DataFlowCall call | call = callContext.(LocalCallContextSpecificCall).getCall() |
+      isUnreachableInCallCached(node1.asNode(), call) or
+      isUnreachableInCallCached(node2.asNode(), call)
+    )
+  }
+}
+
+private import LocalFlowBigStep
+
+private module Stage3Param implements MkStage<Stage2>::StageParam {
+  private module PrevStage = Stage2;
+
+  class Ap = AccessPathFront;
+
+  class ApNil = AccessPathFrontNil;
+
+  PrevStage::Ap getApprox(Ap ap) { result = ap.toBoolNonEmpty() }
+
+  ApNil getApNil(NodeEx node) {
+    PrevStage::revFlow(node, _) and result = TFrontNil(node.getDataFlowType())
+  }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result.getHead() = tc and exists(tail) }
+
+  pragma[noinline]
+  Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathFrontOption;
+
+  ApOption apNone() { result = TAccessPathFrontNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathFrontSome(ap) }
+
+  import BooleanCallContext
+
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, state1, node2, state2, preservesValue, ap, config, _) and exists(lcc)
+  }
+
+  predicate flowOutOfCall = flowOutOfCallNodeCand2/5;
+
+  predicate flowIntoCall = flowIntoCallNodeCand2/5;
+
+  pragma[nomagic]
+  private predicate clearSet(NodeEx node, ContentSet c, Configuration config) {
+    PrevStage::revFlow(node, config) and
+    clearsContentCached(node.asNode(), c)
+  }
+
+  pragma[nomagic]
+  private predicate clearContent(NodeEx node, Content c, Configuration config) {
+    exists(ContentSet cs |
+      PrevStage::readStepCand(_, pragma[only_bind_into](c), _, pragma[only_bind_into](config)) and
+      c = cs.getAReadContent() and
+      clearSet(node, cs, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate clear(NodeEx node, Ap ap, Configuration config) {
+    clearContent(node, ap.getHead().getContent(), config)
+  }
+
+  pragma[nomagic]
+  private predicate expectsContentCand(NodeEx node, Ap ap, Configuration config) {
+    exists(Content c |
+      PrevStage::revFlow(node, pragma[only_bind_into](config)) and
+      PrevStage::readStepCand(_, c, _, pragma[only_bind_into](config)) and
+      expectsContentEx(node, c) and
+      c = ap.getHead().getContent()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate castingNodeEx(NodeEx node) { node.asNode() instanceof CastingNode }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    exists(state) and
+    exists(config) and
+    not clear(node, ap, config) and
+    (if castingNodeEx(node) then compatibleTypes(node.getDataFlowType(), ap.getType()) else any()) and
+    (
+      notExpectsContent(node)
+      or
+      expectsContentCand(node, ap, config)
+    )
+  }
+
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) {
+    // We need to typecheck stores here, since reverse flow through a getter
+    // might have a different type here compared to inside the getter.
+    compatibleTypes(ap.getType(), contentType)
+  }
+}
+
+private module Stage3 implements StageSig {
+  import MkStage<Stage2>::Stage<Stage3Param>
+}
+
+/**
+ * Holds if `argApf` is recorded as the summary context for flow reaching `node`
+ * and remains relevant for the following pruning stage.
+ */
+private predicate flowCandSummaryCtx(
+  NodeEx node, FlowState state, AccessPathFront argApf, Configuration config
+) {
+  exists(AccessPathFront apf |
+    Stage3::revFlow(node, state, true, _, apf, config) and
+    Stage3::fwdFlow(node, state, any(Stage3::CcCall ccc), TAccessPathFrontSome(argApf), apf, config)
+  )
+}
+
+/**
+ * Holds if a length 2 access path approximation with the head `tc` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen2unfolding(TypedContent tc, Configuration config) {
+  exists(int tails, int nodes, int apLimit, int tupleLimit |
+    tails = strictcount(AccessPathFront apf | Stage3::consCand(tc, apf, config)) and
+    nodes =
+      strictcount(NodeEx n, FlowState state |
+        Stage3::revFlow(n, state, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+        or
+        flowCandSummaryCtx(n, state, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+      ) and
+    accessPathApproxCostLimits(apLimit, tupleLimit) and
+    apLimit < tails and
+    tupleLimit < (tails - 1) * nodes and
+    not tc.forceHighPrecision()
+  )
+}
+
+private newtype TAccessPathApprox =
+  TNil(DataFlowType t) or
+  TConsNil(TypedContent tc, DataFlowType t) {
+    Stage3::consCand(tc, TFrontNil(t), _) and
+    not expensiveLen2unfolding(tc, _)
+  } or
+  TConsCons(TypedContent tc1, TypedContent tc2, int len) {
+    Stage3::consCand(tc1, TFrontHead(tc2), _) and
+    len in [2 .. accessPathLimit()] and
+    not expensiveLen2unfolding(tc1, _)
+  } or
+  TCons1(TypedContent tc, int len) {
+    len in [1 .. accessPathLimit()] and
+    expensiveLen2unfolding(tc, _)
+  }
+
+/**
+ * Conceptually a list of `TypedContent`s followed by a `DataFlowType`, but only
+ * the first two elements of the list and its length are tracked. If data flows
+ * from a source to a given node with a given `AccessPathApprox`, this indicates
+ * the sequence of dereference operations needed to get from the value in the node
+ * to the tracked object. The final type indicates the type of the tracked object.
+ */
+abstract private class AccessPathApprox extends TAccessPathApprox {
+  abstract string toString();
+
+  abstract TypedContent getHead();
+
+  abstract int len();
+
+  abstract DataFlowType getType();
+
+  abstract AccessPathFront getFront();
+
+  /** Gets the access path obtained by popping `head` from this path, if any. */
+  abstract AccessPathApprox pop(TypedContent head);
+}
+
+private class AccessPathApproxNil extends AccessPathApprox, TNil {
+  private DataFlowType t;
+
+  AccessPathApproxNil() { this = TNil(t) }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+
+  override TypedContent getHead() { none() }
+
+  override int len() { result = 0 }
+
+  override DataFlowType getType() { result = t }
+
+  override AccessPathFront getFront() { result = TFrontNil(t) }
+
+  override AccessPathApprox pop(TypedContent head) { none() }
+}
+
+abstract private class AccessPathApproxCons extends AccessPathApprox { }
+
+private class AccessPathApproxConsNil extends AccessPathApproxCons, TConsNil {
+  private TypedContent tc;
+  private DataFlowType t;
+
+  AccessPathApproxConsNil() { this = TConsNil(tc, t) }
+
+  override string toString() {
+    // The `concat` becomes "" if `ppReprType` has no result.
+    result = "[" + tc.toString() + "]" + concat(" : " + ppReprType(t))
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = 1 }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) { head = tc and result = TNil(t) }
+}
+
+private class AccessPathApproxConsCons extends AccessPathApproxCons, TConsCons {
+  private TypedContent tc1;
+  private TypedContent tc2;
+  private int len;
+
+  AccessPathApproxConsCons() { this = TConsCons(tc1, tc2, len) }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + tc1.toString() + ", " + tc2.toString() + "]"
+    else result = "[" + tc1.toString() + ", " + tc2.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc1 }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc1.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc1) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc1 and
+    (
+      result = TConsCons(tc2, _, len - 1)
+      or
+      len = 2 and
+      result = TConsNil(tc2, _)
+      or
+      result = TCons1(tc2, len - 1)
+    )
+  }
+}
+
+private class AccessPathApproxCons1 extends AccessPathApproxCons, TCons1 {
+  private TypedContent tc;
+  private int len;
+
+  AccessPathApproxCons1() { this = TCons1(tc, len) }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + tc.toString() + "]"
+    else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc and
+    (
+      exists(TypedContent tc2 | Stage3::consCand(tc, TFrontHead(tc2), _) |
+        result = TConsCons(tc2, _, len - 1)
+        or
+        len = 2 and
+        result = TConsNil(tc2, _)
+        or
+        result = TCons1(tc2, len - 1)
+      )
+      or
+      exists(DataFlowType t |
+        len = 1 and
+        Stage3::consCand(tc, TFrontNil(t), _) and
+        result = TNil(t)
+      )
+    )
+  }
+}
+
+/** Gets the access path obtained by popping `tc` from `ap`, if any. */
+private AccessPathApprox pop(TypedContent tc, AccessPathApprox apa) { result = apa.pop(tc) }
+
+/** Gets the access path obtained by pushing `tc` onto `ap`. */
+private AccessPathApprox push(TypedContent tc, AccessPathApprox apa) { apa = pop(tc, result) }
+
+private newtype TAccessPathApproxOption =
+  TAccessPathApproxNone() or
+  TAccessPathApproxSome(AccessPathApprox apa)
+
+private class AccessPathApproxOption extends TAccessPathApproxOption {
+  string toString() {
+    this = TAccessPathApproxNone() and result = "<none>"
+    or
+    this = TAccessPathApproxSome(any(AccessPathApprox apa | result = apa.toString()))
+  }
+}
+
+private module Stage4Param implements MkStage<Stage3>::StageParam {
+  private module PrevStage = Stage3;
+
+  class Ap = AccessPathApprox;
+
+  class ApNil = AccessPathApproxNil;
+
+  PrevStage::Ap getApprox(Ap ap) { result = ap.getFront() }
+
+  ApNil getApNil(NodeEx node) {
+    PrevStage::revFlow(node, _) and result = TNil(node.getDataFlowType())
+  }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result = push(tc, tail) }
+
+  pragma[noinline]
+  Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathApproxOption;
+
+  ApOption apNone() { result = TAccessPathApproxNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathApproxSome(ap) }
+
+  import Level1CallContext
+  import LocalCallContext
+
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getFront(), config, lcc)
+  }
+
+  pragma[nomagic]
+  predicate flowOutOfCall(
+    DataFlowCall call, RetNodeEx node1, NodeEx node2, boolean allowsFieldFlow, Configuration config
+  ) {
+    exists(FlowState state |
+      flowOutOfCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+      PrevStage::revFlow(node2, pragma[only_bind_into](state), _, pragma[only_bind_into](config)) and
+      PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  predicate flowIntoCall(
+    DataFlowCall call, ArgNodeEx node1, ParamNodeEx node2, boolean allowsFieldFlow,
+    Configuration config
+  ) {
+    exists(FlowState state |
+      flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+      PrevStage::revFlow(node2, pragma[only_bind_into](state), _, pragma[only_bind_into](config)) and
+      PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) { any() }
+
+  // Type checking is not necessary here as it has already been done in stage 3.
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+}
+
+private module Stage4 = MkStage<Stage3>::Stage<Stage4Param>;
+
+bindingset[conf, result]
+private Configuration unbindConf(Configuration conf) {
+  exists(Configuration c | result = pragma[only_bind_into](c) and conf = pragma[only_bind_into](c))
+}
+
+pragma[nomagic]
+private predicate nodeMayUseSummary0(
+  NodeEx n, DataFlowCallable c, FlowState state, AccessPathApprox apa, Configuration config
+) {
+  exists(AccessPathApprox apa0 |
+    Stage4::parameterMayFlowThrough(_, c, _, _) and
+    Stage4::revFlow(n, state, true, _, apa0, config) and
+    Stage4::fwdFlow(n, state, any(CallContextCall ccc), TAccessPathApproxSome(apa), apa0, config) and
+    n.getEnclosingCallable() = c
+  )
+}
+
+pragma[nomagic]
+private predicate nodeMayUseSummary(
+  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
+) {
+  exists(DataFlowCallable c |
+    Stage4::parameterMayFlowThrough(_, c, apa, config) and
+    nodeMayUseSummary0(n, c, state, apa, config)
+  )
+}
+
+private newtype TSummaryCtx =
+  TSummaryCtxNone() or
+  TSummaryCtxSome(ParamNodeEx p, FlowState state, AccessPath ap) {
+    exists(Configuration config |
+      Stage4::parameterMayFlowThrough(p, _, ap.getApprox(), config) and
+      Stage4::revFlow(p, state, _, config)
+    )
+  }
+
+/**
+ * A context for generating flow summaries. This represents flow entry through
+ * a specific parameter with an access path of a specific shape.
+ *
+ * Summaries are only created for parameters that may flow through.
+ */
+abstract private class SummaryCtx extends TSummaryCtx {
+  abstract string toString();
+}
+
+/** A summary context from which no flow summary can be generated. */
+private class SummaryCtxNone extends SummaryCtx, TSummaryCtxNone {
+  override string toString() { result = "<none>" }
+}
+
+/** A summary context from which a flow summary can be generated. */
+private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
+  private ParamNodeEx p;
+  private FlowState s;
+  private AccessPath ap;
+
+  SummaryCtxSome() { this = TSummaryCtxSome(p, s, ap) }
+
+  ParameterPosition getParameterPos() { p.isParameterOf(_, result) }
+
+  ParamNodeEx getParamNode() { result = p }
+
+  override string toString() { result = p + ": " + ap }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    p.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/**
+ * Gets the number of length 2 access path approximations that correspond to `apa`.
+ */
+private int count1to2unfold(AccessPathApproxCons1 apa, Configuration config) {
+  exists(TypedContent tc, int len |
+    tc = apa.getHead() and
+    len = apa.len() and
+    result =
+      strictcount(AccessPathFront apf |
+        Stage4::consCand(tc, any(AccessPathApprox ap | ap.getFront() = apf and ap.len() = len - 1),
+          config)
+      )
+  )
+}
+
+private int countNodesUsingAccessPath(AccessPathApprox apa, Configuration config) {
+  result =
+    strictcount(NodeEx n, FlowState state |
+      Stage4::revFlow(n, state, apa, config) or nodeMayUseSummary(n, state, apa, config)
+    )
+}
+
+/**
+ * Holds if a length 2 access path approximation matching `apa` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen1to2unfolding(AccessPathApproxCons1 apa, Configuration config) {
+  exists(int aps, int nodes, int apLimit, int tupleLimit |
+    aps = count1to2unfold(apa, config) and
+    nodes = countNodesUsingAccessPath(apa, config) and
+    accessPathCostLimits(apLimit, tupleLimit) and
+    apLimit < aps and
+    tupleLimit < (aps - 1) * nodes
+  )
+}
+
+private AccessPathApprox getATail(AccessPathApprox apa, Configuration config) {
+  exists(TypedContent head |
+    apa.pop(head) = result and
+    Stage4::consCand(head, result, config)
+  )
+}
+
+/**
+ * Holds with `unfold = false` if a precise head-tail representation of `apa` is
+ * expected to be expensive. Holds with `unfold = true` otherwise.
+ */
+private predicate evalUnfold(AccessPathApprox apa, boolean unfold, Configuration config) {
+  if apa.getHead().forceHighPrecision()
+  then unfold = true
+  else
+    exists(int aps, int nodes, int apLimit, int tupleLimit |
+      aps = countPotentialAps(apa, config) and
+      nodes = countNodesUsingAccessPath(apa, config) and
+      accessPathCostLimits(apLimit, tupleLimit) and
+      if apLimit < aps and tupleLimit < (aps - 1) * nodes then unfold = false else unfold = true
+    )
+}
+
+/**
+ * Gets the number of `AccessPath`s that correspond to `apa`.
+ */
+private int countAps(AccessPathApprox apa, Configuration config) {
+  evalUnfold(apa, false, config) and
+  result = 1 and
+  (not apa instanceof AccessPathApproxCons1 or expensiveLen1to2unfolding(apa, config))
+  or
+  evalUnfold(apa, false, config) and
+  result = count1to2unfold(apa, config) and
+  not expensiveLen1to2unfolding(apa, config)
+  or
+  evalUnfold(apa, true, config) and
+  result = countPotentialAps(apa, config)
+}
+
+/**
+ * Gets the number of `AccessPath`s that would correspond to `apa` assuming
+ * that it is expanded to a precise head-tail representation.
+ */
+language[monotonicAggregates]
+private int countPotentialAps(AccessPathApprox apa, Configuration config) {
+  apa instanceof AccessPathApproxNil and result = 1
+  or
+  result = strictsum(AccessPathApprox tail | tail = getATail(apa, config) | countAps(tail, config))
+}
+
+private newtype TAccessPath =
+  TAccessPathNil(DataFlowType t) or
+  TAccessPathCons(TypedContent head, AccessPath tail) {
+    exists(AccessPathApproxCons apa |
+      not evalUnfold(apa, false, _) and
+      head = apa.getHead() and
+      tail.getApprox() = getATail(apa, _)
+    )
+  } or
+  TAccessPathCons2(TypedContent head1, TypedContent head2, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      not expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head1 = apa.getHead() and
+      head2 = getATail(apa, _).getHead()
+    )
+  } or
+  TAccessPathCons1(TypedContent head, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head = apa.getHead()
+    )
+  }
+
+private newtype TPathNode =
+  TPathNodeMid(
+    NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap, Configuration config
+  ) {
+    // A PathNode is introduced by a source ...
+    Stage4::revFlow(node, state, config) and
+    sourceNode(node, state, config) and
+    (
+      if hasSourceCallCtx(config)
+      then cc instanceof CallContextSomeCall
+      else cc instanceof CallContextAny
+    ) and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(node.getDataFlowType())
+    or
+    // ... or a step from an existing PathNode to another node.
+    exists(PathNodeMid mid |
+      pathStep(mid, node, state, cc, sc, ap) and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      Stage4::revFlow(node, state, ap.getApprox(), pragma[only_bind_into](config))
+    )
+  } or
+  TPathNodeSink(NodeEx node, FlowState state, Configuration config) {
+    exists(PathNodeMid sink |
+      sink.isAtSink() and
+      node = sink.getNodeEx() and
+      state = sink.getState() and
+      config = sink.getConfiguration()
+    )
+  }
+
+/**
+ * A list of `TypedContent`s followed by a `DataFlowType`. If data flows from a
+ * source to a given node with a given `AccessPath`, this indicates the sequence
+ * of dereference operations needed to get from the value in the node to the
+ * tracked object. The final type indicates the type of the tracked object.
+ */
+private class AccessPath extends TAccessPath {
+  /** Gets the head of this access path, if any. */
+  abstract TypedContent getHead();
+
+  /** Gets the tail of this access path, if any. */
+  abstract AccessPath getTail();
+
+  /** Gets the front of this access path. */
+  abstract AccessPathFront getFront();
+
+  /** Gets the approximation of this access path. */
+  abstract AccessPathApprox getApprox();
+
+  /** Gets the length of this access path. */
+  abstract int length();
+
+  /** Gets a textual representation of this access path. */
+  abstract string toString();
+
+  /** Gets the access path obtained by popping `tc` from this access path, if any. */
+  final AccessPath pop(TypedContent tc) {
+    result = this.getTail() and
+    tc = this.getHead()
+  }
+
+  /** Gets the access path obtained by pushing `tc` onto this access path. */
+  final AccessPath push(TypedContent tc) { this = result.pop(tc) }
+}
+
+private class AccessPathNil extends AccessPath, TAccessPathNil {
+  private DataFlowType t;
+
+  AccessPathNil() { this = TAccessPathNil(t) }
+
+  DataFlowType getType() { result = t }
+
+  override TypedContent getHead() { none() }
+
+  override AccessPath getTail() { none() }
+
+  override AccessPathFrontNil getFront() { result = TFrontNil(t) }
+
+  override AccessPathApproxNil getApprox() { result = TNil(t) }
+
+  override int length() { result = 0 }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+}
+
+private class AccessPathCons extends AccessPath, TAccessPathCons {
+  private TypedContent head;
+  private AccessPath tail;
+
+  AccessPathCons() { this = TAccessPathCons(head, tail) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() { result = tail }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsNil(head, tail.(AccessPathNil).getType())
+    or
+    result = TConsCons(head, tail.getHead(), this.length())
+    or
+    result = TCons1(head, this.length())
+  }
+
+  override int length() { result = 1 + tail.length() }
+
+  private string toStringImpl(boolean needsSuffix) {
+    exists(DataFlowType t |
+      tail = TAccessPathNil(t) and
+      needsSuffix = false and
+      result = head.toString() + "]" + concat(" : " + ppReprType(t))
+    )
+    or
+    result = head + ", " + tail.(AccessPathCons).toStringImpl(needsSuffix)
+    or
+    exists(TypedContent tc2, TypedContent tc3, int len | tail = TAccessPathCons2(tc2, tc3, len) |
+      result = head + ", " + tc2 + ", " + tc3 + ", ... (" and len > 2 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + ", " + tc3 + "]" and len = 2 and needsSuffix = false
+    )
+    or
+    exists(TypedContent tc2, int len | tail = TAccessPathCons1(tc2, len) |
+      result = head + ", " + tc2 + ", ... (" and len > 1 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + "]" and len = 1 and needsSuffix = false
+    )
+  }
+
+  override string toString() {
+    result = "[" + this.toStringImpl(true) + this.length().toString() + ")]"
+    or
+    result = "[" + this.toStringImpl(false)
+  }
+}
+
+private class AccessPathCons2 extends AccessPath, TAccessPathCons2 {
+  private TypedContent head1;
+  private TypedContent head2;
+  private int len;
+
+  AccessPathCons2() { this = TAccessPathCons2(head1, head2, len) }
+
+  override TypedContent getHead() { result = head1 }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head1, result.getApprox(), _) and
+    result.getHead() = head2 and
+    result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head1) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsCons(head1, head2, len) or
+    result = TCons1(head1, len)
+  }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + head1.toString() + ", " + head2.toString() + "]"
+    else
+      result = "[" + head1.toString() + ", " + head2.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+private class AccessPathCons1 extends AccessPath, TAccessPathCons1 {
+  private TypedContent head;
+  private int len;
+
+  AccessPathCons1() { this = TAccessPathCons1(head, len) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head, result.getApprox(), _) and result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() { result = TCons1(head, len) }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + head.toString() + "]"
+    else result = "[" + head.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+/**
+ * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
+ * Only those `PathNode`s that are reachable from a source are generated.
+ */
+class PathNode extends TPathNode {
+  /** Gets a textual representation of this element. */
+  string toString() { none() }
+
+  /**
+   * Gets a textual representation of this element, including a textual
+   * representation of the call context.
+   */
+  string toStringWithContext() { none() }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    none()
+  }
+
+  /** Gets the underlying `Node`. */
+  final Node getNode() { this.(PathNodeImpl).getNodeEx().projectToNode() = result }
+
+  /** Gets the `FlowState` of this node. */
+  FlowState getState() { none() }
+
+  /** Gets the associated configuration. */
+  Configuration getConfiguration() { none() }
+
+  /** Gets a successor of this node, if any. */
+  final PathNode getASuccessor() {
+    result = this.(PathNodeImpl).getANonHiddenSuccessor() and
+    reach(this) and
+    reach(result)
+  }
+
+  /** Holds if this node is a source. */
+  predicate isSource() { none() }
+}
+
+abstract private class PathNodeImpl extends PathNode {
+  abstract PathNodeImpl getASuccessorImpl();
+
+  private PathNodeImpl getASuccessorIfHidden() {
+    this.isHidden() and
+    result = this.getASuccessorImpl()
+  }
+
+  final PathNodeImpl getANonHiddenSuccessor() {
+    result = this.getASuccessorImpl().getASuccessorIfHidden*() and
+    not this.isHidden() and
+    not result.isHidden()
+  }
+
+  abstract NodeEx getNodeEx();
+
+  predicate isHidden() {
+    not this.getConfiguration().includeHiddenNodes() and
+    (
+      hiddenNode(this.getNodeEx().asNode()) and
+      not this.isSource() and
+      not this instanceof PathNodeSink
+      or
+      this.getNodeEx() instanceof TNodeImplicitRead
+    )
+  }
+
+  private string ppAp() {
+    this instanceof PathNodeSink and result = ""
+    or
+    exists(string s | s = this.(PathNodeMid).getAp().toString() |
+      if s = "" then result = "" else result = " " + s
+    )
+  }
+
+  private string ppCtx() {
+    this instanceof PathNodeSink and result = ""
+    or
+    result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
+  }
+
+  override string toString() { result = this.getNodeEx().toString() + this.ppAp() }
+
+  override string toStringWithContext() {
+    result = this.getNodeEx().toString() + this.ppAp() + this.ppCtx()
+  }
+
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/** Holds if `n` can reach a sink. */
+private predicate directReach(PathNodeImpl n) {
+  n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
+}
+
+/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
+private predicate reach(PathNode n) { directReach(n) or Subpaths::retReach(n) }
+
+/** Holds if `n1.getASuccessor() = n2` and `n2` can reach a sink. */
+private predicate pathSucc(PathNodeImpl n1, PathNode n2) {
+  n1.getANonHiddenSuccessor() = n2 and directReach(n2)
+}
+
+private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
+
+/**
+ * Provides the query predicates needed to include a graph in a path-problem query.
+ */
+module PathGraph {
+  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+  query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }
+
+  /** Holds if `n` is a node in the graph of data flow path explanations. */
+  query predicate nodes(PathNode n, string key, string val) {
+    reach(n) and key = "semmle.label" and val = n.toString()
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {
+    Subpaths::subpaths(arg, par, ret, out) and
+    reach(arg) and
+    reach(par) and
+    reach(ret) and
+    reach(out)
+  }
+}
+
+/**
+ * An intermediate flow graph node. This is a triple consisting of a `Node`,
+ * a `CallContext`, and a `Configuration`.
+ */
+private class PathNodeMid extends PathNodeImpl, TPathNodeMid {
+  NodeEx node;
+  FlowState state;
+  CallContext cc;
+  SummaryCtx sc;
+  AccessPath ap;
+  Configuration config;
+
+  PathNodeMid() { this = TPathNodeMid(node, state, cc, sc, ap, config) }
+
+  override NodeEx getNodeEx() { result = node }
+
+  override FlowState getState() { result = state }
+
+  CallContext getCallContext() { result = cc }
+
+  SummaryCtx getSummaryCtx() { result = sc }
+
+  AccessPath getAp() { result = ap }
+
+  override Configuration getConfiguration() { result = config }
+
+  private PathNodeMid getSuccMid() {
+    pathStep(this, result.getNodeEx(), result.getState(), result.getCallContext(),
+      result.getSummaryCtx(), result.getAp()) and
+    result.getConfiguration() = unbindConf(this.getConfiguration())
+  }
+
+  override PathNodeImpl getASuccessorImpl() {
+    // an intermediate step to another intermediate node
+    result = this.getSuccMid()
+    or
+    // a final step to a sink
+    result = this.getSuccMid().projectToSink()
+  }
+
+  override predicate isSource() {
+    sourceNode(node, state, config) and
+    (
+      if hasSourceCallCtx(config)
+      then cc instanceof CallContextSomeCall
+      else cc instanceof CallContextAny
+    ) and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(node.getDataFlowType())
+  }
+
+  predicate isAtSink() {
+    sinkNode(node, state, config) and
+    ap instanceof AccessPathNil and
+    if hasSinkCallCtx(config)
+    then
+      // For `FeatureHasSinkCallContext` the condition `cc instanceof CallContextNoCall`
+      // is exactly what we need to check. This also implies
+      // `sc instanceof SummaryCtxNone`.
+      // For `FeatureEqualSourceSinkCallContext` the initial call context was
+      // set to `CallContextSomeCall` and jumps are disallowed, so
+      // `cc instanceof CallContextNoCall` never holds. On the other hand,
+      // in this case there's never any need to enter a call except to identify
+      // a summary, so the condition in `pathIntoCallable` enforces this, which
+      // means that `sc instanceof SummaryCtxNone` holds if and only if we are
+      // in the call context of the source.
+      sc instanceof SummaryCtxNone or
+      cc instanceof CallContextNoCall
+    else any()
+  }
+
+  PathNodeSink projectToSink() {
+    this.isAtSink() and
+    result.getNodeEx() = node and
+    result.getState() = state and
+    result.getConfiguration() = unbindConf(config)
+  }
+}
+
+/**
+ * A flow graph node corresponding to a sink. This is disjoint from the
+ * intermediate nodes in order to uniquely correspond to a given sink by
+ * excluding the `CallContext`.
+ */
+private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
+  NodeEx node;
+  FlowState state;
+  Configuration config;
+
+  PathNodeSink() { this = TPathNodeSink(node, state, config) }
+
+  override NodeEx getNodeEx() { result = node }
+
+  override FlowState getState() { result = state }
+
+  override Configuration getConfiguration() { result = config }
+
+  override PathNodeImpl getASuccessorImpl() { none() }
+
+  override predicate isSource() { sourceNode(node, state, config) }
+}
+
+private predicate pathNode(
+  PathNodeMid mid, NodeEx midnode, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap,
+  Configuration conf, LocalCallContext localCC
+) {
+  midnode = mid.getNodeEx() and
+  state = mid.getState() and
+  conf = mid.getConfiguration() and
+  cc = mid.getCallContext() and
+  sc = mid.getSummaryCtx() and
+  localCC =
+    getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
+      midnode.getEnclosingCallable()) and
+  ap = mid.getAp()
+}
+
+/**
+ * Holds if data may flow from `mid` to `node`. The last step in or out of
+ * a callable is recorded by `cc`.
+ */
+pragma[nomagic]
+private predicate pathStep(
+  PathNodeMid mid, NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap
+) {
+  exists(NodeEx midnode, FlowState state0, Configuration conf, LocalCallContext localCC |
+    pathNode(mid, midnode, state0, cc, sc, ap, conf, localCC) and
+    localFlowBigStep(midnode, state0, node, state, true, _, conf, localCC)
+  )
+  or
+  exists(
+    AccessPath ap0, NodeEx midnode, FlowState state0, Configuration conf, LocalCallContext localCC
+  |
+    pathNode(mid, midnode, state0, cc, sc, ap0, conf, localCC) and
+    localFlowBigStep(midnode, state0, node, state, false, ap.getFront(), conf, localCC) and
+    ap0 instanceof AccessPathNil
+  )
+  or
+  jumpStep(mid.getNodeEx(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  ap = mid.getAp()
+  or
+  additionalJumpStep(mid.getNodeEx(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(node.getDataFlowType())
+  or
+  additionalJumpStateStep(mid.getNodeEx(), mid.getState(), node, state, mid.getConfiguration()) and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(node.getDataFlowType())
+  or
+  exists(TypedContent tc | pathStoreStep(mid, node, state, ap.pop(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  exists(TypedContent tc | pathReadStep(mid, node, state, ap.push(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  pathIntoCallable(mid, node, state, _, cc, sc, _, _) and ap = mid.getAp()
+  or
+  pathOutOfCallable(mid, node, state, cc) and ap = mid.getAp() and sc instanceof SummaryCtxNone
+  or
+  pathThroughCallable(mid, node, state, cc, ap) and sc = mid.getSummaryCtx()
+}
+
+pragma[nomagic]
+private predicate pathReadStep(
+  PathNodeMid mid, NodeEx node, FlowState state, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  tc = ap0.getHead() and
+  Stage4::readStepCand(mid.getNodeEx(), tc.getContent(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc = mid.getCallContext()
+}
+
+pragma[nomagic]
+private predicate pathStoreStep(
+  PathNodeMid mid, NodeEx node, FlowState state, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  Stage4::storeStepCand(mid.getNodeEx(), _, tc, node, _, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc = mid.getCallContext()
+}
+
+private predicate pathOutOfCallable0(
+  PathNodeMid mid, ReturnPosition pos, FlowState state, CallContext innercc, AccessPathApprox apa,
+  Configuration config
+) {
+  pos = mid.getNodeEx().(RetNodeEx).getReturnPosition() and
+  state = mid.getState() and
+  innercc = mid.getCallContext() and
+  innercc instanceof CallContextNoCall and
+  apa = mid.getAp().getApprox() and
+  config = mid.getConfiguration()
+}
+
+pragma[nomagic]
+private predicate pathOutOfCallable1(
+  PathNodeMid mid, DataFlowCall call, ReturnKindExt kind, FlowState state, CallContext cc,
+  AccessPathApprox apa, Configuration config
+) {
+  exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+    pathOutOfCallable0(mid, pos, state, innercc, apa, config) and
+    c = pos.getCallable() and
+    kind = pos.getKind() and
+    resolveReturn(innercc, c, call)
+  |
+    if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+  )
+}
+
+pragma[noinline]
+private NodeEx getAnOutNodeFlow(
+  ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config
+) {
+  result.asNode() = kind.getAnOutNode(call) and
+  Stage4::revFlow(result, _, apa, config)
+}
+
+/**
+ * Holds if data may flow from `mid` to `out`. The last step of this path
+ * is a return from a callable and is recorded by `cc`, if needed.
+ */
+pragma[noinline]
+private predicate pathOutOfCallable(PathNodeMid mid, NodeEx out, FlowState state, CallContext cc) {
+  exists(ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config |
+    pathOutOfCallable1(mid, call, kind, state, cc, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
+ */
+pragma[noinline]
+private predicate pathIntoArg(
+  PathNodeMid mid, ParameterPosition ppos, FlowState state, CallContext cc, DataFlowCall call,
+  AccessPath ap, AccessPathApprox apa, Configuration config
+) {
+  exists(ArgNodeEx arg, ArgumentPosition apos |
+    pathNode(mid, arg, state, cc, _, ap, config, _) and
+    arg.asNode().(ArgNode).argumentOf(call, apos) and
+    apa = ap.getApprox() and
+    parameterMatch(ppos, apos)
+  )
+}
+
+pragma[nomagic]
+private predicate parameterCand(
+  DataFlowCallable callable, ParameterPosition pos, AccessPathApprox apa, Configuration config
+) {
+  exists(ParamNodeEx p |
+    Stage4::revFlow(p, _, apa, config) and
+    p.isParameterOf(callable, pos)
+  )
+}
+
+pragma[nomagic]
+private predicate pathIntoCallable0(
+  PathNodeMid mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+  CallContext outercc, DataFlowCall call, AccessPath ap, Configuration config
+) {
+  exists(AccessPathApprox apa |
+    pathIntoArg(mid, pragma[only_bind_into](pos), state, outercc, call, ap,
+      pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+    callable = resolveCall(call, outercc) and
+    parameterCand(callable, pragma[only_bind_into](pos), pragma[only_bind_into](apa),
+      pragma[only_bind_into](config))
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to `p` through `call`. The contexts
+ * before and after entering the callable are `outercc` and `innercc`,
+ * respectively.
+ */
+pragma[nomagic]
+private predicate pathIntoCallable(
+  PathNodeMid mid, ParamNodeEx p, FlowState state, CallContext outercc, CallContextCall innercc,
+  SummaryCtx sc, DataFlowCall call, Configuration config
+) {
+  exists(ParameterPosition pos, DataFlowCallable callable, AccessPath ap |
+    pathIntoCallable0(mid, callable, pos, state, outercc, call, ap, config) and
+    p.isParameterOf(callable, pos) and
+    (
+      sc = TSummaryCtxSome(p, state, ap)
+      or
+      not exists(TSummaryCtxSome(p, state, ap)) and
+      sc = TSummaryCtxNone() and
+      // When the call contexts of source and sink needs to match then there's
+      // never any reason to enter a callable except to find a summary. See also
+      // the comment in `PathNodeMid::isAtSink`.
+      not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+    )
+  |
+    if recordDataFlowCallSite(call, callable)
+    then innercc = TSpecificCall(call)
+    else innercc = TSomeCall()
+  )
+}
+
+/** Holds if data may flow from a parameter given by `sc` to a return of kind `kind`. */
+pragma[nomagic]
+private predicate paramFlowsThrough(
+  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
+  AccessPathApprox apa, Configuration config
+) {
+  exists(PathNodeMid mid, RetNodeEx ret, ParameterPosition pos |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    kind = ret.getKind() and
+    apa = ap.getApprox() and
+    pos = sc.getParameterPos() and
+    // we don't expect a parameter to return stored in itself, unless explicitly allowed
+    (
+      not kind.(ParamUpdateReturnKind).getPosition() = pos
+      or
+      sc.getParamNode().allowParameterReturnInSelf()
+    )
+  )
+}
+
+pragma[nomagic]
+private predicate pathThroughCallable0(
+  DataFlowCall call, PathNodeMid mid, ReturnKindExt kind, FlowState state, CallContext cc,
+  AccessPath ap, AccessPathApprox apa, Configuration config
+) {
+  exists(CallContext innercc, SummaryCtx sc |
+    pathIntoCallable(mid, _, _, cc, innercc, sc, call, config) and
+    paramFlowsThrough(kind, state, innercc, sc, ap, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` through a callable to the node `out`.
+ * The context `cc` is restored to its value prior to entering the callable.
+ */
+pragma[noinline]
+private predicate pathThroughCallable(
+  PathNodeMid mid, NodeEx out, FlowState state, CallContext cc, AccessPath ap
+) {
+  exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa, Configuration config |
+    pathThroughCallable0(call, mid, kind, state, cc, ap, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+private module Subpaths {
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple and `ret` is determined by
+   * `kind`, `sc`, `apout`, and `innercc`.
+   */
+  pragma[nomagic]
+  private predicate subpaths01(
+    PathNodeImpl arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
+    NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    exists(Configuration config |
+      pathThroughCallable(arg, out, pragma[only_bind_into](sout), _, pragma[only_bind_into](apout)) and
+      pathIntoCallable(arg, par, _, _, innercc, sc, _, config) and
+      paramFlowsThrough(kind, pragma[only_bind_into](sout), innercc, sc,
+        pragma[only_bind_into](apout), _, unbindConf(config)) and
+      not arg.isHidden()
+    )
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple and `ret` is determined by
+   * `kind`, `sc`, `sout`, `apout`, and `innercc`.
+   */
+  pragma[nomagic]
+  private predicate subpaths02(
+    PathNode arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
+    NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    subpaths01(arg, par, sc, innercc, kind, out, sout, apout) and
+    out.asNode() = kind.getAnOutNode(_)
+  }
+
+  pragma[nomagic]
+  private Configuration getPathNodeConf(PathNode n) { result = n.getConfiguration() }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple.
+   */
+  pragma[nomagic]
+  private predicate subpaths03(
+    PathNode arg, ParamNodeEx par, PathNodeMid ret, NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    exists(SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind, RetNodeEx retnode |
+      subpaths02(arg, par, sc, innercc, kind, out, sout, apout) and
+      pathNode(ret, retnode, sout, innercc, sc, apout, unbindConf(getPathNodeConf(arg)), _) and
+      kind = retnode.getKind()
+    )
+  }
+
+  private PathNodeImpl localStepToHidden(PathNodeImpl n) {
+    n.getASuccessorImpl() = result and
+    result.isHidden() and
+    exists(NodeEx n1, NodeEx n2 | n1 = n.getNodeEx() and n2 = result.getNodeEx() |
+      localFlowBigStep(n1, _, n2, _, _, _, _, _) or
+      store(n1, _, n2, _, _) or
+      readSet(n1, _, n2, _)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate hasSuccessor(PathNodeImpl pred, PathNodeMid succ, NodeEx succNode) {
+    succ = pred.getANonHiddenSuccessor() and
+    succNode = succ.getNodeEx()
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  predicate subpaths(PathNodeImpl arg, PathNodeImpl par, PathNodeImpl ret, PathNode out) {
+    exists(ParamNodeEx p, NodeEx o, FlowState sout, AccessPath apout, PathNodeMid out0 |
+      pragma[only_bind_into](arg).getANonHiddenSuccessor() = pragma[only_bind_into](out0) and
+      subpaths03(pragma[only_bind_into](arg), p, localStepToHidden*(ret), o, sout, apout) and
+      hasSuccessor(pragma[only_bind_into](arg), par, p) and
+      not ret.isHidden() and
+      pathNode(out0, o, sout, _, _, apout, _, _)
+    |
+      out = out0 or out = out0.projectToSink()
+    )
+  }
+
+  /**
+   * Holds if `n` can reach a return node in a summarized subpath that can reach a sink.
+   */
+  predicate retReach(PathNodeImpl n) {
+    exists(PathNode out | subpaths(_, _, n, out) | directReach(out) or retReach(out))
+    or
+    exists(PathNodeImpl mid |
+      retReach(mid) and
+      n.getANonHiddenSuccessor() = mid and
+      not subpaths(_, mid, _, _)
+    )
+  }
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+private predicate flowsTo(
+  PathNode flowsource, PathNodeSink flowsink, Node source, Node sink, Configuration configuration
+) {
+  flowsource.isSource() and
+  flowsource.getConfiguration() = configuration and
+  flowsource.(PathNodeImpl).getNodeEx().asNode() = source and
+  (flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
+  flowsink.getNodeEx().asNode() = sink
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+predicate flowsTo(Node source, Node sink, Configuration configuration) {
+  flowsTo(_, _, source, sink, configuration)
+}
+
+private predicate finalStats(
+  boolean fwd, int nodes, int fields, int conscand, int states, int tuples
+) {
+  fwd = true and
+  nodes = count(NodeEx n0 | exists(PathNodeImpl pn | pn.getNodeEx() = n0)) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0)) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap)) and
+  states = count(FlowState state | exists(PathNodeMid pn | pn.getState() = state)) and
+  tuples = count(PathNode pn)
+  or
+  fwd = false and
+  nodes = count(NodeEx n0 | exists(PathNodeImpl pn | pn.getNodeEx() = n0 and reach(pn))) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0 and reach(pn))) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap and reach(pn))) and
+  states = count(FlowState state | exists(PathNodeMid pn | pn.getState() = state and reach(pn))) and
+  tuples = count(PathNode pn | reach(pn))
+}
+
+/**
+ * INTERNAL: Only for debugging.
+ *
+ * Calculates per-stage metrics for data flow.
+ */
+predicate stageStats(
+  int n, string stage, int nodes, int fields, int conscand, int states, int tuples,
+  Configuration config
+) {
+  stage = "1 Fwd" and
+  n = 10 and
+  Stage1::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "1 Rev" and
+  n = 15 and
+  Stage1::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "2 Fwd" and
+  n = 20 and
+  Stage2::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "2 Rev" and
+  n = 25 and
+  Stage2::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "3 Fwd" and
+  n = 30 and
+  Stage3::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "3 Rev" and
+  n = 35 and
+  Stage3::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "4 Fwd" and
+  n = 40 and
+  Stage4::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "4 Rev" and
+  n = 45 and
+  Stage4::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "5 Fwd" and n = 50 and finalStats(true, nodes, fields, conscand, states, tuples)
+  or
+  stage = "5 Rev" and n = 55 and finalStats(false, nodes, fields, conscand, states, tuples)
+}
+
+private module FlowExploration {
+  private predicate callableStep(DataFlowCallable c1, DataFlowCallable c2, Configuration config) {
+    exists(NodeEx node1, NodeEx node2 |
+      jumpStep(node1, node2, config)
+      or
+      additionalJumpStep(node1, node2, config)
+      or
+      additionalJumpStateStep(node1, _, node2, _, config)
+      or
+      // flow into callable
+      viableParamArgEx(_, node2, node1)
+      or
+      // flow out of a callable
+      viableReturnPosOutEx(_, node1.(RetNodeEx).getReturnPosition(), node2)
+    |
+      c1 = node1.getEnclosingCallable() and
+      c2 = node2.getEnclosingCallable() and
+      c1 != c2
+    )
+  }
+
+  private predicate interestingCallableSrc(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSource(n) or config.isSource(n, _) | c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSrc(mid, config) and callableStep(mid, c, config)
+    )
+  }
+
+  private predicate interestingCallableSink(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSink(n) or config.isSink(n, _) | c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSink(mid, config) and callableStep(c, mid, config)
+    )
+  }
+
+  private newtype TCallableExt =
+    TCallable(DataFlowCallable c, Configuration config) {
+      interestingCallableSrc(c, config) or
+      interestingCallableSink(c, config)
+    } or
+    TCallableSrc() or
+    TCallableSink()
+
+  private predicate callableExtSrc(TCallableSrc src) { any() }
+
+  private predicate callableExtSink(TCallableSink sink) { any() }
+
+  private predicate callableExtStepFwd(TCallableExt ce1, TCallableExt ce2) {
+    exists(DataFlowCallable c1, DataFlowCallable c2, Configuration config |
+      callableStep(c1, c2, config) and
+      ce1 = TCallable(c1, pragma[only_bind_into](config)) and
+      ce2 = TCallable(c2, pragma[only_bind_into](config))
+    )
+    or
+    exists(Node n, Configuration config |
+      ce1 = TCallableSrc() and
+      (config.isSource(n) or config.isSource(n, _)) and
+      ce2 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+    or
+    exists(Node n, Configuration config |
+      ce2 = TCallableSink() and
+      (config.isSink(n) or config.isSink(n, _)) and
+      ce1 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+  }
+
+  private predicate callableExtStepRev(TCallableExt ce1, TCallableExt ce2) {
+    callableExtStepFwd(ce2, ce1)
+  }
+
+  private int distSrcExt(TCallableExt c) =
+    shortestDistances(callableExtSrc/1, callableExtStepFwd/2)(_, c, result)
+
+  private int distSinkExt(TCallableExt c) =
+    shortestDistances(callableExtSink/1, callableExtStepRev/2)(_, c, result)
+
+  private int distSrc(DataFlowCallable c, Configuration config) {
+    result = distSrcExt(TCallable(c, config)) - 1
+  }
+
+  private int distSink(DataFlowCallable c, Configuration config) {
+    result = distSinkExt(TCallable(c, config)) - 1
+  }
+
+  private newtype TPartialAccessPath =
+    TPartialNil(DataFlowType t) or
+    TPartialCons(TypedContent tc, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `TypedContent`s followed by a `Type`, but only the first
+   * element of the list and its length are tracked. If data flows from a source to
+   * a given node with a given `AccessPath`, this indicates the sequence of
+   * dereference operations needed to get from the value in the node to the
+   * tracked object. The final type indicates the type of the tracked object.
+   */
+  private class PartialAccessPath extends TPartialAccessPath {
+    abstract string toString();
+
+    TypedContent getHead() { this = TPartialCons(result, _) }
+
+    int len() {
+      this = TPartialNil(_) and result = 0
+      or
+      this = TPartialCons(_, result)
+    }
+
+    DataFlowType getType() {
+      this = TPartialNil(result)
+      or
+      exists(TypedContent head | this = TPartialCons(head, _) | result = head.getContainerType())
+    }
+  }
+
+  private class PartialAccessPathNil extends PartialAccessPath, TPartialNil {
+    override string toString() {
+      exists(DataFlowType t | this = TPartialNil(t) | result = concat(": " + ppReprType(t)))
+    }
+  }
+
+  private class PartialAccessPathCons extends PartialAccessPath, TPartialCons {
+    override string toString() {
+      exists(TypedContent tc, int len | this = TPartialCons(tc, len) |
+        if len = 1
+        then result = "[" + tc.toString() + "]"
+        else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private newtype TRevPartialAccessPath =
+    TRevPartialNil() or
+    TRevPartialCons(Content c, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `Content`s, but only the first
+   * element of the list and its length are tracked.
+   */
+  private class RevPartialAccessPath extends TRevPartialAccessPath {
+    abstract string toString();
+
+    Content getHead() { this = TRevPartialCons(result, _) }
+
+    int len() {
+      this = TRevPartialNil() and result = 0
+      or
+      this = TRevPartialCons(_, result)
+    }
+  }
+
+  private class RevPartialAccessPathNil extends RevPartialAccessPath, TRevPartialNil {
+    override string toString() { result = "" }
+  }
+
+  private class RevPartialAccessPathCons extends RevPartialAccessPath, TRevPartialCons {
+    override string toString() {
+      exists(Content c, int len | this = TRevPartialCons(c, len) |
+        if len = 1
+        then result = "[" + c.toString() + "]"
+        else result = "[" + c.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private predicate relevantState(FlowState state) {
+    sourceNode(_, state, _) or
+    sinkNode(_, state, _) or
+    additionalLocalStateStep(_, state, _, _, _) or
+    additionalLocalStateStep(_, _, _, state, _) or
+    additionalJumpStateStep(_, state, _, _, _) or
+    additionalJumpStateStep(_, _, _, state, _)
+  }
+
+  private newtype TSummaryCtx1 =
+    TSummaryCtx1None() or
+    TSummaryCtx1Param(ParamNodeEx p)
+
+  private newtype TSummaryCtx2 =
+    TSummaryCtx2None() or
+    TSummaryCtx2Some(FlowState s) { relevantState(s) }
+
+  private newtype TSummaryCtx3 =
+    TSummaryCtx3None() or
+    TSummaryCtx3Some(PartialAccessPath ap)
+
+  private newtype TRevSummaryCtx1 =
+    TRevSummaryCtx1None() or
+    TRevSummaryCtx1Some(ReturnPosition pos)
+
+  private newtype TRevSummaryCtx2 =
+    TRevSummaryCtx2None() or
+    TRevSummaryCtx2Some(FlowState s) { relevantState(s) }
+
+  private newtype TRevSummaryCtx3 =
+    TRevSummaryCtx3None() or
+    TRevSummaryCtx3Some(RevPartialAccessPath ap)
+
+  private newtype TPartialPathNode =
+    TPartialPathNodeFwd(
+      NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+      TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+    ) {
+      sourceNode(node, state, config) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      sc3 = TSummaryCtx3None() and
+      ap = TPartialNil(node.getDataFlowType()) and
+      exists(config.explorationLimit())
+      or
+      partialPathNodeMk0(node, state, cc, sc1, sc2, sc3, ap, config) and
+      distSrc(node.getEnclosingCallable(), config) <= config.explorationLimit()
+    } or
+    TPartialPathNodeRev(
+      NodeEx node, FlowState state, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2, TRevSummaryCtx3 sc3,
+      RevPartialAccessPath ap, Configuration config
+    ) {
+      sinkNode(node, state, config) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = TRevPartialNil() and
+      exists(config.explorationLimit())
+      or
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
+    }
+
+  pragma[nomagic]
+  private predicate partialPathNodeMk0(
+    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
+  }
+
+  /**
+   * A `Node` augmented with a call context, an access path, and a configuration.
+   */
+  class PartialPathNode extends TPartialPathNode {
+    /** Gets a textual representation of this element. */
+    string toString() { result = this.getNodeEx().toString() + this.ppAp() }
+
+    /**
+     * Gets a textual representation of this element, including a textual
+     * representation of the call context.
+     */
+    string toStringWithContext() {
+      result = this.getNodeEx().toString() + this.ppAp() + this.ppCtx()
+    }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+
+    /** Gets the underlying `Node`. */
+    final Node getNode() { this.getNodeEx().projectToNode() = result }
+
+    FlowState getState() { none() }
+
+    private NodeEx getNodeEx() {
+      result = this.(PartialPathNodeFwd).getNodeEx() or
+      result = this.(PartialPathNodeRev).getNodeEx()
+    }
+
+    /** Gets the associated configuration. */
+    Configuration getConfiguration() { none() }
+
+    /** Gets a successor of this node, if any. */
+    PartialPathNode getASuccessor() { none() }
+
+    /**
+     * Gets the approximate distance to the nearest source measured in number
+     * of interprocedural steps.
+     */
+    int getSourceDistance() {
+      result = distSrc(this.getNodeEx().getEnclosingCallable(), this.getConfiguration())
+    }
+
+    /**
+     * Gets the approximate distance to the nearest sink measured in number
+     * of interprocedural steps.
+     */
+    int getSinkDistance() {
+      result = distSink(this.getNodeEx().getEnclosingCallable(), this.getConfiguration())
+    }
+
+    private string ppAp() {
+      exists(string s |
+        s = this.(PartialPathNodeFwd).getAp().toString() or
+        s = this.(PartialPathNodeRev).getAp().toString()
+      |
+        if s = "" then result = "" else result = " " + s
+      )
+    }
+
+    private string ppCtx() {
+      result = " <" + this.(PartialPathNodeFwd).getCallContext().toString() + ">"
+    }
+
+    /** Holds if this is a source in a forward-flow path. */
+    predicate isFwdSource() { this.(PartialPathNodeFwd).isSource() }
+
+    /** Holds if this is a sink in a reverse-flow path. */
+    predicate isRevSink() { this.(PartialPathNodeRev).isSink() }
+  }
+
+  /**
+   * Provides the query predicates needed to include a graph in a path-problem query.
+   */
+  module PartialPathGraph {
+    /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+    query predicate edges(PartialPathNode a, PartialPathNode b) { a.getASuccessor() = b }
+  }
+
+  private class PartialPathNodeFwd extends PartialPathNode, TPartialPathNodeFwd {
+    NodeEx node;
+    FlowState state;
+    CallContext cc;
+    TSummaryCtx1 sc1;
+    TSummaryCtx2 sc2;
+    TSummaryCtx3 sc3;
+    PartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeFwd() { this = TPartialPathNodeFwd(node, state, cc, sc1, sc2, sc3, ap, config) }
+
+    NodeEx getNodeEx() { result = node }
+
+    override FlowState getState() { result = state }
+
+    CallContext getCallContext() { result = cc }
+
+    TSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    TSummaryCtx3 getSummaryCtx3() { result = sc3 }
+
+    PartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeFwd getASuccessor() {
+      partialPathStep(this, result.getNodeEx(), result.getState(), result.getCallContext(),
+        result.getSummaryCtx1(), result.getSummaryCtx2(), result.getSummaryCtx3(), result.getAp(),
+        result.getConfiguration())
+    }
+
+    predicate isSource() {
+      sourceNode(node, state, config) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      sc3 = TSummaryCtx3None() and
+      ap instanceof TPartialNil
+    }
+  }
+
+  private class PartialPathNodeRev extends PartialPathNode, TPartialPathNodeRev {
+    NodeEx node;
+    FlowState state;
+    TRevSummaryCtx1 sc1;
+    TRevSummaryCtx2 sc2;
+    TRevSummaryCtx3 sc3;
+    RevPartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeRev() { this = TPartialPathNodeRev(node, state, sc1, sc2, sc3, ap, config) }
+
+    NodeEx getNodeEx() { result = node }
+
+    override FlowState getState() { result = state }
+
+    TRevSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TRevSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    TRevSummaryCtx3 getSummaryCtx3() { result = sc3 }
+
+    RevPartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeRev getASuccessor() {
+      revPartialPathStep(result, this.getNodeEx(), this.getState(), this.getSummaryCtx1(),
+        this.getSummaryCtx2(), this.getSummaryCtx3(), this.getAp(), this.getConfiguration())
+    }
+
+    predicate isSink() {
+      sinkNode(node, state, config) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = TRevPartialNil()
+    }
+  }
+
+  private predicate partialPathStep(
+    PartialPathNodeFwd mid, NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1,
+    TSummaryCtx2 sc2, TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    not isUnreachableInCallCached(node.asNode(), cc.(CallContextSpecificCall).getCall()) and
+    (
+      localFlowStep(mid.getNodeEx(), node, config) and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+      or
+      additionalLocalFlowStep(mid.getNodeEx(), node, config) and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(node.getDataFlowType()) and
+      config = mid.getConfiguration()
+      or
+      additionalLocalStateStep(mid.getNodeEx(), mid.getState(), node, state, config) and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(node.getDataFlowType()) and
+      config = mid.getConfiguration()
+    )
+    or
+    jumpStep(mid.getNodeEx(), node, config) and
+    state = mid.getState() and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(mid.getNodeEx(), node, config) and
+    state = mid.getState() and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(node.getDataFlowType()) and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStateStep(mid.getNodeEx(), mid.getState(), node, state, config) and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(node.getDataFlowType()) and
+    config = mid.getConfiguration()
+    or
+    partialPathStoreStep(mid, _, _, node, ap) and
+    state = mid.getState() and
+    cc = mid.getCallContext() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    config = mid.getConfiguration()
+    or
+    exists(PartialAccessPath ap0, TypedContent tc |
+      partialPathReadStep(mid, ap0, tc, node, cc, config) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      apConsFwd(ap, tc, ap0, config)
+    )
+    or
+    partialPathIntoCallable(mid, node, state, _, cc, sc1, sc2, sc3, _, ap, config)
+    or
+    partialPathOutOfCallable(mid, node, state, cc, ap, config) and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None()
+    or
+    partialPathThroughCallable(mid, node, state, cc, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3()
+  }
+
+  bindingset[result, i]
+  private int unbindInt(int i) { pragma[only_bind_out](i) = pragma[only_bind_out](result) }
+
+  pragma[inline]
+  private predicate partialPathStoreStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap1, TypedContent tc, NodeEx node,
+    PartialAccessPath ap2
+  ) {
+    exists(NodeEx midNode, DataFlowType contentType |
+      midNode = mid.getNodeEx() and
+      ap1 = mid.getAp() and
+      store(midNode, tc, node, contentType, mid.getConfiguration()) and
+      ap2.getHead() = tc and
+      ap2.len() = unbindInt(ap1.len() + 1) and
+      compatibleTypes(ap1.getType(), contentType)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsFwd(
+    PartialAccessPath ap1, TypedContent tc, PartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStoreStep(mid, ap1, tc, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathReadStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap, TypedContent tc, NodeEx node, CallContext cc,
+    Configuration config
+  ) {
+    exists(NodeEx midNode |
+      midNode = mid.getNodeEx() and
+      ap = mid.getAp() and
+      read(midNode, tc.getContent(), node, pragma[only_bind_into](config)) and
+      ap.getHead() = tc and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      cc = mid.getCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable0(
+    PartialPathNodeFwd mid, ReturnPosition pos, FlowState state, CallContext innercc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    pos = mid.getNodeEx().(RetNodeEx).getReturnPosition() and
+    state = mid.getState() and
+    innercc = mid.getCallContext() and
+    innercc instanceof CallContextNoCall and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+  }
+
+  pragma[nomagic]
+  private predicate partialPathOutOfCallable1(
+    PartialPathNodeFwd mid, DataFlowCall call, ReturnKindExt kind, FlowState state, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+      partialPathOutOfCallable0(mid, pos, state, innercc, ap, config) and
+      c = pos.getCallable() and
+      kind = pos.getKind() and
+      resolveReturn(innercc, c, call)
+    |
+      if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable(
+    PartialPathNodeFwd mid, NodeEx out, FlowState state, CallContext cc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(ReturnKindExt kind, DataFlowCall call |
+      partialPathOutOfCallable1(mid, call, kind, state, cc, ap, config)
+    |
+      out.asNode() = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathIntoArg(
+    PartialPathNodeFwd mid, ParameterPosition ppos, FlowState state, CallContext cc,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ArgNode arg, ArgumentPosition apos |
+      arg = mid.getNodeEx().asNode() and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      arg.argumentOf(call, apos) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration() and
+      parameterMatch(ppos, apos)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathIntoCallable0(
+    PartialPathNodeFwd mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+    CallContext outercc, DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    partialPathIntoArg(mid, pos, state, outercc, call, ap, config) and
+    callable = resolveCall(call, outercc)
+  }
+
+  private predicate partialPathIntoCallable(
+    PartialPathNodeFwd mid, ParamNodeEx p, FlowState state, CallContext outercc,
+    CallContextCall innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ParameterPosition pos, DataFlowCallable callable |
+      partialPathIntoCallable0(mid, callable, pos, state, outercc, call, ap, config) and
+      p.isParameterOf(callable, pos) and
+      sc1 = TSummaryCtx1Param(p) and
+      sc2 = TSummaryCtx2Some(state) and
+      sc3 = TSummaryCtx3Some(ap)
+    |
+      if recordDataFlowCallSite(call, callable)
+      then innercc = TSpecificCall(call)
+      else innercc = TSomeCall()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate paramFlowsThroughInPartialPath(
+    ReturnKindExt kind, FlowState state, CallContextCall cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid, RetNodeEx ret |
+      mid.getNodeEx() = ret and
+      kind = ret.getKind() and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      config = mid.getConfiguration() and
+      ap = mid.getAp()
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeFwd mid, ReturnKindExt kind, FlowState state, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(CallContext innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3 |
+      partialPathIntoCallable(mid, _, _, cc, innercc, sc1, sc2, sc3, call, _, config) and
+      paramFlowsThroughInPartialPath(kind, state, innercc, sc1, sc2, sc3, ap, config)
+    )
+  }
+
+  private predicate partialPathThroughCallable(
+    PartialPathNodeFwd mid, NodeEx out, FlowState state, CallContext cc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(DataFlowCall call, ReturnKindExt kind |
+      partialPathThroughCallable0(call, mid, kind, state, cc, ap, config) and
+      out.asNode() = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStep(
+    PartialPathNodeRev mid, NodeEx node, FlowState state, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2,
+    TRevSummaryCtx3 sc3, RevPartialAccessPath ap, Configuration config
+  ) {
+    localFlowStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalFlowStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalStateStep(node, state, mid.getNodeEx(), mid.getState(), config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    jumpStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStateStep(node, state, mid.getNodeEx(), mid.getState(), config) and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    revPartialPathReadStep(mid, _, _, node, ap) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    config = mid.getConfiguration()
+    or
+    exists(RevPartialAccessPath ap0, Content c |
+      revPartialPathStoreStep(mid, ap0, c, node, config) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      apConsRev(ap, c, ap0, config)
+    )
+    or
+    exists(ParamNodeEx p |
+      mid.getNodeEx() = p and
+      viableParamArgEx(_, p, node) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+    or
+    exists(ReturnPosition pos |
+      revPartialPathIntoReturn(mid, pos, state, sc1, sc2, sc3, _, ap, config) and
+      pos = getReturnPosition(node.asNode())
+    )
+    or
+    revPartialPathThroughCallable(mid, node, state, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3()
+  }
+
+  pragma[inline]
+  private predicate revPartialPathReadStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap1, Content c, NodeEx node,
+    RevPartialAccessPath ap2
+  ) {
+    exists(NodeEx midNode |
+      midNode = mid.getNodeEx() and
+      ap1 = mid.getAp() and
+      read(node, c, midNode, mid.getConfiguration()) and
+      ap2.getHead() = c and
+      ap2.len() = unbindInt(ap1.len() + 1)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsRev(
+    RevPartialAccessPath ap1, Content c, RevPartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid |
+      revPartialPathReadStep(mid, ap1, c, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStoreStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap, Content c, NodeEx node, Configuration config
+  ) {
+    exists(NodeEx midNode, TypedContent tc |
+      midNode = mid.getNodeEx() and
+      ap = mid.getAp() and
+      store(node, tc, midNode, _, config) and
+      ap.getHead() = c and
+      config = mid.getConfiguration() and
+      tc.getContent() = c
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathIntoReturn(
+    PartialPathNodeRev mid, ReturnPosition pos, FlowState state, TRevSummaryCtx1Some sc1,
+    TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3, DataFlowCall call, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(NodeEx out |
+      mid.getNodeEx() = out and
+      mid.getState() = state and
+      viableReturnPosOutEx(call, pos, out) and
+      sc1 = TRevSummaryCtx1Some(pos) and
+      sc2 = TRevSummaryCtx2Some(state) and
+      sc3 = TRevSummaryCtx3Some(ap) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathFlowsThrough(
+    ArgumentPosition apos, FlowState state, TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2,
+    TRevSummaryCtx3Some sc3, RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid, ParamNodeEx p, ParameterPosition ppos |
+      mid.getNodeEx() = p and
+      mid.getState() = state and
+      p.getPosition() = ppos and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration() and
+      parameterMatch(ppos, apos)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeRev mid, ArgumentPosition pos, FlowState state,
+    RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3 |
+      revPartialPathIntoReturn(mid, _, _, sc1, sc2, sc3, call, _, config) and
+      revPartialPathFlowsThrough(pos, state, sc1, sc2, sc3, ap, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable(
+    PartialPathNodeRev mid, ArgNodeEx node, FlowState state, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(DataFlowCall call, ArgumentPosition pos |
+      revPartialPathThroughCallable0(call, mid, pos, state, ap, config) and
+      node.asNode().(ArgNode).argumentOf(call, pos)
+    )
+  }
+}
+
+import FlowExploration
+
+private predicate partialFlow(
+  PartialPathNode source, PartialPathNode node, Configuration configuration
+) {
+  source.getConfiguration() = configuration and
+  source.isFwdSource() and
+  node = source.getASuccessor+()
+}
+
+private predicate revPartialFlow(
+  PartialPathNode node, PartialPathNode sink, Configuration configuration
+) {
+  sink.getConfiguration() = configuration and
+  sink.isRevSink() and
+  node.getASuccessor+() = sink
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
new file mode 100644
index 00000000000..468f8640a78
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
@@ -0,0 +1,4450 @@
+/**
+ * Provides an implementation of global (interprocedural) data flow. This file
+ * re-exports the local (intraprocedural) data flow analysis from
+ * `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
+ * through the `Configuration` class. This file exists in several identical
+ * copies, allowing queries to use multiple `Configuration` classes that depend
+ * on each other without introducing mutual recursion among those configurations.
+ */
+
+private import DataFlowImplCommon
+private import DataFlowImplSpecific::Private
+import DataFlowImplSpecific::Public
+import DataFlowImplCommonPublic
+
+/**
+ * A configuration of interprocedural data flow analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the global data flow library must define its own unique extension
+ * of this abstract class. To create a configuration, extend this class with
+ * a subclass whose characteristic predicate is a unique singleton string.
+ * For example, write
+ *
+ * ```ql
+ * class MyAnalysisConfiguration extends DataFlow::Configuration {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Optionally override `isBarrier`.
+ *   // Optionally override `isAdditionalFlowStep`.
+ * }
+ * ```
+ * Conceptually, this defines a graph where the nodes are `DataFlow::Node`s and
+ * the edges are those data-flow steps that preserve the value of the node
+ * along with any additional edges defined by `isAdditionalFlowStep`.
+ * Specifying nodes in `isBarrier` will remove those nodes from the graph, and
+ * specifying nodes in `isBarrierIn` and/or `isBarrierOut` will remove in-going
+ * and/or out-going edges from those nodes, respectively.
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```ql
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but two classes extending
+ * `DataFlow::Configuration` should never depend on each other. One of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`.
+ */
+abstract class Configuration extends string {
+  bindingset[this]
+  Configuration() { any() }
+
+  /**
+   * Holds if `source` is a relevant data flow source.
+   */
+  predicate isSource(Node source) { none() }
+
+  /**
+   * Holds if `source` is a relevant data flow source with the given initial
+   * `state`.
+   */
+  predicate isSource(Node source, FlowState state) { none() }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink.
+   */
+  predicate isSink(Node sink) { none() }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink accepting `state`.
+   */
+  predicate isSink(Node source, FlowState state) { none() }
+
+  /**
+   * Holds if data flow through `node` is prohibited. This completely removes
+   * `node` from the data flow graph.
+   */
+  predicate isBarrier(Node node) { none() }
+
+  /**
+   * Holds if data flow through `node` is prohibited when the flow state is
+   * `state`.
+   */
+  predicate isBarrier(Node node, FlowState state) { none() }
+
+  /** Holds if data flow into `node` is prohibited. */
+  predicate isBarrierIn(Node node) { none() }
+
+  /** Holds if data flow out of `node` is prohibited. */
+  predicate isBarrierOut(Node node) { none() }
+
+  /**
+   * DEPRECATED: Use `isBarrier` and `BarrierGuard` module instead.
+   *
+   * Holds if data flow through nodes guarded by `guard` is prohibited.
+   */
+  deprecated predicate isBarrierGuard(BarrierGuard guard) { none() }
+
+  /**
+   * DEPRECATED: Use `isBarrier` and `BarrierGuard` module instead.
+   *
+   * Holds if data flow through nodes guarded by `guard` is prohibited when
+   * the flow state is `state`
+   */
+  deprecated predicate isBarrierGuard(BarrierGuard guard, FlowState state) { none() }
+
+  /**
+   * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
+   */
+  predicate isAdditionalFlowStep(Node node1, Node node2) { none() }
+
+  /**
+   * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
+   * This step is only applicable in `state1` and updates the flow state to `state2`.
+   */
+  predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
+    none()
+  }
+
+  /**
+   * Holds if an arbitrary number of implicit read steps of content `c` may be
+   * taken at `node`.
+   */
+  predicate allowImplicitRead(Node node, ContentSet c) { none() }
+
+  /**
+   * Gets the virtual dispatch branching limit when calculating field flow.
+   * This can be overridden to a smaller value to improve performance (a
+   * value of 0 disables field flow), or a larger value to get more results.
+   */
+  int fieldFlowBranchLimit() { result = 2 }
+
+  /**
+   * Gets a data flow configuration feature to add restrictions to the set of
+   * valid flow paths.
+   *
+   * - `FeatureHasSourceCallContext`:
+   *    Assume that sources have some existing call context to disallow
+   *    conflicting return-flow directly following the source.
+   * - `FeatureHasSinkCallContext`:
+   *    Assume that sinks have some existing call context to disallow
+   *    conflicting argument-to-parameter flow directly preceding the sink.
+   * - `FeatureEqualSourceSinkCallContext`:
+   *    Implies both of the above and additionally ensures that the entire flow
+   *    path preserves the call context.
+   */
+  FlowFeature getAFeature() { none() }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   */
+  predicate hasFlow(Node source, Node sink) { flowsTo(source, sink, this) }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   *
+   * The corresponding paths are generated from the end-points and the graph
+   * included in the module `PathGraph`.
+   */
+  predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowTo(Node sink) { this.hasFlow(_, sink) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowToExpr(DataFlowExpr sink) { this.hasFlowTo(exprNode(sink)) }
+
+  /**
+   * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
+   * measured in approximate number of interprocedural steps.
+   */
+  int explorationLimit() { none() }
+
+  /**
+   * Holds if hidden nodes should be included in the data flow graph.
+   *
+   * This feature should only be used for debugging or when the data flow graph
+   * is not visualized (for example in a `path-problem` query).
+   */
+  predicate includeHiddenNodes() { none() }
+
+  /**
+   * Holds if there is a partial data flow path from `source` to `node`. The
+   * approximate distance between `node` and the closest source is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards sink definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sources is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   */
+  final predicate hasPartialFlow(PartialPathNode source, PartialPathNode node, int dist) {
+    partialFlow(source, node, this) and
+    dist = node.getSourceDistance()
+  }
+
+  /**
+   * Holds if there is a partial data flow path from `node` to `sink`. The
+   * approximate distance between `node` and the closest sink is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards source definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sinks is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   *
+   * Note that reverse flow has slightly lower precision than the corresponding
+   * forward flow, as reverse flow disregards type pruning among other features.
+   */
+  final predicate hasPartialFlowRev(PartialPathNode node, PartialPathNode sink, int dist) {
+    revPartialFlow(node, sink, this) and
+    dist = node.getSinkDistance()
+  }
+}
+
+/**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ */
+abstract private class ConfigurationRecursionPrevention extends Configuration {
+  bindingset[this]
+  ConfigurationRecursionPrevention() { any() }
+
+  override predicate hasFlow(Node source, Node sink) {
+    strictcount(Node n | this.isSource(n)) < 0
+    or
+    strictcount(Node n | this.isSource(n, _)) < 0
+    or
+    strictcount(Node n | this.isSink(n)) < 0
+    or
+    strictcount(Node n | this.isSink(n, _)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, _, n2, _)) < 0
+    or
+    super.hasFlow(source, sink)
+  }
+}
+
+private newtype TNodeEx =
+  TNodeNormal(Node n) or
+  TNodeImplicitRead(Node n, boolean hasRead) {
+    any(Configuration c).allowImplicitRead(n, _) and hasRead = [false, true]
+  }
+
+private class NodeEx extends TNodeEx {
+  string toString() {
+    result = this.asNode().toString()
+    or
+    exists(Node n | this.isImplicitReadNode(n, _) | result = n.toString() + " [Ext]")
+  }
+
+  Node asNode() { this = TNodeNormal(result) }
+
+  predicate isImplicitReadNode(Node n, boolean hasRead) { this = TNodeImplicitRead(n, hasRead) }
+
+  Node projectToNode() { this = TNodeNormal(result) or this = TNodeImplicitRead(result, _) }
+
+  pragma[nomagic]
+  private DataFlowCallable getEnclosingCallable0() {
+    nodeEnclosingCallable(this.projectToNode(), result)
+  }
+
+  pragma[inline]
+  DataFlowCallable getEnclosingCallable() {
+    pragma[only_bind_out](this).getEnclosingCallable0() = pragma[only_bind_into](result)
+  }
+
+  pragma[nomagic]
+  private DataFlowType getDataFlowType0() { nodeDataFlowType(this.asNode(), result) }
+
+  pragma[inline]
+  DataFlowType getDataFlowType() {
+    pragma[only_bind_out](this).getDataFlowType0() = pragma[only_bind_into](result)
+  }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.projectToNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+private class ArgNodeEx extends NodeEx {
+  ArgNodeEx() { this.asNode() instanceof ArgNode }
+}
+
+private class ParamNodeEx extends NodeEx {
+  ParamNodeEx() { this.asNode() instanceof ParamNode }
+
+  predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) {
+    this.asNode().(ParamNode).isParameterOf(c, pos)
+  }
+
+  ParameterPosition getPosition() { this.isParameterOf(_, result) }
+
+  predicate allowParameterReturnInSelf() { allowParameterReturnInSelfCached(this.asNode()) }
+}
+
+private class RetNodeEx extends NodeEx {
+  RetNodeEx() { this.asNode() instanceof ReturnNodeExt }
+
+  ReturnPosition getReturnPosition() { result = getReturnPosition(this.asNode()) }
+
+  ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
+}
+
+private predicate inBarrier(NodeEx node, Configuration config) {
+  exists(Node n |
+    node.asNode() = n and
+    config.isBarrierIn(n)
+  |
+    config.isSource(n) or config.isSource(n, _)
+  )
+}
+
+private predicate outBarrier(NodeEx node, Configuration config) {
+  exists(Node n |
+    node.asNode() = n and
+    config.isBarrierOut(n)
+  |
+    config.isSink(n) or config.isSink(n, _)
+  )
+}
+
+/** A bridge class to access the deprecated `isBarrierGuard`. */
+private class BarrierGuardGuardedNodeBridge extends Unit {
+  abstract predicate guardedNode(Node n, Configuration config);
+
+  abstract predicate guardedNode(Node n, FlowState state, Configuration config);
+}
+
+private class BarrierGuardGuardedNode extends BarrierGuardGuardedNodeBridge {
+  deprecated override predicate guardedNode(Node n, Configuration config) {
+    exists(BarrierGuard g |
+      config.isBarrierGuard(g) and
+      n = g.getAGuardedNode()
+    )
+  }
+
+  deprecated override predicate guardedNode(Node n, FlowState state, Configuration config) {
+    exists(BarrierGuard g |
+      config.isBarrierGuard(g, state) and
+      n = g.getAGuardedNode()
+    )
+  }
+}
+
+pragma[nomagic]
+private predicate fullBarrier(NodeEx node, Configuration config) {
+  exists(Node n | node.asNode() = n |
+    config.isBarrier(n)
+    or
+    config.isBarrierIn(n) and
+    not config.isSource(n) and
+    not config.isSource(n, _)
+    or
+    config.isBarrierOut(n) and
+    not config.isSink(n) and
+    not config.isSink(n, _)
+    or
+    any(BarrierGuardGuardedNodeBridge b).guardedNode(n, config)
+  )
+}
+
+pragma[nomagic]
+private predicate stateBarrier(NodeEx node, FlowState state, Configuration config) {
+  exists(Node n | node.asNode() = n |
+    config.isBarrier(n, state)
+    or
+    any(BarrierGuardGuardedNodeBridge b).guardedNode(n, state, config)
+  )
+}
+
+pragma[nomagic]
+private predicate sourceNode(NodeEx node, FlowState state, Configuration config) {
+  (
+    config.isSource(node.asNode()) and state instanceof FlowStateEmpty
+    or
+    config.isSource(node.asNode(), state)
+  ) and
+  not fullBarrier(node, config) and
+  not stateBarrier(node, state, config)
+}
+
+pragma[nomagic]
+private predicate sinkNode(NodeEx node, FlowState state, Configuration config) {
+  (
+    config.isSink(node.asNode()) and state instanceof FlowStateEmpty
+    or
+    config.isSink(node.asNode(), state)
+  ) and
+  not fullBarrier(node, config) and
+  not stateBarrier(node, state, config)
+}
+
+/** Provides the relevant barriers for a step from `node1` to `node2`. */
+pragma[inline]
+private predicate stepFilter(NodeEx node1, NodeEx node2, Configuration config) {
+  not outBarrier(node1, config) and
+  not inBarrier(node2, config) and
+  not fullBarrier(node1, config) and
+  not fullBarrier(node2, config)
+}
+
+/**
+ * Holds if data can flow in one local step from `node1` to `node2`.
+ */
+private predicate localFlowStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    simpleLocalFlowStepExt(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    stepFilter(node1, node2, config)
+  )
+  or
+  exists(Node n |
+    config.allowImplicitRead(n, _) and
+    node1.asNode() = n and
+    node2.isImplicitReadNode(n, false) and
+    not fullBarrier(node1, config)
+  )
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` does not jump between callables.
+ */
+private predicate additionalLocalFlowStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config)
+  )
+  or
+  exists(Node n |
+    config.allowImplicitRead(n, _) and
+    node1.isImplicitReadNode(n, true) and
+    node2.asNode() = n and
+    not fullBarrier(node2, config)
+  )
+}
+
+private predicate additionalLocalStateStep(
+  NodeEx node1, FlowState s1, NodeEx node2, FlowState s2, Configuration config
+) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), s1, pragma[only_bind_into](n2), s2) and
+    getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not stateBarrier(node1, s1, config) and
+    not stateBarrier(node2, s2, config)
+  )
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` in a way that discards call contexts.
+ */
+private predicate jumpStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    jumpStepCached(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    stepFilter(node1, node2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` jumps between callables.
+ */
+private predicate additionalJumpStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private predicate additionalJumpStateStep(
+  NodeEx node1, FlowState s1, NodeEx node2, FlowState s2, Configuration config
+) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), s1, pragma[only_bind_into](n2), s2) and
+    getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not stateBarrier(node1, s1, config) and
+    not stateBarrier(node2, s2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+pragma[nomagic]
+private predicate readSet(NodeEx node1, ContentSet c, NodeEx node2, Configuration config) {
+  readSet(pragma[only_bind_into](node1.asNode()), c, pragma[only_bind_into](node2.asNode())) and
+  stepFilter(node1, node2, config)
+  or
+  exists(Node n |
+    node2.isImplicitReadNode(n, true) and
+    node1.isImplicitReadNode(n, _) and
+    config.allowImplicitRead(n, c)
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate read(NodeEx node1, Content c, NodeEx node2, Configuration config) {
+  exists(ContentSet cs |
+    readSet(node1, cs, node2, config) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate clearsContentEx(NodeEx n, Content c) {
+  exists(ContentSet cs |
+    clearsContentCached(n.asNode(), cs) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate expectsContentEx(NodeEx n, Content c) {
+  exists(ContentSet cs |
+    expectsContentCached(n.asNode(), cs) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+pragma[nomagic]
+private predicate notExpectsContent(NodeEx n) { not expectsContentCached(n.asNode(), _) }
+
+pragma[nomagic]
+private predicate store(
+  NodeEx node1, TypedContent tc, NodeEx node2, DataFlowType contentType, Configuration config
+) {
+  store(pragma[only_bind_into](node1.asNode()), tc, pragma[only_bind_into](node2.asNode()),
+    contentType) and
+  read(_, tc.getContent(), _, config) and
+  stepFilter(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutEx(DataFlowCall call, ReturnPosition pos, NodeEx out) {
+  viableReturnPosOut(call, pos, out.asNode())
+}
+
+pragma[nomagic]
+private predicate viableParamArgEx(DataFlowCall call, ParamNodeEx p, ArgNodeEx arg) {
+  viableParamArg(call, p.asNode(), arg.asNode())
+}
+
+/**
+ * Holds if field flow should be used for the given configuration.
+ */
+private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
+
+private predicate hasSourceCallCtx(Configuration config) {
+  exists(FlowFeature feature | feature = config.getAFeature() |
+    feature instanceof FeatureHasSourceCallContext or
+    feature instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private predicate hasSinkCallCtx(Configuration config) {
+  exists(FlowFeature feature | feature = config.getAFeature() |
+    feature instanceof FeatureHasSinkCallContext or
+    feature instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private module Stage1 implements StageSig {
+  class ApApprox = Unit;
+
+  class Ap = Unit;
+
+  class ApOption = Unit;
+
+  class Cc = boolean;
+
+  /* Begin: Stage 1 logic. */
+  /**
+   * Holds if `node` is reachable from a source in the configuration `config`.
+   *
+   * The Boolean `cc` records whether the node is reached through an
+   * argument in a call.
+   */
+  predicate fwdFlow(NodeEx node, Cc cc, Configuration config) {
+    sourceNode(node, _, config) and
+    if hasSourceCallCtx(config) then cc = true else cc = false
+    or
+    exists(NodeEx mid | fwdFlow(mid, cc, config) |
+      localFlowStep(mid, node, config) or
+      additionalLocalFlowStep(mid, node, config) or
+      additionalLocalStateStep(mid, _, node, _, config)
+    )
+    or
+    exists(NodeEx mid | fwdFlow(mid, _, config) and cc = false |
+      jumpStep(mid, node, config) or
+      additionalJumpStep(mid, node, config) or
+      additionalJumpStateStep(mid, _, node, _, config)
+    )
+    or
+    // store
+    exists(NodeEx mid |
+      useFieldFlow(config) and
+      fwdFlow(mid, cc, config) and
+      store(mid, _, node, _, config)
+    )
+    or
+    // read
+    exists(ContentSet c |
+      fwdFlowReadSet(c, node, cc, config) and
+      fwdFlowConsCandSet(c, _, config)
+    )
+    or
+    // flow into a callable
+    exists(NodeEx arg |
+      fwdFlow(arg, _, config) and
+      viableParamArgEx(_, node, arg) and
+      cc = true and
+      not fullBarrier(node, config)
+    )
+    or
+    // flow out of a callable
+    exists(DataFlowCall call |
+      fwdFlowOut(call, node, false, config) and
+      cc = false
+      or
+      fwdFlowOutFromArg(call, node, config) and
+      fwdFlowIsEntered(call, cc, config)
+    )
+  }
+
+  private predicate fwdFlow(NodeEx node, Configuration config) { fwdFlow(node, _, config) }
+
+  pragma[nomagic]
+  private predicate fwdFlowReadSet(ContentSet c, NodeEx node, Cc cc, Configuration config) {
+    exists(NodeEx mid |
+      fwdFlow(mid, cc, config) and
+      readSet(mid, c, node, config)
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a store in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCand(Content c, Configuration config) {
+    exists(NodeEx mid, NodeEx node, TypedContent tc |
+      not fullBarrier(node, config) and
+      useFieldFlow(config) and
+      fwdFlow(mid, _, config) and
+      store(mid, tc, node, _, config) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `cs` may be interpreted in a read as the target of some store
+   * into `c`, in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCandSet(ContentSet cs, Content c, Configuration config) {
+    fwdFlowConsCand(c, config) and
+    c = cs.getAReadContent()
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowReturnPosition(ReturnPosition pos, Cc cc, Configuration config) {
+    exists(RetNodeEx ret |
+      fwdFlow(ret, cc, config) and
+      ret.getReturnPosition() = pos
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOut(DataFlowCall call, NodeEx out, Cc cc, Configuration config) {
+    exists(ReturnPosition pos |
+      fwdFlowReturnPosition(pos, cc, config) and
+      viableReturnPosOutEx(call, pos, out) and
+      not fullBarrier(out, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOutFromArg(DataFlowCall call, NodeEx out, Configuration config) {
+    fwdFlowOut(call, out, true, config)
+  }
+
+  /**
+   * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowIsEntered(DataFlowCall call, Cc cc, Configuration config) {
+    exists(ArgNodeEx arg |
+      fwdFlow(arg, cc, config) and
+      viableParamArgEx(call, _, arg)
+    )
+  }
+
+  private predicate stateStepFwd(FlowState state1, FlowState state2, Configuration config) {
+    exists(NodeEx node1 |
+      additionalLocalStateStep(node1, state1, _, state2, config) or
+      additionalJumpStateStep(node1, state1, _, state2, config)
+    |
+      fwdFlow(node1, config)
+    )
+  }
+
+  private predicate fwdFlowState(FlowState state, Configuration config) {
+    sourceNode(_, state, config)
+    or
+    exists(FlowState state0 |
+      fwdFlowState(state0, config) and
+      stateStepFwd(state0, state, config)
+    )
+  }
+
+  /**
+   * Holds if `node` is part of a path from a source to a sink in the
+   * configuration `config`.
+   *
+   * The Boolean `toReturn` records whether the node must be returned from
+   * the enclosing callable in order to reach a sink.
+   */
+  pragma[nomagic]
+  predicate revFlow(NodeEx node, boolean toReturn, Configuration config) {
+    revFlow0(node, toReturn, config) and
+    fwdFlow(node, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlow0(NodeEx node, boolean toReturn, Configuration config) {
+    exists(FlowState state |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      sinkNode(node, state, config) and
+      fwdFlowState(state, pragma[only_bind_into](config)) and
+      if hasSinkCallCtx(config) then toReturn = true else toReturn = false
+    )
+    or
+    exists(NodeEx mid | revFlow(mid, toReturn, config) |
+      localFlowStep(node, mid, config) or
+      additionalLocalFlowStep(node, mid, config) or
+      additionalLocalStateStep(node, _, mid, _, config)
+    )
+    or
+    exists(NodeEx mid | revFlow(mid, _, config) and toReturn = false |
+      jumpStep(node, mid, config) or
+      additionalJumpStep(node, mid, config) or
+      additionalJumpStateStep(node, _, mid, _, config)
+    )
+    or
+    // store
+    exists(Content c |
+      revFlowStore(c, node, toReturn, config) and
+      revFlowConsCand(c, config)
+    )
+    or
+    // read
+    exists(NodeEx mid, ContentSet c |
+      readSet(node, c, mid, config) and
+      fwdFlowConsCandSet(c, _, pragma[only_bind_into](config)) and
+      revFlow(mid, toReturn, pragma[only_bind_into](config))
+    )
+    or
+    // flow into a callable
+    exists(DataFlowCall call |
+      revFlowIn(call, node, false, config) and
+      toReturn = false
+      or
+      revFlowInToReturn(call, node, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+    or
+    // flow out of a callable
+    exists(ReturnPosition pos |
+      revFlowOut(pos, config) and
+      node.(RetNodeEx).getReturnPosition() = pos and
+      toReturn = true
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a read in the flow covered by `revFlow`.
+   */
+  pragma[nomagic]
+  private predicate revFlowConsCand(Content c, Configuration config) {
+    exists(NodeEx mid, NodeEx node, ContentSet cs |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      readSet(node, cs, mid, config) and
+      fwdFlowConsCandSet(cs, c, pragma[only_bind_into](config)) and
+      revFlow(pragma[only_bind_into](mid), _, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowStore(Content c, NodeEx node, boolean toReturn, Configuration config) {
+    exists(NodeEx mid, TypedContent tc |
+      revFlow(mid, toReturn, pragma[only_bind_into](config)) and
+      fwdFlowConsCand(c, pragma[only_bind_into](config)) and
+      store(node, tc, mid, _, config) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of both a read and a store in the flow covered
+   * by `revFlow`.
+   */
+  pragma[nomagic]
+  predicate revFlowIsReadAndStored(Content c, Configuration conf) {
+    revFlowConsCand(c, conf) and
+    revFlowStore(c, _, _, conf)
+  }
+
+  pragma[nomagic]
+  predicate viableReturnPosOutNodeCandFwd1(
+    DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
+  ) {
+    fwdFlowReturnPosition(pos, _, config) and
+    viableReturnPosOutEx(call, pos, out)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
+    exists(DataFlowCall call, NodeEx out |
+      revFlow(out, _, config) and
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate viableParamArgNodeCandFwd1(
+    DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
+  ) {
+    viableParamArgEx(call, p, arg) and
+    fwdFlow(arg, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowIn(
+    DataFlowCall call, ArgNodeEx arg, boolean toReturn, Configuration config
+  ) {
+    exists(ParamNodeEx p |
+      revFlow(p, toReturn, config) and
+      viableParamArgNodeCandFwd1(call, p, arg, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowInToReturn(DataFlowCall call, ArgNodeEx arg, Configuration config) {
+    revFlowIn(call, arg, true, config)
+  }
+
+  /**
+   * Holds if an output from `call` is reached in the flow covered by `revFlow`
+   * and data might flow through the target callable resulting in reverse flow
+   * reaching an argument of `call`.
+   */
+  pragma[nomagic]
+  private predicate revFlowIsReturned(DataFlowCall call, boolean toReturn, Configuration config) {
+    exists(NodeEx out |
+      revFlow(out, toReturn, config) and
+      fwdFlowOutFromArg(call, out, config)
+    )
+  }
+
+  private predicate stateStepRev(FlowState state1, FlowState state2, Configuration config) {
+    exists(NodeEx node1, NodeEx node2 |
+      additionalLocalStateStep(node1, state1, node2, state2, config) or
+      additionalJumpStateStep(node1, state1, node2, state2, config)
+    |
+      revFlow(node1, _, pragma[only_bind_into](config)) and
+      revFlow(node2, _, pragma[only_bind_into](config)) and
+      fwdFlowState(state1, pragma[only_bind_into](config)) and
+      fwdFlowState(state2, pragma[only_bind_into](config))
+    )
+  }
+
+  predicate revFlowState(FlowState state, Configuration config) {
+    exists(NodeEx node |
+      sinkNode(node, state, config) and
+      revFlow(node, _, pragma[only_bind_into](config)) and
+      fwdFlowState(state, pragma[only_bind_into](config))
+    )
+    or
+    exists(FlowState state0 |
+      revFlowState(state0, config) and
+      stateStepRev(state, state0, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate storeStepCand(
+    NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+    Configuration config
+  ) {
+    exists(Content c |
+      revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      revFlow(node2, pragma[only_bind_into](config)) and
+      store(node1, tc, node2, contentType, config) and
+      c = tc.getContent() and
+      exists(ap1)
+    )
+  }
+
+  pragma[nomagic]
+  predicate readStepCand(NodeEx n1, Content c, NodeEx n2, Configuration config) {
+    revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+    read(n1, c, n2, pragma[only_bind_into](config)) and
+    revFlow(n2, pragma[only_bind_into](config))
+  }
+
+  pragma[nomagic]
+  predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, config) }
+
+  bindingset[node, state, config]
+  predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    revFlow(node, _, pragma[only_bind_into](config)) and
+    exists(state) and
+    exists(ap)
+  }
+
+  private predicate throughFlowNodeCand(NodeEx node, Configuration config) {
+    revFlow(node, true, config) and
+    fwdFlow(node, true, config) and
+    not inBarrier(node, config) and
+    not outBarrier(node, config)
+  }
+
+  /** Holds if flow may return from `callable`. */
+  pragma[nomagic]
+  private predicate returnFlowCallableNodeCand(
+    DataFlowCallable callable, ReturnKindExt kind, Configuration config
+  ) {
+    exists(RetNodeEx ret |
+      throughFlowNodeCand(ret, config) and
+      callable = ret.getEnclosingCallable() and
+      kind = ret.getKind()
+    )
+  }
+
+  /**
+   * Holds if flow may enter through `p` and reach a return node making `p` a
+   * candidate for the origin of a summary.
+   */
+  pragma[nomagic]
+  predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
+    exists(ReturnKindExt kind |
+      throughFlowNodeCand(p, config) and
+      returnFlowCallableNodeCand(c, kind, config) and
+      p.getEnclosingCallable() = c and
+      exists(ap) and
+      // we don't expect a parameter to return stored in itself, unless explicitly allowed
+      (
+        not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
+        or
+        p.allowParameterReturnInSelf()
+      )
+    )
+  }
+
+  pragma[nomagic]
+  predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
+    exists(ArgNodeEx arg, boolean toReturn |
+      revFlow(arg, toReturn, config) and
+      revFlowInToReturn(call, arg, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+  }
+
+  predicate stats(
+    boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
+  ) {
+    fwd = true and
+    nodes = count(NodeEx node | fwdFlow(node, config)) and
+    fields = count(Content f0 | fwdFlowConsCand(f0, config)) and
+    conscand = -1 and
+    states = count(FlowState state | fwdFlowState(state, config)) and
+    tuples = count(NodeEx n, boolean b | fwdFlow(n, b, config))
+    or
+    fwd = false and
+    nodes = count(NodeEx node | revFlow(node, _, config)) and
+    fields = count(Content f0 | revFlowConsCand(f0, config)) and
+    conscand = -1 and
+    states = count(FlowState state | revFlowState(state, config)) and
+    tuples = count(NodeEx n, boolean b | revFlow(n, b, config))
+  }
+  /* End: Stage 1 logic. */
+}
+
+pragma[noinline]
+private predicate localFlowStepNodeCand1(NodeEx node1, NodeEx node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  localFlowStep(node1, node2, config)
+}
+
+pragma[noinline]
+private predicate additionalLocalFlowStepNodeCand1(NodeEx node1, NodeEx node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  additionalLocalFlowStep(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutNodeCand1(
+  DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
+) {
+  Stage1::revFlow(out, config) and
+  Stage1::viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, RetNodeEx ret, NodeEx out, Configuration config
+) {
+  viableReturnPosOutNodeCand1(call, ret.getReturnPosition(), out, config) and
+  Stage1::revFlow(ret, config) and
+  not outBarrier(ret, config) and
+  not inBarrier(out, config)
+}
+
+pragma[nomagic]
+private predicate viableParamArgNodeCand1(
+  DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
+) {
+  Stage1::viableParamArgNodeCandFwd1(call, p, arg, config) and
+  Stage1::revFlow(arg, config)
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, Configuration config
+) {
+  viableParamArgNodeCand1(call, p, arg, config) and
+  Stage1::revFlow(p, config) and
+  not outBarrier(arg, config) and
+  not inBarrier(p, config)
+}
+
+/**
+ * Gets the amount of forward branching on the origin of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int branch(NodeEx n1, Configuration conf) {
+  result =
+    strictcount(NodeEx n |
+      flowOutOfCallNodeCand1(_, n1, n, conf) or flowIntoCallNodeCand1(_, n1, n, conf)
+    )
+}
+
+/**
+ * Gets the amount of backward branching on the target of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int join(NodeEx n2, Configuration conf) {
+  result =
+    strictcount(NodeEx n |
+      flowOutOfCallNodeCand1(_, n, n2, conf) or flowIntoCallNodeCand1(_, n, n2, conf)
+    )
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink. The
+ * `allowsFieldFlow` flag indicates whether the branching is within the limit
+ * specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, ret, out, config) and
+  exists(int b, int j |
+    b = branch(ret, config) and
+    j = join(out, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink. The `allowsFieldFlow` flag indicates whether
+ * the branching is within the limit specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+) {
+  flowIntoCallNodeCand1(call, arg, p, config) and
+  exists(int b, int j |
+    b = branch(arg, config) and
+    j = join(p, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+private signature module StageSig {
+  class Ap;
+
+  predicate revFlow(NodeEx node, Configuration config);
+
+  bindingset[node, state, config]
+  predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config);
+
+  predicate callMayFlowThroughRev(DataFlowCall call, Configuration config);
+
+  predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config);
+
+  predicate storeStepCand(
+    NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+    Configuration config
+  );
+
+  predicate readStepCand(NodeEx n1, Content c, NodeEx n2, Configuration config);
+}
+
+private module MkStage<StageSig PrevStage> {
+  class ApApprox = PrevStage::Ap;
+
+  signature module StageParam {
+    class Ap;
+
+    class ApNil extends Ap;
+
+    bindingset[result, ap]
+    ApApprox getApprox(Ap ap);
+
+    ApNil getApNil(NodeEx node);
+
+    bindingset[tc, tail]
+    Ap apCons(TypedContent tc, Ap tail);
+
+    Content getHeadContent(Ap ap);
+
+    class ApOption;
+
+    ApOption apNone();
+
+    ApOption apSome(Ap ap);
+
+    class Cc;
+
+    class CcCall extends Cc;
+
+    // TODO: member predicate on CcCall
+    predicate matchesCall(CcCall cc, DataFlowCall call);
+
+    class CcNoCall extends Cc;
+
+    Cc ccNone();
+
+    CcCall ccSomeCall();
+
+    class LocalCc;
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc);
+
+    bindingset[call, c, innercc]
+    CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc);
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc);
+
+    bindingset[node1, state1, config]
+    bindingset[node2, state2, config]
+    predicate localStep(
+      NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+      ApNil ap, Configuration config, LocalCc lcc
+    );
+
+    predicate flowOutOfCall(
+      DataFlowCall call, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow, Configuration config
+    );
+
+    predicate flowIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+    );
+
+    bindingset[node, state, ap, config]
+    predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config);
+
+    bindingset[ap, contentType]
+    predicate typecheckStore(Ap ap, DataFlowType contentType);
+  }
+
+  module Stage<StageParam Param> implements StageSig {
+    import Param
+
+    /* Begin: Stage logic. */
+    bindingset[result, apa]
+    private ApApprox unbindApa(ApApprox apa) {
+      pragma[only_bind_out](apa) = pragma[only_bind_out](result)
+    }
+
+    pragma[nomagic]
+    private predicate flowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      Configuration config
+    ) {
+      flowOutOfCall(call, ret, out, allowsFieldFlow, pragma[only_bind_into](config)) and
+      PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(_, ret.getEnclosingCallable(), _,
+        pragma[only_bind_into](config)) and
+      matchesCall(ccc, call)
+    }
+
+    /**
+     * Holds if `node` is reachable with access path `ap` from a source in the
+     * configuration `config`.
+     *
+     * The call context `cc` records whether the node is reached through an
+     * argument in a call, and if so, `argAp` records the access path of that
+     * argument.
+     */
+    pragma[nomagic]
+    predicate fwdFlow(
+      NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      fwdFlow0(node, state, cc, argAp, ap, config) and
+      PrevStage::revFlow(node, state, unbindApa(getApprox(ap)), config) and
+      filter(node, state, ap, config)
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlow0(
+      NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      sourceNode(node, state, config) and
+      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
+      argAp = apNone() and
+      ap = getApNil(node)
+      or
+      exists(NodeEx mid, FlowState state0, Ap ap0, LocalCc localCc |
+        fwdFlow(mid, state0, cc, argAp, ap0, config) and
+        localCc = getLocalCc(mid, cc)
+      |
+        localStep(mid, state0, node, state, true, _, config, localCc) and
+        ap = ap0
+        or
+        localStep(mid, state0, node, state, false, ap, config, localCc) and
+        ap0 instanceof ApNil
+      )
+      or
+      exists(NodeEx mid |
+        fwdFlow(mid, pragma[only_bind_into](state), _, _, ap, pragma[only_bind_into](config)) and
+        jumpStep(mid, node, config) and
+        cc = ccNone() and
+        argAp = apNone()
+      )
+      or
+      exists(NodeEx mid, ApNil nil |
+        fwdFlow(mid, state, _, _, nil, pragma[only_bind_into](config)) and
+        additionalJumpStep(mid, node, config) and
+        cc = ccNone() and
+        argAp = apNone() and
+        ap = getApNil(node)
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(mid, state0, _, _, nil, pragma[only_bind_into](config)) and
+        additionalJumpStateStep(mid, state0, node, state, config) and
+        cc = ccNone() and
+        argAp = apNone() and
+        ap = getApNil(node)
+      )
+      or
+      // store
+      exists(TypedContent tc, Ap ap0 |
+        fwdFlowStore(_, ap0, tc, node, state, cc, argAp, config) and
+        ap = apCons(tc, ap0)
+      )
+      or
+      // read
+      exists(Ap ap0, Content c |
+        fwdFlowRead(ap0, c, _, node, state, cc, argAp, config) and
+        fwdFlowConsCand(ap0, c, ap, config)
+      )
+      or
+      // flow into a callable
+      exists(ApApprox apa |
+        fwdFlowIn(_, node, state, _, cc, _, ap, config) and
+        apa = getApprox(ap) and
+        if PrevStage::parameterMayFlowThrough(node, _, apa, config)
+        then argAp = apSome(ap)
+        else argAp = apNone()
+      )
+      or
+      // flow out of a callable
+      fwdFlowOutNotFromArg(node, state, cc, argAp, ap, config)
+      or
+      exists(DataFlowCall call, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, argAp0, ap, config) and
+        fwdFlowIsEntered(call, cc, argAp, argAp0, config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowStore(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc, ApOption argAp,
+      Configuration config
+    ) {
+      exists(DataFlowType contentType |
+        fwdFlow(node1, state, cc, argAp, ap1, config) and
+        PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
+        typecheckStore(ap1, contentType)
+      )
+    }
+
+    /**
+     * Holds if forward flow with access path `tail` reaches a store of `c`
+     * resulting in access path `cons`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+      exists(TypedContent tc |
+        fwdFlowStore(_, tail, tc, _, _, _, _, config) and
+        tc.getContent() = c and
+        cons = apCons(tc, tail)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowRead(
+      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc, ApOption argAp,
+      Configuration config
+    ) {
+      fwdFlow(node1, state, cc, argAp, ap, config) and
+      PrevStage::readStepCand(node1, c, node2, config) and
+      getHeadContent(ap) = c
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowIn(
+      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, Cc innercc, ApOption argAp,
+      Ap ap, Configuration config
+    ) {
+      exists(ArgNodeEx arg, boolean allowsFieldFlow |
+        fwdFlow(arg, state, outercc, argAp, ap, config) and
+        flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+        innercc = getCallContextCall(call, p.getEnclosingCallable(), outercc) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowOutNotFromArg(
+      NodeEx out, FlowState state, Cc ccOut, ApOption argAp, Ap ap, Configuration config
+    ) {
+      exists(
+        DataFlowCall call, RetNodeEx ret, boolean allowsFieldFlow, CcNoCall innercc,
+        DataFlowCallable inner
+      |
+        fwdFlow(ret, state, innercc, argAp, ap, config) and
+        flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+        inner = ret.getEnclosingCallable() and
+        ccOut = getCallContextReturn(inner, call, innercc) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, Ap argAp, Ap ap, Configuration config
+    ) {
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc |
+        fwdFlow(ret, state, ccc, apSome(argAp), ap, config) and
+        flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    /**
+     * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`
+     * and data might flow through the target callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowIsEntered(
+      DataFlowCall call, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p |
+        fwdFlowIn(call, p, _, cc, _, argAp, ap, config) and
+        PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate storeStepFwd(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, Ap ap2, Configuration config
+    ) {
+      fwdFlowStore(node1, ap1, tc, node2, _, _, _, config) and
+      ap2 = apCons(tc, ap1) and
+      fwdFlowRead(ap2, tc.getContent(), _, _, _, _, _, config)
+    }
+
+    private predicate readStepFwd(
+      NodeEx n1, Ap ap1, Content c, NodeEx n2, Ap ap2, Configuration config
+    ) {
+      fwdFlowRead(ap1, c, n1, n2, _, _, _, config) and
+      fwdFlowConsCand(ap1, c, ap2, config)
+    }
+
+    pragma[nomagic]
+    private predicate callMayFlowThroughFwd(DataFlowCall call, Configuration config) {
+      exists(Ap argAp0, NodeEx out, FlowState state, Cc cc, ApOption argAp, Ap ap |
+        fwdFlow(out, state, pragma[only_bind_into](cc), pragma[only_bind_into](argAp), ap,
+          pragma[only_bind_into](config)) and
+        fwdFlowOutFromArg(call, out, state, argAp0, ap, config) and
+        fwdFlowIsEntered(pragma[only_bind_into](call), pragma[only_bind_into](cc),
+          pragma[only_bind_into](argAp), pragma[only_bind_into](argAp0),
+          pragma[only_bind_into](config))
+      )
+    }
+
+    pragma[nomagic]
+    private predicate flowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+    ) {
+      flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+      fwdFlow(arg, _, _, _, _, pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(p, _, _, pragma[only_bind_into](config)) and
+      callMayFlowThroughFwd(call, pragma[only_bind_into](config))
+    }
+
+    pragma[nomagic]
+    private predicate returnNodeMayFlowThrough(
+      RetNodeEx ret, FlowState state, Ap ap, Configuration config
+    ) {
+      fwdFlow(ret, state, any(CcCall ccc), apSome(_), ap, config)
+    }
+
+    /**
+     * Holds if `node` with access path `ap` is part of a path from a source to a
+     * sink in the configuration `config`.
+     *
+     * The Boolean `toReturn` records whether the node must be returned from the
+     * enclosing callable in order to reach a sink, and if so, `returnAp` records
+     * the access path of the returned value.
+     */
+    pragma[nomagic]
+    predicate revFlow(
+      NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      revFlow0(node, state, toReturn, returnAp, ap, config) and
+      fwdFlow(node, state, _, _, ap, config)
+    }
+
+    pragma[nomagic]
+    private predicate revFlow0(
+      NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      fwdFlow(node, state, _, _, ap, config) and
+      sinkNode(node, state, config) and
+      (if hasSinkCallCtx(config) then toReturn = true else toReturn = false) and
+      returnAp = apNone() and
+      ap instanceof ApNil
+      or
+      exists(NodeEx mid, FlowState state0 |
+        localStep(node, state, mid, state0, true, _, config, _) and
+        revFlow(mid, state0, toReturn, returnAp, ap, config)
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(node, pragma[only_bind_into](state), _, _, ap, pragma[only_bind_into](config)) and
+        localStep(node, pragma[only_bind_into](state), mid, state0, false, _, config, _) and
+        revFlow(mid, state0, toReturn, returnAp, nil, pragma[only_bind_into](config)) and
+        ap instanceof ApNil
+      )
+      or
+      exists(NodeEx mid |
+        jumpStep(node, mid, config) and
+        revFlow(mid, state, _, _, ap, config) and
+        toReturn = false and
+        returnAp = apNone()
+      )
+      or
+      exists(NodeEx mid, ApNil nil |
+        fwdFlow(node, _, _, _, ap, pragma[only_bind_into](config)) and
+        additionalJumpStep(node, mid, config) and
+        revFlow(pragma[only_bind_into](mid), state, _, _, nil, pragma[only_bind_into](config)) and
+        toReturn = false and
+        returnAp = apNone() and
+        ap instanceof ApNil
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(node, _, _, _, ap, pragma[only_bind_into](config)) and
+        additionalJumpStateStep(node, state, mid, state0, config) and
+        revFlow(pragma[only_bind_into](mid), pragma[only_bind_into](state0), _, _, nil,
+          pragma[only_bind_into](config)) and
+        toReturn = false and
+        returnAp = apNone() and
+        ap instanceof ApNil
+      )
+      or
+      // store
+      exists(Ap ap0, Content c |
+        revFlowStore(ap0, c, ap, node, state, _, _, toReturn, returnAp, config) and
+        revFlowConsCand(ap0, c, ap, config)
+      )
+      or
+      // read
+      exists(NodeEx mid, Ap ap0 |
+        revFlow(mid, state, toReturn, returnAp, ap0, config) and
+        readStepFwd(node, ap, _, mid, ap0, config)
+      )
+      or
+      // flow into a callable
+      revFlowInNotToReturn(node, state, returnAp, ap, config) and
+      toReturn = false
+      or
+      exists(DataFlowCall call, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+      or
+      // flow out of a callable
+      revFlowOut(_, node, state, _, _, ap, config) and
+      toReturn = true and
+      if returnNodeMayFlowThrough(node, state, ap, config)
+      then returnAp = apSome(ap)
+      else returnAp = apNone()
+    }
+
+    pragma[nomagic]
+    private predicate revFlowStore(
+      Ap ap0, Content c, Ap ap, NodeEx node, FlowState state, TypedContent tc, NodeEx mid,
+      boolean toReturn, ApOption returnAp, Configuration config
+    ) {
+      revFlow(mid, state, toReturn, returnAp, ap0, config) and
+      storeStepFwd(node, ap, tc, mid, ap0, config) and
+      tc.getContent() = c
+    }
+
+    /**
+     * Holds if reverse flow with access path `tail` reaches a read of `c`
+     * resulting in access path `cons`.
+     */
+    pragma[nomagic]
+    private predicate revFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+      exists(NodeEx mid, Ap tail0 |
+        revFlow(mid, _, _, _, tail, config) and
+        tail = pragma[only_bind_into](tail0) and
+        readStepFwd(_, cons, c, mid, tail0, config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowOut(
+      DataFlowCall call, RetNodeEx ret, FlowState state, boolean toReturn, ApOption returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(NodeEx out, boolean allowsFieldFlow |
+        revFlow(out, state, toReturn, returnAp, ap, config) and
+        flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInNotToReturn(
+      ArgNodeEx arg, FlowState state, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlow(p, state, false, returnAp, ap, config) and
+        flowIntoCall(_, arg, p, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, Ap returnAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlow(p, state, true, apSome(returnAp), ap, config) and
+        flowThroughIntoCall(call, arg, p, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    /**
+     * Holds if an output from `call` is reached in the flow covered by `revFlow`
+     * and data might flow through the target callable resulting in reverse flow
+     * reaching an argument of `call`.
+     */
+    pragma[nomagic]
+    private predicate revFlowIsReturned(
+      DataFlowCall call, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      exists(RetNodeEx ret, FlowState state, CcCall ccc |
+        revFlowOut(call, ret, state, toReturn, returnAp, ap, config) and
+        fwdFlow(ret, state, ccc, apSome(_), ap, config) and
+        matchesCall(ccc, call)
+      )
+    }
+
+    pragma[nomagic]
+    predicate storeStepCand(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+      Configuration config
+    ) {
+      exists(Ap ap2, Content c |
+        PrevStage::storeStepCand(node1, _, tc, node2, contentType, config) and
+        revFlowStore(ap2, c, ap1, node1, _, tc, node2, _, _, config) and
+        revFlowConsCand(ap2, c, ap1, config)
+      )
+    }
+
+    predicate readStepCand(NodeEx node1, Content c, NodeEx node2, Configuration config) {
+      exists(Ap ap1, Ap ap2 |
+        revFlow(node2, _, _, _, pragma[only_bind_into](ap2), pragma[only_bind_into](config)) and
+        readStepFwd(node1, ap1, c, node2, ap2, config) and
+        revFlowStore(ap1, c, pragma[only_bind_into](ap2), _, _, _, _, _, _,
+          pragma[only_bind_into](config))
+      )
+    }
+
+    predicate revFlow(NodeEx node, FlowState state, Configuration config) {
+      revFlow(node, state, _, _, _, config)
+    }
+
+    predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config) {
+      revFlow(node, state, _, _, ap, config)
+    }
+
+    pragma[nomagic]
+    predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
+
+    // use an alias as a workaround for bad functionality-induced joins
+    pragma[nomagic]
+    predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
+
+    // use an alias as a workaround for bad functionality-induced joins
+    pragma[nomagic]
+    predicate revFlowAlias(NodeEx node, FlowState state, Ap ap, Configuration config) {
+      revFlow(node, state, ap, config)
+    }
+
+    private predicate fwdConsCand(TypedContent tc, Ap ap, Configuration config) {
+      storeStepFwd(_, ap, tc, _, _, config)
+    }
+
+    private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
+      storeStepCand(_, ap, tc, _, _, config)
+    }
+
+    private predicate validAp(Ap ap, Configuration config) {
+      revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
+      or
+      exists(TypedContent head, Ap tail |
+        consCand(head, tail, config) and
+        ap = apCons(head, tail)
+      )
+    }
+
+    predicate consCand(TypedContent tc, Ap ap, Configuration config) {
+      revConsCand(tc, ap, config) and
+      validAp(ap, config)
+    }
+
+    pragma[noinline]
+    private predicate parameterFlow(
+      ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
+    ) {
+      revFlow(p, _, true, apSome(ap0), ap, config) and
+      c = p.getEnclosingCallable()
+    }
+
+    predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
+      exists(RetNodeEx ret, FlowState state, Ap ap0, ReturnKindExt kind, ParameterPosition pos |
+        parameterFlow(p, ap, ap0, c, config) and
+        c = ret.getEnclosingCallable() and
+        revFlow(pragma[only_bind_into](ret), pragma[only_bind_into](state), true, apSome(_),
+          pragma[only_bind_into](ap0), pragma[only_bind_into](config)) and
+        fwdFlow(ret, state, any(CcCall ccc), apSome(ap), ap0, config) and
+        kind = ret.getKind() and
+        p.getPosition() = pos and
+        // we don't expect a parameter to return stored in itself, unless explicitly allowed
+        (
+          not kind.(ParamUpdateReturnKind).getPosition() = pos
+          or
+          p.allowParameterReturnInSelf()
+        )
+      )
+    }
+
+    pragma[nomagic]
+    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
+      exists(
+        Ap returnAp0, ArgNodeEx arg, FlowState state, boolean toReturn, ApOption returnAp, Ap ap
+      |
+        revFlow(arg, state, toReturn, returnAp, ap, config) and
+        revFlowInToReturn(call, arg, state, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+    }
+
+    predicate stats(
+      boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
+    ) {
+      fwd = true and
+      nodes = count(NodeEx node | fwdFlow(node, _, _, _, _, config)) and
+      fields = count(TypedContent f0 | fwdConsCand(f0, _, config)) and
+      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
+      states = count(FlowState state | fwdFlow(_, state, _, _, _, config)) and
+      tuples =
+        count(NodeEx n, FlowState state, Cc cc, ApOption argAp, Ap ap |
+          fwdFlow(n, state, cc, argAp, ap, config)
+        )
+      or
+      fwd = false and
+      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
+      fields = count(TypedContent f0 | consCand(f0, _, config)) and
+      conscand = count(TypedContent f0, Ap ap | consCand(f0, ap, config)) and
+      states = count(FlowState state | revFlow(_, state, _, _, _, config)) and
+      tuples =
+        count(NodeEx n, FlowState state, boolean b, ApOption retAp, Ap ap |
+          revFlow(n, state, b, retAp, ap, config)
+        )
+    }
+    /* End: Stage logic. */
+  }
+}
+
+private module BooleanCallContext {
+  class Cc extends boolean {
+    Cc() { this in [true, false] }
+  }
+
+  class CcCall extends Cc {
+    CcCall() { this = true }
+  }
+
+  /** Holds if the call context may be `call`. */
+  predicate matchesCall(CcCall cc, DataFlowCall call) { any() }
+
+  class CcNoCall extends Cc {
+    CcNoCall() { this = false }
+  }
+
+  Cc ccNone() { result = false }
+
+  CcCall ccSomeCall() { result = true }
+
+  class LocalCc = Unit;
+
+  bindingset[node, cc]
+  LocalCc getLocalCc(NodeEx node, Cc cc) { any() }
+
+  bindingset[call, c, outercc]
+  CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) { any() }
+
+  bindingset[call, c, innercc]
+  CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) { any() }
+}
+
+private module Level1CallContext {
+  class Cc = CallContext;
+
+  class CcCall = CallContextCall;
+
+  pragma[inline]
+  predicate matchesCall(CcCall cc, DataFlowCall call) { cc.matchesCall(call) }
+
+  class CcNoCall = CallContextNoCall;
+
+  Cc ccNone() { result instanceof CallContextAny }
+
+  CcCall ccSomeCall() { result instanceof CallContextSomeCall }
+
+  module NoLocalCallContext {
+    class LocalCc = Unit;
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc) { any() }
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+      checkCallContextCall(outercc, call, c) and
+      if recordDataFlowCallSiteDispatch(call, c)
+      then result = TSpecificCall(call)
+      else result = TSomeCall()
+    }
+  }
+
+  module LocalCallContext {
+    class LocalCc = LocalCallContext;
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc) {
+      result =
+        getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
+          node.getEnclosingCallable())
+    }
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+      checkCallContextCall(outercc, call, c) and
+      if recordDataFlowCallSite(call, c) then result = TSpecificCall(call) else result = TSomeCall()
+    }
+  }
+
+  bindingset[call, c, innercc]
+  CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) {
+    checkCallContextReturn(innercc, c, call) and
+    if reducedViableImplInReturn(c, call) then result = TReturn(c, call) else result = ccNone()
+  }
+}
+
+private module Stage2Param implements MkStage<Stage1>::StageParam {
+  private module PrevStage = Stage1;
+
+  class Ap extends boolean {
+    Ap() { this in [true, false] }
+  }
+
+  class ApNil extends Ap {
+    ApNil() { this = false }
+  }
+
+  bindingset[result, ap]
+  PrevStage::Ap getApprox(Ap ap) { any() }
+
+  ApNil getApNil(NodeEx node) { Stage1::revFlow(node, _) and exists(result) }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result = true and exists(tc) and exists(tail) }
+
+  pragma[inline]
+  Content getHeadContent(Ap ap) { exists(result) and ap = true }
+
+  class ApOption = BooleanOption;
+
+  ApOption apNone() { result = TBooleanNone() }
+
+  ApOption apSome(Ap ap) { result = TBooleanSome(ap) }
+
+  import Level1CallContext
+  import NoLocalCallContext
+
+  bindingset[node1, state1, config]
+  bindingset[node2, state2, config]
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    (
+      preservesValue = true and
+      localFlowStepNodeCand1(node1, node2, config) and
+      state1 = state2
+      or
+      preservesValue = false and
+      additionalLocalFlowStepNodeCand1(node1, node2, config) and
+      state1 = state2
+      or
+      preservesValue = false and
+      additionalLocalStateStep(node1, state1, node2, state2, config)
+    ) and
+    exists(ap) and
+    exists(lcc)
+  }
+
+  predicate flowOutOfCall = flowOutOfCallNodeCand1/5;
+
+  predicate flowIntoCall = flowIntoCallNodeCand1/5;
+
+  pragma[nomagic]
+  private predicate expectsContentCand(NodeEx node, Configuration config) {
+    exists(Content c |
+      PrevStage::revFlow(node, pragma[only_bind_into](config)) and
+      PrevStage::revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      expectsContentEx(node, c)
+    )
+  }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    PrevStage::revFlowState(state, pragma[only_bind_into](config)) and
+    exists(ap) and
+    not stateBarrier(node, state, config) and
+    (
+      notExpectsContent(node)
+      or
+      ap = true and
+      expectsContentCand(node, config)
+    )
+  }
+
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+}
+
+private module Stage2 implements StageSig {
+  import MkStage<Stage1>::Stage<Stage2Param>
+}
+
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand2(
+  DataFlowCall call, RetNodeEx node1, NodeEx node2, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlowAlias(node1, pragma[only_bind_into](config))
+}
+
+pragma[nomagic]
+private predicate flowIntoCallNodeCand2(
+  DataFlowCall call, ArgNodeEx node1, ParamNodeEx node2, boolean allowsFieldFlow,
+  Configuration config
+) {
+  flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlowAlias(node1, pragma[only_bind_into](config))
+}
+
+private module LocalFlowBigStep {
+  /**
+   * A node where some checking is required, and hence the big-step relation
+   * is not allowed to step over.
+   */
+  private class FlowCheckNode extends NodeEx {
+    FlowCheckNode() {
+      castNode(this.asNode()) or
+      clearsContentCached(this.asNode(), _) or
+      expectsContentCached(this.asNode(), _)
+    }
+  }
+
+  /**
+   * Holds if `node` can be the first node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowEntry(NodeEx node, FlowState state, Configuration config) {
+    Stage2::revFlow(node, state, config) and
+    (
+      sourceNode(node, state, config)
+      or
+      jumpStep(_, node, config)
+      or
+      additionalJumpStep(_, node, config)
+      or
+      additionalJumpStateStep(_, _, node, state, config)
+      or
+      node instanceof ParamNodeEx
+      or
+      node.asNode() instanceof OutNodeExt
+      or
+      Stage2::storeStepCand(_, _, _, node, _, config)
+      or
+      Stage2::readStepCand(_, _, node, config)
+      or
+      node instanceof FlowCheckNode
+      or
+      exists(FlowState s |
+        additionalLocalStateStep(_, s, node, state, config) and
+        s != state
+      )
+    )
+  }
+
+  /**
+   * Holds if `node` can be the last node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowExit(NodeEx node, FlowState state, Configuration config) {
+    exists(NodeEx next | Stage2::revFlow(next, state, config) |
+      jumpStep(node, next, config) or
+      additionalJumpStep(node, next, config) or
+      flowIntoCallNodeCand1(_, node, next, config) or
+      flowOutOfCallNodeCand1(_, node, next, config) or
+      Stage2::storeStepCand(node, _, _, next, _, config) or
+      Stage2::readStepCand(node, _, next, config)
+    )
+    or
+    exists(NodeEx next, FlowState s | Stage2::revFlow(next, s, config) |
+      additionalJumpStateStep(node, state, next, s, config)
+      or
+      additionalLocalStateStep(node, state, next, s, config) and
+      s != state
+    )
+    or
+    Stage2::revFlow(node, state, config) and
+    node instanceof FlowCheckNode
+    or
+    sinkNode(node, state, config)
+  }
+
+  pragma[noinline]
+  private predicate additionalLocalFlowStepNodeCand2(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, Configuration config
+  ) {
+    additionalLocalFlowStepNodeCand1(node1, node2, config) and
+    state1 = state2 and
+    Stage2::revFlow(node1, pragma[only_bind_into](state1), false, pragma[only_bind_into](config)) and
+    Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false,
+      pragma[only_bind_into](config))
+    or
+    additionalLocalStateStep(node1, state1, node2, state2, config) and
+    Stage2::revFlow(node1, state1, false, pragma[only_bind_into](config)) and
+    Stage2::revFlowAlias(node2, state2, false, pragma[only_bind_into](config))
+  }
+
+  /**
+   * Holds if the local path from `node1` to `node2` is a prefix of a maximal
+   * subsequence of local flow steps in a dataflow path.
+   *
+   * This is the transitive closure of `[additional]localFlowStep` beginning
+   * at `localFlowEntry`.
+   */
+  pragma[nomagic]
+  private predicate localFlowStepPlus(
+    NodeEx node1, FlowState state, NodeEx node2, boolean preservesValue, DataFlowType t,
+    Configuration config, LocalCallContext cc
+  ) {
+    not isUnreachableInCallCached(node2.asNode(), cc.(LocalCallContextSpecificCall).getCall()) and
+    (
+      localFlowEntry(node1, pragma[only_bind_into](state), pragma[only_bind_into](config)) and
+      (
+        localFlowStepNodeCand1(node1, node2, config) and
+        preservesValue = true and
+        t = node1.getDataFlowType() and // irrelevant dummy value
+        Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
+        or
+        additionalLocalFlowStepNodeCand2(node1, state, node2, state, config) and
+        preservesValue = false and
+        t = node2.getDataFlowType()
+      ) and
+      node1 != node2 and
+      cc.relevantFor(node1.getEnclosingCallable()) and
+      not isUnreachableInCallCached(node1.asNode(), cc.(LocalCallContextSpecificCall).getCall())
+      or
+      exists(NodeEx mid |
+        localFlowStepPlus(node1, pragma[only_bind_into](state), mid, preservesValue, t,
+          pragma[only_bind_into](config), cc) and
+        localFlowStepNodeCand1(mid, node2, config) and
+        not mid instanceof FlowCheckNode and
+        Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
+      )
+      or
+      exists(NodeEx mid |
+        localFlowStepPlus(node1, state, mid, _, _, pragma[only_bind_into](config), cc) and
+        additionalLocalFlowStepNodeCand2(mid, state, node2, state, config) and
+        not mid instanceof FlowCheckNode and
+        preservesValue = false and
+        t = node2.getDataFlowType()
+      )
+    )
+  }
+
+  /**
+   * Holds if `node1` can step to `node2` in one or more local steps and this
+   * path can occur as a maximal subsequence of local steps in a dataflow path.
+   */
+  pragma[nomagic]
+  predicate localFlowBigStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    AccessPathFrontNil apf, Configuration config, LocalCallContext callContext
+  ) {
+    localFlowStepPlus(node1, state1, node2, preservesValue, apf.getType(), config, callContext) and
+    localFlowExit(node2, state1, config) and
+    state1 = state2
+    or
+    additionalLocalFlowStepNodeCand2(node1, state1, node2, state2, config) and
+    state1 != state2 and
+    preservesValue = false and
+    apf = TFrontNil(node2.getDataFlowType()) and
+    callContext.relevantFor(node1.getEnclosingCallable()) and
+    not exists(DataFlowCall call | call = callContext.(LocalCallContextSpecificCall).getCall() |
+      isUnreachableInCallCached(node1.asNode(), call) or
+      isUnreachableInCallCached(node2.asNode(), call)
+    )
+  }
+}
+
+private import LocalFlowBigStep
+
+private module Stage3Param implements MkStage<Stage2>::StageParam {
+  private module PrevStage = Stage2;
+
+  class Ap = AccessPathFront;
+
+  class ApNil = AccessPathFrontNil;
+
+  PrevStage::Ap getApprox(Ap ap) { result = ap.toBoolNonEmpty() }
+
+  ApNil getApNil(NodeEx node) {
+    PrevStage::revFlow(node, _) and result = TFrontNil(node.getDataFlowType())
+  }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result.getHead() = tc and exists(tail) }
+
+  pragma[noinline]
+  Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathFrontOption;
+
+  ApOption apNone() { result = TAccessPathFrontNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathFrontSome(ap) }
+
+  import BooleanCallContext
+
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, state1, node2, state2, preservesValue, ap, config, _) and exists(lcc)
+  }
+
+  predicate flowOutOfCall = flowOutOfCallNodeCand2/5;
+
+  predicate flowIntoCall = flowIntoCallNodeCand2/5;
+
+  pragma[nomagic]
+  private predicate clearSet(NodeEx node, ContentSet c, Configuration config) {
+    PrevStage::revFlow(node, config) and
+    clearsContentCached(node.asNode(), c)
+  }
+
+  pragma[nomagic]
+  private predicate clearContent(NodeEx node, Content c, Configuration config) {
+    exists(ContentSet cs |
+      PrevStage::readStepCand(_, pragma[only_bind_into](c), _, pragma[only_bind_into](config)) and
+      c = cs.getAReadContent() and
+      clearSet(node, cs, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate clear(NodeEx node, Ap ap, Configuration config) {
+    clearContent(node, ap.getHead().getContent(), config)
+  }
+
+  pragma[nomagic]
+  private predicate expectsContentCand(NodeEx node, Ap ap, Configuration config) {
+    exists(Content c |
+      PrevStage::revFlow(node, pragma[only_bind_into](config)) and
+      PrevStage::readStepCand(_, c, _, pragma[only_bind_into](config)) and
+      expectsContentEx(node, c) and
+      c = ap.getHead().getContent()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate castingNodeEx(NodeEx node) { node.asNode() instanceof CastingNode }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    exists(state) and
+    exists(config) and
+    not clear(node, ap, config) and
+    (if castingNodeEx(node) then compatibleTypes(node.getDataFlowType(), ap.getType()) else any()) and
+    (
+      notExpectsContent(node)
+      or
+      expectsContentCand(node, ap, config)
+    )
+  }
+
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) {
+    // We need to typecheck stores here, since reverse flow through a getter
+    // might have a different type here compared to inside the getter.
+    compatibleTypes(ap.getType(), contentType)
+  }
+}
+
+private module Stage3 implements StageSig {
+  import MkStage<Stage2>::Stage<Stage3Param>
+}
+
+/**
+ * Holds if `argApf` is recorded as the summary context for flow reaching `node`
+ * and remains relevant for the following pruning stage.
+ */
+private predicate flowCandSummaryCtx(
+  NodeEx node, FlowState state, AccessPathFront argApf, Configuration config
+) {
+  exists(AccessPathFront apf |
+    Stage3::revFlow(node, state, true, _, apf, config) and
+    Stage3::fwdFlow(node, state, any(Stage3::CcCall ccc), TAccessPathFrontSome(argApf), apf, config)
+  )
+}
+
+/**
+ * Holds if a length 2 access path approximation with the head `tc` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen2unfolding(TypedContent tc, Configuration config) {
+  exists(int tails, int nodes, int apLimit, int tupleLimit |
+    tails = strictcount(AccessPathFront apf | Stage3::consCand(tc, apf, config)) and
+    nodes =
+      strictcount(NodeEx n, FlowState state |
+        Stage3::revFlow(n, state, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+        or
+        flowCandSummaryCtx(n, state, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+      ) and
+    accessPathApproxCostLimits(apLimit, tupleLimit) and
+    apLimit < tails and
+    tupleLimit < (tails - 1) * nodes and
+    not tc.forceHighPrecision()
+  )
+}
+
+private newtype TAccessPathApprox =
+  TNil(DataFlowType t) or
+  TConsNil(TypedContent tc, DataFlowType t) {
+    Stage3::consCand(tc, TFrontNil(t), _) and
+    not expensiveLen2unfolding(tc, _)
+  } or
+  TConsCons(TypedContent tc1, TypedContent tc2, int len) {
+    Stage3::consCand(tc1, TFrontHead(tc2), _) and
+    len in [2 .. accessPathLimit()] and
+    not expensiveLen2unfolding(tc1, _)
+  } or
+  TCons1(TypedContent tc, int len) {
+    len in [1 .. accessPathLimit()] and
+    expensiveLen2unfolding(tc, _)
+  }
+
+/**
+ * Conceptually a list of `TypedContent`s followed by a `DataFlowType`, but only
+ * the first two elements of the list and its length are tracked. If data flows
+ * from a source to a given node with a given `AccessPathApprox`, this indicates
+ * the sequence of dereference operations needed to get from the value in the node
+ * to the tracked object. The final type indicates the type of the tracked object.
+ */
+abstract private class AccessPathApprox extends TAccessPathApprox {
+  abstract string toString();
+
+  abstract TypedContent getHead();
+
+  abstract int len();
+
+  abstract DataFlowType getType();
+
+  abstract AccessPathFront getFront();
+
+  /** Gets the access path obtained by popping `head` from this path, if any. */
+  abstract AccessPathApprox pop(TypedContent head);
+}
+
+private class AccessPathApproxNil extends AccessPathApprox, TNil {
+  private DataFlowType t;
+
+  AccessPathApproxNil() { this = TNil(t) }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+
+  override TypedContent getHead() { none() }
+
+  override int len() { result = 0 }
+
+  override DataFlowType getType() { result = t }
+
+  override AccessPathFront getFront() { result = TFrontNil(t) }
+
+  override AccessPathApprox pop(TypedContent head) { none() }
+}
+
+abstract private class AccessPathApproxCons extends AccessPathApprox { }
+
+private class AccessPathApproxConsNil extends AccessPathApproxCons, TConsNil {
+  private TypedContent tc;
+  private DataFlowType t;
+
+  AccessPathApproxConsNil() { this = TConsNil(tc, t) }
+
+  override string toString() {
+    // The `concat` becomes "" if `ppReprType` has no result.
+    result = "[" + tc.toString() + "]" + concat(" : " + ppReprType(t))
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = 1 }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) { head = tc and result = TNil(t) }
+}
+
+private class AccessPathApproxConsCons extends AccessPathApproxCons, TConsCons {
+  private TypedContent tc1;
+  private TypedContent tc2;
+  private int len;
+
+  AccessPathApproxConsCons() { this = TConsCons(tc1, tc2, len) }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + tc1.toString() + ", " + tc2.toString() + "]"
+    else result = "[" + tc1.toString() + ", " + tc2.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc1 }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc1.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc1) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc1 and
+    (
+      result = TConsCons(tc2, _, len - 1)
+      or
+      len = 2 and
+      result = TConsNil(tc2, _)
+      or
+      result = TCons1(tc2, len - 1)
+    )
+  }
+}
+
+private class AccessPathApproxCons1 extends AccessPathApproxCons, TCons1 {
+  private TypedContent tc;
+  private int len;
+
+  AccessPathApproxCons1() { this = TCons1(tc, len) }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + tc.toString() + "]"
+    else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc and
+    (
+      exists(TypedContent tc2 | Stage3::consCand(tc, TFrontHead(tc2), _) |
+        result = TConsCons(tc2, _, len - 1)
+        or
+        len = 2 and
+        result = TConsNil(tc2, _)
+        or
+        result = TCons1(tc2, len - 1)
+      )
+      or
+      exists(DataFlowType t |
+        len = 1 and
+        Stage3::consCand(tc, TFrontNil(t), _) and
+        result = TNil(t)
+      )
+    )
+  }
+}
+
+/** Gets the access path obtained by popping `tc` from `ap`, if any. */
+private AccessPathApprox pop(TypedContent tc, AccessPathApprox apa) { result = apa.pop(tc) }
+
+/** Gets the access path obtained by pushing `tc` onto `ap`. */
+private AccessPathApprox push(TypedContent tc, AccessPathApprox apa) { apa = pop(tc, result) }
+
+private newtype TAccessPathApproxOption =
+  TAccessPathApproxNone() or
+  TAccessPathApproxSome(AccessPathApprox apa)
+
+private class AccessPathApproxOption extends TAccessPathApproxOption {
+  string toString() {
+    this = TAccessPathApproxNone() and result = "<none>"
+    or
+    this = TAccessPathApproxSome(any(AccessPathApprox apa | result = apa.toString()))
+  }
+}
+
+private module Stage4Param implements MkStage<Stage3>::StageParam {
+  private module PrevStage = Stage3;
+
+  class Ap = AccessPathApprox;
+
+  class ApNil = AccessPathApproxNil;
+
+  PrevStage::Ap getApprox(Ap ap) { result = ap.getFront() }
+
+  ApNil getApNil(NodeEx node) {
+    PrevStage::revFlow(node, _) and result = TNil(node.getDataFlowType())
+  }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result = push(tc, tail) }
+
+  pragma[noinline]
+  Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathApproxOption;
+
+  ApOption apNone() { result = TAccessPathApproxNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathApproxSome(ap) }
+
+  import Level1CallContext
+  import LocalCallContext
+
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getFront(), config, lcc)
+  }
+
+  pragma[nomagic]
+  predicate flowOutOfCall(
+    DataFlowCall call, RetNodeEx node1, NodeEx node2, boolean allowsFieldFlow, Configuration config
+  ) {
+    exists(FlowState state |
+      flowOutOfCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+      PrevStage::revFlow(node2, pragma[only_bind_into](state), _, pragma[only_bind_into](config)) and
+      PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  predicate flowIntoCall(
+    DataFlowCall call, ArgNodeEx node1, ParamNodeEx node2, boolean allowsFieldFlow,
+    Configuration config
+  ) {
+    exists(FlowState state |
+      flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+      PrevStage::revFlow(node2, pragma[only_bind_into](state), _, pragma[only_bind_into](config)) and
+      PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) { any() }
+
+  // Type checking is not necessary here as it has already been done in stage 3.
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+}
+
+private module Stage4 = MkStage<Stage3>::Stage<Stage4Param>;
+
+bindingset[conf, result]
+private Configuration unbindConf(Configuration conf) {
+  exists(Configuration c | result = pragma[only_bind_into](c) and conf = pragma[only_bind_into](c))
+}
+
+pragma[nomagic]
+private predicate nodeMayUseSummary0(
+  NodeEx n, DataFlowCallable c, FlowState state, AccessPathApprox apa, Configuration config
+) {
+  exists(AccessPathApprox apa0 |
+    Stage4::parameterMayFlowThrough(_, c, _, _) and
+    Stage4::revFlow(n, state, true, _, apa0, config) and
+    Stage4::fwdFlow(n, state, any(CallContextCall ccc), TAccessPathApproxSome(apa), apa0, config) and
+    n.getEnclosingCallable() = c
+  )
+}
+
+pragma[nomagic]
+private predicate nodeMayUseSummary(
+  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
+) {
+  exists(DataFlowCallable c |
+    Stage4::parameterMayFlowThrough(_, c, apa, config) and
+    nodeMayUseSummary0(n, c, state, apa, config)
+  )
+}
+
+private newtype TSummaryCtx =
+  TSummaryCtxNone() or
+  TSummaryCtxSome(ParamNodeEx p, FlowState state, AccessPath ap) {
+    exists(Configuration config |
+      Stage4::parameterMayFlowThrough(p, _, ap.getApprox(), config) and
+      Stage4::revFlow(p, state, _, config)
+    )
+  }
+
+/**
+ * A context for generating flow summaries. This represents flow entry through
+ * a specific parameter with an access path of a specific shape.
+ *
+ * Summaries are only created for parameters that may flow through.
+ */
+abstract private class SummaryCtx extends TSummaryCtx {
+  abstract string toString();
+}
+
+/** A summary context from which no flow summary can be generated. */
+private class SummaryCtxNone extends SummaryCtx, TSummaryCtxNone {
+  override string toString() { result = "<none>" }
+}
+
+/** A summary context from which a flow summary can be generated. */
+private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
+  private ParamNodeEx p;
+  private FlowState s;
+  private AccessPath ap;
+
+  SummaryCtxSome() { this = TSummaryCtxSome(p, s, ap) }
+
+  ParameterPosition getParameterPos() { p.isParameterOf(_, result) }
+
+  ParamNodeEx getParamNode() { result = p }
+
+  override string toString() { result = p + ": " + ap }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    p.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/**
+ * Gets the number of length 2 access path approximations that correspond to `apa`.
+ */
+private int count1to2unfold(AccessPathApproxCons1 apa, Configuration config) {
+  exists(TypedContent tc, int len |
+    tc = apa.getHead() and
+    len = apa.len() and
+    result =
+      strictcount(AccessPathFront apf |
+        Stage4::consCand(tc, any(AccessPathApprox ap | ap.getFront() = apf and ap.len() = len - 1),
+          config)
+      )
+  )
+}
+
+private int countNodesUsingAccessPath(AccessPathApprox apa, Configuration config) {
+  result =
+    strictcount(NodeEx n, FlowState state |
+      Stage4::revFlow(n, state, apa, config) or nodeMayUseSummary(n, state, apa, config)
+    )
+}
+
+/**
+ * Holds if a length 2 access path approximation matching `apa` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen1to2unfolding(AccessPathApproxCons1 apa, Configuration config) {
+  exists(int aps, int nodes, int apLimit, int tupleLimit |
+    aps = count1to2unfold(apa, config) and
+    nodes = countNodesUsingAccessPath(apa, config) and
+    accessPathCostLimits(apLimit, tupleLimit) and
+    apLimit < aps and
+    tupleLimit < (aps - 1) * nodes
+  )
+}
+
+private AccessPathApprox getATail(AccessPathApprox apa, Configuration config) {
+  exists(TypedContent head |
+    apa.pop(head) = result and
+    Stage4::consCand(head, result, config)
+  )
+}
+
+/**
+ * Holds with `unfold = false` if a precise head-tail representation of `apa` is
+ * expected to be expensive. Holds with `unfold = true` otherwise.
+ */
+private predicate evalUnfold(AccessPathApprox apa, boolean unfold, Configuration config) {
+  if apa.getHead().forceHighPrecision()
+  then unfold = true
+  else
+    exists(int aps, int nodes, int apLimit, int tupleLimit |
+      aps = countPotentialAps(apa, config) and
+      nodes = countNodesUsingAccessPath(apa, config) and
+      accessPathCostLimits(apLimit, tupleLimit) and
+      if apLimit < aps and tupleLimit < (aps - 1) * nodes then unfold = false else unfold = true
+    )
+}
+
+/**
+ * Gets the number of `AccessPath`s that correspond to `apa`.
+ */
+private int countAps(AccessPathApprox apa, Configuration config) {
+  evalUnfold(apa, false, config) and
+  result = 1 and
+  (not apa instanceof AccessPathApproxCons1 or expensiveLen1to2unfolding(apa, config))
+  or
+  evalUnfold(apa, false, config) and
+  result = count1to2unfold(apa, config) and
+  not expensiveLen1to2unfolding(apa, config)
+  or
+  evalUnfold(apa, true, config) and
+  result = countPotentialAps(apa, config)
+}
+
+/**
+ * Gets the number of `AccessPath`s that would correspond to `apa` assuming
+ * that it is expanded to a precise head-tail representation.
+ */
+language[monotonicAggregates]
+private int countPotentialAps(AccessPathApprox apa, Configuration config) {
+  apa instanceof AccessPathApproxNil and result = 1
+  or
+  result = strictsum(AccessPathApprox tail | tail = getATail(apa, config) | countAps(tail, config))
+}
+
+private newtype TAccessPath =
+  TAccessPathNil(DataFlowType t) or
+  TAccessPathCons(TypedContent head, AccessPath tail) {
+    exists(AccessPathApproxCons apa |
+      not evalUnfold(apa, false, _) and
+      head = apa.getHead() and
+      tail.getApprox() = getATail(apa, _)
+    )
+  } or
+  TAccessPathCons2(TypedContent head1, TypedContent head2, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      not expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head1 = apa.getHead() and
+      head2 = getATail(apa, _).getHead()
+    )
+  } or
+  TAccessPathCons1(TypedContent head, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head = apa.getHead()
+    )
+  }
+
+private newtype TPathNode =
+  TPathNodeMid(
+    NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap, Configuration config
+  ) {
+    // A PathNode is introduced by a source ...
+    Stage4::revFlow(node, state, config) and
+    sourceNode(node, state, config) and
+    (
+      if hasSourceCallCtx(config)
+      then cc instanceof CallContextSomeCall
+      else cc instanceof CallContextAny
+    ) and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(node.getDataFlowType())
+    or
+    // ... or a step from an existing PathNode to another node.
+    exists(PathNodeMid mid |
+      pathStep(mid, node, state, cc, sc, ap) and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      Stage4::revFlow(node, state, ap.getApprox(), pragma[only_bind_into](config))
+    )
+  } or
+  TPathNodeSink(NodeEx node, FlowState state, Configuration config) {
+    exists(PathNodeMid sink |
+      sink.isAtSink() and
+      node = sink.getNodeEx() and
+      state = sink.getState() and
+      config = sink.getConfiguration()
+    )
+  }
+
+/**
+ * A list of `TypedContent`s followed by a `DataFlowType`. If data flows from a
+ * source to a given node with a given `AccessPath`, this indicates the sequence
+ * of dereference operations needed to get from the value in the node to the
+ * tracked object. The final type indicates the type of the tracked object.
+ */
+private class AccessPath extends TAccessPath {
+  /** Gets the head of this access path, if any. */
+  abstract TypedContent getHead();
+
+  /** Gets the tail of this access path, if any. */
+  abstract AccessPath getTail();
+
+  /** Gets the front of this access path. */
+  abstract AccessPathFront getFront();
+
+  /** Gets the approximation of this access path. */
+  abstract AccessPathApprox getApprox();
+
+  /** Gets the length of this access path. */
+  abstract int length();
+
+  /** Gets a textual representation of this access path. */
+  abstract string toString();
+
+  /** Gets the access path obtained by popping `tc` from this access path, if any. */
+  final AccessPath pop(TypedContent tc) {
+    result = this.getTail() and
+    tc = this.getHead()
+  }
+
+  /** Gets the access path obtained by pushing `tc` onto this access path. */
+  final AccessPath push(TypedContent tc) { this = result.pop(tc) }
+}
+
+private class AccessPathNil extends AccessPath, TAccessPathNil {
+  private DataFlowType t;
+
+  AccessPathNil() { this = TAccessPathNil(t) }
+
+  DataFlowType getType() { result = t }
+
+  override TypedContent getHead() { none() }
+
+  override AccessPath getTail() { none() }
+
+  override AccessPathFrontNil getFront() { result = TFrontNil(t) }
+
+  override AccessPathApproxNil getApprox() { result = TNil(t) }
+
+  override int length() { result = 0 }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+}
+
+private class AccessPathCons extends AccessPath, TAccessPathCons {
+  private TypedContent head;
+  private AccessPath tail;
+
+  AccessPathCons() { this = TAccessPathCons(head, tail) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() { result = tail }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsNil(head, tail.(AccessPathNil).getType())
+    or
+    result = TConsCons(head, tail.getHead(), this.length())
+    or
+    result = TCons1(head, this.length())
+  }
+
+  override int length() { result = 1 + tail.length() }
+
+  private string toStringImpl(boolean needsSuffix) {
+    exists(DataFlowType t |
+      tail = TAccessPathNil(t) and
+      needsSuffix = false and
+      result = head.toString() + "]" + concat(" : " + ppReprType(t))
+    )
+    or
+    result = head + ", " + tail.(AccessPathCons).toStringImpl(needsSuffix)
+    or
+    exists(TypedContent tc2, TypedContent tc3, int len | tail = TAccessPathCons2(tc2, tc3, len) |
+      result = head + ", " + tc2 + ", " + tc3 + ", ... (" and len > 2 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + ", " + tc3 + "]" and len = 2 and needsSuffix = false
+    )
+    or
+    exists(TypedContent tc2, int len | tail = TAccessPathCons1(tc2, len) |
+      result = head + ", " + tc2 + ", ... (" and len > 1 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + "]" and len = 1 and needsSuffix = false
+    )
+  }
+
+  override string toString() {
+    result = "[" + this.toStringImpl(true) + this.length().toString() + ")]"
+    or
+    result = "[" + this.toStringImpl(false)
+  }
+}
+
+private class AccessPathCons2 extends AccessPath, TAccessPathCons2 {
+  private TypedContent head1;
+  private TypedContent head2;
+  private int len;
+
+  AccessPathCons2() { this = TAccessPathCons2(head1, head2, len) }
+
+  override TypedContent getHead() { result = head1 }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head1, result.getApprox(), _) and
+    result.getHead() = head2 and
+    result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head1) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsCons(head1, head2, len) or
+    result = TCons1(head1, len)
+  }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + head1.toString() + ", " + head2.toString() + "]"
+    else
+      result = "[" + head1.toString() + ", " + head2.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+private class AccessPathCons1 extends AccessPath, TAccessPathCons1 {
+  private TypedContent head;
+  private int len;
+
+  AccessPathCons1() { this = TAccessPathCons1(head, len) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head, result.getApprox(), _) and result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() { result = TCons1(head, len) }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + head.toString() + "]"
+    else result = "[" + head.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+/**
+ * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
+ * Only those `PathNode`s that are reachable from a source are generated.
+ */
+class PathNode extends TPathNode {
+  /** Gets a textual representation of this element. */
+  string toString() { none() }
+
+  /**
+   * Gets a textual representation of this element, including a textual
+   * representation of the call context.
+   */
+  string toStringWithContext() { none() }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    none()
+  }
+
+  /** Gets the underlying `Node`. */
+  final Node getNode() { this.(PathNodeImpl).getNodeEx().projectToNode() = result }
+
+  /** Gets the `FlowState` of this node. */
+  FlowState getState() { none() }
+
+  /** Gets the associated configuration. */
+  Configuration getConfiguration() { none() }
+
+  /** Gets a successor of this node, if any. */
+  final PathNode getASuccessor() {
+    result = this.(PathNodeImpl).getANonHiddenSuccessor() and
+    reach(this) and
+    reach(result)
+  }
+
+  /** Holds if this node is a source. */
+  predicate isSource() { none() }
+}
+
+abstract private class PathNodeImpl extends PathNode {
+  abstract PathNodeImpl getASuccessorImpl();
+
+  private PathNodeImpl getASuccessorIfHidden() {
+    this.isHidden() and
+    result = this.getASuccessorImpl()
+  }
+
+  final PathNodeImpl getANonHiddenSuccessor() {
+    result = this.getASuccessorImpl().getASuccessorIfHidden*() and
+    not this.isHidden() and
+    not result.isHidden()
+  }
+
+  abstract NodeEx getNodeEx();
+
+  predicate isHidden() {
+    not this.getConfiguration().includeHiddenNodes() and
+    (
+      hiddenNode(this.getNodeEx().asNode()) and
+      not this.isSource() and
+      not this instanceof PathNodeSink
+      or
+      this.getNodeEx() instanceof TNodeImplicitRead
+    )
+  }
+
+  private string ppAp() {
+    this instanceof PathNodeSink and result = ""
+    or
+    exists(string s | s = this.(PathNodeMid).getAp().toString() |
+      if s = "" then result = "" else result = " " + s
+    )
+  }
+
+  private string ppCtx() {
+    this instanceof PathNodeSink and result = ""
+    or
+    result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
+  }
+
+  override string toString() { result = this.getNodeEx().toString() + this.ppAp() }
+
+  override string toStringWithContext() {
+    result = this.getNodeEx().toString() + this.ppAp() + this.ppCtx()
+  }
+
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/** Holds if `n` can reach a sink. */
+private predicate directReach(PathNodeImpl n) {
+  n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
+}
+
+/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
+private predicate reach(PathNode n) { directReach(n) or Subpaths::retReach(n) }
+
+/** Holds if `n1.getASuccessor() = n2` and `n2` can reach a sink. */
+private predicate pathSucc(PathNodeImpl n1, PathNode n2) {
+  n1.getANonHiddenSuccessor() = n2 and directReach(n2)
+}
+
+private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
+
+/**
+ * Provides the query predicates needed to include a graph in a path-problem query.
+ */
+module PathGraph {
+  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+  query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }
+
+  /** Holds if `n` is a node in the graph of data flow path explanations. */
+  query predicate nodes(PathNode n, string key, string val) {
+    reach(n) and key = "semmle.label" and val = n.toString()
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {
+    Subpaths::subpaths(arg, par, ret, out) and
+    reach(arg) and
+    reach(par) and
+    reach(ret) and
+    reach(out)
+  }
+}
+
+/**
+ * An intermediate flow graph node. This is a triple consisting of a `Node`,
+ * a `CallContext`, and a `Configuration`.
+ */
+private class PathNodeMid extends PathNodeImpl, TPathNodeMid {
+  NodeEx node;
+  FlowState state;
+  CallContext cc;
+  SummaryCtx sc;
+  AccessPath ap;
+  Configuration config;
+
+  PathNodeMid() { this = TPathNodeMid(node, state, cc, sc, ap, config) }
+
+  override NodeEx getNodeEx() { result = node }
+
+  override FlowState getState() { result = state }
+
+  CallContext getCallContext() { result = cc }
+
+  SummaryCtx getSummaryCtx() { result = sc }
+
+  AccessPath getAp() { result = ap }
+
+  override Configuration getConfiguration() { result = config }
+
+  private PathNodeMid getSuccMid() {
+    pathStep(this, result.getNodeEx(), result.getState(), result.getCallContext(),
+      result.getSummaryCtx(), result.getAp()) and
+    result.getConfiguration() = unbindConf(this.getConfiguration())
+  }
+
+  override PathNodeImpl getASuccessorImpl() {
+    // an intermediate step to another intermediate node
+    result = this.getSuccMid()
+    or
+    // a final step to a sink
+    result = this.getSuccMid().projectToSink()
+  }
+
+  override predicate isSource() {
+    sourceNode(node, state, config) and
+    (
+      if hasSourceCallCtx(config)
+      then cc instanceof CallContextSomeCall
+      else cc instanceof CallContextAny
+    ) and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(node.getDataFlowType())
+  }
+
+  predicate isAtSink() {
+    sinkNode(node, state, config) and
+    ap instanceof AccessPathNil and
+    if hasSinkCallCtx(config)
+    then
+      // For `FeatureHasSinkCallContext` the condition `cc instanceof CallContextNoCall`
+      // is exactly what we need to check. This also implies
+      // `sc instanceof SummaryCtxNone`.
+      // For `FeatureEqualSourceSinkCallContext` the initial call context was
+      // set to `CallContextSomeCall` and jumps are disallowed, so
+      // `cc instanceof CallContextNoCall` never holds. On the other hand,
+      // in this case there's never any need to enter a call except to identify
+      // a summary, so the condition in `pathIntoCallable` enforces this, which
+      // means that `sc instanceof SummaryCtxNone` holds if and only if we are
+      // in the call context of the source.
+      sc instanceof SummaryCtxNone or
+      cc instanceof CallContextNoCall
+    else any()
+  }
+
+  PathNodeSink projectToSink() {
+    this.isAtSink() and
+    result.getNodeEx() = node and
+    result.getState() = state and
+    result.getConfiguration() = unbindConf(config)
+  }
+}
+
+/**
+ * A flow graph node corresponding to a sink. This is disjoint from the
+ * intermediate nodes in order to uniquely correspond to a given sink by
+ * excluding the `CallContext`.
+ */
+private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
+  NodeEx node;
+  FlowState state;
+  Configuration config;
+
+  PathNodeSink() { this = TPathNodeSink(node, state, config) }
+
+  override NodeEx getNodeEx() { result = node }
+
+  override FlowState getState() { result = state }
+
+  override Configuration getConfiguration() { result = config }
+
+  override PathNodeImpl getASuccessorImpl() { none() }
+
+  override predicate isSource() { sourceNode(node, state, config) }
+}
+
+private predicate pathNode(
+  PathNodeMid mid, NodeEx midnode, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap,
+  Configuration conf, LocalCallContext localCC
+) {
+  midnode = mid.getNodeEx() and
+  state = mid.getState() and
+  conf = mid.getConfiguration() and
+  cc = mid.getCallContext() and
+  sc = mid.getSummaryCtx() and
+  localCC =
+    getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
+      midnode.getEnclosingCallable()) and
+  ap = mid.getAp()
+}
+
+/**
+ * Holds if data may flow from `mid` to `node`. The last step in or out of
+ * a callable is recorded by `cc`.
+ */
+pragma[nomagic]
+private predicate pathStep(
+  PathNodeMid mid, NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap
+) {
+  exists(NodeEx midnode, FlowState state0, Configuration conf, LocalCallContext localCC |
+    pathNode(mid, midnode, state0, cc, sc, ap, conf, localCC) and
+    localFlowBigStep(midnode, state0, node, state, true, _, conf, localCC)
+  )
+  or
+  exists(
+    AccessPath ap0, NodeEx midnode, FlowState state0, Configuration conf, LocalCallContext localCC
+  |
+    pathNode(mid, midnode, state0, cc, sc, ap0, conf, localCC) and
+    localFlowBigStep(midnode, state0, node, state, false, ap.getFront(), conf, localCC) and
+    ap0 instanceof AccessPathNil
+  )
+  or
+  jumpStep(mid.getNodeEx(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  ap = mid.getAp()
+  or
+  additionalJumpStep(mid.getNodeEx(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(node.getDataFlowType())
+  or
+  additionalJumpStateStep(mid.getNodeEx(), mid.getState(), node, state, mid.getConfiguration()) and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(node.getDataFlowType())
+  or
+  exists(TypedContent tc | pathStoreStep(mid, node, state, ap.pop(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  exists(TypedContent tc | pathReadStep(mid, node, state, ap.push(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  pathIntoCallable(mid, node, state, _, cc, sc, _, _) and ap = mid.getAp()
+  or
+  pathOutOfCallable(mid, node, state, cc) and ap = mid.getAp() and sc instanceof SummaryCtxNone
+  or
+  pathThroughCallable(mid, node, state, cc, ap) and sc = mid.getSummaryCtx()
+}
+
+pragma[nomagic]
+private predicate pathReadStep(
+  PathNodeMid mid, NodeEx node, FlowState state, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  tc = ap0.getHead() and
+  Stage4::readStepCand(mid.getNodeEx(), tc.getContent(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc = mid.getCallContext()
+}
+
+pragma[nomagic]
+private predicate pathStoreStep(
+  PathNodeMid mid, NodeEx node, FlowState state, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  Stage4::storeStepCand(mid.getNodeEx(), _, tc, node, _, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc = mid.getCallContext()
+}
+
+private predicate pathOutOfCallable0(
+  PathNodeMid mid, ReturnPosition pos, FlowState state, CallContext innercc, AccessPathApprox apa,
+  Configuration config
+) {
+  pos = mid.getNodeEx().(RetNodeEx).getReturnPosition() and
+  state = mid.getState() and
+  innercc = mid.getCallContext() and
+  innercc instanceof CallContextNoCall and
+  apa = mid.getAp().getApprox() and
+  config = mid.getConfiguration()
+}
+
+pragma[nomagic]
+private predicate pathOutOfCallable1(
+  PathNodeMid mid, DataFlowCall call, ReturnKindExt kind, FlowState state, CallContext cc,
+  AccessPathApprox apa, Configuration config
+) {
+  exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+    pathOutOfCallable0(mid, pos, state, innercc, apa, config) and
+    c = pos.getCallable() and
+    kind = pos.getKind() and
+    resolveReturn(innercc, c, call)
+  |
+    if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+  )
+}
+
+pragma[noinline]
+private NodeEx getAnOutNodeFlow(
+  ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config
+) {
+  result.asNode() = kind.getAnOutNode(call) and
+  Stage4::revFlow(result, _, apa, config)
+}
+
+/**
+ * Holds if data may flow from `mid` to `out`. The last step of this path
+ * is a return from a callable and is recorded by `cc`, if needed.
+ */
+pragma[noinline]
+private predicate pathOutOfCallable(PathNodeMid mid, NodeEx out, FlowState state, CallContext cc) {
+  exists(ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config |
+    pathOutOfCallable1(mid, call, kind, state, cc, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
+ */
+pragma[noinline]
+private predicate pathIntoArg(
+  PathNodeMid mid, ParameterPosition ppos, FlowState state, CallContext cc, DataFlowCall call,
+  AccessPath ap, AccessPathApprox apa, Configuration config
+) {
+  exists(ArgNodeEx arg, ArgumentPosition apos |
+    pathNode(mid, arg, state, cc, _, ap, config, _) and
+    arg.asNode().(ArgNode).argumentOf(call, apos) and
+    apa = ap.getApprox() and
+    parameterMatch(ppos, apos)
+  )
+}
+
+pragma[nomagic]
+private predicate parameterCand(
+  DataFlowCallable callable, ParameterPosition pos, AccessPathApprox apa, Configuration config
+) {
+  exists(ParamNodeEx p |
+    Stage4::revFlow(p, _, apa, config) and
+    p.isParameterOf(callable, pos)
+  )
+}
+
+pragma[nomagic]
+private predicate pathIntoCallable0(
+  PathNodeMid mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+  CallContext outercc, DataFlowCall call, AccessPath ap, Configuration config
+) {
+  exists(AccessPathApprox apa |
+    pathIntoArg(mid, pragma[only_bind_into](pos), state, outercc, call, ap,
+      pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+    callable = resolveCall(call, outercc) and
+    parameterCand(callable, pragma[only_bind_into](pos), pragma[only_bind_into](apa),
+      pragma[only_bind_into](config))
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to `p` through `call`. The contexts
+ * before and after entering the callable are `outercc` and `innercc`,
+ * respectively.
+ */
+pragma[nomagic]
+private predicate pathIntoCallable(
+  PathNodeMid mid, ParamNodeEx p, FlowState state, CallContext outercc, CallContextCall innercc,
+  SummaryCtx sc, DataFlowCall call, Configuration config
+) {
+  exists(ParameterPosition pos, DataFlowCallable callable, AccessPath ap |
+    pathIntoCallable0(mid, callable, pos, state, outercc, call, ap, config) and
+    p.isParameterOf(callable, pos) and
+    (
+      sc = TSummaryCtxSome(p, state, ap)
+      or
+      not exists(TSummaryCtxSome(p, state, ap)) and
+      sc = TSummaryCtxNone() and
+      // When the call contexts of source and sink needs to match then there's
+      // never any reason to enter a callable except to find a summary. See also
+      // the comment in `PathNodeMid::isAtSink`.
+      not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+    )
+  |
+    if recordDataFlowCallSite(call, callable)
+    then innercc = TSpecificCall(call)
+    else innercc = TSomeCall()
+  )
+}
+
+/** Holds if data may flow from a parameter given by `sc` to a return of kind `kind`. */
+pragma[nomagic]
+private predicate paramFlowsThrough(
+  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
+  AccessPathApprox apa, Configuration config
+) {
+  exists(PathNodeMid mid, RetNodeEx ret, ParameterPosition pos |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    kind = ret.getKind() and
+    apa = ap.getApprox() and
+    pos = sc.getParameterPos() and
+    // we don't expect a parameter to return stored in itself, unless explicitly allowed
+    (
+      not kind.(ParamUpdateReturnKind).getPosition() = pos
+      or
+      sc.getParamNode().allowParameterReturnInSelf()
+    )
+  )
+}
+
+pragma[nomagic]
+private predicate pathThroughCallable0(
+  DataFlowCall call, PathNodeMid mid, ReturnKindExt kind, FlowState state, CallContext cc,
+  AccessPath ap, AccessPathApprox apa, Configuration config
+) {
+  exists(CallContext innercc, SummaryCtx sc |
+    pathIntoCallable(mid, _, _, cc, innercc, sc, call, config) and
+    paramFlowsThrough(kind, state, innercc, sc, ap, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` through a callable to the node `out`.
+ * The context `cc` is restored to its value prior to entering the callable.
+ */
+pragma[noinline]
+private predicate pathThroughCallable(
+  PathNodeMid mid, NodeEx out, FlowState state, CallContext cc, AccessPath ap
+) {
+  exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa, Configuration config |
+    pathThroughCallable0(call, mid, kind, state, cc, ap, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+private module Subpaths {
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple and `ret` is determined by
+   * `kind`, `sc`, `apout`, and `innercc`.
+   */
+  pragma[nomagic]
+  private predicate subpaths01(
+    PathNodeImpl arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
+    NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    exists(Configuration config |
+      pathThroughCallable(arg, out, pragma[only_bind_into](sout), _, pragma[only_bind_into](apout)) and
+      pathIntoCallable(arg, par, _, _, innercc, sc, _, config) and
+      paramFlowsThrough(kind, pragma[only_bind_into](sout), innercc, sc,
+        pragma[only_bind_into](apout), _, unbindConf(config)) and
+      not arg.isHidden()
+    )
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple and `ret` is determined by
+   * `kind`, `sc`, `sout`, `apout`, and `innercc`.
+   */
+  pragma[nomagic]
+  private predicate subpaths02(
+    PathNode arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
+    NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    subpaths01(arg, par, sc, innercc, kind, out, sout, apout) and
+    out.asNode() = kind.getAnOutNode(_)
+  }
+
+  pragma[nomagic]
+  private Configuration getPathNodeConf(PathNode n) { result = n.getConfiguration() }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple.
+   */
+  pragma[nomagic]
+  private predicate subpaths03(
+    PathNode arg, ParamNodeEx par, PathNodeMid ret, NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    exists(SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind, RetNodeEx retnode |
+      subpaths02(arg, par, sc, innercc, kind, out, sout, apout) and
+      pathNode(ret, retnode, sout, innercc, sc, apout, unbindConf(getPathNodeConf(arg)), _) and
+      kind = retnode.getKind()
+    )
+  }
+
+  private PathNodeImpl localStepToHidden(PathNodeImpl n) {
+    n.getASuccessorImpl() = result and
+    result.isHidden() and
+    exists(NodeEx n1, NodeEx n2 | n1 = n.getNodeEx() and n2 = result.getNodeEx() |
+      localFlowBigStep(n1, _, n2, _, _, _, _, _) or
+      store(n1, _, n2, _, _) or
+      readSet(n1, _, n2, _)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate hasSuccessor(PathNodeImpl pred, PathNodeMid succ, NodeEx succNode) {
+    succ = pred.getANonHiddenSuccessor() and
+    succNode = succ.getNodeEx()
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  predicate subpaths(PathNodeImpl arg, PathNodeImpl par, PathNodeImpl ret, PathNode out) {
+    exists(ParamNodeEx p, NodeEx o, FlowState sout, AccessPath apout, PathNodeMid out0 |
+      pragma[only_bind_into](arg).getANonHiddenSuccessor() = pragma[only_bind_into](out0) and
+      subpaths03(pragma[only_bind_into](arg), p, localStepToHidden*(ret), o, sout, apout) and
+      hasSuccessor(pragma[only_bind_into](arg), par, p) and
+      not ret.isHidden() and
+      pathNode(out0, o, sout, _, _, apout, _, _)
+    |
+      out = out0 or out = out0.projectToSink()
+    )
+  }
+
+  /**
+   * Holds if `n` can reach a return node in a summarized subpath that can reach a sink.
+   */
+  predicate retReach(PathNodeImpl n) {
+    exists(PathNode out | subpaths(_, _, n, out) | directReach(out) or retReach(out))
+    or
+    exists(PathNodeImpl mid |
+      retReach(mid) and
+      n.getANonHiddenSuccessor() = mid and
+      not subpaths(_, mid, _, _)
+    )
+  }
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+private predicate flowsTo(
+  PathNode flowsource, PathNodeSink flowsink, Node source, Node sink, Configuration configuration
+) {
+  flowsource.isSource() and
+  flowsource.getConfiguration() = configuration and
+  flowsource.(PathNodeImpl).getNodeEx().asNode() = source and
+  (flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
+  flowsink.getNodeEx().asNode() = sink
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+predicate flowsTo(Node source, Node sink, Configuration configuration) {
+  flowsTo(_, _, source, sink, configuration)
+}
+
+private predicate finalStats(
+  boolean fwd, int nodes, int fields, int conscand, int states, int tuples
+) {
+  fwd = true and
+  nodes = count(NodeEx n0 | exists(PathNodeImpl pn | pn.getNodeEx() = n0)) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0)) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap)) and
+  states = count(FlowState state | exists(PathNodeMid pn | pn.getState() = state)) and
+  tuples = count(PathNode pn)
+  or
+  fwd = false and
+  nodes = count(NodeEx n0 | exists(PathNodeImpl pn | pn.getNodeEx() = n0 and reach(pn))) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0 and reach(pn))) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap and reach(pn))) and
+  states = count(FlowState state | exists(PathNodeMid pn | pn.getState() = state and reach(pn))) and
+  tuples = count(PathNode pn | reach(pn))
+}
+
+/**
+ * INTERNAL: Only for debugging.
+ *
+ * Calculates per-stage metrics for data flow.
+ */
+predicate stageStats(
+  int n, string stage, int nodes, int fields, int conscand, int states, int tuples,
+  Configuration config
+) {
+  stage = "1 Fwd" and
+  n = 10 and
+  Stage1::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "1 Rev" and
+  n = 15 and
+  Stage1::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "2 Fwd" and
+  n = 20 and
+  Stage2::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "2 Rev" and
+  n = 25 and
+  Stage2::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "3 Fwd" and
+  n = 30 and
+  Stage3::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "3 Rev" and
+  n = 35 and
+  Stage3::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "4 Fwd" and
+  n = 40 and
+  Stage4::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "4 Rev" and
+  n = 45 and
+  Stage4::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "5 Fwd" and n = 50 and finalStats(true, nodes, fields, conscand, states, tuples)
+  or
+  stage = "5 Rev" and n = 55 and finalStats(false, nodes, fields, conscand, states, tuples)
+}
+
+private module FlowExploration {
+  private predicate callableStep(DataFlowCallable c1, DataFlowCallable c2, Configuration config) {
+    exists(NodeEx node1, NodeEx node2 |
+      jumpStep(node1, node2, config)
+      or
+      additionalJumpStep(node1, node2, config)
+      or
+      additionalJumpStateStep(node1, _, node2, _, config)
+      or
+      // flow into callable
+      viableParamArgEx(_, node2, node1)
+      or
+      // flow out of a callable
+      viableReturnPosOutEx(_, node1.(RetNodeEx).getReturnPosition(), node2)
+    |
+      c1 = node1.getEnclosingCallable() and
+      c2 = node2.getEnclosingCallable() and
+      c1 != c2
+    )
+  }
+
+  private predicate interestingCallableSrc(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSource(n) or config.isSource(n, _) | c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSrc(mid, config) and callableStep(mid, c, config)
+    )
+  }
+
+  private predicate interestingCallableSink(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSink(n) or config.isSink(n, _) | c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSink(mid, config) and callableStep(c, mid, config)
+    )
+  }
+
+  private newtype TCallableExt =
+    TCallable(DataFlowCallable c, Configuration config) {
+      interestingCallableSrc(c, config) or
+      interestingCallableSink(c, config)
+    } or
+    TCallableSrc() or
+    TCallableSink()
+
+  private predicate callableExtSrc(TCallableSrc src) { any() }
+
+  private predicate callableExtSink(TCallableSink sink) { any() }
+
+  private predicate callableExtStepFwd(TCallableExt ce1, TCallableExt ce2) {
+    exists(DataFlowCallable c1, DataFlowCallable c2, Configuration config |
+      callableStep(c1, c2, config) and
+      ce1 = TCallable(c1, pragma[only_bind_into](config)) and
+      ce2 = TCallable(c2, pragma[only_bind_into](config))
+    )
+    or
+    exists(Node n, Configuration config |
+      ce1 = TCallableSrc() and
+      (config.isSource(n) or config.isSource(n, _)) and
+      ce2 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+    or
+    exists(Node n, Configuration config |
+      ce2 = TCallableSink() and
+      (config.isSink(n) or config.isSink(n, _)) and
+      ce1 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+  }
+
+  private predicate callableExtStepRev(TCallableExt ce1, TCallableExt ce2) {
+    callableExtStepFwd(ce2, ce1)
+  }
+
+  private int distSrcExt(TCallableExt c) =
+    shortestDistances(callableExtSrc/1, callableExtStepFwd/2)(_, c, result)
+
+  private int distSinkExt(TCallableExt c) =
+    shortestDistances(callableExtSink/1, callableExtStepRev/2)(_, c, result)
+
+  private int distSrc(DataFlowCallable c, Configuration config) {
+    result = distSrcExt(TCallable(c, config)) - 1
+  }
+
+  private int distSink(DataFlowCallable c, Configuration config) {
+    result = distSinkExt(TCallable(c, config)) - 1
+  }
+
+  private newtype TPartialAccessPath =
+    TPartialNil(DataFlowType t) or
+    TPartialCons(TypedContent tc, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `TypedContent`s followed by a `Type`, but only the first
+   * element of the list and its length are tracked. If data flows from a source to
+   * a given node with a given `AccessPath`, this indicates the sequence of
+   * dereference operations needed to get from the value in the node to the
+   * tracked object. The final type indicates the type of the tracked object.
+   */
+  private class PartialAccessPath extends TPartialAccessPath {
+    abstract string toString();
+
+    TypedContent getHead() { this = TPartialCons(result, _) }
+
+    int len() {
+      this = TPartialNil(_) and result = 0
+      or
+      this = TPartialCons(_, result)
+    }
+
+    DataFlowType getType() {
+      this = TPartialNil(result)
+      or
+      exists(TypedContent head | this = TPartialCons(head, _) | result = head.getContainerType())
+    }
+  }
+
+  private class PartialAccessPathNil extends PartialAccessPath, TPartialNil {
+    override string toString() {
+      exists(DataFlowType t | this = TPartialNil(t) | result = concat(": " + ppReprType(t)))
+    }
+  }
+
+  private class PartialAccessPathCons extends PartialAccessPath, TPartialCons {
+    override string toString() {
+      exists(TypedContent tc, int len | this = TPartialCons(tc, len) |
+        if len = 1
+        then result = "[" + tc.toString() + "]"
+        else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private newtype TRevPartialAccessPath =
+    TRevPartialNil() or
+    TRevPartialCons(Content c, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `Content`s, but only the first
+   * element of the list and its length are tracked.
+   */
+  private class RevPartialAccessPath extends TRevPartialAccessPath {
+    abstract string toString();
+
+    Content getHead() { this = TRevPartialCons(result, _) }
+
+    int len() {
+      this = TRevPartialNil() and result = 0
+      or
+      this = TRevPartialCons(_, result)
+    }
+  }
+
+  private class RevPartialAccessPathNil extends RevPartialAccessPath, TRevPartialNil {
+    override string toString() { result = "" }
+  }
+
+  private class RevPartialAccessPathCons extends RevPartialAccessPath, TRevPartialCons {
+    override string toString() {
+      exists(Content c, int len | this = TRevPartialCons(c, len) |
+        if len = 1
+        then result = "[" + c.toString() + "]"
+        else result = "[" + c.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private predicate relevantState(FlowState state) {
+    sourceNode(_, state, _) or
+    sinkNode(_, state, _) or
+    additionalLocalStateStep(_, state, _, _, _) or
+    additionalLocalStateStep(_, _, _, state, _) or
+    additionalJumpStateStep(_, state, _, _, _) or
+    additionalJumpStateStep(_, _, _, state, _)
+  }
+
+  private newtype TSummaryCtx1 =
+    TSummaryCtx1None() or
+    TSummaryCtx1Param(ParamNodeEx p)
+
+  private newtype TSummaryCtx2 =
+    TSummaryCtx2None() or
+    TSummaryCtx2Some(FlowState s) { relevantState(s) }
+
+  private newtype TSummaryCtx3 =
+    TSummaryCtx3None() or
+    TSummaryCtx3Some(PartialAccessPath ap)
+
+  private newtype TRevSummaryCtx1 =
+    TRevSummaryCtx1None() or
+    TRevSummaryCtx1Some(ReturnPosition pos)
+
+  private newtype TRevSummaryCtx2 =
+    TRevSummaryCtx2None() or
+    TRevSummaryCtx2Some(FlowState s) { relevantState(s) }
+
+  private newtype TRevSummaryCtx3 =
+    TRevSummaryCtx3None() or
+    TRevSummaryCtx3Some(RevPartialAccessPath ap)
+
+  private newtype TPartialPathNode =
+    TPartialPathNodeFwd(
+      NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+      TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+    ) {
+      sourceNode(node, state, config) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      sc3 = TSummaryCtx3None() and
+      ap = TPartialNil(node.getDataFlowType()) and
+      exists(config.explorationLimit())
+      or
+      partialPathNodeMk0(node, state, cc, sc1, sc2, sc3, ap, config) and
+      distSrc(node.getEnclosingCallable(), config) <= config.explorationLimit()
+    } or
+    TPartialPathNodeRev(
+      NodeEx node, FlowState state, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2, TRevSummaryCtx3 sc3,
+      RevPartialAccessPath ap, Configuration config
+    ) {
+      sinkNode(node, state, config) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = TRevPartialNil() and
+      exists(config.explorationLimit())
+      or
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
+    }
+
+  pragma[nomagic]
+  private predicate partialPathNodeMk0(
+    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
+  }
+
+  /**
+   * A `Node` augmented with a call context, an access path, and a configuration.
+   */
+  class PartialPathNode extends TPartialPathNode {
+    /** Gets a textual representation of this element. */
+    string toString() { result = this.getNodeEx().toString() + this.ppAp() }
+
+    /**
+     * Gets a textual representation of this element, including a textual
+     * representation of the call context.
+     */
+    string toStringWithContext() {
+      result = this.getNodeEx().toString() + this.ppAp() + this.ppCtx()
+    }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+
+    /** Gets the underlying `Node`. */
+    final Node getNode() { this.getNodeEx().projectToNode() = result }
+
+    FlowState getState() { none() }
+
+    private NodeEx getNodeEx() {
+      result = this.(PartialPathNodeFwd).getNodeEx() or
+      result = this.(PartialPathNodeRev).getNodeEx()
+    }
+
+    /** Gets the associated configuration. */
+    Configuration getConfiguration() { none() }
+
+    /** Gets a successor of this node, if any. */
+    PartialPathNode getASuccessor() { none() }
+
+    /**
+     * Gets the approximate distance to the nearest source measured in number
+     * of interprocedural steps.
+     */
+    int getSourceDistance() {
+      result = distSrc(this.getNodeEx().getEnclosingCallable(), this.getConfiguration())
+    }
+
+    /**
+     * Gets the approximate distance to the nearest sink measured in number
+     * of interprocedural steps.
+     */
+    int getSinkDistance() {
+      result = distSink(this.getNodeEx().getEnclosingCallable(), this.getConfiguration())
+    }
+
+    private string ppAp() {
+      exists(string s |
+        s = this.(PartialPathNodeFwd).getAp().toString() or
+        s = this.(PartialPathNodeRev).getAp().toString()
+      |
+        if s = "" then result = "" else result = " " + s
+      )
+    }
+
+    private string ppCtx() {
+      result = " <" + this.(PartialPathNodeFwd).getCallContext().toString() + ">"
+    }
+
+    /** Holds if this is a source in a forward-flow path. */
+    predicate isFwdSource() { this.(PartialPathNodeFwd).isSource() }
+
+    /** Holds if this is a sink in a reverse-flow path. */
+    predicate isRevSink() { this.(PartialPathNodeRev).isSink() }
+  }
+
+  /**
+   * Provides the query predicates needed to include a graph in a path-problem query.
+   */
+  module PartialPathGraph {
+    /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+    query predicate edges(PartialPathNode a, PartialPathNode b) { a.getASuccessor() = b }
+  }
+
+  private class PartialPathNodeFwd extends PartialPathNode, TPartialPathNodeFwd {
+    NodeEx node;
+    FlowState state;
+    CallContext cc;
+    TSummaryCtx1 sc1;
+    TSummaryCtx2 sc2;
+    TSummaryCtx3 sc3;
+    PartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeFwd() { this = TPartialPathNodeFwd(node, state, cc, sc1, sc2, sc3, ap, config) }
+
+    NodeEx getNodeEx() { result = node }
+
+    override FlowState getState() { result = state }
+
+    CallContext getCallContext() { result = cc }
+
+    TSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    TSummaryCtx3 getSummaryCtx3() { result = sc3 }
+
+    PartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeFwd getASuccessor() {
+      partialPathStep(this, result.getNodeEx(), result.getState(), result.getCallContext(),
+        result.getSummaryCtx1(), result.getSummaryCtx2(), result.getSummaryCtx3(), result.getAp(),
+        result.getConfiguration())
+    }
+
+    predicate isSource() {
+      sourceNode(node, state, config) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      sc3 = TSummaryCtx3None() and
+      ap instanceof TPartialNil
+    }
+  }
+
+  private class PartialPathNodeRev extends PartialPathNode, TPartialPathNodeRev {
+    NodeEx node;
+    FlowState state;
+    TRevSummaryCtx1 sc1;
+    TRevSummaryCtx2 sc2;
+    TRevSummaryCtx3 sc3;
+    RevPartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeRev() { this = TPartialPathNodeRev(node, state, sc1, sc2, sc3, ap, config) }
+
+    NodeEx getNodeEx() { result = node }
+
+    override FlowState getState() { result = state }
+
+    TRevSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TRevSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    TRevSummaryCtx3 getSummaryCtx3() { result = sc3 }
+
+    RevPartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeRev getASuccessor() {
+      revPartialPathStep(result, this.getNodeEx(), this.getState(), this.getSummaryCtx1(),
+        this.getSummaryCtx2(), this.getSummaryCtx3(), this.getAp(), this.getConfiguration())
+    }
+
+    predicate isSink() {
+      sinkNode(node, state, config) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = TRevPartialNil()
+    }
+  }
+
+  private predicate partialPathStep(
+    PartialPathNodeFwd mid, NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1,
+    TSummaryCtx2 sc2, TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    not isUnreachableInCallCached(node.asNode(), cc.(CallContextSpecificCall).getCall()) and
+    (
+      localFlowStep(mid.getNodeEx(), node, config) and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+      or
+      additionalLocalFlowStep(mid.getNodeEx(), node, config) and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(node.getDataFlowType()) and
+      config = mid.getConfiguration()
+      or
+      additionalLocalStateStep(mid.getNodeEx(), mid.getState(), node, state, config) and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(node.getDataFlowType()) and
+      config = mid.getConfiguration()
+    )
+    or
+    jumpStep(mid.getNodeEx(), node, config) and
+    state = mid.getState() and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(mid.getNodeEx(), node, config) and
+    state = mid.getState() and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(node.getDataFlowType()) and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStateStep(mid.getNodeEx(), mid.getState(), node, state, config) and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(node.getDataFlowType()) and
+    config = mid.getConfiguration()
+    or
+    partialPathStoreStep(mid, _, _, node, ap) and
+    state = mid.getState() and
+    cc = mid.getCallContext() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    config = mid.getConfiguration()
+    or
+    exists(PartialAccessPath ap0, TypedContent tc |
+      partialPathReadStep(mid, ap0, tc, node, cc, config) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      apConsFwd(ap, tc, ap0, config)
+    )
+    or
+    partialPathIntoCallable(mid, node, state, _, cc, sc1, sc2, sc3, _, ap, config)
+    or
+    partialPathOutOfCallable(mid, node, state, cc, ap, config) and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None()
+    or
+    partialPathThroughCallable(mid, node, state, cc, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3()
+  }
+
+  bindingset[result, i]
+  private int unbindInt(int i) { pragma[only_bind_out](i) = pragma[only_bind_out](result) }
+
+  pragma[inline]
+  private predicate partialPathStoreStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap1, TypedContent tc, NodeEx node,
+    PartialAccessPath ap2
+  ) {
+    exists(NodeEx midNode, DataFlowType contentType |
+      midNode = mid.getNodeEx() and
+      ap1 = mid.getAp() and
+      store(midNode, tc, node, contentType, mid.getConfiguration()) and
+      ap2.getHead() = tc and
+      ap2.len() = unbindInt(ap1.len() + 1) and
+      compatibleTypes(ap1.getType(), contentType)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsFwd(
+    PartialAccessPath ap1, TypedContent tc, PartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStoreStep(mid, ap1, tc, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathReadStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap, TypedContent tc, NodeEx node, CallContext cc,
+    Configuration config
+  ) {
+    exists(NodeEx midNode |
+      midNode = mid.getNodeEx() and
+      ap = mid.getAp() and
+      read(midNode, tc.getContent(), node, pragma[only_bind_into](config)) and
+      ap.getHead() = tc and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      cc = mid.getCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable0(
+    PartialPathNodeFwd mid, ReturnPosition pos, FlowState state, CallContext innercc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    pos = mid.getNodeEx().(RetNodeEx).getReturnPosition() and
+    state = mid.getState() and
+    innercc = mid.getCallContext() and
+    innercc instanceof CallContextNoCall and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+  }
+
+  pragma[nomagic]
+  private predicate partialPathOutOfCallable1(
+    PartialPathNodeFwd mid, DataFlowCall call, ReturnKindExt kind, FlowState state, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+      partialPathOutOfCallable0(mid, pos, state, innercc, ap, config) and
+      c = pos.getCallable() and
+      kind = pos.getKind() and
+      resolveReturn(innercc, c, call)
+    |
+      if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable(
+    PartialPathNodeFwd mid, NodeEx out, FlowState state, CallContext cc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(ReturnKindExt kind, DataFlowCall call |
+      partialPathOutOfCallable1(mid, call, kind, state, cc, ap, config)
+    |
+      out.asNode() = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathIntoArg(
+    PartialPathNodeFwd mid, ParameterPosition ppos, FlowState state, CallContext cc,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ArgNode arg, ArgumentPosition apos |
+      arg = mid.getNodeEx().asNode() and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      arg.argumentOf(call, apos) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration() and
+      parameterMatch(ppos, apos)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathIntoCallable0(
+    PartialPathNodeFwd mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+    CallContext outercc, DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    partialPathIntoArg(mid, pos, state, outercc, call, ap, config) and
+    callable = resolveCall(call, outercc)
+  }
+
+  private predicate partialPathIntoCallable(
+    PartialPathNodeFwd mid, ParamNodeEx p, FlowState state, CallContext outercc,
+    CallContextCall innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ParameterPosition pos, DataFlowCallable callable |
+      partialPathIntoCallable0(mid, callable, pos, state, outercc, call, ap, config) and
+      p.isParameterOf(callable, pos) and
+      sc1 = TSummaryCtx1Param(p) and
+      sc2 = TSummaryCtx2Some(state) and
+      sc3 = TSummaryCtx3Some(ap)
+    |
+      if recordDataFlowCallSite(call, callable)
+      then innercc = TSpecificCall(call)
+      else innercc = TSomeCall()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate paramFlowsThroughInPartialPath(
+    ReturnKindExt kind, FlowState state, CallContextCall cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid, RetNodeEx ret |
+      mid.getNodeEx() = ret and
+      kind = ret.getKind() and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      config = mid.getConfiguration() and
+      ap = mid.getAp()
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeFwd mid, ReturnKindExt kind, FlowState state, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(CallContext innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3 |
+      partialPathIntoCallable(mid, _, _, cc, innercc, sc1, sc2, sc3, call, _, config) and
+      paramFlowsThroughInPartialPath(kind, state, innercc, sc1, sc2, sc3, ap, config)
+    )
+  }
+
+  private predicate partialPathThroughCallable(
+    PartialPathNodeFwd mid, NodeEx out, FlowState state, CallContext cc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(DataFlowCall call, ReturnKindExt kind |
+      partialPathThroughCallable0(call, mid, kind, state, cc, ap, config) and
+      out.asNode() = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStep(
+    PartialPathNodeRev mid, NodeEx node, FlowState state, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2,
+    TRevSummaryCtx3 sc3, RevPartialAccessPath ap, Configuration config
+  ) {
+    localFlowStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalFlowStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalStateStep(node, state, mid.getNodeEx(), mid.getState(), config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    jumpStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStateStep(node, state, mid.getNodeEx(), mid.getState(), config) and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    revPartialPathReadStep(mid, _, _, node, ap) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    config = mid.getConfiguration()
+    or
+    exists(RevPartialAccessPath ap0, Content c |
+      revPartialPathStoreStep(mid, ap0, c, node, config) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      apConsRev(ap, c, ap0, config)
+    )
+    or
+    exists(ParamNodeEx p |
+      mid.getNodeEx() = p and
+      viableParamArgEx(_, p, node) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+    or
+    exists(ReturnPosition pos |
+      revPartialPathIntoReturn(mid, pos, state, sc1, sc2, sc3, _, ap, config) and
+      pos = getReturnPosition(node.asNode())
+    )
+    or
+    revPartialPathThroughCallable(mid, node, state, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3()
+  }
+
+  pragma[inline]
+  private predicate revPartialPathReadStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap1, Content c, NodeEx node,
+    RevPartialAccessPath ap2
+  ) {
+    exists(NodeEx midNode |
+      midNode = mid.getNodeEx() and
+      ap1 = mid.getAp() and
+      read(node, c, midNode, mid.getConfiguration()) and
+      ap2.getHead() = c and
+      ap2.len() = unbindInt(ap1.len() + 1)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsRev(
+    RevPartialAccessPath ap1, Content c, RevPartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid |
+      revPartialPathReadStep(mid, ap1, c, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStoreStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap, Content c, NodeEx node, Configuration config
+  ) {
+    exists(NodeEx midNode, TypedContent tc |
+      midNode = mid.getNodeEx() and
+      ap = mid.getAp() and
+      store(node, tc, midNode, _, config) and
+      ap.getHead() = c and
+      config = mid.getConfiguration() and
+      tc.getContent() = c
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathIntoReturn(
+    PartialPathNodeRev mid, ReturnPosition pos, FlowState state, TRevSummaryCtx1Some sc1,
+    TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3, DataFlowCall call, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(NodeEx out |
+      mid.getNodeEx() = out and
+      mid.getState() = state and
+      viableReturnPosOutEx(call, pos, out) and
+      sc1 = TRevSummaryCtx1Some(pos) and
+      sc2 = TRevSummaryCtx2Some(state) and
+      sc3 = TRevSummaryCtx3Some(ap) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathFlowsThrough(
+    ArgumentPosition apos, FlowState state, TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2,
+    TRevSummaryCtx3Some sc3, RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid, ParamNodeEx p, ParameterPosition ppos |
+      mid.getNodeEx() = p and
+      mid.getState() = state and
+      p.getPosition() = ppos and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration() and
+      parameterMatch(ppos, apos)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeRev mid, ArgumentPosition pos, FlowState state,
+    RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3 |
+      revPartialPathIntoReturn(mid, _, _, sc1, sc2, sc3, call, _, config) and
+      revPartialPathFlowsThrough(pos, state, sc1, sc2, sc3, ap, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable(
+    PartialPathNodeRev mid, ArgNodeEx node, FlowState state, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(DataFlowCall call, ArgumentPosition pos |
+      revPartialPathThroughCallable0(call, mid, pos, state, ap, config) and
+      node.asNode().(ArgNode).argumentOf(call, pos)
+    )
+  }
+}
+
+import FlowExploration
+
+private predicate partialFlow(
+  PartialPathNode source, PartialPathNode node, Configuration configuration
+) {
+  source.getConfiguration() = configuration and
+  source.isFwdSource() and
+  node = source.getASuccessor+()
+}
+
+private predicate revPartialFlow(
+  PartialPathNode node, PartialPathNode sink, Configuration configuration
+) {
+  sink.getConfiguration() = configuration and
+  sink.isRevSink() and
+  node.getASuccessor+() = sink
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
new file mode 100644
index 00000000000..95b34f15dad
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
@@ -0,0 +1,1374 @@
+private import DataFlowImplSpecific::Private
+private import DataFlowImplSpecific::Public
+import Cached
+
+module DataFlowImplCommonPublic {
+  /** A state value to track during data flow. */
+  class FlowState = string;
+
+  /**
+   * The default state, which is used when the state is unspecified for a source
+   * or a sink.
+   */
+  class FlowStateEmpty extends FlowState {
+    FlowStateEmpty() { this = "" }
+  }
+
+  private newtype TFlowFeature =
+    TFeatureHasSourceCallContext() or
+    TFeatureHasSinkCallContext() or
+    TFeatureEqualSourceSinkCallContext()
+
+  /** A flow configuration feature for use in `Configuration::getAFeature()`. */
+  class FlowFeature extends TFlowFeature {
+    string toString() { none() }
+  }
+
+  /**
+   * A flow configuration feature that implies that sources have some existing
+   * call context.
+   */
+  class FeatureHasSourceCallContext extends FlowFeature, TFeatureHasSourceCallContext {
+    override string toString() { result = "FeatureHasSourceCallContext" }
+  }
+
+  /**
+   * A flow configuration feature that implies that sinks have some existing
+   * call context.
+   */
+  class FeatureHasSinkCallContext extends FlowFeature, TFeatureHasSinkCallContext {
+    override string toString() { result = "FeatureHasSinkCallContext" }
+  }
+
+  /**
+   * A flow configuration feature that implies that source-sink pairs have some
+   * shared existing call context.
+   */
+  class FeatureEqualSourceSinkCallContext extends FlowFeature, TFeatureEqualSourceSinkCallContext {
+    override string toString() { result = "FeatureEqualSourceSinkCallContext" }
+  }
+}
+
+/**
+ * The cost limits for the `AccessPathFront` to `AccessPathApprox` expansion.
+ *
+ * `apLimit` bounds the acceptable fan-out, and `tupleLimit` bounds the
+ * estimated per-`AccessPathFront` tuple cost. Access paths exceeding both of
+ * these limits are represented with lower precision during pruning.
+ */
+predicate accessPathApproxCostLimits(int apLimit, int tupleLimit) {
+  apLimit = 10 and
+  tupleLimit = 10000
+}
+
+/**
+ * The cost limits for the `AccessPathApprox` to `AccessPath` expansion.
+ *
+ * `apLimit` bounds the acceptable fan-out, and `tupleLimit` bounds the
+ * estimated per-`AccessPathApprox` tuple cost. Access paths exceeding both of
+ * these limits are represented with lower precision.
+ */
+predicate accessPathCostLimits(int apLimit, int tupleLimit) {
+  apLimit = 5 and
+  tupleLimit = 1000
+}
+
+/**
+ * Holds if `arg` is an argument of `call` with an argument position that matches
+ * parameter position `ppos`.
+ */
+pragma[noinline]
+predicate argumentPositionMatch(DataFlowCall call, ArgNode arg, ParameterPosition ppos) {
+  exists(ArgumentPosition apos |
+    arg.argumentOf(call, apos) and
+    parameterMatch(ppos, apos)
+  )
+}
+
+/**
+ * Provides a simple data-flow analysis for resolving lambda calls. The analysis
+ * currently excludes read-steps, store-steps, and flow-through.
+ *
+ * The analysis uses non-linear recursion: When computing a flow path in or out
+ * of a call, we use the results of the analysis recursively to resolve lambda
+ * calls. For this reason, we cannot reuse the code from `DataFlowImpl.qll` directly.
+ */
+private module LambdaFlow {
+  pragma[noinline]
+  private predicate viableParamNonLambda(DataFlowCall call, ParameterPosition ppos, ParamNode p) {
+    p.isParameterOf(viableCallable(call), ppos)
+  }
+
+  pragma[noinline]
+  private predicate viableParamLambda(DataFlowCall call, ParameterPosition ppos, ParamNode p) {
+    p.isParameterOf(viableCallableLambda(call, _), ppos)
+  }
+
+  private predicate viableParamArgNonLambda(DataFlowCall call, ParamNode p, ArgNode arg) {
+    exists(ParameterPosition ppos |
+      viableParamNonLambda(call, ppos, p) and
+      argumentPositionMatch(call, arg, ppos)
+    )
+  }
+
+  private predicate viableParamArgLambda(DataFlowCall call, ParamNode p, ArgNode arg) {
+    exists(ParameterPosition ppos |
+      viableParamLambda(call, ppos, p) and
+      argumentPositionMatch(call, arg, ppos)
+    )
+  }
+
+  private newtype TReturnPositionSimple =
+    TReturnPositionSimple0(DataFlowCallable c, ReturnKind kind) {
+      exists(ReturnNode ret |
+        c = getNodeEnclosingCallable(ret) and
+        kind = ret.getKind()
+      )
+    }
+
+  pragma[noinline]
+  private TReturnPositionSimple getReturnPositionSimple(ReturnNode ret, ReturnKind kind) {
+    result = TReturnPositionSimple0(getNodeEnclosingCallable(ret), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosNonLambda(DataFlowCall call, ReturnKind kind) {
+    result = TReturnPositionSimple0(viableCallable(call), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, ReturnKind kind
+  ) {
+    result = TReturnPositionSimple0(viableCallableLambda(call, lastCall), kind)
+  }
+
+  private predicate viableReturnPosOutNonLambda(
+    DataFlowCall call, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosNonLambda(call, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  private predicate viableReturnPosOutLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosLambda(call, lastCall, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  /**
+   * Holds if data can flow (inter-procedurally) from `node` (of type `t`) to
+   * the lambda call `lambdaCall`.
+   *
+   * The parameter `toReturn` indicates whether the path from `node` to
+   * `lambdaCall` goes through a return, and `toJump` whether the path goes
+   * through a jump step.
+   *
+   * The call context `lastCall` records the last call on the path from `node`
+   * to `lambdaCall`, if any. That is, `lastCall` is able to target the enclosing
+   * callable of `lambdaCall`.
+   */
+  pragma[nomagic]
+  predicate revLambdaFlow(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow0(lambdaCall, kind, node, t, toReturn, toJump, lastCall) and
+    if castNode(node) or node instanceof ArgNode or node instanceof ReturnNode
+    then compatibleTypes(t, getNodeDataFlowType(node))
+    else any()
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlow0(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    lambdaCall(lambdaCall, kind, node) and
+    t = getNodeDataFlowType(node) and
+    toReturn = false and
+    toJump = false and
+    lastCall = TDataFlowCallNone()
+    or
+    // local flow
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, toReturn, toJump, lastCall)
+    |
+      simpleLocalFlowStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) = getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeDataFlowType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // jump step
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, _, _, lastCall) and
+      toReturn = false and
+      toJump = true
+    |
+      jumpStepCached(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) != getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeDataFlowType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // flow into a callable
+    exists(ParamNode p, DataFlowCallOption lastCall0, DataFlowCall call |
+      revLambdaFlowIn(lambdaCall, kind, p, t, toJump, lastCall0) and
+      (
+        if lastCall0 = TDataFlowCallNone() and toJump = false
+        then lastCall = TDataFlowCallSome(call)
+        else lastCall = lastCall0
+      ) and
+      toReturn = false
+    |
+      viableParamArgNonLambda(call, p, node)
+      or
+      viableParamArgLambda(call, p, node) // non-linear recursion
+    )
+    or
+    // flow out of a callable
+    exists(TReturnPositionSimple pos |
+      revLambdaFlowOut(lambdaCall, kind, pos, t, toJump, lastCall) and
+      getReturnPositionSimple(node, node.(ReturnNode).getKind()) = pos and
+      toReturn = true
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOutLambdaCall(
+    DataFlowCall lambdaCall, LambdaCallKind kind, OutNode out, DataFlowType t, boolean toJump,
+    DataFlowCall call, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+    exists(ReturnKindExt rk |
+      out = rk.getAnOutNode(call) and
+      lambdaCall(call, _, _)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOut(
+    DataFlowCall lambdaCall, LambdaCallKind kind, TReturnPositionSimple pos, DataFlowType t,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    exists(DataFlowCall call, OutNode out |
+      revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+      viableReturnPosOutNonLambda(call, pos, out)
+      or
+      // non-linear recursion
+      revLambdaFlowOutLambdaCall(lambdaCall, kind, out, t, toJump, call, lastCall) and
+      viableReturnPosOutLambda(call, _, pos, out)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowIn(
+    DataFlowCall lambdaCall, LambdaCallKind kind, ParamNode p, DataFlowType t, boolean toJump,
+    DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, p, t, false, toJump, lastCall)
+  }
+}
+
+private DataFlowCallable viableCallableExt(DataFlowCall call) {
+  result = viableCallable(call)
+  or
+  result = viableCallableLambda(call, _)
+}
+
+cached
+private module Cached {
+  /**
+   * If needed, call this predicate from `DataFlowImplSpecific.qll` in order to
+   * force a stage-dependency on the `DataFlowImplCommon.qll` stage and thereby
+   * collapsing the two stages.
+   */
+  cached
+  predicate forceCachingInSameStage() { any() }
+
+  cached
+  predicate nodeEnclosingCallable(Node n, DataFlowCallable c) { c = nodeGetEnclosingCallable(n) }
+
+  cached
+  predicate callEnclosingCallable(DataFlowCall call, DataFlowCallable c) {
+    c = call.getEnclosingCallable()
+  }
+
+  cached
+  predicate nodeDataFlowType(Node n, DataFlowType t) { t = getNodeType(n) }
+
+  cached
+  predicate jumpStepCached(Node node1, Node node2) { jumpStep(node1, node2) }
+
+  cached
+  predicate clearsContentCached(Node n, ContentSet c) { clearsContent(n, c) }
+
+  cached
+  predicate expectsContentCached(Node n, ContentSet c) { expectsContent(n, c) }
+
+  cached
+  predicate isUnreachableInCallCached(Node n, DataFlowCall call) { isUnreachableInCall(n, call) }
+
+  cached
+  predicate outNodeExt(Node n) {
+    n instanceof OutNode
+    or
+    n.(PostUpdateNode).getPreUpdateNode() instanceof ArgNode
+  }
+
+  cached
+  predicate hiddenNode(Node n) { nodeIsHidden(n) }
+
+  cached
+  OutNodeExt getAnOutNodeExt(DataFlowCall call, ReturnKindExt k) {
+    result = getAnOutNode(call, k.(ValueReturnKind).getKind())
+    or
+    exists(ArgNode arg |
+      result.(PostUpdateNode).getPreUpdateNode() = arg and
+      arg.argumentOf(call, k.(ParamUpdateReturnKind).getAMatchingArgumentPosition())
+    )
+  }
+
+  cached
+  predicate returnNodeExt(Node n, ReturnKindExt k) {
+    k = TValueReturn(n.(ReturnNode).getKind())
+    or
+    exists(ParamNode p, ParameterPosition pos |
+      parameterValueFlowsToPreUpdate(p, n) and
+      p.isParameterOf(_, pos) and
+      k = TParamUpdate(pos)
+    )
+  }
+
+  cached
+  predicate castNode(Node n) { n instanceof CastNode }
+
+  cached
+  predicate castingNode(Node n) {
+    castNode(n) or
+    n instanceof ParamNode or
+    n instanceof OutNodeExt or
+    // For reads, `x.f`, we want to check that the tracked type after the read (which
+    // is obtained by popping the head of the access path stack) is compatible with
+    // the type of `x.f`.
+    readSet(_, _, n)
+  }
+
+  cached
+  predicate parameterNode(Node p, DataFlowCallable c, ParameterPosition pos) {
+    isParameterNode(p, c, pos)
+  }
+
+  cached
+  predicate argumentNode(Node n, DataFlowCall call, ArgumentPosition pos) {
+    isArgumentNode(n, call, pos)
+  }
+
+  /**
+   * Gets a viable target for the lambda call `call`.
+   *
+   * `lastCall` records the call required to reach `call` in order for the result
+   * to be a viable target, if any.
+   */
+  cached
+  DataFlowCallable viableCallableLambda(DataFlowCall call, DataFlowCallOption lastCall) {
+    exists(Node creation, LambdaCallKind kind |
+      LambdaFlow::revLambdaFlow(call, kind, creation, _, _, _, lastCall) and
+      lambdaCreation(creation, kind, result)
+    )
+  }
+
+  /**
+   * Holds if `p` is the parameter of a viable dispatch target of `call`,
+   * and `p` has position `ppos`.
+   */
+  pragma[nomagic]
+  private predicate viableParam(DataFlowCall call, ParameterPosition ppos, ParamNode p) {
+    p.isParameterOf(viableCallableExt(call), ppos)
+  }
+
+  /**
+   * Holds if `arg` is a possible argument to `p` in `call`, taking virtual
+   * dispatch into account.
+   */
+  cached
+  predicate viableParamArg(DataFlowCall call, ParamNode p, ArgNode arg) {
+    exists(ParameterPosition ppos |
+      viableParam(call, ppos, p) and
+      argumentPositionMatch(call, arg, ppos) and
+      compatibleTypes(getNodeDataFlowType(arg), getNodeDataFlowType(p))
+    )
+  }
+
+  pragma[nomagic]
+  private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKindExt kind) {
+    viableCallableExt(call) = result.getCallable() and
+    kind = result.getKind()
+  }
+
+  /**
+   * Holds if a value at return position `pos` can be returned to `out` via `call`,
+   * taking virtual dispatch into account.
+   */
+  cached
+  predicate viableReturnPosOut(DataFlowCall call, ReturnPosition pos, Node out) {
+    exists(ReturnKindExt kind |
+      pos = viableReturnPos(call, kind) and
+      out = kind.getAnOutNode(call)
+    )
+  }
+
+  /** Provides predicates for calculating flow-through summaries. */
+  private module FlowThrough {
+    /**
+     * The first flow-through approximation:
+     *
+     * - Input access paths are abstracted with a Boolean parameter
+     *   that indicates (non-)emptiness.
+     */
+    private module Cand {
+      /**
+       * Holds if `p` can flow to `node` in the same callable using only
+       * value-preserving steps.
+       *
+       * `read` indicates whether it is contents of `p` that can flow to `node`.
+       */
+      pragma[nomagic]
+      private predicate parameterValueFlowCand(ParamNode p, Node node, boolean read) {
+        p = node and
+        read = false
+        or
+        // local flow
+        exists(Node mid |
+          parameterValueFlowCand(p, mid, read) and
+          simpleLocalFlowStep(mid, node)
+        )
+        or
+        // read
+        exists(Node mid |
+          parameterValueFlowCand(p, mid, false) and
+          readSet(mid, _, node) and
+          read = true
+        )
+        or
+        // flow through: no prior read
+        exists(ArgNode arg |
+          parameterValueFlowArgCand(p, arg, false) and
+          argumentValueFlowsThroughCand(arg, node, read)
+        )
+        or
+        // flow through: no read inside method
+        exists(ArgNode arg |
+          parameterValueFlowArgCand(p, arg, read) and
+          argumentValueFlowsThroughCand(arg, node, false)
+        )
+      }
+
+      pragma[nomagic]
+      private predicate parameterValueFlowArgCand(ParamNode p, ArgNode arg, boolean read) {
+        parameterValueFlowCand(p, arg, read)
+      }
+
+      pragma[nomagic]
+      predicate parameterValueFlowsToPreUpdateCand(ParamNode p, PostUpdateNode n) {
+        parameterValueFlowCand(p, n.getPreUpdateNode(), false)
+      }
+
+      /**
+       * Holds if `p` can flow to a return node of kind `kind` in the same
+       * callable using only value-preserving steps, not taking call contexts
+       * into account.
+       *
+       * `read` indicates whether it is contents of `p` that can flow to the return
+       * node.
+       */
+      predicate parameterValueFlowReturnCand(ParamNode p, ReturnKind kind, boolean read) {
+        exists(ReturnNode ret |
+          parameterValueFlowCand(p, ret, read) and
+          kind = ret.getKind()
+        )
+      }
+
+      pragma[nomagic]
+      private predicate argumentValueFlowsThroughCand0(
+        DataFlowCall call, ArgNode arg, ReturnKind kind, boolean read
+      ) {
+        exists(ParamNode param | viableParamArg(call, param, arg) |
+          parameterValueFlowReturnCand(param, kind, read)
+        )
+      }
+
+      /**
+       * Holds if `arg` flows to `out` through a call using only value-preserving steps,
+       * not taking call contexts into account.
+       *
+       * `read` indicates whether it is contents of `arg` that can flow to `out`.
+       */
+      predicate argumentValueFlowsThroughCand(ArgNode arg, Node out, boolean read) {
+        exists(DataFlowCall call, ReturnKind kind |
+          argumentValueFlowsThroughCand0(call, arg, kind, read) and
+          out = getAnOutNode(call, kind)
+        )
+      }
+
+      predicate cand(ParamNode p, Node n) {
+        parameterValueFlowCand(p, n, _) and
+        (
+          parameterValueFlowReturnCand(p, _, _)
+          or
+          parameterValueFlowsToPreUpdateCand(p, _)
+        )
+      }
+    }
+
+    /**
+     * The final flow-through calculation:
+     *
+     * - Calculated flow is either value-preserving (`read = TReadStepTypesNone()`)
+     *   or summarized as a single read step with before and after types recorded
+     *   in the `ReadStepTypesOption` parameter.
+     * - Types are checked using the `compatibleTypes()` relation.
+     */
+    private module Final {
+      /**
+       * Holds if `p` can flow to `node` in the same callable using only
+       * value-preserving steps and possibly a single read step, not taking
+       * call contexts into account.
+       *
+       * If a read step was taken, then `read` captures the `Content`, the
+       * container type, and the content type.
+       */
+      predicate parameterValueFlow(ParamNode p, Node node, ReadStepTypesOption read) {
+        parameterValueFlow0(p, node, read) and
+        if node instanceof CastingNode
+        then
+          // normal flow through
+          read = TReadStepTypesNone() and
+          compatibleTypes(getNodeDataFlowType(p), getNodeDataFlowType(node))
+          or
+          // getter
+          compatibleTypes(read.getContentType(), getNodeDataFlowType(node))
+        else any()
+      }
+
+      pragma[nomagic]
+      private predicate parameterValueFlow0(ParamNode p, Node node, ReadStepTypesOption read) {
+        p = node and
+        Cand::cand(p, _) and
+        read = TReadStepTypesNone()
+        or
+        // local flow
+        exists(Node mid |
+          parameterValueFlow(p, mid, read) and
+          simpleLocalFlowStep(mid, node)
+        )
+        or
+        // read
+        exists(Node mid |
+          parameterValueFlow(p, mid, TReadStepTypesNone()) and
+          readStepWithTypes(mid, read.getContainerType(), read.getContent(), node,
+            read.getContentType()) and
+          Cand::parameterValueFlowReturnCand(p, _, true) and
+          compatibleTypes(getNodeDataFlowType(p), read.getContainerType())
+        )
+        or
+        parameterValueFlow0_0(TReadStepTypesNone(), p, node, read)
+      }
+
+      pragma[nomagic]
+      private predicate parameterValueFlow0_0(
+        ReadStepTypesOption mustBeNone, ParamNode p, Node node, ReadStepTypesOption read
+      ) {
+        // flow through: no prior read
+        exists(ArgNode arg |
+          parameterValueFlowArg(p, arg, mustBeNone) and
+          argumentValueFlowsThrough(arg, read, node)
+        )
+        or
+        // flow through: no read inside method
+        exists(ArgNode arg |
+          parameterValueFlowArg(p, arg, read) and
+          argumentValueFlowsThrough(arg, mustBeNone, node)
+        )
+      }
+
+      pragma[nomagic]
+      private predicate parameterValueFlowArg(ParamNode p, ArgNode arg, ReadStepTypesOption read) {
+        parameterValueFlow(p, arg, read) and
+        Cand::argumentValueFlowsThroughCand(arg, _, _)
+      }
+
+      pragma[nomagic]
+      private predicate argumentValueFlowsThrough0(
+        DataFlowCall call, ArgNode arg, ReturnKind kind, ReadStepTypesOption read
+      ) {
+        exists(ParamNode param | viableParamArg(call, param, arg) |
+          parameterValueFlowReturn(param, kind, read)
+        )
+      }
+
+      /**
+       * Holds if `arg` flows to `out` through a call using only
+       * value-preserving steps and possibly a single read step, not taking
+       * call contexts into account.
+       *
+       * If a read step was taken, then `read` captures the `Content`, the
+       * container type, and the content type.
+       */
+      pragma[nomagic]
+      predicate argumentValueFlowsThrough(ArgNode arg, ReadStepTypesOption read, Node out) {
+        exists(DataFlowCall call, ReturnKind kind |
+          argumentValueFlowsThrough0(call, arg, kind, read) and
+          out = getAnOutNode(call, kind)
+        |
+          // normal flow through
+          read = TReadStepTypesNone() and
+          compatibleTypes(getNodeDataFlowType(arg), getNodeDataFlowType(out))
+          or
+          // getter
+          compatibleTypes(getNodeDataFlowType(arg), read.getContainerType()) and
+          compatibleTypes(read.getContentType(), getNodeDataFlowType(out))
+        )
+      }
+
+      /**
+       * Holds if `arg` flows to `out` through a call using only
+       * value-preserving steps and a single read step, not taking call
+       * contexts into account, thus representing a getter-step.
+       *
+       * This predicate is exposed for testing only.
+       */
+      predicate getterStep(ArgNode arg, ContentSet c, Node out) {
+        argumentValueFlowsThrough(arg, TReadStepTypesSome(_, c, _), out)
+      }
+
+      /**
+       * Holds if `p` can flow to a return node of kind `kind` in the same
+       * callable using only value-preserving steps and possibly a single read
+       * step.
+       *
+       * If a read step was taken, then `read` captures the `Content`, the
+       * container type, and the content type.
+       */
+      private predicate parameterValueFlowReturn(
+        ParamNode p, ReturnKind kind, ReadStepTypesOption read
+      ) {
+        exists(ReturnNode ret |
+          parameterValueFlow(p, ret, read) and
+          kind = ret.getKind()
+        )
+      }
+    }
+
+    import Final
+  }
+
+  import FlowThrough
+
+  cached
+  private module DispatchWithCallContext {
+    /**
+     * Holds if the set of viable implementations that can be called by `call`
+     * might be improved by knowing the call context.
+     */
+    pragma[nomagic]
+    private predicate mayBenefitFromCallContextExt(DataFlowCall call, DataFlowCallable callable) {
+      mayBenefitFromCallContext(call, callable)
+      or
+      callEnclosingCallable(call, callable) and
+      exists(viableCallableLambda(call, TDataFlowCallSome(_)))
+    }
+
+    /**
+     * Gets a viable dispatch target of `call` in the context `ctx`. This is
+     * restricted to those `call`s for which a context might make a difference.
+     */
+    pragma[nomagic]
+    private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
+      result = viableImplInCallContext(call, ctx)
+      or
+      result = viableCallableLambda(call, TDataFlowCallSome(ctx))
+      or
+      exists(DataFlowCallable enclosing |
+        mayBenefitFromCallContextExt(call, enclosing) and
+        enclosing = viableCallableExt(ctx) and
+        result = viableCallableLambda(call, TDataFlowCallNone())
+      )
+    }
+
+    /**
+     * Holds if the call context `ctx` reduces the set of viable run-time
+     * dispatch targets of call `call` in `c`.
+     */
+    cached
+    predicate reducedViableImplInCallContext(DataFlowCall call, DataFlowCallable c, DataFlowCall ctx) {
+      exists(int tgts, int ctxtgts |
+        mayBenefitFromCallContextExt(call, c) and
+        c = viableCallableExt(ctx) and
+        ctxtgts = count(viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(viableCallableExt(call)) and
+        ctxtgts < tgts
+      )
+    }
+
+    /**
+     * Gets a viable run-time dispatch target for the call `call` in the
+     * context `ctx`. This is restricted to those calls for which a context
+     * makes a difference.
+     */
+    cached
+    DataFlowCallable prunedViableImplInCallContext(DataFlowCall call, DataFlowCall ctx) {
+      result = viableImplInCallContextExt(call, ctx) and
+      reducedViableImplInCallContext(call, _, ctx)
+    }
+
+    /**
+     * Holds if flow returning from callable `c` to call `call` might return
+     * further and if this path restricts the set of call sites that can be
+     * returned to.
+     */
+    cached
+    predicate reducedViableImplInReturn(DataFlowCallable c, DataFlowCall call) {
+      exists(int tgts, int ctxtgts |
+        mayBenefitFromCallContextExt(call, _) and
+        c = viableCallableExt(call) and
+        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(DataFlowCall ctx | callEnclosingCallable(call, viableCallableExt(ctx))) and
+        ctxtgts < tgts
+      )
+    }
+
+    /**
+     * Gets a viable run-time dispatch target for the call `call` in the
+     * context `ctx`. This is restricted to those calls and results for which
+     * the return flow from the result to `call` restricts the possible context
+     * `ctx`.
+     */
+    cached
+    DataFlowCallable prunedViableImplInCallContextReverse(DataFlowCall call, DataFlowCall ctx) {
+      result = viableImplInCallContextExt(call, ctx) and
+      reducedViableImplInReturn(result, call)
+    }
+  }
+
+  import DispatchWithCallContext
+
+  /**
+   * Holds if `p` can flow to the pre-update node associated with post-update
+   * node `n`, in the same callable, using only value-preserving steps.
+   */
+  private predicate parameterValueFlowsToPreUpdate(ParamNode p, PostUpdateNode n) {
+    parameterValueFlow(p, n.getPreUpdateNode(), TReadStepTypesNone())
+  }
+
+  cached
+  predicate readSet(Node node1, ContentSet c, Node node2) { readStep(node1, c, node2) }
+
+  cached
+  predicate storeSet(
+    Node node1, ContentSet c, Node node2, DataFlowType contentType, DataFlowType containerType
+  ) {
+    storeStep(node1, c, node2) and
+    contentType = getNodeDataFlowType(node1) and
+    containerType = getNodeDataFlowType(node2)
+    or
+    exists(Node n1, Node n2 |
+      n1 = node1.(PostUpdateNode).getPreUpdateNode() and
+      n2 = node2.(PostUpdateNode).getPreUpdateNode()
+    |
+      argumentValueFlowsThrough(n2, TReadStepTypesSome(containerType, c, contentType), n1)
+      or
+      readSet(n2, c, n1) and
+      contentType = getNodeDataFlowType(n1) and
+      containerType = getNodeDataFlowType(n2)
+    )
+  }
+
+  private predicate store(
+    Node node1, Content c, Node node2, DataFlowType contentType, DataFlowType containerType
+  ) {
+    exists(ContentSet cs |
+      c = cs.getAStoreContent() and storeSet(node1, cs, node2, contentType, containerType)
+    )
+  }
+
+  /**
+   * Holds if data can flow from `node1` to `node2` via a direct assignment to
+   * `f`.
+   *
+   * This includes reverse steps through reads when the result of the read has
+   * been stored into, in order to handle cases like `x.f1.f2 = y`.
+   */
+  cached
+  predicate store(Node node1, TypedContent tc, Node node2, DataFlowType contentType) {
+    store(node1, tc.getContent(), node2, contentType, tc.getContainerType())
+  }
+
+  /**
+   * Holds if data can flow from `fromNode` to `toNode` because they are the post-update
+   * nodes of some function output and input respectively, where the output and input
+   * are aliases. A typical example is a function returning `this`, implementing a fluent
+   * interface.
+   */
+  private predicate reverseStepThroughInputOutputAlias(
+    PostUpdateNode fromNode, PostUpdateNode toNode
+  ) {
+    exists(Node fromPre, Node toPre |
+      fromPre = fromNode.getPreUpdateNode() and
+      toPre = toNode.getPreUpdateNode()
+    |
+      exists(DataFlowCall c |
+        // Does the language-specific simpleLocalFlowStep already model flow
+        // from function input to output?
+        fromPre = getAnOutNode(c, _) and
+        toPre.(ArgNode).argumentOf(c, _) and
+        simpleLocalFlowStep(toPre.(ArgNode), fromPre)
+      )
+      or
+      argumentValueFlowsThrough(toPre, TReadStepTypesNone(), fromPre)
+    )
+  }
+
+  cached
+  predicate simpleLocalFlowStepExt(Node node1, Node node2) {
+    simpleLocalFlowStep(node1, node2) or
+    reverseStepThroughInputOutputAlias(node1, node2)
+  }
+
+  /**
+   * Holds if the call context `call` improves virtual dispatch in `callable`.
+   */
+  cached
+  predicate recordDataFlowCallSiteDispatch(DataFlowCall call, DataFlowCallable callable) {
+    reducedViableImplInCallContext(_, callable, call)
+  }
+
+  /**
+   * Holds if the call context `call` allows us to prune unreachable nodes in `callable`.
+   */
+  cached
+  predicate recordDataFlowCallSiteUnreachable(DataFlowCall call, DataFlowCallable callable) {
+    exists(Node n | getNodeEnclosingCallable(n) = callable | isUnreachableInCallCached(n, call))
+  }
+
+  cached
+  predicate allowParameterReturnInSelfCached(ParamNode p) { allowParameterReturnInSelf(p) }
+
+  cached
+  newtype TCallContext =
+    TAnyCallContext() or
+    TSpecificCall(DataFlowCall call) { recordDataFlowCallSite(call, _) } or
+    TSomeCall() or
+    TReturn(DataFlowCallable c, DataFlowCall call) { reducedViableImplInReturn(c, call) }
+
+  cached
+  newtype TReturnPosition =
+    TReturnPosition0(DataFlowCallable c, ReturnKindExt kind) {
+      exists(ReturnNodeExt ret |
+        c = returnNodeGetEnclosingCallable(ret) and
+        kind = ret.getKind()
+      )
+    }
+
+  cached
+  newtype TLocalFlowCallContext =
+    TAnyLocalCall() or
+    TSpecificLocalCall(DataFlowCall call) { isUnreachableInCallCached(_, call) }
+
+  cached
+  newtype TReturnKindExt =
+    TValueReturn(ReturnKind kind) or
+    TParamUpdate(ParameterPosition pos) { exists(ParamNode p | p.isParameterOf(_, pos)) }
+
+  cached
+  newtype TBooleanOption =
+    TBooleanNone() or
+    TBooleanSome(boolean b) { b = true or b = false }
+
+  cached
+  newtype TDataFlowCallOption =
+    TDataFlowCallNone() or
+    TDataFlowCallSome(DataFlowCall call)
+
+  cached
+  newtype TTypedContent = MkTypedContent(Content c, DataFlowType t) { store(_, c, _, _, t) }
+
+  cached
+  newtype TAccessPathFront =
+    TFrontNil(DataFlowType t) or
+    TFrontHead(TypedContent tc)
+
+  cached
+  newtype TAccessPathFrontOption =
+    TAccessPathFrontNone() or
+    TAccessPathFrontSome(AccessPathFront apf)
+}
+
+/**
+ * Holds if the call context `call` either improves virtual dispatch in
+ * `callable` or if it allows us to prune unreachable nodes in `callable`.
+ */
+predicate recordDataFlowCallSite(DataFlowCall call, DataFlowCallable callable) {
+  recordDataFlowCallSiteDispatch(call, callable) or
+  recordDataFlowCallSiteUnreachable(call, callable)
+}
+
+/**
+ * A `Node` at which a cast can occur such that the type should be checked.
+ */
+class CastingNode extends Node {
+  CastingNode() { castingNode(this) }
+}
+
+private predicate readStepWithTypes(
+  Node n1, DataFlowType container, ContentSet c, Node n2, DataFlowType content
+) {
+  readSet(n1, c, n2) and
+  container = getNodeDataFlowType(n1) and
+  content = getNodeDataFlowType(n2)
+}
+
+private newtype TReadStepTypesOption =
+  TReadStepTypesNone() or
+  TReadStepTypesSome(DataFlowType container, ContentSet c, DataFlowType content) {
+    readStepWithTypes(_, container, c, _, content)
+  }
+
+private class ReadStepTypesOption extends TReadStepTypesOption {
+  predicate isSome() { this instanceof TReadStepTypesSome }
+
+  DataFlowType getContainerType() { this = TReadStepTypesSome(result, _, _) }
+
+  ContentSet getContent() { this = TReadStepTypesSome(_, result, _) }
+
+  DataFlowType getContentType() { this = TReadStepTypesSome(_, _, result) }
+
+  string toString() { if this.isSome() then result = "Some(..)" else result = "None()" }
+}
+
+/**
+ * A call context to restrict the targets of virtual dispatch, prune local flow,
+ * and match the call sites of flow into a method with flow out of a method.
+ *
+ * There are four cases:
+ * - `TAnyCallContext()` : No restrictions on method flow.
+ * - `TSpecificCall(DataFlowCall call)` : Flow entered through the
+ *    given `call`. This call improves the set of viable
+ *    dispatch targets for at least one method call in the current callable
+ *    or helps prune unreachable nodes in the current callable.
+ * - `TSomeCall()` : Flow entered through a parameter. The
+ *    originating call does not improve the set of dispatch targets for any
+ *    method call in the current callable and was therefore not recorded.
+ * - `TReturn(Callable c, DataFlowCall call)` : Flow reached `call` from `c` and
+ *    this dispatch target of `call` implies a reduced set of dispatch origins
+ *    to which data may flow if it should reach a `return` statement.
+ */
+abstract class CallContext extends TCallContext {
+  abstract string toString();
+
+  /** Holds if this call context is relevant for `callable`. */
+  abstract predicate relevantFor(DataFlowCallable callable);
+}
+
+abstract class CallContextNoCall extends CallContext { }
+
+class CallContextAny extends CallContextNoCall, TAnyCallContext {
+  override string toString() { result = "CcAny" }
+
+  override predicate relevantFor(DataFlowCallable callable) { any() }
+}
+
+abstract class CallContextCall extends CallContext {
+  /** Holds if this call context may be `call`. */
+  bindingset[call]
+  abstract predicate matchesCall(DataFlowCall call);
+}
+
+class CallContextSpecificCall extends CallContextCall, TSpecificCall {
+  override string toString() {
+    exists(DataFlowCall call | this = TSpecificCall(call) | result = "CcCall(" + call + ")")
+  }
+
+  override predicate relevantFor(DataFlowCallable callable) {
+    recordDataFlowCallSite(this.getCall(), callable)
+  }
+
+  override predicate matchesCall(DataFlowCall call) { call = this.getCall() }
+
+  DataFlowCall getCall() { this = TSpecificCall(result) }
+}
+
+class CallContextSomeCall extends CallContextCall, TSomeCall {
+  override string toString() { result = "CcSomeCall" }
+
+  override predicate relevantFor(DataFlowCallable callable) {
+    exists(ParamNode p | getNodeEnclosingCallable(p) = callable)
+  }
+
+  override predicate matchesCall(DataFlowCall call) { any() }
+}
+
+class CallContextReturn extends CallContextNoCall, TReturn {
+  override string toString() {
+    exists(DataFlowCall call | this = TReturn(_, call) | result = "CcReturn(" + call + ")")
+  }
+
+  override predicate relevantFor(DataFlowCallable callable) {
+    exists(DataFlowCall call | this = TReturn(_, call) and callEnclosingCallable(call, callable))
+  }
+}
+
+/**
+ * A call context that is relevant for pruning local flow.
+ */
+abstract class LocalCallContext extends TLocalFlowCallContext {
+  abstract string toString();
+
+  /** Holds if this call context is relevant for `callable`. */
+  abstract predicate relevantFor(DataFlowCallable callable);
+}
+
+class LocalCallContextAny extends LocalCallContext, TAnyLocalCall {
+  override string toString() { result = "LocalCcAny" }
+
+  override predicate relevantFor(DataFlowCallable callable) { any() }
+}
+
+class LocalCallContextSpecificCall extends LocalCallContext, TSpecificLocalCall {
+  LocalCallContextSpecificCall() { this = TSpecificLocalCall(call) }
+
+  DataFlowCall call;
+
+  DataFlowCall getCall() { result = call }
+
+  override string toString() { result = "LocalCcCall(" + call + ")" }
+
+  override predicate relevantFor(DataFlowCallable callable) { relevantLocalCCtx(call, callable) }
+}
+
+private predicate relevantLocalCCtx(DataFlowCall call, DataFlowCallable callable) {
+  exists(Node n | getNodeEnclosingCallable(n) = callable and isUnreachableInCallCached(n, call))
+}
+
+/**
+ * Gets the local call context given the call context and the callable that
+ * the contexts apply to.
+ */
+LocalCallContext getLocalCallContext(CallContext ctx, DataFlowCallable callable) {
+  ctx.relevantFor(callable) and
+  if relevantLocalCCtx(ctx.(CallContextSpecificCall).getCall(), callable)
+  then result.(LocalCallContextSpecificCall).getCall() = ctx.(CallContextSpecificCall).getCall()
+  else result instanceof LocalCallContextAny
+}
+
+/**
+ * The value of a parameter at function entry, viewed as a node in a data
+ * flow graph.
+ */
+class ParamNode extends Node {
+  ParamNode() { parameterNode(this, _, _) }
+
+  /**
+   * Holds if this node is the parameter of callable `c` at the specified
+   * position.
+   */
+  predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) { parameterNode(this, c, pos) }
+}
+
+/** A data-flow node that represents a call argument. */
+class ArgNode extends Node {
+  ArgNode() { argumentNode(this, _, _) }
+
+  /** Holds if this argument occurs at the given position in the given call. */
+  final predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
+    argumentNode(this, call, pos)
+  }
+}
+
+/**
+ * A node from which flow can return to the caller. This is either a regular
+ * `ReturnNode` or a `PostUpdateNode` corresponding to the value of a parameter.
+ */
+class ReturnNodeExt extends Node {
+  ReturnNodeExt() { returnNodeExt(this, _) }
+
+  /** Gets the kind of this returned value. */
+  ReturnKindExt getKind() { returnNodeExt(this, result) }
+}
+
+/**
+ * A node to which data can flow from a call. Either an ordinary out node
+ * or a post-update node associated with a call argument.
+ */
+class OutNodeExt extends Node {
+  OutNodeExt() { outNodeExt(this) }
+}
+
+/**
+ * An extended return kind. A return kind describes how data can be returned
+ * from a callable. This can either be through a returned value or an updated
+ * parameter.
+ */
+abstract class ReturnKindExt extends TReturnKindExt {
+  /** Gets a textual representation of this return kind. */
+  abstract string toString();
+
+  /** Gets a node corresponding to data flow out of `call`. */
+  final OutNodeExt getAnOutNode(DataFlowCall call) { result = getAnOutNodeExt(call, this) }
+}
+
+class ValueReturnKind extends ReturnKindExt, TValueReturn {
+  private ReturnKind kind;
+
+  ValueReturnKind() { this = TValueReturn(kind) }
+
+  ReturnKind getKind() { result = kind }
+
+  override string toString() { result = kind.toString() }
+}
+
+class ParamUpdateReturnKind extends ReturnKindExt, TParamUpdate {
+  private ParameterPosition pos;
+
+  ParamUpdateReturnKind() { this = TParamUpdate(pos) }
+
+  ParameterPosition getPosition() { result = pos }
+
+  pragma[nomagic]
+  ArgumentPosition getAMatchingArgumentPosition() { parameterMatch(pos, result) }
+
+  override string toString() { result = "param update " + pos }
+}
+
+/** A callable tagged with a relevant return kind. */
+class ReturnPosition extends TReturnPosition0 {
+  private DataFlowCallable c;
+  private ReturnKindExt kind;
+
+  ReturnPosition() { this = TReturnPosition0(c, kind) }
+
+  /** Gets the callable. */
+  DataFlowCallable getCallable() { result = c }
+
+  /** Gets the return kind. */
+  ReturnKindExt getKind() { result = kind }
+
+  /** Gets a textual representation of this return position. */
+  string toString() { result = "[" + kind + "] " + c }
+}
+
+/**
+ * Gets the enclosing callable of `n`. Unlike `n.getEnclosingCallable()`, this
+ * predicate ensures that joins go from `n` to the result instead of the other
+ * way around.
+ */
+pragma[inline]
+DataFlowCallable getNodeEnclosingCallable(Node n) {
+  nodeEnclosingCallable(pragma[only_bind_out](n), pragma[only_bind_into](result))
+}
+
+/** Gets the type of `n` used for type pruning. */
+pragma[inline]
+DataFlowType getNodeDataFlowType(Node n) {
+  nodeDataFlowType(pragma[only_bind_out](n), pragma[only_bind_into](result))
+}
+
+pragma[noinline]
+private DataFlowCallable returnNodeGetEnclosingCallable(ReturnNodeExt ret) {
+  result = getNodeEnclosingCallable(ret)
+}
+
+pragma[noinline]
+private ReturnPosition getReturnPosition0(ReturnNodeExt ret, ReturnKindExt kind) {
+  result.getCallable() = returnNodeGetEnclosingCallable(ret) and
+  kind = result.getKind()
+}
+
+pragma[noinline]
+ReturnPosition getReturnPosition(ReturnNodeExt ret) {
+  result = getReturnPosition0(ret, ret.getKind())
+}
+
+/**
+ * Checks whether `inner` can return to `call` in the call context `innercc`.
+ * Assumes a context of `inner = viableCallableExt(call)`.
+ */
+bindingset[innercc, inner, call]
+predicate checkCallContextReturn(CallContext innercc, DataFlowCallable inner, DataFlowCall call) {
+  innercc instanceof CallContextAny
+  or
+  exists(DataFlowCallable c0, DataFlowCall call0 |
+    callEnclosingCallable(call0, inner) and
+    innercc = TReturn(c0, call0) and
+    c0 = prunedViableImplInCallContextReverse(call0, call)
+  )
+}
+
+/**
+ * Checks whether `call` can resolve to `calltarget` in the call context `cc`.
+ * Assumes a context of `calltarget = viableCallableExt(call)`.
+ */
+bindingset[cc, call, calltarget]
+predicate checkCallContextCall(CallContext cc, DataFlowCall call, DataFlowCallable calltarget) {
+  exists(DataFlowCall ctx | cc = TSpecificCall(ctx) |
+    if reducedViableImplInCallContext(call, _, ctx)
+    then calltarget = prunedViableImplInCallContext(call, ctx)
+    else any()
+  )
+  or
+  cc instanceof CallContextSomeCall
+  or
+  cc instanceof CallContextAny
+  or
+  cc instanceof CallContextReturn
+}
+
+/**
+ * Resolves a return from `callable` in `cc` to `call`. This is equivalent to
+ * `callable = viableCallableExt(call) and checkCallContextReturn(cc, callable, call)`.
+ */
+bindingset[cc, callable]
+predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
+  cc instanceof CallContextAny and callable = viableCallableExt(call)
+  or
+  exists(DataFlowCallable c0, DataFlowCall call0 |
+    callEnclosingCallable(call0, callable) and
+    cc = TReturn(c0, call0) and
+    c0 = prunedViableImplInCallContextReverse(call0, call)
+  )
+}
+
+/**
+ * Resolves a call from `call` in `cc` to `result`. This is equivalent to
+ * `result = viableCallableExt(call) and checkCallContextCall(cc, call, result)`.
+ */
+bindingset[call, cc]
+DataFlowCallable resolveCall(DataFlowCall call, CallContext cc) {
+  exists(DataFlowCall ctx | cc = TSpecificCall(ctx) |
+    if reducedViableImplInCallContext(call, _, ctx)
+    then result = prunedViableImplInCallContext(call, ctx)
+    else result = viableCallableExt(call)
+  )
+  or
+  result = viableCallableExt(call) and cc instanceof CallContextSomeCall
+  or
+  result = viableCallableExt(call) and cc instanceof CallContextAny
+  or
+  result = viableCallableExt(call) and cc instanceof CallContextReturn
+}
+
+/** An optional Boolean value. */
+class BooleanOption extends TBooleanOption {
+  string toString() {
+    this = TBooleanNone() and result = "<none>"
+    or
+    this = TBooleanSome(any(boolean b | result = b.toString()))
+  }
+}
+
+/** An optional `DataFlowCall`. */
+class DataFlowCallOption extends TDataFlowCallOption {
+  string toString() {
+    this = TDataFlowCallNone() and
+    result = "(none)"
+    or
+    exists(DataFlowCall call |
+      this = TDataFlowCallSome(call) and
+      result = call.toString()
+    )
+  }
+}
+
+/** A `Content` tagged with the type of a containing object. */
+class TypedContent extends MkTypedContent {
+  private Content c;
+  private DataFlowType t;
+
+  TypedContent() { this = MkTypedContent(c, t) }
+
+  /** Gets the content. */
+  Content getContent() { result = c }
+
+  /** Gets the container type. */
+  DataFlowType getContainerType() { result = t }
+
+  /** Gets a textual representation of this content. */
+  string toString() { result = c.toString() }
+
+  /**
+   * Holds if access paths with this `TypedContent` at their head always should
+   * be tracked at high precision. This disables adaptive access path precision
+   * for such access paths.
+   */
+  predicate forceHighPrecision() { forceHighPrecision(c) }
+}
+
+/**
+ * The front of an access path. This is either a head or a nil.
+ */
+abstract class AccessPathFront extends TAccessPathFront {
+  abstract string toString();
+
+  abstract DataFlowType getType();
+
+  abstract boolean toBoolNonEmpty();
+
+  TypedContent getHead() { this = TFrontHead(result) }
+}
+
+class AccessPathFrontNil extends AccessPathFront, TFrontNil {
+  private DataFlowType t;
+
+  AccessPathFrontNil() { this = TFrontNil(t) }
+
+  override string toString() { result = ppReprType(t) }
+
+  override DataFlowType getType() { result = t }
+
+  override boolean toBoolNonEmpty() { result = false }
+}
+
+class AccessPathFrontHead extends AccessPathFront, TFrontHead {
+  private TypedContent tc;
+
+  AccessPathFrontHead() { this = TFrontHead(tc) }
+
+  override string toString() { result = tc.toString() }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override boolean toBoolNonEmpty() { result = true }
+}
+
+/** An optional access path front. */
+class AccessPathFrontOption extends TAccessPathFrontOption {
+  string toString() {
+    this = TAccessPathFrontNone() and result = "<none>"
+    or
+    this = TAccessPathFrontSome(any(AccessPathFront apf | result = apf.toString()))
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll
new file mode 100644
index 00000000000..d6c1bad2744
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll
@@ -0,0 +1,212 @@
+/**
+ * Provides consistency queries for checking invariants in the language-specific
+ * data-flow classes and predicates.
+ */
+
+private import DataFlowImplSpecific::Private
+private import DataFlowImplSpecific::Public
+private import tainttracking1.TaintTrackingParameter::Private
+private import tainttracking1.TaintTrackingParameter::Public
+
+module Consistency {
+  private newtype TConsistencyConfiguration = MkConsistencyConfiguration()
+
+  /** A class for configuring the consistency queries. */
+  class ConsistencyConfiguration extends TConsistencyConfiguration {
+    string toString() { none() }
+
+    /** Holds if `n` should be excluded from the consistency test `uniqueEnclosingCallable`. */
+    predicate uniqueEnclosingCallableExclude(Node n) { none() }
+
+    /** Holds if `n` should be excluded from the consistency test `uniqueNodeLocation`. */
+    predicate uniqueNodeLocationExclude(Node n) { none() }
+
+    /** Holds if `n` should be excluded from the consistency test `missingLocation`. */
+    predicate missingLocationExclude(Node n) { none() }
+
+    /** Holds if `n` should be excluded from the consistency test `postWithInFlow`. */
+    predicate postWithInFlowExclude(Node n) { none() }
+
+    /** Holds if `n` should be excluded from the consistency test `argHasPostUpdate`. */
+    predicate argHasPostUpdateExclude(ArgumentNode n) { none() }
+
+    /** Holds if `n` should be excluded from the consistency test `reverseRead`. */
+    predicate reverseReadExclude(Node n) { none() }
+  }
+
+  private class RelevantNode extends Node {
+    RelevantNode() {
+      this instanceof ArgumentNode or
+      this instanceof ParameterNode or
+      this instanceof ReturnNode or
+      this = getAnOutNode(_, _) or
+      simpleLocalFlowStep(this, _) or
+      simpleLocalFlowStep(_, this) or
+      jumpStep(this, _) or
+      jumpStep(_, this) or
+      storeStep(this, _, _) or
+      storeStep(_, _, this) or
+      readStep(this, _, _) or
+      readStep(_, _, this) or
+      defaultAdditionalTaintStep(this, _) or
+      defaultAdditionalTaintStep(_, this)
+    }
+  }
+
+  query predicate uniqueEnclosingCallable(Node n, string msg) {
+    exists(int c |
+      n instanceof RelevantNode and
+      c = count(nodeGetEnclosingCallable(n)) and
+      c != 1 and
+      not any(ConsistencyConfiguration conf).uniqueEnclosingCallableExclude(n) and
+      msg = "Node should have one enclosing callable but has " + c + "."
+    )
+  }
+
+  query predicate uniqueType(Node n, string msg) {
+    exists(int c |
+      n instanceof RelevantNode and
+      c = count(getNodeType(n)) and
+      c != 1 and
+      msg = "Node should have one type but has " + c + "."
+    )
+  }
+
+  query predicate uniqueNodeLocation(Node n, string msg) {
+    exists(int c |
+      c =
+        count(string filepath, int startline, int startcolumn, int endline, int endcolumn |
+          n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+        ) and
+      c != 1 and
+      not any(ConsistencyConfiguration conf).uniqueNodeLocationExclude(n) and
+      msg = "Node should have one location but has " + c + "."
+    )
+  }
+
+  query predicate missingLocation(string msg) {
+    exists(int c |
+      c =
+        strictcount(Node n |
+          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
+            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+          ) and
+          not any(ConsistencyConfiguration conf).missingLocationExclude(n)
+        ) and
+      msg = "Nodes without location: " + c
+    )
+  }
+
+  query predicate uniqueNodeToString(Node n, string msg) {
+    exists(int c |
+      c = count(n.toString()) and
+      c != 1 and
+      msg = "Node should have one toString but has " + c + "."
+    )
+  }
+
+  query predicate missingToString(string msg) {
+    exists(int c |
+      c = strictcount(Node n | not exists(n.toString())) and
+      msg = "Nodes without toString: " + c
+    )
+  }
+
+  query predicate parameterCallable(ParameterNode p, string msg) {
+    exists(DataFlowCallable c | isParameterNode(p, c, _) and c != nodeGetEnclosingCallable(p)) and
+    msg = "Callable mismatch for parameter."
+  }
+
+  query predicate localFlowIsLocal(Node n1, Node n2, string msg) {
+    simpleLocalFlowStep(n1, n2) and
+    nodeGetEnclosingCallable(n1) != nodeGetEnclosingCallable(n2) and
+    msg = "Local flow step does not preserve enclosing callable."
+  }
+
+  private DataFlowType typeRepr() { result = getNodeType(_) }
+
+  query predicate compatibleTypesReflexive(DataFlowType t, string msg) {
+    t = typeRepr() and
+    not compatibleTypes(t, t) and
+    msg = "Type compatibility predicate is not reflexive."
+  }
+
+  query predicate unreachableNodeCCtx(Node n, DataFlowCall call, string msg) {
+    isUnreachableInCall(n, call) and
+    exists(DataFlowCallable c |
+      c = nodeGetEnclosingCallable(n) and
+      not viableCallable(call) = c
+    ) and
+    msg = "Call context for isUnreachableInCall is inconsistent with call graph."
+  }
+
+  query predicate localCallNodes(DataFlowCall call, Node n, string msg) {
+    (
+      n = getAnOutNode(call, _) and
+      msg = "OutNode and call does not share enclosing callable."
+      or
+      n.(ArgumentNode).argumentOf(call, _) and
+      msg = "ArgumentNode and call does not share enclosing callable."
+    ) and
+    nodeGetEnclosingCallable(n) != call.getEnclosingCallable()
+  }
+
+  // This predicate helps the compiler forget that in some languages
+  // it is impossible for a result of `getPreUpdateNode` to be an
+  // instance of `PostUpdateNode`.
+  private Node getPre(PostUpdateNode n) {
+    result = n.getPreUpdateNode()
+    or
+    none()
+  }
+
+  query predicate postIsNotPre(PostUpdateNode n, string msg) {
+    getPre(n) = n and
+    msg = "PostUpdateNode should not equal its pre-update node."
+  }
+
+  query predicate postHasUniquePre(PostUpdateNode n, string msg) {
+    exists(int c |
+      c = count(n.getPreUpdateNode()) and
+      c != 1 and
+      msg = "PostUpdateNode should have one pre-update node but has " + c + "."
+    )
+  }
+
+  query predicate uniquePostUpdate(Node n, string msg) {
+    1 < strictcount(PostUpdateNode post | post.getPreUpdateNode() = n) and
+    msg = "Node has multiple PostUpdateNodes."
+  }
+
+  query predicate postIsInSameCallable(PostUpdateNode n, string msg) {
+    nodeGetEnclosingCallable(n) != nodeGetEnclosingCallable(n.getPreUpdateNode()) and
+    msg = "PostUpdateNode does not share callable with its pre-update node."
+  }
+
+  private predicate hasPost(Node n) { exists(PostUpdateNode post | post.getPreUpdateNode() = n) }
+
+  query predicate reverseRead(Node n, string msg) {
+    exists(Node n2 | readStep(n, _, n2) and hasPost(n2) and not hasPost(n)) and
+    not any(ConsistencyConfiguration conf).reverseReadExclude(n) and
+    msg = "Origin of readStep is missing a PostUpdateNode."
+  }
+
+  query predicate argHasPostUpdate(ArgumentNode n, string msg) {
+    not hasPost(n) and
+    not any(ConsistencyConfiguration c).argHasPostUpdateExclude(n) and
+    msg = "ArgumentNode is missing PostUpdateNode."
+  }
+
+  // This predicate helps the compiler forget that in some languages
+  // it is impossible for a `PostUpdateNode` to be the target of
+  // `simpleLocalFlowStep`.
+  private predicate isPostUpdateNode(Node n) { n instanceof PostUpdateNode or none() }
+
+  query predicate postWithInFlow(Node n, string msg) {
+    isPostUpdateNode(n) and
+    not clearsContent(n, _) and
+    simpleLocalFlowStep(_, n) and
+    not any(ConsistencyConfiguration c).postWithInFlowExclude(n) and
+    msg = "PostUpdateNode should not be the target of local flow."
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll
new file mode 100644
index 00000000000..4ea383b20a1
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll
@@ -0,0 +1,11 @@
+/**
+ * Provides IR-specific definitions for use in the data flow library.
+ */
+module Private {
+  import DataFlowPrivate
+  import DataFlowDispatch
+}
+
+module Public {
+  import DataFlowUtil
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
new file mode 100644
index 00000000000..d6b2d455dd2
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -0,0 +1,560 @@
+private import cpp as Cpp
+private import DataFlowUtil
+private import semmle.code.cpp.ir.IR
+private import DataFlowDispatch
+private import DataFlowImplConsistency
+private import semmle.code.cpp.ir.internal.IRCppLanguage
+private import SsaInternals as Ssa
+
+/** Gets the callable in which this node occurs. */
+DataFlowCallable nodeGetEnclosingCallable(Node n) { result = n.getEnclosingCallable() }
+
+/** Holds if `p` is a `ParameterNode` of `c` with position `pos`. */
+predicate isParameterNode(ParameterNode p, DataFlowCallable c, ParameterPosition pos) {
+  p.isParameterOf(c, pos)
+}
+
+/** Holds if `arg` is an `ArgumentNode` of `c` with position `pos`. */
+predicate isArgumentNode(ArgumentNode arg, DataFlowCall c, ArgumentPosition pos) {
+  arg.argumentOf(c, pos)
+}
+
+/**
+ * A data flow node that occurs as the argument of a call and is passed as-is
+ * to the callable. Instance arguments (`this` pointer) and read side effects
+ * on parameters are also included.
+ */
+abstract class ArgumentNode extends Node {
+  /**
+   * Holds if this argument occurs at the given position in the given call.
+   * The instance argument is considered to have index `-1`.
+   */
+  abstract predicate argumentOf(DataFlowCall call, ArgumentPosition pos);
+
+  /** Gets the call in which this node is an argument. */
+  DataFlowCall getCall() { this.argumentOf(result, _) }
+}
+
+/**
+ * A data flow node that occurs as the argument to a call, or an
+ * implicit `this` pointer argument.
+ */
+private class PrimaryArgumentNode extends ArgumentNode, OperandNode {
+  override ArgumentOperand op;
+
+  PrimaryArgumentNode() { exists(CallInstruction call | op = call.getAnArgumentOperand()) }
+
+  override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
+    op = call.getArgumentOperand(pos.(DirectPosition).getIndex())
+  }
+
+  override string toStringImpl() { result = argumentOperandToString(op) }
+}
+
+private string argumentOperandToString(ArgumentOperand op) {
+  exists(Expr unconverted |
+    unconverted = op.getDef().getUnconvertedResultExpression() and
+    result = unconverted.toString()
+  )
+  or
+  // Certain instructions don't map to an unconverted result expression. For these cases
+  // we fall back to a simpler naming scheme. This can happen in IR-generated constructors.
+  not exists(op.getDef().getUnconvertedResultExpression()) and
+  (
+    result = "Argument " + op.(PositionalArgumentOperand).getIndex()
+    or
+    op instanceof ThisArgumentOperand and result = "Argument this"
+  )
+}
+
+private class SideEffectArgumentNode extends ArgumentNode, SideEffectOperandNode {
+  override predicate argumentOf(DataFlowCall dfCall, ArgumentPosition pos) {
+    this.getCallInstruction() = dfCall and
+    pos.(IndirectionPosition).getArgumentIndex() = this.getArgumentIndex() and
+    pos.(IndirectionPosition).getIndirectionIndex() = super.getIndirectionIndex()
+  }
+
+  override string toStringImpl() {
+    result = argumentOperandToString(this.getAddressOperand()) + " indirection"
+  }
+}
+
+/** A parameter position represented by an integer. */
+class ParameterPosition = Position;
+
+/** An argument position represented by an integer. */
+class ArgumentPosition = Position;
+
+class Position extends TPosition {
+  abstract string toString();
+}
+
+class DirectPosition extends Position, TDirectPosition {
+  int index;
+
+  DirectPosition() { this = TDirectPosition(index) }
+
+  override string toString() { if index = -1 then result = "this" else result = index.toString() }
+
+  int getIndex() { result = index }
+}
+
+class IndirectionPosition extends Position, TIndirectionPosition {
+  int argumentIndex;
+  int indirectionIndex;
+
+  IndirectionPosition() { this = TIndirectionPosition(argumentIndex, indirectionIndex) }
+
+  override string toString() {
+    if argumentIndex = -1
+    then if indirectionIndex > 0 then result = "this indirection" else result = "this"
+    else
+      if indirectionIndex > 0
+      then result = argumentIndex.toString() + " indirection"
+      else result = argumentIndex.toString()
+  }
+
+  int getArgumentIndex() { result = argumentIndex }
+
+  int getIndirectionIndex() { result = indirectionIndex }
+}
+
+newtype TPosition =
+  TDirectPosition(int index) { exists(any(CallInstruction c).getArgument(index)) } or
+  TIndirectionPosition(int argumentIndex, int indirectionIndex) {
+    hasOperandAndIndex(_, any(CallInstruction call).getArgumentOperand(argumentIndex),
+      indirectionIndex)
+  }
+
+private newtype TReturnKind =
+  TNormalReturnKind(int index) {
+    exists(IndirectReturnNode return |
+      return.getAddressOperand() = any(ReturnValueInstruction r).getReturnAddressOperand() and
+      index = return.getIndirectionIndex() - 1 // We subtract one because the return loads the value.
+    )
+  } or
+  TIndirectReturnKind(int argumentIndex, int indirectionIndex) {
+    exists(IndirectReturnNode return, ReturnIndirectionInstruction returnInd |
+      returnInd.hasIndex(argumentIndex) and
+      return.getAddressOperand() = returnInd.getSourceAddressOperand() and
+      indirectionIndex = return.getIndirectionIndex() - 1 // We subtract one because the return loads the value.
+    )
+  }
+
+/**
+ * A return kind. A return kind describes how a value can be returned
+ * from a callable. For C++, this is simply a function return.
+ */
+class ReturnKind extends TReturnKind {
+  /** Gets a textual representation of this return kind. */
+  abstract string toString();
+}
+
+private class NormalReturnKind extends ReturnKind, TNormalReturnKind {
+  int index;
+
+  NormalReturnKind() { this = TNormalReturnKind(index) }
+
+  override string toString() { result = "indirect return" }
+}
+
+private class IndirectReturnKind extends ReturnKind, TIndirectReturnKind {
+  int argumentIndex;
+  int indirectionIndex;
+
+  IndirectReturnKind() { this = TIndirectReturnKind(argumentIndex, indirectionIndex) }
+
+  override string toString() { result = "indirect outparam[" + argumentIndex.toString() + "]" }
+}
+
+/** A data flow node that occurs as the result of a `ReturnStmt`. */
+class ReturnNode extends Node instanceof IndirectReturnNode {
+  /** Gets the kind of this returned value. */
+  abstract ReturnKind getKind();
+}
+
+/**
+ * This predicate represents an annoying hack that we have to do. We use the
+ * `ReturnIndirectionInstruction` to determine which variables need flow back
+ * out of a function. However, the IR will unconditionally create those for a
+ * variable passed to a function even though the variable was never updated by
+ * the function. And if a function has too many `ReturnNode`s the dataflow
+ * library lowers its precision for that function by disabling field flow.
+ *
+ * So we those eliminate `ReturnNode`s that would have otherwise been created
+ * by this unconditional `ReturnIndirectionInstruction` by requiring that there
+ * must exist an SSA definition of the IR variable in the function.
+ */
+private predicate hasNonInitializeParameterDef(IRVariable v) {
+  exists(Ssa::Def def |
+    not def.getDefiningInstruction() instanceof InitializeParameterInstruction and
+    v = def.getSourceVariable().getBaseVariable().(Ssa::BaseIRVariable).getIRVariable()
+  )
+}
+
+class ReturnIndirectionNode extends IndirectReturnNode, ReturnNode {
+  override ReturnKind getKind() {
+    exists(int argumentIndex, ReturnIndirectionInstruction returnInd |
+      returnInd.hasIndex(argumentIndex) and
+      this.getAddressOperand() = returnInd.getSourceAddressOperand() and
+      result = TIndirectReturnKind(argumentIndex, this.getIndirectionIndex() - 1) and
+      hasNonInitializeParameterDef(returnInd.getIRVariable())
+    )
+    or
+    this.getAddressOperand() = any(ReturnValueInstruction r).getReturnAddressOperand() and
+    result = TNormalReturnKind(this.getIndirectionIndex() - 1)
+  }
+}
+
+private Operand fullyConvertedCallStep(Operand op) {
+  not exists(getANonConversionUse(op)) and
+  exists(Instruction instr |
+    conversionFlow(op, instr, _) and
+    result = getAUse(instr)
+  )
+}
+
+/**
+ * Gets the instruction that uses this operand, if the instruction is not
+ * ignored for dataflow purposes.
+ */
+private Instruction getUse(Operand op) {
+  result = op.getUse() and
+  not Ssa::ignoreOperand(op)
+}
+
+/** Gets a use of the instruction `instr` that is not ignored for dataflow purposes. */
+Operand getAUse(Instruction instr) {
+  result = instr.getAUse() and
+  not Ssa::ignoreOperand(result)
+}
+
+/**
+ * Gets a use of `operand` that is:
+ * - not ignored for dataflow purposes, and
+ * - not a conversion-like instruction.
+ */
+private Instruction getANonConversionUse(Operand operand) {
+  result = getUse(operand) and
+  not conversionFlow(_, result, _)
+}
+
+/**
+ * Gets the operand that represents the first use of the value of `call` following
+ * a sequnce of conversion-like instructions.
+ */
+predicate operandForfullyConvertedCall(Operand operand, CallInstruction call) {
+  exists(getANonConversionUse(operand)) and
+  (
+    operand = getAUse(call)
+    or
+    operand = fullyConvertedCallStep*(getAUse(call))
+  )
+}
+
+/**
+ * Gets the instruction that represents the first use of the value of `call` following
+ * a sequnce of conversion-like instructions.
+ *
+ * This predicate only holds if there is no suitable operand (i.e., no operand of a non-
+ * conversion instruction) to use to represent the value of `call` after conversions.
+ */
+predicate instructionForfullyConvertedCall(Instruction instr, CallInstruction call) {
+  not operandForfullyConvertedCall(_, call) and
+  (
+    // If there is no use of the call then we pick the call instruction
+    not exists(getAUse(call)) and
+    instr = call
+    or
+    // Otherwise, flow to the first non-conversion use.
+    exists(Operand operand | operand = fullyConvertedCallStep*(getAUse(call)) |
+      instr = getANonConversionUse(operand)
+    )
+  )
+}
+
+/** Holds if `node` represents the output node for `call`. */
+private predicate simpleOutNode(Node node, CallInstruction call) {
+  operandForfullyConvertedCall(node.asOperand(), call)
+  or
+  instructionForfullyConvertedCall(node.asInstruction(), call)
+}
+
+/** A data flow node that represents the output of a call. */
+class OutNode extends Node {
+  OutNode() {
+    // Return values not hidden behind indirections
+    simpleOutNode(this, _)
+    or
+    // Return values hidden behind indirections
+    this instanceof IndirectReturnOutNode
+    or
+    // Modified arguments hidden behind indirections
+    this instanceof IndirectArgumentOutNode
+  }
+
+  /** Gets the underlying call. */
+  abstract DataFlowCall getCall();
+
+  abstract ReturnKind getReturnKind();
+}
+
+private class DirectCallOutNode extends OutNode {
+  CallInstruction call;
+
+  DirectCallOutNode() { simpleOutNode(this, call) }
+
+  override DataFlowCall getCall() { result = call }
+
+  override ReturnKind getReturnKind() { result = TNormalReturnKind(0) }
+}
+
+private class IndirectCallOutNode extends OutNode, IndirectReturnOutNode {
+  override DataFlowCall getCall() { result = this.getCallInstruction() }
+
+  override ReturnKind getReturnKind() { result = TNormalReturnKind(this.getIndirectionIndex()) }
+}
+
+private class SideEffectOutNode extends OutNode, IndirectArgumentOutNode {
+  override DataFlowCall getCall() { result = this.getCallInstruction() }
+
+  override ReturnKind getReturnKind() {
+    result = TIndirectReturnKind(this.getArgumentIndex(), this.getIndirectionIndex())
+  }
+}
+
+/**
+ * Gets a node that can read the value returned from `call` with return kind
+ * `kind`.
+ */
+OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
+  result.getCall() = call and
+  result.getReturnKind() = kind
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` in a way that loses the
+ * calling context. For example, this would happen with flow through a
+ * global or static variable.
+ */
+predicate jumpStep(Node n1, Node n2) {
+  exists(Cpp::GlobalOrNamespaceVariable v |
+    v =
+      n1.asInstruction()
+          .(StoreInstruction)
+          .getResultAddress()
+          .(VariableAddressInstruction)
+          .getAstVariable() and
+    v = n2.asVariable()
+    or
+    v =
+      n2.asInstruction()
+          .(LoadInstruction)
+          .getSourceAddress()
+          .(VariableAddressInstruction)
+          .getAstVariable() and
+    v = n1.asVariable()
+  )
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` via an assignment to `f`.
+ * Thus, `node2` references an object with a field `f` that contains the
+ * value of `node1`.
+ */
+predicate storeStep(Node node1, Content c, PostFieldUpdateNode node2) {
+  exists(int indirectionIndex1, int numberOfLoads, StoreInstruction store |
+    nodeHasInstruction(node1, store, pragma[only_bind_into](indirectionIndex1)) and
+    node2.getIndirectionIndex() = 0 and
+    numberOfLoadsFromOperand(node2.getFieldAddress(), store.getDestinationAddressOperand(),
+      numberOfLoads)
+  |
+    exists(FieldContent fc | fc = c |
+      fc.getField() = node2.getUpdatedField() and
+      fc.getIndirectionIndex() = 1 + indirectionIndex1 + numberOfLoads
+    )
+    or
+    exists(UnionContent uc | uc = c |
+      uc.getAField() = node2.getUpdatedField() and
+      uc.getIndirectionIndex() = 1 + indirectionIndex1 + numberOfLoads
+    )
+  )
+}
+
+/**
+ * Holds if `operandFrom` flows to `operandTo` using a sequence of conversion-like
+ * operations and exactly `n` `LoadInstruction` operations.
+ */
+private predicate numberOfLoadsFromOperandRec(Operand operandFrom, Operand operandTo, int ind) {
+  exists(LoadInstruction load | load.getSourceAddressOperand() = operandFrom |
+    operandTo = operandFrom and ind = 0
+    or
+    numberOfLoadsFromOperand(load.getAUse(), operandTo, ind - 1)
+  )
+  or
+  exists(Operand op, Instruction instr |
+    instr = op.getDef() and
+    conversionFlow(operandFrom, instr, _) and
+    numberOfLoadsFromOperand(op, operandTo, ind)
+  )
+}
+
+/**
+ * Holds if `operandFrom` flows to `operandTo` using a sequence of conversion-like
+ * operations and exactly `n` `LoadInstruction` operations.
+ */
+private predicate numberOfLoadsFromOperand(Operand operandFrom, Operand operandTo, int n) {
+  numberOfLoadsFromOperandRec(operandFrom, operandTo, n)
+  or
+  not any(LoadInstruction load).getSourceAddressOperand() = operandFrom and
+  not conversionFlow(operandFrom, _, _) and
+  operandFrom = operandTo and
+  n = 0
+}
+
+// Needed to join on both an operand and an index at the same time.
+pragma[noinline]
+predicate nodeHasOperand(Node node, Operand operand, int indirectionIndex) {
+  node.asOperand() = operand and indirectionIndex = 0
+  or
+  hasOperandAndIndex(node, operand, indirectionIndex)
+}
+
+// Needed to join on both an instruction and an index at the same time.
+pragma[noinline]
+predicate nodeHasInstruction(Node node, Instruction instr, int indirectionIndex) {
+  node.asInstruction() = instr and indirectionIndex = 0
+  or
+  hasInstructionAndIndex(node, instr, indirectionIndex)
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` via a read of `f`.
+ * Thus, `node1` references an object with a field `f` whose value ends up in
+ * `node2`.
+ */
+predicate readStep(Node node1, Content c, Node node2) {
+  exists(FieldAddress fa1, Operand operand, int numberOfLoads, int indirectionIndex2 |
+    nodeHasOperand(node2, operand, indirectionIndex2) and
+    nodeHasOperand(node1, fa1.getObjectAddressOperand(), _) and
+    numberOfLoadsFromOperand(fa1, operand, numberOfLoads)
+  |
+    exists(FieldContent fc | fc = c |
+      fc.getField() = fa1.getField() and
+      fc.getIndirectionIndex() = indirectionIndex2 + numberOfLoads
+    )
+    or
+    exists(UnionContent uc | uc = c |
+      uc.getAField() = fa1.getField() and
+      uc.getIndirectionIndex() = indirectionIndex2 + numberOfLoads
+    )
+  )
+}
+
+/**
+ * Holds if values stored inside content `c` are cleared at node `n`.
+ */
+predicate clearsContent(Node n, Content c) {
+  none() // stub implementation
+}
+
+/**
+ * Holds if the value that is being tracked is expected to be stored inside content `c`
+ * at node `n`.
+ */
+predicate expectsContent(Node n, ContentSet c) { none() }
+
+/** Gets the type of `n` used for type pruning. */
+IRType getNodeType(Node n) {
+  suppressUnusedNode(n) and
+  result instanceof IRVoidType // stub implementation
+}
+
+/** Gets a string representation of a type returned by `getNodeType`. */
+string ppReprType(IRType t) { none() } // stub implementation
+
+/**
+ * Holds if `t1` and `t2` are compatible, that is, whether data can flow from
+ * a node of type `t1` to a node of type `t2`.
+ */
+pragma[inline]
+predicate compatibleTypes(IRType t1, IRType t2) {
+  any() // stub implementation
+}
+
+private predicate suppressUnusedNode(Node n) { any() }
+
+//////////////////////////////////////////////////////////////////////////////
+// Java QL library compatibility wrappers
+//////////////////////////////////////////////////////////////////////////////
+/** A node that performs a type cast. */
+class CastNode extends Node {
+  CastNode() { none() } // stub implementation
+}
+
+/**
+ * A function that may contain code or a variable that may contain itself. When
+ * flow crosses from one _enclosing callable_ to another, the interprocedural
+ * data-flow library discards call contexts and inserts a node in the big-step
+ * relation used for human-readable path explanations.
+ */
+class DataFlowCallable = Cpp::Declaration;
+
+class DataFlowExpr = Expr;
+
+class DataFlowType = IRType;
+
+/** A function call relevant for data flow. */
+class DataFlowCall extends CallInstruction {
+  Function getEnclosingCallable() { result = this.getEnclosingFunction() }
+}
+
+predicate isUnreachableInCall(Node n, DataFlowCall call) { none() } // stub implementation
+
+int accessPathLimit() { result = 5 }
+
+/**
+ * Holds if access paths with `c` at their head always should be tracked at high
+ * precision. This disables adaptive access path precision for such access paths.
+ */
+predicate forceHighPrecision(Content c) { none() }
+
+/** The unit type. */
+private newtype TUnit = TMkUnit()
+
+/** The trivial type with a single element. */
+class Unit extends TUnit {
+  /** Gets a textual representation of this element. */
+  string toString() { result = "unit" }
+}
+
+/** Holds if `n` should be hidden from path explanations. */
+predicate nodeIsHidden(Node n) { n instanceof OperandNode and not n instanceof ArgumentNode }
+
+class LambdaCallKind = Unit;
+
+/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
+predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) { none() }
+
+/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
+predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { none() }
+
+/** Extra data-flow steps needed for lambda flow analysis. */
+predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
+
+/**
+ * Holds if flow is allowed to pass from parameter `p` and back to itself as a
+ * side-effect, resulting in a summary from `p` to itself.
+ *
+ * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
+ * by default as a heuristic.
+ */
+predicate allowParameterReturnInSelf(ParameterNode p) { none() }
+
+private class MyConsistencyConfiguration extends Consistency::ConsistencyConfiguration {
+  override predicate argHasPostUpdateExclude(ArgumentNode n) {
+    // The rules for whether an IR argument gets a post-update node are too
+    // complex to model here.
+    any()
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
new file mode 100644
index 00000000000..b3b055bc9a1
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -0,0 +1,1346 @@
+/**
+ * Provides C++-specific definitions for use in the data flow library.
+ */
+
+private import cpp
+// The `ValueNumbering` library has to be imported right after `cpp` to ensure
+// that the cached IR gets the same checksum here as it does in queries that use
+// `ValueNumbering` without `DataFlow`.
+private import semmle.code.cpp.ir.ValueNumbering
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.controlflow.IRGuards
+private import semmle.code.cpp.models.interfaces.DataFlow
+private import DataFlowPrivate
+private import ModelUtil
+private import SsaInternals as Ssa
+
+cached
+private module Cached {
+  /**
+   * The IR dataflow graph consists of the following nodes:
+   * - `InstructionNode`, which injects most instructions directly into the dataflow graph.
+   * - `OperandNode`, which similarly injects most operands directly into the dataflow graph.
+   * - `VariableNode`, which is used to model flow through global variables.
+   * - `PostFieldUpdateNode`, which is used to model the state of a field after a value has been stored
+   * into an address after a number of loads.
+   * - `SsaPhiNode`, which represents phi nodes as computed by the shared SSA library.
+   * - `IndirectArgumentOutNode`, which represents the value of an argument (and its indirections) after
+   * it leaves a function call.
+   * - `IndirectOperand`, which represents the value of `operand` after loading the address a number
+   * of times.
+   * - `IndirectInstruction`, which represents the value of `instr` after loading the address a number
+   * of times.
+   */
+  cached
+  newtype TIRDataFlowNode =
+    TInstructionNode(Instruction i) { not Ssa::ignoreInstruction(i) } or
+    TOperandNode(Operand op) { not Ssa::ignoreOperand(op) } or
+    TVariableNode(Variable var) or
+    TPostFieldUpdateNode(FieldAddress operand, int indirectionIndex) {
+      indirectionIndex =
+        [0 .. Ssa::countIndirectionsForCppType(operand.getObjectAddress().getResultLanguageType()) -
+            1]
+    } or
+    TSsaPhiNode(Ssa::PhiNode phi) or
+    TIndirectArgumentOutNode(ArgumentOperand operand, int indirectionIndex) {
+      Ssa::isModifiableByCall(operand) and
+      indirectionIndex = [0 .. Ssa::countIndirectionsForCppType(operand.getLanguageType()) - 1]
+    } or
+    TIndirectOperand(Operand op, int indirectionIndex) {
+      Ssa::hasIndirectOperand(op, indirectionIndex)
+    } or
+    TIndirectInstruction(Instruction instr, int indirectionIndex) {
+      Ssa::hasIndirectInstruction(instr, indirectionIndex)
+    }
+}
+
+/**
+ * An operand that is defined by a `FieldAddressInstruction`.
+ */
+class FieldAddress extends Operand {
+  FieldAddressInstruction fai;
+
+  FieldAddress() { fai = this.getDef() }
+
+  /** Gets the field associated with this instruction. */
+  Field getField() { result = fai.getField() }
+
+  /** Gets the instruction whose result provides the address of the object containing the field. */
+  Instruction getObjectAddress() { result = fai.getObjectAddress() }
+
+  /** Gets the operand that provides the address of the object containing the field. */
+  Operand getObjectAddressOperand() { result = fai.getObjectAddressOperand() }
+}
+
+/**
+ * Holds if `opFrom` is an operand whose value flows to the result of `instrTo`.
+ *
+ * `isPointerArith` is `true` if `instrTo` is a `PointerArithmeticInstruction` and `opFrom`
+ * is the left operand.
+ */
+predicate conversionFlow(Operand opFrom, Instruction instrTo, boolean isPointerArith) {
+  isPointerArith = false and
+  (
+    instrTo.(CopyValueInstruction).getSourceValueOperand() = opFrom
+    or
+    instrTo.(ConvertInstruction).getUnaryOperand() = opFrom
+    or
+    instrTo.(CheckedConvertOrNullInstruction).getUnaryOperand() = opFrom
+    or
+    instrTo.(InheritanceConversionInstruction).getUnaryOperand() = opFrom
+  )
+  or
+  isPointerArith = true and
+  instrTo.(PointerArithmeticInstruction).getLeftOperand() = opFrom
+}
+
+private import Cached
+
+/**
+ * A node in a data flow graph.
+ *
+ * A node can be either an expression, a parameter, or an uninitialized local
+ * variable. Such nodes are created with `DataFlow::exprNode`,
+ * `DataFlow::parameterNode`, and `DataFlow::uninitializedNode` respectively.
+ */
+class Node extends TIRDataFlowNode {
+  /**
+   * INTERNAL: Do not use.
+   */
+  Declaration getEnclosingCallable() { none() } // overridden in subclasses
+
+  /** Gets the function to which this node belongs, if any. */
+  Declaration getFunction() { none() } // overridden in subclasses
+
+  /** Gets the type of this node. */
+  IRType getType() { none() } // overridden in subclasses
+
+  /** Gets the instruction corresponding to this node, if any. */
+  Instruction asInstruction() { result = this.(InstructionNode).getInstruction() }
+
+  /** Gets the operands corresponding to this node, if any. */
+  Operand asOperand() { result = this.(OperandNode).getOperand() }
+
+  /**
+   * Gets the non-conversion expression corresponding to this node, if any.
+   * This predicate only has a result on nodes that represent the value of
+   * evaluating the expression. For data flowing _out of_ an expression, like
+   * when an argument is passed by reference, use `asDefiningArgument` instead
+   * of `asExpr`.
+   *
+   * If this node strictly (in the sense of `asConvertedExpr`) corresponds to
+   * a `Conversion`, then the result is the underlying non-`Conversion` base
+   * expression.
+   */
+  Expr asExpr() { result = this.(ExprNode).getExpr() }
+
+  /**
+   * Gets the non-conversion expression that's indirectly tracked by this node
+   * under `index` number of indirections.
+   */
+  Expr asIndirectExpr(int index) {
+    exists(Operand operand | hasOperandAndIndex(this, operand, index) |
+      result = operand.getDef().getUnconvertedResultExpression()
+    )
+  }
+
+  /**
+   * Gets the non-conversion expression that's indirectly tracked by this node
+   * behind a number of indirections.
+   */
+  Expr asIndirectExpr() { result = this.asIndirectExpr(_) }
+
+  /**
+   * Gets the expression corresponding to this node, if any. The returned
+   * expression may be a `Conversion`.
+   */
+  Expr asConvertedExpr() { result = this.(ExprNode).getConvertedExpr() }
+
+  /**
+   * Gets the expression that's indirectly tracked by this node
+   * behind `index` number of indirections.
+   */
+  Expr asIndirectConvertedExpr(int index) {
+    exists(Operand operand | hasOperandAndIndex(this, operand, index) |
+      result = operand.getDef().getConvertedResultExpression()
+    )
+  }
+
+  /**
+   * Gets the expression that's indirectly tracked by this node behind a
+   * number of indirections.
+   */
+  Expr asIndirectConvertedExpr() { result = this.asIndirectConvertedExpr(_) }
+
+  /**
+   * Gets the argument that defines this `DefinitionByReferenceNode`, if any.
+   * This predicate should be used instead of `asExpr` when referring to the
+   * value of a reference argument _after_ the call has returned. For example,
+   * in `f(&x)`, this predicate will have `&x` as its result for the `Node`
+   * that represents the new value of `x`.
+   */
+  Expr asDefiningArgument() { result = this.asDefiningArgument(_) }
+
+  /**
+   * Gets the argument that defines this `DefinitionByReferenceNode`, if any.
+   *
+   * Unlike `Node::asDefiningArgument/0`, this predicate gets the node representing
+   * the value of the `index`'th indirection after leaving a function. For example,
+   * in:
+   * ```cpp
+   * void f(int**);
+   * ...
+   * int** x = ...;
+   * f(x);
+   * ```
+   * The node `n` such that `n.asDefiningArgument(1)` is the argument `x` will
+   * contain the value of `*x` after `f` has returned, and the node `n` such that
+   * `n.asDefiningArgument(2)` is the argument `x` will contain the value of `**x`
+   * after the `f` has returned.
+   */
+  Expr asDefiningArgument(int index) {
+    // Subtract one because `DefinitionByReferenceNode` is defined to be in
+    // the range `[0 ... n - 1]` for some `n` instead of `[1 ... n]`.
+    this.(DefinitionByReferenceNode).getIndirectionIndex() = index - 1 and
+    result = this.(DefinitionByReferenceNode).getArgument()
+  }
+
+  /**
+   * Gets the the argument going into a function for a node that represents
+   * the indirect value of the argument after `index` loads. For example, in:
+   * ```cpp
+   * void f(int**);
+   * ...
+   * int** x = ...;
+   * f(x);
+   * ```
+   * The node `n` such that `n.asIndirectArgument(1)` represents the value of
+   * `*x` going into `f`, and the node `n` such that `n.asIndirectArgument(2)`
+   * represents the value of `**x` going into `f`.
+   */
+  Expr asIndirectArgument(int index) {
+    this.(SideEffectOperandNode).getIndirectionIndex() = index and
+    result = this.(SideEffectOperandNode).getArgument()
+  }
+
+  /**
+   * Gets the the argument going into a function for a node that represents
+   * the indirect value of the argument after any non-zero number of loads.
+   */
+  Expr asIndirectArgument() { result = this.asIndirectArgument(_) }
+
+  /** Gets the positional parameter corresponding to this node, if any. */
+  Parameter asParameter() { result = asParameter(0) }
+
+  /**
+   * Gets the positional parameter corresponding to the node that represents
+   * the value of the parameter after `index` number of loads, if any. For
+   * example, in:
+   * ```cpp
+   * void f(int** x) { ... }
+   * ```
+   * - The node `n` such that `n.asParameter(0)` is the parameter `x` represents
+   * the value of `x`.
+   * - The node `n` such that `n.asParameter(1)` is the parameter `x` represents
+   * the value of `*x`.
+   * The node `n` such that `n.asParameter(2)` is the parameter `x` represents
+   * the value of `**x`.
+   */
+  Parameter asParameter(int index) {
+    index = 0 and
+    result = this.(ExplicitParameterNode).getParameter()
+    or
+    this.(IndirectParameterNode).getIndirectionIndex() = index and
+    result = this.(IndirectParameterNode).getParameter()
+  }
+
+  /**
+   * Gets the variable corresponding to this node, if any. This can be used for
+   * modeling flow in and out of global variables.
+   */
+  Variable asVariable() { result = this.(VariableNode).getVariable() }
+
+  /**
+   * Gets the expression that is partially defined by this node, if any.
+   *
+   * Partial definitions are created for field stores (`x.y = taint();` is a partial
+   * definition of `x`), and for calls that may change the value of an object (so
+   * `x.set(taint())` is a partial definition of `x`, and `transfer(&x, taint())` is
+   * a partial definition of `&x`).
+   */
+  Expr asPartialDefinition() { result = this.(PartialDefinitionNode).getDefinedExpr() }
+
+  /**
+   * Gets an upper bound on the type of this node.
+   */
+  IRType getTypeBound() { result = this.getType() }
+
+  /** Gets the location of this element. */
+  cached
+  final Location getLocation() { result = this.getLocationImpl() }
+
+  /** INTERNAL: Do not use. */
+  Location getLocationImpl() {
+    none() // overridden by subclasses
+  }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+
+  /** Gets a textual representation of this element. */
+  cached
+  final string toString() { result = this.toStringImpl() }
+
+  /** INTERNAL: Do not use. */
+  string toStringImpl() {
+    none() // overridden by subclasses
+  }
+}
+
+/**
+ * An instruction, viewed as a node in a data flow graph.
+ */
+class InstructionNode extends Node, TInstructionNode {
+  Instruction instr;
+
+  InstructionNode() { this = TInstructionNode(instr) }
+
+  /** Gets the instruction corresponding to this node. */
+  Instruction getInstruction() { result = instr }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override Declaration getFunction() { result = instr.getEnclosingFunction() }
+
+  override IRType getType() { result = instr.getResultIRType() }
+
+  final override Location getLocationImpl() { result = instr.getLocation() }
+
+  override string toStringImpl() {
+    // This predicate is overridden in subclasses. This default implementation
+    // does not use `Instruction.toString` because that's expensive to compute.
+    result = this.getInstruction().getOpcode().toString()
+  }
+}
+
+/**
+ * An operand, viewed as a node in a data flow graph.
+ */
+class OperandNode extends Node, TOperandNode {
+  Operand op;
+
+  OperandNode() { this = TOperandNode(op) }
+
+  /** Gets the operand corresponding to this node. */
+  Operand getOperand() { result = op }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override Declaration getFunction() { result = op.getUse().getEnclosingFunction() }
+
+  override IRType getType() { result = op.getIRType() }
+
+  final override Location getLocationImpl() { result = op.getLocation() }
+
+  override string toStringImpl() { result = this.getOperand().toString() }
+}
+
+/**
+ * INTERNAL: do not use.
+ *
+ * The node representing the value of a field after it has been updated.
+ */
+class PostFieldUpdateNode extends TPostFieldUpdateNode, PartialDefinitionNode {
+  int indirectionIndex;
+  FieldAddress fieldAddress;
+
+  PostFieldUpdateNode() { this = TPostFieldUpdateNode(fieldAddress, indirectionIndex) }
+
+  override Function getFunction() { result = fieldAddress.getUse().getEnclosingFunction() }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override IRType getType() { result = fieldAddress.getIRType() }
+
+  FieldAddress getFieldAddress() { result = fieldAddress }
+
+  Field getUpdatedField() { result = fieldAddress.getField() }
+
+  int getIndirectionIndex() { result = indirectionIndex }
+
+  override Node getPreUpdateNode() {
+    // + 1 because we're storing into an lvalue, and the original node should be the rvalue of
+    // the same address.
+    hasOperandAndIndex(result, pragma[only_bind_into](fieldAddress).getObjectAddressOperand(),
+      indirectionIndex + 1)
+  }
+
+  override Expr getDefinedExpr() {
+    result = fieldAddress.getObjectAddress().getUnconvertedResultExpression()
+  }
+
+  override Location getLocationImpl() { result = fieldAddress.getLocation() }
+
+  override string toStringImpl() { result = this.getPreUpdateNode() + " [post update]" }
+}
+
+/**
+ * INTERNAL: do not use.
+ *
+ * A phi node produced by the shared SSA library, viewed as a node in a data flow graph.
+ */
+class SsaPhiNode extends Node, TSsaPhiNode {
+  Ssa::PhiNode phi;
+
+  SsaPhiNode() { this = TSsaPhiNode(phi) }
+
+  /** Gets the phi node associated with this node. */
+  Ssa::PhiNode getPhiNode() { result = phi }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override Declaration getFunction() { result = phi.getBasicBlock().getEnclosingFunction() }
+
+  override IRType getType() { result instanceof IRVoidType }
+
+  final override Location getLocationImpl() { result = phi.getBasicBlock().getLocation() }
+
+  override string toStringImpl() { result = "Phi" }
+}
+
+/**
+ * INTERNAL: do not use.
+ *
+ * A node representing a value after leaving a function.
+ */
+class SideEffectOperandNode extends Node, IndirectOperand {
+  CallInstruction call;
+  int argumentIndex;
+
+  SideEffectOperandNode() { operand = call.getArgumentOperand(argumentIndex) }
+
+  CallInstruction getCallInstruction() { result = call }
+
+  Operand getAddressOperand() { result = operand }
+
+  int getArgumentIndex() { result = argumentIndex }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override Function getFunction() { result = call.getEnclosingFunction() }
+
+  override IRType getType() { result instanceof IRVoidType }
+
+  Expr getArgument() { result = call.getArgument(argumentIndex).getUnconvertedResultExpression() }
+}
+
+/**
+ * INTERNAL: do not use.
+ *
+ * A node representing an indirection of a parameter.
+ */
+class IndirectParameterNode extends Node, IndirectInstruction {
+  InitializeParameterInstruction init;
+
+  IndirectParameterNode() { this.getInstruction() = init }
+
+  int getArgumentIndex() { init.hasIndex(result) }
+
+  /** Gets the parameter whose indirection is initialized. */
+  Parameter getParameter() { result = init.getParameter() }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override Function getFunction() { result = this.getInstruction().getEnclosingFunction() }
+
+  override IRType getType() { result instanceof IRVoidType }
+
+  override string toStringImpl() {
+    result = this.getParameter().toString() + " indirection"
+    or
+    not exists(this.getParameter()) and
+    result = "this indirection"
+  }
+}
+
+/**
+ * INTERNAL: do not use.
+ *
+ * A node representing the indirection of a value that is
+ * about to be returned from a function.
+ */
+class IndirectReturnNode extends IndirectOperand {
+  IndirectReturnNode() {
+    this.getOperand() = any(ReturnIndirectionInstruction ret).getSourceAddressOperand()
+    or
+    this.getOperand() = any(ReturnValueInstruction ret).getReturnAddressOperand()
+  }
+
+  Operand getAddressOperand() { result = operand }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override IRType getType() { result instanceof IRVoidType }
+}
+
+/**
+ * INTERNAL: do not use.
+ *
+ * A node representing the indirection of a value after it
+ * has been returned from a function.
+ */
+class IndirectArgumentOutNode extends Node, TIndirectArgumentOutNode, PostUpdateNode {
+  ArgumentOperand operand;
+  int indirectionIndex;
+
+  IndirectArgumentOutNode() { this = TIndirectArgumentOutNode(operand, indirectionIndex) }
+
+  int getIndirectionIndex() { result = indirectionIndex }
+
+  int getArgumentIndex() {
+    exists(CallInstruction call | call.getArgumentOperand(result) = operand)
+  }
+
+  Operand getAddressOperand() { result = operand }
+
+  CallInstruction getCallInstruction() { result.getAnArgumentOperand() = operand }
+
+  Function getStaticCallTarget() { result = this.getCallInstruction().getStaticCallTarget() }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override Function getFunction() { result = this.getCallInstruction().getEnclosingFunction() }
+
+  override IRType getType() { result instanceof IRVoidType }
+
+  override Node getPreUpdateNode() { hasOperandAndIndex(result, operand, indirectionIndex + 1) }
+
+  override string toStringImpl() {
+    // This string should be unique enough to be helpful but common enough to
+    // avoid storing too many different strings.
+    result = this.getStaticCallTarget().getName() + " output argument"
+    or
+    not exists(this.getStaticCallTarget()) and
+    result = "output argument"
+  }
+
+  override Location getLocationImpl() { result = operand.getLocation() }
+}
+
+pragma[nomagic]
+predicate indirectReturnOutNodeOperand0(CallInstruction call, Operand operand, int indirectionIndex) {
+  Ssa::hasIndirectInstruction(call, indirectionIndex) and
+  operandForfullyConvertedCall(operand, call)
+}
+
+pragma[nomagic]
+predicate indirectReturnOutNodeInstruction0(
+  CallInstruction call, Instruction instr, int indirectionIndex
+) {
+  Ssa::hasIndirectInstruction(call, indirectionIndex) and
+  instructionForfullyConvertedCall(instr, call)
+}
+
+/**
+ * INTERNAL: do not use.
+ *
+ * A node representing the value of a function call.
+ */
+class IndirectReturnOutNode extends Node {
+  CallInstruction call;
+  int indirectionIndex;
+
+  IndirectReturnOutNode() {
+    // Annoyingly, we need to pick the fully converted value as the output of the function to
+    // make flow through in the shared dataflow library work correctly.
+    exists(Operand operand |
+      indirectReturnOutNodeOperand0(call, operand, indirectionIndex) and
+      hasOperandAndIndex(this, operand, indirectionIndex)
+    )
+    or
+    exists(Instruction instr |
+      indirectReturnOutNodeInstruction0(call, instr, indirectionIndex) and
+      hasInstructionAndIndex(this, instr, indirectionIndex)
+    )
+  }
+
+  CallInstruction getCallInstruction() { result = call }
+
+  int getIndirectionIndex() { result = indirectionIndex }
+}
+
+/**
+ * INTERNAL: Do not use.
+ *
+ * A node that represents the indirect value of an operand in the IR
+ * after `index` number of loads.
+ */
+class IndirectOperand extends Node, TIndirectOperand {
+  Operand operand;
+  int indirectionIndex;
+
+  IndirectOperand() { this = TIndirectOperand(operand, indirectionIndex) }
+
+  /** Gets the underlying instruction. */
+  Operand getOperand() { result = operand }
+
+  int getIndirectionIndex() { result = indirectionIndex }
+
+  override Function getFunction() { result = this.getOperand().getDef().getEnclosingFunction() }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override IRType getType() { result = this.getOperand().getIRType() }
+
+  final override Location getLocationImpl() { result = this.getOperand().getLocation() }
+
+  override string toStringImpl() {
+    result = instructionNode(this.getOperand().getDef()).toStringImpl() + " indirection"
+  }
+}
+
+/**
+ * INTERNAL: Do not use.
+ *
+ * A node that represents the indirect value of an instruction in the IR
+ * after `index` number of loads.
+ */
+class IndirectInstruction extends Node, TIndirectInstruction {
+  Instruction instr;
+  int indirectionIndex;
+
+  IndirectInstruction() { this = TIndirectInstruction(instr, indirectionIndex) }
+
+  /** Gets the underlying instruction. */
+  Instruction getInstruction() { result = instr }
+
+  int getIndirectionIndex() { result = indirectionIndex }
+
+  override Function getFunction() { result = this.getInstruction().getEnclosingFunction() }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override IRType getType() { result = this.getInstruction().getResultIRType() }
+
+  final override Location getLocationImpl() { result = this.getInstruction().getLocation() }
+
+  override string toStringImpl() {
+    result = instructionNode(this.getInstruction()).toStringImpl() + " indirection"
+  }
+}
+
+private predicate isFullyConvertedArgument(Expr e) {
+  e = any(Call call).getAnArgument().getFullyConverted()
+}
+
+private predicate isFullyConvertedCall(Expr e) { e = any(Call call).getFullyConverted() }
+
+/** Holds if `Node::asExpr` should map an some operand node to `e`. */
+private predicate convertedExprMustBeOperand(Expr e) {
+  isFullyConvertedArgument(e)
+  or
+  isFullyConvertedCall(e)
+}
+
+/** Holds if `node` is an `OperandNode` that should map `node.asExpr()` to `e`. */
+predicate exprNodeShouldBeOperand(Node node, Expr e) {
+  e = node.asOperand().getDef().getConvertedResultExpression() and
+  convertedExprMustBeOperand(e)
+}
+
+/**
+ * Holds if `load` is a `LoadInstruction` that is the result of evaluating `e`
+ * and `node` is an `IndirctOperandNode` that should map `node.asExpr()` to `e`.
+ *
+ * We map `e` to `node.asExpr()` when `node` semantically represents the
+ * same value as `load`. A subsequent flow step will flow `node` to
+ * the `LoadInstruction`.
+ */
+private predicate exprNodeShouldBeIndirectOperand(IndirectOperand node, Expr e, LoadInstruction load) {
+  node.getIndirectionIndex() = 1 and
+  e = load.getConvertedResultExpression() and
+  load.getSourceAddressOperand() = node.getOperand() and
+  not convertedExprMustBeOperand(e)
+}
+
+/** Holds if `node` should be an instruction node that maps `node.asExpr()` to `e`. */
+predicate exprNodeShouldBeInstruction(Node node, Expr e) {
+  e = node.asInstruction().getConvertedResultExpression() and
+  not exprNodeShouldBeOperand(_, e) and
+  not exprNodeShouldBeIndirectOperand(_, e, _)
+}
+
+private class ExprNodeBase extends Node {
+  Expr getConvertedExpr() { none() } // overridden by subclasses
+
+  Expr getExpr() { none() } // overridden by subclasses
+}
+
+private class InstructionExprNode extends ExprNodeBase, InstructionNode {
+  InstructionExprNode() { exprNodeShouldBeInstruction(this, _) }
+
+  final override Expr getConvertedExpr() { exprNodeShouldBeInstruction(this, result) }
+
+  final override Expr getExpr() { result = this.getInstruction().getUnconvertedResultExpression() }
+
+  final override string toStringImpl() { result = this.getConvertedExpr().toString() }
+}
+
+private class OperandExprNode extends ExprNodeBase, OperandNode {
+  OperandExprNode() { exprNodeShouldBeOperand(this, _) }
+
+  final override Expr getConvertedExpr() { exprNodeShouldBeOperand(this, result) }
+
+  final override Expr getExpr() {
+    result = this.getOperand().getDef().getUnconvertedResultExpression()
+  }
+
+  final override string toStringImpl() {
+    // Avoid generating multiple `toString` results for `ArgumentNode`s
+    // since they have a better `toString`.
+    result = this.(ArgumentNode).toStringImpl()
+    or
+    not this instanceof ArgumentNode and
+    result = this.getConvertedExpr().toString()
+  }
+}
+
+private class IndirectOperandExprNode extends ExprNodeBase, IndirectOperand {
+  LoadInstruction load;
+
+  IndirectOperandExprNode() { exprNodeShouldBeIndirectOperand(this, _, load) }
+
+  final override Expr getConvertedExpr() { exprNodeShouldBeIndirectOperand(this, result, load) }
+
+  final override Expr getExpr() { result = load.getUnconvertedResultExpression() }
+
+  final override string toStringImpl() { result = this.getConvertedExpr().toString() }
+}
+
+/**
+ * An expression, viewed as a node in a data flow graph.
+ */
+class ExprNode extends Node instanceof ExprNodeBase {
+  /**
+   * Gets the non-conversion expression corresponding to this node, if any. If
+   * this node strictly (in the sense of `getConvertedExpr`) corresponds to a
+   * `Conversion`, then the result is that `Conversion`'s non-`Conversion` base
+   * expression.
+   */
+  Expr getExpr() { result = super.getExpr() }
+
+  /**
+   * Gets the expression corresponding to this node, if any. The returned
+   * expression may be a `Conversion`.
+   */
+  Expr getConvertedExpr() { result = super.getConvertedExpr() }
+}
+
+/**
+ * The value of a parameter at function entry, viewed as a node in a data
+ * flow graph. This includes both explicit parameters such as `x` in `f(x)`
+ * and implicit parameters such as `this` in `x.f()`.
+ *
+ * To match a specific kind of parameter, consider using one of the subclasses
+ * `ExplicitParameterNode`, `ThisParameterNode`, or
+ * `ParameterIndirectionNode`.
+ */
+class ParameterNode extends Node {
+  ParameterNode() {
+    // To avoid making this class abstract, we enumerate its values here
+    this.asInstruction() instanceof InitializeParameterInstruction
+    or
+    this instanceof IndirectParameterNode
+  }
+
+  /**
+   * Holds if this node is the parameter of `f` at the specified position. The
+   * implicit `this` parameter is considered to have position `-1`, and
+   * pointer-indirection parameters are at further negative positions.
+   */
+  predicate isParameterOf(Function f, ParameterPosition pos) { none() } // overridden by subclasses
+}
+
+/** An explicit positional parameter, not including `this` or `...`. */
+private class ExplicitParameterNode extends ParameterNode, InstructionNode {
+  override InitializeParameterInstruction instr;
+
+  ExplicitParameterNode() { exists(instr.getParameter()) }
+
+  override predicate isParameterOf(Function f, ParameterPosition pos) {
+    f.getParameter(pos.(DirectPosition).getIndex()) = instr.getParameter()
+  }
+
+  /** Gets the `Parameter` associated with this node. */
+  Parameter getParameter() { result = instr.getParameter() }
+
+  override string toStringImpl() { result = instr.getParameter().toString() }
+}
+
+/** An implicit `this` parameter. */
+class ThisParameterNode extends ParameterNode, InstructionNode {
+  override InitializeParameterInstruction instr;
+
+  ThisParameterNode() { instr.getIRVariable() instanceof IRThisVariable }
+
+  override predicate isParameterOf(Function f, ParameterPosition pos) {
+    pos.(DirectPosition).getIndex() = -1 and instr.getEnclosingFunction() = f
+  }
+
+  override string toStringImpl() { result = "this" }
+}
+
+pragma[noinline]
+private predicate indirectPostionHasArgumentIndexAndIndex(
+  IndirectionPosition pos, int argumentIndex, int indirectionIndex
+) {
+  pos.getArgumentIndex() = argumentIndex and
+  pos.getIndirectionIndex() = indirectionIndex
+}
+
+pragma[noinline]
+private predicate indirectParameterNodeHasArgumentIndexAndIndex(
+  IndirectParameterNode node, int argumentIndex, int indirectionIndex
+) {
+  node.getArgumentIndex() = argumentIndex and
+  node.getIndirectionIndex() = indirectionIndex
+}
+
+/** A synthetic parameter to model the pointed-to object of a pointer parameter. */
+class ParameterIndirectionNode extends ParameterNode instanceof IndirectParameterNode {
+  override predicate isParameterOf(Function f, ParameterPosition pos) {
+    IndirectParameterNode.super.getEnclosingCallable() = f and
+    exists(int argumentIndex, int indirectionIndex |
+      indirectPostionHasArgumentIndexAndIndex(pos, argumentIndex, indirectionIndex) and
+      indirectParameterNodeHasArgumentIndexAndIndex(this, argumentIndex, indirectionIndex)
+    )
+  }
+}
+
+/**
+ * A node associated with an object after an operation that might have
+ * changed its state.
+ *
+ * This can be either the argument to a callable after the callable returns
+ * (which might have mutated the argument), or the qualifier of a field after
+ * an update to the field.
+ *
+ * Nodes corresponding to AST elements, for example `ExprNode`, usually refer
+ * to the value before the update with the exception of `ClassInstanceExpr`,
+ * which represents the value after the constructor has run.
+ */
+abstract class PostUpdateNode extends Node {
+  /**
+   * Gets the node before the state update.
+   */
+  abstract Node getPreUpdateNode();
+}
+
+/**
+ * The base class for nodes that perform "partial definitions".
+ *
+ * In contrast to a normal "definition", which provides a new value for
+ * something, a partial definition is an expression that may affect a
+ * value, but does not necessarily replace it entirely. For example:
+ * ```
+ * x.y = 1; // a partial definition of the object `x`.
+ * x.y.z = 1; // a partial definition of the object `x.y` and `x`.
+ * x.setY(1); // a partial definition of the object `x`.
+ * setY(&x); // a partial definition of the object `x`.
+ * ```
+ */
+abstract private class PartialDefinitionNode extends PostUpdateNode {
+  abstract Expr getDefinedExpr();
+}
+
+/**
+ * A node that represents the value of a variable after a function call that
+ * may have changed the variable because it's passed by reference.
+ *
+ * A typical example would be a call `f(&x)`. Firstly, there will be flow into
+ * `x` from previous definitions of `x`. Secondly, there will be a
+ * `DefinitionByReferenceNode` to represent the value of `x` after the call has
+ * returned. This node will have its `getArgument()` equal to `&x` and its
+ * `getVariableAccess()` equal to `x`.
+ */
+class DefinitionByReferenceNode extends IndirectArgumentOutNode {
+  /** Gets the unconverted argument corresponding to this node. */
+  Expr getArgument() { result = this.getAddressOperand().getDef().getUnconvertedResultExpression() }
+
+  /** Gets the parameter through which this value is assigned. */
+  Parameter getParameter() {
+    result = this.getCallInstruction().getStaticCallTarget().getParameter(this.getArgumentIndex())
+  }
+}
+
+/**
+ * A `Node` corresponding to a variable in the program, as opposed to the
+ * value of that variable at some particular point. This can be used for
+ * modeling flow in and out of global variables.
+ */
+class VariableNode extends Node, TVariableNode {
+  Variable v;
+
+  VariableNode() { this = TVariableNode(v) }
+
+  /** Gets the variable corresponding to this node. */
+  Variable getVariable() { result = v }
+
+  override Declaration getFunction() { none() }
+
+  override Declaration getEnclosingCallable() {
+    // When flow crosses from one _enclosing callable_ to another, the
+    // interprocedural data-flow library discards call contexts and inserts a
+    // node in the big-step relation used for human-readable path explanations.
+    // Therefore we want a distinct enclosing callable for each `VariableNode`,
+    // and that can be the `Variable` itself.
+    result = v
+  }
+
+  override IRType getType() { result.getCanonicalLanguageType().hasUnspecifiedType(v.getType(), _) }
+
+  final override Location getLocationImpl() { result = v.getLocation() }
+
+  override string toStringImpl() { result = v.toString() }
+}
+
+/**
+ * Gets the node corresponding to `instr`.
+ */
+InstructionNode instructionNode(Instruction instr) { result.getInstruction() = instr }
+
+/**
+ * Gets the node corresponding to `operand`.
+ */
+OperandNode operandNode(Operand operand) { result.getOperand() = operand }
+
+/**
+ * Gets the `Node` corresponding to the value of evaluating `e` or any of its
+ * conversions. There is no result if `e` is a `Conversion`. For data flowing
+ * _out of_ an expression, like when an argument is passed by reference, use
+ * `definitionByReferenceNodeFromArgument` instead.
+ */
+ExprNode exprNode(Expr e) { result.getExpr() = e }
+
+/**
+ * Gets the `Node` corresponding to the value of evaluating `e`. Here, `e` may
+ * be a `Conversion`. For data flowing _out of_ an expression, like when an
+ * argument is passed by reference, use
+ * `definitionByReferenceNodeFromArgument` instead.
+ */
+ExprNode convertedExprNode(Expr e) { result.getConvertedExpr() = e }
+
+/**
+ * Gets the `Node` corresponding to the value of `p` at function entry.
+ */
+ExplicitParameterNode parameterNode(Parameter p) { result.getParameter() = p }
+
+/**
+ * Gets the `Node` corresponding to a definition by reference of the variable
+ * that is passed as unconverted `argument` of a call.
+ */
+DefinitionByReferenceNode definitionByReferenceNodeFromArgument(Expr argument) {
+  result.getArgument() = argument
+}
+
+/** Gets the `VariableNode` corresponding to the variable `v`. */
+VariableNode variableNode(Variable v) { result.getVariable() = v }
+
+/**
+ * DEPRECATED: See UninitializedNode.
+ *
+ * Gets the `Node` corresponding to the value of an uninitialized local
+ * variable `v`.
+ */
+Node uninitializedNode(LocalVariable v) { none() }
+
+/**
+ * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
+ * (intra-procedural) step.
+ */
+predicate localFlowStep = simpleLocalFlowStep/2;
+
+private predicate indirectionOperandFlow(IndirectOperand nodeFrom, Node nodeTo) {
+  // Reduce the indirection count by 1 if we're passing through a `LoadInstruction`.
+  exists(int ind, LoadInstruction load |
+    hasOperandAndIndex(nodeFrom, load.getSourceAddressOperand(), ind) and
+    nodeHasInstruction(nodeTo, load, ind - 1)
+  )
+  or
+  // If an operand flows to an instruction, then the indirection of
+  // the operand also flows to the indirction of the instruction.
+  exists(Operand operand, Instruction instr, int indirectionIndex |
+    simpleInstructionLocalFlowStep(operand, instr) and
+    hasOperandAndIndex(nodeFrom, operand, indirectionIndex) and
+    hasInstructionAndIndex(nodeTo, instr, indirectionIndex)
+  )
+  or
+  // If there's indirect flow to an operand, then there's also indirect
+  // flow to the operand after applying some pointer arithmetic.
+  exists(PointerArithmeticInstruction pointerArith, int indirectionIndex |
+    hasOperandAndIndex(nodeFrom, pointerArith.getAnOperand(), indirectionIndex) and
+    hasInstructionAndIndex(nodeTo, pointerArith, indirectionIndex)
+  )
+}
+
+pragma[noinline]
+predicate hasOperandAndIndex(IndirectOperand indirectOperand, Operand operand, int indirectionIndex) {
+  indirectOperand.getOperand() = operand and
+  indirectOperand.getIndirectionIndex() = indirectionIndex
+}
+
+pragma[noinline]
+predicate hasInstructionAndIndex(
+  IndirectInstruction indirectInstr, Instruction instr, int indirectionIndex
+) {
+  indirectInstr.getInstruction() = instr and
+  indirectInstr.getIndirectionIndex() = indirectionIndex
+}
+
+private predicate indirectionInstructionFlow(IndirectInstruction nodeFrom, IndirectOperand nodeTo) {
+  // If there's flow from an instruction to an operand, then there's also flow from the
+  // indirect instruction to the indirect operand.
+  exists(Operand operand, Instruction instr, int indirectionIndex |
+    simpleOperandLocalFlowStep(pragma[only_bind_into](instr), pragma[only_bind_into](operand))
+  |
+    hasOperandAndIndex(nodeTo, operand, indirectionIndex) and
+    hasInstructionAndIndex(nodeFrom, instr, indirectionIndex)
+  )
+}
+
+/**
+ * INTERNAL: do not use.
+ *
+ * This is the local flow predicate that's used as a building block in global
+ * data flow. It may have less flow than the `localFlowStep` predicate.
+ */
+predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
+  // Post update node -> Node flow
+  Ssa::ssaFlow(nodeFrom.(PostUpdateNode).getPreUpdateNode(), nodeTo)
+  or
+  // Def-use/Use-use flow
+  Ssa::ssaFlow(nodeFrom, nodeTo)
+  or
+  // Operand -> Instruction flow
+  simpleInstructionLocalFlowStep(nodeFrom.asOperand(), nodeTo.asInstruction())
+  or
+  // Instruction -> Operand flow
+  simpleOperandLocalFlowStep(nodeFrom.asInstruction(), nodeTo.asOperand())
+  or
+  // Phi node -> Node flow
+  Ssa::fromPhiNode(nodeFrom, nodeTo)
+  or
+  // Indirect operand -> (indirect) instruction flow
+  indirectionOperandFlow(nodeFrom, nodeTo)
+  or
+  // Indirect instruction -> indirect operand flow
+  indirectionInstructionFlow(nodeFrom, nodeTo)
+  or
+  // Flow through modeled functions
+  modelFlow(nodeFrom, nodeTo)
+  or
+  // Reverse flow: data that flows from the definition node back into the indirection returned
+  // by a function. This allows data to flow 'in' through references returned by a modeled
+  // function such as `operator[]`.
+  exists(Operand address, int indirectionIndex |
+    nodeHasOperand(nodeTo.(IndirectReturnOutNode), address, indirectionIndex)
+  |
+    exists(StoreInstruction store |
+      nodeHasInstruction(nodeFrom, store, indirectionIndex - 1) and
+      store.getDestinationAddressOperand() = address
+    )
+    or
+    Ssa::outNodeHasAddressAndIndex(nodeFrom, address, indirectionIndex - 1)
+  )
+}
+
+pragma[noinline]
+private predicate getAddressType(LoadInstruction load, Type t) {
+  exists(Instruction address |
+    address = load.getSourceAddress() and
+    t = address.getResultType()
+  )
+}
+
+/**
+ * Like the AST dataflow library, we want to conflate the address and value of a reference. This class
+ * represents the `LoadInstruction` that is generated from a reference dereference.
+ */
+private class ReferenceDereferenceInstruction extends LoadInstruction {
+  ReferenceDereferenceInstruction() {
+    exists(ReferenceType ref |
+      getAddressType(this, ref) and
+      this.getResultType() = ref.getBaseType()
+    )
+  }
+}
+
+private predicate simpleInstructionLocalFlowStep(Operand opFrom, Instruction iTo) {
+  // Treat all conversions as flow, even conversions between different numeric types.
+  conversionFlow(opFrom, iTo, false)
+  or
+  iTo.(CopyInstruction).getSourceValueOperand() = opFrom
+  or
+  // Conflate references and values like in AST dataflow.
+  iTo.(ReferenceDereferenceInstruction).getSourceAddressOperand() = opFrom
+}
+
+private predicate simpleOperandLocalFlowStep(Instruction iFrom, Operand opTo) {
+  not opTo instanceof MemoryOperand and
+  opTo.getDef() = iFrom
+}
+
+private predicate modelFlow(Node nodeFrom, Node nodeTo) {
+  exists(
+    CallInstruction call, DataFlowFunction func, FunctionInput modelIn, FunctionOutput modelOut
+  |
+    call.getStaticCallTarget() = func and
+    func.hasDataFlow(modelIn, modelOut)
+  |
+    nodeFrom = callInput(call, modelIn) and
+    nodeTo = callOutput(call, modelOut)
+    or
+    exists(int d |
+      nodeFrom = callInput(call, modelIn, d) and
+      nodeTo = callOutput(call, modelOut, d)
+    )
+  )
+}
+
+/**
+ * Holds if data flows from `source` to `sink` in zero or more local
+ * (intra-procedural) steps.
+ */
+pragma[inline]
+predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
+
+/**
+ * Holds if data can flow from `i1` to `i2` in zero or more
+ * local (intra-procedural) steps.
+ */
+pragma[inline]
+predicate localInstructionFlow(Instruction e1, Instruction e2) {
+  localFlow(instructionNode(e1), instructionNode(e2))
+}
+
+/**
+ * Holds if data can flow from `e1` to `e2` in zero or more
+ * local (intra-procedural) steps.
+ */
+pragma[inline]
+predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
+
+cached
+private newtype TContent =
+  TFieldContent(Field f, int indirectionIndex) {
+    indirectionIndex = [1 .. Ssa::getMaxIndirectionsForType(f.getUnspecifiedType())] and
+    // Reads and writes of union fields are tracked using `UnionContent`.
+    not f.getDeclaringType() instanceof Union
+  } or
+  TUnionContent(Union u, int indirectionIndex) {
+    // We key `UnionContent` by the union instead of its fields since a write to one
+    // field can be read by any read of the union's fields.
+    indirectionIndex =
+      [1 .. max(Ssa::getMaxIndirectionsForType(u.getAField().getUnspecifiedType()))]
+  } or
+  TCollectionContent() or // Not used in C/C++
+  TArrayContent() // Not used in C/C++.
+
+/**
+ * A description of the way data may be stored inside an object. Examples
+ * include instance fields, the contents of a collection object, or the contents
+ * of an array.
+ */
+class Content extends TContent {
+  /** Gets a textual representation of this element. */
+  abstract string toString();
+
+  predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
+    path = "" and sl = 0 and sc = 0 and el = 0 and ec = 0
+  }
+}
+
+/** A reference through a non-union instance field. */
+class FieldContent extends Content, TFieldContent {
+  Field f;
+  int indirectionIndex;
+
+  FieldContent() { this = TFieldContent(f, indirectionIndex) }
+
+  override string toString() {
+    indirectionIndex = 1 and result = f.toString()
+    or
+    indirectionIndex > 1 and result = f.toString() + " indirection"
+  }
+
+  Field getField() { result = f }
+
+  pragma[inline]
+  int getIndirectionIndex() {
+    pragma[only_bind_into](result) = pragma[only_bind_out](indirectionIndex)
+  }
+}
+
+/** A reference through an instance field of a union. */
+class UnionContent extends Content, TUnionContent {
+  Union u;
+  int indirectionIndex;
+
+  UnionContent() { this = TUnionContent(u, indirectionIndex) }
+
+  override string toString() {
+    indirectionIndex = 1 and result = u.toString()
+    or
+    indirectionIndex > 1 and result = u.toString() + " indirection"
+  }
+
+  Field getAField() { result = u.getAField() }
+
+  pragma[inline]
+  int getIndirectionIndex() {
+    pragma[only_bind_into](result) = pragma[only_bind_out](indirectionIndex)
+  }
+}
+
+/** A reference through an array. */
+class ArrayContent extends Content, TArrayContent {
+  override string toString() { result = "[]" }
+}
+
+/** A reference through the contents of some collection-like container. */
+private class CollectionContent extends Content, TCollectionContent {
+  override string toString() { result = "<element>" }
+}
+
+/**
+ * An entity that represents a set of `Content`s.
+ *
+ * The set may be interpreted differently depending on whether it is
+ * stored into (`getAStoreContent`) or read from (`getAReadContent`).
+ */
+class ContentSet instanceof Content {
+  /** Gets a content that may be stored into when storing into this set. */
+  Content getAStoreContent() { result = this }
+
+  /** Gets a content that may be read from when reading from this set. */
+  Content getAReadContent() { result = this }
+
+  /** Gets a textual representation of this content set. */
+  string toString() { result = super.toString() }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
+    super.hasLocationInfo(path, sl, sc, el, ec)
+  }
+}
+
+private IRBlock getBasicBlock(Node node) {
+  node.asInstruction().getBlock() = result
+  or
+  node.asOperand().getUse().getBlock() = result
+  or
+  node.(SsaPhiNode).getPhiNode().getBasicBlock() = result
+  or
+  node.(IndirectOperand).getOperand().getUse().getBlock() = result
+  or
+  node.(IndirectInstruction).getInstruction().getBlock() = result
+  or
+  result = getBasicBlock(node.(PostUpdateNode).getPreUpdateNode())
+}
+
+/**
+ * Holds if the guard `g` validates the expression `e` upon evaluating to `branch`.
+ *
+ * The expression `e` is expected to be a syntactic part of the guard `g`.
+ * For example, the guard `g` might be a call `isSafe(x)` and the expression `e`
+ * the argument `x`.
+ */
+signature predicate guardChecksSig(IRGuardCondition g, Expr e, boolean branch);
+
+/**
+ * Provides a set of barrier nodes for a guard that validates an expression.
+ *
+ * This is expected to be used in `isBarrier`/`isSanitizer` definitions
+ * in data flow and taint tracking.
+ */
+module BarrierGuard<guardChecksSig/3 guardChecks> {
+  /** Gets a node that is safely guarded by the given guard check. */
+  ExprNode getABarrierNode() {
+    exists(IRGuardCondition g, Expr e, ValueNumber value, boolean edge |
+      e = value.getAnInstruction().getConvertedResultExpression() and
+      result.getConvertedExpr() = e and
+      guardChecks(g, value.getAnInstruction().getConvertedResultExpression(), edge) and
+      g.controls(getBasicBlock(result), edge)
+    )
+  }
+}
+
+/**
+ * Holds if the guard `g` validates the instruction `instr` upon evaluating to `branch`.
+ */
+signature predicate instructionGuardChecksSig(IRGuardCondition g, Instruction instr, boolean branch);
+
+/**
+ * Provides a set of barrier nodes for a guard that validates an instruction.
+ *
+ * This is expected to be used in `isBarrier`/`isSanitizer` definitions
+ * in data flow and taint tracking.
+ */
+module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardChecks> {
+  /** Gets a node that is safely guarded by the given guard check. */
+  ExprNode getABarrierNode() {
+    exists(IRGuardCondition g, ValueNumber value, boolean edge |
+      instructionGuardChecks(g, value.getAnInstruction(), edge) and
+      result.asInstruction() = value.getAnInstruction() and
+      g.controls(result.asInstruction().getBlock(), edge)
+    )
+  }
+}
+
+/**
+ * DEPRECATED: Use `BarrierGuard` module instead.
+ *
+ * A guard that validates some instruction.
+ *
+ * To use this in a configuration, extend the class and provide a
+ * characteristic predicate precisely specifying the guard, and override
+ * `checks` to specify what is being validated and in which branch.
+ *
+ * It is important that all extending classes in scope are disjoint.
+ */
+deprecated class BarrierGuard extends IRGuardCondition {
+  /** Override this predicate to hold if this guard validates `instr` upon evaluating to `b`. */
+  predicate checksInstr(Instruction instr, boolean b) { none() }
+
+  /** Override this predicate to hold if this guard validates `expr` upon evaluating to `b`. */
+  predicate checks(Expr e, boolean b) { none() }
+
+  /** Gets a node guarded by this guard. */
+  final Node getAGuardedNode() {
+    exists(ValueNumber value, boolean edge |
+      (
+        this.checksInstr(value.getAnInstruction(), edge)
+        or
+        this.checks(value.getAnInstruction().getConvertedResultExpression(), edge)
+      ) and
+      result.asInstruction() = value.getAnInstruction() and
+      this.controls(result.asInstruction().getBlock(), edge)
+    )
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll
new file mode 100644
index 00000000000..c302c6ef878
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll
@@ -0,0 +1,93 @@
+/**
+ * Provides predicates for mapping the `FunctionInput` and `FunctionOutput`
+ * classes used in function models to the corresponding instructions.
+ */
+
+private import semmle.code.cpp.ir.IR
+private import experimental.semmle.code.cpp.ir.dataflow.DataFlow
+private import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import SsaInternals as Ssa
+
+/**
+ * Gets the instruction that goes into `input` for `call`.
+ */
+DataFlow::Node callInput(CallInstruction call, FunctionInput input) {
+  // An argument or qualifier
+  exists(int index |
+    result.asOperand() = call.getArgumentOperand(index) and
+    input.isParameterOrQualifierAddress(index)
+  )
+  or
+  // A value pointed to by an argument or qualifier
+  exists(int index, int indirectionIndex |
+    hasOperandAndIndex(result, call.getArgumentOperand(index), indirectionIndex) and
+    input.isParameterDerefOrQualifierObject(index, indirectionIndex)
+  )
+  or
+  exists(int ind |
+    result = getIndirectReturnOutNode(call, ind) and
+    input.isReturnValueDeref(ind)
+  )
+}
+
+/**
+ * Gets the instruction that holds the `output` for `call`.
+ */
+Node callOutput(CallInstruction call, FunctionOutput output) {
+  // The return value
+  result.asInstruction() = call and
+  output.isReturnValue()
+  or
+  // The side effect of a call on the value pointed to by an argument or qualifier
+  exists(int index, int indirectionIndex |
+    result.(IndirectArgumentOutNode).getArgumentIndex() = index and
+    result.(IndirectArgumentOutNode).getIndirectionIndex() + 1 = indirectionIndex and
+    result.(IndirectArgumentOutNode).getCallInstruction() = call and
+    output.isParameterDerefOrQualifierObject(index, indirectionIndex)
+  )
+  or
+  exists(int ind |
+    result = getIndirectReturnOutNode(call, ind) and
+    output.isReturnValueDeref(ind)
+  )
+}
+
+DataFlow::Node callInput(CallInstruction call, FunctionInput input, int d) {
+  exists(DataFlow::Node n | n = callInput(call, input) and d > 0 |
+    // An argument or qualifier
+    hasOperandAndIndex(result, n.asOperand(), d)
+    or
+    exists(Operand operand, int indirectionIndex |
+      // A value pointed to by an argument or qualifier
+      hasOperandAndIndex(n, operand, indirectionIndex) and
+      hasOperandAndIndex(result, operand, indirectionIndex + d)
+    )
+  )
+}
+
+private IndirectReturnOutNode getIndirectReturnOutNode(CallInstruction call, int d) {
+  result.getCallInstruction() = call and
+  result.getIndirectionIndex() = d
+}
+
+/**
+ * Gets the instruction that holds the `output` for `call`.
+ */
+bindingset[d]
+Node callOutput(CallInstruction call, FunctionOutput output, int d) {
+  exists(DataFlow::Node n | n = callOutput(call, output) and d > 0 |
+    // The return value
+    result = getIndirectReturnOutNode(n.asInstruction(), d)
+    or
+    // If there isn't an indirect out node for the call with indirection `d` then
+    // we conflate this with the underlying `CallInstruction`.
+    not exists(getIndirectReturnOutNode(call, d)) and
+    n.asInstruction() = result.asInstruction()
+    or
+    // The side effect of a call on the value pointed to by an argument or qualifier
+    exists(Operand operand, int indirectionIndex |
+      Ssa::outNodeHasAddressAndIndex(n, operand, indirectionIndex) and
+      Ssa::outNodeHasAddressAndIndex(result, operand, indirectionIndex + d)
+    )
+  )
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
new file mode 100644
index 00000000000..7359656e5a4
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
@@ -0,0 +1,136 @@
+private import cpp
+// The `ValueNumbering` library has to be imported right after `cpp` to ensure
+// that the cached IR gets the same checksum here as it does in queries that use
+// `ValueNumbering` without `DataFlow`.
+private import semmle.code.cpp.ir.ValueNumbering
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.DataFlow
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import PrintIRUtilities
+
+/**
+ * Gets the local dataflow from other nodes in the same function to this node.
+ */
+private string getFromFlow(DataFlow::Node useNode, int order1, int order2) {
+  exists(DataFlow::Node defNode, string prefix |
+    (
+      simpleLocalFlowStep(defNode, useNode) and prefix = ""
+      or
+      any(DataFlow::Configuration cfg).isAdditionalFlowStep(defNode, useNode) and
+      defNode.getEnclosingCallable() = useNode.getEnclosingCallable() and
+      prefix = "+"
+    ) and
+    if defNode.asInstruction() = useNode.asOperand().getAnyDef()
+    then
+      // Shorthand for flow from the def of this operand.
+      result = prefix + "def" and
+      order1 = -1 and
+      order2 = 0
+    else
+      if defNode.asOperand().getUse() = useNode.asInstruction()
+      then
+        // Shorthand for flow from an operand of this instruction
+        result = prefix + defNode.asOperand().getDumpId() and
+        order1 = -1 and
+        order2 = defNode.asOperand().getDumpSortOrder()
+      else result = prefix + nodeId(defNode, order1, order2)
+  )
+}
+
+/**
+ * Gets the local dataflow from this node to other nodes in the same function.
+ */
+private string getToFlow(DataFlow::Node defNode, int order1, int order2) {
+  exists(DataFlow::Node useNode, string prefix |
+    (
+      simpleLocalFlowStep(defNode, useNode) and prefix = ""
+      or
+      any(DataFlow::Configuration cfg).isAdditionalFlowStep(defNode, useNode) and
+      defNode.getEnclosingCallable() = useNode.getEnclosingCallable() and
+      prefix = "+"
+    ) and
+    if useNode.asInstruction() = defNode.asOperand().getUse()
+    then
+      // Shorthand for flow to this operand's instruction.
+      result = prefix + "result" and
+      order1 = -1 and
+      order2 = 0
+    else result = prefix + nodeId(useNode, order1, order2)
+  )
+}
+
+/**
+ * Gets the properties of the dataflow node `node`.
+ */
+private string getNodeProperty(DataFlow::Node node, string key) {
+  // List dataflow into and out of this node. Flow into this node is printed as `src->@`, and flow
+  // out of this node is printed as `@->dest`.
+  key = "flow" and
+  result =
+    strictconcat(string flow, boolean to, int order1, int order2 |
+      flow = getFromFlow(node, order1, order2) + "->@" and to = false
+      or
+      flow = "@->" + getToFlow(node, order1, order2) and to = true
+    |
+      flow, ", " order by to, order1, order2, flow
+    )
+  or
+  // Is this node a dataflow sink?
+  key = "sink" and
+  any(DataFlow::Configuration cfg).isSink(node) and
+  result = "true"
+  or
+  // Is this node a dataflow source?
+  key = "source" and
+  any(DataFlow::Configuration cfg).isSource(node) and
+  result = "true"
+  or
+  // Is this node a dataflow barrier, and if so, what kind?
+  key = "barrier" and
+  result =
+    strictconcat(string kind |
+      any(DataFlow::Configuration cfg).isBarrier(node) and kind = "full"
+      or
+      any(DataFlow::Configuration cfg).isBarrierIn(node) and kind = "in"
+      or
+      any(DataFlow::Configuration cfg).isBarrierOut(node) and kind = "out"
+    |
+      kind, ", "
+    )
+  or
+  // Is there partial flow from a source to this node?
+  // This property will only be emitted if partial flow is enabled by overriding
+  // `DataFlow::Configration::explorationLimit()`.
+  key = "pflow" and
+  result =
+    strictconcat(DataFlow::PartialPathNode sourceNode, DataFlow::PartialPathNode destNode, int dist,
+      int order1, int order2 |
+      any(DataFlow::Configuration cfg).hasPartialFlow(sourceNode, destNode, dist) and
+      destNode.getNode() = node and
+      // Only print flow from a source in the same function.
+      sourceNode.getNode().getEnclosingCallable() = node.getEnclosingCallable()
+    |
+      nodeId(sourceNode.getNode(), order1, order2) + "+" + dist.toString(), ", "
+      order by
+        order1, order2, dist desc
+    )
+}
+
+/**
+ * Property provider for local IR dataflow.
+ */
+class LocalFlowPropertyProvider extends IRPropertyProvider {
+  override string getOperandProperty(Operand operand, string key) {
+    exists(DataFlow::Node node |
+      operand = node.asOperand() and
+      result = getNodeProperty(node, key)
+    )
+  }
+
+  override string getInstructionProperty(Instruction instruction, string key) {
+    exists(DataFlow::Node node |
+      instruction = node.asInstruction() and
+      result = getNodeProperty(node, key)
+    )
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll
new file mode 100644
index 00000000000..8c318216217
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll
@@ -0,0 +1,33 @@
+/**
+ * Print the dataflow local store steps in IR dumps.
+ */
+
+private import cpp
+// The `ValueNumbering` library has to be imported right after `cpp` to ensure
+// that the cached IR gets the same checksum here as it does in queries that use
+// `ValueNumbering` without `DataFlow`.
+private import semmle.code.cpp.ir.ValueNumbering
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.DataFlow
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
+private import PrintIRUtilities
+
+/**
+ * Property provider for local IR dataflow store steps.
+ */
+class LocalFlowPropertyProvider extends IRPropertyProvider {
+  override string getInstructionProperty(Instruction instruction, string key) {
+    exists(DataFlow::Node objectNode, Content content |
+      key = "content[" + content.toString() + "]" and
+      instruction = objectNode.asInstruction() and
+      result =
+        strictconcat(string element, DataFlow::Node fieldNode |
+          storeStep(fieldNode, content, objectNode) and
+          element = nodeId(fieldNode, _, _)
+        |
+          element, ", "
+        )
+    )
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll
new file mode 100644
index 00000000000..5fc15cf986c
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll
@@ -0,0 +1,39 @@
+/**
+ * Shared utilities used when printing dataflow annotations in IR dumps.
+ */
+
+private import cpp
+// The `ValueNumbering` library has to be imported right after `cpp` to ensure
+// that the cached IR gets the same checksum here as it does in queries that use
+// `ValueNumbering` without `DataFlow`.
+private import semmle.code.cpp.ir.ValueNumbering
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.DataFlow
+
+/**
+ * Gets a short ID for an IR dataflow node.
+ * - For `Instruction`s, this is just the result ID of the instruction (e.g. `m128`).
+ * - For `Operand`s, this is the label of the operand, prefixed with the result ID of the
+ *   instruction and a dot (e.g. `m128.left`).
+ * - For `Variable`s, this is the qualified name of the variable.
+ */
+string nodeId(DataFlow::Node node, int order1, int order2) {
+  exists(Instruction instruction | instruction = node.asInstruction() |
+    result = instruction.getResultId() and
+    order1 = instruction.getBlock().getDisplayIndex() and
+    order2 = instruction.getDisplayIndexInBlock()
+  )
+  or
+  exists(Operand operand, Instruction instruction |
+    operand = node.asOperand() and
+    instruction = operand.getUse()
+  |
+    result = instruction.getResultId() + "." + operand.getDumpId() and
+    order1 = instruction.getBlock().getDisplayIndex() and
+    order2 = instruction.getDisplayIndexInBlock()
+  )
+  or
+  result = "var(" + node.asVariable().getQualifiedName() + ")" and
+  order1 = 1000000 and
+  order2 = 0
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
new file mode 100644
index 00000000000..61ff5707d77
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
@@ -0,0 +1,547 @@
+private import codeql.ssa.Ssa as SsaImplCommon
+private import semmle.code.cpp.ir.IR
+private import DataFlowUtil
+private import DataFlowImplCommon as DataFlowImplCommon
+private import semmle.code.cpp.models.interfaces.Allocation as Alloc
+private import semmle.code.cpp.models.interfaces.DataFlow as DataFlow
+private import semmle.code.cpp.ir.internal.IRCppLanguage
+private import DataFlowPrivate
+private import ssa0.SsaInternals as SsaInternals0
+import SsaInternalsCommon
+
+private module SourceVariables {
+  int getMaxIndirectionForIRVariable(IRVariable var) {
+    exists(Type type, boolean isGLValue |
+      var.getLanguageType().hasType(type, isGLValue) and
+      if isGLValue = true
+      then result = 1 + getMaxIndirectionsForType(type)
+      else result = getMaxIndirectionsForType(type)
+    )
+  }
+
+  class BaseSourceVariable = SsaInternals0::BaseSourceVariable;
+
+  class BaseIRVariable = SsaInternals0::BaseIRVariable;
+
+  class BaseCallVariable = SsaInternals0::BaseCallVariable;
+
+  cached
+  private newtype TSourceVariable =
+    TSourceIRVariable(BaseIRVariable baseVar, int ind) {
+      ind = [0 .. getMaxIndirectionForIRVariable(baseVar.getIRVariable())]
+    } or
+    TCallVariable(AllocationInstruction call, int ind) {
+      ind = [0 .. countIndirectionsForCppType(getResultLanguageType(call))]
+    }
+
+  abstract class SourceVariable extends TSourceVariable {
+    int ind;
+
+    bindingset[ind]
+    SourceVariable() { any() }
+
+    abstract string toString();
+
+    int getIndirection() { result = ind }
+
+    abstract BaseSourceVariable getBaseVariable();
+  }
+
+  class SourceIRVariable extends SourceVariable, TSourceIRVariable {
+    BaseIRVariable var;
+
+    SourceIRVariable() { this = TSourceIRVariable(var, ind) }
+
+    IRVariable getIRVariable() { result = var.getIRVariable() }
+
+    override BaseIRVariable getBaseVariable() { result.getIRVariable() = this.getIRVariable() }
+
+    override string toString() {
+      ind = 0 and
+      result = this.getIRVariable().toString()
+      or
+      ind > 0 and
+      result = this.getIRVariable().toString() + " indirection"
+    }
+  }
+
+  class CallVariable extends SourceVariable, TCallVariable {
+    AllocationInstruction call;
+
+    CallVariable() { this = TCallVariable(call, ind) }
+
+    AllocationInstruction getCall() { result = call }
+
+    override BaseCallVariable getBaseVariable() { result.getCallInstruction() = call }
+
+    override string toString() {
+      ind = 0 and
+      result = "Call"
+      or
+      ind > 0 and
+      result = "Call indirection"
+    }
+  }
+}
+
+import SourceVariables
+
+predicate hasIndirectOperand(Operand op, int indirectionIndex) {
+  exists(CppType type, int m |
+    not ignoreOperand(op) and
+    type = getLanguageType(op) and
+    m = countIndirectionsForCppType(type) and
+    indirectionIndex = [1 .. m]
+  )
+}
+
+predicate hasIndirectInstruction(Instruction instr, int indirectionIndex) {
+  exists(CppType type, int m |
+    not ignoreInstruction(instr) and
+    type = getResultLanguageType(instr) and
+    m = countIndirectionsForCppType(type) and
+    indirectionIndex = [1 .. m]
+  )
+}
+
+cached
+private newtype TDefOrUseImpl =
+  TDefImpl(Operand address, int indirectionIndex) {
+    isDef(_, _, address, _, _, indirectionIndex) and
+    // We only include the definition if the SSA pruning stage
+    // concluded that the definition is live after the write.
+    any(SsaInternals0::Def def).getAddressOperand() = address
+  } or
+  TUseImpl(Operand operand, int indirectionIndex) {
+    isUse(_, operand, _, _, indirectionIndex) and
+    not isDef(_, _, operand, _, _, _)
+  }
+
+abstract private class DefOrUseImpl extends TDefOrUseImpl {
+  /** Gets a textual representation of this element. */
+  abstract string toString();
+
+  /** Gets the block of this definition or use. */
+  abstract IRBlock getBlock();
+
+  /** Holds if this definition or use has index `index` in block `block`. */
+  abstract predicate hasIndexInBlock(IRBlock block, int index);
+
+  final predicate hasIndexInBlock(IRBlock block, int index, SourceVariable sv) {
+    this.hasIndexInBlock(block, index) and
+    sv = this.getSourceVariable()
+  }
+
+  /** Gets the location of this element. */
+  abstract Cpp::Location getLocation();
+
+  /**
+   * Gets the index (i.e., the number of loads required) of this
+   * definition or use.
+   *
+   * Note that this is _not_ the definition's (or use's) index in
+   * the enclosing basic block. To obtain this index, use
+   * `DefOrUseImpl::hasIndexInBlock/2` or `DefOrUseImpl::hasIndexInBlock/3`.
+   */
+  abstract int getIndirectionIndex();
+
+  /**
+   * Gets the instruction that computes the base of this definition or use.
+   * This is always a `VariableAddressInstruction` or an `AllocationInstruction`.
+   */
+  abstract Instruction getBase();
+
+  final BaseSourceVariable getBaseSourceVariable() {
+    exists(IRVariable var |
+      result.(BaseIRVariable).getIRVariable() = var and
+      instructionHasIRVariable(this.getBase(), var)
+    )
+    or
+    result.(BaseCallVariable).getCallInstruction() = this.getBase()
+  }
+
+  /** Gets the variable that is defined or used. */
+  final SourceVariable getSourceVariable() {
+    exists(BaseSourceVariable v, int ind |
+      sourceVariableHasBaseAndIndex(result, v, ind) and
+      defOrUseHasSourceVariable(this, v, ind)
+    )
+  }
+}
+
+pragma[noinline]
+private predicate instructionHasIRVariable(VariableAddressInstruction vai, IRVariable var) {
+  vai.getIRVariable() = var
+}
+
+private predicate defOrUseHasSourceVariable(DefOrUseImpl defOrUse, BaseSourceVariable bv, int ind) {
+  defHasSourceVariable(defOrUse, bv, ind)
+  or
+  useHasSourceVariable(defOrUse, bv, ind)
+}
+
+pragma[noinline]
+private predicate defHasSourceVariable(DefImpl def, BaseSourceVariable bv, int ind) {
+  bv = def.getBaseSourceVariable() and
+  ind = def.getIndirection()
+}
+
+pragma[noinline]
+private predicate useHasSourceVariable(UseImpl use, BaseSourceVariable bv, int ind) {
+  bv = use.getBaseSourceVariable() and
+  ind = use.getIndirection()
+}
+
+pragma[noinline]
+private predicate sourceVariableHasBaseAndIndex(SourceVariable v, BaseSourceVariable bv, int ind) {
+  v.getBaseVariable() = bv and
+  v.getIndirection() = ind
+}
+
+class DefImpl extends DefOrUseImpl, TDefImpl {
+  Operand address;
+  int ind;
+
+  DefImpl() { this = TDefImpl(address, ind) }
+
+  override Instruction getBase() { isDef(_, _, address, result, _, _) }
+
+  Operand getAddressOperand() { result = address }
+
+  int getIndirection() { isDef(_, _, address, _, result, ind) }
+
+  override int getIndirectionIndex() { result = ind }
+
+  Instruction getDefiningInstruction() { isDef(_, result, address, _, _, _) }
+
+  override string toString() { result = "DefImpl" }
+
+  override IRBlock getBlock() { result = this.getDefiningInstruction().getBlock() }
+
+  override Cpp::Location getLocation() { result = this.getDefiningInstruction().getLocation() }
+
+  final override predicate hasIndexInBlock(IRBlock block, int index) {
+    this.getDefiningInstruction() = block.getInstruction(index)
+  }
+
+  predicate isCertain() { isDef(true, _, address, _, _, ind) }
+}
+
+class UseImpl extends DefOrUseImpl, TUseImpl {
+  Operand operand;
+  int ind;
+
+  UseImpl() { this = TUseImpl(operand, ind) }
+
+  Operand getOperand() { result = operand }
+
+  override string toString() { result = "UseImpl" }
+
+  final override predicate hasIndexInBlock(IRBlock block, int index) {
+    operand.getUse() = block.getInstruction(index)
+  }
+
+  final override IRBlock getBlock() { result = operand.getUse().getBlock() }
+
+  final override Cpp::Location getLocation() { result = operand.getLocation() }
+
+  final int getIndirection() { isUse(_, operand, _, result, ind) }
+
+  override int getIndirectionIndex() { result = ind }
+
+  override Instruction getBase() { isUse(_, operand, result, _, ind) }
+
+  predicate isCertain() { isUse(true, operand, _, _, ind) }
+}
+
+/**
+ * Holds if `defOrUse1` is a definition which is first read by `use`,
+ * or if `defOrUse1` is a use and `use` is a next subsequent use.
+ *
+ * In both cases, `use` can either be an explicit use written in the
+ * source file, or it can be a phi node as computed by the SSA library.
+ */
+predicate adjacentDefRead(DefOrUse defOrUse1, UseOrPhi use) {
+  exists(IRBlock bb1, int i1, SourceVariable v |
+    defOrUse1.asDefOrUse().hasIndexInBlock(bb1, i1, v)
+  |
+    exists(IRBlock bb2, int i2 |
+      adjacentDefRead(_, pragma[only_bind_into](bb1), pragma[only_bind_into](i1),
+        pragma[only_bind_into](bb2), pragma[only_bind_into](i2))
+    |
+      use.asDefOrUse().(UseImpl).hasIndexInBlock(bb2, i2, v)
+    )
+    or
+    exists(PhiNode phi |
+      lastRefRedef(_, bb1, i1, phi) and
+      use.asPhi() = phi and
+      phi.getSourceVariable() = pragma[only_bind_into](v)
+    )
+  )
+}
+
+private predicate useToNode(UseOrPhi use, Node nodeTo) {
+  exists(UseImpl useImpl |
+    useImpl = use.asDefOrUse() and
+    nodeHasOperand(nodeTo, useImpl.getOperand(), useImpl.getIndirectionIndex())
+  )
+  or
+  nodeTo.(SsaPhiNode).getPhiNode() = use.asPhi()
+}
+
+pragma[noinline]
+predicate outNodeHasAddressAndIndex(
+  IndirectArgumentOutNode out, Operand address, int indirectionIndex
+) {
+  out.getAddressOperand() = address and
+  out.getIndirectionIndex() = indirectionIndex
+}
+
+private predicate defToNode(Node nodeFrom, Def def) {
+  nodeHasInstruction(nodeFrom, def.getDefiningInstruction(), def.getIndirectionIndex())
+}
+
+private predicate nodeToDefOrUse(Node nodeFrom, SsaDefOrUse defOrUse) {
+  // Node -> Def
+  defToNode(nodeFrom, defOrUse)
+  or
+  // Node -> Use
+  useToNode(defOrUse, nodeFrom)
+}
+
+/**
+ * Perform a single conversion-like step from `nFrom` to `nTo`. This relation
+ * only holds when there is no use-use relation out of `nTo`.
+ */
+private predicate indirectConversionFlowStep(Node nFrom, Node nTo) {
+  not exists(UseOrPhi defOrUse |
+    nodeToDefOrUse(nTo, defOrUse) and
+    adjacentDefRead(defOrUse, _)
+  ) and
+  exists(Operand op1, Operand op2, int indirectionIndex, Instruction instr |
+    hasOperandAndIndex(nFrom, op1, pragma[only_bind_into](indirectionIndex)) and
+    hasOperandAndIndex(nTo, op2, pragma[only_bind_into](indirectionIndex)) and
+    instr = op2.getDef() and
+    conversionFlow(op1, instr, _)
+  )
+}
+
+/**
+ * The reason for this predicate is a bit annoying:
+ * We cannot mark a `PointerArithmeticInstruction` that computes an offset based on some SSA
+ * variable `x` as a use of `x` since this creates taint-flow in the following example:
+ * ```c
+ * int x = array[source]
+ * sink(*array)
+ * ```
+ * This is because `source` would flow from the operand of `PointerArithmeticInstruction` to the
+ * result of the instruction, and into the `IndirectOperand` that represents the value of `*array`.
+ * Then, via use-use flow, flow will arrive at `*array` in `sink(*array)`.
+ *
+ * So this predicate recurses back along conversions and `PointerArithmeticInstruction`s to find the
+ * first use that has provides use-use flow, and uses that target as the target of the `nodeFrom`.
+ */
+private predicate adjustForPointerArith(Node nodeFrom, UseOrPhi use) {
+  nodeFrom = any(PostUpdateNode pun).getPreUpdateNode() and
+  exists(DefOrUse defOrUse, Node adjusted |
+    indirectConversionFlowStep*(adjusted, nodeFrom) and
+    nodeToDefOrUse(adjusted, defOrUse) and
+    adjacentDefRead(defOrUse, use)
+  )
+}
+
+/** Holds if there is def-use or use-use flow from `nodeFrom` to `nodeTo`. */
+predicate ssaFlow(Node nodeFrom, Node nodeTo) {
+  // `nodeFrom = any(PostUpdateNode pun).getPreUpdateNode()` is implied by adjustedForPointerArith.
+  exists(UseOrPhi use |
+    adjustForPointerArith(nodeFrom, use) and
+    useToNode(use, nodeTo)
+  )
+  or
+  not nodeFrom = any(PostUpdateNode pun).getPreUpdateNode() and
+  exists(DefOrUse defOrUse1, UseOrPhi use |
+    nodeToDefOrUse(nodeFrom, defOrUse1) and
+    adjacentDefRead(defOrUse1, use) and
+    useToNode(use, nodeTo)
+  )
+}
+
+/** Holds if `nodeTo` receives flow from the phi node `nodeFrom`. */
+predicate fromPhiNode(SsaPhiNode nodeFrom, Node nodeTo) {
+  exists(PhiNode phi, SourceVariable sv, IRBlock bb1, int i1, UseOrPhi use |
+    phi = nodeFrom.getPhiNode() and
+    phi.definesAt(sv, bb1, i1) and
+    useToNode(use, nodeTo)
+  |
+    exists(IRBlock bb2, int i2 |
+      use.asDefOrUse().hasIndexInBlock(bb2, i2, sv) and
+      adjacentDefRead(phi, bb1, i1, bb2, i2)
+    )
+    or
+    exists(PhiNode phiTo |
+      lastRefRedef(phi, _, _, phiTo) and
+      nodeTo.(SsaPhiNode).getPhiNode() = phiTo
+    )
+  )
+}
+
+private SsaInternals0::SourceVariable getOldSourceVariable(SourceVariable v) {
+  v.getBaseVariable().(BaseIRVariable).getIRVariable() =
+    result.getBaseVariable().(SsaInternals0::BaseIRVariable).getIRVariable()
+  or
+  v.getBaseVariable().(BaseCallVariable).getCallInstruction() =
+    result.getBaseVariable().(SsaInternals0::BaseCallVariable).getCallInstruction()
+}
+
+/**
+ * Holds if there is a write at index `i` in basic block `bb` to variable `v` that's
+ * subsequently read (as determined by the SSA pruning stage).
+ */
+private predicate variableWriteCand(IRBlock bb, int i, SourceVariable v) {
+  exists(SsaInternals0::Def def, SsaInternals0::SourceVariable v0 |
+    def.asDefOrUse().hasIndexInBlock(bb, i, v0) and
+    v0 = getOldSourceVariable(v)
+  )
+}
+
+private module SsaInput implements SsaImplCommon::InputSig {
+  import InputSigCommon
+  import SourceVariables
+
+  /**
+   * Holds if the `i`'th write in block `bb` writes to the variable `v`.
+   * `certain` is `true` if the write is guaranteed to overwrite the entire variable.
+   */
+  predicate variableWrite(IRBlock bb, int i, SourceVariable v, boolean certain) {
+    DataFlowImplCommon::forceCachingInSameStage() and
+    variableWriteCand(bb, i, v) and
+    exists(DefImpl def | def.hasIndexInBlock(bb, i, v) |
+      if def.isCertain() then certain = true else certain = false
+    )
+  }
+
+  /**
+   * Holds if the `i`'th read in block `bb` reads to the variable `v`.
+   * `certain` is `true` if the read is guaranteed. For C++, this is always the case.
+   */
+  predicate variableRead(IRBlock bb, int i, SourceVariable v, boolean certain) {
+    exists(UseImpl use | use.hasIndexInBlock(bb, i, v) |
+      if use.isCertain() then certain = true else certain = false
+    )
+  }
+}
+
+/**
+ * The final SSA predicates used for dataflow purposes.
+ */
+cached
+module SsaCached {
+  /**
+   * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
+   * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
+   * path between them without any read of `def`.
+   */
+  cached
+  predicate adjacentDefRead(Definition def, IRBlock bb1, int i1, IRBlock bb2, int i2) {
+    SsaImpl::adjacentDefRead(def, bb1, i1, bb2, i2)
+  }
+
+  /**
+   * Holds if the node at index `i` in `bb` is a last reference to SSA definition
+   * `def`. The reference is last because it can reach another write `next`,
+   * without passing through another read or write.
+   */
+  cached
+  predicate lastRefRedef(Definition def, IRBlock bb, int i, Definition next) {
+    SsaImpl::lastRefRedef(def, bb, i, next)
+  }
+}
+
+cached
+private newtype TSsaDefOrUse =
+  TDefOrUse(DefOrUseImpl defOrUse) {
+    defOrUse instanceof UseImpl
+    or
+    // Like in the pruning stage, we only include definition that's live after the
+    // write as the final definitions computed by SSA.
+    exists(Definition def, SourceVariable sv, IRBlock bb, int i |
+      def.definesAt(sv, bb, i) and
+      defOrUse.(DefImpl).hasIndexInBlock(bb, i, sv)
+    )
+  } or
+  TPhi(PhiNode phi)
+
+abstract private class SsaDefOrUse extends TSsaDefOrUse {
+  string toString() { none() }
+
+  DefOrUseImpl asDefOrUse() { none() }
+
+  PhiNode asPhi() { none() }
+
+  abstract Location getLocation();
+}
+
+class DefOrUse extends TDefOrUse, SsaDefOrUse {
+  DefOrUseImpl defOrUse;
+
+  DefOrUse() { this = TDefOrUse(defOrUse) }
+
+  final override DefOrUseImpl asDefOrUse() { result = defOrUse }
+
+  final override Location getLocation() { result = defOrUse.getLocation() }
+
+  final SourceVariable getSourceVariable() { result = defOrUse.getSourceVariable() }
+
+  override string toString() { result = defOrUse.toString() }
+}
+
+class Phi extends TPhi, SsaDefOrUse {
+  PhiNode phi;
+
+  Phi() { this = TPhi(phi) }
+
+  final override PhiNode asPhi() { result = phi }
+
+  final override Location getLocation() { result = phi.getBasicBlock().getLocation() }
+
+  override string toString() { result = "Phi" }
+}
+
+class UseOrPhi extends SsaDefOrUse {
+  UseOrPhi() {
+    this.asDefOrUse() instanceof UseImpl
+    or
+    this instanceof Phi
+  }
+
+  final override Location getLocation() {
+    result = this.asDefOrUse().getLocation() or result = this.(Phi).getLocation()
+  }
+}
+
+class Def extends DefOrUse {
+  override DefImpl defOrUse;
+
+  Operand getAddressOperand() { result = defOrUse.getAddressOperand() }
+
+  Instruction getAddress() { result = this.getAddressOperand().getDef() }
+
+  /**
+   * This predicate ensures that joins go from `defOrUse` to the result
+   * instead of the other way around.
+   */
+  pragma[inline]
+  int getIndirectionIndex() {
+    pragma[only_bind_into](result) = pragma[only_bind_out](defOrUse).getIndirectionIndex()
+  }
+
+  Instruction getDefiningInstruction() { result = defOrUse.getDefiningInstruction() }
+}
+
+private module SsaImpl = SsaImplCommon::Make<SsaInput>;
+
+class PhiNode = SsaImpl::PhiNode;
+
+class Definition = SsaImpl::Definition;
+
+import SsaCached
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
new file mode 100644
index 00000000000..36ab036c4e5
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
@@ -0,0 +1,268 @@
+import cpp as Cpp
+import semmle.code.cpp.ir.IR
+import semmle.code.cpp.ir.internal.IRCppLanguage
+private import semmle.code.cpp.ir.implementation.raw.internal.SideEffects as SideEffects
+private import DataFlowImplCommon as DataFlowImplCommon
+private import DataFlowUtil
+
+/**
+ * Holds if `operand` is an operand that is not used by the dataflow library.
+ * Ignored operands are not recognizd as uses by SSA, and they don't have a
+ * corresponding `(Indirect)OperandNode`.
+ */
+predicate ignoreOperand(Operand operand) {
+  operand = any(Instruction instr | ignoreInstruction(instr)).getAnOperand()
+}
+
+/**
+ * Holds if `instr` is an instruction that is not used by the dataflow library.
+ * Ignored instructions are not recognized as reads/writes by SSA, and they
+ * don't have a corresponding `(Indirect)InstructionNode`.
+ */
+predicate ignoreInstruction(Instruction instr) {
+  DataFlowImplCommon::forceCachingInSameStage() and
+  (
+    instr instanceof WriteSideEffectInstruction or
+    instr instanceof PhiInstruction or
+    instr instanceof ReadSideEffectInstruction or
+    instr instanceof ChiInstruction or
+    instr instanceof InitializeIndirectionInstruction
+  )
+}
+
+/**
+ * Gets the C++ type of `this` in the member function `f`.
+ * The result is a glvalue if `isGLValue` is true, and
+ * a prvalue if `isGLValue` is false.
+ */
+bindingset[isGLValue]
+private CppType getThisType(Cpp::MemberFunction f, boolean isGLValue) {
+  result.hasType(f.getTypeOfThis(), isGLValue)
+}
+
+/**
+ * Gets the C++ type of the instruction `i`.
+ *
+ * This is equivalent to `i.getResultLanguageType()` with the exception
+ * of instructions that directly references a `this` IRVariable. In this
+ * case, `i.getResultLanguageType()` gives an unknown type, whereas the
+ * predicate gives the expected type (i.e., a potentially cv-qualified
+ * type `A*` where `A` is the declaring type of the member function that
+ * contains `i`).
+ */
+cached
+CppType getResultLanguageType(Instruction i) {
+  if i.(VariableAddressInstruction).getIRVariable() instanceof IRThisVariable
+  then
+    if i.isGLValue()
+    then result = getThisType(i.getEnclosingFunction(), true)
+    else result = getThisType(i.getEnclosingFunction(), false)
+  else result = i.getResultLanguageType()
+}
+
+/**
+ * Gets the C++ type of the operand `operand`.
+ * This is equivalent to the type of the operand's defining instruction.
+ *
+ * See `getResultLanguageType` for a description of this behavior.
+ */
+CppType getLanguageType(Operand operand) { result = getResultLanguageType(operand.getDef()) }
+
+/**
+ * Gets the maximum number of indirections a glvalue of type `type` can have.
+ * For example:
+ * - If `type = int`, the result is 1
+ * - If `type = MyStruct`, the result is 1
+ * - If `type = char*`, the result is 2
+ */
+int getMaxIndirectionsForType(Type type) {
+  result = countIndirectionsForCppType(getTypeForGLValue(type))
+}
+
+/**
+ * Gets the maximum number of indirections a value of type `type` can have.
+ *
+ * Note that this predicate is intended to be called on unspecified types
+ * (i.e., `countIndirections(e.getUnspecifiedType())`).
+ */
+private int countIndirections(Type t) {
+  result =
+    1 +
+      countIndirections([t.(Cpp::PointerType).getBaseType(), t.(Cpp::ReferenceType).getBaseType()])
+  or
+  not t instanceof Cpp::PointerType and
+  not t instanceof Cpp::ReferenceType and
+  result = 0
+}
+
+/**
+ * Gets the maximum number of indirections a value of C++
+ * type `langType` can have.
+ */
+int countIndirectionsForCppType(LanguageType langType) {
+  exists(Type type | langType.hasType(type, true) |
+    result = 1 + countIndirections(type.getUnspecifiedType())
+  )
+  or
+  exists(Type type | langType.hasType(type, false) |
+    result = countIndirections(type.getUnspecifiedType())
+  )
+}
+
+/**
+ * A `CallInstruction` that calls an allocation function such
+ * as `malloc` or `operator new`.
+ */
+class AllocationInstruction extends CallInstruction {
+  AllocationInstruction() { this.getStaticCallTarget() instanceof Cpp::AllocationFunction }
+}
+
+/**
+ * Holds if `i` is a base instruction that starts a sequence of uses
+ * of some variable that SSA can handle.
+ *
+ * This is either when `i` is a `VariableAddressInstruction` or when
+ * `i` is a fresh allocation produced by an `AllocationInstruction`.
+ */
+private predicate isSourceVariableBase(Instruction i) {
+  i instanceof VariableAddressInstruction or i instanceof AllocationInstruction
+}
+
+/**
+ * Holds if the value pointed to by `operand` can potentially be
+ * modified be the caller.
+ */
+predicate isModifiableByCall(ArgumentOperand operand) {
+  exists(CallInstruction call, int index, CppType type |
+    type = getLanguageType(operand) and
+    call.getArgumentOperand(index) = operand and
+    if index = -1
+    then not call.getStaticCallTarget() instanceof Cpp::ConstMemberFunction
+    else not SideEffects::isConstPointerLike(any(Type t | type.hasType(t, _)))
+  )
+}
+
+cached
+private module Cached {
+  /**
+   * Holds if `op` is a use of an SSA variable rooted at `base` with `ind` number
+   * of indirections.
+   *
+   * `certain` is `true` if the operand is guaranteed to read the variable, and
+   * `indirectionIndex` specifies the number of loads required to read the variable.
+   */
+  cached
+  predicate isUse(boolean certain, Operand op, Instruction base, int ind, int indirectionIndex) {
+    not ignoreOperand(op) and
+    certain = true and
+    exists(LanguageType type, int m, int ind0 |
+      type = getLanguageType(op) and
+      m = countIndirectionsForCppType(type) and
+      isUseImpl(op, base, ind0) and
+      ind = ind0 + [0 .. m] and
+      indirectionIndex = ind - ind0
+    )
+  }
+
+  /**
+   * Holds if `operand` is a use of an SSA variable rooted at `base`, and the
+   * path from `base` to `operand` passes through `ind` load-like instructions.
+   */
+  private predicate isUseImpl(Operand operand, Instruction base, int ind) {
+    DataFlowImplCommon::forceCachingInSameStage() and
+    ind = 0 and
+    operand.getDef() = base and
+    isSourceVariableBase(base)
+    or
+    exists(Operand mid, Instruction instr |
+      isUseImpl(mid, base, ind) and
+      instr = operand.getDef() and
+      conversionFlow(mid, instr, false)
+    )
+    or
+    exists(int ind0 |
+      isUseImpl(operand.getDef().(LoadInstruction).getSourceAddressOperand(), base, ind0)
+      or
+      isUseImpl(operand.getDef().(InitializeParameterInstruction).getAnOperand(), base, ind0)
+    |
+      ind0 = ind - 1
+    )
+  }
+
+  /**
+   * Holds if `address` is an address of an SSA variable rooted at `base`,
+   * and `instr` is a definition of the SSA variable with `ind` number of indirections.
+   *
+   * `certain` is `true` if `instr` is guaranteed to write to the variable, and
+   * `indirectionIndex` specifies the number of loads required to read the variable
+   * after the write operation.
+   */
+  cached
+  predicate isDef(
+    boolean certain, Instruction instr, Operand address, Instruction base, int ind,
+    int indirectionIndex
+  ) {
+    certain = true and
+    exists(int ind0, CppType type, int m |
+      address =
+        [
+          instr.(StoreInstruction).getDestinationAddressOperand(),
+          instr.(InitializeParameterInstruction).getAnOperand(),
+          instr.(InitializeDynamicAllocationInstruction).getAllocationAddressOperand(),
+          instr.(UninitializedInstruction).getAnOperand()
+        ]
+    |
+      isDefImpl(address, base, ind0) and
+      type = getLanguageType(address) and
+      m = countIndirectionsForCppType(type) and
+      ind = ind0 + [1 .. m] and
+      indirectionIndex = ind - (ind0 + 1)
+    )
+  }
+
+  /**
+   * Holds if `address` is a use of an SSA variable rooted at `base`, and the
+   * path from `base` to `address` passes through `ind` load-like instructions.
+   *
+   * Note: Unlike `isUseImpl`, this predicate recurses through pointer-arithmetic
+   * instructions.
+   */
+  private predicate isDefImpl(Operand address, Instruction base, int ind) {
+    DataFlowImplCommon::forceCachingInSameStage() and
+    ind = 0 and
+    address.getDef() = base and
+    isSourceVariableBase(base)
+    or
+    exists(Operand mid, Instruction instr |
+      isDefImpl(mid, base, ind) and
+      instr = address.getDef() and
+      conversionFlow(mid, instr, _)
+    )
+    or
+    exists(int ind0 |
+      isDefImpl(address.getDef().(LoadInstruction).getSourceAddressOperand(), base, ind0)
+      or
+      isDefImpl(address.getDef().(InitializeParameterInstruction).getAnOperand(), base, ind0)
+    |
+      ind0 = ind - 1
+    )
+  }
+}
+
+import Cached
+
+/**
+ * Inputs to the shared SSA library's parameterized module that is shared
+ * between the SSA pruning stage, and the final SSA stage.
+ */
+module InputSigCommon {
+  class BasicBlock = IRBlock;
+
+  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
+
+  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+  class ExitBasicBlock extends IRBlock {
+    ExitBasicBlock() { this.getLastInstruction() instanceof ExitFunctionInstruction }
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
new file mode 100644
index 00000000000..1ab232923bf
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
@@ -0,0 +1,208 @@
+private import semmle.code.cpp.ir.IR
+private import experimental.semmle.code.cpp.ir.dataflow.DataFlow
+private import ModelUtil
+private import semmle.code.cpp.models.interfaces.DataFlow
+private import semmle.code.cpp.models.interfaces.SideEffect
+private import DataFlowUtil
+private import DataFlowPrivate
+private import semmle.code.cpp.models.Models
+
+/**
+ * Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
+ * (intra-procedural) step.
+ */
+predicate localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+  DataFlow::localFlowStep(nodeFrom, nodeTo)
+  or
+  localAdditionalTaintStep(nodeFrom, nodeTo)
+}
+
+/**
+ * Holds if taint can flow in one local step from `nodeFrom` to `nodeTo` excluding
+ * local data flow steps. That is, `nodeFrom` and `nodeTo` are likely to represent
+ * different objects.
+ */
+cached
+predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+  operandToInstructionTaintStep(nodeFrom.asOperand(), nodeTo.asInstruction())
+  or
+  modeledTaintStep(nodeFrom, nodeTo)
+  or
+  // Flow from `op` to `*op`.
+  exists(Operand operand, int indirectionIndex |
+    nodeHasOperand(nodeFrom, operand, indirectionIndex) and
+    nodeHasOperand(nodeTo, operand, indirectionIndex - 1)
+  )
+  or
+  // Flow from `instr` to `*instr`.
+  exists(Instruction instr, int indirectionIndex |
+    nodeHasInstruction(nodeFrom, instr, indirectionIndex) and
+    nodeHasInstruction(nodeTo, instr, indirectionIndex - 1)
+  )
+  or
+  // Flow from (the indirection of) an operand of a pointer arithmetic instruction to the
+  // indirection of the pointer arithmetic instruction. This provides flow from `source`
+  // in `x[source]` to the result of the associated load instruction.
+  exists(PointerArithmeticInstruction pai, int indirectionIndex |
+    nodeHasOperand(nodeFrom, pai.getAnOperand(), pragma[only_bind_into](indirectionIndex)) and
+    hasInstructionAndIndex(nodeTo, pai, indirectionIndex + 1)
+  )
+}
+
+/**
+ * Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
+ * (intra-procedural) step.
+ */
+private predicate operandToInstructionTaintStep(Operand opFrom, Instruction instrTo) {
+  // Taint can flow through expressions that alter the value but preserve
+  // more than one bit of it _or_ expressions that follow data through
+  // pointer indirections.
+  instrTo.getAnOperand() = opFrom and
+  (
+    instrTo instanceof ArithmeticInstruction
+    or
+    instrTo instanceof BitwiseInstruction
+    or
+    instrTo instanceof PointerArithmeticInstruction
+  )
+  or
+  // The `CopyInstruction` case is also present in non-taint data flow, but
+  // that uses `getDef` rather than `getAnyDef`. For taint, we want flow
+  // from a definition of `myStruct` to a `myStruct.myField` expression.
+  instrTo.(LoadInstruction).getSourceAddressOperand() = opFrom
+  or
+  // Unary instructions tend to preserve enough information in practice that we
+  // want taint to flow through.
+  // The exception is `FieldAddressInstruction`. Together with the rules below for
+  // `LoadInstruction`s and `ChiInstruction`s, flow through `FieldAddressInstruction`
+  // could cause flow into one field to come out an unrelated field.
+  // This would happen across function boundaries, where the IR would not be able to
+  // match loads to stores.
+  instrTo.(UnaryInstruction).getUnaryOperand() = opFrom and
+  (
+    not instrTo instanceof FieldAddressInstruction
+    or
+    instrTo.(FieldAddressInstruction).getField().getDeclaringType() instanceof Union
+  )
+}
+
+/**
+ * Holds if taint may propagate from `source` to `sink` in zero or more local
+ * (intra-procedural) steps.
+ */
+pragma[inline]
+predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
+
+/**
+ * Holds if taint can flow from `i1` to `i2` in zero or more
+ * local (intra-procedural) steps.
+ */
+pragma[inline]
+predicate localInstructionTaint(Instruction i1, Instruction i2) {
+  localTaint(DataFlow::instructionNode(i1), DataFlow::instructionNode(i2))
+}
+
+/**
+ * Holds if taint can flow from `e1` to `e2` in zero or more
+ * local (intra-procedural) steps.
+ */
+pragma[inline]
+predicate localExprTaint(Expr e1, Expr e2) {
+  localTaint(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
+}
+
+/**
+ * Holds if the additional step from `src` to `sink` should be included in all
+ * global taint flow configurations.
+ */
+predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
+  localAdditionalTaintStep(src, sink)
+}
+
+/**
+ * Holds if default `TaintTracking::Configuration`s should allow implicit reads
+ * of `c` at sinks and inputs to additional taint steps.
+ */
+bindingset[node]
+predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::Content c) { none() }
+
+/**
+ * Holds if `node` should be a sanitizer in all global taint flow configurations
+ * but not in local taint.
+ */
+predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
+
+/**
+ * Holds if taint can flow from `instrIn` to `instrOut` through a call to a
+ * modeled function.
+ */
+predicate modeledTaintStep(DataFlow::Node nodeIn, DataFlow::Node nodeOut) {
+  // Normal taint steps
+  exists(CallInstruction call, TaintFunction func, FunctionInput modelIn, FunctionOutput modelOut |
+    call.getStaticCallTarget() = func and
+    func.hasTaintFlow(modelIn, modelOut)
+  |
+    (
+      nodeIn = callInput(call, modelIn)
+      or
+      exists(int n |
+        modelIn.isParameterDerefOrQualifierObject(n) and
+        if n = -1
+        then nodeIn = callInput(call, any(InQualifierAddress inQualifier))
+        else nodeIn = callInput(call, any(InParameter inParam | inParam.getIndex() = n))
+      )
+    ) and
+    nodeOut = callOutput(call, modelOut)
+    or
+    exists(int d |
+      nodeIn = callInput(call, modelIn, d)
+      or
+      exists(int n |
+        d = 1 and
+        modelIn.isParameterDerefOrQualifierObject(n) and
+        if n = -1
+        then nodeIn = callInput(call, any(InQualifierAddress inQualifier))
+        else nodeIn = callInput(call, any(InParameter inParam | inParam.getIndex() = n))
+      )
+    |
+      call.getStaticCallTarget() = func and
+      func.hasTaintFlow(modelIn, modelOut) and
+      nodeOut = callOutput(call, modelOut, d)
+    )
+  )
+  or
+  // Taint flow from one argument to another and data flow from an argument to a
+  // return value. This happens in functions like `strcat` and `memcpy`. We
+  // could model this flow in two separate steps, but that would add reverse
+  // flow from the write side-effect to the call instruction, which may not be
+  // desirable.
+  exists(
+    CallInstruction call, Function func, FunctionInput modelIn, OutParameterDeref modelMidOut,
+    int indexMid, InParameter modelMidIn, OutReturnValue modelOut
+  |
+    nodeIn = callInput(call, modelIn) and
+    nodeOut = callOutput(call, modelOut) and
+    call.getStaticCallTarget() = func and
+    func.(TaintFunction).hasTaintFlow(modelIn, modelMidOut) and
+    func.(DataFlowFunction).hasDataFlow(modelMidIn, modelOut) and
+    modelMidOut.isParameterDeref(indexMid) and
+    modelMidIn.isParameter(indexMid)
+  )
+  or
+  // Taint flow from a pointer argument to an output, when the model specifies flow from the deref
+  // to that output, but the deref is not modeled in the IR for the caller.
+  exists(
+    CallInstruction call, DataFlow::SideEffectOperandNode indirectArgument, Function func,
+    FunctionInput modelIn, FunctionOutput modelOut
+  |
+    indirectArgument = callInput(call, modelIn) and
+    indirectArgument.getAddressOperand() = nodeIn.asOperand() and
+    call.getStaticCallTarget() = func and
+    (
+      func.(DataFlowFunction).hasDataFlow(modelIn, modelOut)
+      or
+      func.(TaintFunction).hasTaintFlow(modelIn, modelOut)
+    ) and
+    nodeOut = callOutput(call, modelOut)
+  )
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/ssa0/SsaInternals.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/ssa0/SsaInternals.qll
new file mode 100644
index 00000000000..3a89f1d170f
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/ssa0/SsaInternals.qll
@@ -0,0 +1,314 @@
+/**
+ * This module defines an initial SSA pruning stage that doesn't take
+ * indirections into account.
+ */
+
+private import codeql.ssa.Ssa as SsaImplCommon
+private import semmle.code.cpp.ir.IR
+private import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
+private import semmle.code.cpp.models.interfaces.Allocation as Alloc
+private import semmle.code.cpp.models.interfaces.DataFlow as DataFlow
+private import semmle.code.cpp.ir.implementation.raw.internal.SideEffects as SideEffects
+private import semmle.code.cpp.ir.internal.IRCppLanguage
+private import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
+private import experimental.semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import experimental.semmle.code.cpp.ir.dataflow.internal.SsaInternalsCommon
+
+private module SourceVariables {
+  newtype TBaseSourceVariable =
+    // Each IR variable gets its own source variable
+    TBaseIRVariable(IRVariable var) or
+    // Each allocation gets its own source variable
+    TBaseCallVariable(AllocationInstruction call)
+
+  abstract class BaseSourceVariable extends TBaseSourceVariable {
+    abstract string toString();
+
+    abstract DataFlowType getType();
+  }
+
+  class BaseIRVariable extends BaseSourceVariable, TBaseIRVariable {
+    IRVariable var;
+
+    IRVariable getIRVariable() { result = var }
+
+    BaseIRVariable() { this = TBaseIRVariable(var) }
+
+    override string toString() { result = var.toString() }
+
+    override DataFlowType getType() { result = var.getIRType() }
+  }
+
+  class BaseCallVariable extends BaseSourceVariable, TBaseCallVariable {
+    AllocationInstruction call;
+
+    BaseCallVariable() { this = TBaseCallVariable(call) }
+
+    AllocationInstruction getCallInstruction() { result = call }
+
+    override string toString() { result = call.toString() }
+
+    override DataFlowType getType() { result = call.getResultIRType() }
+  }
+
+  private newtype TSourceVariable =
+    TSourceIRVariable(BaseIRVariable baseVar) or
+    TCallVariable(AllocationInstruction call)
+
+  abstract class SourceVariable extends TSourceVariable {
+    abstract string toString();
+
+    abstract BaseSourceVariable getBaseVariable();
+  }
+
+  class SourceIRVariable extends SourceVariable, TSourceIRVariable {
+    BaseIRVariable var;
+
+    SourceIRVariable() { this = TSourceIRVariable(var) }
+
+    IRVariable getIRVariable() { result = var.getIRVariable() }
+
+    override BaseIRVariable getBaseVariable() { result.getIRVariable() = this.getIRVariable() }
+
+    override string toString() { result = this.getIRVariable().toString() }
+  }
+
+  class CallVariable extends SourceVariable, TCallVariable {
+    AllocationInstruction call;
+
+    CallVariable() { this = TCallVariable(call) }
+
+    AllocationInstruction getCall() { result = call }
+
+    override BaseCallVariable getBaseVariable() { result.getCallInstruction() = call }
+
+    override string toString() { result = "Call" }
+  }
+}
+
+import SourceVariables
+
+private newtype TDefOrUseImpl =
+  TDefImpl(Operand address) { isDef(_, _, address, _, _, _) } or
+  TUseImpl(Operand operand) {
+    isUse(_, operand, _, _, _) and
+    not isDef(_, _, operand, _, _, _)
+  }
+
+abstract private class DefOrUseImpl extends TDefOrUseImpl {
+  /** Gets a textual representation of this element. */
+  abstract string toString();
+
+  /** Gets the block of this definition or use. */
+  abstract IRBlock getBlock();
+
+  /** Holds if this definition or use has index `index` in block `block`. */
+  abstract predicate hasIndexInBlock(IRBlock block, int index);
+
+  final predicate hasIndexInBlock(IRBlock block, int index, SourceVariable sv) {
+    this.hasIndexInBlock(block, index) and
+    sv = this.getSourceVariable()
+  }
+
+  /** Gets the location of this element. */
+  abstract Cpp::Location getLocation();
+
+  abstract Instruction getBase();
+
+  final BaseSourceVariable getBaseSourceVariable() {
+    exists(IRVariable var |
+      result.(BaseIRVariable).getIRVariable() = var and
+      instructionHasIRVariable(this.getBase(), var)
+    )
+    or
+    result.(BaseCallVariable).getCallInstruction() = this.getBase()
+  }
+
+  /** Gets the variable that is defined or used. */
+  final SourceVariable getSourceVariable() {
+    exists(BaseSourceVariable v |
+      sourceVariableHasBaseAndIndex(result, v) and
+      defOrUseHasSourceVariable(this, v)
+    )
+  }
+}
+
+pragma[noinline]
+private predicate instructionHasIRVariable(VariableAddressInstruction vai, IRVariable var) {
+  vai.getIRVariable() = var
+}
+
+private predicate defOrUseHasSourceVariable(DefOrUseImpl defOrUse, BaseSourceVariable bv) {
+  defHasSourceVariable(defOrUse, bv)
+  or
+  useHasSourceVariable(defOrUse, bv)
+}
+
+pragma[noinline]
+private predicate defHasSourceVariable(DefImpl def, BaseSourceVariable bv) {
+  bv = def.getBaseSourceVariable()
+}
+
+pragma[noinline]
+private predicate useHasSourceVariable(UseImpl use, BaseSourceVariable bv) {
+  bv = use.getBaseSourceVariable()
+}
+
+pragma[noinline]
+private predicate sourceVariableHasBaseAndIndex(SourceVariable v, BaseSourceVariable bv) {
+  v.getBaseVariable() = bv
+}
+
+class DefImpl extends DefOrUseImpl, TDefImpl {
+  Operand address;
+
+  DefImpl() { this = TDefImpl(address) }
+
+  override Instruction getBase() { isDef(_, _, address, result, _, _) }
+
+  Operand getAddressOperand() { result = address }
+
+  Instruction getDefiningInstruction() { isDef(_, result, address, _, _, _) }
+
+  override string toString() { result = address.toString() }
+
+  override IRBlock getBlock() { result = this.getDefiningInstruction().getBlock() }
+
+  override Cpp::Location getLocation() { result = this.getDefiningInstruction().getLocation() }
+
+  final override predicate hasIndexInBlock(IRBlock block, int index) {
+    this.getDefiningInstruction() = block.getInstruction(index)
+  }
+
+  predicate isCertain() { isDef(true, _, address, _, _, _) }
+}
+
+class UseImpl extends DefOrUseImpl, TUseImpl {
+  Operand operand;
+
+  UseImpl() { this = TUseImpl(operand) }
+
+  Operand getOperand() { result = operand }
+
+  override string toString() { result = operand.toString() }
+
+  final override predicate hasIndexInBlock(IRBlock block, int index) {
+    operand.getUse() = block.getInstruction(index)
+  }
+
+  final override IRBlock getBlock() { result = operand.getUse().getBlock() }
+
+  final override Cpp::Location getLocation() { result = operand.getLocation() }
+
+  override Instruction getBase() { isUse(_, operand, result, _, _) }
+
+  predicate isCertain() { isUse(true, operand, _, _, _) }
+}
+
+private module SsaInput implements SsaImplCommon::InputSig {
+  import InputSigCommon
+  import SourceVariables
+
+  /**
+   * Holds if the `i`'th write in block `bb` writes to the variable `v`.
+   * `certain` is `true` if the write is guaranteed to overwrite the entire variable.
+   */
+  predicate variableWrite(IRBlock bb, int i, SourceVariable v, boolean certain) {
+    DataFlowImplCommon::forceCachingInSameStage() and
+    exists(DefImpl def | def.hasIndexInBlock(bb, i, v) |
+      if def.isCertain() then certain = true else certain = false
+    )
+  }
+
+  /**
+   * Holds if the `i`'th read in block `bb` reads to the variable `v`.
+   * `certain` is `true` if the read is guaranteed.
+   */
+  predicate variableRead(IRBlock bb, int i, SourceVariable v, boolean certain) {
+    exists(UseImpl use | use.hasIndexInBlock(bb, i, v) |
+      if use.isCertain() then certain = true else certain = false
+    )
+  }
+}
+
+private newtype TSsaDefOrUse =
+  TDefOrUse(DefOrUseImpl defOrUse) {
+    defOrUse instanceof UseImpl
+    or
+    // If `defOrUse` is a definition we only include it if the
+    // SSA library concludes that it's live after the write.
+    exists(Definition def, SourceVariable sv, IRBlock bb, int i |
+      def.definesAt(sv, bb, i) and
+      defOrUse.(DefImpl).hasIndexInBlock(bb, i, sv)
+    )
+  } or
+  TPhi(PhiNode phi)
+
+abstract private class SsaDefOrUse extends TSsaDefOrUse {
+  string toString() { result = "SsaDefOrUse" }
+
+  DefOrUseImpl asDefOrUse() { none() }
+
+  PhiNode asPhi() { none() }
+
+  abstract Location getLocation();
+}
+
+class DefOrUse extends TDefOrUse, SsaDefOrUse {
+  DefOrUseImpl defOrUse;
+
+  DefOrUse() { this = TDefOrUse(defOrUse) }
+
+  final override DefOrUseImpl asDefOrUse() { result = defOrUse }
+
+  final override Location getLocation() { result = defOrUse.getLocation() }
+
+  final SourceVariable getSourceVariable() { result = defOrUse.getSourceVariable() }
+}
+
+class Phi extends TPhi, SsaDefOrUse {
+  PhiNode phi;
+
+  Phi() { this = TPhi(phi) }
+
+  final override PhiNode asPhi() { result = phi }
+
+  final override Location getLocation() { result = phi.getBasicBlock().getLocation() }
+}
+
+class UseOrPhi extends SsaDefOrUse {
+  UseOrPhi() {
+    this.asDefOrUse() instanceof UseImpl
+    or
+    this instanceof Phi
+  }
+
+  final override Location getLocation() {
+    result = this.asDefOrUse().getLocation() or result = this.(Phi).getLocation()
+  }
+
+  override string toString() {
+    result = this.asDefOrUse().toString()
+    or
+    this instanceof Phi and
+    result = "Phi"
+  }
+}
+
+class Def extends DefOrUse {
+  override DefImpl defOrUse;
+
+  Operand getAddressOperand() { result = defOrUse.getAddressOperand() }
+
+  Instruction getAddress() { result = this.getAddressOperand().getDef() }
+
+  Instruction getDefiningInstruction() { result = defOrUse.getDefiningInstruction() }
+
+  override string toString() { result = this.asDefOrUse().toString() + " (def)" }
+}
+
+private module SsaImpl = SsaImplCommon::Make<SsaInput>;
+
+class PhiNode = SsaImpl::PhiNode;
+
+class Definition = SsaImpl::Definition;
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
new file mode 100644
index 00000000000..bf937b6de31
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
@@ -0,0 +1,191 @@
+/**
+ * Provides an implementation of global (interprocedural) taint tracking.
+ * This file re-exports the local (intraprocedural) taint-tracking analysis
+ * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
+ * exposed through the `Configuration` class. For some languages, this file
+ * exists in several identical copies, allowing queries to use multiple
+ * `Configuration` classes that depend on each other without introducing
+ * mutual recursion among those configurations.
+ */
+
+import TaintTrackingParameter::Public
+private import TaintTrackingParameter::Private
+
+/**
+ * A configuration of interprocedural taint tracking analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the taint tracking library must define its own unique extension of
+ * this abstract class.
+ *
+ * A taint-tracking configuration is a special data flow configuration
+ * (`DataFlow::Configuration`) that allows for flow through nodes that do not
+ * necessarily preserve values but are still relevant from a taint tracking
+ * perspective. (For example, string concatenation, where one of the operands
+ * is tainted.)
+ *
+ * To create a configuration, extend this class with a subclass whose
+ * characteristic predicate is a unique singleton string. For example, write
+ *
+ * ```ql
+ * class MyAnalysisConfiguration extends TaintTracking::Configuration {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Optionally override `isSanitizer`.
+ *   // Optionally override `isSanitizerIn`.
+ *   // Optionally override `isSanitizerOut`.
+ *   // Optionally override `isSanitizerGuard`.
+ *   // Optionally override `isAdditionalTaintStep`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```ql
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but it is unsupported to depend on
+ * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
+ * overridden predicates that define sources, sinks, or additional steps.
+ * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
+ * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
+ */
+abstract class Configuration extends DataFlow::Configuration {
+  bindingset[this]
+  Configuration() { any() }
+
+  /**
+   * Holds if `source` is a relevant taint source.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSource(DataFlow::Node source) { none() }
+
+  /**
+   * Holds if `source` is a relevant taint source with the given initial
+   * `state`.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) { none() }
+
+  /**
+   * Holds if `sink` is a relevant taint sink
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSink(DataFlow::Node sink) { none() }
+
+  /**
+   * Holds if `sink` is a relevant taint sink accepting `state`.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) { none() }
+
+  /** Holds if the node `node` is a taint sanitizer. */
+  predicate isSanitizer(DataFlow::Node node) { none() }
+
+  final override predicate isBarrier(DataFlow::Node node) {
+    this.isSanitizer(node) or
+    defaultTaintSanitizer(node)
+  }
+
+  /**
+   * Holds if the node `node` is a taint sanitizer when the flow state is
+   * `state`.
+   */
+  predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) { none() }
+
+  final override predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) {
+    this.isSanitizer(node, state)
+  }
+
+  /** Holds if taint propagation into `node` is prohibited. */
+  predicate isSanitizerIn(DataFlow::Node node) { none() }
+
+  final override predicate isBarrierIn(DataFlow::Node node) { this.isSanitizerIn(node) }
+
+  /** Holds if taint propagation out of `node` is prohibited. */
+  predicate isSanitizerOut(DataFlow::Node node) { none() }
+
+  final override predicate isBarrierOut(DataFlow::Node node) { this.isSanitizerOut(node) }
+
+  /**
+   * DEPRECATED: Use `isSanitizer` and `BarrierGuard` module instead.
+   *
+   * Holds if taint propagation through nodes guarded by `guard` is prohibited.
+   */
+  deprecated predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
+
+  deprecated final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) {
+    this.isSanitizerGuard(guard)
+  }
+
+  /**
+   * DEPRECATED: Use `isSanitizer` and `BarrierGuard` module instead.
+   *
+   * Holds if taint propagation through nodes guarded by `guard` is prohibited
+   * when the flow state is `state`.
+   */
+  deprecated predicate isSanitizerGuard(DataFlow::BarrierGuard guard, DataFlow::FlowState state) {
+    none()
+  }
+
+  deprecated final override predicate isBarrierGuard(
+    DataFlow::BarrierGuard guard, DataFlow::FlowState state
+  ) {
+    this.isSanitizerGuard(guard, state)
+  }
+
+  /**
+   * Holds if taint may propagate from `node1` to `node2` in addition to the normal data-flow and taint steps.
+   */
+  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
+
+  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    this.isAdditionalTaintStep(node1, node2) or
+    defaultAdditionalTaintStep(node1, node2)
+  }
+
+  /**
+   * Holds if taint may propagate from `node1` to `node2` in addition to the normal data-flow and taint steps.
+   * This step is only applicable in `state1` and updates the flow state to `state2`.
+   */
+  predicate isAdditionalTaintStep(
+    DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+    DataFlow::FlowState state2
+  ) {
+    none()
+  }
+
+  final override predicate isAdditionalFlowStep(
+    DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+    DataFlow::FlowState state2
+  ) {
+    this.isAdditionalTaintStep(node1, state1, node2, state2)
+  }
+
+  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
+    defaultImplicitTaintRead(node, c)
+  }
+
+  /**
+   * Holds if taint may flow from `source` to `sink` for this configuration.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
+    super.hasFlow(source, sink)
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingParameter.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingParameter.qll
new file mode 100644
index 00000000000..07185a4ad57
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingParameter.qll
@@ -0,0 +1,5 @@
+import experimental.semmle.code.cpp.ir.dataflow.internal.TaintTrackingUtil as Public
+
+module Private {
+  import experimental.semmle.code.cpp.ir.dataflow.DataFlow::DataFlow as DataFlow
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
new file mode 100644
index 00000000000..bf937b6de31
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
@@ -0,0 +1,191 @@
+/**
+ * Provides an implementation of global (interprocedural) taint tracking.
+ * This file re-exports the local (intraprocedural) taint-tracking analysis
+ * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
+ * exposed through the `Configuration` class. For some languages, this file
+ * exists in several identical copies, allowing queries to use multiple
+ * `Configuration` classes that depend on each other without introducing
+ * mutual recursion among those configurations.
+ */
+
+import TaintTrackingParameter::Public
+private import TaintTrackingParameter::Private
+
+/**
+ * A configuration of interprocedural taint tracking analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the taint tracking library must define its own unique extension of
+ * this abstract class.
+ *
+ * A taint-tracking configuration is a special data flow configuration
+ * (`DataFlow::Configuration`) that allows for flow through nodes that do not
+ * necessarily preserve values but are still relevant from a taint tracking
+ * perspective. (For example, string concatenation, where one of the operands
+ * is tainted.)
+ *
+ * To create a configuration, extend this class with a subclass whose
+ * characteristic predicate is a unique singleton string. For example, write
+ *
+ * ```ql
+ * class MyAnalysisConfiguration extends TaintTracking::Configuration {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Optionally override `isSanitizer`.
+ *   // Optionally override `isSanitizerIn`.
+ *   // Optionally override `isSanitizerOut`.
+ *   // Optionally override `isSanitizerGuard`.
+ *   // Optionally override `isAdditionalTaintStep`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```ql
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but it is unsupported to depend on
+ * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
+ * overridden predicates that define sources, sinks, or additional steps.
+ * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
+ * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
+ */
+abstract class Configuration extends DataFlow::Configuration {
+  bindingset[this]
+  Configuration() { any() }
+
+  /**
+   * Holds if `source` is a relevant taint source.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSource(DataFlow::Node source) { none() }
+
+  /**
+   * Holds if `source` is a relevant taint source with the given initial
+   * `state`.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) { none() }
+
+  /**
+   * Holds if `sink` is a relevant taint sink
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSink(DataFlow::Node sink) { none() }
+
+  /**
+   * Holds if `sink` is a relevant taint sink accepting `state`.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) { none() }
+
+  /** Holds if the node `node` is a taint sanitizer. */
+  predicate isSanitizer(DataFlow::Node node) { none() }
+
+  final override predicate isBarrier(DataFlow::Node node) {
+    this.isSanitizer(node) or
+    defaultTaintSanitizer(node)
+  }
+
+  /**
+   * Holds if the node `node` is a taint sanitizer when the flow state is
+   * `state`.
+   */
+  predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) { none() }
+
+  final override predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) {
+    this.isSanitizer(node, state)
+  }
+
+  /** Holds if taint propagation into `node` is prohibited. */
+  predicate isSanitizerIn(DataFlow::Node node) { none() }
+
+  final override predicate isBarrierIn(DataFlow::Node node) { this.isSanitizerIn(node) }
+
+  /** Holds if taint propagation out of `node` is prohibited. */
+  predicate isSanitizerOut(DataFlow::Node node) { none() }
+
+  final override predicate isBarrierOut(DataFlow::Node node) { this.isSanitizerOut(node) }
+
+  /**
+   * DEPRECATED: Use `isSanitizer` and `BarrierGuard` module instead.
+   *
+   * Holds if taint propagation through nodes guarded by `guard` is prohibited.
+   */
+  deprecated predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
+
+  deprecated final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) {
+    this.isSanitizerGuard(guard)
+  }
+
+  /**
+   * DEPRECATED: Use `isSanitizer` and `BarrierGuard` module instead.
+   *
+   * Holds if taint propagation through nodes guarded by `guard` is prohibited
+   * when the flow state is `state`.
+   */
+  deprecated predicate isSanitizerGuard(DataFlow::BarrierGuard guard, DataFlow::FlowState state) {
+    none()
+  }
+
+  deprecated final override predicate isBarrierGuard(
+    DataFlow::BarrierGuard guard, DataFlow::FlowState state
+  ) {
+    this.isSanitizerGuard(guard, state)
+  }
+
+  /**
+   * Holds if taint may propagate from `node1` to `node2` in addition to the normal data-flow and taint steps.
+   */
+  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
+
+  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    this.isAdditionalTaintStep(node1, node2) or
+    defaultAdditionalTaintStep(node1, node2)
+  }
+
+  /**
+   * Holds if taint may propagate from `node1` to `node2` in addition to the normal data-flow and taint steps.
+   * This step is only applicable in `state1` and updates the flow state to `state2`.
+   */
+  predicate isAdditionalTaintStep(
+    DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+    DataFlow::FlowState state2
+  ) {
+    none()
+  }
+
+  final override predicate isAdditionalFlowStep(
+    DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+    DataFlow::FlowState state2
+  ) {
+    this.isAdditionalTaintStep(node1, state1, node2, state2)
+  }
+
+  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
+    defaultImplicitTaintRead(node, c)
+  }
+
+  /**
+   * Holds if taint may flow from `source` to `sink` for this configuration.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
+    super.hasFlow(source, sink)
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingParameter.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingParameter.qll
new file mode 100644
index 00000000000..7d545fe5d04
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingParameter.qll
@@ -0,0 +1,5 @@
+import experimental.semmle.code.cpp.ir.dataflow.internal.TaintTrackingUtil as Public
+
+module Private {
+  import experimental.semmle.code.cpp.ir.dataflow.DataFlow2::DataFlow2 as DataFlow
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
new file mode 100644
index 00000000000..bf937b6de31
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
@@ -0,0 +1,191 @@
+/**
+ * Provides an implementation of global (interprocedural) taint tracking.
+ * This file re-exports the local (intraprocedural) taint-tracking analysis
+ * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
+ * exposed through the `Configuration` class. For some languages, this file
+ * exists in several identical copies, allowing queries to use multiple
+ * `Configuration` classes that depend on each other without introducing
+ * mutual recursion among those configurations.
+ */
+
+import TaintTrackingParameter::Public
+private import TaintTrackingParameter::Private
+
+/**
+ * A configuration of interprocedural taint tracking analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the taint tracking library must define its own unique extension of
+ * this abstract class.
+ *
+ * A taint-tracking configuration is a special data flow configuration
+ * (`DataFlow::Configuration`) that allows for flow through nodes that do not
+ * necessarily preserve values but are still relevant from a taint tracking
+ * perspective. (For example, string concatenation, where one of the operands
+ * is tainted.)
+ *
+ * To create a configuration, extend this class with a subclass whose
+ * characteristic predicate is a unique singleton string. For example, write
+ *
+ * ```ql
+ * class MyAnalysisConfiguration extends TaintTracking::Configuration {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Optionally override `isSanitizer`.
+ *   // Optionally override `isSanitizerIn`.
+ *   // Optionally override `isSanitizerOut`.
+ *   // Optionally override `isSanitizerGuard`.
+ *   // Optionally override `isAdditionalTaintStep`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```ql
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but it is unsupported to depend on
+ * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
+ * overridden predicates that define sources, sinks, or additional steps.
+ * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
+ * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
+ */
+abstract class Configuration extends DataFlow::Configuration {
+  bindingset[this]
+  Configuration() { any() }
+
+  /**
+   * Holds if `source` is a relevant taint source.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSource(DataFlow::Node source) { none() }
+
+  /**
+   * Holds if `source` is a relevant taint source with the given initial
+   * `state`.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) { none() }
+
+  /**
+   * Holds if `sink` is a relevant taint sink
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSink(DataFlow::Node sink) { none() }
+
+  /**
+   * Holds if `sink` is a relevant taint sink accepting `state`.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) { none() }
+
+  /** Holds if the node `node` is a taint sanitizer. */
+  predicate isSanitizer(DataFlow::Node node) { none() }
+
+  final override predicate isBarrier(DataFlow::Node node) {
+    this.isSanitizer(node) or
+    defaultTaintSanitizer(node)
+  }
+
+  /**
+   * Holds if the node `node` is a taint sanitizer when the flow state is
+   * `state`.
+   */
+  predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) { none() }
+
+  final override predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) {
+    this.isSanitizer(node, state)
+  }
+
+  /** Holds if taint propagation into `node` is prohibited. */
+  predicate isSanitizerIn(DataFlow::Node node) { none() }
+
+  final override predicate isBarrierIn(DataFlow::Node node) { this.isSanitizerIn(node) }
+
+  /** Holds if taint propagation out of `node` is prohibited. */
+  predicate isSanitizerOut(DataFlow::Node node) { none() }
+
+  final override predicate isBarrierOut(DataFlow::Node node) { this.isSanitizerOut(node) }
+
+  /**
+   * DEPRECATED: Use `isSanitizer` and `BarrierGuard` module instead.
+   *
+   * Holds if taint propagation through nodes guarded by `guard` is prohibited.
+   */
+  deprecated predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
+
+  deprecated final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) {
+    this.isSanitizerGuard(guard)
+  }
+
+  /**
+   * DEPRECATED: Use `isSanitizer` and `BarrierGuard` module instead.
+   *
+   * Holds if taint propagation through nodes guarded by `guard` is prohibited
+   * when the flow state is `state`.
+   */
+  deprecated predicate isSanitizerGuard(DataFlow::BarrierGuard guard, DataFlow::FlowState state) {
+    none()
+  }
+
+  deprecated final override predicate isBarrierGuard(
+    DataFlow::BarrierGuard guard, DataFlow::FlowState state
+  ) {
+    this.isSanitizerGuard(guard, state)
+  }
+
+  /**
+   * Holds if taint may propagate from `node1` to `node2` in addition to the normal data-flow and taint steps.
+   */
+  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
+
+  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    this.isAdditionalTaintStep(node1, node2) or
+    defaultAdditionalTaintStep(node1, node2)
+  }
+
+  /**
+   * Holds if taint may propagate from `node1` to `node2` in addition to the normal data-flow and taint steps.
+   * This step is only applicable in `state1` and updates the flow state to `state2`.
+   */
+  predicate isAdditionalTaintStep(
+    DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+    DataFlow::FlowState state2
+  ) {
+    none()
+  }
+
+  final override predicate isAdditionalFlowStep(
+    DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+    DataFlow::FlowState state2
+  ) {
+    this.isAdditionalTaintStep(node1, state1, node2, state2)
+  }
+
+  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
+    defaultImplicitTaintRead(node, c)
+  }
+
+  /**
+   * Holds if taint may flow from `source` to `sink` for this configuration.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
+    super.hasFlow(source, sink)
+  }
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingParameter.qll b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingParameter.qll
new file mode 100644
index 00000000000..3e69abcf4a7
--- /dev/null
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingParameter.qll
@@ -0,0 +1,5 @@
+import experimental.semmle.code.cpp.ir.dataflow.internal.TaintTrackingUtil as Public
+
+module Private {
+  import experimental.semmle.code.cpp.ir.dataflow.DataFlow3::DataFlow3 as DataFlow
+}
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/Bound.qll b/cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/Bound.qll
index bdd0e39f9b7..abff447ca87 100644
--- a/cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/Bound.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/Bound.qll
@@ -28,6 +28,10 @@ private newtype TBound =
       i.(LoadInstruction).getSourceAddress() instanceof FieldAddressInstruction
       or
       i.getAUse() instanceof ArgumentOperand
+      or
+      i instanceof PointerArithmeticInstruction
+      or
+      i.getAUse() instanceof AddressOperand
     )
   }
 
@@ -73,7 +77,7 @@ class ValueNumberBound extends Bound, TBoundValueNumber {
     this = TBoundValueNumber(valueNumber(result)) and delta = 0
   }
 
-  override string toString() { result = vn.getExampleInstruction().toString() }
+  override string toString() { result = "ValueNumberBound" }
 
   override Location getLocation() { result = vn.getLocation() }
 
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExpr.qll b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExpr.qll
index 8aeb15cab12..2ea958931da 100644
--- a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExpr.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExpr.qll
@@ -178,11 +178,11 @@ class SemRelationalExpr extends SemBinaryExpr {
 }
 
 class SemAddExpr extends SemBinaryExpr {
-  SemAddExpr() { opcode instanceof Opcode::Add }
+  SemAddExpr() { opcode instanceof Opcode::Add or opcode instanceof Opcode::PointerAdd }
 }
 
 class SemSubExpr extends SemBinaryExpr {
-  SemSubExpr() { opcode instanceof Opcode::Sub }
+  SemSubExpr() { opcode instanceof Opcode::Sub or opcode instanceof Opcode::PointerSub }
 }
 
 class SemMulExpr extends SemBinaryExpr {
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExprSpecific.qll b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExprSpecific.qll
index 3ed2c49e5c0..dc178f77547 100644
--- a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExprSpecific.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExprSpecific.qll
@@ -112,12 +112,11 @@ module SemanticExprConfig {
 
   predicate hasDominanceInformation(BasicBlock block) { any() }
 
-  int getBasicBlockUniqueId(BasicBlock block) {
-    // REVIEW: `getDisplayIndex()` is not intended for use in real queries, but for now it's the
-    // best we can do because `equivalentRelation` won't accept a predicate whose parameters are IPA
-    // types.
-    result = block.getDisplayIndex()
-  }
+  private predicate id(Cpp::Locatable x, Cpp::Locatable y) { x = y }
+
+  private predicate idOf(Cpp::Locatable x, int y) = equivalenceRelation(id/2)(x, y)
+
+  int getBasicBlockUniqueId(BasicBlock block) { idOf(block.getFirstInstruction().getAst(), result) }
 
   newtype TSsaVariable =
     TSsaInstruction(IR::Instruction instr) { instr.hasMemoryResult() } or
@@ -162,7 +161,7 @@ module SemanticExprConfig {
   predicate phi(SsaVariable v) { v.asInstruction() instanceof IR::PhiInstruction }
 
   SsaVariable getAPhiInput(SsaVariable v) {
-    exists(IR::PhiInstruction instr |
+    exists(IR::PhiInstruction instr | v.asInstruction() = instr |
       result.asInstruction() = instr.getAnInput()
       or
       result.asOperand() = instr.getAnInputOperand()
@@ -267,17 +266,7 @@ module SemanticExprConfig {
 
     ValueNumberBound() { bound = this }
 
-    override string toString() {
-      result =
-        min(SsaVariable v |
-          v.asInstruction() = bound.getValueNumber().getAnInstruction()
-        |
-          v
-          order by
-            v.asInstruction().getBlock().getDisplayIndex(),
-            v.asInstruction().getDisplayIndexInBlock()
-        ).toString()
-    }
+    override string toString() { result = bound.toString() }
   }
 
   predicate zeroBound(Bound bound) { bound instanceof IRBound::ZeroBound }
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticOpcode.qll b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticOpcode.qll
index 304d299dfba..bb56da71f73 100644
--- a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticOpcode.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticOpcode.qll
@@ -65,10 +65,18 @@ module Opcode {
     override string toString() { result = "Add" }
   }
 
+  class PointerAdd extends Opcode, TPointerAdd {
+    override string toString() { result = "PointerAdd" }
+  }
+
   class Sub extends Opcode, TSub {
     override string toString() { result = "Sub" }
   }
 
+  class PointerSub extends Opcode, TPointerSub {
+    override string toString() { result = "PointerSub" }
+  }
+
   class Mul extends Opcode, TMul {
     override string toString() { result = "Mul" }
   }
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysis.qll b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysis.qll
index 4f8462705b1..4953b994c8e 100644
--- a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysis.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysis.qll
@@ -223,7 +223,9 @@ private SemGuard boundFlowCond(
       else resultIsStrict = testIsTrue.booleanNot()
     ) and
     (
-      if getTrackedTypeForSsaVariable(v) instanceof SemIntegerType
+      if
+        getTrackedTypeForSsaVariable(v) instanceof SemIntegerType or
+        getTrackedTypeForSsaVariable(v) instanceof SemAddressType
       then
         upper = true and strengthen = -1
         or
@@ -542,12 +544,32 @@ private predicate unequalIntegralSsa(
 ) {
   exists(SemExpr e, int d1, int d2 |
     unequalFlowStepIntegralSsa(v, pos, e, d1, reason) and
-    bounded(e, b, d2, true, _, _, _) and
-    bounded(e, b, d2, false, _, _, _) and
+    boundedUpper(e, b, d1) and
+    boundedLower(e, b, d2) and
     delta = d2 + d1
   )
 }
 
+/**
+ * Holds if `b + delta` is an upper bound for `e`.
+ *
+ * This predicate only exists to prevent a bad standard order in `unequalIntegralSsa`.
+ */
+pragma[nomagic]
+private predicate boundedUpper(SemExpr e, SemBound b, int delta) {
+  bounded(e, b, delta, true, _, _, _)
+}
+
+/**
+ * Holds if `b + delta` is a lower bound for `e`.
+ *
+ * This predicate only exists to prevent a bad standard order in `unequalIntegralSsa`.
+ */
+pragma[nomagic]
+private predicate boundedLower(SemExpr e, SemBound b, int delta) {
+  bounded(e, b, delta, false, _, _, _)
+}
+
 /** Weakens a delta to lie in the range `[-1..1]`. */
 bindingset[delta, upper]
 private int weakenDelta(boolean upper, int delta) {
diff --git a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/SignAnalysisCommon.qll b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/SignAnalysisCommon.qll
index 6015c33c035..10944b55fbc 100644
--- a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/SignAnalysisCommon.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/SignAnalysisCommon.qll
@@ -204,6 +204,7 @@ private class BinarySignExpr extends FlowSignExpr {
   }
 }
 
+pragma[nomagic]
 private predicate binaryExprOperands(SemBinaryExpr binary, SemExpr left, SemExpr right) {
   binary.getLeftOperand() = left and binary.getRightOperand() = right
 }
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 4d96d9635ed..432fe263feb 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -5,3 +5,5 @@ dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp
 library: true
 upgrades: upgrades
+dependencies:
+  codeql/ssa: 0.0.1
diff --git a/cpp/ql/lib/semmle/code/cpp/Class.qll b/cpp/ql/lib/semmle/code/cpp/Class.qll
index a91cedb9a0b..f139f67c70a 100644
--- a/cpp/ql/lib/semmle/code/cpp/Class.qll
+++ b/cpp/ql/lib/semmle/code/cpp/Class.qll
@@ -404,7 +404,10 @@ class Class extends UserType {
    * compiled for. For this reason, the `is_pod_class` predicate is
    * generated by the extractor.
    */
-  predicate isPOD() { is_pod_class(underlyingElement(this)) }
+  predicate isPod() { is_pod_class(underlyingElement(this)) }
+
+  /** DEPRECATED: Alias for isPod */
+  deprecated predicate isPOD() { this.isPod() }
 
   /**
    * Holds if this class, struct or union is a standard-layout class
diff --git a/cpp/ql/lib/semmle/code/cpp/PODType03.qll b/cpp/ql/lib/semmle/code/cpp/PODType03.qll
index 88c9a1203aa..4d6e5262213 100644
--- a/cpp/ql/lib/semmle/code/cpp/PODType03.qll
+++ b/cpp/ql/lib/semmle/code/cpp/PODType03.qll
@@ -79,17 +79,17 @@ predicate isAggregateType03(Type t) {
  *   user-defined copy assignment operator and no user-defined destructor.
  *   A POD class is a class that is either a POD-struct or a POD-union.
  */
-predicate isPODClass03(Class c) {
+predicate isPodClass03(Class c) {
   isAggregateClass03(c) and
   not exists(Variable v |
     v.getDeclaringType() = c and
     not v.isStatic()
   |
-    not isPODType03(v.getType())
+    not isPodType03(v.getType())
     or
     exists(ArrayType at |
       at = v.getType() and
-      not isPODType03(at.getBaseType())
+      not isPodType03(at.getBaseType())
     )
     or
     v.getType() instanceof ReferenceType
@@ -104,6 +104,9 @@ predicate isPODClass03(Class c) {
   )
 }
 
+/** DEPRECATED: Alias for isPodClass03 */
+deprecated predicate isPODClass03 = isPodClass03/1;
+
 /**
  * Holds if `t` is a POD type, according to the rules specified in
  * C++03 3.9(10):
@@ -112,14 +115,17 @@ predicate isPODClass03(Class c) {
  *   such types and cv-qualified versions of these types (3.9.3) are
  *   collectively called POD types.
  */
-predicate isPODType03(Type t) {
+predicate isPodType03(Type t) {
   exists(Type ut | ut = t.getUnderlyingType() |
     isScalarType03(ut)
     or
-    isPODClass03(ut)
+    isPodClass03(ut)
     or
-    exists(ArrayType at | at = ut and isPODType03(at.getBaseType()))
+    exists(ArrayType at | at = ut and isPodType03(at.getBaseType()))
     or
-    isPODType03(ut.(SpecifiedType).getUnspecifiedType())
+    isPodType03(ut.(SpecifiedType).getUnspecifiedType())
   )
 }
+
+/** DEPRECATED: Alias for isPodType03 */
+deprecated predicate isPODType03 = isPodType03/1;
diff --git a/cpp/ql/lib/semmle/code/cpp/commons/Dependency.qll b/cpp/ql/lib/semmle/code/cpp/commons/Dependency.qll
index ec95b29177b..e7169d6917f 100644
--- a/cpp/ql/lib/semmle/code/cpp/commons/Dependency.qll
+++ b/cpp/ql/lib/semmle/code/cpp/commons/Dependency.qll
@@ -238,7 +238,7 @@ predicate dependsOnTransitive(DependsSource src, Element dest) {
 /**
  * A dependency that targets a TypeDeclarationEntry.
  */
-private predicate dependsOnTDE(Element src, Type t, TypeDeclarationEntry dest) {
+private predicate dependsOnTde(Element src, Type t, TypeDeclarationEntry dest) {
   dependsOnTransitive(src, t) and
   getDeclarationEntries(t, dest)
 }
@@ -247,8 +247,8 @@ private predicate dependsOnTDE(Element src, Type t, TypeDeclarationEntry dest) {
  * A dependency that targets a visible TypeDeclarationEntry.
  */
 pragma[noopt]
-private predicate dependsOnVisibleTDE(Element src, Type t, TypeDeclarationEntry dest) {
-  dependsOnTDE(src, t, dest) and
+private predicate dependsOnVisibleTde(Element src, Type t, TypeDeclarationEntry dest) {
+  dependsOnTde(src, t, dest) and
   exists(File g | g = dest.getFile() |
     exists(File f | f = src.getFile() | f.getAnIncludedFile*() = g)
   )
@@ -260,8 +260,8 @@ private predicate dependsOnVisibleTDE(Element src, Type t, TypeDeclarationEntry
 private predicate dependsOnDeclarationEntry(Element src, DeclarationEntry dest) {
   exists(Type t |
     // dependency from a Type use -> unique visible TDE
-    dependsOnVisibleTDE(src, t, dest) and
-    strictcount(TypeDeclarationEntry alt | dependsOnVisibleTDE(src, t, alt)) = 1
+    dependsOnVisibleTde(src, t, dest) and
+    strictcount(TypeDeclarationEntry alt | dependsOnVisibleTde(src, t, alt)) = 1
   )
   or
   exists(TypedefType mid |
diff --git a/cpp/ql/lib/semmle/code/cpp/commons/NULL.qll b/cpp/ql/lib/semmle/code/cpp/commons/NULL.qll
index fa6008f1379..54981548245 100644
--- a/cpp/ql/lib/semmle/code/cpp/commons/NULL.qll
+++ b/cpp/ql/lib/semmle/code/cpp/commons/NULL.qll
@@ -1,11 +1,14 @@
 import semmle.code.cpp.Macro
 
 /** A macro defining NULL. */
-class NULLMacro extends Macro {
-  NULLMacro() { this.getHead() = "NULL" }
+class NullMacro extends Macro {
+  NullMacro() { this.getHead() = "NULL" }
 }
 
+/** DEPRECATED: Alias for NullMacro */
+deprecated class NULLMacro = NullMacro;
+
 /** A use of the NULL macro. */
 class NULL extends Literal {
-  NULL() { exists(NULLMacro nm | this = nm.getAnInvocation().getAnExpandedElement()) }
+  NULL() { exists(NullMacro nm | this = nm.getAnInvocation().getAnExpandedElement()) }
 }
diff --git a/cpp/ql/lib/semmle/code/cpp/commons/Scanf.qll b/cpp/ql/lib/semmle/code/cpp/commons/Scanf.qll
index 58d980318d9..0d51c948170 100644
--- a/cpp/ql/lib/semmle/code/cpp/commons/Scanf.qll
+++ b/cpp/ql/lib/semmle/code/cpp/commons/Scanf.qll
@@ -143,6 +143,28 @@ class ScanfFunctionCall extends FunctionCall {
    * (rather than a `char*`).
    */
   predicate isWideCharDefault() { this.getScanfFunction().isWideCharDefault() }
+
+  /**
+   * Gets the output argument at position `n` in the vararg list of this call.
+   *
+   * The range of `n` is from `0` to `this.getNumberOfOutputArguments() - 1`.
+   */
+  Expr getOutputArgument(int n) {
+    result = this.getArgument(this.getTarget().getNumberOfParameters() + n) and
+    n >= 0
+  }
+
+  /**
+   * Gets an output argument given to this call in vararg position.
+   */
+  Expr getAnOutputArgument() { result = this.getOutputArgument(_) }
+
+  /**
+   * Gets the number of output arguments present in this call.
+   */
+  int getNumberOfOutputArguments() {
+    result = this.getNumberOfArguments() - this.getTarget().getNumberOfParameters()
+  }
 }
 
 /**
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowVar.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowVar.qll
index 34b2ef5aaf9..ee76e9aa671 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowVar.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowVar.qll
@@ -474,7 +474,7 @@ module FlowVar_internal {
   }
 
   /** Type-specialized version of `getEnclosingElement`. */
-  private ControlFlowNode getCFNParent(ControlFlowNode node) { result = node.getEnclosingElement() }
+  private ControlFlowNode getCfnParent(ControlFlowNode node) { result = node.getEnclosingElement() }
 
   /**
    * A for-loop or while-loop whose condition is always true upon entry but not
@@ -526,7 +526,7 @@ module FlowVar_internal {
     }
 
     private predicate bbInLoopCondition(BasicBlock bb) {
-      getCFNParent*(bb.getANode()) = this.(Loop).getCondition()
+      getCfnParent*(bb.getANode()) = this.(Loop).getCondition()
     }
 
     private predicate bbInLoop(BasicBlock bb) {
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/cpp/ql/lib/semmle/code/cpp/exprs/BuiltInOperations.qll b/cpp/ql/lib/semmle/code/cpp/exprs/BuiltInOperations.qll
index 979c9c03940..f5ead5b6f5f 100644
--- a/cpp/ql/lib/semmle/code/cpp/exprs/BuiltInOperations.qll
+++ b/cpp/ql/lib/semmle/code/cpp/exprs/BuiltInOperations.qll
@@ -1040,6 +1040,494 @@ class BuiltInOperationHasUniqueObjectRepresentations extends BuiltInOperation,
   override string getAPrimaryQlClass() { result = "BuiltInOperationHasUniqueObjectRepresentations" }
 }
 
+/**
+ * A C++ `__is_same` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if two types are the same.
+ * ```
+ * template<typename _Tp, typename _Up>
+ *   struct is_same
+ *   : public integral_constant<bool, __is_same(_Tp, _Up)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsSame extends BuiltInOperation, @issame {
+  override string toString() { result = "__is_same" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsSame" }
+}
+
+/**
+ * A C++ `__is_function` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is a function type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_function
+ *   : public integral_constant<bool, __is_function(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsFunction extends BuiltInOperation, @isfunction {
+  override string toString() { result = "__is_function" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsFunction" }
+}
+
+/**
+ * A C++ `__is_layout_compatible` built-in operation (used by some implementations
+ * of the `<type_traits>` header).
+ *
+ * Returns `true` if two types are layout-compatible.
+ * ```
+ * template<typename _Tp, typename _Up>
+ *   struct is_layout_compatible
+ *   : public integral_constant<bool, __is_layout_compatible(_Tp, _Up)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsLayoutCompatible extends BuiltInOperation, @islayoutcompatible {
+  override string toString() { result = "__is_layout_compatible" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsLayoutCompatible" }
+}
+
+/**
+ * A C++ `__is_pointer_interconvertible_base_of` built-in operation (used
+ * by some implementations of the `<type_traits>` header).
+ *
+ * Returns `true` if the second type is pointer-interconvertible with the first type.
+ * ```
+ * template<typename _Tp, typename _Up>
+ *   struct is_pointer_interconvertible_base_of_v
+ *   : public integral_constant<bool, __is_pointer_interconvertible_base_of(_Tp, _Up)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsPointerInterconvertibleBaseOf extends BuiltInOperation,
+  @ispointerinterconvertiblebaseof {
+  override string toString() { result = "__is_pointer_interconvertible_base_of" }
+
+  override string getAPrimaryQlClass() {
+    result = "BuiltInOperationIsPointerInterconvertibleBaseOf"
+  }
+}
+
+/**
+ * A C++ `__is_array` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is an array type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_array
+ *   : public integral_constant<bool, __is_array(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsArray extends BuiltInOperation, @isarray {
+  override string toString() { result = "__is_array" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsArray" }
+}
+
+/**
+ * A C++ `__array_rank` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * If known, returns the number of dimentsions of an arrary type.
+ * ```
+ * template<typename _Tp>
+ *   struct rank
+ *   : public integral_constant<size_t, __array_rank(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationArrayRank extends BuiltInOperation, @arrayrank {
+  override string toString() { result = "__array_rank" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationArrayRank" }
+}
+
+/**
+ * A C++ `__array_extent` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * If known, returns the number of elements of an arrary type in the specified
+ * dimension.
+ * ```
+ * template<typename _Tp,  unsigned int _Dim>
+ *   struct extent
+ *   : public integral_constant<size_t, __array_extent(_Tp, _Dim)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationArrayExtent extends BuiltInOperation, @arrayextent {
+  override string toString() { result = "__array_extent" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationArrayExtent" }
+}
+
+/**
+ * A C++ `__is_arithmetic` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is an arithmetic type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_arithmetic
+ *   : public integral_constant<bool, __is_arithmetic(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsArithmetic extends BuiltInOperation, @isarithmetic {
+  override string toString() { result = "__is_arithmetic" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsArithmetic" }
+}
+
+/**
+ * A C++ `__is_complete_type` built-in operation.
+ *
+ * Returns `true` if a type is a complete type. Note that this built-in operation
+ * can return different values for the same type at different points in a program.
+ * ```
+ * class S;
+ * bool b = __complete_type(S);
+ * ```
+ */
+class BuiltInOperationIsCompleteType extends BuiltInOperation, @iscompletetype {
+  override string toString() { result = "__is_complete_type" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsCompleteType" }
+}
+
+/**
+ * A C++ `__is_compound` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is a compound type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_compound
+ *   : public integral_constant<bool, __is_compound(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsCompound extends BuiltInOperation, @iscompound {
+  override string toString() { result = "__is_compound" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsCompound" }
+}
+
+/**
+ * A C++ `__is_const` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is a const-qualified type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_const
+ *   : public integral_constant<bool, __is_const(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsConst extends BuiltInOperation, @isconst {
+  override string toString() { result = "__is_const" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsConst" }
+}
+
+/**
+ * A C++ `__is_floating_point` built-in operation (used by some implementations
+ * of the `<type_traits>` header).
+ *
+ * Returns `true` if a type is a floating point type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_floating_point
+ *   : public integral_constant<bool, __is_floating_point(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsFloatingPoint extends BuiltInOperation, @isfloatingpoint {
+  override string toString() { result = "__is_floating_point" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsFloatingPoint" }
+}
+
+/**
+ * A C++ `__is_fundamental` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is a fundamental C++ type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_fundamental
+ *   : public integral_constant<bool, __is_fundamental(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsFundamental extends BuiltInOperation, @isfundamental {
+  override string toString() { result = "__is_fundamental" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsFundamental" }
+}
+
+/**
+ * A C++ `__is_integral` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is an integral type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_integral
+ *   : public integral_constant<bool, __is_integral(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsIntegral extends BuiltInOperation, @isintegral {
+  override string toString() { result = "__is_integral" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsIntegral" }
+}
+
+/**
+ * A C++ `__is_lvalue_reference` built-in operation (used by some implementations
+ * of the `<type_traits>` header).
+ *
+ * Returns `true` if a type is an lvalue reference type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_lvalue_reference
+ *   : public integral_constant<bool, __is_lvalue_reference(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsLvalueReference extends BuiltInOperation, @islvaluereference {
+  override string toString() { result = "__is_lvalue_reference" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsLvalueReference" }
+}
+
+/**
+ * A C++ `__is_member_function_pointer` built-in operation (used by some implementations
+ * of the `<type_traits>` header).
+ *
+ * Returns `true` if a type is an non-static member function pointer type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_member_function_pointer
+ *   : public integral_constant<bool, __is_member_function_pointer(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsMemberFunctionPointer extends BuiltInOperation, @ismemberfunctionpointer {
+  override string toString() { result = "__is_member_function_pointer" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsMemberFunctionPointer" }
+}
+
+/**
+ * A C++ `__is_member_object_pointer` built-in operation (used by some implementations
+ * of the `<type_traits>` header).
+ *
+ * Returns `true` if a type is an non-static member object pointer type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_member_object_pointer
+ *   : public integral_constant<bool, __is_member_object_pointer(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsMemberObjectPointer extends BuiltInOperation, @ismemberobjectpointer {
+  override string toString() { result = "__is_member_object_pointer" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsMemberObjectPointer" }
+}
+
+/**
+ * A C++ `__is_member_pointer` built-in operation (used by some implementations
+ * of the `<type_traits>` header).
+ *
+ * Returns `true` if a type is an non-static member object of function pointer type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_member_pointer
+ *   : public integral_constant<bool, __is_member_pointer(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsMemberPointer extends BuiltInOperation, @ismemberpointer {
+  override string toString() { result = "__is_member_pointer" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsMemberPointer" }
+}
+
+/**
+ * A C++ `__is_object` built-in operation (used by some implementations
+ * of the `<type_traits>` header).
+ *
+ * Returns `true` if a type is an object type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_object
+ *   : public integral_constant<bool, __is_object(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsObject extends BuiltInOperation, @isobject {
+  override string toString() { result = "__is_object" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsObject" }
+}
+
+/**
+ * A C++ `__is_pointer` built-in operation (used by some implementations
+ * of the `<type_traits>` header).
+ *
+ * Returns `true` if a type is a pointer to an object or function type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_pointer
+ *   : public integral_constant<bool, __is_pointer(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsPointer extends BuiltInOperation, @ispointer {
+  override string toString() { result = "__is_pointer" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsPointer" }
+}
+
+/**
+ * A C++ `__is_reference` built-in operation (used by some implementations
+ * of the `<type_traits>` header).
+ *
+ * Returns `true` if a type is an lvalue or rvalue reference type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_reference
+ *   : public integral_constant<bool, __is_reference(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsReference extends BuiltInOperation, @isreference {
+  override string toString() { result = "__is_reference" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsReference" }
+}
+
+/**
+ * A C++ `__is_rvalue_reference` built-in operation (used by some implementations
+ * of the `<type_traits>` header).
+ *
+ * Returns `true` if a type is an rvalue reference type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_rvalue_reference
+ *   : public integral_constant<bool, __is_rvalue_reference(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsRvalueReference extends BuiltInOperation, @isrvaluereference {
+  override string toString() { result = "__is_rvalue_reference" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsRvalueReference" }
+}
+
+/**
+ * A C++ `__is_scalar` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is a scalar type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_scalar
+ *   : public integral_constant<bool, __is_scalar(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsScalar extends BuiltInOperation, @isscalar {
+  override string toString() { result = "__is_scalar" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsScalar" }
+}
+
+/**
+ * A C++ `__is_signed` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is a signed arithmetic type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_signed
+ *   : public integral_constant<bool, __is_signed(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsSigned extends BuiltInOperation, @issigned {
+  override string toString() { result = "__is_signed" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsSigned" }
+}
+
+/**
+ * A C++ `__is_unsigned` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is an unsigned arithmetic type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_unsigned
+ *   : public integral_constant<bool, __is_unsigned(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsUnsigned extends BuiltInOperation, @isunsigned {
+  override string toString() { result = "__is_unsigned" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsUnsigned" }
+}
+
+/**
+ * A C++ `__is_void` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is a void type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_void
+ *   : public integral_constant<bool, __is_void(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsVoid extends BuiltInOperation, @isvoid {
+  override string toString() { result = "__is_void" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsVoid" }
+}
+
+/**
+ * A C++ `__is_volatile` built-in operation (used by some implementations of the
+ * `<type_traits>` header).
+ *
+ * Returns `true` if a type is a volatile-qualified type.
+ * ```
+ * template<typename _Tp>
+ *   struct is_volatile
+ *   : public integral_constant<bool, __is_volatile(_Tp)>
+ *   { };
+ * ```
+ */
+class BuiltInOperationIsVolatile extends BuiltInOperation, @isvolatile {
+  override string toString() { result = "__is_volatile" }
+
+  override string getAPrimaryQlClass() { result = "BuiltInOperationIsVolatile" }
+}
+
 /**
  * A C/C++ `__builtin_bit_cast` built-in operation (used by some implementations
  * of `std::bit_cast`).
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll
deleted file mode 100644
index 659940def50..00000000000
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll
+++ /dev/null
@@ -1,795 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
-    maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaActualRead() or
-    SsaPhiRead() or
-    SsaDef()
-
-  class SsaRead = SsaActualRead or SsaPhiRead;
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaActualRead() and
-      result = "SsaActualRead"
-      or
-      this = SsaPhiRead() and
-      result = "SsaPhiRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this instanceof SsaRead and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if `bb` is in the dominance frontier of a block containing a
-   * read of `v`.
-   */
-  pragma[nomagic]
-  private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
-    exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
-      lastRefIsRead(readbb, v)
-      or
-      phiRead(readbb, v)
-    )
-  }
-
-  /**
-   * Holds if a phi-read node should be inserted for variable `v` at the beginning
-   * of basic block `bb`.
-   *
-   * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
-   * instead of writes, and only if the dominance-frontier block does not already
-   * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
-   * an internal implementation detail that is not exposed.
-   *
-   * The motivation for adding phi-reads is to improve performance of the use-use
-   * calculation in cases where there is a large number of reads that can reach the
-   * same join-point, and from there reach a large number of basic blocks. Example:
-   *
-   * ```cs
-   * if (a)
-   *   use(x);
-   * else if (b)
-   *   use(x);
-   * else if (c)
-   *   use(x);
-   * else if (d)
-   *   use(x);
-   * // many more ifs ...
-   *
-   * // phi-read for `x` inserted here
-   *
-   * // program not mentioning `x`, with large basic block graph
-   *
-   * use(x);
-   * ```
-   *
-   * Without phi-reads, the analysis has to replicate reachability for each of
-   * the guarded uses of `x`. However, with phi-reads, the analysis will limit
-   * each conditional use of `x` to reach the basic block containing the phi-read
-   * node for `x`, and only that basic block will have to compute reachability
-   * through the remainder of the large program.
-   *
-   * Like normal reads, each phi-read node `phi-read` can be reached from exactly
-   * one SSA definition (without passing through another definition): Assume, for
-   * the sake of contradiction, that there are two reaching definitions `def1` and
-   * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
-   * dominating definition will prevent the other from reaching `phi-read`. So, at
-   * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
-   * Then `def1` must go through one of its dominance-frontier blocks in order to
-   * reach `phi-read`. However, such a block will always start with a (normal) phi
-   * node, which contradicts reachability.
-   *
-   * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
-   * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
-   * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
-   * which contradicts reachability.
-   */
-  pragma[nomagic]
-  predicate phiRead(BasicBlock bb, SourceVariable v) {
-    inReadDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v) and
-    // only if there are no other references to `v` inside `bb`
-    not ref(bb, _, v, _) and
-    not exists(Definition def | def.definesAt(v, bb, _))
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  pragma[nomagic]
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaActualRead()
-    or
-    phiRead(bb, v) and
-    i = -1 and
-    k = SsaPhiRead()
-    or
-    any(Definition def).definesAt(v, bb, i) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, any(SsaRead k))
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, any(SsaRead k))
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
-    exists(ssaDefRank(def, v, bb, _, k))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable(), _)
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
-   * predecessor of `bb2`, and the underlying variable for `def` is neither read
-   * nor written in any block on the path between `bb1` and `bb2`.
-   *
-   * Phi reads are considered as normal reads for this predicate.
-   */
-  pragma[nomagic]
-  private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReachesInclPhiRead(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(def, bb1, bb2) and
-    defOccursInBlock(def, bb2, v, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
-    ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExclPhiRead(def, mid, bb2) and
-      phiReadStep(def, _, bb1, mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * the underlying variable `v` of `def` is accessed in basic block `bb2`
-   * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
-   * `v` is neither read nor written in any block on the path between `bb1`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesExclPhiRead(def, bb1, bb2) and
-    not defOccursInBlock(def, bb1, _, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb` (either a read or a write),
-   * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
-   * and `v` is neither read nor written in any block on the path between `bb`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReachesExit(Definition def, BasicBlock bb) {
-    exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExit(def, mid) and
-      phiReadStep(def, _, bb, mid)
-    )
-  }
-}
-
-predicate phiReadExposedForTesting = phiRead/2;
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last |
-    last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  ssaRef(bb, i, v, any(SsaRead k)) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  // Can reach another definition
-  lastRefRedef(def, bb, i, _)
-  or
-  exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    varBlockReachesExit(def, bb)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-
-  query predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
-      ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      (bb != bbDef or i < iDef)
-      or
-      ssaDefReachesRead(v, def, bb, i) and
-      not ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
-    )
-  }
-}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplSpecific.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplSpecific.qll
deleted file mode 100644
index 20f9d1894b1..00000000000
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplSpecific.qll
+++ /dev/null
@@ -1,18 +0,0 @@
-private import semmle.code.cpp.ir.IR
-private import SsaInternals as Ssa
-
-class BasicBlock = IRBlock;
-
-class SourceVariable = Ssa::SourceVariable;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock extends IRBlock {
-  ExitBasicBlock() { this.getLastInstruction() instanceof ExitFunctionInstruction }
-}
-
-predicate variableWrite = Ssa::variableWrite/4;
-
-predicate variableRead = Ssa::variableRead/4;
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
index 7aefc3893f2..2b86e0369bd 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
@@ -1,10 +1,10 @@
-import SsaImplCommon
 private import cpp as Cpp
 private import semmle.code.cpp.ir.IR
 private import DataFlowUtil
 private import DataFlowImplCommon as DataFlowImplCommon
 private import semmle.code.cpp.models.interfaces.Allocation as Alloc
 private import semmle.code.cpp.models.interfaces.DataFlow as DataFlow
+private import codeql.ssa.Ssa as SsaImplCommon
 
 private module SourceVariables {
   private newtype TSourceVariable =
@@ -38,8 +38,6 @@ private module SourceVariables {
   }
 }
 
-import SourceVariables
-
 cached
 private newtype TDefOrUse =
   TExplicitDef(Instruction store) { explicitWrite(_, store, _) } or
@@ -86,7 +84,7 @@ abstract class Def extends DefOrUse {
   Instruction getInstruction() { result = store }
 
   /** Gets the variable that is defined by this definition. */
-  abstract SourceVariable getSourceVariable();
+  abstract SourceVariables::SourceVariable getSourceVariable();
 
   /** Holds if this definition is guaranteed to happen. */
   abstract predicate isCertain();
@@ -103,10 +101,10 @@ abstract class Def extends DefOrUse {
 private class ExplicitDef extends Def, TExplicitDef {
   ExplicitDef() { this = TExplicitDef(store) }
 
-  override SourceVariable getSourceVariable() {
+  override SourceVariables::SourceVariable getSourceVariable() {
     exists(VariableInstruction var |
       explicitWrite(_, this.getInstruction(), var) and
-      result.(SourceIRVariable).getIRVariable() = var.getIRVariable()
+      result.(SourceVariables::SourceIRVariable).getIRVariable() = var.getIRVariable()
     )
   }
 
@@ -116,11 +114,11 @@ private class ExplicitDef extends Def, TExplicitDef {
 private class ParameterDef extends Def, TInitializeParam {
   ParameterDef() { this = TInitializeParam(store) }
 
-  override SourceVariable getSourceVariable() {
-    result.(SourceIRVariable).getIRVariable() =
+  override SourceVariables::SourceVariable getSourceVariable() {
+    result.(SourceVariables::SourceIRVariable).getIRVariable() =
       store.(InitializeParameterInstruction).getIRVariable()
     or
-    result.(SourceIRVariableIndirection).getUnderlyingIRVariable() =
+    result.(SourceVariables::SourceIRVariableIndirection).getUnderlyingIRVariable() =
       store.(InitializeIndirectionInstruction).getIRVariable()
   }
 
@@ -138,7 +136,7 @@ abstract class Use extends DefOrUse {
   override string toString() { result = "Use" }
 
   /** Gets the variable that is used by this use. */
-  abstract SourceVariable getSourceVariable();
+  abstract SourceVariables::SourceVariable getSourceVariable();
 
   override IRBlock getBlock() { result = use.getUse().getBlock() }
 
@@ -148,12 +146,14 @@ abstract class Use extends DefOrUse {
 private class ExplicitUse extends Use, TExplicitUse {
   ExplicitUse() { this = TExplicitUse(use) }
 
-  override SourceVariable getSourceVariable() {
+  override SourceVariables::SourceVariable getSourceVariable() {
     exists(VariableInstruction var |
       use.getDef() = var and
       if use.getUse() instanceof ReadSideEffectInstruction
-      then result.(SourceIRVariableIndirection).getUnderlyingIRVariable() = var.getIRVariable()
-      else result.(SourceIRVariable).getIRVariable() = var.getIRVariable()
+      then
+        result.(SourceVariables::SourceIRVariableIndirection).getUnderlyingIRVariable() =
+          var.getIRVariable()
+      else result.(SourceVariables::SourceIRVariable).getIRVariable() = var.getIRVariable()
     )
   }
 }
@@ -161,10 +161,11 @@ private class ExplicitUse extends Use, TExplicitUse {
 private class ReturnParameterIndirection extends Use, TReturnParamIndirection {
   ReturnParameterIndirection() { this = TReturnParamIndirection(use) }
 
-  override SourceVariable getSourceVariable() {
+  override SourceVariables::SourceVariable getSourceVariable() {
     exists(ReturnIndirectionInstruction ret |
       returnParameterIndirection(use, ret) and
-      result.(SourceIRVariableIndirection).getUnderlyingIRVariable() = ret.getIRVariable()
+      result.(SourceVariables::SourceIRVariableIndirection).getUnderlyingIRVariable() =
+        ret.getIRVariable()
     )
   }
 }
@@ -610,27 +611,45 @@ private module Cached {
 
 import Cached
 
-/**
- * Holds if the `i`'th write in block `bb` writes to the variable `v`.
- * `certain` is `true` if the write is guaranteed to overwrite the entire variable.
- */
-predicate variableWrite(IRBlock bb, int i, SourceVariable v, boolean certain) {
-  DataFlowImplCommon::forceCachingInSameStage() and
-  exists(Def def |
-    def.hasIndexInBlock(bb, i) and
-    v = def.getSourceVariable() and
-    (if def.isCertain() then certain = true else certain = false)
-  )
+private module SsaInput implements SsaImplCommon::InputSig {
+  private import semmle.code.cpp.ir.IR
+
+  class BasicBlock = IRBlock;
+
+  class SourceVariable = SourceVariables::SourceVariable;
+
+  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
+
+  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+  class ExitBasicBlock extends IRBlock {
+    ExitBasicBlock() { this.getLastInstruction() instanceof ExitFunctionInstruction }
+  }
+
+  /**
+   * Holds if the `i`'th write in block `bb` writes to the variable `v`.
+   * `certain` is `true` if the write is guaranteed to overwrite the entire variable.
+   */
+  predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    DataFlowImplCommon::forceCachingInSameStage() and
+    exists(Def def |
+      def.hasIndexInBlock(bb, i) and
+      v = def.getSourceVariable() and
+      (if def.isCertain() then certain = true else certain = false)
+    )
+  }
+
+  /**
+   * Holds if the `i`'th read in block `bb` reads to the variable `v`.
+   * `certain` is `true` if the read is guaranteed. For C++, this is always the case.
+   */
+  predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    exists(Use use |
+      use.hasIndexInBlock(bb, i) and
+      v = use.getSourceVariable() and
+      certain = true
+    )
+  }
 }
 
-/**
- * Holds if the `i`'th read in block `bb` reads to the variable `v`.
- * `certain` is `true` if the read is guaranteed. For C++, this is always the case.
- */
-predicate variableRead(IRBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(Use use |
-    use.hasIndexInBlock(bb, i) and
-    v = use.getSourceVariable() and
-    certain = true
-  )
-}
+import SsaImplCommon::Make<SsaInput>
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll
index 1c75529be00..873a3c635f8 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll
@@ -1,2 +1,2 @@
-private import SSAConstruction as SSA
-import SSA::SsaConsistency
+private import SSAConstruction as Ssa
+import Ssa::SsaConsistency
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
index 901735069c0..21c03e176a5 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
@@ -1135,7 +1135,7 @@ deprecated module SSAConsistency = SsaConsistency;
  * These predicates are all just aliases for predicates defined in the `Cached` module. This ensures
  * that all of SSA construction will be evaluated in the same stage.
  */
-module SSA {
+module Ssa {
   class MemoryLocation = Alias::MemoryLocation;
 
   predicate hasPhiInstruction = Cached::hasPhiInstructionCached/2;
@@ -1144,3 +1144,6 @@ module SSA {
 
   predicate hasUnreachedInstruction = Cached::hasUnreachedInstructionCached/1;
 }
+
+/** DEPRECATED: Alias for Ssa */
+deprecated module SSA = Ssa;
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstruction.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstruction.qll
index b30372a791b..5564a16f215 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstruction.qll
@@ -20,24 +20,24 @@ newtype TInstruction =
     IRConstruction::Raw::hasInstruction(tag1, tag2)
   } or
   TUnaliasedSsaPhiInstruction(
-    TRawInstruction blockStartInstr, UnaliasedSsa::SSA::MemoryLocation memoryLocation
+    TRawInstruction blockStartInstr, UnaliasedSsa::Ssa::MemoryLocation memoryLocation
   ) {
-    UnaliasedSsa::SSA::hasPhiInstruction(blockStartInstr, memoryLocation)
+    UnaliasedSsa::Ssa::hasPhiInstruction(blockStartInstr, memoryLocation)
   } or
   TUnaliasedSsaChiInstruction(TRawInstruction primaryInstruction) { none() } or
   TUnaliasedSsaUnreachedInstruction(IRFunctionBase irFunc) {
-    UnaliasedSsa::SSA::hasUnreachedInstruction(irFunc)
+    UnaliasedSsa::Ssa::hasUnreachedInstruction(irFunc)
   } or
   TAliasedSsaPhiInstruction(
-    TRawInstruction blockStartInstr, AliasedSsa::SSA::MemoryLocation memoryLocation
+    TRawInstruction blockStartInstr, AliasedSsa::Ssa::MemoryLocation memoryLocation
   ) {
-    AliasedSsa::SSA::hasPhiInstruction(blockStartInstr, memoryLocation)
+    AliasedSsa::Ssa::hasPhiInstruction(blockStartInstr, memoryLocation)
   } or
   TAliasedSsaChiInstruction(TRawInstruction primaryInstruction) {
-    AliasedSsa::SSA::hasChiInstruction(primaryInstruction)
+    AliasedSsa::Ssa::hasChiInstruction(primaryInstruction)
   } or
   TAliasedSsaUnreachedInstruction(IRFunctionBase irFunc) {
-    AliasedSsa::SSA::hasUnreachedInstruction(irFunc)
+    AliasedSsa::Ssa::hasUnreachedInstruction(irFunc)
   }
 
 /**
@@ -50,7 +50,7 @@ module UnaliasedSsaInstructions {
   class TPhiInstruction = TUnaliasedSsaPhiInstruction;
 
   TPhiInstruction phiInstruction(
-    TRawInstruction blockStartInstr, UnaliasedSsa::SSA::MemoryLocation memoryLocation
+    TRawInstruction blockStartInstr, UnaliasedSsa::Ssa::MemoryLocation memoryLocation
   ) {
     result = TUnaliasedSsaPhiInstruction(blockStartInstr, memoryLocation)
   }
@@ -83,7 +83,7 @@ module AliasedSsaInstructions {
   class TPhiInstruction = TAliasedSsaPhiInstruction or TUnaliasedSsaPhiInstruction;
 
   TPhiInstruction phiInstruction(
-    TRawInstruction blockStartInstr, AliasedSsa::SSA::MemoryLocation memoryLocation
+    TRawInstruction blockStartInstr, AliasedSsa::Ssa::MemoryLocation memoryLocation
   ) {
     result = TAliasedSsaPhiInstruction(blockStartInstr, memoryLocation)
   }
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll
index 93b20865cac..684aa4f14f2 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll
@@ -55,7 +55,15 @@ private predicate isDeeplyConstBelow(Type t) {
   isDeeplyConstBelow(t.(TypedefType).getBaseType())
 }
 
-private predicate isConstPointerLike(Type t) {
+/**
+ * INTERNAL: Do not use.
+ *
+ * Holds if `t` is a pointer-like type (i.e., a pointer,
+ * an array a reference, or a pointer-wrapper such as
+ * `std::unique_ptr`) that is constant and only contains
+ * constant types, excluding the type itself.
+ */
+predicate isConstPointerLike(Type t) {
   (
     t instanceof PointerWrapper
     or
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
index 36f1ce9443d..03a6422b114 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
@@ -13,8 +13,8 @@ private import TranslatedInitialization
  * Gets the `TranslatedDeclarationEntry` that represents the declaration
  * `entry`.
  */
-TranslatedDeclarationEntry getTranslatedDeclarationEntry(DeclarationEntry entry) {
-  result.getAst() = entry
+TranslatedDeclarationEntry getTranslatedDeclarationEntry(IRDeclarationEntry entry) {
+  result.getIRDeclarationEntry() = entry
 }
 
 /**
@@ -24,20 +24,22 @@ TranslatedDeclarationEntry getTranslatedDeclarationEntry(DeclarationEntry entry)
  * functions do not have a `TranslatedDeclarationEntry`.
  */
 abstract class TranslatedDeclarationEntry extends TranslatedElement, TTranslatedDeclarationEntry {
-  DeclarationEntry entry;
+  IRDeclarationEntry entry;
 
   TranslatedDeclarationEntry() { this = TTranslatedDeclarationEntry(entry) }
 
   final override Function getFunction() {
     exists(DeclStmt stmt |
-      stmt.getADeclarationEntry() = entry and
+      stmt = entry.getStmt() and
       result = stmt.getEnclosingFunction()
     )
   }
 
+  IRDeclarationEntry getIRDeclarationEntry() { result = entry }
+
   final override string toString() { result = entry.toString() }
 
-  final override Locatable getAst() { result = entry }
+  final override Locatable getAst() { result = entry.getAst() }
 
   /** DEPRECATED: Alias for getAst */
   deprecated override Locatable getAST() { result = getAst() }
@@ -216,7 +218,7 @@ class TranslatedStaticLocalVariableDeclarationEntry extends TranslatedDeclaratio
  */
 class TranslatedStaticLocalVariableInitialization extends TranslatedElement,
   TranslatedLocalVariableDeclaration, TTranslatedStaticLocalVariableInitialization {
-  VariableDeclarationEntry entry;
+  IRVariableDeclarationEntry entry;
   StaticLocalVariable var;
 
   TranslatedStaticLocalVariableInitialization() {
@@ -226,7 +228,7 @@ class TranslatedStaticLocalVariableInitialization extends TranslatedElement,
 
   final override string toString() { result = "init: " + entry.toString() }
 
-  final override Locatable getAst() { result = entry }
+  final override Locatable getAst() { result = entry.getAst() }
 
   /** DEPRECATED: Alias for getAst */
   deprecated override Locatable getAST() { result = getAst() }
@@ -236,40 +238,6 @@ class TranslatedStaticLocalVariableInitialization extends TranslatedElement,
   final override Function getFunction() { result = var.getFunction() }
 }
 
-/**
- * Gets the `TranslatedRangeBasedForVariableDeclaration` that represents the declaration of
- * `var`.
- */
-TranslatedRangeBasedForVariableDeclaration getTranslatedRangeBasedForVariableDeclaration(
-  LocalVariable var
-) {
-  result.getVariable() = var
-}
-
-/**
- * Represents the IR translation of a compiler-generated variable in a range-based `for` loop.
- */
-class TranslatedRangeBasedForVariableDeclaration extends TranslatedLocalVariableDeclaration,
-  TTranslatedRangeBasedForVariableDeclaration {
-  RangeBasedForStmt forStmt;
-  LocalVariable var;
-
-  TranslatedRangeBasedForVariableDeclaration() {
-    this = TTranslatedRangeBasedForVariableDeclaration(forStmt, var)
-  }
-
-  override string toString() { result = var.toString() }
-
-  override Locatable getAst() { result = var }
-
-  /** DEPRECATED: Alias for getAst */
-  deprecated override Locatable getAST() { result = getAst() }
-
-  override Function getFunction() { result = forStmt.getEnclosingFunction() }
-
-  override LocalVariable getVariable() { result = var }
-}
-
 TranslatedConditionDecl getTranslatedConditionDecl(ConditionDeclExpr expr) {
   result.getAst() = expr
 }
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
index 38a886746ab..3a350ea0e1a 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
@@ -443,10 +443,10 @@ predicate hasTranslatedSyntheticTemporaryObject(Expr expr) {
  * necessary for automatic local variables, or for static local variables with dynamic
  * initialization.
  */
-private predicate translateDeclarationEntry(DeclarationEntry entry) {
+private predicate translateDeclarationEntry(IRDeclarationEntry entry) {
   exists(DeclStmt declStmt, LocalVariable var |
     translateStmt(declStmt) and
-    declStmt.getADeclarationEntry() = entry and
+    declStmt = entry.getStmt() and
     // Only declarations of local variables need to be translated to IR.
     var = entry.getDeclaration() and
     (
@@ -458,6 +458,102 @@ private predicate translateDeclarationEntry(DeclarationEntry entry) {
   )
 }
 
+private module IRDeclarationEntries {
+  private newtype TIRDeclarationEntry =
+    TPresentDeclarationEntry(DeclarationEntry entry) or
+    TMissingDeclarationEntry(DeclStmt stmt, Declaration d, int index) {
+      not exists(stmt.getDeclarationEntry(index)) and
+      stmt.getDeclaration(index) = d
+    }
+
+  /**
+   * An entity that represents a declaration entry in the database.
+   *
+   * This class exists to work around the fact that `DeclStmt`s in some cases
+   * do not have `DeclarationEntry`s. Currently, this is the case for:
+   * - `DeclStmt`s in template instantiations.
+   * - `DeclStmt`s that are generated by the desugaring of range-based for-loops.
+   *
+   * So instead, the IR works with `IRDeclarationEntry`s that synthesize missing
+   * `DeclarationEntry`s when there is no result for `DeclStmt::getDeclarationEntry`.
+   */
+  abstract class IRDeclarationEntry extends TIRDeclarationEntry {
+    /** Gets a string representation of this `IRDeclarationEntry`. */
+    abstract string toString();
+
+    /** Gets the `DeclStmt` that this `IRDeclarationEntry` belongs to. */
+    abstract DeclStmt getStmt();
+
+    /** Gets the `Declaration` declared by this `IRDeclarationEntry`. */
+    abstract Declaration getDeclaration();
+
+    /** Gets the AST represented by this `IRDeclarationEntry`. */
+    abstract Locatable getAst();
+
+    /**
+     * Holds if this `IRDeclarationEntry` is the `index`'th entry
+     * declared by the enclosing `DeclStmt`.
+     */
+    abstract predicate hasIndex(int index);
+  }
+
+  /** A `IRDeclarationEntry` for an existing `DeclarationEntry`. */
+  private class PresentDeclarationEntry extends IRDeclarationEntry, TPresentDeclarationEntry {
+    DeclarationEntry entry;
+
+    PresentDeclarationEntry() { this = TPresentDeclarationEntry(entry) }
+
+    override string toString() { result = entry.toString() }
+
+    override DeclStmt getStmt() { result.getADeclarationEntry() = entry }
+
+    override Declaration getDeclaration() { result = entry.getDeclaration() }
+
+    override Locatable getAst() { result = entry }
+
+    override predicate hasIndex(int index) { this.getStmt().getDeclarationEntry(index) = entry }
+  }
+
+  /**
+   * A synthesized `DeclarationEntry` that is created when a `DeclStmt` is missing a
+   * result for `DeclStmt::getDeclarationEntry`
+   */
+  private class MissingDeclarationEntry extends IRDeclarationEntry, TMissingDeclarationEntry {
+    DeclStmt stmt;
+    Declaration d;
+    int index;
+
+    MissingDeclarationEntry() { this = TMissingDeclarationEntry(stmt, d, index) }
+
+    override string toString() { result = "missing declaration of " + d.getName() }
+
+    override DeclStmt getStmt() { result = stmt }
+
+    override Declaration getDeclaration() { result = d }
+
+    override Locatable getAst() { result = stmt }
+
+    override predicate hasIndex(int idx) { idx = index }
+  }
+
+  /** A `IRDeclarationEntry` that represents an entry for a `Variable`. */
+  class IRVariableDeclarationEntry instanceof IRDeclarationEntry {
+    Variable v;
+
+    IRVariableDeclarationEntry() { super.getDeclaration() = v }
+
+    Variable getDeclaration() { result = v }
+
+    string toString() { result = super.toString() }
+
+    Locatable getAst() { result = super.getAst() }
+
+    DeclStmt getStmt() { result = super.getStmt() }
+  }
+}
+
+import IRDeclarationEntries
+
 newtype TTranslatedElement =
   // An expression that is not being consumed as a condition
   TTranslatedValueExpr(Expr expr) {
@@ -613,23 +709,13 @@ newtype TTranslatedElement =
     )
   } or
   // A local declaration
-  TTranslatedDeclarationEntry(DeclarationEntry entry) { translateDeclarationEntry(entry) } or
+  TTranslatedDeclarationEntry(IRDeclarationEntry entry) { translateDeclarationEntry(entry) } or
   // The dynamic initialization of a static local variable. This is a separate object from the
   // declaration entry.
-  TTranslatedStaticLocalVariableInitialization(DeclarationEntry entry) {
+  TTranslatedStaticLocalVariableInitialization(IRDeclarationEntry entry) {
     translateDeclarationEntry(entry) and
     entry.getDeclaration() instanceof StaticLocalVariable
   } or
-  // A compiler-generated variable to implement a range-based for loop. These don't have a
-  // `DeclarationEntry` in the database, so we have to go by the `Variable` itself.
-  TTranslatedRangeBasedForVariableDeclaration(RangeBasedForStmt forStmt, LocalVariable var) {
-    translateStmt(forStmt) and
-    (
-      var = forStmt.getRangeVariable() or
-      var = forStmt.getBeginEndDeclaration().getADeclaration() or
-      var = forStmt.getVariable()
-    )
-  } or
   // An allocator call in a `new` or `new[]` expression
   TTranslatedAllocatorCall(NewOrNewArrayExpr newExpr) { not ignoreExpr(newExpr) } or
   // An allocation size for a `new` or `new[]` expression
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
index 187dbc2f994..ee14c9847bc 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
@@ -76,6 +76,13 @@ class TranslatedDeclStmt extends TranslatedStmt {
 
   private int getChildCount() { result = count(getDeclarationEntry(_)) }
 
+  IRDeclarationEntry getIRDeclarationEntry(int index) {
+    result.hasIndex(index) and
+    result.getStmt() = stmt
+  }
+
+  IRDeclarationEntry getAnIRDeclarationEntry() { result = this.getIRDeclarationEntry(_) }
+
   /**
    * Gets the `TranslatedDeclarationEntry` child at zero-based index `index`. Since not all
    * `DeclarationEntry` objects have a `TranslatedDeclarationEntry` (e.g. extern functions), we map
@@ -85,7 +92,7 @@ class TranslatedDeclStmt extends TranslatedStmt {
   private TranslatedDeclarationEntry getDeclarationEntry(int index) {
     result =
       rank[index + 1](TranslatedDeclarationEntry entry, int originalIndex |
-        entry = getTranslatedDeclarationEntry(stmt.getDeclarationEntry(originalIndex))
+        entry = getTranslatedDeclarationEntry(this.getIRDeclarationEntry(originalIndex))
       |
         entry order by originalIndex
       )
@@ -597,36 +604,32 @@ class TranslatedRangeBasedForStmt extends TranslatedStmt, ConditionContext {
   override RangeBasedForStmt stmt;
 
   override TranslatedElement getChild(int id) {
-    id = 0 and result = getRangeVariableDeclaration()
+    id = 0 and result = getRangeVariableDeclStmt()
     or
-    id = 1 and result = getBeginVariableDeclaration()
+    // Note: `__begin` and `__end` are declared by the same `DeclStmt`
+    id = 1 and result = getBeginEndVariableDeclStmt()
     or
-    id = 2 and result = getEndVariableDeclaration()
+    id = 2 and result = getCondition()
     or
-    id = 3 and result = getCondition()
+    id = 3 and result = getUpdate()
     or
-    id = 4 and result = getUpdate()
+    id = 4 and result = getVariableDeclStmt()
     or
-    id = 5 and result = getVariableDeclaration()
-    or
-    id = 6 and result = getBody()
+    id = 5 and result = getBody()
   }
 
   override Instruction getFirstInstruction() {
-    result = getRangeVariableDeclaration().getFirstInstruction()
+    result = getRangeVariableDeclStmt().getFirstInstruction()
   }
 
   override Instruction getChildSuccessor(TranslatedElement child) {
-    child = getRangeVariableDeclaration() and
-    result = getBeginVariableDeclaration().getFirstInstruction()
+    child = getRangeVariableDeclStmt() and
+    result = getBeginEndVariableDeclStmt().getFirstInstruction()
     or
-    child = getBeginVariableDeclaration() and
-    result = getEndVariableDeclaration().getFirstInstruction()
-    or
-    child = getEndVariableDeclaration() and
+    child = getBeginEndVariableDeclStmt() and
     result = getCondition().getFirstInstruction()
     or
-    child = getVariableDeclaration() and
+    child = getVariableDeclStmt() and
     result = getBody().getFirstInstruction()
     or
     child = getBody() and
@@ -643,23 +646,25 @@ class TranslatedRangeBasedForStmt extends TranslatedStmt, ConditionContext {
   override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) { none() }
 
   override Instruction getChildTrueSuccessor(TranslatedCondition child) {
-    child = getCondition() and result = getVariableDeclaration().getFirstInstruction()
+    child = getCondition() and result = getVariableDeclStmt().getFirstInstruction()
   }
 
   override Instruction getChildFalseSuccessor(TranslatedCondition child) {
     child = getCondition() and result = getParent().getChildSuccessor(this)
   }
 
-  private TranslatedRangeBasedForVariableDeclaration getRangeVariableDeclaration() {
-    result = getTranslatedRangeBasedForVariableDeclaration(stmt.getRangeVariable())
+  private TranslatedDeclStmt getRangeVariableDeclStmt() {
+    exists(IRVariableDeclarationEntry entry |
+      entry.getDeclaration() = stmt.getRangeVariable() and
+      result.getAnIRDeclarationEntry() = entry
+    )
   }
 
-  private TranslatedRangeBasedForVariableDeclaration getBeginVariableDeclaration() {
-    result = getTranslatedRangeBasedForVariableDeclaration(stmt.getBeginVariable())
-  }
-
-  private TranslatedRangeBasedForVariableDeclaration getEndVariableDeclaration() {
-    result = getTranslatedRangeBasedForVariableDeclaration(stmt.getEndVariable())
+  private TranslatedDeclStmt getBeginEndVariableDeclStmt() {
+    exists(IRVariableDeclarationEntry entry |
+      entry.getStmt() = stmt.getBeginEndDeclaration() and
+      result.getAnIRDeclarationEntry() = entry
+    )
   }
 
   // Public for getInstructionBackEdgeSuccessor
@@ -672,8 +677,11 @@ class TranslatedRangeBasedForStmt extends TranslatedStmt, ConditionContext {
     result = getTranslatedExpr(stmt.getUpdate().getFullyConverted())
   }
 
-  private TranslatedRangeBasedForVariableDeclaration getVariableDeclaration() {
-    result = getTranslatedRangeBasedForVariableDeclaration(stmt.getVariable())
+  private TranslatedDeclStmt getVariableDeclStmt() {
+    exists(IRVariableDeclarationEntry entry |
+      entry.getDeclaration() = stmt.getVariable() and
+      result.getAnIRDeclarationEntry() = entry
+    )
   }
 
   private TranslatedStmt getBody() { result = getTranslatedStmt(stmt.getStmt()) }
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll
index 1c75529be00..873a3c635f8 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll
@@ -1,2 +1,2 @@
-private import SSAConstruction as SSA
-import SSA::SsaConsistency
+private import SSAConstruction as Ssa
+import Ssa::SsaConsistency
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
index 901735069c0..21c03e176a5 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
@@ -1135,7 +1135,7 @@ deprecated module SSAConsistency = SsaConsistency;
  * These predicates are all just aliases for predicates defined in the `Cached` module. This ensures
  * that all of SSA construction will be evaluated in the same stage.
  */
-module SSA {
+module Ssa {
   class MemoryLocation = Alias::MemoryLocation;
 
   predicate hasPhiInstruction = Cached::hasPhiInstructionCached/2;
@@ -1144,3 +1144,6 @@ module SSA {
 
   predicate hasUnreachedInstruction = Cached::hasUnreachedInstructionCached/1;
 }
+
+/** DEPRECATED: Alias for Ssa */
+deprecated module SSA = Ssa;
diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll
index c93a5ad147b..8c531891bcd 100644
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll
@@ -176,7 +176,7 @@ private class StdSequenceContainerInsert extends TaintFunction {
     ) and
     (
       output.isQualifierObject() or
-      output.isReturnValueDeref()
+      output.isReturnValue()
     )
   }
 }
diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll
index ae190688b70..3d2eda59799 100644
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll
@@ -543,11 +543,11 @@ private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from second parameter to first parameter
-    input.isParameter(1) and
+    input.isParameterDeref(1) and
     output.isParameterDeref(0)
     or
     // flow from second parameter to return value
-    input.isParameter(1) and
+    input.isParameterDeref(1) and
     output.isReturnValueDeref()
     or
     // reverse flow from returned reference to the first parameter
diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll
index 1a65e7b6ca4..e729c3cb0a4 100644
--- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll
@@ -61,7 +61,7 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid
     input.isParameterDeref(0) and
     output.isParameterDeref(0)
     or
-    input.isParameter(1) and
+    input.isParameterDeref(1) and
     output.isParameterDeref(0)
   }
 
diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
index 5e899be68d4..de44913a39f 100644
--- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
@@ -46,6 +46,26 @@ class FunctionInput extends TFunctionInput {
    */
   deprecated final predicate isInParameter(ParameterIndex index) { this.isParameter(index) }
 
+  /**
+   * Holds if this is the input value pointed to (through `ind` number of indirections) by a
+   * pointer parameter to a function, or the input value referred to by a reference parameter
+   * to a function, where the parameter has index `index`.
+   *
+   * Example:
+   * ```
+   * void func(int n, char* p, float& r);
+   * ```
+   * - `isParameterDeref(1, 1)` holds for the `FunctionInput` that represents the value of `*p` (with
+   *   type `char`) on entry to the function.
+   * - `isParameterDeref(2, 1)` holds for the `FunctionInput` that represents the value of `r` (with type
+   *   `float`) on entry to the function.
+   * - There is no `FunctionInput` for which `isParameterDeref(0, _)` holds, because `n` is neither a
+   *   pointer nor a reference.
+   */
+  predicate isParameterDeref(ParameterIndex index, int ind) {
+    ind = 1 and this.isParameterDeref(index)
+  }
+
   /**
    * Holds if this is the input value pointed to by a pointer parameter to a function, or the input
    * value referred to by a reference parameter to a function, where the parameter has index
@@ -62,7 +82,7 @@ class FunctionInput extends TFunctionInput {
    * - There is no `FunctionInput` for which `isParameterDeref(0)` holds, because `n` is neither a
    *   pointer nor a reference.
    */
-  predicate isParameterDeref(ParameterIndex index) { none() }
+  predicate isParameterDeref(ParameterIndex index) { this.isParameterDeref(index, 1) }
 
   /**
    * Holds if this is the input value pointed to by a pointer parameter to a function, or the input
@@ -87,7 +107,22 @@ class FunctionInput extends TFunctionInput {
    * - `isQualifierObject()` holds for the `FunctionInput` that represents the value of `*this`
    *   (with type `C const`) on entry to the function.
    */
-  predicate isQualifierObject() { none() }
+  predicate isQualifierObject(int ind) { ind = 1 and this.isQualifierObject() }
+
+  /**
+   * Holds if this is the input value pointed to by the `this` pointer of an instance member
+   * function.
+   *
+   * Example:
+   * ```
+   * struct C {
+   *   void mfunc(int n, char* p, float& r) const;
+   * };
+   * ```
+   * - `isQualifierObject()` holds for the `FunctionInput` that represents the value of `*this`
+   *   (with type `C const`) on entry to the function.
+   */
+  predicate isQualifierObject() { this.isQualifierObject(1) }
 
   /**
    * Holds if this is the input value pointed to by the `this` pointer of an instance member
@@ -143,16 +178,49 @@ class FunctionInput extends TFunctionInput {
    * rare, but they do occur when a function returns a reference to itself,
    * part of itself, or one of its other inputs.
    */
-  predicate isReturnValueDeref() { none() }
+  predicate isReturnValueDeref() { this.isReturnValueDeref(1) }
+
+  /**
+   * Holds if this is the input value pointed to by the return value of a
+   * function, if the function returns a pointer, or the input value referred
+   * to by the return value of a function, if the function returns a reference.
+   *
+   * Example:
+   * ```
+   * char* getPointer();
+   * float& getReference();
+   * int getInt();
+   * ```
+   * - `isReturnValueDeref(1)` holds for the `FunctionInput` that represents the
+   *   value of `*getPointer()` (with type `char`).
+   * - `isReturnValueDeref(1)` holds for the `FunctionInput` that represents the
+   *   value of `getReference()` (with type `float`).
+   * - There is no `FunctionInput` of `getInt()` for which
+   *   `isReturnValueDeref(_)` holds because the return type of `getInt()` is
+   *   neither a pointer nor a reference.
+   *
+   * Note that data flows in through function return values are relatively
+   * rare, but they do occur when a function returns a reference to itself,
+   * part of itself, or one of its other inputs.
+   */
+  predicate isReturnValueDeref(int ind) { ind = 1 and this.isReturnValueDeref() }
+
+  /**
+   * Holds if `i >= 0` and `isParameterDeref(i, ind)` holds for this value, or
+   * if `i = -1` and `isQualifierObject(ind)` holds for this value.
+   */
+  final predicate isParameterDerefOrQualifierObject(ParameterIndex i, int ind) {
+    i >= 0 and this.isParameterDeref(i, ind)
+    or
+    i = -1 and this.isQualifierObject(ind)
+  }
 
   /**
    * Holds if `i >= 0` and `isParameterDeref(i)` holds for this value, or
    * if `i = -1` and `isQualifierObject()` holds for this value.
    */
   final predicate isParameterDerefOrQualifierObject(ParameterIndex i) {
-    i >= 0 and this.isParameterDeref(i)
-    or
-    i = -1 and this.isQualifierObject()
+    this.isParameterDerefOrQualifierObject(i, 1)
   }
 }
 
@@ -308,7 +376,25 @@ class FunctionOutput extends TFunctionOutput {
    * - There is no `FunctionOutput` for which `isParameterDeref(0)` holds, because `n` is neither a
    *   pointer nor a reference.
    */
-  predicate isParameterDeref(ParameterIndex i) { none() }
+  predicate isParameterDeref(ParameterIndex i) { this.isParameterDeref(i, 1) }
+
+  /**
+   * Holds if this is the output value pointed to by a pointer parameter (through `ind` number
+   * of indirections) to a function, or the output value referred to by a reference parameter to
+   * a function, where the parameter has index `index`.
+   *
+   * Example:
+   * ```
+   * void func(int n, char* p, float& r);
+   * ```
+   * - `isParameterDeref(1, 1)` holds for the `FunctionOutput` that represents the value of `*p` (with
+   *   type `char`) on return from the function.
+   * - `isParameterDeref(2, 1)` holds for the `FunctionOutput` that represents the value of `r` (with
+   *   type `float`) on return from the function.
+   * - There is no `FunctionOutput` for which `isParameterDeref(0, _)` holds, because `n` is neither a
+   *   pointer nor a reference.
+   */
+  predicate isParameterDeref(ParameterIndex i, int ind) { ind = 1 and this.isParameterDeref(i) }
 
   /**
    * Holds if this is the output value pointed to by a pointer parameter to a function, or the
@@ -333,7 +419,22 @@ class FunctionOutput extends TFunctionOutput {
    * - `isQualifierObject()` holds for the `FunctionOutput` that represents the value of `*this`
    *   (with type `C`) on return from the function.
    */
-  predicate isQualifierObject() { none() }
+  predicate isQualifierObject() { this.isQualifierObject(1) }
+
+  /**
+   * Holds if this is the output value pointed to by the `this` pointer of an instance member
+   *   function.
+   *
+   * Example:
+   * ```
+   * struct C {
+   *   void mfunc(int n, char* p, float& r);
+   * };
+   * ```
+   * - `isQualifierObject()` holds for the `FunctionOutput` that represents the value of `*this`
+   *   (with type `C`) on return from the function.
+   */
+  predicate isQualifierObject(int ind) { ind = 1 and this.isQualifierObject() }
 
   /**
    * Holds if this is the output value pointed to by the `this` pointer of an instance member
@@ -385,7 +486,27 @@ class FunctionOutput extends TFunctionOutput {
    * - There is no `FunctionOutput` of `getInt()` for which `isReturnValueDeref()` holds because the
    *   return type of `getInt()` is neither a pointer nor a reference.
    */
-  predicate isReturnValueDeref() { none() }
+  predicate isReturnValueDeref() { this.isReturnValueDeref(_) }
+
+  /**
+   * Holds if this is the output value pointed to by the return value of a function, if the function
+   * returns a pointer, or the output value referred to by the return value of a function, if the
+   * function returns a reference.
+   *
+   * Example:
+   * ```
+   * char* getPointer();
+   * float& getReference();
+   * int getInt();
+   * ```
+   * - `isReturnValueDeref(1)` holds for the `FunctionOutput` that represents the value of
+   *   `*getPointer()` (with type `char`).
+   * - `isReturnValueDeref(1)` holds for the `FunctionOutput` that represents the value of
+   *   `getReference()` (with type `float`).
+   * - There is no `FunctionOutput` of `getInt()` for which `isReturnValueDeref(_)` holds because the
+   *   return type of `getInt()` is neither a pointer nor a reference.
+   */
+  predicate isReturnValueDeref(int ind) { ind = 1 and this.isReturnValueDeref() }
 
   /**
    * Holds if this is the output value pointed to by the return value of a function, if the function
@@ -395,14 +516,22 @@ class FunctionOutput extends TFunctionOutput {
    */
   deprecated final predicate isOutReturnPointer() { this.isReturnValueDeref() }
 
+  /**
+   * Holds if `i >= 0` and `isParameterDeref(i, ind)` holds for this is the value, or
+   * if `i = -1` and `isQualifierObject(ind)` holds for this value.
+   */
+  final predicate isParameterDerefOrQualifierObject(ParameterIndex i, int ind) {
+    i >= 0 and this.isParameterDeref(i, ind)
+    or
+    i = -1 and this.isQualifierObject(ind)
+  }
+
   /**
    * Holds if `i >= 0` and `isParameterDeref(i)` holds for this is the value, or
    * if `i = -1` and `isQualifierObject()` holds for this value.
    */
   final predicate isParameterDerefOrQualifierObject(ParameterIndex i) {
-    i >= 0 and this.isParameterDeref(i)
-    or
-    i = -1 and this.isQualifierObject()
+    this.isParameterDerefOrQualifierObject(i, 1)
   }
 }
 
@@ -431,6 +560,10 @@ class OutParameterDeref extends FunctionOutput, TOutParameterDeref {
   ParameterIndex getIndex() { result = index }
 
   override predicate isParameterDeref(ParameterIndex i) { i = index }
+
+  override predicate isParameterDeref(ParameterIndex i, int ind) {
+    this.isParameterDeref(i) and ind = 1
+  }
 }
 
 /**
diff --git a/cpp/ql/lib/semmle/code/cpp/pointsto/PointsTo.qll b/cpp/ql/lib/semmle/code/cpp/pointsto/PointsTo.qll
index 83b8c2936f0..542ce985060 100644
--- a/cpp/ql/lib/semmle/code/cpp/pointsto/PointsTo.qll
+++ b/cpp/ql/lib/semmle/code/cpp/pointsto/PointsTo.qll
@@ -19,6 +19,10 @@
  * `pointstoinfo` predicate determines the transitively implied points-to
  * information by collapsing pointers into equivalence classes. These
  * equivalence classes are called "points-to sets".
+ *
+ * WARNING: This library may perform poorly on very large projects.
+ * Consider using another library such as `semmle.code.cpp.dataflow.DataFlow`
+ * instead.
  */
 
 import semmle.code.cpp.commons.File
diff --git a/cpp/ql/lib/semmle/code/cpp/valuenumbering/GlobalValueNumberingImpl.qll b/cpp/ql/lib/semmle/code/cpp/valuenumbering/GlobalValueNumberingImpl.qll
index d5e69d31254..7dd55dbfde3 100644
--- a/cpp/ql/lib/semmle/code/cpp/valuenumbering/GlobalValueNumberingImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/valuenumbering/GlobalValueNumberingImpl.qll
@@ -165,7 +165,7 @@ private ControlFlowNode mostRecentSideEffect(ControlFlowNode node) {
 
 /** Used to represent the "global value number" of an expression. */
 cached
-private newtype GVNBase =
+private newtype GvnBase =
   GVN_IntConst(int val, Type t) { mk_IntConst(val, t, _) } or
   GVN_FloatConst(float val, Type t) { mk_FloatConst(val, t, _) } or
   // If the local variable does not have a defining value, then
@@ -221,8 +221,8 @@ private newtype GVNBase =
  * expression with this `GVN` and using its `toString` and `getLocation`
  * methods.
  */
-class GVN extends GVNBase {
-  GVN() { this instanceof GVNBase }
+class GVN extends GvnBase {
+  GVN() { this instanceof GvnBase }
 
   /** Gets an expression that has this GVN. */
   Expr getAnExpr() { this = globalValueNumber(result) }
diff --git a/cpp/ql/lib/semmlecode.cpp.dbscheme b/cpp/ql/lib/semmlecode.cpp.dbscheme
index f96ad9b2da4..625f706f2a4 100644
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme
@@ -746,7 +746,7 @@ type_mentions(
     unique int id: @type_mention,
     int type_id: @type ref,
     int location: @location ref,
-    // a_symbol_reference_kind from the EDG frontend.  See symbol_ref.h there.
+    // a_symbol_reference_kind from the frontend.
     int kind: int ref
 );
 
@@ -1596,7 +1596,7 @@ case @expr.kind of
 | 117 = @ispolyexpr // __is_polymorphic ::= type
 | 118 = @isunionexpr // __is_union ::= type
 | 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
-| 120 = @intaddrexpr // EDG internal builtin, used to implement offsetof
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
 // ...
 | 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
 | 123 = @literal
@@ -1666,6 +1666,33 @@ case @expr.kind of
 | 333 = @builtinbitcast
 | 334 = @builtinshuffle
 | 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
 ;
 
 @var_args_expr = @vastartexpr
@@ -1732,6 +1759,33 @@ case @expr.kind of
             | @hasuniqueobjectrepresentations
             | @builtinbitcast
             | @builtinshuffle
+            | @issame
+            | @isfunction
+            | @islayoutcompatible
+            | @ispointerinterconvertiblebaseof
+            | @isarray
+            | @arrayrank
+            | @arrayextent
+            | @isarithmetic
+            | @iscompletetype
+            | @iscompound
+            | @isconst
+            | @isfloatingpoint
+            | @isfundamental
+            | @isintegral
+            | @islvaluereference
+            | @ismemberfunctionpointer
+            | @ismemberobjectpointer
+            | @ismemberpointer
+            | @isobject
+            | @ispointer
+            | @isreference
+            | @isrvaluereference
+            | @isscalar
+            | @issigned
+            | @isunsigned
+            | @isvoid
+            | @isvolatile
             ;
 
 new_allocated_type(
diff --git a/cpp/ql/lib/semmlecode.cpp.dbscheme.stats b/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
index 7fb9f2c2e4d..69f7841b64c 100644
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
@@ -16,21 +16,21 @@
             <k>@svnentry</k>
             <v>575525</v>
         </e>
+        <e>
+            <k>@location_default</k>
+            <v>29655085</v>
+        </e>
         <e>
             <k>@location_stmt</k>
-            <v>3813503</v>
+            <v>3813506</v>
         </e>
         <e>
             <k>@location_expr</k>
-            <v>13165921</v>
-        </e>
-        <e>
-            <k>@location_default</k>
-            <v>29655056</v>
+            <v>13165934</v>
         </e>
         <e>
             <k>@diagnostic</k>
-            <v>72092</v>
+            <v>72091</v>
         </e>
         <e>
             <k>@file</k>
@@ -42,27 +42,27 @@
         </e>
         <e>
             <k>@macroinvocation</k>
-            <v>33818017</v>
+            <v>34146969</v>
         </e>
         <e>
             <k>@function</k>
-            <v>4628077</v>
+            <v>4628081</v>
         </e>
         <e>
             <k>@fun_decl</k>
-            <v>4995583</v>
+            <v>4995588</v>
         </e>
         <e>
             <k>@var_decl</k>
-            <v>8391080</v>
+            <v>8391088</v>
         </e>
         <e>
             <k>@type_decl</k>
-            <v>3240440</v>
+            <v>3240444</v>
         </e>
         <e>
             <k>@namespace_decl</k>
-            <v>307432</v>
+            <v>307431</v>
         </e>
         <e>
             <k>@using</k>
@@ -74,23 +74,23 @@
         </e>
         <e>
             <k>@parameter</k>
-            <v>6536424</v>
+            <v>6536430</v>
         </e>
         <e>
             <k>@membervariable</k>
-            <v>1052962</v>
+            <v>1052936</v>
         </e>
         <e>
             <k>@globalvariable</k>
-            <v>300708</v>
+            <v>301270</v>
         </e>
         <e>
             <k>@localvariable</k>
-            <v>581177</v>
+            <v>581167</v>
         </e>
         <e>
             <k>@enumconstant</k>
-            <v>241273</v>
+            <v>241267</v>
         </e>
         <e>
             <k>@builtintype</k>
@@ -98,7 +98,7 @@
         </e>
         <e>
             <k>@derivedtype</k>
-            <v>4324907</v>
+            <v>4324912</v>
         </e>
         <e>
             <k>@decltype</k>
@@ -106,19 +106,19 @@
         </e>
         <e>
             <k>@usertype</k>
-            <v>5230250</v>
+            <v>5230255</v>
         </e>
         <e>
             <k>@mangledname</k>
-            <v>2114402</v>
+            <v>2114368</v>
         </e>
         <e>
             <k>@type_mention</k>
-            <v>4022510</v>
+            <v>4022409</v>
         </e>
         <e>
             <k>@routinetype</k>
-            <v>547156</v>
+            <v>547157</v>
         </e>
         <e>
             <k>@ptrtomember</k>
@@ -128,26 +128,6 @@
             <k>@specifier</k>
             <v>24531</v>
         </e>
-        <e>
-            <k>@gnuattribute</k>
-            <v>680858</v>
-        </e>
-        <e>
-            <k>@stdattribute</k>
-            <v>493039</v>
-        </e>
-        <e>
-            <k>@alignas</k>
-            <v>9719</v>
-        </e>
-        <e>
-            <k>@declspec</k>
-            <v>243695</v>
-        </e>
-        <e>
-            <k>@msattribute</k>
-            <v>3</v>
-        </e>
         <e>
             <k>@attribute_arg_token</k>
             <v>38879</v>
@@ -168,17 +148,37 @@
             <k>@attribute_arg_constant</k>
             <v>1</v>
         </e>
+        <e>
+            <k>@gnuattribute</k>
+            <v>680858</v>
+        </e>
+        <e>
+            <k>@stdattribute</k>
+            <v>493031</v>
+        </e>
+        <e>
+            <k>@alignas</k>
+            <v>9719</v>
+        </e>
+        <e>
+            <k>@declspec</k>
+            <v>243692</v>
+        </e>
+        <e>
+            <k>@msattribute</k>
+            <v>3</v>
+        </e>
         <e>
             <k>@derivation</k>
             <v>368264</v>
         </e>
         <e>
             <k>@frienddecl</k>
-            <v>716133</v>
+            <v>716134</v>
         </e>
         <e>
             <k>@comment</k>
-            <v>8773472</v>
+            <v>8773331</v>
         </e>
         <e>
             <k>@namespace</k>
@@ -190,15 +190,15 @@
         </e>
         <e>
             <k>@namequalifier</k>
-            <v>1533107</v>
+            <v>1533108</v>
         </e>
         <e>
             <k>@value</k>
-            <v>10759270</v>
+            <v>10759479</v>
         </e>
         <e>
             <k>@initialiser</k>
-            <v>1699581</v>
+            <v>1699574</v>
         </e>
         <e>
             <k>@lambdacapture</k>
@@ -214,15 +214,15 @@
         </e>
         <e>
             <k>@reference_to</k>
-            <v>1592318</v>
+            <v>1592319</v>
         </e>
         <e>
             <k>@indirect</k>
-            <v>292162</v>
+            <v>292157</v>
         </e>
         <e>
             <k>@ref_indirect</k>
-            <v>1938635</v>
+            <v>1938637</v>
         </e>
         <e>
             <k>@array_to_pointer</k>
@@ -234,7 +234,7 @@
         </e>
         <e>
             <k>@parexpr</k>
-            <v>3581771</v>
+            <v>3581772</v>
         </e>
         <e>
             <k>@arithnegexpr</k>
@@ -246,11 +246,11 @@
         </e>
         <e>
             <k>@notexpr</k>
-            <v>275941</v>
+            <v>275934</v>
         </e>
         <e>
             <k>@postincrexpr</k>
-            <v>61943</v>
+            <v>61942</v>
         </e>
         <e>
             <k>@postdecrexpr</k>
@@ -270,7 +270,7 @@
         </e>
         <e>
             <k>@addexpr</k>
-            <v>397789</v>
+            <v>397795</v>
         </e>
         <e>
             <k>@subexpr</k>
@@ -278,11 +278,11 @@
         </e>
         <e>
             <k>@mulexpr</k>
-            <v>305921</v>
+            <v>305914</v>
         </e>
         <e>
             <k>@divexpr</k>
-            <v>132913</v>
+            <v>132910</v>
         </e>
         <e>
             <k>@remexpr</k>
@@ -290,35 +290,35 @@
         </e>
         <e>
             <k>@paddexpr</k>
-            <v>86519</v>
+            <v>86517</v>
         </e>
         <e>
             <k>@psubexpr</k>
-            <v>49818</v>
+            <v>49816</v>
         </e>
         <e>
             <k>@pdiffexpr</k>
-            <v>35456</v>
+            <v>35455</v>
         </e>
         <e>
             <k>@lshiftexpr</k>
-            <v>565473</v>
+            <v>565465</v>
         </e>
         <e>
             <k>@rshiftexpr</k>
-            <v>140572</v>
+            <v>140568</v>
         </e>
         <e>
             <k>@andexpr</k>
-            <v>488189</v>
+            <v>488177</v>
         </e>
         <e>
             <k>@orexpr</k>
-            <v>145188</v>
+            <v>145184</v>
         </e>
         <e>
             <k>@xorexpr</k>
-            <v>54086</v>
+            <v>54084</v>
         </e>
         <e>
             <k>@eqexpr</k>
@@ -338,15 +338,15 @@
         </e>
         <e>
             <k>@geexpr</k>
-            <v>59151</v>
+            <v>59150</v>
         </e>
         <e>
             <k>@leexpr</k>
-            <v>212175</v>
+            <v>212171</v>
         </e>
         <e>
             <k>@assignexpr</k>
-            <v>935391</v>
+            <v>935392</v>
         </e>
         <e>
             <k>@assignaddexpr</k>
@@ -378,7 +378,7 @@
         </e>
         <e>
             <k>@assignandexpr</k>
-            <v>4817</v>
+            <v>4816</v>
         </e>
         <e>
             <k>@assignorexpr</k>
@@ -398,15 +398,15 @@
         </e>
         <e>
             <k>@orlogicalexpr</k>
-            <v>864675</v>
+            <v>864670</v>
         </e>
         <e>
             <k>@commaexpr</k>
-            <v>124044</v>
+            <v>124042</v>
         </e>
         <e>
             <k>@subscriptexpr</k>
-            <v>367585</v>
+            <v>367579</v>
         </e>
         <e>
             <k>@callexpr</k>
@@ -426,11 +426,11 @@
         </e>
         <e>
             <k>@varaccess</k>
-            <v>6019055</v>
+            <v>6019061</v>
         </e>
         <e>
             <k>@thisaccess</k>
-            <v>1127165</v>
+            <v>1127159</v>
         </e>
         <e>
             <k>@new_expr</k>
@@ -458,7 +458,7 @@
         </e>
         <e>
             <k>@runtime_sizeof</k>
-            <v>295484</v>
+            <v>295477</v>
         </e>
         <e>
             <k>@runtime_alignof</k>
@@ -470,11 +470,11 @@
         </e>
         <e>
             <k>@routineexpr</k>
-            <v>2917668</v>
+            <v>2917671</v>
         </e>
         <e>
             <k>@type_operand</k>
-            <v>1126886</v>
+            <v>1126879</v>
         </e>
         <e>
             <k>@isemptyexpr</k>
@@ -490,7 +490,7 @@
         </e>
         <e>
             <k>@literal</k>
-            <v>4406598</v>
+            <v>4406610</v>
         </e>
         <e>
             <k>@aggregateliteral</k>
@@ -506,7 +506,7 @@
         </e>
         <e>
             <k>@ctordirectinit</k>
-            <v>112980</v>
+            <v>112981</v>
         </e>
         <e>
             <k>@ctorvirtualinit</k>
@@ -534,7 +534,7 @@
         </e>
         <e>
             <k>@static_cast</k>
-            <v>210928</v>
+            <v>210926</v>
         </e>
         <e>
             <k>@reinterpret_cast</k>
@@ -542,7 +542,7 @@
         </e>
         <e>
             <k>@const_cast</k>
-            <v>35247</v>
+            <v>35246</v>
         </e>
         <e>
             <k>@dynamic_cast</k>
@@ -654,7 +654,7 @@
         </e>
         <e>
             <k>@expr_stmt</k>
-            <v>94228</v>
+            <v>94226</v>
         </e>
         <e>
             <k>@offsetofexpr</k>
@@ -730,7 +730,7 @@
         </e>
         <e>
             <k>@typescompexpr</k>
-            <v>562843</v>
+            <v>562840</v>
         </e>
         <e>
             <k>@intaddrexpr</k>
@@ -834,7 +834,7 @@
         </e>
         <e>
             <k>@builtinchooseexpr</k>
-            <v>9069</v>
+            <v>9068</v>
         </e>
         <e>
             <k>@vec_fill</k>
@@ -884,9 +884,117 @@
             <k>@blockassignexpr</k>
             <v>12</v>
         </e>
+        <e>
+            <k>@issame</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isfunction</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@islayoutcompatible</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@ispointerinterconvertiblebaseof</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isarray</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@arrayrank</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@arrayextent</k>
+            <v>3</v>
+        </e>
+        <e>
+            <k>@isarithmetic</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@iscompletetype</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@iscompound</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isconst</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isfloatingpoint</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isfundamental</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isintegral</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@islvaluereference</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@ismemberfunctionpointer</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@ismemberobjectpointer</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@ismemberpointer</k>
+            <v>3</v>
+        </e>
+        <e>
+            <k>@isobject</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@ispointer</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isreference</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isrvaluereference</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isscalar</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@issigned</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isunsigned</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isvoid</k>
+            <v>2</v>
+        </e>
+        <e>
+            <k>@isvolatile</k>
+            <v>2</v>
+        </e>
         <e>
             <k>@stmt_expr</k>
-            <v>1483542</v>
+            <v>1483544</v>
         </e>
         <e>
             <k>@stmt_if</k>
@@ -898,19 +1006,19 @@
         </e>
         <e>
             <k>@stmt_label</k>
-            <v>53054</v>
+            <v>53053</v>
         </e>
         <e>
             <k>@stmt_return</k>
-            <v>1285345</v>
+            <v>1285346</v>
         </e>
         <e>
             <k>@stmt_block</k>
-            <v>1423276</v>
+            <v>1423277</v>
         </e>
         <e>
             <k>@stmt_end_test_while</k>
-            <v>148628</v>
+            <v>148625</v>
         </e>
         <e>
             <k>@stmt_for</k>
@@ -922,7 +1030,7 @@
         </e>
         <e>
             <k>@stmt_switch</k>
-            <v>20747</v>
+            <v>20746</v>
         </e>
         <e>
             <k>@stmt_try_block</k>
@@ -930,19 +1038,19 @@
         </e>
         <e>
             <k>@stmt_decl</k>
-            <v>606536</v>
+            <v>606532</v>
         </e>
         <e>
             <k>@stmt_empty</k>
-            <v>193314</v>
+            <v>193310</v>
         </e>
         <e>
             <k>@stmt_continue</k>
-            <v>22525</v>
+            <v>22524</v>
         </e>
         <e>
             <k>@stmt_break</k>
-            <v>102345</v>
+            <v>102344</v>
         </e>
         <e>
             <k>@stmt_range_based_for</k>
@@ -954,15 +1062,15 @@
         </e>
         <e>
             <k>@stmt_constexpr_if</k>
-            <v>52504</v>
+            <v>52503</v>
         </e>
         <e>
             <k>@stmt_goto</k>
-            <v>110508</v>
+            <v>110506</v>
         </e>
         <e>
             <k>@stmt_asm</k>
-            <v>109773</v>
+            <v>109770</v>
         </e>
         <e>
             <k>@stmt_microsoft_try</k>
@@ -986,7 +1094,7 @@
         </e>
         <e>
             <k>@ppd_if</k>
-            <v>661418</v>
+            <v>661419</v>
         </e>
         <e>
             <k>@ppd_ifdef</k>
@@ -1006,7 +1114,7 @@
         </e>
         <e>
             <k>@ppd_endif</k>
-            <v>1186757</v>
+            <v>1186758</v>
         </e>
         <e>
             <k>@ppd_plain_include</k>
@@ -1014,7 +1122,7 @@
         </e>
         <e>
             <k>@ppd_define</k>
-            <v>2433089</v>
+            <v>2433050</v>
         </e>
         <e>
             <k>@ppd_undef</k>
@@ -1022,7 +1130,7 @@
         </e>
         <e>
             <k>@ppd_pragma</k>
-            <v>311993</v>
+            <v>311988</v>
         </e>
         <e>
             <k>@ppd_include_next</k>
@@ -1030,7 +1138,7 @@
         </e>
         <e>
             <k>@ppd_line</k>
-            <v>27756</v>
+            <v>27755</v>
         </e>
         <e>
             <k>@ppd_error</k>
@@ -1124,7 +1232,7 @@
         </relation>
         <relation>
             <name>compilation_args</name>
-            <cardinality>651309</cardinality>
+            <cardinality>651293</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
@@ -1136,7 +1244,7 @@
                 </e>
                 <e>
                     <k>arg</k>
-                    <v>34395</v>
+                    <v>34394</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -1160,7 +1268,7 @@
                                 <b>
                                     <a>126</a>
                                     <b>127</b>
-                                    <v>3861</v>
+                                    <v>3860</v>
                                 </b>
                                 <b>
                                     <a>127</a>
@@ -1201,7 +1309,7 @@
                                 <b>
                                     <a>106</a>
                                     <b>107</b>
-                                    <v>3824</v>
+                                    <v>3823</v>
                                 </b>
                                 <b>
                                     <a>107</a>
@@ -1374,7 +1482,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>32335</v>
+                                    <v>32334</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -1395,7 +1503,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>33191</v>
+                                    <v>33190</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -1410,7 +1518,7 @@
         </relation>
         <relation>
             <name>compilation_compiling_files</name>
-            <cardinality>11527</cardinality>
+            <cardinality>11526</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
@@ -1538,7 +1646,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1755</v>
+                                    <v>1754</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -1574,7 +1682,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1755</v>
+                                    <v>1754</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -1656,7 +1764,7 @@
         </relation>
         <relation>
             <name>compilation_time</name>
-            <cardinality>46108</cardinality>
+            <cardinality>46107</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
@@ -1672,7 +1780,7 @@
                 </e>
                 <e>
                     <k>seconds</k>
-                    <v>10330</v>
+                    <v>11287</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -1753,48 +1861,48 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>678</v>
+                                    <v>757</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>319</v>
+                                    <v>279</v>
                                 </b>
                                 <b>
                                     <a>6</a>
-                                    <b>8</b>
-                                    <v>119</v>
+                                    <b>9</b>
+                                    <v>159</v>
                                 </b>
                                 <b>
-                                    <a>8</a>
+                                    <a>9</a>
                                     <b>10</b>
-                                    <v>159</v>
+                                    <v>119</v>
                                 </b>
                                 <b>
                                     <a>10</a>
                                     <b>11</b>
-                                    <v>79</v>
+                                    <v>159</v>
                                 </b>
                                 <b>
                                     <a>11</a>
-                                    <b>13</b>
-                                    <v>159</v>
-                                </b>
-                                <b>
-                                    <a>15</a>
-                                    <b>18</b>
-                                    <v>159</v>
+                                    <b>16</b>
+                                    <v>119</v>
                                 </b>
                                 <b>
                                     <a>18</a>
-                                    <b>22</b>
+                                    <b>19</b>
                                     <v>159</v>
                                 </b>
                                 <b>
-                                    <a>25</a>
-                                    <b>92</b>
+                                    <a>19</a>
+                                    <b>43</b>
                                     <v>159</v>
                                 </b>
+                                <b>
+                                    <a>57</a>
+                                    <b>112</b>
+                                    <v>79</v>
+                                </b>
                             </bs>
                         </hist>
                     </val>
@@ -1809,7 +1917,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1755</v>
+                                    <v>1754</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -1861,27 +1969,27 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1396</v>
+                                    <v>1316</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>358</v>
+                                    <v>438</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>199</v>
+                                    <v>239</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>7</b>
-                                    <v>478</v>
+                                    <v>319</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>8</b>
-                                    <v>39</v>
+                                    <v>159</v>
                                 </b>
                                 <b>
                                     <a>8</a>
@@ -1890,13 +1998,13 @@
                                 </b>
                                 <b>
                                     <a>9</a>
-                                    <b>24</b>
-                                    <v>239</v>
+                                    <b>26</b>
+                                    <v>279</v>
                                 </b>
                                 <b>
-                                    <a>25</a>
-                                    <b>90</b>
-                                    <v>279</v>
+                                    <a>27</a>
+                                    <b>94</b>
+                                    <v>239</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1952,13 +2060,13 @@
                                     <v>39</v>
                                 </b>
                                 <b>
-                                    <a>128</a>
-                                    <b>129</b>
+                                    <a>137</a>
+                                    <b>138</b>
                                     <v>39</v>
                                 </b>
                                 <b>
-                                    <a>133</a>
-                                    <b>134</b>
+                                    <a>148</a>
+                                    <b>149</b>
                                     <v>39</v>
                                 </b>
                             </bs>
@@ -1975,27 +2083,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6062</v>
+                                    <v>6222</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>2034</v>
+                                    <v>3031</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>917</v>
+                                    <v>1196</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>5</b>
-                                    <v>797</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>42</b>
-                                    <v>518</v>
+                                    <b>44</b>
+                                    <v>837</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2011,32 +2114,27 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5225</v>
+                                    <v>5384</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1874</v>
+                                    <v>2991</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1276</v>
+                                    <v>1435</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>997</v>
+                                    <v>757</v>
                                 </b>
                                 <b>
                                     <a>5</a>
-                                    <b>9</b>
-                                    <v>797</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>65</b>
-                                    <v>159</v>
+                                    <b>66</b>
+                                    <v>717</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2052,12 +2150,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10051</v>
+                                    <v>10928</v>
                                 </b>
                                 <b>
                                     <a>2</a>
-                                    <b>4</b>
-                                    <v>279</v>
+                                    <b>3</b>
+                                    <v>358</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2067,11 +2165,11 @@
         </relation>
         <relation>
             <name>diagnostic_for</name>
-            <cardinality>889095</cardinality>
+            <cardinality>889089</cardinality>
             <columnsizes>
                 <e>
                     <k>diagnostic</k>
-                    <v>72092</v>
+                    <v>72091</v>
                 </e>
                 <e>
                     <k>compilation</k>
@@ -2102,7 +2200,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>59654</v>
+                                    <v>59653</v>
                                 </b>
                                 <b>
                                     <a>254</a>
@@ -2123,7 +2221,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>72092</v>
+                                    <v>72091</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2139,7 +2237,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>72092</v>
+                                    <v>72091</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2436,7 +2534,7 @@
                 </e>
                 <e>
                     <k>cpu_seconds</k>
-                    <v>7792</v>
+                    <v>7538</v>
                 </e>
                 <e>
                     <k>elapsed_seconds</k>
@@ -2486,17 +2584,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6489</v>
+                                    <v>6201</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>922</v>
+                                    <v>910</v>
                                 </b>
                                 <b>
                                     <a>3</a>
-                                    <b>19</b>
-                                    <v>380</v>
+                                    <b>11</b>
+                                    <v>426</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2512,12 +2610,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7319</v>
+                                    <v>7020</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>472</v>
+                                    <v>518</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2538,56 +2636,51 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>23</v>
+                                    <v>11</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
+                                    <v>23</v>
+                                </b>
+                                <b>
+                                    <a>8</a>
+                                    <b>9</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>7</a>
-                                    <b>8</b>
+                                    <a>9</a>
+                                    <b>10</b>
+                                    <v>23</v>
+                                </b>
+                                <b>
+                                    <a>18</a>
+                                    <b>19</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>10</a>
-                                    <b>11</b>
+                                    <a>52</a>
+                                    <b>53</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>11</a>
-                                    <b>12</b>
+                                    <a>107</a>
+                                    <b>108</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>26</a>
-                                    <b>27</b>
+                                    <a>159</a>
+                                    <b>160</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>51</a>
-                                    <b>52</b>
+                                    <a>239</a>
+                                    <b>240</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>160</a>
-                                    <b>161</b>
-                                    <v>11</v>
-                                </b>
-                                <b>
-                                    <a>172</a>
-                                    <b>173</b>
-                                    <v>11</v>
-                                </b>
-                                <b>
-                                    <a>198</a>
-                                    <b>199</b>
-                                    <v>11</v>
-                                </b>
-                                <b>
-                                    <a>219</a>
-                                    <b>220</b>
+                                    <a>252</a>
+                                    <b>253</b>
                                     <v>11</v>
                                 </b>
                             </bs>
@@ -2609,31 +2702,26 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>23</v>
+                                    <v>11</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
+                                    <v>23</v>
+                                </b>
+                                <b>
+                                    <a>8</a>
+                                    <b>9</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>7</a>
-                                    <b>8</b>
-                                    <v>11</v>
+                                    <a>9</a>
+                                    <b>10</b>
+                                    <v>23</v>
                                 </b>
                                 <b>
-                                    <a>10</a>
-                                    <b>11</b>
-                                    <v>11</v>
-                                </b>
-                                <b>
-                                    <a>11</a>
-                                    <b>12</b>
-                                    <v>11</v>
-                                </b>
-                                <b>
-                                    <a>24</a>
-                                    <b>25</b>
+                                    <a>18</a>
+                                    <b>19</b>
                                     <v>11</v>
                                 </b>
                                 <b>
@@ -2642,23 +2730,23 @@
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>115</a>
-                                    <b>116</b>
+                                    <a>98</a>
+                                    <b>99</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>140</a>
-                                    <b>141</b>
+                                    <a>114</a>
+                                    <b>115</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>155</a>
-                                    <b>156</b>
+                                    <a>168</a>
+                                    <b>169</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>197</a>
-                                    <b>198</b>
+                                    <a>216</a>
+                                    <b>217</b>
                                     <v>11</v>
                                 </b>
                             </bs>
@@ -4383,11 +4471,11 @@
         </relation>
         <relation>
             <name>locations_default</name>
-            <cardinality>29655056</cardinality>
+            <cardinality>29655085</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>29655056</v>
+                    <v>29655085</v>
                 </e>
                 <e>
                     <k>container</k>
@@ -4395,7 +4483,7 @@
                 </e>
                 <e>
                     <k>startLine</k>
-                    <v>2080991</v>
+                    <v>2080993</v>
                 </e>
                 <e>
                     <k>startColumn</k>
@@ -4403,11 +4491,11 @@
                 </e>
                 <e>
                     <k>endLine</k>
-                    <v>2083768</v>
+                    <v>2083770</v>
                 </e>
                 <e>
                     <k>endColumn</k>
-                    <v>47673</v>
+                    <v>47674</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -4421,7 +4509,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>29655056</v>
+                                    <v>29655085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4437,7 +4525,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>29655056</v>
+                                    <v>29655085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4453,7 +4541,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>29655056</v>
+                                    <v>29655085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4469,7 +4557,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>29655056</v>
+                                    <v>29655085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4485,7 +4573,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>29655056</v>
+                                    <v>29655085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4876,7 +4964,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>572087</v>
+                                    <v>572088</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -4937,12 +5025,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>855354</v>
+                                    <v>855355</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>275860</v>
+                                    <v>275861</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -4993,12 +5081,12 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>308260</v>
+                                    <v>308261</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>199952</v>
+                                    <v>199953</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -5008,7 +5096,7 @@
                                 <b>
                                     <a>6</a>
                                     <b>9</b>
-                                    <v>177735</v>
+                                    <v>177736</v>
                                 </b>
                                 <b>
                                     <a>9</a>
@@ -5044,17 +5132,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1520938</v>
+                                    <v>1520939</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>345751</v>
+                                    <v>345752</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>5</b>
-                                    <v>161998</v>
+                                    <v>161999</v>
                                 </b>
                                 <b>
                                     <a>5</a>
@@ -5592,7 +5680,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>866925</v>
+                                    <v>866926</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -5607,7 +5695,7 @@
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>139781</v>
+                                    <v>139782</v>
                                 </b>
                                 <b>
                                     <a>6</a>
@@ -5617,7 +5705,7 @@
                                 <b>
                                     <a>10</a>
                                     <b>15</b>
-                                    <v>165238</v>
+                                    <v>165239</v>
                                 </b>
                                 <b>
                                     <a>15</a>
@@ -5648,12 +5736,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1513995</v>
+                                    <v>1513996</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>343437</v>
+                                    <v>343438</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -5694,7 +5782,7 @@
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>184215</v>
+                                    <v>184216</v>
                                 </b>
                                 <b>
                                     <a>6</a>
@@ -5709,7 +5797,7 @@
                                 <b>
                                     <a>13</a>
                                     <b>19</b>
-                                    <v>171718</v>
+                                    <v>171719</v>
                                 </b>
                                 <b>
                                     <a>19</a>
@@ -6170,11 +6258,11 @@
         </relation>
         <relation>
             <name>locations_stmt</name>
-            <cardinality>3813503</cardinality>
+            <cardinality>3813506</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3813503</v>
+                    <v>3813506</v>
                 </e>
                 <e>
                     <k>container</k>
@@ -6208,7 +6296,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3813503</v>
+                                    <v>3813506</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6224,7 +6312,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3813503</v>
+                                    <v>3813506</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6240,7 +6328,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3813503</v>
+                                    <v>3813506</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6256,7 +6344,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3813503</v>
+                                    <v>3813506</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6272,7 +6360,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3813503</v>
+                                    <v>3813506</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7641,7 +7729,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>16832</v>
+                                    <v>16833</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -7651,7 +7739,7 @@
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>18579</v>
+                                    <v>18580</v>
                                 </b>
                                 <b>
                                     <a>6</a>
@@ -8152,15 +8240,15 @@
         </relation>
         <relation>
             <name>locations_expr</name>
-            <cardinality>13165921</cardinality>
+            <cardinality>13165934</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>13165921</v>
+                    <v>13165934</v>
                 </e>
                 <e>
                     <k>container</k>
-                    <v>4644</v>
+                    <v>4645</v>
                 </e>
                 <e>
                     <k>startLine</k>
@@ -8190,7 +8278,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13165921</v>
+                                    <v>13165934</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8206,7 +8294,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13165921</v>
+                                    <v>13165934</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8222,7 +8310,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13165921</v>
+                                    <v>13165934</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8238,7 +8326,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13165921</v>
+                                    <v>13165934</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8254,7 +8342,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13165921</v>
+                                    <v>13165934</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10084,11 +10172,11 @@
         </relation>
         <relation>
             <name>numlines</name>
-            <cardinality>1383933</cardinality>
+            <cardinality>1383934</cardinality>
             <columnsizes>
                 <e>
                     <k>element_id</k>
-                    <v>1376990</v>
+                    <v>1376992</v>
                 </e>
                 <e>
                     <k>num_lines</k>
@@ -10114,7 +10202,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1370047</v>
+                                    <v>1370049</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -10135,7 +10223,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1370973</v>
+                                    <v>1370974</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -10156,7 +10244,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1376990</v>
+                                    <v>1376992</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10208,7 +10296,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>69890</v>
+                                    <v>69891</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -10500,11 +10588,11 @@
         </relation>
         <relation>
             <name>diagnostics</name>
-            <cardinality>72092</cardinality>
+            <cardinality>72091</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>72092</v>
+                    <v>72091</v>
                 </e>
                 <e>
                     <k>severity</k>
@@ -10538,7 +10626,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>72092</v>
+                                    <v>72091</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10554,7 +10642,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>72092</v>
+                                    <v>72091</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10570,7 +10658,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>72092</v>
+                                    <v>72091</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10586,7 +10674,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>72092</v>
+                                    <v>72091</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10602,7 +10690,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>72092</v>
+                                    <v>72091</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11033,7 +11121,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>62536</v>
+                                    <v>62535</v>
                                 </b>
                                 <b>
                                     <a>829</a>
@@ -11308,7 +11396,7 @@
         </relation>
         <relation>
             <name>containerparent</name>
-            <cardinality>136541</cardinality>
+            <cardinality>136542</cardinality>
             <columnsizes>
                 <e>
                     <k>parent</k>
@@ -11316,7 +11404,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>136541</v>
+                    <v>136542</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -11371,7 +11459,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>136541</v>
+                                    <v>136542</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11381,7 +11469,7 @@
         </relation>
         <relation>
             <name>fileannotations</name>
-            <cardinality>5237857</cardinality>
+            <cardinality>5237823</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
@@ -11397,7 +11485,7 @@
                 </e>
                 <e>
                     <k>value</k>
-                    <v>47020</v>
+                    <v>47019</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -11739,7 +11827,7 @@
                                 <b>
                                     <a>6</a>
                                     <b>9</b>
-                                    <v>4219</v>
+                                    <v>4218</v>
                                 </b>
                                 <b>
                                     <a>9</a>
@@ -11749,7 +11837,7 @@
                                 <b>
                                     <a>14</a>
                                     <b>17</b>
-                                    <v>4219</v>
+                                    <v>4218</v>
                                 </b>
                                 <b>
                                     <a>17</a>
@@ -11897,7 +11985,7 @@
                                 <b>
                                     <a>5</a>
                                     <b>8</b>
-                                    <v>3585</v>
+                                    <v>3584</v>
                                 </b>
                                 <b>
                                     <a>8</a>
@@ -11917,7 +12005,7 @@
                                 <b>
                                     <a>19</a>
                                     <b>29</b>
-                                    <v>3585</v>
+                                    <v>3584</v>
                                 </b>
                                 <b>
                                     <a>29</a>
@@ -11957,15 +12045,15 @@
         </relation>
         <relation>
             <name>inmacroexpansion</name>
-            <cardinality>109604497</cardinality>
+            <cardinality>109604545</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>17996941</v>
+                    <v>17997566</v>
                 </e>
                 <e>
                     <k>inv</k>
-                    <v>2695871</v>
+                    <v>2695876</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -11979,37 +12067,37 @@
                                 <b>
                                     <a>1</a>
                                     <b>3</b>
-                                    <v>1578646</v>
+                                    <v>1579270</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>5</b>
-                                    <v>1074226</v>
+                                    <v>1074227</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>1182860</v>
+                                    <v>1182861</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>7</b>
-                                    <v>4812393</v>
+                                    <v>4812395</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>8</b>
-                                    <v>6375799</v>
+                                    <v>6375802</v>
                                 </b>
                                 <b>
                                     <a>8</a>
                                     <b>9</b>
-                                    <v>2601948</v>
+                                    <v>2601949</v>
                                 </b>
                                 <b>
                                     <a>9</a>
-                                    <b>150</b>
-                                    <v>371065</v>
+                                    <b>21</b>
+                                    <v>371061</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12025,12 +12113,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>377822</v>
+                                    <v>377823</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>543239</v>
+                                    <v>543242</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -12050,7 +12138,7 @@
                                 <b>
                                     <a>8</a>
                                     <b>9</b>
-                                    <v>241503</v>
+                                    <v>241504</v>
                                 </b>
                                 <b>
                                     <a>9</a>
@@ -12060,7 +12148,7 @@
                                 <b>
                                     <a>10</a>
                                     <b>11</b>
-                                    <v>324968</v>
+                                    <v>324969</v>
                                 </b>
                                 <b>
                                     <a>11</a>
@@ -12085,15 +12173,15 @@
         </relation>
         <relation>
             <name>affectedbymacroexpansion</name>
-            <cardinality>35632294</cardinality>
+            <cardinality>35632309</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>5148536</v>
+                    <v>5148539</v>
                 </e>
                 <e>
                     <k>inv</k>
-                    <v>2780342</v>
+                    <v>2780344</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -12107,7 +12195,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2811452</v>
+                                    <v>2811454</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -12153,7 +12241,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>4</b>
-                                    <v>228751</v>
+                                    <v>228752</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -12223,11 +12311,11 @@
         </relation>
         <relation>
             <name>macroinvocations</name>
-            <cardinality>33818017</cardinality>
+            <cardinality>34146969</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>33818017</v>
+                    <v>34146969</v>
                 </e>
                 <e>
                     <k>macro_id</k>
@@ -12235,7 +12323,7 @@
                 </e>
                 <e>
                     <k>location</k>
-                    <v>776461</v>
+                    <v>776502</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -12253,7 +12341,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>33818017</v>
+                                    <v>34146969</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12269,7 +12357,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>33818017</v>
+                                    <v>34146969</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12285,7 +12373,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>33818017</v>
+                                    <v>34146969</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12301,57 +12389,57 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>17521</v>
+                                    <v>16645</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>16922</v>
+                                    <v>16979</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>3688</v>
+                                    <v>3181</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>4853</v>
+                                    <v>5348</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>8</b>
-                                    <v>6005</v>
+                                    <v>5890</v>
                                 </b>
                                 <b>
                                     <a>8</a>
-                                    <b>14</b>
-                                    <v>6432</v>
+                                    <b>13</b>
+                                    <v>6270</v>
                                 </b>
                                 <b>
-                                    <a>14</a>
-                                    <b>29</b>
-                                    <v>6305</v>
+                                    <a>13</a>
+                                    <b>26</b>
+                                    <v>6259</v>
                                 </b>
                                 <b>
-                                    <a>29</a>
-                                    <b>73</b>
-                                    <v>6201</v>
+                                    <a>26</a>
+                                    <b>61</b>
+                                    <v>6213</v>
                                 </b>
                                 <b>
-                                    <a>73</a>
-                                    <b>257</b>
-                                    <v>6097</v>
+                                    <a>61</a>
+                                    <b>205</b>
+                                    <v>6132</v>
                                 </b>
                                 <b>
-                                    <a>257</a>
-                                    <b>5161</b>
-                                    <v>6097</v>
+                                    <a>205</a>
+                                    <b>1780</b>
+                                    <v>6109</v>
                                 </b>
                                 <b>
-                                    <a>5432</a>
-                                    <b>168296</b>
-                                    <v>1048</v>
+                                    <a>1780</a>
+                                    <b>168526</b>
+                                    <v>2144</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12367,7 +12455,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>43366</v>
+                                    <v>43365</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -12377,7 +12465,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>5268</v>
+                                    <v>5267</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -12413,7 +12501,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>75308</v>
+                                    <v>75307</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -12434,37 +12522,42 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>320046</v>
+                                    <v>288516</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>170824</v>
+                                    <v>173555</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>50732</v>
+                                    <v>72483</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>61717</v>
+                                    <v>60990</v>
                                 </b>
                                 <b>
                                     <a>5</a>
-                                    <b>9</b>
-                                    <v>68887</v>
+                                    <b>8</b>
+                                    <v>54639</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
-                                    <b>23</b>
-                                    <v>58340</v>
+                                    <a>8</a>
+                                    <b>17</b>
+                                    <v>63538</v>
                                 </b>
                                 <b>
-                                    <a>23</a>
-                                    <b>244365</b>
-                                    <v>45913</v>
+                                    <a>17</a>
+                                    <b>628</b>
+                                    <v>58247</v>
+                                </b>
+                                <b>
+                                    <a>632</a>
+                                    <b>244541</b>
+                                    <v>4530</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12480,12 +12573,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>729337</v>
+                                    <v>729355</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>350</b>
-                                    <v>47123</v>
+                                    <v>47146</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12501,7 +12594,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>776461</v>
+                                    <v>776502</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12515,13 +12608,13 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>20464</a>
-                                    <b>20465</b>
+                                    <a>20671</a>
+                                    <b>20672</b>
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>2913248</a>
-                                    <b>2913249</b>
+                                    <a>2941597</a>
+                                    <b>2941598</b>
                                     <v>11</v>
                                 </b>
                             </bs>
@@ -12562,8 +12655,8 @@
                                     <v>11</v>
                                 </b>
                                 <b>
-                                    <a>61043</a>
-                                    <b>61044</b>
+                                    <a>61047</a>
+                                    <b>61048</b>
                                     <v>11</v>
                                 </b>
                             </bs>
@@ -12574,15 +12667,15 @@
         </relation>
         <relation>
             <name>macroparent</name>
-            <cardinality>30368148</cardinality>
+            <cardinality>30547394</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>30368148</v>
+                    <v>30547394</v>
                 </e>
                 <e>
                     <k>parent_id</k>
-                    <v>23632653</v>
+                    <v>23742572</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -12596,7 +12689,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>30368148</v>
+                                    <v>30547394</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12612,17 +12705,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>18259095</v>
+                                    <v>18336300</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>4525350</v>
+                                    <v>4553885</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>88</b>
-                                    <v>848207</v>
+                                    <v>852386</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12632,15 +12725,15 @@
         </relation>
         <relation>
             <name>macrolocationbind</name>
-            <cardinality>4036896</cardinality>
+            <cardinality>4037048</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2826220</v>
+                    <v>2826423</v>
                 </e>
                 <e>
                     <k>location</k>
-                    <v>2017729</v>
+                    <v>2017695</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -12654,22 +12747,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2225956</v>
+                                    <v>2226199</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>340592</v>
+                                    <v>340555</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>7</b>
-                                    <v>230144</v>
+                                    <v>230140</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>57</b>
-                                    <v>29528</v>
+                                    <v>29527</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12685,22 +12778,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1608672</v>
+                                    <v>1608334</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>177047</v>
+                                    <v>177385</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>8</b>
-                                    <v>156640</v>
+                                    <v>156607</v>
                                 </b>
                                 <b>
                                     <a>8</a>
                                     <b>723</b>
-                                    <v>75368</v>
+                                    <v>75366</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12710,11 +12803,11 @@
         </relation>
         <relation>
             <name>macro_argument_unexpanded</name>
-            <cardinality>85909146</cardinality>
+            <cardinality>86237561</cardinality>
             <columnsizes>
                 <e>
                     <k>invocation</k>
-                    <v>26486648</v>
+                    <v>26718658</v>
                 </e>
                 <e>
                     <k>argument_index</k>
@@ -12722,7 +12815,7 @@
                 </e>
                 <e>
                     <k>text</k>
-                    <v>325037</v>
+                    <v>325035</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -12736,22 +12829,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7413109</v>
+                                    <v>7569359</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>10827242</v>
+                                    <v>10882987</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>6239771</v>
+                                    <v>6259004</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>67</b>
-                                    <v>2006525</v>
+                                    <v>2007307</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12767,22 +12860,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7484094</v>
+                                    <v>7640355</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>10976626</v>
+                                    <v>11032911</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>6070745</v>
+                                    <v>6089437</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>67</b>
-                                    <v>1955182</v>
+                                    <v>1955953</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12802,12 +12895,12 @@
                                 </b>
                                 <b>
                                     <a>41432</a>
-                                    <b>174067</b>
+                                    <b>174136</b>
                                     <v>57</v>
                                 </b>
                                 <b>
-                                    <a>715366</a>
-                                    <b>2297717</b>
+                                    <a>717107</a>
+                                    <b>2317859</b>
                                     <v>34</v>
                                 </b>
                             </bs>
@@ -12850,57 +12943,57 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>40726</v>
+                                    <v>37325</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>65394</v>
+                                    <v>64645</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>15135</v>
+                                    <v>16979</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>44945</v>
+                                    <v>45740</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>8</b>
-                                    <v>25510</v>
+                                    <v>25521</v>
                                 </b>
                                 <b>
                                     <a>8</a>
                                     <b>12</b>
-                                    <v>16000</v>
+                                    <v>16357</v>
                                 </b>
                                 <b>
                                     <a>12</a>
                                     <b>16</b>
-                                    <v>22213</v>
+                                    <v>21752</v>
                                 </b>
                                 <b>
                                     <a>16</a>
                                     <b>23</b>
-                                    <v>26420</v>
+                                    <v>25682</v>
                                 </b>
                                 <b>
                                     <a>23</a>
-                                    <b>43</b>
-                                    <v>24691</v>
+                                    <b>42</b>
+                                    <v>24495</v>
                                 </b>
                                 <b>
-                                    <a>43</a>
-                                    <b>165</b>
-                                    <v>24391</v>
+                                    <a>42</a>
+                                    <b>129</b>
+                                    <v>24403</v>
                                 </b>
                                 <b>
-                                    <a>165</a>
-                                    <b>521384</b>
-                                    <v>19608</v>
+                                    <a>129</a>
+                                    <b>522100</b>
+                                    <v>22132</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12916,7 +13009,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>235066</v>
+                                    <v>235064</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -12936,11 +13029,11 @@
         </relation>
         <relation>
             <name>macro_argument_expanded</name>
-            <cardinality>85909146</cardinality>
+            <cardinality>86237561</cardinality>
             <columnsizes>
                 <e>
                     <k>invocation</k>
-                    <v>26486648</v>
+                    <v>26718658</v>
                 </e>
                 <e>
                     <k>argument_index</k>
@@ -12948,7 +13041,7 @@
                 </e>
                 <e>
                     <k>text</k>
-                    <v>196979</v>
+                    <v>196978</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -12962,22 +13055,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7413109</v>
+                                    <v>7569359</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>10827242</v>
+                                    <v>10882987</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>6239771</v>
+                                    <v>6259004</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>67</b>
-                                    <v>2006525</v>
+                                    <v>2007307</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12993,22 +13086,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10713329</v>
+                                    <v>10891563</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>9344510</v>
+                                    <v>9381278</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>5293039</v>
+                                    <v>5309327</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>9</b>
-                                    <v>1135769</v>
+                                    <v>1136488</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13028,12 +13121,12 @@
                                 </b>
                                 <b>
                                     <a>41432</a>
-                                    <b>174067</b>
+                                    <b>174136</b>
                                     <v>57</v>
                                 </b>
                                 <b>
-                                    <a>715366</a>
-                                    <b>2297717</b>
+                                    <a>717107</a>
+                                    <b>2317859</b>
                                     <v>34</v>
                                 </b>
                             </bs>
@@ -13076,62 +13169,62 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>24472</v>
+                                    <v>22017</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>41025</v>
+                                    <v>39746</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>6904</v>
+                                    <v>8876</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>16311</v>
+                                    <v>16772</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>2985</v>
+                                    <v>3054</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>7</b>
-                                    <v>23204</v>
+                                    <v>22720</v>
                                 </b>
                                 <b>
                                     <a>7</a>
-                                    <b>9</b>
-                                    <v>15953</v>
+                                    <b>10</b>
+                                    <v>16195</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
+                                    <a>10</a>
                                     <b>15</b>
-                                    <v>16622</v>
+                                    <v>15757</v>
                                 </b>
                                 <b>
                                     <a>15</a>
-                                    <b>31</b>
-                                    <v>15527</v>
+                                    <b>27</b>
+                                    <v>14939</v>
                                 </b>
                                 <b>
-                                    <a>31</a>
-                                    <b>97</b>
-                                    <v>15054</v>
+                                    <a>27</a>
+                                    <b>73</b>
+                                    <v>14916</v>
                                 </b>
                                 <b>
-                                    <a>97</a>
-                                    <b>775</b>
-                                    <v>15446</v>
+                                    <a>73</a>
+                                    <b>361</b>
+                                    <v>14824</v>
                                 </b>
                                 <b>
-                                    <a>775</a>
-                                    <b>1052972</b>
-                                    <v>3469</v>
+                                    <a>363</a>
+                                    <b>1059615</b>
+                                    <v>7158</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13152,7 +13245,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>82582</v>
+                                    <v>82581</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -13167,15 +13260,15 @@
         </relation>
         <relation>
             <name>functions</name>
-            <cardinality>4628077</cardinality>
+            <cardinality>4628081</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4628077</v>
+                    <v>4628081</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>1902792</v>
+                    <v>1902794</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -13193,7 +13286,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4628077</v>
+                                    <v>4628081</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13209,7 +13302,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4628077</v>
+                                    <v>4628081</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13225,7 +13318,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1492704</v>
+                                    <v>1492705</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -13235,7 +13328,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>5</b>
-                                    <v>149038</v>
+                                    <v>149039</v>
                                 </b>
                                 <b>
                                     <a>5</a>
@@ -13256,7 +13349,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1902329</v>
+                                    <v>1902331</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -13363,15 +13456,15 @@
         </relation>
         <relation>
             <name>function_entry_point</name>
-            <cardinality>1158060</cardinality>
+            <cardinality>1158061</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1148340</v>
+                    <v>1148341</v>
                 </e>
                 <e>
                     <k>entry_point</k>
-                    <v>1158060</v>
+                    <v>1158061</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13385,7 +13478,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1138620</v>
+                                    <v>1138621</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -13406,7 +13499,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1158060</v>
+                                    <v>1158061</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13416,15 +13509,15 @@
         </relation>
         <relation>
             <name>function_return_type</name>
-            <cardinality>4636408</cardinality>
+            <cardinality>4636413</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4628077</v>
+                    <v>4628081</v>
                 </e>
                 <e>
                     <k>return_type</k>
-                    <v>990970</v>
+                    <v>990971</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13438,7 +13531,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4621134</v>
+                                    <v>4621138</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -13818,22 +13911,22 @@
         </relation>
         <relation>
             <name>function_defaulted</name>
-            <cardinality>73130</cardinality>
+            <cardinality>73131</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>73130</v>
+                    <v>73131</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>member_function_this_type</name>
-            <cardinality>553401</cardinality>
+            <cardinality>553402</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>553401</v>
+                    <v>553402</v>
                 </e>
                 <e>
                     <k>this_type</k>
@@ -13851,7 +13944,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>553401</v>
+                                    <v>553402</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13902,27 +13995,27 @@
         </relation>
         <relation>
             <name>fun_decls</name>
-            <cardinality>5000674</cardinality>
+            <cardinality>5000679</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4995583</v>
+                    <v>4995588</v>
                 </e>
                 <e>
                     <k>function</k>
-                    <v>4485518</v>
+                    <v>4485522</v>
                 </e>
                 <e>
                     <k>type_id</k>
-                    <v>989581</v>
+                    <v>989582</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>1806056</v>
+                    <v>1806058</v>
                 </e>
                 <e>
                     <k>location</k>
-                    <v>3404291</v>
+                    <v>3404294</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13936,7 +14029,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4995583</v>
+                                    <v>4995588</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13952,7 +14045,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4990491</v>
+                                    <v>4990496</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -13973,7 +14066,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4995583</v>
+                                    <v>4995588</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13989,7 +14082,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4995583</v>
+                                    <v>4995588</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14005,7 +14098,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4055063</v>
+                                    <v>4055067</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14015,7 +14108,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>7</b>
-                                    <v>73130</v>
+                                    <v>73131</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14031,7 +14124,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4444324</v>
+                                    <v>4444328</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14052,7 +14145,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4485518</v>
+                                    <v>4485522</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14068,7 +14161,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4111069</v>
+                                    <v>4111073</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14094,12 +14187,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>438785</v>
+                                    <v>438786</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>438785</v>
+                                    <v>438786</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -14130,7 +14223,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>368431</v>
+                                    <v>368432</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -14161,7 +14254,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>5</b>
-                                    <v>88867</v>
+                                    <v>88868</v>
                                 </b>
                                 <b>
                                     <a>5</a>
@@ -14182,7 +14275,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>759543</v>
+                                    <v>759544</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14197,7 +14290,7 @@
                                 <b>
                                     <a>11</a>
                                     <b>2029</b>
-                                    <v>22216</v>
+                                    <v>22217</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14213,7 +14306,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1225174</v>
+                                    <v>1225175</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14228,7 +14321,7 @@
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>136541</v>
+                                    <v>136542</v>
                                 </b>
                                 <b>
                                     <a>6</a>
@@ -14249,7 +14342,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1402910</v>
+                                    <v>1402911</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14259,7 +14352,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>5</b>
-                                    <v>143021</v>
+                                    <v>143022</v>
                                 </b>
                                 <b>
                                     <a>5</a>
@@ -14280,7 +14373,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1589440</v>
+                                    <v>1589442</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14306,7 +14399,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1246002</v>
+                                    <v>1246004</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14342,7 +14435,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2947454</v>
+                                    <v>2947457</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14368,7 +14461,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3014105</v>
+                                    <v>3014108</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14394,7 +14487,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3193692</v>
+                                    <v>3193695</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14415,7 +14508,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3231646</v>
+                                    <v>3231649</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14430,11 +14523,11 @@
         </relation>
         <relation>
             <name>fun_def</name>
-            <cardinality>1932415</cardinality>
+            <cardinality>1932417</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1932415</v>
+                    <v>1932417</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -14463,11 +14556,11 @@
         </relation>
         <relation>
             <name>fun_decl_specifiers</name>
-            <cardinality>2890060</cardinality>
+            <cardinality>2890063</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1683400</v>
+                    <v>1683401</v>
                 </e>
                 <e>
                     <k>name</k>
@@ -14485,12 +14578,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>495253</v>
+                                    <v>495254</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1169632</v>
+                                    <v>1169633</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -14667,26 +14760,26 @@
         </relation>
         <relation>
             <name>fun_decl_empty_throws</name>
-            <cardinality>1926861</cardinality>
+            <cardinality>1926863</cardinality>
             <columnsizes>
                 <e>
                     <k>fun_decl</k>
-                    <v>1926861</v>
+                    <v>1926863</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>fun_decl_noexcept</name>
-            <cardinality>61185</cardinality>
+            <cardinality>61184</cardinality>
             <columnsizes>
                 <e>
                     <k>fun_decl</k>
-                    <v>61185</v>
+                    <v>61184</v>
                 </e>
                 <e>
                     <k>constant</k>
-                    <v>61080</v>
+                    <v>61079</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -14700,7 +14793,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>61185</v>
+                                    <v>61184</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14716,7 +14809,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>60976</v>
+                                    <v>60975</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -14731,11 +14824,11 @@
         </relation>
         <relation>
             <name>fun_decl_empty_noexcept</name>
-            <cardinality>873868</cardinality>
+            <cardinality>873869</cardinality>
             <columnsizes>
                 <e>
                     <k>fun_decl</k>
-                    <v>873868</v>
+                    <v>873869</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -14840,11 +14933,11 @@
         </relation>
         <relation>
             <name>param_decl_bind</name>
-            <cardinality>7337161</cardinality>
+            <cardinality>7337168</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>7337161</v>
+                    <v>7337168</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -14852,7 +14945,7 @@
                 </e>
                 <e>
                     <k>fun_decl</k>
-                    <v>4202714</v>
+                    <v>4202718</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -14866,7 +14959,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7337161</v>
+                                    <v>7337168</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14882,7 +14975,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7337161</v>
+                                    <v>7337168</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15060,17 +15153,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2355464</v>
+                                    <v>2355466</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1054381</v>
+                                    <v>1054382</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>498493</v>
+                                    <v>498494</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -15091,17 +15184,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2355464</v>
+                                    <v>2355466</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1054381</v>
+                                    <v>1054382</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>498493</v>
+                                    <v>498494</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -15116,19 +15209,19 @@
         </relation>
         <relation>
             <name>var_decls</name>
-            <cardinality>8458657</cardinality>
+            <cardinality>8458665</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>8391080</v>
+                    <v>8391088</v>
                 </e>
                 <e>
                     <k>variable</k>
-                    <v>7384372</v>
+                    <v>7384380</v>
                 </e>
                 <e>
                     <k>type_id</k>
-                    <v>2376755</v>
+                    <v>2376757</v>
                 </e>
                 <e>
                     <k>name</k>
@@ -15136,7 +15229,7 @@
                 </e>
                 <e>
                     <k>location</k>
-                    <v>5278849</v>
+                    <v>5278855</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -15150,7 +15243,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8391080</v>
+                                    <v>8391088</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15166,7 +15259,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8323503</v>
+                                    <v>8323511</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15187,7 +15280,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8391080</v>
+                                    <v>8391088</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15203,7 +15296,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8391080</v>
+                                    <v>8391088</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15219,17 +15312,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6536424</v>
+                                    <v>6536430</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>695669</v>
+                                    <v>695670</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>7</b>
-                                    <v>152278</v>
+                                    <v>152279</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15245,7 +15338,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7214042</v>
+                                    <v>7214049</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15266,7 +15359,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7269122</v>
+                                    <v>7269129</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15287,7 +15380,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6840519</v>
+                                    <v>6840526</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15308,12 +15401,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1466784</v>
+                                    <v>1466785</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>507750</v>
+                                    <v>507751</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -15344,12 +15437,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1599160</v>
+                                    <v>1599162</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>483219</v>
+                                    <v>483220</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -15375,7 +15468,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1873170</v>
+                                    <v>1873172</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15401,12 +15494,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1700988</v>
+                                    <v>1700990</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>400368</v>
+                                    <v>400369</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -15478,7 +15571,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>365654</v>
+                                    <v>365655</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15601,7 +15694,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4462838</v>
+                                    <v>4462842</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15627,7 +15720,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4860429</v>
+                                    <v>4860434</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15653,12 +15746,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4935875</v>
+                                    <v>4935879</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>1529</b>
-                                    <v>342974</v>
+                                    <v>342975</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15674,7 +15767,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5274684</v>
+                                    <v>5274689</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15689,11 +15782,11 @@
         </relation>
         <relation>
             <name>var_def</name>
-            <cardinality>4018035</cardinality>
+            <cardinality>4018039</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4018035</v>
+                    <v>4018039</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -15769,19 +15862,19 @@
         </relation>
         <relation>
             <name>type_decls</name>
-            <cardinality>3240440</cardinality>
+            <cardinality>3240444</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3240440</v>
+                    <v>3240444</v>
                 </e>
                 <e>
                     <k>type_id</k>
-                    <v>3190452</v>
+                    <v>3190455</v>
                 </e>
                 <e>
                     <k>location</k>
-                    <v>3161755</v>
+                    <v>3161758</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -15795,7 +15888,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3240440</v>
+                                    <v>3240444</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15811,7 +15904,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3240440</v>
+                                    <v>3240444</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15827,7 +15920,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3149258</v>
+                                    <v>3149261</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15848,7 +15941,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3149258</v>
+                                    <v>3149261</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15869,7 +15962,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3121487</v>
+                                    <v>3121490</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15890,7 +15983,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3121487</v>
+                                    <v>3121490</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -15905,33 +15998,33 @@
         </relation>
         <relation>
             <name>type_def</name>
-            <cardinality>2627159</cardinality>
+            <cardinality>2627161</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2627159</v>
+                    <v>2627161</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>type_decl_top</name>
-            <cardinality>743806</cardinality>
+            <cardinality>743807</cardinality>
             <columnsizes>
                 <e>
                     <k>type_decl</k>
-                    <v>743806</v>
+                    <v>743807</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>namespace_decls</name>
-            <cardinality>307432</cardinality>
+            <cardinality>307431</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>307432</v>
+                    <v>307431</v>
                 </e>
                 <e>
                     <k>namespace_id</k>
@@ -15939,11 +16032,11 @@
                 </e>
                 <e>
                     <k>location</k>
-                    <v>307432</v>
+                    <v>307431</v>
                 </e>
                 <e>
                     <k>bodylocation</k>
-                    <v>307432</v>
+                    <v>307431</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -15957,7 +16050,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>307432</v>
+                                    <v>307431</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15973,7 +16066,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>307432</v>
+                                    <v>307431</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15989,7 +16082,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>307432</v>
+                                    <v>307431</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16203,7 +16296,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>307432</v>
+                                    <v>307431</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16219,7 +16312,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>307432</v>
+                                    <v>307431</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16235,7 +16328,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>307432</v>
+                                    <v>307431</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16251,7 +16344,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>307432</v>
+                                    <v>307431</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16267,7 +16360,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>307432</v>
+                                    <v>307431</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16283,7 +16376,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>307432</v>
+                                    <v>307431</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16351,7 +16444,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>260123</v>
+                                    <v>260124</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -16377,7 +16470,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>260123</v>
+                                    <v>260124</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -16459,7 +16552,7 @@
         </relation>
         <relation>
             <name>using_container</name>
-            <cardinality>476668</cardinality>
+            <cardinality>476665</cardinality>
             <columnsizes>
                 <e>
                     <k>parent</k>
@@ -16467,7 +16560,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>302247</v>
+                    <v>302245</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -16537,7 +16630,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>222928</v>
+                                    <v>222926</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -17180,15 +17273,15 @@
         </relation>
         <relation>
             <name>params</name>
-            <cardinality>6699348</cardinality>
+            <cardinality>6699355</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>6536424</v>
+                    <v>6536430</v>
                 </e>
                 <e>
                     <k>function</k>
-                    <v>3860202</v>
+                    <v>3860206</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -17196,7 +17289,7 @@
                 </e>
                 <e>
                     <k>type_id</k>
-                    <v>2182819</v>
+                    <v>2182821</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17210,7 +17303,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6536424</v>
+                                    <v>6536430</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17226,7 +17319,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6536424</v>
+                                    <v>6536430</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17242,7 +17335,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6413305</v>
+                                    <v>6413311</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -17263,12 +17356,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2249470</v>
+                                    <v>2249472</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>945147</v>
+                                    <v>945148</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -17294,12 +17387,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2249470</v>
+                                    <v>2249472</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>945147</v>
+                                    <v>945148</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -17325,7 +17418,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2547085</v>
+                                    <v>2547088</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -17594,7 +17687,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1485298</v>
+                                    <v>1485299</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -17625,7 +17718,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1705154</v>
+                                    <v>1705155</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -17656,7 +17749,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1756993</v>
+                                    <v>1756995</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -17676,11 +17769,11 @@
         </relation>
         <relation>
             <name>overrides</name>
-            <cardinality>160001</cardinality>
+            <cardinality>160000</cardinality>
             <columnsizes>
                 <e>
                     <k>new</k>
-                    <v>125162</v>
+                    <v>125161</v>
                 </e>
                 <e>
                     <k>old</k>
@@ -17764,19 +17857,19 @@
         </relation>
         <relation>
             <name>membervariables</name>
-            <cardinality>1054757</cardinality>
+            <cardinality>1054731</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1052962</v>
+                    <v>1052936</v>
                 </e>
                 <e>
                     <k>type_id</k>
-                    <v>327188</v>
+                    <v>327180</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>450876</v>
+                    <v>450865</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17790,7 +17883,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1051247</v>
+                                    <v>1051221</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -17811,7 +17904,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1052962</v>
+                                    <v>1052936</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17827,17 +17920,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>242629</v>
+                                    <v>242623</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>51812</v>
+                                    <v>51811</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>10</b>
-                                    <v>25487</v>
+                                    <v>25486</v>
                                 </b>
                                 <b>
                                     <a>10</a>
@@ -17858,22 +17951,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>254834</v>
+                                    <v>254828</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>46387</v>
+                                    <v>46386</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>40</b>
-                                    <v>24570</v>
+                                    <v>24569</v>
                                 </b>
                                 <b>
                                     <a>41</a>
                                     <b>2031</b>
-                                    <v>1396</v>
+                                    <v>1395</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17889,17 +17982,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>294840</v>
+                                    <v>294833</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>86394</v>
+                                    <v>86391</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>5</b>
-                                    <v>41122</v>
+                                    <v>41121</v>
                                 </b>
                                 <b>
                                     <a>5</a>
@@ -17920,12 +18013,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>367234</v>
+                                    <v>367225</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>51652</v>
+                                    <v>51651</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -17940,11 +18033,11 @@
         </relation>
         <relation>
             <name>globalvariables</name>
-            <cardinality>300716</cardinality>
+            <cardinality>301278</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>300708</v>
+                    <v>301270</v>
                 </e>
                 <e>
                     <k>type_id</k>
@@ -17966,7 +18059,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>300700</v>
+                                    <v>301262</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -17987,7 +18080,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>300708</v>
+                                    <v>301270</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18003,27 +18096,27 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>977</v>
+                                    <v>972</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>159</v>
+                                    <v>160</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>7</b>
-                                    <v>114</v>
+                                    <v>117</v>
                                 </b>
                                 <b>
                                     <a>7</a>
-                                    <b>77</b>
+                                    <b>68</b>
                                     <v>106</v>
                                 </b>
                                 <b>
-                                    <a>83</a>
-                                    <b>169397</b>
-                                    <v>49</v>
+                                    <a>76</a>
+                                    <b>169440</b>
+                                    <v>50</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18075,12 +18168,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>290989</v>
+                                    <v>290721</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>33</b>
-                                    <v>3749</v>
+                                    <v>4017</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18096,12 +18189,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>294142</v>
+                                    <v>294139</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>12</b>
-                                    <v>596</v>
+                                    <v>599</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18111,11 +18204,11 @@
         </relation>
         <relation>
             <name>localvariables</name>
-            <cardinality>581177</cardinality>
+            <cardinality>581167</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>581177</v>
+                    <v>581167</v>
                 </e>
                 <e>
                     <k>type_id</k>
@@ -18123,7 +18216,7 @@
                 </e>
                 <e>
                     <k>name</k>
-                    <v>91322</v>
+                    <v>91320</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -18137,7 +18230,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>581177</v>
+                                    <v>581167</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18153,7 +18246,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>581177</v>
+                                    <v>581167</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18174,7 +18267,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>5412</v>
+                                    <v>5408</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -18184,7 +18277,7 @@
                                 <b>
                                     <a>4</a>
                                     <b>7</b>
-                                    <v>3405</v>
+                                    <v>3409</v>
                                 </b>
                                 <b>
                                     <a>7</a>
@@ -18210,7 +18303,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>26975</v>
+                                    <v>26970</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -18220,7 +18313,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>5</b>
-                                    <v>2939</v>
+                                    <v>2943</v>
                                 </b>
                                 <b>
                                     <a>5</a>
@@ -18246,12 +18339,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>57519</v>
+                                    <v>57518</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>14407</v>
+                                    <v>14406</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -18282,7 +18375,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>77145</v>
+                                    <v>77144</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -18302,11 +18395,11 @@
         </relation>
         <relation>
             <name>autoderivation</name>
-            <cardinality>149355</cardinality>
+            <cardinality>149352</cardinality>
             <columnsizes>
                 <e>
                     <k>var</k>
-                    <v>149355</v>
+                    <v>149352</v>
                 </e>
                 <e>
                     <k>derivation_type</k>
@@ -18324,7 +18417,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>149355</v>
+                                    <v>149352</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18428,11 +18521,11 @@
         </relation>
         <relation>
             <name>enumconstants</name>
-            <cardinality>241273</cardinality>
+            <cardinality>241267</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>241273</v>
+                    <v>241267</v>
                 </e>
                 <e>
                     <k>parent</k>
@@ -18448,11 +18541,11 @@
                 </e>
                 <e>
                     <k>name</k>
-                    <v>240994</v>
+                    <v>240987</v>
                 </e>
                 <e>
                     <k>location</k>
-                    <v>221210</v>
+                    <v>221204</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -18466,7 +18559,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>241273</v>
+                                    <v>241267</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18482,7 +18575,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>241273</v>
+                                    <v>241267</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18498,7 +18591,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>241273</v>
+                                    <v>241267</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18514,7 +18607,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>241273</v>
+                                    <v>241267</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18530,7 +18623,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>241273</v>
+                                    <v>241267</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18765,7 +18858,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>4188</v>
+                                    <v>4187</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -18790,7 +18883,7 @@
                                 <b>
                                     <a>7</a>
                                     <b>8</b>
-                                    <v>1396</v>
+                                    <v>1395</v>
                                 </b>
                                 <b>
                                     <a>8</a>
@@ -18831,7 +18924,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1755</v>
+                                    <v>1754</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -18887,7 +18980,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1755</v>
+                                    <v>1754</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -18959,7 +19052,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1755</v>
+                                    <v>1754</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -19015,7 +19108,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1755</v>
+                                    <v>1754</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -19141,7 +19234,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>240714</v>
+                                    <v>240708</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -19162,7 +19255,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>240714</v>
+                                    <v>240708</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -19183,7 +19276,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>240994</v>
+                                    <v>240987</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19199,7 +19292,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>240994</v>
+                                    <v>240987</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19215,7 +19308,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>240714</v>
+                                    <v>240708</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -19236,7 +19329,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>220452</v>
+                                    <v>220446</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -19257,7 +19350,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>221210</v>
+                                    <v>221204</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19273,7 +19366,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>220452</v>
+                                    <v>220446</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -19294,7 +19387,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>221210</v>
+                                    <v>221204</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19310,7 +19403,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>220452</v>
+                                    <v>220446</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -20037,15 +20130,15 @@
         </relation>
         <relation>
             <name>derivedtypes</name>
-            <cardinality>4324907</cardinality>
+            <cardinality>4324912</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4324907</v>
+                    <v>4324912</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>2161065</v>
+                    <v>2161067</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -20053,7 +20146,7 @@
                 </e>
                 <e>
                     <k>type_id</k>
-                    <v>2666964</v>
+                    <v>2666967</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -20067,7 +20160,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4324907</v>
+                                    <v>4324912</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20083,7 +20176,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4324907</v>
+                                    <v>4324912</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20099,7 +20192,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4324907</v>
+                                    <v>4324912</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20115,7 +20208,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1901404</v>
+                                    <v>1901406</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -20141,7 +20234,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2160139</v>
+                                    <v>2160141</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -20162,7 +20255,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1901404</v>
+                                    <v>1901406</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -20311,12 +20404,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1649148</v>
+                                    <v>1649150</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>558201</v>
+                                    <v>558202</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -20342,7 +20435,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1660257</v>
+                                    <v>1660258</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -20373,12 +20466,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1653314</v>
+                                    <v>1653316</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>561904</v>
+                                    <v>561905</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -20388,7 +20481,7 @@
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>98587</v>
+                                    <v>98588</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20398,11 +20491,11 @@
         </relation>
         <relation>
             <name>pointerishsize</name>
-            <cardinality>3208041</cardinality>
+            <cardinality>3208044</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3208041</v>
+                    <v>3208044</v>
                 </e>
                 <e>
                     <k>size</k>
@@ -20424,7 +20517,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3208041</v>
+                                    <v>3208044</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20440,7 +20533,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3208041</v>
+                                    <v>3208044</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20850,15 +20943,15 @@
         </relation>
         <relation>
             <name>typedefbase</name>
-            <cardinality>1722225</cardinality>
+            <cardinality>1722214</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1722225</v>
+                    <v>1722214</v>
                 </e>
                 <e>
                     <k>type_id</k>
-                    <v>809049</v>
+                    <v>809043</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -20872,7 +20965,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1722225</v>
+                                    <v>1722214</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20888,7 +20981,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>629268</v>
+                                    <v>629264</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -20903,7 +20996,7 @@
                                 <b>
                                     <a>6</a>
                                     <b>5437</b>
-                                    <v>31435</v>
+                                    <v>31434</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21199,15 +21292,15 @@
         </relation>
         <relation>
             <name>usertypes</name>
-            <cardinality>5230250</cardinality>
+            <cardinality>5230255</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>5230250</v>
+                    <v>5230255</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>1349682</v>
+                    <v>1349683</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -21225,7 +21318,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5230250</v>
+                                    <v>5230255</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21241,7 +21334,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5230250</v>
+                                    <v>5230255</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21257,7 +21350,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>980787</v>
+                                    <v>980788</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -21293,7 +21386,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1209437</v>
+                                    <v>1209438</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -21445,11 +21538,11 @@
         </relation>
         <relation>
             <name>usertypesize</name>
-            <cardinality>1711634</cardinality>
+            <cardinality>1711635</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1711634</v>
+                    <v>1711635</v>
                 </e>
                 <e>
                     <k>size</k>
@@ -21471,7 +21564,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1711634</v>
+                                    <v>1711635</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21487,7 +21580,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1711634</v>
+                                    <v>1711635</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21662,11 +21755,11 @@
         </relation>
         <relation>
             <name>usertype_uuid</name>
-            <cardinality>36167</cardinality>
+            <cardinality>36166</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>36167</v>
+                    <v>36166</v>
                 </e>
                 <e>
                     <k>uuid</k>
@@ -21684,7 +21777,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>36167</v>
+                                    <v>36166</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21715,15 +21808,15 @@
         </relation>
         <relation>
             <name>mangled_name</name>
-            <cardinality>5182113</cardinality>
+            <cardinality>5182118</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>5182113</v>
+                    <v>5182118</v>
                 </e>
                 <e>
                     <k>mangled_name</k>
-                    <v>1244614</v>
+                    <v>1244615</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -21737,7 +21830,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5182113</v>
+                                    <v>5182118</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21758,7 +21851,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>174495</v>
+                                    <v>174496</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -21788,33 +21881,33 @@
         </relation>
         <relation>
             <name>is_pod_class</name>
-            <cardinality>534132</cardinality>
+            <cardinality>534129</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>534132</v>
+                    <v>534129</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>is_standard_layout_class</name>
-            <cardinality>1259425</cardinality>
+            <cardinality>1259426</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1259425</v>
+                    <v>1259426</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>is_complete</name>
-            <cardinality>1651463</cardinality>
+            <cardinality>1651464</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1651463</v>
+                    <v>1651464</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -21832,15 +21925,15 @@
         </relation>
         <relation>
             <name>class_instantiation</name>
-            <cardinality>1092104</cardinality>
+            <cardinality>1092096</cardinality>
             <columnsizes>
                 <e>
                     <k>to</k>
-                    <v>1090870</v>
+                    <v>1090863</v>
                 </e>
                 <e>
                     <k>from</k>
-                    <v>70259</v>
+                    <v>70258</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -21854,7 +21947,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1089729</v>
+                                    <v>1089722</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -21925,11 +22018,11 @@
         </relation>
         <relation>
             <name>class_template_argument</name>
-            <cardinality>2918536</cardinality>
+            <cardinality>2918517</cardinality>
             <columnsizes>
                 <e>
                     <k>type_id</k>
-                    <v>1329545</v>
+                    <v>1329536</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -21937,7 +22030,7 @@
                 </e>
                 <e>
                     <k>arg_type</k>
-                    <v>856542</v>
+                    <v>856536</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -21951,22 +22044,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>544138</v>
+                                    <v>544134</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>404518</v>
+                                    <v>404516</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>235642</v>
+                                    <v>235641</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>7</b>
-                                    <v>121141</v>
+                                    <v>121140</v>
                                 </b>
                                 <b>
                                     <a>7</a>
@@ -21987,17 +22080,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>569833</v>
+                                    <v>569829</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>416288</v>
+                                    <v>416285</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>248830</v>
+                                    <v>248828</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -22110,12 +22203,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>533452</v>
+                                    <v>533449</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>179089</v>
+                                    <v>179088</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -22125,7 +22218,7 @@
                                 <b>
                                     <a>4</a>
                                     <b>10</b>
-                                    <v>64334</v>
+                                    <v>64333</v>
                                 </b>
                                 <b>
                                     <a>10</a>
@@ -22146,7 +22239,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>755723</v>
+                                    <v>755718</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -22166,7 +22259,7 @@
         </relation>
         <relation>
             <name>class_template_argument_value</name>
-            <cardinality>494790</cardinality>
+            <cardinality>494791</cardinality>
             <columnsizes>
                 <e>
                     <k>type_id</k>
@@ -22178,7 +22271,7 @@
                 </e>
                 <e>
                     <k>arg_value</k>
-                    <v>494790</v>
+                    <v>494791</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -22311,7 +22404,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>494790</v>
+                                    <v>494791</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22327,7 +22420,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>494790</v>
+                                    <v>494791</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22385,19 +22478,19 @@
         </relation>
         <relation>
             <name>type_mentions</name>
-            <cardinality>4022510</cardinality>
+            <cardinality>4022409</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4022510</v>
+                    <v>4022409</v>
                 </e>
                 <e>
                     <k>type_id</k>
-                    <v>197876</v>
+                    <v>197871</v>
                 </e>
                 <e>
                     <k>location</k>
-                    <v>3989045</v>
+                    <v>3988945</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -22415,7 +22508,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4022510</v>
+                                    <v>4022409</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22431,7 +22524,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4022510</v>
+                                    <v>4022409</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22447,7 +22540,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4022510</v>
+                                    <v>4022409</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22463,12 +22556,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>97442</v>
+                                    <v>97440</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>21698</v>
+                                    <v>21697</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -22483,7 +22576,7 @@
                                 <b>
                                     <a>5</a>
                                     <b>7</b>
-                                    <v>14359</v>
+                                    <v>14358</v>
                                 </b>
                                 <b>
                                     <a>7</a>
@@ -22498,7 +22591,7 @@
                                 <b>
                                     <a>27</a>
                                     <b>8555</b>
-                                    <v>14399</v>
+                                    <v>14398</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22514,12 +22607,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>97442</v>
+                                    <v>97440</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>21698</v>
+                                    <v>21697</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -22534,7 +22627,7 @@
                                 <b>
                                     <a>5</a>
                                     <b>7</b>
-                                    <v>14359</v>
+                                    <v>14358</v>
                                 </b>
                                 <b>
                                     <a>7</a>
@@ -22549,7 +22642,7 @@
                                 <b>
                                     <a>27</a>
                                     <b>8555</b>
-                                    <v>14399</v>
+                                    <v>14398</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22565,7 +22658,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>197876</v>
+                                    <v>197871</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22581,12 +22674,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3955580</v>
+                                    <v>3955481</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>33464</v>
+                                    <v>33463</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22602,12 +22695,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3955580</v>
+                                    <v>3955481</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>33464</v>
+                                    <v>33463</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22623,7 +22716,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3989045</v>
+                                    <v>3988945</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22681,22 +22774,22 @@
         </relation>
         <relation>
             <name>is_function_template</name>
-            <cardinality>1390876</cardinality>
+            <cardinality>1390877</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1390876</v>
+                    <v>1390877</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>function_instantiation</name>
-            <cardinality>907058</cardinality>
+            <cardinality>907059</cardinality>
             <columnsizes>
                 <e>
                     <k>to</k>
-                    <v>907058</v>
+                    <v>907059</v>
                 </e>
                 <e>
                     <k>from</k>
@@ -22714,7 +22807,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>907058</v>
+                                    <v>907059</v>
                                 </b>
                             </bs>
                         </hist>
@@ -22760,11 +22853,11 @@
         </relation>
         <relation>
             <name>function_template_argument</name>
-            <cardinality>2342325</cardinality>
+            <cardinality>2342327</cardinality>
             <columnsizes>
                 <e>
                     <k>function_id</k>
-                    <v>1319745</v>
+                    <v>1319746</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -22791,7 +22884,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>388305</v>
+                                    <v>388306</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -22817,12 +22910,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>695633</v>
+                                    <v>695634</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>393633</v>
+                                    <v>393634</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -23021,7 +23114,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>274830</v>
+                                    <v>274831</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -23053,7 +23146,7 @@
                 </e>
                 <e>
                     <k>arg_value</k>
-                    <v>360889</v>
+                    <v>360890</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -23093,7 +23186,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>20711</v>
+                                    <v>20712</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -23257,7 +23350,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>360889</v>
+                                    <v>360890</v>
                                 </b>
                             </bs>
                         </hist>
@@ -23278,15 +23371,15 @@
         </relation>
         <relation>
             <name>variable_instantiation</name>
-            <cardinality>168076</cardinality>
+            <cardinality>168074</cardinality>
             <columnsizes>
                 <e>
                     <k>to</k>
-                    <v>168076</v>
+                    <v>168074</v>
                 </e>
                 <e>
                     <k>from</k>
-                    <v>25729</v>
+                    <v>25728</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -23300,7 +23393,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>168076</v>
+                                    <v>168074</v>
                                 </b>
                             </bs>
                         </hist>
@@ -23316,7 +23409,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>14015</v>
+                                    <v>14014</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -23356,11 +23449,11 @@
         </relation>
         <relation>
             <name>variable_template_argument</name>
-            <cardinality>295468</cardinality>
+            <cardinality>295463</cardinality>
             <columnsizes>
                 <e>
                     <k>variable_id</k>
-                    <v>159709</v>
+                    <v>159707</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -23368,7 +23461,7 @@
                 </e>
                 <e>
                     <k>arg_type</k>
-                    <v>165462</v>
+                    <v>165459</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -23382,7 +23475,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>81894</v>
+                                    <v>81893</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -23392,12 +23485,12 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>18826</v>
+                                    <v>18825</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>17</b>
-                                    <v>9413</v>
+                                    <v>9412</v>
                                 </b>
                             </bs>
                         </hist>
@@ -23413,7 +23506,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>85555</v>
+                                    <v>85553</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -23556,12 +23649,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>133352</v>
+                                    <v>133350</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>18094</v>
+                                    <v>18093</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -23587,7 +23680,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>149564</v>
+                                    <v>149562</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -23768,11 +23861,11 @@
         </relation>
         <relation>
             <name>routinetypes</name>
-            <cardinality>547156</cardinality>
+            <cardinality>547157</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>547156</v>
+                    <v>547157</v>
                 </e>
                 <e>
                     <k>return_type</k>
@@ -23790,7 +23883,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>547156</v>
+                                    <v>547157</v>
                                 </b>
                             </bs>
                         </hist>
@@ -23826,7 +23919,7 @@
         </relation>
         <relation>
             <name>routinetypeargs</name>
-            <cardinality>975696</cardinality>
+            <cardinality>975697</cardinality>
             <columnsizes>
                 <e>
                     <k>routine</k>
@@ -23857,7 +23950,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>133301</v>
+                                    <v>133302</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -23888,7 +23981,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>180975</v>
+                                    <v>180976</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -24102,7 +24195,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>171255</v>
+                                    <v>171256</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -24311,11 +24404,11 @@
         </relation>
         <relation>
             <name>typespecifiers</name>
-            <cardinality>1287196</cardinality>
+            <cardinality>1287198</cardinality>
             <columnsizes>
                 <e>
                     <k>type_id</k>
-                    <v>1269145</v>
+                    <v>1269146</v>
                 </e>
                 <e>
                     <k>spec_id</k>
@@ -24333,7 +24426,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1251094</v>
+                                    <v>1251095</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -24399,11 +24492,11 @@
         </relation>
         <relation>
             <name>funspecifiers</name>
-            <cardinality>12354933</cardinality>
+            <cardinality>12354946</cardinality>
             <columnsizes>
                 <e>
                     <k>func_id</k>
-                    <v>3802185</v>
+                    <v>3802189</v>
                 </e>
                 <e>
                     <k>spec_id</k>
@@ -24431,12 +24524,12 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1147133</v>
+                                    <v>1147135</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>1556434</v>
+                                    <v>1556435</v>
                                 </b>
                                 <b>
                                     <a>5</a>
@@ -24557,11 +24650,11 @@
         </relation>
         <relation>
             <name>varspecifiers</name>
-            <cardinality>2310104</cardinality>
+            <cardinality>2310106</cardinality>
             <columnsizes>
                 <e>
                     <k>var_id</k>
-                    <v>1234894</v>
+                    <v>1234895</v>
                 </e>
                 <e>
                     <k>spec_id</k>
@@ -24579,12 +24672,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>723903</v>
+                                    <v>723904</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>199952</v>
+                                    <v>199953</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -24655,11 +24748,11 @@
         </relation>
         <relation>
             <name>attributes</name>
-            <cardinality>737258</cardinality>
+            <cardinality>737246</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>737258</v>
+                    <v>737246</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -24675,7 +24768,7 @@
                 </e>
                 <e>
                     <k>location</k>
-                    <v>483417</v>
+                    <v>483409</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -24689,7 +24782,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>737258</v>
+                                    <v>737246</v>
                                 </b>
                             </bs>
                         </hist>
@@ -24705,7 +24798,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>737258</v>
+                                    <v>737246</v>
                                 </b>
                             </bs>
                         </hist>
@@ -24721,7 +24814,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>737258</v>
+                                    <v>737246</v>
                                 </b>
                             </bs>
                         </hist>
@@ -24737,7 +24830,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>737258</v>
+                                    <v>737246</v>
                                 </b>
                             </bs>
                         </hist>
@@ -25130,17 +25223,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>425055</v>
+                                    <v>425049</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>37443</v>
+                                    <v>37442</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>201</b>
-                                    <v>20918</v>
+                                    <v>20917</v>
                                 </b>
                             </bs>
                         </hist>
@@ -25156,7 +25249,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>483417</v>
+                                    <v>483409</v>
                                 </b>
                             </bs>
                         </hist>
@@ -25172,7 +25265,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>479129</v>
+                                    <v>479121</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -25193,7 +25286,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>483417</v>
+                                    <v>483409</v>
                                 </b>
                             </bs>
                         </hist>
@@ -25203,11 +25296,11 @@
         </relation>
         <relation>
             <name>attribute_args</name>
-            <cardinality>406848</cardinality>
+            <cardinality>406849</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>406848</v>
+                    <v>406849</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -25215,7 +25308,7 @@
                 </e>
                 <e>
                     <k>attribute</k>
-                    <v>295763</v>
+                    <v>295764</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -25237,7 +25330,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>406848</v>
+                                    <v>406849</v>
                                 </b>
                             </bs>
                         </hist>
@@ -25253,7 +25346,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>406848</v>
+                                    <v>406849</v>
                                 </b>
                             </bs>
                         </hist>
@@ -25269,7 +25362,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>406848</v>
+                                    <v>406849</v>
                                 </b>
                             </bs>
                         </hist>
@@ -25285,7 +25378,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>406848</v>
+                                    <v>406849</v>
                                 </b>
                             </bs>
                         </hist>
@@ -25893,15 +25986,15 @@
         </relation>
         <relation>
             <name>typeattributes</name>
-            <cardinality>85973</cardinality>
+            <cardinality>85972</cardinality>
             <columnsizes>
                 <e>
                     <k>type_id</k>
-                    <v>62022</v>
+                    <v>62021</v>
                 </e>
                 <e>
                     <k>spec_id</k>
-                    <v>85973</v>
+                    <v>85972</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -25915,7 +26008,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>55014</v>
+                                    <v>55013</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -25941,7 +26034,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>85973</v>
+                                    <v>85972</v>
                                 </b>
                             </bs>
                         </hist>
@@ -25951,15 +26044,15 @@
         </relation>
         <relation>
             <name>funcattributes</name>
-            <cardinality>647729</cardinality>
+            <cardinality>647718</cardinality>
             <columnsizes>
                 <e>
                     <k>func_id</k>
-                    <v>592296</v>
+                    <v>592286</v>
                 </e>
                 <e>
                     <k>spec_id</k>
-                    <v>647729</v>
+                    <v>647718</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -25973,12 +26066,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>554120</v>
+                                    <v>554111</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>7</b>
-                                    <v>38175</v>
+                                    <v>38174</v>
                                 </b>
                             </bs>
                         </hist>
@@ -25994,7 +26087,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>647729</v>
+                                    <v>647718</v>
                                 </b>
                             </bs>
                         </hist>
@@ -26004,15 +26097,15 @@
         </relation>
         <relation>
             <name>varattributes</name>
-            <cardinality>371880</cardinality>
+            <cardinality>372127</cardinality>
             <columnsizes>
                 <e>
                     <k>var_id</k>
-                    <v>322247</v>
+                    <v>322510</v>
                 </e>
                 <e>
                     <k>spec_id</k>
-                    <v>371880</v>
+                    <v>372127</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -26026,17 +26119,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>273279</v>
+                                    <v>273537</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>48804</v>
+                                    <v>48807</v>
                                 </b>
                                 <b>
                                     <a>3</a>
-                                    <b>62</b>
-                                    <v>164</v>
+                                    <b>46</b>
+                                    <v>166</v>
                                 </b>
                             </bs>
                         </hist>
@@ -26052,7 +26145,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>371880</v>
+                                    <v>372127</v>
                                 </b>
                             </bs>
                         </hist>
@@ -26110,15 +26203,15 @@
         </relation>
         <relation>
             <name>unspecifiedtype</name>
-            <cardinality>10137428</cardinality>
+            <cardinality>10137438</cardinality>
             <columnsizes>
                 <e>
                     <k>type_id</k>
-                    <v>10137428</v>
+                    <v>10137438</v>
                 </e>
                 <e>
                     <k>unspecified_type_id</k>
-                    <v>6822468</v>
+                    <v>6822474</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -26132,7 +26225,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10137428</v>
+                                    <v>10137438</v>
                                 </b>
                             </bs>
                         </hist>
@@ -26148,17 +26241,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4591048</v>
+                                    <v>4591053</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1996752</v>
+                                    <v>1996754</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>147</b>
-                                    <v>234666</v>
+                                    <v>234667</v>
                                 </b>
                             </bs>
                         </hist>
@@ -26168,7 +26261,7 @@
         </relation>
         <relation>
             <name>member</name>
-            <cardinality>4925926</cardinality>
+            <cardinality>4925931</cardinality>
             <columnsizes>
                 <e>
                     <k>parent</k>
@@ -26180,7 +26273,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>4862061</v>
+                    <v>4862066</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -26199,7 +26292,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>320347</v>
+                                    <v>320348</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -26224,7 +26317,7 @@
                                 <b>
                                     <a>15</a>
                                     <b>24</b>
-                                    <v>49609</v>
+                                    <v>49610</v>
                                 </b>
                                 <b>
                                     <a>24</a>
@@ -26438,7 +26531,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4862061</v>
+                                    <v>4862066</v>
                                 </b>
                             </bs>
                         </hist>
@@ -26454,12 +26547,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4799678</v>
+                                    <v>4799682</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>8</b>
-                                    <v>62382</v>
+                                    <v>62383</v>
                                 </b>
                             </bs>
                         </hist>
@@ -26469,11 +26562,11 @@
         </relation>
         <relation>
             <name>enclosingfunction</name>
-            <cardinality>121348</cardinality>
+            <cardinality>121347</cardinality>
             <columnsizes>
                 <e>
                     <k>child</k>
-                    <v>121348</v>
+                    <v>121347</v>
                 </e>
                 <e>
                     <k>parent</k>
@@ -26491,7 +26584,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>121348</v>
+                                    <v>121347</v>
                                 </b>
                             </bs>
                         </hist>
@@ -27108,11 +27201,11 @@
         </relation>
         <relation>
             <name>direct_base_offsets</name>
-            <cardinality>338942</cardinality>
+            <cardinality>338943</cardinality>
             <columnsizes>
                 <e>
                     <k>der_id</k>
-                    <v>338942</v>
+                    <v>338943</v>
                 </e>
                 <e>
                     <k>offset</k>
@@ -27130,7 +27223,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>338942</v>
+                                    <v>338943</v>
                                 </b>
                             </bs>
                         </hist>
@@ -27472,11 +27565,11 @@
         </relation>
         <relation>
             <name>frienddecls</name>
-            <cardinality>716133</cardinality>
+            <cardinality>716134</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>716133</v>
+                    <v>716134</v>
                 </e>
                 <e>
                     <k>type_id</k>
@@ -27502,7 +27595,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>716133</v>
+                                    <v>716134</v>
                                 </b>
                             </bs>
                         </hist>
@@ -27518,7 +27611,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>716133</v>
+                                    <v>716134</v>
                                 </b>
                             </bs>
                         </hist>
@@ -27534,7 +27627,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>716133</v>
+                                    <v>716134</v>
                                 </b>
                             </bs>
                         </hist>
@@ -27853,19 +27946,19 @@
         </relation>
         <relation>
             <name>comments</name>
-            <cardinality>8773472</cardinality>
+            <cardinality>8773331</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>8773472</v>
+                    <v>8773331</v>
                 </e>
                 <e>
                     <k>contents</k>
-                    <v>3339994</v>
+                    <v>3339940</v>
                 </e>
                 <e>
                     <k>location</k>
-                    <v>8773472</v>
+                    <v>8773331</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -27879,7 +27972,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8773472</v>
+                                    <v>8773331</v>
                                 </b>
                             </bs>
                         </hist>
@@ -27895,7 +27988,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8773472</v>
+                                    <v>8773331</v>
                                 </b>
                             </bs>
                         </hist>
@@ -27911,12 +28004,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3055507</v>
+                                    <v>3055458</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>7</b>
-                                    <v>250912</v>
+                                    <v>250908</v>
                                 </b>
                                 <b>
                                     <a>7</a>
@@ -27937,12 +28030,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3055507</v>
+                                    <v>3055458</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>7</b>
-                                    <v>250912</v>
+                                    <v>250908</v>
                                 </b>
                                 <b>
                                     <a>7</a>
@@ -27963,7 +28056,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8773472</v>
+                                    <v>8773331</v>
                                 </b>
                             </bs>
                         </hist>
@@ -27979,7 +28072,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8773472</v>
+                                    <v>8773331</v>
                                 </b>
                             </bs>
                         </hist>
@@ -27989,15 +28082,15 @@
         </relation>
         <relation>
             <name>commentbinding</name>
-            <cardinality>3095104</cardinality>
+            <cardinality>3095107</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2450349</v>
+                    <v>2450351</v>
                 </e>
                 <e>
                     <k>element</k>
-                    <v>3019196</v>
+                    <v>3019199</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -28011,7 +28104,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2369349</v>
+                                    <v>2369351</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -28032,7 +28125,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2943288</v>
+                                    <v>2943291</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -28047,15 +28140,15 @@
         </relation>
         <relation>
             <name>exprconv</name>
-            <cardinality>7021832</cardinality>
+            <cardinality>7021834</cardinality>
             <columnsizes>
                 <e>
                     <k>converted</k>
-                    <v>7021832</v>
+                    <v>7021834</v>
                 </e>
                 <e>
                     <k>conversion</k>
-                    <v>7021832</v>
+                    <v>7021834</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -28069,7 +28162,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7021832</v>
+                                    <v>7021834</v>
                                 </b>
                             </bs>
                         </hist>
@@ -28085,7 +28178,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7021832</v>
+                                    <v>7021834</v>
                                 </b>
                             </bs>
                         </hist>
@@ -28095,22 +28188,22 @@
         </relation>
         <relation>
             <name>compgenerated</name>
-            <cardinality>8328197</cardinality>
+            <cardinality>8328205</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>8328197</v>
+                    <v>8328205</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>synthetic_destructor_call</name>
-            <cardinality>144327</cardinality>
+            <cardinality>144328</cardinality>
             <columnsizes>
                 <e>
                     <k>element</k>
-                    <v>111770</v>
+                    <v>111771</v>
                 </e>
                 <e>
                     <k>i</k>
@@ -28118,7 +28211,7 @@
                 </e>
                 <e>
                     <k>destructor_call</k>
-                    <v>129098</v>
+                    <v>129099</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -28357,7 +28450,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>129098</v>
+                                    <v>129099</v>
                                 </b>
                             </bs>
                         </hist>
@@ -28436,7 +28529,7 @@
         </relation>
         <relation>
             <name>namespacembrs</name>
-            <cardinality>2389715</cardinality>
+            <cardinality>2389717</cardinality>
             <columnsizes>
                 <e>
                     <k>parentid</k>
@@ -28444,7 +28537,7 @@
                 </e>
                 <e>
                     <k>memberid</k>
-                    <v>2389715</v>
+                    <v>2389717</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -28524,7 +28617,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2389715</v>
+                                    <v>2389717</v>
                                 </b>
                             </bs>
                         </hist>
@@ -28534,11 +28627,11 @@
         </relation>
         <relation>
             <name>exprparents</name>
-            <cardinality>14182785</cardinality>
+            <cardinality>14182799</cardinality>
             <columnsizes>
                 <e>
                     <k>expr_id</k>
-                    <v>14182785</v>
+                    <v>14182799</v>
                 </e>
                 <e>
                     <k>child_index</k>
@@ -28546,7 +28639,7 @@
                 </e>
                 <e>
                     <k>parent_id</k>
-                    <v>9437898</v>
+                    <v>9437907</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -28560,7 +28653,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>14182785</v>
+                                    <v>14182799</v>
                                 </b>
                             </bs>
                         </hist>
@@ -28576,7 +28669,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>14182785</v>
+                                    <v>14182799</v>
                                 </b>
                             </bs>
                         </hist>
@@ -28694,12 +28787,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5400325</v>
+                                    <v>5400330</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>3700399</v>
+                                    <v>3700403</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -28720,12 +28813,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5400325</v>
+                                    <v>5400330</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>3700399</v>
+                                    <v>3700403</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -28740,11 +28833,11 @@
         </relation>
         <relation>
             <name>expr_isload</name>
-            <cardinality>4982130</cardinality>
+            <cardinality>4982107</cardinality>
             <columnsizes>
                 <e>
                     <k>expr_id</k>
-                    <v>4982130</v>
+                    <v>4982107</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -28824,11 +28917,11 @@
         </relation>
         <relation>
             <name>iscall</name>
-            <cardinality>2951156</cardinality>
+            <cardinality>2951159</cardinality>
             <columnsizes>
                 <e>
                     <k>caller</k>
-                    <v>2951156</v>
+                    <v>2951159</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -28846,7 +28939,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2951156</v>
+                                    <v>2951159</v>
                                 </b>
                             </bs>
                         </hist>
@@ -28882,11 +28975,11 @@
         </relation>
         <relation>
             <name>numtemplatearguments</name>
-            <cardinality>396244</cardinality>
+            <cardinality>396245</cardinality>
             <columnsizes>
                 <e>
                     <k>expr_id</k>
-                    <v>396244</v>
+                    <v>396245</v>
                 </e>
                 <e>
                     <k>num</k>
@@ -28904,7 +28997,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>396244</v>
+                                    <v>396245</v>
                                 </b>
                             </bs>
                         </hist>
@@ -29008,15 +29101,15 @@
         </relation>
         <relation>
             <name>namequalifiers</name>
-            <cardinality>1533107</cardinality>
+            <cardinality>1533108</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1533107</v>
+                    <v>1533108</v>
                 </e>
                 <e>
                     <k>qualifiableelement</k>
-                    <v>1533107</v>
+                    <v>1533108</v>
                 </e>
                 <e>
                     <k>qualifyingelement</k>
@@ -29038,7 +29131,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1533107</v>
+                                    <v>1533108</v>
                                 </b>
                             </bs>
                         </hist>
@@ -29054,7 +29147,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1533107</v>
+                                    <v>1533108</v>
                                 </b>
                             </bs>
                         </hist>
@@ -29070,7 +29163,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1533107</v>
+                                    <v>1533108</v>
                                 </b>
                             </bs>
                         </hist>
@@ -29086,7 +29179,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1533107</v>
+                                    <v>1533108</v>
                                 </b>
                             </bs>
                         </hist>
@@ -29102,7 +29195,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1533107</v>
+                                    <v>1533108</v>
                                 </b>
                             </bs>
                         </hist>
@@ -29118,7 +29211,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1533107</v>
+                                    <v>1533108</v>
                                 </b>
                             </bs>
                         </hist>
@@ -29349,15 +29442,15 @@
         </relation>
         <relation>
             <name>varbind</name>
-            <cardinality>6019055</cardinality>
+            <cardinality>6019061</cardinality>
             <columnsizes>
                 <e>
                     <k>expr</k>
-                    <v>6019055</v>
+                    <v>6019061</v>
                 </e>
                 <e>
                     <k>var</k>
-                    <v>767246</v>
+                    <v>767247</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -29371,7 +29464,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6019055</v>
+                                    <v>6019061</v>
                                 </b>
                             </bs>
                         </hist>
@@ -29442,15 +29535,15 @@
         </relation>
         <relation>
             <name>funbind</name>
-            <cardinality>2954265</cardinality>
+            <cardinality>2954268</cardinality>
             <columnsizes>
                 <e>
                     <k>expr</k>
-                    <v>2951453</v>
+                    <v>2951456</v>
                 </e>
                 <e>
                     <k>fun</k>
-                    <v>533823</v>
+                    <v>533843</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -29464,7 +29557,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2948641</v>
+                                    <v>2948644</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -29485,12 +29578,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>329747</v>
+                                    <v>329787</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>82204</v>
+                                    <v>82184</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -29937,15 +30030,15 @@
         </relation>
         <relation>
             <name>values</name>
-            <cardinality>10759270</cardinality>
+            <cardinality>10759479</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>10759270</v>
+                    <v>10759479</v>
                 </e>
                 <e>
                     <k>str</k>
-                    <v>87848</v>
+                    <v>87846</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -29959,7 +30052,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10759270</v>
+                                    <v>10759479</v>
                                 </b>
                             </bs>
                         </hist>
@@ -29975,7 +30068,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>59389</v>
+                                    <v>59388</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -29985,12 +30078,12 @@
                                 <b>
                                     <a>3</a>
                                     <b>6</b>
-                                    <v>6924</v>
+                                    <v>6919</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>56</b>
-                                    <v>6612</v>
+                                    <v>6618</v>
                                 </b>
                                 <b>
                                     <a>57</a>
@@ -30068,15 +30161,15 @@
         </relation>
         <relation>
             <name>valuebind</name>
-            <cardinality>11192950</cardinality>
+            <cardinality>11193149</cardinality>
             <columnsizes>
                 <e>
                     <k>val</k>
-                    <v>10759270</v>
+                    <v>10759479</v>
                 </e>
                 <e>
                     <k>expr</k>
-                    <v>11192950</v>
+                    <v>11193149</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -30090,12 +30183,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10348201</v>
+                                    <v>10348421</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>7</b>
-                                    <v>411068</v>
+                                    <v>411058</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30111,7 +30204,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>11192950</v>
+                                    <v>11193149</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30121,15 +30214,15 @@
         </relation>
         <relation>
             <name>fieldoffsets</name>
-            <cardinality>1052962</cardinality>
+            <cardinality>1052936</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1052962</v>
+                    <v>1052936</v>
                 </e>
                 <e>
                     <k>byteoffset</k>
-                    <v>22655</v>
+                    <v>22654</v>
                 </e>
                 <e>
                     <k>bitoffset</k>
@@ -30147,7 +30240,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1052962</v>
+                                    <v>1052936</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30163,7 +30256,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1052962</v>
+                                    <v>1052936</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30225,7 +30318,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>21977</v>
+                                    <v>21976</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -30322,11 +30415,11 @@
         </relation>
         <relation>
             <name>bitfield</name>
-            <cardinality>20918</cardinality>
+            <cardinality>20917</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>20918</v>
+                    <v>20917</v>
                 </e>
                 <e>
                     <k>bits</k>
@@ -30348,7 +30441,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>20918</v>
+                                    <v>20917</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30364,7 +30457,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>20918</v>
+                                    <v>20917</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30508,23 +30601,23 @@
         </relation>
         <relation>
             <name>initialisers</name>
-            <cardinality>1699581</cardinality>
+            <cardinality>1699574</cardinality>
             <columnsizes>
                 <e>
                     <k>init</k>
-                    <v>1699581</v>
+                    <v>1699574</v>
                 </e>
                 <e>
                     <k>var</k>
-                    <v>722038</v>
+                    <v>722035</v>
                 </e>
                 <e>
                     <k>expr</k>
-                    <v>1699581</v>
+                    <v>1699574</v>
                 </e>
                 <e>
                     <k>location</k>
-                    <v>390813</v>
+                    <v>390811</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -30538,7 +30631,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1699581</v>
+                                    <v>1699574</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30554,7 +30647,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1699581</v>
+                                    <v>1699574</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30570,7 +30663,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1699581</v>
+                                    <v>1699574</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30586,7 +30679,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>633767</v>
+                                    <v>633764</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -30612,7 +30705,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>633767</v>
+                                    <v>633764</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -30638,7 +30731,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>722032</v>
+                                    <v>722028</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -30659,7 +30752,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1699581</v>
+                                    <v>1699574</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30675,7 +30768,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1699581</v>
+                                    <v>1699574</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30691,7 +30784,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1699581</v>
+                                    <v>1699574</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30707,7 +30800,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>318365</v>
+                                    <v>318364</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -30738,7 +30831,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>341138</v>
+                                    <v>341137</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -30764,7 +30857,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>318365</v>
+                                    <v>318364</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -30863,11 +30956,11 @@
         </relation>
         <relation>
             <name>exprs</name>
-            <cardinality>18356790</cardinality>
+            <cardinality>18356808</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>18356790</v>
+                    <v>18356808</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -30875,7 +30968,7 @@
                 </e>
                 <e>
                     <k>location</k>
-                    <v>3591749</v>
+                    <v>3591752</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -30889,7 +30982,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>18356790</v>
+                                    <v>18356808</v>
                                 </b>
                             </bs>
                         </hist>
@@ -30905,7 +30998,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>18356790</v>
+                                    <v>18356808</v>
                                 </b>
                             </bs>
                         </hist>
@@ -31073,7 +31166,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1941352</v>
+                                    <v>1941354</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -31114,17 +31207,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2391758</v>
+                                    <v>2391761</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>875231</v>
+                                    <v>875232</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>6</b>
-                                    <v>307821</v>
+                                    <v>307822</v>
                                 </b>
                                 <b>
                                     <a>6</a>
@@ -31139,15 +31232,15 @@
         </relation>
         <relation>
             <name>expr_types</name>
-            <cardinality>18411724</cardinality>
+            <cardinality>18411742</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>18356790</v>
+                    <v>18356808</v>
                 </e>
                 <e>
                     <k>typeid</k>
-                    <v>881136</v>
+                    <v>881137</v>
                 </e>
                 <e>
                     <k>value_category</k>
@@ -31165,7 +31258,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>18301855</v>
+                                    <v>18301873</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -31186,7 +31279,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>18356790</v>
+                                    <v>18356808</v>
                                 </b>
                             </bs>
                         </hist>
@@ -31207,7 +31300,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>172230</v>
+                                    <v>172231</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -31258,7 +31351,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>111869</v>
+                                    <v>111870</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -32102,7 +32195,7 @@
                 </e>
                 <e>
                     <k>type_id</k>
-                    <v>19827</v>
+                    <v>19826</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -32147,11 +32240,11 @@
         </relation>
         <relation>
             <name>sizeof_bind</name>
-            <cardinality>198889</cardinality>
+            <cardinality>198884</cardinality>
             <columnsizes>
                 <e>
                     <k>expr</k>
-                    <v>198889</v>
+                    <v>198884</v>
                 </e>
                 <e>
                     <k>type_id</k>
@@ -32169,7 +32262,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>198889</v>
+                                    <v>198884</v>
                                 </b>
                             </bs>
                         </hist>
@@ -33273,11 +33366,11 @@
         </relation>
         <relation>
             <name>stmts</name>
-            <cardinality>4653233</cardinality>
+            <cardinality>4653158</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4653233</v>
+                    <v>4653158</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -33285,7 +33378,7 @@
                 </e>
                 <e>
                     <k>location</k>
-                    <v>2284884</v>
+                    <v>2284848</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -33299,7 +33392,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4653233</v>
+                                    <v>4653158</v>
                                 </b>
                             </bs>
                         </hist>
@@ -33315,7 +33408,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4653233</v>
+                                    <v>4653158</v>
                                 </b>
                             </bs>
                         </hist>
@@ -33543,22 +33636,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1890473</v>
+                                    <v>1890443</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>4</b>
-                                    <v>175816</v>
+                                    <v>175813</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>12</b>
-                                    <v>176025</v>
+                                    <v>176023</v>
                                 </b>
                                 <b>
                                     <a>12</a>
                                     <b>687</b>
-                                    <v>42568</v>
+                                    <v>42567</v>
                                 </b>
                             </bs>
                         </hist>
@@ -33574,12 +33667,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2227673</v>
+                                    <v>2227637</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>8</b>
-                                    <v>57211</v>
+                                    <v>57210</v>
                                 </b>
                             </bs>
                         </hist>
@@ -33877,15 +33970,15 @@
         </relation>
         <relation>
             <name>constexpr_if_then</name>
-            <cardinality>52504</cardinality>
+            <cardinality>52503</cardinality>
             <columnsizes>
                 <e>
                     <k>constexpr_if_stmt</k>
-                    <v>52504</v>
+                    <v>52503</v>
                 </e>
                 <e>
                     <k>then_id</k>
-                    <v>52504</v>
+                    <v>52503</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -33899,7 +33992,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>52504</v>
+                                    <v>52503</v>
                                 </b>
                             </bs>
                         </hist>
@@ -33915,7 +34008,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>52504</v>
+                                    <v>52503</v>
                                 </b>
                             </bs>
                         </hist>
@@ -33925,15 +34018,15 @@
         </relation>
         <relation>
             <name>constexpr_if_else</name>
-            <cardinality>30854</cardinality>
+            <cardinality>30853</cardinality>
             <columnsizes>
                 <e>
                     <k>constexpr_if_stmt</k>
-                    <v>30854</v>
+                    <v>30853</v>
                 </e>
                 <e>
                     <k>else_id</k>
-                    <v>30854</v>
+                    <v>30853</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -33947,7 +34040,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>30854</v>
+                                    <v>30853</v>
                                 </b>
                             </bs>
                         </hist>
@@ -33963,7 +34056,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>30854</v>
+                                    <v>30853</v>
                                 </b>
                             </bs>
                         </hist>
@@ -34021,15 +34114,15 @@
         </relation>
         <relation>
             <name>do_body</name>
-            <cardinality>148628</cardinality>
+            <cardinality>148625</cardinality>
             <columnsizes>
                 <e>
                     <k>do_stmt</k>
-                    <v>148628</v>
+                    <v>148625</v>
                 </e>
                 <e>
                     <k>body_id</k>
-                    <v>148628</v>
+                    <v>148625</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -34043,7 +34136,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>148628</v>
+                                    <v>148625</v>
                                 </b>
                             </bs>
                         </hist>
@@ -34059,7 +34152,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>148628</v>
+                                    <v>148625</v>
                                 </b>
                             </bs>
                         </hist>
@@ -34383,15 +34476,15 @@
         </relation>
         <relation>
             <name>switch_body</name>
-            <cardinality>20747</cardinality>
+            <cardinality>20746</cardinality>
             <columnsizes>
                 <e>
                     <k>switch_stmt</k>
-                    <v>20747</v>
+                    <v>20746</v>
                 </e>
                 <e>
                     <k>body_id</k>
-                    <v>20747</v>
+                    <v>20746</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -34405,7 +34498,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>20747</v>
+                                    <v>20746</v>
                                 </b>
                             </bs>
                         </hist>
@@ -34421,7 +34514,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>20747</v>
+                                    <v>20746</v>
                                 </b>
                             </bs>
                         </hist>
@@ -34623,11 +34716,11 @@
         </relation>
         <relation>
             <name>stmtparents</name>
-            <cardinality>4056811</cardinality>
+            <cardinality>4056792</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4056811</v>
+                    <v>4056792</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -34635,7 +34728,7 @@
                 </e>
                 <e>
                     <k>parent</k>
-                    <v>1721378</v>
+                    <v>1721371</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -34649,7 +34742,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4056811</v>
+                                    <v>4056792</v>
                                 </b>
                             </bs>
                         </hist>
@@ -34665,7 +34758,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4056811</v>
+                                    <v>4056792</v>
                                 </b>
                             </bs>
                         </hist>
@@ -34803,12 +34896,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>988419</v>
+                                    <v>988415</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>373378</v>
+                                    <v>373376</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -34818,12 +34911,12 @@
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>111365</v>
+                                    <v>111364</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>17</b>
-                                    <v>129977</v>
+                                    <v>129976</v>
                                 </b>
                                 <b>
                                     <a>17</a>
@@ -34844,12 +34937,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>988419</v>
+                                    <v>988415</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>373378</v>
+                                    <v>373376</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -34859,12 +34952,12 @@
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>111365</v>
+                                    <v>111364</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>17</b>
-                                    <v>129977</v>
+                                    <v>129976</v>
                                 </b>
                                 <b>
                                     <a>17</a>
@@ -34890,11 +34983,11 @@
         </relation>
         <relation>
             <name>stmt_decl_bind</name>
-            <cardinality>585107</cardinality>
+            <cardinality>585097</cardinality>
             <columnsizes>
                 <e>
                     <k>stmt</k>
-                    <v>544993</v>
+                    <v>544983</v>
                 </e>
                 <e>
                     <k>num</k>
@@ -34902,7 +34995,7 @@
                 </e>
                 <e>
                     <k>decl</k>
-                    <v>585002</v>
+                    <v>584992</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -34916,12 +35009,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>524132</v>
+                                    <v>524123</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>19</b>
-                                    <v>20861</v>
+                                    <v>20860</v>
                                 </b>
                             </bs>
                         </hist>
@@ -34937,12 +35030,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>524132</v>
+                                    <v>524123</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>19</b>
-                                    <v>20861</v>
+                                    <v>20860</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35140,7 +35233,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>584964</v>
+                                    <v>584954</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -35161,7 +35254,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>585002</v>
+                                    <v>584992</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35171,11 +35264,11 @@
         </relation>
         <relation>
             <name>stmt_decl_entry_bind</name>
-            <cardinality>527567</cardinality>
+            <cardinality>527557</cardinality>
             <columnsizes>
                 <e>
                     <k>stmt</k>
-                    <v>487755</v>
+                    <v>487746</v>
                 </e>
                 <e>
                     <k>num</k>
@@ -35183,7 +35276,7 @@
                 </e>
                 <e>
                     <k>decl_entry</k>
-                    <v>527508</v>
+                    <v>527499</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -35197,7 +35290,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>467158</v>
+                                    <v>467150</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -35218,7 +35311,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>467158</v>
+                                    <v>467150</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -35421,7 +35514,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>527487</v>
+                                    <v>527478</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -35442,7 +35535,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>527508</v>
+                                    <v>527499</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35452,15 +35545,15 @@
         </relation>
         <relation>
             <name>blockscope</name>
-            <cardinality>1414944</cardinality>
+            <cardinality>1414946</cardinality>
             <columnsizes>
                 <e>
                     <k>block</k>
-                    <v>1414944</v>
+                    <v>1414946</v>
                 </e>
                 <e>
                     <k>enclosing</k>
-                    <v>1300619</v>
+                    <v>1300621</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -35474,7 +35567,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1414944</v>
+                                    <v>1414946</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35490,7 +35583,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1235820</v>
+                                    <v>1235821</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -35505,11 +35598,11 @@
         </relation>
         <relation>
             <name>jumpinfo</name>
-            <cardinality>254036</cardinality>
+            <cardinality>254032</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>254036</v>
+                    <v>254032</v>
                 </e>
                 <e>
                     <k>str</k>
@@ -35517,7 +35610,7 @@
                 </e>
                 <e>
                     <k>target</k>
-                    <v>53054</v>
+                    <v>53053</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -35531,7 +35624,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>254036</v>
+                                    <v>254032</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35547,7 +35640,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>254036</v>
+                                    <v>254032</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35568,7 +35661,7 @@
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>4247</v>
+                                    <v>4246</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -35609,7 +35702,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>16720</v>
+                                    <v>16719</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -35681,7 +35774,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>53054</v>
+                                    <v>53053</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35691,11 +35784,11 @@
         </relation>
         <relation>
             <name>preprocdirects</name>
-            <cardinality>4427317</cardinality>
+            <cardinality>4427246</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4427317</v>
+                    <v>4427246</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -35703,7 +35796,7 @@
                 </e>
                 <e>
                     <k>location</k>
-                    <v>4424807</v>
+                    <v>4424736</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -35717,7 +35810,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4427317</v>
+                                    <v>4427246</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35733,7 +35826,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4427317</v>
+                                    <v>4427246</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35871,7 +35964,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4424702</v>
+                                    <v>4424631</v>
                                 </b>
                                 <b>
                                     <a>25</a>
@@ -35892,7 +35985,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4424807</v>
+                                    <v>4424736</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35902,15 +35995,15 @@
         </relation>
         <relation>
             <name>preprocpair</name>
-            <cardinality>1419110</cardinality>
+            <cardinality>1419111</cardinality>
             <columnsizes>
                 <e>
                     <k>begin</k>
-                    <v>1186757</v>
+                    <v>1186758</v>
                 </e>
                 <e>
                     <k>elseelifend</k>
-                    <v>1419110</v>
+                    <v>1419111</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -35929,7 +36022,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>206432</v>
+                                    <v>206433</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -35950,7 +36043,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1419110</v>
+                                    <v>1419111</v>
                                 </b>
                             </bs>
                         </hist>
@@ -35960,11 +36053,11 @@
         </relation>
         <relation>
             <name>preproctrue</name>
-            <cardinality>770651</cardinality>
+            <cardinality>770652</cardinality>
             <columnsizes>
                 <e>
                     <k>branch</k>
-                    <v>770651</v>
+                    <v>770652</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -35982,19 +36075,19 @@
         </relation>
         <relation>
             <name>preproctext</name>
-            <cardinality>3569465</cardinality>
+            <cardinality>3569408</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3569465</v>
+                    <v>3569408</v>
                 </e>
                 <e>
                     <k>head</k>
-                    <v>2589243</v>
+                    <v>2589201</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>1514470</v>
+                    <v>1514446</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -36008,7 +36101,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3569465</v>
+                                    <v>3569408</v>
                                 </b>
                             </bs>
                         </hist>
@@ -36024,7 +36117,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3569465</v>
+                                    <v>3569408</v>
                                 </b>
                             </bs>
                         </hist>
@@ -36040,12 +36133,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2442293</v>
+                                    <v>2442254</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>740</b>
-                                    <v>146949</v>
+                                    <v>146947</v>
                                 </b>
                             </bs>
                         </hist>
@@ -36061,12 +36154,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2527116</v>
+                                    <v>2527075</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>5</b>
-                                    <v>62126</v>
+                                    <v>62125</v>
                                 </b>
                             </bs>
                         </hist>
@@ -36082,12 +36175,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1370972</v>
+                                    <v>1370950</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>6</b>
-                                    <v>113585</v>
+                                    <v>113583</v>
                                 </b>
                                 <b>
                                     <a>6</a>
@@ -36108,12 +36201,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1374005</v>
+                                    <v>1373983</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>7</b>
-                                    <v>113899</v>
+                                    <v>113897</v>
                                 </b>
                                 <b>
                                     <a>7</a>
@@ -36249,11 +36342,11 @@
         </relation>
         <relation>
             <name>link_parent</name>
-            <cardinality>38279611</cardinality>
+            <cardinality>38417223</cardinality>
             <columnsizes>
                 <e>
                     <k>element</k>
-                    <v>4843995</v>
+                    <v>4860584</v>
                 </e>
                 <e>
                     <k>link_target</k>
@@ -36271,17 +36364,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>645317</v>
+                                    <v>646377</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>9</b>
-                                    <v>25334</v>
+                                    <v>25792</v>
                                 </b>
                                 <b>
                                     <a>9</a>
                                     <b>10</b>
-                                    <v>4173343</v>
+                                    <v>4188413</v>
                                 </b>
                             </bs>
                         </hist>
@@ -36300,48 +36393,48 @@
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>118453</a>
-                                    <b>118454</b>
+                                    <a>118880</a>
+                                    <b>118881</b>
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>118557</a>
-                                    <b>118558</b>
+                                    <a>118984</a>
+                                    <b>118985</b>
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>118652</a>
-                                    <b>118653</b>
+                                    <a>119079</a>
+                                    <b>119080</b>
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>118687</a>
-                                    <b>118688</b>
+                                    <a>119114</a>
+                                    <b>119115</b>
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>118693</a>
-                                    <b>118694</b>
+                                    <a>119120</a>
+                                    <b>119121</b>
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>118709</a>
-                                    <b>118710</b>
+                                    <a>119145</a>
+                                    <b>119146</b>
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>120575</a>
-                                    <b>120576</b>
+                                    <a>121003</a>
+                                    <b>121004</b>
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>125080</a>
-                                    <b>125081</b>
+                                    <a>125539</a>
+                                    <b>125540</b>
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>127476</a>
-                                    <b>127477</b>
+                                    <a>127917</a>
+                                    <b>127918</b>
                                     <v>35</v>
                                 </b>
                             </bs>
diff --git a/cpp/ql/lib/upgrades/f96ad9b2da43bbc9e55a72a165febd270ae07981/old.dbscheme b/cpp/ql/lib/upgrades/f96ad9b2da43bbc9e55a72a165febd270ae07981/old.dbscheme
new file mode 100644
index 00000000000..f96ad9b2da4
--- /dev/null
+++ b/cpp/ql/lib/upgrades/f96ad9b2da43bbc9e55a72a165febd270ae07981/old.dbscheme
@@ -0,0 +1,2136 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    /**
+     * An invocation of the compiler. Note that more than one file may
+     * be compiled per invocation. For example, this command compiles
+     * three source files:
+     *
+     *   gcc -c f1.c f2.c f3.c
+     */
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | *path to extractor*
+ * 1   | `--mimic`
+ * 2   | `/usr/bin/gcc`
+ * 3   | `-c`
+ * 4   | f1.c
+ * 5   | f2.c
+ * 6   | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.c
+ * 1   | f2.c
+ * 2   | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+    int id : @externalDataElement,
+    string path : string ref,
+    int column: int ref,
+    string value : string ref
+);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Information about packages that provide code used during compilation.
+ * The `id` is just a unique identifier.
+ * The `namespace` is typically the name of the package manager that
+ * provided the package (e.g. "dpkg" or "yum").
+ * The `package_name` is the name of the package, and `version` is its
+ * version (as a string).
+ */
+external_packages(
+    unique int id: @external_package,
+    string namespace : string ref,
+    string package_name : string ref,
+    string version : string ref
+);
+
+/**
+ * Holds if File `fileid` was provided by package `package`.
+ */
+header_to_external_package(
+    int fileid : @file ref,
+    int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+    unique int id : @svnentry,
+    string revision : string ref,
+    string author : string ref,
+    date revisionDate : date ref,
+    int changeSize : int ref
+)
+
+svnaffectedfiles(
+    int id : @svnentry ref,
+    int file : @file ref,
+    string action : string ref
+)
+
+svnentrymsg(
+    unique int id : @svnentry ref,
+    string message : string ref
+)
+
+svnchurn(
+    int commit : @svnentry ref,
+    int file : @file ref,
+    int addedLines : int ref,
+    int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+    /** The location of an element that is not an expression or a statement. */
+    unique int id: @location_default,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_stmt(
+    /** The location of a statement. */
+    unique int id: @location_stmt,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_expr(
+    /** The location of an expression. */
+    unique int id: @location_expr,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+    int element_id: @sourceline ref,
+    int num_lines: int ref,
+    int num_code: int ref,
+    int num_comment: int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+files(
+    unique int id: @file,
+    string name: string ref
+);
+
+folders(
+    unique int id: @folder,
+    string name: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+    int parent: @container ref,
+    unique int child: @container ref
+);
+
+fileannotations(
+    int id: @file ref,
+    int kind: int ref,
+    string name: string ref,
+    string value: string ref
+);
+
+inmacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+/*
+  case @macroinvocations.kind of
+    1 = macro expansion
+  | 2 = other macro reference
+  ;
+*/
+macroinvocations(
+    unique int id: @macroinvocation,
+    int macro_id: @ppd_define ref,
+    int location: @location_default ref,
+    int kind: int ref
+);
+
+macroparent(
+    unique int id: @macroinvocation ref,
+    int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+    int id: @macroinvocation ref,
+    int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+/*
+  case @function.kind of
+    1 = normal
+  | 2 = constructor
+  | 3 = destructor
+  | 4 = conversion
+  | 5 = operator
+  | 6 = builtin     // GCC built-in functions, e.g. __builtin___memcpy_chk
+  ;
+*/
+functions(
+    unique int id: @function,
+    string name: string ref,
+    int kind: int ref
+);
+
+function_entry_point(int id: @function ref, unique int entry_point: @stmt ref);
+
+function_return_type(int id: @function ref, int return_type: @type ref);
+
+/** If `function` is a coroutine, then this gives the
+    std::experimental::resumable_traits instance associated with it,
+    and the variables representing the `handle` and `promise` for it. */
+coroutine(
+  unique int function: @function ref,
+  int traits: @type ref,
+  int handle: @variable ref,
+  int promise: @variable ref
+);
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+  unique int function: @function ref,
+  int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+  unique int function: @function ref,
+  int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+member_function_this_type(unique int id: @function ref, int this_type: @type ref);
+
+#keyset[id, type_id]
+fun_decls(
+    int id: @fun_decl,
+    int function: @function ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+    int id: @fun_decl ref,
+    string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+    int fun_decl: @fun_decl ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+    int fun_decl: @fun_decl ref,
+    int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+    unique int fun_decl: @fun_decl ref,
+    int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+    unique int id: @var_decl ref,
+    int index: int ref,
+    int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+    int id: @var_decl,
+    int variable: @variable ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+    int id: @var_decl ref,
+    string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+
+type_decls(
+    unique int id: @type_decl,
+    int type_id: @type ref,
+    int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+    unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+    unique int id: @namespace_decl,
+    int namespace_id: @namespace ref,
+    int location: @location_default ref,
+    int bodylocation: @location_default ref
+);
+
+usings(
+    unique int id: @using,
+    int element_id: @element ref,
+    int location: @location_default ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+    int parent: @element ref,
+    int child: @using ref
+);
+
+static_asserts(
+    unique int id: @static_assert,
+    int condition : @expr ref,
+    string message : string ref,
+    int location: @location_default ref,
+    int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+    int id: @parameter,
+    int function: @functionorblock ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+overrides(int new: @function ref, int old: @function ref);
+
+#keyset[id, type_id]
+membervariables(
+    int id: @membervariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+    int id: @globalvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+    int id: @localvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+autoderivation(
+    unique int var: @variable ref,
+    int derivation_type: @type ref
+);
+
+orphaned_variables(
+    int var: @localvariable ref,
+    int function: @function ref
+)
+
+enumconstants(
+    unique int id: @enumconstant,
+    int parent: @usertype ref,
+    int index: int ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/*
+  Built-in types are the fundamental types, e.g., integral, floating, and void.
+
+  case @builtintype.kind of
+    1 = error
+  | 2 = unknown
+  | 3 = void
+  | 4 = boolean
+  | 5 = char
+  | 6 = unsigned_char
+  | 7 = signed_char
+  | 8 = short
+  | 9 = unsigned_short
+  | 10 = signed_short
+  | 11 = int
+  | 12 = unsigned_int
+  | 13 = signed_int
+  | 14 = long
+  | 15 = unsigned_long
+  | 16 = signed_long
+  | 17 = long_long
+  | 18 = unsigned_long_long
+  | 19 = signed_long_long
+  | 20 = __int8                 // Microsoft-specific
+  | 21 = __int16                // Microsoft-specific
+  | 22 = __int32                // Microsoft-specific
+  | 23 = __int64                // Microsoft-specific
+  | 24 = float
+  | 25 = double
+  | 26 = long_double
+  | 27 = _Complex_float         // C99-specific
+  | 28 = _Complex_double        // C99-specific
+  | 29 = _Complex_long double   // C99-specific
+  | 30 = _Imaginary_float       // C99-specific
+  | 31 = _Imaginary_double      // C99-specific
+  | 32 = _Imaginary_long_double // C99-specific
+  | 33 = wchar_t                // Microsoft-specific
+  | 34 = decltype_nullptr       // C++11
+  | 35 = __int128
+  | 36 = unsigned___int128
+  | 37 = signed___int128
+  | 38 = __float128
+  | 39 = _Complex___float128
+  | 40 = _Decimal32
+  | 41 = _Decimal64
+  | 42 = _Decimal128
+  | 43 = char16_t
+  | 44 = char32_t
+  | 45 = _Float32
+  | 46 = _Float32x
+  | 47 = _Float64
+  | 48 = _Float64x
+  | 49 = _Float128
+  | 50 = _Float128x
+  | 51 = char8_t
+  ;
+*/
+builtintypes(
+    unique int id: @builtintype,
+    string name: string ref,
+    int kind: int ref,
+    int size: int ref,
+    int sign: int ref,
+    int alignment: int ref
+);
+
+/*
+  Derived types are types that are directly derived from existing types and
+  point to, refer to, transform type data to return a new type.
+
+  case @derivedtype.kind of
+    1 = pointer
+  | 2 = reference
+  | 3 = type_with_specifiers
+  | 4 = array
+  | 5 = gnu_vector
+  | 6 = routineptr
+  | 7 = routinereference
+  | 8 = rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+  | 10 = block
+  ;
+*/
+derivedtypes(
+    unique int id: @derivedtype,
+    string name: string ref,
+    int kind: int ref,
+    int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+    int size: int ref,
+    int alignment: int ref);
+
+arraysizes(
+    unique int id: @derivedtype ref,
+    int num_elements: int ref,
+    int bytesize: int ref,
+    int alignment: int ref
+);
+
+typedefbase(
+    unique int id: @usertype ref,
+    int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator.  For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * would change the semantics of this decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+#keyset[id, expr]
+decltypes(
+    int id: @decltype,
+    int expr: @expr ref,
+    int base_type: @type ref,
+    boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+  case @usertype.kind of
+    1 = struct
+  | 2 = class
+  | 3 = union
+  | 4 = enum
+  | 5 = typedef                       // classic C: typedef typedef type name
+  | 6 = template
+  | 7 = template_parameter
+  | 8 = template_template_parameter
+  | 9 = proxy_class                   // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+  | 13 = scoped_enum
+  | 14 = using_alias                  // a using name = type style typedef
+  ;
+*/
+usertypes(
+    unique int id: @usertype,
+    string name: string ref,
+    int kind: int ref
+);
+
+usertypesize(
+    unique int id: @usertype ref,
+    int size: int ref,
+    int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+    unique int id: @usertype ref,
+    string uuid: string ref
+);
+
+mangled_name(
+    unique int id: @declaration ref,
+    int mangled_name : @mangledname
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+    int to: @usertype ref,
+    int from: @usertype ref
+);
+class_template_argument(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+class_template_argument_value(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+is_proxy_class_for(
+    unique int id: @usertype ref,
+    unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+    unique int id: @type_mention,
+    int type_id: @type ref,
+    int location: @location ref,
+    // a_symbol_reference_kind from the EDG frontend.  See symbol_ref.h there.
+    int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+    unique int to: @function ref,
+    int from: @function ref
+);
+function_template_argument(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+function_template_argument_value(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+    unique int to: @variable ref,
+    int from: @variable ref
+);
+variable_template_argument(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+variable_template_argument_value(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+/*
+  Fixed point types
+  precision(1) = short, precision(2) = default, precision(3) = long
+  is_unsigned(1) = unsigned is_unsigned(2) = signed
+  is_fract_type(1) = declared with _Fract
+  saturating(1) = declared with _Sat
+*/
+/* TODO
+fixedpointtypes(
+    unique int id: @fixedpointtype,
+    int precision: int ref,
+    int is_unsigned: int ref,
+    int is_fract_type: int ref,
+    int saturating: int ref);
+*/
+
+routinetypes(
+    unique int id: @routinetype,
+    int return_type: @type ref
+);
+
+routinetypeargs(
+    int routine: @routinetype ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+ptrtomembers(
+    unique int id: @ptrtomember,
+    int type_id: @type ref,
+    int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+    "public",
+    "protected",
+    "private",
+
+    "const",
+    "volatile",
+    "static",
+
+    "pure",
+    "virtual",
+    "sealed", // Microsoft
+    "__interface", // Microsoft
+    "inline",
+    "explicit",
+
+    "near", // near far extension
+    "far", // near far extension
+    "__ptr32", // Microsoft
+    "__ptr64", // Microsoft
+    "__sptr", // Microsoft
+    "__uptr", // Microsoft
+    "dllimport", // Microsoft
+    "dllexport", // Microsoft
+    "thread", // Microsoft
+    "naked", // Microsoft
+    "microsoft_inline", // Microsoft
+    "forceinline", // Microsoft
+    "selectany", // Microsoft
+    "nothrow", // Microsoft
+    "novtable", // Microsoft
+    "noreturn", // Microsoft
+    "noinline", // Microsoft
+    "noalias", // Microsoft
+    "restrict", // Microsoft
+*/
+
+specifiers(
+    unique int id: @specifier,
+    unique string str: string ref
+);
+
+typespecifiers(
+    int type_id: @type ref,
+    int spec_id: @specifier ref
+);
+
+funspecifiers(
+    int func_id: @function ref,
+    int spec_id: @specifier ref
+);
+
+varspecifiers(
+    int var_id: @accessible ref,
+    int spec_id: @specifier ref
+);
+
+attributes(
+    unique int id: @attribute,
+    int kind: int ref,
+    string name: string ref,
+    string name_space: string ref,
+    int location: @location_default ref
+);
+
+case @attribute.kind of
+  0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+    unique int id: @attribute_arg,
+    int kind: int ref,
+    int attribute: @attribute ref,
+    int index: int ref,
+    int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+  0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+;
+
+attribute_arg_value(
+    unique int arg: @attribute_arg ref,
+    string value: string ref
+);
+attribute_arg_type(
+    unique int arg: @attribute_arg ref,
+    int type_id: @type ref
+);
+attribute_arg_constant(
+    unique int arg: @attribute_arg ref,
+    int constant: @expr ref
+)
+attribute_arg_name(
+    unique int arg: @attribute_arg ref,
+    string name: string ref
+);
+
+typeattributes(
+    int type_id: @type ref,
+    int spec_id: @attribute ref
+);
+
+funcattributes(
+    int func_id: @function ref,
+    int spec_id: @attribute ref
+);
+
+varattributes(
+    int var_id: @accessible ref,
+    int spec_id: @attribute ref
+);
+
+stmtattributes(
+    int stmt_id: @stmt ref,
+    int spec_id: @attribute ref
+);
+
+@type = @builtintype
+      | @derivedtype
+      | @usertype
+      /* TODO | @fixedpointtype */
+      | @routinetype
+      | @ptrtomember
+      | @decltype;
+
+unspecifiedtype(
+    unique int type_id: @type ref,
+    int unspecified_type_id: @type ref
+);
+
+member(
+    int parent: @type ref,
+    int index: int ref,
+    int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+    unique int child: @enclosingfunction_child ref,
+    int parent: @function ref
+);
+
+derivations(
+    unique int derivation: @derivation,
+    int sub: @type ref,
+    int index: int ref,
+    int super: @type ref,
+    int location: @location_default ref
+);
+
+derspecifiers(
+    int der_id: @derivation ref,
+    int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+    unique int der_id: @derivation ref,
+    int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+    int sub: @usertype ref,
+    int super: @usertype ref,
+    int offset: int ref
+);
+
+frienddecls(
+    unique int id: @frienddecl,
+    int type_id: @type ref,
+    int decl_id: @declaration ref,
+    int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+             | @declaredtype
+             | @variable
+             | @enumconstant
+             | @frienddecl;
+
+@member = @membervariable
+        | @function
+        | @declaredtype
+        | @enumconstant;
+
+@locatable = @diagnostic
+           | @declaration
+           | @ppd_include
+           | @ppd_define
+           | @macroinvocation
+           /*| @funcall*/
+           | @xmllocatable
+           | @attribute
+           | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+         | @file
+         | @folder
+         | @specifier
+         | @type
+         | @expr
+         | @namespace
+         | @initialiser
+         | @stmt
+         | @derivation
+         | @comment
+         | @preprocdirect
+         | @fun_decl
+         | @var_decl
+         | @type_decl
+         | @namespace_decl
+         | @using
+         | @namequalifier
+         | @specialnamequalifyingelement
+         | @static_assert
+         | @type_mention
+         | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+    unique int id: @comment,
+    string contents: string ref,
+    int location: @location_default ref
+);
+
+commentbinding(
+    int id: @comment ref,
+    int element: @element ref
+);
+
+exprconv(
+    int converted: @expr ref,
+    unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+    int element: @element ref,
+    int i: int ref,
+    int destructor_call: @routineexpr ref
+);
+
+namespaces(
+    unique int id: @namespace,
+    string name: string ref
+);
+
+namespace_inline(
+    unique int id: @namespace ref
+);
+
+namespacembrs(
+    int parentid: @namespace ref,
+    unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+    int expr_id: @expr ref,
+    int child_index: int ref,
+    int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+      | @const_cast
+      | @dynamic_cast
+      | @reinterpret_cast
+      | @static_cast
+      ;
+
+/*
+case @conversion.kind of
+  0 = @simple_conversion           // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion             // conversion to 'bool'
+| 2 = @base_class_conversion       // a derived-to-base conversion
+| 3 = @derived_class_conversion    // a base-to-derived conversion
+| 4 = @pm_base_class_conversion    // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust              // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust              // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+    unique int expr_id: @cast ref,
+    int kind: int ref
+);
+
+@conversion = @cast
+            | @array_to_pointer
+            | @parexpr
+            | @reference_to
+            | @ref_indirect
+            | @temp_init
+            ;
+
+/*
+case @funbindexpr.kind of
+  0 = @normal_call  // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call     // a call whose target is only found by ADL
+;
+*/
+iscall(unique int caller: @funbindexpr ref, int kind: int ref);
+
+numtemplatearguments(
+    unique int expr_id: @expr ref,
+    int num: int ref
+);
+
+specialnamequalifyingelements(
+    unique int id: @specialnamequalifyingelement,
+    unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+                       | @specialnamequalifyingelement
+                       | @usertype;
+
+namequalifiers(
+    unique int id: @namequalifier,
+    unique int qualifiableelement: @namequalifiableelement ref,
+    int qualifyingelement: @namequalifyingelement ref,
+    int location: @location_default ref
+);
+
+varbind(
+    int expr: @varbindexpr ref,
+    int var: @accessible ref
+);
+
+funbind(
+    int expr: @funbindexpr ref,
+    int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+              | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+                    | @delete_expr
+                    | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+                  | @unaryplusexpr
+                  | @conjugation
+                  | @realpartexpr
+                  | @imagpartexpr
+                  | @crement_expr
+                  ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+            | @indirect
+            | @un_arith_op_expr
+            | @un_bitwise_op_expr
+            | @builtinaddressof
+            | @vec_fill
+            | @un_log_op_expr
+            | @co_await
+            | @co_yield
+            ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+             | @ltexpr
+             | @geexpr
+             | @leexpr
+             | @spaceshipexpr
+             ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+                     | @rshiftexpr
+                     | @andexpr
+                     | @orexpr
+                     | @xorexpr
+                     ;
+
+@p_arith_op_expr = @paddexpr
+                 | @psubexpr
+                 | @pdiffexpr
+                 ;
+
+@bin_arith_op_expr = @addexpr
+                   | @subexpr
+                   | @mulexpr
+                   | @divexpr
+                   | @remexpr
+                   | @jmulexpr
+                   | @jdivexpr
+                   | @fjaddexpr
+                   | @jfaddexpr
+                   | @fjsubexpr
+                   | @jfsubexpr
+                   | @minexpr
+                   | @maxexpr
+                   | @p_arith_op_expr
+                   ;
+
+@bin_op_expr = @bin_arith_op_expr
+             | @bin_bitwise_op_expr
+             | @cmp_op_expr
+             | @bin_log_op_expr
+             ;
+
+@op_expr = @un_op_expr
+         | @bin_op_expr
+         | @assign_expr
+         | @conditionalexpr
+         ;
+
+@assign_arith_expr = @assignaddexpr
+                   | @assignsubexpr
+                   | @assignmulexpr
+                   | @assigndivexpr
+                   | @assignremexpr
+                   ;
+
+@assign_bitwise_expr = @assignandexpr
+                     | @assignorexpr
+                     | @assignxorexpr
+                     | @assignlshiftexpr
+                     | @assignrshiftexpr
+                     | @assignpaddexpr
+                     | @assignpsubexpr
+                     ;
+
+@assign_op_expr = @assign_arith_expr | @assign_bitwise_expr
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+  case @allocator.form of
+    0 = plain
+  | 1 = alignment
+  ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+    unique int expr: @any_new_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/*
+  case @deallocator.form of
+    0 = plain
+  | 1 = size
+  | 2 = alignment
+  | 3 = size_and_alignment
+  ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+    unique int expr: @new_or_delete_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+    unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+    unique int cond: @conditionalexpr ref,
+    int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+    unique int cond: @conditionalexpr ref,
+    int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+    unique int cond: @conditionalexpr ref,
+    int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+    unique int id: @value,
+    string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+    unique int id: @value ref,
+    string text: string ref
+);
+
+valuebind(
+    int val: @value ref,
+    unique int expr: @expr ref
+);
+
+fieldoffsets(
+    unique int id: @variable ref,
+    int byteoffset: int ref,
+    int bitoffset: int ref
+);
+
+bitfield(
+    unique int id: @variable ref,
+    int bits: int ref,
+    int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+    int member: @expr ref,
+    int prefix: @expr ref
+);
+*/
+
+/*
+   kind(1) = mbrcallexpr
+   kind(2) = mbrptrcallexpr
+   kind(3) = mbrptrmbrcallexpr
+   kind(4) = ptrmbrptrmbrcallexpr
+   kind(5) = mbrreadexpr // x.y
+   kind(6) = mbrptrreadexpr // p->y
+   kind(7) = mbrptrmbrreadexpr // x.*pm
+   kind(8) = mbrptrmbrptrreadexpr // x->*pm
+   kind(9) = staticmbrreadexpr // static x.y
+   kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+    int member: @expr ref,
+    int kind: int ref
+);
+*/
+
+initialisers(
+    unique int init: @initialiser,
+    int var: @accessible ref,
+    unique int expr: @expr ref,
+    int location: @location_expr ref
+);
+
+braced_initialisers(
+    int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+    int exp: @expr ref,
+    int ancestor: @element ref
+);
+
+exprs(
+    unique int id: @expr,
+    int kind: int ref,
+    int location: @location_expr ref
+);
+
+/*
+  case @value.category of
+    1 = prval
+  | 2 = xval
+  | 3 = lval
+  ;
+*/
+expr_types(
+    int id: @expr ref,
+    int typeid: @type ref,
+    int value_category: int ref
+);
+
+case @expr.kind of
+    1 = @errorexpr
+|   2 = @address_of // & AddressOfExpr
+|   3 = @reference_to // ReferenceToExpr (implicit?)
+|   4 = @indirect // * PointerDereferenceExpr
+|   5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+|   8 = @array_to_pointer // (???)
+|   9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+|  11 = @assume // Microsoft
+|  12 = @parexpr
+|  13 = @arithnegexpr
+|  14 = @unaryplusexpr
+|  15 = @complementexpr
+|  16 = @notexpr
+|  17 = @conjugation // GNU ~ operator
+|  18 = @realpartexpr // GNU __real
+|  19 = @imagpartexpr // GNU __imag
+|  20 = @postincrexpr
+|  21 = @postdecrexpr
+|  22 = @preincrexpr
+|  23 = @predecrexpr
+|  24 = @conditionalexpr
+|  25 = @addexpr
+|  26 = @subexpr
+|  27 = @mulexpr
+|  28 = @divexpr
+|  29 = @remexpr
+|  30 = @jmulexpr // C99 mul imaginary
+|  31 = @jdivexpr // C99 div imaginary
+|  32 = @fjaddexpr // C99 add real + imaginary
+|  33 = @jfaddexpr // C99 add imaginary + real
+|  34 = @fjsubexpr // C99 sub real - imaginary
+|  35 = @jfsubexpr // C99 sub imaginary - real
+|  36 = @paddexpr // pointer add (pointer + int or int + pointer)
+|  37 = @psubexpr // pointer sub (pointer - integer)
+|  38 = @pdiffexpr // difference between two pointers
+|  39 = @lshiftexpr
+|  40 = @rshiftexpr
+|  41 = @andexpr
+|  42 = @orexpr
+|  43 = @xorexpr
+|  44 = @eqexpr
+|  45 = @neexpr
+|  46 = @gtexpr
+|  47 = @ltexpr
+|  48 = @geexpr
+|  49 = @leexpr
+|  50 = @minexpr // GNU minimum
+|  51 = @maxexpr // GNU maximum
+|  52 = @assignexpr
+|  53 = @assignaddexpr
+|  54 = @assignsubexpr
+|  55 = @assignmulexpr
+|  56 = @assigndivexpr
+|  57 = @assignremexpr
+|  58 = @assignlshiftexpr
+|  59 = @assignrshiftexpr
+|  60 = @assignandexpr
+|  61 = @assignorexpr
+|  62 = @assignxorexpr
+|  63 = @assignpaddexpr // assign pointer add
+|  64 = @assignpsubexpr // assign pointer sub
+|  65 = @andlogicalexpr
+|  66 = @orlogicalexpr
+|  67 = @commaexpr
+|  68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ...  69 @objc_subscriptexpr deprecated
+// ...  70 @cmdaccess deprecated
+// ...
+|  73 = @virtfunptrexpr
+|  74 = @callexpr
+// ...  75 @msgexpr_normal deprecated
+// ...  76 @msgexpr_super deprecated
+// ...  77 @atselectorexpr deprecated
+// ...  78 @atprotocolexpr deprecated
+|  79 = @vastartexpr
+|  80 = @vaargexpr
+|  81 = @vaendexpr
+|  82 = @vacopyexpr
+// ...  83 @atencodeexpr deprecated
+|  84 = @varaccess
+|  85 = @thisaccess
+// ...  86 @objc_box_expr deprecated
+|  87 = @new_expr
+|  88 = @delete_expr
+|  89 = @throw_expr
+|  90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+|  91 = @braced_init_list
+|  92 = @type_id
+|  93 = @runtime_sizeof
+|  94 = @runtime_alignof
+|  95 = @sizeof_pack
+|  96 = @expr_stmt // GNU extension
+|  97 = @routineexpr
+|  98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+|  99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // EDG internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+;
+
+@var_args_expr = @vastartexpr
+               | @vaendexpr
+               | @vaargexpr
+               | @vacopyexpr
+               ;
+
+@builtin_op = @var_args_expr
+            | @noopexpr
+            | @offsetofexpr
+            | @intaddrexpr
+            | @hasassignexpr
+            | @hascopyexpr
+            | @hasnothrowassign
+            | @hasnothrowconstr
+            | @hasnothrowcopy
+            | @hastrivialassign
+            | @hastrivialconstr
+            | @hastrivialcopy
+            | @hastrivialdestructor
+            | @hasuserdestr
+            | @hasvirtualdestr
+            | @isabstractexpr
+            | @isbaseofexpr
+            | @isclassexpr
+            | @isconvtoexpr
+            | @isemptyexpr
+            | @isenumexpr
+            | @ispodexpr
+            | @ispolyexpr
+            | @isunionexpr
+            | @typescompexpr
+            | @builtinshufflevector
+            | @builtinconvertvector
+            | @builtinaddressof
+            | @istriviallyconstructibleexpr
+            | @isdestructibleexpr
+            | @isnothrowdestructibleexpr
+            | @istriviallydestructibleexpr
+            | @istriviallyassignableexpr
+            | @isnothrowassignableexpr
+            | @isstandardlayoutexpr
+            | @istriviallycopyableexpr
+            | @isliteraltypeexpr
+            | @hastrivialmoveconstructorexpr
+            | @hastrivialmoveassignexpr
+            | @hasnothrowmoveassignexpr
+            | @isconstructibleexpr
+            | @isnothrowconstructibleexpr
+            | @hasfinalizerexpr
+            | @isdelegateexpr
+            | @isinterfaceclassexpr
+            | @isrefarrayexpr
+            | @isrefclassexpr
+            | @issealedexpr
+            | @issimplevalueclassexpr
+            | @isvalueclassexpr
+            | @isfinalexpr
+            | @builtinchooseexpr
+            | @builtincomplex
+            | @isassignable
+            | @isaggregate
+            | @hasuniqueobjectrepresentations
+            | @builtinbitcast
+            | @builtinshuffle
+            ;
+
+new_allocated_type(
+    unique int expr: @new_expr ref,
+    int type_id: @type ref
+);
+
+new_array_allocated_type(
+    unique int expr: @new_array_expr ref,
+    int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union.
+ */
+#keyset[aggregate, field]
+aggregate_field_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int field: @membervariable ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array.
+ */
+#keyset[aggregate, element_index]
+aggregate_array_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int element_index: int ref
+);
+
+@ctorinit = @ctordirectinit
+          | @ctorvirtualinit
+          | @ctorfieldinit
+          | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+              | @dtorvirtualdestruct
+              | @dtorfielddestruct;
+
+
+condition_decl_bind(
+    unique int expr: @condition_decl ref,
+    unique int decl: @declaration ref
+);
+
+typeid_bind(
+    unique int expr: @type_id ref,
+    int type_id: @type ref
+);
+
+uuidof_bind(
+    unique int expr: @uuidof ref,
+    int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof;
+
+sizeof_bind(
+    unique int expr: @runtime_sizeof_or_alignof ref,
+    int type_id: @type ref
+);
+
+code_block(
+    unique int block: @literal ref,
+    unique int routine: @function ref
+);
+
+lambdas(
+    unique int expr: @lambdaexpr ref,
+    string default_capture: string ref,
+    boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+    unique int id: @lambdacapture,
+    int lambda: @lambdaexpr ref,
+    int index: int ref,
+    int field: @membervariable ref,
+    boolean captured_by_reference: boolean ref,
+    boolean is_implicit: boolean ref,
+    int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+             | @new_expr
+             | @delete_expr
+             | @delete_array_expr
+             | @ctordirectinit
+             | @ctorvirtualinit
+             | @ctordelegatinginit
+             | @dtordirectdestruct
+             | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+    int expr: @foldexpr ref,
+    string operator: string ref,
+    boolean is_left_fold: boolean ref
+);
+
+stmts(
+    unique int id: @stmt,
+    int kind: int ref,
+    int location: @location_stmt ref
+);
+
+case @stmt.kind of
+    1 = @stmt_expr
+|   2 = @stmt_if
+|   3 = @stmt_while
+|   4 = @stmt_goto
+|   5 = @stmt_label
+|   6 = @stmt_return
+|   7 = @stmt_block
+|   8 = @stmt_end_test_while // do { ... } while ( ... )
+|   9 = @stmt_for
+|  10 = @stmt_switch_case
+|  11 = @stmt_switch
+|  13 = @stmt_asm // "asm" statement or the body of an asm function
+|  15 = @stmt_try_block
+|  16 = @stmt_microsoft_try // Microsoft
+|  17 = @stmt_decl
+|  18 = @stmt_set_vla_size // C99
+|  19 = @stmt_vla_decl // C99
+|  25 = @stmt_assigned_goto // GNU
+|  26 = @stmt_empty
+|  27 = @stmt_continue
+|  28 = @stmt_break
+|  29 = @stmt_range_based_for // C++11
+// ...  30 @stmt_at_autoreleasepool_block deprecated
+// ...  31 @stmt_objc_for_in deprecated
+// ...  32 @stmt_at_synchronized deprecated
+|  33 = @stmt_handler
+// ...  34 @stmt_finally_end deprecated
+|  35 = @stmt_constexpr_if
+|  37 = @stmt_co_return
+;
+
+type_vla(
+    int type_id: @type ref,
+    int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+    int var: @variable ref,
+    int decl: @stmt_vla_decl ref
+);
+
+if_initialization(
+    unique int if_stmt: @stmt_if ref,
+    int init_id: @stmt ref
+);
+
+if_then(
+    unique int if_stmt: @stmt_if ref,
+    int then_id: @stmt ref
+);
+
+if_else(
+    unique int if_stmt: @stmt_if ref,
+    int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int init_id: @stmt ref
+);
+
+constexpr_if_then(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int then_id: @stmt ref
+);
+
+constexpr_if_else(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int else_id: @stmt ref
+);
+
+while_body(
+    unique int while_stmt: @stmt_while ref,
+    int body_id: @stmt ref
+);
+
+do_body(
+    unique int do_stmt: @stmt_end_test_while ref,
+    int body_id: @stmt ref
+);
+
+switch_initialization(
+    unique int switch_stmt: @stmt_switch ref,
+    int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+    int switch_stmt: @stmt_switch ref,
+    int index: int ref,
+    int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+    unique int switch_stmt: @stmt_switch ref,
+    int body_id: @stmt ref
+);
+
+for_initialization(
+    unique int for_stmt: @stmt_for ref,
+    int init_id: @stmt ref
+);
+
+for_condition(
+    unique int for_stmt: @stmt_for ref,
+    int condition_id: @expr ref
+);
+
+for_update(
+    unique int for_stmt: @stmt_for ref,
+    int update_id: @expr ref
+);
+
+for_body(
+    unique int for_stmt: @stmt_for ref,
+    int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+    unique int id: @stmt ref,
+    int index: int ref,
+    int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+    unique int block: @stmt_block ref,
+    int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+    unique int id: @jumporlabel ref,
+    string str: string ref,
+    int target: @stmt ref
+);
+
+preprocdirects(
+    unique int id: @preprocdirect,
+    int kind: int ref,
+    int location: @location_default ref
+);
+case @preprocdirect.kind of
+   0 = @ppd_if
+|  1 = @ppd_ifdef
+|  2 = @ppd_ifndef
+|  3 = @ppd_elif
+|  4 = @ppd_else
+|  5 = @ppd_endif
+|  6 = @ppd_plain_include
+|  7 = @ppd_define
+|  8 = @ppd_undef
+|  9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+    int begin : @ppd_branch ref,
+    int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+    unique int id: @preprocdirect ref,
+    string head: string ref,
+    string body: string ref
+);
+
+includes(
+    unique int id: @ppd_include ref,
+    int included: @file ref
+);
+
+link_targets(
+    unique int id: @link_target,
+    int binary: @file ref
+);
+
+link_parent(
+    int element : @element ref,
+    int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+    unique int id: @xmldtd,
+    string root: string ref,
+    string publicId: string ref,
+    string systemId: string ref,
+    int fileid: @file ref
+);
+
+xmlElements(
+    unique int id: @xmlelement,
+    string name: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlAttrs(
+    unique int id: @xmlattribute,
+    int elementid: @xmlelement ref,
+    string name: string ref,
+    string value: string ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlNs(
+    int id: @xmlnamespace,
+    string prefixName: string ref,
+    string URI: string ref,
+    int fileid: @file ref
+);
+
+xmlHasNs(
+    int elementId: @xmlnamespaceable ref,
+    int nsId: @xmlnamespace ref,
+    int fileid: @file ref
+);
+
+xmlComments(
+    unique int id: @xmlcomment,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int fileid: @file ref
+);
+
+xmlChars(
+    unique int id: @xmlcharacters,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int isCDATA: int ref,
+    int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+    int xmlElement: @xmllocatable ref,
+    int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+              | @xmlelement
+              | @xmlcomment
+              | @xmlattribute
+              | @xmldtd
+              | @file
+              | @xmlnamespace;
diff --git a/cpp/ql/lib/upgrades/f96ad9b2da43bbc9e55a72a165febd270ae07981/semmlecode.cpp.dbscheme b/cpp/ql/lib/upgrades/f96ad9b2da43bbc9e55a72a165febd270ae07981/semmlecode.cpp.dbscheme
new file mode 100644
index 00000000000..625f706f2a4
--- /dev/null
+++ b/cpp/ql/lib/upgrades/f96ad9b2da43bbc9e55a72a165febd270ae07981/semmlecode.cpp.dbscheme
@@ -0,0 +1,2190 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    /**
+     * An invocation of the compiler. Note that more than one file may
+     * be compiled per invocation. For example, this command compiles
+     * three source files:
+     *
+     *   gcc -c f1.c f2.c f3.c
+     */
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | *path to extractor*
+ * 1   | `--mimic`
+ * 2   | `/usr/bin/gcc`
+ * 3   | `-c`
+ * 4   | f1.c
+ * 5   | f2.c
+ * 6   | f3.c
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.c
+ * 1   | f2.c
+ * 2   | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+    int id : @externalDataElement,
+    string path : string ref,
+    int column: int ref,
+    string value : string ref
+);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Information about packages that provide code used during compilation.
+ * The `id` is just a unique identifier.
+ * The `namespace` is typically the name of the package manager that
+ * provided the package (e.g. "dpkg" or "yum").
+ * The `package_name` is the name of the package, and `version` is its
+ * version (as a string).
+ */
+external_packages(
+    unique int id: @external_package,
+    string namespace : string ref,
+    string package_name : string ref,
+    string version : string ref
+);
+
+/**
+ * Holds if File `fileid` was provided by package `package`.
+ */
+header_to_external_package(
+    int fileid : @file ref,
+    int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+    unique int id : @svnentry,
+    string revision : string ref,
+    string author : string ref,
+    date revisionDate : date ref,
+    int changeSize : int ref
+)
+
+svnaffectedfiles(
+    int id : @svnentry ref,
+    int file : @file ref,
+    string action : string ref
+)
+
+svnentrymsg(
+    unique int id : @svnentry ref,
+    string message : string ref
+)
+
+svnchurn(
+    int commit : @svnentry ref,
+    int file : @file ref,
+    int addedLines : int ref,
+    int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_default(
+    /** The location of an element that is not an expression or a statement. */
+    unique int id: @location_default,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_stmt(
+    /** The location of a statement. */
+    unique int id: @location_stmt,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+locations_expr(
+    /** The location of an expression. */
+    unique int id: @location_expr,
+    int container: @container ref,
+    int startLine: int ref,
+    int startColumn: int ref,
+    int endLine: int ref,
+    int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+    int element_id: @sourceline ref,
+    int num_lines: int ref,
+    int num_code: int ref,
+    int num_comment: int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+files(
+    unique int id: @file,
+    string name: string ref
+);
+
+folders(
+    unique int id: @folder,
+    string name: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+    int parent: @container ref,
+    unique int child: @container ref
+);
+
+fileannotations(
+    int id: @file ref,
+    int kind: int ref,
+    string name: string ref,
+    string value: string ref
+);
+
+inmacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+    int id: @element ref,
+    int inv: @macroinvocation ref
+);
+
+/*
+  case @macroinvocations.kind of
+    1 = macro expansion
+  | 2 = other macro reference
+  ;
+*/
+macroinvocations(
+    unique int id: @macroinvocation,
+    int macro_id: @ppd_define ref,
+    int location: @location_default ref,
+    int kind: int ref
+);
+
+macroparent(
+    unique int id: @macroinvocation ref,
+    int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+    int id: @macroinvocation ref,
+    int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+    int invocation: @macroinvocation ref,
+    int argument_index: int ref,
+    string text: string ref
+);
+
+/*
+  case @function.kind of
+    1 = normal
+  | 2 = constructor
+  | 3 = destructor
+  | 4 = conversion
+  | 5 = operator
+  | 6 = builtin     // GCC built-in functions, e.g. __builtin___memcpy_chk
+  ;
+*/
+functions(
+    unique int id: @function,
+    string name: string ref,
+    int kind: int ref
+);
+
+function_entry_point(int id: @function ref, unique int entry_point: @stmt ref);
+
+function_return_type(int id: @function ref, int return_type: @type ref);
+
+/** If `function` is a coroutine, then this gives the
+    std::experimental::resumable_traits instance associated with it,
+    and the variables representing the `handle` and `promise` for it. */
+coroutine(
+  unique int function: @function ref,
+  int traits: @type ref,
+  int handle: @variable ref,
+  int promise: @variable ref
+);
+
+/** The `new` function used for allocating the coroutine state, if any. */
+coroutine_new(
+  unique int function: @function ref,
+  int new: @function ref
+);
+
+/** The `delete` function used for deallocating the coroutine state, if any. */
+coroutine_delete(
+  unique int function: @function ref,
+  int delete: @function ref
+);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+member_function_this_type(unique int id: @function ref, int this_type: @type ref);
+
+#keyset[id, type_id]
+fun_decls(
+    int id: @fun_decl,
+    int function: @function ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+    int id: @fun_decl ref,
+    string name: string ref
+)
+#keyset[fun_decl, index]
+fun_decl_throws(
+    int fun_decl: @fun_decl ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+    int fun_decl: @fun_decl ref,
+    int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+    unique int fun_decl: @fun_decl ref,
+    int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+    unique int id: @var_decl ref,
+    int index: int ref,
+    int fun_decl: @fun_decl ref
+);
+
+#keyset[id, type_id]
+var_decls(
+    int id: @var_decl,
+    int variable: @variable ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+    int id: @var_decl ref,
+    string name: string ref
+)
+is_structured_binding(unique int id: @variable ref);
+
+type_decls(
+    unique int id: @type_decl,
+    int type_id: @type ref,
+    int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+    unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+    unique int id: @namespace_decl,
+    int namespace_id: @namespace ref,
+    int location: @location_default ref,
+    int bodylocation: @location_default ref
+);
+
+usings(
+    unique int id: @using,
+    int element_id: @element ref,
+    int location: @location_default ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+    int parent: @element ref,
+    int child: @using ref
+);
+
+static_asserts(
+    unique int id: @static_assert,
+    int condition : @expr ref,
+    string message : string ref,
+    int location: @location_default ref,
+    int enclosing : @element ref
+);
+
+// each function has an ordered list of parameters
+#keyset[id, type_id]
+#keyset[function, index, type_id]
+params(
+    int id: @parameter,
+    int function: @functionorblock ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+overrides(int new: @function ref, int old: @function ref);
+
+#keyset[id, type_id]
+membervariables(
+    int id: @membervariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+globalvariables(
+    int id: @globalvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+#keyset[id, type_id]
+localvariables(
+    int id: @localvariable,
+    int type_id: @type ref,
+    string name: string ref
+);
+
+autoderivation(
+    unique int var: @variable ref,
+    int derivation_type: @type ref
+);
+
+orphaned_variables(
+    int var: @localvariable ref,
+    int function: @function ref
+)
+
+enumconstants(
+    unique int id: @enumconstant,
+    int parent: @usertype ref,
+    int index: int ref,
+    int type_id: @type ref,
+    string name: string ref,
+    int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/*
+  Built-in types are the fundamental types, e.g., integral, floating, and void.
+
+  case @builtintype.kind of
+    1 = error
+  | 2 = unknown
+  | 3 = void
+  | 4 = boolean
+  | 5 = char
+  | 6 = unsigned_char
+  | 7 = signed_char
+  | 8 = short
+  | 9 = unsigned_short
+  | 10 = signed_short
+  | 11 = int
+  | 12 = unsigned_int
+  | 13 = signed_int
+  | 14 = long
+  | 15 = unsigned_long
+  | 16 = signed_long
+  | 17 = long_long
+  | 18 = unsigned_long_long
+  | 19 = signed_long_long
+  | 20 = __int8                 // Microsoft-specific
+  | 21 = __int16                // Microsoft-specific
+  | 22 = __int32                // Microsoft-specific
+  | 23 = __int64                // Microsoft-specific
+  | 24 = float
+  | 25 = double
+  | 26 = long_double
+  | 27 = _Complex_float         // C99-specific
+  | 28 = _Complex_double        // C99-specific
+  | 29 = _Complex_long double   // C99-specific
+  | 30 = _Imaginary_float       // C99-specific
+  | 31 = _Imaginary_double      // C99-specific
+  | 32 = _Imaginary_long_double // C99-specific
+  | 33 = wchar_t                // Microsoft-specific
+  | 34 = decltype_nullptr       // C++11
+  | 35 = __int128
+  | 36 = unsigned___int128
+  | 37 = signed___int128
+  | 38 = __float128
+  | 39 = _Complex___float128
+  | 40 = _Decimal32
+  | 41 = _Decimal64
+  | 42 = _Decimal128
+  | 43 = char16_t
+  | 44 = char32_t
+  | 45 = _Float32
+  | 46 = _Float32x
+  | 47 = _Float64
+  | 48 = _Float64x
+  | 49 = _Float128
+  | 50 = _Float128x
+  | 51 = char8_t
+  ;
+*/
+builtintypes(
+    unique int id: @builtintype,
+    string name: string ref,
+    int kind: int ref,
+    int size: int ref,
+    int sign: int ref,
+    int alignment: int ref
+);
+
+/*
+  Derived types are types that are directly derived from existing types and
+  point to, refer to, transform type data to return a new type.
+
+  case @derivedtype.kind of
+    1 = pointer
+  | 2 = reference
+  | 3 = type_with_specifiers
+  | 4 = array
+  | 5 = gnu_vector
+  | 6 = routineptr
+  | 7 = routinereference
+  | 8 = rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+  | 10 = block
+  ;
+*/
+derivedtypes(
+    unique int id: @derivedtype,
+    string name: string ref,
+    int kind: int ref,
+    int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+    int size: int ref,
+    int alignment: int ref);
+
+arraysizes(
+    unique int id: @derivedtype ref,
+    int num_elements: int ref,
+    int bytesize: int ref,
+    int alignment: int ref
+);
+
+typedefbase(
+    unique int id: @usertype ref,
+    int type_id: @type ref
+);
+
+/**
+ * An instance of the C++11 `decltype` operator.  For example:
+ * ```
+ * int a;
+ * decltype(1+a) b;
+ * ```
+ * Here `expr` is `1+a`.
+ *
+ * Sometimes an additional pair of parentheses around the expression
+ * would change the semantics of this decltype, e.g.
+ * ```
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * ```
+ * (Please consult the C++11 standard for more details).
+ * `parentheses_would_change_meaning` is `true` iff that is the case.
+ */
+#keyset[id, expr]
+decltypes(
+    int id: @decltype,
+    int expr: @expr ref,
+    int base_type: @type ref,
+    boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+  case @usertype.kind of
+    1 = struct
+  | 2 = class
+  | 3 = union
+  | 4 = enum
+  | 5 = typedef                       // classic C: typedef typedef type name
+  | 6 = template
+  | 7 = template_parameter
+  | 8 = template_template_parameter
+  | 9 = proxy_class                   // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+  | 13 = scoped_enum
+  | 14 = using_alias                  // a using name = type style typedef
+  ;
+*/
+usertypes(
+    unique int id: @usertype,
+    string name: string ref,
+    int kind: int ref
+);
+
+usertypesize(
+    unique int id: @usertype ref,
+    int size: int ref,
+    int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+    unique int id: @usertype ref,
+    string uuid: string ref
+);
+
+mangled_name(
+    unique int id: @declaration ref,
+    int mangled_name : @mangledname
+);
+
+is_pod_class(unique int id: @usertype ref);
+is_standard_layout_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+    int to: @usertype ref,
+    int from: @usertype ref
+);
+class_template_argument(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+class_template_argument_value(
+    int type_id: @usertype ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+is_proxy_class_for(
+    unique int id: @usertype ref,
+    unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+    unique int id: @type_mention,
+    int type_id: @type ref,
+    int location: @location ref,
+    // a_symbol_reference_kind from the frontend.
+    int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+    unique int to: @function ref,
+    int from: @function ref
+);
+function_template_argument(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+function_template_argument_value(
+    int function_id: @function ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+    unique int to: @variable ref,
+    int from: @variable ref
+);
+variable_template_argument(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_type: @type ref
+);
+variable_template_argument_value(
+    int variable_id: @variable ref,
+    int index: int ref,
+    int arg_value: @expr ref
+);
+
+/*
+  Fixed point types
+  precision(1) = short, precision(2) = default, precision(3) = long
+  is_unsigned(1) = unsigned is_unsigned(2) = signed
+  is_fract_type(1) = declared with _Fract
+  saturating(1) = declared with _Sat
+*/
+/* TODO
+fixedpointtypes(
+    unique int id: @fixedpointtype,
+    int precision: int ref,
+    int is_unsigned: int ref,
+    int is_fract_type: int ref,
+    int saturating: int ref);
+*/
+
+routinetypes(
+    unique int id: @routinetype,
+    int return_type: @type ref
+);
+
+routinetypeargs(
+    int routine: @routinetype ref,
+    int index: int ref,
+    int type_id: @type ref
+);
+
+ptrtomembers(
+    unique int id: @ptrtomember,
+    int type_id: @type ref,
+    int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+    "public",
+    "protected",
+    "private",
+
+    "const",
+    "volatile",
+    "static",
+
+    "pure",
+    "virtual",
+    "sealed", // Microsoft
+    "__interface", // Microsoft
+    "inline",
+    "explicit",
+
+    "near", // near far extension
+    "far", // near far extension
+    "__ptr32", // Microsoft
+    "__ptr64", // Microsoft
+    "__sptr", // Microsoft
+    "__uptr", // Microsoft
+    "dllimport", // Microsoft
+    "dllexport", // Microsoft
+    "thread", // Microsoft
+    "naked", // Microsoft
+    "microsoft_inline", // Microsoft
+    "forceinline", // Microsoft
+    "selectany", // Microsoft
+    "nothrow", // Microsoft
+    "novtable", // Microsoft
+    "noreturn", // Microsoft
+    "noinline", // Microsoft
+    "noalias", // Microsoft
+    "restrict", // Microsoft
+*/
+
+specifiers(
+    unique int id: @specifier,
+    unique string str: string ref
+);
+
+typespecifiers(
+    int type_id: @type ref,
+    int spec_id: @specifier ref
+);
+
+funspecifiers(
+    int func_id: @function ref,
+    int spec_id: @specifier ref
+);
+
+varspecifiers(
+    int var_id: @accessible ref,
+    int spec_id: @specifier ref
+);
+
+attributes(
+    unique int id: @attribute,
+    int kind: int ref,
+    string name: string ref,
+    string name_space: string ref,
+    int location: @location_default ref
+);
+
+case @attribute.kind of
+  0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+    unique int id: @attribute_arg,
+    int kind: int ref,
+    int attribute: @attribute ref,
+    int index: int ref,
+    int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+  0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+| 4 = @attribute_arg_constant_expr
+;
+
+attribute_arg_value(
+    unique int arg: @attribute_arg ref,
+    string value: string ref
+);
+attribute_arg_type(
+    unique int arg: @attribute_arg ref,
+    int type_id: @type ref
+);
+attribute_arg_constant(
+    unique int arg: @attribute_arg ref,
+    int constant: @expr ref
+)
+attribute_arg_name(
+    unique int arg: @attribute_arg ref,
+    string name: string ref
+);
+
+typeattributes(
+    int type_id: @type ref,
+    int spec_id: @attribute ref
+);
+
+funcattributes(
+    int func_id: @function ref,
+    int spec_id: @attribute ref
+);
+
+varattributes(
+    int var_id: @accessible ref,
+    int spec_id: @attribute ref
+);
+
+stmtattributes(
+    int stmt_id: @stmt ref,
+    int spec_id: @attribute ref
+);
+
+@type = @builtintype
+      | @derivedtype
+      | @usertype
+      /* TODO | @fixedpointtype */
+      | @routinetype
+      | @ptrtomember
+      | @decltype;
+
+unspecifiedtype(
+    unique int type_id: @type ref,
+    int unspecified_type_id: @type ref
+);
+
+member(
+    int parent: @type ref,
+    int index: int ref,
+    int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+    unique int child: @enclosingfunction_child ref,
+    int parent: @function ref
+);
+
+derivations(
+    unique int derivation: @derivation,
+    int sub: @type ref,
+    int index: int ref,
+    int super: @type ref,
+    int location: @location_default ref
+);
+
+derspecifiers(
+    int der_id: @derivation ref,
+    int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+    unique int der_id: @derivation ref,
+    int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+    int sub: @usertype ref,
+    int super: @usertype ref,
+    int offset: int ref
+);
+
+frienddecls(
+    unique int id: @frienddecl,
+    int type_id: @type ref,
+    int decl_id: @declaration ref,
+    int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+             | @declaredtype
+             | @variable
+             | @enumconstant
+             | @frienddecl;
+
+@member = @membervariable
+        | @function
+        | @declaredtype
+        | @enumconstant;
+
+@locatable = @diagnostic
+           | @declaration
+           | @ppd_include
+           | @ppd_define
+           | @macroinvocation
+           /*| @funcall*/
+           | @xmllocatable
+           | @attribute
+           | @attribute_arg;
+
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+         | @file
+         | @folder
+         | @specifier
+         | @type
+         | @expr
+         | @namespace
+         | @initialiser
+         | @stmt
+         | @derivation
+         | @comment
+         | @preprocdirect
+         | @fun_decl
+         | @var_decl
+         | @type_decl
+         | @namespace_decl
+         | @using
+         | @namequalifier
+         | @specialnamequalifyingelement
+         | @static_assert
+         | @type_mention
+         | @lambdacapture;
+
+@exprparent = @element;
+
+comments(
+    unique int id: @comment,
+    string contents: string ref,
+    int location: @location_default ref
+);
+
+commentbinding(
+    int id: @comment ref,
+    int element: @element ref
+);
+
+exprconv(
+    int converted: @expr ref,
+    unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+/**
+ * `destructor_call` destructs the `i`'th entity that should be
+ * destructed following `element`. Note that entities should be
+ * destructed in reverse construction order, so for a given `element`
+ * these should be called from highest to lowest `i`.
+ */
+#keyset[element, destructor_call]
+#keyset[element, i]
+synthetic_destructor_call(
+    int element: @element ref,
+    int i: int ref,
+    int destructor_call: @routineexpr ref
+);
+
+namespaces(
+    unique int id: @namespace,
+    string name: string ref
+);
+
+namespace_inline(
+    unique int id: @namespace ref
+);
+
+namespacembrs(
+    int parentid: @namespace ref,
+    unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+    int expr_id: @expr ref,
+    int child_index: int ref,
+    int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+      | @const_cast
+      | @dynamic_cast
+      | @reinterpret_cast
+      | @static_cast
+      ;
+
+/*
+case @conversion.kind of
+  0 = @simple_conversion           // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion             // conversion to 'bool'
+| 2 = @base_class_conversion       // a derived-to-base conversion
+| 3 = @derived_class_conversion    // a base-to-derived conversion
+| 4 = @pm_base_class_conversion    // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust              // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust              // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+    unique int expr_id: @cast ref,
+    int kind: int ref
+);
+
+@conversion = @cast
+            | @array_to_pointer
+            | @parexpr
+            | @reference_to
+            | @ref_indirect
+            | @temp_init
+            ;
+
+/*
+case @funbindexpr.kind of
+  0 = @normal_call  // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call     // a call whose target is only found by ADL
+;
+*/
+iscall(unique int caller: @funbindexpr ref, int kind: int ref);
+
+numtemplatearguments(
+    unique int expr_id: @expr ref,
+    int num: int ref
+);
+
+specialnamequalifyingelements(
+    unique int id: @specialnamequalifyingelement,
+    unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+                       | @specialnamequalifyingelement
+                       | @usertype;
+
+namequalifiers(
+    unique int id: @namequalifier,
+    unique int qualifiableelement: @namequalifiableelement ref,
+    int qualifyingelement: @namequalifyingelement ref,
+    int location: @location_default ref
+);
+
+varbind(
+    int expr: @varbindexpr ref,
+    int var: @accessible ref
+);
+
+funbind(
+    int expr: @funbindexpr ref,
+    int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+              | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+                    | @delete_expr
+                    | @delete_array_expr;
+
+@prefix_crement_expr = @preincrexpr | @predecrexpr;
+
+@postfix_crement_expr = @postincrexpr | @postdecrexpr;
+
+@increment_expr = @preincrexpr | @postincrexpr;
+
+@decrement_expr = @predecrexpr | @postdecrexpr;
+
+@crement_expr = @increment_expr | @decrement_expr;
+
+@un_arith_op_expr = @arithnegexpr
+                  | @unaryplusexpr
+                  | @conjugation
+                  | @realpartexpr
+                  | @imagpartexpr
+                  | @crement_expr
+                  ;
+
+@un_bitwise_op_expr = @complementexpr;
+
+@un_log_op_expr = @notexpr;
+
+@un_op_expr = @address_of
+            | @indirect
+            | @un_arith_op_expr
+            | @un_bitwise_op_expr
+            | @builtinaddressof
+            | @vec_fill
+            | @un_log_op_expr
+            | @co_await
+            | @co_yield
+            ;
+
+@bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
+
+@cmp_op_expr = @eq_op_expr | @rel_op_expr;
+
+@eq_op_expr = @eqexpr | @neexpr;
+
+@rel_op_expr = @gtexpr
+             | @ltexpr
+             | @geexpr
+             | @leexpr
+             | @spaceshipexpr
+             ;
+
+@bin_bitwise_op_expr = @lshiftexpr
+                     | @rshiftexpr
+                     | @andexpr
+                     | @orexpr
+                     | @xorexpr
+                     ;
+
+@p_arith_op_expr = @paddexpr
+                 | @psubexpr
+                 | @pdiffexpr
+                 ;
+
+@bin_arith_op_expr = @addexpr
+                   | @subexpr
+                   | @mulexpr
+                   | @divexpr
+                   | @remexpr
+                   | @jmulexpr
+                   | @jdivexpr
+                   | @fjaddexpr
+                   | @jfaddexpr
+                   | @fjsubexpr
+                   | @jfsubexpr
+                   | @minexpr
+                   | @maxexpr
+                   | @p_arith_op_expr
+                   ;
+
+@bin_op_expr = @bin_arith_op_expr
+             | @bin_bitwise_op_expr
+             | @cmp_op_expr
+             | @bin_log_op_expr
+             ;
+
+@op_expr = @un_op_expr
+         | @bin_op_expr
+         | @assign_expr
+         | @conditionalexpr
+         ;
+
+@assign_arith_expr = @assignaddexpr
+                   | @assignsubexpr
+                   | @assignmulexpr
+                   | @assigndivexpr
+                   | @assignremexpr
+                   ;
+
+@assign_bitwise_expr = @assignandexpr
+                     | @assignorexpr
+                     | @assignxorexpr
+                     | @assignlshiftexpr
+                     | @assignrshiftexpr
+                     | @assignpaddexpr
+                     | @assignpsubexpr
+                     ;
+
+@assign_op_expr = @assign_arith_expr | @assign_bitwise_expr
+
+@assign_expr = @assignexpr | @assign_op_expr | @blockassignexpr
+
+/*
+  case @allocator.form of
+    0 = plain
+  | 1 = alignment
+  ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+    unique int expr: @any_new_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/*
+  case @deallocator.form of
+    0 = plain
+  | 1 = size
+  | 2 = alignment
+  | 3 = size_and_alignment
+  ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+    unique int expr: @new_or_delete_expr ref,
+    int func: @function ref,
+    int form: int ref
+);
+
+/**
+ * Holds if the `@conditionalexpr` is of the two operand form
+ * `guard ? : false`.
+ */
+expr_cond_two_operand(
+    unique int cond: @conditionalexpr ref
+);
+
+/**
+ * The guard of `@conditionalexpr` `guard ? true : false`
+ */
+expr_cond_guard(
+    unique int cond: @conditionalexpr ref,
+    int guard: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` holds. For the two operand form
+ * `guard ?: false` consider using `expr_cond_guard` instead.
+ */
+expr_cond_true(
+    unique int cond: @conditionalexpr ref,
+    int true: @expr ref
+);
+
+/**
+ * The expression used when the guard of `@conditionalexpr`
+ * `guard ? true : false` does not hold.
+ */
+expr_cond_false(
+    unique int cond: @conditionalexpr ref,
+    int false: @expr ref
+);
+
+/** A string representation of the value. */
+values(
+    unique int id: @value,
+    string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+    unique int id: @value ref,
+    string text: string ref
+);
+
+valuebind(
+    int val: @value ref,
+    unique int expr: @expr ref
+);
+
+fieldoffsets(
+    unique int id: @variable ref,
+    int byteoffset: int ref,
+    int bitoffset: int ref
+);
+
+bitfield(
+    unique int id: @variable ref,
+    int bits: int ref,
+    int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+    int member: @expr ref,
+    int prefix: @expr ref
+);
+*/
+
+/*
+   kind(1) = mbrcallexpr
+   kind(2) = mbrptrcallexpr
+   kind(3) = mbrptrmbrcallexpr
+   kind(4) = ptrmbrptrmbrcallexpr
+   kind(5) = mbrreadexpr // x.y
+   kind(6) = mbrptrreadexpr // p->y
+   kind(7) = mbrptrmbrreadexpr // x.*pm
+   kind(8) = mbrptrmbrptrreadexpr // x->*pm
+   kind(9) = staticmbrreadexpr // static x.y
+   kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+    int member: @expr ref,
+    int kind: int ref
+);
+*/
+
+initialisers(
+    unique int init: @initialiser,
+    int var: @accessible ref,
+    unique int expr: @expr ref,
+    int location: @location_expr ref
+);
+
+braced_initialisers(
+    int init: @initialiser ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+    int exp: @expr ref,
+    int ancestor: @element ref
+);
+
+exprs(
+    unique int id: @expr,
+    int kind: int ref,
+    int location: @location_expr ref
+);
+
+/*
+  case @value.category of
+    1 = prval
+  | 2 = xval
+  | 3 = lval
+  ;
+*/
+expr_types(
+    int id: @expr ref,
+    int typeid: @type ref,
+    int value_category: int ref
+);
+
+case @expr.kind of
+    1 = @errorexpr
+|   2 = @address_of // & AddressOfExpr
+|   3 = @reference_to // ReferenceToExpr (implicit?)
+|   4 = @indirect // * PointerDereferenceExpr
+|   5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+|   8 = @array_to_pointer // (???)
+|   9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+|  11 = @assume // Microsoft
+|  12 = @parexpr
+|  13 = @arithnegexpr
+|  14 = @unaryplusexpr
+|  15 = @complementexpr
+|  16 = @notexpr
+|  17 = @conjugation // GNU ~ operator
+|  18 = @realpartexpr // GNU __real
+|  19 = @imagpartexpr // GNU __imag
+|  20 = @postincrexpr
+|  21 = @postdecrexpr
+|  22 = @preincrexpr
+|  23 = @predecrexpr
+|  24 = @conditionalexpr
+|  25 = @addexpr
+|  26 = @subexpr
+|  27 = @mulexpr
+|  28 = @divexpr
+|  29 = @remexpr
+|  30 = @jmulexpr // C99 mul imaginary
+|  31 = @jdivexpr // C99 div imaginary
+|  32 = @fjaddexpr // C99 add real + imaginary
+|  33 = @jfaddexpr // C99 add imaginary + real
+|  34 = @fjsubexpr // C99 sub real - imaginary
+|  35 = @jfsubexpr // C99 sub imaginary - real
+|  36 = @paddexpr // pointer add (pointer + int or int + pointer)
+|  37 = @psubexpr // pointer sub (pointer - integer)
+|  38 = @pdiffexpr // difference between two pointers
+|  39 = @lshiftexpr
+|  40 = @rshiftexpr
+|  41 = @andexpr
+|  42 = @orexpr
+|  43 = @xorexpr
+|  44 = @eqexpr
+|  45 = @neexpr
+|  46 = @gtexpr
+|  47 = @ltexpr
+|  48 = @geexpr
+|  49 = @leexpr
+|  50 = @minexpr // GNU minimum
+|  51 = @maxexpr // GNU maximum
+|  52 = @assignexpr
+|  53 = @assignaddexpr
+|  54 = @assignsubexpr
+|  55 = @assignmulexpr
+|  56 = @assigndivexpr
+|  57 = @assignremexpr
+|  58 = @assignlshiftexpr
+|  59 = @assignrshiftexpr
+|  60 = @assignandexpr
+|  61 = @assignorexpr
+|  62 = @assignxorexpr
+|  63 = @assignpaddexpr // assign pointer add
+|  64 = @assignpsubexpr // assign pointer sub
+|  65 = @andlogicalexpr
+|  66 = @orlogicalexpr
+|  67 = @commaexpr
+|  68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ...  69 @objc_subscriptexpr deprecated
+// ...  70 @cmdaccess deprecated
+// ...
+|  73 = @virtfunptrexpr
+|  74 = @callexpr
+// ...  75 @msgexpr_normal deprecated
+// ...  76 @msgexpr_super deprecated
+// ...  77 @atselectorexpr deprecated
+// ...  78 @atprotocolexpr deprecated
+|  79 = @vastartexpr
+|  80 = @vaargexpr
+|  81 = @vaendexpr
+|  82 = @vacopyexpr
+// ...  83 @atencodeexpr deprecated
+|  84 = @varaccess
+|  85 = @thisaccess
+// ...  86 @objc_box_expr deprecated
+|  87 = @new_expr
+|  88 = @delete_expr
+|  89 = @throw_expr
+|  90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+|  91 = @braced_init_list
+|  92 = @type_id
+|  93 = @runtime_sizeof
+|  94 = @runtime_alignof
+|  95 = @sizeof_pack
+|  96 = @expr_stmt // GNU extension
+|  97 = @routineexpr
+|  98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+|  99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // frontend internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+| 132 = @foldexpr
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
+| 324 = @builtinconvertvector
+| 325 = @builtincomplex
+| 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
+| 329 = @temp_init
+| 330 = @isassignable
+| 331 = @isaggregate
+| 332 = @hasuniqueobjectrepresentations
+| 333 = @builtinbitcast
+| 334 = @builtinshuffle
+| 335 = @blockassignexpr
+| 336 = @issame
+| 337 = @isfunction
+| 338 = @islayoutcompatible
+| 339 = @ispointerinterconvertiblebaseof
+| 340 = @isarray
+| 341 = @arrayrank
+| 342 = @arrayextent
+| 343 = @isarithmetic
+| 344 = @iscompletetype
+| 345 = @iscompound
+| 346 = @isconst
+| 347 = @isfloatingpoint
+| 348 = @isfundamental
+| 349 = @isintegral
+| 350 = @islvaluereference
+| 351 = @ismemberfunctionpointer
+| 352 = @ismemberobjectpointer
+| 353 = @ismemberpointer
+| 354 = @isobject
+| 355 = @ispointer
+| 356 = @isreference
+| 357 = @isrvaluereference
+| 358 = @isscalar
+| 359 = @issigned
+| 360 = @isunsigned
+| 361 = @isvoid
+| 362 = @isvolatile
+;
+
+@var_args_expr = @vastartexpr
+               | @vaendexpr
+               | @vaargexpr
+               | @vacopyexpr
+               ;
+
+@builtin_op = @var_args_expr
+            | @noopexpr
+            | @offsetofexpr
+            | @intaddrexpr
+            | @hasassignexpr
+            | @hascopyexpr
+            | @hasnothrowassign
+            | @hasnothrowconstr
+            | @hasnothrowcopy
+            | @hastrivialassign
+            | @hastrivialconstr
+            | @hastrivialcopy
+            | @hastrivialdestructor
+            | @hasuserdestr
+            | @hasvirtualdestr
+            | @isabstractexpr
+            | @isbaseofexpr
+            | @isclassexpr
+            | @isconvtoexpr
+            | @isemptyexpr
+            | @isenumexpr
+            | @ispodexpr
+            | @ispolyexpr
+            | @isunionexpr
+            | @typescompexpr
+            | @builtinshufflevector
+            | @builtinconvertvector
+            | @builtinaddressof
+            | @istriviallyconstructibleexpr
+            | @isdestructibleexpr
+            | @isnothrowdestructibleexpr
+            | @istriviallydestructibleexpr
+            | @istriviallyassignableexpr
+            | @isnothrowassignableexpr
+            | @isstandardlayoutexpr
+            | @istriviallycopyableexpr
+            | @isliteraltypeexpr
+            | @hastrivialmoveconstructorexpr
+            | @hastrivialmoveassignexpr
+            | @hasnothrowmoveassignexpr
+            | @isconstructibleexpr
+            | @isnothrowconstructibleexpr
+            | @hasfinalizerexpr
+            | @isdelegateexpr
+            | @isinterfaceclassexpr
+            | @isrefarrayexpr
+            | @isrefclassexpr
+            | @issealedexpr
+            | @issimplevalueclassexpr
+            | @isvalueclassexpr
+            | @isfinalexpr
+            | @builtinchooseexpr
+            | @builtincomplex
+            | @isassignable
+            | @isaggregate
+            | @hasuniqueobjectrepresentations
+            | @builtinbitcast
+            | @builtinshuffle
+            | @issame
+            | @isfunction
+            | @islayoutcompatible
+            | @ispointerinterconvertiblebaseof
+            | @isarray
+            | @arrayrank
+            | @arrayextent
+            | @isarithmetic
+            | @iscompletetype
+            | @iscompound
+            | @isconst
+            | @isfloatingpoint
+            | @isfundamental
+            | @isintegral
+            | @islvaluereference
+            | @ismemberfunctionpointer
+            | @ismemberobjectpointer
+            | @ismemberpointer
+            | @isobject
+            | @ispointer
+            | @isreference
+            | @isrvaluereference
+            | @isscalar
+            | @issigned
+            | @isunsigned
+            | @isvoid
+            | @isvolatile
+            ;
+
+new_allocated_type(
+    unique int expr: @new_expr ref,
+    int type_id: @type ref
+);
+
+new_array_allocated_type(
+    unique int expr: @new_array_expr ref,
+    int type_id: @type ref
+);
+
+/**
+ * The field being initialized by an initializer expression within an aggregate
+ * initializer for a class/struct/union.
+ */
+#keyset[aggregate, field]
+aggregate_field_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int field: @membervariable ref
+);
+
+/**
+ * The index of the element being initialized by an initializer expression
+ * within an aggregate initializer for an array.
+ */
+#keyset[aggregate, element_index]
+aggregate_array_init(
+    int aggregate: @aggregateliteral ref,
+    int initializer: @expr ref,
+    int element_index: int ref
+);
+
+@ctorinit = @ctordirectinit
+          | @ctorvirtualinit
+          | @ctorfieldinit
+          | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+              | @dtorvirtualdestruct
+              | @dtorfielddestruct;
+
+
+condition_decl_bind(
+    unique int expr: @condition_decl ref,
+    unique int decl: @declaration ref
+);
+
+typeid_bind(
+    unique int expr: @type_id ref,
+    int type_id: @type ref
+);
+
+uuidof_bind(
+    unique int expr: @uuidof ref,
+    int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof;
+
+sizeof_bind(
+    unique int expr: @runtime_sizeof_or_alignof ref,
+    int type_id: @type ref
+);
+
+code_block(
+    unique int block: @literal ref,
+    unique int routine: @function ref
+);
+
+lambdas(
+    unique int expr: @lambdaexpr ref,
+    string default_capture: string ref,
+    boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+    unique int id: @lambdacapture,
+    int lambda: @lambdaexpr ref,
+    int index: int ref,
+    int field: @membervariable ref,
+    boolean captured_by_reference: boolean ref,
+    boolean is_implicit: boolean ref,
+    int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+             | @new_expr
+             | @delete_expr
+             | @delete_array_expr
+             | @ctordirectinit
+             | @ctorvirtualinit
+             | @ctordelegatinginit
+             | @dtordirectdestruct
+             | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+
+@access = @varaccess | @routineexpr ;
+
+fold(
+    int expr: @foldexpr ref,
+    string operator: string ref,
+    boolean is_left_fold: boolean ref
+);
+
+stmts(
+    unique int id: @stmt,
+    int kind: int ref,
+    int location: @location_stmt ref
+);
+
+case @stmt.kind of
+    1 = @stmt_expr
+|   2 = @stmt_if
+|   3 = @stmt_while
+|   4 = @stmt_goto
+|   5 = @stmt_label
+|   6 = @stmt_return
+|   7 = @stmt_block
+|   8 = @stmt_end_test_while // do { ... } while ( ... )
+|   9 = @stmt_for
+|  10 = @stmt_switch_case
+|  11 = @stmt_switch
+|  13 = @stmt_asm // "asm" statement or the body of an asm function
+|  15 = @stmt_try_block
+|  16 = @stmt_microsoft_try // Microsoft
+|  17 = @stmt_decl
+|  18 = @stmt_set_vla_size // C99
+|  19 = @stmt_vla_decl // C99
+|  25 = @stmt_assigned_goto // GNU
+|  26 = @stmt_empty
+|  27 = @stmt_continue
+|  28 = @stmt_break
+|  29 = @stmt_range_based_for // C++11
+// ...  30 @stmt_at_autoreleasepool_block deprecated
+// ...  31 @stmt_objc_for_in deprecated
+// ...  32 @stmt_at_synchronized deprecated
+|  33 = @stmt_handler
+// ...  34 @stmt_finally_end deprecated
+|  35 = @stmt_constexpr_if
+|  37 = @stmt_co_return
+;
+
+type_vla(
+    int type_id: @type ref,
+    int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+    int var: @variable ref,
+    int decl: @stmt_vla_decl ref
+);
+
+if_initialization(
+    unique int if_stmt: @stmt_if ref,
+    int init_id: @stmt ref
+);
+
+if_then(
+    unique int if_stmt: @stmt_if ref,
+    int then_id: @stmt ref
+);
+
+if_else(
+    unique int if_stmt: @stmt_if ref,
+    int else_id: @stmt ref
+);
+
+constexpr_if_initialization(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int init_id: @stmt ref
+);
+
+constexpr_if_then(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int then_id: @stmt ref
+);
+
+constexpr_if_else(
+    unique int constexpr_if_stmt: @stmt_constexpr_if ref,
+    int else_id: @stmt ref
+);
+
+while_body(
+    unique int while_stmt: @stmt_while ref,
+    int body_id: @stmt ref
+);
+
+do_body(
+    unique int do_stmt: @stmt_end_test_while ref,
+    int body_id: @stmt ref
+);
+
+switch_initialization(
+    unique int switch_stmt: @stmt_switch ref,
+    int init_id: @stmt ref
+);
+
+#keyset[switch_stmt, index]
+switch_case(
+    int switch_stmt: @stmt_switch ref,
+    int index: int ref,
+    int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+    unique int switch_stmt: @stmt_switch ref,
+    int body_id: @stmt ref
+);
+
+for_initialization(
+    unique int for_stmt: @stmt_for ref,
+    int init_id: @stmt ref
+);
+
+for_condition(
+    unique int for_stmt: @stmt_for ref,
+    int condition_id: @expr ref
+);
+
+for_update(
+    unique int for_stmt: @stmt_for ref,
+    int update_id: @expr ref
+);
+
+for_body(
+    unique int for_stmt: @stmt_for ref,
+    int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+    unique int id: @stmt ref,
+    int index: int ref,
+    int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+
+stmt_decl_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+    int stmt: @stmt_decl ref,
+    int num: int ref,
+    int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+    unique int block: @stmt_block ref,
+    int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+    unique int id: @jumporlabel ref,
+    string str: string ref,
+    int target: @stmt ref
+);
+
+preprocdirects(
+    unique int id: @preprocdirect,
+    int kind: int ref,
+    int location: @location_default ref
+);
+case @preprocdirect.kind of
+   0 = @ppd_if
+|  1 = @ppd_ifdef
+|  2 = @ppd_ifndef
+|  3 = @ppd_elif
+|  4 = @ppd_else
+|  5 = @ppd_endif
+|  6 = @ppd_plain_include
+|  7 = @ppd_define
+|  8 = @ppd_undef
+|  9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+    int begin : @ppd_branch ref,
+    int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+    unique int id: @preprocdirect ref,
+    string head: string ref,
+    string body: string ref
+);
+
+includes(
+    unique int id: @ppd_include ref,
+    int included: @file ref
+);
+
+link_targets(
+    unique int id: @link_target,
+    int binary: @file ref
+);
+
+link_parent(
+    int element : @element ref,
+    int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+    unique int id: @xmldtd,
+    string root: string ref,
+    string publicId: string ref,
+    string systemId: string ref,
+    int fileid: @file ref
+);
+
+xmlElements(
+    unique int id: @xmlelement,
+    string name: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlAttrs(
+    unique int id: @xmlattribute,
+    int elementid: @xmlelement ref,
+    string name: string ref,
+    string value: string ref,
+    int idx: int ref,
+    int fileid: @file ref
+);
+
+xmlNs(
+    int id: @xmlnamespace,
+    string prefixName: string ref,
+    string URI: string ref,
+    int fileid: @file ref
+);
+
+xmlHasNs(
+    int elementId: @xmlnamespaceable ref,
+    int nsId: @xmlnamespace ref,
+    int fileid: @file ref
+);
+
+xmlComments(
+    unique int id: @xmlcomment,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int fileid: @file ref
+);
+
+xmlChars(
+    unique int id: @xmlcharacters,
+    string text: string ref,
+    int parentid: @xmlparent ref,
+    int idx: int ref,
+    int isCDATA: int ref,
+    int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+    int xmlElement: @xmllocatable ref,
+    int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+              | @xmlelement
+              | @xmlcomment
+              | @xmlattribute
+              | @xmldtd
+              | @file
+              | @xmlnamespace;
diff --git a/cpp/ql/lib/upgrades/f96ad9b2da43bbc9e55a72a165febd270ae07981/upgrade.properties b/cpp/ql/lib/upgrades/f96ad9b2da43bbc9e55a72a165febd270ae07981/upgrade.properties
new file mode 100644
index 00000000000..db0e7e92d0e
--- /dev/null
+++ b/cpp/ql/lib/upgrades/f96ad9b2da43bbc9e55a72a165febd270ae07981/upgrade.properties
@@ -0,0 +1,2 @@
+description: Add new builtin operations
+compatibility: backwards
diff --git a/cpp/ql/src/Architecture/General Class-Level Information/HubClasses.ql b/cpp/ql/src/Architecture/General Class-Level Information/HubClasses.ql
index 7361e875581..ca8d277cc91 100644
--- a/cpp/ql/src/Architecture/General Class-Level Information/HubClasses.ql	
+++ b/cpp/ql/src/Architecture/General Class-Level Information/HubClasses.ql	
@@ -12,5 +12,5 @@ import cpp
 
 from Class c
 where c.fromSource()
-select c as Class, c.getMetrics().getAfferentCoupling() as AfferentCoupling,
-  c.getMetrics().getEfferentSourceCoupling() as EfferentCoupling order by AfferentCoupling desc
+select c as class_, c.getMetrics().getAfferentCoupling() as afferentCoupling,
+  c.getMetrics().getEfferentSourceCoupling() as efferentCoupling order by afferentCoupling desc
diff --git a/cpp/ql/src/Architecture/General Class-Level Information/InheritanceDepthDistribution.ql b/cpp/ql/src/Architecture/General Class-Level Information/InheritanceDepthDistribution.ql
index 0fc6f0ba2a7..693c2961e4d 100644
--- a/cpp/ql/src/Architecture/General Class-Level Information/InheritanceDepthDistribution.ql	
+++ b/cpp/ql/src/Architecture/General Class-Level Information/InheritanceDepthDistribution.ql	
@@ -16,5 +16,5 @@ predicate hasInheritanceDepth(Class c, int d) {
 
 from int depth
 where hasInheritanceDepth(_, depth)
-select depth as InheritanceDepth, count(Class c | hasInheritanceDepth(c, depth)) as NumberOfClasses
-  order by InheritanceDepth
+select depth as inheritanceDepth, count(Class c | hasInheritanceDepth(c, depth)) as numberOfClasses
+  order by inheritanceDepth
diff --git a/cpp/ql/src/Architecture/General Top-Level Information/GeneralStatistics.ql b/cpp/ql/src/Architecture/General Top-Level Information/GeneralStatistics.ql
index 6f842baec42..a065e4d4823 100644
--- a/cpp/ql/src/Architecture/General Top-Level Information/GeneralStatistics.ql	
+++ b/cpp/ql/src/Architecture/General Top-Level Information/GeneralStatistics.ql	
@@ -51,4 +51,4 @@ where
         100 * sum(Class c | c.fromSource() | c.getMetrics().getEfferentSourceCoupling()) /
           sum(Class c | c.fromSource() | c.getMetrics().getEfferentCoupling())
       ).toString() + "%"
-select l as Title, n as Value
+select l as title, n as value
diff --git a/cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyDependencies.ql b/cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyDependencies.ql
index 384af9ebef8..a38cbbd9cb6 100644
--- a/cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyDependencies.ql	
+++ b/cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyDependencies.ql	
@@ -16,4 +16,4 @@ where
   t.fromSource() and
   n = t.getMetrics().getEfferentSourceCoupling() and
   n > 10
-select t as Class, "This class has too many dependencies (" + n.toString() + ")"
+select t as class_, "This class has too many dependencies (" + n.toString() + ")"
diff --git a/cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyFields.ql b/cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyFields.ql
index a5f46595f6c..e7d95091d3d 100644
--- a/cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyFields.ql	
+++ b/cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyFields.ql	
@@ -63,17 +63,17 @@ class VariableDeclarationLine extends TVariableDeclarationInfo {
   /**
    * Gets a `VariableDeclarationEntry` on this line.
    */
-  VariableDeclarationEntry getAVDE() { vdeInfo(result, c, f, line) }
+  VariableDeclarationEntry getAVde() { vdeInfo(result, c, f, line) }
 
   /**
    * Gets the start column of the first `VariableDeclarationEntry` on this line.
    */
-  int getStartColumn() { result = min(this.getAVDE().getLocation().getStartColumn()) }
+  int getStartColumn() { result = min(this.getAVde().getLocation().getStartColumn()) }
 
   /**
    * Gets the end column of the last `VariableDeclarationEntry` on this line.
    */
-  int getEndColumn() { result = max(this.getAVDE().getLocation().getEndColumn()) }
+  int getEndColumn() { result = max(this.getAVde().getLocation().getEndColumn()) }
 
   /**
    * Gets the rank of this `VariableDeclarationLine` in its file and class
@@ -134,13 +134,13 @@ class VariableDeclarationGroup extends VariableDeclarationLine {
       count(VariableDeclarationLine l |
         l = this.getProximateNext*()
       |
-        l.getAVDE().getVariable().getName()
+        l.getAVde().getVariable().getName()
       )
   }
 
   override string toString() {
     this.getCount() = 1 and
-    result = "declaration of " + this.getAVDE().getVariable().getName()
+    result = "declaration of " + this.getAVde().getVariable().getName()
     or
     this.getCount() > 1 and
     result = "group of " + this.getCount() + " fields here"
diff --git a/cpp/ql/src/Architecture/Refactoring Opportunities/ComplexFunctions.ql b/cpp/ql/src/Architecture/Refactoring Opportunities/ComplexFunctions.ql
index 5fe0585131c..ff4ce9fbda1 100644
--- a/cpp/ql/src/Architecture/Refactoring Opportunities/ComplexFunctions.ql	
+++ b/cpp/ql/src/Architecture/Refactoring Opportunities/ComplexFunctions.ql	
@@ -17,4 +17,4 @@ where
   n = f.getMetrics().getNumberOfCalls() and
   n > 99 and
   not f.isMultiplyDefined()
-select f as Function, "This function makes too many calls (" + n.toString() + ")"
+select f as function, "This function makes too many calls (" + n.toString() + ")"
diff --git a/cpp/ql/src/Best Practices/BlockWithTooManyStatements.ql b/cpp/ql/src/Best Practices/BlockWithTooManyStatements.ql
index 97481bc8b03..be175660bd9 100644
--- a/cpp/ql/src/Best Practices/BlockWithTooManyStatements.ql	
+++ b/cpp/ql/src/Best Practices/BlockWithTooManyStatements.ql	
@@ -29,7 +29,4 @@ where
   n = strictcount(ComplexStmt s | s = b.getAStmt()) and
   n > 3 and
   complexStmt = b.getAStmt()
-select b,
-  "Block with too many statements (" + n.toString() +
-    " complex statements in the block). Complex statements at: $@", complexStmt,
-  complexStmt.toString()
+select b, "Block with too many statements (" + n.toString() + " complex statements in the block)."
diff --git a/cpp/ql/src/Best Practices/Likely Errors/EmptyBlock.ql b/cpp/ql/src/Best Practices/Likely Errors/EmptyBlock.ql
index 6e434c85c95..055fbf29f7c 100644
--- a/cpp/ql/src/Best Practices/Likely Errors/EmptyBlock.ql	
+++ b/cpp/ql/src/Best Practices/Likely Errors/EmptyBlock.ql	
@@ -110,4 +110,4 @@ where
   emptyBlock(s, eb) and
   not emptyBlockContainsNonchild(eb) and
   not lineComment(eb)
-select eb, "Empty block without comment"
+select eb, "Empty block without comment."
diff --git a/cpp/ql/src/Best Practices/UseOfGoto.ql b/cpp/ql/src/Best Practices/UseOfGoto.ql
index a1dcddc0123..26d72d69a0a 100644
--- a/cpp/ql/src/Best Practices/UseOfGoto.ql	
+++ b/cpp/ql/src/Best Practices/UseOfGoto.ql	
@@ -16,7 +16,7 @@ import cpp
 class JumpTarget extends Stmt {
   JumpTarget() { exists(GotoStmt g | g.getTarget() = this) }
 
-  FunctionDeclarationEntry getFDE() { result.getBlock() = this.getParentStmt+() }
+  FunctionDeclarationEntry getFde() { result.getBlock() = this.getParentStmt+() }
 
   predicate isForward() {
     exists(GotoStmt g | g.getTarget() = this |
@@ -33,8 +33,8 @@ class JumpTarget extends Stmt {
 
 from FunctionDeclarationEntry fde, int nforward, int nbackward
 where
-  nforward = strictcount(JumpTarget t | t.getFDE() = fde and t.isForward()) and
-  nbackward = strictcount(JumpTarget t | t.getFDE() = fde and t.isBackward()) and
+  nforward = strictcount(JumpTarget t | t.getFde() = fde and t.isForward()) and
+  nbackward = strictcount(JumpTarget t | t.getFde() = fde and t.isBackward()) and
   nforward != 1 and
   nbackward != 1
 select fde,
diff --git a/cpp/ql/src/Critical/MissingCheckScanf.cpp b/cpp/ql/src/Critical/MissingCheckScanf.cpp
new file mode 100644
index 00000000000..c4700a67e47
--- /dev/null
+++ b/cpp/ql/src/Critical/MissingCheckScanf.cpp
@@ -0,0 +1,17 @@
+{
+  int i, j, r;
+
+  r = scanf("%d %d", &i, &j);
+
+  use(i); // BAD: i is not guarded
+
+  if (r >= 1) {
+    use(i); // GOOD: i is guarded correctly
+    use(j); // BAD: j is guarded incorrectly
+  }
+
+  if (r != 2)
+    return;
+
+  use(j); // GOOD: j is guarded correctly
+}
diff --git a/cpp/ql/src/Critical/MissingCheckScanf.qhelp b/cpp/ql/src/Critical/MissingCheckScanf.qhelp
new file mode 100644
index 00000000000..162c94cf9f8
--- /dev/null
+++ b/cpp/ql/src/Critical/MissingCheckScanf.qhelp
@@ -0,0 +1,51 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+
+<overview>
+<p>
+This query finds calls of <tt>scanf</tt>-like functions with missing or
+improper return-value checking.
+</p>
+<p>
+Specifically, the query flags uses of variables that may have been modified by
+<tt>scanf</tt> and subsequently are used without being guarded by a correct
+return-value check. A proper check is one that ensures that the corresponding
+<tt>scanf</tt> has returned (at least) a certain minimum constant.
+</p>
+<p>
+Functions in the <tt>scanf</tt> family return either EOF (a negative value)
+in case of IO failure, or the number of items successfully read from the
+input. Consequently, a simple check that the return value is truthy (nonzero)
+is not enough.
+</p>
+<warning>
+This query has medium precision because, in the current implementation, it
+takes a strict stance on unguarded uses of output variables, and flags them
+as problematic even if they have already been initialized.
+</warning>
+</overview>
+
+<recommendation>
+<p>
+Ensure that all subsequent uses of <tt>scanf</tt> output arguments occur in a
+branch of an <tt>if</tt> statement (or similar), in which it is known that the
+corresponding <tt>scanf</tt> call has in fact read all possible items from its
+input. This can be done by comparing the return value to a numerical constant.
+</p>
+</recommendation>
+
+<example>
+<p>This example shows different ways of guarding a <tt>scanf</tt> output:
+</p>
+<sample src="MissingCheckScanf.cpp" />
+</example>
+
+<references>
+<li>SEI CERT C++ Coding Standard: <a href="https://wiki.sei.cmu.edu/confluence/display/cplusplus/ERR62-CPP.+Detect+errors+when+converting+a+string+to+a+number">ERR62-CPP. Detect errors when converting a string to a number</a>.</li>
+<li>SEI CERT C Coding Standard: <a href="https://wiki.sei.cmu.edu/confluence/display/c/ERR33-C.+Detect+and+handle+standard+library+errors">ERR33-C. Detect and handle standard library errors</a>.</li>
+<li>cppreference.com: <a href="https://en.cppreference.com/w/c/io/fscanf">scanf, fscanf, sscanf, scanf_s, fscanf_s, sscanf_s</a>.</li>
+</references>
+</qhelp>
diff --git a/cpp/ql/src/Critical/MissingCheckScanf.ql b/cpp/ql/src/Critical/MissingCheckScanf.ql
new file mode 100644
index 00000000000..ff859e27735
--- /dev/null
+++ b/cpp/ql/src/Critical/MissingCheckScanf.ql
@@ -0,0 +1,122 @@
+/**
+ * @name Missing return-value check for a 'scanf'-like function
+ * @description Failing to check that a call to 'scanf' actually writes to an
+ *              output variable can lead to unexpected behavior at reading time.
+ * @kind problem
+ * @problem.severity warning
+ * @security-severity 7.5
+ * @precision medium
+ * @id cpp/missing-check-scanf
+ * @tags security
+ *       correctness
+ *       external/cwe/cwe-252
+ *       external/cwe/cwe-253
+ */
+
+import cpp
+import semmle.code.cpp.commons.Scanf
+import semmle.code.cpp.controlflow.Guards
+import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.ir.IR
+import semmle.code.cpp.ir.ValueNumbering
+
+/** An expression appearing as an output argument to a `scanf`-like call */
+class ScanfOutput extends Expr {
+  ScanfFunctionCall call;
+  int varargIndex;
+  Instruction instr;
+  ValueNumber valNum;
+
+  ScanfOutput() {
+    this = call.getOutputArgument(varargIndex).getFullyConverted() and
+    instr.getConvertedResultExpression() = this and
+    valueNumber(instr) = valNum
+  }
+
+  ScanfFunctionCall getCall() { result = call }
+
+  /**
+   * Returns the smallest possible `scanf` return value that would indicate
+   * success in writing this output argument.
+   */
+  int getMinimumGuardConstant() {
+    result =
+      varargIndex + 1 -
+        count(ScanfFormatLiteral f, int n |
+          // Special case: %n writes to an argument without reading any input.
+          // It does not increase the count returned by `scanf`.
+          n <= varargIndex and f.getUse() = call and f.getConversionChar(n) = "n"
+        )
+  }
+
+  predicate hasGuardedAccess(Access e, boolean isGuarded) {
+    e = this.getAnAccess() and
+    if
+      exists(int value, int minGuard | minGuard = this.getMinimumGuardConstant() |
+        e.getBasicBlock() = blockGuardedBy(value, "==", call) and minGuard <= value
+        or
+        e.getBasicBlock() = blockGuardedBy(value, "<", call) and minGuard - 1 <= value
+        or
+        e.getBasicBlock() = blockGuardedBy(value, "<=", call) and minGuard <= value
+      )
+    then isGuarded = true
+    else isGuarded = false
+  }
+
+  /**
+   * Get a subsequent access of the same underlying storage,
+   * but before it gets reset or reused in another `scanf` call.
+   */
+  Access getAnAccess() {
+    exists(Instruction dst |
+      this.bigStep() = dst and
+      dst.getAst() = result and
+      valueNumber(dst) = valNum
+    )
+  }
+
+  private Instruction bigStep() {
+    result = this.smallStep(instr)
+    or
+    exists(Instruction i | i = this.bigStep() | result = this.smallStep(i))
+  }
+
+  private Instruction smallStep(Instruction i) {
+    instr.getASuccessor*() = i and
+    i.getASuccessor() = result and
+    not this.isBarrier(result)
+  }
+
+  private predicate isBarrier(Instruction i) {
+    valueNumber(i) = valNum and
+    exists(Expr e | i.getAst() = e |
+      i = any(StoreInstruction s).getDestinationAddress()
+      or
+      [e, e.getParent().(AddressOfExpr)] instanceof ScanfOutput
+    )
+  }
+}
+
+/** Returns a block guarded by the assertion of `value op call` */
+BasicBlock blockGuardedBy(int value, string op, ScanfFunctionCall call) {
+  exists(GuardCondition g, Expr left, Expr right |
+    right = g.getAChild() and
+    value = left.getValue().toInt() and
+    DataFlow::localExprFlow(call, right)
+  |
+    g.ensuresEq(left, right, 0, result, true) and op = "=="
+    or
+    g.ensuresLt(left, right, 0, result, true) and op = "<"
+    or
+    g.ensuresLt(left, right, 1, result, true) and op = "<="
+  )
+}
+
+from ScanfOutput output, ScanfFunctionCall call, Access access
+where
+  output.getCall() = call and
+  output.hasGuardedAccess(access, false)
+select access,
+  "$@ is read here, but may not have been written. " +
+    "It should be guarded by a check that the $@ returns at least " +
+    output.getMinimumGuardConstant() + ".", access, access.toString(), call, call.toString()
diff --git a/cpp/ql/src/Documentation/CommentedOutCode.ql b/cpp/ql/src/Documentation/CommentedOutCode.ql
index 89411738178..1fe70ac4c94 100644
--- a/cpp/ql/src/Documentation/CommentedOutCode.ql
+++ b/cpp/ql/src/Documentation/CommentedOutCode.ql
@@ -12,4 +12,4 @@
 import CommentedOutCode
 
 from CommentedOutCode comment
-select comment, "This comment appears to contain commented-out code"
+select comment, "This comment appears to contain commented-out code."
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/BitwiseSignCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/BitwiseSignCheck.ql
index fe1b2640058..dd27e4b7aee 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/BitwiseSignCheck.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/BitwiseSignCheck.ql	
@@ -1,7 +1,6 @@
 /**
  * @name Sign check of bitwise operation
- * @description Checking the sign of a bitwise operation often has surprising
- *              edge cases.
+ * @description Checking the sign of the result of a bitwise operation may yield unexpected results.
  * @kind problem
  * @problem.severity warning
  * @precision high
@@ -26,4 +25,4 @@ where
   forall(int op | op = lhs.(BitwiseAndExpr).getAnOperand().getValue().toInt() | op < 0) and
   // exception for cases involving macros
   not e.isAffectedByMacro()
-select e, "Potential unsafe sign check of a bitwise operation."
+select e, "Potentially unsafe sign check of a bitwise operation."
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/FloatComparison.ql b/cpp/ql/src/Likely Bugs/Arithmetic/FloatComparison.ql
index 5233f567fa5..5a2180bfaf3 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/FloatComparison.ql	
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/FloatComparison.ql	
@@ -21,4 +21,4 @@ where
     FloatingPointType and
   not ro.getAnOperand().isConstant() and // comparisons to constants generate too many false positives
   not left.(VariableAccess).getTarget() = right.(VariableAccess).getTarget() // skip self comparison
-select ro, "Equality test on floating point values may not behave as expected."
+select ro, "Equality checks on floating point values can yield unexpected results."
diff --git a/cpp/ql/src/Likely Bugs/Likely Typos/MissingEnumCaseInSwitch.ql b/cpp/ql/src/Likely Bugs/Likely Typos/MissingEnumCaseInSwitch.ql
index 554937127c0..86e419f22ac 100644
--- a/cpp/ql/src/Likely Bugs/Likely Typos/MissingEnumCaseInSwitch.ql	
+++ b/cpp/ql/src/Likely Bugs/Likely Typos/MissingEnumCaseInSwitch.ql	
@@ -13,10 +13,11 @@
 
 import cpp
 
-from EnumSwitch es, float missing, float total
+from EnumSwitch es, float missing, float total, EnumConstant case
 where
   not es.hasDefaultCase() and
   missing = count(es.getAMissingCase()) and
   total = missing + count(es.getASwitchCase()) and
-  missing / total < 0.3
-select es, "Switch statement is missing case for " + es.getAMissingCase().getName()
+  missing / total < 0.3 and
+  case = es.getAMissingCase()
+select es, "Switch statement does not have a case for $@.", case, case.getName()
diff --git a/cpp/ql/src/Metrics/Namespaces/AbstractNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/AbstractNamespaces.ql
index 2d1440813f4..a468ce4a46d 100644
--- a/cpp/ql/src/Metrics/Namespaces/AbstractNamespaces.ql
+++ b/cpp/ql/src/Metrics/Namespaces/AbstractNamespaces.ql
@@ -14,4 +14,4 @@ where
   n.fromSource() and
   c = n.getMetrics().getAbstractness() and
   c > 0.2
-select n as Namespace, c as Abstractness order by Abstractness desc
+select n as namespace, c as abstractness order by abstractness desc
diff --git a/cpp/ql/src/Metrics/Namespaces/ConcreteNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/ConcreteNamespaces.ql
index c71f654f275..cd60b46594a 100644
--- a/cpp/ql/src/Metrics/Namespaces/ConcreteNamespaces.ql
+++ b/cpp/ql/src/Metrics/Namespaces/ConcreteNamespaces.ql
@@ -13,4 +13,4 @@ where
   n.fromSource() and
   c = n.getMetrics().getAbstractness() and
   c = 0
-select n as Namespace, c as Abstractness order by Abstractness desc
+select n as namespace, c as abstractness order by abstractness desc
diff --git a/cpp/ql/src/Metrics/Namespaces/HighAfferentCouplingNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/HighAfferentCouplingNamespaces.ql
index 89dae1a3404..4b89e3710ce 100644
--- a/cpp/ql/src/Metrics/Namespaces/HighAfferentCouplingNamespaces.ql
+++ b/cpp/ql/src/Metrics/Namespaces/HighAfferentCouplingNamespaces.ql
@@ -15,4 +15,4 @@ where
   n.fromSource() and
   c = n.getMetrics().getAfferentCoupling() and
   c > 20
-select n as Namespace, c as AfferentCoupling order by AfferentCoupling desc
+select n as namespace, c as afferentCoupling order by afferentCoupling desc
diff --git a/cpp/ql/src/Metrics/Namespaces/HighDistanceFromMainLineNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/HighDistanceFromMainLineNamespaces.ql
index ce5553749d2..f97bb3e4f5c 100644
--- a/cpp/ql/src/Metrics/Namespaces/HighDistanceFromMainLineNamespaces.ql
+++ b/cpp/ql/src/Metrics/Namespaces/HighDistanceFromMainLineNamespaces.ql
@@ -15,4 +15,4 @@ where
   n.fromSource() and
   c = n.getMetrics().getDistanceFromMain() and
   c > 0.7
-select n as Namespace, c as DistanceFromMainline order by DistanceFromMainline desc
+select n as namespace, c as distanceFromMainline order by distanceFromMainline desc
diff --git a/cpp/ql/src/Metrics/Namespaces/HighEfferentCouplingNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/HighEfferentCouplingNamespaces.ql
index 1de659f1384..35ebe468be6 100644
--- a/cpp/ql/src/Metrics/Namespaces/HighEfferentCouplingNamespaces.ql
+++ b/cpp/ql/src/Metrics/Namespaces/HighEfferentCouplingNamespaces.ql
@@ -15,4 +15,4 @@ where
   n.fromSource() and
   c = n.getMetrics().getEfferentCoupling() and
   c > 20
-select n as Namespace, c as EfferentCoupling order by EfferentCoupling desc
+select n as namespace, c as efferentCoupling order by efferentCoupling desc
diff --git a/cpp/ql/src/Metrics/Namespaces/StableNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/StableNamespaces.ql
index 3fd17ee4066..37c1b698c56 100644
--- a/cpp/ql/src/Metrics/Namespaces/StableNamespaces.ql
+++ b/cpp/ql/src/Metrics/Namespaces/StableNamespaces.ql
@@ -14,4 +14,4 @@ where
   n.fromSource() and
   c = n.getMetrics().getInstability() and
   c < 0.2
-select n as Namespace, c as Instability order by Instability desc
+select n as namespace, c as instability order by instability desc
diff --git a/cpp/ql/src/Metrics/Namespaces/UnstableNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/UnstableNamespaces.ql
index 8e150d62f03..8dbaa5f1cc7 100644
--- a/cpp/ql/src/Metrics/Namespaces/UnstableNamespaces.ql
+++ b/cpp/ql/src/Metrics/Namespaces/UnstableNamespaces.ql
@@ -14,4 +14,4 @@ where
   n.fromSource() and
   c = n.getMetrics().getInstability() and
   c > 0.8
-select n as Package, c as Instability order by Instability desc
+select n as package, c as instability order by instability desc
diff --git a/cpp/ql/src/Microsoft/CallWithNullSAL.ql b/cpp/ql/src/Microsoft/CallWithNullSAL.ql
index d5c74547c3e..dcf47fcbf5d 100644
--- a/cpp/ql/src/Microsoft/CallWithNullSAL.ql
+++ b/cpp/ql/src/Microsoft/CallWithNullSAL.ql
@@ -13,7 +13,7 @@ import SAL
 
 from Parameter p, Call c, Expr arg
 where
-  any(SALNotNull a).getDeclaration() = p and
+  any(SalNotNull a).getDeclaration() = p and
   c.getTarget() = p.getFunction() and
   arg = c.getArgument(p.getIndex()) and
   nullValue(arg)
diff --git a/cpp/ql/src/Microsoft/IgnoreReturnValueSAL.ql b/cpp/ql/src/Microsoft/IgnoreReturnValueSAL.ql
index bf52b2bb615..8202b2d4b05 100644
--- a/cpp/ql/src/Microsoft/IgnoreReturnValueSAL.ql
+++ b/cpp/ql/src/Microsoft/IgnoreReturnValueSAL.ql
@@ -18,7 +18,7 @@ from Function f, FunctionCall call
 where
   call.getTarget() = f and
   call instanceof ExprInVoidContext and
-  any(SALCheckReturn a).getDeclaration() = f and
+  any(SalCheckReturn a).getDeclaration() = f and
   not getOptions().okToIgnoreReturnValue(call)
 select call, "Return value of $@ discarded although a SAL annotation " + "requires inspecting it.",
   f, f.getName()
diff --git a/cpp/ql/src/Microsoft/InconsistentSAL.ql b/cpp/ql/src/Microsoft/InconsistentSAL.ql
index e5965e62b49..fcda9e40f45 100644
--- a/cpp/ql/src/Microsoft/InconsistentSAL.ql
+++ b/cpp/ql/src/Microsoft/InconsistentSAL.ql
@@ -11,7 +11,7 @@ import SAL
 
 /** Holds if `e` has SAL annotation `name`. */
 predicate hasAnnotation(DeclarationEntry e, string name) {
-  exists(SALAnnotation a |
+  exists(SalAnnotation a |
     a.getMacro().getName() = name and
     a.getDeclarationEntry() = e
   )
@@ -21,7 +21,7 @@ predicate hasAnnotation(DeclarationEntry e, string name) {
 predicate inheritsDeclAnnotations(DeclarationEntry e) {
   // Is directly annotated
   e.isDefinition() and
-  exists(SALAnnotation a | a.getMacro().getName() = "_Use_decl_annotations_" |
+  exists(SalAnnotation a | a.getMacro().getName() = "_Use_decl_annotations_" |
     a.getDeclarationEntry() = e
   )
   or
diff --git a/cpp/ql/src/Microsoft/SAL.qll b/cpp/ql/src/Microsoft/SAL.qll
index 46fedbb5d80..99102755b2d 100644
--- a/cpp/ql/src/Microsoft/SAL.qll
+++ b/cpp/ql/src/Microsoft/SAL.qll
@@ -8,8 +8,8 @@ import cpp
 /**
  * A SAL macro defined in `sal.h` or a similar header file.
  */
-class SALMacro extends Macro {
-  SALMacro() {
+class SalMacro extends Macro {
+  SalMacro() {
     this.getFile().getBaseName() =
       ["sal.h", "specstrings_strict.h", "specstrings.h", "w32p.h", "minwindef.h"] and
     (
@@ -22,15 +22,18 @@ class SALMacro extends Macro {
   }
 }
 
+/** DEPRECATED: Alias for SalMacro */
+deprecated class SALMacro = SalMacro;
+
 pragma[noinline]
 private predicate isTopLevelMacroAccess(MacroAccess ma) { not exists(ma.getParentInvocation()) }
 
 /**
  * An invocation of a SAL macro (excluding invocations inside other macros).
  */
-class SALAnnotation extends MacroInvocation {
-  SALAnnotation() {
-    this.getMacro() instanceof SALMacro and
+class SalAnnotation extends MacroInvocation {
+  SalAnnotation() {
+    this.getMacro() instanceof SalMacro and
     isTopLevelMacroAccess(this)
   }
 
@@ -47,23 +50,29 @@ class SALAnnotation extends MacroInvocation {
   }
 }
 
+/** DEPRECATED: Alias for SalAnnotation */
+deprecated class SALAnnotation = SalAnnotation;
+
 /**
  * A SAL macro indicating that the return value of a function should always be
  * checked.
  */
-class SALCheckReturn extends SALAnnotation {
-  SALCheckReturn() {
-    this.getMacro().(SALMacro).getName() = ["_Check_return_", "_Must_inspect_result_"]
+class SalCheckReturn extends SalAnnotation {
+  SalCheckReturn() {
+    this.getMacro().(SalMacro).getName() = ["_Check_return_", "_Must_inspect_result_"]
   }
 }
 
+/** DEPRECATED: Alias for SalCheckReturn */
+deprecated class SALCheckReturn = SalCheckReturn;
+
 /**
  * A SAL macro indicating that a pointer variable or return value should not be
  * `NULL`.
  */
-class SALNotNull extends SALAnnotation {
-  SALNotNull() {
-    exists(SALMacro m | m = this.getMacro() |
+class SalNotNull extends SalAnnotation {
+  SalNotNull() {
+    exists(SalMacro m | m = this.getMacro() |
       not m.getName().matches("%\\_opt\\_%") and
       (
         m.getName().matches("_In%") or
@@ -80,12 +89,15 @@ class SALNotNull extends SALAnnotation {
   }
 }
 
+/** DEPRECATED: Alias for SalNotNull */
+deprecated class SALNotNull = SalNotNull;
+
 /**
  * A SAL macro indicating that a value may be `NULL`.
  */
-class SALMaybeNull extends SALAnnotation {
-  SALMaybeNull() {
-    exists(SALMacro m | m = this.getMacro() |
+class SalMaybeNull extends SalAnnotation {
+  SalMaybeNull() {
+    exists(SalMacro m | m = this.getMacro() |
       m.getName().matches("%\\_opt\\_%") or
       m.getName().matches("\\_Ret_maybenull\\_%") or
       m.getName() = "_Result_nullonfailure_"
@@ -93,14 +105,17 @@ class SALMaybeNull extends SALAnnotation {
   }
 }
 
+/** DEPRECATED: Alias for SalMaybeNull */
+deprecated class SALMaybeNull = SalMaybeNull;
+
 /**
  * A parameter annotated by one or more SAL annotations.
  */
-class SALParameter extends Parameter {
+class SalParameter extends Parameter {
   /** One of this parameter's annotations. */
-  SALAnnotation a;
+  SalAnnotation a;
 
-  SALParameter() { annotatesAt(a, this.getADeclarationEntry(), _, _) }
+  SalParameter() { annotatesAt(a, this.getADeclarationEntry(), _, _) }
 
   predicate isIn() { a.getMacroName().toLowerCase().matches("%\\_in%") }
 
@@ -109,14 +124,17 @@ class SALParameter extends Parameter {
   predicate isInOut() { a.getMacroName().toLowerCase().matches("%\\_inout%") }
 }
 
+/** DEPRECATED: Alias for SalParameter */
+deprecated class SALParameter = SalParameter;
+
 ///////////////////////////////////////////////////////////////////////////////
 // Implementation details
 /**
  * Holds if `a` annotates the declaration entry `d` and
  * its start position is the `idx`th position in `file` that holds a SAL element.
  */
-private predicate annotatesAt(SALAnnotation a, DeclarationEntry d, File file, int idx) {
-  annotatesAtPosition(a.(SALElement).getStartPosition(), d, file, idx)
+private predicate annotatesAt(SalAnnotation a, DeclarationEntry d, File file, int idx) {
+  annotatesAtPosition(a.(SalElement).getStartPosition(), d, file, idx)
 }
 
 /**
@@ -127,12 +145,12 @@ private predicate annotatesAt(SALAnnotation a, DeclarationEntry d, File file, in
 // For performance reasons, do not mention the annotation itself here,
 // but compute with positions instead. This performs better on databases
 // with many annotations at the same position.
-private predicate annotatesAtPosition(SALPosition pos, DeclarationEntry d, File file, int idx) {
+private predicate annotatesAtPosition(SalPosition pos, DeclarationEntry d, File file, int idx) {
   pos = salRelevantPositionAt(file, idx) and
   salAnnotationPos(pos) and
   (
     // Base case: `pos` right before `d`
-    d.(SALElement).getStartPosition() = salRelevantPositionAt(file, idx + 1)
+    d.(SalElement).getStartPosition() = salRelevantPositionAt(file, idx + 1)
     or
     // Recursive case: `pos` right before some annotation on `d`
     annotatesAtPosition(_, d, file, idx + 1)
@@ -143,10 +161,10 @@ private predicate annotatesAtPosition(SALPosition pos, DeclarationEntry d, File
  * A SAL element, that is, a SAL annotation or a declaration entry
  * that may have SAL annotations.
  */
-library class SALElement extends Element {
-  SALElement() {
-    containsSALAnnotation(this.(DeclarationEntry).getFile()) or
-    this instanceof SALAnnotation
+library class SalElement extends Element {
+  SalElement() {
+    containsSalAnnotation(this.(DeclarationEntry).getFile()) or
+    this instanceof SalAnnotation
   }
 
   predicate hasStartPosition(File file, int line, int col) {
@@ -173,25 +191,28 @@ library class SALElement extends Element {
     )
   }
 
-  SALPosition getStartPosition() {
+  SalPosition getStartPosition() {
     exists(File file, int line, int col |
       this.hasStartPosition(file, line, col) and
-      result = MkSALPosition(file, line, col)
+      result = MkSalPosition(file, line, col)
     )
   }
 }
 
+/** DEPRECATED: Alias for SalElement */
+deprecated class SALElement = SalElement;
+
 /** Holds if `file` contains a SAL annotation. */
 pragma[noinline]
-private predicate containsSALAnnotation(File file) { any(SALAnnotation a).getFile() = file }
+private predicate containsSalAnnotation(File file) { any(SalAnnotation a).getFile() = file }
 
 /**
  * A source-file position of a `SALElement`. Unlike location, this denotes a
  * point in the file rather than a range.
  */
-private newtype SALPosition =
-  MkSALPosition(File file, int line, int col) {
-    exists(SALElement e |
+private newtype SalPosition =
+  MkSalPosition(File file, int line, int col) {
+    exists(SalElement e |
       e.hasStartPosition(file, line, col)
       or
       e.hasEndPosition(file, line, col)
@@ -200,18 +221,18 @@ private newtype SALPosition =
 
 /** Holds if `pos` is the start position of a SAL annotation. */
 pragma[noinline]
-private predicate salAnnotationPos(SALPosition pos) {
-  any(SALAnnotation a).(SALElement).getStartPosition() = pos
+private predicate salAnnotationPos(SalPosition pos) {
+  any(SalAnnotation a).(SalElement).getStartPosition() = pos
 }
 
 /**
  * Gets the `idx`th position in `file` that holds a SAL element,
  * ordering positions lexicographically by their start line and start column.
  */
-private SALPosition salRelevantPositionAt(File file, int idx) {
+private SalPosition salRelevantPositionAt(File file, int idx) {
   result =
-    rank[idx](SALPosition pos, int line, int col |
-      pos = MkSALPosition(file, line, col)
+    rank[idx](SalPosition pos, int line, int col |
+      pos = MkSalPosition(file, line, col)
     |
       pos order by line, col
     )
diff --git a/cpp/ql/src/PointsTo/TaintedFormatStrings.ql b/cpp/ql/src/PointsTo/TaintedFormatStrings.ql
index 1b671697573..929833f52a0 100644
--- a/cpp/ql/src/PointsTo/TaintedFormatStrings.ql
+++ b/cpp/ql/src/PointsTo/TaintedFormatStrings.ql
@@ -119,4 +119,4 @@ predicate potentialViolation(InputBuffer source, FormatBuffer dest) {
 
 from InputBuffer source, FormatBuffer dest
 where potentialViolation(source, dest)
-select dest.getFile() as File, dest as FormatString
+select dest.getFile() as file, dest as formatString
diff --git a/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql b/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql
index 9a08bbd64a6..c062039d930 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql
+++ b/cpp/ql/src/Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql
@@ -24,7 +24,7 @@ where
     if e = DefinitionInSnapshot()
     then defined = ""
     else
-      if e = SuggestiveSALAnnotation()
+      if e = SuggestiveSalAnnotation()
       then defined = "externally defined (SAL) "
       else defined = "externally defined (CSV) "
   )
diff --git a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
index 29f519163cc..a5def46dd60 100644
--- a/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
+++ b/cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll
@@ -149,7 +149,7 @@ newtype Evidence =
    * The function is externally defined, but the parameter has an `_out` SAL annotation which
    * suggests that it is initialized in the function.
    */
-  SuggestiveSALAnnotation() or
+  SuggestiveSalAnnotation() or
   /**
    * We have been given a CSV file which indicates this parameter is conditionally initialized.
    */
@@ -198,8 +198,8 @@ class InitializationFunction extends Function {
     or
     // If we have no definition, we look at SAL annotations
     not this.hasDefinition() and
-    this.getParameter(i).(SALParameter).isOut() and
-    evidence = SuggestiveSALAnnotation()
+    this.getParameter(i).(SalParameter).isOut() and
+    evidence = SuggestiveSalAnnotation()
     or
     // We have some external information that this function conditionally initializes
     not this.hasDefinition() and
diff --git a/cpp/ql/src/Security/CWE/CWE-611/XXE.ql b/cpp/ql/src/Security/CWE/CWE-611/XXE.ql
index da17913dec5..abd1773afd8 100644
--- a/cpp/ql/src/Security/CWE/CWE-611/XXE.ql
+++ b/cpp/ql/src/Security/CWE/CWE-611/XXE.ql
@@ -19,8 +19,8 @@ import DataFlow::PathGraph
 /**
  * A configuration for tracking XML objects and their states.
  */
-class XXEConfiguration extends DataFlow::Configuration {
-  XXEConfiguration() { this = "XXEConfiguration" }
+class XxeConfiguration extends DataFlow::Configuration {
+  XxeConfiguration() { this = "XXEConfiguration" }
 
   override predicate isSource(DataFlow::Node node, string flowstate) {
     any(XmlLibrary l).configurationSource(node, flowstate)
@@ -45,7 +45,7 @@ class XXEConfiguration extends DataFlow::Configuration {
   }
 }
 
-from XXEConfiguration conf, DataFlow::PathNode source, DataFlow::PathNode sink
+from XxeConfiguration conf, DataFlow::PathNode source, DataFlow::PathNode sink
 where conf.hasFlowPath(source, sink)
 select sink, source, sink,
   "This $@ is not configured to prevent an XML external entity (XXE) attack.", source, "XML parser"
diff --git a/cpp/ql/src/change-notes/2022-08-23-alert-messages.md b/cpp/ql/src/change-notes/2022-08-23-alert-messages.md
new file mode 100644
index 00000000000..22f4c5c6682
--- /dev/null
+++ b/cpp/ql/src/change-notes/2022-08-23-alert-messages.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The alert message of many queries have been changed to make the message consistent with other languages.
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/2022-08-24-missing-check-scanf.md b/cpp/ql/src/change-notes/2022-08-24-missing-check-scanf.md
new file mode 100644
index 00000000000..d8e5384422e
--- /dev/null
+++ b/cpp/ql/src/change-notes/2022-08-24-missing-check-scanf.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new medium-precision query, `cpp/missing-check-scanf`, which detects `scanf` output variables that are used without a proper return-value check to see that they were actually written. A variation of this query was originally contributed as an [experimental query by @ihsinme](https://github.com/github/codeql/pull/8246).
diff --git a/cpp/ql/src/experimental/Likely Bugs/ArrayAccessProductFlow.ql b/cpp/ql/src/experimental/Likely Bugs/ArrayAccessProductFlow.ql
new file mode 100644
index 00000000000..7b163f5c05c
--- /dev/null
+++ b/cpp/ql/src/experimental/Likely Bugs/ArrayAccessProductFlow.ql	
@@ -0,0 +1,51 @@
+import cpp
+import experimental.semmle.code.cpp.dataflow.ProductFlow
+import experimental.semmle.code.cpp.semantic.analysis.RangeAnalysis
+import experimental.semmle.code.cpp.rangeanalysis.Bound
+import experimental.semmle.code.cpp.semantic.SemanticExprSpecific
+import semmle.code.cpp.ir.IR
+import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+import semmle.code.cpp.models.interfaces.Allocation
+import semmle.code.cpp.ir.IRConfiguration
+
+predicate bounded(Instruction i, Bound b, int delta, boolean upper) {
+  // TODO: reason
+  semBounded(getSemanticExpr(i), b, delta, upper, _)
+}
+
+class ArraySizeConfiguration extends ProductFlow::Configuration {
+  ArraySizeConfiguration() { this = "ArraySizeConfiguration" }
+
+  override predicate isSourcePair(DataFlow::Node source1, DataFlow::Node source2) {
+    exists(GVN sizeGvn |
+      source1.asConvertedExpr().(AllocationExpr).getSizeExpr() = sizeGvn.getAnExpr() and
+      source2.asConvertedExpr() = sizeGvn.getAnExpr()
+    )
+  }
+
+  override predicate isSinkPair(DataFlow::Node sink1, DataFlow::Node sink2) {
+    exists(PointerAddInstruction pai, Instruction index, Bound b, int delta |
+      pai.getRight() = index and
+      pai.getLeft() = sink1.asInstruction() and
+      bounded(index, b, delta, true) and
+      sink2.asInstruction() = b.getInstruction() and
+      (
+        delta = 0 and
+        exists(DataFlow::Node paiNode, DataFlow::Node derefNode |
+          DataFlow::localFlow(paiNode, derefNode) and
+          paiNode.asInstruction() = pai and
+          derefNode.asOperand() instanceof AddressOperand
+        )
+        or
+        delta >= 1
+      )
+    )
+  }
+}
+
+from
+  ArraySizeConfiguration conf, DataFlow::PathNode source1, DataFlow2::PathNode source2,
+  DataFlow::PathNode sink1, DataFlow2::PathNode sink2
+where conf.hasFlowPath(source1, source2, sink1, sink2)
+// TODO: pull delta out and display it
+select source1, source2, sink1, sink2
diff --git a/cpp/ql/src/experimental/Likely Bugs/OverrunWriteProductFlow.ql b/cpp/ql/src/experimental/Likely Bugs/OverrunWriteProductFlow.ql
new file mode 100644
index 00000000000..07e78db7344
--- /dev/null
+++ b/cpp/ql/src/experimental/Likely Bugs/OverrunWriteProductFlow.ql	
@@ -0,0 +1,34 @@
+import cpp
+import experimental.semmle.code.cpp.dataflow.ProductFlow
+import semmle.code.cpp.ir.IR
+import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+import semmle.code.cpp.models.interfaces.Allocation
+import semmle.code.cpp.models.interfaces.ArrayFunction
+
+class StringSizeConfiguration extends ProductFlow::Configuration {
+  StringSizeConfiguration() { this = "StringSizeConfiguration" }
+
+  override predicate isSourcePair(DataFlow::Node bufSource, DataFlow::Node sizeSource) {
+    exists(
+      GVN sizeGvn // TODO: use-use flow instead of GVN
+    |
+      bufSource.asConvertedExpr().(AllocationExpr).getSizeExpr() = sizeGvn.getAnExpr() and
+      sizeSource.asConvertedExpr() = sizeGvn.getAnExpr()
+    )
+  }
+
+  override predicate isSinkPair(DataFlow::Node bufSink, DataFlow::Node sizeSink) {
+    exists(CallInstruction c, int bufIndex, int sizeIndex |
+      c.getStaticCallTarget().(ArrayFunction).hasArrayWithVariableSize(bufIndex, sizeIndex) and
+      c.getArgument(bufIndex) = bufSink.asInstruction() and
+      c.getArgument(sizeIndex) = sizeSink.asInstruction()
+    )
+  }
+}
+
+// we don't actually check correctness yet. Right now the query just finds relevant source/sink pairs.
+from
+  StringSizeConfiguration conf, DataFlow::PathNode source1, DataFlow2::PathNode source2,
+  DataFlow::PathNode sink1, DataFlow2::PathNode sink2
+where conf.hasFlowPath(source1, source2, sink1, sink2)
+select source1, source2, sink1, sink2
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.cpp b/cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.cpp
new file mode 100644
index 00000000000..0ad0635ae40
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.cpp
@@ -0,0 +1,26 @@
+void *malloc(unsigned);
+unsigned get_size();
+void write_data(const unsigned char*, const unsigned char*);
+
+int main(int argc, char* argv[]) {
+  unsigned size = get_size();
+  
+  {
+    unsigned char *begin = (unsigned char*)malloc(size);
+    if(!begin) return -1;
+
+    unsigned char* end = begin + size;
+    write_data(begin, end);
+    *end = '\0'; // BAD: Out-of-bounds write
+  }
+
+  {
+    unsigned char *begin = (unsigned char*)malloc(size);
+    if(!begin) return -1;
+
+    unsigned char* end = begin + size;
+    write_data(begin, end);
+    *(end - 1) = '\0'; // GOOD: writing to the last byte
+  }
+
+}
\ No newline at end of file
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.qhelp
new file mode 100644
index 00000000000..4f590659112
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.qhelp
@@ -0,0 +1,31 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>The program performs an out-of-bounds read or write operation. In addition to causing program instability, techniques exist which may allow an attacker to use this vulnerability to execute arbitrary code.</p>
+
+</overview>
+<recommendation>
+
+<p>Ensure that pointer dereferences are properly guarded to ensure that they cannot be used to read or write past the end of the allocation.</p>
+
+</recommendation>
+<example>
+<p>The first example allocates a buffer of size <code>size</code> and creates a local variable that stores the location that is one byte past the end of the allocation.
+This local variable is then dereferenced which results in an out-of-bounds write.
+The second example subtracts one from the <code>end</code> variable before dereferencing it. This subtraction ensures that the write correctly updates the final byte of the allocation.</p>
+<sample src="InvalidPointerDeref.cpp" />
+
+</example>
+<references>
+
+<li>CERT C Coding Standard:
+<a href="https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts">ARR30-C. Do not form or use out-of-bounds pointers or array subscripts</a>.</li>
+<li>
+OWASP:
+<a href="https://owasp.org/www-community/vulnerabilities/Buffer_Overflow">Buffer Overflow</a>.
+</li>
+
+</references>
+</qhelp>
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.ql b/cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.ql
new file mode 100644
index 00000000000..05327263386
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.ql
@@ -0,0 +1,360 @@
+/**
+ * @name Invalid pointer dereference
+ * @description Dereferencing a pointer that points past it allocation is undefined behavior
+ *              and may lead to security vulnerabilities.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/invalid-pointer-deref
+ * @tags reliability
+ *       security
+ *       external/cwe/cwe-119
+ *       external/cwe/cwe-125
+ *       external/cwe/cwe-193
+ *       external/cwe/cwe-787
+ */
+
+import cpp
+import experimental.semmle.code.cpp.dataflow.ProductFlow
+import experimental.semmle.code.cpp.ir.dataflow.DataFlow3
+import experimental.semmle.code.cpp.semantic.analysis.RangeAnalysis
+import experimental.semmle.code.cpp.semantic.SemanticBound
+import experimental.semmle.code.cpp.semantic.SemanticExprSpecific
+import semmle.code.cpp.ir.IR
+
+pragma[nomagic]
+Instruction getABoundIn(SemBound b, IRFunction func) {
+  result = b.getExpr(0) and
+  result.getEnclosingIRFunction() = func
+}
+
+/**
+ * Holds if `i <= b + delta`.
+ */
+pragma[nomagic]
+predicate bounded(Instruction i, Instruction b, int delta) {
+  exists(SemBound bound, IRFunction func |
+    semBounded(getSemanticExpr(i), bound, delta, true, _) and
+    b = getABoundIn(bound, func) and
+    i.getEnclosingIRFunction() = func
+  )
+}
+
+/**
+ * Holds if the combination of `n` and `state` represents an appropriate
+ * source for the expression `e` suitable for use-use flow.
+ */
+private predicate hasSizeImpl(Expr e, DataFlow::Node n, string state) {
+  // The simple case: If the size is a variable access with no qualifier we can just use the
+  // dataflow node for that expression and no state.
+  exists(VariableAccess va |
+    va = e and
+    not va instanceof FieldAccess and
+    n.asConvertedExpr() = va.getFullyConverted() and
+    state = "0"
+  )
+  or
+  // If the size is a choice between two expressions we allow both to be nodes representing the size.
+  exists(ConditionalExpr cond | cond = e | hasSizeImpl([cond.getThen(), cond.getElse()], n, state))
+  or
+  // If the size is an expression plus a constant, we pick the dataflow node of the expression and
+  // remember the constant in the state.
+  exists(Expr const, Expr nonconst |
+    e.(AddExpr).hasOperands(const, nonconst) and
+    state = const.getValue() and
+    hasSizeImpl(nonconst, n, _)
+  )
+  or
+  exists(Expr const, Expr nonconst |
+    e.(SubExpr).hasOperands(const, nonconst) and
+    state = "-" + const.getValue() and
+    hasSizeImpl(nonconst, n, _)
+  )
+}
+
+/**
+ * Holds if `(n, state)` pair represents the source of flow for the size
+ * expression associated with `alloc`.
+ */
+predicate hasSize(AllocationExpr alloc, DataFlow::Node n, string state) {
+  hasSizeImpl(alloc.getSizeExpr(), n, state)
+}
+
+/**
+ * A product-flow configuration for flow from an (allocation, size) pair to a
+ * pointer-arithmetic operation that is non-strictly upper-bounded by `allocation + size`.
+ *
+ * The goal of this query is to find patterns such as:
+ * ```cpp
+ * 1. char* begin = (char*)malloc(size);
+ * 2. char* end = begin + size;
+ * 3. for(int *p = begin; p <= end; p++) {
+ * 4.   use(*p);
+ * 5. }
+ * ```
+ *
+ * We do this by splitting the task up into two configurations:
+ * 1. `AllocToInvalidPointerConf` find flow from `malloc(size)` to `begin + size`, and
+ * 2. `InvalidPointerToDerefConf` finds flow from `begin + size` to an `end` (on line 3).
+ *
+ * Finally, the range-analysis library will find a load from (or store to) an address that
+ * is non-strictly upper-bounded by `end` (which in this case is `*p`).
+ */
+class AllocToInvalidPointerConf extends ProductFlow::Configuration {
+  AllocToInvalidPointerConf() { this = "AllocToInvalidPointerConf" }
+
+  override predicate isSourcePair(
+    DataFlow::Node source1, string state1, DataFlow::Node source2, string state2
+  ) {
+    // In the case of an allocation like
+    // ```cpp
+    // malloc(size + 1);
+    // ```
+    // we use `state2` to remember that there was an offset (in this case an offset of `1`) added
+    // to the size of the allocation. This state is then checked in `isSinkPair`.
+    state1 = "" and
+    hasSize(source1.asConvertedExpr(), source2, state2)
+  }
+
+  override predicate isSinkPair(
+    DataFlow::Node sink1, DataFlow::FlowState state1, DataFlow::Node sink2,
+    DataFlow::FlowState state2
+  ) {
+    state1 = "" and
+    // We check that the delta computed by the range analysis matches the
+    // state value that we set in `isSourcePair`.
+    exists(int delta |
+      isSinkImpl(_, sink1, sink2, delta) and
+      state2 = delta.toString()
+    )
+  }
+}
+
+pragma[nomagic]
+predicate pointerAddInstructionHasOperands(
+  PointerAddInstruction pai, Instruction left, Instruction right
+) {
+  pai.getLeft() = left and
+  pai.getRight() = right
+}
+
+/**
+ * Holds if `pai` is non-strictly upper bounded by `sink2 + delta` and `sink1` is the
+ * left operand of the pointer-arithmetic operation.
+ *
+ * For example in,
+ * ```cpp
+ * char* end = p + (size + 1);
+ * ```
+ * We will have:
+ * - `pai` is `p + (size + 1)`,
+ * - `sink1` is `p`
+ * - `sink2` is `size`
+ * - `delta` is `1`.
+ */
+pragma[nomagic]
+predicate pointerAddInstructionHasBounds(
+  PointerAddInstruction pai, DataFlow::Node sink1, Instruction sink2, int delta
+) {
+  exists(Instruction right |
+    pointerAddInstructionHasOperands(pai, sink1.asInstruction(), right) and
+    bounded(right, sink2, delta)
+  )
+}
+
+/**
+ * Holds if `pai` is non-strictly upper bounded by `sink2 + delta` and `sink1` is the
+ * left operand of the pointer-arithmetic operation.
+ *
+ * See `pointerAddInstructionHasBounds` for an example.
+ */
+predicate isSinkImpl(
+  PointerAddInstruction pai, DataFlow::Node sink1, DataFlow::Node sink2, int delta
+) {
+  pointerAddInstructionHasBounds(pai, sink1, sink2.asInstruction(), delta)
+}
+
+/**
+ * Holds if `sink` is a sink for `InvalidPointerToDerefConf` and `i` is a `StoreInstruction` that
+ * writes to an address that non-strictly upper-bounds `sink`, or `i` is a `LoadInstruction` that
+ * reads from an address that non-strictly upper-bounds `sink`.
+ */
+predicate isInvalidPointerDerefSink(DataFlow::Node sink, Instruction i, string operation) {
+  exists(AddressOperand addr, int delta |
+    bounded(addr.getDef(), sink.asInstruction(), delta) and
+    delta >= 0 and
+    i.getAnOperand() = addr
+  |
+    i instanceof StoreInstruction and
+    operation = "write"
+    or
+    i instanceof LoadInstruction and
+    operation = "read"
+  )
+}
+
+/**
+ * A configuration to track flow from a pointer-arithmetic operation found
+ * by `AllocToInvalidPointerConf` to a dereference of the pointer.
+ */
+class InvalidPointerToDerefConf extends DataFlow3::Configuration {
+  InvalidPointerToDerefConf() { this = "InvalidPointerToDerefConf" }
+
+  override predicate isSource(DataFlow::Node source) { invalidPointerToDerefSource(_, source, _) }
+
+  override predicate isSink(DataFlow::Node sink) { isInvalidPointerDerefSink(sink, _, _) }
+}
+
+/**
+ * Holds if `pai` is a pointer-arithmetic operation and `source` is a dataflow node with a
+ * pointer-value that is non-strictly upper bounded by `pai + delta`.
+ *
+ * For example, if `pai` is a pointer-arithmetic operation `p + size` in an expression such
+ * as `(p + size) + 1` and `source` is the node representing `(p + size) + 1`. In this
+ * case `delta` is 1.
+ */
+predicate invalidPointerToDerefSource(
+  PointerArithmeticInstruction pai, DataFlow::Node source, int delta
+) {
+  exists(ProductFlow::Configuration conf, DataFlow::PathNode p, DataFlow::Node sink1 |
+    p.getNode() = sink1 and
+    conf.hasFlowPath(_, _, p, _) and
+    isSinkImpl(pai, sink1, _, _) and
+    bounded(source.asInstruction(), pai, delta) and
+    delta >= 0
+  )
+}
+
+newtype TMergedPathNode =
+  // The path nodes computed by the first projection of `AllocToInvalidPointerConf`
+  TPathNode1(DataFlow::PathNode p) or
+  // The path nodes computed by `InvalidPointerToDerefConf`
+  TPathNode3(DataFlow3::PathNode p) or
+  // The read/write that uses the invalid pointer identified by `InvalidPointerToDerefConf`.
+  // This one is needed because the sink identified by `InvalidPointerToDerefConf` is the
+  // pointer, but we want to raise an alert at the dereference.
+  TPathNodeSink(Instruction i) {
+    exists(DataFlow::Node n |
+      any(InvalidPointerToDerefConf conf).hasFlow(_, n) and
+      isInvalidPointerDerefSink(n, i, _)
+    )
+  }
+
+class MergedPathNode extends TMergedPathNode {
+  string toString() { none() }
+
+  final DataFlow::PathNode asPathNode1() { this = TPathNode1(result) }
+
+  final DataFlow3::PathNode asPathNode3() { this = TPathNode3(result) }
+
+  final Instruction asSinkNode() { this = TPathNodeSink(result) }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    none()
+  }
+}
+
+class PathNode1 extends MergedPathNode, TPathNode1 {
+  override string toString() {
+    exists(DataFlow::PathNode p |
+      this = TPathNode1(p) and
+      result = p.toString()
+    )
+  }
+
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.asPathNode1().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+class PathNode3 extends MergedPathNode, TPathNode3 {
+  override string toString() {
+    exists(DataFlow3::PathNode p |
+      this = TPathNode3(p) and
+      result = p.toString()
+    )
+  }
+
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.asPathNode3().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+class PathSinkNode extends MergedPathNode, TPathNodeSink {
+  override string toString() {
+    exists(Instruction i |
+      this = TPathNodeSink(i) and
+      result = i.toString()
+    )
+  }
+
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.asSinkNode()
+        .getLocation()
+        .hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+query predicate edges(MergedPathNode node1, MergedPathNode node2) {
+  node1.asPathNode1().getASuccessor() = node2.asPathNode1()
+  or
+  joinOn1(_, node1.asPathNode1(), node2.asPathNode3())
+  or
+  node1.asPathNode3().getASuccessor() = node2.asPathNode3()
+  or
+  joinOn2(node1.asPathNode3(), node2.asSinkNode(), _)
+}
+
+/**
+ * Holds if `p1` is a sink of `AllocToInvalidPointerConf` and `p2` is a source
+ * of `InvalidPointerToDerefConf`, and they are connected through `pai`.
+ */
+predicate joinOn1(PointerArithmeticInstruction pai, DataFlow::PathNode p1, DataFlow3::PathNode p2) {
+  isSinkImpl(pai, p1.getNode(), _, _) and
+  invalidPointerToDerefSource(pai, p2.getNode(), _)
+}
+
+/**
+ * Holds if `p1` is a sink of `InvalidPointerToDerefConf` and `i` is the instruction
+ * that dereferences `p1`. The string `operation` describes whether the `i` is
+ * a `StoreInstruction` or `LoadInstruction`.
+ */
+predicate joinOn2(DataFlow3::PathNode p1, Instruction i, string operation) {
+  isInvalidPointerDerefSink(p1.getNode(), i, operation)
+}
+
+predicate hasFlowPath(
+  MergedPathNode source1, MergedPathNode sink, DataFlow3::PathNode source3,
+  PointerArithmeticInstruction pai, string operation
+) {
+  exists(
+    AllocToInvalidPointerConf conf1, InvalidPointerToDerefConf conf2, DataFlow3::PathNode sink3,
+    DataFlow::PathNode sink1
+  |
+    conf1.hasFlowPath(source1.asPathNode1(), _, sink1, _) and
+    joinOn1(pai, sink1, source3) and
+    conf2.hasFlowPath(source3, sink3) and
+    joinOn2(sink3, sink.asSinkNode(), operation)
+  )
+}
+
+from
+  MergedPathNode source, MergedPathNode sink, int k, string kstr, DataFlow3::PathNode source3,
+  PointerArithmeticInstruction pai, string operation, Expr offset, DataFlow::Node n
+where
+  hasFlowPath(source, sink, source3, pai, operation) and
+  invalidPointerToDerefSource(pai, source3.getNode(), k) and
+  offset = pai.getRight().getUnconvertedResultExpression() and
+  n = source.asPathNode1().getNode() and
+  if k = 0 then kstr = "" else kstr = " + " + k
+select sink, source, sink,
+  "This " + operation + " might be out of bounds, as the pointer might be equal to $@ + $@" + kstr +
+    ".", n, n.toString(), offset, offset.toString()
diff --git a/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 2.ql b/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 2.ql
index 0420b9c3984..d3f7ac9adb7 100644
--- a/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 2.ql	
+++ b/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 2.ql	
@@ -16,17 +16,17 @@ import cpp
 // pointers. This will obviously not catch code that uses inline assembly to achieve
 // self-modification, nor will it spot the use of OS mechanisms to write into process
 // memory (such as WriteProcessMemory under Windows).
-predicate maybeSMCConversion(Type t1, Type t2) {
+predicate maybeSmcConversion(Type t1, Type t2) {
   t1 instanceof FunctionPointerType and
   t2 instanceof PointerType and
   not t2 instanceof FunctionPointerType and
   not t2 instanceof VoidPointerType
   or
-  maybeSMCConversion(t2, t1)
+  maybeSmcConversion(t2, t1)
 }
 
 from Expr e
 where
   e.fromSource() and
-  maybeSMCConversion(e.getUnderlyingType(), e.getActualType())
+  maybeSmcConversion(e.getUnderlyingType(), e.getActualType())
 select e, "AV Rule 2: There shall not be any self-modifying code."
diff --git a/cpp/ql/test/experimental/library-tests/rangeanalysis/rangeanalysis/RangeAnalysis.expected b/cpp/ql/test/experimental/library-tests/rangeanalysis/rangeanalysis/RangeAnalysis.expected
index 78ff3edde3d..106313c8707 100644
--- a/cpp/ql/test/experimental/library-tests/rangeanalysis/rangeanalysis/RangeAnalysis.expected
+++ b/cpp/ql/test/experimental/library-tests/rangeanalysis/rangeanalysis/RangeAnalysis.expected
@@ -1,32 +1,34 @@
-| test.cpp:10:10:10:10 | Store: x | test.cpp:6:15:6:15 | InitializeParameter: x | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:10:10:10:10 | Store: x | test.cpp:6:22:6:22 | InitializeParameter: y | 0 | false | CompareLT: ... < ... | test.cpp:7:7:7:11 | test.cpp:7:7:7:11 |
-| test.cpp:10:10:10:10 | Store: x | test.cpp:6:22:6:22 | InitializeParameter: y | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:20:10:20:10 | Store: x | test.cpp:14:15:14:15 | InitializeParameter: x | -2 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:20:10:20:10 | Store: x | test.cpp:14:22:14:22 | InitializeParameter: y | -2 | false | CompareLT: ... < ... | test.cpp:15:7:15:11 | test.cpp:15:7:15:11 |
+| test.cpp:10:10:10:10 | Store: x | test.cpp:6:15:6:15 | ValueNumberBound | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:10:10:10:10 | Store: x | test.cpp:6:22:6:22 | ValueNumberBound | 0 | false | CompareLT: ... < ... | test.cpp:7:7:7:11 | test.cpp:7:7:7:11 |
+| test.cpp:10:10:10:10 | Store: x | test.cpp:6:22:6:22 | ValueNumberBound | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:20:10:20:10 | Store: x | test.cpp:14:15:14:15 | ValueNumberBound | -2 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:20:10:20:10 | Store: x | test.cpp:14:22:14:22 | ValueNumberBound | -2 | false | CompareLT: ... < ... | test.cpp:15:7:15:11 | test.cpp:15:7:15:11 |
 | test.cpp:27:10:27:10 | Load: i | file://:0:0:0:0 | 0 | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:27:10:27:10 | Load: i | test.cpp:24:15:24:15 | InitializeParameter: x | -1 | true | CompareLT: ... < ... | test.cpp:26:14:26:18 | test.cpp:26:14:26:18 |
+| test.cpp:27:10:27:10 | Load: i | test.cpp:24:15:24:15 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:26:14:26:18 | test.cpp:26:14:26:18 |
 | test.cpp:30:10:30:10 | Load: i | file://:0:0:0:0 | 0 | 1 | false | CompareGT: ... > ... | test.cpp:29:14:29:18 | test.cpp:29:14:29:18 |
-| test.cpp:30:10:30:10 | Load: i | test.cpp:24:15:24:15 | InitializeParameter: x | 0 | true | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:30:10:30:10 | Load: i | test.cpp:26:14:26:14 | Phi: i | 0 | true | CompareLT: ... < ... | test.cpp:26:14:26:18 | test.cpp:26:14:26:18 |
+| test.cpp:30:10:30:10 | Load: i | test.cpp:24:15:24:15 | ValueNumberBound | 0 | true | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:30:10:30:10 | Load: i | test.cpp:26:14:26:14 | ValueNumberBound | 0 | true | CompareLT: ... < ... | test.cpp:26:14:26:18 | test.cpp:26:14:26:18 |
 | test.cpp:33:10:33:10 | Load: i | file://:0:0:0:0 | 0 | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:33:10:33:10 | Load: i | test.cpp:24:15:24:15 | InitializeParameter: x | 1 | true | CompareLT: ... < ... | test.cpp:32:14:32:22 | test.cpp:32:14:32:22 |
-| test.cpp:33:10:33:10 | Load: i | test.cpp:26:14:26:14 | Phi: i | 1 | true | CompareLT: ... < ... | test.cpp:32:14:32:22 | test.cpp:32:14:32:22 |
-| test.cpp:33:10:33:10 | Load: i | test.cpp:29:14:29:14 | Phi: i | 0 | false | CompareGT: ... > ... | test.cpp:29:14:29:18 | test.cpp:29:14:29:18 |
-| test.cpp:40:10:40:14 | Load: begin | test.cpp:38:16:38:20 | InitializeParameter: begin | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:40:10:40:14 | Load: begin | test.cpp:38:28:38:30 | InitializeParameter: end | -1 | true | CompareLT: ... < ... | test.cpp:39:10:39:20 | test.cpp:39:10:39:20 |
-| test.cpp:49:12:49:12 | Load: x | test.cpp:46:22:46:22 | InitializeParameter: y | -1 | true | CompareLT: ... < ... | test.cpp:48:9:48:13 | test.cpp:48:9:48:13 |
-| test.cpp:49:12:49:12 | Load: x | test.cpp:46:29:46:29 | InitializeParameter: z | -2 | true | CompareLT: ... < ... | test.cpp:48:9:48:13 | test.cpp:48:9:48:13 |
-| test.cpp:54:12:54:12 | Load: x | test.cpp:46:22:46:22 | InitializeParameter: y | -1 | true | CompareLT: ... < ... | test.cpp:52:7:52:11 | test.cpp:52:7:52:11 |
-| test.cpp:62:10:62:13 | Load: iter | test.cpp:60:17:60:17 | InitializeParameter: p | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:62:10:62:13 | Load: iter | test.cpp:60:17:60:17 | InitializeParameter: p | 3 | true | CompareLT: ... < ... | test.cpp:61:32:61:51 | test.cpp:61:32:61:51 |
-| test.cpp:62:10:62:13 | Load: iter | test.cpp:61:39:61:51 | Convert: (char *)... | -1 | true | CompareLT: ... < ... | test.cpp:61:32:61:51 | test.cpp:61:32:61:51 |
-| test.cpp:67:10:67:13 | Load: iter | test.cpp:60:17:60:17 | InitializeParameter: p | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:67:10:67:13 | Load: iter | test.cpp:60:17:60:17 | InitializeParameter: p | 3 | true | CompareLT: ... < ... | test.cpp:66:32:66:41 | test.cpp:66:32:66:41 |
-| test.cpp:67:10:67:13 | Load: iter | test.cpp:61:32:61:35 | Phi: iter | -1 | true | CompareLT: ... < ... | test.cpp:66:32:66:41 | test.cpp:66:32:66:41 |
-| test.cpp:67:10:67:13 | Load: iter | test.cpp:61:39:61:51 | Convert: (char *)... | -1 | true | CompareLT: ... < ... | test.cpp:66:32:66:41 | test.cpp:66:32:66:41 |
+| test.cpp:33:10:33:10 | Load: i | test.cpp:24:15:24:15 | ValueNumberBound | 1 | true | CompareLT: ... < ... | test.cpp:32:14:32:22 | test.cpp:32:14:32:22 |
+| test.cpp:33:10:33:10 | Load: i | test.cpp:26:14:26:14 | ValueNumberBound | 1 | true | CompareLT: ... < ... | test.cpp:32:14:32:22 | test.cpp:32:14:32:22 |
+| test.cpp:33:10:33:10 | Load: i | test.cpp:29:14:29:14 | ValueNumberBound | 0 | false | CompareGT: ... > ... | test.cpp:29:14:29:18 | test.cpp:29:14:29:18 |
+| test.cpp:40:10:40:14 | Load: begin | test.cpp:38:16:38:20 | ValueNumberBound | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:40:10:40:14 | Load: begin | test.cpp:38:28:38:30 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:39:10:39:20 | test.cpp:39:10:39:20 |
+| test.cpp:49:12:49:12 | Load: x | test.cpp:46:22:46:22 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:48:9:48:13 | test.cpp:48:9:48:13 |
+| test.cpp:49:12:49:12 | Load: x | test.cpp:46:29:46:29 | ValueNumberBound | -2 | true | CompareLT: ... < ... | test.cpp:48:9:48:13 | test.cpp:48:9:48:13 |
+| test.cpp:54:12:54:12 | Load: x | test.cpp:46:22:46:22 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:52:7:52:11 | test.cpp:52:7:52:11 |
+| test.cpp:62:10:62:13 | Load: iter | test.cpp:60:17:60:17 | ValueNumberBound | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:62:10:62:13 | Load: iter | test.cpp:60:17:60:17 | ValueNumberBound | 3 | true | CompareLT: ... < ... | test.cpp:61:32:61:51 | test.cpp:61:32:61:51 |
+| test.cpp:62:10:62:13 | Load: iter | test.cpp:61:39:61:51 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:61:32:61:51 | test.cpp:61:32:61:51 |
+| test.cpp:62:10:62:13 | Load: iter | test.cpp:61:48:61:50 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:61:32:61:51 | test.cpp:61:32:61:51 |
+| test.cpp:67:10:67:13 | Load: iter | test.cpp:60:17:60:17 | ValueNumberBound | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:67:10:67:13 | Load: iter | test.cpp:60:17:60:17 | ValueNumberBound | 3 | true | CompareLT: ... < ... | test.cpp:66:32:66:41 | test.cpp:66:32:66:41 |
+| test.cpp:67:10:67:13 | Load: iter | test.cpp:61:32:61:35 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:66:32:66:41 | test.cpp:66:32:66:41 |
+| test.cpp:67:10:67:13 | Load: iter | test.cpp:61:39:61:51 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:66:32:66:41 | test.cpp:66:32:66:41 |
+| test.cpp:67:10:67:13 | Load: iter | test.cpp:61:48:61:50 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:66:32:66:41 | test.cpp:66:32:66:41 |
 | test.cpp:77:12:77:12 | Load: i | file://:0:0:0:0 | 0 | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:77:12:77:12 | Load: i | test.cpp:72:15:72:15 | InitializeParameter: x | -1 | true | CompareLT: ... < ... | test.cpp:76:20:76:24 | test.cpp:76:20:76:24 |
-| test.cpp:77:12:77:12 | Load: i | test.cpp:72:22:72:22 | InitializeParameter: y | -1 | true | CompareLT: ... < ... | test.cpp:76:20:76:24 | test.cpp:76:20:76:24 |
+| test.cpp:77:12:77:12 | Load: i | test.cpp:72:15:72:15 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:76:20:76:24 | test.cpp:76:20:76:24 |
+| test.cpp:77:12:77:12 | Load: i | test.cpp:72:22:72:22 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:76:20:76:24 | test.cpp:76:20:76:24 |
 | test.cpp:85:10:85:10 | Load: x | file://:0:0:0:0 | 0 | 2 | false | CompareGT: ... > ... | test.cpp:84:7:84:11 | test.cpp:84:7:84:11 |
 | test.cpp:87:10:87:10 | Load: x | file://:0:0:0:0 | 0 | 1 | true | CompareGT: ... > ... | test.cpp:84:7:84:11 | test.cpp:84:7:84:11 |
 | test.cpp:90:10:90:10 | Load: x | file://:0:0:0:0 | 0 | 1 | false | CompareGE: ... >= ... | test.cpp:89:7:89:12 | test.cpp:89:7:89:12 |
@@ -35,32 +37,32 @@
 | test.cpp:97:10:97:10 | Load: x | file://:0:0:0:0 | 0 | 1 | false | CompareLT: ... < ... | test.cpp:94:7:94:11 | test.cpp:94:7:94:11 |
 | test.cpp:100:10:100:10 | Load: x | file://:0:0:0:0 | 0 | 1 | true | CompareLE: ... <= ... | test.cpp:99:7:99:12 | test.cpp:99:7:99:12 |
 | test.cpp:102:10:102:10 | Load: x | file://:0:0:0:0 | 0 | 2 | false | CompareLE: ... <= ... | test.cpp:99:7:99:12 | test.cpp:99:7:99:12 |
-| test.cpp:117:10:117:10 | Load: i | test.cpp:114:3:114:6 | Phi: call to sink | -1 | true | CompareLT: ... < ... | test.cpp:116:7:116:11 | test.cpp:116:7:116:11 |
+| test.cpp:117:10:117:10 | Load: i | test.cpp:114:3:114:6 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:116:7:116:11 | test.cpp:116:7:116:11 |
 | test.cpp:130:10:130:10 | Load: i | file://:0:0:0:0 | 0 | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
 | test.cpp:140:10:140:10 | Store: i | file://:0:0:0:0 | 0 | 1 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:140:10:140:10 | Store: i | test.cpp:135:16:135:16 | InitializeParameter: x | 0 | false | CompareLT: ... < ... | test.cpp:139:11:139:15 | test.cpp:139:11:139:15 |
-| test.cpp:140:10:140:10 | Store: i | test.cpp:138:5:138:5 | Phi: i | 1 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:140:10:140:10 | Store: i | test.cpp:138:5:138:5 | Phi: i | 1 | true | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:156:12:156:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | -1 | false | CompareEQ: ... == ... | test.cpp:155:9:155:16 | test.cpp:155:9:155:16 |
-| test.cpp:156:12:156:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | -1 | true | CompareEQ: ... == ... | test.cpp:155:9:155:16 | test.cpp:155:9:155:16 |
-| test.cpp:156:12:156:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | -1 | true | CompareLT: ... < ... | test.cpp:154:6:154:10 | test.cpp:154:6:154:10 |
-| test.cpp:158:12:158:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | -2 | true | CompareEQ: ... == ... | test.cpp:155:9:155:16 | test.cpp:155:9:155:16 |
-| test.cpp:158:12:158:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | -2 | true | CompareLT: ... < ... | test.cpp:154:6:154:10 | test.cpp:154:6:154:10 |
-| test.cpp:161:12:161:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | -2 | true | CompareLT: ... < ... | test.cpp:154:6:154:10 | test.cpp:154:6:154:10 |
-| test.cpp:161:12:161:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | -2 | true | CompareNE: ... != ... | test.cpp:160:9:160:16 | test.cpp:160:9:160:16 |
-| test.cpp:163:12:163:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | -1 | false | CompareNE: ... != ... | test.cpp:160:9:160:16 | test.cpp:160:9:160:16 |
-| test.cpp:163:12:163:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | -1 | true | CompareLT: ... < ... | test.cpp:154:6:154:10 | test.cpp:154:6:154:10 |
-| test.cpp:163:12:163:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | -1 | true | CompareNE: ... != ... | test.cpp:160:9:160:16 | test.cpp:160:9:160:16 |
-| test.cpp:167:12:167:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | 1 | false | CompareEQ: ... == ... | test.cpp:166:9:166:16 | test.cpp:166:9:166:16 |
-| test.cpp:167:12:167:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | 1 | true | CompareEQ: ... == ... | test.cpp:166:9:166:16 | test.cpp:166:9:166:16 |
-| test.cpp:169:12:169:12 | Load: x | test.cpp:153:23:153:23 | InitializeParameter: y | 0 | false | CompareLT: ... < ... | test.cpp:154:6:154:10 | test.cpp:154:6:154:10 |
-| test.cpp:177:10:177:10 | Load: i | test.cpp:175:23:175:23 | InitializeParameter: x | 1 | false | CompareLT: ... < ... | test.cpp:176:7:176:11 | test.cpp:176:7:176:11 |
-| test.cpp:179:10:179:10 | Load: i | test.cpp:175:23:175:23 | InitializeParameter: x | 0 | true | CompareLT: ... < ... | test.cpp:176:7:176:11 | test.cpp:176:7:176:11 |
-| test.cpp:183:10:183:10 | Load: i | test.cpp:175:23:175:23 | InitializeParameter: x | -1 | true | CompareLT: ... < ... | test.cpp:182:9:182:13 | test.cpp:182:9:182:13 |
-| test.cpp:185:10:185:10 | Load: i | test.cpp:175:23:175:23 | InitializeParameter: x | 0 | true | CompareLT: ... < ... | test.cpp:176:7:176:11 | test.cpp:176:7:176:11 |
-| test.cpp:187:10:187:10 | Store: i | test.cpp:175:23:175:23 | InitializeParameter: x | 0 | false | CompareLT: ... < ... | test.cpp:182:9:182:13 | test.cpp:182:9:182:13 |
-| test.cpp:194:8:194:8 | Load: l | test.cpp:191:16:191:16 | InitializeParameter: i | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:194:8:194:8 | Load: l | test.cpp:191:16:191:16 | InitializeParameter: i | 0 | true | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
-| test.cpp:200:10:200:10 | Load: i | test.cpp:198:25:198:25 | InitializeParameter: l | -1 | true | CompareLT: ... < ... | test.cpp:199:7:199:11 | test.cpp:199:7:199:11 |
-| test.cpp:203:11:203:11 | Load: i | test.cpp:198:25:198:25 | InitializeParameter: l | -3 | true | CompareLT: ... < ... | test.cpp:202:7:202:15 | test.cpp:202:7:202:15 |
-| test.cpp:209:10:209:10 | Load: x | test.cpp:207:24:207:24 | InitializeParameter: y | -3 | true | CompareLT: ... < ... | test.cpp:208:7:208:15 | test.cpp:208:7:208:15 |
+| test.cpp:140:10:140:10 | Store: i | test.cpp:135:16:135:16 | ValueNumberBound | 0 | false | CompareLT: ... < ... | test.cpp:139:11:139:15 | test.cpp:139:11:139:15 |
+| test.cpp:140:10:140:10 | Store: i | test.cpp:138:5:138:5 | ValueNumberBound | 1 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:140:10:140:10 | Store: i | test.cpp:138:5:138:5 | ValueNumberBound | 1 | true | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:156:12:156:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | -1 | false | CompareEQ: ... == ... | test.cpp:155:9:155:16 | test.cpp:155:9:155:16 |
+| test.cpp:156:12:156:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | -1 | true | CompareEQ: ... == ... | test.cpp:155:9:155:16 | test.cpp:155:9:155:16 |
+| test.cpp:156:12:156:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:154:6:154:10 | test.cpp:154:6:154:10 |
+| test.cpp:158:12:158:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | -2 | true | CompareEQ: ... == ... | test.cpp:155:9:155:16 | test.cpp:155:9:155:16 |
+| test.cpp:158:12:158:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | -2 | true | CompareLT: ... < ... | test.cpp:154:6:154:10 | test.cpp:154:6:154:10 |
+| test.cpp:161:12:161:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | -2 | true | CompareLT: ... < ... | test.cpp:154:6:154:10 | test.cpp:154:6:154:10 |
+| test.cpp:161:12:161:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | -2 | true | CompareNE: ... != ... | test.cpp:160:9:160:16 | test.cpp:160:9:160:16 |
+| test.cpp:163:12:163:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | -1 | false | CompareNE: ... != ... | test.cpp:160:9:160:16 | test.cpp:160:9:160:16 |
+| test.cpp:163:12:163:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:154:6:154:10 | test.cpp:154:6:154:10 |
+| test.cpp:163:12:163:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | -1 | true | CompareNE: ... != ... | test.cpp:160:9:160:16 | test.cpp:160:9:160:16 |
+| test.cpp:167:12:167:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | 1 | false | CompareEQ: ... == ... | test.cpp:166:9:166:16 | test.cpp:166:9:166:16 |
+| test.cpp:167:12:167:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | 1 | true | CompareEQ: ... == ... | test.cpp:166:9:166:16 | test.cpp:166:9:166:16 |
+| test.cpp:169:12:169:12 | Load: x | test.cpp:153:23:153:23 | ValueNumberBound | 0 | false | CompareLT: ... < ... | test.cpp:154:6:154:10 | test.cpp:154:6:154:10 |
+| test.cpp:177:10:177:10 | Load: i | test.cpp:175:23:175:23 | ValueNumberBound | 1 | false | CompareLT: ... < ... | test.cpp:176:7:176:11 | test.cpp:176:7:176:11 |
+| test.cpp:179:10:179:10 | Load: i | test.cpp:175:23:175:23 | ValueNumberBound | 0 | true | CompareLT: ... < ... | test.cpp:176:7:176:11 | test.cpp:176:7:176:11 |
+| test.cpp:183:10:183:10 | Load: i | test.cpp:175:23:175:23 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:182:9:182:13 | test.cpp:182:9:182:13 |
+| test.cpp:185:10:185:10 | Load: i | test.cpp:175:23:175:23 | ValueNumberBound | 0 | true | CompareLT: ... < ... | test.cpp:176:7:176:11 | test.cpp:176:7:176:11 |
+| test.cpp:187:10:187:10 | Store: i | test.cpp:175:23:175:23 | ValueNumberBound | 0 | false | CompareLT: ... < ... | test.cpp:182:9:182:13 | test.cpp:182:9:182:13 |
+| test.cpp:194:8:194:8 | Load: l | test.cpp:191:16:191:16 | ValueNumberBound | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:194:8:194:8 | Load: l | test.cpp:191:16:191:16 | ValueNumberBound | 0 | true | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
+| test.cpp:200:10:200:10 | Load: i | test.cpp:198:25:198:25 | ValueNumberBound | -1 | true | CompareLT: ... < ... | test.cpp:199:7:199:11 | test.cpp:199:7:199:11 |
+| test.cpp:203:11:203:11 | Load: i | test.cpp:198:25:198:25 | ValueNumberBound | -3 | true | CompareLT: ... < ... | test.cpp:202:7:202:15 | test.cpp:202:7:202:15 |
+| test.cpp:209:10:209:10 | Load: x | test.cpp:207:24:207:24 | ValueNumberBound | -3 | true | CompareLT: ... < ... | test.cpp:208:7:208:15 | test.cpp:208:7:208:15 |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/OverrunWriteProductFlow.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/OverrunWriteProductFlow.expected
new file mode 100644
index 00000000000..dedb1d72a38
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/OverrunWriteProductFlow.expected
@@ -0,0 +1,2 @@
+| test.cpp:19:19:19:24 | call to malloc | test.cpp:18:17:18:20 | size | test.cpp:26:18:26:23 | Load | test.cpp:26:31:26:39 | Convert |
+| test.cpp:19:19:19:24 | call to malloc | test.cpp:18:17:18:20 | size | test.cpp:30:18:30:23 | Load | test.cpp:30:31:30:39 | Convert |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/OverrunWriteProductFlow.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/OverrunWriteProductFlow.qlref
new file mode 100644
index 00000000000..21ced45de5d
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/OverrunWriteProductFlow.qlref
@@ -0,0 +1 @@
+experimental/Likely Bugs/OverrunWriteProductFlow.ql
\ No newline at end of file
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/test.cpp
new file mode 100644
index 00000000000..670b43f672e
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/test.cpp
@@ -0,0 +1,37 @@
+
+typedef unsigned long long size_t;
+int sprintf(char *s, const char *format, ...);
+int snprintf(char *s, size_t n, const char *format, ...);
+int scanf(const char *format, ...);
+int sscanf(const char *s, const char *format, ...);
+char *malloc(size_t size);
+char *strncpy(char *dst, const char *src, size_t n);
+
+typedef struct
+{
+	char *string;
+	int size;
+} string_t;
+
+string_t *mk_string_t(int size) {
+    string_t *str = (string_t *) malloc(sizeof(string_t));
+    str->size = size;
+    str->string = malloc(size);
+    return str;
+}
+
+void test1(int size, char *buf) {
+    string_t *str = mk_string_t(size);
+
+    strncpy(str->string, buf, str->size);
+}
+
+void strncpy_wrapper(string_t *str, char *buf) {
+    strncpy(str->string, buf, str->size);
+}
+
+void test2(int size, char *buf) {
+    string_t *str = mk_string_t(size);
+    strncpy_wrapper(str, buf);
+}
+
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.expected
new file mode 100644
index 00000000000..8b82181b9f7
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.expected
@@ -0,0 +1,20 @@
+| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:10:9:10:11 | Load | test.cpp:5:25:5:28 | Load |
+| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:10:9:10:11 | Load | test.cpp:9:26:9:29 | Load |
+| test.cpp:4:17:4:22 | call to malloc | test.cpp:5:25:5:28 | size | test.cpp:10:9:10:11 | Load | test.cpp:5:25:5:28 | Load |
+| test.cpp:4:17:4:22 | call to malloc | test.cpp:5:25:5:28 | size | test.cpp:10:9:10:11 | Load | test.cpp:9:26:9:29 | Load |
+| test.cpp:4:17:4:22 | call to malloc | test.cpp:9:26:9:29 | size | test.cpp:10:9:10:11 | Load | test.cpp:9:26:9:29 | Load |
+| test.cpp:22:13:22:18 | call to malloc | test.cpp:21:16:21:19 | size | test.cpp:35:13:35:13 | Load | test.cpp:30:29:30:32 | Load |
+| test.cpp:22:13:22:18 | call to malloc | test.cpp:21:16:21:19 | size | test.cpp:35:13:35:13 | Load | test.cpp:34:30:34:33 | Load |
+| test.cpp:22:13:22:18 | call to malloc | test.cpp:21:16:21:19 | size | test.cpp:45:13:45:13 | Load | test.cpp:40:29:40:32 | Load |
+| test.cpp:22:13:22:18 | call to malloc | test.cpp:21:16:21:19 | size | test.cpp:45:13:45:13 | Load | test.cpp:44:30:44:33 | Load |
+| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:63:13:63:13 | Load | test.cpp:55:5:55:19 | Store |
+| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:63:13:63:13 | Load | test.cpp:55:5:55:19 | Store |
+| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:63:13:63:13 | Load | test.cpp:55:16:55:19 | Load |
+| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:63:13:63:13 | Load | test.cpp:56:20:56:23 | Load |
+| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:63:13:63:13 | Load | test.cpp:58:29:58:32 | Load |
+| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:63:13:63:13 | Load | test.cpp:62:30:62:33 | Load |
+| test.cpp:56:13:56:18 | call to malloc | test.cpp:58:29:58:32 | size | test.cpp:63:13:63:13 | Load | test.cpp:58:29:58:32 | Load |
+| test.cpp:56:13:56:18 | call to malloc | test.cpp:62:30:62:33 | size | test.cpp:63:13:63:13 | Load | test.cpp:62:30:62:33 | Load |
+| test.cpp:70:14:70:19 | call to malloc | test.cpp:69:17:69:20 | size | test.cpp:83:14:83:14 | Load | test.cpp:82:31:82:34 | Load |
+| test.cpp:70:14:70:19 | call to malloc | test.cpp:69:17:69:20 | size | test.cpp:93:14:93:14 | Load | test.cpp:88:30:88:33 | Load |
+| test.cpp:70:14:70:19 | call to malloc | test.cpp:69:17:69:20 | size | test.cpp:93:14:93:14 | Load | test.cpp:92:31:92:34 | Load |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref
new file mode 100644
index 00000000000..8186dd0721b
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref
@@ -0,0 +1 @@
+experimental/Likely Bugs/ArrayAccessProductFlow.ql
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp
new file mode 100644
index 00000000000..f35379db3e4
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp
@@ -0,0 +1,110 @@
+char *malloc(int size);
+
+void test1(int size) {
+    char *arr = malloc(size);
+    for (int i = 0; i < size; i++) {
+        arr[i] = 0; // GOOD
+    }
+
+    for (int i = 0; i <= size; i++) {
+        arr[i] = i; // BAD
+    }
+}
+
+typedef struct {
+    int size;
+    char *p;
+} array_t;
+
+array_t mk_array(int size) {
+    array_t arr;
+    arr.size = size;
+    arr.p = malloc(size);
+
+    return arr;
+}
+
+void test2(int size) {
+    array_t arr = mk_array(size);
+
+    for (int i = 0; i < arr.size; i++) {
+        arr.p[i] = 0; // GOOD
+    }
+
+    for (int i = 0; i <= arr.size; i++) {
+        arr.p[i] = i; // BAD
+    }
+}
+
+void test3_callee(array_t arr) {
+    for (int i = 0; i < arr.size; i++) {
+        arr.p[i] = 0; // GOOD
+    }
+
+    for (int i = 0; i <= arr.size; i++) {
+        arr.p[i] = i; // BAD
+    }
+}
+
+void test3(int size) {
+    test3_callee(mk_array(size));
+}
+
+void test4(int size) {
+    array_t arr;
+    arr.size = size;
+    arr.p = malloc(size);
+
+    for (int i = 0; i < arr.size; i++) {
+        arr.p[i] = 0; // GOOD
+    }
+
+    for (int i = 0; i <= arr.size; i++) {
+        arr.p[i] = i; // BAD
+    }
+}
+
+array_t *mk_array_p(int size) {
+    array_t *arr = (array_t*) malloc(sizeof(array_t));
+    arr->size = size;
+    arr->p = malloc(size);
+
+    return arr;
+}
+
+void test5(int size) {
+    array_t *arr = mk_array_p(size);
+
+    for (int i = 0; i < arr->size; i++) {
+        arr->p[i] = 0; // GOOD
+    }
+
+    for (int i = 0; i <= arr->size; i++) {
+        arr->p[i] = i; // BAD
+    }
+}
+
+void test6_callee(array_t *arr) {
+    for (int i = 0; i < arr->size; i++) {
+        arr->p[i] = 0; // GOOD
+    }
+
+    for (int i = 0; i <= arr->size; i++) {
+        arr->p[i] = i; // BAD
+    }
+}
+
+void test6(int size) {
+    test6_callee(mk_array_p(size));
+}
+
+void test7(int size) {
+    char *arr = malloc(size);
+    for (char *p = arr; p < arr + size; p++) {
+        *p = 0; // GOOD
+    }
+
+    for (char *p = arr; p <= arr + size; p++) {
+        *p = 0; // BAD [NOT DETECTED]
+    }
+}
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected
new file mode 100644
index 00000000000..494713b124b
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected
@@ -0,0 +1,627 @@
+edges
+| test.cpp:4:15:4:20 | call to malloc | test.cpp:5:15:5:15 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:5:15:5:22 | ... + ... |
+| test.cpp:5:15:5:15 | Load | test.cpp:5:15:5:22 | ... + ... |
+| test.cpp:5:15:5:15 | Load | test.cpp:5:15:5:22 | ... + ... |
+| test.cpp:5:15:5:15 | Load | test.cpp:5:15:5:22 | ... + ... |
+| test.cpp:5:15:5:15 | Load | test.cpp:5:15:5:22 | Store |
+| test.cpp:5:15:5:15 | Load | test.cpp:5:15:5:22 | Store |
+| test.cpp:5:15:5:15 | Load | test.cpp:5:15:5:22 | Store |
+| test.cpp:5:15:5:15 | Load | test.cpp:5:15:5:22 | Store |
+| test.cpp:5:15:5:15 | Load | test.cpp:6:15:6:15 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:6:15:6:15 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:6:15:6:15 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:6:15:6:15 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:7:16:7:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:7:16:7:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:7:16:7:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:7:16:7:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:8:16:8:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:8:16:8:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:8:16:8:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:8:16:8:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:8:16:8:20 | ... + ... |
+| test.cpp:5:15:5:15 | Load | test.cpp:8:16:8:20 | ... + ... |
+| test.cpp:5:15:5:15 | Load | test.cpp:8:16:8:20 | ... + ... |
+| test.cpp:5:15:5:15 | Load | test.cpp:8:16:8:20 | ... + ... |
+| test.cpp:5:15:5:15 | Load | test.cpp:9:16:9:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:9:16:9:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:9:16:9:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:9:16:9:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:12:16:12:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:12:16:12:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:12:16:12:16 | Load |
+| test.cpp:5:15:5:15 | Load | test.cpp:12:16:12:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:5:15:5:22 | Store |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:5:15:5:22 | Store |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:6:15:6:15 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:6:15:6:15 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:7:16:7:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:7:16:7:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:8:16:8:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:8:16:8:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:9:16:9:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:9:16:9:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:10:16:10:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:10:16:10:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:11:16:11:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:11:16:11:16 | Load |
+| test.cpp:5:15:5:22 | ... + ... | test.cpp:12:16:12:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:5:15:5:22 | Store | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:5:15:5:22 | Store | test.cpp:6:15:6:15 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:6:15:6:15 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:7:16:7:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:7:16:7:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:5:15:5:22 | Store | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:5:15:5:22 | Store | test.cpp:8:16:8:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:8:16:8:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:9:16:9:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:9:16:9:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:10:16:10:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:10:16:10:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:11:16:11:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:11:16:11:16 | Load |
+| test.cpp:5:15:5:22 | Store | test.cpp:12:16:12:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:6:15:6:15 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:6:15:6:15 | Load | test.cpp:7:16:7:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:7:16:7:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:6:15:6:15 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:6:15:6:15 | Load | test.cpp:8:16:8:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:8:16:8:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:9:16:9:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:9:16:9:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:6:15:6:15 | Load | test.cpp:12:16:12:16 | Load |
+| test.cpp:7:16:7:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:7:16:7:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:7:16:7:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:7:16:7:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:7:16:7:16 | Load | test.cpp:8:16:8:16 | Load |
+| test.cpp:7:16:7:16 | Load | test.cpp:8:16:8:16 | Load |
+| test.cpp:7:16:7:16 | Load | test.cpp:9:16:9:16 | Load |
+| test.cpp:7:16:7:16 | Load | test.cpp:9:16:9:16 | Load |
+| test.cpp:7:16:7:16 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:7:16:7:16 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:7:16:7:16 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:7:16:7:16 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:7:16:7:16 | Load | test.cpp:12:16:12:16 | Load |
+| test.cpp:8:16:8:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:8:16:8:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:8:16:8:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:8:16:8:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:8:16:8:16 | Load | test.cpp:9:16:9:16 | Load |
+| test.cpp:8:16:8:16 | Load | test.cpp:9:16:9:16 | Load |
+| test.cpp:8:16:8:16 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:8:16:8:16 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:8:16:8:16 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:8:16:8:16 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:8:16:8:16 | Load | test.cpp:12:16:12:16 | Load |
+| test.cpp:8:16:8:20 | ... + ... | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:8:16:8:20 | ... + ... | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:9:16:9:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:9:16:9:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:9:16:9:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:9:16:9:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:9:16:9:16 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:9:16:9:16 | Load | test.cpp:10:16:10:16 | Load |
+| test.cpp:9:16:9:16 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:9:16:9:16 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:9:16:9:16 | Load | test.cpp:12:16:12:16 | Load |
+| test.cpp:10:16:10:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:10:16:10:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:10:16:10:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:10:16:10:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:10:16:10:16 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:10:16:10:16 | Load | test.cpp:11:16:11:16 | Load |
+| test.cpp:10:16:10:16 | Load | test.cpp:12:16:12:16 | Load |
+| test.cpp:11:16:11:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:11:16:11:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:11:16:11:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:11:16:11:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:11:16:11:16 | Load | test.cpp:12:16:12:16 | Load |
+| test.cpp:12:16:12:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:12:16:12:16 | Load | test.cpp:6:14:6:15 | Load: * ... |
+| test.cpp:12:16:12:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:12:16:12:16 | Load | test.cpp:8:14:8:21 | Load: * ... |
+| test.cpp:16:15:16:20 | call to malloc | test.cpp:17:15:17:15 | Load |
+| test.cpp:17:15:17:15 | Load | test.cpp:17:15:17:22 | ... + ... |
+| test.cpp:17:15:17:15 | Load | test.cpp:17:15:17:22 | ... + ... |
+| test.cpp:17:15:17:15 | Load | test.cpp:17:15:17:22 | ... + ... |
+| test.cpp:17:15:17:15 | Load | test.cpp:17:15:17:22 | ... + ... |
+| test.cpp:17:15:17:15 | Load | test.cpp:20:16:20:20 | ... + ... |
+| test.cpp:17:15:17:15 | Load | test.cpp:20:16:20:20 | ... + ... |
+| test.cpp:17:15:17:15 | Load | test.cpp:20:16:20:20 | ... + ... |
+| test.cpp:17:15:17:15 | Load | test.cpp:20:16:20:20 | ... + ... |
+| test.cpp:17:15:17:22 | ... + ... | test.cpp:20:14:20:21 | Load: * ... |
+| test.cpp:17:15:17:22 | ... + ... | test.cpp:20:14:20:21 | Load: * ... |
+| test.cpp:20:16:20:20 | ... + ... | test.cpp:20:14:20:21 | Load: * ... |
+| test.cpp:20:16:20:20 | ... + ... | test.cpp:20:14:20:21 | Load: * ... |
+| test.cpp:28:15:28:20 | call to malloc | test.cpp:29:15:29:15 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:29:15:29:28 | ... + ... |
+| test.cpp:29:15:29:15 | Load | test.cpp:29:15:29:28 | ... + ... |
+| test.cpp:29:15:29:15 | Load | test.cpp:29:15:29:28 | ... + ... |
+| test.cpp:29:15:29:15 | Load | test.cpp:29:15:29:28 | ... + ... |
+| test.cpp:29:15:29:15 | Load | test.cpp:29:15:29:28 | Store |
+| test.cpp:29:15:29:15 | Load | test.cpp:29:15:29:28 | Store |
+| test.cpp:29:15:29:15 | Load | test.cpp:29:15:29:28 | Store |
+| test.cpp:29:15:29:15 | Load | test.cpp:29:15:29:28 | Store |
+| test.cpp:29:15:29:15 | Load | test.cpp:30:15:30:15 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:30:15:30:15 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:30:15:30:15 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:30:15:30:15 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:31:16:31:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:31:16:31:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:31:16:31:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:31:16:31:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:32:16:32:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:32:16:32:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:32:16:32:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:32:16:32:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:32:16:32:20 | ... + ... |
+| test.cpp:29:15:29:15 | Load | test.cpp:32:16:32:20 | ... + ... |
+| test.cpp:29:15:29:15 | Load | test.cpp:32:16:32:20 | ... + ... |
+| test.cpp:29:15:29:15 | Load | test.cpp:32:16:32:20 | ... + ... |
+| test.cpp:29:15:29:15 | Load | test.cpp:33:16:33:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:33:16:33:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:33:16:33:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:33:16:33:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:36:16:36:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:36:16:36:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:36:16:36:16 | Load |
+| test.cpp:29:15:29:15 | Load | test.cpp:36:16:36:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:29:15:29:28 | Store |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:29:15:29:28 | Store |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:30:15:30:15 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:30:15:30:15 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:31:16:31:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:31:16:31:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:32:16:32:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:32:16:32:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:33:16:33:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:33:16:33:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:34:16:34:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:34:16:34:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:35:16:35:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:35:16:35:16 | Load |
+| test.cpp:29:15:29:28 | ... + ... | test.cpp:36:16:36:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:29:15:29:28 | Store | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:29:15:29:28 | Store | test.cpp:30:15:30:15 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:30:15:30:15 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:31:16:31:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:31:16:31:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:29:15:29:28 | Store | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:29:15:29:28 | Store | test.cpp:32:16:32:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:32:16:32:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:33:16:33:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:33:16:33:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:34:16:34:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:34:16:34:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:35:16:35:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:35:16:35:16 | Load |
+| test.cpp:29:15:29:28 | Store | test.cpp:36:16:36:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:30:15:30:15 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:30:15:30:15 | Load | test.cpp:31:16:31:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:31:16:31:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:30:15:30:15 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:30:15:30:15 | Load | test.cpp:32:16:32:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:32:16:32:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:33:16:33:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:33:16:33:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:30:15:30:15 | Load | test.cpp:36:16:36:16 | Load |
+| test.cpp:31:16:31:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:31:16:31:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:31:16:31:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:31:16:31:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:31:16:31:16 | Load | test.cpp:32:16:32:16 | Load |
+| test.cpp:31:16:31:16 | Load | test.cpp:32:16:32:16 | Load |
+| test.cpp:31:16:31:16 | Load | test.cpp:33:16:33:16 | Load |
+| test.cpp:31:16:31:16 | Load | test.cpp:33:16:33:16 | Load |
+| test.cpp:31:16:31:16 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:31:16:31:16 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:31:16:31:16 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:31:16:31:16 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:31:16:31:16 | Load | test.cpp:36:16:36:16 | Load |
+| test.cpp:32:16:32:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:32:16:32:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:32:16:32:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:32:16:32:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:32:16:32:16 | Load | test.cpp:33:16:33:16 | Load |
+| test.cpp:32:16:32:16 | Load | test.cpp:33:16:33:16 | Load |
+| test.cpp:32:16:32:16 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:32:16:32:16 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:32:16:32:16 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:32:16:32:16 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:32:16:32:16 | Load | test.cpp:36:16:36:16 | Load |
+| test.cpp:32:16:32:20 | ... + ... | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:32:16:32:20 | ... + ... | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:33:16:33:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:33:16:33:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:33:16:33:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:33:16:33:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:33:16:33:16 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:33:16:33:16 | Load | test.cpp:34:16:34:16 | Load |
+| test.cpp:33:16:33:16 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:33:16:33:16 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:33:16:33:16 | Load | test.cpp:36:16:36:16 | Load |
+| test.cpp:34:16:34:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:34:16:34:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:34:16:34:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:34:16:34:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:34:16:34:16 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:34:16:34:16 | Load | test.cpp:35:16:35:16 | Load |
+| test.cpp:34:16:34:16 | Load | test.cpp:36:16:36:16 | Load |
+| test.cpp:35:16:35:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:35:16:35:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:35:16:35:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:35:16:35:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:35:16:35:16 | Load | test.cpp:36:16:36:16 | Load |
+| test.cpp:36:16:36:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:36:16:36:16 | Load | test.cpp:30:14:30:15 | Load: * ... |
+| test.cpp:36:16:36:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:36:16:36:16 | Load | test.cpp:32:14:32:21 | Load: * ... |
+| test.cpp:40:15:40:20 | call to malloc | test.cpp:41:15:41:15 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:41:15:41:28 | ... + ... |
+| test.cpp:41:15:41:15 | Load | test.cpp:41:15:41:28 | ... + ... |
+| test.cpp:41:15:41:15 | Load | test.cpp:41:15:41:28 | ... + ... |
+| test.cpp:41:15:41:15 | Load | test.cpp:41:15:41:28 | ... + ... |
+| test.cpp:41:15:41:15 | Load | test.cpp:41:15:41:28 | Store |
+| test.cpp:41:15:41:15 | Load | test.cpp:41:15:41:28 | Store |
+| test.cpp:41:15:41:15 | Load | test.cpp:41:15:41:28 | Store |
+| test.cpp:41:15:41:15 | Load | test.cpp:41:15:41:28 | Store |
+| test.cpp:41:15:41:15 | Load | test.cpp:42:15:42:15 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:42:15:42:15 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:42:15:42:15 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:42:15:42:15 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:43:16:43:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:43:16:43:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:43:16:43:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:43:16:43:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:44:16:44:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:44:16:44:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:44:16:44:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:44:16:44:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:44:16:44:20 | ... + ... |
+| test.cpp:41:15:41:15 | Load | test.cpp:44:16:44:20 | ... + ... |
+| test.cpp:41:15:41:15 | Load | test.cpp:44:16:44:20 | ... + ... |
+| test.cpp:41:15:41:15 | Load | test.cpp:44:16:44:20 | ... + ... |
+| test.cpp:41:15:41:15 | Load | test.cpp:45:16:45:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:45:16:45:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:45:16:45:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:45:16:45:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:48:16:48:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:48:16:48:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:48:16:48:16 | Load |
+| test.cpp:41:15:41:15 | Load | test.cpp:48:16:48:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:41:15:41:28 | Store |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:41:15:41:28 | Store |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:42:15:42:15 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:42:15:42:15 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:43:16:43:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:43:16:43:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:44:16:44:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:44:16:44:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:45:16:45:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:45:16:45:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:46:16:46:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:46:16:46:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:47:16:47:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:47:16:47:16 | Load |
+| test.cpp:41:15:41:28 | ... + ... | test.cpp:48:16:48:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:41:15:41:28 | Store | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:41:15:41:28 | Store | test.cpp:42:15:42:15 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:42:15:42:15 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:43:16:43:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:43:16:43:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:41:15:41:28 | Store | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:41:15:41:28 | Store | test.cpp:44:16:44:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:44:16:44:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:45:16:45:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:45:16:45:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:46:16:46:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:46:16:46:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:47:16:47:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:47:16:47:16 | Load |
+| test.cpp:41:15:41:28 | Store | test.cpp:48:16:48:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:42:15:42:15 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:42:15:42:15 | Load | test.cpp:43:16:43:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:43:16:43:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:42:15:42:15 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:42:15:42:15 | Load | test.cpp:44:16:44:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:44:16:44:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:45:16:45:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:45:16:45:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:42:15:42:15 | Load | test.cpp:48:16:48:16 | Load |
+| test.cpp:43:16:43:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:43:16:43:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:43:16:43:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:43:16:43:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:43:16:43:16 | Load | test.cpp:44:16:44:16 | Load |
+| test.cpp:43:16:43:16 | Load | test.cpp:44:16:44:16 | Load |
+| test.cpp:43:16:43:16 | Load | test.cpp:45:16:45:16 | Load |
+| test.cpp:43:16:43:16 | Load | test.cpp:45:16:45:16 | Load |
+| test.cpp:43:16:43:16 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:43:16:43:16 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:43:16:43:16 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:43:16:43:16 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:43:16:43:16 | Load | test.cpp:48:16:48:16 | Load |
+| test.cpp:44:16:44:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:44:16:44:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:44:16:44:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:44:16:44:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:44:16:44:16 | Load | test.cpp:45:16:45:16 | Load |
+| test.cpp:44:16:44:16 | Load | test.cpp:45:16:45:16 | Load |
+| test.cpp:44:16:44:16 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:44:16:44:16 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:44:16:44:16 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:44:16:44:16 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:44:16:44:16 | Load | test.cpp:48:16:48:16 | Load |
+| test.cpp:44:16:44:20 | ... + ... | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:44:16:44:20 | ... + ... | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:45:16:45:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:45:16:45:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:45:16:45:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:45:16:45:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:45:16:45:16 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:45:16:45:16 | Load | test.cpp:46:16:46:16 | Load |
+| test.cpp:45:16:45:16 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:45:16:45:16 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:45:16:45:16 | Load | test.cpp:48:16:48:16 | Load |
+| test.cpp:46:16:46:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:46:16:46:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:46:16:46:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:46:16:46:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:46:16:46:16 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:46:16:46:16 | Load | test.cpp:47:16:47:16 | Load |
+| test.cpp:46:16:46:16 | Load | test.cpp:48:16:48:16 | Load |
+| test.cpp:47:16:47:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:47:16:47:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:47:16:47:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:47:16:47:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:47:16:47:16 | Load | test.cpp:48:16:48:16 | Load |
+| test.cpp:48:16:48:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:48:16:48:16 | Load | test.cpp:42:14:42:15 | Load: * ... |
+| test.cpp:48:16:48:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:48:16:48:16 | Load | test.cpp:44:14:44:21 | Load: * ... |
+| test.cpp:51:7:51:14 | VariableAddress indirection | test.cpp:62:39:62:39 | Load |
+| test.cpp:51:7:51:14 | VariableAddress indirection | test.cpp:66:39:66:39 | Load |
+| test.cpp:51:7:51:14 | VariableAddress indirection | test.cpp:70:38:70:38 | Load |
+| test.cpp:51:33:51:35 | Load indirection | test.cpp:60:34:60:37 | mk_array output argument |
+| test.cpp:52:19:52:24 | call to malloc | test.cpp:51:7:51:14 | VariableAddress indirection |
+| test.cpp:52:19:52:24 | call to malloc | test.cpp:53:12:53:16 | Load |
+| test.cpp:53:5:53:23 | Store | test.cpp:51:33:51:35 | Load indirection |
+| test.cpp:53:12:53:16 | Load | test.cpp:53:5:53:23 | Store |
+| test.cpp:53:12:53:16 | Load | test.cpp:53:5:53:23 | Store |
+| test.cpp:53:12:53:16 | Load | test.cpp:53:12:53:23 | ... + ... |
+| test.cpp:53:12:53:16 | Load | test.cpp:53:12:53:23 | ... + ... |
+| test.cpp:53:12:53:23 | ... + ... | test.cpp:51:33:51:35 | Load indirection |
+| test.cpp:60:34:60:37 | mk_array output argument | test.cpp:62:32:62:34 | Load |
+| test.cpp:60:34:60:37 | mk_array output argument | test.cpp:66:32:66:34 | Load |
+| test.cpp:60:34:60:37 | mk_array output argument | test.cpp:70:31:70:33 | Load |
+| test.cpp:62:32:62:34 | Load | test.cpp:67:9:67:14 | Store: ... = ... |
+| test.cpp:62:32:62:34 | Load | test.cpp:67:9:67:14 | Store: ... = ... |
+| test.cpp:66:32:66:34 | Load | test.cpp:67:9:67:14 | Store: ... = ... |
+| test.cpp:66:32:66:34 | Load | test.cpp:67:9:67:14 | Store: ... = ... |
+| test.cpp:70:31:70:33 | Load | test.cpp:67:9:67:14 | Store: ... = ... |
+| test.cpp:70:31:70:33 | Load | test.cpp:67:9:67:14 | Store: ... = ... |
+| test.cpp:80:9:80:16 | VariableAddress indirection [begin] | test.cpp:91:20:91:22 | arr indirection [begin] |
+| test.cpp:80:9:80:16 | VariableAddress indirection [begin] | test.cpp:95:20:95:22 | arr indirection [begin] |
+| test.cpp:80:9:80:16 | VariableAddress indirection [begin] | test.cpp:99:20:99:22 | arr indirection [begin] |
+| test.cpp:80:9:80:16 | VariableAddress indirection [begin] | test.cpp:119:18:119:25 | call to mk_array [begin] |
+| test.cpp:80:9:80:16 | VariableAddress indirection [end] | test.cpp:91:36:91:38 | arr indirection [end] |
+| test.cpp:80:9:80:16 | VariableAddress indirection [end] | test.cpp:95:36:95:38 | arr indirection [end] |
+| test.cpp:80:9:80:16 | VariableAddress indirection [end] | test.cpp:99:35:99:37 | arr indirection [end] |
+| test.cpp:80:9:80:16 | VariableAddress indirection [end] | test.cpp:119:18:119:25 | call to mk_array [end] |
+| test.cpp:82:5:82:28 | Store | test.cpp:82:9:82:13 | arr indirection [post update] [begin] |
+| test.cpp:82:9:82:13 | arr indirection [post update] [begin] | test.cpp:80:9:80:16 | VariableAddress indirection [begin] |
+| test.cpp:82:9:82:13 | arr indirection [post update] [begin] | test.cpp:83:15:83:17 | arr indirection [begin] |
+| test.cpp:82:17:82:22 | call to malloc | test.cpp:82:5:82:28 | Store |
+| test.cpp:83:5:83:30 | Store | test.cpp:83:9:83:11 | arr indirection [post update] [end] |
+| test.cpp:83:9:83:11 | arr indirection [post update] [end] | test.cpp:80:9:80:16 | VariableAddress indirection [end] |
+| test.cpp:83:15:83:17 | arr indirection [begin] | test.cpp:83:19:83:23 | begin |
+| test.cpp:83:15:83:30 | ... + ... | test.cpp:83:5:83:30 | Store |
+| test.cpp:83:19:83:23 | Load | test.cpp:83:5:83:30 | Store |
+| test.cpp:83:19:83:23 | Load | test.cpp:83:5:83:30 | Store |
+| test.cpp:83:19:83:23 | Load | test.cpp:83:15:83:30 | ... + ... |
+| test.cpp:83:19:83:23 | Load | test.cpp:83:15:83:30 | ... + ... |
+| test.cpp:83:19:83:23 | begin | test.cpp:83:19:83:23 | Load |
+| test.cpp:91:20:91:22 | arr indirection [begin] | test.cpp:91:24:91:28 | begin |
+| test.cpp:91:20:91:22 | arr indirection [begin] | test.cpp:91:47:91:47 | Load |
+| test.cpp:91:24:91:28 | begin | test.cpp:91:47:91:47 | Load |
+| test.cpp:91:36:91:38 | arr indirection [end] | test.cpp:91:40:91:42 | end |
+| test.cpp:91:40:91:42 | Load | test.cpp:96:9:96:14 | Store: ... = ... |
+| test.cpp:91:40:91:42 | Load | test.cpp:96:9:96:14 | Store: ... = ... |
+| test.cpp:91:40:91:42 | end | test.cpp:91:40:91:42 | Load |
+| test.cpp:95:20:95:22 | arr indirection [begin] | test.cpp:95:24:95:28 | begin |
+| test.cpp:95:20:95:22 | arr indirection [begin] | test.cpp:95:47:95:47 | Load |
+| test.cpp:95:24:95:28 | begin | test.cpp:95:47:95:47 | Load |
+| test.cpp:95:36:95:38 | arr indirection [end] | test.cpp:95:40:95:42 | end |
+| test.cpp:95:40:95:42 | Load | test.cpp:96:9:96:14 | Store: ... = ... |
+| test.cpp:95:40:95:42 | Load | test.cpp:96:9:96:14 | Store: ... = ... |
+| test.cpp:95:40:95:42 | end | test.cpp:95:40:95:42 | Load |
+| test.cpp:99:20:99:22 | arr indirection [begin] | test.cpp:99:24:99:28 | begin |
+| test.cpp:99:20:99:22 | arr indirection [begin] | test.cpp:99:46:99:46 | Load |
+| test.cpp:99:24:99:28 | begin | test.cpp:99:46:99:46 | Load |
+| test.cpp:99:35:99:37 | arr indirection [end] | test.cpp:99:39:99:41 | end |
+| test.cpp:99:39:99:41 | Load | test.cpp:96:9:96:14 | Store: ... = ... |
+| test.cpp:99:39:99:41 | Load | test.cpp:96:9:96:14 | Store: ... = ... |
+| test.cpp:99:39:99:41 | end | test.cpp:99:39:99:41 | Load |
+| test.cpp:104:27:104:29 | arr [begin] | test.cpp:105:20:105:22 | arr indirection [begin] |
+| test.cpp:104:27:104:29 | arr [begin] | test.cpp:109:20:109:22 | arr indirection [begin] |
+| test.cpp:104:27:104:29 | arr [begin] | test.cpp:113:20:113:22 | arr indirection [begin] |
+| test.cpp:104:27:104:29 | arr [end] | test.cpp:105:36:105:38 | arr indirection [end] |
+| test.cpp:104:27:104:29 | arr [end] | test.cpp:109:36:109:38 | arr indirection [end] |
+| test.cpp:104:27:104:29 | arr [end] | test.cpp:113:35:113:37 | arr indirection [end] |
+| test.cpp:105:20:105:22 | arr indirection [begin] | test.cpp:105:24:105:28 | begin |
+| test.cpp:105:20:105:22 | arr indirection [begin] | test.cpp:105:47:105:47 | Load |
+| test.cpp:105:24:105:28 | begin | test.cpp:105:47:105:47 | Load |
+| test.cpp:105:36:105:38 | arr indirection [end] | test.cpp:105:40:105:42 | end |
+| test.cpp:105:40:105:42 | Load | test.cpp:110:9:110:14 | Store: ... = ... |
+| test.cpp:105:40:105:42 | Load | test.cpp:110:9:110:14 | Store: ... = ... |
+| test.cpp:105:40:105:42 | end | test.cpp:105:40:105:42 | Load |
+| test.cpp:109:20:109:22 | arr indirection [begin] | test.cpp:109:24:109:28 | begin |
+| test.cpp:109:20:109:22 | arr indirection [begin] | test.cpp:109:47:109:47 | Load |
+| test.cpp:109:24:109:28 | begin | test.cpp:109:47:109:47 | Load |
+| test.cpp:109:36:109:38 | arr indirection [end] | test.cpp:109:40:109:42 | end |
+| test.cpp:109:40:109:42 | Load | test.cpp:110:9:110:14 | Store: ... = ... |
+| test.cpp:109:40:109:42 | Load | test.cpp:110:9:110:14 | Store: ... = ... |
+| test.cpp:109:40:109:42 | end | test.cpp:109:40:109:42 | Load |
+| test.cpp:113:20:113:22 | arr indirection [begin] | test.cpp:113:24:113:28 | begin |
+| test.cpp:113:20:113:22 | arr indirection [begin] | test.cpp:113:46:113:46 | Load |
+| test.cpp:113:24:113:28 | begin | test.cpp:113:46:113:46 | Load |
+| test.cpp:113:35:113:37 | arr indirection [end] | test.cpp:113:39:113:41 | end |
+| test.cpp:113:39:113:41 | Load | test.cpp:110:9:110:14 | Store: ... = ... |
+| test.cpp:113:39:113:41 | Load | test.cpp:110:9:110:14 | Store: ... = ... |
+| test.cpp:113:39:113:41 | end | test.cpp:113:39:113:41 | Load |
+| test.cpp:119:18:119:25 | call to mk_array [begin] | test.cpp:104:27:104:29 | arr [begin] |
+| test.cpp:119:18:119:25 | call to mk_array [end] | test.cpp:104:27:104:29 | arr [end] |
+| test.cpp:124:15:124:20 | call to malloc | test.cpp:125:5:125:17 | Store |
+| test.cpp:124:15:124:20 | call to malloc | test.cpp:126:15:126:15 | Load |
+| test.cpp:125:5:125:17 | Store | test.cpp:125:9:125:13 | arr indirection [post update] [begin] |
+| test.cpp:125:9:125:13 | arr indirection [post update] [begin] | test.cpp:129:11:129:13 | arr indirection [begin] |
+| test.cpp:125:9:125:13 | arr indirection [post update] [begin] | test.cpp:133:11:133:13 | arr indirection [begin] |
+| test.cpp:125:9:125:13 | arr indirection [post update] [begin] | test.cpp:137:11:137:13 | arr indirection [begin] |
+| test.cpp:129:11:129:13 | arr indirection [begin] | test.cpp:129:15:129:19 | begin |
+| test.cpp:129:15:129:19 | begin | test.cpp:129:15:129:19 | Load |
+| test.cpp:133:11:133:13 | arr indirection [begin] | test.cpp:133:15:133:19 | begin |
+| test.cpp:133:15:133:19 | begin | test.cpp:133:15:133:19 | Load |
+| test.cpp:137:11:137:13 | arr indirection [begin] | test.cpp:137:15:137:19 | begin |
+| test.cpp:137:15:137:19 | begin | test.cpp:137:15:137:19 | Load |
+| test.cpp:141:10:141:19 | VariableAddress indirection [begin] | test.cpp:150:20:150:29 | Call indirection [begin] |
+| test.cpp:141:10:141:19 | VariableAddress indirection [begin] | test.cpp:180:19:180:28 | call to mk_array_p indirection [begin] |
+| test.cpp:141:10:141:19 | VariableAddress indirection [end] | test.cpp:150:20:150:29 | Call indirection [end] |
+| test.cpp:141:10:141:19 | VariableAddress indirection [end] | test.cpp:180:19:180:28 | call to mk_array_p indirection [end] |
+| test.cpp:143:5:143:29 | Store | test.cpp:143:10:143:14 | Load indirection [post update] [begin] |
+| test.cpp:143:10:143:14 | Load indirection [post update] [begin] | test.cpp:141:10:141:19 | VariableAddress indirection [begin] |
+| test.cpp:143:10:143:14 | Load indirection [post update] [begin] | test.cpp:144:16:144:18 | Load indirection [begin] |
+| test.cpp:143:18:143:23 | call to malloc | test.cpp:143:5:143:29 | Store |
+| test.cpp:144:5:144:32 | Store | test.cpp:144:10:144:12 | Load indirection [post update] [end] |
+| test.cpp:144:10:144:12 | Load indirection [post update] [end] | test.cpp:141:10:141:19 | VariableAddress indirection [end] |
+| test.cpp:144:16:144:18 | Load indirection [begin] | test.cpp:144:21:144:25 | begin |
+| test.cpp:144:16:144:32 | ... + ... | test.cpp:144:5:144:32 | Store |
+| test.cpp:144:21:144:25 | Load | test.cpp:144:5:144:32 | Store |
+| test.cpp:144:21:144:25 | Load | test.cpp:144:5:144:32 | Store |
+| test.cpp:144:21:144:25 | Load | test.cpp:144:16:144:32 | ... + ... |
+| test.cpp:144:21:144:25 | Load | test.cpp:144:16:144:32 | ... + ... |
+| test.cpp:144:21:144:25 | begin | test.cpp:144:21:144:25 | Load |
+| test.cpp:150:20:150:29 | Call indirection [begin] | test.cpp:152:20:152:22 | Load indirection [begin] |
+| test.cpp:150:20:150:29 | Call indirection [begin] | test.cpp:156:20:156:22 | Load indirection [begin] |
+| test.cpp:150:20:150:29 | Call indirection [begin] | test.cpp:160:20:160:22 | Load indirection [begin] |
+| test.cpp:150:20:150:29 | Call indirection [end] | test.cpp:156:37:156:39 | Load indirection [end] |
+| test.cpp:152:20:152:22 | Load indirection [begin] | test.cpp:152:25:152:29 | begin |
+| test.cpp:152:20:152:22 | Load indirection [begin] | test.cpp:152:49:152:49 | Load |
+| test.cpp:152:25:152:29 | begin | test.cpp:152:49:152:49 | Load |
+| test.cpp:156:20:156:22 | Load indirection [begin] | test.cpp:156:25:156:29 | begin |
+| test.cpp:156:20:156:22 | Load indirection [begin] | test.cpp:156:49:156:49 | Load |
+| test.cpp:156:25:156:29 | begin | test.cpp:156:49:156:49 | Load |
+| test.cpp:156:37:156:39 | Load indirection [end] | test.cpp:156:42:156:44 | end |
+| test.cpp:156:42:156:44 | Load | test.cpp:157:9:157:14 | Store: ... = ... |
+| test.cpp:156:42:156:44 | Load | test.cpp:157:9:157:14 | Store: ... = ... |
+| test.cpp:156:42:156:44 | end | test.cpp:156:42:156:44 | Load |
+| test.cpp:160:20:160:22 | Load indirection [begin] | test.cpp:160:25:160:29 | begin |
+| test.cpp:160:20:160:22 | Load indirection [begin] | test.cpp:160:48:160:48 | Load |
+| test.cpp:160:25:160:29 | begin | test.cpp:160:48:160:48 | Load |
+| test.cpp:165:29:165:31 | arr indirection [begin] | test.cpp:166:20:166:22 | Load indirection [begin] |
+| test.cpp:165:29:165:31 | arr indirection [begin] | test.cpp:170:20:170:22 | Load indirection [begin] |
+| test.cpp:165:29:165:31 | arr indirection [begin] | test.cpp:174:20:174:22 | Load indirection [begin] |
+| test.cpp:165:29:165:31 | arr indirection [end] | test.cpp:166:37:166:39 | Load indirection [end] |
+| test.cpp:165:29:165:31 | arr indirection [end] | test.cpp:170:37:170:39 | Load indirection [end] |
+| test.cpp:165:29:165:31 | arr indirection [end] | test.cpp:174:36:174:38 | Load indirection [end] |
+| test.cpp:166:20:166:22 | Load indirection [begin] | test.cpp:166:25:166:29 | begin |
+| test.cpp:166:20:166:22 | Load indirection [begin] | test.cpp:166:49:166:49 | Load |
+| test.cpp:166:25:166:29 | begin | test.cpp:166:49:166:49 | Load |
+| test.cpp:166:37:166:39 | Load indirection [end] | test.cpp:166:42:166:44 | end |
+| test.cpp:166:42:166:44 | Load | test.cpp:171:9:171:14 | Store: ... = ... |
+| test.cpp:166:42:166:44 | Load | test.cpp:171:9:171:14 | Store: ... = ... |
+| test.cpp:166:42:166:44 | end | test.cpp:166:42:166:44 | Load |
+| test.cpp:170:20:170:22 | Load indirection [begin] | test.cpp:170:25:170:29 | begin |
+| test.cpp:170:20:170:22 | Load indirection [begin] | test.cpp:170:49:170:49 | Load |
+| test.cpp:170:25:170:29 | begin | test.cpp:170:49:170:49 | Load |
+| test.cpp:170:37:170:39 | Load indirection [end] | test.cpp:170:42:170:44 | end |
+| test.cpp:170:42:170:44 | Load | test.cpp:171:9:171:14 | Store: ... = ... |
+| test.cpp:170:42:170:44 | Load | test.cpp:171:9:171:14 | Store: ... = ... |
+| test.cpp:170:42:170:44 | end | test.cpp:170:42:170:44 | Load |
+| test.cpp:174:20:174:22 | Load indirection [begin] | test.cpp:174:25:174:29 | begin |
+| test.cpp:174:20:174:22 | Load indirection [begin] | test.cpp:174:48:174:48 | Load |
+| test.cpp:174:25:174:29 | begin | test.cpp:174:48:174:48 | Load |
+| test.cpp:174:36:174:38 | Load indirection [end] | test.cpp:174:41:174:43 | end |
+| test.cpp:174:41:174:43 | Load | test.cpp:171:9:171:14 | Store: ... = ... |
+| test.cpp:174:41:174:43 | Load | test.cpp:171:9:171:14 | Store: ... = ... |
+| test.cpp:174:41:174:43 | end | test.cpp:174:41:174:43 | Load |
+| test.cpp:180:19:180:28 | call to mk_array_p indirection [begin] | test.cpp:165:29:165:31 | arr indirection [begin] |
+| test.cpp:180:19:180:28 | call to mk_array_p indirection [end] | test.cpp:165:29:165:31 | arr indirection [end] |
+| test.cpp:188:15:188:20 | call to malloc | test.cpp:189:15:189:15 | Load |
+#select
+| test.cpp:6:14:6:15 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
+| test.cpp:8:14:8:21 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:8:14:8:21 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
+| test.cpp:8:14:8:21 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:8:14:8:21 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
+| test.cpp:20:14:20:21 | Load: * ... | test.cpp:16:15:16:20 | call to malloc | test.cpp:20:14:20:21 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:16:15:16:20 | call to malloc | call to malloc | test.cpp:17:19:17:22 | size | size |
+| test.cpp:30:14:30:15 | Load: * ... | test.cpp:28:15:28:20 | call to malloc | test.cpp:30:14:30:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:28:15:28:20 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... |
+| test.cpp:32:14:32:21 | Load: * ... | test.cpp:28:15:28:20 | call to malloc | test.cpp:32:14:32:21 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:28:15:28:20 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... |
+| test.cpp:32:14:32:21 | Load: * ... | test.cpp:28:15:28:20 | call to malloc | test.cpp:32:14:32:21 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:28:15:28:20 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... |
+| test.cpp:42:14:42:15 | Load: * ... | test.cpp:40:15:40:20 | call to malloc | test.cpp:42:14:42:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:40:15:40:20 | call to malloc | call to malloc | test.cpp:41:20:41:27 | ... - ... | ... - ... |
+| test.cpp:44:14:44:21 | Load: * ... | test.cpp:40:15:40:20 | call to malloc | test.cpp:44:14:44:21 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:40:15:40:20 | call to malloc | call to malloc | test.cpp:41:20:41:27 | ... - ... | ... - ... |
+| test.cpp:44:14:44:21 | Load: * ... | test.cpp:40:15:40:20 | call to malloc | test.cpp:44:14:44:21 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:40:15:40:20 | call to malloc | call to malloc | test.cpp:41:20:41:27 | ... - ... | ... - ... |
+| test.cpp:67:9:67:14 | Store: ... = ... | test.cpp:52:19:52:24 | call to malloc | test.cpp:67:9:67:14 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:52:19:52:24 | call to malloc | call to malloc | test.cpp:53:20:53:23 | size | size |
+| test.cpp:96:9:96:14 | Store: ... = ... | test.cpp:82:17:82:22 | call to malloc | test.cpp:96:9:96:14 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:82:17:82:22 | call to malloc | call to malloc | test.cpp:83:27:83:30 | size | size |
+| test.cpp:110:9:110:14 | Store: ... = ... | test.cpp:82:17:82:22 | call to malloc | test.cpp:110:9:110:14 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:82:17:82:22 | call to malloc | call to malloc | test.cpp:83:27:83:30 | size | size |
+| test.cpp:157:9:157:14 | Store: ... = ... | test.cpp:143:18:143:23 | call to malloc | test.cpp:157:9:157:14 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:143:18:143:23 | call to malloc | call to malloc | test.cpp:144:29:144:32 | size | size |
+| test.cpp:171:9:171:14 | Store: ... = ... | test.cpp:143:18:143:23 | call to malloc | test.cpp:171:9:171:14 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:143:18:143:23 | call to malloc | call to malloc | test.cpp:144:29:144:32 | size | size |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.qlref
new file mode 100644
index 00000000000..76da29dc7a0
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-193/InvalidPointerDeref.ql
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp
new file mode 100644
index 00000000000..809c348c0b0
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp
@@ -0,0 +1,191 @@
+char *malloc(int size);
+
+void test1(int size) {
+    char* p = malloc(size);
+    char* q = p + size;
+    char a = *q; // BAD
+    char b = *(q - 1); // GOOD
+    char c = *(q + 1); // BAD
+    char d = *(q + size); // BAD [NOT DETECTED]
+    char e = *(q - size); // GOOD
+    char f = *(q + size + 1); // BAD [NOT DETECTED]
+    char g = *(q - size - 1); // GOOD
+}
+
+void test2(int size) {
+    char* p = malloc(size);
+    char* q = p + size - 1;
+    char a = *q; // GOOD
+    char b = *(q - 1); // GOOD
+    char c = *(q + 1); // BAD
+    char d = *(q + size); // BAD [NOT DETECTED]
+    char e = *(q - size); // GOOD
+    char f = *(q + size + 1); // BAD [NOT DETECTED]
+    char g = *(q - size - 1); // GOOD
+}
+
+void test3(int size) {
+    char* p = malloc(size + 1);
+    char* q = p + (size + 1);
+    char a = *q; // BAD
+    char b = *(q - 1); // GOOD
+    char c = *(q + 1); // BAD
+    char d = *(q + size); // BAD [NOT DETECTED]
+    char e = *(q - size); // GOOD
+    char f = *(q + size + 1); // BAD [NOT DETECTED]
+    char g = *(q - size - 1); // GOOD
+}
+
+void test4(int size) {
+    char* p = malloc(size - 1);
+    char* q = p + (size - 1);
+    char a = *q; // BAD
+    char b = *(q - 1); // GOOD
+    char c = *(q + 1); // BAD
+    char d = *(q + size); // BAD [NOT DETECTED]
+    char e = *(q - size); // GOOD
+    char f = *(q + size + 1); // BAD [NOT DETECTED]
+    char g = *(q - size - 1); // GOOD
+}
+
+char* mk_array(int size, char** end) {
+    char* begin = malloc(size);
+    *end = begin + size;
+
+    return begin;
+}
+
+void test5(int size) {
+    char* end;
+    char* begin = mk_array(size, &end);
+
+    for (char* p = begin; p != end; ++p) {
+        *p = 0; // GOOD
+    }
+
+    for (char* p = begin; p <= end; ++p) {
+        *p = 0; // BAD
+    }
+
+    for (char* p = begin; p < end; ++p) {
+        *p = 0; // GOOD
+    }
+}
+
+struct array_t {
+    char* begin;
+    char* end;
+};
+
+array_t mk_array(int size) {
+    array_t arr;
+    arr.begin = malloc(size);
+    arr.end = arr.begin + size;
+
+    return arr;
+}
+
+void test6(int size) {
+    array_t arr = mk_array(size);
+
+    for (char* p = arr.begin; p != arr.end; ++p) {
+        *p = 0; // GOOD
+    }
+
+    for (char* p = arr.begin; p <= arr.end; ++p) {
+        *p = 0; // BAD
+    }
+
+    for (char* p = arr.begin; p < arr.end; ++p) {
+        *p = 0; // GOOD
+    }
+}
+
+void test7_callee(array_t arr) {
+    for (char* p = arr.begin; p != arr.end; ++p) {
+        *p = 0; // GOOD
+    }
+
+    for (char* p = arr.begin; p <= arr.end; ++p) {
+        *p = 0; // BAD
+    }
+
+    for (char* p = arr.begin; p < arr.end; ++p) {
+        *p = 0; // GOOD
+    }
+}
+
+void test7(int size) {
+    test7_callee(mk_array(size));
+}
+
+void test8(int size) {
+    array_t arr;
+    char* p = malloc(size);
+    arr.begin = p;
+    arr.end = p + size;
+
+    for (int i = 0; i < arr.end - arr.begin; i++) {
+        *(arr.begin + i) = 0; // GOOD
+    }
+
+    for (int i = 0; i != arr.end - arr.begin; i++) {
+        *(arr.begin + i) = 0; // GOOD
+    }
+
+    for (int i = 0; i <= arr.end - arr.begin; i++) {
+        *(arr.begin + i) = 0; // BAD [NOT DETECTED]
+    }
+}
+
+array_t *mk_array_p(int size) {
+    array_t *arr = (array_t*) malloc(sizeof(array_t));
+    arr->begin = malloc(size);
+    arr->end = arr->begin + size;
+
+    return arr;
+}
+
+void test9(int size) {
+    array_t *arr = mk_array_p(size);
+
+    for (char* p = arr->begin; p != arr->end; ++p) {
+        *p = 0; // GOOD
+    }
+
+    for (char* p = arr->begin; p <= arr->end; ++p) {
+        *p = 0; // BAD
+    }
+
+    for (char* p = arr->begin; p < arr->end; ++p) {
+        *p = 0; // GOOD
+    }
+}
+
+void test10_callee(array_t *arr) {
+    for (char* p = arr->begin; p != arr->end; ++p) {
+        *p = 0; // GOOD
+    }
+
+    for (char* p = arr->begin; p <= arr->end; ++p) {
+        *p = 0; // BAD
+    }
+
+    for (char* p = arr->begin; p < arr->end; ++p) {
+        *p = 0; // GOOD
+    }
+}
+
+void test10(int size) {
+    test10_callee(mk_array_p(size));
+}
+
+void deref_plus_one(char* q) {
+    char a = *(q + 1); // BAD [NOT DETECTED]
+}
+
+void test11(unsigned size) {
+    char *p = malloc(size);
+    char *q = p + size - 1;
+    deref_plus_one(q);
+}
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/builtins/type_traits/clang.cpp b/cpp/ql/test/library-tests/builtins/type_traits/clang.cpp
new file mode 100644
index 00000000000..8cb32567820
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/type_traits/clang.cpp
@@ -0,0 +1,88 @@
+// semmle-extractor-options: --clang --clang_version 100000
+
+struct S {
+    void f() {}
+    int o;
+};
+
+using f_type = decltype(&S::f);
+using o_type = decltype(&S::o);
+
+struct T;
+
+bool b_is_same1 = __is_same(int, int);
+bool b_is_same2 = __is_same(int, float);
+
+bool b_is_function1 = __is_function(void(int));
+bool b_is_function2 = __is_function(int);
+
+bool b_is_array1 = __is_array(int[]);
+bool b_is_array2 = __is_array(int);
+
+unsigned long b_array_rank1 = __array_rank(int[42][42]);
+unsigned long b_array_rank2 = __array_rank(int);
+
+unsigned long b_array_extent1 = __array_extent(int[42][42], 1);
+unsigned long b_array_extent2 = __array_extent(int[42][42], 2);
+unsigned long b_array_extent3 = __array_extent(int, 0);
+
+bool bok_is_arithmetic1 = __is_arithmetic(S);
+bool bok_is_arithmetic2 = __is_arithmetic(int);
+
+bool bok_is_complete_type1 = __is_complete_type(S);
+bool bok_is_complete_type2 = __is_complete_type(T);
+
+bool bok_is_compound1 = __is_compound(S);
+bool bok_is_compound2 = __is_compound(int);
+
+bool bok_is_const1 = __is_const(const int);
+bool bok_is_const2 = __is_const(int);
+
+bool bok_is_floating_point1 = __is_floating_point(int);
+bool bok_is_floating_point2 = __is_floating_point(float);
+
+bool bok_is_fundamental1 = __is_fundamental(S);
+bool bok_is_fundamental2 = __is_fundamental(int);
+
+bool bok_is_integral1 = __is_integral(float);
+bool bok_is_integral2 = __is_integral(int);
+
+bool bok_is_lvalue_reference1 = __is_lvalue_reference(int&);
+bool bok_is_lvalue_reference2 = __is_lvalue_reference(int);
+
+bool bok_is_member_function_pointer1 = __is_member_function_pointer(f_type);
+bool bok_is_member_function_pointer2 = __is_member_function_pointer(o_type);
+
+bool bok_is_member_object_pointer1 = __is_member_object_pointer(f_type);
+bool bok_is_member_object_pointer2 = __is_member_object_pointer(o_type);
+
+bool bok_is_member_pointer1 = __is_member_pointer(f_type);
+bool bok_is_member_pointer2 = __is_member_pointer(o_type);
+bool bok_is_member_pointer3 = __is_member_pointer(int);
+
+bool bok_is_object1 = __is_object(int);
+bool bok_is_object2 = __is_object(int&);
+
+bool bok_is_pointer1 = __is_pointer(int);
+bool bok_is_pointer2 = __is_pointer(int*);
+
+bool bok_is_reference1 = __is_reference(int);
+bool bok_is_reference2 = __is_reference(int&);
+
+bool bok_is_rvalue_reference1 = __is_rvalue_reference(int&&);
+bool bok_is_rvalue_reference2 = __is_rvalue_reference(int);
+
+bool bok_is_scalar1 = __is_scalar(int);
+bool bok_is_scalar2 = __is_scalar(int[]);
+
+bool bok_is_signed1 = __is_signed(int);
+bool bok_is_signed2 = __is_signed(unsigned int);
+
+bool bok_is_unsigned1 = __is_unsigned(int);
+bool bok_is_unsigned2 = __is_unsigned(unsigned int);
+
+bool bok_is_void1 = __is_void(void);
+bool bok_is_void2 = __is_void(int);
+
+bool bok_is_volatile1 = __is_volatile(volatile int);
+bool bok_is_volatile2 = __is_volatile(int);
diff --git a/cpp/ql/test/library-tests/builtins/type_traits/expr.expected b/cpp/ql/test/library-tests/builtins/type_traits/expr.expected
index a19d917aaac..010d68711c6 100644
--- a/cpp/ql/test/library-tests/builtins/type_traits/expr.expected
+++ b/cpp/ql/test/library-tests/builtins/type_traits/expr.expected
@@ -1,3 +1,126 @@
+| clang.cpp:8:25:8:29 | f |  | <none> |
+| clang.cpp:9:25:9:29 | o |  | <none> |
+| clang.cpp:13:19:13:37 | __is_same | int,int | 1 |
+| clang.cpp:13:19:13:37 | int |  | <none> |
+| clang.cpp:13:19:13:37 | int |  | <none> |
+| clang.cpp:14:19:14:39 | __is_same | int,float | 0 |
+| clang.cpp:14:19:14:39 | float |  | <none> |
+| clang.cpp:14:19:14:39 | int |  | <none> |
+| clang.cpp:16:23:16:46 | ..()(..) |  | <none> |
+| clang.cpp:16:23:16:46 | __is_function | ..()(..) | 1 |
+| clang.cpp:17:23:17:40 | __is_function | int | 0 |
+| clang.cpp:17:23:17:40 | int |  | <none> |
+| clang.cpp:19:20:19:36 | __is_array | int[] | 1 |
+| clang.cpp:19:20:19:36 | int[] |  | <none> |
+| clang.cpp:20:20:20:34 | __is_array | int | 0 |
+| clang.cpp:20:20:20:34 | int |  | <none> |
+| clang.cpp:22:31:22:55 | __array_rank | int[42][42] | 2 |
+| clang.cpp:22:31:22:55 | int[42][42] |  | <none> |
+| clang.cpp:22:48:22:49 | 42 |  | 42 |
+| clang.cpp:22:48:22:49 | (unsigned long)... |  | 42 |
+| clang.cpp:22:52:22:53 | 42 |  | 42 |
+| clang.cpp:22:52:22:53 | (unsigned long)... |  | 42 |
+| clang.cpp:23:31:23:47 | __array_rank | int | 0 |
+| clang.cpp:23:31:23:47 | int |  | <none> |
+| clang.cpp:25:33:25:62 | __array_extent | int[42][42],1 | 42 |
+| clang.cpp:25:33:25:62 | int[42][42] |  | <none> |
+| clang.cpp:25:52:25:53 | 42 |  | 42 |
+| clang.cpp:25:52:25:53 | (unsigned long)... |  | 42 |
+| clang.cpp:25:56:25:57 | 42 |  | 42 |
+| clang.cpp:25:56:25:57 | (unsigned long)... |  | 42 |
+| clang.cpp:25:61:25:61 | 1 |  | 1 |
+| clang.cpp:26:33:26:62 | __array_extent | int[42][42],2 | 0 |
+| clang.cpp:26:33:26:62 | int[42][42] |  | <none> |
+| clang.cpp:26:52:26:53 | 42 |  | 42 |
+| clang.cpp:26:52:26:53 | (unsigned long)... |  | 42 |
+| clang.cpp:26:56:26:57 | 42 |  | 42 |
+| clang.cpp:26:56:26:57 | (unsigned long)... |  | 42 |
+| clang.cpp:26:61:26:61 | 2 |  | 2 |
+| clang.cpp:27:33:27:54 | __array_extent | int,0 | 0 |
+| clang.cpp:27:33:27:54 | int |  | <none> |
+| clang.cpp:27:53:27:53 | 0 |  | 0 |
+| clang.cpp:29:27:29:44 | S |  | <none> |
+| clang.cpp:29:27:29:44 | __is_arithmetic | S | 0 |
+| clang.cpp:30:27:30:46 | __is_arithmetic | int | 1 |
+| clang.cpp:30:27:30:46 | int |  | <none> |
+| clang.cpp:32:30:32:50 | S |  | <none> |
+| clang.cpp:32:30:32:50 | __is_complete_type | S | 1 |
+| clang.cpp:33:30:33:50 | T |  | <none> |
+| clang.cpp:33:30:33:50 | __is_complete_type | T | 0 |
+| clang.cpp:35:25:35:40 | S |  | <none> |
+| clang.cpp:35:25:35:40 | __is_compound | S | 1 |
+| clang.cpp:36:25:36:42 | __is_compound | int | 0 |
+| clang.cpp:36:25:36:42 | int |  | <none> |
+| clang.cpp:38:22:38:42 | __is_const | const int | 1 |
+| clang.cpp:38:22:38:42 | const int |  | <none> |
+| clang.cpp:39:22:39:36 | __is_const | int | 0 |
+| clang.cpp:39:22:39:36 | int |  | <none> |
+| clang.cpp:41:31:41:54 | __is_floating_point | int | 0 |
+| clang.cpp:41:31:41:54 | int |  | <none> |
+| clang.cpp:42:31:42:56 | __is_floating_point | float | 1 |
+| clang.cpp:42:31:42:56 | float |  | <none> |
+| clang.cpp:44:28:44:46 | S |  | <none> |
+| clang.cpp:44:28:44:46 | __is_fundamental | S | 0 |
+| clang.cpp:45:28:45:48 | __is_fundamental | int | 1 |
+| clang.cpp:45:28:45:48 | int |  | <none> |
+| clang.cpp:47:25:47:44 | __is_integral | float | 0 |
+| clang.cpp:47:25:47:44 | float |  | <none> |
+| clang.cpp:48:25:48:42 | __is_integral | int | 1 |
+| clang.cpp:48:25:48:42 | int |  | <none> |
+| clang.cpp:50:33:50:59 | __is_lvalue_reference | int & | 1 |
+| clang.cpp:50:33:50:59 | int & |  | <none> |
+| clang.cpp:51:33:51:58 | __is_lvalue_reference | int | 0 |
+| clang.cpp:51:33:51:58 | int |  | <none> |
+| clang.cpp:53:40:53:75 | __is_member_function_pointer | f_type | 1 |
+| clang.cpp:53:40:53:75 | f_type |  | <none> |
+| clang.cpp:54:40:54:75 | __is_member_function_pointer | o_type | 0 |
+| clang.cpp:54:40:54:75 | o_type |  | <none> |
+| clang.cpp:56:38:56:71 | __is_member_object_pointer | f_type | 0 |
+| clang.cpp:56:38:56:71 | f_type |  | <none> |
+| clang.cpp:57:38:57:71 | __is_member_object_pointer | o_type | 1 |
+| clang.cpp:57:38:57:71 | o_type |  | <none> |
+| clang.cpp:59:31:59:57 | __is_member_pointer | f_type | 1 |
+| clang.cpp:59:31:59:57 | f_type |  | <none> |
+| clang.cpp:60:31:60:57 | __is_member_pointer | o_type | 1 |
+| clang.cpp:60:31:60:57 | o_type |  | <none> |
+| clang.cpp:61:31:61:54 | __is_member_pointer | int | 0 |
+| clang.cpp:61:31:61:54 | int |  | <none> |
+| clang.cpp:63:23:63:38 | __is_object | int | 1 |
+| clang.cpp:63:23:63:38 | int |  | <none> |
+| clang.cpp:64:23:64:39 | __is_object | int & | 0 |
+| clang.cpp:64:23:64:39 | int & |  | <none> |
+| clang.cpp:66:24:66:40 | __is_pointer | int | 0 |
+| clang.cpp:66:24:66:40 | int |  | <none> |
+| clang.cpp:67:24:67:41 | __is_pointer | int * | 1 |
+| clang.cpp:67:24:67:41 | int * |  | <none> |
+| clang.cpp:69:26:69:44 | __is_reference | int | 0 |
+| clang.cpp:69:26:69:44 | int |  | <none> |
+| clang.cpp:70:26:70:45 | __is_reference | int & | 1 |
+| clang.cpp:70:26:70:45 | int & |  | <none> |
+| clang.cpp:72:33:72:60 | __is_rvalue_reference | int && | 1 |
+| clang.cpp:72:33:72:60 | int && |  | <none> |
+| clang.cpp:73:33:73:58 | __is_rvalue_reference | int | 0 |
+| clang.cpp:73:33:73:58 | int |  | <none> |
+| clang.cpp:75:23:75:38 | __is_scalar | int | 1 |
+| clang.cpp:75:23:75:38 | int |  | <none> |
+| clang.cpp:76:23:76:40 | __is_scalar | int[] | 0 |
+| clang.cpp:76:23:76:40 | int[] |  | <none> |
+| clang.cpp:78:23:78:38 | __is_signed | int | 1 |
+| clang.cpp:78:23:78:38 | int |  | <none> |
+| clang.cpp:79:23:79:47 | __is_signed | unsigned int | 0 |
+| clang.cpp:79:23:79:47 | unsigned int |  | <none> |
+| clang.cpp:81:25:81:42 | __is_unsigned | int | 0 |
+| clang.cpp:81:25:81:42 | int |  | <none> |
+| clang.cpp:82:25:82:51 | __is_unsigned | unsigned int | 1 |
+| clang.cpp:82:25:82:51 | unsigned int |  | <none> |
+| clang.cpp:84:21:84:35 | __is_void | void | 1 |
+| clang.cpp:84:21:84:35 | void |  | <none> |
+| clang.cpp:85:21:85:34 | __is_void | int | 0 |
+| clang.cpp:85:21:85:34 | int |  | <none> |
+| clang.cpp:87:25:87:51 | __is_volatile | volatile int | 1 |
+| clang.cpp:87:25:87:51 | volatile int |  | <none> |
+| clang.cpp:88:25:88:42 | __is_volatile | int | 0 |
+| clang.cpp:88:25:88:42 | int |  | <none> |
 | file://:0:0:0:0 | 0 |  | 0 |
 | file://:0:0:0:0 | 1 |  | 1 |
 | file://:0:0:0:0 | 2 |  | 2 |
@@ -313,3 +436,15 @@
 | ms.cpp:265:49:265:88 | int |  | <none> |
 | ms.cpp:266:49:266:90 | __has_unique_object_representations | float | 0 |
 | ms.cpp:266:49:266:90 | float |  | <none> |
+| ms.cpp:268:36:268:68 | __is_layout_compatible | int,long | 0 |
+| ms.cpp:268:36:268:68 | int |  | <none> |
+| ms.cpp:268:36:268:68 | long |  | <none> |
+| ms.cpp:269:36:269:75 | __is_layout_compatible | int *,int *const | 1 |
+| ms.cpp:269:36:269:75 | int * |  | <none> |
+| ms.cpp:269:36:269:75 | int *const |  | <none> |
+| ms.cpp:271:51:271:101 | __is_pointer_interconvertible_base_of | empty,empty | 1 |
+| ms.cpp:271:51:271:101 | empty |  | <none> |
+| ms.cpp:271:51:271:101 | empty |  | <none> |
+| ms.cpp:272:51:272:104 | __is_pointer_interconvertible_base_of | empty,abstract | 0 |
+| ms.cpp:272:51:272:104 | abstract |  | <none> |
+| ms.cpp:272:51:272:104 | empty |  | <none> |
diff --git a/cpp/ql/test/library-tests/builtins/type_traits/ms.cpp b/cpp/ql/test/library-tests/builtins/type_traits/ms.cpp
index 91d6245cc35..6083f9dc6bb 100644
--- a/cpp/ql/test/library-tests/builtins/type_traits/ms.cpp
+++ b/cpp/ql/test/library-tests/builtins/type_traits/ms.cpp
@@ -1,4 +1,4 @@
-
+// semmle-extractor-options: --microsoft --microsoft_version 1600
 class empty {
 };
 
@@ -264,4 +264,10 @@ void f(void) {
 
     bool b_has_unique_object_representations1 = __has_unique_object_representations(int);
     bool b_has_unique_object_representations2 = __has_unique_object_representations(float);
+
+    bool b_is_layout_compatible1 = __is_layout_compatible(int, long);
+    bool b_is_layout_compatible2 = __is_layout_compatible(int*, int* const);
+
+    bool b_is_pointer_interconvertible_base_of1 = __is_pointer_interconvertible_base_of(empty, empty);
+    bool b_is_pointer_interconvertible_base_of2 = __is_pointer_interconvertible_base_of(empty, abstract);
 }
diff --git a/cpp/ql/test/library-tests/builtins/type_traits/options b/cpp/ql/test/library-tests/builtins/type_traits/options
deleted file mode 100644
index dd5426f016a..00000000000
--- a/cpp/ql/test/library-tests/builtins/type_traits/options
+++ /dev/null
@@ -1 +0,0 @@
-semmle-extractor-options: --microsoft --microsoft_version 1600
diff --git a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
index 1523c0eef25..4153f37c024 100644
--- a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
+++ b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
@@ -14161,6 +14161,221 @@ ir.cpp:
 # 1851|               Type = [PointerType] const char *
 # 1851|               ValueCategory = prvalue
 # 1852|     getStmt(2): [ReturnStmt] return ...
+# 1855| [CopyAssignmentOperator] missing_declaration_entries::S& missing_declaration_entries::S::operator=(missing_declaration_entries::S const&)
+# 1855|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const S &
+# 1855| [MoveAssignmentOperator] missing_declaration_entries::S& missing_declaration_entries::S::operator=(missing_declaration_entries::S&&)
+# 1855|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] S &&
+# 1859| [CopyAssignmentOperator] missing_declaration_entries::Bar1<int>& missing_declaration_entries::Bar1<int>::operator=(missing_declaration_entries::Bar1<int> const&)
+# 1859|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const Bar1<int> &
+# 1859| [MoveAssignmentOperator] missing_declaration_entries::Bar1<int>& missing_declaration_entries::Bar1<int>::operator=(missing_declaration_entries::Bar1<int>&&)
+# 1859|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] Bar1<int> &&
+# 1862| [MemberFunction] void* missing_declaration_entries::Bar1<T>::missing_type_decl_entry(missing_declaration_entries::Bar1<T>::pointer)
+# 1862|   <params>: 
+# 1862|     getParameter(0): [Parameter] p
+# 1862|         Type = [CTypedefType,NestedTypedefType] pointer
+# 1862|   getEntryPoint(): [BlockStmt] { ... }
+# 1863|     getStmt(0): [DeclStmt] declaration
+# 1863|       getDeclarationEntry(0): [TypeDeclarationEntry] declaration of _Res
+# 1863|           Type = [CTypedefType,LocalTypedefType] _Res
+# 1864|     getStmt(1): [ReturnStmt] return ...
+# 1864|       getExpr(): [VariableAccess] p
+# 1864|           Type = [CTypedefType,NestedTypedefType] pointer
+# 1864|           ValueCategory = prvalue(load)
+# 1864|       getExpr().getFullyConverted(): [CStyleCast] (void *)...
+# 1864|           Conversion = [PointerConversion] pointer conversion
+# 1864|           Type = [VoidPointerType] void *
+# 1864|           ValueCategory = prvalue
+# 1862| [MemberFunction] void* missing_declaration_entries::Bar1<int>::missing_type_decl_entry(missing_declaration_entries::Bar1<int>::pointer)
+# 1862|   <params>: 
+# 1862|     getParameter(0): [Parameter] p
+# 1862|         Type = [CTypedefType,NestedTypedefType] pointer
+# 1862|   getEntryPoint(): [BlockStmt] { ... }
+# 1863|     getStmt(0): [DeclStmt] declaration
+# 1864|     getStmt(1): [ReturnStmt] return ...
+# 1864|       getExpr(): [VariableAccess] p
+# 1864|           Type = [CTypedefType,NestedTypedefType] pointer
+# 1864|           ValueCategory = prvalue(load)
+# 1864|       getExpr().getFullyConverted(): [CStyleCast] (void *)...
+# 1864|           Conversion = [PointerConversion] pointer conversion
+# 1864|           Type = [VoidPointerType] void *
+# 1864|           ValueCategory = prvalue
+# 1868| [TopLevelFunction] void missing_declaration_entries::test1()
+# 1868|   <params>: 
+# 1868|   getEntryPoint(): [BlockStmt] { ... }
+# 1869|     getStmt(0): [DeclStmt] declaration
+# 1869|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of b
+# 1869|           Type = [ClassTemplateInstantiation,Struct] Bar1<int>
+# 1870|     getStmt(1): [ExprStmt] ExprStmt
+# 1870|       getExpr(): [FunctionCall] call to missing_type_decl_entry
+# 1870|           Type = [VoidPointerType] void *
+# 1870|           ValueCategory = prvalue
+# 1870|         getQualifier(): [VariableAccess] b
+# 1870|             Type = [ClassTemplateInstantiation,Struct] Bar1<int>
+# 1870|             ValueCategory = lvalue
+# 1870|         getArgument(0): [Literal] 0
+# 1870|             Type = [NullPointerType] decltype(nullptr)
+# 1870|             Value = [Literal] 0
+# 1870|             ValueCategory = prvalue
+# 1870|         getArgument(0).getFullyConverted(): [CStyleCast] (pointer)...
+# 1870|             Conversion = [PointerConversion] pointer conversion
+# 1870|             Type = [CTypedefType,NestedTypedefType] pointer
+# 1870|             Value = [CStyleCast] 0
+# 1870|             ValueCategory = prvalue
+# 1871|     getStmt(2): [ReturnStmt] return ...
+# 1873| [CopyAssignmentOperator] missing_declaration_entries::Bar2<int>& missing_declaration_entries::Bar2<int>::operator=(missing_declaration_entries::Bar2<int> const&)
+# 1873|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const Bar2<int> &
+# 1873| [MoveAssignmentOperator] missing_declaration_entries::Bar2<int>& missing_declaration_entries::Bar2<int>::operator=(missing_declaration_entries::Bar2<int>&&)
+# 1873|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] Bar2<int> &&
+# 1875| [MemberFunction] int missing_declaration_entries::Bar2<T>::two_missing_variable_declaration_entries()
+# 1875|   <params>: 
+# 1875|   getEntryPoint(): [BlockStmt] { ... }
+# 1876|     getStmt(0): [DeclStmt] declaration
+# 1876|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of x
+# 1876|           Type = [ArrayType] int[10]
+# 1876|       getDeclarationEntry(1): [VariableDeclarationEntry] definition of y
+# 1876|           Type = [ArrayType] int[10]
+# 1877|     getStmt(1): [ExprStmt] ExprStmt
+# 1877|       getExpr(): [AssignExpr] ... = ...
+# 1877|           Type = [IntType] int
+# 1877|           ValueCategory = lvalue
+# 1877|         getLValue(): [PointerDereferenceExpr] * ...
+# 1877|             Type = [IntType] int
+# 1877|             ValueCategory = lvalue
+# 1877|           getOperand(): [VariableAccess] x
+# 1877|               Type = [ArrayType] int[10]
+# 1877|               ValueCategory = lvalue
+# 1877|           getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 1877|               Type = [IntPointerType] int *
+# 1877|               ValueCategory = prvalue
+# 1877|         getRValue(): [Literal] 10
+# 1877|             Type = [IntType] int
+# 1877|             Value = [Literal] 10
+# 1877|             ValueCategory = prvalue
+# 1878|     getStmt(2): [ExprStmt] ExprStmt
+# 1878|       getExpr(): [AssignExpr] ... = ...
+# 1878|           Type = [IntType] int
+# 1878|           ValueCategory = lvalue
+# 1878|         getLValue(): [PointerDereferenceExpr] * ...
+# 1878|             Type = [IntType] int
+# 1878|             ValueCategory = lvalue
+# 1878|           getOperand(): [VariableAccess] y
+# 1878|               Type = [ArrayType] int[10]
+# 1878|               ValueCategory = lvalue
+# 1878|           getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 1878|               Type = [IntPointerType] int *
+# 1878|               ValueCategory = prvalue
+# 1878|         getRValue(): [Literal] 10
+# 1878|             Type = [IntType] int
+# 1878|             Value = [Literal] 10
+# 1878|             ValueCategory = prvalue
+# 1879|     getStmt(3): [ReturnStmt] return ...
+# 1879|       getExpr(): [AddExpr] ... + ...
+# 1879|           Type = [IntType] int
+# 1879|           ValueCategory = prvalue
+# 1879|         getLeftOperand(): [PointerDereferenceExpr] * ...
+# 1879|             Type = [IntType] int
+# 1879|             ValueCategory = prvalue(load)
+# 1879|           getOperand(): [VariableAccess] x
+# 1879|               Type = [ArrayType] int[10]
+# 1879|               ValueCategory = lvalue
+# 1879|           getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 1879|               Type = [IntPointerType] int *
+# 1879|               ValueCategory = prvalue
+# 1879|         getRightOperand(): [PointerDereferenceExpr] * ...
+# 1879|             Type = [IntType] int
+# 1879|             ValueCategory = prvalue(load)
+# 1879|           getOperand(): [VariableAccess] y
+# 1879|               Type = [ArrayType] int[10]
+# 1879|               ValueCategory = lvalue
+# 1879|           getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 1879|               Type = [IntPointerType] int *
+# 1879|               ValueCategory = prvalue
+# 1875| [MemberFunction] int missing_declaration_entries::Bar2<int>::two_missing_variable_declaration_entries()
+# 1875|   <params>: 
+# 1875|   getEntryPoint(): [BlockStmt] { ... }
+# 1876|     getStmt(0): [DeclStmt] declaration
+# 1877|     getStmt(1): [ExprStmt] ExprStmt
+# 1877|       getExpr(): [AssignExpr] ... = ...
+# 1877|           Type = [IntType] int
+# 1877|           ValueCategory = lvalue
+# 1877|         getLValue(): [PointerDereferenceExpr] * ...
+# 1877|             Type = [IntType] int
+# 1877|             ValueCategory = lvalue
+# 1877|           getOperand(): [VariableAccess] x
+# 1877|               Type = [ArrayType] int[10]
+# 1877|               ValueCategory = lvalue
+# 1877|           getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 1877|               Type = [IntPointerType] int *
+# 1877|               ValueCategory = prvalue
+# 1877|         getRValue(): [Literal] 10
+# 1877|             Type = [IntType] int
+# 1877|             Value = [Literal] 10
+# 1877|             ValueCategory = prvalue
+# 1878|     getStmt(2): [ExprStmt] ExprStmt
+# 1878|       getExpr(): [AssignExpr] ... = ...
+# 1878|           Type = [IntType] int
+# 1878|           ValueCategory = lvalue
+# 1878|         getLValue(): [PointerDereferenceExpr] * ...
+# 1878|             Type = [IntType] int
+# 1878|             ValueCategory = lvalue
+# 1878|           getOperand(): [VariableAccess] y
+# 1878|               Type = [ArrayType] int[10]
+# 1878|               ValueCategory = lvalue
+# 1878|           getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 1878|               Type = [IntPointerType] int *
+# 1878|               ValueCategory = prvalue
+# 1878|         getRValue(): [Literal] 10
+# 1878|             Type = [IntType] int
+# 1878|             Value = [Literal] 10
+# 1878|             ValueCategory = prvalue
+# 1879|     getStmt(3): [ReturnStmt] return ...
+# 1879|       getExpr(): [AddExpr] ... + ...
+# 1879|           Type = [IntType] int
+# 1879|           ValueCategory = prvalue
+# 1879|         getLeftOperand(): [PointerDereferenceExpr] * ...
+# 1879|             Type = [IntType] int
+# 1879|             ValueCategory = prvalue(load)
+# 1879|           getOperand(): [VariableAccess] x
+# 1879|               Type = [ArrayType] int[10]
+# 1879|               ValueCategory = lvalue
+# 1879|           getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 1879|               Type = [IntPointerType] int *
+# 1879|               ValueCategory = prvalue
+# 1879|         getRightOperand(): [PointerDereferenceExpr] * ...
+# 1879|             Type = [IntType] int
+# 1879|             ValueCategory = prvalue(load)
+# 1879|           getOperand(): [VariableAccess] y
+# 1879|               Type = [ArrayType] int[10]
+# 1879|               ValueCategory = lvalue
+# 1879|           getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 1879|               Type = [IntPointerType] int *
+# 1879|               ValueCategory = prvalue
+# 1883| [TopLevelFunction] void missing_declaration_entries::test2()
+# 1883|   <params>: 
+# 1883|   getEntryPoint(): [BlockStmt] { ... }
+# 1884|     getStmt(0): [DeclStmt] declaration
+# 1884|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of b
+# 1884|           Type = [ClassTemplateInstantiation,Struct] Bar2<int>
+# 1885|     getStmt(1): [ExprStmt] ExprStmt
+# 1885|       getExpr(): [FunctionCall] call to two_missing_variable_declaration_entries
+# 1885|           Type = [IntType] int
+# 1885|           ValueCategory = prvalue
+# 1885|         getQualifier(): [VariableAccess] b
+# 1885|             Type = [ClassTemplateInstantiation,Struct] Bar2<int>
+# 1885|             ValueCategory = lvalue
+# 1886|     getStmt(2): [ReturnStmt] return ...
 perf-regression.cpp:
 #    4| [CopyAssignmentOperator] Big& Big::operator=(Big const&)
 #    4|   <params>: 
diff --git a/cpp/ql/test/library-tests/ir/ir/ir.cpp b/cpp/ql/test/library-tests/ir/ir/ir.cpp
index 3e43f5b0d61..5a8d500fa43 100644
--- a/cpp/ql/test/library-tests/ir/ir/ir.cpp
+++ b/cpp/ql/test/library-tests/ir/ir/ir.cpp
@@ -1851,4 +1851,39 @@ void magicvars() {
     const char *strfunc = __func__;
 }
 
+namespace missing_declaration_entries {
+    struct S {};
+
+    template<typename A, typename B> struct pair{};
+
+    template<typename T> struct Bar1 {
+        typedef S* pointer;
+
+        void* missing_type_decl_entry(pointer p) {
+            typedef pair<pointer, bool> _Res;
+            return p;
+        }
+    };
+
+    void test1() {
+        Bar1<int> b;
+        b.missing_type_decl_entry(nullptr);
+    }
+
+    template<typename T> struct Bar2 {
+
+        int two_missing_variable_declaration_entries() {
+            int x[10], y[10];
+            *x = 10;
+            *y = 10;
+            return *x + *y;
+        }
+    };
+
+    void test2() {
+        Bar2<int> b;
+        b.two_missing_variable_declaration_entries();
+    }
+}
+
 // semmle-extractor-options: -std=c++17 --clang
diff --git a/cpp/ql/test/library-tests/ir/ir/operand_locations.expected b/cpp/ql/test/library-tests/ir/ir/operand_locations.expected
index 61ca670b978..eb63841daba 100644
--- a/cpp/ql/test/library-tests/ir/ir/operand_locations.expected
+++ b/cpp/ql/test/library-tests/ir/ir/operand_locations.expected
@@ -5303,10 +5303,10 @@
 | ir.cpp:1077:39:1077:39 | Address | &:r1077_7 |
 | ir.cpp:1077:39:1077:39 | Load | m1077_6 |
 | ir.cpp:1077:39:1077:39 | SideEffect | m1077_8 |
-| ir.cpp:1078:5:1078:5 | Address | &:r1078_1 |
-| ir.cpp:1078:5:1078:5 | Address | &:r1078_7 |
-| ir.cpp:1078:5:1078:5 | Address | &:r1078_15 |
-| ir.cpp:1078:14:1078:14 | Address | &:r1078_33 |
+| ir.cpp:1078:5:1082:5 | Address | &:r1078_1 |
+| ir.cpp:1078:5:1082:5 | Address | &:r1078_7 |
+| ir.cpp:1078:5:1082:5 | Address | &:r1078_15 |
+| ir.cpp:1078:5:1082:5 | Address | &:r1078_33 |
 | ir.cpp:1078:18:1078:18 | Address | &:r1078_2 |
 | ir.cpp:1078:18:1078:18 | Address | &:r1078_8 |
 | ir.cpp:1078:18:1078:18 | Address | &:r1078_16 |
@@ -5369,10 +5369,10 @@
 | ir.cpp:1079:13:1079:13 | Load | m1078_40 |
 | ir.cpp:1079:13:1079:17 | Condition | r1079_4 |
 | ir.cpp:1079:17:1079:17 | Right | r1079_3 |
-| ir.cpp:1084:5:1084:5 | Address | &:r1084_1 |
-| ir.cpp:1084:5:1084:5 | Address | &:r1084_7 |
-| ir.cpp:1084:5:1084:5 | Address | &:r1084_15 |
-| ir.cpp:1084:21:1084:21 | Address | &:r1084_42 |
+| ir.cpp:1084:5:1088:5 | Address | &:r1084_1 |
+| ir.cpp:1084:5:1088:5 | Address | &:r1084_7 |
+| ir.cpp:1084:5:1088:5 | Address | &:r1084_15 |
+| ir.cpp:1084:5:1088:5 | Address | &:r1084_42 |
 | ir.cpp:1084:25:1084:25 | Address | &:r1084_2 |
 | ir.cpp:1084:25:1084:25 | Address | &:r1084_8 |
 | ir.cpp:1084:25:1084:25 | Address | &:r1084_16 |
@@ -8650,6 +8650,97 @@
 | ir.cpp:1851:17:1851:23 | Address | &:r1851_1 |
 | ir.cpp:1851:27:1851:34 | StoreValue | r1851_3 |
 | ir.cpp:1851:27:1851:34 | Unary | r1851_2 |
+| ir.cpp:1862:15:1862:15 | Address | &:r1862_5 |
+| ir.cpp:1862:15:1862:15 | Address | &:r1862_5 |
+| ir.cpp:1862:15:1862:15 | Address | &:r1862_7 |
+| ir.cpp:1862:15:1862:15 | Address | &:r1862_7 |
+| ir.cpp:1862:15:1862:15 | Address | &:r1862_15 |
+| ir.cpp:1862:15:1862:15 | ChiPartial | partial:m1862_3 |
+| ir.cpp:1862:15:1862:15 | ChiTotal | total:m1862_2 |
+| ir.cpp:1862:15:1862:15 | Load | m1862_6 |
+| ir.cpp:1862:15:1862:15 | Load | m1864_5 |
+| ir.cpp:1862:15:1862:15 | SideEffect | m1862_3 |
+| ir.cpp:1862:15:1862:15 | SideEffect | m1862_8 |
+| ir.cpp:1862:47:1862:47 | Address | &:r1862_9 |
+| ir.cpp:1862:47:1862:47 | Address | &:r1862_9 |
+| ir.cpp:1862:47:1862:47 | Address | &:r1862_11 |
+| ir.cpp:1862:47:1862:47 | Address | &:r1862_11 |
+| ir.cpp:1862:47:1862:47 | Load | m1862_10 |
+| ir.cpp:1862:47:1862:47 | SideEffect | m1862_12 |
+| ir.cpp:1864:13:1864:21 | Address | &:r1864_1 |
+| ir.cpp:1864:20:1864:20 | Address | &:r1864_2 |
+| ir.cpp:1864:20:1864:20 | Load | m1862_10 |
+| ir.cpp:1864:20:1864:20 | StoreValue | r1864_4 |
+| ir.cpp:1864:20:1864:20 | Unary | r1864_3 |
+| ir.cpp:1868:10:1868:14 | ChiPartial | partial:m1868_3 |
+| ir.cpp:1868:10:1868:14 | ChiTotal | total:m1868_2 |
+| ir.cpp:1868:10:1868:14 | SideEffect | ~m1870_12 |
+| ir.cpp:1869:19:1869:19 | Address | &:r1869_1 |
+| ir.cpp:1870:9:1870:9 | Address | &:r1870_1 |
+| ir.cpp:1870:9:1870:9 | Address | &:r1870_1 |
+| ir.cpp:1870:9:1870:9 | Arg(this) | this:r1870_1 |
+| ir.cpp:1870:9:1870:9 | ChiPartial | partial:m1870_9 |
+| ir.cpp:1870:9:1870:9 | ChiTotal | total:m1869_2 |
+| ir.cpp:1870:9:1870:9 | SideEffect | m1869_2 |
+| ir.cpp:1870:11:1870:33 | CallTarget | func:r1870_2 |
+| ir.cpp:1870:11:1870:33 | ChiPartial | partial:m1870_5 |
+| ir.cpp:1870:11:1870:33 | ChiTotal | total:m1868_4 |
+| ir.cpp:1870:11:1870:33 | SideEffect | ~m1868_4 |
+| ir.cpp:1870:35:1870:41 | Address | &:r1870_3 |
+| ir.cpp:1870:35:1870:41 | Address | &:r1870_3 |
+| ir.cpp:1870:35:1870:41 | Arg(0) | 0:r1870_3 |
+| ir.cpp:1870:35:1870:41 | ChiPartial | partial:m1870_11 |
+| ir.cpp:1870:35:1870:41 | ChiTotal | total:m1870_6 |
+| ir.cpp:1870:35:1870:41 | SideEffect | ~m1870_6 |
+| ir.cpp:1875:13:1875:13 | Address | &:r1875_5 |
+| ir.cpp:1875:13:1875:13 | Address | &:r1875_5 |
+| ir.cpp:1875:13:1875:13 | Address | &:r1875_7 |
+| ir.cpp:1875:13:1875:13 | Address | &:r1875_7 |
+| ir.cpp:1875:13:1875:13 | Address | &:r1875_10 |
+| ir.cpp:1875:13:1875:13 | ChiPartial | partial:m1875_3 |
+| ir.cpp:1875:13:1875:13 | ChiTotal | total:m1875_2 |
+| ir.cpp:1875:13:1875:13 | Load | m1875_6 |
+| ir.cpp:1875:13:1875:13 | Load | m1879_9 |
+| ir.cpp:1875:13:1875:13 | SideEffect | m1875_3 |
+| ir.cpp:1875:13:1875:13 | SideEffect | m1875_8 |
+| ir.cpp:1876:13:1876:29 | Address | &:r1876_1 |
+| ir.cpp:1876:13:1876:29 | Address | &:r1876_3 |
+| ir.cpp:1877:13:1877:14 | Address | &:r1877_4 |
+| ir.cpp:1877:13:1877:19 | ChiPartial | partial:m1877_5 |
+| ir.cpp:1877:13:1877:19 | ChiTotal | total:m1876_2 |
+| ir.cpp:1877:14:1877:14 | Unary | r1877_2 |
+| ir.cpp:1877:14:1877:14 | Unary | r1877_3 |
+| ir.cpp:1877:18:1877:19 | StoreValue | r1877_1 |
+| ir.cpp:1878:13:1878:14 | Address | &:r1878_4 |
+| ir.cpp:1878:13:1878:19 | ChiPartial | partial:m1878_5 |
+| ir.cpp:1878:13:1878:19 | ChiTotal | total:m1876_4 |
+| ir.cpp:1878:14:1878:14 | Unary | r1878_2 |
+| ir.cpp:1878:14:1878:14 | Unary | r1878_3 |
+| ir.cpp:1878:18:1878:19 | StoreValue | r1878_1 |
+| ir.cpp:1879:13:1879:27 | Address | &:r1879_1 |
+| ir.cpp:1879:20:1879:21 | Left | r1879_4 |
+| ir.cpp:1879:20:1879:21 | Load | m1877_5 |
+| ir.cpp:1879:20:1879:26 | StoreValue | r1879_8 |
+| ir.cpp:1879:21:1879:21 | Address | &:r1879_3 |
+| ir.cpp:1879:21:1879:21 | Unary | r1879_2 |
+| ir.cpp:1879:25:1879:26 | Load | m1878_5 |
+| ir.cpp:1879:25:1879:26 | Right | r1879_7 |
+| ir.cpp:1879:26:1879:26 | Address | &:r1879_6 |
+| ir.cpp:1879:26:1879:26 | Unary | r1879_5 |
+| ir.cpp:1883:10:1883:14 | ChiPartial | partial:m1883_3 |
+| ir.cpp:1883:10:1883:14 | ChiTotal | total:m1883_2 |
+| ir.cpp:1883:10:1883:14 | SideEffect | ~m1885_5 |
+| ir.cpp:1884:19:1884:19 | Address | &:r1884_1 |
+| ir.cpp:1885:9:1885:9 | Address | &:r1885_1 |
+| ir.cpp:1885:9:1885:9 | Address | &:r1885_1 |
+| ir.cpp:1885:9:1885:9 | Arg(this) | this:r1885_1 |
+| ir.cpp:1885:9:1885:9 | ChiPartial | partial:m1885_7 |
+| ir.cpp:1885:9:1885:9 | ChiTotal | total:m1884_2 |
+| ir.cpp:1885:9:1885:9 | SideEffect | m1884_2 |
+| ir.cpp:1885:11:1885:50 | CallTarget | func:r1885_2 |
+| ir.cpp:1885:11:1885:50 | ChiPartial | partial:m1885_4 |
+| ir.cpp:1885:11:1885:50 | ChiTotal | total:m1883_4 |
+| ir.cpp:1885:11:1885:50 | SideEffect | ~m1883_4 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_7 |
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_consistency.expected b/cpp/ql/test/library-tests/ir/ir/raw_consistency.expected
index cc50472385b..600d74bc916 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_consistency.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_consistency.expected
@@ -6,7 +6,6 @@ missingOperandType
 duplicateChiOperand
 sideEffectWithoutPrimary
 instructionWithoutSuccessor
-| ../../../include/memory.h:68:25:68:33 | CopyValue: (reference to) | Instruction 'CopyValue: (reference to)' has no successors in function '$@'. | ../../../include/memory.h:67:5:67:5 | void std::unique_ptr<int, std::default_delete<int>>::~unique_ptr() | void std::unique_ptr<int, std::default_delete<int>>::~unique_ptr() |
 ambiguousSuccessors
 unexplainedLoop
 unnecessaryPhiInstruction
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index 1d059ce6a1e..cb8bd0465da 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -9932,6 +9932,108 @@ ir.cpp:
 # 1849|     v1849_5(void)            = AliasedUse                           : ~m?
 # 1849|     v1849_6(void)            = ExitFunction                         : 
 
+# 1862| void* missing_declaration_entries::Bar1<int>::missing_type_decl_entry(missing_declaration_entries::Bar1<int>::pointer)
+# 1862|   Block 0
+# 1862|     v1862_1(void)              = EnterFunction                : 
+# 1862|     mu1862_2(unknown)          = AliasedDefinition            : 
+# 1862|     mu1862_3(unknown)          = InitializeNonLocal           : 
+# 1862|     r1862_4(glval<unknown>)    = VariableAddress[#this]       : 
+# 1862|     mu1862_5(glval<Bar1<int>>) = InitializeParameter[#this]   : &:r1862_4
+# 1862|     r1862_6(glval<Bar1<int>>)  = Load[#this]                  : &:r1862_4, ~m?
+# 1862|     mu1862_7(Bar1<int>)        = InitializeIndirection[#this] : &:r1862_6
+# 1862|     r1862_8(glval<S *>)        = VariableAddress[p]           : 
+# 1862|     mu1862_9(S *)              = InitializeParameter[p]       : &:r1862_8
+# 1862|     r1862_10(S *)              = Load[p]                      : &:r1862_8, ~m?
+# 1862|     mu1862_11(unknown)         = InitializeIndirection[p]     : &:r1862_10
+# 1864|     r1864_1(glval<void *>)     = VariableAddress[#return]     : 
+# 1864|     r1864_2(glval<S *>)        = VariableAddress[p]           : 
+# 1864|     r1864_3(S *)               = Load[p]                      : &:r1864_2, ~m?
+# 1864|     r1864_4(void *)            = Convert                      : r1864_3
+# 1864|     mu1864_5(void *)           = Store[#return]               : &:r1864_1, r1864_4
+# 1862|     v1862_12(void)             = ReturnIndirection[#this]     : &:r1862_6, ~m?
+# 1862|     v1862_13(void)             = ReturnIndirection[p]         : &:r1862_10, ~m?
+# 1862|     r1862_14(glval<void *>)    = VariableAddress[#return]     : 
+# 1862|     v1862_15(void)             = ReturnValue                  : &:r1862_14, ~m?
+# 1862|     v1862_16(void)             = AliasedUse                   : ~m?
+# 1862|     v1862_17(void)             = ExitFunction                 : 
+
+# 1868| void missing_declaration_entries::test1()
+# 1868|   Block 0
+# 1868|     v1868_1(void)             = EnterFunction                            : 
+# 1868|     mu1868_2(unknown)         = AliasedDefinition                        : 
+# 1868|     mu1868_3(unknown)         = InitializeNonLocal                       : 
+# 1869|     r1869_1(glval<Bar1<int>>) = VariableAddress[b]                       : 
+# 1869|     mu1869_2(Bar1<int>)       = Uninitialized[b]                         : &:r1869_1
+# 1870|     r1870_1(glval<Bar1<int>>) = VariableAddress[b]                       : 
+# 1870|     r1870_2(glval<unknown>)   = FunctionAddress[missing_type_decl_entry] : 
+# 1870|     r1870_3(S *)              = Constant[0]                              : 
+# 1870|     r1870_4(void *)           = Call[missing_type_decl_entry]            : func:r1870_2, this:r1870_1, 0:r1870_3
+# 1870|     mu1870_5(unknown)         = ^CallSideEffect                          : ~m?
+# 1870|     v1870_6(void)             = ^IndirectReadSideEffect[-1]              : &:r1870_1, ~m?
+# 1870|     v1870_7(void)             = ^BufferReadSideEffect[0]                 : &:r1870_3, ~m?
+# 1870|     mu1870_8(Bar1<int>)       = ^IndirectMayWriteSideEffect[-1]          : &:r1870_1
+# 1870|     mu1870_9(unknown)         = ^BufferMayWriteSideEffect[0]             : &:r1870_3
+# 1871|     v1871_1(void)             = NoOp                                     : 
+# 1868|     v1868_4(void)             = ReturnVoid                               : 
+# 1868|     v1868_5(void)             = AliasedUse                               : ~m?
+# 1868|     v1868_6(void)             = ExitFunction                             : 
+
+# 1875| int missing_declaration_entries::Bar2<int>::two_missing_variable_declaration_entries()
+# 1875|   Block 0
+# 1875|     v1875_1(void)              = EnterFunction                : 
+# 1875|     mu1875_2(unknown)          = AliasedDefinition            : 
+# 1875|     mu1875_3(unknown)          = InitializeNonLocal           : 
+# 1875|     r1875_4(glval<unknown>)    = VariableAddress[#this]       : 
+# 1875|     mu1875_5(glval<Bar2<int>>) = InitializeParameter[#this]   : &:r1875_4
+# 1875|     r1875_6(glval<Bar2<int>>)  = Load[#this]                  : &:r1875_4, ~m?
+# 1875|     mu1875_7(Bar2<int>)        = InitializeIndirection[#this] : &:r1875_6
+# 1876|     r1876_1(glval<int[10]>)    = VariableAddress[x]           : 
+# 1876|     mu1876_2(int[10])          = Uninitialized[x]             : &:r1876_1
+# 1876|     r1876_3(glval<int[10]>)    = VariableAddress[y]           : 
+# 1876|     mu1876_4(int[10])          = Uninitialized[y]             : &:r1876_3
+# 1877|     r1877_1(int)               = Constant[10]                 : 
+# 1877|     r1877_2(glval<int[10]>)    = VariableAddress[x]           : 
+# 1877|     r1877_3(int *)             = Convert                      : r1877_2
+# 1877|     r1877_4(glval<int>)        = CopyValue                    : r1877_3
+# 1877|     mu1877_5(int)              = Store[?]                     : &:r1877_4, r1877_1
+# 1878|     r1878_1(int)               = Constant[10]                 : 
+# 1878|     r1878_2(glval<int[10]>)    = VariableAddress[y]           : 
+# 1878|     r1878_3(int *)             = Convert                      : r1878_2
+# 1878|     r1878_4(glval<int>)        = CopyValue                    : r1878_3
+# 1878|     mu1878_5(int)              = Store[?]                     : &:r1878_4, r1878_1
+# 1879|     r1879_1(glval<int>)        = VariableAddress[#return]     : 
+# 1879|     r1879_2(glval<int[10]>)    = VariableAddress[x]           : 
+# 1879|     r1879_3(int *)             = Convert                      : r1879_2
+# 1879|     r1879_4(int)               = Load[?]                      : &:r1879_3, ~m?
+# 1879|     r1879_5(glval<int[10]>)    = VariableAddress[y]           : 
+# 1879|     r1879_6(int *)             = Convert                      : r1879_5
+# 1879|     r1879_7(int)               = Load[?]                      : &:r1879_6, ~m?
+# 1879|     r1879_8(int)               = Add                          : r1879_4, r1879_7
+# 1879|     mu1879_9(int)              = Store[#return]               : &:r1879_1, r1879_8
+# 1875|     v1875_8(void)              = ReturnIndirection[#this]     : &:r1875_6, ~m?
+# 1875|     r1875_9(glval<int>)        = VariableAddress[#return]     : 
+# 1875|     v1875_10(void)             = ReturnValue                  : &:r1875_9, ~m?
+# 1875|     v1875_11(void)             = AliasedUse                   : ~m?
+# 1875|     v1875_12(void)             = ExitFunction                 : 
+
+# 1883| void missing_declaration_entries::test2()
+# 1883|   Block 0
+# 1883|     v1883_1(void)             = EnterFunction                                             : 
+# 1883|     mu1883_2(unknown)         = AliasedDefinition                                         : 
+# 1883|     mu1883_3(unknown)         = InitializeNonLocal                                        : 
+# 1884|     r1884_1(glval<Bar2<int>>) = VariableAddress[b]                                        : 
+# 1884|     mu1884_2(Bar2<int>)       = Uninitialized[b]                                          : &:r1884_1
+# 1885|     r1885_1(glval<Bar2<int>>) = VariableAddress[b]                                        : 
+# 1885|     r1885_2(glval<unknown>)   = FunctionAddress[two_missing_variable_declaration_entries] : 
+# 1885|     r1885_3(int)              = Call[two_missing_variable_declaration_entries]            : func:r1885_2, this:r1885_1
+# 1885|     mu1885_4(unknown)         = ^CallSideEffect                                           : ~m?
+# 1885|     v1885_5(void)             = ^IndirectReadSideEffect[-1]                               : &:r1885_1, ~m?
+# 1885|     mu1885_6(Bar2<int>)       = ^IndirectMayWriteSideEffect[-1]                           : &:r1885_1
+# 1886|     v1886_1(void)             = NoOp                                                      : 
+# 1883|     v1883_4(void)             = ReturnVoid                                                : 
+# 1883|     v1883_5(void)             = AliasedUse                                                : ~m?
+# 1883|     v1883_6(void)             = ExitFunction                                              : 
+
 perf-regression.cpp:
 #    6| void Big::Big()
 #    6|   Block 0
diff --git a/cpp/ql/test/library-tests/pod/isPOD.ql b/cpp/ql/test/library-tests/pod/isPOD.ql
index e7860247eb7..77f7e136019 100644
--- a/cpp/ql/test/library-tests/pod/isPOD.ql
+++ b/cpp/ql/test/library-tests/pod/isPOD.ql
@@ -1,5 +1,5 @@
 import cpp
 
 from Class c, boolean ispod
-where if c.isPOD() then ispod = true else ispod = false
+where if c.isPod() then ispod = true else ispod = false
 select c, ispod
diff --git a/cpp/ql/test/library-tests/pod/isPOD03.ql b/cpp/ql/test/library-tests/pod/isPOD03.ql
index 42f6eed559f..84f2433f8da 100644
--- a/cpp/ql/test/library-tests/pod/isPOD03.ql
+++ b/cpp/ql/test/library-tests/pod/isPOD03.ql
@@ -1,5 +1,5 @@
 import semmle.code.cpp.PODType03
 
 from Class c, boolean ispod
-where if isPODClass03(c) then ispod = true else ispod = false
+where if isPodClass03(c) then ispod = true else ispod = false
 select c, ispod
diff --git a/cpp/ql/test/library-tests/sal/sal.ql b/cpp/ql/test/library-tests/sal/sal.ql
index eb4908bae9e..52104793d3e 100644
--- a/cpp/ql/test/library-tests/sal/sal.ql
+++ b/cpp/ql/test/library-tests/sal/sal.ql
@@ -1,4 +1,4 @@
 import Microsoft.SAL
 
-from SALAnnotation a
+from SalAnnotation a
 select a, a.getDeclaration()
diff --git a/cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected b/cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected
index 044257ed952..b4035e32b18 100644
--- a/cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected
+++ b/cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected
@@ -1598,17 +1598,17 @@ postWithInFlow
 | constmemberaccess.cpp:9:2:9:2 | i [post update] | PostUpdateNode should not be the target of local flow. |
 | constructorinitializer.cpp:8:4:8:4 | Argument this [post update] | PostUpdateNode should not be the target of local flow. |
 | constructorinitializer.cpp:8:4:8:4 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:6:5:6:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:6:5:6:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:6:5:6:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:6:16:6:17 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:6:5:8:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:6:5:8:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:6:5:8:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:6:5:8:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | cpp11.cpp:7:7:7:8 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
 | cpp11.cpp:7:7:7:8 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | cpp11.cpp:7:7:7:8 | el [post update] | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:28:5:28:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:28:5:28:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:28:5:28:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:28:16:28:17 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:28:5:30:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:28:5:30:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:28:5:30:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:28:5:30:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | cpp11.cpp:28:21:28:21 | (__begin) [post update] | PostUpdateNode should not be the target of local flow. |
 | cpp11.cpp:28:21:28:21 | (__begin) [post update] | PostUpdateNode should not be the target of local flow. |
 | cpp11.cpp:28:21:28:21 | (__begin) [post update] | PostUpdateNode should not be the target of local flow. |
@@ -2644,10 +2644,10 @@ postWithInFlow
 | stmt_expr.cpp:27:5:27:7 | ptr [post update] | PostUpdateNode should not be the target of local flow. |
 | stream_it.cpp:4:16:4:30 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | stream_it.cpp:5:14:5:28 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| stream_it.cpp:11:3:11:3 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| stream_it.cpp:11:3:11:3 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| stream_it.cpp:11:3:11:3 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| stream_it.cpp:11:10:11:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| stream_it.cpp:11:3:13:3 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| stream_it.cpp:11:3:13:3 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| stream_it.cpp:11:3:13:3 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| stream_it.cpp:11:3:13:3 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | stream_it.cpp:11:16:11:16 | (__range) [post update] | PostUpdateNode should not be the target of local flow. |
 | stream_it.cpp:11:16:11:16 | (__range) [post update] | PostUpdateNode should not be the target of local flow. |
 | stream_it.cpp:11:16:11:16 | (__range) [post update] | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/EmptyBlock/EmptyBlock.expected b/cpp/ql/test/query-tests/Best Practices/Likely Errors/EmptyBlock/EmptyBlock.expected
index db58438a704..dc572fae9be 100644
--- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/EmptyBlock/EmptyBlock.expected	
+++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/EmptyBlock/EmptyBlock.expected	
@@ -1,3 +1,3 @@
-| empty_block.cpp:9:10:9:11 | { ... } | Empty block without comment |
-| empty_block.cpp:12:10:13:3 | { ... } | Empty block without comment |
-| empty_block.cpp:20:10:21:3 | { ... } | Empty block without comment |
+| empty_block.cpp:9:10:9:11 | { ... } | Empty block without comment. |
+| empty_block.cpp:12:10:13:3 | { ... } | Empty block without comment. |
+| empty_block.cpp:20:10:21:3 | { ... } | Empty block without comment. |
diff --git a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.expected b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.expected
new file mode 100644
index 00000000000..184e893ad16
--- /dev/null
+++ b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.expected
@@ -0,0 +1,19 @@
+| test.cpp:30:7:30:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:30:7:30:7 | i | i | test.cpp:29:3:29:7 | call to scanf | call to scanf |
+| test.cpp:46:7:46:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:46:7:46:7 | i | i | test.cpp:45:3:45:7 | call to scanf | call to scanf |
+| test.cpp:63:7:63:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:63:7:63:7 | i | i | test.cpp:62:3:62:7 | call to scanf | call to scanf |
+| test.cpp:75:7:75:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:75:7:75:7 | i | i | test.cpp:74:3:74:7 | call to scanf | call to scanf |
+| test.cpp:87:7:87:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:87:7:87:7 | i | i | test.cpp:86:3:86:8 | call to fscanf | call to fscanf |
+| test.cpp:94:7:94:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:94:7:94:7 | i | i | test.cpp:93:3:93:8 | call to sscanf | call to sscanf |
+| test.cpp:143:8:143:8 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:143:8:143:8 | i | i | test.cpp:141:7:141:11 | call to scanf | call to scanf |
+| test.cpp:152:8:152:8 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:152:8:152:8 | i | i | test.cpp:150:7:150:11 | call to scanf | call to scanf |
+| test.cpp:184:8:184:8 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:184:8:184:8 | i | i | test.cpp:183:7:183:11 | call to scanf | call to scanf |
+| test.cpp:203:8:203:8 | j | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 2. | test.cpp:203:8:203:8 | j | j | test.cpp:200:7:200:11 | call to scanf | call to scanf |
+| test.cpp:227:9:227:9 | d | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 2. | test.cpp:227:9:227:9 | d | d | test.cpp:225:25:225:29 | call to scanf | call to scanf |
+| test.cpp:231:9:231:9 | d | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 2. | test.cpp:231:9:231:9 | d | d | test.cpp:229:14:229:18 | call to scanf | call to scanf |
+| test.cpp:243:7:243:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:243:7:243:7 | i | i | test.cpp:242:3:242:7 | call to scanf | call to scanf |
+| test.cpp:251:7:251:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:251:7:251:7 | i | i | test.cpp:250:3:250:7 | call to scanf | call to scanf |
+| test.cpp:259:7:259:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:259:7:259:7 | i | i | test.cpp:258:3:258:7 | call to scanf | call to scanf |
+| test.cpp:271:7:271:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:271:7:271:7 | i | i | test.cpp:270:3:270:7 | call to scanf | call to scanf |
+| test.cpp:281:8:281:12 | ptr_i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:281:8:281:12 | ptr_i | ptr_i | test.cpp:280:3:280:7 | call to scanf | call to scanf |
+| test.cpp:289:7:289:7 | i | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:289:7:289:7 | i | i | test.cpp:288:3:288:7 | call to scanf | call to scanf |
+| test.cpp:383:25:383:25 | u | $@ is read here, but may not have been written. It should be guarded by a check that the $@ returns at least 1. | test.cpp:383:25:383:25 | u | u | test.cpp:382:6:382:11 | call to sscanf | call to sscanf |
diff --git a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.qlref b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.qlref
new file mode 100644
index 00000000000..97e85b5abbe
--- /dev/null
+++ b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.qlref
@@ -0,0 +1 @@
+Critical/MissingCheckScanf.ql
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp
new file mode 100644
index 00000000000..e621936dc33
--- /dev/null
+++ b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp
@@ -0,0 +1,387 @@
+typedef struct
+{
+} FILE;
+
+typedef void *locale_t;
+
+int scanf(const char *format, ...);
+int fscanf(FILE *stream, const char *format, ...);
+int sscanf(const char *s, const char *format, ...);
+int _scanf_l(const char *format, locale_t locale, ...);
+
+void use(int i);
+
+void set_by_ref(int &i);
+void set_by_ptr(int *i);
+bool maybe();
+
+FILE *get_a_stream();
+const char *get_a_string();
+extern locale_t get_a_locale();
+
+int main()
+{
+	// --- simple cases ---
+
+	{
+		int i;
+
+		scanf("%d", &i);
+		use(i); // BAD: may not have written `i`
+	}
+
+	{
+		int i;
+
+		if (scanf("%d", &i) == 1)
+		{
+			use(i); // GOOD: checks return value
+		}
+	}
+
+	{
+		int i = 0;
+
+		scanf("%d", &i);
+		use(i); // BAD. Design choice: already initialized variables shouldn't make a difference.
+	}
+
+	{
+		int i;
+		use(i); // GOOD: only care about uses after scanf call
+
+		if (scanf("%d", &i) == 1)
+		{
+			use(i); // GOOD
+		}
+	}
+
+	{
+		int i; // Reused variable
+
+		scanf("%d", &i);
+		use(i); // BAD
+
+		if (scanf("%d", &i) == 1)
+		{
+			use(i); // GOOD
+		}
+	}
+
+	{
+		int i; // Reset variable
+
+		scanf("%d", &i);
+		use(i); // BAD
+
+		i = 1;
+		use(i); // GOOD
+	}
+
+	// --- different scanf functions ---
+
+	{
+		int i;
+
+		fscanf(get_a_stream(), "%d", &i);
+		use(i); // BAD: may not have written `i`
+	}
+
+	{
+		int i;
+
+		sscanf(get_a_string(), "%d", &i);
+		use(i); // BAD: may not have written `i`
+	}
+
+	{
+		int i;
+
+		if (_scanf_l("%d", get_a_locale(), &i) == 1)
+		{
+			use(i); // GOOD
+		}
+	}
+
+	// --- different ways of checking ---
+
+	{
+		int i;
+
+		if (scanf("%d", &i) >= 1)
+		{
+			use(i); // GOOD
+		}
+	}
+
+	{
+		int i;
+
+		if (scanf("%d", &i) == 1)
+		{
+			use(i); // GOOD
+		}
+	}
+
+	{
+		int i;
+
+		if (0 < scanf("%d", &i))
+		{
+			if (true)
+			{
+				use(i); // GOOD
+			}
+		}
+	}
+
+	{
+		int i;
+
+		if (scanf("%d", &i) != 0)
+		{
+			use(i); // BAD: scanf can return EOF
+		}
+	}
+
+	{
+		int i;
+
+		if (scanf("%d", &i) == 0)
+		{
+			use(i); // BAD: checks return value incorrectly
+		}
+	}
+
+	{
+		int r;
+		int i;
+
+		r = scanf("%d", &i);
+
+		if (r >= 1)
+		{
+			use(i); // GOOD
+		}
+	}
+
+	{
+		bool b;
+		int i;
+
+		b = scanf("%d", &i);
+
+		if (b >= 1)
+		{
+			use(i); // BAD [NOT DETECTED]: scanf can return EOF (boolifies true)
+		}
+	}
+
+	{
+		int i;
+
+		if (scanf("%d", &i))
+			use(i); // BAD
+	}
+
+	{
+		int i, j;
+
+		if (scanf("%d %d", &i) >= 2)
+		{
+			use(i); // GOOD
+			use(j); // GOOD: `j` is not a scanf arg, so out of scope of MissingCheckScanf
+		}
+	}
+
+	{
+		int i, j;
+
+		if (scanf("%d %d", &i, &j) >= 1)
+		{
+			use(i); // GOOD
+			use(j); // BAD: checks return value incorrectly
+		}
+	}
+
+	{
+		int i, j;
+
+		if (scanf("%d %d", &i, &j) >= 2)
+		{
+			use(i); // GOOD
+			use(j); // GOOD
+		}
+	}
+
+	{
+		char c[5];
+		int d;
+
+		while(maybe()) {
+			if (maybe()) {
+				break;
+			}
+			else if (maybe() && (scanf("%5c %d", c, &d) == 1)) { // GOOD
+				use(*(int *)c); // GOOD
+				use(d); // BAD
+			}
+			else if ((scanf("%5c %d", c, &d) == 1) && maybe()) { // GOOD
+				use(*(int *)c); // GOOD
+				use(d); // BAD
+			}
+		}
+	}
+
+	// --- different initialization ---
+
+	{
+		int i;
+		i = 0;
+
+		scanf("%d", &i);
+		use(i); // BAD
+	}
+
+	{
+		int i;
+
+		set_by_ref(i);
+		scanf("%d", &i);
+		use(i); // BAD
+	}
+
+	{
+		int i;
+
+		set_by_ptr(&i);
+		scanf("%d", &i);
+		use(i); // BAD
+	}
+
+	{
+		int i;
+
+		if (maybe())
+		{
+			i = 0;
+		}
+
+		scanf("%d", &i);
+		use(i); // BAD: `i` may not have been initialized
+	}
+
+	// --- different use ---
+
+	{
+		int i;
+		int *ptr_i = &i;
+
+		scanf("%d", &i);
+		use(*ptr_i); // BAD: may not have written `i`
+	}
+
+	{
+		int i;
+		int *ptr_i = &i;
+
+		scanf("%d", ptr_i);
+		use(i); // BAD: may not have written `*ptr_i`
+	}
+
+	{
+		int i;
+		scanf("%d", &i);
+		i = 42;
+		use(i); // GOOD
+	}
+
+	// --- weird formatting strings ---
+
+	{
+		int i, j;
+
+		if (sscanf("123", "%n %*d %n", &i, &j) >= 0)
+		{
+			use(i); // GOOD (`%n` does not consume input, but writes 0 to i)
+			use(j); // GOOD (`%n` does not consume input, but writes 3 to j)
+		}
+	}
+
+	{
+		int i;
+
+		if (scanf("%% %d", &i) >= 1)
+		{
+			use(i); // GOOD (`%%` does not consume input)
+		}
+	}
+
+	{
+		int i;
+
+		if (scanf("%*d %d", &i) >= 1)
+		{
+			use(i); // GOOD (`%*d` does not consume input)
+		}
+	}
+
+	{
+		int d, n;
+
+		if (scanf("%*d %d %n", &d, &n) == 1) {
+			use(d); // GOOD
+			use(n); // GOOD
+		}
+	}
+
+	{
+		char substr[32];
+		int n;
+        while (sscanf(get_a_string(), "%31[^:]: %d", substr, &n) == 2) { // GOOD: cycle from write to unguarded access
+			use(*(int *)substr); // GOOD
+            use(n); // GOOD
+		}
+	}
+}
+
+// --- Non-local cases ---
+
+bool my_scan_int(int &i)
+{
+	return scanf("%d", &i) == 1; // GOOD
+}
+
+void my_scan_int_test()
+{
+	int i;
+
+	use(i); // GOOD: used before scanf
+
+	my_scan_int(i);
+	use(i); // BAD [NOT DETECTED]
+
+	if (my_scan_int(i))
+	{
+		use(i); // GOOD
+	}
+}
+
+// --- Can be OK'd given a sufficiently smart analysis ---
+
+char *my_string_copy() {
+	static const char SRC_STRING[] = "48656C6C6F";
+	static       char DST_STRING[] = ".....";
+
+	int len = sizeof(SRC_STRING) - 1;
+    const char *src = SRC_STRING;
+    char *ptr = DST_STRING;
+
+    for (int i = 0; i < len; i += 2) {
+		unsigned int u;
+	    sscanf(src + i, "%2x", &u);
+        *ptr++ = (char) u; // GOOD [FALSE POSITIVE]? src+i+{0,1} are always valid %x digits, so this should be OK.
+    }
+	*ptr++ = 0;
+	return DST_STRING;
+}
diff --git a/cpp/ql/test/query-tests/Documentation/CommentedOutCode/CommentedOutCode.expected b/cpp/ql/test/query-tests/Documentation/CommentedOutCode/CommentedOutCode.expected
index b7889805514..9b4547cd2cd 100644
--- a/cpp/ql/test/query-tests/Documentation/CommentedOutCode/CommentedOutCode.expected
+++ b/cpp/ql/test/query-tests/Documentation/CommentedOutCode/CommentedOutCode.expected
@@ -1,20 +1,20 @@
-| test2.cpp:37:1:37:39 | // int myFunction() { return myValue; } | This comment appears to contain commented-out code |
-| test2.cpp:39:1:39:45 | // int myFunction() const { return myValue; } | This comment appears to contain commented-out code |
-| test2.cpp:41:1:41:54 | // int myFunction() const noexcept { return myValue; } | This comment appears to contain commented-out code |
-| test2.cpp:43:1:43:18 | // #define MYMACRO | This comment appears to contain commented-out code |
-| test2.cpp:45:1:45:23 | // #include "include.h" | This comment appears to contain commented-out code |
-| test2.cpp:47:1:51:2 | /*\n#ifdef\nvoid myFunction();\n#endif\n*/ | This comment appears to contain commented-out code |
-| test2.cpp:59:1:59:24 | // #if(defined(MYMACRO)) | This comment appears to contain commented-out code |
-| test2.cpp:63:1:63:15 | // #pragma once | This comment appears to contain commented-out code |
-| test2.cpp:65:1:65:17 | //  # pragma once | This comment appears to contain commented-out code |
-| test2.cpp:67:1:67:19 | /*#error"myerror"*/ | This comment appears to contain commented-out code |
-| test2.cpp:91:1:95:2 | /*\n#ifdef MYMACRO\n\t// ...\n#endif // #ifdef MYMACRO\n*/ | This comment appears to contain commented-out code |
-| test2.cpp:107:21:107:43 | // #include "config2.h" | This comment appears to contain commented-out code |
-| test2.cpp:115:16:115:35 | /* #ifdef MYMACRO */ | This comment appears to contain commented-out code |
-| test2.cpp:117:1:117:24 | // commented_out_code(); | This comment appears to contain commented-out code |
-| test2.cpp:120:2:120:25 | // commented_out_code(); | This comment appears to contain commented-out code |
-| test.c:2:1:2:22 | // commented out code; | This comment appears to contain commented-out code |
-| test.c:4:1:7:8 | // some; | This comment appears to contain commented-out code |
-| test.c:9:1:13:8 | // also; | This comment appears to contain commented-out code |
-| test.c:21:1:26:2 | /*\n    some;\n    commented;\n    out;\n    code;\n*/ | This comment appears to contain commented-out code |
-| test.c:28:1:34:2 | /*\n    also;\n    this\n    is;\n    commented-out\n    code;\n*/ | This comment appears to contain commented-out code |
+| test2.cpp:37:1:37:39 | // int myFunction() { return myValue; } | This comment appears to contain commented-out code. |
+| test2.cpp:39:1:39:45 | // int myFunction() const { return myValue; } | This comment appears to contain commented-out code. |
+| test2.cpp:41:1:41:54 | // int myFunction() const noexcept { return myValue; } | This comment appears to contain commented-out code. |
+| test2.cpp:43:1:43:18 | // #define MYMACRO | This comment appears to contain commented-out code. |
+| test2.cpp:45:1:45:23 | // #include "include.h" | This comment appears to contain commented-out code. |
+| test2.cpp:47:1:51:2 | /*\n#ifdef\nvoid myFunction();\n#endif\n*/ | This comment appears to contain commented-out code. |
+| test2.cpp:59:1:59:24 | // #if(defined(MYMACRO)) | This comment appears to contain commented-out code. |
+| test2.cpp:63:1:63:15 | // #pragma once | This comment appears to contain commented-out code. |
+| test2.cpp:65:1:65:17 | //  # pragma once | This comment appears to contain commented-out code. |
+| test2.cpp:67:1:67:19 | /*#error"myerror"*/ | This comment appears to contain commented-out code. |
+| test2.cpp:91:1:95:2 | /*\n#ifdef MYMACRO\n\t// ...\n#endif // #ifdef MYMACRO\n*/ | This comment appears to contain commented-out code. |
+| test2.cpp:107:21:107:43 | // #include "config2.h" | This comment appears to contain commented-out code. |
+| test2.cpp:115:16:115:35 | /* #ifdef MYMACRO */ | This comment appears to contain commented-out code. |
+| test2.cpp:117:1:117:24 | // commented_out_code(); | This comment appears to contain commented-out code. |
+| test2.cpp:120:2:120:25 | // commented_out_code(); | This comment appears to contain commented-out code. |
+| test.c:2:1:2:22 | // commented out code; | This comment appears to contain commented-out code. |
+| test.c:4:1:7:8 | // some; | This comment appears to contain commented-out code. |
+| test.c:9:1:13:8 | // also; | This comment appears to contain commented-out code. |
+| test.c:21:1:26:2 | /*\n    some;\n    commented;\n    out;\n    code;\n*/ | This comment appears to contain commented-out code. |
+| test.c:28:1:34:2 | /*\n    also;\n    this\n    is;\n    commented-out\n    code;\n*/ | This comment appears to contain commented-out code. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/BitwiseSignCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/BitwiseSignCheck.expected
index a6d6da31f69..ce1f90c3ed2 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/BitwiseSignCheck.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/BitwiseSignCheck.expected	
@@ -1,4 +1,4 @@
-| bsc.cpp:2:10:2:32 | ... > ... | Potential unsafe sign check of a bitwise operation. |
-| bsc.cpp:6:10:6:32 | ... > ... | Potential unsafe sign check of a bitwise operation. |
-| bsc.cpp:18:10:18:28 | ... > ... | Potential unsafe sign check of a bitwise operation. |
-| bsc.cpp:22:10:22:28 | ... < ... | Potential unsafe sign check of a bitwise operation. |
+| bsc.cpp:2:10:2:32 | ... > ... | Potentially unsafe sign check of a bitwise operation. |
+| bsc.cpp:6:10:6:32 | ... > ... | Potentially unsafe sign check of a bitwise operation. |
+| bsc.cpp:18:10:18:28 | ... > ... | Potentially unsafe sign check of a bitwise operation. |
+| bsc.cpp:22:10:22:28 | ... < ... | Potentially unsafe sign check of a bitwise operation. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/FloatComparison.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/FloatComparison.expected
index 6152aa1c475..31fda8e5f89 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/FloatComparison.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/FloatComparison.expected	
@@ -1,4 +1,4 @@
-| c.c:10:5:10:10 | ... == ... | Equality test on floating point values may not behave as expected. |
-| c.c:14:5:14:14 | ... == ... | Equality test on floating point values may not behave as expected. |
-| c.c:16:5:16:12 | ... == ... | Equality test on floating point values may not behave as expected. |
-| c.c:17:5:17:12 | ... == ... | Equality test on floating point values may not behave as expected. |
+| c.c:10:5:10:10 | ... == ... | Equality checks on floating point values can yield unexpected results. |
+| c.c:14:5:14:14 | ... == ... | Equality checks on floating point values can yield unexpected results. |
+| c.c:16:5:16:12 | ... == ... | Equality checks on floating point values can yield unexpected results. |
+| c.c:17:5:17:12 | ... == ... | Equality checks on floating point values can yield unexpected results. |
diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
index 304c8a68b6f..9afe24ed72f 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
@@ -413,7 +413,7 @@ namespace Semmle.Autobuild.CSharp.Tests
             actions.RunProcess["cmd.exe /C dotnet --info"] = 0;
             actions.RunProcess[@"cmd.exe /C dotnet clean C:\Project\test.csproj"] = 0;
             actions.RunProcess[@"cmd.exe /C dotnet restore C:\Project\test.csproj"] = 0;
-            actions.RunProcess[@"cmd.exe /C dotnet build --no-incremental /p:UseSharedCompilation=false C:\Project\test.csproj"] = 0;
+            actions.RunProcess[@"cmd.exe /C dotnet build --no-incremental C:\Project\test.csproj"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists[@"C:\Project\test.csproj"] = true;
             actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_TRAP_DIR"] = "";
@@ -440,7 +440,7 @@ namespace Semmle.Autobuild.CSharp.Tests
             actions.RunProcess["dotnet --info"] = 0;
             actions.RunProcess[@"dotnet clean C:\Project/test.csproj"] = 0;
             actions.RunProcess[@"dotnet restore C:\Project/test.csproj"] = 0;
-            actions.RunProcess[@"dotnet build --no-incremental /p:UseSharedCompilation=false C:\Project/test.csproj"] = 0;
+            actions.RunProcess[@"dotnet build --no-incremental C:\Project/test.csproj"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists[@"C:\Project/test.csproj"] = true;
             actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_TRAP_DIR"] = "";
@@ -715,9 +715,9 @@ namespace Semmle.Autobuild.CSharp.Tests
         public void TestWindowCSharpMsBuild()
         {
             actions.RunProcess[@"cmd.exe /C C:\Project\.nuget\nuget.exe restore C:\Project\test1.sln -DisableParallelProcessing"] = 0;
-            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test1.sln /p:UseSharedCompilation=false /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /p:MvcBuildViews=true /P:Fu=Bar"] = 0;
+            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test1.sln /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /P:Fu=Bar"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.nuget\nuget.exe restore C:\Project\test2.sln -DisableParallelProcessing"] = 0;
-            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test2.sln /p:UseSharedCompilation=false /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /p:MvcBuildViews=true /P:Fu=Bar"] = 0;
+            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test2.sln /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /P:Fu=Bar"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe"] = false;
             actions.FileExists[@"C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat"] = false;
@@ -746,9 +746,9 @@ namespace Semmle.Autobuild.CSharp.Tests
         public void TestWindowCSharpMsBuildMultipleSolutions()
         {
             actions.RunProcess[@"cmd.exe /C nuget restore C:\Project\test1.csproj -DisableParallelProcessing"] = 0;
-            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test1.csproj /p:UseSharedCompilation=false /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /p:MvcBuildViews=true /P:Fu=Bar"] = 0;
+            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test1.csproj /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /P:Fu=Bar"] = 0;
             actions.RunProcess[@"cmd.exe /C nuget restore C:\Project\test2.csproj -DisableParallelProcessing"] = 0;
-            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test2.csproj /p:UseSharedCompilation=false /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /p:MvcBuildViews=true /P:Fu=Bar"] = 0;
+            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test2.csproj /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /P:Fu=Bar"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists[@"C:\Project\test1.csproj"] = true;
             actions.FileExists[@"C:\Project\test2.csproj"] = true;
@@ -791,7 +791,7 @@ namespace Semmle.Autobuild.CSharp.Tests
         public void TestWindowCSharpMsBuildFailed()
         {
             actions.RunProcess[@"cmd.exe /C nuget restore C:\Project\test1.sln -DisableParallelProcessing"] = 0;
-            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test1.sln /p:UseSharedCompilation=false /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /p:MvcBuildViews=true /P:Fu=Bar"] = 1;
+            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test1.sln /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /P:Fu=Bar"] = 1;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe"] = false;
             actions.FileExists[@"C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat"] = false;
@@ -817,8 +817,8 @@ namespace Semmle.Autobuild.CSharp.Tests
         [Fact]
         public void TestSkipNugetMsBuild()
         {
-            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test1.sln /p:UseSharedCompilation=false /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /p:MvcBuildViews=true /P:Fu=Bar"] = 0;
-            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test2.sln /p:UseSharedCompilation=false /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /p:MvcBuildViews=true /P:Fu=Bar"] = 0;
+            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test1.sln /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /P:Fu=Bar"] = 0;
+            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\test2.sln /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /P:Fu=Bar"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe"] = false;
             actions.FileExists[@"C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat"] = false;
@@ -862,7 +862,7 @@ namespace Semmle.Autobuild.CSharp.Tests
             actions.RunProcess["dotnet --info"] = 0;
             actions.RunProcess[@"dotnet clean C:\Project/test.csproj"] = 0;
             actions.RunProcess[@"dotnet restore C:\Project/test.csproj"] = 0;
-            actions.RunProcess[@"dotnet build --no-incremental /p:UseSharedCompilation=false --no-restore C:\Project/test.csproj"] = 0;
+            actions.RunProcess[@"dotnet build --no-incremental --no-restore C:\Project/test.csproj"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists[@"C:\Project/test.csproj"] = true;
             actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_TRAP_DIR"] = "";
@@ -894,7 +894,7 @@ namespace Semmle.Autobuild.CSharp.Tests
             actions.RunProcess[@"C:\Project/.dotnet/dotnet --info"] = 0;
             actions.RunProcess[@"C:\Project/.dotnet/dotnet clean C:\Project/test.csproj"] = 0;
             actions.RunProcess[@"C:\Project/.dotnet/dotnet restore C:\Project/test.csproj"] = 0;
-            actions.RunProcess[@"C:\Project/.dotnet/dotnet build --no-incremental /p:UseSharedCompilation=false C:\Project/test.csproj"] = 0;
+            actions.RunProcess[@"C:\Project/.dotnet/dotnet build --no-incremental C:\Project/test.csproj"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists["test.csproj"] = true;
             actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_TRAP_DIR"] = "";
@@ -929,7 +929,7 @@ namespace Semmle.Autobuild.CSharp.Tests
             actions.RunProcess[@"C:\Project/.dotnet/dotnet --info"] = 0;
             actions.RunProcess[@"C:\Project/.dotnet/dotnet clean C:\Project/test.csproj"] = 0;
             actions.RunProcess[@"C:\Project/.dotnet/dotnet restore C:\Project/test.csproj"] = 0;
-            actions.RunProcess[@"C:\Project/.dotnet/dotnet build --no-incremental /p:UseSharedCompilation=false C:\Project/test.csproj"] = 0;
+            actions.RunProcess[@"C:\Project/.dotnet/dotnet build --no-incremental C:\Project/test.csproj"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists["test.csproj"] = true;
             actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_TRAP_DIR"] = "";
@@ -960,7 +960,7 @@ namespace Semmle.Autobuild.CSharp.Tests
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet --info"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet clean C:\Project\test.csproj"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet restore C:\Project\test.csproj"] = 0;
-            actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet build --no-incremental /p:UseSharedCompilation=false C:\Project\test.csproj"] = 0;
+            actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet build --no-incremental C:\Project\test.csproj"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists[@"C:\Project\test.csproj"] = true;
             actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_TRAP_DIR"] = "";
@@ -1008,7 +1008,7 @@ namespace Semmle.Autobuild.CSharp.Tests
         {
             actions.RunProcess[@"cmd.exe /C nuget restore C:\Project\dirs.proj -DisableParallelProcessing"] = 1;
             actions.RunProcess[@"cmd.exe /C C:\Project\.nuget\nuget.exe restore C:\Project\dirs.proj -DisableParallelProcessing"] = 0;
-            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\dirs.proj /p:UseSharedCompilation=false /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /p:MvcBuildViews=true /P:Fu=Bar"] = 0;
+            actions.RunProcess["cmd.exe /C CALL ^\"C:\\Program Files ^(x86^)\\Microsoft Visual Studio 12.0\\VC\\vcvarsall.bat^\" && set Platform=&& type NUL && msbuild C:\\Project\\dirs.proj /t:Windows /p:Platform=\"x86\" /p:Configuration=\"Debug\" /P:Fu=Bar"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists[@"C:\Project\a\test.csproj"] = true;
             actions.FileExists[@"C:\Project\dirs.proj"] = true;
@@ -1052,7 +1052,7 @@ namespace Semmle.Autobuild.CSharp.Tests
         {
             actions.RunProcess[@"nuget restore C:\Project/dirs.proj -DisableParallelProcessing"] = 1;
             actions.RunProcess[@"mono C:\Project/.nuget/nuget.exe restore C:\Project/dirs.proj -DisableParallelProcessing"] = 0;
-            actions.RunProcess[@"msbuild C:\Project/dirs.proj /p:UseSharedCompilation=false /t:rebuild /p:MvcBuildViews=true"] = 0;
+            actions.RunProcess[@"msbuild C:\Project/dirs.proj /t:rebuild"] = 0;
             actions.FileExists["csharp.log"] = true;
             actions.FileExists[@"C:\Project/a/test.csproj"] = true;
             actions.FileExists[@"C:\Project/dirs.proj"] = true;
diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs b/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
index 18603809d34..163dbfa1464 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
@@ -5,7 +5,6 @@ using Newtonsoft.Json.Linq;
 using System.Collections.Generic;
 using System.IO;
 using Semmle.Util;
-using System.Text.RegularExpressions;
 using Semmle.Autobuild.Shared;
 
 namespace Semmle.Autobuild.CSharp
@@ -81,9 +80,6 @@ namespace Semmle.Autobuild.CSharp
                     env = null;
                 }
 
-                if (env is null)
-                    env = new Dictionary<string, string>();
-                env.Add("UseSharedCompilation", "false");
                 return f(installDir, env);
             });
         }
@@ -245,8 +241,7 @@ namespace Semmle.Autobuild.CSharp
                 Argument("--no-incremental");
 
             return
-                script.Argument("/p:UseSharedCompilation=false").
-                    Argument(builder.Options.DotNetArguments).
+                script.Argument(builder.Options.DotNetArguments).
                     QuoteArgument(projOrSln).
                     Script;
         }
diff --git a/csharp/autobuilder/Semmle.Autobuild.Shared/MsBuildRule.cs b/csharp/autobuilder/Semmle.Autobuild.Shared/MsBuildRule.cs
index 55dbf31ba1b..0afc1da098c 100644
--- a/csharp/autobuilder/Semmle.Autobuild.Shared/MsBuildRule.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.Shared/MsBuildRule.cs
@@ -98,8 +98,6 @@ namespace Semmle.Autobuild.Shared
                 command.RunCommand(msBuild);
                 command.QuoteArgument(projectOrSolution.FullPath);
 
-                command.Argument("/p:UseSharedCompilation=false");
-
                 var target = builder.Options.MsBuildTarget ?? "rebuild";
                 var platform = builder.Options.MsBuildPlatform ?? (projectOrSolution is ISolution s1 ? s1.DefaultPlatformName : null);
                 var configuration = builder.Options.MsBuildConfiguration ?? (projectOrSolution is ISolution s2 ? s2.DefaultConfigurationName : null);
@@ -109,7 +107,6 @@ namespace Semmle.Autobuild.Shared
                     command.Argument(string.Format("/p:Platform=\"{0}\"", platform));
                 if (configuration is not null)
                     command.Argument(string.Format("/p:Configuration=\"{0}\"", configuration));
-                command.Argument("/p:MvcBuildViews=true");
 
                 command.Argument(builder.Options.MsBuildArguments);
 
diff --git a/csharp/codeql-extractor.yml b/csharp/codeql-extractor.yml
index 4e1fa7934ce..fbf7841eea6 100644
--- a/csharp/codeql-extractor.yml
+++ b/csharp/codeql-extractor.yml
@@ -35,3 +35,10 @@ options:
       the code (for example if it uses inaccessible dependencies).
     type: string
     pattern: "^(false|true)$"
+  cil:
+    title: Whether to enable CIL extraction.
+    description: >
+      A value indicating, whether CIL extraction should be enabled.
+      The default is 'true'.
+    type: string
+    pattern: "^(false|true)$"
diff --git a/csharp/documentation/library-coverage/coverage.csv b/csharp/documentation/library-coverage/coverage.csv
index fd6c64f91d0..6ab77f6aba6 100644
--- a/csharp/documentation/library-coverage/coverage.csv
+++ b/csharp/documentation/library-coverage/coverage.csv
@@ -9,7 +9,7 @@ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
 Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
 Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
 Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
-Microsoft.Extensions.FileProviders,,,15,,,,,,,,,,,,15,
+Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
 Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
 Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
 Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
@@ -19,10 +19,10 @@ Microsoft.Extensions.Primitives,,,63,,,,,,,,,,,,63,
 Microsoft.Interop,,,27,,,,,,,,,,,,27,
 Microsoft.NET.Build.Tasks,,,1,,,,,,,,,,,,1,
 Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,,,,,,4,
-Microsoft.VisualBasic,,,9,,,,,,,,,,,,5,4
+Microsoft.VisualBasic,,,10,,,,,,,,,,,,5,5
 Microsoft.Win32,,,8,,,,,,,,,,,,8,
 MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
 Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
 ServiceStack,194,,7,27,,,,,,75,92,,,,7,
-System,43,4,11809,,1,1,1,,4,,33,3,1,3,9867,1942
+System,65,4,12131,,8,8,9,,4,,33,3,1,3,10139,1992
 Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,
diff --git a/csharp/documentation/library-coverage/coverage.rst b/csharp/documentation/library-coverage/coverage.rst
index 1d3a0a7d5cc..0f3dce2941a 100644
--- a/csharp/documentation/library-coverage/coverage.rst
+++ b/csharp/documentation/library-coverage/coverage.rst
@@ -8,7 +8,7 @@ C# framework & library support
 
    Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE-079` :sub:`Cross-site scripting`
    `ServiceStack <https://servicestack.net/>`_,"``ServiceStack.*``, ``ServiceStack``",,7,194,
-   System,"``System.*``, ``System``",4,11809,43,7
-   Others,"``Dapper``, ``JsonToItemsTaskFactory``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.CSharp``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.NETCore.Platforms.BuildTasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``, ``Windows.Security.Cryptography.Core``",,554,138,
-   Totals,,4,12370,375,7
+   System,"``System.*``, ``System``",4,12131,65,7
+   Others,"``Dapper``, ``JsonToItemsTaskFactory``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.CSharp``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.NETCore.Platforms.BuildTasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``, ``Windows.Security.Cryptography.Core``",,556,138,
+   Totals,,4,12694,397,7
 
diff --git a/csharp/downgrades/4ac7d8bcac6f664b1e83c858aa71f8dc761cc603/old.dbscheme b/csharp/downgrades/4ac7d8bcac6f664b1e83c858aa71f8dc761cc603/old.dbscheme
new file mode 100644
index 00000000000..4ac7d8bcac6
--- /dev/null
+++ b/csharp/downgrades/4ac7d8bcac6f664b1e83c858aa71f8dc761cc603/old.dbscheme
@@ -0,0 +1,2064 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | f1.cs
+ * 3   | f2.cs
+ * 4   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+   int id: @externalDataElement,
+   string path: string ref,
+   int column: int ref,
+   string value: string ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @externalDataElement
+         | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+locations_mapped(
+  unique int id: @location_default ref,
+  int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+files(
+  unique int id: @file,
+  string name: string ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+  unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+  | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+  | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+  unique int id: @directive_if,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+  unique int id: @directive_elif,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref,  /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+directive_elses(
+  unique int id: @directive_else,
+  int branchTaken: int ref,   /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+  unique int id: @directive_endif,
+  unique int start: @directive_if ref);
+
+directive_define_symbols(
+  unique int id: @define_symbol_expr ref,
+  string name: string ref);
+
+directive_regions(
+  unique int id: @directive_region,
+  string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+  unique int id: @directive_endregion,
+  unique int start: @directive_region ref);
+
+directive_lines(
+  unique int id: @directive_line,
+  int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+  unique int id: @directive_line ref,
+  int line: int ref);
+
+directive_line_file(
+  unique int id: @directive_line ref,
+  int file: @file ref);
+
+directive_line_offset(
+  unique int id: @directive_line ref,
+  int offset: int ref);
+
+directive_line_span(
+  unique int id: @directive_line ref,
+  int startLine: int ref,
+  int startColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+directive_nullables(
+  unique int id: @directive_nullable,
+  int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+  int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+  unique int id: @directive_warning,
+  string message: string ref);
+
+directive_errors(
+  unique int id: @directive_error,
+  string message: string ref);
+
+directive_undefines(
+  unique int id: @directive_undefine,
+  string name: string ref);
+
+directive_defines(
+  unique int id: @directive_define,
+  string name: string ref);
+
+pragma_checksums(
+  unique int id: @pragma_checksum,
+  int file: @file ref,
+  string guid: string ref,
+  string bytes: string ref);
+
+pragma_warnings(
+  unique int id: @pragma_warning,
+  int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+  int id: @pragma_warning ref,
+  string errorCode: string ref,
+  int index: int ref);
+
+preprocessor_directive_location(
+  unique int id: @preprocessor_directive ref,
+  int loc: @location ref);
+
+preprocessor_directive_compilation(
+  unique int id: @preprocessor_directive ref,
+  int compilation: @compilation ref);
+
+preprocessor_directive_active(
+  unique int id: @preprocessor_directive ref,
+  int active: int ref);  /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int kind: int ref,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+case @attribute.kind of
+  0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+  unique int id: @foreach_stmt ref,
+  int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol =  @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+  int id: @foreach_stmt ref,
+  int symbol: @foreach_symbol ref,
+  int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+lambda_expr_return_type(
+  unique int id: @lambda_expr ref,
+  int type_id: @type_or_ref ref);
+  
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+| 4 = @cil_function_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_function_pointer_return_type(
+  unique int id: @cil_function_pointer_type ref,
+  int return_type: @cil_type ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
+@cil_parameterizable = @cil_method | @cil_function_pointer_type;
+@cil_has_type_annotation = @cil_stack_variable | @cil_property | @cil_method | @cil_function_pointer_type;
+
+#keyset[parameterizable, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int parameterizable: @cil_parameterizable ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_type_annotation(
+  int id: @cil_has_type_annotation ref,
+  int annotation: int ref);
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+cil_function_pointer_calling_conventions(
+  int id: @cil_function_pointer_type ref,
+  int kind: int ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+@dotnet_parameterizable = @parameterizable | @cil_parameterizable;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/downgrades/4ac7d8bcac6f664b1e83c858aa71f8dc761cc603/semmlecode.csharp.dbscheme b/csharp/downgrades/4ac7d8bcac6f664b1e83c858aa71f8dc761cc603/semmlecode.csharp.dbscheme
new file mode 100644
index 00000000000..a696c8bae06
--- /dev/null
+++ b/csharp/downgrades/4ac7d8bcac6f664b1e83c858aa71f8dc761cc603/semmlecode.csharp.dbscheme
@@ -0,0 +1,2065 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+   int id: @externalDataElement,
+   string path: string ref,
+   int column: int ref,
+   string value: string ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @externalDataElement
+         | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+locations_mapped(
+  unique int id: @location_default ref,
+  int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+files(
+  unique int id: @file,
+  string name: string ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+  unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+  | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+  | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+  unique int id: @directive_if,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+  unique int id: @directive_elif,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref,  /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+directive_elses(
+  unique int id: @directive_else,
+  int branchTaken: int ref,   /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+  unique int id: @directive_endif,
+  unique int start: @directive_if ref);
+
+directive_define_symbols(
+  unique int id: @define_symbol_expr ref,
+  string name: string ref);
+
+directive_regions(
+  unique int id: @directive_region,
+  string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+  unique int id: @directive_endregion,
+  unique int start: @directive_region ref);
+
+directive_lines(
+  unique int id: @directive_line,
+  int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+  unique int id: @directive_line ref,
+  int line: int ref);
+
+directive_line_file(
+  unique int id: @directive_line ref,
+  int file: @file ref);
+
+directive_line_offset(
+  unique int id: @directive_line ref,
+  int offset: int ref);
+
+directive_line_span(
+  unique int id: @directive_line ref,
+  int startLine: int ref,
+  int startColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+directive_nullables(
+  unique int id: @directive_nullable,
+  int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+  int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+  unique int id: @directive_warning,
+  string message: string ref);
+
+directive_errors(
+  unique int id: @directive_error,
+  string message: string ref);
+
+directive_undefines(
+  unique int id: @directive_undefine,
+  string name: string ref);
+
+directive_defines(
+  unique int id: @directive_define,
+  string name: string ref);
+
+pragma_checksums(
+  unique int id: @pragma_checksum,
+  int file: @file ref,
+  string guid: string ref,
+  string bytes: string ref);
+
+pragma_warnings(
+  unique int id: @pragma_warning,
+  int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+  int id: @pragma_warning ref,
+  string errorCode: string ref,
+  int index: int ref);
+
+preprocessor_directive_location(
+  unique int id: @preprocessor_directive ref,
+  int loc: @location ref);
+
+preprocessor_directive_compilation(
+  unique int id: @preprocessor_directive ref,
+  int compilation: @compilation ref);
+
+preprocessor_directive_active(
+  unique int id: @preprocessor_directive ref,
+  int active: int ref);  /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int kind: int ref,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+case @attribute.kind of
+  0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+  unique int id: @foreach_stmt ref,
+  int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol =  @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+  int id: @foreach_stmt ref,
+  int symbol: @foreach_symbol ref,
+  int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+lambda_expr_return_type(
+  unique int id: @lambda_expr ref,
+  int type_id: @type_or_ref ref);
+  
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+| 4 = @cil_function_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_function_pointer_return_type(
+  unique int id: @cil_function_pointer_type ref,
+  int return_type: @cil_type ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
+@cil_parameterizable = @cil_method | @cil_function_pointer_type;
+@cil_has_type_annotation = @cil_stack_variable | @cil_property | @cil_method | @cil_function_pointer_type;
+
+#keyset[parameterizable, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int parameterizable: @cil_parameterizable ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_type_annotation(
+  int id: @cil_has_type_annotation ref,
+  int annotation: int ref);
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+cil_function_pointer_calling_conventions(
+  int id: @cil_function_pointer_type ref,
+  int kind: int ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+@dotnet_parameterizable = @parameterizable | @cil_parameterizable;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/downgrades/4ac7d8bcac6f664b1e83c858aa71f8dc761cc603/upgrade.properties b/csharp/downgrades/4ac7d8bcac6f664b1e83c858aa71f8dc761cc603/upgrade.properties
new file mode 100644
index 00000000000..9760a4b01e1
--- /dev/null
+++ b/csharp/downgrades/4ac7d8bcac6f664b1e83c858aa71f8dc761cc603/upgrade.properties
@@ -0,0 +1,2 @@
+description: Introduce '--cil' flag in the comments. This does not make any changes to the dbscheme.
+compatibility: full
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.Driver/Driver.cs b/csharp/extractor/Semmle.Extraction.CSharp.Driver/Driver.cs
index 047a8ddb8ae..d4073deee33 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.Driver/Driver.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.Driver/Driver.cs
@@ -13,31 +13,6 @@ namespace Semmle.Extraction.CSharp
         {
             Extractor.SetInvariantCulture();
 
-            Console.WriteLine($"Semmle.Extraction.CSharp.Driver: called with {string.Join(", ", args)}");
-
-            if (args.Length > 0 && args[0] == "--dotnetexec")
-            {
-                var compilerRegEx = new Regex(@"csc\.exe|mcs\.exe|csc\.dll", RegexOptions.Compiled);
-                var cil = args.Length > 1 && args[1] == "--cil";
-                for (var i = cil ? 2 : 1; i < args.Length; i++)
-                {
-                    if (compilerRegEx.IsMatch(args[i]))
-                    {
-                        var argsList = new List<string>();
-                        if (cil)
-                            argsList.Add("--cil");
-                        argsList.Add("--compiler");
-                        argsList.Add(args[i]);
-                        if (i + 1 < args.Length)
-                            argsList.AddRange(args[(i + 1)..]);
-                        return (int)Extractor.Run(argsList.ToArray());
-                    }
-                }
-
-                Console.WriteLine($"Semmle.Extraction.CSharp.Driver: not a compiler invocation");
-                return 0;
-            }
-
             return (int)Extractor.Run(args);
         }
     }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.Standalone/Program.cs b/csharp/extractor/Semmle.Extraction.CSharp.Standalone/Program.cs
index 6266eb09f93..8ee0cae1fd2 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.Standalone/Program.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.Standalone/Program.cs
@@ -56,7 +56,6 @@ namespace Semmle.Extraction.CSharp.Standalone
             CSharp.Extractor.SetInvariantCulture();
 
             var options = Options.Create(args);
-            // options.CIL = true;  // To do: Enable this
 
             if (options.Help)
             {
diff --git a/csharp/extractor/Semmle.Extraction.Tests/Options.cs b/csharp/extractor/Semmle.Extraction.Tests/Options.cs
index 2637eb3d5f4..026bc80c114 100644
--- a/csharp/extractor/Semmle.Extraction.Tests/Options.cs
+++ b/csharp/extractor/Semmle.Extraction.Tests/Options.cs
@@ -22,7 +22,7 @@ namespace Semmle.Extraction.Tests
         {
             options = CSharp.Options.CreateWithEnvironment(Array.Empty<string>());
             Assert.True(options.Cache);
-            Assert.False(options.CIL);
+            Assert.True(options.CIL);
             Assert.Null(options.Framework);
             Assert.Null(options.CompilerName);
             Assert.Empty(options.CompilerArguments);
@@ -51,10 +51,20 @@ namespace Semmle.Extraction.Tests
         [Fact]
         public void CIL()
         {
-            options = CSharp.Options.CreateWithEnvironment(new string[] { "--cil" });
+            options = CSharp.Options.CreateWithEnvironment(Array.Empty<string>());
             Assert.True(options.CIL);
-            options = CSharp.Options.CreateWithEnvironment(new string[] { "--cil", "--nocil" });
+
+            Environment.SetEnvironmentVariable("CODEQL_EXTRACTOR_CSHARP_OPTION_CIL", "false");
+            options = CSharp.Options.CreateWithEnvironment(Array.Empty<string>());
             Assert.False(options.CIL);
+
+            Environment.SetEnvironmentVariable("CODEQL_EXTRACTOR_CSHARP_OPTION_CIL", "true");
+            options = CSharp.Options.CreateWithEnvironment(Array.Empty<string>());
+            Assert.True(options.CIL);
+
+            Environment.SetEnvironmentVariable("CODEQL_EXTRACTOR_CSHARP_OPTION_CIL", null);
+            options = CSharp.Options.CreateWithEnvironment(Array.Empty<string>());
+            Assert.True(options.CIL);
         }
 
         [Fact]
@@ -121,22 +131,6 @@ namespace Semmle.Extraction.Tests
             Assert.Equal("foo", options.Framework);
         }
 
-        [Fact]
-        public void EnvironmentVariables()
-        {
-            Environment.SetEnvironmentVariable("LGTM_INDEX_EXTRACTOR", "--cil c");
-            options = CSharp.Options.CreateWithEnvironment(new string[] { "a", "b" });
-            Assert.True(options.CIL);
-            Assert.Equal("a", options.CompilerArguments[0]);
-            Assert.Equal("b", options.CompilerArguments[1]);
-            Assert.Equal("c", options.CompilerArguments[2]);
-
-            Environment.SetEnvironmentVariable("LGTM_INDEX_EXTRACTOR", "");
-            Environment.SetEnvironmentVariable("LGTM_INDEX_EXTRACTOR", "--nocil");
-            options = CSharp.Options.CreateWithEnvironment(new string[] { "--cil" });
-            Assert.False(options.CIL);
-        }
-
         [Fact]
         public void StandaloneDefaults()
         {
diff --git a/csharp/extractor/Semmle.Extraction/Options.cs b/csharp/extractor/Semmle.Extraction/Options.cs
index bef37be1d45..afd4b2db7eb 100644
--- a/csharp/extractor/Semmle.Extraction/Options.cs
+++ b/csharp/extractor/Semmle.Extraction/Options.cs
@@ -28,7 +28,7 @@ namespace Semmle.Extraction
         /// <summary>
         /// Holds if CIL should be extracted.
         /// </summary>
-        public bool CIL { get; private set; } = false;
+        public bool CIL { get; private set; } = true;
 
         /// <summary>
         /// Holds if assemblies shouldn't be extracted twice.
@@ -50,7 +50,6 @@ namespace Semmle.Extraction
         /// </summary>
         public bool QlTest { get; private set; } = false;
 
-
         /// <summary>
         /// The compression algorithm used for trap files.
         /// </summary>
@@ -73,6 +72,9 @@ namespace Semmle.Extraction
                         return true;
                     }
                     return false;
+                case "cil":
+                    CIL = Boolean.Parse(value);
+                    return true;
                 default:
                     return false;
             }
@@ -97,9 +99,6 @@ namespace Semmle.Extraction
                 case "cache":
                     Cache = value;
                     return true;
-                case "cil":
-                    CIL = value;
-                    return true;
                 case "pdb":
                     PDB = value;
                     CIL = true;
diff --git a/csharp/extractor/Semmle.Util/CommandLineOptions.cs b/csharp/extractor/Semmle.Util/CommandLineOptions.cs
index 5531155d5be..34917ae6bcd 100644
--- a/csharp/extractor/Semmle.Util/CommandLineOptions.cs
+++ b/csharp/extractor/Semmle.Util/CommandLineOptions.cs
@@ -17,7 +17,7 @@ namespace Semmle.Util
         bool HandleOption(string key, string value);
 
         /// <summary>
-        /// Handle a flag of the form "--cil" or "--nocil"
+        /// Handle a flag of the form "--cache" or "--nocache"
         /// </summary>
         /// <param name="key">The name of the flag. This is case sensitive.</param>
         /// <param name="value">True if set, or false if prefixed by "--no"</param>
@@ -40,6 +40,7 @@ namespace Semmle.Util
 
     public static class OptionsExtensions
     {
+        private static readonly string[] ExtractorOptions = new[] { "trap_compression", "cil" };
         private static string? GetExtractorOption(string name) =>
             Environment.GetEnvironmentVariable($"CODEQL_EXTRACTOR_CSHARP_OPTION_{name.ToUpper()}");
 
@@ -47,12 +48,14 @@ namespace Semmle.Util
         {
             var extractorOptions = new List<string>();
 
-            var trapCompression = GetExtractorOption("trap_compression");
-            if (!string.IsNullOrEmpty(trapCompression))
+            foreach (var option in ExtractorOptions)
             {
-                extractorOptions.Add($"--trap_compression:{trapCompression}");
+                var value = GetExtractorOption(option);
+                if (!string.IsNullOrEmpty(value))
+                {
+                    extractorOptions.Add($"--{option}:{value}");
+                }
             }
-
             return extractorOptions;
         }
 
diff --git a/csharp/ql/campaigns/Solorigate/src/ModifiedFnvFunctionDetection.ql b/csharp/ql/campaigns/Solorigate/src/ModifiedFnvFunctionDetection.ql
index e9f81596e04..5e4a47f7ec0 100644
--- a/csharp/ql/campaigns/Solorigate/src/ModifiedFnvFunctionDetection.ql
+++ b/csharp/ql/campaigns/Solorigate/src/ModifiedFnvFunctionDetection.ql
@@ -15,7 +15,7 @@ import experimental.code.csharp.Cryptography.NonCryptographicHashes
 
 from Variable v, Literal l, LoopStmt loop, Expr additional_xor
 where
-  maybeUsedInFNVFunction(v, _, _, loop) and
+  maybeUsedInFnvFunction(v, _, _, loop) and
   (
     exists(BitwiseXorExpr xor2 | xor2.getAnOperand() = l and additional_xor = xor2 |
       loop.getAControlFlowExitNode().getASuccessor*() = xor2.getAControlFlowNode() and
diff --git a/csharp/ql/consistency-queries/SsaConsistency.ql b/csharp/ql/consistency-queries/SsaConsistency.ql
index ee231828279..71f88bf2ab0 100644
--- a/csharp/ql/consistency-queries/SsaConsistency.ql
+++ b/csharp/ql/consistency-queries/SsaConsistency.ql
@@ -1,8 +1,8 @@
 import csharp
-import semmle.code.csharp.dataflow.internal.SsaImplCommon::Consistency
+import semmle.code.csharp.dataflow.internal.SsaImpl::Consistency as Consistency
 import Ssa
 
-class MyRelevantDefinition extends RelevantDefinition, Ssa::Definition {
+class MyRelevantDefinition extends Consistency::RelevantDefinition, Ssa::Definition {
   override predicate hasLocationInfo(
     string filepath, int startline, int startcolumn, int endline, int endcolumn
   ) {
@@ -10,6 +10,14 @@ class MyRelevantDefinition extends RelevantDefinition, Ssa::Definition {
   }
 }
 
+query predicate nonUniqueDef = Consistency::nonUniqueDef/4;
+
+query predicate readWithoutDef = Consistency::readWithoutDef/3;
+
+query predicate deadDef = Consistency::deadDef/2;
+
+query predicate notDominatedByDef = Consistency::notDominatedByDef/4;
+
 query predicate localDeclWithSsaDef(LocalVariableDeclExpr d) {
   // Local variables in C# must be initialized before every use, so uninitialized
   // local variables should not have an SSA definition, as that would imply that
diff --git a/csharp/ql/integration-tests/all-platforms/dotnet_build/Program.cs b/csharp/ql/integration-tests/all-platforms/dotnet_build/Program.cs
new file mode 100644
index 00000000000..e9708d0b5d2
--- /dev/null
+++ b/csharp/ql/integration-tests/all-platforms/dotnet_build/Program.cs
@@ -0,0 +1 @@
+Console.WriteLine(args[0]);
diff --git a/csharp/ql/integration-tests/all-platforms/dotnet_build/dotnet_build.csproj b/csharp/ql/integration-tests/all-platforms/dotnet_build/dotnet_build.csproj
new file mode 100644
index 00000000000..74abf5c9766
--- /dev/null
+++ b/csharp/ql/integration-tests/all-platforms/dotnet_build/dotnet_build.csproj
@@ -0,0 +1,10 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net6.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+</Project>
diff --git a/csharp/ql/integration-tests/all-platforms/dotnet_build/test.py b/csharp/ql/integration-tests/all-platforms/dotnet_build/test.py
new file mode 100644
index 00000000000..2568768ad6b
--- /dev/null
+++ b/csharp/ql/integration-tests/all-platforms/dotnet_build/test.py
@@ -0,0 +1,3 @@
+from create_database_utils import *
+
+run_codeql_database_create(['dotnet build'], test_db="default-db", db=None, lang="csharp")
diff --git a/csharp/ql/integration-tests/all-platforms/qlpack.yml b/csharp/ql/integration-tests/all-platforms/qlpack.yml
new file mode 100644
index 00000000000..f1531efffb2
--- /dev/null
+++ b/csharp/ql/integration-tests/all-platforms/qlpack.yml
@@ -0,0 +1,2 @@
+libraryPathDependencies:
+  - codeql-csharp
diff --git a/csharp/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md b/csharp/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md
new file mode 100644
index 00000000000..efdaf85f2ed
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed an issue in the taint tracking analysis where implicit reads were not allowed by default in sinks or additional taint steps that used flow states.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2022-09-12-uppercase.md b/csharp/ql/lib/change-notes/2022-09-12-uppercase.md
new file mode 100644
index 00000000000..996861f1c2c
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2022-09-12-uppercase.md
@@ -0,0 +1,5 @@
+---
+category: deprecated
+---
+* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
+  The old name still exists as a deprecated alias.
\ No newline at end of file
diff --git a/csharp/ql/lib/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll b/csharp/ql/lib/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll
index 03585e32a77..28de629816d 100644
--- a/csharp/ql/lib/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll
+++ b/csharp/ql/lib/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll
@@ -13,7 +13,7 @@ private import semmle.code.csharp.dataflow.TaintTracking2
 predicate maybeANonCryptogrphicHash(Callable callable, Variable v, Expr xor, Expr mul, LoopStmt loop) {
   callable = loop.getEnclosingCallable() and
   (
-    maybeUsedInFNVFunction(v, xor, mul, loop) or
+    maybeUsedInFnvFunction(v, xor, mul, loop) or
     maybeUsedInElfHashFunction(v, xor, mul, loop)
   )
 }
@@ -23,7 +23,7 @@ predicate maybeANonCryptogrphicHash(Callable callable, Variable v, Expr xor, Exp
  * where there is a loop statement `loop` where the variable `v` is used in an xor `xor` expression
  * followed by a multiplication `mul` expression.
  */
-predicate maybeUsedInFNVFunction(Variable v, Operation xor, Operation mul, LoopStmt loop) {
+predicate maybeUsedInFnvFunction(Variable v, Operation xor, Operation mul, LoopStmt loop) {
   exists(Expr e1, Expr e2 |
     e1.getAChild*() = v.getAnAccess() and
     e2.getAChild*() = v.getAnAccess() and
@@ -37,6 +37,9 @@ predicate maybeUsedInFNVFunction(Variable v, Operation xor, Operation mul, LoopS
   loop.getAChild*() = xor.getEnclosingStmt()
 }
 
+/** DEPRECATED: Alias for maybeUsedInFnvFunction */
+deprecated predicate maybeUsedInFNVFunction = maybeUsedInFnvFunction/4;
+
 /**
  * Holds if the arguments are used in a way that resembles an Elf-Hash hash function
  * where there is a loop statement `loop` where the variable `v` is used in an xor `xor` expression
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 0af84d51ff3..7716eb77741 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -5,3 +5,5 @@ dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp
 library: true
 upgrades: upgrades
+dependencies:
+  codeql/ssa: 0.0.1 
diff --git a/csharp/ql/lib/semmle/code/cil/CallableReturns.qll b/csharp/ql/lib/semmle/code/cil/CallableReturns.qll
index 6a86ef72170..4cd46c10941 100644
--- a/csharp/ql/lib/semmle/code/cil/CallableReturns.qll
+++ b/csharp/ql/lib/semmle/code/cil/CallableReturns.qll
@@ -56,7 +56,7 @@ private predicate alwaysNotNullVariableUpdate(VariableUpdate vu) {
 
 /** Holds if expression `expr` always evaluates to non-null. */
 private predicate alwaysNotNullExpr(Expr expr) {
-  expr instanceof Opcodes::Newobj
+  expr instanceof Opcodes::NewObj
   or
   expr instanceof Literal and not expr instanceof NullLiteral
   or
diff --git a/csharp/ql/lib/semmle/code/cil/Instructions.qll b/csharp/ql/lib/semmle/code/cil/Instructions.qll
index 91bc1f37ea6..7d425594b8d 100644
--- a/csharp/ql/lib/semmle/code/cil/Instructions.qll
+++ b/csharp/ql/lib/semmle/code/cil/Instructions.qll
@@ -766,7 +766,7 @@ module Opcodes {
   }
 
   /** A `newobj` instruction. */
-  class Newobj extends Call, @cil_newobj {
+  class NewObj extends Call, @cil_newobj {
     override string getOpcodeName() { result = "newobj" }
 
     override int getPushCount() { result = 1 }
@@ -788,6 +788,9 @@ module Opcodes {
     }
   }
 
+  /** DEPRECATED: Alias for NewObj */
+  deprecated class Newobj = NewObj;
+
   /** An `initobj` instruction. */
   class Initobj extends Instruction, @cil_initobj {
     override string getOpcodeName() { result = "initobj" }
@@ -847,10 +850,13 @@ module Opcodes {
   }
 
   /** A `rethrow` instruction. */
-  class Rethrow extends Throw, @cil_rethrow {
+  class ReThrow extends Throw, @cil_rethrow {
     override string getOpcodeName() { result = "rethrow" }
   }
 
+  /** DEPRECATED: Alias for ReThrow */
+  deprecated class Rethrow = ReThrow;
+
   /** A `ldlen` instruction. */
   class Ldlen extends UnaryExpr, @cil_ldlen {
     override string getOpcodeName() { result = "ldlen" }
diff --git a/csharp/ql/lib/semmle/code/cil/Ssa.qll b/csharp/ql/lib/semmle/code/cil/Ssa.qll
index 229925f6d08..50338d3284d 100644
--- a/csharp/ql/lib/semmle/code/cil/Ssa.qll
+++ b/csharp/ql/lib/semmle/code/cil/Ssa.qll
@@ -8,13 +8,12 @@ private import CIL
  * Provides classes for working with static single assignment (SSA) form.
  */
 module Ssa {
-  private import internal.SsaImplCommon as SsaImpl
-  private import internal.SsaImpl
+  private import internal.SsaImpl as SsaImpl
 
   /** An SSA definition. */
   class Definition extends SsaImpl::Definition {
     /** Gets a read of this SSA definition. */
-    final ReadAccess getARead() { result = getARead(this) }
+    final ReadAccess getARead() { result = SsaImpl::getARead(this) }
 
     /** Gets the underlying variable update, if any. */
     final VariableUpdate getVariableUpdate() {
@@ -25,11 +24,11 @@ module Ssa {
     }
 
     /** Gets a first read of this SSA definition. */
-    final ReadAccess getAFirstRead() { result = getAFirstRead(this) }
+    final ReadAccess getAFirstRead() { result = SsaImpl::getAFirstRead(this) }
 
     /** Holds if `first` and `second` are adjacent reads of this SSA definition. */
     final predicate hasAdjacentReads(ReadAccess first, ReadAccess second) {
-      hasAdjacentReads(this, first, second)
+      SsaImpl::hasAdjacentReads(this, first, second)
     }
 
     private Definition getAPhiInput() { result = this.(PhiNode).getAnInput() }
@@ -52,7 +51,7 @@ module Ssa {
     final override Location getLocation() { result = this.getBasicBlock().getLocation() }
 
     /** Gets an input to this phi node. */
-    final Definition getAnInput() { result = getAPhiInput(this) }
+    final Definition getAnInput() { result = SsaImpl::getAPhiInput(this) }
 
     /**
      * Holds if if `def` is an input to this phi node, and a reference to `def` at
@@ -60,7 +59,7 @@ module Ssa {
      * other references.
      */
     final predicate hasLastInputRef(Definition def, BasicBlock bb, int i) {
-      hasLastInputRef(this, def, bb, i)
+      SsaImpl::hasLastInputRef(this, def, bb, i)
     }
   }
 }
diff --git a/csharp/ql/lib/semmle/code/cil/internal/SsaImpl.qll b/csharp/ql/lib/semmle/code/cil/internal/SsaImpl.qll
index 593c877b9af..9ca724cb08d 100644
--- a/csharp/ql/lib/semmle/code/cil/internal/SsaImpl.qll
+++ b/csharp/ql/lib/semmle/code/cil/internal/SsaImpl.qll
@@ -1,8 +1,40 @@
-private import semmle.code.cil.CIL
-private import SsaImplCommon
+private import cil
+private import codeql.ssa.Ssa as SsaImplCommon
+
+private module SsaInput implements SsaImplCommon::InputSig {
+  class BasicBlock = CIL::BasicBlock;
+
+  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
+
+  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+  class ExitBasicBlock = CIL::ExitBasicBlock;
+
+  class SourceVariable = CIL::StackVariable;
+
+  predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    forceCachingInSameStage() and
+    exists(CIL::VariableUpdate vu |
+      vu.updatesAt(bb, i) and
+      v = vu.getVariable() and
+      certain = true
+    )
+  }
+
+  predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    exists(CIL::ReadAccess ra | bb.getNode(i) = ra |
+      ra.getTarget() = v and
+      certain = true
+    )
+  }
+}
+
+import SsaImplCommon::Make<SsaInput>
 
 cached
 private module Cached {
+  private import CIL
+
   cached
   predicate forceCachingInSameStage() { any() }
 
diff --git a/csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll b/csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll
deleted file mode 100644
index 659940def50..00000000000
--- a/csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll
+++ /dev/null
@@ -1,795 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
-    maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaActualRead() or
-    SsaPhiRead() or
-    SsaDef()
-
-  class SsaRead = SsaActualRead or SsaPhiRead;
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaActualRead() and
-      result = "SsaActualRead"
-      or
-      this = SsaPhiRead() and
-      result = "SsaPhiRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this instanceof SsaRead and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if `bb` is in the dominance frontier of a block containing a
-   * read of `v`.
-   */
-  pragma[nomagic]
-  private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
-    exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
-      lastRefIsRead(readbb, v)
-      or
-      phiRead(readbb, v)
-    )
-  }
-
-  /**
-   * Holds if a phi-read node should be inserted for variable `v` at the beginning
-   * of basic block `bb`.
-   *
-   * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
-   * instead of writes, and only if the dominance-frontier block does not already
-   * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
-   * an internal implementation detail that is not exposed.
-   *
-   * The motivation for adding phi-reads is to improve performance of the use-use
-   * calculation in cases where there is a large number of reads that can reach the
-   * same join-point, and from there reach a large number of basic blocks. Example:
-   *
-   * ```cs
-   * if (a)
-   *   use(x);
-   * else if (b)
-   *   use(x);
-   * else if (c)
-   *   use(x);
-   * else if (d)
-   *   use(x);
-   * // many more ifs ...
-   *
-   * // phi-read for `x` inserted here
-   *
-   * // program not mentioning `x`, with large basic block graph
-   *
-   * use(x);
-   * ```
-   *
-   * Without phi-reads, the analysis has to replicate reachability for each of
-   * the guarded uses of `x`. However, with phi-reads, the analysis will limit
-   * each conditional use of `x` to reach the basic block containing the phi-read
-   * node for `x`, and only that basic block will have to compute reachability
-   * through the remainder of the large program.
-   *
-   * Like normal reads, each phi-read node `phi-read` can be reached from exactly
-   * one SSA definition (without passing through another definition): Assume, for
-   * the sake of contradiction, that there are two reaching definitions `def1` and
-   * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
-   * dominating definition will prevent the other from reaching `phi-read`. So, at
-   * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
-   * Then `def1` must go through one of its dominance-frontier blocks in order to
-   * reach `phi-read`. However, such a block will always start with a (normal) phi
-   * node, which contradicts reachability.
-   *
-   * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
-   * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
-   * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
-   * which contradicts reachability.
-   */
-  pragma[nomagic]
-  predicate phiRead(BasicBlock bb, SourceVariable v) {
-    inReadDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v) and
-    // only if there are no other references to `v` inside `bb`
-    not ref(bb, _, v, _) and
-    not exists(Definition def | def.definesAt(v, bb, _))
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  pragma[nomagic]
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaActualRead()
-    or
-    phiRead(bb, v) and
-    i = -1 and
-    k = SsaPhiRead()
-    or
-    any(Definition def).definesAt(v, bb, i) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, any(SsaRead k))
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, any(SsaRead k))
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
-    exists(ssaDefRank(def, v, bb, _, k))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable(), _)
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
-   * predecessor of `bb2`, and the underlying variable for `def` is neither read
-   * nor written in any block on the path between `bb1` and `bb2`.
-   *
-   * Phi reads are considered as normal reads for this predicate.
-   */
-  pragma[nomagic]
-  private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReachesInclPhiRead(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(def, bb1, bb2) and
-    defOccursInBlock(def, bb2, v, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
-    ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExclPhiRead(def, mid, bb2) and
-      phiReadStep(def, _, bb1, mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * the underlying variable `v` of `def` is accessed in basic block `bb2`
-   * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
-   * `v` is neither read nor written in any block on the path between `bb1`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesExclPhiRead(def, bb1, bb2) and
-    not defOccursInBlock(def, bb1, _, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb` (either a read or a write),
-   * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
-   * and `v` is neither read nor written in any block on the path between `bb`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReachesExit(Definition def, BasicBlock bb) {
-    exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExit(def, mid) and
-      phiReadStep(def, _, bb, mid)
-    )
-  }
-}
-
-predicate phiReadExposedForTesting = phiRead/2;
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last |
-    last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  ssaRef(bb, i, v, any(SsaRead k)) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  // Can reach another definition
-  lastRefRedef(def, bb, i, _)
-  or
-  exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    varBlockReachesExit(def, bb)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-
-  query predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
-      ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      (bb != bbDef or i < iDef)
-      or
-      ssaDefReachesRead(v, def, bb, i) and
-      not ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
-    )
-  }
-}
diff --git a/csharp/ql/lib/semmle/code/cil/internal/SsaImplSpecific.qll b/csharp/ql/lib/semmle/code/cil/internal/SsaImplSpecific.qll
deleted file mode 100644
index 94b4812d996..00000000000
--- a/csharp/ql/lib/semmle/code/cil/internal/SsaImplSpecific.qll
+++ /dev/null
@@ -1,30 +0,0 @@
-/** Provides the CIL specific parameters for `SsaImplCommon.qll`. */
-
-private import cil
-private import SsaImpl
-
-class BasicBlock = CIL::BasicBlock;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock = CIL::ExitBasicBlock;
-
-class SourceVariable = CIL::StackVariable;
-
-predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  forceCachingInSameStage() and
-  exists(CIL::VariableUpdate vu |
-    vu.updatesAt(bb, i) and
-    v = vu.getVariable() and
-    certain = true
-  )
-}
-
-predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(CIL::ReadAccess ra | bb.getNode(i) = ra |
-    ra.getTarget() = v and
-    certain = true
-  )
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/BasicBlocks.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/BasicBlocks.qll
index 08e5925ad50..44ff56706a7 100644
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/BasicBlocks.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/BasicBlocks.qll
@@ -192,8 +192,7 @@ class BasicBlock extends TBasicBlockStart {
    * Gets the basic block that immediately dominates this basic block, if any.
    *
    * That is, all paths reaching this basic block from some entry point
-   * basic block must go through the result, which is an immediate basic block
-   * predecessor of this basic block.
+   * basic block must go through the result.
    *
    * Example:
    *
@@ -207,8 +206,7 @@ class BasicBlock extends TBasicBlockStart {
    *
    * The basic block starting on line 2 is an immediate dominator of
    * the basic block online 4 (all paths from the entry point of `M`
-   * to `return s.Length;` must go through the null check, and the null check
-   * is an immediate predecessor of `return s.Length;`).
+   * to `return s.Length;` must go through the null check.
    */
   BasicBlock getImmediateDominator() { bbIDominates(result, this) }
 
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll
index 5ac313651d7..73d19171a52 100644
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll
@@ -6,26 +6,158 @@ import csharp
  * scope variables.
  */
 module PreSsa {
-  import pressa.SsaImplSpecific
-  private import pressa.SsaImplCommon as SsaImpl
+  private import AssignableDefinitions
+  private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl
+  private import semmle.code.csharp.controlflow.internal.PreBasicBlocks as PreBasicBlocks
+  private import codeql.ssa.Ssa as SsaImplCommon
+
+  private predicate definitionAt(
+    AssignableDefinition def, SsaInput::BasicBlock bb, int i, SsaInput::SourceVariable v
+  ) {
+    bb.getElement(i) = def.getExpr() and
+    v = def.getTarget() and
+    // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
+    not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = def |
+      second.getAssignment() = first.getAssignment() and
+      second.getEvaluationOrder() > first.getEvaluationOrder() and
+      second.getTarget() = v
+    )
+    or
+    def.(ImplicitParameterDefinition).getParameter() = v and
+    exists(Callable c | v = c.getAParameter() |
+      scopeFirst(c, bb) and
+      i = -1
+    )
+  }
+
+  predicate implicitEntryDef(Callable c, SsaInput::BasicBlock bb, SsaInput::SourceVariable v) {
+    not v instanceof LocalScopeVariable and
+    c = v.getACallable() and
+    scopeFirst(c, bb)
+  }
+
+  module SsaInput implements SsaImplCommon::InputSig {
+    class BasicBlock = PreBasicBlocks::PreBasicBlock;
+
+    BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
+
+    BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+    class ExitBasicBlock extends BasicBlock {
+      ExitBasicBlock() { scopeLast(_, this.getLastElement(), _) }
+    }
+
+    /** Holds if `a` is assigned in non-constructor callable `c`. */
+    pragma[nomagic]
+    private predicate assignableDefinition(Assignable a, Callable c) {
+      exists(AssignableDefinition def | def.getTarget() = a |
+        c = def.getEnclosingCallable() and
+        not c instanceof Constructor
+      )
+    }
+
+    /** Holds if `a` is accessed in callable `c`. */
+    pragma[nomagic]
+    private predicate assignableAccess(Assignable a, Callable c) {
+      exists(AssignableAccess aa | aa.getTarget() = a | c = aa.getEnclosingCallable())
+    }
+
+    pragma[nomagic]
+    private predicate assignableNoCapturing(Assignable a, Callable c) {
+      assignableAccess(a, c) and
+      /*
+       * The code below is equivalent to
+       * ```ql
+       * not exists(Callable other | assignableDefinition(a, other) | other != c)
+       * ```
+       * but it avoids a Cartesian product in the compiler generated antijoin
+       * predicate.
+       */
+
+      (
+        not assignableDefinition(a, _)
+        or
+        c = unique(Callable c0 | assignableDefinition(a, c0) | c0)
+      )
+    }
+
+    pragma[noinline]
+    private predicate assignableNoComplexQualifiers(Assignable a) {
+      forall(QualifiableExpr qe | qe.(AssignableAccess).getTarget() = a | qe.targetIsThisInstance())
+    }
+
+    /**
+     * A simple assignable. Either a local scope variable or a field/property
+     * that behaves like a local scope variable.
+     */
+    class SourceVariable extends Assignable {
+      private Callable c;
+
+      SourceVariable() {
+        (
+          this instanceof LocalScopeVariable
+          or
+          this = any(Field f | not f.isVolatile())
+          or
+          this = any(TrivialProperty tp | not tp.isOverridableOrImplementable())
+        ) and
+        assignableNoCapturing(this, c) and
+        assignableNoComplexQualifiers(this)
+      }
+
+      /** Gets a callable in which this simple assignable can be analyzed. */
+      Callable getACallable() { result = c }
+    }
+
+    predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+      exists(AssignableDefinition def |
+        definitionAt(def, bb, i, v) and
+        if def.getTargetAccess().isRefArgument() then certain = false else certain = true
+      )
+      or
+      exists(Callable c |
+        implicitEntryDef(c, bb, v) and
+        i = -1 and
+        certain = true
+      )
+    }
+
+    predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+      exists(AssignableRead read |
+        read = bb.getElement(i) and
+        read.getTarget() = v and
+        certain = true
+      )
+      or
+      v =
+        any(LocalScopeVariable lsv |
+          lsv.getCallable() = bb.(ExitBasicBlock).getEnclosingCallable() and
+          i = bb.length() and
+          (lsv.isRef() or v.(Parameter).isOut()) and
+          certain = false
+        )
+    }
+  }
+
+  private module SsaImpl = SsaImplCommon::Make<SsaInput>;
 
   class Definition extends SsaImpl::Definition {
     final AssignableRead getARead() {
-      exists(BasicBlock bb, int i |
+      exists(SsaInput::BasicBlock bb, int i |
         SsaImpl::ssaDefReachesRead(_, this, bb, i) and
         result = bb.getElement(i)
       )
     }
 
     final AssignableDefinition getDefinition() {
-      exists(BasicBlock bb, int i, SourceVariable v |
+      exists(SsaInput::BasicBlock bb, int i, SsaInput::SourceVariable v |
         this.definesAt(v, bb, i) and
         definitionAt(result, bb, i, v)
       )
     }
 
     final AssignableRead getAFirstRead() {
-      exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
+      exists(SsaInput::BasicBlock bb1, int i1, SsaInput::BasicBlock bb2, int i2 |
         this.definesAt(_, bb1, i1) and
         SsaImpl::adjacentDefRead(this, bb1, i1, bb2, i2) and
         result = bb2.getElement(i2)
@@ -42,14 +174,14 @@ module PreSsa {
       not result instanceof PhiNode
     }
 
-    final predicate isLiveAtEndOfBlock(BasicBlock bb) {
+    final predicate isLiveAtEndOfBlock(SsaInput::BasicBlock bb) {
       SsaImpl::ssaDefReachesEndOfBlock(bb, this, _)
     }
 
     Location getLocation() {
       result = this.getDefinition().getLocation()
       or
-      exists(Callable c, BasicBlock bb, SourceVariable v |
+      exists(Callable c, SsaInput::BasicBlock bb, SsaInput::SourceVariable v |
         this.definesAt(v, bb, -1) and
         implicitEntryDef(c, bb, v) and
         result = c.getLocation()
@@ -64,9 +196,9 @@ module PreSsa {
   }
 
   predicate adjacentReadPairSameVar(AssignableRead read1, AssignableRead read2) {
-    exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
+    exists(SsaInput::BasicBlock bb1, int i1, SsaInput::BasicBlock bb2, int i2 |
       read1 = bb1.getElement(i1) and
-      variableRead(bb1, i1, _, true) and
+      SsaInput::variableRead(bb1, i1, _, true) and
       SsaImpl::adjacentDefRead(_, bb1, i1, bb2, i2) and
       read2 = bb2.getElement(i2)
     )
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll
deleted file mode 100644
index 659940def50..00000000000
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll
+++ /dev/null
@@ -1,795 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
-    maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaActualRead() or
-    SsaPhiRead() or
-    SsaDef()
-
-  class SsaRead = SsaActualRead or SsaPhiRead;
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaActualRead() and
-      result = "SsaActualRead"
-      or
-      this = SsaPhiRead() and
-      result = "SsaPhiRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this instanceof SsaRead and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if `bb` is in the dominance frontier of a block containing a
-   * read of `v`.
-   */
-  pragma[nomagic]
-  private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
-    exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
-      lastRefIsRead(readbb, v)
-      or
-      phiRead(readbb, v)
-    )
-  }
-
-  /**
-   * Holds if a phi-read node should be inserted for variable `v` at the beginning
-   * of basic block `bb`.
-   *
-   * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
-   * instead of writes, and only if the dominance-frontier block does not already
-   * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
-   * an internal implementation detail that is not exposed.
-   *
-   * The motivation for adding phi-reads is to improve performance of the use-use
-   * calculation in cases where there is a large number of reads that can reach the
-   * same join-point, and from there reach a large number of basic blocks. Example:
-   *
-   * ```cs
-   * if (a)
-   *   use(x);
-   * else if (b)
-   *   use(x);
-   * else if (c)
-   *   use(x);
-   * else if (d)
-   *   use(x);
-   * // many more ifs ...
-   *
-   * // phi-read for `x` inserted here
-   *
-   * // program not mentioning `x`, with large basic block graph
-   *
-   * use(x);
-   * ```
-   *
-   * Without phi-reads, the analysis has to replicate reachability for each of
-   * the guarded uses of `x`. However, with phi-reads, the analysis will limit
-   * each conditional use of `x` to reach the basic block containing the phi-read
-   * node for `x`, and only that basic block will have to compute reachability
-   * through the remainder of the large program.
-   *
-   * Like normal reads, each phi-read node `phi-read` can be reached from exactly
-   * one SSA definition (without passing through another definition): Assume, for
-   * the sake of contradiction, that there are two reaching definitions `def1` and
-   * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
-   * dominating definition will prevent the other from reaching `phi-read`. So, at
-   * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
-   * Then `def1` must go through one of its dominance-frontier blocks in order to
-   * reach `phi-read`. However, such a block will always start with a (normal) phi
-   * node, which contradicts reachability.
-   *
-   * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
-   * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
-   * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
-   * which contradicts reachability.
-   */
-  pragma[nomagic]
-  predicate phiRead(BasicBlock bb, SourceVariable v) {
-    inReadDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v) and
-    // only if there are no other references to `v` inside `bb`
-    not ref(bb, _, v, _) and
-    not exists(Definition def | def.definesAt(v, bb, _))
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  pragma[nomagic]
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaActualRead()
-    or
-    phiRead(bb, v) and
-    i = -1 and
-    k = SsaPhiRead()
-    or
-    any(Definition def).definesAt(v, bb, i) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, any(SsaRead k))
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, any(SsaRead k))
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
-    exists(ssaDefRank(def, v, bb, _, k))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable(), _)
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
-   * predecessor of `bb2`, and the underlying variable for `def` is neither read
-   * nor written in any block on the path between `bb1` and `bb2`.
-   *
-   * Phi reads are considered as normal reads for this predicate.
-   */
-  pragma[nomagic]
-  private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReachesInclPhiRead(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(def, bb1, bb2) and
-    defOccursInBlock(def, bb2, v, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
-    ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExclPhiRead(def, mid, bb2) and
-      phiReadStep(def, _, bb1, mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * the underlying variable `v` of `def` is accessed in basic block `bb2`
-   * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
-   * `v` is neither read nor written in any block on the path between `bb1`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesExclPhiRead(def, bb1, bb2) and
-    not defOccursInBlock(def, bb1, _, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb` (either a read or a write),
-   * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
-   * and `v` is neither read nor written in any block on the path between `bb`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReachesExit(Definition def, BasicBlock bb) {
-    exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExit(def, mid) and
-      phiReadStep(def, _, bb, mid)
-    )
-  }
-}
-
-predicate phiReadExposedForTesting = phiRead/2;
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last |
-    last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  ssaRef(bb, i, v, any(SsaRead k)) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  // Can reach another definition
-  lastRefRedef(def, bb, i, _)
-  or
-  exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    varBlockReachesExit(def, bb)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-
-  query predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
-      ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      (bb != bbDef or i < iDef)
-      or
-      ssaDefReachesRead(v, def, bb, i) and
-      not ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
-    )
-  }
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplSpecific.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplSpecific.qll
deleted file mode 100644
index ad64c38973a..00000000000
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplSpecific.qll
+++ /dev/null
@@ -1,130 +0,0 @@
-/** Provides the C# specific parameters for `SsaImplCommon.qll`. */
-
-private import csharp
-private import AssignableDefinitions
-private import semmle.code.csharp.controlflow.internal.PreBasicBlocks as PreBasicBlocks
-private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl
-
-class BasicBlock = PreBasicBlocks::PreBasicBlock;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock extends BasicBlock {
-  ExitBasicBlock() { scopeLast(_, this.getLastElement(), _) }
-}
-
-/** Holds if `a` is assigned in non-constructor callable `c`. */
-pragma[nomagic]
-private predicate assignableDefinition(Assignable a, Callable c) {
-  exists(AssignableDefinition def | def.getTarget() = a |
-    c = def.getEnclosingCallable() and
-    not c instanceof Constructor
-  )
-}
-
-/** Holds if `a` is accessed in callable `c`. */
-pragma[nomagic]
-private predicate assignableAccess(Assignable a, Callable c) {
-  exists(AssignableAccess aa | aa.getTarget() = a | c = aa.getEnclosingCallable())
-}
-
-pragma[nomagic]
-private predicate assignableNoCapturing(Assignable a, Callable c) {
-  assignableAccess(a, c) and
-  /*
-   * The code below is equivalent to
-   * ```ql
-   * not exists(Callable other | assignableDefinition(a, other) | other != c)
-   * ```
-   * but it avoids a Cartesian product in the compiler generated antijoin
-   * predicate.
-   */
-
-  (
-    not assignableDefinition(a, _)
-    or
-    c = unique(Callable c0 | assignableDefinition(a, c0) | c0)
-  )
-}
-
-pragma[noinline]
-private predicate assignableNoComplexQualifiers(Assignable a) {
-  forall(QualifiableExpr qe | qe.(AssignableAccess).getTarget() = a | qe.targetIsThisInstance())
-}
-
-/**
- * A simple assignable. Either a local scope variable or a field/property
- * that behaves like a local scope variable.
- */
-class SourceVariable extends Assignable {
-  private Callable c;
-
-  SourceVariable() {
-    (
-      this instanceof LocalScopeVariable
-      or
-      this = any(Field f | not f.isVolatile())
-      or
-      this = any(TrivialProperty tp | not tp.isOverridableOrImplementable())
-    ) and
-    assignableNoCapturing(this, c) and
-    assignableNoComplexQualifiers(this)
-  }
-
-  /** Gets a callable in which this simple assignable can be analyzed. */
-  Callable getACallable() { result = c }
-}
-
-predicate definitionAt(AssignableDefinition def, BasicBlock bb, int i, SourceVariable v) {
-  bb.getElement(i) = def.getExpr() and
-  v = def.getTarget() and
-  // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
-  not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = def |
-    second.getAssignment() = first.getAssignment() and
-    second.getEvaluationOrder() > first.getEvaluationOrder() and
-    second.getTarget() = v
-  )
-  or
-  def.(ImplicitParameterDefinition).getParameter() = v and
-  exists(Callable c | v = c.getAParameter() |
-    scopeFirst(c, bb) and
-    i = -1
-  )
-}
-
-predicate implicitEntryDef(Callable c, BasicBlock bb, SourceVariable v) {
-  not v instanceof LocalScopeVariable and
-  c = v.getACallable() and
-  scopeFirst(c, bb)
-}
-
-predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(AssignableDefinition def |
-    definitionAt(def, bb, i, v) and
-    if def.getTargetAccess().isRefArgument() then certain = false else certain = true
-  )
-  or
-  exists(Callable c |
-    implicitEntryDef(c, bb, v) and
-    i = -1 and
-    certain = true
-  )
-}
-
-predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(AssignableRead read |
-    read = bb.getElement(i) and
-    read.getTarget() = v and
-    certain = true
-  )
-  or
-  v =
-    any(LocalScopeVariable lsv |
-      lsv.getCallable() = bb.(ExitBasicBlock).getEnclosingCallable() and
-      i = bb.length() and
-      (lsv.isRef() or v.(Parameter).isOut()) and
-      certain = false
-    )
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll
index 9285ba2f4a7..8227501f841 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll
@@ -12,6 +12,8 @@
  *   `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
  * - Negative Summaries:
  *   `namespace; type; name; signature; provenance`
+ *   A negative summary is used to indicate that there is no flow via a callable.
+ *
  * The interpretation of a row is similar to API-graphs with a left-to-right
  * reading.
  * 1. The `namespace` column selects a namespace.
@@ -100,6 +102,7 @@ private module Frameworks {
   private import semmle.code.csharp.frameworks.ServiceStack
   private import semmle.code.csharp.frameworks.Sql
   private import semmle.code.csharp.frameworks.System
+  private import semmle.code.csharp.frameworks.system.CodeDom
   private import semmle.code.csharp.frameworks.system.Collections
   private import semmle.code.csharp.frameworks.system.collections.Concurrent
   private import semmle.code.csharp.frameworks.system.collections.Generic
@@ -108,6 +111,7 @@ private module Frameworks {
   private import semmle.code.csharp.frameworks.system.collections.Specialized
   private import semmle.code.csharp.frameworks.system.ComponentModel
   private import semmle.code.csharp.frameworks.system.componentmodel.Design
+  private import semmle.code.csharp.frameworks.system.Configuration
   private import semmle.code.csharp.frameworks.system.Data
   private import semmle.code.csharp.frameworks.system.data.Common
   private import semmle.code.csharp.frameworks.system.Diagnostics
@@ -119,6 +123,7 @@ private module Frameworks {
   private import semmle.code.csharp.frameworks.system.IO
   private import semmle.code.csharp.frameworks.system.io.Compression
   private import semmle.code.csharp.frameworks.system.runtime.CompilerServices
+  private import semmle.code.csharp.frameworks.system.Security
   private import semmle.code.csharp.frameworks.system.security.Cryptography
   private import semmle.code.csharp.frameworks.system.security.cryptography.X509Certificates
   private import semmle.code.csharp.frameworks.system.Text
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
index 281523a2fbd..cb737200a02 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
@@ -4,19 +4,74 @@ import csharp
  * Provides a simple SSA implementation for local scope variables.
  */
 module BaseSsa {
-  import basessa.SsaImplSpecific
-  private import basessa.SsaImplCommon as SsaImpl
+  private import AssignableDefinitions
+  private import codeql.ssa.Ssa as SsaImplCommon
+
+  /**
+   * Holds if the `i`th node of basic block `bb` is assignable definition `def`,
+   * targeting local scope variable `v`.
+   */
+  private predicate definitionAt(
+    AssignableDefinition def, ControlFlow::BasicBlock bb, int i, SsaInput::SourceVariable v
+  ) {
+    bb.getNode(i) = def.getAControlFlowNode() and
+    v = def.getTarget() and
+    // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
+    not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = def |
+      second.getAssignment() = first.getAssignment() and
+      second.getEvaluationOrder() > first.getEvaluationOrder() and
+      second.getTarget() = v
+    )
+  }
+
+  private module SsaInput implements SsaImplCommon::InputSig {
+    class BasicBlock = ControlFlow::BasicBlock;
+
+    BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) {
+      result = bb.getImmediateDominator()
+    }
+
+    BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+    class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
+
+    pragma[noinline]
+    private Callable getAnAssigningCallable(LocalScopeVariable v) {
+      result = any(AssignableDefinition def | def.getTarget() = v).getEnclosingCallable()
+    }
+
+    class SourceVariable extends LocalScopeVariable {
+      SourceVariable() { not getAnAssigningCallable(this) != getAnAssigningCallable(this) }
+    }
+
+    predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+      exists(AssignableDefinition def |
+        definitionAt(def, bb, i, v) and
+        if def.isCertain() then certain = true else certain = false
+      )
+    }
+
+    predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+      exists(AssignableRead read |
+        read.getAControlFlowNode() = bb.getNode(i) and
+        read.getTarget() = v and
+        certain = true
+      )
+    }
+  }
+
+  private module SsaImpl = SsaImplCommon::Make<SsaInput>;
 
   class Definition extends SsaImpl::Definition {
     final AssignableRead getARead() {
-      exists(BasicBlock bb, int i |
+      exists(ControlFlow::BasicBlock bb, int i |
         SsaImpl::ssaDefReachesRead(_, this, bb, i) and
         result.getAControlFlowNode() = bb.getNode(i)
       )
     }
 
     final AssignableDefinition getDefinition() {
-      exists(BasicBlock bb, int i, SourceVariable v |
+      exists(ControlFlow::BasicBlock bb, int i, SsaInput::SourceVariable v |
         this.definesAt(v, bb, i) and
         definitionAt(result, bb, i, v)
       )
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
index e00fc952e1c..d857cdaa359 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
@@ -226,15 +226,6 @@ module Public {
       none()
     }
 
-    /**
-     * Holds if values stored inside `content` are cleared on objects passed as
-     * arguments at position `pos` to this callable.
-     *
-     * TODO: Remove once all languages support `WithoutContent` tokens.
-     */
-    pragma[nomagic]
-    predicate clearsContent(ParameterPosition pos, ContentSet content) { none() }
-
     /**
      * Holds if the summary is auto generated.
      */
@@ -328,23 +319,6 @@ module Private {
           SummaryComponentStack::singleton(TArgumentSummaryComponent(_))) and
       preservesValue = preservesValue1.booleanAnd(preservesValue2)
     )
-    or
-    exists(ParameterPosition ppos, ContentSet cs |
-      c.clearsContent(ppos, cs) and
-      input = SummaryComponentStack::push(SummaryComponent::withoutContent(cs), output) and
-      output = SummaryComponentStack::argument(ppos) and
-      preservesValue = true
-    )
-  }
-
-  private class MkClearStack extends RequiredSummaryComponentStack {
-    override predicate required(SummaryComponent head, SummaryComponentStack tail) {
-      exists(SummarizedCallable sc, ParameterPosition ppos, ContentSet cs |
-        sc.clearsContent(ppos, cs) and
-        head = SummaryComponent::withoutContent(cs) and
-        tail = SummaryComponentStack::argument(ppos)
-      )
-    }
   }
 
   /**
@@ -945,8 +919,7 @@ module Private {
         AccessPath inSpec, AccessPath outSpec, string kind
       ) {
         summaryElement(this, inSpec, outSpec, kind, true) and
-        not summaryElement(this, _, _, _, false) and
-        not this.clearsContent(_, _)
+        not summaryElement(this, _, _, _, false)
       }
 
       private predicate relevantSummaryElement(AccessPath inSpec, AccessPath outSpec, string kind) {
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll
index 620c3a7a410..864fda40cf7 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll
@@ -163,6 +163,10 @@ bindingset[c]
 SummaryComponent interpretComponentSpecific(AccessPathToken c) {
   c = "Element" and result = SummaryComponent::content(any(ElementContent ec))
   or
+  c = "WithoutElement" and result = SummaryComponent::withoutContent(any(ElementContent ec))
+  or
+  c = "WithElement" and result = SummaryComponent::withContent(any(ElementContent ec))
+  or
   // Qualified names may contain commas,such as in `Tuple<,>`, so get the entire argument list
   // rather than an individual argument.
   exists(Field f |
@@ -199,6 +203,10 @@ private string getContentSpecificCsv(Content c) {
 string getComponentSpecificCsv(SummaryComponent sc) {
   exists(Content c | sc = TContentSummaryComponent(c) and result = getContentSpecificCsv(c))
   or
+  exists(Content c | sc = TWithoutContentSummaryComponent(c) and result = "WithoutElement")
+  or
+  exists(Content c | sc = TWithContentSummaryComponent(c) and result = "WithElement")
+  or
   exists(ReturnKind rk |
     sc = TReturnSummaryComponent(rk) and
     result = "ReturnValue[" + rk + "]" and
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
index 7528d47db91..0655ffee6f9 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -3,7 +3,53 @@
  */
 
 import csharp
-import SsaImplCommon
+private import codeql.ssa.Ssa as SsaImplCommon
+private import AssignableDefinitions
+
+private module SsaInput implements SsaImplCommon::InputSig {
+  class BasicBlock = ControlFlow::BasicBlock;
+
+  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
+
+  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+  class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
+
+  class SourceVariable = Ssa::SourceVariable;
+
+  /**
+   * Holds if the `i`th node of basic block `bb` is a (potential) write to source
+   * variable `v`. The Boolean `certain` indicates whether the write is certain.
+   *
+   * This includes implicit writes via calls.
+   */
+  predicate variableWrite(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain) {
+    variableWriteDirect(bb, i, v, certain)
+    or
+    variableWriteQualifier(bb, i, v, certain)
+    or
+    updatesNamedFieldOrProp(bb, i, _, v, _) and
+    certain = false
+    or
+    updatesCapturedVariable(bb, i, _, v, _, _) and
+    certain = false
+  }
+
+  /**
+   * Holds if the `i`th of basic block `bb` reads source variable `v`.
+   *
+   * This includes implicit reads via calls.
+   */
+  predicate variableRead(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain) {
+    variableReadActual(bb, i, v) and
+    certain = true
+    or
+    variableReadPseudo(bb, i, v) and
+    certain = false
+  }
+}
+
+import SsaImplCommon::Make<SsaInput>
 
 /**
  * Holds if the `i`th node of basic block `bb` reads source variable `v`.
@@ -805,24 +851,6 @@ private module CapturedVariableImpl {
   }
 }
 
-/**
- * Holds if the `i`th node of basic block `bb` is a (potential) write to source
- * variable `v`. The Boolean `certain` indicates whether the write is certain.
- *
- * This includes implicit writes via calls.
- */
-predicate variableWrite(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain) {
-  variableWriteDirect(bb, i, v, certain)
-  or
-  variableWriteQualifier(bb, i, v, certain)
-  or
-  updatesNamedFieldOrProp(bb, i, _, v, _) and
-  certain = false
-  or
-  updatesCapturedVariable(bb, i, _, v, _, _) and
-  certain = false
-}
-
 /**
  * Liveness analysis to restrict the size of the SSA representation for
  * captured variables.
@@ -1039,19 +1067,6 @@ private predicate variableReadPseudo(ControlFlow::BasicBlock bb, int i, Ssa::Sou
   capturedReadIn(bb, i, v, _, _, _)
 }
 
-/**
- * Holds if the `i`th of basic block `bb` reads source variable `v`.
- *
- * This includes implicit reads via calls.
- */
-predicate variableRead(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain) {
-  variableReadActual(bb, i, v) and
-  certain = true
-  or
-  variableReadPseudo(bb, i, v) and
-  certain = false
-}
-
 cached
 private module Cached {
   cached
@@ -1151,7 +1166,7 @@ private module Cached {
   predicate variableWriteQualifier(
     ControlFlow::BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v, boolean certain
   ) {
-    variableWrite(bb, i, v.getQualifier(), certain) and
+    SsaInput::variableWrite(bb, i, v.getQualifier(), certain) and
     // Eliminate corner case where a call definition can overlap with a
     // qualifier definition: if method `M` updates field `F`, then a call
     // to `M` is both an update of `x.M` and `x.M.M`, so the former call
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
deleted file mode 100644
index 659940def50..00000000000
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
+++ /dev/null
@@ -1,795 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
-    maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaActualRead() or
-    SsaPhiRead() or
-    SsaDef()
-
-  class SsaRead = SsaActualRead or SsaPhiRead;
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaActualRead() and
-      result = "SsaActualRead"
-      or
-      this = SsaPhiRead() and
-      result = "SsaPhiRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this instanceof SsaRead and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if `bb` is in the dominance frontier of a block containing a
-   * read of `v`.
-   */
-  pragma[nomagic]
-  private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
-    exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
-      lastRefIsRead(readbb, v)
-      or
-      phiRead(readbb, v)
-    )
-  }
-
-  /**
-   * Holds if a phi-read node should be inserted for variable `v` at the beginning
-   * of basic block `bb`.
-   *
-   * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
-   * instead of writes, and only if the dominance-frontier block does not already
-   * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
-   * an internal implementation detail that is not exposed.
-   *
-   * The motivation for adding phi-reads is to improve performance of the use-use
-   * calculation in cases where there is a large number of reads that can reach the
-   * same join-point, and from there reach a large number of basic blocks. Example:
-   *
-   * ```cs
-   * if (a)
-   *   use(x);
-   * else if (b)
-   *   use(x);
-   * else if (c)
-   *   use(x);
-   * else if (d)
-   *   use(x);
-   * // many more ifs ...
-   *
-   * // phi-read for `x` inserted here
-   *
-   * // program not mentioning `x`, with large basic block graph
-   *
-   * use(x);
-   * ```
-   *
-   * Without phi-reads, the analysis has to replicate reachability for each of
-   * the guarded uses of `x`. However, with phi-reads, the analysis will limit
-   * each conditional use of `x` to reach the basic block containing the phi-read
-   * node for `x`, and only that basic block will have to compute reachability
-   * through the remainder of the large program.
-   *
-   * Like normal reads, each phi-read node `phi-read` can be reached from exactly
-   * one SSA definition (without passing through another definition): Assume, for
-   * the sake of contradiction, that there are two reaching definitions `def1` and
-   * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
-   * dominating definition will prevent the other from reaching `phi-read`. So, at
-   * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
-   * Then `def1` must go through one of its dominance-frontier blocks in order to
-   * reach `phi-read`. However, such a block will always start with a (normal) phi
-   * node, which contradicts reachability.
-   *
-   * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
-   * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
-   * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
-   * which contradicts reachability.
-   */
-  pragma[nomagic]
-  predicate phiRead(BasicBlock bb, SourceVariable v) {
-    inReadDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v) and
-    // only if there are no other references to `v` inside `bb`
-    not ref(bb, _, v, _) and
-    not exists(Definition def | def.definesAt(v, bb, _))
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  pragma[nomagic]
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaActualRead()
-    or
-    phiRead(bb, v) and
-    i = -1 and
-    k = SsaPhiRead()
-    or
-    any(Definition def).definesAt(v, bb, i) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, any(SsaRead k))
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, any(SsaRead k))
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
-    exists(ssaDefRank(def, v, bb, _, k))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable(), _)
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
-   * predecessor of `bb2`, and the underlying variable for `def` is neither read
-   * nor written in any block on the path between `bb1` and `bb2`.
-   *
-   * Phi reads are considered as normal reads for this predicate.
-   */
-  pragma[nomagic]
-  private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReachesInclPhiRead(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(def, bb1, bb2) and
-    defOccursInBlock(def, bb2, v, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
-    ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExclPhiRead(def, mid, bb2) and
-      phiReadStep(def, _, bb1, mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * the underlying variable `v` of `def` is accessed in basic block `bb2`
-   * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
-   * `v` is neither read nor written in any block on the path between `bb1`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesExclPhiRead(def, bb1, bb2) and
-    not defOccursInBlock(def, bb1, _, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb` (either a read or a write),
-   * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
-   * and `v` is neither read nor written in any block on the path between `bb`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReachesExit(Definition def, BasicBlock bb) {
-    exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExit(def, mid) and
-      phiReadStep(def, _, bb, mid)
-    )
-  }
-}
-
-predicate phiReadExposedForTesting = phiRead/2;
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last |
-    last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  ssaRef(bb, i, v, any(SsaRead k)) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  // Can reach another definition
-  lastRefRedef(def, bb, i, _)
-  or
-  exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    varBlockReachesExit(def, bb)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-
-  query predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
-      ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      (bb != bbDef or i < iDef)
-      or
-      ssaDefReachesRead(v, def, bb, i) and
-      not ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
-    )
-  }
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
deleted file mode 100644
index a929e23a942..00000000000
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
+++ /dev/null
@@ -1,19 +0,0 @@
-/** Provides the C# specific parameters for `SsaImplCommon.qll`. */
-
-private import csharp
-private import AssignableDefinitions
-private import SsaImpl as SsaImpl
-
-class BasicBlock = ControlFlow::BasicBlock;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
-
-class SourceVariable = Ssa::SourceVariable;
-
-predicate variableWrite = SsaImpl::variableWrite/4;
-
-predicate variableRead = SsaImpl::variableRead/4;
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll
deleted file mode 100644
index 659940def50..00000000000
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll
+++ /dev/null
@@ -1,795 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
-    maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaActualRead() or
-    SsaPhiRead() or
-    SsaDef()
-
-  class SsaRead = SsaActualRead or SsaPhiRead;
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaActualRead() and
-      result = "SsaActualRead"
-      or
-      this = SsaPhiRead() and
-      result = "SsaPhiRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this instanceof SsaRead and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if `bb` is in the dominance frontier of a block containing a
-   * read of `v`.
-   */
-  pragma[nomagic]
-  private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
-    exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
-      lastRefIsRead(readbb, v)
-      or
-      phiRead(readbb, v)
-    )
-  }
-
-  /**
-   * Holds if a phi-read node should be inserted for variable `v` at the beginning
-   * of basic block `bb`.
-   *
-   * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
-   * instead of writes, and only if the dominance-frontier block does not already
-   * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
-   * an internal implementation detail that is not exposed.
-   *
-   * The motivation for adding phi-reads is to improve performance of the use-use
-   * calculation in cases where there is a large number of reads that can reach the
-   * same join-point, and from there reach a large number of basic blocks. Example:
-   *
-   * ```cs
-   * if (a)
-   *   use(x);
-   * else if (b)
-   *   use(x);
-   * else if (c)
-   *   use(x);
-   * else if (d)
-   *   use(x);
-   * // many more ifs ...
-   *
-   * // phi-read for `x` inserted here
-   *
-   * // program not mentioning `x`, with large basic block graph
-   *
-   * use(x);
-   * ```
-   *
-   * Without phi-reads, the analysis has to replicate reachability for each of
-   * the guarded uses of `x`. However, with phi-reads, the analysis will limit
-   * each conditional use of `x` to reach the basic block containing the phi-read
-   * node for `x`, and only that basic block will have to compute reachability
-   * through the remainder of the large program.
-   *
-   * Like normal reads, each phi-read node `phi-read` can be reached from exactly
-   * one SSA definition (without passing through another definition): Assume, for
-   * the sake of contradiction, that there are two reaching definitions `def1` and
-   * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
-   * dominating definition will prevent the other from reaching `phi-read`. So, at
-   * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
-   * Then `def1` must go through one of its dominance-frontier blocks in order to
-   * reach `phi-read`. However, such a block will always start with a (normal) phi
-   * node, which contradicts reachability.
-   *
-   * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
-   * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
-   * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
-   * which contradicts reachability.
-   */
-  pragma[nomagic]
-  predicate phiRead(BasicBlock bb, SourceVariable v) {
-    inReadDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v) and
-    // only if there are no other references to `v` inside `bb`
-    not ref(bb, _, v, _) and
-    not exists(Definition def | def.definesAt(v, bb, _))
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  pragma[nomagic]
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaActualRead()
-    or
-    phiRead(bb, v) and
-    i = -1 and
-    k = SsaPhiRead()
-    or
-    any(Definition def).definesAt(v, bb, i) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, any(SsaRead k))
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, any(SsaRead k))
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
-    exists(ssaDefRank(def, v, bb, _, k))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable(), _)
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
-   * predecessor of `bb2`, and the underlying variable for `def` is neither read
-   * nor written in any block on the path between `bb1` and `bb2`.
-   *
-   * Phi reads are considered as normal reads for this predicate.
-   */
-  pragma[nomagic]
-  private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReachesInclPhiRead(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(def, bb1, bb2) and
-    defOccursInBlock(def, bb2, v, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
-    ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExclPhiRead(def, mid, bb2) and
-      phiReadStep(def, _, bb1, mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * the underlying variable `v` of `def` is accessed in basic block `bb2`
-   * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
-   * `v` is neither read nor written in any block on the path between `bb1`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesExclPhiRead(def, bb1, bb2) and
-    not defOccursInBlock(def, bb1, _, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb` (either a read or a write),
-   * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
-   * and `v` is neither read nor written in any block on the path between `bb`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReachesExit(Definition def, BasicBlock bb) {
-    exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExit(def, mid) and
-      phiReadStep(def, _, bb, mid)
-    )
-  }
-}
-
-predicate phiReadExposedForTesting = phiRead/2;
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last |
-    last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  ssaRef(bb, i, v, any(SsaRead k)) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  // Can reach another definition
-  lastRefRedef(def, bb, i, _)
-  or
-  exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    varBlockReachesExit(def, bb)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-
-  query predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
-      ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      (bb != bbDef or i < iDef)
-      or
-      ssaDefReachesRead(v, def, bb, i) and
-      not ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
-    )
-  }
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplSpecific.qll
deleted file mode 100644
index f095926e2a4..00000000000
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplSpecific.qll
+++ /dev/null
@@ -1,51 +0,0 @@
-/** Provides the C# specific parameters for `SsaImplCommon.qll`. */
-
-private import csharp
-private import AssignableDefinitions
-
-class BasicBlock = ControlFlow::BasicBlock;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
-
-pragma[noinline]
-private Callable getAnAssigningCallable(LocalScopeVariable v) {
-  result = any(AssignableDefinition def | def.getTarget() = v).getEnclosingCallable()
-}
-
-class SourceVariable extends LocalScopeVariable {
-  SourceVariable() { not getAnAssigningCallable(this) != getAnAssigningCallable(this) }
-}
-
-/**
- * Holds if the `i`th node of basic block `bb` is assignable definition `def`,
- * targeting local scope variable `v`.
- */
-predicate definitionAt(AssignableDefinition def, BasicBlock bb, int i, SourceVariable v) {
-  bb.getNode(i) = def.getAControlFlowNode() and
-  v = def.getTarget() and
-  // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
-  not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = def |
-    second.getAssignment() = first.getAssignment() and
-    second.getEvaluationOrder() > first.getEvaluationOrder() and
-    second.getTarget() = v
-  )
-}
-
-predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(AssignableDefinition def |
-    definitionAt(def, bb, i, v) and
-    if def.isCertain() then certain = true else certain = false
-  )
-}
-
-predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(AssignableRead read |
-    read.getAControlFlowNode() = bb.getNode(i) and
-    read.getTarget() = v and
-    certain = true
-  )
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/GeneratedNegative.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/GeneratedNegative.qll
index 0e1c66e251d..a7fb4c6c58c 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/GeneratedNegative.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/GeneratedNegative.qll
@@ -1,9 +1,8 @@
+/** Provides a module for importing negative models. */
+
 /**
  * A module importing all generated negative Models as Data models.
  */
-
-import csharp
-
 private module GeneratedFrameworks {
   private import generated.dotnet.NegativeRuntime
 }
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/System.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/System.qll
index e878179d7f8..652ec19a86a 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/System.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/System.qll
@@ -71,6 +71,8 @@ private class SystemArrayFlowModelCsv extends SummaryModelCsv {
     row =
       [
         "System;Array;false;AsReadOnly<>;(T[]);;Argument[0].Element;ReturnValue.Element;value;manual",
+        "System;Array;false;Clear;(System.Array,System.Int32,System.Int32);;Argument[0].WithoutElement;Argument[0];value;manual",
+        "System;Array;false;Clear;(System.Array);;Argument[0].WithoutElement;Argument[0];value;manual",
         "System;Array;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual",
         "System;Array;false;CopyTo;(System.Array,System.Int64);;Argument[this].Element;Argument[0].Element;value;manual",
         "System;Array;false;Find<>;(T[],System.Predicate<T>);;Argument[0].Element;Argument[1].Parameter[0];value;manual",
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/NegativeRuntime.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/NegativeRuntime.qll
index 8abcb5071c7..eaf039352de 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/NegativeRuntime.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/NegativeRuntime.qll
@@ -3237,7 +3237,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.CodeDom.Compiler;IndentedTextWriter;Close;();generated",
         "System.CodeDom.Compiler;IndentedTextWriter;DisposeAsync;();generated",
         "System.CodeDom.Compiler;IndentedTextWriter;Flush;();generated",
-        "System.CodeDom.Compiler;IndentedTextWriter;FlushAsync;();generated",
         "System.CodeDom.Compiler;IndentedTextWriter;IndentedTextWriter;(System.IO.TextWriter);generated",
         "System.CodeDom.Compiler;IndentedTextWriter;OutputTabs;();generated",
         "System.CodeDom.Compiler;IndentedTextWriter;OutputTabsAsync;();generated",
@@ -3281,7 +3280,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.CodeDom.Compiler;IndentedTextWriter;WriteLineAsync;(System.String);generated",
         "System.CodeDom.Compiler;IndentedTextWriter;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);generated",
         "System.CodeDom.Compiler;IndentedTextWriter;WriteLineNoTabs;(System.String);generated",
-        "System.CodeDom.Compiler;IndentedTextWriter;WriteLineNoTabsAsync;(System.String);generated",
         "System.CodeDom.Compiler;IndentedTextWriter;get_Indent;();generated",
         "System.CodeDom.Compiler;IndentedTextWriter;set_Indent;(System.Int32);generated",
         "System.CodeDom.Compiler;TempFileCollection;AddFile;(System.String,System.Boolean);generated",
@@ -3459,7 +3457,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.CodeDom;CodeNamespaceImport;set_LinePragma;(System.CodeDom.CodeLinePragma);generated",
         "System.CodeDom;CodeNamespaceImportCollection;Clear;();generated",
         "System.CodeDom;CodeNamespaceImportCollection;Contains;(System.Object);generated",
-        "System.CodeDom;CodeNamespaceImportCollection;GetEnumerator;();generated",
         "System.CodeDom;CodeNamespaceImportCollection;IndexOf;(System.Object);generated",
         "System.CodeDom;CodeNamespaceImportCollection;Remove;(System.Object);generated",
         "System.CodeDom;CodeNamespaceImportCollection;RemoveAt;(System.Int32);generated",
@@ -3612,7 +3609,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Concurrent;ConcurrentDictionary<,>;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;Contains;(System.Object);generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;ContainsKey;(TKey);generated",
-        "System.Collections.Concurrent;ConcurrentDictionary<,>;GetEnumerator;();generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;Remove;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;Remove;(System.Object);generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;Remove;(TKey);generated",
@@ -3676,9 +3672,7 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Generic;ByteEqualityComparer;Equals;(System.Object);generated",
         "System.Collections.Generic;ByteEqualityComparer;GetHashCode;();generated",
         "System.Collections.Generic;ByteEqualityComparer;GetHashCode;(System.Byte);generated",
-        "System.Collections.Generic;CollectionExtensions;AsReadOnly<,>;(System.Collections.Generic.IDictionary<TKey,TValue>);generated",
         "System.Collections.Generic;CollectionExtensions;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey);generated",
-        "System.Collections.Generic;CollectionExtensions;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);generated",
         "System.Collections.Generic;Comparer<>;Compare;(System.Object,System.Object);generated",
         "System.Collections.Generic;Comparer<>;Compare;(T,T);generated",
         "System.Collections.Generic;Comparer<>;get_Default;();generated",
@@ -3819,7 +3813,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Generic;KeyNotFoundException;KeyNotFoundException;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
         "System.Collections.Generic;KeyNotFoundException;KeyNotFoundException;(System.String);generated",
         "System.Collections.Generic;KeyNotFoundException;KeyNotFoundException;(System.String,System.Exception);generated",
-        "System.Collections.Generic;KeyValuePair;Create<,>;(TKey,TValue);generated",
         "System.Collections.Generic;KeyValuePair<,>;ToString;();generated",
         "System.Collections.Generic;LinkedList<>+Enumerator;Dispose;();generated",
         "System.Collections.Generic;LinkedList<>+Enumerator;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
@@ -4172,9 +4165,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableDictionary;CreateBuilder<,>;();generated",
         "System.Collections.Immutable;ImmutableDictionary;CreateBuilder<,>;(System.Collections.Generic.IEqualityComparer<TKey>);generated",
         "System.Collections.Immutable;ImmutableDictionary;CreateBuilder<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);generated",
-        "System.Collections.Immutable;ImmutableDictionary;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
-        "System.Collections.Immutable;ImmutableDictionary;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
-        "System.Collections.Immutable;ImmutableDictionary;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
         "System.Collections.Immutable;ImmutableDictionary;GetValueOrDefault<,>;(System.Collections.Immutable.IImmutableDictionary<TKey,TValue>,TKey);generated",
         "System.Collections.Immutable;ImmutableDictionary<,>+Builder;Clear;();generated",
         "System.Collections.Immutable;ImmutableDictionary<,>+Builder;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated",
@@ -4264,10 +4254,8 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableInterlocked;TryRemove<,>;(System.Collections.Immutable.ImmutableDictionary<TKey,TValue>,TKey,TValue);generated",
         "System.Collections.Immutable;ImmutableInterlocked;TryUpdate<,>;(System.Collections.Immutable.ImmutableDictionary<TKey,TValue>,TKey,TValue,TValue);generated",
         "System.Collections.Immutable;ImmutableList;Create<>;();generated",
-        "System.Collections.Immutable;ImmutableList;Create<>;(T);generated",
         "System.Collections.Immutable;ImmutableList;Create<>;(T[]);generated",
         "System.Collections.Immutable;ImmutableList;CreateBuilder<>;();generated",
-        "System.Collections.Immutable;ImmutableList;CreateRange<>;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableList;IndexOf<>;(System.Collections.Immutable.IImmutableList<T>,T);generated",
         "System.Collections.Immutable;ImmutableList;IndexOf<>;(System.Collections.Immutable.IImmutableList<T>,T,System.Collections.Generic.IEqualityComparer<T>);generated",
         "System.Collections.Immutable;ImmutableList;IndexOf<>;(System.Collections.Immutable.IImmutableList<T>,T,System.Int32);generated",
@@ -4331,9 +4319,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableQueue<>;get_IsEmpty;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary;Create<,>;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary;CreateBuilder<,>;();generated",
-        "System.Collections.Immutable;ImmutableSortedDictionary;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
-        "System.Collections.Immutable;ImmutableSortedDictionary;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
-        "System.Collections.Immutable;ImmutableSortedDictionary;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;Clear;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;Contains;(System.Object);generated",
@@ -4353,7 +4338,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;Dispose;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;MoveNext;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;Reset;();generated",
-        "System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;get_Current;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;Clear;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;Contains;(System.Object);generated",
@@ -4370,8 +4354,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;get_IsReadOnly;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;get_IsSynchronized;();generated",
         "System.Collections.Immutable;ImmutableSortedSet;Create<>;();generated",
-        "System.Collections.Immutable;ImmutableSortedSet;Create<>;(System.Collections.Generic.IComparer<T>,T);generated",
-        "System.Collections.Immutable;ImmutableSortedSet;Create<>;(T);generated",
         "System.Collections.Immutable;ImmutableSortedSet;Create<>;(T[]);generated",
         "System.Collections.Immutable;ImmutableSortedSet;CreateBuilder<>;();generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;Clear;();generated",
@@ -4385,7 +4367,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;Overlaps;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;Remove;(T);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;SetEquals;(System.Collections.Generic.IEnumerable<T>);generated",
-        "System.Collections.Immutable;ImmutableSortedSet<>+Builder;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;get_Count;();generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;get_IsReadOnly;();generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;get_IsSynchronized;();generated",
@@ -4399,7 +4380,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedSet<>;ExceptWith;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;IndexOf;(System.Object);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;IndexOf;(T);generated",
-        "System.Collections.Immutable;ImmutableSortedSet<>;Intersect;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;IntersectWith;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;IsProperSubsetOf;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;IsProperSupersetOf;(System.Collections.Generic.IEnumerable<T>);generated",
@@ -4411,7 +4391,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedSet<>;Remove;(T);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;RemoveAt;(System.Int32);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;SetEquals;(System.Collections.Generic.IEnumerable<T>);generated",
-        "System.Collections.Immutable;ImmutableSortedSet<>;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;UnionWith;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;get_Count;();generated",
@@ -4819,7 +4798,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;AggregateCatalog;(System.Collections.Generic.IEnumerable<System.ComponentModel.Composition.Primitives.ComposablePartCatalog>);generated",
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;AggregateCatalog;(System.ComponentModel.Composition.Primitives.ComposablePartCatalog[]);generated",
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;AggregateCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;OnChanged;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;OnChanging;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;AggregateExportProvider;AggregateExportProvider;(System.Collections.Generic.IEnumerable<System.ComponentModel.Composition.Hosting.ExportProvider>);generated",
@@ -4827,13 +4805,11 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;AggregateExportProvider;Dispose;(System.Boolean);generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;ApplicationCatalog;();generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;ApplicationCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;ToString;();generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;get_DisplayName;();generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;get_Origin;();generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;AssemblyCatalog;(System.String);generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;AssemblyCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;get_Origin;();generated",
         "System.ComponentModel.Composition.Hosting;AtomicComposition;AtomicComposition;();generated",
         "System.ComponentModel.Composition.Hosting;AtomicComposition;Complete;();generated",
@@ -4869,7 +4845,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;CompositionContainer;SatisfyImportsOnce;(System.ComponentModel.Composition.Primitives.ComposablePart);generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;CompositionScopeDefinition;();generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;OnChanged;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;OnChanging;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;CompositionService;Dispose;();generated",
@@ -4879,7 +4854,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;DirectoryCatalog;(System.String,System.Reflection.ReflectionContext);generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;DirectoryCatalog;(System.String,System.Reflection.ReflectionContext,System.ComponentModel.Composition.Primitives.ICompositionElement);generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;DirectoryCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;OnChanged;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;OnChanging;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;Refresh;();generated",
@@ -4902,7 +4876,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;ExportsChangeEventArgs;get_AtomicComposition;();generated",
         "System.ComponentModel.Composition.Hosting;ExportsChangeEventArgs;set_AtomicComposition;(System.ComponentModel.Composition.Hosting.AtomicComposition);generated",
         "System.ComponentModel.Composition.Hosting;FilteredCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;FilteredCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;FilteredCatalog;IncludeDependencies;();generated",
         "System.ComponentModel.Composition.Hosting;FilteredCatalog;IncludeDependents;();generated",
         "System.ComponentModel.Composition.Hosting;FilteredCatalog;OnChanged;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
@@ -4936,7 +4909,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Primitives;ComposablePartCatalog;ComposablePartCatalog;();generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartCatalog;Dispose;();generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Primitives;ComposablePartCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartDefinition;ComposablePartDefinition;();generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartDefinition;CreatePart;();generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartDefinition;get_ExportDefinitions;();generated",
@@ -6364,7 +6336,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel;TypeConverter+SimplePropertyDescriptor;get_ComponentType;();generated",
         "System.ComponentModel;TypeConverter+SimplePropertyDescriptor;get_IsReadOnly;();generated",
         "System.ComponentModel;TypeConverter+SimplePropertyDescriptor;get_PropertyType;();generated",
-        "System.ComponentModel;TypeConverter+StandardValuesCollection;GetEnumerator;();generated",
         "System.ComponentModel;TypeConverter+StandardValuesCollection;get_Count;();generated",
         "System.ComponentModel;TypeConverter+StandardValuesCollection;get_IsSynchronized;();generated",
         "System.ComponentModel;TypeConverter+StandardValuesCollection;get_SyncRoot;();generated",
@@ -7511,14 +7482,9 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data.Common;DbCommand;DbCommand;();generated",
         "System.Data.Common;DbCommand;DisposeAsync;();generated",
         "System.Data.Common;DbCommand;ExecuteDbDataReader;(System.Data.CommandBehavior);generated",
-        "System.Data.Common;DbCommand;ExecuteDbDataReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);generated",
         "System.Data.Common;DbCommand;ExecuteNonQuery;();generated",
         "System.Data.Common;DbCommand;ExecuteNonQueryAsync;();generated",
         "System.Data.Common;DbCommand;ExecuteNonQueryAsync;(System.Threading.CancellationToken);generated",
-        "System.Data.Common;DbCommand;ExecuteReaderAsync;();generated",
-        "System.Data.Common;DbCommand;ExecuteReaderAsync;(System.Data.CommandBehavior);generated",
-        "System.Data.Common;DbCommand;ExecuteReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);generated",
-        "System.Data.Common;DbCommand;ExecuteReaderAsync;(System.Threading.CancellationToken);generated",
         "System.Data.Common;DbCommand;ExecuteScalar;();generated",
         "System.Data.Common;DbCommand;ExecuteScalarAsync;();generated",
         "System.Data.Common;DbCommand;ExecuteScalarAsync;(System.Threading.CancellationToken);generated",
@@ -7602,7 +7568,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data.Common;DbConnectionStringBuilder;GetDefaultEvent;();generated",
         "System.Data.Common;DbConnectionStringBuilder;GetDefaultProperty;();generated",
         "System.Data.Common;DbConnectionStringBuilder;GetEditor;(System.Type);generated",
-        "System.Data.Common;DbConnectionStringBuilder;GetEnumerator;();generated",
         "System.Data.Common;DbConnectionStringBuilder;GetEvents;();generated",
         "System.Data.Common;DbConnectionStringBuilder;GetEvents;(System.Attribute[]);generated",
         "System.Data.Common;DbConnectionStringBuilder;GetProperties;(System.Collections.Hashtable);generated",
@@ -7670,8 +7635,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data.Common;DbDataReader;GetDecimal;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetDouble;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetFieldType;(System.Int32);generated",
-        "System.Data.Common;DbDataReader;GetFieldValueAsync<>;(System.Int32);generated",
-        "System.Data.Common;DbDataReader;GetFieldValueAsync<>;(System.Int32,System.Threading.CancellationToken);generated",
         "System.Data.Common;DbDataReader;GetFloat;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetGuid;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetInt16;(System.Int32);generated",
@@ -7681,7 +7644,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data.Common;DbDataReader;GetOrdinal;(System.String);generated",
         "System.Data.Common;DbDataReader;GetProviderSpecificFieldType;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetSchemaTable;();generated",
-        "System.Data.Common;DbDataReader;GetSchemaTableAsync;(System.Threading.CancellationToken);generated",
         "System.Data.Common;DbDataReader;GetStream;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetString;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetValue;(System.Int32);generated",
@@ -8993,9 +8955,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data;DataColumnChangeEventArgs;get_ProposedValue;();generated",
         "System.Data;DataColumnChangeEventArgs;get_Row;();generated",
         "System.Data;DataColumnChangeEventArgs;set_ProposedValue;(System.Object);generated",
-        "System.Data;DataColumnCollection;Add;();generated",
-        "System.Data;DataColumnCollection;Add;(System.String,System.Type);generated",
-        "System.Data;DataColumnCollection;Add;(System.String,System.Type,System.String);generated",
         "System.Data;DataColumnCollection;CanRemove;(System.Data.DataColumn);generated",
         "System.Data;DataColumnCollection;Clear;();generated",
         "System.Data;DataColumnCollection;Contains;(System.String);generated",
@@ -9018,7 +8977,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data;DataReaderExtensions;GetDecimal;(System.Data.Common.DbDataReader,System.String);generated",
         "System.Data;DataReaderExtensions;GetDouble;(System.Data.Common.DbDataReader,System.String);generated",
         "System.Data;DataReaderExtensions;GetFieldType;(System.Data.Common.DbDataReader,System.String);generated",
-        "System.Data;DataReaderExtensions;GetFieldValueAsync<>;(System.Data.Common.DbDataReader,System.String,System.Threading.CancellationToken);generated",
         "System.Data;DataReaderExtensions;GetFloat;(System.Data.Common.DbDataReader,System.String);generated",
         "System.Data;DataReaderExtensions;GetInt16;(System.Data.Common.DbDataReader,System.String);generated",
         "System.Data;DataReaderExtensions;GetInt32;(System.Data.Common.DbDataReader,System.String);generated",
@@ -9036,10 +8994,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data;DataRelation;get_Nested;();generated",
         "System.Data;DataRelation;get_ParentTable;();generated",
         "System.Data;DataRelation;set_Nested;(System.Boolean);generated",
-        "System.Data;DataRelationCollection;Add;(System.Data.DataColumn,System.Data.DataColumn);generated",
-        "System.Data;DataRelationCollection;Add;(System.Data.DataColumn[],System.Data.DataColumn[]);generated",
-        "System.Data;DataRelationCollection;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn);generated",
-        "System.Data;DataRelationCollection;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);generated",
         "System.Data;DataRelationCollection;AddCore;(System.Data.DataRelation);generated",
         "System.Data;DataRelationCollection;CanRemove;(System.Data.DataRelation);generated",
         "System.Data;DataRelationCollection;Clear;();generated",
@@ -9286,7 +9240,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data;DataTableClearEventArgs;get_Table;();generated",
         "System.Data;DataTableClearEventArgs;get_TableName;();generated",
         "System.Data;DataTableClearEventArgs;get_TableNamespace;();generated",
-        "System.Data;DataTableCollection;Add;();generated",
         "System.Data;DataTableCollection;CanRemove;(System.Data.DataTable);generated",
         "System.Data;DataTableCollection;Clear;();generated",
         "System.Data;DataTableCollection;Contains;(System.String);generated",
@@ -13442,19 +13395,15 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Drawing.Printing;PrinterResolution;set_X;(System.Int32);generated",
         "System.Drawing.Printing;PrinterResolution;set_Y;(System.Int32);generated",
         "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;CopyTo;(System.Drawing.Printing.PaperSize[],System.Int32);generated",
-        "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;GetEnumerator;();generated",
         "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;get_Count;();generated",
         "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;get_IsSynchronized;();generated",
         "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;CopyTo;(System.Drawing.Printing.PaperSource[],System.Int32);generated",
-        "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;GetEnumerator;();generated",
         "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;get_Count;();generated",
         "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;get_IsSynchronized;();generated",
         "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;CopyTo;(System.Drawing.Printing.PrinterResolution[],System.Int32);generated",
-        "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;GetEnumerator;();generated",
         "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;get_Count;();generated",
         "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;get_IsSynchronized;();generated",
         "System.Drawing.Printing;PrinterSettings+StringCollection;CopyTo;(System.String[],System.Int32);generated",
-        "System.Drawing.Printing;PrinterSettings+StringCollection;GetEnumerator;();generated",
         "System.Drawing.Printing;PrinterSettings+StringCollection;get_Count;();generated",
         "System.Drawing.Printing;PrinterSettings+StringCollection;get_IsSynchronized;();generated",
         "System.Drawing.Printing;PrinterSettings;Clone;();generated",
@@ -15785,12 +15734,10 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO.Compression;DeflateStream;EndWrite;(System.IAsyncResult);generated",
         "System.IO.Compression;DeflateStream;Flush;();generated",
         "System.IO.Compression;DeflateStream;Read;(System.Span<System.Byte>);generated",
-        "System.IO.Compression;DeflateStream;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO.Compression;DeflateStream;ReadByte;();generated",
         "System.IO.Compression;DeflateStream;Seek;(System.Int64,System.IO.SeekOrigin);generated",
         "System.IO.Compression;DeflateStream;SetLength;(System.Int64);generated",
         "System.IO.Compression;DeflateStream;Write;(System.ReadOnlySpan<System.Byte>);generated",
-        "System.IO.Compression;DeflateStream;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO.Compression;DeflateStream;WriteByte;(System.Byte);generated",
         "System.IO.Compression;DeflateStream;get_CanRead;();generated",
         "System.IO.Compression;DeflateStream;get_CanSeek;();generated",
@@ -15806,12 +15753,10 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO.Compression;GZipStream;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionLevel);generated",
         "System.IO.Compression;GZipStream;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionMode);generated",
         "System.IO.Compression;GZipStream;Read;(System.Span<System.Byte>);generated",
-        "System.IO.Compression;GZipStream;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO.Compression;GZipStream;ReadByte;();generated",
         "System.IO.Compression;GZipStream;Seek;(System.Int64,System.IO.SeekOrigin);generated",
         "System.IO.Compression;GZipStream;SetLength;(System.Int64);generated",
         "System.IO.Compression;GZipStream;Write;(System.ReadOnlySpan<System.Byte>);generated",
-        "System.IO.Compression;GZipStream;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO.Compression;GZipStream;WriteByte;(System.Byte);generated",
         "System.IO.Compression;GZipStream;get_CanRead;();generated",
         "System.IO.Compression;GZipStream;get_CanSeek;();generated",
@@ -16383,7 +16328,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;BinaryWriter;BinaryWriter;(System.IO.Stream,System.Text.Encoding);generated",
         "System.IO;BinaryWriter;Close;();generated", "System.IO;BinaryWriter;Dispose;();generated",
         "System.IO;BinaryWriter;Dispose;(System.Boolean);generated",
-        "System.IO;BinaryWriter;DisposeAsync;();generated",
         "System.IO;BinaryWriter;Flush;();generated",
         "System.IO;BinaryWriter;Seek;(System.Int32,System.IO.SeekOrigin);generated",
         "System.IO;BinaryWriter;Write7BitEncodedInt64;(System.Int64);generated",
@@ -16774,18 +16718,14 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;Stream;DisposeAsync;();generated",
         "System.IO;Stream;EndRead;(System.IAsyncResult);generated",
         "System.IO;Stream;EndWrite;(System.IAsyncResult);generated",
-        "System.IO;Stream;Flush;();generated", "System.IO;Stream;FlushAsync;();generated",
-        "System.IO;Stream;FlushAsync;(System.Threading.CancellationToken);generated",
-        "System.IO;Stream;ObjectInvariant;();generated",
+        "System.IO;Stream;Flush;();generated", "System.IO;Stream;ObjectInvariant;();generated",
         "System.IO;Stream;Read;(System.Span<System.Byte>);generated",
-        "System.IO;Stream;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO;Stream;ReadByte;();generated",
         "System.IO;Stream;Seek;(System.Int64,System.IO.SeekOrigin);generated",
         "System.IO;Stream;SetLength;(System.Int64);generated",
         "System.IO;Stream;ValidateBufferArguments;(System.Byte[],System.Int32,System.Int32);generated",
         "System.IO;Stream;ValidateCopyToArguments;(System.IO.Stream,System.Int32);generated",
         "System.IO;Stream;Write;(System.ReadOnlySpan<System.Byte>);generated",
-        "System.IO;Stream;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO;Stream;WriteByte;(System.Byte);generated",
         "System.IO;Stream;get_CanRead;();generated", "System.IO;Stream;get_CanSeek;();generated",
         "System.IO;Stream;get_CanTimeout;();generated",
@@ -16805,7 +16745,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;StreamWriter;Dispose;(System.Boolean);generated",
         "System.IO;StreamWriter;DisposeAsync;();generated",
         "System.IO;StreamWriter;Flush;();generated",
-        "System.IO;StreamWriter;FlushAsync;();generated",
         "System.IO;StreamWriter;StreamWriter;(System.IO.Stream);generated",
         "System.IO;StreamWriter;StreamWriter;(System.IO.Stream,System.Text.Encoding);generated",
         "System.IO;StreamWriter;StreamWriter;(System.IO.Stream,System.Text.Encoding,System.Int32);generated",
@@ -16824,15 +16763,8 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;StreamWriter;Write;(System.String,System.Object,System.Object);generated",
         "System.IO;StreamWriter;Write;(System.String,System.Object,System.Object,System.Object);generated",
         "System.IO;StreamWriter;Write;(System.String,System.Object[]);generated",
-        "System.IO;StreamWriter;WriteAsync;(System.Char);generated",
-        "System.IO;StreamWriter;WriteAsync;(System.Char[],System.Int32,System.Int32);generated",
-        "System.IO;StreamWriter;WriteAsync;(System.String);generated",
         "System.IO;StreamWriter;WriteLine;(System.ReadOnlySpan<System.Char>);generated",
         "System.IO;StreamWriter;WriteLine;(System.String);generated",
-        "System.IO;StreamWriter;WriteLineAsync;();generated",
-        "System.IO;StreamWriter;WriteLineAsync;(System.Char);generated",
-        "System.IO;StreamWriter;WriteLineAsync;(System.Char[],System.Int32,System.Int32);generated",
-        "System.IO;StreamWriter;WriteLineAsync;(System.String);generated",
         "System.IO;StreamWriter;get_AutoFlush;();generated",
         "System.IO;StreamWriter;set_AutoFlush;(System.Boolean);generated",
         "System.IO;StringReader;Close;();generated",
@@ -16845,10 +16777,8 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;StringWriter;StringWriter;(System.Text.StringBuilder);generated",
         "System.IO;StringWriter;Write;(System.Char);generated",
         "System.IO;StringWriter;Write;(System.ReadOnlySpan<System.Char>);generated",
-        "System.IO;StringWriter;Write;(System.Text.StringBuilder);generated",
         "System.IO;StringWriter;WriteAsync;(System.Char);generated",
         "System.IO;StringWriter;WriteLine;(System.ReadOnlySpan<System.Char>);generated",
-        "System.IO;StringWriter;WriteLine;(System.Text.StringBuilder);generated",
         "System.IO;StringWriter;WriteLineAsync;(System.Char);generated",
         "System.IO;StringWriter;get_Encoding;();generated",
         "System.IO;TextReader;Close;();generated", "System.IO;TextReader;Dispose;();generated",
@@ -16857,7 +16787,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;TextWriter;Close;();generated", "System.IO;TextWriter;Dispose;();generated",
         "System.IO;TextWriter;Dispose;(System.Boolean);generated",
         "System.IO;TextWriter;DisposeAsync;();generated", "System.IO;TextWriter;Flush;();generated",
-        "System.IO;TextWriter;FlushAsync;();generated",
         "System.IO;TextWriter;TextWriter;();generated",
         "System.IO;TextWriter;Write;(System.Boolean);generated",
         "System.IO;TextWriter;Write;(System.Char);generated",
@@ -16872,9 +16801,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;TextWriter;Write;(System.Text.StringBuilder);generated",
         "System.IO;TextWriter;Write;(System.UInt32);generated",
         "System.IO;TextWriter;Write;(System.UInt64);generated",
-        "System.IO;TextWriter;WriteAsync;(System.Char);generated",
-        "System.IO;TextWriter;WriteAsync;(System.Char[],System.Int32,System.Int32);generated",
-        "System.IO;TextWriter;WriteAsync;(System.String);generated",
         "System.IO;TextWriter;WriteLine;();generated",
         "System.IO;TextWriter;WriteLine;(System.Boolean);generated",
         "System.IO;TextWriter;WriteLine;(System.Char);generated",
@@ -16884,13 +16810,8 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;TextWriter;WriteLine;(System.Int64);generated",
         "System.IO;TextWriter;WriteLine;(System.ReadOnlySpan<System.Char>);generated",
         "System.IO;TextWriter;WriteLine;(System.Single);generated",
-        "System.IO;TextWriter;WriteLine;(System.Text.StringBuilder);generated",
         "System.IO;TextWriter;WriteLine;(System.UInt32);generated",
         "System.IO;TextWriter;WriteLine;(System.UInt64);generated",
-        "System.IO;TextWriter;WriteLineAsync;();generated",
-        "System.IO;TextWriter;WriteLineAsync;(System.Char);generated",
-        "System.IO;TextWriter;WriteLineAsync;(System.Char[],System.Int32,System.Int32);generated",
-        "System.IO;TextWriter;WriteLineAsync;(System.String);generated",
         "System.IO;TextWriter;get_Encoding;();generated",
         "System.IO;UnmanagedMemoryAccessor;Dispose;();generated",
         "System.IO;UnmanagedMemoryAccessor;Dispose;(System.Boolean);generated",
@@ -18094,7 +18015,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Http.Headers;HttpHeadersNonValidated+Enumerator;Reset;();generated",
         "System.Net.Http.Headers;HttpHeadersNonValidated;Contains;(System.String);generated",
         "System.Net.Http.Headers;HttpHeadersNonValidated;ContainsKey;(System.String);generated",
-        "System.Net.Http.Headers;HttpHeadersNonValidated;GetEnumerator;();generated",
         "System.Net.Http.Headers;HttpHeadersNonValidated;get_Count;();generated",
         "System.Net.Http.Headers;HttpRequestHeaders;get_Accept;();generated",
         "System.Net.Http.Headers;HttpRequestHeaders;get_AcceptCharset;();generated",
@@ -18283,7 +18203,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Http.Json;JsonContent;TryComputeLength;(System.Int64);generated",
         "System.Net.Http.Json;JsonContent;get_ObjectType;();generated",
         "System.Net.Http.Json;JsonContent;get_Value;();generated",
-        "System.Net.Http;ByteArrayContent;CreateContentReadStreamAsync;();generated",
         "System.Net.Http;ByteArrayContent;TryComputeLength;(System.Int64);generated",
         "System.Net.Http;DelegatingHandler;DelegatingHandler;();generated",
         "System.Net.Http;DelegatingHandler;Dispose;(System.Boolean);generated",
@@ -18383,7 +18302,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Http;HttpClientHandler;set_UseDefaultCredentials;(System.Boolean);generated",
         "System.Net.Http;HttpClientHandler;set_UseProxy;(System.Boolean);generated",
         "System.Net.Http;HttpContent;CreateContentReadStreamAsync;();generated",
-        "System.Net.Http;HttpContent;CreateContentReadStreamAsync;(System.Threading.CancellationToken);generated",
         "System.Net.Http;HttpContent;Dispose;();generated",
         "System.Net.Http;HttpContent;Dispose;(System.Boolean);generated",
         "System.Net.Http;HttpContent;HttpContent;();generated",
@@ -18472,7 +18390,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Http;MultipartContent;get_HeaderEncodingSelector;();generated",
         "System.Net.Http;MultipartFormDataContent;MultipartFormDataContent;();generated",
         "System.Net.Http;MultipartFormDataContent;MultipartFormDataContent;(System.String);generated",
-        "System.Net.Http;ReadOnlyMemoryContent;CreateContentReadStreamAsync;();generated",
         "System.Net.Http;ReadOnlyMemoryContent;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);generated",
         "System.Net.Http;ReadOnlyMemoryContent;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);generated",
         "System.Net.Http;ReadOnlyMemoryContent;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);generated",
@@ -19103,7 +19020,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Quic;QuicStreamAbortedException;QuicStreamAbortedException;(System.String,System.Int64);generated",
         "System.Net.Quic;QuicStreamAbortedException;get_ErrorCode;();generated",
         "System.Net.Security;AuthenticatedStream;Dispose;(System.Boolean);generated",
-        "System.Net.Security;AuthenticatedStream;DisposeAsync;();generated",
         "System.Net.Security;AuthenticatedStream;get_IsAuthenticated;();generated",
         "System.Net.Security;AuthenticatedStream;get_IsEncrypted;();generated",
         "System.Net.Security;AuthenticatedStream;get_IsMutuallyAuthenticated;();generated",
@@ -19328,7 +19244,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Sockets;SendPacketsElement;set_MemoryBuffer;(System.Nullable<System.ReadOnlyMemory<System.Byte>>);generated",
         "System.Net.Sockets;SendPacketsElement;set_OffsetLong;(System.Int64);generated",
         "System.Net.Sockets;Socket;AcceptAsync;();generated",
-        "System.Net.Sockets;Socket;AcceptAsync;(System.Net.Sockets.Socket);generated",
         "System.Net.Sockets;Socket;CancelConnectAsync;(System.Net.Sockets.SocketAsyncEventArgs);generated",
         "System.Net.Sockets;Socket;Close;();generated",
         "System.Net.Sockets;Socket;Close;(System.Int32);generated",
@@ -19343,7 +19258,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Sockets;Socket;DuplicateAndClose;(System.Int32);generated",
         "System.Net.Sockets;Socket;EndAccept;(System.Byte[],System.IAsyncResult);generated",
         "System.Net.Sockets;Socket;EndAccept;(System.Byte[],System.Int32,System.IAsyncResult);generated",
-        "System.Net.Sockets;Socket;EndAccept;(System.IAsyncResult);generated",
         "System.Net.Sockets;Socket;EndConnect;(System.IAsyncResult);generated",
         "System.Net.Sockets;Socket;EndDisconnect;(System.IAsyncResult);generated",
         "System.Net.Sockets;Socket;EndReceive;(System.IAsyncResult);generated",
@@ -19378,10 +19292,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Sockets;Socket;ReceiveAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags);generated",
         "System.Net.Sockets;Socket;ReceiveAsync;(System.Collections.Generic.IList<System.ArraySegment<System.Byte>>);generated",
         "System.Net.Sockets;Socket;ReceiveAsync;(System.Collections.Generic.IList<System.ArraySegment<System.Byte>>,System.Net.Sockets.SocketFlags);generated",
-        "System.Net.Sockets;Socket;ReceiveFromAsync;(System.ArraySegment<System.Byte>,System.Net.EndPoint);generated",
-        "System.Net.Sockets;Socket;ReceiveFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated",
-        "System.Net.Sockets;Socket;ReceiveMessageFromAsync;(System.ArraySegment<System.Byte>,System.Net.EndPoint);generated",
-        "System.Net.Sockets;Socket;ReceiveMessageFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated",
         "System.Net.Sockets;Socket;Select;(System.Collections.IList,System.Collections.IList,System.Collections.IList,System.Int32);generated",
         "System.Net.Sockets;Socket;Send;(System.Byte[]);generated",
         "System.Net.Sockets;Socket;Send;(System.Byte[],System.Int32,System.Int32,System.Net.Sockets.SocketFlags);generated",
@@ -19481,14 +19391,11 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Sockets;SocketInformation;set_Options;(System.Net.Sockets.SocketInformationOptions);generated",
         "System.Net.Sockets;SocketInformation;set_ProtocolInformation;(System.Byte[]);generated",
         "System.Net.Sockets;SocketTaskExtensions;AcceptAsync;(System.Net.Sockets.Socket);generated",
-        "System.Net.Sockets;SocketTaskExtensions;AcceptAsync;(System.Net.Sockets.Socket,System.Net.Sockets.Socket);generated",
         "System.Net.Sockets;SocketTaskExtensions;ConnectAsync;(System.Net.Sockets.Socket,System.Net.IPAddress[],System.Int32);generated",
         "System.Net.Sockets;SocketTaskExtensions;ConnectAsync;(System.Net.Sockets.Socket,System.Net.IPAddress[],System.Int32,System.Threading.CancellationToken);generated",
         "System.Net.Sockets;SocketTaskExtensions;ConnectAsync;(System.Net.Sockets.Socket,System.String,System.Int32);generated",
         "System.Net.Sockets;SocketTaskExtensions;ReceiveAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags);generated",
         "System.Net.Sockets;SocketTaskExtensions;ReceiveAsync;(System.Net.Sockets.Socket,System.Collections.Generic.IList<System.ArraySegment<System.Byte>>,System.Net.Sockets.SocketFlags);generated",
-        "System.Net.Sockets;SocketTaskExtensions;ReceiveFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated",
-        "System.Net.Sockets;SocketTaskExtensions;ReceiveMessageFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated",
         "System.Net.Sockets;SocketTaskExtensions;SendAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags);generated",
         "System.Net.Sockets;SocketTaskExtensions;SendAsync;(System.Net.Sockets.Socket,System.Collections.Generic.IList<System.ArraySegment<System.Byte>>,System.Net.Sockets.SocketFlags);generated",
         "System.Net.Sockets;TcpClient;Close;();generated",
@@ -19530,8 +19437,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Sockets;TcpListener;AcceptTcpClientAsync;(System.Threading.CancellationToken);generated",
         "System.Net.Sockets;TcpListener;AllowNatTraversal;(System.Boolean);generated",
         "System.Net.Sockets;TcpListener;Create;(System.Int32);generated",
-        "System.Net.Sockets;TcpListener;EndAcceptSocket;(System.IAsyncResult);generated",
-        "System.Net.Sockets;TcpListener;EndAcceptTcpClient;(System.IAsyncResult);generated",
         "System.Net.Sockets;TcpListener;Pending;();generated",
         "System.Net.Sockets;TcpListener;Start;();generated",
         "System.Net.Sockets;TcpListener;Start;(System.Int32);generated",
@@ -19748,10 +19653,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net;CredentialCache;Remove;(System.Uri,System.String);generated",
         "System.Net;CredentialCache;get_DefaultCredentials;();generated",
         "System.Net;CredentialCache;get_DefaultNetworkCredentials;();generated",
-        "System.Net;Dns;EndGetHostAddresses;(System.IAsyncResult);generated",
-        "System.Net;Dns;EndGetHostByName;(System.IAsyncResult);generated",
-        "System.Net;Dns;EndGetHostEntry;(System.IAsyncResult);generated",
-        "System.Net;Dns;EndResolve;(System.IAsyncResult);generated",
         "System.Net;Dns;GetHostAddresses;(System.String);generated",
         "System.Net;Dns;GetHostAddresses;(System.String,System.Net.Sockets.AddressFamily);generated",
         "System.Net;Dns;GetHostAddressesAsync;(System.String);generated",
@@ -19795,8 +19696,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net;EndpointPermission;get_Port;();generated",
         "System.Net;EndpointPermission;get_Transport;();generated",
         "System.Net;FileWebRequest;Abort;();generated",
-        "System.Net;FileWebRequest;EndGetRequestStream;(System.IAsyncResult);generated",
-        "System.Net;FileWebRequest;EndGetResponse;(System.IAsyncResult);generated",
         "System.Net;FileWebRequest;FileWebRequest;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
         "System.Net;FileWebRequest;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
         "System.Net;FileWebRequest;GetRequestStreamAsync;();generated",
@@ -19951,9 +19850,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net;HttpWebRequest;AddRange;(System.String,System.Int32,System.Int32);generated",
         "System.Net;HttpWebRequest;AddRange;(System.String,System.Int64);generated",
         "System.Net;HttpWebRequest;AddRange;(System.String,System.Int64,System.Int64);generated",
-        "System.Net;HttpWebRequest;EndGetRequestStream;(System.IAsyncResult);generated",
-        "System.Net;HttpWebRequest;EndGetRequestStream;(System.IAsyncResult,System.Net.TransportContext);generated",
-        "System.Net;HttpWebRequest;EndGetResponse;(System.IAsyncResult);generated",
         "System.Net;HttpWebRequest;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
         "System.Net;HttpWebRequest;HttpWebRequest;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
         "System.Net;HttpWebRequest;get_AllowAutoRedirect;();generated",
@@ -20102,7 +19998,7 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net;NetworkCredential;get_SecurePassword;();generated",
         "System.Net;NetworkCredential;set_SecurePassword;(System.Security.SecureString);generated",
         "System.Net;PathList;GetCookiesCount;();generated",
-        "System.Net;PathList;get_Count;();generated", "System.Net;PathList;get_Values;();generated",
+        "System.Net;PathList;get_Count;();generated",
         "System.Net;PathList;set_Item;(System.String,System.Object);generated",
         "System.Net;ProtocolViolationException;ProtocolViolationException;();generated",
         "System.Net;ProtocolViolationException;ProtocolViolationException;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
@@ -20488,6 +20384,7 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Numerics;BigInteger;Log;(System.Numerics.BigInteger,System.Double);generated",
         "System.Numerics;BigInteger;ModPow;(System.Numerics.BigInteger,System.Numerics.BigInteger,System.Numerics.BigInteger);generated",
         "System.Numerics;BigInteger;Multiply;(System.Numerics.BigInteger,System.Numerics.BigInteger);generated",
+        "System.Numerics;BigInteger;Negate;(System.Numerics.BigInteger);generated",
         "System.Numerics;BigInteger;Parse;(System.ReadOnlySpan<System.Char>,System.Globalization.NumberStyles,System.IFormatProvider);generated",
         "System.Numerics;BigInteger;Parse;(System.String);generated",
         "System.Numerics;BigInteger;Parse;(System.String,System.Globalization.NumberStyles);generated",
@@ -20553,6 +20450,7 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Numerics;BigInteger;op_Multiply;(System.Numerics.BigInteger,System.Numerics.BigInteger);generated",
         "System.Numerics;BigInteger;op_OnesComplement;(System.Numerics.BigInteger);generated",
         "System.Numerics;BigInteger;op_Subtraction;(System.Numerics.BigInteger,System.Numerics.BigInteger);generated",
+        "System.Numerics;BigInteger;op_UnaryNegation;(System.Numerics.BigInteger);generated",
         "System.Numerics;BitOperations;IsPow2;(System.Int32);generated",
         "System.Numerics;BitOperations;IsPow2;(System.Int64);generated",
         "System.Numerics;BitOperations;IsPow2;(System.IntPtr);generated",
@@ -23476,7 +23374,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Resources;ResourceSet;Dispose;(System.Boolean);generated",
         "System.Resources;ResourceSet;GetDefaultReader;();generated",
         "System.Resources;ResourceSet;GetDefaultWriter;();generated",
-        "System.Resources;ResourceSet;GetEnumerator;();generated",
         "System.Resources;ResourceSet;GetObject;(System.String);generated",
         "System.Resources;ResourceSet;GetObject;(System.String,System.Boolean);generated",
         "System.Resources;ResourceSet;GetString;(System.String);generated",
@@ -23691,6 +23588,8 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Runtime.CompilerServices;DisablePrivateReflectionAttribute;DisablePrivateReflectionAttribute;();generated",
         "System.Runtime.CompilerServices;DiscardableAttribute;DiscardableAttribute;();generated",
         "System.Runtime.CompilerServices;DynamicAttribute;DynamicAttribute;();generated",
+        "System.Runtime.CompilerServices;DynamicAttribute;DynamicAttribute;(System.Boolean[]);generated",
+        "System.Runtime.CompilerServices;DynamicAttribute;get_TransformFlags;();generated",
         "System.Runtime.CompilerServices;EnumeratorCancellationAttribute;EnumeratorCancellationAttribute;();generated",
         "System.Runtime.CompilerServices;FixedAddressValueTypeAttribute;FixedAddressValueTypeAttribute;();generated",
         "System.Runtime.CompilerServices;FixedBufferAttribute;FixedBufferAttribute;(System.Type,System.Int32);generated",
@@ -29676,7 +29575,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;Decrypt;(System.ReadOnlySpan<System.Byte>);generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;Decrypt;(System.ReadOnlySpan<System.Char>);generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;Decrypt;(System.String);generated",
-        "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;GetBags;();generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;Pkcs12SafeContents;();generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;get_ConfidentialityMode;();generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;get_IsReadOnly;();generated",
@@ -29984,7 +29882,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Security.Cryptography.X509Certificates;X509Certificate;get_Handle;();generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;MoveNext;();generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;Reset;();generated",
-        "System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;X509CertificateEnumerator;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection;Contains;(System.Security.Cryptography.X509Certificates.X509Certificate);generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection;GetHashCode;();generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection;IndexOf;(System.Security.Cryptography.X509Certificates.X509Certificate);generated",
@@ -30154,7 +30051,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Security.Cryptography.Xml;EncryptionPropertyCollection;get_IsReadOnly;();generated",
         "System.Security.Cryptography.Xml;EncryptionPropertyCollection;get_IsSynchronized;();generated",
         "System.Security.Cryptography.Xml;IRelDecryptor;Decrypt;(System.Security.Cryptography.Xml.EncryptionMethod,System.Security.Cryptography.Xml.KeyInfo,System.IO.Stream);generated",
-        "System.Security.Cryptography.Xml;KeyInfo;GetEnumerator;(System.Type);generated",
         "System.Security.Cryptography.Xml;KeyInfo;GetXml;();generated",
         "System.Security.Cryptography.Xml;KeyInfo;KeyInfo;();generated",
         "System.Security.Cryptography.Xml;KeyInfo;get_Count;();generated",
@@ -30221,7 +30117,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Security.Cryptography.Xml;Transform;Transform;();generated",
         "System.Security.Cryptography.Xml;Transform;get_InputTypes;();generated",
         "System.Security.Cryptography.Xml;Transform;get_OutputTypes;();generated",
-        "System.Security.Cryptography.Xml;TransformChain;GetEnumerator;();generated",
         "System.Security.Cryptography.Xml;TransformChain;TransformChain;();generated",
         "System.Security.Cryptography.Xml;TransformChain;get_Count;();generated",
         "System.Security.Cryptography.Xml;X509IssuerSerial;get_IssuerName;();generated",
@@ -34394,7 +34289,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Text.Json.Serialization;ReferenceResolver;GetReference;(System.Object,System.Boolean);generated",
         "System.Text.Json.Serialization;ReferenceResolver;ResolveReference;(System.String);generated",
         "System.Text.Json.SourceGeneration;JsonSourceGenerator;Execute;(Microsoft.CodeAnalysis.GeneratorExecutionContext);generated",
-        "System.Text.Json.SourceGeneration;JsonSourceGenerator;GetSerializableTypes;();generated",
         "System.Text.Json.SourceGeneration;JsonSourceGenerator;Initialize;(Microsoft.CodeAnalysis.GeneratorInitializationContext);generated",
         "System.Text.Json.SourceGeneration;JsonSourceGenerator;Initialize;(Microsoft.CodeAnalysis.IncrementalGeneratorInitializationContext);generated",
         "System.Text.Json;JsonDocument;Dispose;();generated",
@@ -35424,7 +35318,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Threading.RateLimiting;MetadataName<>;op_Inequality;(System.Threading.RateLimiting.MetadataName<>,System.Threading.RateLimiting.MetadataName<>);generated",
         "System.Threading.RateLimiting;RateLimitLease;Dispose;();generated",
         "System.Threading.RateLimiting;RateLimitLease;Dispose;(System.Boolean);generated",
-        "System.Threading.RateLimiting;RateLimitLease;GetAllMetadata;();generated",
         "System.Threading.RateLimiting;RateLimitLease;TryGetMetadata;(System.String,System.Object);generated",
         "System.Threading.RateLimiting;RateLimitLease;get_IsAcquired;();generated",
         "System.Threading.RateLimiting;RateLimitLease;get_MetadataNames;();generated",
@@ -35507,10 +35400,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Threading.Tasks.Dataflow;DataflowBlock;OutputAvailableAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>);generated",
         "System.Threading.Tasks.Dataflow;DataflowBlock;OutputAvailableAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);generated",
         "System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAllAsync<>;(System.Threading.Tasks.Dataflow.IReceivableSourceBlock<TOutput>,System.Threading.CancellationToken);generated",
-        "System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>);generated",
-        "System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);generated",
-        "System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);generated",
-        "System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);generated",
         "System.Threading.Tasks.Dataflow;DataflowBlock;SendAsync<>;(System.Threading.Tasks.Dataflow.ITargetBlock<TInput>,TInput);generated",
         "System.Threading.Tasks.Dataflow;DataflowBlockOptions;DataflowBlockOptions;();generated",
         "System.Threading.Tasks.Dataflow;DataflowBlockOptions;get_BoundedCapacity;();generated",
@@ -36723,13 +36612,10 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Xml.Schema;XmlSchemaParticle;set_MinOccursString;(System.String);generated",
         "System.Xml.Schema;XmlSchemaPatternFacet;XmlSchemaPatternFacet;();generated",
         "System.Xml.Schema;XmlSchemaRedefine;XmlSchemaRedefine;();generated",
-        "System.Xml.Schema;XmlSchemaSet;Add;(System.Xml.Schema.XmlSchemaSet);generated",
         "System.Xml.Schema;XmlSchemaSet;Compile;();generated",
         "System.Xml.Schema;XmlSchemaSet;Contains;(System.String);generated",
         "System.Xml.Schema;XmlSchemaSet;Contains;(System.Xml.Schema.XmlSchema);generated",
-        "System.Xml.Schema;XmlSchemaSet;CopyTo;(System.Xml.Schema.XmlSchema[],System.Int32);generated",
         "System.Xml.Schema;XmlSchemaSet;RemoveRecursive;(System.Xml.Schema.XmlSchema);generated",
-        "System.Xml.Schema;XmlSchemaSet;Schemas;();generated",
         "System.Xml.Schema;XmlSchemaSet;Schemas;(System.String);generated",
         "System.Xml.Schema;XmlSchemaSet;XmlSchemaSet;();generated",
         "System.Xml.Schema;XmlSchemaSet;get_Count;();generated",
@@ -36982,7 +36868,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Xml.Serialization;XmlSerializationWriter;WriteEmptyTag;(System.String,System.String);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteEndElement;();generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteEndElement;(System.Object);generated",
-        "System.Xml.Serialization;XmlSerializationWriter;WriteId;(System.Object);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteNamespaceDeclarations;(System.Xml.Serialization.XmlSerializerNamespaces);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteNullTagEncoded;(System.String);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteNullTagEncoded;(System.String,System.String);generated",
@@ -36991,8 +36876,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Xml.Serialization;XmlSerializationWriter;WriteNullableQualifiedNameEncoded;(System.String,System.String,System.Xml.XmlQualifiedName,System.Xml.XmlQualifiedName);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteNullableQualifiedNameLiteral;(System.String,System.String,System.Xml.XmlQualifiedName);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteReferencedElements;();generated",
-        "System.Xml.Serialization;XmlSerializationWriter;WriteReferencingElement;(System.String,System.String,System.Object);generated",
-        "System.Xml.Serialization;XmlSerializationWriter;WriteReferencingElement;(System.String,System.String,System.Object,System.Boolean);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteStartDocument;();generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteStartElement;(System.String);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteStartElement;(System.String,System.String);generated",
@@ -41163,29 +41046,7 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System;Tuple<>;Equals;(System.Object,System.Collections.IEqualityComparer);generated",
         "System;Tuple<>;GetHashCode;();generated",
         "System;Tuple<>;GetHashCode;(System.Collections.IEqualityComparer);generated",
-        "System;Tuple<>;get_Length;();generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20,T21>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6>);generated",
-        "System;TupleExtensions;ToTuple<,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5>);generated",
-        "System;TupleExtensions;ToTuple<,,,>;(System.ValueTuple<T1,T2,T3,T4>);generated",
-        "System;TupleExtensions;ToTuple<,,>;(System.ValueTuple<T1,T2,T3>);generated",
-        "System;TupleExtensions;ToTuple<,>;(System.ValueTuple<T1,T2>);generated",
-        "System;TupleExtensions;ToTuple<>;(System.ValueTuple<T1>);generated",
-        "System;Type;Equals;(System.Object);generated",
+        "System;Tuple<>;get_Length;();generated", "System;Type;Equals;(System.Object);generated",
         "System;Type;Equals;(System.Type);generated", "System;Type;GetArrayRank;();generated",
         "System;Type;GetAttributeFlagsImpl;();generated",
         "System;Type;GetConstructorImpl;(System.Reflection.BindingFlags,System.Reflection.Binder,System.Reflection.CallingConventions,System.Type[],System.Reflection.ParameterModifier[]);generated",
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/Runtime.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/Runtime.qll
index b94322f77a7..65fa78671d7 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/Runtime.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/Runtime.qll
@@ -13,7 +13,29 @@ private class RuntimeSinksCsv extends SinkModelCsv {
         "System.Data.Odbc;OdbcDataAdapter;false;OdbcDataAdapter;(System.String,System.Data.Odbc.OdbcConnection);;Argument[0];sql;generated",
         "System.Data.Odbc;OdbcDataAdapter;false;OdbcDataAdapter;(System.String,System.String);;Argument[0];sql;generated",
         "System.Net.Http;StringContent;false;StringContent;(System.String);;Argument[0];xss;generated",
-        "System.Net.Http;StringContent;false;StringContent;(System.String,System.Text.Encoding);;Argument[0];xss;generated"
+        "System.Net.Http;StringContent;false;StringContent;(System.String,System.Text.Encoding);;Argument[0];xss;generated",
+        "System.Security.Cryptography;AesCryptoServiceProvider;false;CreateDecryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-decryptor;generated",
+        "System.Security.Cryptography;AesCryptoServiceProvider;false;CreateEncryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-encryptor;generated",
+        "System.Security.Cryptography;AesCryptoServiceProvider;false;set_Key;(System.Byte[]);;Argument[0];encryption-keyprop;generated",
+        "System.Security.Cryptography;AesManaged;false;CreateDecryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-decryptor;generated",
+        "System.Security.Cryptography;AesManaged;false;CreateEncryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-encryptor;generated",
+        "System.Security.Cryptography;AesManaged;false;set_Key;(System.Byte[]);;Argument[0];encryption-keyprop;generated",
+        "System.Security.Cryptography;DES;false;set_Key;(System.Byte[]);;Argument[0];encryption-keyprop;generated",
+        "System.Security.Cryptography;DESCryptoServiceProvider;false;CreateDecryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-decryptor;generated",
+        "System.Security.Cryptography;DESCryptoServiceProvider;false;CreateEncryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-encryptor;generated",
+        "System.Security.Cryptography;DESCryptoServiceProvider;false;set_Key;(System.Byte[]);;Argument[0];encryption-keyprop;generated",
+        "System.Security.Cryptography;RC2CryptoServiceProvider;false;CreateDecryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-decryptor;generated",
+        "System.Security.Cryptography;RC2CryptoServiceProvider;false;CreateEncryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-encryptor;generated",
+        "System.Security.Cryptography;RC2CryptoServiceProvider;false;set_Key;(System.Byte[]);;Argument[0];encryption-keyprop;generated",
+        "System.Security.Cryptography;RijndaelManaged;false;CreateDecryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-decryptor;generated",
+        "System.Security.Cryptography;RijndaelManaged;false;CreateEncryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-encryptor;generated",
+        "System.Security.Cryptography;RijndaelManaged;false;set_Key;(System.Byte[]);;Argument[0];encryption-keyprop;generated",
+        "System.Security.Cryptography;SymmetricAlgorithm;true;CreateDecryptor;();;Argument[this];encryption-decryptor;generated",
+        "System.Security.Cryptography;SymmetricAlgorithm;true;CreateEncryptor;();;Argument[this];encryption-encryptor;generated",
+        "System.Security.Cryptography;TripleDES;false;set_Key;(System.Byte[]);;Argument[0];encryption-keyprop;generated",
+        "System.Security.Cryptography;TripleDESCryptoServiceProvider;false;CreateDecryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-decryptor;generated",
+        "System.Security.Cryptography;TripleDESCryptoServiceProvider;false;CreateEncryptor;(System.Byte[],System.Byte[]);;Argument[0];encryption-encryptor;generated",
+        "System.Security.Cryptography;TripleDESCryptoServiceProvider;false;set_Key;(System.Byte[]);;Argument[0];encryption-keyprop;generated"
       ]
   }
 }
@@ -275,6 +297,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "Microsoft.Extensions.FileProviders.Composite;CompositeDirectoryContents;false;CompositeDirectoryContents;(System.Collections.Generic.IList<Microsoft.Extensions.FileProviders.IFileProvider>,System.String);;Argument[1];Argument[this];taint;generated",
         "Microsoft.Extensions.FileProviders.Internal;PhysicalDirectoryContents;false;PhysicalDirectoryContents;(System.String,Microsoft.Extensions.FileProviders.Physical.ExclusionFilters);;Argument[0];Argument[this];taint;generated",
         "Microsoft.Extensions.FileProviders.Physical;PhysicalDirectoryInfo;false;PhysicalDirectoryInfo;(System.IO.DirectoryInfo);;Argument[0];Argument[this];taint;generated",
+        "Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;CreateReadStream;();;Argument[this];ReturnValue;taint;generated",
         "Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;PhysicalFileInfo;(System.IO.FileInfo);;Argument[0];Argument[this];taint;generated",
         "Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;get_PhysicalPath;();;Argument[this];ReturnValue;taint;generated",
         "Microsoft.Extensions.FileProviders.Physical;PhysicalFilesWatcher;false;PhysicalFilesWatcher;(System.String,System.IO.FileSystemWatcher,System.Boolean,Microsoft.Extensions.FileProviders.Physical.ExclusionFilters);;Argument[0];Argument[this];taint;generated",
@@ -541,8 +564,11 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.CodeDom.Compiler;GeneratedCodeAttribute;false;GeneratedCodeAttribute;(System.String,System.String);;Argument[1];Argument[this];taint;generated",
         "System.CodeDom.Compiler;GeneratedCodeAttribute;false;get_Tool;();;Argument[this];ReturnValue;taint;generated",
         "System.CodeDom.Compiler;GeneratedCodeAttribute;false;get_Version;();;Argument[this];ReturnValue;taint;generated",
+        "System.CodeDom.Compiler;IndentedTextWriter;false;FlushAsync;();;Argument[this];ReturnValue;taint;generated",
         "System.CodeDom.Compiler;IndentedTextWriter;false;IndentedTextWriter;(System.IO.TextWriter,System.String);;Argument[0];Argument[this];taint;generated",
         "System.CodeDom.Compiler;IndentedTextWriter;false;IndentedTextWriter;(System.IO.TextWriter,System.String);;Argument[1];Argument[this];taint;generated",
+        "System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineNoTabsAsync;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineNoTabsAsync;(System.String);;Argument[this];ReturnValue;taint;generated",
         "System.CodeDom.Compiler;IndentedTextWriter;false;get_Encoding;();;Argument[this];ReturnValue;taint;generated",
         "System.CodeDom.Compiler;IndentedTextWriter;false;get_InnerWriter;();;Argument[this];ReturnValue;taint;generated",
         "System.CodeDom.Compiler;IndentedTextWriter;false;get_NewLine;();;Argument[this];ReturnValue;taint;generated",
@@ -755,6 +781,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.CodeDom;CodeNamespaceImport;false;set_Namespace;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.CodeDom;CodeNamespaceImportCollection;false;Add;(System.CodeDom.CodeNamespaceImport);;Argument[0];Argument[this];taint;generated",
         "System.CodeDom;CodeNamespaceImportCollection;false;AddRange;(System.CodeDom.CodeNamespaceImport[]);;Argument[0].Element;Argument[this];taint;generated",
+        "System.CodeDom;CodeNamespaceImportCollection;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.CodeDom;CodeNamespaceImportCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.CodeDom;CodeNamespaceImportCollection;false;set_Item;(System.Int32,System.CodeDom.CodeNamespaceImport);;Argument[1];Argument[this];taint;generated",
         "System.CodeDom;CodeObject;false;get_UserData;();;Argument[this];ReturnValue;taint;generated",
@@ -927,6 +954,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Concurrent;ConcurrentBag<>;false;TryAdd;(T);;Argument[0];Argument[this];taint;generated",
         "System.Collections.Concurrent;ConcurrentBag<>;false;TryPeek;(T);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Concurrent;ConcurrentBag<>;false;TryTake;(T);;Argument[this];ReturnValue;taint;generated",
+        "System.Collections.Concurrent;ConcurrentDictionary<,>;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;false;GetOrAdd;(TKey,TValue);;Argument[1];ReturnValue;taint;generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Concurrent;ConcurrentStack<>;false;ConcurrentStack;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated",
@@ -940,6 +968,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Concurrent;Partitioner;false;Create<>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Concurrent.EnumerablePartitionerOptions);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Concurrent;Partitioner;false;Create<>;(System.Collections.Generic.IList<TSource>,System.Boolean);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Concurrent;Partitioner;false;Create<>;(TSource[],System.Boolean);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.Collections.Generic;CollectionExtensions;false;AsReadOnly<,>;(System.Collections.Generic.IDictionary<TKey,TValue>);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Generic;CollectionExtensions;false;AsReadOnly<>;(System.Collections.Generic.IList<T>);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Generic;CollectionExtensions;false;GetDefaultAssets;(System.Collections.Generic.IEnumerable<Microsoft.Extensions.DependencyModel.RuntimeAssetGroup>);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Generic;CollectionExtensions;false;GetDefaultGroup;(System.Collections.Generic.IEnumerable<Microsoft.Extensions.DependencyModel.RuntimeAssetGroup>);;Argument[0].Element;ReturnValue;taint;generated",
@@ -951,6 +980,9 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Generic;CollectionExtensions;false;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey,TValue);;Argument[1];ReturnValue;taint;generated",
         "System.Collections.Generic;CollectionExtensions;false;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated",
         "System.Collections.Generic;CollectionExtensions;false;Remove<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[0].Element;Argument[2];taint;generated",
+        "System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[1];Argument[0].Element;taint;generated",
+        "System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[2];Argument[0].Element;taint;generated",
         "System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Entry;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Key;();;Argument[this];ReturnValue;taint;generated",
@@ -970,6 +1002,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Generic;HashSet<>;false;HashSet;(System.Collections.Generic.IEqualityComparer<T>);;Argument[0];Argument[this];taint;generated",
         "System.Collections.Generic;HashSet<>;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Generic;HashSet<>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated",
+        "System.Collections.Generic;KeyValuePair;false;Create<,>;(TKey,TValue);;Argument[0];ReturnValue;taint;generated",
+        "System.Collections.Generic;KeyValuePair;false;Create<,>;(TKey,TValue);;Argument[1];ReturnValue;taint;generated",
         "System.Collections.Generic;KeyValuePair<,>;false;Deconstruct;(TKey,TValue);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Generic;KeyValuePair<,>;false;get_Key;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Generic;KeyValuePair<,>;false;get_Value;();;Argument[this];ReturnValue;taint;generated",
@@ -1121,6 +1155,12 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[1];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1].Element;ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[2].Element;ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableDictionary;false;GetValueOrDefault<,>;(System.Collections.Immutable.IImmutableDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableDictionary;false;ToImmutableDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableDictionary;false;ToImmutableDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0].Element;ReturnValue;taint;generated",
@@ -1137,6 +1177,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Immutable;ImmutableDictionary<,>+Builder;false;get_ValueComparer;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableDictionary<,>+Builder;false;set_KeyComparer;(System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0];Argument[this];taint;generated",
         "System.Collections.Immutable;ImmutableDictionary<,>+Builder;false;set_ValueComparer;(System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];Argument[this];taint;generated",
+        "System.Collections.Immutable;ImmutableDictionary<,>;false;Clear;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableDictionary<,>;false;Remove;(TKey);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableDictionary<,>;false;RemoveRange;(System.Collections.Generic.IEnumerable<TKey>);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableDictionary<,>;false;SetItem;(TKey,TValue);;Argument[this];ReturnValue;taint;generated",
@@ -1158,6 +1199,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Immutable;ImmutableHashSet<>+Builder;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableHashSet<>+Builder;false;get_KeyComparer;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableHashSet<>+Builder;false;set_KeyComparer;(System.Collections.Generic.IEqualityComparer<T>);;Argument[0];Argument[this];taint;generated",
+        "System.Collections.Immutable;ImmutableHashSet<>;false;Clear;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableHashSet<>;false;Except;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableHashSet<>;false;Intersect;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableHashSet<>;false;Remove;(T);;Argument[this];ReturnValue;taint;generated",
@@ -1170,6 +1212,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Immutable;ImmutableHashSet<>;false;get_KeyComparer;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableHashSet<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
         "System.Collections.Immutable;ImmutableInterlocked;false;GetOrAdd<,>;(System.Collections.Immutable.ImmutableDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableList;false;Create<>;(T);;Argument[0];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableList;false;CreateRange<>;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableList;false;Remove<>;(System.Collections.Immutable.IImmutableList<T>,T);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableList;false;RemoveRange<>;(System.Collections.Immutable.IImmutableList<T>,System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableList;false;Replace<>;(System.Collections.Immutable.IImmutableList<T>,T,T);;Argument[0].Element;ReturnValue;taint;generated",
@@ -1228,6 +1272,12 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>);;Argument[0];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[1];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1].Element;ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[2].Element;ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IComparer<TKey>);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IComparer<TKey>);;Argument[1];ReturnValue;taint;generated",
@@ -1244,6 +1294,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;get_ValueComparer;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;set_KeyComparer;(System.Collections.Generic.IComparer<TKey>);;Argument[0];Argument[this];taint;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;set_ValueComparer;(System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];Argument[this];taint;generated",
+        "System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Clear;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Remove;(TKey);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;false;RemoveRange;(System.Collections.Generic.IEnumerable<TKey>);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;false;SetItem;(TKey,TValue);;Argument[0];ReturnValue;taint;generated",
@@ -1261,7 +1313,10 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;false;get_ValueComparer;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>);;Argument[0];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T);;Argument[0];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T);;Argument[1];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T[]);;Argument[0];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(T);;Argument[0];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet;false;CreateBuilder<>;(System.Collections.Generic.IComparer<T>);;Argument[0];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet;false;CreateRange<>;(System.Collections.Generic.IComparer<T>,System.Collections.Generic.IEnumerable<T>);;Argument[0];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet;false;CreateRange<>;(System.Collections.Generic.IComparer<T>,System.Collections.Generic.IEnumerable<T>);;Argument[1].Element;ReturnValue;taint;generated",
@@ -1271,6 +1326,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedSet;false;ToImmutableSortedSet<>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IComparer<TSource>);;Argument[1];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet;false;ToImmutableSortedSet<>;(System.Collections.Immutable.ImmutableSortedSet<TSource>+Builder);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;IntersectWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated",
+        "System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;ToImmutable;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated",
@@ -1281,8 +1337,13 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;set_KeyComparer;(System.Collections.Generic.IComparer<T>);;Argument[0];Argument[this];taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedSet<>;false;Clear;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;false;Except;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedSet<>;false;Intersect;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;false;Remove;(T);;Argument[this];ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated",
+        "System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;false;ToBuilder;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated",
@@ -1306,17 +1367,23 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections.Immutable;ImmutableStack<>;false;Push;(T);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.ObjectModel;Collection<>;false;Collection;(System.Collections.Generic.IList<T>);;Argument[0].Element;Argument[this];taint;generated",
         "System.Collections.ObjectModel;Collection<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated",
+        "System.Collections.ObjectModel;Collection<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated",
         "System.Collections.ObjectModel;Collection<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated",
+        "System.Collections.ObjectModel;Collection<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated",
         "System.Collections.ObjectModel;Collection<>;false;get_Items;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.ObjectModel;Collection<>;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.ObjectModel;KeyedCollection<,>;false;InsertItem;(System.Int32,TItem);;Argument[1];Argument[this];taint;generated",
+        "System.Collections.ObjectModel;KeyedCollection<,>;false;InsertItem;(System.Int32,TItem);;Argument[this];Argument[1];taint;generated",
         "System.Collections.ObjectModel;KeyedCollection<,>;false;KeyedCollection;(System.Collections.Generic.IEqualityComparer<TKey>,System.Int32);;Argument[0];Argument[this];taint;generated",
         "System.Collections.ObjectModel;KeyedCollection<,>;false;SetItem;(System.Int32,TItem);;Argument[1];Argument[this];taint;generated",
+        "System.Collections.ObjectModel;KeyedCollection<,>;false;SetItem;(System.Int32,TItem);;Argument[this];Argument[1];taint;generated",
         "System.Collections.ObjectModel;KeyedCollection<,>;false;TryGetValue;(TKey,TItem);;Argument[this];ReturnValue;taint;generated",
         "System.Collections.ObjectModel;KeyedCollection<,>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.ObjectModel;KeyedCollection<,>;false;get_Dictionary;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.ObjectModel;ObservableCollection<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated",
+        "System.Collections.ObjectModel;ObservableCollection<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated",
         "System.Collections.ObjectModel;ObservableCollection<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated",
+        "System.Collections.ObjectModel;ObservableCollection<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated",
         "System.Collections.ObjectModel;ReadOnlyCollection<>;false;ReadOnlyCollection;(System.Collections.Generic.IList<T>);;Argument[0].Element;Argument[this];taint;generated",
         "System.Collections.ObjectModel;ReadOnlyCollection<>;false;get_Items;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections.ObjectModel;ReadOnlyCollection<>;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated",
@@ -1395,6 +1462,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections;BitArray;false;Xor;(System.Collections.BitArray);;Argument[this];ReturnValue;value;generated",
         "System.Collections;BitArray;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
         "System.Collections;CollectionBase;false;Remove;(System.Object);;Argument[0];Argument[this];taint;generated",
+        "System.Collections;CollectionBase;false;Remove;(System.Object);;Argument[this];Argument[0];taint;generated",
         "System.Collections;CollectionBase;false;get_InnerList;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections;CollectionBase;false;get_List;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections;CollectionBase;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated",
@@ -1444,6 +1512,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Collections;Stack;false;Synchronized;(System.Collections.Stack);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Collections;Stack;false;ToArray;();;Argument[this];ReturnValue;taint;generated",
         "System.Collections;Stack;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
+        "System.ComponentModel.Composition.Hosting;AggregateCatalog;false;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;false;get_Catalogs;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;AggregateExportProvider;false;AggregateExportProvider;(System.ComponentModel.Composition.Hosting.ExportProvider[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;AggregateExportProvider;false;GetExportsCore;(System.ComponentModel.Composition.Primitives.ImportDefinition,System.ComponentModel.Composition.Hosting.AtomicComposition);;Argument[this];ReturnValue;taint;generated",
@@ -1452,6 +1521,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;false;ApplicationCatalog;(System.Reflection.ReflectionContext);;Argument[0];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;false;ApplicationCatalog;(System.Reflection.ReflectionContext,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[0];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;false;ApplicationCatalog;(System.Reflection.ReflectionContext,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[1];Argument[this];taint;generated",
+        "System.ComponentModel.Composition.Hosting;ApplicationCatalog;false;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;false;AssemblyCatalog;(System.Reflection.Assembly);;Argument[0];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;false;AssemblyCatalog;(System.Reflection.Assembly,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[0];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;false;AssemblyCatalog;(System.Reflection.Assembly,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[1];Argument[this];taint;generated",
@@ -1464,6 +1534,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;false;AssemblyCatalog;(System.String,System.Reflection.ReflectionContext);;Argument[1];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;false;AssemblyCatalog;(System.String,System.Reflection.ReflectionContext,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[1];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;false;AssemblyCatalog;(System.String,System.Reflection.ReflectionContext,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[2];Argument[this];taint;generated",
+        "System.ComponentModel.Composition.Hosting;AssemblyCatalog;false;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;false;ToString;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;false;get_Assembly;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;false;get_DisplayName;();;Argument[this];ReturnValue;taint;generated",
@@ -1500,6 +1571,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;false;CompositionScopeDefinition;(System.ComponentModel.Composition.Primitives.ComposablePartCatalog,System.Collections.Generic.IEnumerable<System.ComponentModel.Composition.Hosting.CompositionScopeDefinition>,System.Collections.Generic.IEnumerable<System.ComponentModel.Composition.Primitives.ExportDefinition>);;Argument[0].Element;Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;false;CompositionScopeDefinition;(System.ComponentModel.Composition.Primitives.ComposablePartCatalog,System.Collections.Generic.IEnumerable<System.ComponentModel.Composition.Hosting.CompositionScopeDefinition>,System.Collections.Generic.IEnumerable<System.ComponentModel.Composition.Primitives.ExportDefinition>);;Argument[1].Element;Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;false;CompositionScopeDefinition;(System.ComponentModel.Composition.Primitives.ComposablePartCatalog,System.Collections.Generic.IEnumerable<System.ComponentModel.Composition.Hosting.CompositionScopeDefinition>,System.Collections.Generic.IEnumerable<System.ComponentModel.Composition.Primitives.ExportDefinition>);;Argument[2].Element;Argument[this];taint;generated",
+        "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;false;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;false;get_Children;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;false;get_PublicSurface;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;false;DirectoryCatalog;(System.String,System.String);;Argument[0];Argument[this];taint;generated",
@@ -1514,6 +1586,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;false;DirectoryCatalog;(System.String,System.String,System.Reflection.ReflectionContext,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[1];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;false;DirectoryCatalog;(System.String,System.String,System.Reflection.ReflectionContext,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[2];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;false;DirectoryCatalog;(System.String,System.String,System.Reflection.ReflectionContext,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[3];Argument[this];taint;generated",
+        "System.ComponentModel.Composition.Hosting;DirectoryCatalog;false;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;false;ToString;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;false;get_DisplayName;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;false;get_FullPath;();;Argument[this];ReturnValue;taint;generated",
@@ -1532,12 +1605,14 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;ExportsChangeEventArgs;false;get_AddedExports;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;ExportsChangeEventArgs;false;get_ChangedContractNames;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;ExportsChangeEventArgs;false;get_RemovedExports;();;Argument[this];ReturnValue;taint;generated",
+        "System.ComponentModel.Composition.Hosting;FilteredCatalog;false;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;FilteredCatalog;false;get_Complement;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Hosting;ImportEngine;false;ImportEngine;(System.ComponentModel.Composition.Hosting.ExportProvider,System.ComponentModel.Composition.Hosting.CompositionOptions);;Argument[0];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;TypeCatalog;false;TypeCatalog;(System.Collections.Generic.IEnumerable<System.Type>);;Argument[0].Element;Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;TypeCatalog;false;TypeCatalog;(System.Collections.Generic.IEnumerable<System.Type>,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[0].Element;Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;TypeCatalog;false;TypeCatalog;(System.Collections.Generic.IEnumerable<System.Type>,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[1];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Hosting;TypeCatalog;false;TypeCatalog;(System.Collections.Generic.IEnumerable<System.Type>,System.Reflection.ReflectionContext,System.ComponentModel.Composition.Primitives.ICompositionElement);;Argument[2];Argument[this];taint;generated",
+        "System.ComponentModel.Composition.Primitives;ComposablePartCatalog;true;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartCatalog;true;get_Parts;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartException;false;ComposablePartException;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[0];Argument[this];taint;generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartException;false;ComposablePartException;(System.String,System.ComponentModel.Composition.Primitives.ICompositionElement,System.Exception);;Argument[1];Argument[this];taint;generated",
@@ -1738,7 +1813,9 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.ComponentModel;BaseNumberConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[1];ReturnValue;taint;generated",
         "System.ComponentModel;BaseNumberConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated",
         "System.ComponentModel;BindingList<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated",
+        "System.ComponentModel;BindingList<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated",
         "System.ComponentModel;BindingList<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated",
+        "System.ComponentModel;BindingList<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated",
         "System.ComponentModel;CategoryAttribute;false;CategoryAttribute;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.ComponentModel;CategoryAttribute;false;get_Category;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel;CharConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated",
@@ -1872,6 +1949,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.ComponentModel;ToolboxItemAttribute;false;get_ToolboxItemTypeName;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel;ToolboxItemFilterAttribute;false;get_TypeId;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel;TypeConverter+StandardValuesCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this];Argument[0].Element;taint;generated",
+        "System.ComponentModel;TypeConverter+StandardValuesCollection;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel;TypeConverter+StandardValuesCollection;false;StandardValuesCollection;(System.Collections.ICollection);;Argument[0].Element;Argument[this];taint;generated",
         "System.ComponentModel;TypeConverter+StandardValuesCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.ComponentModel;TypeConverter;false;ConvertFrom;(System.Object);;Argument[0];ReturnValue;taint;generated",
@@ -2017,6 +2095,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Configuration.Internal;DelegatingConfigHost;false;GetStreamNameForConfigSource;(System.String,System.String);;Argument[0];ReturnValue;taint;generated",
         "System.Configuration.Internal;DelegatingConfigHost;false;GetStreamNameForConfigSource;(System.String,System.String);;Argument[1];ReturnValue;taint;generated",
         "System.Configuration.Internal;DelegatingConfigHost;false;InitForConfiguration;(System.String,System.String,System.String,System.Configuration.Internal.IInternalConfigRoot,System.Object[]);;Argument[4].Element;ReturnValue;taint;generated",
+        "System.Configuration.Internal;DelegatingConfigHost;false;OpenStreamForRead;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.Configuration.Internal;DelegatingConfigHost;false;OpenStreamForRead;(System.String,System.Boolean);;Argument[0];ReturnValue;taint;generated",
         "System.Configuration.Internal;DelegatingConfigHost;false;OpenStreamForWrite;(System.String,System.String,System.Object);;Argument[1];ReturnValue;taint;generated",
         "System.Configuration.Internal;DelegatingConfigHost;false;OpenStreamForWrite;(System.String,System.String,System.Object);;Argument[2];ReturnValue;taint;generated",
         "System.Configuration.Internal;DelegatingConfigHost;false;OpenStreamForWrite;(System.String,System.String,System.Object,System.Boolean);;Argument[1];ReturnValue;taint;generated",
@@ -2334,6 +2414,10 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Data.Common;DataTableMappingCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
         "System.Data.Common;DbCommand;false;ExecuteReader;();;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbCommand;false;ExecuteReader;(System.Data.CommandBehavior);;Argument[this];ReturnValue;taint;generated",
+        "System.Data.Common;DbCommand;false;ExecuteReaderAsync;();;Argument[this];ReturnValue;taint;generated",
+        "System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Data.CommandBehavior);;Argument[this];ReturnValue;taint;generated",
+        "System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbCommand;false;get_Connection;();;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbCommand;false;get_Parameters;();;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbCommand;false;get_Transaction;();;Argument[this];ReturnValue;taint;generated",
@@ -2341,6 +2425,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Data.Common;DbCommand;false;set_Connection;(System.Data.IDbConnection);;Argument[0];Argument[this];taint;generated",
         "System.Data.Common;DbCommand;false;set_Transaction;(System.Data.Common.DbTransaction);;Argument[0];Argument[this];taint;generated",
         "System.Data.Common;DbCommand;false;set_Transaction;(System.Data.IDbTransaction);;Argument[0];Argument[this];taint;generated",
+        "System.Data.Common;DbCommand;true;ExecuteDbDataReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbCommand;true;PrepareAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Data.Common;DbCommandBuilder;false;GetDeleteCommand;();;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbCommandBuilder;false;GetDeleteCommand;(System.Boolean);;Argument[this];ReturnValue;taint;generated",
@@ -2367,6 +2452,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String);;Argument[2];Argument[0];taint;generated",
         "System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String,System.Boolean);;Argument[1];Argument[0];taint;generated",
         "System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String,System.Boolean);;Argument[2];Argument[0];taint;generated",
+        "System.Data.Common;DbConnectionStringBuilder;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbConnectionStringBuilder;false;GetProperties;();;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbConnectionStringBuilder;false;GetProperties;(System.Attribute[]);;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbConnectionStringBuilder;false;GetPropertyOwner;(System.ComponentModel.PropertyDescriptor);;Argument[this];ReturnValue;value;generated",
@@ -2393,9 +2479,12 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[0];ReturnValue;taint;generated",
         "System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[1];ReturnValue;taint;generated",
         "System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[3];ReturnValue;taint;generated",
+        "System.Data.Common;DbDataReader;false;GetFieldValueAsync<>;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbDataReader;true;GetFieldValue<>;(System.Int32);;Argument[this];ReturnValue;taint;generated",
+        "System.Data.Common;DbDataReader;true;GetFieldValueAsync<>;(System.Int32,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbDataReader;true;GetProviderSpecificValue;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbDataReader;true;GetProviderSpecificValues;(System.Object[]);;Argument[this];Argument[0].Element;taint;generated",
+        "System.Data.Common;DbDataReader;true;GetSchemaTableAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbDataReader;true;GetTextReader;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Data.Common;DbDataRecord;false;GetPropertyOwner;(System.ComponentModel.PropertyDescriptor);;Argument[this];ReturnValue;value;generated",
         "System.Data.Common;DbEnumerator;false;DbEnumerator;(System.Data.IDataReader);;Argument[0];Argument[this];taint;generated",
@@ -2540,6 +2629,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Data.Odbc;OdbcParameter;false;set_Value;(System.Object);;Argument[0];Argument[this];taint;generated",
         "System.Data.Odbc;OdbcParameterCollection;false;Add;(System.Data.Odbc.OdbcParameter);;Argument[0];Argument[this];taint;generated",
         "System.Data.Odbc;OdbcParameterCollection;false;Add;(System.Data.Odbc.OdbcParameter);;Argument[0];ReturnValue;taint;generated",
+        "System.Data.Odbc;OdbcParameterCollection;false;Add;(System.Data.Odbc.OdbcParameter);;Argument[this];Argument[0];taint;generated",
         "System.Data.Odbc;OdbcParameterCollection;false;Add;(System.String,System.Data.Odbc.OdbcType);;Argument[0];Argument[this];taint;generated",
         "System.Data.Odbc;OdbcParameterCollection;false;Add;(System.String,System.Data.Odbc.OdbcType);;Argument[0];ReturnValue;taint;generated",
         "System.Data.Odbc;OdbcParameterCollection;false;Add;(System.String,System.Data.Odbc.OdbcType,System.Int32);;Argument[0];Argument[this];taint;generated",
@@ -2561,6 +2651,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Data.Odbc;OdbcParameterCollection;false;GetParameter;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Data.Odbc;OdbcParameterCollection;false;GetParameter;(System.String);;Argument[this];ReturnValue;taint;generated",
         "System.Data.Odbc;OdbcParameterCollection;false;Insert;(System.Int32,System.Data.Odbc.OdbcParameter);;Argument[1];Argument[this];taint;generated",
+        "System.Data.Odbc;OdbcParameterCollection;false;Insert;(System.Int32,System.Data.Odbc.OdbcParameter);;Argument[this];Argument[1];taint;generated",
         "System.Data.Odbc;OdbcParameterCollection;false;SetParameter;(System.Int32,System.Data.Common.DbParameter);;Argument[this];Argument[1];taint;generated",
         "System.Data.Odbc;OdbcParameterCollection;false;SetParameter;(System.String,System.Data.Common.DbParameter);;Argument[this];Argument[1];taint;generated",
         "System.Data.Odbc;OdbcParameterCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
@@ -2672,11 +2763,15 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Data;DataColumn;false;set_Prefix;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.Data;DataColumnChangeEventArgs;false;DataColumnChangeEventArgs;(System.Data.DataRow,System.Data.DataColumn,System.Object);;Argument[1];Argument[this];taint;generated",
         "System.Data;DataColumnChangeEventArgs;false;get_Column;();;Argument[this];ReturnValue;taint;generated",
+        "System.Data;DataColumnCollection;false;Add;();;Argument[this];ReturnValue;taint;generated",
+        "System.Data;DataColumnCollection;false;Add;(System.String,System.Type);;Argument[this];ReturnValue;taint;generated",
+        "System.Data;DataColumnCollection;false;Add;(System.String,System.Type,System.String);;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataColumnCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataColumnCollection;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataColumnCollection;false;get_List;();;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataReaderExtensions;false;GetDateTime;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Data;DataReaderExtensions;false;GetFieldValue<>;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.Data;DataReaderExtensions;false;GetFieldValueAsync<>;(System.Data.Common.DbDataReader,System.String,System.Threading.CancellationToken);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Data;DataReaderExtensions;false;GetGuid;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Data;DataReaderExtensions;false;GetProviderSpecificValue;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Data;DataReaderExtensions;false;GetString;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated",
@@ -2706,10 +2801,16 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Data;DataRelation;false;get_RelationName;();;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataRelation;false;set_RelationName;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.Data;DataRelationCollection;false;Remove;(System.Data.DataRelation);;Argument[0];Argument[this];taint;generated",
+        "System.Data;DataRelationCollection;true;Add;(System.Data.DataColumn,System.Data.DataColumn);;Argument[this];ReturnValue;taint;generated",
+        "System.Data;DataRelationCollection;true;Add;(System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[this];ReturnValue;taint;generated",
+        "System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn);;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[0];Argument[this];taint;generated",
         "System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[0];ReturnValue;taint;generated",
+        "System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[this];ReturnValue;taint;generated",
+        "System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[0];Argument[this];taint;generated",
         "System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[0];ReturnValue;taint;generated",
+        "System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataRow;false;DataRow;(System.Data.DataRowBuilder);;Argument[0];Argument[this];taint;generated",
         "System.Data;DataRow;false;GetChildRows;(System.Data.DataRelation);;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataRow;false;GetChildRows;(System.Data.DataRelation,System.Data.DataRowVersion);;Argument[this];ReturnValue;taint;generated",
@@ -2807,8 +2908,10 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Data;DataTable;false;set_PrimaryKey;(System.Data.DataColumn[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.Data;DataTable;false;set_Site;(System.ComponentModel.ISite);;Argument[0];Argument[this];taint;generated",
         "System.Data;DataTable;false;set_TableName;(System.String);;Argument[0];Argument[this];taint;generated",
+        "System.Data;DataTableCollection;false;Add;();;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[1];Argument[this];taint;generated",
         "System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[1];ReturnValue;taint;generated",
+        "System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataTableCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataTableCollection;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated",
         "System.Data;DataTableCollection;false;get_Item;(System.String,System.String);;Argument[this];ReturnValue;taint;generated",
@@ -3111,20 +3214,29 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.DirectoryServices.Protocols;DirSyncRequestControl;false;DirSyncRequestControl;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.DirectoryServices.Protocols;DirSyncRequestControl;false;set_Cookie;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;Add;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated",
+        "System.DirectoryServices.Protocols;DirectoryAttribute;false;Add;(System.Byte[]);;Argument[this];Argument[0].Element;taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;Add;(System.String);;Argument[0];Argument[this];taint;generated",
+        "System.DirectoryServices.Protocols;DirectoryAttribute;false;Add;(System.String);;Argument[this];Argument[0];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;Add;(System.Uri);;Argument[0];Argument[this];taint;generated",
+        "System.DirectoryServices.Protocols;DirectoryAttribute;false;Add;(System.Uri);;Argument[this];Argument[0];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;AddRange;(System.Object[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;CopyTo;(System.Object[],System.Int32);;Argument[this];Argument[0].Element;taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;DirectoryAttribute;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;DirectoryAttribute;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated",
+        "System.DirectoryServices.Protocols;DirectoryAttribute;false;DirectoryAttribute;(System.String,System.Object[]);;Argument[this];Argument[1].Element;taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;GetValues;(System.Type);;Argument[this];ReturnValue;taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;Insert;(System.Int32,System.Byte[]);;Argument[1].Element;Argument[this];taint;generated",
+        "System.DirectoryServices.Protocols;DirectoryAttribute;false;Insert;(System.Int32,System.Byte[]);;Argument[this];Argument[1].Element;taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;Insert;(System.Int32,System.String);;Argument[1];Argument[this];taint;generated",
+        "System.DirectoryServices.Protocols;DirectoryAttribute;false;Insert;(System.Int32,System.String);;Argument[this];Argument[1];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;Insert;(System.Int32,System.Uri);;Argument[1];Argument[this];taint;generated",
+        "System.DirectoryServices.Protocols;DirectoryAttribute;false;Insert;(System.Int32,System.Uri);;Argument[this];Argument[1];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;Remove;(System.Object);;Argument[0];Argument[this];taint;generated",
+        "System.DirectoryServices.Protocols;DirectoryAttribute;false;Remove;(System.Object);;Argument[this];Argument[0];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;get_Name;();;Argument[this];ReturnValue;taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this];taint;generated",
+        "System.DirectoryServices.Protocols;DirectoryAttribute;false;set_Item;(System.Int32,System.Object);;Argument[this];Argument[1];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttribute;false;set_Name;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttributeCollection;false;Add;(System.DirectoryServices.Protocols.DirectoryAttribute);;Argument[0].Element;Argument[this];taint;generated",
         "System.DirectoryServices.Protocols;DirectoryAttributeCollection;false;AddRange;(System.DirectoryServices.Protocols.DirectoryAttributeCollection);;Argument[0].Element;Argument[this];taint;generated",
@@ -3313,18 +3425,22 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Drawing.Printing;PrintPageEventArgs;false;get_PageBounds;();;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;PrintPageEventArgs;false;get_PageSettings;();;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;false;Add;(System.Drawing.Printing.PaperSize);;Argument[0];Argument[this];taint;generated",
+        "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;false;PaperSizeCollection;(System.Drawing.Printing.PaperSize[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
         "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;false;Add;(System.Drawing.Printing.PaperSource);;Argument[0];Argument[this];taint;generated",
+        "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;false;PaperSourceCollection;(System.Drawing.Printing.PaperSource[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
         "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;false;Add;(System.Drawing.Printing.PrinterResolution);;Argument[0];Argument[this];taint;generated",
+        "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;false;PrinterResolutionCollection;(System.Drawing.Printing.PrinterResolution[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
         "System.Drawing.Printing;PrinterSettings+StringCollection;false;Add;(System.String);;Argument[0];Argument[this];taint;generated",
+        "System.Drawing.Printing;PrinterSettings+StringCollection;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;PrinterSettings+StringCollection;false;StringCollection;(System.String[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.Drawing.Printing;PrinterSettings+StringCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;PrinterSettings+StringCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
@@ -3341,6 +3457,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Drawing.Printing;QueryPageSettingsEventArgs;false;get_PageSettings;();;Argument[this];ReturnValue;taint;generated",
         "System.Drawing.Printing;QueryPageSettingsEventArgs;false;set_PageSettings;(System.Drawing.Printing.PageSettings);;Argument[0];Argument[this];taint;generated",
         "System.Drawing.Printing;StandardPrintController;false;OnStartPage;(System.Drawing.Printing.PrintDocument,System.Drawing.Printing.PrintPageEventArgs);;Argument[1];ReturnValue;taint;generated",
+        "System.Drawing;Bitmap;false;Bitmap;(System.String,System.Boolean);;Argument[0];Argument[this];taint;generated",
         "System.Drawing;Bitmap;false;LockBits;(System.Drawing.Rectangle,System.Drawing.Imaging.ImageLockMode,System.Drawing.Imaging.PixelFormat,System.Drawing.Imaging.BitmapData);;Argument[3];ReturnValue;taint;generated",
         "System.Drawing;Brush;false;SetNativeBrush;(System.IntPtr);;Argument[0];Argument[this];taint;generated",
         "System.Drawing;BufferedGraphics;false;get_Graphics;();;Argument[this];ReturnValue;taint;generated",
@@ -3378,6 +3495,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Drawing;Icon;false;Icon;(System.Drawing.Icon,System.Drawing.Size);;Argument[1];Argument[this];taint;generated",
         "System.Drawing;Icon;false;get_Handle;();;Argument[this];ReturnValue;taint;generated",
         "System.Drawing;Icon;false;get_Size;();;Argument[this];ReturnValue;taint;generated",
+        "System.Drawing;Image;false;FromFile;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.Drawing;Image;false;FromFile;(System.String,System.Boolean);;Argument[0];ReturnValue;taint;generated",
         "System.Drawing;Image;false;get_Tag;();;Argument[this];ReturnValue;taint;generated",
         "System.Drawing;Image;false;set_Tag;(System.Object);;Argument[0];Argument[this];taint;generated",
         "System.Drawing;ImageFormatConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated",
@@ -3581,10 +3700,14 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO.Compression;BrotliStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.IO.Compression;BrotliStream;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated",
         "System.IO.Compression;DeflateStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.IO.Compression;DeflateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.IO.Compression;DeflateStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.IO.Compression;DeflateStream;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated",
         "System.IO.Compression;GZipStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.IO.Compression;GZipStream;false;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionLevel,System.Boolean);;Argument[0];Argument[this];taint;generated",
         "System.IO.Compression;GZipStream;false;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionMode,System.Boolean);;Argument[0];Argument[this];taint;generated",
+        "System.IO.Compression;GZipStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.IO.Compression;GZipStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.IO.Compression;GZipStream;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated",
         "System.IO.Compression;ZLibException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated",
         "System.IO.Compression;ZLibException;false;ZLibException;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[0];Argument[this];taint;generated",
@@ -3609,7 +3732,10 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO.Compression;ZipArchiveEntry;false;get_Name;();;Argument[this];ReturnValue;taint;generated",
         "System.IO.Compression;ZipArchiveEntry;false;set_FullName;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.IO.Compression;ZipArchiveEntry;false;set_LastWriteTime;(System.DateTimeOffset);;Argument[0];Argument[this];taint;generated",
+        "System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode);;Argument[0];ReturnValue;taint;generated",
+        "System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated",
         "System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode,System.Text.Encoding);;Argument[2];ReturnValue;taint;generated",
+        "System.IO.Compression;ZipFile;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated",
         "System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String);;Argument[0];ReturnValue;taint;generated",
         "System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String);;Argument[2];ReturnValue;taint;generated",
         "System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String,System.IO.Compression.CompressionLevel);;Argument[0];ReturnValue;taint;generated",
@@ -3623,12 +3749,18 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO.IsolatedStorage;IsolatedStorage;false;get_AssemblyIdentity;();;Argument[this];ReturnValue;taint;generated",
         "System.IO.IsolatedStorage;IsolatedStorage;false;get_DomainIdentity;();;Argument[this];ReturnValue;taint;generated",
         "System.IO.IsolatedStorage;IsolatedStorageFileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.IO.IsolatedStorage;IsolatedStorageFileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.IO.IsolatedStorage;IsolatedStorageFileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.IO.IsolatedStorage;IsolatedStorageFileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.IO.FileStream,System.String,System.Int64,System.IO.MemoryMappedFiles.MemoryMappedFileAccess,System.IO.HandleInheritability,System.Boolean);;Argument[0];ReturnValue;taint;generated",
+        "System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode);;Argument[0];ReturnValue;taint;generated",
+        "System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String,System.Int64);;Argument[0];ReturnValue;taint;generated",
+        "System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String,System.Int64,System.IO.MemoryMappedFiles.MemoryMappedFileAccess);;Argument[0];ReturnValue;taint;generated",
         "System.IO.MemoryMappedFiles;MemoryMappedFile;false;get_SafeMemoryMappedFileHandle;();;Argument[this];ReturnValue;taint;generated",
         "System.IO.MemoryMappedFiles;MemoryMappedViewAccessor;false;get_SafeMemoryMappedViewHandle;();;Argument[this];ReturnValue;taint;generated",
         "System.IO.MemoryMappedFiles;MemoryMappedViewStream;false;get_SafeMemoryMappedViewHandle;();;Argument[this];ReturnValue;taint;generated",
@@ -3743,6 +3875,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO;BinaryReader;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;BinaryWriter;false;BinaryWriter;(System.IO.Stream,System.Text.Encoding,System.Boolean);;Argument[0];Argument[this];taint;generated",
         "System.IO;BinaryWriter;false;BinaryWriter;(System.IO.Stream,System.Text.Encoding,System.Boolean);;Argument[1];Argument[this];taint;generated",
+        "System.IO;BinaryWriter;false;DisposeAsync;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;BinaryWriter;false;Write;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.IO;BinaryWriter;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated",
         "System.IO;BinaryWriter;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated",
@@ -3782,8 +3915,19 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO;File;false;AppendAllLinesAsync;(System.String,System.Collections.Generic.IEnumerable<System.String>,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated",
         "System.IO;File;false;AppendAllTextAsync;(System.String,System.String,System.Text.Encoding,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated",
         "System.IO;File;false;AppendAllTextAsync;(System.String,System.String,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated",
+        "System.IO;File;false;Create;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;File;false;Create;(System.String,System.Int32);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;File;false;Create;(System.String,System.Int32,System.IO.FileOptions);;Argument[0];ReturnValue;taint;generated",
         "System.IO;File;false;CreateSymbolicLink;(System.String,System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;File;false;Open;(System.String,System.IO.FileMode);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;File;false;Open;(System.String,System.IO.FileMode,System.IO.FileAccess);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;File;false;Open;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare);;Argument[0];ReturnValue;taint;generated",
         "System.IO;File;false;OpenHandle;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.IO.FileOptions,System.Int64);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;File;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;File;false;OpenText;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;File;false;OpenWrite;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;File;false;ReadAllText;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;File;false;ReadAllText;(System.String,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated",
         "System.IO;File;false;ReadLines;(System.String);;Argument[0];ReturnValue;taint;generated",
         "System.IO;File;false;ReadLines;(System.String,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated",
         "System.IO;File;false;ReadLines;(System.String,System.Text.Encoding);;Argument[1];ReturnValue;taint;generated",
@@ -3801,8 +3945,15 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO;FileFormatException;false;get_SourceUri;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;FileInfo;false;CopyTo;(System.String);;Argument[0];ReturnValue;taint;generated",
         "System.IO;FileInfo;false;CopyTo;(System.String,System.Boolean);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;FileInfo;false;Create;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;FileInfo;false;MoveTo;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.IO;FileInfo;false;MoveTo;(System.String,System.Boolean);;Argument[0];Argument[this];taint;generated",
+        "System.IO;FileInfo;false;Open;(System.IO.FileMode);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;FileInfo;false;Open;(System.IO.FileMode,System.IO.FileAccess);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;FileInfo;false;Open;(System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;FileInfo;false;OpenRead;();;Argument[this];ReturnValue;taint;generated",
+        "System.IO;FileInfo;false;OpenText;();;Argument[this];ReturnValue;taint;generated",
+        "System.IO;FileInfo;false;OpenWrite;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;FileInfo;false;get_Directory;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;FileInfo;false;get_DirectoryName;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;FileLoadException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated",
@@ -3811,6 +3962,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO;FileNotFoundException;false;ToString;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;FileNotFoundException;false;get_Message;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;FileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;FileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.IO;FileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.IO;FileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.IO;FileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
@@ -3867,14 +4019,24 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO;RenamedEventArgs;false;RenamedEventArgs;(System.IO.WatcherChangeTypes,System.String,System.String,System.String);;Argument[3];Argument[this];taint;generated",
         "System.IO;RenamedEventArgs;false;get_OldFullPath;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;RenamedEventArgs;false;get_OldName;();;Argument[this];ReturnValue;taint;generated",
+        "System.IO;Stream;false;FlushAsync;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;Stream;false;Synchronized;(System.IO.Stream);;Argument[0];ReturnValue;taint;generated",
-        "System.IO;StreamReader;false;StreamReader;(System.IO.Stream,System.Text.Encoding,System.Boolean,System.Int32,System.Boolean);;Argument[0];Argument[this];taint;generated",
-        "System.IO;StreamReader;false;StreamReader;(System.IO.Stream,System.Text.Encoding,System.Boolean,System.Int32,System.Boolean);;Argument[1];Argument[this];taint;generated",
+        "System.IO;Stream;true;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;Stream;true;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;Stream;true;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.IO;StreamReader;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;StreamReader;false;get_CurrentEncoding;();;Argument[this];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;FlushAsync;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;StreamWriter;false;StreamWriter;(System.IO.Stream,System.Text.Encoding,System.Int32,System.Boolean);;Argument[0];Argument[this];taint;generated",
         "System.IO;StreamWriter;false;StreamWriter;(System.IO.Stream,System.Text.Encoding,System.Int32,System.Boolean);;Argument[1];Argument[this];taint;generated",
+        "System.IO;StreamWriter;false;WriteAsync;(System.Char);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.IO;StreamWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteAsync;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteAsync;(System.String);;Argument[this];ReturnValue;taint;generated",
         "System.IO;StreamWriter;false;WriteLine;(System.String,System.Object);;Argument[0];Argument[this];taint;generated",
         "System.IO;StreamWriter;false;WriteLine;(System.String,System.Object);;Argument[1];Argument[this];taint;generated",
         "System.IO;StreamWriter;false;WriteLine;(System.String,System.Object,System.Object);;Argument[0];Argument[this];taint;generated",
@@ -3886,7 +4048,15 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO;StreamWriter;false;WriteLine;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated",
         "System.IO;StreamWriter;false;WriteLine;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated",
         "System.IO;StreamWriter;false;WriteLine;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated",
+        "System.IO;StreamWriter;false;WriteLineAsync;();;Argument[this];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteLineAsync;(System.Char);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.IO;StreamWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteLineAsync;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;StreamWriter;false;WriteLineAsync;(System.String);;Argument[this];ReturnValue;taint;generated",
         "System.IO;StreamWriter;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;StreamWriter;false;get_Encoding;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;StringWriter;false;GetStringBuilder;();;Argument[this];ReturnValue;taint;generated",
@@ -3894,19 +4064,29 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO;StringWriter;false;ToString;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;StringWriter;false;Write;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated",
         "System.IO;StringWriter;false;Write;(System.String);;Argument[0];Argument[this];taint;generated",
+        "System.IO;StringWriter;false;Write;(System.Text.StringBuilder);;Argument[0];Argument[this];taint;generated",
         "System.IO;StringWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated",
         "System.IO;StringWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.IO;StringWriter;false;WriteAsync;(System.String);;Argument[0];Argument[this];taint;generated",
+        "System.IO;StringWriter;false;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[0];Argument[this];taint;generated",
         "System.IO;StringWriter;false;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
+        "System.IO;StringWriter;false;WriteLine;(System.Text.StringBuilder);;Argument[0];Argument[this];taint;generated",
         "System.IO;StringWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated",
         "System.IO;StringWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.IO;StringWriter;false;WriteLineAsync;(System.String);;Argument[0];Argument[this];taint;generated",
+        "System.IO;StringWriter;false;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[0];Argument[this];taint;generated",
         "System.IO;StringWriter;false;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
+        "System.IO;StringWriter;false;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.IO;TextReader;false;Synchronized;(System.IO.TextReader);;Argument[0];ReturnValue;taint;generated",
         "System.IO;TextWriter;false;Synchronized;(System.IO.TextWriter);;Argument[0];ReturnValue;taint;generated",
         "System.IO;TextWriter;false;TextWriter;(System.IFormatProvider);;Argument[0];Argument[this];taint;generated",
         "System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated",
+        "System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[this];ReturnValue;taint;generated",
         "System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated",
+        "System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;FlushAsync;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;TextWriter;true;Write;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.IO;TextWriter;true;Write;(System.Object);;Argument[0];Argument[this];taint;generated",
         "System.IO;TextWriter;true;Write;(System.String,System.Object);;Argument[0];Argument[this];taint;generated",
@@ -3920,7 +4100,14 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO;TextWriter;true;Write;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated",
         "System.IO;TextWriter;true;Write;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated",
         "System.IO;TextWriter;true;Write;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated",
+        "System.IO;TextWriter;true;WriteAsync;(System.Char);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteAsync;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteAsync;(System.String);;Argument[this];ReturnValue;taint;generated",
         "System.IO;TextWriter;true;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.IO;TextWriter;true;WriteLine;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.IO;TextWriter;true;WriteLine;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated",
@@ -3937,8 +4124,18 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.IO;TextWriter;true;WriteLine;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated",
         "System.IO;TextWriter;true;WriteLine;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated",
         "System.IO;TextWriter;true;WriteLine;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated",
+        "System.IO;TextWriter;true;WriteLine;(System.Text.StringBuilder);;Argument[0];Argument[this];taint;generated",
+        "System.IO;TextWriter;true;WriteLineAsync;();;Argument[this];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteLineAsync;(System.Char);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteLineAsync;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteLineAsync;(System.String);;Argument[this];ReturnValue;taint;generated",
         "System.IO;TextWriter;true;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
+        "System.IO;TextWriter;true;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.IO;TextWriter;true;get_FormatProvider;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;TextWriter;true;get_NewLine;();;Argument[this];ReturnValue;taint;generated",
         "System.IO;TextWriter;true;set_NewLine;(System.String);;Argument[0];Argument[this];taint;generated",
@@ -4537,6 +4734,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Http.Headers;HeaderStringValues;false;ToString;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http.Headers;HttpHeaders;false;get_NonValidated;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http.Headers;HttpHeadersNonValidated+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated",
+        "System.Net.Http.Headers;HttpHeadersNonValidated;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http.Headers;HttpHeadersNonValidated;false;TryGetValue;(System.String,System.Net.Http.Headers.HeaderStringValues);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Http.Headers;HttpHeadersNonValidated;false;TryGetValues;(System.String,System.Net.Http.Headers.HeaderStringValues);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Http.Headers;HttpHeadersNonValidated;false;get_Item;(System.String);;Argument[0];ReturnValue;taint;generated",
@@ -4637,14 +4835,23 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Http;ByteArrayContent;false;ByteArrayContent;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.Net.Http;ByteArrayContent;false;ByteArrayContent;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated",
         "System.Net.Http;ByteArrayContent;false;CreateContentReadStream;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.Net.Http;ByteArrayContent;false;CreateContentReadStreamAsync;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;ByteArrayContent;false;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated",
+        "System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];Argument[0];taint;generated",
+        "System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated",
+        "System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated",
         "System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated",
+        "System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;DelegatingHandler;false;DelegatingHandler;(System.Net.Http.HttpMessageHandler);;Argument[0];Argument[this];taint;generated",
         "System.Net.Http;DelegatingHandler;false;SendAsync;(System.Net.Http.HttpRequestMessage,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.Net.Http;DelegatingHandler;false;get_InnerHandler;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;DelegatingHandler;false;set_InnerHandler;(System.Net.Http.HttpMessageHandler);;Argument[0];Argument[this];taint;generated",
+        "System.Net.Http;FormUrlEncodedContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.Net.Http;FormUrlEncodedContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated",
         "System.Net.Http;FormUrlEncodedContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated",
+        "System.Net.Http;FormUrlEncodedContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage);;Argument[this];Argument[0];taint;generated",
         "System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage,System.Net.Http.HttpCompletionOption);;Argument[this];Argument[0];taint;generated",
         "System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage,System.Net.Http.HttpCompletionOption,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated",
@@ -4671,7 +4878,10 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Http;HttpContent;false;ReadAsStreamAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;HttpContent;false;get_Headers;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;HttpContent;true;CreateContentReadStream;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.Net.Http;HttpContent;true;CreateContentReadStreamAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated",
+        "System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;HttpMessageInvoker;false;HttpMessageInvoker;(System.Net.Http.HttpMessageHandler,System.Boolean);;Argument[0];Argument[this];taint;generated",
         "System.Net.Http;HttpMessageInvoker;false;SendAsync;(System.Net.Http.HttpRequestMessage,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.Net.Http;HttpMethod;false;HttpMethod;(System.String);;Argument[0];Argument[this];taint;generated",
@@ -4706,6 +4916,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent,System.String,System.String);;Argument[0];Argument[this];taint;generated",
         "System.Net.Http;MultipartFormDataContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated",
         "System.Net.Http;ReadOnlyMemoryContent;false;CreateContentReadStream;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
+        "System.Net.Http;ReadOnlyMemoryContent;false;CreateContentReadStreamAsync;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;ReadOnlyMemoryContent;false;ReadOnlyMemoryContent;(System.ReadOnlyMemory<System.Byte>);;Argument[0];Argument[this];taint;generated",
         "System.Net.Http;SocketsHttpConnectionContext;false;get_DnsEndPoint;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;SocketsHttpConnectionContext;false;get_InitialRequestMessage;();;Argument[this];ReturnValue;taint;generated",
@@ -4744,11 +4955,19 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Http;SocketsHttpPlaintextStreamFilterContext;false;get_NegotiatedHttpVersion;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;SocketsHttpPlaintextStreamFilterContext;false;get_PlaintextStream;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;StreamContent;false;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated",
+        "System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];Argument[0];taint;generated",
+        "System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated",
+        "System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated",
         "System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated",
+        "System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Net.Http;StreamContent;false;StreamContent;(System.IO.Stream);;Argument[0];Argument[this];taint;generated",
         "System.Net.Http;StreamContent;false;StreamContent;(System.IO.Stream,System.Int32);;Argument[0];Argument[this];taint;generated",
+        "System.Net.Http;StringContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.Net.Http;StringContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated",
         "System.Net.Http;StringContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated",
+        "System.Net.Http;StringContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String,System.Net.Mime.ContentType);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String,System.Net.Mime.ContentType);;Argument[1];ReturnValue;taint;generated",
@@ -4778,7 +4997,10 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated",
         "System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.Net.Mime.ContentType);;Argument[1];Argument[this];taint;generated",
         "System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.String);;Argument[0];Argument[this];taint;generated",
+        "System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String);;Argument[0];Argument[this];taint;generated",
+        "System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated",
         "System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.Net.Mime.ContentType);;Argument[1];Argument[this];taint;generated",
+        "System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.String);;Argument[0];Argument[this];taint;generated",
         "System.Net.Mail;AttachmentBase;false;get_ContentId;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Mail;AttachmentBase;false;get_ContentStream;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Mail;AttachmentBase;false;set_ContentType;(System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated",
@@ -4881,6 +5103,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Quic;QuicListener;false;QuicListener;(System.Net.Quic.Implementations.QuicImplementationProvider,System.Net.Quic.QuicListenerOptions);;Argument[1];Argument[this];taint;generated",
         "System.Net.Quic;QuicListener;false;get_ListenEndPoint;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Security;AuthenticatedStream;false;AuthenticatedStream;(System.IO.Stream,System.Boolean);;Argument[0];Argument[this];taint;generated",
+        "System.Net.Security;AuthenticatedStream;false;DisposeAsync;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Security;AuthenticatedStream;false;get_InnerStream;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Security;NegotiateStream;false;AuthenticateAsClient;(System.Net.NetworkCredential,System.Security.Authentication.ExtendedProtection.ChannelBinding,System.String);;Argument[1];Argument[this];taint;generated",
         "System.Net.Security;NegotiateStream;false;AuthenticateAsClient;(System.Net.NetworkCredential,System.Security.Authentication.ExtendedProtection.ChannelBinding,System.String);;Argument[2];Argument[this];taint;generated",
@@ -4899,6 +5122,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Security;NegotiateStream;false;AuthenticateAsServerAsync;(System.Net.NetworkCredential,System.Security.Authentication.ExtendedProtection.ExtendedProtectionPolicy,System.Net.Security.ProtectionLevel,System.Security.Principal.TokenImpersonationLevel);;Argument[1];Argument[this];taint;generated",
         "System.Net.Security;NegotiateStream;false;AuthenticateAsServerAsync;(System.Security.Authentication.ExtendedProtection.ExtendedProtectionPolicy);;Argument[0];Argument[this];taint;generated",
         "System.Net.Security;NegotiateStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.Net.Security;NegotiateStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Net.Security;NegotiateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Security;NegotiateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.Net.Security;NegotiateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
@@ -4911,6 +5135,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Security;SslCertificateTrust;false;CreateForX509Collection;(System.Security.Cryptography.X509Certificates.X509Certificate2Collection,System.Boolean);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Net.Security;SslCertificateTrust;false;CreateForX509Store;(System.Security.Cryptography.X509Certificates.X509Store,System.Boolean);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Security;SslStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.Net.Security;SslStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Net.Security;SslStream;false;Write;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.Net.Security;SslStream;false;get_LocalCertificate;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Security;SslStream;false;get_NegotiatedApplicationProtocol;();;Argument[this];ReturnValue;taint;generated",
@@ -4941,6 +5166,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Sockets;NetworkStream;false;get_Socket;();;Argument[this];ReturnValue;taint;generated",
         "System.Net.Sockets;SafeSocketHandle;false;SafeSocketHandle;(System.IntPtr,System.Boolean);;Argument[0];Argument[this];taint;generated",
         "System.Net.Sockets;Socket;false;Accept;();;Argument[this];ReturnValue;taint;generated",
+        "System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
@@ -4964,6 +5190,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Sockets;Socket;false;DisconnectAsync;(System.Boolean,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;DisconnectAsync;(System.Boolean,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;DisconnectAsync;(System.Net.Sockets.SocketAsyncEventArgs);;Argument[this];Argument[0];taint;generated",
+        "System.Net.Sockets;Socket;false;EndAccept;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
@@ -4983,6 +5210,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.EndPoint);;Argument[1];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];Argument[this];taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated",
+        "System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.ArraySegment<System.Byte>,System.Net.EndPoint);;Argument[1];ReturnValue;taint;generated",
+        "System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated",
@@ -4996,6 +5225,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Byte[],System.Int32,System.Int32,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[4];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[2];Argument[this];taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[2];ReturnValue;taint;generated",
+        "System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.ArraySegment<System.Byte>,System.Net.EndPoint);;Argument[1];ReturnValue;taint;generated",
+        "System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated",
@@ -5054,6 +5285,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Sockets;SocketAsyncEventArgs;false;set_SendPacketsElements;(System.Net.Sockets.SendPacketsElement[]);;Argument[0].Element;Argument[this];taint;generated",
         "System.Net.Sockets;SocketAsyncEventArgs;false;set_UserToken;(System.Object);;Argument[0];Argument[this];taint;generated",
         "System.Net.Sockets;SocketException;false;get_Message;();;Argument[this];ReturnValue;taint;generated",
+        "System.Net.Sockets;SocketTaskExtensions;false;AcceptAsync;(System.Net.Sockets.Socket,System.Net.Sockets.Socket);;Argument[1];ReturnValue;taint;generated",
         "System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint);;Argument[1];Argument[0];taint;generated",
         "System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[1];Argument[0];taint;generated",
@@ -5065,6 +5297,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated",
         "System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated",
+        "System.Net.Sockets;SocketTaskExtensions;false;ReceiveFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];ReturnValue;taint;generated",
+        "System.Net.Sockets;SocketTaskExtensions;false;ReceiveMessageFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];ReturnValue;taint;generated",
         "System.Net.Sockets;SocketTaskExtensions;false;SendAsync;(System.Net.Sockets.Socket,System.ReadOnlyMemory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;SocketTaskExtensions;false;SendAsync;(System.Net.Sockets.Socket,System.ReadOnlyMemory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated",
         "System.Net.Sockets;SocketTaskExtensions;false;SendToAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];Argument[0];taint;generated",
@@ -5079,6 +5313,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net.Sockets;TcpListener;false;AcceptSocketAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;TcpListener;false;AcceptSocketAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Net.Sockets;TcpListener;false;AcceptTcpClient;();;Argument[this];ReturnValue;taint;generated",
+        "System.Net.Sockets;TcpListener;false;EndAcceptSocket;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
+        "System.Net.Sockets;TcpListener;false;EndAcceptTcpClient;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
         "System.Net.Sockets;TcpListener;false;TcpListener;(System.Net.IPAddress,System.Int32);;Argument[0];Argument[this];taint;generated",
         "System.Net.Sockets;TcpListener;false;TcpListener;(System.Net.IPEndPoint);;Argument[0];Argument[this];taint;generated",
         "System.Net.Sockets;TcpListener;false;get_LocalEndpoint;();;Argument[this];ReturnValue;taint;generated",
@@ -5163,11 +5399,17 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net;CookieCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
         "System.Net;CookieException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated",
         "System.Net;CredentialCache;false;GetCredential;(System.Uri,System.String);;Argument[this];ReturnValue;taint;generated",
+        "System.Net;Dns;false;EndGetHostAddresses;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
+        "System.Net;Dns;false;EndGetHostByName;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
+        "System.Net;Dns;false;EndGetHostEntry;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
+        "System.Net;Dns;false;EndResolve;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
         "System.Net;DnsEndPoint;false;DnsEndPoint;(System.String,System.Int32,System.Net.Sockets.AddressFamily);;Argument[0];Argument[this];taint;generated",
         "System.Net;DnsEndPoint;false;ToString;();;Argument[this];ReturnValue;taint;generated",
         "System.Net;DnsEndPoint;false;get_Host;();;Argument[this];ReturnValue;taint;generated",
         "System.Net;DownloadDataCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated",
         "System.Net;DownloadStringCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated",
+        "System.Net;FileWebRequest;false;EndGetRequestStream;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
+        "System.Net;FileWebRequest;false;EndGetResponse;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
         "System.Net;FileWebRequest;false;GetRequestStream;();;Argument[this];ReturnValue;taint;generated",
         "System.Net;FileWebRequest;false;GetResponse;();;Argument[this];ReturnValue;taint;generated",
         "System.Net;FileWebRequest;false;get_ContentType;();;Argument[this];ReturnValue;taint;generated",
@@ -5241,6 +5483,9 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net;HttpListenerTimeoutManager;false;get_IdleConnection;();;Argument[this];ReturnValue;taint;generated",
         "System.Net;HttpListenerTimeoutManager;false;set_DrainEntityBody;(System.TimeSpan);;Argument[0];Argument[this];taint;generated",
         "System.Net;HttpListenerTimeoutManager;false;set_IdleConnection;(System.TimeSpan);;Argument[0];Argument[this];taint;generated",
+        "System.Net;HttpWebRequest;false;EndGetRequestStream;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
+        "System.Net;HttpWebRequest;false;EndGetRequestStream;(System.IAsyncResult,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated",
+        "System.Net;HttpWebRequest;false;EndGetResponse;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
         "System.Net;HttpWebRequest;false;GetRequestStream;();;Argument[this];ReturnValue;taint;generated",
         "System.Net;HttpWebRequest;false;GetRequestStream;(System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated",
         "System.Net;HttpWebRequest;false;GetResponse;();;Argument[this];ReturnValue;taint;generated",
@@ -5297,6 +5542,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net;OpenWriteCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated",
         "System.Net;PathList;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated",
         "System.Net;PathList;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated",
+        "System.Net;PathList;false;get_Values;();;Argument[this];ReturnValue;taint;generated",
         "System.Net;ProtocolViolationException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated",
         "System.Net;UploadDataCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated",
         "System.Net;UploadFileCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated",
@@ -5326,6 +5572,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest);;Argument[0];ReturnValue;taint;generated",
         "System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[0];Argument[this];taint;generated",
         "System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[0];ReturnValue;taint;generated",
+        "System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[1];Argument[this];taint;generated",
+        "System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[1];ReturnValue;taint;generated",
         "System.Net;WebClient;false;OpenRead;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.Net;WebClient;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated",
         "System.Net;WebClient;false;OpenRead;(System.String);;Argument[this];ReturnValue;taint;generated",
@@ -5486,7 +5734,6 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Numerics;BigInteger;false;Max;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[1];ReturnValue;taint;generated",
         "System.Numerics;BigInteger;false;Min;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated",
         "System.Numerics;BigInteger;false;Min;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[1];ReturnValue;taint;generated",
-        "System.Numerics;BigInteger;false;Negate;(System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated",
         "System.Numerics;BigInteger;false;Pow;(System.Numerics.BigInteger,System.Int32);;Argument[0];ReturnValue;taint;generated",
         "System.Numerics;BigInteger;false;Remainder;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated",
         "System.Numerics;BigInteger;false;op_BitwiseOr;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated",
@@ -5494,7 +5741,6 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Numerics;BigInteger;false;op_LeftShift;(System.Numerics.BigInteger,System.Int32);;Argument[0];ReturnValue;taint;generated",
         "System.Numerics;BigInteger;false;op_Modulus;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated",
         "System.Numerics;BigInteger;false;op_RightShift;(System.Numerics.BigInteger,System.Int32);;Argument[0];ReturnValue;taint;generated",
-        "System.Numerics;BigInteger;false;op_UnaryNegation;(System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated",
         "System.Numerics;BigInteger;false;op_UnaryPlus;(System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated",
         "System.Numerics;Complex;false;ToString;(System.IFormatProvider);;Argument[0];ReturnValue;taint;generated",
         "System.Numerics;Complex;false;ToString;(System.String,System.IFormatProvider);;Argument[1];ReturnValue;taint;generated",
@@ -6224,6 +6470,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Resources.Extensions;DeserializingResourceReader;false;DeserializingResourceReader;(System.IO.Stream);;Argument[0];Argument[this];taint;generated",
         "System.Resources.Extensions;DeserializingResourceReader;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Resources.Extensions;PreserializedResourceWriter;false;PreserializedResourceWriter;(System.IO.Stream);;Argument[0];Argument[this];taint;generated",
+        "System.Resources.Extensions;PreserializedResourceWriter;false;PreserializedResourceWriter;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.Resources;MissingSatelliteAssemblyException;false;MissingSatelliteAssemblyException;(System.String,System.String);;Argument[1];Argument[this];taint;generated",
         "System.Resources;MissingSatelliteAssemblyException;false;get_CultureName;();;Argument[this];ReturnValue;taint;generated",
         "System.Resources;ResourceManager;false;CreateFileBasedResourceManager;(System.String,System.String,System.Type);;Argument[0];ReturnValue;taint;generated",
@@ -6241,9 +6488,11 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Resources;ResourceReader;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Resources;ResourceReader;false;GetResourceData;(System.String,System.String,System.Byte[]);;Argument[this];ReturnValue;taint;generated",
         "System.Resources;ResourceReader;false;ResourceReader;(System.IO.Stream);;Argument[0];Argument[this];taint;generated",
+        "System.Resources;ResourceSet;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Resources;ResourceSet;false;ResourceSet;(System.IO.Stream);;Argument[0];Argument[this];taint;generated",
         "System.Resources;ResourceSet;false;ResourceSet;(System.Resources.IResourceReader);;Argument[0].Element;Argument[this];taint;generated",
         "System.Resources;ResourceWriter;false;ResourceWriter;(System.IO.Stream);;Argument[0];Argument[this];taint;generated",
+        "System.Resources;ResourceWriter;false;ResourceWriter;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.Runtime.Caching;CacheEntryRemovedArguments;false;CacheEntryRemovedArguments;(System.Runtime.Caching.ObjectCache,System.Runtime.Caching.CacheEntryRemovedReason,System.Runtime.Caching.CacheItem);;Argument[0].Element;Argument[this];taint;generated",
         "System.Runtime.Caching;CacheEntryRemovedArguments;false;CacheEntryRemovedArguments;(System.Runtime.Caching.ObjectCache,System.Runtime.Caching.CacheEntryRemovedReason,System.Runtime.Caching.CacheItem);;Argument[2];Argument[this];taint;generated",
         "System.Runtime.Caching;CacheEntryRemovedArguments;false;get_CacheItem;();;Argument[this];ReturnValue;taint;generated",
@@ -6308,8 +6557,6 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider);;Argument[2];Argument[this];taint;generated",
         "System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider,System.Span<System.Char>);;Argument[2];Argument[this];taint;generated",
         "System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider,System.Span<System.Char>);;Argument[3];Argument[this];taint;generated",
-        "System.Runtime.CompilerServices;DynamicAttribute;false;DynamicAttribute;(System.Boolean[]);;Argument[0].Element;Argument[this];taint;generated",
-        "System.Runtime.CompilerServices;DynamicAttribute;false;get_TransformFlags;();;Argument[this];ReturnValue;taint;generated",
         "System.Runtime.CompilerServices;FormattableStringFactory;false;Create;(System.String,System.Object[]);;Argument[0];ReturnValue;taint;generated",
         "System.Runtime.CompilerServices;FormattableStringFactory;false;Create;(System.String,System.Object[]);;Argument[1].Element;ReturnValue;taint;generated",
         "System.Runtime.CompilerServices;PoolingAsyncValueTaskMethodBuilder;false;AwaitOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated",
@@ -6321,13 +6568,11 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;ReadOnlyCollectionBuilder;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated",
         "System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated",
         "System.Runtime.CompilerServices;RuntimeOps;false;CreateRuntimeVariables;(System.Object[],System.Int64[]);;Argument[0].Element;ReturnValue;taint;generated",
-        "System.Runtime.CompilerServices;RuntimeOps;false;CreateRuntimeVariables;(System.Object[],System.Int64[]);;Argument[1].Element;ReturnValue;taint;generated",
         "System.Runtime.CompilerServices;RuntimeOps;false;ExpandoPromoteClass;(System.Dynamic.ExpandoObject,System.Object,System.Object);;Argument[2];Argument[0].Element;taint;generated",
         "System.Runtime.CompilerServices;RuntimeOps;false;ExpandoTryGetValue;(System.Dynamic.ExpandoObject,System.Object,System.Int32,System.String,System.Boolean,System.Object);;Argument[0].Element;ReturnValue;taint;generated",
         "System.Runtime.CompilerServices;RuntimeOps;false;ExpandoTrySetValue;(System.Dynamic.ExpandoObject,System.Object,System.Int32,System.Object,System.String,System.Boolean);;Argument[3];ReturnValue;taint;generated",
         "System.Runtime.CompilerServices;RuntimeOps;false;MergeRuntimeVariables;(System.Runtime.CompilerServices.IRuntimeVariables,System.Runtime.CompilerServices.IRuntimeVariables,System.Int32[]);;Argument[0];ReturnValue;taint;generated",
         "System.Runtime.CompilerServices;RuntimeOps;false;MergeRuntimeVariables;(System.Runtime.CompilerServices.IRuntimeVariables,System.Runtime.CompilerServices.IRuntimeVariables,System.Int32[]);;Argument[1];ReturnValue;taint;generated",
-        "System.Runtime.CompilerServices;RuntimeOps;false;MergeRuntimeVariables;(System.Runtime.CompilerServices.IRuntimeVariables,System.Runtime.CompilerServices.IRuntimeVariables,System.Int32[]);;Argument[2].Element;ReturnValue;taint;generated",
         "System.Runtime.CompilerServices;RuntimeOps;false;Quote;(System.Linq.Expressions.Expression,System.Object,System.Object[]);;Argument[0];ReturnValue;taint;generated",
         "System.Runtime.CompilerServices;RuntimeWrappedException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated",
         "System.Runtime.CompilerServices;RuntimeWrappedException;false;RuntimeWrappedException;(System.Object);;Argument[0];Argument[this];taint;generated",
@@ -6651,6 +6896,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Security.Cryptography.Pkcs;Pkcs12SafeBag;false;set_Attributes;(System.Security.Cryptography.CryptographicAttributeObjectCollection);;Argument[0].Element;Argument[this];taint;generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;false;AddSafeBag;(System.Security.Cryptography.Pkcs.Pkcs12SafeBag);;Argument[0];Argument[this];taint;generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;false;AddSecret;(System.Security.Cryptography.Oid,System.ReadOnlyMemory<System.Byte>);;Argument[0];ReturnValue;taint;generated",
+        "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;false;GetBags;();;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SecretBag;false;GetSecretType;();;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SecretBag;false;get_SecretValue;();;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.Pkcs;Pkcs9AttributeObject;false;CopyFrom;(System.Security.Cryptography.AsnEncodedData);;Argument[0];Argument[this];taint;generated",
@@ -6737,6 +6983,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Security.Cryptography.X509Certificates;X509Certificate;false;ToString;(System.Boolean);;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.X509Certificates;X509Certificate;false;get_Issuer;();;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.X509Certificates;X509Certificate;false;get_Subject;();;Argument[this];ReturnValue;taint;generated",
+        "System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;false;X509CertificateEnumerator;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);;Argument[0].Element;Argument[this];taint;generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection;false;Remove;(System.Security.Cryptography.X509Certificates.X509Certificate);;Argument[0];Argument[this];taint;generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection;false;X509CertificateCollection;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);;Argument[0].Element;Argument[this];taint;generated",
@@ -6857,6 +7104,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;set_ItemOf;(System.Int32,System.Security.Cryptography.Xml.EncryptionProperty);;Argument[1];Argument[this];taint;generated",
         "System.Security.Cryptography.Xml;KeyInfo;false;AddClause;(System.Security.Cryptography.Xml.KeyInfoClause);;Argument[0];Argument[this];taint;generated",
+        "System.Security.Cryptography.Xml;KeyInfo;false;GetEnumerator;(System.Type);;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.Xml;KeyInfo;false;LoadXml;(System.Xml.XmlElement);;Argument[0].Element;Argument[this];taint;generated",
         "System.Security.Cryptography.Xml;KeyInfo;false;get_Id;();;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.Xml;KeyInfo;false;set_Id;(System.String);;Argument[0];Argument[this];taint;generated",
@@ -6969,6 +7217,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Security.Cryptography.Xml;Transform;false;set_Context;(System.Xml.XmlElement);;Argument[0].Element;Argument[this];taint;generated",
         "System.Security.Cryptography.Xml;Transform;false;set_Resolver;(System.Xml.XmlResolver);;Argument[0];Argument[this];taint;generated",
         "System.Security.Cryptography.Xml;TransformChain;false;Add;(System.Security.Cryptography.Xml.Transform);;Argument[0];Argument[this];taint;generated",
+        "System.Security.Cryptography.Xml;TransformChain;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.Xml;TransformChain;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography.Xml;XmlDecryptionTransform;false;AddExceptUri;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.Security.Cryptography.Xml;XmlDecryptionTransform;false;GetOutput;();;Argument[this];ReturnValue;taint;generated",
@@ -7034,6 +7283,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Security.Cryptography;CryptoStream;false;CryptoStream;(System.IO.Stream,System.Security.Cryptography.ICryptoTransform,System.Security.Cryptography.CryptoStreamMode,System.Boolean);;Argument[0];Argument[this];taint;generated",
         "System.Security.Cryptography;CryptoStream;false;CryptoStream;(System.IO.Stream,System.Security.Cryptography.ICryptoTransform,System.Security.Cryptography.CryptoStreamMode,System.Boolean);;Argument[1];Argument[this];taint;generated",
         "System.Security.Cryptography;CryptoStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.Security.Cryptography;CryptoStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography;CryptographicAttributeObject;false;CryptographicAttributeObject;(System.Security.Cryptography.Oid,System.Security.Cryptography.AsnEncodedDataCollection);;Argument[0];Argument[this];taint;generated",
         "System.Security.Cryptography;CryptographicAttributeObject;false;get_Oid;();;Argument[this];ReturnValue;taint;generated",
         "System.Security.Cryptography;CryptographicAttributeObjectCollection;false;Add;(System.Security.Cryptography.CryptographicAttributeObject);;Argument[0];Argument[this];taint;generated",
@@ -7298,6 +7548,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Text.Encodings.Web;TextEncoder;true;Encode;(System.IO.TextWriter,System.String,System.Int32,System.Int32);;Argument[1];Argument[0];taint;generated",
         "System.Text.Encodings.Web;TextEncoder;true;Encode;(System.String);;Argument[0];ReturnValue;taint;generated",
         "System.Text.Json.Nodes;JsonArray;false;Add<>;(T);;Argument[0];Argument[this];taint;generated",
+        "System.Text.Json.Nodes;JsonArray;false;Add<>;(T);;Argument[this];Argument[0];taint;generated",
         "System.Text.Json.Nodes;JsonArray;false;Create;(System.Text.Json.JsonElement,System.Nullable<System.Text.Json.Nodes.JsonNodeOptions>);;Argument[0];ReturnValue;taint;generated",
         "System.Text.Json.Nodes;JsonArray;false;JsonArray;(System.Text.Json.Nodes.JsonNodeOptions,System.Text.Json.Nodes.JsonNode[]);;Argument[this];Argument[1].Element;taint;generated",
         "System.Text.Json.Nodes;JsonArray;false;JsonArray;(System.Text.Json.Nodes.JsonNode[]);;Argument[this];Argument[0].Element;taint;generated",
@@ -7317,6 +7568,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Text.Json.Serialization;JsonSerializerContext;false;JsonSerializerContext;(System.Text.Json.JsonSerializerOptions);;Argument[this];Argument[0];taint;generated",
         "System.Text.Json.Serialization;JsonSerializerContext;false;get_Options;();;Argument[this];ReturnValue;taint;generated",
         "System.Text.Json.Serialization;JsonStringEnumConverter;false;JsonStringEnumConverter;(System.Text.Json.JsonNamingPolicy,System.Boolean);;Argument[0];Argument[this];taint;generated",
+        "System.Text.Json.SourceGeneration;JsonSourceGenerator;false;GetSerializableTypes;();;Argument[this];ReturnValue;taint;generated",
         "System.Text.Json;JsonDocument;false;Parse;(System.Buffers.ReadOnlySequence<System.Byte>,System.Text.Json.JsonDocumentOptions);;Argument[0];ReturnValue;taint;generated",
         "System.Text.Json;JsonDocument;false;Parse;(System.IO.Stream,System.Text.Json.JsonDocumentOptions);;Argument[0];ReturnValue;taint;generated",
         "System.Text.Json;JsonDocument;false;Parse;(System.ReadOnlyMemory<System.Byte>,System.Text.Json.JsonDocumentOptions);;Argument[0];ReturnValue;taint;generated",
@@ -7541,6 +7793,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Threading.RateLimiting;MetadataName<>;false;ToString;();;Argument[this];ReturnValue;taint;generated",
         "System.Threading.RateLimiting;MetadataName<>;false;get_Name;();;Argument[this];ReturnValue;taint;generated",
         "System.Threading.RateLimiting;RateLimitLease;false;TryGetMetadata<>;(System.Threading.RateLimiting.MetadataName<T>,T);;Argument[this];ReturnValue;taint;generated",
+        "System.Threading.RateLimiting;RateLimitLease;true;GetAllMetadata;();;Argument[this];ReturnValue;taint;generated",
         "System.Threading.RateLimiting;RateLimiter;false;Acquire;(System.Int32);;Argument[this];ReturnValue;taint;generated",
         "System.Threading.RateLimiting;RateLimiter;false;WaitAsync;(System.Int32,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated",
         "System.Threading.RateLimiting;TokenBucketRateLimiter;false;TokenBucketRateLimiter;(System.Threading.RateLimiting.TokenBucketRateLimiterOptions);;Argument[0];Argument[this];taint;generated",
@@ -7582,6 +7835,10 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);;Argument[0];ReturnValue;taint;generated",
         "System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>);;Argument[0];ReturnValue;taint;generated",
+        "System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
+        "System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);;Argument[0];ReturnValue;taint;generated",
+        "System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated",
         "System.Threading.Tasks.Dataflow;DataflowBlock;false;SendAsync<>;(System.Threading.Tasks.Dataflow.ITargetBlock<TInput>,TInput,System.Threading.CancellationToken);;Argument[1];Argument[0];taint;generated",
         "System.Threading.Tasks.Dataflow;DataflowBlock;false;TryReceive<>;(System.Threading.Tasks.Dataflow.IReceivableSourceBlock<TOutput>,TOutput);;Argument[0];ReturnValue;taint;generated",
         "System.Threading.Tasks.Dataflow;DataflowBlockOptions;false;get_CancellationToken;();;Argument[this];ReturnValue;taint;generated",
@@ -7957,6 +8214,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Xml.Linq;XText;false;XText;(System.Xml.Linq.XText);;Argument[0];Argument[this];taint;generated",
         "System.Xml.Linq;XText;false;get_Value;();;Argument[this];ReturnValue;taint;generated",
         "System.Xml.Linq;XText;false;set_Value;(System.String);;Argument[0];Argument[this];taint;generated",
+        "System.Xml.Resolvers;XmlPreloadedResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated",
         "System.Xml.Resolvers;XmlPreloadedResolver;false;ResolveUri;(System.Uri,System.String);;Argument[0];ReturnValue;taint;generated",
         "System.Xml.Resolvers;XmlPreloadedResolver;false;ResolveUri;(System.Uri,System.String);;Argument[1];ReturnValue;taint;generated",
         "System.Xml.Resolvers;XmlPreloadedResolver;false;XmlPreloadedResolver;(System.Xml.XmlResolver,System.Xml.Resolvers.XmlKnownDtds,System.Collections.Generic.IEqualityComparer<System.Uri>);;Argument[0];Argument[this];taint;generated",
@@ -8177,9 +8435,12 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Xml.Schema;XmlSchemaSet;false;Add;(System.String,System.Xml.XmlReader);;Argument[this];ReturnValue;taint;generated",
         "System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchema);;Argument[0];Argument[this];taint;generated",
         "System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated",
+        "System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchemaSet);;Argument[0];Argument[this];taint;generated",
+        "System.Xml.Schema;XmlSchemaSet;false;CopyTo;(System.Xml.Schema.XmlSchema[],System.Int32);;Argument[this];Argument[0].Element;taint;generated",
         "System.Xml.Schema;XmlSchemaSet;false;Remove;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated",
         "System.Xml.Schema;XmlSchemaSet;false;Reprocess;(System.Xml.Schema.XmlSchema);;Argument[0];Argument[this];taint;generated",
         "System.Xml.Schema;XmlSchemaSet;false;Reprocess;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated",
+        "System.Xml.Schema;XmlSchemaSet;false;Schemas;();;Argument[this];ReturnValue;taint;generated",
         "System.Xml.Schema;XmlSchemaSet;false;XmlSchemaSet;(System.Xml.XmlNameTable);;Argument[0];Argument[this];taint;generated",
         "System.Xml.Schema;XmlSchemaSet;false;get_CompilationSettings;();;Argument[this];ReturnValue;taint;generated",
         "System.Xml.Schema;XmlSchemaSet;false;get_GlobalAttributes;();;Argument[this];ReturnValue;taint;generated",
@@ -8266,8 +8527,10 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Xml.Schema;XmlSchemaXPath;false;get_XPath;();;Argument[this];ReturnValue;taint;generated",
         "System.Xml.Schema;XmlSchemaXPath;false;set_XPath;(System.String);;Argument[0];Argument[this];taint;generated",
         "System.Xml.Serialization;CodeIdentifiers;false;Add;(System.String,System.Object);;Argument[1];Argument[this];taint;generated",
+        "System.Xml.Serialization;CodeIdentifiers;false;Add;(System.String,System.Object);;Argument[this];Argument[1];taint;generated",
         "System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[0];ReturnValue;taint;generated",
         "System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[1];Argument[this];taint;generated",
+        "System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[this];Argument[1];taint;generated",
         "System.Xml.Serialization;CodeIdentifiers;false;MakeUnique;(System.String);;Argument[0];ReturnValue;taint;generated",
         "System.Xml.Serialization;CodeIdentifiers;false;ToArray;(System.Type);;Argument[this];ReturnValue;taint;generated",
         "System.Xml.Serialization;ImportContext;false;ImportContext;(System.Xml.Serialization.CodeIdentifiers,System.Boolean);;Argument[0];Argument[this];taint;generated",
@@ -8550,6 +8813,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.String);;Argument[2];Argument[this];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.Xml.XmlQualifiedName);;Argument[1];Argument[this];taint;generated",
+        "System.Xml.Serialization;XmlSerializationWriter;false;WriteId;(System.Object);;Argument[this];Argument[0];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncoded;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncodedRaw;(System.String,System.String,System.Byte[],System.Xml.XmlQualifiedName);;Argument[2].Element;Argument[this];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncodedRaw;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated",
@@ -8557,9 +8821,15 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringLiteralRaw;(System.String,System.String,System.Byte[]);;Argument[2].Element;Argument[this];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringLiteralRaw;(System.String,System.String,System.String);;Argument[2];Argument[this];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object);;Argument[2];Argument[this];taint;generated",
+        "System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object);;Argument[this];Argument[2];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type);;Argument[2];Argument[this];taint;generated",
+        "System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type);;Argument[this];Argument[2];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean);;Argument[2];Argument[this];taint;generated",
+        "System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean);;Argument[this];Argument[2];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean,System.Boolean);;Argument[2];Argument[this];taint;generated",
+        "System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean,System.Boolean);;Argument[this];Argument[2];taint;generated",
+        "System.Xml.Serialization;XmlSerializationWriter;false;WriteReferencingElement;(System.String,System.String,System.Object);;Argument[this];Argument[2];taint;generated",
+        "System.Xml.Serialization;XmlSerializationWriter;false;WriteReferencingElement;(System.String,System.String,System.Object,System.Boolean);;Argument[this];Argument[2];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteRpcResult;(System.String,System.String);;Argument[0];Argument[this];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteRpcResult;(System.String,System.String);;Argument[1];Argument[this];taint;generated",
         "System.Xml.Serialization;XmlSerializationWriter;false;WriteSerializable;(System.Xml.Serialization.IXmlSerializable,System.String,System.String,System.Boolean);;Argument[0];Argument[this];taint;generated",
@@ -9306,6 +9576,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Xml;XmlReaderSettings;false;set_XmlResolver;(System.Xml.XmlResolver);;Argument[0];Argument[this];taint;generated",
         "System.Xml;XmlResolver;true;ResolveUri;(System.Uri,System.String);;Argument[0];ReturnValue;taint;generated",
         "System.Xml;XmlResolver;true;ResolveUri;(System.Uri,System.String);;Argument[1];ReturnValue;taint;generated",
+        "System.Xml;XmlSecureResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated",
         "System.Xml;XmlSecureResolver;false;ResolveUri;(System.Uri,System.String);;Argument[0];ReturnValue;taint;generated",
         "System.Xml;XmlSecureResolver;false;ResolveUri;(System.Uri,System.String);;Argument[1];ReturnValue;taint;generated",
         "System.Xml;XmlSecureResolver;false;XmlSecureResolver;(System.Xml.XmlResolver,System.String);;Argument[0];Argument[this];taint;generated",
@@ -9335,6 +9606,7 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Xml;XmlTextWriter;false;XmlTextWriter;(System.IO.TextWriter);;Argument[0];Argument[this];taint;generated",
         "System.Xml;XmlTextWriter;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated",
         "System.Xml;XmlTextWriter;false;get_XmlLang;();;Argument[this];ReturnValue;taint;generated",
+        "System.Xml;XmlUrlResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated",
         "System.Xml;XmlUrlResolver;false;ResolveUri;(System.Uri,System.String);;Argument[0];ReturnValue;taint;generated",
         "System.Xml;XmlUrlResolver;false;ResolveUri;(System.Uri,System.String);;Argument[1];ReturnValue;taint;generated",
         "System.Xml;XmlUrlResolver;false;set_Credentials;(System.Net.ICredentials);;Argument[0];Argument[this];taint;generated",
@@ -9354,6 +9626,8 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System.Xml;XmlWriter;false;Create;(System.IO.TextWriter);;Argument[0];ReturnValue;taint;generated",
         "System.Xml;XmlWriter;false;Create;(System.IO.TextWriter,System.Xml.XmlWriterSettings);;Argument[0];ReturnValue;taint;generated",
         "System.Xml;XmlWriter;false;Create;(System.IO.TextWriter,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated",
+        "System.Xml;XmlWriter;false;Create;(System.String);;Argument[0];ReturnValue;taint;generated",
+        "System.Xml;XmlWriter;false;Create;(System.String,System.Xml.XmlWriterSettings);;Argument[0];ReturnValue;taint;generated",
         "System.Xml;XmlWriter;false;Create;(System.String,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated",
         "System.Xml;XmlWriter;false;Create;(System.Text.StringBuilder,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated",
         "System.Xml;XmlWriter;false;Create;(System.Xml.XmlWriter);;Argument[0];ReturnValue;taint;generated",
@@ -9736,6 +10010,27 @@ private class RuntimeSummaryCsv extends SummaryModelCsv {
         "System;Tuple<,>;false;get_Item2;();;Argument[this];ReturnValue;taint;generated",
         "System;Tuple<>;false;ToString;();;Argument[this];ReturnValue;taint;generated",
         "System;Tuple<>;false;get_Item1;();;Argument[this];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20,T21>>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20>>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19>>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18>>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17>>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16>>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15>>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8>>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,,>;(System.ValueTuple<T1,T2,T3,T4>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,,>;(System.ValueTuple<T1,T2,T3>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<,>;(System.ValueTuple<T1,T2>);;Argument[0];ReturnValue;taint;generated",
+        "System;TupleExtensions;false;ToTuple<>;(System.ValueTuple<T1>);;Argument[0];ReturnValue;taint;generated",
         "System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19,T20,T21>>>);;Argument[0];ReturnValue;taint;generated",
         "System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19,T20>>>);;Argument[0];ReturnValue;taint;generated",
         "System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19>>>);;Argument[0];ReturnValue;taint;generated",
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/VisualBasic.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/VisualBasic.qll
index 721ce089846..74954bcc200 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/VisualBasic.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/VisualBasic.qll
@@ -7,6 +7,7 @@ private class MicrosoftVisualBasicCollectionFlowModelCsv extends SummaryModelCsv
   override predicate row(string row) {
     row =
       [
+        "Microsoft.VisualBasic;Collection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "Microsoft.VisualBasic;Collection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual",
         "Microsoft.VisualBasic;Collection;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual",
         "Microsoft.VisualBasic;Collection;false;get_Item;(System.Object);;Argument[this].Element;ReturnValue;value;manual",
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/CodeDom.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/CodeDom.qll
index 400e9954866..2688f14a3fe 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/CodeDom.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/CodeDom.qll
@@ -2,6 +2,7 @@
 
 import csharp
 private import semmle.code.csharp.frameworks.System
+private import semmle.code.csharp.dataflow.ExternalFlow
 
 /** The `System.CodeDome` namespace. */
 class SystemCodeDomNamespace extends Namespace {
@@ -10,3 +11,11 @@ class SystemCodeDomNamespace extends Namespace {
     this.hasName("CodeDom")
   }
 }
+
+/** Data flow for `System.CodeDom.CodeNamespaceImportCollection`. */
+private class SystemCodeDomCodeNamespaceImportCollectionFlowModelCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      "System.CodeDom;CodeNamespaceImportCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual"
+  }
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Collections.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Collections.qll
index f5ca63d3eb6..7a12a1546ef 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Collections.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Collections.qll
@@ -46,20 +46,6 @@ private class SystemCollectionIEnumerableFlowModelCsv extends SummaryModelCsv {
   }
 }
 
-/** Clear content for Clear methods in all subtypes of `System.Collections.IEnumerable`. */
-private class SystemCollectionsIEnumerableClearFlow extends SummarizedCallable {
-  SystemCollectionsIEnumerableClearFlow() {
-    this.getDeclaringType().(RefType).getABaseType*() instanceof
-      SystemCollectionsIEnumerableInterface and
-    this.hasName("Clear")
-  }
-
-  override predicate clearsContent(ParameterPosition pos, DataFlow::ContentSet content) {
-    (if this.(Modifiable).isStatic() then pos.getPosition() = 0 else pos.isThisParameter()) and
-    content instanceof DataFlow::ElementContent
-  }
-}
-
 /** The `System.Collections.IEnumerator` interface. */
 class SystemCollectionsIEnumeratorInterface extends SystemCollectionsInterface {
   SystemCollectionsIEnumeratorInterface() { this.hasName("IEnumerator") }
@@ -96,6 +82,7 @@ private class SystemCollectionsIListFlowModelCsv extends SummaryModelCsv {
     row =
       [
         "System.Collections;IList;true;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual",
+        "System.Collections;IList;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Collections;IList;true;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual",
         "System.Collections;IList;true;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual",
         "System.Collections;IList;true;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual",
@@ -115,6 +102,7 @@ private class SystemCollectionsIDictionaryFlowModelCsv extends SummaryModelCsv {
       [
         "System.Collections;IDictionary;true;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual",
         "System.Collections;IDictionary;true;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual",
+        "System.Collections;IDictionary;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Collections;IDictionary;true;get_Item;(System.Object);;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue;value;manual",
         "System.Collections;IDictionary;true;get_Keys;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];ReturnValue.Element;value;manual",
         "System.Collections;IDictionary;true;get_Values;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue.Element;value;manual",
@@ -194,6 +182,7 @@ private class SystemCollectionsQueueFlowModelCsv extends SummaryModelCsv {
   override predicate row(string row) {
     row =
       [
+        "System.Collections;Queue;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Collections;Queue;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual",
         "System.Collections;Queue;false;Peek;();;Argument[this].Element;ReturnValue;value;manual",
       ]
@@ -205,6 +194,7 @@ private class SystemCollectionsStackFlowModelCsv extends SummaryModelCsv {
   override predicate row(string row) {
     row =
       [
+        "System.Collections;Stack;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Collections;Stack;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual",
         "System.Collections;Stack;false;Peek;();;Argument[this].Element;ReturnValue;value;manual",
         "System.Collections;Stack;false;Pop;();;Argument[this].Element;ReturnValue;value;manual",
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/ComponentModel.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/ComponentModel.qll
index 3eb5de6fd6f..fee6e5ce86d 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/ComponentModel.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/ComponentModel.qll
@@ -12,6 +12,7 @@ private class SystemComponentModelPropertyDescriptorCollectionFlowModelCsv exten
         "System.ComponentModel;PropertyDescriptorCollection;false;Add;(System.ComponentModel.PropertyDescriptor);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual",
         "System.ComponentModel;PropertyDescriptorCollection;false;Add;(System.Object);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual",
         "System.ComponentModel;PropertyDescriptorCollection;false;Add;(System.Object);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual",
+        "System.ComponentModel;PropertyDescriptorCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.ComponentModel;PropertyDescriptorCollection;false;Find;(System.String,System.Boolean);;Argument[this].Element;ReturnValue;value;manual",
         "System.ComponentModel;PropertyDescriptorCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual",
         "System.ComponentModel;PropertyDescriptorCollection;false;Insert;(System.Int32,System.ComponentModel.PropertyDescriptor);;Argument[1];Argument[this].Element;value;manual",
@@ -37,6 +38,7 @@ private class SystemComponentModelEventDescriptorCollectionFlowModelCsv extends
     row =
       [
         "System.ComponentModel;EventDescriptorCollection;false;Add;(System.ComponentModel.EventDescriptor);;Argument[0];Argument[this].Element;value;manual",
+        "System.ComponentModel;EventDescriptorCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.ComponentModel;EventDescriptorCollection;false;Find;(System.String,System.Boolean);;Argument[this].Element;ReturnValue;value;manual",
         "System.ComponentModel;EventDescriptorCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual",
         "System.ComponentModel;EventDescriptorCollection;false;Insert;(System.Int32,System.ComponentModel.EventDescriptor);;Argument[1];Argument[this].Element;value;manual",
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Configuration.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Configuration.qll
new file mode 100644
index 00000000000..ab28ed772bd
--- /dev/null
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Configuration.qll
@@ -0,0 +1,26 @@
+/** Provides definitions related to the namespace `System.Configuration`. */
+
+import csharp
+private import semmle.code.csharp.dataflow.ExternalFlow
+
+/** Data flow for some collection classes in `System.Configuration.*`. */
+private class SystemClearFlowModelCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "System.Configuration;CommaDelimitedStringCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;ConfigurationLockCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;ConfigurationPropertyCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;ConfigurationSectionCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;ConfigurationSectionGroupCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;ConnectionStringSettingsCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;KeyValueConfigurationCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;NameValueConfigurationCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;ProviderSettingsCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;SettingElementCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;SettingsPropertyCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration;SettingsPropertyValueCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Configuration.Provider;ProviderCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+      ]
+  }
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Data.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Data.qll
index bc671003a42..0c91f35cbcd 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Data.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Data.qll
@@ -150,6 +150,7 @@ private class SystemDataConstraintCollectionFlowModelCsv extends SummaryModelCsv
       [
         "System.Data;ConstraintCollection;false;Add;(System.Data.Constraint);;Argument[0];Argument[this].Element;value;manual",
         "System.Data;ConstraintCollection;false;AddRange;(System.Data.Constraint[]);;Argument[0].Element;Argument[this].Element;value;manual",
+        "System.Data;ConstraintCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Data;ConstraintCollection;false;CopyTo;(System.Data.Constraint[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual",
       ]
   }
@@ -163,6 +164,7 @@ private class SystemDataDataColumnCollectionFlowModelCsv extends SummaryModelCsv
         "System.Data;DataColumnCollection;false;Add;(System.Data.DataColumn);;Argument[0];Argument[this].Element;value;manual",
         "System.Data;DataColumnCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual",
         "System.Data;DataColumnCollection;false;AddRange;(System.Data.DataColumn[]);;Argument[0].Element;Argument[this].Element;value;manual",
+        "System.Data;DataColumnCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Data;DataColumnCollection;false;CopyTo;(System.Data.DataColumn[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual",
       ]
   }
@@ -174,6 +176,7 @@ private class SystemDataDataRelationCollectionFlowModelCsv extends SummaryModelC
     row =
       [
         "System.Data;DataRelationCollection;false;Add;(System.Data.DataRelation);;Argument[0];Argument[this].Element;value;manual",
+        "System.Data;DataRelationCollection;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Data;DataRelationCollection;false;CopyTo;(System.Data.DataRelation[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual",
         "System.Data;DataRelationCollection;true;AddRange;(System.Data.DataRelation[]);;Argument[0].Element;Argument[this].Element;value;manual",
       ]
@@ -187,6 +190,7 @@ private class SystemDataDataRawCollectionFlowModelCsv extends SummaryModelCsv {
       [
         "System.Data;DataRowCollection;false;Add;(System.Data.DataRow);;Argument[0];Argument[this].Element;value;manual",
         "System.Data;DataRowCollection;false;Add;(System.Object[]);;Argument[0];Argument[this].Element;value;manual",
+        "System.Data;DataRowCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Data;DataRowCollection;false;CopyTo;(System.Data.DataRow[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual",
         "System.Data;DataRowCollection;false;Find;(System.Object);;Argument[this].Element;ReturnValue;value;manual",
         "System.Data;DataRowCollection;false;Find;(System.Object[]);;Argument[this].Element;ReturnValue;value;manual",
@@ -202,6 +206,7 @@ private class SystemDataDataTableCollectionFlowModelCsv extends SummaryModelCsv
         "System.Data;DataTableCollection;false;Add;(System.Data.DataTable);;Argument[0];Argument[this].Element;value;manual",
         "System.Data;DataTableCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual",
         "System.Data;DataTableCollection;false;AddRange;(System.Data.DataTable[]);;Argument[0].Element;Argument[this].Element;value;manual",
+        "System.Data;DataTableCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Data;DataTableCollection;false;CopyTo;(System.Data.DataTable[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual",
       ]
   }
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Security.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Security.qll
index 02325e19383..15bfbeaef9f 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Security.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Security.qll
@@ -1,6 +1,7 @@
 /** Provides classes related to the namespace `System.Security`. */
 
 import csharp
+private import semmle.code.csharp.dataflow.ExternalFlow
 private import semmle.code.csharp.frameworks.System
 
 /** The `System.Security` namespace. */
@@ -15,3 +16,15 @@ class SystemSecurityNamespace extends Namespace {
 class SystemSecurityClass extends Class {
   SystemSecurityClass() { this.getNamespace() instanceof SystemSecurityNamespace }
 }
+
+/** Data flow for some collection like classes in `System.Security.*`. */
+private class SystemSecurityPolicyApplicationTrustCollectionFlowModelCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "System.Security.Permissions;KeyContainerPermissionAccessEntryCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Security.Policy;ApplicationTrustCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Security.Policy;Evidence;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+      ]
+  }
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Text.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Text.qll
index 44ceb2fbae8..e26a3f73109 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Text.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Text.qll
@@ -26,18 +26,6 @@ class SystemTextStringBuilderClass extends SystemTextClass {
   Method getAppendFormatMethod() { result = this.getAMethod("AppendFormat") }
 }
 
-/** Clear content for `System.Text.StringBuilder.Clear`. */
-private class SystemTextStringBuilderClearFlow extends SummarizedCallable {
-  SystemTextStringBuilderClearFlow() {
-    this = any(SystemTextStringBuilderClass s).getAMethod("Clear")
-  }
-
-  override predicate clearsContent(ParameterPosition pos, DataFlow::ContentSet content) {
-    pos.isThisParameter() and
-    content instanceof DataFlow::ElementContent
-  }
-}
-
 /** Data flow for `System.Text.StringBuilder`. */
 private class SystemTextStringBuilderFlowModelCsv extends SummaryModelCsv {
   override predicate row(string row) {
@@ -120,6 +108,7 @@ private class SystemTextStringBuilderFlowModelCsv extends SummaryModelCsv {
         "System.Text;StringBuilder;false;AppendLine;();;Argument[this];ReturnValue;value;manual",
         "System.Text;StringBuilder;false;AppendLine;(System.String);;Argument[0];Argument[this].Element;value;manual",
         "System.Text;StringBuilder;false;AppendLine;(System.String);;Argument[this];ReturnValue;value;manual",
+        "System.Text;StringBuilder;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Text;StringBuilder;false;StringBuilder;(System.String);;Argument[0];Argument[this].Element;value;manual",
         "System.Text;StringBuilder;false;StringBuilder;(System.String,System.Int32);;Argument[0];Argument[this].Element;value;manual",
         "System.Text;StringBuilder;false;StringBuilder;(System.String,System.Int32,System.Int32,System.Int32);;Argument[0];Argument[this].Element;value;manual",
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Concurrent.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Concurrent.qll
index 34a827ee538..34022715227 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Concurrent.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Concurrent.qll
@@ -44,6 +44,25 @@ private class SystemCollectionsConcurrentIProducerConsumerCollectionFlowModelCsv
 private class SystemCollectionsConcurrentConcurrentBagFlowModelCsv extends SummaryModelCsv {
   override predicate row(string row) {
     row =
-      "System.Collections.Concurrent;ConcurrentBag<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual"
+      [
+        "System.Collections.Concurrent;ConcurrentBag<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual",
+        "System.Collections.Concurrent;ConcurrentBag<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+      ]
+  }
+}
+
+/** Data flow for `System.Collections.Concurrent.ConcurrentQueue<>`. */
+private class SystemCollectionsConcurrentConcurrentQueueFlowModelCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      "System.Collections.Concurrent;ConcurrentQueue<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual"
+  }
+}
+
+/** Data flow for `System.Collections.Concurrent.ConcurrentStack<>`. */
+private class SystemCollectionsConcurrentConcurrentStackFlowModelCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      "System.Collections.Concurrent;ConcurrentStack<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual"
   }
 }
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Generic.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Generic.qll
index 737dddd0ea5..9668ec4686b 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Generic.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Generic.qll
@@ -197,6 +197,7 @@ private class SystemCollectionsGenericICollectionFlowModelCsv extends SummaryMod
     row =
       [
         "System.Collections.Generic;ICollection<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual",
+        "System.Collections.Generic;ICollection<>;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Collections.Generic;ICollection<>;true;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual",
       ]
   }
@@ -289,6 +290,8 @@ private class SystemCollectionsGenericSortedListFlowModelCsv extends SummaryMode
         "System.Collections.Generic;SortedList<,>;false;SortedList;(System.Collections.Generic.IDictionary<TKey,TValue>,System.Collections.Generic.IComparer<TKey>);;Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual",
         "System.Collections.Generic;SortedList<,>;false;get_Keys;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];ReturnValue.Element;value;manual",
         "System.Collections.Generic;SortedList<,>;false;get_Values;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue.Element;value;manual",
+        "System.Collections.Generic;SortedList<,>+KeyList;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
+        "System.Collections.Generic;SortedList<,>+ValueList;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
       ]
   }
 }
@@ -298,6 +301,7 @@ private class SystemCollectionsGenericQueueFlowModelCsv extends SummaryModelCsv
   override predicate row(string row) {
     row =
       [
+        "System.Collections.Generic;Queue<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Collections.Generic;Queue<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual",
         "System.Collections.Generic;Queue<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.Queue<>+Enumerator.Current];value;manual",
         "System.Collections.Generic;Queue<>;false;Peek;();;Argument[this].Element;ReturnValue;value;manual",
@@ -310,6 +314,7 @@ private class SystemCollectionsGenericStackFlowModelCsv extends SummaryModelCsv
   override predicate row(string row) {
     row =
       [
+        "System.Collections.Generic;Stack<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Collections.Generic;Stack<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual",
         "System.Collections.Generic;Stack<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.Stack<>+Enumerator.Current];value;manual",
         "System.Collections.Generic;Stack<>;false;Peek;();;Argument[this].Element;ReturnValue;value;manual",
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Immutable.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Immutable.qll
index 8440db4d7e7..2264730c5df 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Immutable.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Immutable.qll
@@ -6,7 +6,10 @@ private import semmle.code.csharp.dataflow.ExternalFlow
 private class SystemCollectionsImmutableIImmutableDictionaryFlowModelCsv extends SummaryModelCsv {
   override predicate row(string row) {
     row =
-      "System.Collections.Immutable;IImmutableDictionary<,>;true;AddRange;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;Argument[this].Element;value;manual"
+      [
+        "System.Collections.Immutable;IImmutableDictionary<,>;true;AddRange;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;Argument[this].Element;value;manual",
+        "System.Collections.Immutable;IImmutableDictionary<,>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual",
+      ]
   }
 }
 
@@ -65,6 +68,7 @@ private class SystemCollectionsImmutableIImmutableListFlowModelCsv extends Summa
       [
         "System.Collections.Immutable;IImmutableList<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual",
         "System.Collections.Immutable;IImmutableList<>;true;AddRange;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].Element;value;manual",
+        "System.Collections.Immutable;IImmutableList<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual",
       ]
   }
 }
@@ -124,7 +128,10 @@ private class SystemCollectionsImmutableImmutableSortedSetFlowModelCsv extends S
 private class SystemCollectionsImmutableIImmutableSetFlowModelCsv extends SummaryModelCsv {
   override predicate row(string row) {
     row =
-      "System.Collections.Immutable;IImmutableSet<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual"
+      [
+        "System.Collections.Immutable;IImmutableSet<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual",
+        "System.Collections.Immutable;IImmutableSet<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual",
+      ]
   }
 }
 
@@ -153,6 +160,7 @@ private class SystemCollectionsImmutableImmutableHashSetFlowModelCsv extends Sum
       [
         "System.Collections.Immutable;ImmutableHashSet<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableHashSet<>+Enumerator.Current];value;manual",
         "System.Collections.Immutable;ImmutableHashSet<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual",
+        "System.Collections.Immutable;ImmutableHashSet<>;false;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual",
         "System.Collections.Immutable;ImmutableHashSet<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableHashSet<>+Enumerator.Current];value;manual",
       ]
   }
@@ -162,7 +170,10 @@ private class SystemCollectionsImmutableImmutableHashSetFlowModelCsv extends Sum
 private class SystemCollectionsImmutableImmutableQueueFlowModelCsv extends SummaryModelCsv {
   override predicate row(string row) {
     row =
-      "System.Collections.Immutable;ImmutableQueue<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableQueue<>+Enumerator.Current];value;manual"
+      [
+        "System.Collections.Immutable;IImmutableQueue<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual",
+        "System.Collections.Immutable;ImmutableQueue<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableQueue<>+Enumerator.Current];value;manual",
+      ]
   }
 }
 
@@ -170,6 +181,9 @@ private class SystemCollectionsImmutableImmutableQueueFlowModelCsv extends Summa
 private class SystemCollectionsImmutableImmutableStackFlowModelCsv extends SummaryModelCsv {
   override predicate row(string row) {
     row =
-      "System.Collections.Immutable;ImmutableStack<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableStack<>+Enumerator.Current];value;manual"
+      [
+        "System.Collections.Immutable;IImmutableStack<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual",
+        "System.Collections.Immutable;ImmutableStack<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableStack<>+Enumerator.Current];value;manual",
+      ]
   }
 }
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Specialized.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Specialized.qll
index acdd2adc473..16da8fe1087 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Specialized.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Specialized.qll
@@ -30,6 +30,7 @@ private class SystemCollectionsSpecializedNameValueCollectionFlowModelCsv extend
     row =
       [
         "System.Collections.Specialized;NameValueCollection;false;Add;(System.Collections.Specialized.NameValueCollection);;Argument[0];Argument[this].Element;value;manual",
+        "System.Collections.Specialized;NameValueCollection;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual",
         "System.Collections.Specialized;NameValueCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual",
       ]
   }
@@ -70,3 +71,11 @@ private class SystemCollectionsSpecializedStringCollectionFlowModelCsv extends S
       ]
   }
 }
+
+/** Data flow for `System.Collections.Specialized.StringDictionary`. */
+private class SystemCollectionsSpecializedStringDictionaryFlowModelCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      "System.Collections.Specialized;StringDictionary;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual"
+  }
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/data/Common.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/data/Common.qll
index e9c97335ce7..522e107a91b 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/data/Common.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/data/Common.qll
@@ -95,3 +95,11 @@ private class SystemDataCommonDbParameterCollectionFlowModelCsv extends External
       ]
   }
 }
+
+/** Data flow for `System.Data.Common.DbBatchCommandCollection`. */
+private class SystemDataCommonDbBatchCommandCollectionFlowModelCsv extends ExternalFlow::SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      "System.Data.Common;DbBatchCommandCollection;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual"
+  }
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/net/Http.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/net/Http.qll
index 574945867ac..7096adee635 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/net/Http.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/net/Http.qll
@@ -28,3 +28,11 @@ private class SystemNetHttpMultipartFormDataContentFlowModelCsv extends SummaryM
       "System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent);;Argument[0];Argument[this].Element;value;manual"
   }
 }
+
+/** Data flow for `System.Net.Http.Headers.HttpHeaders`. */
+private class SystemNetHttpHeadersHttpHeadersFlowModelCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      "System.Net.Http.Headers;HttpHeaders;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual"
+  }
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/runtime/CompilerServices.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/runtime/CompilerServices.qll
index e0b2b54f59b..705896a5b0a 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/runtime/CompilerServices.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/runtime/CompilerServices.qll
@@ -103,3 +103,11 @@ private class SystemRuntimeCompilerServicesReadOnlyCollectionBuilderFlowModelCsv
       ]
   }
 }
+
+/** Data flow for `System.Runtime.CompilerServices.ConditionalWeakTable<,>`. */
+private class SystemRuntimeCompilerServicesConditionalWeakTableFlowModelCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      "System.Runtime.CompilerServices;ConditionalWeakTable<,>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual"
+  }
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Remote.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Remote.qll
index b194ad57d57..0770a948b09 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Remote.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Remote.qll
@@ -6,7 +6,7 @@ import csharp
 private import Email::Email
 private import ExternalLocationSink
 private import Html
-private import semmle.code.csharp.security.dataflow.XSSSinks as XSSSinks
+private import semmle.code.csharp.security.dataflow.XSSSinks as XssSinks
 private import semmle.code.csharp.frameworks.system.web.UI
 
 /** A data flow sink of remote user output. */
diff --git a/csharp/ql/lib/semmlecode.csharp.dbscheme b/csharp/ql/lib/semmlecode.csharp.dbscheme
index a696c8bae06..4ac7d8bcac6 100644
--- a/csharp/ql/lib/semmlecode.csharp.dbscheme
+++ b/csharp/ql/lib/semmlecode.csharp.dbscheme
@@ -36,10 +36,9 @@ compilations(
  * --- | ---
  * 0   | --compiler
  * 1   | *path to compiler*
- * 2   | --cil
- * 3   | f1.cs
- * 4   | f2.cs
- * 5   | f3.cs
+ * 2   | f1.cs
+ * 3   | f2.cs
+ * 4   | f3.cs
  */
 #keyset[id, num]
 compilation_args(
diff --git a/csharp/ql/lib/upgrades/a696c8bae067f69ab3208e98ce35f4fdf7efb68b/old.dbscheme b/csharp/ql/lib/upgrades/a696c8bae067f69ab3208e98ce35f4fdf7efb68b/old.dbscheme
new file mode 100644
index 00000000000..a696c8bae06
--- /dev/null
+++ b/csharp/ql/lib/upgrades/a696c8bae067f69ab3208e98ce35f4fdf7efb68b/old.dbscheme
@@ -0,0 +1,2065 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+   int id: @externalDataElement,
+   string path: string ref,
+   int column: int ref,
+   string value: string ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @externalDataElement
+         | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+locations_mapped(
+  unique int id: @location_default ref,
+  int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+files(
+  unique int id: @file,
+  string name: string ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+  unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+  | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+  | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+  unique int id: @directive_if,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+  unique int id: @directive_elif,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref,  /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+directive_elses(
+  unique int id: @directive_else,
+  int branchTaken: int ref,   /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+  unique int id: @directive_endif,
+  unique int start: @directive_if ref);
+
+directive_define_symbols(
+  unique int id: @define_symbol_expr ref,
+  string name: string ref);
+
+directive_regions(
+  unique int id: @directive_region,
+  string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+  unique int id: @directive_endregion,
+  unique int start: @directive_region ref);
+
+directive_lines(
+  unique int id: @directive_line,
+  int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+  unique int id: @directive_line ref,
+  int line: int ref);
+
+directive_line_file(
+  unique int id: @directive_line ref,
+  int file: @file ref);
+
+directive_line_offset(
+  unique int id: @directive_line ref,
+  int offset: int ref);
+
+directive_line_span(
+  unique int id: @directive_line ref,
+  int startLine: int ref,
+  int startColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+directive_nullables(
+  unique int id: @directive_nullable,
+  int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+  int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+  unique int id: @directive_warning,
+  string message: string ref);
+
+directive_errors(
+  unique int id: @directive_error,
+  string message: string ref);
+
+directive_undefines(
+  unique int id: @directive_undefine,
+  string name: string ref);
+
+directive_defines(
+  unique int id: @directive_define,
+  string name: string ref);
+
+pragma_checksums(
+  unique int id: @pragma_checksum,
+  int file: @file ref,
+  string guid: string ref,
+  string bytes: string ref);
+
+pragma_warnings(
+  unique int id: @pragma_warning,
+  int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+  int id: @pragma_warning ref,
+  string errorCode: string ref,
+  int index: int ref);
+
+preprocessor_directive_location(
+  unique int id: @preprocessor_directive ref,
+  int loc: @location ref);
+
+preprocessor_directive_compilation(
+  unique int id: @preprocessor_directive ref,
+  int compilation: @compilation ref);
+
+preprocessor_directive_active(
+  unique int id: @preprocessor_directive ref,
+  int active: int ref);  /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int kind: int ref,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+case @attribute.kind of
+  0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+  unique int id: @foreach_stmt ref,
+  int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol =  @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+  int id: @foreach_stmt ref,
+  int symbol: @foreach_symbol ref,
+  int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+lambda_expr_return_type(
+  unique int id: @lambda_expr ref,
+  int type_id: @type_or_ref ref);
+  
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+| 4 = @cil_function_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_function_pointer_return_type(
+  unique int id: @cil_function_pointer_type ref,
+  int return_type: @cil_type ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
+@cil_parameterizable = @cil_method | @cil_function_pointer_type;
+@cil_has_type_annotation = @cil_stack_variable | @cil_property | @cil_method | @cil_function_pointer_type;
+
+#keyset[parameterizable, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int parameterizable: @cil_parameterizable ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_type_annotation(
+  int id: @cil_has_type_annotation ref,
+  int annotation: int ref);
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+cil_function_pointer_calling_conventions(
+  int id: @cil_function_pointer_type ref,
+  int kind: int ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+@dotnet_parameterizable = @parameterizable | @cil_parameterizable;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/ql/lib/upgrades/a696c8bae067f69ab3208e98ce35f4fdf7efb68b/semmlecode.csharp.dbscheme b/csharp/ql/lib/upgrades/a696c8bae067f69ab3208e98ce35f4fdf7efb68b/semmlecode.csharp.dbscheme
new file mode 100644
index 00000000000..4ac7d8bcac6
--- /dev/null
+++ b/csharp/ql/lib/upgrades/a696c8bae067f69ab3208e98ce35f4fdf7efb68b/semmlecode.csharp.dbscheme
@@ -0,0 +1,2064 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | f1.cs
+ * 3   | f2.cs
+ * 4   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+   int id: @externalDataElement,
+   string path: string ref,
+   int column: int ref,
+   string value: string ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @externalDataElement
+         | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+locations_mapped(
+  unique int id: @location_default ref,
+  int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+files(
+  unique int id: @file,
+  string name: string ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+  unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+  | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+  | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+  unique int id: @directive_if,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+  unique int id: @directive_elif,
+  int branchTaken: int ref,     /* 0: false, 1: true */
+  int conditionValue: int ref,  /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+directive_elses(
+  unique int id: @directive_else,
+  int branchTaken: int ref,   /* 0: false, 1: true */
+  int parent: @directive_if ref,
+  int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+  unique int id: @directive_endif,
+  unique int start: @directive_if ref);
+
+directive_define_symbols(
+  unique int id: @define_symbol_expr ref,
+  string name: string ref);
+
+directive_regions(
+  unique int id: @directive_region,
+  string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+  unique int id: @directive_endregion,
+  unique int start: @directive_region ref);
+
+directive_lines(
+  unique int id: @directive_line,
+  int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+  unique int id: @directive_line ref,
+  int line: int ref);
+
+directive_line_file(
+  unique int id: @directive_line ref,
+  int file: @file ref);
+
+directive_line_offset(
+  unique int id: @directive_line ref,
+  int offset: int ref);
+
+directive_line_span(
+  unique int id: @directive_line ref,
+  int startLine: int ref,
+  int startColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+directive_nullables(
+  unique int id: @directive_nullable,
+  int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+  int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+  unique int id: @directive_warning,
+  string message: string ref);
+
+directive_errors(
+  unique int id: @directive_error,
+  string message: string ref);
+
+directive_undefines(
+  unique int id: @directive_undefine,
+  string name: string ref);
+
+directive_defines(
+  unique int id: @directive_define,
+  string name: string ref);
+
+pragma_checksums(
+  unique int id: @pragma_checksum,
+  int file: @file ref,
+  string guid: string ref,
+  string bytes: string ref);
+
+pragma_warnings(
+  unique int id: @pragma_warning,
+  int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+  int id: @pragma_warning ref,
+  string errorCode: string ref,
+  int index: int ref);
+
+preprocessor_directive_location(
+  unique int id: @preprocessor_directive ref,
+  int loc: @location ref);
+
+preprocessor_directive_compilation(
+  unique int id: @preprocessor_directive ref,
+  int compilation: @compilation ref);
+
+preprocessor_directive_active(
+  unique int id: @preprocessor_directive ref,
+  int active: int ref);  /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int kind: int ref,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+case @attribute.kind of
+  0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+  unique int id: @foreach_stmt ref,
+  int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol =  @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+  int id: @foreach_stmt ref,
+  int symbol: @foreach_symbol ref,
+  int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+lambda_expr_return_type(
+  unique int id: @lambda_expr ref,
+  int type_id: @type_or_ref ref);
+  
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+| 4 = @cil_function_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_function_pointer_return_type(
+  unique int id: @cil_function_pointer_type ref,
+  int return_type: @cil_type ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
+@cil_parameterizable = @cil_method | @cil_function_pointer_type;
+@cil_has_type_annotation = @cil_stack_variable | @cil_property | @cil_method | @cil_function_pointer_type;
+
+#keyset[parameterizable, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int parameterizable: @cil_parameterizable ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_type_annotation(
+  int id: @cil_has_type_annotation ref,
+  int annotation: int ref);
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+cil_function_pointer_calling_conventions(
+  int id: @cil_function_pointer_type ref,
+  int kind: int ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+@dotnet_parameterizable = @parameterizable | @cil_parameterizable;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/ql/lib/upgrades/a696c8bae067f69ab3208e98ce35f4fdf7efb68b/upgrade.properties b/csharp/ql/lib/upgrades/a696c8bae067f69ab3208e98ce35f4fdf7efb68b/upgrade.properties
new file mode 100644
index 00000000000..e48f6376fce
--- /dev/null
+++ b/csharp/ql/lib/upgrades/a696c8bae067f69ab3208e98ce35f4fdf7efb68b/upgrade.properties
@@ -0,0 +1,2 @@
+description: Remove '--cil' flag from the comments. This does not make any changes to the dbscheme.
+compatibility: full
diff --git a/csharp/ql/src/Bad Practices/Comments/TodoComments.ql b/csharp/ql/src/Bad Practices/Comments/TodoComments.ql
index bb87724678f..751c064bccf 100644
--- a/csharp/ql/src/Bad Practices/Comments/TodoComments.ql	
+++ b/csharp/ql/src/Bad Practices/Comments/TodoComments.ql	
@@ -14,4 +14,4 @@ import csharp
 
 from CommentLine c
 where c.getText().regexpMatch("(?s).*FIXME.*|.*TODO.*|.*(?<!=)\\s*XXX.*")
-select c, "TODO comment."
+select c, "TODO comments should be addressed."
diff --git a/csharp/ql/src/Bad Practices/Naming Conventions/ConfusingOverridesNames.ql b/csharp/ql/src/Bad Practices/Naming Conventions/ConfusingOverridesNames.ql
index c1a3e5612b6..ae085389729 100644
--- a/csharp/ql/src/Bad Practices/Naming Conventions/ConfusingOverridesNames.ql	
+++ b/csharp/ql/src/Bad Practices/Naming Conventions/ConfusingOverridesNames.ql	
@@ -72,5 +72,5 @@ where
   ) and
   m1.fromSource()
 select m1,
-  "confusing to have methods " + m1.getName() + " in " + m1.getDeclaringType().getName() + " and " +
-    m2.getName() + " in " + m2.getDeclaringType().getName() + "."
+  "It is confusing to have methods " + m1.getName() + " in " + m1.getDeclaringType().getName() +
+    " and " + m2.getName() + " in " + m2.getDeclaringType().getName() + "."
diff --git a/csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql b/csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql
index 487d1fb6ecf..615f0634f16 100644
--- a/csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql	
+++ b/csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql	
@@ -64,6 +64,5 @@ where
     validGuard.controls(array, index) and
     validGuard.guards(indexAccess, _)
   )
-select incorrectGuard,
-  "Off-by-one index comparison against length leads to possible out of bounds $@.", ea,
-  ea.toString()
+select incorrectGuard, "Off-by-one index comparison against length may lead to out-of-bounds $@.",
+  ea, ea.toString()
diff --git a/csharp/ql/src/Likely Bugs/EqualityCheckOnFloats.ql b/csharp/ql/src/Likely Bugs/EqualityCheckOnFloats.ql
index 1884cd5cc5f..bdf3ee4e97c 100644
--- a/csharp/ql/src/Likely Bugs/EqualityCheckOnFloats.ql	
+++ b/csharp/ql/src/Likely Bugs/EqualityCheckOnFloats.ql	
@@ -1,6 +1,8 @@
 /**
  * @name Equality check on floating point values
- * @description Equality checks on floating point values can yield unexpected results.
+ * @description Comparing results of floating-point computations with '==' or
+ *              '!=' is likely to yield surprising results since floating-point
+ *              computation does not follow the standard rules of algebra.
  * @kind problem
  * @problem.severity warning
  * @precision medium
diff --git a/csharp/ql/src/Likely Bugs/Statements/EmptyBlock.ql b/csharp/ql/src/Likely Bugs/Statements/EmptyBlock.ql
index 1906b373e6f..5929e7e8f91 100644
--- a/csharp/ql/src/Likely Bugs/Statements/EmptyBlock.ql	
+++ b/csharp/ql/src/Likely Bugs/Statements/EmptyBlock.ql	
@@ -42,4 +42,4 @@ where
   (loopStmtWithEmptyBlock(s) or conditionalWithEmptyBlock(s)) and
   not exists(CommentBlock c | c.getParent() = s) and
   not exists(ForStmt fs | fs.getBody() = s and exists(fs.getAnUpdate()))
-select s, "Empty block."
+select s, "Empty block without comment."
diff --git a/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql b/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql
index 7c93d25d646..5b490190a0e 100644
--- a/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql	
+++ b/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql	
@@ -35,4 +35,4 @@ where
   access = cast.getAChild() and
   access.getTarget().getDeclaringElement() = access.getEnclosingCallable() and
   nodeBeforeParameterAccess(access.getAControlFlowNode())
-select cast, "Missing type-check before casting parameter to 'Equals'."
+select cast, "Equals() method does not check argument type."
diff --git a/csharp/ql/src/Security Features/CWE-730/RegexInjection.ql b/csharp/ql/src/Security Features/CWE-730/RegexInjection.ql
index 0ce1459091e..396c0859d33 100644
--- a/csharp/ql/src/Security Features/CWE-730/RegexInjection.ql	
+++ b/csharp/ql/src/Security Features/CWE-730/RegexInjection.ql	
@@ -23,5 +23,5 @@ where
   c.hasFlowPath(source, sink) and
   // No global timeout set
   not exists(RegexGlobalTimeout r)
-select sink.getNode(), source, sink, "$@ flows to the construction of a regular expression.",
-  source.getNode(), "User-provided value"
+select sink.getNode(), source, sink, "This regular expression is constructed from a $@.",
+  source.getNode(), "user-provided value"
diff --git a/csharp/ql/src/Security Features/InsufficientKeySize.ql b/csharp/ql/src/Security Features/InsufficientKeySize.ql
index 7e1b1bd6de4..1a712467b89 100644
--- a/csharp/ql/src/Security Features/InsufficientKeySize.ql	
+++ b/csharp/ql/src/Security Features/InsufficientKeySize.ql	
@@ -24,7 +24,7 @@ predicate incorrectUseOfRC2(Assignment e, string msg) {
   msg = "Key size should be at least 128 bits for RC2 encryption."
 }
 
-predicate incorrectUseOfDSA(ObjectCreation e, string msg) {
+predicate incorrectUseOfDsa(ObjectCreation e, string msg) {
   e.getTarget()
       .getDeclaringType()
       .hasQualifiedName("System.Security.Cryptography", "DSACryptoServiceProvider") and
@@ -32,7 +32,7 @@ predicate incorrectUseOfDSA(ObjectCreation e, string msg) {
   msg = "Key size should be at least 2048 bits for DSA encryption."
 }
 
-predicate incorrectUseOfRSA(ObjectCreation e, string msg) {
+predicate incorrectUseOfRsa(ObjectCreation e, string msg) {
   e.getTarget()
       .getDeclaringType()
       .hasQualifiedName("System.Security.Cryptography", "RSACryptoServiceProvider") and
@@ -43,6 +43,6 @@ predicate incorrectUseOfRSA(ObjectCreation e, string msg) {
 from Expr e, string msg
 where
   incorrectUseOfRC2(e, msg) or
-  incorrectUseOfDSA(e, msg) or
-  incorrectUseOfRSA(e, msg)
+  incorrectUseOfDsa(e, msg) or
+  incorrectUseOfRsa(e, msg)
 select e, msg
diff --git a/csharp/ql/src/Stubs/make_stubs_nuget.py b/csharp/ql/src/Stubs/make_stubs_nuget.py
index f06fc75e0de..0912d32ea75 100644
--- a/csharp/ql/src/Stubs/make_stubs_nuget.py
+++ b/csharp/ql/src/Stubs/make_stubs_nuget.py
@@ -77,7 +77,7 @@ run_cmd(['dotnet', 'new', 'globaljson', '--force', '--sdk-version', sdk_version,
 
 print("\n* Creating DB")
 run_cmd(['codeql', 'database', 'create', dbDir, '--language=csharp',
-                 '--command', 'dotnet build /t:rebuild /p:UseSharedCompilation=false ' + projectDirIn])
+                 '--command', 'dotnet build /t:rebuild ' + projectDirIn])
 
 if not os.path.isdir(dbDir):
     print("Expected database directory " + dbDir + " not found.")
diff --git a/csharp/ql/src/Useless code/RedundantToStringCall.ql b/csharp/ql/src/Useless code/RedundantToStringCall.ql
index f8282dc1a24..f0507f9d8a4 100644
--- a/csharp/ql/src/Useless code/RedundantToStringCall.ql	
+++ b/csharp/ql/src/Useless code/RedundantToStringCall.ql	
@@ -18,4 +18,4 @@ from MethodCall mc
 where
   mc instanceof ImplicitToStringExpr and
   mc.getTarget() instanceof ToStringMethod
-select mc, "Redundant call to 'ToString'."
+select mc, "Redundant call to 'ToString' on a String object."
diff --git a/csharp/ql/src/change-notes/2022-08-23-alert-messages.md b/csharp/ql/src/change-notes/2022-08-23-alert-messages.md
new file mode 100644
index 00000000000..22f4c5c6682
--- /dev/null
+++ b/csharp/ql/src/change-notes/2022-08-23-alert-messages.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The alert message of many queries have been changed to make the message consistent with other languages.
\ No newline at end of file
diff --git a/csharp/ql/src/change-notes/2022-08-24-remove-cil-flag.md b/csharp/ql/src/change-notes/2022-08-24-remove-cil-flag.md
new file mode 100644
index 00000000000..09350501495
--- /dev/null
+++ b/csharp/ql/src/change-notes/2022-08-24-remove-cil-flag.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* A new extractor option has been introduced for disabling CIL extraction. Either pass `-Ocil=false` to the `codeql` CLI or set the environment variable `CODEQL_EXTRACTOR_CSHARP_OPTION_CIL=false`.
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/JsonWebTokenHandlerLib.qll b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/JsonWebTokenHandlerLib.qll
new file mode 100644
index 00000000000..bf9df3e5184
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/JsonWebTokenHandlerLib.qll	
@@ -0,0 +1,259 @@
+import csharp
+import DataFlow
+
+/**
+ * A sensitive property for `TokenValidationParameters` that updates the underlying value.
+ */
+class TokenValidationParametersPropertySensitiveValidation extends Property {
+  TokenValidationParametersPropertySensitiveValidation() {
+    exists(Class c |
+      c.hasQualifiedName("Microsoft.IdentityModel.Tokens.TokenValidationParameters")
+    |
+      c.getAProperty() = this and
+      this.getName() in [
+          "ValidateIssuer", "ValidateAudience", "ValidateLifetime", "RequireExpirationTime",
+          "RequireAudience"
+        ]
+    )
+  }
+}
+
+/**
+ * A dataflow from a `false` value to a write sensitive property for `TokenValidationParameters`.
+ */
+class FalseValueFlowsToTokenValidationParametersPropertyWriteToBypassValidation extends DataFlow::Configuration {
+  FalseValueFlowsToTokenValidationParametersPropertyWriteToBypassValidation() {
+    this = "FalseValueFlowsToTokenValidationParametersPropertyWriteToBypassValidation"
+  }
+
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr().getValue() = "false" and
+    source.asExpr().getType() instanceof BoolType
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() = any(TokenValidationParametersPropertySensitiveValidation p).getAnAssignedValue()
+  }
+}
+
+/**
+ * Holds if `assemblyName` is older than version `ver`
+ */
+bindingset[ver]
+predicate isAssemblyOlderVersion(string assemblyName, string ver) {
+  exists(Assembly a |
+    a.getName() = assemblyName and
+    a.getVersion().isEarlierThan(ver)
+  )
+}
+
+/**
+ * A method `ValidateToken` for `Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler` or other Token handler that shares the same behavior characteristics
+ */
+class JsonWebTokenHandlerValidateTokenMethod extends Method {
+  JsonWebTokenHandlerValidateTokenMethod() {
+    this.hasQualifiedName("Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ValidateToken") or
+    this.hasQualifiedName("Microsoft.AzureAD.DeviceIdentification.Common.Tokens.JwtValidator.ValidateEncryptedToken")
+  }
+}
+
+/**
+ * A Call to `Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ValidateToken`
+ */
+class JsonWebTokenHandlerValidateTokenCall extends MethodCall {
+  JsonWebTokenHandlerValidateTokenCall() {
+    this.getTarget() instanceof JsonWebTokenHandlerValidateTokenMethod
+  }
+}
+
+/**
+ * A read access for properties `IsValid` or `Exception` for `Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ValidateToken`
+ */
+private class TokenValidationResultIsValidCall extends PropertyRead {
+  TokenValidationResultIsValidCall() {
+    exists(Property p | p.getAnAccess() = this |
+      p.hasName("IsValid") or
+      p.hasName("Exception")
+    )
+  }
+}
+
+/**
+ * Dataflow from the output of `Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ValidateToken` call to access the `IsValid` or `Exception` property
+ */
+private class FlowsToTokenValidationResultIsValidCall extends DataFlow::Configuration {
+  FlowsToTokenValidationResultIsValidCall() { this = "FlowsToTokenValidationResultIsValidCall" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr() instanceof JsonWebTokenHandlerValidateTokenCall
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(TokenValidationResultIsValidCall call | sink.asExpr() = call.getQualifier())
+  }
+}
+
+/**
+ * A security-sensitive property for `Microsoft.IdentityModel.Tokens.TokenValidationParameters`
+ */
+class TokenValidationParametersProperty extends Property {
+  TokenValidationParametersProperty() {
+    exists(Class c |
+      c.hasQualifiedName("Microsoft.IdentityModel.Tokens.TokenValidationParameters")
+    |
+      c.getAProperty() = this and
+      this.getName() in [
+          "SignatureValidator", "TokenReplayValidator", "AlgorithmValidator", "AudienceValidator",
+          "IssuerSigningKeyValidator", "LifetimeValidator"
+        ]
+    )
+  }
+}
+
+/**
+ * Holds if the callable has a return statement and it always returns true for all such statements
+ */
+predicate callableHasAReturnStmtAndAlwaysReturnsTrue(Callable c) {
+  c.getReturnType() instanceof BoolType and
+  not callableMayThrowException(c) and
+  forall(ReturnStmt rs | rs.getEnclosingCallable() = c |
+    rs.getNumberOfChildren() = 1 and
+    isExpressionAlwaysTrue(rs.getChildExpr(0))
+  ) and
+  exists(ReturnStmt rs | rs.getEnclosingCallable() = c)
+}
+
+/**
+ * Holds if the lambda expression `le` always returns true
+ */
+predicate lambdaExprReturnsOnlyLiteralTrue(AnonymousFunctionExpr le) {
+  le.getExpressionBody().(BoolLiteral).getBoolValue() = true
+  or
+  // special scenarios where the expression is not a `BoolLiteral`, but it will evaluatue to `true`
+  exists(Expr e | le.getExpressionBody() = e |
+    not e instanceof Call and
+    not e instanceof Literal and
+    e.getType() instanceof BoolType and
+    e.getValue() = "true"
+  )
+}
+
+class CallableAlwaysReturnsTrue extends Callable {
+  CallableAlwaysReturnsTrue() {
+    callableHasAReturnStmtAndAlwaysReturnsTrue(this)
+    or
+    lambdaExprReturnsOnlyLiteralTrue(this)
+    or
+    exists(AnonymousFunctionExpr le, Call call, Callable callable | this = le |
+      callable.getACall() = call and
+      call = le.getExpressionBody() and
+      callableHasAReturnStmtAndAlwaysReturnsTrue(callable)
+    )
+  }
+}
+
+/**
+ * Holds if any exception being thrown by the callable is of type `System.ArgumentNullException`
+ * It will also hold if no exceptions are thrown by the callable
+ */
+predicate callableOnlyThrowsArgumentNullException(Callable c) {
+  forall(ThrowElement thre | c = thre.getEnclosingCallable() |
+    thre.getThrownExceptionType().hasQualifiedName("System.ArgumentNullException")
+  )
+}
+
+/**
+ * A specialization of `CallableAlwaysReturnsTrue` that takes into consideration exceptions being thrown for higher precision.
+ */
+class CallableAlwaysReturnsTrueHigherPrecision extends CallableAlwaysReturnsTrue {
+  CallableAlwaysReturnsTrueHigherPrecision() {
+    callableOnlyThrowsArgumentNullException(this) and
+    (
+      forall(Call call, Callable callable | call.getEnclosingCallable() = this |
+        callable.getACall() = call and
+        callable instanceof CallableAlwaysReturnsTrueHigherPrecision
+      )
+      or
+      exists(AnonymousFunctionExpr le, Call call, CallableAlwaysReturnsTrueHigherPrecision cat |
+        this = le
+      |
+        le.canReturn(call) and
+        cat.getACall() = call
+      )
+      or
+      exists(LambdaExpr le | le = this |
+        le.getBody() instanceof CallableAlwaysReturnsTrueHigherPrecision
+      )
+    )
+  }
+}
+
+/**
+ * A callable that returns a `string` and has a `string` as 1st argument
+ */
+private class CallableReturnsStringAndArg0IsString extends Callable {
+  CallableReturnsStringAndArg0IsString() {
+    this.getReturnType() instanceof StringType and
+    this.getParameter(0).getType() instanceof StringType
+  }
+}
+
+/**
+ * A Callable that always return the 1st argument, both of `string` type
+ */
+class CallableAlwaysReturnsParameter0 extends CallableReturnsStringAndArg0IsString {
+  CallableAlwaysReturnsParameter0() {
+    forex(Expr ret | this.canReturn(ret) |
+      ret = this.getParameter(0).getAnAccess()
+      or
+      exists(CallableAlwaysReturnsParameter0 c |
+        ret = c.getACall() and
+        ret.(Call).getArgument(0) = this.getParameter(0).getAnAccess()
+      )
+    )
+  }
+}
+
+/**
+ * A Callable that always return the 1st argument, both of `string` type. Higher precision
+ */
+class CallableAlwaysReturnsParameter0MayThrowExceptions extends CallableReturnsStringAndArg0IsString {
+  CallableAlwaysReturnsParameter0MayThrowExceptions() {
+    forex(Expr ret | this.canReturn(ret) |
+      ret = this.getParameter(0).getAnAccess()
+      or
+      exists(CallableAlwaysReturnsParameter0MayThrowExceptions c |
+        ret = c.getACall() and
+        ret.(Call).getArgument(0) = this.getParameter(0).getAnAccess()
+      )
+    )
+  }
+}
+
+/**
+ * Hold if the `Expr` e is a `BoolLiteral` with value true,
+ * the expression has a predictable value == `true`,
+ * or if it is a `ConditionalExpr` where the `then` and `else` expressions meet `isExpressionAlwaysTrue` criteria
+ */
+predicate isExpressionAlwaysTrue(Expr e) {
+  e.(BoolLiteral).getBoolValue() = true
+  or
+  e.getValue() = "true"
+  or
+  e instanceof ConditionalExpr and
+  isExpressionAlwaysTrue(e.(ConditionalExpr).getThen()) and
+  isExpressionAlwaysTrue(e.(ConditionalExpr).getElse())
+  or
+  exists(Callable callable |
+    callableHasAReturnStmtAndAlwaysReturnsTrue(callable) and
+    callable.getACall() = e
+  )
+}
+
+/**
+ * Holds if the `Callable` c throws any exception other than `ThrowsArgumentNullException`
+ */
+predicate callableMayThrowException(Callable c) {
+  exists(ThrowStmt thre | c = thre.getEnclosingCallable()) and
+  not callableOnlyThrowsArgumentNullException(c)
+}
diff --git a/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true-bad.cs b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true-bad.cs
new file mode 100644
index 00000000000..2eda6821019
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true-bad.cs	
@@ -0,0 +1,10 @@
+using System;
+using Microsoft.IdentityModel.Tokens;
+class TestClass
+{
+    public void TestMethod()
+    {
+        TokenValidationParameters parameters = new TokenValidationParameters();
+        parameters.AudienceValidator = (audiences, token, tvp) => { return true; };
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true-good.cs b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true-good.cs
new file mode 100644
index 00000000000..28ba1d6f94e
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true-good.cs	
@@ -0,0 +1,17 @@
+using System;
+using Microsoft.IdentityModel.Tokens;
+class TestClass
+{
+    public void TestMethod()
+    {
+        TokenValidationParameters parameters = new TokenValidationParameters();
+        parameters.AudienceValidator = (audiences, token, tvp) =>
+        {
+            // Implement your own custom audience validation
+            if (PerformCustomAudienceValidation(audiences, token))
+                return true;
+            else
+                return false;
+        };
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.qhelp b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.qhelp
new file mode 100644
index 00000000000..8c4f8dff229
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.qhelp	
@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>By setting critical <code>TokenValidationParameter</code> validation delegates to always return <code>true</code>, important authentication safeguards are disabled. Disabling safeguards can lead to incorrect validation of tokens from any issuer or expired tokens.</p>
+
+</overview>
+<recommendation>
+<p>Improve the logic of the delegate so not all code paths return <code>true</code>, which effectively disables that type of validation; or throw <code>SecurityTokenInvalidAudienceException</code> or <code>SecurityTokenInvalidLifetimeException</code> in failure cases when you want to fail validation and have other cases pass by returning <code>true</code>.
+</p>
+</recommendation>
+
+<example>
+<p>This example delegates <code>AudienceValidator</code> to a callable that always returns true.</p>
+<sample src="delegated-security-validations-always-return-true-bad.cs" />
+
+<p>To fix it, use a callable that performs a validation, and fails when appropriate.</p>
+<sample src="delegated-security-validations-always-return-true-good.cs" />
+
+</example>
+
+<references>
+
+  <li><a href="https://aka.ms/wilson/tokenvalidation">azure-activedirectory-identitymodel-extensions-for-dotnet ValidatingTokens wiki</a></li>
+
+</references>
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.ql b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.ql
new file mode 100644
index 00000000000..57561944718
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.ql	
@@ -0,0 +1,21 @@
+/**
+ * @name Delegated security sensitive validations for JsonWebTokenHandler always return true, medium precision
+ * @description Security sensitive validations for `JsonWebTokenHandler` are being delegated to a function that seems to always return true.
+ *   Higher precision version checks for exception throws, so less false positives are expected.
+ * @kind problem
+ * @tags security
+ *       JsonWebTokenHandler
+ *       manual-verification-required
+ * @id cs/json-webtoken-handler/delegated-security-validations-always-return-true
+ * @problem.severity error
+ * @precision high
+ */
+
+import csharp
+import DataFlow
+import JsonWebTokenHandlerLib
+
+from TokenValidationParametersProperty p, CallableAlwaysReturnsTrueHigherPrecision e
+where e = p.getAnAssignedValue()
+select e, "JsonWebTokenHandler security-sensitive property $@ is being delegated to $@.", p,
+  p.getQualifiedName().toString(), e, "a callable that always returns \"true\""
diff --git a/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-bad.cs b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-bad.cs
new file mode 100644
index 00000000000..81df44fea9a
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-bad.cs	
@@ -0,0 +1,13 @@
+using System;
+using Microsoft.IdentityModel.Tokens;
+class TestClass
+{
+    public void TestMethod()
+    {
+        TokenValidationParameters parameters = new TokenValidationParameters();
+        parameters.RequireExpirationTime = false;
+        parameters.ValidateAudience = false;
+        parameters.ValidateIssuer = false;
+        parameters.ValidateLifetime = false;
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-good.cs b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-good.cs
new file mode 100644
index 00000000000..e2f74c0653d
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-good.cs	
@@ -0,0 +1,13 @@
+using System;
+using Microsoft.IdentityModel.Tokens;
+class TestClass
+{
+    public void TestMethod()
+    {
+        TokenValidationParameters parameters = new TokenValidationParameters();
+        parameters.RequireExpirationTime = true;
+        parameters.ValidateAudience = true;
+        parameters.ValidateIssuer = true;
+        parameters.ValidateLifetime = true;
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.qhelp b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.qhelp
new file mode 100644
index 00000000000..5c027ac3148
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.qhelp	
@@ -0,0 +1,27 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>Token validation checks ensure that while validating tokens, all aspects are analyzed and verified. Turning off validation can lead to security holes by allowing untrusted tokens to make it through validation.</p>
+
+</overview>
+<recommendation>
+<p>Set <code>Microsoft.IdentityModel.Tokens.TokenValidationParameters</code> properties <code>RequireExpirationTime</code>, <code>ValidateAudience</code>, <code>ValidateIssuer</code>, or <code>ValidateLifetime</code> to <code>true</code>. Or, remove the assignment to <code>false</code> because the default value is <code>true</code>.</p>
+</recommendation>
+
+<example>
+<p>This example disabled the validation.</p>
+<sample src="security-validation-disabled-bad.cs" />
+
+<p>To fix it, do not disable the validations or use the default value.</p>
+<sample src="security-validation-disabled-good.cs" />
+
+</example>
+
+<references>
+
+  <li><a href="https://aka.ms/wilson/tokenvalidation">azure-activedirectory-identitymodel-extensions-for-dotnet ValidatingTokens wiki</a></li>
+
+</references>
+</qhelp>
\ No newline at end of file
diff --git a/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.ql b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.ql
new file mode 100644
index 00000000000..cfc745e5314
--- /dev/null
+++ b/csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.ql	
@@ -0,0 +1,24 @@
+/**
+ * @name Security sensitive JsonWebTokenHandler validations are disabled
+ * @description Check if secruity sensitive token validations for `JsonWebTokenHandler` are being disabled.
+ * @kind problem
+ * @tags security
+ *       JsonWebTokenHandler
+ *       manual-verification-required
+ * @id cs/json-webtoken-handler/security-validations-disabled
+ * @problem.severity error
+ * @precision high
+ */
+
+import csharp
+import JsonWebTokenHandlerLib
+
+from
+  FalseValueFlowsToTokenValidationParametersPropertyWriteToBypassValidation config,
+  DataFlow::Node source, DataFlow::Node sink,
+  TokenValidationParametersPropertySensitiveValidation pw
+where
+  config.hasFlow(source, sink) and
+  sink.asExpr() = pw.getAnAssignedValue()
+select sink, "The security sensitive property $@ is being disabled by the following value: $@.", pw,
+  pw.getQualifiedName().toString(), source, "false"
diff --git a/csharp/ql/src/experimental/ir/implementation/internal/AliasedSSAStub.qll b/csharp/ql/src/experimental/ir/implementation/internal/AliasedSSAStub.qll
index 0fedd38bfbd..6fca9e3b974 100644
--- a/csharp/ql/src/experimental/ir/implementation/internal/AliasedSSAStub.qll
+++ b/csharp/ql/src/experimental/ir/implementation/internal/AliasedSSAStub.qll
@@ -6,7 +6,7 @@
 private import IRFunctionBase
 private import TInstruction
 
-module SSA {
+module Ssa {
   class MemoryLocation = boolean;
 
   predicate hasPhiInstruction(TRawInstruction blockStartInstr, MemoryLocation memoryLocation) {
@@ -17,3 +17,6 @@ module SSA {
 
   predicate hasUnreachedInstruction(IRFunctionBase irFunc) { none() }
 }
+
+/** DEPRECATED: Alias for Ssa */
+deprecated module SSA = Ssa;
diff --git a/csharp/ql/src/experimental/ir/implementation/internal/TInstruction.qll b/csharp/ql/src/experimental/ir/implementation/internal/TInstruction.qll
index b30372a791b..5564a16f215 100644
--- a/csharp/ql/src/experimental/ir/implementation/internal/TInstruction.qll
+++ b/csharp/ql/src/experimental/ir/implementation/internal/TInstruction.qll
@@ -20,24 +20,24 @@ newtype TInstruction =
     IRConstruction::Raw::hasInstruction(tag1, tag2)
   } or
   TUnaliasedSsaPhiInstruction(
-    TRawInstruction blockStartInstr, UnaliasedSsa::SSA::MemoryLocation memoryLocation
+    TRawInstruction blockStartInstr, UnaliasedSsa::Ssa::MemoryLocation memoryLocation
   ) {
-    UnaliasedSsa::SSA::hasPhiInstruction(blockStartInstr, memoryLocation)
+    UnaliasedSsa::Ssa::hasPhiInstruction(blockStartInstr, memoryLocation)
   } or
   TUnaliasedSsaChiInstruction(TRawInstruction primaryInstruction) { none() } or
   TUnaliasedSsaUnreachedInstruction(IRFunctionBase irFunc) {
-    UnaliasedSsa::SSA::hasUnreachedInstruction(irFunc)
+    UnaliasedSsa::Ssa::hasUnreachedInstruction(irFunc)
   } or
   TAliasedSsaPhiInstruction(
-    TRawInstruction blockStartInstr, AliasedSsa::SSA::MemoryLocation memoryLocation
+    TRawInstruction blockStartInstr, AliasedSsa::Ssa::MemoryLocation memoryLocation
   ) {
-    AliasedSsa::SSA::hasPhiInstruction(blockStartInstr, memoryLocation)
+    AliasedSsa::Ssa::hasPhiInstruction(blockStartInstr, memoryLocation)
   } or
   TAliasedSsaChiInstruction(TRawInstruction primaryInstruction) {
-    AliasedSsa::SSA::hasChiInstruction(primaryInstruction)
+    AliasedSsa::Ssa::hasChiInstruction(primaryInstruction)
   } or
   TAliasedSsaUnreachedInstruction(IRFunctionBase irFunc) {
-    AliasedSsa::SSA::hasUnreachedInstruction(irFunc)
+    AliasedSsa::Ssa::hasUnreachedInstruction(irFunc)
   }
 
 /**
@@ -50,7 +50,7 @@ module UnaliasedSsaInstructions {
   class TPhiInstruction = TUnaliasedSsaPhiInstruction;
 
   TPhiInstruction phiInstruction(
-    TRawInstruction blockStartInstr, UnaliasedSsa::SSA::MemoryLocation memoryLocation
+    TRawInstruction blockStartInstr, UnaliasedSsa::Ssa::MemoryLocation memoryLocation
   ) {
     result = TUnaliasedSsaPhiInstruction(blockStartInstr, memoryLocation)
   }
@@ -83,7 +83,7 @@ module AliasedSsaInstructions {
   class TPhiInstruction = TAliasedSsaPhiInstruction or TUnaliasedSsaPhiInstruction;
 
   TPhiInstruction phiInstruction(
-    TRawInstruction blockStartInstr, AliasedSsa::SSA::MemoryLocation memoryLocation
+    TRawInstruction blockStartInstr, AliasedSsa::Ssa::MemoryLocation memoryLocation
   ) {
     result = TAliasedSsaPhiInstruction(blockStartInstr, memoryLocation)
   }
diff --git a/csharp/ql/src/experimental/ir/implementation/raw/internal/InstructionTag.qll b/csharp/ql/src/experimental/ir/implementation/raw/internal/InstructionTag.qll
index b97981876d4..3ec2d846254 100644
--- a/csharp/ql/src/experimental/ir/implementation/raw/internal/InstructionTag.qll
+++ b/csharp/ql/src/experimental/ir/implementation/raw/internal/InstructionTag.qll
@@ -65,7 +65,7 @@ newtype TInstructionTag =
   PointerAddTag(int index) { index in [0 .. 255] } or
   ElementsAddressTag(int index) { index in [0 .. 255] } or
   ConvertTag() or
-  GeneratedNEQTag() or
+  GeneratedNeqTag() or
   GeneratedConstantTag() or
   GeneratedBranchTag()
 
@@ -181,7 +181,7 @@ string getInstructionTagId(TInstructionTag tag) {
   or
   tag = ConvertTag() and result = "Convert"
   or
-  tag = GeneratedNEQTag() and result = "GeneratedNEQTag"
+  tag = GeneratedNeqTag() and result = "GeneratedNEQTag"
   or
   tag = GeneratedConstantTag() and result = "GeneratedConstantTag"
   or
diff --git a/csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedExpr.qll b/csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedExpr.qll
index 08b246558b1..1bcca401565 100644
--- a/csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedExpr.qll
+++ b/csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedExpr.qll
@@ -1710,7 +1710,7 @@ class TranslatedIsExpr extends TranslatedNonConstantExpr {
     result = this.getParent().getChildSuccessor(this)
     or
     (
-      tag = GeneratedNEQTag() and
+      tag = GeneratedNeqTag() and
       kind instanceof GotoEdge and
       if this.hasVar()
       then result = this.getInstruction(GeneratedBranchTag())
@@ -1733,7 +1733,7 @@ class TranslatedIsExpr extends TranslatedNonConstantExpr {
     kind instanceof GotoEdge and
     if this.hasVar()
     then result = this.getPatternVarDecl().getFirstInstruction()
-    else result = this.getInstruction(GeneratedNEQTag())
+    else result = this.getInstruction(GeneratedNeqTag())
   }
 
   override Instruction getChildSuccessor(TranslatedElement child) {
@@ -1742,7 +1742,7 @@ class TranslatedIsExpr extends TranslatedNonConstantExpr {
     or
     this.hasVar() and
     child = this.getPatternVarDecl() and
-    result = this.getInstruction(GeneratedNEQTag())
+    result = this.getInstruction(GeneratedNeqTag())
   }
 
   override predicate hasInstruction(Opcode opcode, InstructionTag tag, CSharpType resultType) {
@@ -1755,7 +1755,7 @@ class TranslatedIsExpr extends TranslatedNonConstantExpr {
     opcode instanceof Opcode::CheckedConvertOrNull and
     resultType = getTypeForPRValue(expr.getPattern().getType())
     or
-    tag = GeneratedNEQTag() and
+    tag = GeneratedNeqTag() and
     opcode instanceof Opcode::CompareNE and
     resultType = getTypeForPRValue(expr.getType())
     or
@@ -1775,7 +1775,7 @@ class TranslatedIsExpr extends TranslatedNonConstantExpr {
     result = "0"
   }
 
-  override Instruction getResult() { result = this.getInstruction(GeneratedNEQTag()) }
+  override Instruction getResult() { result = this.getInstruction(GeneratedNeqTag()) }
 
   override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
     tag = ConvertTag() and
@@ -1792,7 +1792,7 @@ class TranslatedIsExpr extends TranslatedNonConstantExpr {
       result = this.getPatternVarDecl().getTargetAddress()
     )
     or
-    tag = GeneratedNEQTag() and
+    tag = GeneratedNeqTag() and
     (
       operandTag instanceof LeftOperandTag and
       result = this.getInstruction(ConvertTag())
@@ -1804,7 +1804,7 @@ class TranslatedIsExpr extends TranslatedNonConstantExpr {
     this.hasVar() and
     tag = GeneratedBranchTag() and
     operandTag instanceof ConditionOperandTag and
-    result = this.getInstruction(GeneratedNEQTag())
+    result = this.getInstruction(GeneratedNeqTag())
   }
 
   private TranslatedExpr getIsExpr() { result = getTranslatedExpr(expr.getExpr()) }
diff --git a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll
index 1c75529be00..873a3c635f8 100644
--- a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll
+++ b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll
@@ -1,2 +1,2 @@
-private import SSAConstruction as SSA
-import SSA::SsaConsistency
+private import SSAConstruction as Ssa
+import Ssa::SsaConsistency
diff --git a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
index 901735069c0..21c03e176a5 100644
--- a/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
+++ b/csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
@@ -1135,7 +1135,7 @@ deprecated module SSAConsistency = SsaConsistency;
  * These predicates are all just aliases for predicates defined in the `Cached` module. This ensures
  * that all of SSA construction will be evaluated in the same stage.
  */
-module SSA {
+module Ssa {
   class MemoryLocation = Alias::MemoryLocation;
 
   predicate hasPhiInstruction = Cached::hasPhiInstructionCached/2;
@@ -1144,3 +1144,6 @@ module SSA {
 
   predicate hasUnreachedInstruction = Cached::hasUnreachedInstructionCached/1;
 }
+
+/** DEPRECATED: Alias for Ssa */
+deprecated module SSA = Ssa;
diff --git a/csharp/ql/src/utils/model-generator/CaptureDiscardedSummaryModels.ql b/csharp/ql/src/utils/model-generator/CaptureDiscardedSummaryModels.ql
index 6276f9793dc..b9e0cc23987 100644
--- a/csharp/ql/src/utils/model-generator/CaptureDiscardedSummaryModels.ql
+++ b/csharp/ql/src/utils/model-generator/CaptureDiscardedSummaryModels.ql
@@ -4,10 +4,10 @@
  * @id csharp/utils/model-generator/discarded-summary-models
  */
 
-private import semmle.code.csharp.dataflow.ExternalFlow
-private import internal.CaptureModels
-private import internal.CaptureSummaryFlow
+import semmle.code.csharp.dataflow.ExternalFlow
+import internal.CaptureModels
+import internal.CaptureSummaryFlow
 
-from TargetApi api, string flow
+from DataFlowTargetApi api, string flow
 where flow = captureFlow(api) and hasSummary(api, false)
 select flow order by flow
diff --git a/csharp/ql/src/utils/model-generator/CaptureNegativeSummaryModels.ql b/csharp/ql/src/utils/model-generator/CaptureNegativeSummaryModels.ql
index 09202f423ea..0e26d3eee7f 100644
--- a/csharp/ql/src/utils/model-generator/CaptureNegativeSummaryModels.ql
+++ b/csharp/ql/src/utils/model-generator/CaptureNegativeSummaryModels.ql
@@ -6,10 +6,12 @@
  * @tags model-generator
  */
 
-private import semmle.code.csharp.dataflow.ExternalFlow
-private import internal.CaptureModels
-private import internal.CaptureSummaryFlow
+import semmle.code.csharp.dataflow.ExternalFlow
+import internal.CaptureModels
+import internal.CaptureSummaryFlow
 
-from TargetApi api, string noflow
-where noflow = captureNoFlow(api) and not hasSummary(api, false)
+from DataFlowTargetApi api, string noflow
+where
+  noflow = captureNoFlow(api) and
+  not hasSummary(api, false)
 select noflow order by noflow
diff --git a/csharp/ql/src/utils/model-generator/CaptureSinkModels.ql b/csharp/ql/src/utils/model-generator/CaptureSinkModels.ql
index 03eeeeda273..ea249016427 100644
--- a/csharp/ql/src/utils/model-generator/CaptureSinkModels.ql
+++ b/csharp/ql/src/utils/model-generator/CaptureSinkModels.ql
@@ -6,8 +6,8 @@
  * @tags model-generator
  */
 
-private import internal.CaptureModels
+import internal.CaptureModels
 
-from TargetApi api, string sink
+from DataFlowTargetApi api, string sink
 where sink = captureSink(api)
 select sink order by sink
diff --git a/csharp/ql/src/utils/model-generator/CaptureSourceModels.ql b/csharp/ql/src/utils/model-generator/CaptureSourceModels.ql
index f60682b2b6d..72ce31d4b61 100644
--- a/csharp/ql/src/utils/model-generator/CaptureSourceModels.ql
+++ b/csharp/ql/src/utils/model-generator/CaptureSourceModels.ql
@@ -6,8 +6,8 @@
  * @tags model-generator
  */
 
-private import internal.CaptureModels
+import internal.CaptureModels
 
-from TargetApi api, string source
+from DataFlowTargetApi api, string source
 where source = captureSource(api)
 select source order by source
diff --git a/csharp/ql/src/utils/model-generator/CaptureSummaryModels.ql b/csharp/ql/src/utils/model-generator/CaptureSummaryModels.ql
index f6c91335428..f308c57c89d 100644
--- a/csharp/ql/src/utils/model-generator/CaptureSummaryModels.ql
+++ b/csharp/ql/src/utils/model-generator/CaptureSummaryModels.ql
@@ -6,10 +6,10 @@
  * @tags model-generator
  */
 
-private import semmle.code.csharp.dataflow.ExternalFlow
-private import internal.CaptureModels
-private import internal.CaptureSummaryFlow
+import semmle.code.csharp.dataflow.ExternalFlow
+import internal.CaptureModels
+import internal.CaptureSummaryFlow
 
-from TargetApi api, string flow
+from DataFlowTargetApi api, string flow
 where flow = captureFlow(api) and not hasSummary(api, false)
 select flow order by flow
diff --git a/csharp/ql/src/utils/model-generator/CaptureTypeBasedSummaryModels.ql b/csharp/ql/src/utils/model-generator/CaptureTypeBasedSummaryModels.ql
new file mode 100644
index 00000000000..e3dcc9dc2f6
--- /dev/null
+++ b/csharp/ql/src/utils/model-generator/CaptureTypeBasedSummaryModels.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Capture typed based summary models.
+ * @description Finds applicable summary models to be used by other queries.
+ * @kind diagnostic
+ * @id cs/utils/model-generator/summary-models-typed-based
+ * @tags model-generator
+ */
+
+import semmle.code.csharp.dataflow.ExternalFlow
+import internal.CaptureTypeBasedSummaryModels
+
+from TypeBasedFlowTargetApi api, string flow
+where flow = captureFlow(api)
+select flow order by flow
diff --git a/csharp/ql/src/utils/model-generator/internal/CaptureModels.qll b/csharp/ql/src/utils/model-generator/internal/CaptureModels.qll
index 2547b058e18..82c6fbd1bbb 100644
--- a/csharp/ql/src/utils/model-generator/internal/CaptureModels.qll
+++ b/csharp/ql/src/utils/model-generator/internal/CaptureModels.qll
@@ -5,7 +5,9 @@
 
 private import CaptureModelsSpecific
 
-class TargetApi = TargetApiSpecific;
+class DataFlowTargetApi extends TargetApiSpecific {
+  DataFlowTargetApi() { isRelevantForDataFlowModels(this) }
+}
 
 /**
  * Holds if data can flow from `node1` to `node2` either via a read or a write of an intermediate field `f`.
@@ -40,7 +42,7 @@ private predicate isRelevantContent(DataFlow::Content c) {
  * Gets the summary model for `api` with `input`, `output` and `kind`.
  */
 bindingset[input, output, kind]
-private string asSummaryModel(TargetApi api, string input, string output, string kind) {
+private string asSummaryModel(TargetApiSpecific api, string input, string output, string kind) {
   result =
     asPartialModel(api) + input + ";" //
       + output + ";" //
@@ -48,13 +50,15 @@ private string asSummaryModel(TargetApi api, string input, string output, string
       + "generated"
 }
 
-string asNegativeSummaryModel(TargetApi api) { result = asPartialNegativeModel(api) + "generated" }
+string asNegativeSummaryModel(TargetApiSpecific api) {
+  result = asPartialNegativeModel(api) + "generated"
+}
 
 /**
  * Gets the value summary model for `api` with `input` and `output`.
  */
 bindingset[input, output]
-private string asValueModel(TargetApi api, string input, string output) {
+string asValueModel(TargetApiSpecific api, string input, string output) {
   result = asSummaryModel(api, input, output, "value")
 }
 
@@ -62,7 +66,7 @@ private string asValueModel(TargetApi api, string input, string output) {
  * Gets the taint summary model for `api` with `input` and `output`.
  */
 bindingset[input, output]
-private string asTaintModel(TargetApi api, string input, string output) {
+private string asTaintModel(TargetApiSpecific api, string input, string output) {
   result = asSummaryModel(api, input, output, "taint")
 }
 
@@ -70,7 +74,7 @@ private string asTaintModel(TargetApi api, string input, string output) {
  * Gets the sink model for `api` with `input` and `kind`.
  */
 bindingset[input, kind]
-private string asSinkModel(TargetApi api, string input, string kind) {
+private string asSinkModel(TargetApiSpecific api, string input, string kind) {
   result =
     asPartialModel(api) + input + ";" //
       + kind + ";" //
@@ -81,7 +85,7 @@ private string asSinkModel(TargetApi api, string input, string kind) {
  * Gets the source model for `api` with `output` and `kind`.
  */
 bindingset[output, kind]
-private string asSourceModel(TargetApi api, string output, string kind) {
+private string asSourceModel(TargetApiSpecific api, string output, string kind) {
   result =
     asPartialModel(api) + output + ";" //
       + kind + ";" //
@@ -91,7 +95,7 @@ private string asSourceModel(TargetApi api, string output, string kind) {
 /**
  * Gets the summary model of `api`, if it follows the `fluent` programming pattern (returns `this`).
  */
-string captureQualifierFlow(TargetApi api) {
+string captureQualifierFlow(TargetApiSpecific api) {
   exists(DataFlowImplCommon::ReturnNodeExt ret |
     api = returnNodeEnclosingCallable(ret) and
     isOwnInstanceAccessNode(ret)
@@ -140,7 +144,7 @@ private class ThroughFlowConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
     source instanceof DataFlow::ParameterNode and
-    source.getEnclosingCallable() instanceof TargetApi and
+    source.getEnclosingCallable() instanceof DataFlowTargetApi and
     state.(TaintRead).getStep() = 0
   }
 
@@ -184,7 +188,7 @@ private class ThroughFlowConfig extends TaintTracking::Configuration {
 /**
  * Gets the summary model(s) of `api`, if there is flow from parameters to return value or parameter.
  */
-string captureThroughFlow(TargetApi api) {
+string captureThroughFlow(DataFlowTargetApi api) {
   exists(
     ThroughFlowConfig config, DataFlow::ParameterNode p,
     DataFlowImplCommon::ReturnNodeExt returnNodeExt, string input, string output
@@ -211,7 +215,7 @@ private class FromSourceConfiguration extends TaintTracking::Configuration {
   override predicate isSource(DataFlow::Node source) { ExternalFlow::sourceNode(source, _) }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(TargetApi c |
+    exists(DataFlowTargetApi c |
       sink instanceof DataFlowImplCommon::ReturnNodeExt and
       sink.getEnclosingCallable() = c
     )
@@ -229,11 +233,12 @@ private class FromSourceConfiguration extends TaintTracking::Configuration {
 /**
  * Gets the source model(s) of `api`, if there is flow from an existing known source to the return of `api`.
  */
-string captureSource(TargetApi api) {
+string captureSource(DataFlowTargetApi api) {
   exists(DataFlow::Node source, DataFlow::Node sink, FromSourceConfiguration config, string kind |
     config.hasFlow(source, sink) and
     ExternalFlow::sourceNode(source, kind) and
     api = sink.getEnclosingCallable() and
+    isRelevantSourceKind(kind) and
     result = asSourceModel(api, returnNodeAsOutput(sink), kind)
   )
 }
@@ -258,7 +263,7 @@ private class PropagateToSinkConfiguration extends PropagateToSinkConfigurationS
 /**
  * Gets the sink model(s) of `api`, if there is flow from a parameter to an existing known sink.
  */
-string captureSink(TargetApi api) {
+string captureSink(DataFlowTargetApi api) {
   exists(DataFlow::Node src, DataFlow::Node sink, PropagateToSinkConfiguration config, string kind |
     config.hasFlow(src, sink) and
     ExternalFlow::sinkNode(sink, kind) and
diff --git a/csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll b/csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll
index f95684370ce..3b0a33336c0 100644
--- a/csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll
+++ b/csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll
@@ -36,10 +36,21 @@ private predicate isRelevantForModels(CS::Callable api) {
   api.getDeclaringType().getNamespace().getQualifiedName() != "" and
   not api instanceof CS::ConversionOperator and
   not api instanceof Util::MainMethod and
-  not isHigherOrder(api) and
   not api instanceof CS::Destructor
 }
 
+/**
+ * Holds if it is relevant to generate models for `api` based on data flow analysis.
+ */
+predicate isRelevantForDataFlowModels(CS::Callable api) {
+  isRelevantForModels(api) and not isHigherOrder(api)
+}
+
+/**
+ * Holds if it is relevant to generate models for `api` based on its type.
+ */
+predicate isRelevantForTypeBasedFlowModels = isRelevantForModels/1;
+
 /**
  * A class of callables that are relevant generating summary, source and sinks models for.
  *
@@ -49,8 +60,7 @@ private predicate isRelevantForModels(CS::Callable api) {
 class TargetApiSpecific extends DotNet::Callable {
   TargetApiSpecific() {
     this.fromSource() and
-    this.isUnboundDeclaration() and
-    isRelevantForModels(this)
+    this.isUnboundDeclaration()
   }
 }
 
@@ -58,6 +68,31 @@ predicate asPartialModel = DataFlowPrivate::Csv::asPartialModel/1;
 
 predicate asPartialNegativeModel = DataFlowPrivate::Csv::asPartialNegativeModel/1;
 
+/**
+ * Holds if `t` is a type that is generally used for bulk data in collection types.
+ * Eg. char[] is roughly equivalent to string and thus a highly
+ * relevant type for model generation.
+ */
+private predicate isPrimitiveTypeUsedForBulkData(CS::Type t) {
+  t instanceof CS::ByteType or
+  t instanceof CS::CharType
+}
+
+/**
+ * Holds if the collection type `ct` is irrelevant for model generation.
+ * Collection types where the type of the elements are
+ * (1) unknown - are considered relevant.
+ * (2) known - at least one the child types should be relevant (a non-simple type
+ * or a type used for bulk data)
+ */
+private predicate irrelevantCollectionType(CS::Type ct) {
+  Collections::isCollectionType(ct) and
+  forex(CS::Type child | child = ct.getAChild() |
+    child instanceof CS::SimpleType and
+    not isPrimitiveTypeUsedForBulkData(child)
+  )
+}
+
 /**
  * Holds for type `t` for fields that are relevant as an intermediate
  * read or write step in the data flow analysis.
@@ -66,7 +101,8 @@ predicate asPartialNegativeModel = DataFlowPrivate::Csv::asPartialNegativeModel/
  */
 predicate isRelevantType(CS::Type t) {
   not t instanceof CS::SimpleType and
-  not t instanceof CS::Enum
+  not t instanceof CS::Enum and
+  not irrelevantCollectionType(t)
 }
 
 /**
@@ -74,7 +110,7 @@ predicate isRelevantType(CS::Type t) {
  */
 string qualifierString() { result = "Argument[this]" }
 
-private string parameterAccess(CS::Parameter p) {
+string parameterAccess(CS::Parameter p) {
   if Collections::isCollectionType(p.getType())
   then result = "Argument[" + p.getPosition() + "].Element"
   else result = "Argument[" + p.getPosition() + "]"
@@ -167,3 +203,9 @@ string asInputArgument(DataFlow::Node source) {
  */
 bindingset[kind]
 predicate isRelevantSinkKind(string kind) { any() }
+
+/**
+ * Holds if `kind` is a relevant source kind for creating source models.
+ */
+bindingset[kind]
+predicate isRelevantSourceKind(string kind) { not kind = "file" }
diff --git a/csharp/ql/src/utils/model-generator/internal/CaptureSummaryFlow.qll b/csharp/ql/src/utils/model-generator/internal/CaptureSummaryFlow.qll
index 65a5181ee89..e06ea1a609a 100644
--- a/csharp/ql/src/utils/model-generator/internal/CaptureSummaryFlow.qll
+++ b/csharp/ql/src/utils/model-generator/internal/CaptureSummaryFlow.qll
@@ -75,7 +75,7 @@ private import CaptureModels
  * Captured Model:
  * ```Summaries;BasicFlow;false;AssignToArray;(System.Int32,System.Int32[]);Argument[0];Argument[1].Element;taint```
  */
-string captureFlow(TargetApi api) {
+string captureFlow(DataFlowTargetApi api) {
   result = captureQualifierFlow(api) or
   result = captureThroughFlow(api)
 }
@@ -84,7 +84,7 @@ string captureFlow(TargetApi api) {
  * Gets the negative summary for `api`, if any.
  * A negative summary is generated, if there does not exist any positive flow.
  */
-string captureNoFlow(TargetApi api) {
+string captureNoFlow(DataFlowTargetApi api) {
   not exists(captureFlow(api)) and
   result = asNegativeSummaryModel(api)
 }
diff --git a/csharp/ql/src/utils/model-generator/internal/CaptureTypeBasedSummaryModels.qll b/csharp/ql/src/utils/model-generator/internal/CaptureTypeBasedSummaryModels.qll
new file mode 100644
index 00000000000..02f00986c3c
--- /dev/null
+++ b/csharp/ql/src/utils/model-generator/internal/CaptureTypeBasedSummaryModels.qll
@@ -0,0 +1,224 @@
+private import csharp
+private import dotnet
+private import semmle.code.csharp.frameworks.system.collections.Generic as GenericCollections
+private import semmle.code.csharp.dataflow.internal.DataFlowPrivate
+private import semmle.code.csharp.frameworks.system.linq.Expressions
+private import CaptureModelsSpecific as Specific
+private import CaptureModels
+
+/**
+ * Holds if `t` is a subtype (reflexive/transitive) of `IEnumerable<T>`, where `T` = `tp`.
+ */
+private predicate genericCollectionType(ValueOrRefType t, TypeParameter tp) {
+  exists(ConstructedGeneric t2 |
+    t2 = t.getABaseType*() and
+    t2.getUnboundDeclaration() instanceof
+      GenericCollections::SystemCollectionsGenericIEnumerableTInterface and
+    tp = t2.getATypeArgument()
+  )
+}
+
+/**
+ * Holds if `tp` is a type parameter of the immediate type declaring `callable`.
+ */
+private predicate classTypeParameter(DotNet::Callable callable, TypeParameter tp) {
+  callable.getDeclaringType().(UnboundGeneric).getATypeParameter() = tp
+}
+
+/**
+ * Holds if `tp` is type parameter of `callable` or the type declaring `callable`.
+ */
+private predicate localTypeParameter(DotNet::Callable callable, TypeParameter tp) {
+  classTypeParameter(callable, tp) or
+  callable.(UnboundGeneric).getATypeParameter() = tp
+}
+
+/**
+ * Holds if `callable` has a parameter of type `tp`
+ * or collection parameterized over type `tp`.
+ */
+private predicate parameter(DotNet::Callable callable, string input, TypeParameter tp) {
+  exists(Parameter p |
+    input = Specific::parameterAccess(p) and
+    p = callable.getAParameter() and
+    (
+      // Parameter of type tp
+      p.getType() = tp
+      or
+      // Parameter is a collection of type tp
+      genericCollectionType(p.getType(), tp)
+    )
+  )
+}
+
+/**
+ * Gets the string representation of a synthetic field corresponding to `tp`.
+ */
+private string getSyntheticField(TypeParameter tp) {
+  result = ".SyntheticField[ArgType" + tp.getIndex() + "]"
+}
+
+/**
+ * Gets a models as data string representation of, how a value of type `tp`
+ * can be read or stored implicitly in relation to `callable`.
+ */
+private string implicit(DotNet::Callable callable, TypeParameter tp) {
+  classTypeParameter(callable, tp) and
+  exists(string access |
+    if genericCollectionType(callable.getDeclaringType(), tp)
+    then access = ".Element"
+    else access = getSyntheticField(tp)
+  |
+    result = Specific::qualifierString() + access
+  )
+}
+
+/**
+ * Holds if `callable` has a delegate parameter `dt` at parameter position `position`.
+ */
+private predicate delegate(DotNet::Callable callable, DelegateType dt, int position) {
+  exists(Parameter p |
+    p = callable.getAParameter() and
+    dt = p.getType().(SystemLinqExpressions::DelegateExtType).getDelegateType() and
+    position = p.getPosition()
+  )
+}
+
+/**
+ * Gets models as data input/output access relative to the type parameter `tp` in the
+ * type `t` in the scope of `callable`.
+ *
+ * Note: This predicate has to be inlined as `callable` is not related to `return` or `tp`
+ * in every disjunction.
+ */
+bindingset[callable]
+private string getAccess(DotNet::Callable callable, Type return, TypeParameter tp) {
+  return = tp and result = ""
+  or
+  genericCollectionType(return, tp) and result = ".Element"
+  or
+  not genericCollectionType(return, tp) and
+  (
+    return.(ConstructedGeneric).getATypeArgument() = tp
+    or
+    callable.getDeclaringType() = return and return.(UnboundGeneric).getATypeParameter() = tp
+  ) and
+  result = getSyntheticField(tp)
+}
+
+/**
+ * Holds if `input` is a models as data string representation of, how a value of type `tp`
+ * (or a generic parameterized over `tp`) can be generated by a delegate parameter of `callable`.
+ */
+private predicate delegateSource(DotNet::Callable callable, string input, TypeParameter tp) {
+  exists(DelegateType dt, int position, Type return, string access |
+    delegate(callable, dt, position) and
+    return = dt.getReturnType() and
+    access = getAccess(callable, return, tp) and
+    input = "Argument[" + position + "].ReturnValue" + access
+  )
+}
+
+/**
+ * Holds if `input` is a models as data string representation of, how a
+ * value of type `tp` (or a generic parameterized over `tp`)
+ * can be provided as input to `callable`.
+ * This includes
+ * (1) The implicit synthetic field(s) of the declaring type of `callable`.
+ * (2) The parameters of `callable`.
+ * (3) Any delegate parameters of `callable`.
+ */
+private predicate input(DotNet::Callable callable, string input, TypeParameter tp) {
+  input = implicit(callable, tp)
+  or
+  parameter(callable, input, tp)
+  or
+  delegateSource(callable, input, tp)
+}
+
+/**
+ * Holds if `callable` returns a value of type `tp` (or a generic parameterized over `tp`) and `output`
+ * is a models as data string representation of, how data is routed to the return.
+ */
+private predicate returns(DotNet::Callable callable, TypeParameter tp, string output) {
+  exists(Type return, string access | return = callable.getReturnType() |
+    access = getAccess(callable, return, tp) and
+    output = "ReturnValue" + access
+  )
+}
+
+/**
+ * Holds if `callable` has a delegate parameter that accepts a value of type `tp`
+ * and `output` is the models as data string representation of, how data is routed to
+ * the delegate parameter.
+ */
+private predicate delegateSink(DotNet::Callable callable, TypeParameter tp, string output) {
+  exists(DelegateType dt, int position, Parameter p |
+    delegate(callable, dt, position) and
+    p = dt.getAParameter() and
+    p.getType() = tp and
+    output = "Argument[" + position + "]" + ".Parameter[" + p.getPosition() + "]"
+  )
+}
+
+/**
+ * Holds if `output` is a models as data string representation of, how values of type `tp`
+ * (or generics parameterized over `tp`) can be routed.
+ * This includes
+ * (1) The implicit synthetic field(s) of the declaring type of `callable`.
+ * (2) The return of `callable`.
+ * (3) Any delegate parameters of `callable`.
+ */
+private predicate output(DotNet::Callable callable, TypeParameter tp, string output) {
+  output = implicit(callable, tp)
+  or
+  returns(callable, tp, output)
+  or
+  delegateSink(callable, tp, output)
+}
+
+/**
+ * A class of callables that are relevant generating summaries for based
+ * on the Theorems for Free approach.
+ */
+class TypeBasedFlowTargetApi extends Specific::TargetApiSpecific {
+  TypeBasedFlowTargetApi() { Specific::isRelevantForTypeBasedFlowModels(this) }
+
+  /**
+   * Gets the string representation of all type based summaries for `this`
+   * inspired by the Theorems for Free approach.
+   *
+   * Examples could be (see C# psuedo code below)
+   * (1) `Get` returns a value of type `T`. We assume that the returned
+   *     value was fetched from a (synthetic) field.
+   * (2) `Set` consumes a value of type `T`. We assume that the value is stored in
+   *     a (synthetic) field.
+   * (3) `Apply<S>` is assumed to apply the provided function to a value stored in
+   *     a (synthetic) field and return the result.
+   * (4) `Apply<S1,S2>` is assumed to apply the provided function to provided value
+   *     and return the result.
+   * ```csharp
+   * public class MyGeneric<T> {
+   *    public void Set(T x) { ... }
+   *    public T Get() { ... }
+   *    public S Apply<S>(Func<T, S> f) { ... }
+   *    public S2 Apply<S1, S2>(S1 x, Func<S1, S2> f) { ... }
+   * }
+   * ```
+   */
+  string getSummaries() {
+    exists(TypeParameter tp, string input, string output |
+      localTypeParameter(this, tp) and
+      input(this, input, tp) and
+      output(this, tp, output) and
+      input != output
+    |
+      result = asValueModel(this, input, output)
+    )
+  }
+}
+
+/**
+ * Returns the Theorems for Free inspired typed based summaries for `api`.
+ */
+string captureFlow(TypeBasedFlowTargetApi api) { result = api.getSummaries() }
diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.expected b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.expected
new file mode 100644
index 00000000000..dc224c9586e
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.expected	
@@ -0,0 +1,7 @@
+| delegation-test.cs:101:63:101:186 | (...) => ... | JsonWebTokenHandler security-sensitive property $@ is being delegated to $@. | stubs.cs:54:34:54:50 | LifetimeValidator | Microsoft.IdentityModel.Tokens.TokenValidationParameters.LifetimeValidator | delegation-test.cs:101:63:101:186 | (...) => ... | a callable that always returns "true" |
+| delegation-test.cs:102:63:102:178 | (...) => ... | JsonWebTokenHandler security-sensitive property $@ is being delegated to $@. | stubs.cs:55:34:55:50 | AudienceValidator | Microsoft.IdentityModel.Tokens.TokenValidationParameters.AudienceValidator | delegation-test.cs:102:63:102:178 | (...) => ... | a callable that always returns "true" |
+| delegation-test.cs:115:63:115:190 | (...) => ... | JsonWebTokenHandler security-sensitive property $@ is being delegated to $@. | stubs.cs:55:34:55:50 | AudienceValidator | Microsoft.IdentityModel.Tokens.TokenValidationParameters.AudienceValidator | delegation-test.cs:115:63:115:190 | (...) => ... | a callable that always returns "true" |
+| delegation-test.cs:116:63:116:180 | (...) => ... | JsonWebTokenHandler security-sensitive property $@ is being delegated to $@. | stubs.cs:55:34:55:50 | AudienceValidator | Microsoft.IdentityModel.Tokens.TokenValidationParameters.AudienceValidator | delegation-test.cs:116:63:116:180 | (...) => ... | a callable that always returns "true" |
+| delegation-test.cs:117:63:117:217 | (...) => ... | JsonWebTokenHandler security-sensitive property $@ is being delegated to $@. | stubs.cs:55:34:55:50 | AudienceValidator | Microsoft.IdentityModel.Tokens.TokenValidationParameters.AudienceValidator | delegation-test.cs:117:63:117:217 | (...) => ... | a callable that always returns "true" |
+| delegation-test.cs:118:63:118:248 | (...) => ... | JsonWebTokenHandler security-sensitive property $@ is being delegated to $@. | stubs.cs:55:34:55:50 | AudienceValidator | Microsoft.IdentityModel.Tokens.TokenValidationParameters.AudienceValidator | delegation-test.cs:118:63:118:248 | (...) => ... | a callable that always returns "true" |
+| delegation-test.cs:119:63:119:177 | (...) => ... | JsonWebTokenHandler security-sensitive property $@ is being delegated to $@. | stubs.cs:55:34:55:50 | AudienceValidator | Microsoft.IdentityModel.Tokens.TokenValidationParameters.AudienceValidator | delegation-test.cs:119:63:119:177 | (...) => ... | a callable that always returns "true" |
diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.qlref b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.qlref
new file mode 100644
index 00000000000..527ea925973
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs
new file mode 100644
index 00000000000..01af41c4b0c
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs	
@@ -0,0 +1,137 @@
+using System;
+using System.Collections.Generic;
+using Microsoft.IdentityModel.Tokens;
+using Microsoft.IdentityModel.JsonWebTokens;
+
+namespace JsonWebTokenHandlerTest
+{
+    public class JsonWebTokenHandler_00
+    {
+        public static object ThrowIfNull(string name, object value)
+        {
+            if (value == null)
+            {
+                throw new System.ArgumentNullException(name);
+            }
+            return value;
+        }
+
+        private static bool MayThrowException(SecurityToken token)
+        {
+            if (token.Id == null)
+            {
+                throw new Exception("foobar");
+            }
+            return true;
+        }
+
+        private static void DoesNotThrowException(SecurityToken token)
+        {
+            int x = 0;
+        }
+
+        private static bool ValidateLifetime_FP01(
+            SecurityToken token,
+            TokenValidationParameters validationParameters)
+        {
+            if (token == null)
+            {
+                throw new System.ArgumentNullException("token");
+            }
+
+            MayThrowException(token);
+
+            return true;
+        }
+
+        private static bool ValidateLifetime_P01(
+    SecurityToken token,
+    TokenValidationParameters validationParameters)
+        {
+            if (token == null)
+            {
+                throw new System.ArgumentNullException("token");
+            }
+
+            DoesNotThrowException(token);
+
+            return true;
+        }
+
+
+        internal static bool ValidateLifetimeAlwaysTrue(
+            SecurityToken token,
+            TokenValidationParameters validationParameters)
+        {
+            if (token is null)
+            {
+                return true;
+            }
+            return true;
+        }
+
+        internal static bool ValidateLifetime(
+            string token,
+            TokenValidationParameters validationParameters)
+        {
+            if (token is null)
+            {
+                return false;
+            }
+            return true;
+        }
+
+        public void TestCase01()
+        {
+            TokenValidationParameters tokenValidationParamsBaseline = new TokenValidationParameters
+            {
+                ClockSkew = TimeSpan.FromMinutes(5),
+                ValidateActor = true,
+                ValidateIssuerSigningKey = true,
+                ValidateIssuer = true,
+                ValidateAudience = true,
+                ValidateLifetime = true,
+                RequireExpirationTime = true,
+                ValidateTokenReplay = true,
+                RequireSignedTokens = true,
+                RequireAudience = true,
+                SaveSigninToken = true
+            };
+
+            tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // BUG delegated-security-validations-always-return-true
+            tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => true; // BUG delegated-security-validations-always-return-true
+            tokenValidationParamsBaseline.TokenReplayValidator = (DateTime? expirationTime, string securityToken, TokenValidationParameters validationParameters) =>    // GOOD
+                {
+                    if (securityToken is null)
+                    {
+                        return false;
+                    }
+                    return true;
+                };
+
+            tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetime02(securityToken, validationParameters); // GOOD
+            tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => {return securityToken is null?false:true; }; // GOOD
+            
+            tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return true; }; // BUG 
+            tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => !false ; // BUG
+            tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return securityToken is null?true:true; }; // BUG
+            tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return ValidateLifetimeAlwaysTrue(securityToken, validationParameters);}; //BUG
+            tokenValidationParamsBaseline.AudienceValidator = (audiences, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); //BUG
+
+        }
+
+        internal static bool ValidateLifetime02(
+            SecurityToken token,
+            TokenValidationParameters validationParameters)
+        {
+            return token is null?false:true;
+        }
+
+        internal static bool ValidateLifetimeAlwaysTrue02(
+            SecurityToken token,
+            TokenValidationParameters validationParameters)
+        {
+            return !false;
+        }
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-test.cs b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-test.cs
new file mode 100644
index 00000000000..505aba41416
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-test.cs	
@@ -0,0 +1,43 @@
+using System;
+using System.Collections.Generic;
+using Microsoft.IdentityModel.Tokens;
+
+namespace JsonWebTokenHandlerTest
+{
+    public class JsonWebTokenHandler_class01
+    {
+        public void TestCase01()
+        {
+            TokenValidationParameters tokenValidationParamsBaseline = new TokenValidationParameters
+            {
+                ClockSkew = TimeSpan.FromMinutes(5),
+                ValidateActor = true,
+                ValidateIssuerSigningKey = true,
+                ValidateIssuer = true,
+                ValidateAudience = true,
+                ValidateLifetime = true,
+                RequireExpirationTime = true,
+                ValidateTokenReplay = true,
+                RequireSignedTokens = true,
+                RequireAudience = true,
+                SaveSigninToken = true
+            };
+
+            TokenValidationParameters tokenValidationParams = new TokenValidationParameters
+            {
+                ClockSkew = TimeSpan.FromMinutes(5),
+                ValidateActor = false,
+                ValidateIssuerSigningKey = false,
+                ValidateIssuer = false,             // BUG
+                ValidateAudience = false,           // BUG
+                ValidateLifetime = false,           // BUG
+                RequireExpirationTime = false,      // BUG
+                ValidateTokenReplay = false,
+                RequireSignedTokens = false,
+                RequireAudience = false,            // BUG
+                SaveSigninToken = false
+            };
+        }
+
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.expected b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.expected
new file mode 100644
index 00000000000..4a0a5afce6f
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.expected	
@@ -0,0 +1,5 @@
+| security-validation-disabled-test.cs:31:34:31:38 | false | The security sensitive property $@ is being disabled by the following value: $@. | stubs.cs:43:21:43:34 | ValidateIssuer | Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateIssuer | security-validation-disabled-test.cs:31:34:31:38 | false | false |
+| security-validation-disabled-test.cs:32:36:32:40 | false | The security sensitive property $@ is being disabled by the following value: $@. | stubs.cs:44:21:44:36 | ValidateAudience | Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateAudience | security-validation-disabled-test.cs:32:36:32:40 | false | false |
+| security-validation-disabled-test.cs:33:36:33:40 | false | The security sensitive property $@ is being disabled by the following value: $@. | stubs.cs:45:21:45:36 | ValidateLifetime | Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateLifetime | security-validation-disabled-test.cs:33:36:33:40 | false | false |
+| security-validation-disabled-test.cs:34:41:34:45 | false | The security sensitive property $@ is being disabled by the following value: $@. | stubs.cs:51:21:51:41 | RequireExpirationTime | Microsoft.IdentityModel.Tokens.TokenValidationParameters.RequireExpirationTime | security-validation-disabled-test.cs:34:41:34:45 | false | false |
+| security-validation-disabled-test.cs:37:35:37:39 | false | The security sensitive property $@ is being disabled by the following value: $@. | stubs.cs:50:21:50:35 | RequireAudience | Microsoft.IdentityModel.Tokens.TokenValidationParameters.RequireAudience | security-validation-disabled-test.cs:37:35:37:39 | false | false |
diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.qlref b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.qlref
new file mode 100644
index 00000000000..ee07957fa06
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.qlref	
@@ -0,0 +1 @@
+experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.ql
\ No newline at end of file
diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/stubs.cs b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/stubs.cs
new file mode 100644
index 00000000000..1d0e0de00a3
--- /dev/null
+++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/stubs.cs	
@@ -0,0 +1,115 @@
+using System;
+using System.Collections.Generic;
+
+namespace Microsoft.IdentityModel
+{
+
+}
+
+namespace Microsoft.IdentityModel.Tokens
+{
+    public abstract class SecurityToken
+    {
+        protected SecurityToken() { }
+        public string Id { get; }
+        public string Issuer { get; }
+        public DateTime ValidFrom { get; }
+        public DateTime ValidTo { get; }
+    }
+
+    public abstract class TokenHandler
+    {
+        public static readonly int DefaultTokenLifetimeInMinutes;
+
+        protected TokenHandler() { }
+
+        public virtual int MaximumTokenSizeInBytes { get; set; }
+        public bool SetDefaultTimesOnTokenCreation { get; set; }
+        public int TokenLifetimeInMinutes { get; set; }
+    }
+
+    public delegate bool LifetimeValidator(DateTime? notBefore, DateTime? expires, SecurityToken securityToken, TokenValidationParameters validationParameters);
+    public delegate bool AudienceValidator(IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters);
+    public delegate bool TokenReplayValidator(DateTime? expirationTime, string securityToken, TokenValidationParameters validationParameters);
+    public delegate string IssuerValidator(string issuer, SecurityToken securityToken, TokenValidationParameters validationParameters);
+
+    public class TokenValidationParameters
+    {
+        public const int DefaultMaximumTokenSizeInBytes = 256000;
+        public static readonly string DefaultAuthenticationType;
+        public static readonly TimeSpan DefaultClockSkew;
+        public TimeSpan ClockSkew { get; set; }
+        public bool SaveSigninToken { get; set; }
+        public bool ValidateIssuer { get; set; }
+        public bool ValidateAudience { get; set; }
+        public bool ValidateLifetime { get; set; }
+        public bool ValidateIssuerSigningKey { get; set; }
+        public bool ValidateTokenReplay { get; set; }
+        public bool ValidateActor { get; set; }
+        public bool RequireSignedTokens { get; set; }
+        public bool RequireAudience { get; set; }
+        public bool RequireExpirationTime { get; set; }
+
+        // Delegation
+        public LifetimeValidator LifetimeValidator { get; set; }
+        public AudienceValidator AudienceValidator { get; set; }
+        public TokenReplayValidator TokenReplayValidator { get; set; }
+        public IssuerValidator IssuerValidator { get; set; }
+
+        /*
+        public TokenValidationParameters() { }
+        public SignatureValidator SignatureValidator { get; set; }
+        public SecurityKey TokenDecryptionKey { get; set; }
+        public TokenDecryptionKeyResolver TokenDecryptionKeyResolver { get; set; }
+        public IEnumerable<SecurityKey> TokenDecryptionKeys { get; set; }
+        public TokenReader TokenReader { get; set; }
+        public ITokenReplayCache TokenReplayCache { get; set; }
+        public Func<SecurityToken, string, string> RoleClaimTypeRetriever { get; set; }
+        public string ValidAudience { get; set; }
+        public IEnumerable<string> ValidAudiences { get; set; }
+        public string ValidIssuer { get; set; }
+        public IEnumerable<string> ValidIssuers { get; set; }
+        public TokenValidationParameters ActorValidationParameters { get; set; }
+        public AudienceValidator AudienceValidator { get; set; }
+        public string AuthenticationType { get; set; }
+        public CryptoProviderFactory CryptoProviderFactory { get; set; }
+        public IssuerSigningKeyValidator IssuerSigningKeyValidator { get; set; }
+        public SecurityKey IssuerSigningKey { get; set; }
+        public IEnumerable<SecurityKey> IssuerSigningKeys { get; set; }
+        public IssuerValidator IssuerValidator { get; set; }
+        public string NameClaimType { get; set; }
+        public string RoleClaimType { get; set; }
+        public Func<SecurityToken, string, string> NameClaimTypeRetriever { get; set; }
+        public IDictionary<string, object> PropertyBag { get; set; }
+        public IssuerSigningKeyResolver IssuerSigningKeyResolver { get; set; }
+        public IEnumerable<string> ValidTypes { get; set; }
+        public virtual TokenValidationParameters Clone();
+        public virtual string CreateClaimsIdentity(SecurityToken securityToken, string issuer);
+        */
+    }
+
+}
+
+namespace Microsoft.IdentityModel.JsonWebTokens
+{
+    public class JsonWebTokenHandler : Microsoft.IdentityModel.Tokens.TokenHandler
+    {
+        public virtual TokenValidationResult ValidateToken(string token, Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters)
+        {
+            return new TokenValidationResult() { IsValid = true, Exception = null, Issuer = "test" };
+        }
+    }
+
+    public class TokenValidationResult
+    {
+        public TokenValidationResult() { }
+
+        public Exception Exception { get; set; }
+        public string Issuer { get; set; }
+        public bool IsValid { get; set; }
+        public Microsoft.IdentityModel.Tokens.SecurityToken SecurityToken { get; set; }
+        public string ClaimsIdentity { get; set; }
+    }
+
+
+}
diff --git a/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs b/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs
index 26b6936543f..7f307e390ea 100644
--- a/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs
+++ b/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs
@@ -112,6 +112,14 @@ namespace My.Qltest
             Sink(f.MyProp);
         }
 
+        void M17()
+        {
+            var a = new object[] { new object() };
+            var b = Reverse(a);
+            Sink(b); // No flow
+            Sink(b[0]); // Flow
+        }
+
         object StepArgRes(object x) { return null; }
 
         void StepArgArg(object @in, object @out) { }
@@ -147,6 +155,8 @@ namespace My.Qltest
 
         static void Parse(string s, out int i) => throw null;
 
+        static object[] Reverse(object[] elements) => throw null;
+
         static void Sink(object o) { }
     }
 
diff --git a/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected b/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected
index cf22a1ee1b1..1cddde807fb 100644
--- a/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected
+++ b/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected
@@ -56,14 +56,19 @@ edges
 | ExternalFlow.cs:111:13:111:13 | [post] access to local variable f [field MyField] : Object | ExternalFlow.cs:112:18:112:18 | access to local variable f [field MyField] : Object |
 | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | ExternalFlow.cs:111:13:111:13 | [post] access to local variable f [field MyField] : Object |
 | ExternalFlow.cs:112:18:112:18 | access to local variable f [field MyField] : Object | ExternalFlow.cs:112:18:112:25 | access to property MyProp |
-| ExternalFlow.cs:177:21:177:32 | object creation of type Object : Object | ExternalFlow.cs:178:32:178:32 | access to local variable o : Object |
-| ExternalFlow.cs:178:32:178:32 | access to local variable o : Object | ExternalFlow.cs:178:18:178:33 | call to method GeneratedFlow |
-| ExternalFlow.cs:183:22:183:33 | object creation of type Object : Object | ExternalFlow.cs:184:36:184:37 | access to local variable o1 : Object |
-| ExternalFlow.cs:184:36:184:37 | access to local variable o1 : Object | ExternalFlow.cs:184:18:184:44 | call to method GeneratedFlowArgs |
-| ExternalFlow.cs:186:22:186:33 | object creation of type Object : Object | ExternalFlow.cs:187:42:187:43 | access to local variable o2 : Object |
-| ExternalFlow.cs:187:42:187:43 | access to local variable o2 : Object | ExternalFlow.cs:187:18:187:44 | call to method GeneratedFlowArgs |
-| ExternalFlow.cs:195:22:195:33 | object creation of type Object : Object | ExternalFlow.cs:196:38:196:39 | access to local variable o2 : Object |
-| ExternalFlow.cs:196:38:196:39 | access to local variable o2 : Object | ExternalFlow.cs:196:18:196:40 | call to method MixedFlowArgs |
+| ExternalFlow.cs:117:34:117:49 | { ..., ... } [element] : Object | ExternalFlow.cs:118:29:118:29 | access to local variable a [element] : Object |
+| ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | ExternalFlow.cs:117:34:117:49 | { ..., ... } [element] : Object |
+| ExternalFlow.cs:118:21:118:30 | call to method Reverse [element] : Object | ExternalFlow.cs:120:18:120:18 | access to local variable b [element] : Object |
+| ExternalFlow.cs:118:29:118:29 | access to local variable a [element] : Object | ExternalFlow.cs:118:21:118:30 | call to method Reverse [element] : Object |
+| ExternalFlow.cs:120:18:120:18 | access to local variable b [element] : Object | ExternalFlow.cs:120:18:120:21 | access to array element |
+| ExternalFlow.cs:187:21:187:32 | object creation of type Object : Object | ExternalFlow.cs:188:32:188:32 | access to local variable o : Object |
+| ExternalFlow.cs:188:32:188:32 | access to local variable o : Object | ExternalFlow.cs:188:18:188:33 | call to method GeneratedFlow |
+| ExternalFlow.cs:193:22:193:33 | object creation of type Object : Object | ExternalFlow.cs:194:36:194:37 | access to local variable o1 : Object |
+| ExternalFlow.cs:194:36:194:37 | access to local variable o1 : Object | ExternalFlow.cs:194:18:194:44 | call to method GeneratedFlowArgs |
+| ExternalFlow.cs:196:22:196:33 | object creation of type Object : Object | ExternalFlow.cs:197:42:197:43 | access to local variable o2 : Object |
+| ExternalFlow.cs:197:42:197:43 | access to local variable o2 : Object | ExternalFlow.cs:197:18:197:44 | call to method GeneratedFlowArgs |
+| ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object |
+| ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs |
 nodes
 | ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 | ExternalFlow.cs:10:18:10:33 | call to method StepArgRes | semmle.label | call to method StepArgRes |
@@ -138,18 +143,24 @@ nodes
 | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 | ExternalFlow.cs:112:18:112:18 | access to local variable f [field MyField] : Object | semmle.label | access to local variable f [field MyField] : Object |
 | ExternalFlow.cs:112:18:112:25 | access to property MyProp | semmle.label | access to property MyProp |
-| ExternalFlow.cs:177:21:177:32 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| ExternalFlow.cs:178:18:178:33 | call to method GeneratedFlow | semmle.label | call to method GeneratedFlow |
-| ExternalFlow.cs:178:32:178:32 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| ExternalFlow.cs:183:22:183:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| ExternalFlow.cs:184:18:184:44 | call to method GeneratedFlowArgs | semmle.label | call to method GeneratedFlowArgs |
-| ExternalFlow.cs:184:36:184:37 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
-| ExternalFlow.cs:186:22:186:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| ExternalFlow.cs:187:18:187:44 | call to method GeneratedFlowArgs | semmle.label | call to method GeneratedFlowArgs |
-| ExternalFlow.cs:187:42:187:43 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
-| ExternalFlow.cs:195:22:195:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| ExternalFlow.cs:196:18:196:40 | call to method MixedFlowArgs | semmle.label | call to method MixedFlowArgs |
-| ExternalFlow.cs:196:38:196:39 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
+| ExternalFlow.cs:117:34:117:49 | { ..., ... } [element] : Object | semmle.label | { ..., ... } [element] : Object |
+| ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
+| ExternalFlow.cs:118:21:118:30 | call to method Reverse [element] : Object | semmle.label | call to method Reverse [element] : Object |
+| ExternalFlow.cs:118:29:118:29 | access to local variable a [element] : Object | semmle.label | access to local variable a [element] : Object |
+| ExternalFlow.cs:120:18:120:18 | access to local variable b [element] : Object | semmle.label | access to local variable b [element] : Object |
+| ExternalFlow.cs:120:18:120:21 | access to array element | semmle.label | access to array element |
+| ExternalFlow.cs:187:21:187:32 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
+| ExternalFlow.cs:188:18:188:33 | call to method GeneratedFlow | semmle.label | call to method GeneratedFlow |
+| ExternalFlow.cs:188:32:188:32 | access to local variable o : Object | semmle.label | access to local variable o : Object |
+| ExternalFlow.cs:193:22:193:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
+| ExternalFlow.cs:194:18:194:44 | call to method GeneratedFlowArgs | semmle.label | call to method GeneratedFlowArgs |
+| ExternalFlow.cs:194:36:194:37 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
+| ExternalFlow.cs:196:22:196:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
+| ExternalFlow.cs:197:18:197:44 | call to method GeneratedFlowArgs | semmle.label | call to method GeneratedFlowArgs |
+| ExternalFlow.cs:197:42:197:43 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
+| ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
+| ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | semmle.label | call to method MixedFlowArgs |
+| ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
 subpaths
 invalidModelRow
 #select
@@ -172,7 +183,8 @@ invalidModelRow
 | ExternalFlow.cs:102:22:102:22 | access to parameter d | ExternalFlow.cs:98:24:98:35 | object creation of type Object : Object | ExternalFlow.cs:102:22:102:22 | access to parameter d | $@ | ExternalFlow.cs:98:24:98:35 | object creation of type Object : Object | object creation of type Object : Object |
 | ExternalFlow.cs:104:18:104:25 | access to field Field | ExternalFlow.cs:98:24:98:35 | object creation of type Object : Object | ExternalFlow.cs:104:18:104:25 | access to field Field | $@ | ExternalFlow.cs:98:24:98:35 | object creation of type Object : Object | object creation of type Object : Object |
 | ExternalFlow.cs:112:18:112:25 | access to property MyProp | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | ExternalFlow.cs:112:18:112:25 | access to property MyProp | $@ | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | object creation of type Object : Object |
-| ExternalFlow.cs:178:18:178:33 | call to method GeneratedFlow | ExternalFlow.cs:177:21:177:32 | object creation of type Object : Object | ExternalFlow.cs:178:18:178:33 | call to method GeneratedFlow | $@ | ExternalFlow.cs:177:21:177:32 | object creation of type Object : Object | object creation of type Object : Object |
-| ExternalFlow.cs:184:18:184:44 | call to method GeneratedFlowArgs | ExternalFlow.cs:183:22:183:33 | object creation of type Object : Object | ExternalFlow.cs:184:18:184:44 | call to method GeneratedFlowArgs | $@ | ExternalFlow.cs:183:22:183:33 | object creation of type Object : Object | object creation of type Object : Object |
-| ExternalFlow.cs:187:18:187:44 | call to method GeneratedFlowArgs | ExternalFlow.cs:186:22:186:33 | object creation of type Object : Object | ExternalFlow.cs:187:18:187:44 | call to method GeneratedFlowArgs | $@ | ExternalFlow.cs:186:22:186:33 | object creation of type Object : Object | object creation of type Object : Object |
-| ExternalFlow.cs:196:18:196:40 | call to method MixedFlowArgs | ExternalFlow.cs:195:22:195:33 | object creation of type Object : Object | ExternalFlow.cs:196:18:196:40 | call to method MixedFlowArgs | $@ | ExternalFlow.cs:195:22:195:33 | object creation of type Object : Object | object creation of type Object : Object |
+| ExternalFlow.cs:120:18:120:21 | access to array element | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | ExternalFlow.cs:120:18:120:21 | access to array element | $@ | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | object creation of type Object : Object |
+| ExternalFlow.cs:188:18:188:33 | call to method GeneratedFlow | ExternalFlow.cs:187:21:187:32 | object creation of type Object : Object | ExternalFlow.cs:188:18:188:33 | call to method GeneratedFlow | $@ | ExternalFlow.cs:187:21:187:32 | object creation of type Object : Object | object creation of type Object : Object |
+| ExternalFlow.cs:194:18:194:44 | call to method GeneratedFlowArgs | ExternalFlow.cs:193:22:193:33 | object creation of type Object : Object | ExternalFlow.cs:194:18:194:44 | call to method GeneratedFlowArgs | $@ | ExternalFlow.cs:193:22:193:33 | object creation of type Object : Object | object creation of type Object : Object |
+| ExternalFlow.cs:197:18:197:44 | call to method GeneratedFlowArgs | ExternalFlow.cs:196:22:196:33 | object creation of type Object : Object | ExternalFlow.cs:197:18:197:44 | call to method GeneratedFlowArgs | $@ | ExternalFlow.cs:196:22:196:33 | object creation of type Object : Object | object creation of type Object : Object |
+| ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | $@ | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | object creation of type Object : Object |
diff --git a/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ql b/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ql
index 421216ad418..fbc4f357e10 100644
--- a/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ql
+++ b/csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ql
@@ -29,6 +29,7 @@ class SummaryModelTest extends SummaryModelCsv {
         "My.Qltest;D;false;Map<,>;(S[],System.Func<S,T>);;Argument[0].Element;Argument[1].Parameter[0];value;manual",
         "My.Qltest;D;false;Map<,>;(S[],System.Func<S,T>);;Argument[1].ReturnValue;ReturnValue.Element;value;manual",
         "My.Qltest;D;false;Parse;(System.String,System.Int32);;Argument[0];Argument[1];taint;manual",
+        "My.Qltest;D;false;Reverse;(System.Object[]);;Argument[0].WithElement;ReturnValue;value;manual",
         "My.Qltest;E;true;get_MyProp;();;Argument[this].Field[My.Qltest.E.MyField];ReturnValue;value;manual",
         "My.Qltest;E;true;set_MyProp;(System.Object);;Argument[0];Argument[this].Field[My.Qltest.E.MyField];value;manual",
         "My.Qltest;G;false;GeneratedFlow;(System.Object);;Argument[0];ReturnValue;value;generated",
diff --git a/csharp/ql/test/library-tests/dataflow/external-models/steps.expected b/csharp/ql/test/library-tests/dataflow/external-models/steps.expected
index af0e9cdfe4b..f73872ed9be 100644
--- a/csharp/ql/test/library-tests/dataflow/external-models/steps.expected
+++ b/csharp/ql/test/library-tests/dataflow/external-models/steps.expected
@@ -19,6 +19,3 @@ summarySetterStep
 | Steps.cs:30:34:30:34 | 0 | Steps.cs:30:13:30:16 | [post] this access | Steps.cs:57:13:57:17 | field Field |
 | Steps.cs:34:37:34:37 | 0 | Steps.cs:34:13:34:16 | [post] this access | Steps.cs:63:13:63:20 | property Property |
 | Steps.cs:38:36:38:36 | 0 | Steps.cs:38:13:38:16 | [post] this access | file://:0:0:0:0 | element |
-clearsContent
-| Steps.cs:61:14:61:28 | StepFieldSetter | file://:0:0:0:0 | element | this |
-| Steps.cs:67:14:67:31 | StepPropertySetter | file://:0:0:0:0 | element | this |
diff --git a/csharp/ql/test/library-tests/dataflow/external-models/steps.ql b/csharp/ql/test/library-tests/dataflow/external-models/steps.ql
index ec271687a13..34b8fedf688 100644
--- a/csharp/ql/test/library-tests/dataflow/external-models/steps.ql
+++ b/csharp/ql/test/library-tests/dataflow/external-models/steps.ql
@@ -29,18 +29,6 @@ private class SummaryModelTest extends SummaryModelCsv {
   }
 }
 
-private class SummarizedCallableClear extends SummarizedCallable {
-  SummarizedCallableClear() {
-    this.getName() = ["StepPropertySetter", "StepFieldSetter"] and
-    this.getFile().getBaseName() = "Steps.cs"
-  }
-
-  override predicate clearsContent(ParameterPosition pos, DataFlow::ContentSet content) {
-    pos.isThisParameter() and
-    content instanceof DataFlow::ElementContent
-  }
-}
-
 query predicate summaryThroughStep(
   DataFlow::Node node1, DataFlow::Node node2, boolean preservesValue
 ) {
@@ -62,8 +50,3 @@ query predicate summarySetterStep(DataFlow::Node arg, DataFlow::Node out, Conten
   FlowSummaryImpl::Private::Steps::summarySetterStep(arg, c, out,
     any(DataFlowDispatch::DataFlowSummarizedCallable sc))
 }
-
-query predicate clearsContent(SummarizedCallable c, DataFlow::Content k, ParameterPosition pos) {
-  c.clearsContent(pos, k) and
-  c.fromSource()
-}
diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
index da1dca9dd24..d3955e54ff6 100644
--- a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
+++ b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
@@ -6,6 +6,7 @@ summary
 | Microsoft.AspNetCore.Connections;ConnectionItems;false;Add;(System.Collections.Generic.KeyValuePair<System.Object,System.Object>);;Argument[0];Argument[this].Element;value;manual |
 | Microsoft.AspNetCore.Connections;ConnectionItems;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | Microsoft.AspNetCore.Connections;ConnectionItems;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| Microsoft.AspNetCore.Connections;ConnectionItems;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.AspNetCore.Connections;ConnectionItems;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.Object,System.Object>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Microsoft.AspNetCore.Connections;ConnectionItems;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Microsoft.AspNetCore.Connections;ConnectionItems;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -25,6 +26,7 @@ summary
 | Microsoft.AspNetCore.Http;HeaderDictionary;false;Add;(System.Collections.Generic.KeyValuePair<System.String,Microsoft.Extensions.Primitives.StringValues>);;Argument[0];Argument[this].Element;value;manual |
 | Microsoft.AspNetCore.Http;HeaderDictionary;false;Add;(System.String,Microsoft.Extensions.Primitives.StringValues);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | Microsoft.AspNetCore.Http;HeaderDictionary;false;Add;(System.String,Microsoft.Extensions.Primitives.StringValues);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| Microsoft.AspNetCore.Http;HeaderDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.AspNetCore.Http;HeaderDictionary;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,Microsoft.Extensions.Primitives.StringValues>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Microsoft.AspNetCore.Http;HeaderDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Microsoft.AspNetCore.Http;HeaderDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -46,6 +48,7 @@ summary
 | Microsoft.AspNetCore.Mvc.ModelBinding.Validation;ValidationStateDictionary;false;Add;(System.Collections.Generic.KeyValuePair<System.Object,Microsoft.AspNetCore.Mvc.ModelBinding.Validation.ValidationStateEntry>);;Argument[0];Argument[this].Element;value;manual |
 | Microsoft.AspNetCore.Mvc.ModelBinding.Validation;ValidationStateDictionary;false;Add;(System.Object,Microsoft.AspNetCore.Mvc.ModelBinding.Validation.ValidationStateEntry);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | Microsoft.AspNetCore.Mvc.ModelBinding.Validation;ValidationStateDictionary;false;Add;(System.Object,Microsoft.AspNetCore.Mvc.ModelBinding.Validation.ValidationStateEntry);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| Microsoft.AspNetCore.Mvc.ModelBinding.Validation;ValidationStateDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.AspNetCore.Mvc.ModelBinding.Validation;ValidationStateDictionary;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.Object,Microsoft.AspNetCore.Mvc.ModelBinding.Validation.ValidationStateEntry>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Microsoft.AspNetCore.Mvc.ModelBinding.Validation;ValidationStateDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Microsoft.AspNetCore.Mvc.ModelBinding.Validation;ValidationStateDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -71,6 +74,7 @@ summary
 | Microsoft.AspNetCore.Mvc.ViewFeatures;AttributeDictionary;false;Add;(System.Collections.Generic.KeyValuePair<System.String,System.String>);;Argument[0];Argument[this].Element;value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;AttributeDictionary;false;Add;(System.String,System.String);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;AttributeDictionary;false;Add;(System.String,System.String);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| Microsoft.AspNetCore.Mvc.ViewFeatures;AttributeDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;AttributeDictionary;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,System.String>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;AttributeDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;AttributeDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -82,6 +86,7 @@ summary
 | Microsoft.AspNetCore.Mvc.ViewFeatures;TempDataDictionary;false;Add;(System.Collections.Generic.KeyValuePair<System.String,System.Object>);;Argument[0];Argument[this].Element;value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;TempDataDictionary;false;Add;(System.String,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;TempDataDictionary;false;Add;(System.String,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| Microsoft.AspNetCore.Mvc.ViewFeatures;TempDataDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;TempDataDictionary;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,System.Object>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;TempDataDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;TempDataDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -93,6 +98,7 @@ summary
 | Microsoft.AspNetCore.Mvc.ViewFeatures;ViewDataDictionary;false;Add;(System.Collections.Generic.KeyValuePair<System.String,System.Object>);;Argument[0];Argument[this].Element;value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;ViewDataDictionary;false;Add;(System.String,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;ViewDataDictionary;false;Add;(System.String,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| Microsoft.AspNetCore.Mvc.ViewFeatures;ViewDataDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;ViewDataDictionary;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,System.Object>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;ViewDataDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;ViewDataDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -112,12 +118,14 @@ summary
 | Microsoft.AspNetCore.Razor.TagHelpers;NullHtmlEncoder;false;Encode;(System.IO.TextWriter,System.String,System.Int32,System.Int32);;Argument[1];Argument[0];taint;generated |
 | Microsoft.AspNetCore.Razor.TagHelpers;NullHtmlEncoder;false;Encode;(System.String);;Argument[0];ReturnValue;taint;generated |
 | Microsoft.AspNetCore.Razor.TagHelpers;TagHelperAttributeList;false;Add;(Microsoft.AspNetCore.Razor.TagHelpers.TagHelperAttribute);;Argument[0];Argument[this].Element;value;manual |
+| Microsoft.AspNetCore.Razor.TagHelpers;TagHelperAttributeList;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.AspNetCore.Razor.TagHelpers;TagHelperAttributeList;false;Insert;(System.Int32,Microsoft.AspNetCore.Razor.TagHelpers.TagHelperAttribute);;Argument[1];Argument[this].Element;value;manual |
 | Microsoft.AspNetCore.Razor.TagHelpers;TagHelperAttributeList;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | Microsoft.AspNetCore.Razor.TagHelpers;TagHelperAttributeList;false;set_Item;(System.Int32,Microsoft.AspNetCore.Razor.TagHelpers.TagHelperAttribute);;Argument[1];Argument[this].Element;value;manual |
 | Microsoft.AspNetCore.Routing;RouteValueDictionary;false;Add;(System.Collections.Generic.KeyValuePair<System.String,System.Object>);;Argument[0];Argument[this].Element;value;manual |
 | Microsoft.AspNetCore.Routing;RouteValueDictionary;false;Add;(System.String,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | Microsoft.AspNetCore.Routing;RouteValueDictionary;false;Add;(System.String,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| Microsoft.AspNetCore.Routing;RouteValueDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.AspNetCore.Routing;RouteValueDictionary;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,System.Object>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Microsoft.AspNetCore.Routing;RouteValueDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Microsoft.AspNetCore.Routing;RouteValueDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -127,6 +135,7 @@ summary
 | Microsoft.AspNetCore.Routing;RouteValueDictionary;false;set_Item;(System.String,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | Microsoft.AspNetCore.Routing;RouteValueDictionary;false;set_Item;(System.String,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | Microsoft.AspNetCore.Server.HttpSys;UrlPrefixCollection;false;Add;(Microsoft.AspNetCore.Server.HttpSys.UrlPrefix);;Argument[0];Argument[this].Element;value;manual |
+| Microsoft.AspNetCore.Server.HttpSys;UrlPrefixCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.AspNetCore.Server.HttpSys;UrlPrefixCollection;false;CopyTo;(Microsoft.AspNetCore.Server.HttpSys.UrlPrefix[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Microsoft.AspNetCore.Server.HttpSys;UrlPrefixCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Microsoft.AspNetCore.Server.HttpSys;UrlPrefixCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -134,19 +143,24 @@ summary
 | Microsoft.AspNetCore.Server.IIS.Core;ThrowingWasUpgradedWriteOnlyStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
 | Microsoft.AspNetCore.Server.IIS.Core;WriteOnlyStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | Microsoft.AspNetCore.Server.IIS.Core;WriteOnlyStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | Microsoft.AspNetCore.WebUtilities;BufferedReadStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | Microsoft.AspNetCore.WebUtilities;BufferedReadStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| Microsoft.AspNetCore.WebUtilities;BufferedReadStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | Microsoft.AspNetCore.WebUtilities;BufferedReadStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | Microsoft.AspNetCore.WebUtilities;BufferedReadStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
 | Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;false;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
 | Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | Microsoft.AspNetCore.WebUtilities;FileBufferingReadStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
 | Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| Microsoft.AspNetCore.WebUtilities;FileBufferingWriteStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;false;Read;();;Argument[this];ReturnValue;taint;manual |
 | Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;false;Read;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;manual |
 | Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;false;Read;(System.Span<System.Char>);;Argument[this];ReturnValue;taint;manual |
@@ -155,8 +169,18 @@ summary
 | Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;false;ReadLine;();;Argument[this];ReturnValue;taint;manual |
 | Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;false;ReadLineAsync;();;Argument[this];ReturnValue;taint;manual |
 | Microsoft.AspNetCore.WebUtilities;HttpRequestStreamReader;false;ReadToEndAsync;();;Argument[this];ReturnValue;taint;manual |
+| Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;FlushAsync;();;Argument[this];ReturnValue;taint;generated |
+| Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
+| Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| Microsoft.AspNetCore.WebUtilities;HttpResponseStreamWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | Microsoft.CSharp.RuntimeBinder;Binder;false;BinaryOperation;(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.Linq.Expressions.ExpressionType,System.Type,System.Collections.Generic.IEnumerable<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>);;Argument[2];ReturnValue;taint;generated |
 | Microsoft.CSharp.RuntimeBinder;Binder;false;BinaryOperation;(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.Linq.Expressions.ExpressionType,System.Type,System.Collections.Generic.IEnumerable<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>);;Argument[3].Element;ReturnValue;taint;generated |
 | Microsoft.CSharp.RuntimeBinder;Binder;false;Convert;(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.Type,System.Type);;Argument[2];ReturnValue;taint;generated |
@@ -363,6 +387,7 @@ summary
 | Microsoft.Extensions.DependencyInjection;OptionsServiceCollectionExtensions;false;ConfigureOptions;(Microsoft.Extensions.DependencyInjection.IServiceCollection,System.Type);;Argument[0].Element;ReturnValue;taint;generated |
 | Microsoft.Extensions.DependencyInjection;OptionsServiceCollectionExtensions;false;ConfigureOptions<>;(Microsoft.Extensions.DependencyInjection.IServiceCollection);;Argument[0].Element;ReturnValue;taint;generated |
 | Microsoft.Extensions.DependencyInjection;ServiceCollection;false;Add;(Microsoft.Extensions.DependencyInjection.ServiceDescriptor);;Argument[0];Argument[this].Element;value;manual |
+| Microsoft.Extensions.DependencyInjection;ServiceCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.Extensions.DependencyInjection;ServiceCollection;false;CopyTo;(Microsoft.Extensions.DependencyInjection.ServiceDescriptor[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Microsoft.Extensions.DependencyInjection;ServiceCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Microsoft.Extensions.DependencyInjection;ServiceCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -397,6 +422,7 @@ summary
 | Microsoft.Extensions.FileProviders.Internal;PhysicalDirectoryContents;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | Microsoft.Extensions.FileProviders.Internal;PhysicalDirectoryContents;false;PhysicalDirectoryContents;(System.String,Microsoft.Extensions.FileProviders.Physical.ExclusionFilters);;Argument[0];Argument[this];taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalDirectoryInfo;false;PhysicalDirectoryInfo;(System.IO.DirectoryInfo);;Argument[0];Argument[this];taint;generated |
+| Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;CreateReadStream;();;Argument[this];ReturnValue;taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;PhysicalFileInfo;(System.IO.FileInfo);;Argument[0];Argument[this];taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;get_PhysicalPath;();;Argument[this];ReturnValue;taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalFilesWatcher;false;PhysicalFilesWatcher;(System.String,System.IO.FileSystemWatcher,System.Boolean,Microsoft.Extensions.FileProviders.Physical.ExclusionFilters);;Argument[0];Argument[this];taint;generated |
@@ -506,6 +532,7 @@ summary
 | Microsoft.Extensions.Primitives;StringValues;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
 | Microsoft.Extensions.Primitives;StringValues;false;Add;(System.String);;Argument[0];ReturnValue;taint;manual |
 | Microsoft.Extensions.Primitives;StringValues;false;Add;(System.String);;Argument[this];ReturnValue;taint;manual |
+| Microsoft.Extensions.Primitives;StringValues;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.Extensions.Primitives;StringValues;false;Concat;(Microsoft.Extensions.Primitives.StringValues,Microsoft.Extensions.Primitives.StringValues);;Argument[0];ReturnValue;taint;manual |
 | Microsoft.Extensions.Primitives;StringValues;false;Concat;(Microsoft.Extensions.Primitives.StringValues,Microsoft.Extensions.Primitives.StringValues);;Argument[1];ReturnValue;taint;manual |
 | Microsoft.Extensions.Primitives;StringValues;false;Concat;(Microsoft.Extensions.Primitives.StringValues,System.String);;Argument[0];ReturnValue;taint;manual |
@@ -574,6 +601,7 @@ summary
 | Microsoft.Extensions.WebEncoders.Testing;UrlTestEncoder;false;Encode;(System.IO.TextWriter,System.String,System.Int32,System.Int32);;Argument[1];Argument[0];taint;generated |
 | Microsoft.Extensions.WebEncoders.Testing;UrlTestEncoder;false;Encode;(System.String);;Argument[0];ReturnValue;taint;generated |
 | Microsoft.VisualBasic;Collection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
+| Microsoft.VisualBasic;Collection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.VisualBasic;Collection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Microsoft.VisualBasic;Collection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | Microsoft.VisualBasic;Collection;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
@@ -590,6 +618,7 @@ summary
 | Microsoft.Win32;RegistryKey;false;get_Handle;();;Argument[this];ReturnValue;taint;generated |
 | Microsoft.Win32;RegistryKey;false;get_Name;();;Argument[this];ReturnValue;taint;generated |
 | Newtonsoft.Json.Linq;JArray;false;Add;(Newtonsoft.Json.Linq.JToken);;Argument[0];Argument[this].Element;value;manual |
+| Newtonsoft.Json.Linq;JArray;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Newtonsoft.Json.Linq;JArray;false;CopyTo;(Newtonsoft.Json.Linq.JToken[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Newtonsoft.Json.Linq;JArray;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Newtonsoft.Json.Linq;JArray;false;Insert;(System.Int32,Newtonsoft.Json.Linq.JToken);;Argument[1];Argument[this].Element;value;manual |
@@ -601,6 +630,7 @@ summary
 | Newtonsoft.Json.Linq;JConstructor;false;set_Item;(System.Object,Newtonsoft.Json.Linq.JToken);;Argument[1];Argument[this].Element;value;manual |
 | Newtonsoft.Json.Linq;JContainer;false;Add;(Newtonsoft.Json.Linq.JToken);;Argument[0];Argument[this].Element;value;manual |
 | Newtonsoft.Json.Linq;JContainer;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
+| Newtonsoft.Json.Linq;JContainer;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Newtonsoft.Json.Linq;JContainer;false;CopyTo;(Newtonsoft.Json.Linq.JToken[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Newtonsoft.Json.Linq;JContainer;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Newtonsoft.Json.Linq;JContainer;false;Find;(System.ComponentModel.PropertyDescriptor,System.Object);;Argument[this].Element;ReturnValue;value;manual |
@@ -617,6 +647,7 @@ summary
 | Newtonsoft.Json.Linq;JObject;false;Add;(System.Collections.Generic.KeyValuePair<System.String,Newtonsoft.Json.Linq.JToken>);;Argument[0];Argument[this].Element;value;manual |
 | Newtonsoft.Json.Linq;JObject;false;Add;(System.String,Newtonsoft.Json.Linq.JToken);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | Newtonsoft.Json.Linq;JObject;false;Add;(System.String,Newtonsoft.Json.Linq.JToken);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| Newtonsoft.Json.Linq;JObject;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Newtonsoft.Json.Linq;JObject;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,Newtonsoft.Json.Linq.JToken>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | Newtonsoft.Json.Linq;JObject;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | Newtonsoft.Json.Linq;JObject;false;JObject;(Newtonsoft.Json.Linq.JObject);;Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
@@ -760,6 +791,7 @@ summary
 | System.CodeDom.Compiler;GeneratedCodeAttribute;false;GeneratedCodeAttribute;(System.String,System.String);;Argument[1];Argument[this];taint;generated |
 | System.CodeDom.Compiler;GeneratedCodeAttribute;false;get_Tool;();;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;GeneratedCodeAttribute;false;get_Version;();;Argument[this];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;FlushAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;IndentedTextWriter;(System.IO.TextWriter,System.String);;Argument[0];Argument[this];taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;IndentedTextWriter;(System.IO.TextWriter,System.String);;Argument[1];Argument[this];taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;Write;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
@@ -771,7 +803,14 @@ summary
 | System.CodeDom.Compiler;IndentedTextWriter;false;Write;(System.String,System.Object,System.Object);;Argument[2];Argument[this];taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;Write;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;Write;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;WriteLine;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;WriteLine;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
@@ -784,8 +823,19 @@ summary
 | System.CodeDom.Compiler;IndentedTextWriter;false;WriteLine;(System.String,System.Object,System.Object);;Argument[2];Argument[this];taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;WriteLine;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;WriteLine;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;();;Argument[this];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineNoTabsAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineNoTabsAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;get_Encoding;();;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;get_InnerWriter;();;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;get_NewLine;();;Argument[this];ReturnValue;taint;generated |
@@ -803,6 +853,7 @@ summary
 | System.Collections.Concurrent;BlockingCollection<>;false;TryAdd;(T,System.Int32,System.Threading.CancellationToken);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Concurrent;BlockingCollection<>;false;TryAdd;(T,System.TimeSpan);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Concurrent;ConcurrentBag<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Concurrent;ConcurrentBag<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Concurrent;ConcurrentBag<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Concurrent;ConcurrentBag<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Concurrent;ConcurrentBag<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -818,6 +869,7 @@ summary
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections.Concurrent;ConcurrentDictionary<,>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;ConcurrentDictionary;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;ConcurrentDictionary;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;ConcurrentDictionary;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
@@ -828,6 +880,7 @@ summary
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;CopyTo;(System.Collections.Generic.KeyValuePair<TKey,TValue>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
+| System.Collections.Concurrent;ConcurrentDictionary<,>;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;GetOrAdd;(TKey,TValue);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;get_Item;(System.Object);;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue;value;manual |
@@ -838,10 +891,12 @@ summary
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;set_Item;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;set_Item;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;set_Item;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections.Concurrent;ConcurrentQueue<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Concurrent;ConcurrentQueue<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Concurrent;ConcurrentQueue<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Concurrent;ConcurrentQueue<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Collections.Concurrent;ConcurrentQueue<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
+| System.Collections.Concurrent;ConcurrentStack<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Concurrent;ConcurrentStack<>;false;ConcurrentStack;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.Concurrent;ConcurrentStack<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Concurrent;ConcurrentStack<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
@@ -862,12 +917,16 @@ summary
 | System.Collections.Generic;CollectionExtensions;false;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey,TValue);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Generic;CollectionExtensions;false;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated |
 | System.Collections.Generic;CollectionExtensions;false;Remove<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[0].Element;Argument[2];taint;generated |
+| System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[1];Argument[0].Element;taint;generated |
+| System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[2];Argument[0].Element;taint;generated |
 | System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Entry;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Key;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Value;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+KeyCollection+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+KeyCollection;false;Add;(TKey);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;Dictionary<,>+KeyCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;Dictionary<,>+KeyCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Dictionary<,>+KeyCollection;false;CopyTo;(TKey[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Dictionary<,>+KeyCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.Dictionary<,>+KeyCollection+Enumerator.Current];value;manual |
@@ -877,6 +936,7 @@ summary
 | System.Collections.Generic;Dictionary<,>+KeyCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+ValueCollection+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+ValueCollection;false;Add;(TValue);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;Dictionary<,>+ValueCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;Dictionary<,>+ValueCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Dictionary<,>+ValueCollection;false;CopyTo;(TValue[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Dictionary<,>+ValueCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.Dictionary<,>+ValueCollection+Enumerator.Current];value;manual |
@@ -891,6 +951,7 @@ summary
 | System.Collections.Generic;Dictionary<,>;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Generic;Dictionary<,>;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Generic;Dictionary<,>;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections.Generic;Dictionary<,>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;Dictionary<,>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Dictionary<,>;false;CopyTo;(System.Collections.Generic.KeyValuePair<TKey,TValue>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Dictionary<,>;false;Dictionary;(System.Collections.Generic.IDictionary<TKey,TValue>);;Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
@@ -918,6 +979,7 @@ summary
 | System.Collections.Generic;Dictionary<,>;false;set_Item;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Generic;HashSet<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;HashSet<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;HashSet<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;HashSet<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;HashSet<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.HashSet<>+Enumerator.Current];value;manual |
 | System.Collections.Generic;HashSet<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -927,6 +989,7 @@ summary
 | System.Collections.Generic;HashSet<>;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;HashSet<>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;ICollection<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;ICollection<>;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;ICollection<>;true;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;IDictionary<,>;true;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Generic;IDictionary<,>;true;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
@@ -940,6 +1003,8 @@ summary
 | System.Collections.Generic;IList<>;true;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.Generic;IList<>;true;set_Item;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Generic;ISet<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;KeyValuePair;false;Create<,>;(TKey,TValue);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Generic;KeyValuePair;false;Create<,>;(TKey,TValue);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Generic;KeyValuePair<,>;false;Deconstruct;(TKey,TValue);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[0];Argument[this].Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[1];Argument[this].Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
@@ -971,6 +1036,7 @@ summary
 | System.Collections.Generic;LinkedList<>;false;AddLast;(T);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Generic;LinkedList<>;false;AddLast;(T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Generic;LinkedList<>;false;AddLast;(T);;Argument[this];ReturnValue;taint;generated |
+| System.Collections.Generic;LinkedList<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;LinkedList<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;LinkedList<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;LinkedList<>;false;Find;(T);;Argument[this].Element;ReturnValue;value;manual |
@@ -995,6 +1061,7 @@ summary
 | System.Collections.Generic;List<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Generic;List<>;false;AddRange;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Collections.Generic;List<>;false;AsReadOnly;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Generic;List<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;List<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;List<>;false;CopyTo;(T[]);;Argument[this];Argument[0].Element;taint;generated |
 | System.Collections.Generic;List<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
@@ -1037,6 +1104,7 @@ summary
 | System.Collections.Generic;PriorityQueue<,>;false;TryPeek;(TElement,TPriority);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;PriorityQueue<,>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Queue<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
+| System.Collections.Generic;Queue<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;Queue<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Queue<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Queue<>;false;Dequeue;();;Argument[this];ReturnValue;taint;generated |
@@ -1050,6 +1118,7 @@ summary
 | System.Collections.Generic;Queue<>;false;TryPeek;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Queue<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections.Generic;SortedDictionary<,>+KeyCollection;false;Add;(TKey);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;SortedDictionary<,>+KeyCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;SortedDictionary<,>+KeyCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;SortedDictionary<,>+KeyCollection;false;CopyTo;(TKey[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;SortedDictionary<,>+KeyCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1058,6 +1127,7 @@ summary
 | System.Collections.Generic;SortedDictionary<,>+KeyCollection;false;KeyCollection;(System.Collections.Generic.SortedDictionary<,>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.Generic;SortedDictionary<,>+KeyCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;SortedDictionary<,>+ValueCollection;false;Add;(TValue);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;SortedDictionary<,>+ValueCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;SortedDictionary<,>+ValueCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;SortedDictionary<,>+ValueCollection;false;CopyTo;(TValue[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;SortedDictionary<,>+ValueCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1072,6 +1142,7 @@ summary
 | System.Collections.Generic;SortedDictionary<,>;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Generic;SortedDictionary<,>;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Generic;SortedDictionary<,>;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections.Generic;SortedDictionary<,>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;SortedDictionary<,>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;SortedDictionary<,>;false;CopyTo;(System.Collections.Generic.KeyValuePair<TKey,TValue>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;SortedDictionary<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1097,6 +1168,7 @@ summary
 | System.Collections.Generic;SortedList<,>;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Generic;SortedList<,>;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Generic;SortedList<,>;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections.Generic;SortedList<,>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;SortedList<,>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;SortedList<,>;false;CopyTo;(System.Collections.Generic.KeyValuePair<TKey,TValue>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;SortedList<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1118,6 +1190,7 @@ summary
 | System.Collections.Generic;SortedList<,>;false;set_Item;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Generic;SortedList<,>;false;set_Item;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Generic;SortedSet<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;SortedSet<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;SortedSet<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;SortedSet<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;SortedSet<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1136,6 +1209,7 @@ summary
 | System.Collections.Generic;SortedSet<>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;SortedSet<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections.Generic;Stack<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
+| System.Collections.Generic;Stack<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;Stack<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Stack<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Stack<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1150,9 +1224,14 @@ summary
 | System.Collections.Generic;Stack<>;false;TryPop;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Stack<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections.Immutable;IImmutableDictionary<,>;true;AddRange;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;IImmutableDictionary<,>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;IImmutableList<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Immutable;IImmutableList<>;true;AddRange;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;IImmutableList<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
+| System.Collections.Immutable;IImmutableQueue<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;IImmutableSet<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Immutable;IImmutableSet<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
+| System.Collections.Immutable;IImmutableStack<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableArray;false;Create<>;(System.Collections.Immutable.ImmutableArray<T>,System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableArray;false;Create<>;(T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableArray;false;Create<>;(T,T);;Argument[0];ReturnValue;taint;generated |
@@ -1175,6 +1254,7 @@ summary
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;AddRange<>;(System.Collections.Immutable.ImmutableArray<TDerived>);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;AddRange<>;(System.Collections.Immutable.ImmutableArray<TDerived>+Builder);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;AddRange<>;(TDerived[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableArray<>+Builder;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -1196,6 +1276,8 @@ summary
 | System.Collections.Immutable;ImmutableArray<>;false;AsMemory;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableArray<>;false;CastArray<>;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableArray<>;false;CastUp<>;(System.Collections.Immutable.ImmutableArray<TDerived>);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableArray<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
+| System.Collections.Immutable;ImmutableArray<>;false;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableArray<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableArray<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableArray<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1231,6 +1313,12 @@ summary
 | System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[2].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;GetValueOrDefault<,>;(System.Collections.Immutable.IImmutableDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;ToImmutableDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;ToImmutableDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0].Element;ReturnValue;taint;generated |
@@ -1247,6 +1335,7 @@ summary
 | System.Collections.Immutable;ImmutableDictionary<,>+Builder;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>+Builder;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>+Builder;false;AddRange;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableDictionary<,>+Builder;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>+Builder;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>+Builder;false;CopyTo;(System.Collections.Generic.KeyValuePair<TKey,TValue>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1276,6 +1365,9 @@ summary
 | System.Collections.Immutable;ImmutableDictionary<,>;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>;false;AddRange;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableDictionary<,>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
+| System.Collections.Immutable;ImmutableDictionary<,>;false;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
+| System.Collections.Immutable;ImmutableDictionary<,>;false;Clear;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary<,>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>;false;CopyTo;(System.Collections.Generic.KeyValuePair<TKey,TValue>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1307,6 +1399,7 @@ summary
 | System.Collections.Immutable;ImmutableHashSet;false;ToImmutableHashSet<>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEqualityComparer<TSource>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableHashSet;false;ToImmutableHashSet<>;(System.Collections.Immutable.ImmutableHashSet<TSource>+Builder);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableHashSet<>+Builder;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableHashSet<>+Builder;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Immutable;ImmutableHashSet<>+Builder;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableHashSet<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Collections.Immutable;ImmutableHashSet<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -1316,6 +1409,8 @@ summary
 | System.Collections.Immutable;ImmutableHashSet<>+Builder;false;get_KeyComparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableHashSet<>+Builder;false;set_KeyComparer;(System.Collections.Generic.IEqualityComparer<T>);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableHashSet<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableHashSet<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
+| System.Collections.Immutable;ImmutableHashSet<>;false;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableHashSet<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableHashSet<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableHashSet<>;false;Except;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
@@ -1333,6 +1428,8 @@ summary
 | System.Collections.Immutable;ImmutableHashSet<>;false;get_KeyComparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableHashSet<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections.Immutable;ImmutableInterlocked;false;GetOrAdd<,>;(System.Collections.Immutable.ImmutableDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableList;false;Create<>;(T);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableList;false;CreateRange<>;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableList;false;Remove<>;(System.Collections.Immutable.IImmutableList<T>,T);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableList;false;RemoveRange<>;(System.Collections.Immutable.IImmutableList<T>,System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableList;false;Replace<>;(System.Collections.Immutable.IImmutableList<T>,T,T);;Argument[0].Element;ReturnValue;taint;generated |
@@ -1347,6 +1444,7 @@ summary
 | System.Collections.Immutable;ImmutableList<>+Builder;false;BinarySearch;(System.Int32,System.Int32,T,System.Collections.Generic.IComparer<T>);;Argument[this];Argument[3];taint;generated |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;BinarySearch;(T,System.Collections.Generic.IComparer<T>);;Argument[0];Argument[1];taint;generated |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;BinarySearch;(T,System.Collections.Generic.IComparer<T>);;Argument[this];Argument[1];taint;generated |
+| System.Collections.Immutable;ImmutableList<>+Builder;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;CopyTo;(T[]);;Argument[this];Argument[0].Element;taint;generated |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
@@ -1378,6 +1476,8 @@ summary
 | System.Collections.Immutable;ImmutableList<>;false;BinarySearch;(System.Int32,System.Int32,T,System.Collections.Generic.IComparer<T>);;Argument[this];Argument[3];taint;generated |
 | System.Collections.Immutable;ImmutableList<>;false;BinarySearch;(T,System.Collections.Generic.IComparer<T>);;Argument[0];Argument[1];taint;generated |
 | System.Collections.Immutable;ImmutableList<>;false;BinarySearch;(T,System.Collections.Generic.IComparer<T>);;Argument[this];Argument[1];taint;generated |
+| System.Collections.Immutable;ImmutableList<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
+| System.Collections.Immutable;ImmutableList<>;false;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;CopyTo;(T[]);;Argument[this];Argument[0].Element;taint;generated |
 | System.Collections.Immutable;ImmutableList<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
@@ -1425,6 +1525,7 @@ summary
 | System.Collections.Immutable;ImmutableQueue;false;CreateRange<>;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableQueue;false;Dequeue<>;(System.Collections.Immutable.IImmutableQueue<T>,T);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableQueue<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableQueue<>;false;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableQueue<>;false;Dequeue;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableQueue<>;false;Dequeue;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableQueue<>;false;Enqueue;(T);;Argument[0];ReturnValue;taint;generated |
@@ -1439,6 +1540,12 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[2].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IComparer<TKey>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IComparer<TKey>);;Argument[1];ReturnValue;taint;generated |
@@ -1454,6 +1561,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;AddRange;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;CopyTo;(System.Collections.Generic.KeyValuePair<TKey,TValue>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1476,6 +1584,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;set_Item;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;set_KeyComparer;(System.Collections.Generic.IComparer<TKey>);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;set_ValueComparer;(System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];Argument[this];taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(System.Collections.Generic.KeyValuePair<TKey,TValue>);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(System.Collections.Generic.KeyValuePair<TKey,TValue>);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(System.Collections.Generic.KeyValuePair<TKey,TValue>);;Argument[0];Argument[this].Element;value;manual |
@@ -1484,6 +1593,9 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;AddRange;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
+| System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
+| System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Clear;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;CopyTo;(System.Collections.Generic.KeyValuePair<TKey,TValue>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1514,7 +1626,10 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;set_Item;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;set_Item;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T[]);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;CreateBuilder<>;(System.Collections.Generic.IComparer<T>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;CreateRange<>;(System.Collections.Generic.IComparer<T>,System.Collections.Generic.IEnumerable<T>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;CreateRange<>;(System.Collections.Generic.IComparer<T>,System.Collections.Generic.IEnumerable<T>);;Argument[1].Element;ReturnValue;taint;generated |
@@ -1524,6 +1639,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet;false;ToImmutableSortedSet<>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IComparer<TSource>);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;ToImmutableSortedSet<>;(System.Collections.Immutable.ImmutableSortedSet<TSource>+Builder);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1531,6 +1647,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;IntersectWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;ToImmutable;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated |
@@ -1543,6 +1660,9 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;Clear;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Except;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
@@ -1551,8 +1671,12 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Insert;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;Intersect;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Remove;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;ToBuilder;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated |
@@ -1572,6 +1696,7 @@ summary
 | System.Collections.Immutable;ImmutableStack;false;CreateRange<>;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableStack;false;Pop<>;(System.Collections.Immutable.IImmutableStack<T>,T);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableStack<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableStack<>;false;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableStack<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Collections.Immutable;ImmutableStack<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableStack<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableStack<>+Enumerator.Current];value;manual |
@@ -1582,6 +1707,7 @@ summary
 | System.Collections.Immutable;ImmutableStack<>;false;Push;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.ObjectModel;Collection<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.ObjectModel;Collection<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.ObjectModel;Collection<>;false;Collection;(System.Collections.Generic.IList<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.ObjectModel;Collection<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
@@ -1590,23 +1716,30 @@ summary
 | System.Collections.ObjectModel;Collection<>;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.ObjectModel;Collection<>;false;Insert;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.ObjectModel;Collection<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;Collection<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;Collection<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.ObjectModel;Collection<>;false;get_Items;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.ObjectModel;Collection<>;false;set_Item;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;InsertItem;(System.Int32,TItem);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;KeyedCollection<,>;false;InsertItem;(System.Int32,TItem);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;KeyedCollection;(System.Collections.Generic.IEqualityComparer<TKey>,System.Int32);;Argument[0];Argument[this];taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;SetItem;(System.Int32,TItem);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;KeyedCollection<,>;false;SetItem;(System.Int32,TItem);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;TryGetValue;(TKey,TItem);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;get_Dictionary;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;get_Item;(TKey);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.ObjectModel;ObservableCollection<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;ObservableCollection<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;ObservableCollection<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;ObservableCollection<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.ObjectModel;ReadOnlyCollection<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1620,12 +1753,14 @@ summary
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;set_Item;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>+KeyCollection;false;Add;(TKey);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.ObjectModel;ReadOnlyDictionary<,>+KeyCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>+KeyCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>+KeyCollection;false;CopyTo;(TKey[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>+KeyCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>+KeyCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>+KeyCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>+ValueCollection;false;Add;(TValue);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.ObjectModel;ReadOnlyDictionary<,>+ValueCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>+ValueCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>+ValueCollection;false;CopyTo;(TValue[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>+ValueCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1638,6 +1773,7 @@ summary
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections.ObjectModel;ReadOnlyDictionary<,>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>;false;CopyTo;(System.Collections.Generic.KeyValuePair<TKey,TValue>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -1657,6 +1793,7 @@ summary
 | System.Collections.ObjectModel;ReadOnlyDictionary<,>;false;set_Item;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Specialized;HybridDictionary;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Specialized;HybridDictionary;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections.Specialized;HybridDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Specialized;HybridDictionary;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Specialized;HybridDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections.Specialized;HybridDictionary;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
@@ -1671,6 +1808,7 @@ summary
 | System.Collections.Specialized;IOrderedDictionary;true;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Specialized;ListDictionary;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Specialized;ListDictionary;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections.Specialized;ListDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Specialized;ListDictionary;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Specialized;ListDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections.Specialized;ListDictionary;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
@@ -1705,6 +1843,7 @@ summary
 | System.Collections.Specialized;NameObjectCollectionBase;true;get_Keys;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Specialized;NameValueCollection;false;Add;(System.Collections.Specialized.NameValueCollection);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Specialized;NameValueCollection;false;Add;(System.String,System.String);;Argument[0];Argument[this];taint;generated |
+| System.Collections.Specialized;NameValueCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Specialized;NameValueCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Specialized;NameValueCollection;false;Get;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Specialized;NameValueCollection;false;Get;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -1729,6 +1868,7 @@ summary
 | System.Collections.Specialized;OrderedDictionary;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Specialized;OrderedDictionary;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Specialized;OrderedDictionary;false;AsReadOnly;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Specialized;OrderedDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Specialized;OrderedDictionary;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Specialized;OrderedDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections.Specialized;OrderedDictionary;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated |
@@ -1746,6 +1886,7 @@ summary
 | System.Collections.Specialized;StringCollection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Specialized;StringCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Specialized;StringCollection;false;AddRange;(System.String[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Specialized;StringCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Specialized;StringCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Specialized;StringCollection;false;CopyTo;(System.String[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Specialized;StringCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -1756,6 +1897,7 @@ summary
 | System.Collections.Specialized;StringCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Specialized;StringCollection;false;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Specialized;StringCollection;false;set_Item;(System.Int32,System.String);;Argument[1];Argument[this].Element;value;manual |
+| System.Collections.Specialized;StringDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Specialized;StringDictionary;false;CopyTo;(System.Array,System.Int32);;Argument[this];Argument[0].Element;taint;generated |
 | System.Collections.Specialized;StringDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections.Specialized;StringDictionary;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -1765,6 +1907,7 @@ summary
 | System.Collections;ArrayList;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections;ArrayList;false;AddRange;(System.Collections.ICollection);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Collections;ArrayList;false;ArrayList;(System.Collections.ICollection);;Argument[0].Element;Argument[this];taint;generated |
+| System.Collections;ArrayList;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;ArrayList;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;CopyTo;(System.Array);;Argument[this];Argument[0].Element;taint;generated |
 | System.Collections;ArrayList;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
@@ -1797,10 +1940,12 @@ summary
 | System.Collections;BitArray;false;Xor;(System.Collections.BitArray);;Argument[this];ReturnValue;value;generated |
 | System.Collections;BitArray;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections;CollectionBase;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections;CollectionBase;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;CollectionBase;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;CollectionBase;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections;CollectionBase;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections;CollectionBase;false;Remove;(System.Object);;Argument[0];Argument[this];taint;generated |
+| System.Collections;CollectionBase;false;Remove;(System.Object);;Argument[this];Argument[0];taint;generated |
 | System.Collections;CollectionBase;false;get_InnerList;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections;CollectionBase;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections;CollectionBase;false;get_List;();;Argument[this];ReturnValue;taint;generated |
@@ -1809,6 +1954,7 @@ summary
 | System.Collections;Comparer;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated |
 | System.Collections;DictionaryBase;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections;DictionaryBase;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections;DictionaryBase;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;DictionaryBase;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;DictionaryBase;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections;DictionaryBase;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
@@ -1830,6 +1976,7 @@ summary
 | System.Collections;DictionaryEntry;false;set_Value;(System.Object);;Argument[0];Argument[this];taint;generated |
 | System.Collections;Hashtable;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections;Hashtable;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections;Hashtable;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;Hashtable;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Hashtable;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;Hashtable;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -1865,6 +2012,7 @@ summary
 | System.Collections;ICollection;true;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;IDictionary;true;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections;IDictionary;true;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections;IDictionary;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;IDictionary;true;get_Item;(System.Object);;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue;value;manual |
 | System.Collections;IDictionary;true;get_Keys;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];ReturnValue.Element;value;manual |
 | System.Collections;IDictionary;true;get_Values;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue.Element;value;manual |
@@ -1872,9 +2020,11 @@ summary
 | System.Collections;IDictionary;true;set_Item;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections;IEnumerable;true;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections;IList;true;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections;IList;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;IList;true;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections;IList;true;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections;IList;true;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
+| System.Collections;Queue;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;Queue;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Queue;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;Queue;false;Dequeue;();;Argument[this];ReturnValue;taint;generated |
@@ -1890,6 +2040,7 @@ summary
 | System.Collections;ReadOnlyCollectionBase;true;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections;SortedList;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections;SortedList;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections;SortedList;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;SortedList;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;SortedList;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;SortedList;false;GetByIndex;(System.Int32);;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue;value;manual |
@@ -1911,6 +2062,7 @@ summary
 | System.Collections;SortedList;false;get_Values;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue.Element;value;manual |
 | System.Collections;SortedList;false;set_Item;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections;SortedList;false;set_Item;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections;Stack;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;Stack;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Stack;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;Stack;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -1989,6 +2141,7 @@ summary
 | System.ComponentModel.Design;DesignerCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.ComponentModel.Design;DesignerCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.ComponentModel.Design;DesignerOptionService+DesignerOptionCollection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
+| System.ComponentModel.Design;DesignerOptionService+DesignerOptionCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.ComponentModel.Design;DesignerOptionService+DesignerOptionCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.ComponentModel.Design;DesignerOptionService+DesignerOptionCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.ComponentModel.Design;DesignerOptionService+DesignerOptionCollection;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
@@ -2031,7 +2184,9 @@ summary
 | System.ComponentModel;BaseNumberConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated |
 | System.ComponentModel;BindingList<>;false;Find;(System.ComponentModel.PropertyDescriptor,System.Object);;Argument[this].Element;ReturnValue;value;manual |
 | System.ComponentModel;BindingList<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.ComponentModel;BindingList<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.ComponentModel;BindingList<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.ComponentModel;BindingList<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.ComponentModel;CategoryAttribute;false;CategoryAttribute;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.ComponentModel;CategoryAttribute;false;get_Category;();;Argument[this];ReturnValue;taint;generated |
 | System.ComponentModel;CharConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated |
@@ -2074,6 +2229,7 @@ summary
 | System.ComponentModel;EnumConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated |
 | System.ComponentModel;EventDescriptorCollection;false;Add;(System.ComponentModel.EventDescriptor);;Argument[0];Argument[this].Element;value;manual |
 | System.ComponentModel;EventDescriptorCollection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
+| System.ComponentModel;EventDescriptorCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.ComponentModel;EventDescriptorCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.ComponentModel;EventDescriptorCollection;false;EventDescriptorCollection;(System.ComponentModel.EventDescriptor[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.ComponentModel;EventDescriptorCollection;false;Find;(System.String,System.Boolean);;Argument[this].Element;ReturnValue;value;manual |
@@ -2109,6 +2265,7 @@ summary
 | System.ComponentModel;LicenseProviderAttribute;false;get_LicenseProvider;();;Argument[this];ReturnValue;taint;generated |
 | System.ComponentModel;LicenseProviderAttribute;false;get_TypeId;();;Argument[this];ReturnValue;taint;generated |
 | System.ComponentModel;ListSortDescriptionCollection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
+| System.ComponentModel;ListSortDescriptionCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.ComponentModel;ListSortDescriptionCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.ComponentModel;ListSortDescriptionCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.ComponentModel;ListSortDescriptionCollection;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
@@ -2171,6 +2328,7 @@ summary
 | System.ComponentModel;PropertyDescriptorCollection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.ComponentModel;PropertyDescriptorCollection;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.ComponentModel;PropertyDescriptorCollection;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.ComponentModel;PropertyDescriptorCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.ComponentModel;PropertyDescriptorCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.ComponentModel;PropertyDescriptorCollection;false;Find;(System.String,System.Boolean);;Argument[this].Element;ReturnValue;value;manual |
 | System.ComponentModel;PropertyDescriptorCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -2295,6 +2453,7 @@ summary
 | System.Data.Common;DataColumnMappingCollection;false;Add;(System.String,System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DataColumnMappingCollection;false;AddRange;(System.Array);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Data.Common;DataColumnMappingCollection;false;AddRange;(System.Data.Common.DataColumnMapping[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data.Common;DataColumnMappingCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data.Common;DataColumnMappingCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data.Common;DataColumnMappingCollection;false;CopyTo;(System.Data.Common.DataColumnMapping[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data.Common;DataColumnMappingCollection;false;GetByDataSetColumn;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -2334,6 +2493,7 @@ summary
 | System.Data.Common;DataTableMappingCollection;false;Add;(System.String,System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DataTableMappingCollection;false;AddRange;(System.Array);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Data.Common;DataTableMappingCollection;false;AddRange;(System.Data.Common.DataTableMapping[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data.Common;DataTableMappingCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data.Common;DataTableMappingCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data.Common;DataTableMappingCollection;false;CopyTo;(System.Data.Common.DataTableMapping[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data.Common;DataTableMappingCollection;false;GetByDataSetTable;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -2354,11 +2514,16 @@ summary
 | System.Data.Common;DbBatchCommandCollection;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Data.Common;DbBatchCommandCollection;false;set_Item;(System.Int32,System.Data.Common.DbBatchCommand);;Argument[1];Argument[this].Element;value;manual |
 | System.Data.Common;DbBatchCommandCollection;true;Add;(System.Data.Common.DbBatchCommand);;Argument[0];Argument[this].Element;value;manual |
+| System.Data.Common;DbBatchCommandCollection;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data.Common;DbBatchCommandCollection;true;CopyTo;(System.Data.Common.DbBatchCommand[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data.Common;DbBatchCommandCollection;true;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Data.Common;DbBatchCommandCollection;true;Insert;(System.Int32,System.Data.Common.DbBatchCommand);;Argument[1];Argument[this].Element;value;manual |
 | System.Data.Common;DbCommand;false;ExecuteReader;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;ExecuteReader;(System.Data.CommandBehavior);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;();;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Data.CommandBehavior);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;get_Connection;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;get_Parameters;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;get_Transaction;();;Argument[this];ReturnValue;taint;generated |
@@ -2366,6 +2531,7 @@ summary
 | System.Data.Common;DbCommand;false;set_Connection;(System.Data.IDbConnection);;Argument[0];Argument[this];taint;generated |
 | System.Data.Common;DbCommand;false;set_Transaction;(System.Data.Common.DbTransaction);;Argument[0];Argument[this];taint;generated |
 | System.Data.Common;DbCommand;false;set_Transaction;(System.Data.IDbTransaction);;Argument[0];Argument[this];taint;generated |
+| System.Data.Common;DbCommand;true;ExecuteDbDataReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;true;PrepareAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Data.Common;DbCommandBuilder;false;GetDeleteCommand;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommandBuilder;false;GetDeleteCommand;(System.Boolean);;Argument[this];ReturnValue;taint;generated |
@@ -2396,8 +2562,10 @@ summary
 | System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String);;Argument[2];Argument[0];taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String,System.Boolean);;Argument[1];Argument[0];taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String,System.Boolean);;Argument[2];Argument[0];taint;generated |
+| System.Data.Common;DbConnectionStringBuilder;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data.Common;DbConnectionStringBuilder;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data.Common;DbConnectionStringBuilder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
+| System.Data.Common;DbConnectionStringBuilder;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;GetProperties;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;GetProperties;(System.Attribute[]);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;GetPropertyOwner;(System.ComponentModel.PropertyDescriptor);;Argument[this];ReturnValue;value;generated |
@@ -2432,10 +2600,13 @@ summary
 | System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[0];ReturnValue;taint;generated |
 | System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[1];ReturnValue;taint;generated |
 | System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[3];ReturnValue;taint;generated |
+| System.Data.Common;DbDataReader;false;GetFieldValueAsync<>;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Data.Common;DbDataReader;true;GetFieldValue<>;(System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbDataReader;true;GetFieldValueAsync<>;(System.Int32,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetProviderSpecificValue;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetProviderSpecificValues;(System.Object[]);;Argument[this];Argument[0].Element;taint;generated |
+| System.Data.Common;DbDataReader;true;GetSchemaTableAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetTextReader;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataRecord;false;GetPropertyOwner;(System.ComponentModel.PropertyDescriptor);;Argument[this];ReturnValue;value;generated |
 | System.Data.Common;DbEnumerator;false;DbEnumerator;(System.Data.IDataReader);;Argument[0];Argument[this];taint;generated |
@@ -2451,6 +2622,7 @@ summary
 | System.Data.Common;DbParameterCollection;false;set_Item;(System.String,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Data.Common;DbParameterCollection;true;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Data.Common;DbParameterCollection;true;AddRange;(System.Array);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data.Common;DbParameterCollection;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data.Common;DbParameterCollection;true;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data.Common;DbParameterCollection;true;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Data.Common;DbParameterCollection;true;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
@@ -2544,6 +2716,7 @@ summary
 | System.Data;ConstraintCollection;false;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[0];Argument[this];taint;generated |
 | System.Data;ConstraintCollection;false;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[0];ReturnValue;taint;generated |
 | System.Data;ConstraintCollection;false;AddRange;(System.Data.Constraint[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data;ConstraintCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;ConstraintCollection;false;CopyTo;(System.Data.Constraint[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;ConstraintCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data;ConstraintCollection;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -2576,15 +2749,20 @@ summary
 | System.Data;DataColumn;false;set_Prefix;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataColumnChangeEventArgs;false;DataColumnChangeEventArgs;(System.Data.DataRow,System.Data.DataColumn,System.Object);;Argument[1];Argument[this];taint;generated |
 | System.Data;DataColumnChangeEventArgs;false;get_Column;();;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataColumnCollection;false;Add;();;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataColumnCollection;false;Add;(System.Data.DataColumn);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataColumnCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
+| System.Data;DataColumnCollection;false;Add;(System.String,System.Type);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataColumnCollection;false;Add;(System.String,System.Type,System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataColumnCollection;false;AddRange;(System.Data.DataColumn[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data;DataColumnCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;DataColumnCollection;false;CopyTo;(System.Data.DataColumn[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataColumnCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataColumnCollection;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataColumnCollection;false;get_List;();;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetDateTime;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetFieldValue<>;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Data;DataReaderExtensions;false;GetFieldValueAsync<>;(System.Data.Common.DbDataReader,System.String,System.Threading.CancellationToken);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetGuid;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetProviderSpecificValue;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetString;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
@@ -2616,11 +2794,18 @@ summary
 | System.Data;DataRelationCollection;false;Add;(System.Data.DataRelation);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataRelationCollection;false;CopyTo;(System.Data.DataRelation[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataRelationCollection;false;Remove;(System.Data.DataRelation);;Argument[0];Argument[this];taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.Data.DataColumn,System.Data.DataColumn);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRelationCollection;true;AddRange;(System.Data.DataRelation[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data;DataRelationCollection;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;DataRow;false;DataRow;(System.Data.DataRowBuilder);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRow;false;GetChildRows;(System.Data.DataRelation);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRow;false;GetChildRows;(System.Data.DataRelation,System.Data.DataRowVersion);;Argument[this];ReturnValue;taint;generated |
@@ -2645,6 +2830,7 @@ summary
 | System.Data;DataRow;false;set_RowError;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRowCollection;false;Add;(System.Data.DataRow);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataRowCollection;false;Add;(System.Object[]);;Argument[0];Argument[this].Element;value;manual |
+| System.Data;DataRowCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;DataRowCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataRowCollection;false;CopyTo;(System.Data.DataRow[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataRowCollection;false;Find;(System.Object);;Argument[this].Element;ReturnValue;value;manual |
@@ -2725,11 +2911,14 @@ summary
 | System.Data;DataTable;false;set_PrimaryKey;(System.Data.DataColumn[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Data;DataTable;false;set_Site;(System.ComponentModel.ISite);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataTable;false;set_TableName;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.Data;DataTableCollection;false;Add;();;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataTableCollection;false;Add;(System.Data.DataTable);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataTableCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[1];Argument[this];taint;generated |
 | System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[1];ReturnValue;taint;generated |
+| System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataTableCollection;false;AddRange;(System.Data.DataTable[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data;DataTableCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;DataTableCollection;false;CopyTo;(System.Data.DataTable[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataTableCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataTableCollection;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -2751,6 +2940,7 @@ summary
 | System.Data;DataView;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataView;false;AddNew;();;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataView;false;ApplySort;(System.ComponentModel.PropertyDescriptor,System.ComponentModel.ListSortDirection);;Argument[0];Argument[this];taint;generated |
+| System.Data;DataView;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;DataView;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataView;false;DataView;(System.Data.DataTable,System.String,System.String,System.Data.DataViewRowState);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataView;false;DataView;(System.Data.DataTable,System.String,System.String,System.Data.DataViewRowState);;Argument[2];Argument[this];taint;generated |
@@ -2780,6 +2970,7 @@ summary
 | System.Data;DataView;false;set_Sort;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataView;false;set_Table;(System.Data.DataTable);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataViewManager;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
+| System.Data;DataViewManager;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;DataViewManager;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataViewManager;false;CreateDataView;(System.Data.DataTable);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataViewManager;false;Find;(System.ComponentModel.PropertyDescriptor,System.Object);;Argument[this].Element;ReturnValue;value;manual |
@@ -2972,6 +3163,7 @@ summary
 | System.Diagnostics;ActivityTagsCollection;false;Add;(System.Collections.Generic.KeyValuePair<System.String,System.Object>);;Argument[0];Argument[this].Element;value;manual |
 | System.Diagnostics;ActivityTagsCollection;false;Add;(System.String,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Diagnostics;ActivityTagsCollection;false;Add;(System.String,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Diagnostics;ActivityTagsCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Diagnostics;ActivityTagsCollection;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,System.Object>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Diagnostics;ActivityTagsCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Diagnostics;ActivityTagsCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -3097,6 +3289,7 @@ summary
 | System.Diagnostics;SwitchLevelAttribute;false;set_SwitchLevelType;(System.Type);;Argument[0];Argument[this];taint;generated |
 | System.Diagnostics;TagList+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Diagnostics;TagList;false;Add;(System.Collections.Generic.KeyValuePair<System.String,System.Object>);;Argument[0];Argument[this].Element;value;manual |
+| System.Diagnostics;TagList;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Diagnostics;TagList;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,System.Object>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Diagnostics;TagList;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Diagnostics;TagList;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -3121,6 +3314,7 @@ summary
 | System.Diagnostics;TraceListenerCollection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Diagnostics;TraceListenerCollection;false;AddRange;(System.Diagnostics.TraceListenerCollection);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Diagnostics;TraceListenerCollection;false;AddRange;(System.Diagnostics.TraceListener[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Diagnostics;TraceListenerCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Diagnostics;TraceListenerCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Diagnostics;TraceListenerCollection;false;CopyTo;(System.Diagnostics.TraceListener[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Diagnostics;TraceListenerCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -3170,6 +3364,7 @@ summary
 | System.Dynamic;ExpandoObject;false;Add;(System.Collections.Generic.KeyValuePair<System.String,System.Object>);;Argument[0];Argument[this].Element;value;manual |
 | System.Dynamic;ExpandoObject;false;Add;(System.String,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Dynamic;ExpandoObject;false;Add;(System.String,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Dynamic;ExpandoObject;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Dynamic;ExpandoObject;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,System.Object>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Dynamic;ExpandoObject;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Dynamic;ExpandoObject;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -3342,10 +3537,13 @@ summary
 | System.IO.Compression;BrotliStream;false;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO.Compression;BrotliStream;false;BrotliStream;(System.IO.Stream,System.IO.Compression.CompressionMode,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO.Compression;BrotliStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.IO.Compression;BrotliStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;BrotliStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.Compression;BrotliStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;BrotliStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;BrotliStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO.Compression;BrotliStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO.Compression;BrotliStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;BrotliStream;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;DeflateStream;false;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.Compression;DeflateStream;false;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
@@ -3356,32 +3554,41 @@ summary
 | System.IO.Compression;DeflateStream;false;DeflateStream;(System.IO.Stream,System.IO.Compression.CompressionMode);;Argument[0];Argument[this];taint;manual |
 | System.IO.Compression;DeflateStream;false;DeflateStream;(System.IO.Stream,System.IO.Compression.CompressionMode,System.Boolean);;Argument[0];Argument[this];taint;manual |
 | System.IO.Compression;DeflateStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.IO.Compression;DeflateStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;DeflateStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.Compression;DeflateStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;DeflateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;DeflateStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO.Compression;DeflateStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO.Compression;DeflateStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;DeflateStream;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;GZipStream;false;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.Compression;GZipStream;false;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO.Compression;GZipStream;false;CopyTo;(System.IO.Stream,System.Int32);;Argument[this];Argument[0];taint;manual |
 | System.IO.Compression;GZipStream;false;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
 | System.IO.Compression;GZipStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.IO.Compression;GZipStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;GZipStream;false;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionLevel,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO.Compression;GZipStream;false;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionMode,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO.Compression;GZipStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.Compression;GZipStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;GZipStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;GZipStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO.Compression;GZipStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO.Compression;GZipStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;GZipStream;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;ZLibStream;false;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.Compression;ZLibStream;false;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO.Compression;ZLibStream;false;CopyTo;(System.IO.Stream,System.Int32);;Argument[this];Argument[0];taint;manual |
 | System.IO.Compression;ZLibStream;false;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
 | System.IO.Compression;ZLibStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.IO.Compression;ZLibStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;ZLibStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.Compression;ZLibStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Compression;ZLibStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;ZLibStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO.Compression;ZLibStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO.Compression;ZLibStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;ZLibStream;false;ZLibStream;(System.IO.Stream,System.IO.Compression.CompressionLevel,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO.Compression;ZLibStream;false;ZLibStream;(System.IO.Stream,System.IO.Compression.CompressionMode,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO.Compression;ZLibStream;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
@@ -3399,7 +3606,10 @@ summary
 | System.IO.Compression;ZipArchiveEntry;false;get_LastWriteTime;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;ZipArchiveEntry;false;get_Name;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;ZipArchiveEntry;false;set_LastWriteTime;(System.DateTimeOffset);;Argument[0];Argument[this];taint;generated |
+| System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode);;Argument[0];ReturnValue;taint;generated |
+| System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode,System.Text.Encoding);;Argument[2];ReturnValue;taint;generated |
+| System.IO.Compression;ZipFile;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String);;Argument[2];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String,System.IO.Compression.CompressionLevel);;Argument[0];ReturnValue;taint;generated |
@@ -3417,6 +3627,7 @@ summary
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.IO.IsolatedStorage;IsolatedStorageFileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
@@ -3427,6 +3638,11 @@ summary
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.IO.FileStream,System.String,System.Int64,System.IO.MemoryMappedFiles.MemoryMappedFileAccess,System.IO.HandleInheritability,System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String,System.Int64);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String,System.Int64,System.IO.MemoryMappedFiles.MemoryMappedFileAccess);;Argument[0];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedFile;false;get_SafeMemoryMappedFileHandle;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedViewAccessor;false;get_SafeMemoryMappedViewHandle;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedViewStream;false;get_SafeMemoryMappedViewHandle;();;Argument[this];ReturnValue;taint;generated |
@@ -3456,11 +3672,14 @@ summary
 | System.IO.Pipes;NamedPipeServerStream;false;WaitForConnectionAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO.Pipes;PipeStream;false;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.Pipes;PipeStream;false;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO.Pipes;PipeStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Pipes;PipeStream;false;InitializeHandle;(Microsoft.Win32.SafeHandles.SafePipeHandle,System.Boolean,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO.Pipes;PipeStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO.Pipes;PipeStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO.Pipes;PipeStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Pipes;PipeStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO.Pipes;PipeStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO.Pipes;PipeStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.Pipes;PipeStream;false;get_SafePipeHandle;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;BinaryReader;false;BinaryReader;(System.IO.Stream,System.Text.Encoding,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO;BinaryReader;false;BinaryReader;(System.IO.Stream,System.Text.Encoding,System.Boolean);;Argument[1];Argument[this];taint;generated |
@@ -3470,6 +3689,7 @@ summary
 | System.IO;BinaryReader;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;BinaryWriter;false;BinaryWriter;(System.IO.Stream,System.Text.Encoding,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO;BinaryWriter;false;BinaryWriter;(System.IO.Stream,System.Text.Encoding,System.Boolean);;Argument[1];Argument[this];taint;generated |
+| System.IO;BinaryWriter;false;DisposeAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;BinaryWriter;false;Write;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;BinaryWriter;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;BinaryWriter;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
@@ -3478,10 +3698,13 @@ summary
 | System.IO;BufferedStream;false;BufferedStream;(System.IO.Stream,System.Int32);;Argument[0];Argument[this];taint;generated |
 | System.IO;BufferedStream;false;CopyTo;(System.IO.Stream,System.Int32);;Argument[this];Argument[0];taint;manual |
 | System.IO;BufferedStream;false;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
+| System.IO;BufferedStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;BufferedStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;BufferedStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO;BufferedStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;BufferedStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO;BufferedStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO;BufferedStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;BufferedStream;false;get_UnderlyingStream;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;Directory;false;CreateDirectory;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO;Directory;false;CreateSymbolicLink;(System.String,System.String);;Argument[0];ReturnValue;taint;generated |
@@ -3518,8 +3741,19 @@ summary
 | System.IO;File;false;AppendAllLinesAsync;(System.String,System.Collections.Generic.IEnumerable<System.String>,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.IO;File;false;AppendAllTextAsync;(System.String,System.String,System.Text.Encoding,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
 | System.IO;File;false;AppendAllTextAsync;(System.String,System.String,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
+| System.IO;File;false;Create;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Create;(System.String,System.Int32);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Create;(System.String,System.Int32,System.IO.FileOptions);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;CreateSymbolicLink;(System.String,System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Open;(System.String,System.IO.FileMode);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Open;(System.String,System.IO.FileMode,System.IO.FileAccess);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Open;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;OpenHandle;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.IO.FileOptions,System.Int64);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;OpenText;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;OpenWrite;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;ReadAllText;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;ReadAllText;(System.String,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;ReadLines;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;ReadLines;(System.String,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;ReadLines;(System.String,System.Text.Encoding);;Argument[1];ReturnValue;taint;generated |
@@ -3530,8 +3764,15 @@ summary
 | System.IO;File;false;WriteAllTextAsync;(System.String,System.String,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;CopyTo;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;CopyTo;(System.String,System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;Create;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;MoveTo;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.IO;FileInfo;false;MoveTo;(System.String,System.Boolean);;Argument[0];Argument[this];taint;generated |
+| System.IO;FileInfo;false;Open;(System.IO.FileMode);;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;Open;(System.IO.FileMode,System.IO.FileAccess);;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;Open;(System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare);;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;OpenRead;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;OpenText;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;OpenWrite;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;get_Directory;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;get_DirectoryName;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;get_Name;();;Argument[this];ReturnValue;taint;generated |
@@ -3550,6 +3791,7 @@ summary
 | System.IO;FileStream;false;FileStream;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.Int32,System.Boolean);;Argument[0];Argument[this];taint;manual |
 | System.IO;FileStream;false;FileStream;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.Int32,System.IO.FileOptions);;Argument[0];Argument[this];taint;manual |
 | System.IO;FileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.IO;FileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;FileStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;FileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
@@ -3584,6 +3826,7 @@ summary
 | System.IO;MemoryStream;false;CopyTo;(System.IO.Stream,System.Int32);;Argument[this];Argument[0];taint;manual |
 | System.IO;MemoryStream;false;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
 | System.IO;MemoryStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.IO;MemoryStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;MemoryStream;false;GetBuffer;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;MemoryStream;false;MemoryStream;(System.Byte[]);;Argument[0];Argument[this];taint;manual |
 | System.IO;MemoryStream;false;MemoryStream;(System.Byte[],System.Boolean);;Argument[0].Element;Argument[this];taint;manual |
@@ -3592,10 +3835,12 @@ summary
 | System.IO;MemoryStream;false;MemoryStream;(System.Byte[],System.Int32,System.Int32,System.Boolean,System.Boolean);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO;MemoryStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;MemoryStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO;MemoryStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;MemoryStream;false;ToArray;();;Argument[this];ReturnValue;taint;manual |
 | System.IO;MemoryStream;false;TryGetBuffer;(System.ArraySegment<System.Byte>);;Argument[this];ReturnValue;taint;generated |
 | System.IO;MemoryStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO;MemoryStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO;MemoryStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;MemoryStream;false;WriteTo;(System.IO.Stream);;Argument[this];Argument[0];taint;generated |
 | System.IO;Path;false;ChangeExtension;(System.String,System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO;Path;false;Combine;(System.String,System.String);;Argument[0];ReturnValue;taint;manual |
@@ -3651,6 +3896,7 @@ summary
 | System.IO;Stream;false;CopyToAsync;(System.IO.Stream);;Argument[this];Argument[0];taint;manual |
 | System.IO;Stream;false;CopyToAsync;(System.IO.Stream,System.Int32);;Argument[this];Argument[0];taint;manual |
 | System.IO;Stream;false;CopyToAsync;(System.IO.Stream,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;false;FlushAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;Stream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;Stream;false;Synchronized;(System.IO.Stream);;Argument[0];ReturnValue;taint;generated |
 | System.IO;Stream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
@@ -3658,10 +3904,13 @@ summary
 | System.IO;Stream;true;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO;Stream;true;CopyTo;(System.IO.Stream,System.Int32);;Argument[this];Argument[0];taint;manual |
 | System.IO;Stream;true;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;true;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;Stream;true;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;Stream;true;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO;Stream;true;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;Stream;true;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO;Stream;true;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO;Stream;true;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;StreamReader;false;Read;();;Argument[this];ReturnValue;taint;manual |
 | System.IO;StreamReader;false;Read;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;manual |
 | System.IO;StreamReader;false;Read;(System.Span<System.Char>);;Argument[this];ReturnValue;taint;manual |
@@ -3690,6 +3939,7 @@ summary
 | System.IO;StreamReader;false;StreamReader;(System.String,System.Text.Encoding,System.Boolean,System.Int32);;Argument[0];Argument[this];taint;manual |
 | System.IO;StreamReader;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;StreamReader;false;get_CurrentEncoding;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;FlushAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;StreamWriter;false;StreamWriter;(System.IO.Stream,System.Text.Encoding,System.Int32,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO;StreamWriter;false;StreamWriter;(System.IO.Stream,System.Text.Encoding,System.Int32,System.Boolean);;Argument[1];Argument[this];taint;generated |
 | System.IO;StreamWriter;false;Write;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
@@ -3704,7 +3954,14 @@ summary
 | System.IO;StreamWriter;false;Write;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated |
 | System.IO;StreamWriter;false;Write;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated |
 | System.IO;StreamWriter;false;Write;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated |
+| System.IO;StreamWriter;false;WriteAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;StreamWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.IO;StreamWriter;false;WriteLine;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.IO;StreamWriter;false;WriteLine;(System.String,System.Object);;Argument[0];Argument[this];taint;generated |
 | System.IO;StreamWriter;false;WriteLine;(System.String,System.Object);;Argument[1];Argument[this];taint;generated |
@@ -3717,7 +3974,15 @@ summary
 | System.IO;StreamWriter;false;WriteLine;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated |
 | System.IO;StreamWriter;false;WriteLine;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated |
 | System.IO;StreamWriter;false;WriteLine;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated |
+| System.IO;StreamWriter;false;WriteLineAsync;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteLineAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;StreamWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteLineAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;StreamWriter;false;WriteLineAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.IO;StreamWriter;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;StreamWriter;false;get_Encoding;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;StringReader;false;Read;();;Argument[this];ReturnValue;taint;manual |
@@ -3733,19 +3998,39 @@ summary
 | System.IO;StringReader;false;ReadToEnd;();;Argument[this];ReturnValue;taint;manual |
 | System.IO;StringReader;false;ReadToEndAsync;();;Argument[this];ReturnValue;taint;manual |
 | System.IO;StringReader;false;StringReader;(System.String);;Argument[0];Argument[this];taint;manual |
+| System.IO;StringWriter;false;FlushAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;GetStringBuilder;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;StringWriter;(System.Text.StringBuilder,System.IFormatProvider);;Argument[0];Argument[this];taint;generated |
 | System.IO;StringWriter;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;Write;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;StringWriter;false;Write;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;Write;(System.Text.StringBuilder);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;WriteAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
+| System.IO;StringWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;WriteAsync;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;WriteAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[0];Argument[this];taint;generated |
 | System.IO;StringWriter;false;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteLine;(System.Text.StringBuilder);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;WriteLineAsync;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[0];Argument[this];taint;generated |
 | System.IO;StringWriter;false;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextReader;false;Synchronized;(System.IO.TextReader);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextReader;true;Read;();;Argument[this];ReturnValue;taint;manual |
 | System.IO;TextReader;true;Read;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;manual |
@@ -3763,7 +4048,12 @@ summary
 | System.IO;TextWriter;false;Synchronized;(System.IO.TextWriter);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextWriter;false;TextWriter;(System.IFormatProvider);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;FlushAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;Write;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.Object);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.String,System.Object);;Argument[0];Argument[this];taint;generated |
@@ -3777,7 +4067,14 @@ summary
 | System.IO;TextWriter;true;Write;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
@@ -3794,8 +4091,18 @@ summary
 | System.IO;TextWriter;true;WriteLine;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;true;WriteLine;(System.Text.StringBuilder);;Argument[0];Argument[this];taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;get_FormatProvider;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;get_NewLine;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;set_NewLine;(System.String);;Argument[0];Argument[this];taint;generated |
@@ -3803,16 +4110,19 @@ summary
 | System.IO;UnmanagedMemoryAccessor;false;UnmanagedMemoryAccessor;(System.Runtime.InteropServices.SafeBuffer,System.Int64,System.Int64);;Argument[0];Argument[this];taint;generated |
 | System.IO;UnmanagedMemoryAccessor;false;UnmanagedMemoryAccessor;(System.Runtime.InteropServices.SafeBuffer,System.Int64,System.Int64,System.IO.FileAccess);;Argument[0];Argument[this];taint;generated |
 | System.IO;UnmanagedMemoryStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.IO;UnmanagedMemoryStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;UnmanagedMemoryStream;false;Initialize;(System.Byte*,System.Int64,System.Int64,System.IO.FileAccess);;Argument[0];Argument[this];taint;generated |
 | System.IO;UnmanagedMemoryStream;false;Initialize;(System.Runtime.InteropServices.SafeBuffer,System.Int64,System.Int64,System.IO.FileAccess);;Argument[0];Argument[this];taint;generated |
 | System.IO;UnmanagedMemoryStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;UnmanagedMemoryStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO;UnmanagedMemoryStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;UnmanagedMemoryStream;false;UnmanagedMemoryStream;(System.Byte*,System.Int64);;Argument[0];Argument[this];taint;generated |
 | System.IO;UnmanagedMemoryStream;false;UnmanagedMemoryStream;(System.Byte*,System.Int64,System.Int64,System.IO.FileAccess);;Argument[0];Argument[this];taint;generated |
 | System.IO;UnmanagedMemoryStream;false;UnmanagedMemoryStream;(System.Runtime.InteropServices.SafeBuffer,System.Int64,System.Int64);;Argument[0];Argument[this];taint;generated |
 | System.IO;UnmanagedMemoryStream;false;UnmanagedMemoryStream;(System.Runtime.InteropServices.SafeBuffer,System.Int64,System.Int64,System.IO.FileAccess);;Argument[0];Argument[this];taint;generated |
 | System.IO;UnmanagedMemoryStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO;UnmanagedMemoryStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO;UnmanagedMemoryStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;UnmanagedMemoryStream;false;get_PositionPointer;();;Argument[this];ReturnValue;taint;generated |
 | System.Linq.Expressions;BinaryExpression;false;Accept;(System.Linq.Expressions.ExpressionVisitor);;Argument[this];Argument[0];taint;generated |
 | System.Linq.Expressions;BinaryExpression;false;Accept;(System.Linq.Expressions.ExpressionVisitor);;Argument[this];ReturnValue;taint;generated |
@@ -5055,15 +5365,18 @@ summary
 | System.Net.Http.Headers;HeaderStringValues;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HeaderStringValues;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeaderValueCollection<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Net.Http.Headers;HttpHeaderValueCollection<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net.Http.Headers;HttpHeaderValueCollection<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net.Http.Headers;HttpHeaderValueCollection<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Net.Http.Headers;HttpHeaderValueCollection<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
+| System.Net.Http.Headers;HttpHeaders;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net.Http.Headers;HttpHeaders;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Net.Http.Headers;HttpHeaders;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Net.Http.Headers;HttpHeaders;false;get_NonValidated;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
+| System.Net.Http.Headers;HttpHeadersNonValidated;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;TryGetValue;(System.String,System.Net.Http.Headers.HeaderStringValues);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;TryGetValues;(System.String,System.Net.Http.Headers.HeaderStringValues);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;get_Item;(System.String);;Argument[0];ReturnValue;taint;generated |
@@ -5161,18 +5474,29 @@ summary
 | System.Net.Http.Headers;WarningHeaderValue;false;get_Text;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Json;JsonContent;false;Create;(System.Object,System.Type,System.Net.Http.Headers.MediaTypeHeaderValue,System.Text.Json.JsonSerializerOptions);;Argument[3];ReturnValue;taint;generated |
 | System.Net.Http.Json;JsonContent;false;Create<>;(T,System.Net.Http.Headers.MediaTypeHeaderValue,System.Text.Json.JsonSerializerOptions);;Argument[2];ReturnValue;taint;generated |
+| System.Net.Http.Json;JsonContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http.Json;JsonContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http.Json;JsonContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;ByteArrayContent;false;ByteArrayContent;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.Http;ByteArrayContent;false;ByteArrayContent;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.Http;ByteArrayContent;false;CreateContentReadStream;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;ByteArrayContent;false;CreateContentReadStreamAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;ByteArrayContent;false;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;DelegatingHandler;false;DelegatingHandler;(System.Net.Http.HttpMessageHandler);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;DelegatingHandler;false;SendAsync;(System.Net.Http.HttpRequestMessage,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Http;DelegatingHandler;false;get_InnerHandler;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;DelegatingHandler;false;set_InnerHandler;(System.Net.Http.HttpMessageHandler);;Argument[0];Argument[this];taint;generated |
+| System.Net.Http;FormUrlEncodedContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Net.Http;FormUrlEncodedContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;FormUrlEncodedContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;FormUrlEncodedContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage);;Argument[this];Argument[0];taint;generated |
 | System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage,System.Net.Http.HttpCompletionOption);;Argument[this];Argument[0];taint;generated |
 | System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage,System.Net.Http.HttpCompletionOption,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
@@ -5199,7 +5523,10 @@ summary
 | System.Net.Http;HttpContent;false;ReadAsStreamAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;HttpContent;false;get_Headers;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;HttpContent;true;CreateContentReadStream;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;HttpContent;true;CreateContentReadStreamAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;HttpMessageInvoker;false;HttpMessageInvoker;(System.Net.Http.HttpMessageHandler,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;HttpMessageInvoker;false;SendAsync;(System.Net.Http.HttpRequestMessage,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Http;HttpMethod;false;HttpMethod;(System.String);;Argument[0];Argument[this];taint;generated |
@@ -5221,6 +5548,7 @@ summary
 | System.Net.Http;HttpRequestOptions;false;Add;(System.Collections.Generic.KeyValuePair<System.String,System.Object>);;Argument[0];Argument[this].Element;value;manual |
 | System.Net.Http;HttpRequestOptions;false;Add;(System.String,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Net.Http;HttpRequestOptions;false;Add;(System.String,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Net.Http;HttpRequestOptions;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net.Http;HttpRequestOptions;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,System.Object>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net.Http;HttpRequestOptions;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Net.Http;HttpRequestOptions;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -5241,19 +5569,27 @@ summary
 | System.Net.Http;MessageProcessingHandler;false;SendAsync;(System.Net.Http.HttpRequestMessage,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Http;MultipartContent;false;Add;(System.Net.Http.HttpContent);;Argument[0];Argument[this].Element;value;manual |
 | System.Net.Http;MultipartContent;false;CreateContentReadStream;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;MultipartContent;false;CreateContentReadStreamAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;MultipartContent;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Net.Http;MultipartContent;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Net.Http;MultipartContent;false;MultipartContent;(System.String,System.String);;Argument[1];Argument[this];taint;generated |
 | System.Net.Http;MultipartContent;false;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
 | System.Net.Http;MultipartContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;MultipartContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;MultipartContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;MultipartContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent);;Argument[0];Argument[this].Element;value;manual |
 | System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent,System.String,System.String);;Argument[0];Argument[this];taint;generated |
+| System.Net.Http;MultipartFormDataContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;MultipartFormDataContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;MultipartFormDataContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;ReadOnlyMemoryContent;false;CreateContentReadStream;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;ReadOnlyMemoryContent;false;CreateContentReadStreamAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;ReadOnlyMemoryContent;false;ReadOnlyMemoryContent;(System.ReadOnlyMemory<System.Byte>);;Argument[0];Argument[this];taint;generated |
+| System.Net.Http;ReadOnlyMemoryContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;ReadOnlyMemoryContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;ReadOnlyMemoryContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;SocketsHttpConnectionContext;false;get_DnsEndPoint;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;SocketsHttpConnectionContext;false;get_InitialRequestMessage;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;SocketsHttpHandler;false;get_ActivityHeadersPropagator;();;Argument[this];ReturnValue;taint;generated |
@@ -5292,11 +5628,19 @@ summary
 | System.Net.Http;SocketsHttpPlaintextStreamFilterContext;false;get_PlaintextStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;CreateContentReadStream;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;StreamContent;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;StreamContent;false;StreamContent;(System.IO.Stream,System.Int32);;Argument[0];Argument[this];taint;generated |
+| System.Net.Http;StringContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Net.Http;StringContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;StringContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;StringContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String,System.Net.Mime.ContentType);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String,System.Net.Mime.ContentType);;Argument[1];ReturnValue;taint;generated |
@@ -5326,7 +5670,10 @@ summary
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.Net.Mime.ContentType);;Argument[1];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.String);;Argument[0];Argument[this];taint;generated |
+| System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.Net.Mime.ContentType);;Argument[1];Argument[this];taint;generated |
+| System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;get_ContentId;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Mail;AttachmentBase;false;get_ContentStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Mail;AttachmentBase;false;set_ContentType;(System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated |
@@ -5417,31 +5764,37 @@ summary
 | System.Net.Mime;ContentType;false;get_Parameters;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Mime;ContentType;false;set_MediaType;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net.NetworkInformation;GatewayIPAddressInformationCollection;false;Add;(System.Net.NetworkInformation.GatewayIPAddressInformation);;Argument[0];Argument[this].Element;value;manual |
+| System.Net.NetworkInformation;GatewayIPAddressInformationCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net.NetworkInformation;GatewayIPAddressInformationCollection;false;CopyTo;(System.Net.NetworkInformation.GatewayIPAddressInformation[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net.NetworkInformation;GatewayIPAddressInformationCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Net.NetworkInformation;GatewayIPAddressInformationCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Net.NetworkInformation;GatewayIPAddressInformationCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Net.NetworkInformation;IPAddressCollection;false;Add;(System.Net.IPAddress);;Argument[0];Argument[this].Element;value;manual |
+| System.Net.NetworkInformation;IPAddressCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net.NetworkInformation;IPAddressCollection;false;CopyTo;(System.Net.IPAddress[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net.NetworkInformation;IPAddressCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Net.NetworkInformation;IPAddressCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Net.NetworkInformation;IPAddressInformationCollection;false;Add;(System.Net.NetworkInformation.IPAddressInformation);;Argument[0];Argument[this].Element;value;manual |
+| System.Net.NetworkInformation;IPAddressInformationCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net.NetworkInformation;IPAddressInformationCollection;false;CopyTo;(System.Net.NetworkInformation.IPAddressInformation[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net.NetworkInformation;IPAddressInformationCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Net.NetworkInformation;IPAddressInformationCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Net.NetworkInformation;IPAddressInformationCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Net.NetworkInformation;MulticastIPAddressInformationCollection;false;Add;(System.Net.NetworkInformation.MulticastIPAddressInformation);;Argument[0];Argument[this].Element;value;manual |
+| System.Net.NetworkInformation;MulticastIPAddressInformationCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net.NetworkInformation;MulticastIPAddressInformationCollection;false;CopyTo;(System.Net.NetworkInformation.MulticastIPAddressInformation[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net.NetworkInformation;MulticastIPAddressInformationCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Net.NetworkInformation;MulticastIPAddressInformationCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Net.NetworkInformation;MulticastIPAddressInformationCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Net.NetworkInformation;PhysicalAddress;false;PhysicalAddress;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.NetworkInformation;UnicastIPAddressInformationCollection;false;Add;(System.Net.NetworkInformation.UnicastIPAddressInformation);;Argument[0];Argument[this].Element;value;manual |
+| System.Net.NetworkInformation;UnicastIPAddressInformationCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net.NetworkInformation;UnicastIPAddressInformationCollection;false;CopyTo;(System.Net.NetworkInformation.UnicastIPAddressInformation[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net.NetworkInformation;UnicastIPAddressInformationCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Net.NetworkInformation;UnicastIPAddressInformationCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Net.NetworkInformation;UnicastIPAddressInformationCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;AuthenticatedStream;false;AuthenticatedStream;(System.IO.Stream,System.Boolean);;Argument[0];Argument[this];taint;generated |
+| System.Net.Security;AuthenticatedStream;false;DisposeAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;AuthenticatedStream;false;get_InnerStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;AuthenticateAsClient;(System.Net.NetworkCredential,System.Security.Authentication.ExtendedProtection.ChannelBinding,System.String);;Argument[1];Argument[this];taint;generated |
 | System.Net.Security;NegotiateStream;false;AuthenticateAsClient;(System.Net.NetworkCredential,System.Security.Authentication.ExtendedProtection.ChannelBinding,System.String);;Argument[2];Argument[this];taint;generated |
@@ -5462,6 +5815,7 @@ summary
 | System.Net.Security;NegotiateStream;false;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[this];Argument[0].Element;taint;manual |
 | System.Net.Security;NegotiateStream;false;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
 | System.Net.Security;NegotiateStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Net.Security;NegotiateStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.Net.Security;NegotiateStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
 | System.Net.Security;NegotiateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
@@ -5480,11 +5834,14 @@ summary
 | System.Net.Security;SslStream;false;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[this];Argument[0].Element;taint;manual |
 | System.Net.Security;SslStream;false;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
 | System.Net.Security;SslStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Net.Security;SslStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;SslStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.Net.Security;SslStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.Net.Security;SslStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;SslStream;false;Write;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.Security;SslStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.Net.Security;SslStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.Net.Security;SslStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;SslStream;false;get_LocalCertificate;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;SslStream;false;get_NegotiatedApplicationProtocol;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;SslStream;false;get_RemoteCertificate;();;Argument[this];ReturnValue;taint;generated |
@@ -5507,6 +5864,7 @@ summary
 | System.Net.Sockets;MulticastOption;false;set_LocalAddress;(System.Net.IPAddress);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;NetworkStream;false;BeginRead;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[this];Argument[0].Element;taint;manual |
 | System.Net.Sockets;NetworkStream;false;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
+| System.Net.Sockets;NetworkStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;NetworkStream;false;NetworkStream;(System.Net.Sockets.Socket,System.IO.FileAccess,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;NetworkStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.Net.Sockets;NetworkStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
@@ -5520,6 +5878,7 @@ summary
 | System.Net.Sockets;NetworkStream;false;get_Socket;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;SafeSocketHandle;false;SafeSocketHandle;(System.IntPtr,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;Socket;false;Accept;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
@@ -5543,6 +5902,7 @@ summary
 | System.Net.Sockets;Socket;false;DisconnectAsync;(System.Boolean,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;DisconnectAsync;(System.Boolean,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;DisconnectAsync;(System.Net.Sockets.SocketAsyncEventArgs);;Argument[this];Argument[0];taint;generated |
+| System.Net.Sockets;Socket;false;EndAccept;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
@@ -5559,6 +5919,7 @@ summary
 | System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.EndPoint);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];Argument[this];taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated |
+| System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
@@ -5568,6 +5929,7 @@ summary
 | System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Byte[],System.Int32,System.Int32,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[4];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[2];Argument[this];taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[2];ReturnValue;taint;generated |
+| System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
@@ -5615,6 +5977,7 @@ summary
 | System.Net.Sockets;SocketAsyncEventArgs;false;set_SendPacketsElements;(System.Net.Sockets.SendPacketsElement[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.Sockets;SocketAsyncEventArgs;false;set_UserToken;(System.Object);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;SocketException;false;get_Message;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Sockets;SocketTaskExtensions;false;AcceptAsync;(System.Net.Sockets.Socket,System.Net.Sockets.Socket);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint);;Argument[1];Argument[0];taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[1];Argument[0];taint;generated |
@@ -5626,6 +5989,8 @@ summary
 | System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
+| System.Net.Sockets;SocketTaskExtensions;false;ReceiveFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];ReturnValue;taint;generated |
+| System.Net.Sockets;SocketTaskExtensions;false;ReceiveMessageFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;SendAsync;(System.Net.Sockets.Socket,System.ReadOnlyMemory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;SendAsync;(System.Net.Sockets.Socket,System.ReadOnlyMemory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;SendToAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];Argument[0];taint;generated |
@@ -5640,6 +6005,8 @@ summary
 | System.Net.Sockets;TcpListener;false;AcceptSocketAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;TcpListener;false;AcceptSocketAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;TcpListener;false;AcceptTcpClient;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Sockets;TcpListener;false;EndAcceptSocket;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net.Sockets;TcpListener;false;EndAcceptTcpClient;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;TcpListener;false;TcpListener;(System.Net.IPAddress,System.Int32);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;TcpListener;false;TcpListener;(System.Net.IPEndPoint);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;TcpListener;false;get_LocalEndpoint;();;Argument[this];ReturnValue;taint;generated |
@@ -5721,6 +6088,7 @@ summary
 | System.Net;Cookie;false;set_Value;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net;CookieCollection;false;Add;(System.Net.Cookie);;Argument[0];Argument[this].Element;value;manual |
 | System.Net;CookieCollection;false;Add;(System.Net.CookieCollection);;Argument[0];Argument[this].Element;value;manual |
+| System.Net;CookieCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net;CookieCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net;CookieCollection;false;CopyTo;(System.Net.Cookie[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net;CookieCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -5731,11 +6099,17 @@ summary
 | System.Net;CookieException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated |
 | System.Net;CredentialCache;false;GetCredential;(System.Uri,System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Net;CredentialCache;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
+| System.Net;Dns;false;EndGetHostAddresses;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndGetHostByName;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndGetHostEntry;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndResolve;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net;DnsEndPoint;false;DnsEndPoint;(System.String,System.Int32,System.Net.Sockets.AddressFamily);;Argument[0];Argument[this];taint;generated |
 | System.Net;DnsEndPoint;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;DnsEndPoint;false;get_Host;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;DownloadDataCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;DownloadStringCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated |
+| System.Net;FileWebRequest;false;EndGetRequestStream;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;FileWebRequest;false;EndGetResponse;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net;FileWebRequest;false;GetRequestStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;FileWebRequest;false;GetResponse;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;FileWebRequest;false;get_ContentType;();;Argument[this];ReturnValue;taint;generated |
@@ -5782,6 +6156,7 @@ summary
 | System.Net;HttpListenerContext;false;get_Response;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpListenerContext;false;get_User;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpListenerPrefixCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
+| System.Net;HttpListenerPrefixCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net;HttpListenerPrefixCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net;HttpListenerPrefixCollection;false;CopyTo;(System.String[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Net;HttpListenerPrefixCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -5814,6 +6189,9 @@ summary
 | System.Net;HttpListenerTimeoutManager;false;get_IdleConnection;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpListenerTimeoutManager;false;set_DrainEntityBody;(System.TimeSpan);;Argument[0];Argument[this];taint;generated |
 | System.Net;HttpListenerTimeoutManager;false;set_IdleConnection;(System.TimeSpan);;Argument[0];Argument[this];taint;generated |
+| System.Net;HttpWebRequest;false;EndGetRequestStream;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;HttpWebRequest;false;EndGetRequestStream;(System.IAsyncResult,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated |
+| System.Net;HttpWebRequest;false;EndGetResponse;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net;HttpWebRequest;false;GetRequestStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpWebRequest;false;GetRequestStream;(System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpWebRequest;false;GetResponse;();;Argument[this];ReturnValue;taint;generated |
@@ -5899,6 +6277,8 @@ summary
 | System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest);;Argument[0];ReturnValue;taint;generated |
 | System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[0];Argument[this];taint;generated |
 | System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[1];Argument[this];taint;generated |
+| System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[1];ReturnValue;taint;generated |
 | System.Net;WebClient;false;OpenRead;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net;WebClient;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Net;WebClient;false;OpenRead;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -6019,6 +6399,7 @@ summary
 | System.Net;WebException;false;WebException;(System.String,System.Exception,System.Net.WebExceptionStatus,System.Net.WebResponse);;Argument[3];Argument[this];taint;generated |
 | System.Net;WebException;false;get_Response;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;WebHeaderCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
+| System.Net;WebHeaderCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net;WebHeaderCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Net;WebHeaderCollection;false;ToByteArray;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;WebHeaderCollection;false;ToString;();;Argument[this];ReturnValue;taint;generated |
@@ -6046,7 +6427,6 @@ summary
 | System.Numerics;BigInteger;false;Max;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[1];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Min;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Min;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[1];ReturnValue;taint;generated |
-| System.Numerics;BigInteger;false;Negate;(System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Pow;(System.Numerics.BigInteger,System.Int32);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Remainder;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;Complex;false;ToString;(System.IFormatProvider);;Argument[0];ReturnValue;taint;generated |
@@ -6834,9 +7214,11 @@ summary
 | System.Resources;ResourceReader;false;GetResourceData;(System.String,System.String,System.Byte[]);;Argument[this];ReturnValue;taint;generated |
 | System.Resources;ResourceReader;false;ResourceReader;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
 | System.Resources;ResourceSet;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
+| System.Resources;ResourceSet;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Resources;ResourceSet;false;ResourceSet;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
 | System.Resources;ResourceSet;false;ResourceSet;(System.Resources.IResourceReader);;Argument[0].Element;Argument[this];taint;generated |
 | System.Resources;ResourceWriter;false;ResourceWriter;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
+| System.Resources;ResourceWriter;false;ResourceWriter;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncIteratorMethodBuilder;false;AwaitOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncIteratorMethodBuilder;false;AwaitUnsafeOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncTaskMethodBuilder;false;AwaitOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
@@ -6853,6 +7235,7 @@ summary
 | System.Runtime.CompilerServices;AsyncValueTaskMethodBuilder<>;false;SetResult;(TResult);;Argument[0];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncValueTaskMethodBuilder<>;false;get_Task;();;Argument[this];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;CallSite;false;get_Binder;();;Argument[this];ReturnValue;taint;generated |
+| System.Runtime.CompilerServices;ConditionalWeakTable<,>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Runtime.CompilerServices;ConditionalWeakTable<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Runtime.CompilerServices;ConditionalWeakTable<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Runtime.CompilerServices;ConditionalWeakTable<,>;false;GetOrCreateValue;(TKey);;Argument[0];ReturnValue;taint;generated |
@@ -6872,8 +7255,6 @@ summary
 | System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider);;Argument[2];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider,System.Span<System.Char>);;Argument[2];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider,System.Span<System.Char>);;Argument[3];Argument[this];taint;generated |
-| System.Runtime.CompilerServices;DynamicAttribute;false;DynamicAttribute;(System.Boolean[]);;Argument[0].Element;Argument[this];taint;generated |
-| System.Runtime.CompilerServices;DynamicAttribute;false;get_TransformFlags;();;Argument[this];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;FormattableStringFactory;false;Create;(System.String,System.Object[]);;Argument[0];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;FormattableStringFactory;false;Create;(System.String,System.Object[]);;Argument[1].Element;ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;PoolingAsyncValueTaskMethodBuilder;false;AwaitOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
@@ -6884,6 +7265,7 @@ summary
 | System.Runtime.CompilerServices;PoolingAsyncValueTaskMethodBuilder<>;false;get_Task;();;Argument[this];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -7237,6 +7619,7 @@ summary
 | System.Security.Cryptography.X509Certificates;X509Certificate;false;ToString;(System.Boolean);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.X509Certificates;X509Certificate;false;get_Issuer;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.X509Certificates;X509Certificate;false;get_Subject;();;Argument[this];ReturnValue;taint;generated |
+| System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;false;X509CertificateEnumerator;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);;Argument[0].Element;Argument[this];taint;generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection;false;Add;(System.Security.Cryptography.X509Certificates.X509Certificate);;Argument[0];Argument[this].Element;value;manual |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection;false;AddRange;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);;Argument[0].Element;Argument[this].Element;value;manual |
@@ -7370,6 +7753,7 @@ summary
 | System.Security.Cryptography.Xml;EncryptionProperty;false;set_PropertyElement;(System.Xml.XmlElement);;Argument[0].Element;Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;Add;(System.Security.Cryptography.Xml.EncryptionProperty);;Argument[0];Argument[this];taint;generated |
+| System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;CopyTo;(System.Security.Cryptography.Xml.EncryptionProperty[],System.Int32);;Argument[this];Argument[0].Element;taint;generated |
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -7383,6 +7767,7 @@ summary
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;set_ItemOf;(System.Int32,System.Security.Cryptography.Xml.EncryptionProperty);;Argument[1];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;AddClause;(System.Security.Cryptography.Xml.KeyInfoClause);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
+| System.Security.Cryptography.Xml;KeyInfo;false;GetEnumerator;(System.Type);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;LoadXml;(System.Xml.XmlElement);;Argument[0].Element;Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;get_Id;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;set_Id;(System.String);;Argument[0];Argument[this];taint;generated |
@@ -7438,6 +7823,7 @@ summary
 | System.Security.Cryptography.Xml;Reference;false;set_Type;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;Reference;false;set_Uri;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;ReferenceList;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
+| System.Security.Cryptography.Xml;ReferenceList;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Security.Cryptography.Xml;ReferenceList;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Security.Cryptography.Xml;ReferenceList;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Security.Cryptography.Xml;ReferenceList;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
@@ -7502,6 +7888,7 @@ summary
 | System.Security.Cryptography.Xml;Transform;false;set_Context;(System.Xml.XmlElement);;Argument[0].Element;Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;Transform;false;set_Resolver;(System.Xml.XmlResolver);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;TransformChain;false;Add;(System.Security.Cryptography.Xml.Transform);;Argument[0];Argument[this];taint;generated |
+| System.Security.Cryptography.Xml;TransformChain;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;TransformChain;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;XmlDecryptionTransform;false;AddExceptUri;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;XmlDecryptionTransform;false;GetOutput;();;Argument[this];ReturnValue;taint;generated |
@@ -7576,10 +7963,13 @@ summary
 | System.Security.Cryptography;CryptoStream;false;CryptoStream;(System.IO.Stream,System.Security.Cryptography.ICryptoTransform,System.Security.Cryptography.CryptoStreamMode,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography;CryptoStream;false;CryptoStream;(System.IO.Stream,System.Security.Cryptography.ICryptoTransform,System.Security.Cryptography.CryptoStreamMode,System.Boolean);;Argument[1];Argument[this];taint;generated |
 | System.Security.Cryptography;CryptoStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Security.Cryptography;CryptoStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography;CryptoStream;false;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.Security.Cryptography;CryptoStream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.Security.Cryptography;CryptoStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography;CryptoStream;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.Security.Cryptography;CryptoStream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.Security.Cryptography;CryptoStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography;CspParameters;false;get_ParentWindowHandle;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography;CspParameters;false;set_ParentWindowHandle;(System.IntPtr);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography;DSASignatureDeformatter;false;DSASignatureDeformatter;(System.Security.Cryptography.AsymmetricAlgorithm);;Argument[0];Argument[this];taint;generated |
@@ -7646,6 +8036,7 @@ summary
 | System.Security.Cryptography;RSAPKCS1SignatureFormatter;false;SetHashAlgorithm;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography;RSAPKCS1SignatureFormatter;false;SetKey;(System.Security.Cryptography.AsymmetricAlgorithm);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography;SafeEvpPKeyHandle;false;DuplicateHandle;();;Argument[this];ReturnValue;taint;generated |
+| System.Security.Policy;Evidence;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Security.Policy;Evidence;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Security.Policy;Evidence;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Security.Principal;GenericIdentity;false;Clone;();;Argument[this];ReturnValue;taint;generated |
@@ -7659,6 +8050,7 @@ summary
 | System.Security.Principal;GenericPrincipal;false;GenericPrincipal;(System.Security.Principal.IIdentity,System.String[]);;Argument[0];Argument[this];taint;generated |
 | System.Security.Principal;GenericPrincipal;false;get_Identity;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Principal;IdentityReferenceCollection;false;Add;(System.Security.Principal.IdentityReference);;Argument[0];Argument[this].Element;value;manual |
+| System.Security.Principal;IdentityReferenceCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Security.Principal;IdentityReferenceCollection;false;CopyTo;(System.Security.Principal.IdentityReference[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Security.Principal;IdentityReferenceCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Security.Principal;IdentityReferenceCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -7690,6 +8082,8 @@ summary
 | System.Text.Encodings.Web;TextEncoder;true;Encode;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Text.Json.Nodes;JsonArray;false;Add;(System.Text.Json.Nodes.JsonNode);;Argument[0];Argument[this].Element;value;manual |
 | System.Text.Json.Nodes;JsonArray;false;Add<>;(T);;Argument[0];Argument[this];taint;generated |
+| System.Text.Json.Nodes;JsonArray;false;Add<>;(T);;Argument[this];Argument[0];taint;generated |
+| System.Text.Json.Nodes;JsonArray;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Text.Json.Nodes;JsonArray;false;CopyTo;(System.Text.Json.Nodes.JsonNode[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Text.Json.Nodes;JsonArray;false;Create;(System.Text.Json.JsonElement,System.Nullable<System.Text.Json.Nodes.JsonNodeOptions>);;Argument[0];ReturnValue;taint;generated |
 | System.Text.Json.Nodes;JsonArray;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -7713,6 +8107,7 @@ summary
 | System.Text.Json.Nodes;JsonObject;false;Add;(System.Collections.Generic.KeyValuePair<System.String,System.Text.Json.Nodes.JsonNode>);;Argument[0];Argument[this].Element;value;manual |
 | System.Text.Json.Nodes;JsonObject;false;Add;(System.String,System.Text.Json.Nodes.JsonNode);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Text.Json.Nodes;JsonObject;false;Add;(System.String,System.Text.Json.Nodes.JsonNode);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Text.Json.Nodes;JsonObject;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Text.Json.Nodes;JsonObject;false;CopyTo;(System.Collections.Generic.KeyValuePair<System.String,System.Text.Json.Nodes.JsonNode>[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Text.Json.Nodes;JsonObject;false;Create;(System.Text.Json.JsonElement,System.Nullable<System.Text.Json.Nodes.JsonNodeOptions>);;Argument[0];ReturnValue;taint;generated |
 | System.Text.Json.Nodes;JsonObject;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -7788,6 +8183,7 @@ summary
 | System.Text.Json;Utf8JsonWriter;false;get_Options;();;Argument[this];ReturnValue;taint;generated |
 | System.Text.RegularExpressions;CaptureCollection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Text.RegularExpressions;CaptureCollection;false;Add;(System.Text.RegularExpressions.Capture);;Argument[0];Argument[this].Element;value;manual |
+| System.Text.RegularExpressions;CaptureCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Text.RegularExpressions;CaptureCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Text.RegularExpressions;CaptureCollection;false;CopyTo;(System.Text.RegularExpressions.Capture[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Text.RegularExpressions;CaptureCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -7801,6 +8197,7 @@ summary
 | System.Text.RegularExpressions;Group;false;Synchronized;(System.Text.RegularExpressions.Group);;Argument[0];ReturnValue;taint;generated |
 | System.Text.RegularExpressions;GroupCollection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Text.RegularExpressions;GroupCollection;false;Add;(System.Text.RegularExpressions.Group);;Argument[0];Argument[this].Element;value;manual |
+| System.Text.RegularExpressions;GroupCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Text.RegularExpressions;GroupCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Text.RegularExpressions;GroupCollection;false;CopyTo;(System.Text.RegularExpressions.Group[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Text.RegularExpressions;GroupCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -7818,6 +8215,7 @@ summary
 | System.Text.RegularExpressions;Match;false;Synchronized;(System.Text.RegularExpressions.Match);;Argument[0];ReturnValue;taint;generated |
 | System.Text.RegularExpressions;MatchCollection;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Text.RegularExpressions;MatchCollection;false;Add;(System.Text.RegularExpressions.Match);;Argument[0];Argument[this].Element;value;manual |
+| System.Text.RegularExpressions;MatchCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Text.RegularExpressions;MatchCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Text.RegularExpressions;MatchCollection;false;CopyTo;(System.Text.RegularExpressions.Match[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Text.RegularExpressions;MatchCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
@@ -8047,6 +8445,7 @@ summary
 | System.Text;StringBuilder;false;AppendLine;(System.String);;Argument[0];Argument[this].Element;value;manual |
 | System.Text;StringBuilder;false;AppendLine;(System.String);;Argument[this];ReturnValue;value;manual |
 | System.Text;StringBuilder;false;AppendLine;(System.Text.StringBuilder+AppendInterpolatedStringHandler);;Argument[this];ReturnValue;taint;generated |
+| System.Text;StringBuilder;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Text;StringBuilder;false;GetChunks;();;Argument[this];ReturnValue;taint;generated |
 | System.Text;StringBuilder;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated |
 | System.Text;StringBuilder;false;Insert;(System.Int32,System.Boolean);;Argument[this];ReturnValue;taint;generated |
@@ -8154,6 +8553,10 @@ summary
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;SendAsync<>;(System.Threading.Tasks.Dataflow.ITargetBlock<TInput>,TInput,System.Threading.CancellationToken);;Argument[1];Argument[0];taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;TryReceive<>;(System.Threading.Tasks.Dataflow.IReceivableSourceBlock<TOutput>,TOutput);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlockOptions;false;get_CancellationToken;();;Argument[this];ReturnValue;taint;generated |
@@ -8717,6 +9120,7 @@ summary
 | System.Xml.Linq;XText;false;XText;(System.Xml.Linq.XText);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Linq;XText;false;get_Value;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Linq;XText;false;set_Value;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.Xml.Resolvers;XmlPreloadedResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Resolvers;XmlPreloadedResolver;false;ResolveUri;(System.Uri,System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Resolvers;XmlPreloadedResolver;false;ResolveUri;(System.Uri,System.String);;Argument[1];ReturnValue;taint;generated |
 | System.Xml.Resolvers;XmlPreloadedResolver;false;XmlPreloadedResolver;(System.Xml.XmlResolver,System.Xml.Resolvers.XmlKnownDtds,System.Collections.Generic.IEqualityComparer<System.Uri>);;Argument[0];Argument[this];taint;generated |
@@ -8949,9 +9353,12 @@ summary
 | System.Xml.Schema;XmlSchemaSet;false;Add;(System.String,System.Xml.XmlReader);;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchema);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated |
+| System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchemaSet);;Argument[0];Argument[this];taint;generated |
+| System.Xml.Schema;XmlSchemaSet;false;CopyTo;(System.Xml.Schema.XmlSchema[],System.Int32);;Argument[this];Argument[0].Element;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Remove;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Reprocess;(System.Xml.Schema.XmlSchema);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Reprocess;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated |
+| System.Xml.Schema;XmlSchemaSet;false;Schemas;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;XmlSchemaSet;(System.Xml.XmlNameTable);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;get_CompilationSettings;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;get_GlobalAttributes;();;Argument[this];ReturnValue;taint;generated |
@@ -9038,8 +9445,10 @@ summary
 | System.Xml.Schema;XmlSchemaXPath;false;get_XPath;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaXPath;false;set_XPath;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;Add;(System.String,System.Object);;Argument[1];Argument[this];taint;generated |
+| System.Xml.Serialization;CodeIdentifiers;false;Add;(System.String,System.Object);;Argument[this];Argument[1];taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[1];Argument[this];taint;generated |
+| System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[this];Argument[1];taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;MakeUnique;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;ToArray;(System.Type);;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Serialization;ImportContext;false;ImportContext;(System.Xml.Serialization.CodeIdentifiers,System.Boolean);;Argument[0];Argument[this];taint;generated |
@@ -9346,6 +9755,7 @@ summary
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.String);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.Xml.XmlQualifiedName);;Argument[1];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WriteId;(System.Object);;Argument[this];Argument[0];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncoded;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncodedRaw;(System.String,System.String,System.Byte[],System.Xml.XmlQualifiedName);;Argument[2].Element;Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncodedRaw;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated |
@@ -9353,9 +9763,15 @@ summary
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringLiteralRaw;(System.String,System.String,System.Byte[]);;Argument[2].Element;Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringLiteralRaw;(System.String,System.String,System.String);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean,System.Boolean);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean,System.Boolean);;Argument[this];Argument[2];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WriteReferencingElement;(System.String,System.String,System.Object);;Argument[this];Argument[2];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WriteReferencingElement;(System.String,System.String,System.Object,System.Boolean);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteRpcResult;(System.String,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteRpcResult;(System.String,System.String);;Argument[1];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteSerializable;(System.Xml.Serialization.IXmlSerializable,System.String,System.String,System.Boolean);;Argument[0];Argument[this];taint;generated |
@@ -10061,6 +10477,7 @@ summary
 | System.Xml;XmlReaderSettings;false;set_XmlResolver;(System.Xml.XmlResolver);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlResolver;true;ResolveUri;(System.Uri,System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlResolver;true;ResolveUri;(System.Uri,System.String);;Argument[1];ReturnValue;taint;generated |
+| System.Xml;XmlSecureResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlSecureResolver;false;ResolveUri;(System.Uri,System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlSecureResolver;false;ResolveUri;(System.Uri,System.String);;Argument[1];ReturnValue;taint;generated |
 | System.Xml;XmlSecureResolver;false;XmlSecureResolver;(System.Xml.XmlResolver,System.String);;Argument[0];Argument[this];taint;generated |
@@ -10107,6 +10524,7 @@ summary
 | System.Xml;XmlTextWriter;false;XmlTextWriter;(System.IO.TextWriter);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlTextWriter;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml;XmlTextWriter;false;get_XmlLang;();;Argument[this];ReturnValue;taint;generated |
+| System.Xml;XmlUrlResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlUrlResolver;false;ResolveUri;(System.Uri,System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlUrlResolver;false;ResolveUri;(System.Uri,System.String);;Argument[1];ReturnValue;taint;generated |
 | System.Xml;XmlUrlResolver;false;set_Credentials;(System.Net.ICredentials);;Argument[0];Argument[this];taint;generated |
@@ -10134,6 +10552,8 @@ summary
 | System.Xml;XmlWriter;false;Create;(System.IO.TextWriter);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.IO.TextWriter,System.Xml.XmlWriterSettings);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.IO.TextWriter,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated |
+| System.Xml;XmlWriter;false;Create;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.Xml;XmlWriter;false;Create;(System.String,System.Xml.XmlWriterSettings);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.String,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.Text.StringBuilder,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.Xml.XmlWriter);;Argument[0];ReturnValue;taint;generated |
@@ -10188,6 +10608,9 @@ summary
 | System;ArgumentOutOfRangeException;false;get_Message;();;Argument[this];ReturnValue;taint;generated |
 | System;Array;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System;Array;false;AsReadOnly<>;(T[]);;Argument[0].Element;ReturnValue.Element;value;manual |
+| System;Array;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
+| System;Array;false;Clear;(System.Array);;Argument[0].WithoutElement;Argument[0];value;manual |
+| System;Array;false;Clear;(System.Array,System.Int32,System.Int32);;Argument[0].WithoutElement;Argument[0];value;manual |
 | System;Array;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System;Array;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System;Array;false;CopyTo;(System.Array,System.Int64);;Argument[this].Element;Argument[0].Element;value;manual |
@@ -10212,6 +10635,7 @@ summary
 | System;ArraySegment<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
 | System;ArraySegment<>;false;ArraySegment;(T[]);;Argument[0].Element;Argument[this];taint;generated |
 | System;ArraySegment<>;false;ArraySegment;(T[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
+| System;ArraySegment<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System;ArraySegment<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System;ArraySegment<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System;ArraySegment<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -11223,6 +11647,27 @@ summary
 | System;TupleExtensions;false;Deconstruct<,>;(System.Tuple<T1,T2>,T1,T2);;Argument[0].Property[System.Tuple<,>.Item1];Argument[1];value;manual |
 | System;TupleExtensions;false;Deconstruct<,>;(System.Tuple<T1,T2>,T1,T2);;Argument[0].Property[System.Tuple<,>.Item2];Argument[2];value;manual |
 | System;TupleExtensions;false;Deconstruct<>;(System.Tuple<T1>,T1);;Argument[0].Property[System.Tuple<>.Item1];Argument[1];value;manual |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20,T21>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,>;(System.ValueTuple<T1,T2,T3,T4>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,>;(System.ValueTuple<T1,T2,T3>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,>;(System.ValueTuple<T1,T2>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<>;(System.ValueTuple<T1>);;Argument[0];ReturnValue;taint;generated |
 | System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19,T20,T21>>>);;Argument[0];ReturnValue;taint;generated |
 | System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19,T20>>>);;Argument[0];ReturnValue;taint;generated |
 | System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19>>>);;Argument[0];ReturnValue;taint;generated |
@@ -13397,7 +13842,6 @@ negativeSummary
 | System.CodeDom.Compiler;IndentedTextWriter;Close;();generated |
 | System.CodeDom.Compiler;IndentedTextWriter;DisposeAsync;();generated |
 | System.CodeDom.Compiler;IndentedTextWriter;Flush;();generated |
-| System.CodeDom.Compiler;IndentedTextWriter;FlushAsync;();generated |
 | System.CodeDom.Compiler;IndentedTextWriter;IndentedTextWriter;(System.IO.TextWriter);generated |
 | System.CodeDom.Compiler;IndentedTextWriter;OutputTabs;();generated |
 | System.CodeDom.Compiler;IndentedTextWriter;OutputTabsAsync;();generated |
@@ -13441,7 +13885,6 @@ negativeSummary
 | System.CodeDom.Compiler;IndentedTextWriter;WriteLineAsync;(System.String);generated |
 | System.CodeDom.Compiler;IndentedTextWriter;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);generated |
 | System.CodeDom.Compiler;IndentedTextWriter;WriteLineNoTabs;(System.String);generated |
-| System.CodeDom.Compiler;IndentedTextWriter;WriteLineNoTabsAsync;(System.String);generated |
 | System.CodeDom.Compiler;IndentedTextWriter;get_Indent;();generated |
 | System.CodeDom.Compiler;IndentedTextWriter;set_Indent;(System.Int32);generated |
 | System.Collections.Concurrent;BlockingCollection<>;AddToAny;(System.Collections.Concurrent.BlockingCollection<>[],T);generated |
@@ -13491,7 +13934,6 @@ negativeSummary
 | System.Collections.Concurrent;ConcurrentDictionary<,>;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;Contains;(System.Object);generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;ContainsKey;(TKey);generated |
-| System.Collections.Concurrent;ConcurrentDictionary<,>;GetEnumerator;();generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;Remove;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;Remove;(System.Object);generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;Remove;(TKey);generated |
@@ -13549,7 +13991,6 @@ negativeSummary
 | System.Collections.Concurrent;Partitioner<>;GetPartitions;(System.Int32);generated |
 | System.Collections.Concurrent;Partitioner<>;get_SupportsDynamicPartitions;();generated |
 | System.Collections.Generic;CollectionExtensions;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey);generated |
-| System.Collections.Generic;CollectionExtensions;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);generated |
 | System.Collections.Generic;Comparer<>;Compare;(System.Object,System.Object);generated |
 | System.Collections.Generic;Comparer<>;Compare;(T,T);generated |
 | System.Collections.Generic;Comparer<>;get_Default;();generated |
@@ -13677,7 +14118,6 @@ negativeSummary
 | System.Collections.Generic;KeyNotFoundException;KeyNotFoundException;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated |
 | System.Collections.Generic;KeyNotFoundException;KeyNotFoundException;(System.String);generated |
 | System.Collections.Generic;KeyNotFoundException;KeyNotFoundException;(System.String,System.Exception);generated |
-| System.Collections.Generic;KeyValuePair;Create<,>;(TKey,TValue);generated |
 | System.Collections.Generic;KeyValuePair<,>;ToString;();generated |
 | System.Collections.Generic;LinkedList<>+Enumerator;Dispose;();generated |
 | System.Collections.Generic;LinkedList<>+Enumerator;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated |
@@ -13985,9 +14425,6 @@ negativeSummary
 | System.Collections.Immutable;ImmutableDictionary;CreateBuilder<,>;();generated |
 | System.Collections.Immutable;ImmutableDictionary;CreateBuilder<,>;(System.Collections.Generic.IEqualityComparer<TKey>);generated |
 | System.Collections.Immutable;ImmutableDictionary;CreateBuilder<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);generated |
-| System.Collections.Immutable;ImmutableDictionary;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated |
-| System.Collections.Immutable;ImmutableDictionary;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated |
-| System.Collections.Immutable;ImmutableDictionary;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated |
 | System.Collections.Immutable;ImmutableDictionary;GetValueOrDefault<,>;(System.Collections.Immutable.IImmutableDictionary<TKey,TValue>,TKey);generated |
 | System.Collections.Immutable;ImmutableDictionary<,>+Builder;Clear;();generated |
 | System.Collections.Immutable;ImmutableDictionary<,>+Builder;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated |
@@ -14077,10 +14514,8 @@ negativeSummary
 | System.Collections.Immutable;ImmutableInterlocked;TryRemove<,>;(System.Collections.Immutable.ImmutableDictionary<TKey,TValue>,TKey,TValue);generated |
 | System.Collections.Immutable;ImmutableInterlocked;TryUpdate<,>;(System.Collections.Immutable.ImmutableDictionary<TKey,TValue>,TKey,TValue,TValue);generated |
 | System.Collections.Immutable;ImmutableList;Create<>;();generated |
-| System.Collections.Immutable;ImmutableList;Create<>;(T);generated |
 | System.Collections.Immutable;ImmutableList;Create<>;(T[]);generated |
 | System.Collections.Immutable;ImmutableList;CreateBuilder<>;();generated |
-| System.Collections.Immutable;ImmutableList;CreateRange<>;(System.Collections.Generic.IEnumerable<T>);generated |
 | System.Collections.Immutable;ImmutableList;IndexOf<>;(System.Collections.Immutable.IImmutableList<T>,T);generated |
 | System.Collections.Immutable;ImmutableList;IndexOf<>;(System.Collections.Immutable.IImmutableList<T>,T,System.Collections.Generic.IEqualityComparer<T>);generated |
 | System.Collections.Immutable;ImmutableList;IndexOf<>;(System.Collections.Immutable.IImmutableList<T>,T,System.Int32);generated |
@@ -14144,9 +14579,6 @@ negativeSummary
 | System.Collections.Immutable;ImmutableQueue<>;get_IsEmpty;();generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;Create<,>;();generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;CreateBuilder<,>;();generated |
-| System.Collections.Immutable;ImmutableSortedDictionary;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated |
-| System.Collections.Immutable;ImmutableSortedDictionary;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated |
-| System.Collections.Immutable;ImmutableSortedDictionary;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;Clear;();generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;Contains;(System.Object);generated |
@@ -14166,7 +14598,6 @@ negativeSummary
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;Dispose;();generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;MoveNext;();generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;Reset;();generated |
-| System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;get_Current;();generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;Clear;();generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;Contains;(System.Object);generated |
@@ -14183,8 +14614,6 @@ negativeSummary
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;get_IsReadOnly;();generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;get_IsSynchronized;();generated |
 | System.Collections.Immutable;ImmutableSortedSet;Create<>;();generated |
-| System.Collections.Immutable;ImmutableSortedSet;Create<>;(System.Collections.Generic.IComparer<T>,T);generated |
-| System.Collections.Immutable;ImmutableSortedSet;Create<>;(T);generated |
 | System.Collections.Immutable;ImmutableSortedSet;Create<>;(T[]);generated |
 | System.Collections.Immutable;ImmutableSortedSet;CreateBuilder<>;();generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;Clear;();generated |
@@ -14198,7 +14627,6 @@ negativeSummary
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;Overlaps;(System.Collections.Generic.IEnumerable<T>);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;Remove;(T);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;SetEquals;(System.Collections.Generic.IEnumerable<T>);generated |
-| System.Collections.Immutable;ImmutableSortedSet<>+Builder;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;get_Count;();generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;get_IsReadOnly;();generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;get_IsSynchronized;();generated |
@@ -14212,7 +14640,6 @@ negativeSummary
 | System.Collections.Immutable;ImmutableSortedSet<>;ExceptWith;(System.Collections.Generic.IEnumerable<T>);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;IndexOf;(System.Object);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;IndexOf;(T);generated |
-| System.Collections.Immutable;ImmutableSortedSet<>;Intersect;(System.Collections.Generic.IEnumerable<T>);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;IntersectWith;(System.Collections.Generic.IEnumerable<T>);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;IsProperSubsetOf;(System.Collections.Generic.IEnumerable<T>);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;IsProperSupersetOf;(System.Collections.Generic.IEnumerable<T>);generated |
@@ -14224,7 +14651,6 @@ negativeSummary
 | System.Collections.Immutable;ImmutableSortedSet<>;Remove;(T);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;RemoveAt;(System.Int32);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;SetEquals;(System.Collections.Generic.IEnumerable<T>);generated |
-| System.Collections.Immutable;ImmutableSortedSet<>;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;UnionWith;(System.Collections.Generic.IEnumerable<T>);generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;get_Count;();generated |
@@ -15889,7 +16315,6 @@ negativeSummary
 | System.ComponentModel;TypeConverter+SimplePropertyDescriptor;get_ComponentType;();generated |
 | System.ComponentModel;TypeConverter+SimplePropertyDescriptor;get_IsReadOnly;();generated |
 | System.ComponentModel;TypeConverter+SimplePropertyDescriptor;get_PropertyType;();generated |
-| System.ComponentModel;TypeConverter+StandardValuesCollection;GetEnumerator;();generated |
 | System.ComponentModel;TypeConverter+StandardValuesCollection;get_Count;();generated |
 | System.ComponentModel;TypeConverter+StandardValuesCollection;get_IsSynchronized;();generated |
 | System.ComponentModel;TypeConverter+StandardValuesCollection;get_SyncRoot;();generated |
@@ -16172,14 +16597,9 @@ negativeSummary
 | System.Data.Common;DbCommand;DbCommand;();generated |
 | System.Data.Common;DbCommand;DisposeAsync;();generated |
 | System.Data.Common;DbCommand;ExecuteDbDataReader;(System.Data.CommandBehavior);generated |
-| System.Data.Common;DbCommand;ExecuteDbDataReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);generated |
 | System.Data.Common;DbCommand;ExecuteNonQuery;();generated |
 | System.Data.Common;DbCommand;ExecuteNonQueryAsync;();generated |
 | System.Data.Common;DbCommand;ExecuteNonQueryAsync;(System.Threading.CancellationToken);generated |
-| System.Data.Common;DbCommand;ExecuteReaderAsync;();generated |
-| System.Data.Common;DbCommand;ExecuteReaderAsync;(System.Data.CommandBehavior);generated |
-| System.Data.Common;DbCommand;ExecuteReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);generated |
-| System.Data.Common;DbCommand;ExecuteReaderAsync;(System.Threading.CancellationToken);generated |
 | System.Data.Common;DbCommand;ExecuteScalar;();generated |
 | System.Data.Common;DbCommand;ExecuteScalarAsync;();generated |
 | System.Data.Common;DbCommand;ExecuteScalarAsync;(System.Threading.CancellationToken);generated |
@@ -16263,7 +16683,6 @@ negativeSummary
 | System.Data.Common;DbConnectionStringBuilder;GetDefaultEvent;();generated |
 | System.Data.Common;DbConnectionStringBuilder;GetDefaultProperty;();generated |
 | System.Data.Common;DbConnectionStringBuilder;GetEditor;(System.Type);generated |
-| System.Data.Common;DbConnectionStringBuilder;GetEnumerator;();generated |
 | System.Data.Common;DbConnectionStringBuilder;GetEvents;();generated |
 | System.Data.Common;DbConnectionStringBuilder;GetEvents;(System.Attribute[]);generated |
 | System.Data.Common;DbConnectionStringBuilder;GetProperties;(System.Collections.Hashtable);generated |
@@ -16331,8 +16750,6 @@ negativeSummary
 | System.Data.Common;DbDataReader;GetDecimal;(System.Int32);generated |
 | System.Data.Common;DbDataReader;GetDouble;(System.Int32);generated |
 | System.Data.Common;DbDataReader;GetFieldType;(System.Int32);generated |
-| System.Data.Common;DbDataReader;GetFieldValueAsync<>;(System.Int32);generated |
-| System.Data.Common;DbDataReader;GetFieldValueAsync<>;(System.Int32,System.Threading.CancellationToken);generated |
 | System.Data.Common;DbDataReader;GetFloat;(System.Int32);generated |
 | System.Data.Common;DbDataReader;GetGuid;(System.Int32);generated |
 | System.Data.Common;DbDataReader;GetInt16;(System.Int32);generated |
@@ -16342,7 +16759,6 @@ negativeSummary
 | System.Data.Common;DbDataReader;GetOrdinal;(System.String);generated |
 | System.Data.Common;DbDataReader;GetProviderSpecificFieldType;(System.Int32);generated |
 | System.Data.Common;DbDataReader;GetSchemaTable;();generated |
-| System.Data.Common;DbDataReader;GetSchemaTableAsync;(System.Threading.CancellationToken);generated |
 | System.Data.Common;DbDataReader;GetStream;(System.Int32);generated |
 | System.Data.Common;DbDataReader;GetString;(System.Int32);generated |
 | System.Data.Common;DbDataReader;GetValue;(System.Int32);generated |
@@ -17057,9 +17473,6 @@ negativeSummary
 | System.Data;DataColumnChangeEventArgs;get_ProposedValue;();generated |
 | System.Data;DataColumnChangeEventArgs;get_Row;();generated |
 | System.Data;DataColumnChangeEventArgs;set_ProposedValue;(System.Object);generated |
-| System.Data;DataColumnCollection;Add;();generated |
-| System.Data;DataColumnCollection;Add;(System.String,System.Type);generated |
-| System.Data;DataColumnCollection;Add;(System.String,System.Type,System.String);generated |
 | System.Data;DataColumnCollection;CanRemove;(System.Data.DataColumn);generated |
 | System.Data;DataColumnCollection;Clear;();generated |
 | System.Data;DataColumnCollection;Contains;(System.String);generated |
@@ -17082,7 +17495,6 @@ negativeSummary
 | System.Data;DataReaderExtensions;GetDecimal;(System.Data.Common.DbDataReader,System.String);generated |
 | System.Data;DataReaderExtensions;GetDouble;(System.Data.Common.DbDataReader,System.String);generated |
 | System.Data;DataReaderExtensions;GetFieldType;(System.Data.Common.DbDataReader,System.String);generated |
-| System.Data;DataReaderExtensions;GetFieldValueAsync<>;(System.Data.Common.DbDataReader,System.String,System.Threading.CancellationToken);generated |
 | System.Data;DataReaderExtensions;GetFloat;(System.Data.Common.DbDataReader,System.String);generated |
 | System.Data;DataReaderExtensions;GetInt16;(System.Data.Common.DbDataReader,System.String);generated |
 | System.Data;DataReaderExtensions;GetInt32;(System.Data.Common.DbDataReader,System.String);generated |
@@ -17100,10 +17512,6 @@ negativeSummary
 | System.Data;DataRelation;get_Nested;();generated |
 | System.Data;DataRelation;get_ParentTable;();generated |
 | System.Data;DataRelation;set_Nested;(System.Boolean);generated |
-| System.Data;DataRelationCollection;Add;(System.Data.DataColumn,System.Data.DataColumn);generated |
-| System.Data;DataRelationCollection;Add;(System.Data.DataColumn[],System.Data.DataColumn[]);generated |
-| System.Data;DataRelationCollection;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn);generated |
-| System.Data;DataRelationCollection;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);generated |
 | System.Data;DataRelationCollection;AddCore;(System.Data.DataRelation);generated |
 | System.Data;DataRelationCollection;CanRemove;(System.Data.DataRelation);generated |
 | System.Data;DataRelationCollection;Clear;();generated |
@@ -17356,7 +17764,6 @@ negativeSummary
 | System.Data;DataTableClearEventArgs;get_Table;();generated |
 | System.Data;DataTableClearEventArgs;get_TableName;();generated |
 | System.Data;DataTableClearEventArgs;get_TableNamespace;();generated |
-| System.Data;DataTableCollection;Add;();generated |
 | System.Data;DataTableCollection;CanRemove;(System.Data.DataTable);generated |
 | System.Data;DataTableCollection;Clear;();generated |
 | System.Data;DataTableCollection;Contains;(System.String);generated |
@@ -20258,12 +20665,10 @@ negativeSummary
 | System.IO.Compression;DeflateStream;EndWrite;(System.IAsyncResult);generated |
 | System.IO.Compression;DeflateStream;Flush;();generated |
 | System.IO.Compression;DeflateStream;Read;(System.Span<System.Byte>);generated |
-| System.IO.Compression;DeflateStream;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);generated |
 | System.IO.Compression;DeflateStream;ReadByte;();generated |
 | System.IO.Compression;DeflateStream;Seek;(System.Int64,System.IO.SeekOrigin);generated |
 | System.IO.Compression;DeflateStream;SetLength;(System.Int64);generated |
 | System.IO.Compression;DeflateStream;Write;(System.ReadOnlySpan<System.Byte>);generated |
-| System.IO.Compression;DeflateStream;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);generated |
 | System.IO.Compression;DeflateStream;get_CanRead;();generated |
 | System.IO.Compression;DeflateStream;get_CanSeek;();generated |
 | System.IO.Compression;DeflateStream;get_CanWrite;();generated |
@@ -20278,12 +20683,10 @@ negativeSummary
 | System.IO.Compression;GZipStream;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionLevel);generated |
 | System.IO.Compression;GZipStream;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionMode);generated |
 | System.IO.Compression;GZipStream;Read;(System.Span<System.Byte>);generated |
-| System.IO.Compression;GZipStream;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);generated |
 | System.IO.Compression;GZipStream;ReadByte;();generated |
 | System.IO.Compression;GZipStream;Seek;(System.Int64,System.IO.SeekOrigin);generated |
 | System.IO.Compression;GZipStream;SetLength;(System.Int64);generated |
 | System.IO.Compression;GZipStream;Write;(System.ReadOnlySpan<System.Byte>);generated |
-| System.IO.Compression;GZipStream;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);generated |
 | System.IO.Compression;GZipStream;get_CanRead;();generated |
 | System.IO.Compression;GZipStream;get_CanSeek;();generated |
 | System.IO.Compression;GZipStream;get_CanWrite;();generated |
@@ -20658,7 +21061,6 @@ negativeSummary
 | System.IO;BinaryWriter;Close;();generated |
 | System.IO;BinaryWriter;Dispose;();generated |
 | System.IO;BinaryWriter;Dispose;(System.Boolean);generated |
-| System.IO;BinaryWriter;DisposeAsync;();generated |
 | System.IO;BinaryWriter;Flush;();generated |
 | System.IO;BinaryWriter;Seek;(System.Int32,System.IO.SeekOrigin);generated |
 | System.IO;BinaryWriter;Write7BitEncodedInt64;(System.Int64);generated |
@@ -21052,18 +21454,14 @@ negativeSummary
 | System.IO;Stream;EndRead;(System.IAsyncResult);generated |
 | System.IO;Stream;EndWrite;(System.IAsyncResult);generated |
 | System.IO;Stream;Flush;();generated |
-| System.IO;Stream;FlushAsync;();generated |
-| System.IO;Stream;FlushAsync;(System.Threading.CancellationToken);generated |
 | System.IO;Stream;ObjectInvariant;();generated |
 | System.IO;Stream;Read;(System.Span<System.Byte>);generated |
-| System.IO;Stream;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);generated |
 | System.IO;Stream;ReadByte;();generated |
 | System.IO;Stream;Seek;(System.Int64,System.IO.SeekOrigin);generated |
 | System.IO;Stream;SetLength;(System.Int64);generated |
 | System.IO;Stream;ValidateBufferArguments;(System.Byte[],System.Int32,System.Int32);generated |
 | System.IO;Stream;ValidateCopyToArguments;(System.IO.Stream,System.Int32);generated |
 | System.IO;Stream;Write;(System.ReadOnlySpan<System.Byte>);generated |
-| System.IO;Stream;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);generated |
 | System.IO;Stream;WriteByte;(System.Byte);generated |
 | System.IO;Stream;get_CanRead;();generated |
 | System.IO;Stream;get_CanSeek;();generated |
@@ -21085,7 +21483,6 @@ negativeSummary
 | System.IO;StreamWriter;Dispose;(System.Boolean);generated |
 | System.IO;StreamWriter;DisposeAsync;();generated |
 | System.IO;StreamWriter;Flush;();generated |
-| System.IO;StreamWriter;FlushAsync;();generated |
 | System.IO;StreamWriter;StreamWriter;(System.IO.Stream);generated |
 | System.IO;StreamWriter;StreamWriter;(System.IO.Stream,System.Text.Encoding);generated |
 | System.IO;StreamWriter;StreamWriter;(System.IO.Stream,System.Text.Encoding,System.Int32);generated |
@@ -21104,15 +21501,8 @@ negativeSummary
 | System.IO;StreamWriter;Write;(System.String,System.Object,System.Object);generated |
 | System.IO;StreamWriter;Write;(System.String,System.Object,System.Object,System.Object);generated |
 | System.IO;StreamWriter;Write;(System.String,System.Object[]);generated |
-| System.IO;StreamWriter;WriteAsync;(System.Char);generated |
-| System.IO;StreamWriter;WriteAsync;(System.Char[],System.Int32,System.Int32);generated |
-| System.IO;StreamWriter;WriteAsync;(System.String);generated |
 | System.IO;StreamWriter;WriteLine;(System.ReadOnlySpan<System.Char>);generated |
 | System.IO;StreamWriter;WriteLine;(System.String);generated |
-| System.IO;StreamWriter;WriteLineAsync;();generated |
-| System.IO;StreamWriter;WriteLineAsync;(System.Char);generated |
-| System.IO;StreamWriter;WriteLineAsync;(System.Char[],System.Int32,System.Int32);generated |
-| System.IO;StreamWriter;WriteLineAsync;(System.String);generated |
 | System.IO;StreamWriter;get_AutoFlush;();generated |
 | System.IO;StreamWriter;set_AutoFlush;(System.Boolean);generated |
 | System.IO;StringReader;Close;();generated |
@@ -21126,10 +21516,8 @@ negativeSummary
 | System.IO;StringWriter;StringWriter;(System.Text.StringBuilder);generated |
 | System.IO;StringWriter;Write;(System.Char);generated |
 | System.IO;StringWriter;Write;(System.ReadOnlySpan<System.Char>);generated |
-| System.IO;StringWriter;Write;(System.Text.StringBuilder);generated |
 | System.IO;StringWriter;WriteAsync;(System.Char);generated |
 | System.IO;StringWriter;WriteLine;(System.ReadOnlySpan<System.Char>);generated |
-| System.IO;StringWriter;WriteLine;(System.Text.StringBuilder);generated |
 | System.IO;StringWriter;WriteLineAsync;(System.Char);generated |
 | System.IO;StringWriter;get_Encoding;();generated |
 | System.IO;TextReader;Close;();generated |
@@ -21142,7 +21530,6 @@ negativeSummary
 | System.IO;TextWriter;Dispose;(System.Boolean);generated |
 | System.IO;TextWriter;DisposeAsync;();generated |
 | System.IO;TextWriter;Flush;();generated |
-| System.IO;TextWriter;FlushAsync;();generated |
 | System.IO;TextWriter;TextWriter;();generated |
 | System.IO;TextWriter;Write;(System.Boolean);generated |
 | System.IO;TextWriter;Write;(System.Char);generated |
@@ -21157,9 +21544,6 @@ negativeSummary
 | System.IO;TextWriter;Write;(System.Text.StringBuilder);generated |
 | System.IO;TextWriter;Write;(System.UInt32);generated |
 | System.IO;TextWriter;Write;(System.UInt64);generated |
-| System.IO;TextWriter;WriteAsync;(System.Char);generated |
-| System.IO;TextWriter;WriteAsync;(System.Char[],System.Int32,System.Int32);generated |
-| System.IO;TextWriter;WriteAsync;(System.String);generated |
 | System.IO;TextWriter;WriteLine;();generated |
 | System.IO;TextWriter;WriteLine;(System.Boolean);generated |
 | System.IO;TextWriter;WriteLine;(System.Char);generated |
@@ -21169,13 +21553,8 @@ negativeSummary
 | System.IO;TextWriter;WriteLine;(System.Int64);generated |
 | System.IO;TextWriter;WriteLine;(System.ReadOnlySpan<System.Char>);generated |
 | System.IO;TextWriter;WriteLine;(System.Single);generated |
-| System.IO;TextWriter;WriteLine;(System.Text.StringBuilder);generated |
 | System.IO;TextWriter;WriteLine;(System.UInt32);generated |
 | System.IO;TextWriter;WriteLine;(System.UInt64);generated |
-| System.IO;TextWriter;WriteLineAsync;();generated |
-| System.IO;TextWriter;WriteLineAsync;(System.Char);generated |
-| System.IO;TextWriter;WriteLineAsync;(System.Char[],System.Int32,System.Int32);generated |
-| System.IO;TextWriter;WriteLineAsync;(System.String);generated |
 | System.IO;TextWriter;get_Encoding;();generated |
 | System.IO;UnmanagedMemoryAccessor;Dispose;();generated |
 | System.IO;UnmanagedMemoryAccessor;Dispose;(System.Boolean);generated |
@@ -21885,7 +22264,6 @@ negativeSummary
 | System.Net.Http.Headers;HttpHeadersNonValidated+Enumerator;Reset;();generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;Contains;(System.String);generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;ContainsKey;(System.String);generated |
-| System.Net.Http.Headers;HttpHeadersNonValidated;GetEnumerator;();generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;get_Count;();generated |
 | System.Net.Http.Headers;HttpRequestHeaders;get_Accept;();generated |
 | System.Net.Http.Headers;HttpRequestHeaders;get_AcceptCharset;();generated |
@@ -22068,7 +22446,6 @@ negativeSummary
 | System.Net.Http.Json;JsonContent;TryComputeLength;(System.Int64);generated |
 | System.Net.Http.Json;JsonContent;get_ObjectType;();generated |
 | System.Net.Http.Json;JsonContent;get_Value;();generated |
-| System.Net.Http;ByteArrayContent;CreateContentReadStreamAsync;();generated |
 | System.Net.Http;ByteArrayContent;TryComputeLength;(System.Int64);generated |
 | System.Net.Http;DelegatingHandler;DelegatingHandler;();generated |
 | System.Net.Http;DelegatingHandler;Dispose;(System.Boolean);generated |
@@ -22168,7 +22545,6 @@ negativeSummary
 | System.Net.Http;HttpClientHandler;set_UseDefaultCredentials;(System.Boolean);generated |
 | System.Net.Http;HttpClientHandler;set_UseProxy;(System.Boolean);generated |
 | System.Net.Http;HttpContent;CreateContentReadStreamAsync;();generated |
-| System.Net.Http;HttpContent;CreateContentReadStreamAsync;(System.Threading.CancellationToken);generated |
 | System.Net.Http;HttpContent;Dispose;();generated |
 | System.Net.Http;HttpContent;Dispose;(System.Boolean);generated |
 | System.Net.Http;HttpContent;HttpContent;();generated |
@@ -22255,7 +22631,6 @@ negativeSummary
 | System.Net.Http;MultipartContent;get_HeaderEncodingSelector;();generated |
 | System.Net.Http;MultipartFormDataContent;MultipartFormDataContent;();generated |
 | System.Net.Http;MultipartFormDataContent;MultipartFormDataContent;(System.String);generated |
-| System.Net.Http;ReadOnlyMemoryContent;CreateContentReadStreamAsync;();generated |
 | System.Net.Http;ReadOnlyMemoryContent;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);generated |
 | System.Net.Http;ReadOnlyMemoryContent;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);generated |
 | System.Net.Http;ReadOnlyMemoryContent;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);generated |
@@ -22697,7 +23072,6 @@ negativeSummary
 | System.Net.NetworkInformation;UnicastIPAddressInformationCollection;get_Count;();generated |
 | System.Net.NetworkInformation;UnicastIPAddressInformationCollection;get_IsReadOnly;();generated |
 | System.Net.Security;AuthenticatedStream;Dispose;(System.Boolean);generated |
-| System.Net.Security;AuthenticatedStream;DisposeAsync;();generated |
 | System.Net.Security;AuthenticatedStream;get_IsAuthenticated;();generated |
 | System.Net.Security;AuthenticatedStream;get_IsEncrypted;();generated |
 | System.Net.Security;AuthenticatedStream;get_IsMutuallyAuthenticated;();generated |
@@ -22910,7 +23284,6 @@ negativeSummary
 | System.Net.Sockets;SendPacketsElement;get_Offset;();generated |
 | System.Net.Sockets;SendPacketsElement;get_OffsetLong;();generated |
 | System.Net.Sockets;Socket;AcceptAsync;();generated |
-| System.Net.Sockets;Socket;AcceptAsync;(System.Net.Sockets.Socket);generated |
 | System.Net.Sockets;Socket;CancelConnectAsync;(System.Net.Sockets.SocketAsyncEventArgs);generated |
 | System.Net.Sockets;Socket;Close;();generated |
 | System.Net.Sockets;Socket;Close;(System.Int32);generated |
@@ -22925,7 +23298,6 @@ negativeSummary
 | System.Net.Sockets;Socket;DuplicateAndClose;(System.Int32);generated |
 | System.Net.Sockets;Socket;EndAccept;(System.Byte[],System.IAsyncResult);generated |
 | System.Net.Sockets;Socket;EndAccept;(System.Byte[],System.Int32,System.IAsyncResult);generated |
-| System.Net.Sockets;Socket;EndAccept;(System.IAsyncResult);generated |
 | System.Net.Sockets;Socket;EndConnect;(System.IAsyncResult);generated |
 | System.Net.Sockets;Socket;EndDisconnect;(System.IAsyncResult);generated |
 | System.Net.Sockets;Socket;EndReceive;(System.IAsyncResult);generated |
@@ -22958,8 +23330,6 @@ negativeSummary
 | System.Net.Sockets;Socket;Receive;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.Sockets.SocketError);generated |
 | System.Net.Sockets;Socket;ReceiveAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags);generated |
 | System.Net.Sockets;Socket;ReceiveAsync;(System.Collections.Generic.IList<System.ArraySegment<System.Byte>>,System.Net.Sockets.SocketFlags);generated |
-| System.Net.Sockets;Socket;ReceiveFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated |
-| System.Net.Sockets;Socket;ReceiveMessageFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated |
 | System.Net.Sockets;Socket;Select;(System.Collections.IList,System.Collections.IList,System.Collections.IList,System.Int32);generated |
 | System.Net.Sockets;Socket;Send;(System.Byte[]);generated |
 | System.Net.Sockets;Socket;Send;(System.Byte[],System.Int32,System.Int32,System.Net.Sockets.SocketFlags);generated |
@@ -23057,14 +23427,11 @@ negativeSummary
 | System.Net.Sockets;SocketInformation;set_Options;(System.Net.Sockets.SocketInformationOptions);generated |
 | System.Net.Sockets;SocketInformation;set_ProtocolInformation;(System.Byte[]);generated |
 | System.Net.Sockets;SocketTaskExtensions;AcceptAsync;(System.Net.Sockets.Socket);generated |
-| System.Net.Sockets;SocketTaskExtensions;AcceptAsync;(System.Net.Sockets.Socket,System.Net.Sockets.Socket);generated |
 | System.Net.Sockets;SocketTaskExtensions;ConnectAsync;(System.Net.Sockets.Socket,System.Net.IPAddress[],System.Int32);generated |
 | System.Net.Sockets;SocketTaskExtensions;ConnectAsync;(System.Net.Sockets.Socket,System.Net.IPAddress[],System.Int32,System.Threading.CancellationToken);generated |
 | System.Net.Sockets;SocketTaskExtensions;ConnectAsync;(System.Net.Sockets.Socket,System.String,System.Int32);generated |
 | System.Net.Sockets;SocketTaskExtensions;ReceiveAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags);generated |
 | System.Net.Sockets;SocketTaskExtensions;ReceiveAsync;(System.Net.Sockets.Socket,System.Collections.Generic.IList<System.ArraySegment<System.Byte>>,System.Net.Sockets.SocketFlags);generated |
-| System.Net.Sockets;SocketTaskExtensions;ReceiveFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated |
-| System.Net.Sockets;SocketTaskExtensions;ReceiveMessageFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated |
 | System.Net.Sockets;SocketTaskExtensions;SendAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags);generated |
 | System.Net.Sockets;SocketTaskExtensions;SendAsync;(System.Net.Sockets.Socket,System.Collections.Generic.IList<System.ArraySegment<System.Byte>>,System.Net.Sockets.SocketFlags);generated |
 | System.Net.Sockets;TcpClient;Close;();generated |
@@ -23106,8 +23473,6 @@ negativeSummary
 | System.Net.Sockets;TcpListener;AcceptTcpClientAsync;(System.Threading.CancellationToken);generated |
 | System.Net.Sockets;TcpListener;AllowNatTraversal;(System.Boolean);generated |
 | System.Net.Sockets;TcpListener;Create;(System.Int32);generated |
-| System.Net.Sockets;TcpListener;EndAcceptSocket;(System.IAsyncResult);generated |
-| System.Net.Sockets;TcpListener;EndAcceptTcpClient;(System.IAsyncResult);generated |
 | System.Net.Sockets;TcpListener;Pending;();generated |
 | System.Net.Sockets;TcpListener;Start;();generated |
 | System.Net.Sockets;TcpListener;Start;(System.Int32);generated |
@@ -23321,10 +23686,6 @@ negativeSummary
 | System.Net;CredentialCache;Remove;(System.Uri,System.String);generated |
 | System.Net;CredentialCache;get_DefaultCredentials;();generated |
 | System.Net;CredentialCache;get_DefaultNetworkCredentials;();generated |
-| System.Net;Dns;EndGetHostAddresses;(System.IAsyncResult);generated |
-| System.Net;Dns;EndGetHostByName;(System.IAsyncResult);generated |
-| System.Net;Dns;EndGetHostEntry;(System.IAsyncResult);generated |
-| System.Net;Dns;EndResolve;(System.IAsyncResult);generated |
 | System.Net;Dns;GetHostAddresses;(System.String);generated |
 | System.Net;Dns;GetHostAddresses;(System.String,System.Net.Sockets.AddressFamily);generated |
 | System.Net;Dns;GetHostAddressesAsync;(System.String);generated |
@@ -23353,8 +23714,6 @@ negativeSummary
 | System.Net;EndPoint;Serialize;();generated |
 | System.Net;EndPoint;get_AddressFamily;();generated |
 | System.Net;FileWebRequest;Abort;();generated |
-| System.Net;FileWebRequest;EndGetRequestStream;(System.IAsyncResult);generated |
-| System.Net;FileWebRequest;EndGetResponse;(System.IAsyncResult);generated |
 | System.Net;FileWebRequest;FileWebRequest;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated |
 | System.Net;FileWebRequest;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated |
 | System.Net;FileWebRequest;GetRequestStreamAsync;();generated |
@@ -23509,9 +23868,6 @@ negativeSummary
 | System.Net;HttpWebRequest;AddRange;(System.String,System.Int32,System.Int32);generated |
 | System.Net;HttpWebRequest;AddRange;(System.String,System.Int64);generated |
 | System.Net;HttpWebRequest;AddRange;(System.String,System.Int64,System.Int64);generated |
-| System.Net;HttpWebRequest;EndGetRequestStream;(System.IAsyncResult);generated |
-| System.Net;HttpWebRequest;EndGetRequestStream;(System.IAsyncResult,System.Net.TransportContext);generated |
-| System.Net;HttpWebRequest;EndGetResponse;(System.IAsyncResult);generated |
 | System.Net;HttpWebRequest;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated |
 | System.Net;HttpWebRequest;HttpWebRequest;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated |
 | System.Net;HttpWebRequest;get_AllowAutoRedirect;();generated |
@@ -23896,6 +24252,7 @@ negativeSummary
 | System.Numerics;BigInteger;Log;(System.Numerics.BigInteger,System.Double);generated |
 | System.Numerics;BigInteger;ModPow;(System.Numerics.BigInteger,System.Numerics.BigInteger,System.Numerics.BigInteger);generated |
 | System.Numerics;BigInteger;Multiply;(System.Numerics.BigInteger,System.Numerics.BigInteger);generated |
+| System.Numerics;BigInteger;Negate;(System.Numerics.BigInteger);generated |
 | System.Numerics;BigInteger;Parse;(System.ReadOnlySpan<System.Char>,System.Globalization.NumberStyles,System.IFormatProvider);generated |
 | System.Numerics;BigInteger;Parse;(System.String);generated |
 | System.Numerics;BigInteger;Parse;(System.String,System.Globalization.NumberStyles);generated |
@@ -26582,7 +26939,6 @@ negativeSummary
 | System.Resources;ResourceSet;Dispose;(System.Boolean);generated |
 | System.Resources;ResourceSet;GetDefaultReader;();generated |
 | System.Resources;ResourceSet;GetDefaultWriter;();generated |
-| System.Resources;ResourceSet;GetEnumerator;();generated |
 | System.Resources;ResourceSet;GetObject;(System.String);generated |
 | System.Resources;ResourceSet;GetObject;(System.String,System.Boolean);generated |
 | System.Resources;ResourceSet;GetString;(System.String);generated |
@@ -26708,6 +27064,8 @@ negativeSummary
 | System.Runtime.CompilerServices;DisablePrivateReflectionAttribute;DisablePrivateReflectionAttribute;();generated |
 | System.Runtime.CompilerServices;DiscardableAttribute;DiscardableAttribute;();generated |
 | System.Runtime.CompilerServices;DynamicAttribute;DynamicAttribute;();generated |
+| System.Runtime.CompilerServices;DynamicAttribute;DynamicAttribute;(System.Boolean[]);generated |
+| System.Runtime.CompilerServices;DynamicAttribute;get_TransformFlags;();generated |
 | System.Runtime.CompilerServices;EnumeratorCancellationAttribute;EnumeratorCancellationAttribute;();generated |
 | System.Runtime.CompilerServices;FixedAddressValueTypeAttribute;FixedAddressValueTypeAttribute;();generated |
 | System.Runtime.CompilerServices;FixedBufferAttribute;FixedBufferAttribute;(System.Type,System.Int32);generated |
@@ -32338,7 +32696,6 @@ negativeSummary
 | System.Security.Cryptography.X509Certificates;X509Certificate;get_Handle;();generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;MoveNext;();generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;Reset;();generated |
-| System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;X509CertificateEnumerator;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection;Contains;(System.Security.Cryptography.X509Certificates.X509Certificate);generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection;GetHashCode;();generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection;IndexOf;(System.Security.Cryptography.X509Certificates.X509Certificate);generated |
@@ -32499,7 +32856,6 @@ negativeSummary
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;get_IsReadOnly;();generated |
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;get_IsSynchronized;();generated |
 | System.Security.Cryptography.Xml;IRelDecryptor;Decrypt;(System.Security.Cryptography.Xml.EncryptionMethod,System.Security.Cryptography.Xml.KeyInfo,System.IO.Stream);generated |
-| System.Security.Cryptography.Xml;KeyInfo;GetEnumerator;(System.Type);generated |
 | System.Security.Cryptography.Xml;KeyInfo;GetXml;();generated |
 | System.Security.Cryptography.Xml;KeyInfo;KeyInfo;();generated |
 | System.Security.Cryptography.Xml;KeyInfo;get_Count;();generated |
@@ -32566,7 +32922,6 @@ negativeSummary
 | System.Security.Cryptography.Xml;Transform;Transform;();generated |
 | System.Security.Cryptography.Xml;Transform;get_InputTypes;();generated |
 | System.Security.Cryptography.Xml;Transform;get_OutputTypes;();generated |
-| System.Security.Cryptography.Xml;TransformChain;GetEnumerator;();generated |
 | System.Security.Cryptography.Xml;TransformChain;TransformChain;();generated |
 | System.Security.Cryptography.Xml;TransformChain;get_Count;();generated |
 | System.Security.Cryptography.Xml;XmlDecryptionTransform;GetInnerXml;();generated |
@@ -35529,10 +35884,6 @@ negativeSummary
 | System.Threading.Tasks.Dataflow;DataflowBlock;OutputAvailableAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>);generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;OutputAvailableAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAllAsync<>;(System.Threading.Tasks.Dataflow.IReceivableSourceBlock<TOutput>,System.Threading.CancellationToken);generated |
-| System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>);generated |
-| System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);generated |
-| System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);generated |
-| System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;SendAsync<>;(System.Threading.Tasks.Dataflow.ITargetBlock<TInput>,TInput);generated |
 | System.Threading.Tasks.Dataflow;DataflowBlockOptions;DataflowBlockOptions;();generated |
 | System.Threading.Tasks.Dataflow;DataflowBlockOptions;get_BoundedCapacity;();generated |
@@ -36654,13 +37005,10 @@ negativeSummary
 | System.Xml.Schema;XmlSchemaParticle;set_MinOccursString;(System.String);generated |
 | System.Xml.Schema;XmlSchemaPatternFacet;XmlSchemaPatternFacet;();generated |
 | System.Xml.Schema;XmlSchemaRedefine;XmlSchemaRedefine;();generated |
-| System.Xml.Schema;XmlSchemaSet;Add;(System.Xml.Schema.XmlSchemaSet);generated |
 | System.Xml.Schema;XmlSchemaSet;Compile;();generated |
 | System.Xml.Schema;XmlSchemaSet;Contains;(System.String);generated |
 | System.Xml.Schema;XmlSchemaSet;Contains;(System.Xml.Schema.XmlSchema);generated |
-| System.Xml.Schema;XmlSchemaSet;CopyTo;(System.Xml.Schema.XmlSchema[],System.Int32);generated |
 | System.Xml.Schema;XmlSchemaSet;RemoveRecursive;(System.Xml.Schema.XmlSchema);generated |
-| System.Xml.Schema;XmlSchemaSet;Schemas;();generated |
 | System.Xml.Schema;XmlSchemaSet;Schemas;(System.String);generated |
 | System.Xml.Schema;XmlSchemaSet;XmlSchemaSet;();generated |
 | System.Xml.Schema;XmlSchemaSet;get_Count;();generated |
@@ -36912,7 +37260,6 @@ negativeSummary
 | System.Xml.Serialization;XmlSerializationWriter;WriteEmptyTag;(System.String,System.String);generated |
 | System.Xml.Serialization;XmlSerializationWriter;WriteEndElement;();generated |
 | System.Xml.Serialization;XmlSerializationWriter;WriteEndElement;(System.Object);generated |
-| System.Xml.Serialization;XmlSerializationWriter;WriteId;(System.Object);generated |
 | System.Xml.Serialization;XmlSerializationWriter;WriteNamespaceDeclarations;(System.Xml.Serialization.XmlSerializerNamespaces);generated |
 | System.Xml.Serialization;XmlSerializationWriter;WriteNullTagEncoded;(System.String);generated |
 | System.Xml.Serialization;XmlSerializationWriter;WriteNullTagEncoded;(System.String,System.String);generated |
@@ -36921,8 +37268,6 @@ negativeSummary
 | System.Xml.Serialization;XmlSerializationWriter;WriteNullableQualifiedNameEncoded;(System.String,System.String,System.Xml.XmlQualifiedName,System.Xml.XmlQualifiedName);generated |
 | System.Xml.Serialization;XmlSerializationWriter;WriteNullableQualifiedNameLiteral;(System.String,System.String,System.Xml.XmlQualifiedName);generated |
 | System.Xml.Serialization;XmlSerializationWriter;WriteReferencedElements;();generated |
-| System.Xml.Serialization;XmlSerializationWriter;WriteReferencingElement;(System.String,System.String,System.Object);generated |
-| System.Xml.Serialization;XmlSerializationWriter;WriteReferencingElement;(System.String,System.String,System.Object,System.Boolean);generated |
 | System.Xml.Serialization;XmlSerializationWriter;WriteStartDocument;();generated |
 | System.Xml.Serialization;XmlSerializationWriter;WriteStartElement;(System.String);generated |
 | System.Xml.Serialization;XmlSerializationWriter;WriteStartElement;(System.String,System.String);generated |
@@ -40382,27 +40727,6 @@ negativeSummary
 | System;Tuple<>;GetHashCode;();generated |
 | System;Tuple<>;GetHashCode;(System.Collections.IEqualityComparer);generated |
 | System;Tuple<>;get_Length;();generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20,T21>>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20>>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19>>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18>>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17>>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16>>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15>>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8>>);generated |
-| System;TupleExtensions;ToTuple<,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7>);generated |
-| System;TupleExtensions;ToTuple<,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6>);generated |
-| System;TupleExtensions;ToTuple<,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5>);generated |
-| System;TupleExtensions;ToTuple<,,,>;(System.ValueTuple<T1,T2,T3,T4>);generated |
-| System;TupleExtensions;ToTuple<,,>;(System.ValueTuple<T1,T2,T3>);generated |
-| System;TupleExtensions;ToTuple<,>;(System.ValueTuple<T1,T2>);generated |
-| System;TupleExtensions;ToTuple<>;(System.ValueTuple<T1>);generated |
 | System;Type;Equals;(System.Object);generated |
 | System;Type;Equals;(System.Type);generated |
 | System;Type;GetArrayRank;();generated |
diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected b/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
index d6076973c37..7f7930bef31 100644
--- a/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
+++ b/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
@@ -226,6 +226,7 @@ summary
 | Microsoft.Extensions.FileProviders.Composite;CompositeDirectoryContents;false;CompositeDirectoryContents;(System.Collections.Generic.IList<Microsoft.Extensions.FileProviders.IFileProvider>,System.String);;Argument[1];Argument[this];taint;generated |
 | Microsoft.Extensions.FileProviders.Internal;PhysicalDirectoryContents;false;PhysicalDirectoryContents;(System.String,Microsoft.Extensions.FileProviders.Physical.ExclusionFilters);;Argument[0];Argument[this];taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalDirectoryInfo;false;PhysicalDirectoryInfo;(System.IO.DirectoryInfo);;Argument[0];Argument[this];taint;generated |
+| Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;CreateReadStream;();;Argument[this];ReturnValue;taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;PhysicalFileInfo;(System.IO.FileInfo);;Argument[0];Argument[this];taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;get_PhysicalPath;();;Argument[this];ReturnValue;taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalFilesWatcher;false;PhysicalFilesWatcher;(System.String,System.IO.FileSystemWatcher,System.Boolean,Microsoft.Extensions.FileProviders.Physical.ExclusionFilters);;Argument[0];Argument[this];taint;generated |
@@ -382,6 +383,7 @@ summary
 | Microsoft.Extensions.Primitives;StringValues;false;set_Item;(System.Int32,System.String);;Argument[0];ReturnValue;taint;manual |
 | Microsoft.Extensions.Primitives;StringValues;false;set_Item;(System.Int32,System.String);;Argument[1];ReturnValue;taint;manual |
 | Microsoft.Extensions.Primitives;StringValues;false;set_Item;(System.Int32,System.String);;Argument[this];ReturnValue;taint;manual |
+| Microsoft.VisualBasic;Collection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | Microsoft.VisualBasic;Collection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | Microsoft.VisualBasic;Collection;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | Microsoft.VisualBasic;Collection;false;get_Item;(System.Object);;Argument[this].Element;ReturnValue;value;manual |
@@ -537,6 +539,8 @@ summary
 | System.CodeDom.Compiler;GeneratedCodeAttribute;false;get_Version;();;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;IndentedTextWriter;(System.IO.TextWriter,System.String);;Argument[0];Argument[this];taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;IndentedTextWriter;(System.IO.TextWriter,System.String);;Argument[1];Argument[this];taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineNoTabsAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineNoTabsAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;get_Encoding;();;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;get_InnerWriter;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Concurrent;BlockingCollection<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
@@ -549,6 +553,7 @@ summary
 | System.Collections.Concurrent;BlockingCollection<>;false;TryAdd;(T,System.Int32,System.Threading.CancellationToken);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Concurrent;BlockingCollection<>;false;TryAdd;(T,System.TimeSpan);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Concurrent;ConcurrentBag<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Concurrent;ConcurrentBag<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Concurrent;ConcurrentBag<>;false;ToArray;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentBag<>;false;TryAdd;(T);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Concurrent;ConcurrentBag<>;false;TryPeek;(T);;Argument[this];ReturnValue;taint;generated |
@@ -561,10 +566,13 @@ summary
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;ConcurrentDictionary;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;ConcurrentDictionary;(System.Int32,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[1].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;ConcurrentDictionary;(System.Int32,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[1].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections.Concurrent;ConcurrentDictionary<,>;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;GetOrAdd;(TKey,TValue);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;get_Keys;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];ReturnValue.Element;value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;get_Values;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue.Element;value;manual |
+| System.Collections.Concurrent;ConcurrentQueue<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
+| System.Collections.Concurrent;ConcurrentStack<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Concurrent;ConcurrentStack<>;false;ConcurrentStack;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.Concurrent;ConcurrentStack<>;false;TryPeek;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentStack<>;false;TryPop;(T);;Argument[this];ReturnValue;taint;generated |
@@ -581,6 +589,9 @@ summary
 | System.Collections.Generic;CollectionExtensions;false;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey,TValue);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Generic;CollectionExtensions;false;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated |
 | System.Collections.Generic;CollectionExtensions;false;Remove<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[0].Element;Argument[2];taint;generated |
+| System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[1];Argument[0].Element;taint;generated |
+| System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[2];Argument[0].Element;taint;generated |
 | System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Entry;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Key;();;Argument[this];ReturnValue;taint;generated |
@@ -617,6 +628,7 @@ summary
 | System.Collections.Generic;HashSet<>;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;HashSet<>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;ICollection<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;ICollection<>;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;ICollection<>;true;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;IDictionary<,>;true;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Generic;IDictionary<,>;true;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
@@ -630,6 +642,8 @@ summary
 | System.Collections.Generic;IList<>;true;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.Generic;IList<>;true;set_Item;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Generic;ISet<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;KeyValuePair;false;Create<,>;(TKey,TValue);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Generic;KeyValuePair;false;Create<,>;(TKey,TValue);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Generic;KeyValuePair<,>;false;Deconstruct;(TKey,TValue);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[0];Argument[this].Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[1];Argument[this].Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
@@ -708,6 +722,7 @@ summary
 | System.Collections.Generic;PriorityQueue<,>;false;TryPeek;(TElement,TPriority);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;PriorityQueue<,>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Queue<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
+| System.Collections.Generic;Queue<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;Queue<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Queue<>;false;Dequeue;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Queue<>;false;Enqueue;(T);;Argument[0];Argument[this];taint;generated |
@@ -760,6 +775,7 @@ summary
 | System.Collections.Generic;SortedSet<>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;SortedSet<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections.Generic;Stack<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
+| System.Collections.Generic;Stack<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;Stack<>;false;CopyTo;(T[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;Stack<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.Stack<>+Enumerator.Current];value;manual |
 | System.Collections.Generic;Stack<>;false;Peek;();;Argument[this].Element;ReturnValue;value;manual |
@@ -771,9 +787,14 @@ summary
 | System.Collections.Generic;Stack<>;false;TryPop;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Stack<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections.Immutable;IImmutableDictionary<,>;true;AddRange;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;IImmutableDictionary<,>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;IImmutableList<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Immutable;IImmutableList<>;true;AddRange;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;IImmutableList<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
+| System.Collections.Immutable;IImmutableQueue<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;IImmutableSet<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Immutable;IImmutableSet<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
+| System.Collections.Immutable;IImmutableStack<>;true;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableArray;false;Create<>;(System.Collections.Immutable.ImmutableArray<T>,System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableArray;false;Create<>;(T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableArray;false;Create<>;(T,T);;Argument[0];ReturnValue;taint;generated |
@@ -834,6 +855,12 @@ summary
 | System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[2].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;GetValueOrDefault<,>;(System.Collections.Immutable.IImmutableDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;ToImmutableDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;ToImmutableDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0].Element;ReturnValue;taint;generated |
@@ -861,6 +888,7 @@ summary
 | System.Collections.Immutable;ImmutableDictionary<,>;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>;false;AddRange;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableDictionary<,>;false;Clear;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableDictionary<,>+Enumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableDictionary<,>;false;Remove;(TKey);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary<,>;false;RemoveRange;(System.Collections.Generic.IEnumerable<TKey>);;Argument[this];ReturnValue;taint;generated |
@@ -888,6 +916,7 @@ summary
 | System.Collections.Immutable;ImmutableHashSet<>+Builder;false;get_KeyComparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableHashSet<>+Builder;false;set_KeyComparer;(System.Collections.Generic.IEqualityComparer<T>);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableHashSet<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableHashSet<>;false;Clear;();;Argument[this].WithoutElement;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableHashSet<>;false;Except;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableHashSet<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableHashSet<>+Enumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableHashSet<>;false;Intersect;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
@@ -901,6 +930,8 @@ summary
 | System.Collections.Immutable;ImmutableHashSet<>;false;get_KeyComparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableHashSet<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections.Immutable;ImmutableInterlocked;false;GetOrAdd<,>;(System.Collections.Immutable.ImmutableDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableList;false;Create<>;(T);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableList;false;CreateRange<>;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableList;false;Remove<>;(System.Collections.Immutable.IImmutableList<T>,T);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableList;false;RemoveRange<>;(System.Collections.Immutable.IImmutableList<T>,System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableList;false;Replace<>;(System.Collections.Immutable.IImmutableList<T>,T,T);;Argument[0].Element;ReturnValue;taint;generated |
@@ -986,6 +1017,12 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[2].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IComparer<TKey>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IComparer<TKey>);;Argument[1];ReturnValue;taint;generated |
@@ -1008,11 +1045,13 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;get_Values;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;set_KeyComparer;(System.Collections.Generic.IComparer<TKey>);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;set_ValueComparer;(System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];Argument[this];taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(System.Collections.Generic.KeyValuePair<TKey,TValue>);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(System.Collections.Generic.KeyValuePair<TKey,TValue>);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(TKey,TValue);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;AddRange;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Clear;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableSortedDictionary<,>+Enumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Remove;(TKey);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;RemoveRange;(System.Collections.Generic.IEnumerable<TKey>);;Argument[this];ReturnValue;taint;generated |
@@ -1034,7 +1073,10 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;get_ValueComparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;get_Values;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T[]);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;CreateBuilder<>;(System.Collections.Generic.IComparer<T>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;CreateRange<>;(System.Collections.Generic.IComparer<T>,System.Collections.Generic.IEnumerable<T>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;CreateRange<>;(System.Collections.Generic.IComparer<T>,System.Collections.Generic.IEnumerable<T>);;Argument[1].Element;ReturnValue;taint;generated |
@@ -1046,6 +1088,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;IntersectWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;ToImmutable;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated |
@@ -1057,10 +1100,15 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;set_KeyComparer;(System.Collections.Generic.IComparer<T>);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;Clear;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Except;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current];value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;Intersect;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Remove;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;ToBuilder;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated |
@@ -1086,18 +1134,24 @@ summary
 | System.Collections.Immutable;ImmutableStack<>;false;Push;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;Collection;(System.Collections.Generic.IList<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;Collection<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;Collection<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;get_Items;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;InsertItem;(System.Int32,TItem);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;KeyedCollection<,>;false;InsertItem;(System.Int32,TItem);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;KeyedCollection;(System.Collections.Generic.IEqualityComparer<TKey>,System.Int32);;Argument[0];Argument[this];taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;SetItem;(System.Int32,TItem);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;KeyedCollection<,>;false;SetItem;(System.Int32,TItem);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;TryGetValue;(TKey,TItem);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;get_Dictionary;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;get_Item;(TKey);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.ObjectModel;ObservableCollection<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;ObservableCollection<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;ObservableCollection<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;ObservableCollection<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;ReadOnlyCollection;(System.Collections.Generic.IList<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;get_Items;();;Argument[this];ReturnValue;taint;generated |
@@ -1142,6 +1196,7 @@ summary
 | System.Collections.Specialized;NameObjectCollectionBase;true;get_Keys;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Specialized;NameValueCollection;false;Add;(System.Collections.Specialized.NameValueCollection);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Specialized;NameValueCollection;false;Add;(System.String,System.String);;Argument[0];Argument[this];taint;generated |
+| System.Collections.Specialized;NameValueCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Specialized;NameValueCollection;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Specialized;NameValueCollection;false;Get;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Specialized;NameValueCollection;false;Get;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -1176,6 +1231,7 @@ summary
 | System.Collections.Specialized;StringCollection;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.Specialized;StringCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Specialized;StringCollection;false;set_Item;(System.Int32,System.String);;Argument[1];Argument[this].Element;value;manual |
+| System.Collections.Specialized;StringDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Specialized;StringDictionary;false;CopyTo;(System.Array,System.Int32);;Argument[this];Argument[0].Element;taint;generated |
 | System.Collections.Specialized;StringDictionary;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Specialized;StringDictionary;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
@@ -1208,6 +1264,7 @@ summary
 | System.Collections;BitArray;false;Xor;(System.Collections.BitArray);;Argument[this];ReturnValue;value;generated |
 | System.Collections;BitArray;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections;CollectionBase;false;Remove;(System.Object);;Argument[0];Argument[this];taint;generated |
+| System.Collections;CollectionBase;false;Remove;(System.Object);;Argument[this];Argument[0];taint;generated |
 | System.Collections;CollectionBase;false;get_InnerList;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections;CollectionBase;false;get_List;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections;CollectionBase;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
@@ -1252,6 +1309,7 @@ summary
 | System.Collections;ICollection;true;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;IDictionary;true;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections;IDictionary;true;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections;IDictionary;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;IDictionary;true;get_Item;(System.Object);;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue;value;manual |
 | System.Collections;IDictionary;true;get_Keys;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];ReturnValue.Element;value;manual |
 | System.Collections;IDictionary;true;get_Values;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue.Element;value;manual |
@@ -1259,9 +1317,11 @@ summary
 | System.Collections;IDictionary;true;set_Item;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections;IEnumerable;true;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections;IList;true;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections;IList;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;IList;true;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections;IList;true;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections;IList;true;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
+| System.Collections;Queue;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;Queue;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Queue;false;Dequeue;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections;Queue;false;Enqueue;(System.Object);;Argument[0];Argument[this];taint;generated |
@@ -1285,6 +1345,7 @@ summary
 | System.Collections;SortedList;false;SortedList;(System.Collections.IDictionary,System.Collections.IComparer);;Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections;SortedList;false;Synchronized;(System.Collections.SortedList);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections;SortedList;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
+| System.Collections;Stack;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections;Stack;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Stack;false;Peek;();;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections;Stack;false;Pop;();;Argument[this].Element;ReturnValue;value;manual |
@@ -1384,7 +1445,9 @@ summary
 | System.ComponentModel;BaseNumberConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[1];ReturnValue;taint;generated |
 | System.ComponentModel;BaseNumberConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated |
 | System.ComponentModel;BindingList<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.ComponentModel;BindingList<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.ComponentModel;BindingList<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.ComponentModel;BindingList<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.ComponentModel;CategoryAttribute;false;CategoryAttribute;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.ComponentModel;CategoryAttribute;false;get_Category;();;Argument[this];ReturnValue;taint;generated |
 | System.ComponentModel;CharConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated |
@@ -1426,6 +1489,7 @@ summary
 | System.ComponentModel;EditorAttribute;false;get_TypeId;();;Argument[this];ReturnValue;taint;generated |
 | System.ComponentModel;EnumConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated |
 | System.ComponentModel;EventDescriptorCollection;false;Add;(System.ComponentModel.EventDescriptor);;Argument[0];Argument[this].Element;value;manual |
+| System.ComponentModel;EventDescriptorCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.ComponentModel;EventDescriptorCollection;false;EventDescriptorCollection;(System.ComponentModel.EventDescriptor[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.ComponentModel;EventDescriptorCollection;false;Find;(System.String,System.Boolean);;Argument[this].Element;ReturnValue;value;manual |
 | System.ComponentModel;EventDescriptorCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -1510,6 +1574,7 @@ summary
 | System.ComponentModel;PropertyDescriptorCollection;false;Add;(System.ComponentModel.PropertyDescriptor);;Argument[0];Argument[this].Element;value;manual |
 | System.ComponentModel;PropertyDescriptorCollection;false;Add;(System.Object);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.ComponentModel;PropertyDescriptorCollection;false;Add;(System.Object);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.ComponentModel;PropertyDescriptorCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.ComponentModel;PropertyDescriptorCollection;false;Find;(System.String,System.Boolean);;Argument[this].Element;ReturnValue;value;manual |
 | System.ComponentModel;PropertyDescriptorCollection;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.ComponentModel;PropertyDescriptorCollection;false;Insert;(System.Int32,System.ComponentModel.PropertyDescriptor);;Argument[1];Argument[this].Element;value;manual |
@@ -1669,6 +1734,10 @@ summary
 | System.Data.Common;DataTableMappingCollection;false;set_Item;(System.String,System.Data.Common.DataTableMapping);;Argument[1];Argument[this].Element;value;manual |
 | System.Data.Common;DbCommand;false;ExecuteReader;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;ExecuteReader;(System.Data.CommandBehavior);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;();;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Data.CommandBehavior);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;get_Connection;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;get_Parameters;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;get_Transaction;();;Argument[this];ReturnValue;taint;generated |
@@ -1676,6 +1745,7 @@ summary
 | System.Data.Common;DbCommand;false;set_Connection;(System.Data.IDbConnection);;Argument[0];Argument[this];taint;generated |
 | System.Data.Common;DbCommand;false;set_Transaction;(System.Data.Common.DbTransaction);;Argument[0];Argument[this];taint;generated |
 | System.Data.Common;DbCommand;false;set_Transaction;(System.Data.IDbTransaction);;Argument[0];Argument[this];taint;generated |
+| System.Data.Common;DbCommand;true;ExecuteDbDataReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;true;PrepareAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Data.Common;DbCommandBuilder;false;GetDeleteCommand;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommandBuilder;false;GetDeleteCommand;(System.Boolean);;Argument[this];ReturnValue;taint;generated |
@@ -1704,6 +1774,7 @@ summary
 | System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String);;Argument[2];Argument[0];taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String,System.Boolean);;Argument[1];Argument[0];taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String,System.Boolean);;Argument[2];Argument[0];taint;generated |
+| System.Data.Common;DbConnectionStringBuilder;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;GetProperties;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;GetProperties;(System.Attribute[]);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;GetPropertyOwner;(System.ComponentModel.PropertyDescriptor);;Argument[this];ReturnValue;value;generated |
@@ -1733,9 +1804,12 @@ summary
 | System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[0];ReturnValue;taint;generated |
 | System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[1];ReturnValue;taint;generated |
 | System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[3];ReturnValue;taint;generated |
+| System.Data.Common;DbDataReader;false;GetFieldValueAsync<>;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetFieldValue<>;(System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbDataReader;true;GetFieldValueAsync<>;(System.Int32,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetProviderSpecificValue;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetProviderSpecificValues;(System.Object[]);;Argument[this];Argument[0].Element;taint;generated |
+| System.Data.Common;DbDataReader;true;GetSchemaTableAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetTextReader;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataRecord;false;GetPropertyOwner;(System.ComponentModel.PropertyDescriptor);;Argument[this];ReturnValue;value;generated |
 | System.Data.Common;DbEnumerator;false;DbEnumerator;(System.Data.IDataReader);;Argument[0];Argument[this];taint;generated |
@@ -1838,6 +1912,7 @@ summary
 | System.Data;ConstraintCollection;false;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[0];Argument[this];taint;generated |
 | System.Data;ConstraintCollection;false;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[0];ReturnValue;taint;generated |
 | System.Data;ConstraintCollection;false;AddRange;(System.Data.Constraint[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data;ConstraintCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;ConstraintCollection;false;CopyTo;(System.Data.Constraint[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;ConstraintCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data;ConstraintCollection;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -1870,15 +1945,20 @@ summary
 | System.Data;DataColumn;false;set_Prefix;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataColumnChangeEventArgs;false;DataColumnChangeEventArgs;(System.Data.DataRow,System.Data.DataColumn,System.Object);;Argument[1];Argument[this];taint;generated |
 | System.Data;DataColumnChangeEventArgs;false;get_Column;();;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataColumnCollection;false;Add;();;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataColumnCollection;false;Add;(System.Data.DataColumn);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataColumnCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
+| System.Data;DataColumnCollection;false;Add;(System.String,System.Type);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataColumnCollection;false;Add;(System.String,System.Type,System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataColumnCollection;false;AddRange;(System.Data.DataColumn[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data;DataColumnCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;DataColumnCollection;false;CopyTo;(System.Data.DataColumn[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataColumnCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataColumnCollection;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataColumnCollection;false;get_List;();;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetDateTime;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetFieldValue<>;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Data;DataReaderExtensions;false;GetFieldValueAsync<>;(System.Data.Common.DbDataReader,System.String,System.Threading.CancellationToken);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetGuid;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetProviderSpecificValue;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetString;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
@@ -1910,11 +1990,18 @@ summary
 | System.Data;DataRelationCollection;false;Add;(System.Data.DataRelation);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataRelationCollection;false;CopyTo;(System.Data.DataRelation[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataRelationCollection;false;Remove;(System.Data.DataRelation);;Argument[0];Argument[this];taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.Data.DataColumn,System.Data.DataColumn);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRelationCollection;true;AddRange;(System.Data.DataRelation[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data;DataRelationCollection;true;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;DataRow;false;DataRow;(System.Data.DataRowBuilder);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRow;false;GetChildRows;(System.Data.DataRelation);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRow;false;GetChildRows;(System.Data.DataRelation,System.Data.DataRowVersion);;Argument[this];ReturnValue;taint;generated |
@@ -1939,6 +2026,7 @@ summary
 | System.Data;DataRow;false;set_RowError;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRowCollection;false;Add;(System.Data.DataRow);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataRowCollection;false;Add;(System.Object[]);;Argument[0];Argument[this].Element;value;manual |
+| System.Data;DataRowCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;DataRowCollection;false;CopyTo;(System.Data.DataRow[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataRowCollection;false;Find;(System.Object);;Argument[this].Element;ReturnValue;value;manual |
 | System.Data;DataRowCollection;false;Find;(System.Object[]);;Argument[this].Element;ReturnValue;value;manual |
@@ -2017,11 +2105,14 @@ summary
 | System.Data;DataTable;false;set_PrimaryKey;(System.Data.DataColumn[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Data;DataTable;false;set_Site;(System.ComponentModel.ISite);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataTable;false;set_TableName;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.Data;DataTableCollection;false;Add;();;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataTableCollection;false;Add;(System.Data.DataTable);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataTableCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[1];Argument[this];taint;generated |
 | System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[1];ReturnValue;taint;generated |
+| System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataTableCollection;false;AddRange;(System.Data.DataTable[]);;Argument[0].Element;Argument[this].Element;value;manual |
+| System.Data;DataTableCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Data;DataTableCollection;false;CopyTo;(System.Data.DataTable[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataTableCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataTableCollection;false;get_Item;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -2598,7 +2689,10 @@ summary
 | System.IO.Compression;ZipArchiveEntry;false;get_LastWriteTime;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;ZipArchiveEntry;false;get_Name;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;ZipArchiveEntry;false;set_LastWriteTime;(System.DateTimeOffset);;Argument[0];Argument[this];taint;generated |
+| System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode);;Argument[0];ReturnValue;taint;generated |
+| System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode,System.Text.Encoding);;Argument[2];ReturnValue;taint;generated |
+| System.IO.Compression;ZipFile;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String);;Argument[2];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String,System.IO.Compression.CompressionLevel);;Argument[0];ReturnValue;taint;generated |
@@ -2613,11 +2707,14 @@ summary
 | System.IO.IsolatedStorage;IsolatedStorage;false;get_DomainIdentity;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.IO.IsolatedStorage;IsolatedStorageFileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.IO.FileStream,System.String,System.Int64,System.IO.MemoryMappedFiles.MemoryMappedFileAccess,System.IO.HandleInheritability,System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String,System.Int64);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String,System.Int64,System.IO.MemoryMappedFiles.MemoryMappedFileAccess);;Argument[0];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedFile;false;get_SafeMemoryMappedFileHandle;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedViewAccessor;false;get_SafeMemoryMappedViewHandle;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedViewStream;false;get_SafeMemoryMappedViewHandle;();;Argument[this];ReturnValue;taint;generated |
@@ -2655,6 +2752,7 @@ summary
 | System.IO;BinaryReader;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;BinaryWriter;false;BinaryWriter;(System.IO.Stream,System.Text.Encoding,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO;BinaryWriter;false;BinaryWriter;(System.IO.Stream,System.Text.Encoding,System.Boolean);;Argument[1];Argument[this];taint;generated |
+| System.IO;BinaryWriter;false;DisposeAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;BinaryWriter;false;Write;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;BinaryWriter;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;BinaryWriter;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
@@ -2694,8 +2792,19 @@ summary
 | System.IO;File;false;AppendAllLinesAsync;(System.String,System.Collections.Generic.IEnumerable<System.String>,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.IO;File;false;AppendAllTextAsync;(System.String,System.String,System.Text.Encoding,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
 | System.IO;File;false;AppendAllTextAsync;(System.String,System.String,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
+| System.IO;File;false;Create;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Create;(System.String,System.Int32);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Create;(System.String,System.Int32,System.IO.FileOptions);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;CreateSymbolicLink;(System.String,System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Open;(System.String,System.IO.FileMode);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Open;(System.String,System.IO.FileMode,System.IO.FileAccess);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Open;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;OpenHandle;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.IO.FileOptions,System.Int64);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;OpenText;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;OpenWrite;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;ReadAllText;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;ReadAllText;(System.String,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;ReadLines;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;ReadLines;(System.String,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;ReadLines;(System.String,System.Text.Encoding);;Argument[1];ReturnValue;taint;generated |
@@ -2706,8 +2815,15 @@ summary
 | System.IO;File;false;WriteAllTextAsync;(System.String,System.String,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;CopyTo;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;CopyTo;(System.String,System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;Create;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;MoveTo;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.IO;FileInfo;false;MoveTo;(System.String,System.Boolean);;Argument[0];Argument[this];taint;generated |
+| System.IO;FileInfo;false;Open;(System.IO.FileMode);;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;Open;(System.IO.FileMode,System.IO.FileAccess);;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;Open;(System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare);;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;OpenRead;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;OpenText;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;OpenWrite;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;get_Directory;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;get_DirectoryName;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileLoadException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated |
@@ -2723,10 +2839,8 @@ summary
 | System.IO;FileStream;false;FileStream;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.Int32,System.IO.FileOptions);;Argument[0];Argument[this];taint;manual |
 | System.IO;FileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;FileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.IO;FileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;FileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.IO;FileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileStream;false;get_SafeFileHandle;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileSystemEventArgs;false;FileSystemEventArgs;(System.IO.WatcherChangeTypes,System.String,System.String);;Argument[1];Argument[this];taint;generated |
 | System.IO;FileSystemEventArgs;false;FileSystemEventArgs;(System.IO.WatcherChangeTypes,System.String,System.String);;Argument[2];Argument[this];taint;generated |
@@ -2811,6 +2925,7 @@ summary
 | System.IO;Stream;false;CopyToAsync;(System.IO.Stream);;Argument[this];Argument[0];taint;manual |
 | System.IO;Stream;false;CopyToAsync;(System.IO.Stream,System.Int32);;Argument[this];Argument[0];taint;manual |
 | System.IO;Stream;false;CopyToAsync;(System.IO.Stream,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;false;FlushAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;Stream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;Stream;false;Synchronized;(System.IO.Stream);;Argument[0];ReturnValue;taint;generated |
 | System.IO;Stream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
@@ -2818,10 +2933,13 @@ summary
 | System.IO;Stream;true;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO;Stream;true;CopyTo;(System.IO.Stream,System.Int32);;Argument[this];Argument[0];taint;manual |
 | System.IO;Stream;true;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;true;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;Stream;true;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;Stream;true;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO;Stream;true;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;Stream;true;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO;Stream;true;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO;Stream;true;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;StreamReader;false;StreamReader;(System.IO.Stream);;Argument[0];Argument[this];taint;manual |
 | System.IO;StreamReader;false;StreamReader;(System.IO.Stream,System.Boolean);;Argument[0];Argument[this];taint;manual |
 | System.IO;StreamReader;false;StreamReader;(System.IO.Stream,System.Text.Encoding);;Argument[0];Argument[this];taint;manual |
@@ -2847,10 +2965,13 @@ summary
 | System.IO;StringWriter;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;Write;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;StringWriter;false;Write;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;Write;(System.Text.StringBuilder);;Argument[0];Argument[this];taint;generated |
 | System.IO;StringWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;StringWriter;false;WriteAsync;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[0];Argument[this];taint;generated |
 | System.IO;StringWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;StringWriter;false;WriteLineAsync;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextReader;false;Synchronized;(System.IO.TextReader);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextReader;true;Read;();;Argument[this];ReturnValue;taint;manual |
 | System.IO;TextReader;true;Read;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;manual |
@@ -2868,7 +2989,12 @@ summary
 | System.IO;TextWriter;false;Synchronized;(System.IO.TextWriter);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextWriter;false;TextWriter;(System.IFormatProvider);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;FlushAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;Write;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.Object);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.String,System.Object);;Argument[0];Argument[this];taint;generated |
@@ -2882,7 +3008,14 @@ summary
 | System.IO;TextWriter;true;Write;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
@@ -2899,8 +3032,18 @@ summary
 | System.IO;TextWriter;true;WriteLine;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;true;WriteLine;(System.Text.StringBuilder);;Argument[0];Argument[this];taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;get_FormatProvider;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;get_NewLine;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;set_NewLine;(System.String);;Argument[0];Argument[this];taint;generated |
@@ -4093,8 +4236,10 @@ summary
 | System.Net.Http.Headers;HeaderStringValues+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HeaderStringValues;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HeaderStringValues;false;ToString;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http.Headers;HttpHeaders;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net.Http.Headers;HttpHeaders;false;get_NonValidated;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http.Headers;HttpHeadersNonValidated;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;TryGetValue;(System.String,System.Net.Http.Headers.HeaderStringValues);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;TryGetValues;(System.String,System.Net.Http.Headers.HeaderStringValues);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;get_Item;(System.String);;Argument[0];ReturnValue;taint;generated |
@@ -4194,12 +4339,17 @@ summary
 | System.Net.Http.Json;JsonContent;false;Create<>;(T,System.Net.Http.Headers.MediaTypeHeaderValue,System.Text.Json.JsonSerializerOptions);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;ByteArrayContent;false;ByteArrayContent;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.Http;ByteArrayContent;false;ByteArrayContent;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
+| System.Net.Http;ByteArrayContent;false;CreateContentReadStreamAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;ByteArrayContent;false;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;DelegatingHandler;false;DelegatingHandler;(System.Net.Http.HttpMessageHandler);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;DelegatingHandler;false;SendAsync;(System.Net.Http.HttpRequestMessage,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Http;DelegatingHandler;false;get_InnerHandler;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;DelegatingHandler;false;set_InnerHandler;(System.Net.Http.HttpMessageHandler);;Argument[0];Argument[this];taint;generated |
+| System.Net.Http;FormUrlEncodedContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage);;Argument[this];Argument[0];taint;generated |
 | System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage,System.Net.Http.HttpCompletionOption);;Argument[this];Argument[0];taint;generated |
 | System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage,System.Net.Http.HttpCompletionOption,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
@@ -4226,7 +4376,10 @@ summary
 | System.Net.Http;HttpContent;false;ReadAsStreamAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;HttpContent;false;get_Headers;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;HttpContent;true;CreateContentReadStream;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;HttpContent;true;CreateContentReadStreamAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;HttpMessageInvoker;false;HttpMessageInvoker;(System.Net.Http.HttpMessageHandler,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;HttpMessageInvoker;false;SendAsync;(System.Net.Http.HttpRequestMessage,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Http;HttpMethod;false;HttpMethod;(System.String);;Argument[0];Argument[this];taint;generated |
@@ -4262,6 +4415,7 @@ summary
 | System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent);;Argument[0];Argument[this].Element;value;manual |
 | System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent,System.String,System.String);;Argument[0];Argument[this];taint;generated |
+| System.Net.Http;ReadOnlyMemoryContent;false;CreateContentReadStreamAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;ReadOnlyMemoryContent;false;ReadOnlyMemoryContent;(System.ReadOnlyMemory<System.Byte>);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;SocketsHttpConnectionContext;false;get_DnsEndPoint;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;SocketsHttpConnectionContext;false;get_InitialRequestMessage;();;Argument[this];ReturnValue;taint;generated |
@@ -4300,9 +4454,13 @@ summary
 | System.Net.Http;SocketsHttpPlaintextStreamFilterContext;false;get_NegotiatedHttpVersion;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;SocketsHttpPlaintextStreamFilterContext;false;get_PlaintextStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;StreamContent;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;StreamContent;false;StreamContent;(System.IO.Stream,System.Int32);;Argument[0];Argument[this];taint;generated |
+| System.Net.Http;StringContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String,System.Net.Mime.ContentType);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String,System.Net.Mime.ContentType);;Argument[1];ReturnValue;taint;generated |
@@ -4332,7 +4490,10 @@ summary
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.Net.Mime.ContentType);;Argument[1];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.String);;Argument[0];Argument[this];taint;generated |
+| System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.Net.Mime.ContentType);;Argument[1];Argument[this];taint;generated |
+| System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;get_ContentId;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Mail;AttachmentBase;false;get_ContentStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Mail;AttachmentBase;false;set_ContentType;(System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated |
@@ -4428,6 +4589,7 @@ summary
 | System.Net.NetworkInformation;PhysicalAddress;false;PhysicalAddress;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.NetworkInformation;UnicastIPAddressInformationCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;AuthenticatedStream;false;AuthenticatedStream;(System.IO.Stream,System.Boolean);;Argument[0];Argument[this];taint;generated |
+| System.Net.Security;AuthenticatedStream;false;DisposeAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;AuthenticatedStream;false;get_InnerStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;AuthenticateAsClient;(System.Net.NetworkCredential,System.Security.Authentication.ExtendedProtection.ChannelBinding,System.String);;Argument[1];Argument[this];taint;generated |
 | System.Net.Security;NegotiateStream;false;AuthenticateAsClient;(System.Net.NetworkCredential,System.Security.Authentication.ExtendedProtection.ChannelBinding,System.String);;Argument[2];Argument[this];taint;generated |
@@ -4448,10 +4610,8 @@ summary
 | System.Net.Security;NegotiateStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.Net.Security;NegotiateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.Net.Security;NegotiateStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;get_RemoteIdentity;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;SslApplicationProtocol;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;SslApplicationProtocol;false;get_Protocol;();;Argument[this];ReturnValue;taint;generated |
@@ -4482,12 +4642,11 @@ summary
 | System.Net.Sockets;NetworkStream;false;NetworkStream;(System.Net.Sockets.Socket,System.IO.FileAccess,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;NetworkStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;NetworkStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.Net.Sockets;NetworkStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;NetworkStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.Net.Sockets;NetworkStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;NetworkStream;false;get_Socket;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;SafeSocketHandle;false;SafeSocketHandle;(System.IntPtr,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;Socket;false;Accept;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
@@ -4511,6 +4670,7 @@ summary
 | System.Net.Sockets;Socket;false;DisconnectAsync;(System.Boolean,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;DisconnectAsync;(System.Boolean,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;DisconnectAsync;(System.Net.Sockets.SocketAsyncEventArgs);;Argument[this];Argument[0];taint;generated |
+| System.Net.Sockets;Socket;false;EndAccept;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
@@ -4527,6 +4687,7 @@ summary
 | System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.EndPoint);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];Argument[this];taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated |
+| System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
@@ -4536,6 +4697,7 @@ summary
 | System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Byte[],System.Int32,System.Int32,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[4];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[2];Argument[this];taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[2];ReturnValue;taint;generated |
+| System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
@@ -4583,6 +4745,7 @@ summary
 | System.Net.Sockets;SocketAsyncEventArgs;false;set_SendPacketsElements;(System.Net.Sockets.SendPacketsElement[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.Sockets;SocketAsyncEventArgs;false;set_UserToken;(System.Object);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;SocketException;false;get_Message;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Sockets;SocketTaskExtensions;false;AcceptAsync;(System.Net.Sockets.Socket,System.Net.Sockets.Socket);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint);;Argument[1];Argument[0];taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[1];Argument[0];taint;generated |
@@ -4594,6 +4757,8 @@ summary
 | System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
+| System.Net.Sockets;SocketTaskExtensions;false;ReceiveFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];ReturnValue;taint;generated |
+| System.Net.Sockets;SocketTaskExtensions;false;ReceiveMessageFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;SendAsync;(System.Net.Sockets.Socket,System.ReadOnlyMemory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;SendAsync;(System.Net.Sockets.Socket,System.ReadOnlyMemory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;SendToAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];Argument[0];taint;generated |
@@ -4608,6 +4773,8 @@ summary
 | System.Net.Sockets;TcpListener;false;AcceptSocketAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;TcpListener;false;AcceptSocketAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;TcpListener;false;AcceptTcpClient;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Sockets;TcpListener;false;EndAcceptSocket;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net.Sockets;TcpListener;false;EndAcceptTcpClient;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;TcpListener;false;TcpListener;(System.Net.IPAddress,System.Int32);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;TcpListener;false;TcpListener;(System.Net.IPEndPoint);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;TcpListener;false;get_LocalEndpoint;();;Argument[this];ReturnValue;taint;generated |
@@ -4693,11 +4860,17 @@ summary
 | System.Net;CookieCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Net;CookieException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated |
 | System.Net;CredentialCache;false;GetCredential;(System.Uri,System.String);;Argument[this];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndGetHostAddresses;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndGetHostByName;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndGetHostEntry;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndResolve;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net;DnsEndPoint;false;DnsEndPoint;(System.String,System.Int32,System.Net.Sockets.AddressFamily);;Argument[0];Argument[this];taint;generated |
 | System.Net;DnsEndPoint;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;DnsEndPoint;false;get_Host;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;DownloadDataCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;DownloadStringCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated |
+| System.Net;FileWebRequest;false;EndGetRequestStream;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;FileWebRequest;false;EndGetResponse;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net;FileWebRequest;false;GetRequestStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;FileWebRequest;false;GetResponse;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;FileWebRequest;false;get_ContentType;();;Argument[this];ReturnValue;taint;generated |
@@ -4772,6 +4945,9 @@ summary
 | System.Net;HttpListenerTimeoutManager;false;get_IdleConnection;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpListenerTimeoutManager;false;set_DrainEntityBody;(System.TimeSpan);;Argument[0];Argument[this];taint;generated |
 | System.Net;HttpListenerTimeoutManager;false;set_IdleConnection;(System.TimeSpan);;Argument[0];Argument[this];taint;generated |
+| System.Net;HttpWebRequest;false;EndGetRequestStream;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;HttpWebRequest;false;EndGetRequestStream;(System.IAsyncResult,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated |
+| System.Net;HttpWebRequest;false;EndGetResponse;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net;HttpWebRequest;false;GetRequestStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpWebRequest;false;GetRequestStream;(System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpWebRequest;false;GetResponse;();;Argument[this];ReturnValue;taint;generated |
@@ -4857,6 +5033,8 @@ summary
 | System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest);;Argument[0];ReturnValue;taint;generated |
 | System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[0];Argument[this];taint;generated |
 | System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[1];Argument[this];taint;generated |
+| System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[1];ReturnValue;taint;generated |
 | System.Net;WebClient;false;OpenRead;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net;WebClient;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Net;WebClient;false;OpenRead;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -4977,6 +5155,7 @@ summary
 | System.Net;WebException;false;WebException;(System.String,System.Exception,System.Net.WebExceptionStatus,System.Net.WebResponse);;Argument[3];Argument[this];taint;generated |
 | System.Net;WebException;false;get_Response;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;WebHeaderCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
+| System.Net;WebHeaderCollection;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Net;WebHeaderCollection;false;ToByteArray;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;WebHeaderCollection;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;WebHeaderCollection;false;get_AllKeys;();;Argument[this];ReturnValue;taint;generated |
@@ -5002,7 +5181,6 @@ summary
 | System.Numerics;BigInteger;false;Max;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[1];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Min;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Min;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[1];ReturnValue;taint;generated |
-| System.Numerics;BigInteger;false;Negate;(System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Pow;(System.Numerics.BigInteger,System.Int32);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Remainder;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;Complex;false;ToString;(System.IFormatProvider);;Argument[0];ReturnValue;taint;generated |
@@ -5727,9 +5905,11 @@ summary
 | System.Resources;ResourceReader;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Resources;ResourceReader;false;GetResourceData;(System.String,System.String,System.Byte[]);;Argument[this];ReturnValue;taint;generated |
 | System.Resources;ResourceReader;false;ResourceReader;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
+| System.Resources;ResourceSet;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Resources;ResourceSet;false;ResourceSet;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
 | System.Resources;ResourceSet;false;ResourceSet;(System.Resources.IResourceReader);;Argument[0].Element;Argument[this];taint;generated |
 | System.Resources;ResourceWriter;false;ResourceWriter;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
+| System.Resources;ResourceWriter;false;ResourceWriter;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncIteratorMethodBuilder;false;AwaitOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncIteratorMethodBuilder;false;AwaitUnsafeOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncTaskMethodBuilder;false;AwaitOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
@@ -5746,6 +5926,7 @@ summary
 | System.Runtime.CompilerServices;AsyncValueTaskMethodBuilder<>;false;SetResult;(TResult);;Argument[0];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncValueTaskMethodBuilder<>;false;get_Task;();;Argument[this];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;CallSite;false;get_Binder;();;Argument[this];ReturnValue;taint;generated |
+| System.Runtime.CompilerServices;ConditionalWeakTable<,>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Runtime.CompilerServices;ConditionalWeakTable<,>;false;GetOrCreateValue;(TKey);;Argument[0];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;ConfiguredCancelableAsyncEnumerable<>;false;ConfigureAwait;(System.Boolean);;Argument[this];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;ConfiguredCancelableAsyncEnumerable<>;false;GetAsyncEnumerator;();;Argument[this];ReturnValue;taint;generated |
@@ -5763,8 +5944,6 @@ summary
 | System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider);;Argument[2];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider,System.Span<System.Char>);;Argument[2];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider,System.Span<System.Char>);;Argument[3];Argument[this];taint;generated |
-| System.Runtime.CompilerServices;DynamicAttribute;false;DynamicAttribute;(System.Boolean[]);;Argument[0].Element;Argument[this];taint;generated |
-| System.Runtime.CompilerServices;DynamicAttribute;false;get_TransformFlags;();;Argument[this];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;FormattableStringFactory;false;Create;(System.String,System.Object[]);;Argument[0];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;FormattableStringFactory;false;Create;(System.String,System.Object[]);;Argument[1].Element;ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;PoolingAsyncValueTaskMethodBuilder;false;AwaitOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
@@ -6109,6 +6288,7 @@ summary
 | System.Security.Cryptography.X509Certificates;X509Certificate;false;ToString;(System.Boolean);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.X509Certificates;X509Certificate;false;get_Issuer;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.X509Certificates;X509Certificate;false;get_Subject;();;Argument[this];ReturnValue;taint;generated |
+| System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;false;X509CertificateEnumerator;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);;Argument[0].Element;Argument[this];taint;generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection;false;Add;(System.Security.Cryptography.X509Certificates.X509Certificate);;Argument[0];Argument[this].Element;value;manual |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection;false;AddRange;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);;Argument[0].Element;Argument[this].Element;value;manual |
@@ -6240,6 +6420,7 @@ summary
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;set_ItemOf;(System.Int32,System.Security.Cryptography.Xml.EncryptionProperty);;Argument[1];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;AddClause;(System.Security.Cryptography.Xml.KeyInfoClause);;Argument[0];Argument[this];taint;generated |
+| System.Security.Cryptography.Xml;KeyInfo;false;GetEnumerator;(System.Type);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;LoadXml;(System.Xml.XmlElement);;Argument[0].Element;Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;get_Id;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;set_Id;(System.String);;Argument[0];Argument[this];taint;generated |
@@ -6351,6 +6532,7 @@ summary
 | System.Security.Cryptography.Xml;Transform;false;set_Context;(System.Xml.XmlElement);;Argument[0].Element;Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;Transform;false;set_Resolver;(System.Xml.XmlResolver);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;TransformChain;false;Add;(System.Security.Cryptography.Xml.Transform);;Argument[0];Argument[this];taint;generated |
+| System.Security.Cryptography.Xml;TransformChain;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;TransformChain;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;XmlDecryptionTransform;false;AddExceptUri;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;XmlDecryptionTransform;false;GetOutput;();;Argument[this];ReturnValue;taint;generated |
@@ -6483,6 +6665,7 @@ summary
 | System.Security.Cryptography;RSAPKCS1SignatureFormatter;false;SetHashAlgorithm;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography;RSAPKCS1SignatureFormatter;false;SetKey;(System.Security.Cryptography.AsymmetricAlgorithm);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography;SafeEvpPKeyHandle;false;DuplicateHandle;();;Argument[this];ReturnValue;taint;generated |
+| System.Security.Policy;Evidence;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Security.Principal;GenericIdentity;false;Clone;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Principal;GenericIdentity;false;GenericIdentity;(System.Security.Principal.GenericIdentity);;Argument[0];Argument[this];taint;generated |
 | System.Security.Principal;GenericIdentity;false;GenericIdentity;(System.String);;Argument[0];Argument[this];taint;generated |
@@ -6518,6 +6701,7 @@ summary
 | System.Text.Encodings.Web;TextEncoder;true;Encode;(System.IO.TextWriter,System.String,System.Int32,System.Int32);;Argument[1];Argument[0];taint;generated |
 | System.Text.Encodings.Web;TextEncoder;true;Encode;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Text.Json.Nodes;JsonArray;false;Add<>;(T);;Argument[0];Argument[this];taint;generated |
+| System.Text.Json.Nodes;JsonArray;false;Add<>;(T);;Argument[this];Argument[0];taint;generated |
 | System.Text.Json.Nodes;JsonArray;false;Create;(System.Text.Json.JsonElement,System.Nullable<System.Text.Json.Nodes.JsonNodeOptions>);;Argument[0];ReturnValue;taint;generated |
 | System.Text.Json.Nodes;JsonArray;false;JsonArray;(System.Text.Json.Nodes.JsonNodeOptions,System.Text.Json.Nodes.JsonNode[]);;Argument[this];Argument[1].Element;taint;generated |
 | System.Text.Json.Nodes;JsonArray;false;JsonArray;(System.Text.Json.Nodes.JsonNode[]);;Argument[this];Argument[0].Element;taint;generated |
@@ -6814,6 +6998,7 @@ summary
 | System.Text;StringBuilder;false;AppendLine;(System.String);;Argument[0];Argument[this].Element;value;manual |
 | System.Text;StringBuilder;false;AppendLine;(System.String);;Argument[this];ReturnValue;value;manual |
 | System.Text;StringBuilder;false;AppendLine;(System.Text.StringBuilder+AppendInterpolatedStringHandler);;Argument[this];ReturnValue;taint;generated |
+| System.Text;StringBuilder;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Text;StringBuilder;false;GetChunks;();;Argument[this];ReturnValue;taint;generated |
 | System.Text;StringBuilder;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated |
 | System.Text;StringBuilder;false;Insert;(System.Int32,System.Boolean);;Argument[this];ReturnValue;taint;generated |
@@ -6885,6 +7070,10 @@ summary
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;SendAsync<>;(System.Threading.Tasks.Dataflow.ITargetBlock<TInput>,TInput,System.Threading.CancellationToken);;Argument[1];Argument[0];taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;TryReceive<>;(System.Threading.Tasks.Dataflow.IReceivableSourceBlock<TOutput>,TOutput);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlockOptions;false;get_CancellationToken;();;Argument[this];ReturnValue;taint;generated |
@@ -7448,6 +7637,7 @@ summary
 | System.Xml.Linq;XText;false;XText;(System.Xml.Linq.XText);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Linq;XText;false;get_Value;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Linq;XText;false;set_Value;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.Xml.Resolvers;XmlPreloadedResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Resolvers;XmlPreloadedResolver;false;XmlPreloadedResolver;(System.Xml.XmlResolver,System.Xml.Resolvers.XmlKnownDtds,System.Collections.Generic.IEqualityComparer<System.Uri>);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Resolvers;XmlPreloadedResolver;false;XmlPreloadedResolver;(System.Xml.XmlResolver,System.Xml.Resolvers.XmlKnownDtds,System.Collections.Generic.IEqualityComparer<System.Uri>);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Resolvers;XmlPreloadedResolver;false;set_Credentials;(System.Net.ICredentials);;Argument[0];Argument[this];taint;generated |
@@ -7676,9 +7866,12 @@ summary
 | System.Xml.Schema;XmlSchemaSet;false;Add;(System.String,System.Xml.XmlReader);;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchema);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated |
+| System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchemaSet);;Argument[0];Argument[this];taint;generated |
+| System.Xml.Schema;XmlSchemaSet;false;CopyTo;(System.Xml.Schema.XmlSchema[],System.Int32);;Argument[this];Argument[0].Element;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Remove;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Reprocess;(System.Xml.Schema.XmlSchema);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Reprocess;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated |
+| System.Xml.Schema;XmlSchemaSet;false;Schemas;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;XmlSchemaSet;(System.Xml.XmlNameTable);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;get_CompilationSettings;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;get_GlobalAttributes;();;Argument[this];ReturnValue;taint;generated |
@@ -7765,8 +7958,10 @@ summary
 | System.Xml.Schema;XmlSchemaXPath;false;get_XPath;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaXPath;false;set_XPath;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;Add;(System.String,System.Object);;Argument[1];Argument[this];taint;generated |
+| System.Xml.Serialization;CodeIdentifiers;false;Add;(System.String,System.Object);;Argument[this];Argument[1];taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[1];Argument[this];taint;generated |
+| System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[this];Argument[1];taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;MakeUnique;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;ToArray;(System.Type);;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Serialization;ImportContext;false;ImportContext;(System.Xml.Serialization.CodeIdentifiers,System.Boolean);;Argument[0];Argument[this];taint;generated |
@@ -8072,6 +8267,7 @@ summary
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.String);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.Xml.XmlQualifiedName);;Argument[1];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WriteId;(System.Object);;Argument[this];Argument[0];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncoded;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncodedRaw;(System.String,System.String,System.Byte[],System.Xml.XmlQualifiedName);;Argument[2].Element;Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncodedRaw;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated |
@@ -8079,9 +8275,15 @@ summary
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringLiteralRaw;(System.String,System.String,System.Byte[]);;Argument[2].Element;Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringLiteralRaw;(System.String,System.String,System.String);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean,System.Boolean);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean,System.Boolean);;Argument[this];Argument[2];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WriteReferencingElement;(System.String,System.String,System.Object);;Argument[this];Argument[2];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WriteReferencingElement;(System.String,System.String,System.Object,System.Boolean);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteRpcResult;(System.String,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteRpcResult;(System.String,System.String);;Argument[1];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteSerializable;(System.Xml.Serialization.IXmlSerializable,System.String,System.String,System.Boolean);;Argument[0];Argument[this];taint;generated |
@@ -8657,6 +8859,7 @@ summary
 | System.Xml;XmlReaderSettings;false;set_XmlResolver;(System.Xml.XmlResolver);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlResolver;true;ResolveUri;(System.Uri,System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlResolver;true;ResolveUri;(System.Uri,System.String);;Argument[1];ReturnValue;taint;generated |
+| System.Xml;XmlSecureResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlSecureResolver;false;XmlSecureResolver;(System.Xml.XmlResolver,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlSecureResolver;false;set_Credentials;(System.Net.ICredentials);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlSignificantWhitespace;false;CloneNode;(System.Boolean);;Argument[this];ReturnValue;taint;generated |
@@ -8684,6 +8887,7 @@ summary
 | System.Xml;XmlTextWriter;false;XmlTextWriter;(System.IO.TextWriter);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlTextWriter;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml;XmlTextWriter;false;get_XmlLang;();;Argument[this];ReturnValue;taint;generated |
+| System.Xml;XmlUrlResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlUrlResolver;false;set_Credentials;(System.Net.ICredentials);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlUrlResolver;false;set_Proxy;(System.Net.IWebProxy);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlValidatingReader;false;LookupNamespace;(System.String);;Argument[0];ReturnValue;taint;generated |
@@ -8701,6 +8905,8 @@ summary
 | System.Xml;XmlWriter;false;Create;(System.IO.TextWriter);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.IO.TextWriter,System.Xml.XmlWriterSettings);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.IO.TextWriter,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated |
+| System.Xml;XmlWriter;false;Create;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.Xml;XmlWriter;false;Create;(System.String,System.Xml.XmlWriterSettings);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.String,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.Text.StringBuilder,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.Xml.XmlWriter);;Argument[0];ReturnValue;taint;generated |
@@ -8754,6 +8960,8 @@ summary
 | System;ArgumentOutOfRangeException;false;get_ActualValue;();;Argument[this];ReturnValue;taint;generated |
 | System;ArgumentOutOfRangeException;false;get_Message;();;Argument[this];ReturnValue;taint;generated |
 | System;Array;false;AsReadOnly<>;(T[]);;Argument[0].Element;ReturnValue.Element;value;manual |
+| System;Array;false;Clear;(System.Array);;Argument[0].WithoutElement;Argument[0];value;manual |
+| System;Array;false;Clear;(System.Array,System.Int32,System.Int32);;Argument[0].WithoutElement;Argument[0];value;manual |
 | System;Array;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System;Array;false;CopyTo;(System.Array,System.Int64);;Argument[this].Element;Argument[0].Element;value;manual |
 | System;Array;false;Fill<>;(T[],T);;Argument[1];Argument[0].Element;taint;generated |
@@ -9773,6 +9981,27 @@ summary
 | System;TupleExtensions;false;Deconstruct<,>;(System.Tuple<T1,T2>,T1,T2);;Argument[0].Property[System.Tuple<,>.Item1];Argument[1];value;manual |
 | System;TupleExtensions;false;Deconstruct<,>;(System.Tuple<T1,T2>,T1,T2);;Argument[0].Property[System.Tuple<,>.Item2];Argument[2];value;manual |
 | System;TupleExtensions;false;Deconstruct<>;(System.Tuple<T1>,T1);;Argument[0].Property[System.Tuple<>.Item1];Argument[1];value;manual |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20,T21>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,>;(System.ValueTuple<T1,T2,T3,T4>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,>;(System.ValueTuple<T1,T2,T3>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,>;(System.ValueTuple<T1,T2>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<>;(System.ValueTuple<T1>);;Argument[0];ReturnValue;taint;generated |
 | System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19,T20,T21>>>);;Argument[0];ReturnValue;taint;generated |
 | System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19,T20>>>);;Argument[0];ReturnValue;taint;generated |
 | System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19>>>);;Argument[0];ReturnValue;taint;generated |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
index 849500904a0..5ee4c6e27a9 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
@@ -7,7 +7,9 @@ class CallableWithSplitting extends Callable {
   CallableWithSplitting() { this = any(SplitControlFlowElement e).getEnclosingCallable() }
 }
 
-query predicate defReadInconsistency(AssignableRead ar, Expr e, PreSsa::SourceVariable v, boolean b) {
+query predicate defReadInconsistency(
+  AssignableRead ar, Expr e, PreSsa::SsaInput::SourceVariable v, boolean b
+) {
   // Exclude definitions in callables with CFG splitting, as SSA definitions may be
   // very different from pre-SSA definitions
   not ar.getEnclosingCallable() instanceof CallableWithSplitting and
@@ -36,7 +38,8 @@ query predicate defReadInconsistency(AssignableRead ar, Expr e, PreSsa::SourceVa
 }
 
 query predicate readReadInconsistency(
-  LocalScopeVariableRead read1, LocalScopeVariableRead read2, PreSsa::SourceVariable v, boolean b
+  LocalScopeVariableRead read1, LocalScopeVariableRead read2, PreSsa::SsaInput::SourceVariable v,
+  boolean b
 ) {
   // Exclude definitions in callables with CFG splitting, as SSA definitions may be
   // very different from pre-SSA definitions
@@ -50,7 +53,7 @@ query predicate readReadInconsistency(
     b = false and
     v = read1.getTarget() and
     SsaImpl::adjacentReadPairSameVar(_, read1.getAControlFlowNode(), read2.getAControlFlowNode()) and
-    read1.getTarget() instanceof PreSsa::SourceVariable and
+    read1.getTarget() instanceof PreSsa::SsaInput::SourceVariable and
     not PreSsa::adjacentReadPairSameVar(read1, read2) and
     // Exclude split CFG elements because SSA may be more precise than pre-SSA
     // in those cases
@@ -59,7 +62,9 @@ query predicate readReadInconsistency(
   )
 }
 
-query predicate phiInconsistency(ControlFlowElement cfe, Expr e, PreSsa::SourceVariable v, boolean b) {
+query predicate phiInconsistency(
+  ControlFlowElement cfe, Expr e, PreSsa::SsaInput::SourceVariable v, boolean b
+) {
   // Exclude definitions in callables with CFG splitting, as SSA definitions may be
   // very different from pre-SSA definitions
   not cfe.getEnclosingCallable() instanceof CallableWithSplitting and
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SSAPhiRead.ql b/csharp/ql/test/library-tests/dataflow/ssa/SSAPhiRead.ql
index abc40f41e8d..f9603dc1da2 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SSAPhiRead.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SSAPhiRead.ql
@@ -1,5 +1,5 @@
 import csharp
-import semmle.code.csharp.dataflow.internal.SsaImplCommon
+import semmle.code.csharp.dataflow.internal.SsaImpl
 
 from Ssa::SourceVariable v, ControlFlow::BasicBlock bb
 where phiReadExposedForTesting(bb, v)
diff --git a/csharp/ql/test/query-tests/Bad Practices/Comments/TodoComments/TodoComments.expected b/csharp/ql/test/query-tests/Bad Practices/Comments/TodoComments/TodoComments.expected
index 523bbf79f23..8afce1f3506 100644
--- a/csharp/ql/test/query-tests/Bad Practices/Comments/TodoComments/TodoComments.expected	
+++ b/csharp/ql/test/query-tests/Bad Practices/Comments/TodoComments/TodoComments.expected	
@@ -1,3 +1,3 @@
-| TodoComments.cs:4:5:4:26 | // ... | TODO comment. |
-| TodoComments.cs:5:5:5:27 | // ... | TODO comment. |
-| TodoCommentsBad.cs:7:9:7:41 | // ... | TODO comment. |
+| TodoComments.cs:4:5:4:26 | // ... | TODO comments should be addressed. |
+| TodoComments.cs:5:5:5:27 | // ... | TODO comments should be addressed. |
+| TodoCommentsBad.cs:7:9:7:41 | // ... | TODO comments should be addressed. |
diff --git a/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.expected b/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.expected
index fc4b22de031..693e6df4898 100644
--- a/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.expected
+++ b/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.expected
@@ -1,3 +1,3 @@
-| EmptyBlock.cs:9:9:10:9 | {...} | Empty block. |
-| EmptyBlock.cs:26:9:27:9 | {...} | Empty block. |
-| EmptyBlock.cs:48:9:49:9 | {...} | Empty block. |
+| EmptyBlock.cs:9:9:10:9 | {...} | Empty block without comment. |
+| EmptyBlock.cs:26:9:27:9 | {...} | Empty block without comment. |
+| EmptyBlock.cs:48:9:49:9 | {...} | Empty block without comment. |
diff --git a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.expected b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.expected
index 133ea2ad6a2..616384fb1e4 100644
--- a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.expected	
+++ b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.expected	
@@ -1,4 +1,4 @@
-| ContainerLengthCmpOffByOne.cs:8:25:8:40 | ... <= ... | Off-by-one index comparison against length leads to possible out of bounds $@. | ContainerLengthCmpOffByOne.cs:10:31:10:37 | access to array element | access to array element |
-| ContainerLengthCmpOffByOne.cs:14:25:14:40 | ... >= ... | Off-by-one index comparison against length leads to possible out of bounds $@. | ContainerLengthCmpOffByOne.cs:16:31:16:37 | access to array element | access to array element |
-| ContainerLengthCmpOffByOne.cs:27:13:27:28 | ... <= ... | Off-by-one index comparison against length leads to possible out of bounds $@. | ContainerLengthCmpOffByOne.cs:29:31:29:37 | access to array element | access to array element |
-| ContainerLengthCmpOffByOne.cs:33:13:33:28 | ... >= ... | Off-by-one index comparison against length leads to possible out of bounds $@. | ContainerLengthCmpOffByOne.cs:35:31:35:37 | access to array element | access to array element |
+| ContainerLengthCmpOffByOne.cs:8:25:8:40 | ... <= ... | Off-by-one index comparison against length may lead to out-of-bounds $@. | ContainerLengthCmpOffByOne.cs:10:31:10:37 | access to array element | access to array element |
+| ContainerLengthCmpOffByOne.cs:14:25:14:40 | ... >= ... | Off-by-one index comparison against length may lead to out-of-bounds $@. | ContainerLengthCmpOffByOne.cs:16:31:16:37 | access to array element | access to array element |
+| ContainerLengthCmpOffByOne.cs:27:13:27:28 | ... <= ... | Off-by-one index comparison against length may lead to out-of-bounds $@. | ContainerLengthCmpOffByOne.cs:29:31:29:37 | access to array element | access to array element |
+| ContainerLengthCmpOffByOne.cs:33:13:33:28 | ... >= ... | Off-by-one index comparison against length may lead to out-of-bounds $@. | ContainerLengthCmpOffByOne.cs:35:31:35:37 | access to array element | access to array element |
diff --git a/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.expected b/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.expected
index 2706724c429..f602c9fcd11 100644
--- a/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.expected	
+++ b/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.expected	
@@ -1 +1 @@
-| UncheckedCastInEquals.cs:7:17:7:27 | (...) ... | Missing type-check before casting parameter to 'Equals'. |
+| UncheckedCastInEquals.cs:7:17:7:27 | (...) ... | Equals() method does not check argument type. |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.expected
index c9c2f544940..01b1dcfb67f 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.expected	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.expected	
@@ -8,4 +8,4 @@ nodes
 | RegexInjection.cs:14:19:14:23 | access to local variable regex | semmle.label | access to local variable regex |
 subpaths
 #select
-| RegexInjection.cs:14:19:14:23 | access to local variable regex | RegexInjection.cs:10:24:10:46 | access to property QueryString : NameValueCollection | RegexInjection.cs:14:19:14:23 | access to local variable regex | $@ flows to the construction of a regular expression. | RegexInjection.cs:10:24:10:46 | access to property QueryString | User-provided value |
+| RegexInjection.cs:14:19:14:23 | access to local variable regex | RegexInjection.cs:10:24:10:46 | access to property QueryString : NameValueCollection | RegexInjection.cs:14:19:14:23 | access to local variable regex | This regular expression is constructed from a $@. | RegexInjection.cs:10:24:10:46 | access to property QueryString | user-provided value |
diff --git a/csharp/ql/test/query-tests/Useless Code/RedundantToStringCall/RedundantToStringCall.expected b/csharp/ql/test/query-tests/Useless Code/RedundantToStringCall/RedundantToStringCall.expected
index f6e2f4d87fd..8021c21df2a 100644
--- a/csharp/ql/test/query-tests/Useless Code/RedundantToStringCall/RedundantToStringCall.expected	
+++ b/csharp/ql/test/query-tests/Useless Code/RedundantToStringCall/RedundantToStringCall.expected	
@@ -1,3 +1,3 @@
-| RedundantToStringCall.cs:7:27:7:38 | call to method ToString | Redundant call to 'ToString'. |
-| RedundantToStringCall.cs:10:37:10:48 | call to method ToString | Redundant call to 'ToString'. |
-| RedundantToStringCallBad.cs:7:45:7:56 | call to method ToString | Redundant call to 'ToString'. |
+| RedundantToStringCall.cs:7:27:7:38 | call to method ToString | Redundant call to 'ToString' on a String object. |
+| RedundantToStringCall.cs:10:37:10:48 | call to method ToString | Redundant call to 'ToString' on a String object. |
+| RedundantToStringCallBad.cs:7:45:7:56 | call to method ToString | Redundant call to 'ToString' on a String object. |
diff --git a/csharp/ql/test/utils/model-generator/CaptureNegativeSummaryModels.expected b/csharp/ql/test/utils/model-generator/dataflow/CaptureNegativeSummaryModels.expected
similarity index 82%
rename from csharp/ql/test/utils/model-generator/CaptureNegativeSummaryModels.expected
rename to csharp/ql/test/utils/model-generator/dataflow/CaptureNegativeSummaryModels.expected
index 8d2b9dcb1d3..da1be111a39 100644
--- a/csharp/ql/test/utils/model-generator/CaptureNegativeSummaryModels.expected
+++ b/csharp/ql/test/utils/model-generator/dataflow/CaptureNegativeSummaryModels.expected
@@ -1,5 +1,8 @@
 | NoSummaries;BaseClass;M1;(System.String);generated |
 | NoSummaries;BaseClass;M2;(System.String);generated |
+| NoSummaries;CollectionFlow;ReturnSimpleTypeArray;(System.Int32[]);generated |
+| NoSummaries;CollectionFlow;ReturnSimpleTypeDictionary;(System.Collections.Generic.Dictionary<System.Int32,System.Int32>);generated |
+| NoSummaries;CollectionFlow;ReturnSimpleTypeList;(System.Collections.Generic.List<System.Int32>);generated |
 | NoSummaries;EquatableBound;Equals;(System.Object);generated |
 | NoSummaries;EquatableUnBound<>;Equals;(T);generated |
 | NoSummaries;SimpleTypes;M1;(System.Boolean);generated |
diff --git a/csharp/ql/test/utils/model-generator/CaptureNegativeSummaryModels.qlref b/csharp/ql/test/utils/model-generator/dataflow/CaptureNegativeSummaryModels.qlref
similarity index 100%
rename from csharp/ql/test/utils/model-generator/CaptureNegativeSummaryModels.qlref
rename to csharp/ql/test/utils/model-generator/dataflow/CaptureNegativeSummaryModels.qlref
diff --git a/csharp/ql/test/utils/model-generator/CaptureSinkModels.expected b/csharp/ql/test/utils/model-generator/dataflow/CaptureSinkModels.expected
similarity index 100%
rename from csharp/ql/test/utils/model-generator/CaptureSinkModels.expected
rename to csharp/ql/test/utils/model-generator/dataflow/CaptureSinkModels.expected
diff --git a/csharp/ql/test/utils/model-generator/CaptureSinkModels.qlref b/csharp/ql/test/utils/model-generator/dataflow/CaptureSinkModels.qlref
similarity index 100%
rename from csharp/ql/test/utils/model-generator/CaptureSinkModels.qlref
rename to csharp/ql/test/utils/model-generator/dataflow/CaptureSinkModels.qlref
diff --git a/csharp/ql/test/utils/model-generator/CaptureSourceModels.expected b/csharp/ql/test/utils/model-generator/dataflow/CaptureSourceModels.expected
similarity index 100%
rename from csharp/ql/test/utils/model-generator/CaptureSourceModels.expected
rename to csharp/ql/test/utils/model-generator/dataflow/CaptureSourceModels.expected
diff --git a/csharp/ql/test/utils/model-generator/CaptureSourceModels.qlref b/csharp/ql/test/utils/model-generator/dataflow/CaptureSourceModels.qlref
similarity index 100%
rename from csharp/ql/test/utils/model-generator/CaptureSourceModels.qlref
rename to csharp/ql/test/utils/model-generator/dataflow/CaptureSourceModels.qlref
diff --git a/csharp/ql/test/utils/model-generator/CaptureSummaryModels.expected b/csharp/ql/test/utils/model-generator/dataflow/CaptureSummaryModels.expected
similarity index 84%
rename from csharp/ql/test/utils/model-generator/CaptureSummaryModels.expected
rename to csharp/ql/test/utils/model-generator/dataflow/CaptureSummaryModels.expected
index 23c7bff2ce4..61f41df45c5 100644
--- a/csharp/ql/test/utils/model-generator/CaptureSummaryModels.expected
+++ b/csharp/ql/test/utils/model-generator/dataflow/CaptureSummaryModels.expected
@@ -13,8 +13,13 @@
 | Summaries;CollectionFlow;false;AssignFieldToArray;(System.Object[]);;Argument[this];Argument[0].Element;taint;generated |
 | Summaries;CollectionFlow;false;AssignToArray;(System.Object,System.Object[]);;Argument[0];Argument[1].Element;taint;generated |
 | Summaries;CollectionFlow;false;ReturnArrayElement;(System.Object[]);;Argument[0].Element;ReturnValue;taint;generated |
+| Summaries;CollectionFlow;false;ReturnBulkTypeList;(System.Collections.Generic.List<System.Byte>);;Argument[0].Element;ReturnValue;taint;generated |
+| Summaries;CollectionFlow;false;ReturnComplexTypeArray;(System.String[]);;Argument[0].Element;ReturnValue;taint;generated |
+| Summaries;CollectionFlow;false;ReturnComplexTypeDictionary;(System.Collections.Generic.Dictionary<System.Int32,System.String>);;Argument[0].Element;ReturnValue;taint;generated |
 | Summaries;CollectionFlow;false;ReturnFieldInAList;();;Argument[this];ReturnValue;taint;generated |
 | Summaries;CollectionFlow;false;ReturnListElement;(System.Collections.Generic.List<System.Object>);;Argument[0].Element;ReturnValue;taint;generated |
+| Summaries;CollectionFlow;false;ReturnUntypedArray;(System.Array);;Argument[0].Element;ReturnValue;taint;generated |
+| Summaries;CollectionFlow;false;ReturnUntypedList;(System.Collections.IList);;Argument[0].Element;ReturnValue;taint;generated |
 | Summaries;DerivedClass1Flow;false;ReturnParam1;(System.String,System.String);;Argument[1];ReturnValue;taint;generated |
 | Summaries;DerivedClass2Flow;false;ReturnParam0;(System.String,System.Int32);;Argument[0];ReturnValue;taint;generated |
 | Summaries;DerivedClass2Flow;false;ReturnParam;(System.Object);;Argument[0];ReturnValue;taint;generated |
diff --git a/csharp/ql/test/utils/model-generator/CaptureSummaryModels.qlref b/csharp/ql/test/utils/model-generator/dataflow/CaptureSummaryModels.qlref
similarity index 100%
rename from csharp/ql/test/utils/model-generator/CaptureSummaryModels.qlref
rename to csharp/ql/test/utils/model-generator/dataflow/CaptureSummaryModels.qlref
diff --git a/csharp/ql/test/utils/model-generator/NoSummaries.cs b/csharp/ql/test/utils/model-generator/dataflow/NoSummaries.cs
similarity index 80%
rename from csharp/ql/test/utils/model-generator/NoSummaries.cs
rename to csharp/ql/test/utils/model-generator/dataflow/NoSummaries.cs
index 5d1f26574b0..112857f504e 100644
--- a/csharp/ql/test/utils/model-generator/NoSummaries.cs
+++ b/csharp/ql/test/utils/model-generator/dataflow/NoSummaries.cs
@@ -1,4 +1,5 @@
 using System;
+using System.Collections.Generic;
 
 namespace NoSummaries;
 
@@ -110,4 +111,24 @@ public abstract class BaseClass
 
     // Negative summary.
     public abstract string M2(string s);
+}
+
+// No methods in this class will have generated flow as
+// the simple types used in the collection are not bulk data types.
+public class CollectionFlow
+{
+    public int[] ReturnSimpleTypeArray(int[] a)
+    {
+        return a;
+    }
+
+    public List<int> ReturnSimpleTypeList(List<int> a)
+    {
+        return a;
+    }
+
+    public Dictionary<int, int> ReturnSimpleTypeDictionary(Dictionary<int, int> a)
+    {
+        return a;
+    }
 }
\ No newline at end of file
diff --git a/csharp/ql/test/utils/model-generator/Sinks.cs b/csharp/ql/test/utils/model-generator/dataflow/Sinks.cs
similarity index 100%
rename from csharp/ql/test/utils/model-generator/Sinks.cs
rename to csharp/ql/test/utils/model-generator/dataflow/Sinks.cs
diff --git a/csharp/ql/test/utils/model-generator/Sources.cs b/csharp/ql/test/utils/model-generator/dataflow/Sources.cs
similarity index 100%
rename from csharp/ql/test/utils/model-generator/Sources.cs
rename to csharp/ql/test/utils/model-generator/dataflow/Sources.cs
diff --git a/csharp/ql/test/utils/model-generator/Summaries.cs b/csharp/ql/test/utils/model-generator/dataflow/Summaries.cs
similarity index 90%
rename from csharp/ql/test/utils/model-generator/Summaries.cs
rename to csharp/ql/test/utils/model-generator/dataflow/Summaries.cs
index fe82980db9c..3db83726765 100644
--- a/csharp/ql/test/utils/model-generator/Summaries.cs
+++ b/csharp/ql/test/utils/model-generator/dataflow/Summaries.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Linq;
+using System.Collections;
 using System.Collections.Generic;
 
 namespace Summaries;
@@ -85,6 +86,31 @@ public class CollectionFlow
     {
         return new List<string> { tainted };
     }
+
+    public string[] ReturnComplexTypeArray(string[] a)
+    {
+        return a;
+    }
+
+    public List<byte> ReturnBulkTypeList(List<byte> a)
+    {
+        return a;
+    }
+
+    public Dictionary<int, string> ReturnComplexTypeDictionary(Dictionary<int, string> a)
+    {
+        return a;
+    }
+
+    public Array ReturnUntypedArray(Array a)
+    {
+        return a;
+    }
+
+    public IList ReturnUntypedList(IList a)
+    {
+        return a;
+    }
 }
 
 public class IEnumerableFlow
@@ -233,4 +259,4 @@ public class EqualsGetHashCodeNoFlow
     {
         return intTainted;
     }
-}
\ No newline at end of file
+}
diff --git a/csharp/ql/test/utils/model-generator/options b/csharp/ql/test/utils/model-generator/dataflow/options
similarity index 52%
rename from csharp/ql/test/utils/model-generator/options
rename to csharp/ql/test/utils/model-generator/dataflow/options
index a55169c6e97..ed33eca5326 100644
--- a/csharp/ql/test/utils/model-generator/options
+++ b/csharp/ql/test/utils/model-generator/dataflow/options
@@ -1,2 +1,2 @@
 semmle-extractor-options: /r:System.Linq.dll /r:System.Collections.Specialized.dll
-semmle-extractor-options: ${testdir}/../../resources/stubs/System.Web.cs
+semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Web.cs
diff --git a/csharp/ql/test/utils/model-generator/typebasedflow/CaptureTypeBasedSummaryModels.expected b/csharp/ql/test/utils/model-generator/typebasedflow/CaptureTypeBasedSummaryModels.expected
new file mode 100644
index 00000000000..6405ea3fab8
--- /dev/null
+++ b/csharp/ql/test/utils/model-generator/typebasedflow/CaptureTypeBasedSummaryModels.expected
@@ -0,0 +1,165 @@
+| Summaries;IGrouping<,>;true;get_Key;();;Argument[this].SyntheticField[ArgType0];ReturnValue;value;generated |
+| Summaries;IOrderedEnumerable<>;true;CreateOrderedEnumerable<>;(System.Func<TElement,TKey>,System.Collections.Generic.IComparer<TKey>,System.Boolean);;Argument[this].Element;Argument[0].Parameter[0];value;generated |
+| Summaries;IOrderedEnumerable<>;true;CreateOrderedEnumerable<>;(System.Func<TElement,TKey>,System.Collections.Generic.IComparer<TKey>,System.Boolean);;Argument[this].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>,System.Func<TAccumulate,TResult>);;Argument[0].Element;Argument[2].Parameter[1];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>,System.Func<TAccumulate,TResult>);;Argument[1];Argument[2].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>,System.Func<TAccumulate,TResult>);;Argument[1];Argument[3].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>,System.Func<TAccumulate,TResult>);;Argument[2].ReturnValue;Argument[2].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>,System.Func<TAccumulate,TResult>);;Argument[2].ReturnValue;Argument[3].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>,System.Func<TAccumulate,TResult>);;Argument[3].ReturnValue;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>);;Argument[0].Element;Argument[2].Parameter[1];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>);;Argument[1];Argument[2].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>);;Argument[1];ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>);;Argument[2].ReturnValue;Argument[2].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<,>;(System.Collections.Generic.IEnumerable<TSource>,TAccumulate,System.Func<TAccumulate,TSource,TAccumulate>);;Argument[2].ReturnValue;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TSource,TSource>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TSource,TSource>);;Argument[0].Element;Argument[1].Parameter[1];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TSource,TSource>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TSource,TSource>);;Argument[1].ReturnValue;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TSource,TSource>);;Argument[1].ReturnValue;Argument[1].Parameter[1];value;generated |
+| Summaries;SystemLinqEnumerable;false;Aggregate<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TSource,TSource>);;Argument[1].ReturnValue;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;All<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Any<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Append<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Append<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[1];ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;AsEnumerable<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Average<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Decimal>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Concat<>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Concat<>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TSource>);;Argument[1].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Count<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;DefaultIfEmpty<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;DefaultIfEmpty<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;DefaultIfEmpty<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[1];ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Distinct<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;DistinctBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;DistinctBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;ElementAt<>;(System.Collections.Generic.IEnumerable<TSource>,System.Int32);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;ElementAtOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,System.Int32);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;First<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;First<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;First<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;FirstOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;FirstOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;FirstOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;FirstOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;FirstOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[1];ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Intersect<>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Intersect<>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TSource>);;Argument[1].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;IntersectBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TKey>,System.Func<TSource,TKey>);;Argument[0].Element;Argument[2].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;IntersectBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TKey>,System.Func<TSource,TKey>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Join<,,,>;(System.Collections.Generic.IEnumerable<TOuter>,System.Collections.Generic.IEnumerable<TInner>,System.Func<TOuter,TKey>,System.Func<TInner,TKey>,System.Func<TOuter,TInner,TResult>);;Argument[0].Element;Argument[2].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Join<,,,>;(System.Collections.Generic.IEnumerable<TOuter>,System.Collections.Generic.IEnumerable<TInner>,System.Func<TOuter,TKey>,System.Func<TInner,TKey>,System.Func<TOuter,TInner,TResult>);;Argument[0].Element;Argument[4].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Join<,,,>;(System.Collections.Generic.IEnumerable<TOuter>,System.Collections.Generic.IEnumerable<TInner>,System.Func<TOuter,TKey>,System.Func<TInner,TKey>,System.Func<TOuter,TInner,TResult>);;Argument[1].Element;Argument[3].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Join<,,,>;(System.Collections.Generic.IEnumerable<TOuter>,System.Collections.Generic.IEnumerable<TInner>,System.Func<TOuter,TKey>,System.Func<TInner,TKey>,System.Func<TOuter,TInner,TResult>);;Argument[1].Element;Argument[4].Parameter[1];value;generated |
+| Summaries;SystemLinqEnumerable;false;Join<,,,>;(System.Collections.Generic.IEnumerable<TOuter>,System.Collections.Generic.IEnumerable<TInner>,System.Func<TOuter,TKey>,System.Func<TInner,TKey>,System.Func<TOuter,TInner,TResult>);;Argument[4].ReturnValue;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Last<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Last<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Last<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;LastOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;LastOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;LastOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;LastOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;LastOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[1];ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;LongCount<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Max<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TResult>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Max<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TResult>);;Argument[1].ReturnValue;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Max<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Max<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Decimal>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;MaxBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;MaxBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Min<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TResult>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Min<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TResult>);;Argument[1].ReturnValue;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Min<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;MinBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;MinBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;OrderBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;OrderBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;OrderByDescending<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;OrderByDescending<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Prepend<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Prepend<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[1];ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Repeat<>;(TResult,System.Int32);;Argument[0];ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Reverse<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Select<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TResult>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Select<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TResult>);;Argument[1].ReturnValue;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;SelectMany<,,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Collections.Generic.IEnumerable<TCollection>>,System.Func<TSource,TCollection,TResult>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;SelectMany<,,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Collections.Generic.IEnumerable<TCollection>>,System.Func<TSource,TCollection,TResult>);;Argument[0].Element;Argument[2].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;SelectMany<,,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Collections.Generic.IEnumerable<TCollection>>,System.Func<TSource,TCollection,TResult>);;Argument[1].ReturnValue.Element;Argument[2].Parameter[1];value;generated |
+| Summaries;SystemLinqEnumerable;false;SelectMany<,,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Collections.Generic.IEnumerable<TCollection>>,System.Func<TSource,TCollection,TResult>);;Argument[2].ReturnValue;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;SelectMany<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Collections.Generic.IEnumerable<TResult>>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;SelectMany<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Collections.Generic.IEnumerable<TResult>>);;Argument[1].ReturnValue.Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Single<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Single<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Single<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;SingleOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;SingleOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;SingleOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;SingleOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[0].Element;ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;SingleOrDefault<>;(System.Collections.Generic.IEnumerable<TSource>,TSource);;Argument[1];ReturnValue;value;generated |
+| Summaries;SystemLinqEnumerable;false;Skip<>;(System.Collections.Generic.IEnumerable<TSource>,System.Int32);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;SkipLast<>;(System.Collections.Generic.IEnumerable<TSource>,System.Int32);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;SkipWhile<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;SkipWhile<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Take<>;(System.Collections.Generic.IEnumerable<TSource>,System.Int32);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;TakeLast<>;(System.Collections.Generic.IEnumerable<TSource>,System.Int32);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;TakeWhile<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;TakeWhile<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;ThenBy<,>;(Summaries.IOrderedEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;ThenBy<,>;(Summaries.IOrderedEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;ThenByDescending<,>;(Summaries.IOrderedEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;ThenByDescending<,>;(Summaries.IOrderedEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;ToHashSet<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;ToList<>;(System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Union<>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TSource>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Union<>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TSource>);;Argument[1].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;UnionBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;Argument[2].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;UnionBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;UnionBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[1].Element;Argument[2].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;UnionBy<,>;(System.Collections.Generic.IEnumerable<TSource>,System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,TKey>);;Argument[1].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Where<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;Argument[1].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Where<>;(System.Collections.Generic.IEnumerable<TSource>,System.Func<TSource,System.Boolean>);;Argument[0].Element;ReturnValue.Element;value;generated |
+| Summaries;SystemLinqEnumerable;false;Zip<,,>;(System.Collections.Generic.IEnumerable<TFirst>,System.Collections.Generic.IEnumerable<TSecond>,System.Func<TFirst,TSecond,TResult>);;Argument[0].Element;Argument[2].Parameter[0];value;generated |
+| Summaries;SystemLinqEnumerable;false;Zip<,,>;(System.Collections.Generic.IEnumerable<TFirst>,System.Collections.Generic.IEnumerable<TSecond>,System.Func<TFirst,TSecond,TResult>);;Argument[1].Element;Argument[2].Parameter[1];value;generated |
+| Summaries;SystemLinqEnumerable;false;Zip<,,>;(System.Collections.Generic.IEnumerable<TFirst>,System.Collections.Generic.IEnumerable<TSecond>,System.Func<TFirst,TSecond,TResult>);;Argument[2].ReturnValue;ReturnValue.Element;value;generated |
+| Summaries;TypeBasedCollection<>;false;Add;(T);;Argument[0];Argument[this].Element;value;generated |
+| Summaries;TypeBasedCollection<>;false;AddMany;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].Element;value;generated |
+| Summaries;TypeBasedCollection<>;false;First;();;Argument[this].Element;ReturnValue;value;generated |
+| Summaries;TypeBasedCollection<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedCollection<>;false;GetMany;();;Argument[this].Element;ReturnValue.Element;value;generated |
+| Summaries;TypeBasedComplex<>;false;AddMany;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedComplex<>;false;Apply;(System.Func<T,System.Int32>);;Argument[this].SyntheticField[ArgType0];Argument[0].Parameter[0];value;generated |
+| Summaries;TypeBasedComplex<>;false;Apply<,>;(T1,System.Func<T1,T2>);;Argument[0];Argument[1].Parameter[0];value;generated |
+| Summaries;TypeBasedComplex<>;false;Apply<,>;(T1,System.Func<T1,T2>);;Argument[1].ReturnValue;ReturnValue;value;generated |
+| Summaries;TypeBasedComplex<>;false;Apply<>;(System.Func<T,S>);;Argument[0].ReturnValue;ReturnValue;value;generated |
+| Summaries;TypeBasedComplex<>;false;Apply<>;(System.Func<T,S>);;Argument[this].SyntheticField[ArgType0];Argument[0].Parameter[0];value;generated |
+| Summaries;TypeBasedComplex<>;false;FlatMap;(System.Func<T,System.Collections.Generic.IEnumerable<T>>);;Argument[0].ReturnValue.Element;Argument[0].Parameter[0];value;generated |
+| Summaries;TypeBasedComplex<>;false;FlatMap;(System.Func<T,System.Collections.Generic.IEnumerable<T>>);;Argument[0].ReturnValue.Element;Argument[this].SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedComplex<>;false;FlatMap;(System.Func<T,System.Collections.Generic.IEnumerable<T>>);;Argument[0].ReturnValue.Element;ReturnValue.SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedComplex<>;false;FlatMap;(System.Func<T,System.Collections.Generic.IEnumerable<T>>);;Argument[this].SyntheticField[ArgType0];Argument[0].Parameter[0];value;generated |
+| Summaries;TypeBasedComplex<>;false;FlatMap;(System.Func<T,System.Collections.Generic.IEnumerable<T>>);;Argument[this].SyntheticField[ArgType0];ReturnValue.SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedComplex<>;false;FlatMap<>;(System.Func<T,System.Collections.Generic.IEnumerable<S>>);;Argument[0].ReturnValue.Element;ReturnValue.SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedComplex<>;false;FlatMap<>;(System.Func<T,System.Collections.Generic.IEnumerable<S>>);;Argument[this].SyntheticField[ArgType0];Argument[0].Parameter[0];value;generated |
+| Summaries;TypeBasedComplex<>;false;GetMany;();;Argument[this].SyntheticField[ArgType0];ReturnValue.Element;value;generated |
+| Summaries;TypeBasedComplex<>;false;Map<>;(System.Func<T,S>);;Argument[0].ReturnValue;ReturnValue;value;generated |
+| Summaries;TypeBasedComplex<>;false;Map<>;(System.Func<T,S>);;Argument[this].SyntheticField[ArgType0];Argument[0].Parameter[0];value;generated |
+| Summaries;TypeBasedComplex<>;false;MapComplex<>;(System.Func<T,S>);;Argument[0].ReturnValue;ReturnValue.SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedComplex<>;false;MapComplex<>;(System.Func<T,S>);;Argument[this].SyntheticField[ArgType0];Argument[0].Parameter[0];value;generated |
+| Summaries;TypeBasedComplex<>;false;Return;(System.Func<T,Summaries.TypeBasedComplex<>>);;Argument[0].ReturnValue.SyntheticField[ArgType0];Argument[0].Parameter[0];value;generated |
+| Summaries;TypeBasedComplex<>;false;Return;(System.Func<T,Summaries.TypeBasedComplex<>>);;Argument[0].ReturnValue.SyntheticField[ArgType0];Argument[this].SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedComplex<>;false;Return;(System.Func<T,Summaries.TypeBasedComplex<>>);;Argument[0].ReturnValue.SyntheticField[ArgType0];ReturnValue.SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedComplex<>;false;Return;(System.Func<T,Summaries.TypeBasedComplex<>>);;Argument[this].SyntheticField[ArgType0];Argument[0].Parameter[0];value;generated |
+| Summaries;TypeBasedComplex<>;false;Return;(System.Func<T,Summaries.TypeBasedComplex<>>);;Argument[this].SyntheticField[ArgType0];ReturnValue.SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedComplex<>;false;Set;(System.Int32,System.Func<System.Int32,T>);;Argument[1].ReturnValue;Argument[this].SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedNoCollection<>;false;Get;();;Argument[this].SyntheticField[ArgType0];ReturnValue;value;generated |
+| Summaries;TypeBasedNoCollection<>;false;Set;(T);;Argument[0];Argument[this].SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedSimple<>;false;Get;();;Argument[this].SyntheticField[ArgType0];ReturnValue;value;generated |
+| Summaries;TypeBasedSimple<>;false;Get;(System.Object);;Argument[this].SyntheticField[ArgType0];ReturnValue;value;generated |
+| Summaries;TypeBasedSimple<>;false;Id;(T);;Argument[0];Argument[this].SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedSimple<>;false;Id;(T);;Argument[0];ReturnValue;value;generated |
+| Summaries;TypeBasedSimple<>;false;Id;(T);;Argument[this].SyntheticField[ArgType0];ReturnValue;value;generated |
+| Summaries;TypeBasedSimple<>;false;Id<>;(S);;Argument[0];ReturnValue;value;generated |
+| Summaries;TypeBasedSimple<>;false;Set;(System.Int32,T);;Argument[1];Argument[this].SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedSimple<>;false;Set;(T);;Argument[0];Argument[this].SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedSimple<>;false;TypeBasedSimple;(T);;Argument[0];Argument[this].SyntheticField[ArgType0];value;generated |
+| Summaries;TypeBasedSimple<>;false;get_Prop;();;Argument[this].SyntheticField[ArgType0];ReturnValue;value;generated |
+| Summaries;TypeBasedSimple<>;false;set_Prop;(T);;Argument[0];Argument[this].SyntheticField[ArgType0];value;generated |
diff --git a/csharp/ql/test/utils/model-generator/typebasedflow/CaptureTypeBasedSummaryModels.qlref b/csharp/ql/test/utils/model-generator/typebasedflow/CaptureTypeBasedSummaryModels.qlref
new file mode 100644
index 00000000000..99c0975a4c2
--- /dev/null
+++ b/csharp/ql/test/utils/model-generator/typebasedflow/CaptureTypeBasedSummaryModels.qlref
@@ -0,0 +1 @@
+utils/model-generator/CaptureTypeBasedSummaryModels.ql
\ No newline at end of file
diff --git a/csharp/ql/test/utils/model-generator/typebasedflow/TypeBasedSummaries.cs b/csharp/ql/test/utils/model-generator/typebasedflow/TypeBasedSummaries.cs
new file mode 100644
index 00000000000..f87563b945d
--- /dev/null
+++ b/csharp/ql/test/utils/model-generator/typebasedflow/TypeBasedSummaries.cs
@@ -0,0 +1,210 @@
+using System;
+using System.Linq;
+using System.Collections;
+using System.Collections.Generic;
+
+namespace Summaries;
+
+public class TypeBasedSimple<T> {
+    
+    public T Prop {
+        get { throw null; }
+        set { throw null; }
+    }
+
+    public TypeBasedSimple(T t)  { throw null; } 
+
+    public T Get() { throw null; }
+
+    public T Get(object x) { throw null; }
+
+    public T Id(T x) { throw null; }
+
+    public S Id<S>(S x) { throw null; }
+
+    public void Set(T x) { throw null; }
+
+    public void Set(int x, T y) { throw null; }
+
+    public void Set<S>(S x) { throw null; } // No summary as S is unrelated to T
+}
+
+public class TypeBasedComplex<T> {
+
+    public void AddMany(IEnumerable<T> xs) { throw null; }
+
+    public int Apply(Func<T, int> f) { throw null; }
+
+    public S Apply<S>(Func<T, S> f) { throw null; }
+
+    public T2 Apply<T1,T2>(T1 x, Func<T1, T2> f) { throw null; }
+
+    public TypeBasedComplex<T> FlatMap(Func<T, IEnumerable<T>> f) { throw null; }
+
+    public TypeBasedComplex<S> FlatMap<S>(Func<T, IEnumerable<S>> f) { throw null; }
+
+    public IList<T> GetMany() { throw null; }
+
+    public S Map<S>(Func<T, S> f) { throw null; }
+
+    public TypeBasedComplex<S> MapComplex<S>(Func<T, S> f) { throw null; }
+
+    public TypeBasedComplex<T> Return(Func<T, TypeBasedComplex<T>> f) { throw null; }
+    
+    public void Set(int x, Func<int, T> f) { throw null;}
+}
+
+// It is assumed that this is a collection with elements of type T.
+public class TypeBasedCollection<T> : IEnumerable<T> {
+    IEnumerator<T> IEnumerable<T>.GetEnumerator() { throw null; }
+    IEnumerator IEnumerable.GetEnumerator() { throw null; }
+
+    public void Add(T x) { throw null; }
+
+    public void AddMany(IEnumerable<T> x) { throw null; }
+
+    public T First() { throw null; }
+
+    public ICollection<T> GetMany() { throw null; }
+}
+
+// It is assumed that this is NOT a collection with elements of type T.
+public class TypeBasedNoCollection<T> : IEnumerable {
+    IEnumerator IEnumerable.GetEnumerator() { throw null; }
+
+    public T Get() { throw null; }
+
+    public void Set(T x) { throw null; }
+}
+
+/* 
+ * Representative subset of Linq.
+ *
+ * Only methods that will get summaries generated correctly are commented in.
+ * The remaning methods and interfaces are commented out with a descriptive reason.
+ * In some cases we will not be able correctly generate a summary based purely on the
+ * type information.
+ */
+public static class SystemLinqEnumerable {
+
+    public static TSource Aggregate<TSource>(this IEnumerable<TSource> source, Func<TSource, TSource, TSource> func) { throw null; }
+    public static TAccumulate Aggregate<TSource, TAccumulate>(this IEnumerable<TSource> source, TAccumulate seed, Func<TAccumulate, TSource, TAccumulate> func) { throw null; }
+    public static TResult Aggregate<TSource, TAccumulate, TResult>(this IEnumerable<TSource> source, TAccumulate seed, Func<TAccumulate, TSource, TAccumulate> func, Func<TAccumulate, TResult> resultSelector) { throw null; }
+    public static bool All<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    public static bool Any<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static bool Any<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    public static IEnumerable<TSource> Append<TSource>(this IEnumerable<TSource> source, TSource element) { throw null; }
+    public static IEnumerable<TSource> AsEnumerable<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static decimal Average<TSource>(this IEnumerable<TSource> source, Func<TSource, decimal> selector) { throw null; }
+    // Summary will not be derivables based on type information.
+    // public static IEnumerable<TResult> Cast<TResult>(this IEnumerable source) { throw null; }
+    public static IEnumerable<TSource[]> Chunk<TSource>(this IEnumerable<TSource> source, int size) { throw null; }
+    public static IEnumerable<TSource> Concat<TSource>(this IEnumerable<TSource> first, IEnumerable<TSource> second) { throw null; }
+    public static bool Contains<TSource>(this IEnumerable<TSource> source, TSource value) { throw null; }
+    public static int Count<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static int Count<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    public static IEnumerable<TSource?> DefaultIfEmpty<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static IEnumerable<TSource> DefaultIfEmpty<TSource>(this IEnumerable<TSource> source, TSource defaultValue) { throw null; }
+    public static IEnumerable<TSource> DistinctBy<TSource, TKey>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector) { throw null; }
+    public static IEnumerable<TSource> Distinct<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static TSource? ElementAtOrDefault<TSource>(this IEnumerable<TSource> source, int index) { throw null; }
+    public static TSource ElementAt<TSource>(this IEnumerable<TSource> source, int index) { throw null; }
+    public static IEnumerable<TResult> Empty<TResult>() { throw null; }
+    // These summaries will not be derivable based on type information.
+    // public static IEnumerable<TSource> ExceptBy<TSource, TKey>(this IEnumerable<TSource> first, IEnumerable<TKey> second, Func<TSource, TKey> keySelector) { throw null; }
+    // public static IEnumerable<TSource> Except<TSource>(this IEnumerable<TSource> first, IEnumerable<TSource> second) { throw null; }
+    public static TSource? FirstOrDefault<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static TSource FirstOrDefault<TSource>(this IEnumerable<TSource> source, TSource defaultValue) { throw null; }
+    public static TSource? FirstOrDefault<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    // Summary will not be correctly derivable based on type information.
+    // public static TSource FirstOrDefault<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate, TSource defaultValue) { throw null; }
+    public static TSource First<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static TSource First<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    // Missing summary for Argument[0].Element -> Argument[2].Parameter[1].Element and similar problem for GroupJoin (issue with generator)
+    // public static IEnumerable<TResult> GroupBy<TSource, TKey, TResult>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector, Func<TKey, IEnumerable<TSource>, TResult> resultSelector) { throw null; }
+    // public static IEnumerable<TResult> GroupJoin<TOuter, TInner, TKey, TResult>(this IEnumerable<TOuter> outer, IEnumerable<TInner> inner, Func<TOuter, TKey> outerKeySelector, Func<TInner, TKey> innerKeySelector, Func<TOuter, IEnumerable<TInner>, TResult> resultSelector) { throw null; }
+    public static IEnumerable<TSource> IntersectBy<TSource, TKey>(this IEnumerable<TSource> first, IEnumerable<TKey> second, Func<TSource, TKey> keySelector) { throw null; }
+    public static IEnumerable<TSource> Intersect<TSource>(this IEnumerable<TSource> first, IEnumerable<TSource> second) { throw null; }
+    public static IEnumerable<TResult> Join<TOuter, TInner, TKey, TResult>(this IEnumerable<TOuter> outer, IEnumerable<TInner> inner, Func<TOuter, TKey> outerKeySelector, Func<TInner, TKey> innerKeySelector, Func<TOuter, TInner, TResult> resultSelector) { throw null; }
+    public static TSource? LastOrDefault<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static TSource LastOrDefault<TSource>(this IEnumerable<TSource> source, TSource defaultValue) { throw null; }
+    public static TSource? LastOrDefault<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    // Summary will not be correctly derivable based on type information (same problem as for FirstOrDefault)
+    // public static TSource LastOrDefault<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate, TSource defaultValue) { throw null; }
+    public static TSource Last<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static TSource Last<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    public static long LongCount<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    public static TSource? MaxBy<TSource, TKey>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector) { throw null; }
+    public static TSource? Max<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static decimal Max<TSource>(this IEnumerable<TSource> source, Func<TSource, decimal> selector) { throw null; }
+    public static TResult? Max<TSource, TResult>(this IEnumerable<TSource> source, Func<TSource, TResult> selector) { throw null; }
+    public static TSource? MinBy<TSource, TKey>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector) { throw null; }
+    public static TSource? Min<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static TResult? Min<TSource, TResult>(this IEnumerable<TSource> source, Func<TSource, TResult> selector) { throw null; }
+    // These summaries will not be derivable based on type information.
+    // public static IEnumerable<TResult> OfType<TResult>(this IEnumerable source) { throw null; }
+    public static IOrderedEnumerable<TSource> OrderByDescending<TSource, TKey>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector) { throw null; }
+    public static IOrderedEnumerable<TSource> OrderBy<TSource, TKey>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector) { throw null; }
+    public static IEnumerable<TSource> Prepend<TSource>(this IEnumerable<TSource> source, TSource element) { throw null; }
+    public static IEnumerable<TResult> Repeat<TResult>(TResult element, int count) { throw null; }
+    public static IEnumerable<TSource> Reverse<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static IEnumerable<TResult> SelectMany<TSource, TResult>(this IEnumerable<TSource> source, Func<TSource, IEnumerable<TResult>> selector) { throw null; }
+    public static IEnumerable<TResult> SelectMany<TSource, TCollection, TResult>(this IEnumerable<TSource> source, Func<TSource, IEnumerable<TCollection>> collectionSelector, Func<TSource, TCollection, TResult> resultSelector) { throw null; }
+    public static IEnumerable<TResult> Select<TSource, TResult>(this IEnumerable<TSource> source, Func<TSource, TResult> selector) { throw null; }
+    public static bool SequenceEqual<TSource>(this IEnumerable<TSource> first, IEnumerable<TSource> second) { throw null; }
+    public static TSource? SingleOrDefault<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static TSource SingleOrDefault<TSource>(this IEnumerable<TSource> source, TSource defaultValue) { throw null; }
+    public static TSource? SingleOrDefault<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    // Summary will not be correctly derivable based on type information (same problem as for FirstOrDefault)
+    // public static TSource SingleOrDefault<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate, TSource defaultValue) { throw null; }
+    public static TSource Single<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static TSource Single<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    public static IEnumerable<TSource> SkipLast<TSource>(this IEnumerable<TSource> source, int count) { throw null; }
+    public static IEnumerable<TSource> SkipWhile<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    public static IEnumerable<TSource> Skip<TSource>(this IEnumerable<TSource> source, int count) { throw null; }
+    public static IEnumerable<TSource> TakeLast<TSource>(this IEnumerable<TSource> source, int count) { throw null; }
+    public static IEnumerable<TSource> TakeWhile<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    public static IEnumerable<TSource> Take<TSource>(this IEnumerable<TSource> source, int count) { throw null; }
+    public static IOrderedEnumerable<TSource> ThenByDescending<TSource, TKey>(this IOrderedEnumerable<TSource> source, Func<TSource, TKey> keySelector) { throw null; }
+    public static IOrderedEnumerable<TSource> ThenBy<TSource, TKey>(this IOrderedEnumerable<TSource> source, Func<TSource, TKey> keySelector) { throw null; }
+    // Missing summary for Argument[0].Element -> ReturnValue.Element  (issue with generator)
+    // public static TSource[] ToArray<TSource>(this IEnumerable<TSource> source) { throw null; }
+    // Summaries related to dictionaries is not generated correctly as dictionaries are not identified as collections of keys and values (issue with generator).
+    // public static Dictionary<TKey, TSource> ToDictionary<TSource, TKey>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector) where TKey : notnull { throw null; }
+    // public static Dictionary<TKey, TElement> ToDictionary<TSource, TKey, TElement>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector, Func<TSource, TElement> elementSelector) where TKey : notnull { throw null; }
+    public static HashSet<TSource> ToHashSet<TSource>(this IEnumerable<TSource> source) { throw null; }
+    public static List<TSource> ToList<TSource>(this IEnumerable<TSource> source) { throw null; }
+    // Type to complicated to be handled by the generator (issue with generator).
+    // public static ILookup<TKey, TSource> ToLookup<TSource, TKey>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector) { throw null; }
+    // public static ILookup<TKey, TElement> ToLookup<TSource, TKey, TElement>(this IEnumerable<TSource> source, Func<TSource, TKey> keySelector, Func<TSource, TElement> elementSelector) { throw null; }
+    public static IEnumerable<TSource> UnionBy<TSource, TKey>(this IEnumerable<TSource> first, IEnumerable<TSource> second, Func<TSource, TKey> keySelector) { throw null; }
+    public static IEnumerable<TSource> Union<TSource>(this IEnumerable<TSource> first, IEnumerable<TSource> second) { throw null; }
+    public static IEnumerable<TSource> Where<TSource>(this IEnumerable<TSource> source, Func<TSource, bool> predicate) { throw null; }
+    // Type to complicated to be handled by the generator (issue with generator).
+    // public static IEnumerable<(TFirst First, TSecond Second)> Zip<TFirst, TSecond>(this IEnumerable<TFirst> first, IEnumerable<TSecond> second) { throw null; }
+    // public static IEnumerable<(TFirst First, TSecond Second, TThird Third)> Zip<TFirst, TSecond, TThird>(this IEnumerable<TFirst> first, IEnumerable<TSecond> second, IEnumerable<TThird> third) { throw null; }
+    public static IEnumerable<TResult> Zip<TFirst, TSecond, TResult>(this IEnumerable<TFirst> first, IEnumerable<TSecond> second, Func<TFirst, TSecond, TResult> resultSelector) { throw null; }
+}
+
+public interface IGrouping<out TKey, out TElement> : IEnumerable<TElement>, IEnumerable {
+    TKey Key { get; }
+}
+
+// public interface ILookup<TKey, TElement> : IEnumerable<IGrouping<TKey, TElement>>, IEnumerable {
+//     IEnumerable<TElement> this[TKey key] { get; }
+//     bool Contains(TKey key);
+// }
+
+public interface IOrderedEnumerable<out TElement> : IEnumerable<TElement>, IEnumerable {
+    IOrderedEnumerable<TElement> CreateOrderedEnumerable<TKey>(Func<TElement, TKey> keySelector, IComparer<TKey>? comparer, bool descending);
+}
+
+// public partial class Lookup<TKey, TElement> : IEnumerable<IGrouping<TKey, TElement>>, IEnumerable, ILookup<TKey, TElement>{
+//         internal Lookup() { }
+//         public int Count { get { throw null; } }
+//         public IEnumerable<TElement> this[TKey key] { get { throw null; } }
+//         public IEnumerable<TResult> ApplyResultSelector<TResult>(Func<TKey, IEnumerable<TElement>, TResult> resultSelector) { throw null; }
+//         public bool Contains(TKey key) { throw null; }
+//         public IEnumerator<IGrouping<TKey, TElement>> GetEnumerator() { throw null; }
+//         IEnumerator IEnumerable.GetEnumerator() { throw null; }
+// }
diff --git a/csharp/tools/linux64/compiler-tracing.spec b/csharp/tools/linux64/compiler-tracing.spec
deleted file mode 100644
index 659170b7ceb..00000000000
--- a/csharp/tools/linux64/compiler-tracing.spec
+++ /dev/null
@@ -1,16 +0,0 @@
-**/mcs.exe:
-**/csc.exe:
-  invoke ${config_dir}/Semmle.Extraction.CSharp.Driver
-  prepend --compiler
-  prepend "${compiler}"
-  prepend --cil
-**/mono*:
-**/dotnet:
-  invoke ${config_dir}/Semmle.Extraction.CSharp.Driver
-  prepend --dotnetexec
-  prepend --cil
-**/msbuild:
-**/xbuild:
-  replace yes
-  invoke ${compiler}
-  append /p:UseSharedCompilation=false
diff --git a/csharp/tools/osx64/compiler-tracing.spec b/csharp/tools/osx64/compiler-tracing.spec
deleted file mode 100644
index 659170b7ceb..00000000000
--- a/csharp/tools/osx64/compiler-tracing.spec
+++ /dev/null
@@ -1,16 +0,0 @@
-**/mcs.exe:
-**/csc.exe:
-  invoke ${config_dir}/Semmle.Extraction.CSharp.Driver
-  prepend --compiler
-  prepend "${compiler}"
-  prepend --cil
-**/mono*:
-**/dotnet:
-  invoke ${config_dir}/Semmle.Extraction.CSharp.Driver
-  prepend --dotnetexec
-  prepend --cil
-**/msbuild:
-**/xbuild:
-  replace yes
-  invoke ${compiler}
-  append /p:UseSharedCompilation=false
diff --git a/csharp/tools/tracing-config.lua b/csharp/tools/tracing-config.lua
index 03d1e49699a..7c62f0062e4 100644
--- a/csharp/tools/tracing-config.lua
+++ b/csharp/tools/tracing-config.lua
@@ -1,7 +1,9 @@
 function RegisterExtractorPack(id)
-    local extractor = GetPlatformToolsDirectory() ..
-        'Semmle.Extraction.CSharp.Driver'
-    if OperatingSystem == 'windows' then extractor = extractor .. '.exe' end
+    function Exify(path)
+        if OperatingSystem == 'windows' then return path .. '.exe' else return path end
+    end
+
+    local extractor = Exify(GetPlatformToolsDirectory() .. 'Semmle.Extraction.CSharp.Driver')
 
     function DotnetMatcherBuild(compilerName, compilerPath, compilerArguments,
                                 _languageId)
@@ -47,10 +49,30 @@ function RegisterExtractorPack(id)
         return nil
     end
 
+    function MsBuildMatcher(compilerName, compilerPath, compilerArguments, _languageId)
+        if MatchCompilerName('^' .. Exify('msbuild') .. '$', compilerName, compilerPath,
+            compilerArguments) or
+            MatchCompilerName('^' .. Exify('xbuild') .. '$', compilerName, compilerPath,
+                compilerArguments) then
+            return {
+                order = ORDER_REPLACE,
+                invocation = BuildExtractorInvocation(id, compilerPath,
+                    compilerPath,
+                    compilerArguments,
+                    nil, {
+                    '/p:UseSharedCompilation=false',
+                    '/p:MvcBuildViews=true'
+                })
+
+            }
+        end
+    end
+
     local windowsMatchers = {
         DotnetMatcherBuild,
+        MsBuildMatcher,
         CreatePatternMatcher({ '^csc.*%.exe$' }, MatchCompilerName, extractor, {
-            prepend = { '--cil', '--compiler', '"${compiler}"' },
+            prepend = { '--compiler', '"${compiler}"' },
             order = ORDER_BEFORE
         }),
         CreatePatternMatcher({ '^fakes.*%.exe$', 'moles.*%.exe' },
@@ -63,7 +85,7 @@ function RegisterExtractorPack(id)
 
             local seenCompilerCall = false
             local argv = NativeArgumentsToArgv(compilerArguments.nativeArgumentPointer)
-            local extractorArgs = { '--cil', '--compiler' }
+            local extractorArgs = { '--compiler' }
             for _, arg in ipairs(argv) do
                 if arg:match('csc%.dll$') then
                     seenCompilerCall = true
@@ -91,25 +113,11 @@ function RegisterExtractorPack(id)
         DotnetMatcherBuild,
         CreatePatternMatcher({ '^mcs%.exe$', '^csc%.exe$' }, MatchCompilerName,
             extractor, {
-            prepend = { '--cil', '--compiler', '"${compiler}"' },
+            prepend = { '--compiler', '"${compiler}"' },
             order = ORDER_BEFORE
-        }), function(compilerName, compilerPath, compilerArguments, _languageId)
-            if MatchCompilerName('^msbuild$', compilerName, compilerPath,
-                compilerArguments) or
-                MatchCompilerName('^xbuild$', compilerName, compilerPath,
-                    compilerArguments) then
-                return {
-                    order = ORDER_REPLACE,
-                    invocation = BuildExtractorInvocation(id, compilerPath,
-                        compilerPath,
-                        compilerArguments,
-                        nil, {
-                        '/p:UseSharedCompilation=false'
-                    })
-
-                }
-            end
-        end, function(compilerName, compilerPath, compilerArguments, _languageId)
+        }),
+        MsBuildMatcher,
+        function(compilerName, compilerPath, compilerArguments, _languageId)
             -- handle cases like `dotnet exec csc.dll <args>` and `mono(-sgen64) csc.exe <args>`
             if compilerName ~= 'dotnet' and not compilerName:match('^mono') then
                 return nil
@@ -117,7 +125,7 @@ function RegisterExtractorPack(id)
 
             local seenCompilerCall = false
             local argv = compilerArguments.argv
-            local extractorArgs = { '--cil', '--compiler' }
+            local extractorArgs = { '--compiler' }
             for _, arg in ipairs(argv) do
                 if arg:match('csc%.dll$') or arg:match('csc%.exe$') or arg:match('mcs%.exe$') then
                     seenCompilerCall = true
diff --git a/csharp/tools/win64/compiler-tracing.spec b/csharp/tools/win64/compiler-tracing.spec
deleted file mode 100644
index ca1d544e884..00000000000
--- a/csharp/tools/win64/compiler-tracing.spec
+++ /dev/null
@@ -1,13 +0,0 @@
-**\fakes*.exe:
-**\moles*.exe:
-  order compiler
-  trace no
-**\csc*.exe:
-  invoke ${config_dir}\Semmle.Extraction.CSharp.Driver.exe
-  prepend --compiler
-  prepend "${compiler}"
-  prepend --cil
-**\dotnet.exe:
-  invoke ${config_dir}\Semmle.Extraction.CSharp.Driver.exe
-  prepend --dotnetexec
-  prepend --cil
diff --git a/docs/codeql/codeql-cli/about-codeql-workspaces.rst b/docs/codeql/codeql-cli/about-codeql-workspaces.rst
index f5b477ec2c0..860fbdb7d63 100644
--- a/docs/codeql/codeql-cli/about-codeql-workspaces.rst
+++ b/docs/codeql/codeql-cli/about-codeql-workspaces.rst
@@ -1,6 +1,6 @@
 .. _about-codeql-workspaces:
 
-About CodeQL Workspaces
+About CodeQL workspaces
 =======================
 
 .. include:: ../reusables/beta-note-package-management.rst
@@ -20,7 +20,7 @@ A CodeQL workspace is defined by a ``codeql-workspace.yml`` yaml file. This file
 * The ``ignore`` block contains a list of glob patterns that define CodeQL packs that are not available in the workspace.
 * The ``registries`` block contains a list of GHES URLs and package patterns that control which container registry is used for publishing CodeQL packs. For more information, see :ref:`Working with CodeQL packs on GitHub Enterprise Server <working-with-codeql-packs-on-ghes>`.
 
-Each entry in the ``provide`` or ``ignore`` section must map to the location of a ``qlpack.yml`` file. All glob patterns are defined relative to the directory that contains the workspace file. For a list of patterns accepted in this file, see" `@actions/glob <https://github.com/actions/toolkit/tree/main/packages/glob#patterns>`__ .
+Each entry in the ``provide`` or ``ignore`` section must map to the location of a ``qlpack.yml`` file. All glob patterns are defined relative to the directory that contains the workspace file. For a list of patterns accepted in this file, see "`@actions/glob <https://github.com/actions/toolkit/tree/main/packages/glob#patterns>`__ ."
 
 For example, the following ``codeql-workspace.yml`` file defines a workspace that contains all the CodeQL packs recursively found in the ``codeql-packs`` directory, except for the packs in the ``experimental`` directory. The ``registries`` block specifies that ``codeql/*`` packs should be downloaded from https://ghcr.io/v2/, which is GitHub's default container registry. All other packs should be downloaded from and published to the regsitry at ``GHE_HOSTNAME``.
 
@@ -55,7 +55,7 @@ This is particularly useful in the following situations:
 CodeQL workspaces and query resolution
 --------------------------------------
 
-All CodeQL packs in a workspace are available as source dependencies for each other when you run any CodeQL command that resolves queries or packs. For example, when you run ``codeql pack install`` in a pack directory in a workspace, any dependency that can be found in the workspace will be used instead of downloading that dependency to the package cache and adding it to the ``codeql-pack.lock.yml`` file. For more information, see ":ref:Adding and Installing Dependencies <adding-and-installing-dependencies>`."
+All CodeQL packs in a workspace are available as source dependencies for each other when you run any CodeQL command that resolves queries or packs. For example, when you run ``codeql pack install`` in a pack directory in a workspace, any dependency that can be found in the workspace will be used instead of downloading that dependency to the package cache and adding it to the ``codeql-pack.lock.yml`` file. For more information, see ":ref:`Adding and Installing Dependencies <adding-and-installing-dependencies>`."
 
 Similarly, when you publish a CodeQL query pack to the GitHub container registry using  ``codeql pack publish`` the command will always use the dependencies from the workspace instead of using dependencies found in the local package cache.
 
diff --git a/docs/codeql/codeql-cli/about-ql-packs.rst b/docs/codeql/codeql-cli/about-ql-packs.rst
new file mode 100644
index 00000000000..2f8d4d9229d
--- /dev/null
+++ b/docs/codeql/codeql-cli/about-ql-packs.rst
@@ -0,0 +1,12 @@
+.. _about-ql-packs:
+
+About QL packs
+==============
+
+This page has been moved to ":doc:`About CodeQL packs <about-codeql-packs>`."
+
+
+.. toctree::
+   :hidden:
+
+   about-ql-packs
diff --git a/docs/codeql/codeql-cli/creating-codeql-databases.rst b/docs/codeql/codeql-cli/creating-codeql-databases.rst
index 5a8e33ffae6..484163d94e7 100644
--- a/docs/codeql/codeql-cli/creating-codeql-databases.rst
+++ b/docs/codeql/codeql-cli/creating-codeql-databases.rst
@@ -11,11 +11,11 @@ or download them from GitHub.com.
 CodeQL analysis relies on extracting relational data from your code, and
 using it to build a :ref:`CodeQL database <codeql-database>`. CodeQL
 databases contain all of the important information about a codebase, which can
-be analyzed by executing CodeQL queries against it. GitHub creates and 
+be analyzed by executing CodeQL queries against it. GitHub creates and
 stores CodeQL databases for a large number of open-source projects. For more information,
 see ":ref:`Downloading CodeQL databases from GitHub.com <downloading-codeql-databases-from-github-com>`."
 
-You can also create CodeQL databases yourself using the CodeQL CLI. 
+You can also create CodeQL databases yourself using the CodeQL CLI.
 Before you generate a CodeQL database, you need to:
 
 - Install and set up the CodeQL CLI. For more information, see
@@ -214,10 +214,10 @@ commands that you can specify for compiled languages.
 
      codeql database create cpp-database --language=cpp --command=make
 
-- C# project built using ``dotnet build``::
+- C# project built using ``dotnet build``:
 
-     It is a good idea to add `/t:rebuild` to ensure that all code will be built, or do a
-     prior `dotnet clean` (code that is not built will not be included in the CodeQL database):
+  It is a good idea to add `/t:rebuild` to ensure that all code will be built, or do a
+  prior `dotnet clean` (code that is not built will not be included in the CodeQL database)::
 
      codeql database create csharp-database --language=csharp --command='dotnet build /t:rebuild'
 
@@ -391,9 +391,9 @@ Downloading databases from GitHub.com
 -------------------------------------
 
 .. include:: ../reusables/download-github-database.rst
-   
+
 Before running an analysis with the CodeQL CLI, you must unzip the databases.
-   
+
 Further reading
 ---------------
 
diff --git a/docs/codeql/codeql-overview/codeql-tools.rst b/docs/codeql/codeql-overview/codeql-tools.rst
index c51a5286cb0..78f47200c94 100644
--- a/docs/codeql/codeql-overview/codeql-tools.rst
+++ b/docs/codeql/codeql-overview/codeql-tools.rst
@@ -13,9 +13,40 @@ CodeQL command-line interface
 
 The CodeQL command-line interface (CLI) is primarily used to create databases for 
 security research. You can also query CodeQL databases directly from the command line 
-or using the Visual Studio Code extension. For more information, see
-":ref:`CodeQL CLI <codeql-cli>`."
+or using the Visual Studio Code extension.
+The CodeQL CLI can be downloaded from `GitHub releases <https://github.com/github/codeql-cli-binaries/releases>`__.
+For more information, see ":ref:`CodeQL CLI <codeql-cli>`" and the `CLI changelog <https://github.com/github/codeql-cli-binaries/blob/main/CHANGELOG.md>`__.
 
+CodeQL packs
+-----------------------------
+
+The standard CodeQL query and library packs
+(`source <https://github.com/github/codeql/tree/codeql-cli/latest>`__)
+maintained by GitHub are:
+
+- ``codeql/cpp-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/src>`__)
+- ``codeql/cpp-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/lib>`__)
+- ``codeql/csharp-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/src>`__)
+- ``codeql/csharp-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/lib>`__)
+- ``codeql/go-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/src>`__)
+- ``codeql/go-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/lib>`__)
+- ``codeql/java-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/src>`__)
+- ``codeql/java-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/lib>`__)
+- ``codeql/javascript-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/src>`__)
+- ``codeql/javascript-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/lib>`__)
+- ``codeql/python-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/src>`__)
+- ``codeql/python-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/lib>`__)
+- ``codeql/ruby-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/src>`__)
+- ``codeql/ruby-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/lib>`__)
+
+For more information, see ":ref:`About CodeQL packs <about-codeql-packs>`."
+
+CodeQL bundle
+-----------------------------
+
+The CodeQL bundle consists of the CodeQL CLI together with the standard CodeQL query and library packs
+maintained by GitHub. The bundle can be downloaded from `GitHub releases <https://github.com/github/codeql-action/releases>`__.
+Use this when running `code scanning with CodeQL <https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql>`__ on GitHub Actions or in another CI system.
 
 CodeQL for Visual Studio Code
 -----------------------------
diff --git a/docs/codeql/ql-language-reference/index.rst b/docs/codeql/ql-language-reference/index.rst
index 5a971259cf7..cf1926ae3d0 100644
--- a/docs/codeql/ql-language-reference/index.rst
+++ b/docs/codeql/ql-language-reference/index.rst
@@ -15,6 +15,8 @@ Learn all about QL, the powerful query language that underlies the code scanning
 
 - :doc:`Modules <modules>`: Modules provide a way of organizing QL code by grouping together related types, predicates, and other modules. 
 
+- :doc:`Signatures <signatures>`: Signatures provide a typing mechanism to parameters of parameterized modules.
+
 - :doc:`Aliases <aliases>`: An alias is an alternative name for an existing QL entity. 
 
 - :doc:`Variables <variables>`: Variables in QL are used in a similar way to variables in algebra or logic. They represent sets of values, and those values are usually restricted by a formula.
@@ -44,6 +46,7 @@ Learn all about QL, the powerful query language that underlies the code scanning
    queries
    types
    modules
+   signatures
    aliases
    variables
    expressions
diff --git a/docs/codeql/ql-language-reference/modules.rst b/docs/codeql/ql-language-reference/modules.rst
index b9998b63248..b82ea1c2838 100644
--- a/docs/codeql/ql-language-reference/modules.rst
+++ b/docs/codeql/ql-language-reference/modules.rst
@@ -133,6 +133,92 @@ defined :ref:`above <library-modules>`:
 This defines an explicit module named ``M``. The body of this module defines
 the class ``OneTwo``.
 
+.. _parameterized-modules:
+
+Parameterized modules
+=====================
+
+Parameterized modules are QL's approach to generic programming.
+Similar to explicit modules, parameterized modules are defined within other modules using the keywork ``module``.
+In addition to the module name, parameterized modules declare one or more parameters between the name and the module body.
+
+For example, consider the module ``M``, which takes two predicate parameters and defines a new predicate
+that applies them one after the other:
+
+.. code-block:: ql
+
+    module M<transformer/1 first, transformer/1 second> {
+      bindingset[x]
+      int applyBoth(int x) {
+        result = second(first(x))
+      }
+    }
+
+Parameterized modules cannot be directly referenced.
+Instead, you instantiate a parameterized module by passing arguments enclosed in angle brackets (``<`` and ``>``) to the module.
+Instantiated parameterized modules can be used as a :ref:`module expression <name-resolution>`, identical to explicit module references.
+
+For example, we can instantiate ``M`` with two identical arguments ``increment``, creating a module
+containing a predicate that adds 2:
+
+.. code-block:: ql
+
+    bindingset[result] bindingset[x]
+    int increment(int x) { result = x + 1 }
+
+    module IncrementTwice = M<increment/1, increment/1>;
+
+    select IncrementTwice::applyBoth(40) // 42
+
+The parameters of a parameterized module are (meta-)typed with :ref:`signatures <signatures>`.
+
+For example, in the previous two snippets, we relied on the predicate signature ``transformer``:
+
+.. code-block:: ql
+
+    bindingset[x]
+    signature int transformer(int x);
+
+The instantiation of parameterized modules is applicative.
+That is, if you instantiate a parameterized module twice with identical arguments, the resulting object is the same.
+This is particularly relevant for type definitions inside parameterized modules as :ref:`classes <classes>`
+or via :ref:`newtype <algebraic-datatypes>`, because the duplication of such type definitions would result in
+incompatible types.
+
+The following example instantiates module ``M`` inside calls to predicate ``foo`` twice.
+The first call is valid but the second call generates an error.
+
+.. code-block:: ql
+
+    bindingset[this]
+    signature class TSig;
+
+    module M<TSig T> {
+      newtype A = B() or C()
+    }
+
+    string foo(M<int>::A a) { ... }
+
+    select foo(M<int>::B()),  // valid: repeated identical instantiation of M does not duplicate A, B, C
+           foo(M<float>::B()) // ERROR: M<float>::B is not compatible with M<int>::A
+
+Module parameters are dependently typed, meaning that signature expressions in parameter definitions can reference
+preceding parameters.
+
+For example, we can declare the signature for ``T2`` dependent on ``T1``, enforcing a subtyping relationship
+between the two parameters:
+
+.. code-block:: ql
+
+    signature class TSig;
+
+    module Extends<TSig T> { signature class Type extends T; }
+
+    module ParameterizedModule<TSig T1, Extends<T1>::Type T2> { ... }
+
+Dependently typed parameters are particularly useful in combination with
+:ref:`parameterized module signatures <parameterized-module-signatures>`.
+
 .. _module-bodies:
 
 Module bodies
diff --git a/docs/codeql/ql-language-reference/name-resolution.rst b/docs/codeql/ql-language-reference/name-resolution.rst
index c8fc351cffb..c14147d533e 100644
--- a/docs/codeql/ql-language-reference/name-resolution.rst
+++ b/docs/codeql/ql-language-reference/name-resolution.rst
@@ -21,7 +21,7 @@ In summary, the kinds of expressions are:
   - **Module expressions**
       - These refer to modules.
       - They can be simple :ref:`names <names>`, :ref:`qualified references <qualified-references>` 
-        (in import statements), or :ref:`selections <selections>`.
+        (in import statements), :ref:`selections <selections>`, or :ref:`instantiations <parameterized-modules>`.
   - **Type expressions**
       - These refer to types.
       - They can be simple :ref:`names <names>` or :ref:`selections <selections>`.
diff --git a/docs/codeql/ql-language-reference/ql-language-specification.rst b/docs/codeql/ql-language-reference/ql-language-specification.rst
index ea90ebbf843..45747ae86ab 100644
--- a/docs/codeql/ql-language-reference/ql-language-specification.rst
+++ b/docs/codeql/ql-language-reference/ql-language-specification.rst
@@ -57,44 +57,27 @@ construction of the library path.
 First, determine the *query directory* of the ``.ql`` file being
 compiled. Starting with the directory containing the ``.ql`` file, and
 walking up the directory structure, each directory is checked for a
-file called ``queries.xml`` or ``qlpack.yml``. The first directory
+file called ``qlpack.yml`` or ``codeql-pack.yml``. The first directory
 where such a file is found is the query directory. If there is no such
 directory, the directory of the ``.ql`` file itself is the query
 directory.
 
-A ``queries.xml`` file that defines a query directory must always
-contain a single top-level tag named
-``queries``, which has a ``language`` attribute set to the identifier
-of the active database schema (for example, ``<queries
-language="java"/>``).
-
 A ``qlpack.yml`` file defines a :ref:`CodeQL pack <about-codeql-packs>`.
 The content of a ``qlpack.yml`` file is described in the CodeQL CLI documentation.
+``codeql-pack.yml`` is an alias for ``qlpack.yml``.
 
-If both a ``queries.xml`` and a ``qlpack.yml`` exist in the same
-directory, the latter takes precedence (and the former is assumed to
-exist for compatibility with older tooling).
-
-The CodeQL CLI and newer tools based on it (such as,
+The CodeQL CLI and tools based on it (such as,
 GitHub code scanning and the CodeQL extension for Visual Studio Code)
 construct a library path using CodeQL packs. For each CodeQL pack
 added to the library path, the CodeQL packs named in its
-``libraryPathDependencies`` will be subsequently added to the library
+``dependencies`` will be subsequently added to the library
 path, and the process continues until all packs have been
 resolved. The actual library path consists of the root directories of
 the selected CodeQL packs. This process depends on a mechanism for finding
-CodeQL packs by pack name, as described in the :ref:`CodeQL CLI documentation <codeql-cli>`.
+CodeQL packs by pack name and version, as described in the :ref:`CodeQL CLI documentation <codeql-cli>`.
 
-When the query directory contains a ``queries.xml`` file but no
-``qlpack.yml``, the CodeQL pack resolution behaves as if it defines a QL
-pack with no name and a single library path dependency named
-``legacy-libraries-LANGUAGE`` where ``LANGUAGE`` is taken from
-``queries.xml``. The ``github/codeql`` repository provides packs with
-names following this pattern, which themselves depend on the actual
-CodeQL libraries for each language.
-
-When the query directory contains neither a ``queries.xml`` nor
-``qlpack.yml`` file, it is considered to be a CodeQL pack with no name and
+When the query directory contains neither a ``qlpack.yml`` nor
+``codeql-pack.yml`` file, it is considered to be a CodeQL pack with no name and
 no library dependencies. This causes the library path to consist of
 *only* the query directory itself. This is not generally useful,
 but it suffices for running toy examples of QL code that don't
@@ -160,7 +143,7 @@ Module definitions
 
 A QL module definition has the following syntax:
 
-:: 
+::
 
    module ::= annotation* "module" modulename "{" moduleBody "}"
 
@@ -196,7 +179,7 @@ An import directive refers to a module identifier:
 
    import ::= annotations "import" importModuleId ("as" modulename)?
 
-   qualId ::= simpleId | qualId "." simpleId 
+   qualId ::= simpleId | qualId "." simpleId
 
    importModuleId ::= qualId
                   | importModuleId "::" simpleId
@@ -268,7 +251,7 @@ With the exception of class domain types and character types (which cannot be re
 
    type ::= (moduleId "::")? classname | dbasetype | "boolean" | "date" | "float" | "int" | "string"
 
-   moduleId ::= simpleId | moduleId "::" simpleId 
+   moduleId ::= simpleId | moduleId "::" simpleId
 
 A type reference is resolved to a type as follows:
 
@@ -598,7 +581,7 @@ An integer literal is a possibly negated sequence of decimal digits (``0`` throu
    0
    42
    123
-   -2147483648 
+   -2147483648
 
 Float literals (float)
 ~~~~~~~~~~~~~~~~~~~~~~
@@ -760,7 +743,7 @@ it is parsed as part of the first declaration.
 Inheriting QLDoc
 ~~~~~~~~~~~~~~~~
 
-If no QLDoc is provided then it may be inherited. 
+If no QLDoc is provided then it may be inherited.
 
 In the case of an alias then it may be inherited from the right-hand side of the alias.
 
@@ -818,7 +801,7 @@ The body of a predicate is of one of three forms:
 ::
 
    optbody ::= ";"
-           |  "{" formula "}" 
+           |  "{" formula "}"
            |  "=" literalId "(" (predicateRef "/" int ("," predicateRef "/" int)*)? ")" "(" (exprs)? ")"
 
 In the first form, with just a semicolon, the predicate is said to not have a body. In the second form, the body of the predicate is the given formula (see "`Formulas <#formulas>`__"). In the third form, the body is a higher-order relation.
@@ -873,7 +856,7 @@ Each member of a class is either a *character*, a predicate, or a field:
 ::
 
    member ::= character | predicate | field
-   character ::= qldoc? annotations classname "(" ")" "{" formula "}" 
+   character ::= qldoc? annotations classname "(" ")" "{" formula "}"
    field ::= qldoc? annotations var_decl ";"
 
 Characters
@@ -924,7 +907,7 @@ A valid class may not inherit from two different classes that include a field wi
 
 A valid field must override another field if it is annotated ``override``.
 
-When field ``f`` overrides field ``g`` the type of ``f`` must be a subtype of the type of ``g``. ``f`` may not be a final field. 
+When field ``f`` overrides field ``g`` the type of ``f`` must be a subtype of the type of ``g``. ``f`` may not be a final field.
 
 Select clauses
 ~~~~~~~~~~~~~~
@@ -993,8 +976,8 @@ There are several kinds of expressions:
         |   binop
         |   cast
         |   primary
-        
-   primary ::= eparen 
+
+   primary ::= eparen
            |   literal
            |   variable
            |   super_expr
@@ -1103,7 +1086,7 @@ A super expression has the following syntax:
 
 ::
 
-   super_expr ::= "super" | type "." "super" 
+   super_expr ::= "super" | type "." "super"
 
 For a super expression to be valid, the ``this`` keyword must have a type and value in the typing environment. The type of the expression is the same as the type of ``this`` in the typing environment.
 
@@ -1163,11 +1146,11 @@ A valid call with results *resolves* to a set of predicates. The ways a call can
 -  If the call has no receiver and the predicate name is a selection identifier, then the qualifier is resolved as a module (see "`Module resolution <#module-resolution>`__"). The identifier is then resolved in the exported predicate environment of the qualifier module.
 
 -  If the call has a super expression as the receiver, then it resolves to a member predicate in a class that the enclosing class inherits from:
-    -  If the super expression is unqualified and there is a single class that the current class inherits from, then the super-class is that class. 
+    -  If the super expression is unqualified and there is a single class that the current class inherits from, then the super-class is that class.
     -  If the super expression is unqualified and there are multiple classes that the current class inherits from, then the super-class is the domain type.
-    -  Otherwise, the super-class is the class named by the qualifier of the super expression. 
+    -  Otherwise, the super-class is the class named by the qualifier of the super expression.
 
-   The predicate is resolved by looking up its name and arity in the exported predicate environment of the super-class. 
+   The predicate is resolved by looking up its name and arity in the exported predicate environment of the super-class.
 
 -  If the type of the receiver is the same as the enclosing class, the predicate is resolved by looking up its name and arity in the visible predicate environment of the class.
 
@@ -1226,15 +1209,15 @@ The rank expression must be present if the aggregate id is ``rank``; otherwise i
 Apart from the presence or absence of the rank variable, all other reduced forms of an aggregation are equivalent to a full form using the following steps:
 
 -  If the formula is omitted, then it is taken to be ``any()``.
--  If there are no aggregation expressions, then either: 
+-  If there are no aggregation expressions, then either:
 
-   - The aggregation id is ``count`` or ``strictcount`` and the expression is taken to be ``1``. 
+   - The aggregation id is ``count`` or ``strictcount`` and the expression is taken to be ``1``.
    - There must be precisely one variable declaration, and the aggregation expression is taken to be a reference to that variable.
 
 -  If the aggregation id is ``concat`` or ``strictconcat`` and it has a single expression then the second expression is taken to be ``""``.
--  If the ``monotonicAggregates`` language pragma is not enabled, or the original formula and variable declarations are both omitted, then the aggregate is transformed as follows: 
+-  If the ``monotonicAggregates`` language pragma is not enabled, or the original formula and variable declarations are both omitted, then the aggregate is transformed as follows:
 
-   - For each aggregation expression ``expr_i``, a fresh variable ``v_i`` is declared with the same type as the expression in addition to the original variable declarations. 
+   - For each aggregation expression ``expr_i``, a fresh variable ``v_i`` is declared with the same type as the expression in addition to the original variable declarations.
    - The new range is the conjunction of the original range and a term ``v_i = expr_i`` for each aggregation expression ``expr_i``.
    - Each original aggregation expression ``expr_i`` is replaced by a new aggregation expression ``v_i``.
 
@@ -1320,11 +1303,11 @@ Expression pragmas can be used to guide optimization.
 The values of an expression pragma are the values of the contained expression.
 
 The type `only_bind_out` hints that uses of the result of the expression pragma should not be used to guide the evaluation of the result of the contained expression.
-When checking to see that all values are bound the compiler does not assume that if the result of the expression pragma is bound then the result of the contained 
+When checking to see that all values are bound the compiler does not assume that if the result of the expression pragma is bound then the result of the contained
 expression is bound.
 
 The type `only_bind_into` hints that uses of the contained expression should not be used to guide the evaluation of the result of the expression pragma.
-When checking to see that all values are bound the compiler does not assume that if the result of the contained expression is bound then the result of the 
+When checking to see that all values are bound the compiler does not assume that if the result of the contained expression is bound then the result of the
 expression pragma is bound.
 
 Ranges
@@ -1498,7 +1481,7 @@ A comparison formula is two expressions separated by a comparison operator:
 ::
 
    comparison ::= expr compop expr
-   compop ::= "=" | "!=" | "<" | ">" | "<=" | ">="      
+   compop ::= "=" | "!=" | "<" | ">" | "<=" | ">="
 
 A comparison formula matches if there is one value of the left expression that is in the given ordering with one of the values of the right expression. The ordering used is specified in "`Ordering <#ordering>`__." If one of the values is an integer and the other is a float value, then the integer is converted to a float value before the comparison.
 
@@ -1582,7 +1565,7 @@ Aliases define new names for existing QL entities.
    alias ::= qldoc? annotations "predicate" literalId "=" predicateRef "/" int ";"
          |   qldoc? annotations "class" classname "=" type ";"
          |   qldoc? annotations "module" modulename "=" moduleId ";"
-       
+
 
 An alias introduces a binding from the new name to the entity referred to by the right-hand side in the current module's declared predicate, type, or module environment respectively.
 
@@ -1973,13 +1956,13 @@ Each layer of the stratification is *populated* in order. To populate a layer, e
 -  To populate a predicate that has a formula as a body, find each named tuple ``t`` that has the following properties:
 
      - The tuple matches the body formula.
-     - The variables should be the predicate's arguments.  
+     - The variables should be the predicate's arguments.
      - If the predicate has a result, then the tuples should additionally have a value for ``result``.
      - If the predicate is a member predicate or characteristic predicate of a class ``C`` then the tuples should additionally have a value for ``this`` and each visible field on the class.
      - The values corresponding to the arguments should all be a member of the declared types of the arguments.
      - The values corresponding to ``result`` should all be a member of the result type.
      - The values corresponding to the fields should all be a member of the declared types of the fields.
-     - If the predicate is a member predicate of a class ``C`` and not a characteristic predicate, then the tuples should additionally extend some tuple in ``C.class``. 
+     - If the predicate is a member predicate of a class ``C`` and not a characteristic predicate, then the tuples should additionally extend some tuple in ``C.class``.
      - If the predicate is a characteristic predicate of a class ``C``, then there should be a tuple ``t'`` in ``C.extends`` such that for each visible field in ``C``, any field that is equal to or overrides a field in ``t'`` should have the same value in ``t``. ``this`` should also map to the same value in ``t`` and ``t'``.
 
    For each such tuple remove any components that correspond to fields and add it to the predicate in the store.
@@ -1998,7 +1981,7 @@ Each layer of the stratification is *populated* in order. To populate a layer, e
 
 -  To populate the type ``C.C`` for a class ``C``, if ``C`` has a characteristic predicate, then add all tuples from that predicate to the store. Otherwise add all tuples ``t`` such that:
 
-     - The variables of ``t`` should be ``this`` and the visible fields of ``C``.  
+     - The variables of ``t`` should be ``this`` and the visible fields of ``C``.
      - The values corresponding to the fields should all be a member of the declared types of the fields.
      - If the predicate is a characteristic predicate of a class ``C``, then there should be a tuple ``t'`` in ``C.extends`` such that for each visible field in ``C``, any field that is equal to or overrides a field in ``t'`` should have the same value in ``t``. ``this`` should also map to the same value in ``t`` and ``t'``.
 
@@ -2033,7 +2016,7 @@ The complete grammar for QL is as follows:
 
    import ::= annotations "import" importModuleId ("as" modulename)?
 
-   qualId ::= simpleId | qualId "." simpleId 
+   qualId ::= simpleId | qualId "." simpleId
 
    importModuleId ::= qualId
                   | importModuleId "::" simpleId
@@ -2072,18 +2055,18 @@ The complete grammar for QL is as follows:
    head ::= ("predicate" | type) predicateName "(" var_decls ")"
 
    optbody ::= ";"
-           |  "{" formula "}" 
+           |  "{" formula "}"
            |  "=" literalId "(" (predicateRef "/" int ("," predicateRef "/" int)*)? ")" "(" (exprs)? ")"
 
    class ::= qldoc? annotations "class" classname "extends" type ("," type)* "{" member* "}"
 
    member ::= character | predicate | field
 
-   character ::= qldoc? annotations classname "(" ")" "{" formula "}" 
+   character ::= qldoc? annotations classname "(" ")" "{" formula "}"
 
    field ::= qldoc? annotations var_decl ";"
 
-   moduleId ::= simpleId | moduleId "::" simpleId 
+   moduleId ::= simpleId | moduleId "::" simpleId
 
    type ::= (moduleId "::")? classname | dbasetype | "boolean" | "date" | "float" | "int" | "string"
 
@@ -2092,7 +2075,7 @@ The complete grammar for QL is as follows:
    alias ::= qldoc? annotations "predicate" literalId "=" predicateRef "/" int ";"
          |  qldoc? annotations "class" classname "=" type ";"
          |  qldoc? annotations "module" modulename "=" moduleId ";"
-         
+
    var_decls ::= (var_decl ("," var_decl)*)?
 
    var_decl ::= type lowerId
@@ -2108,7 +2091,7 @@ The complete grammar for QL is as follows:
            |   instanceof
            |   inrange
            |   call
-           
+
    fparen ::= "(" formula ")"
 
    disjunction ::= formula "or" formula
@@ -2128,7 +2111,7 @@ The complete grammar for QL is as follows:
 
    comparison ::= expr compop expr
 
-   compop ::= "=" | "!=" | "<" | ">" | "<=" | ">="      
+   compop ::= "=" | "!=" | "<" | ">" | "<=" | ">="
 
    instanceof ::= expr "instanceof" type
 
@@ -2146,7 +2129,7 @@ The complete grammar for QL is as follows:
         |   primary
 
 
-   primary ::= eparen 
+   primary ::= eparen
            |   literal
            |   variable
            |   super_expr
@@ -2175,7 +2158,7 @@ The complete grammar for QL is as follows:
 
    variable ::= varname | "this" | "result"
 
-   super_expr ::= "super" | type "." "super" 
+   super_expr ::= "super" | type "." "super"
 
    cast ::= "(" type ")" expr
 
@@ -2184,7 +2167,7 @@ The complete grammar for QL is as follows:
    aggregation ::= aggid ("[" expr "]")? "(" var_decls ("|" (formula)? ("|" as_exprs ("order" "by" aggorderbys)?)?)? ")"
                |   aggid ("[" expr "]")? "(" as_exprs ("order" "by" aggorderbys)? ")"
                |   "unique" "(" var_decls "|" (formula)? ("|" as_exprs)? ")"
- 
+
    expression_pragma ::= "pragma" "[" expression_pragma_type "]" "(" expr ")"
 
    expression_pragma_type ::= "only_bind_out" | "only_bind_into"
@@ -2199,9 +2182,9 @@ The complete grammar for QL is as follows:
 
    callwithresults ::= predicateRef (closure)? "(" (exprs)? ")"
                    |   primary "." predicateName (closure)? "(" (exprs)? ")"
-                   
+
    range ::= "[" expr ".." expr "]"
-   
+
    setliteral ::= "[" expr ("," expr)* ","? "]"
 
    simpleId ::= lowerId | upperId
diff --git a/docs/codeql/ql-language-reference/signatures.rst b/docs/codeql/ql-language-reference/signatures.rst
new file mode 100644
index 00000000000..f7f08eaf3d6
--- /dev/null
+++ b/docs/codeql/ql-language-reference/signatures.rst
@@ -0,0 +1,120 @@
+:tocdepth: 1
+
+.. index:: signature
+
+.. _signatures:
+
+Signatures
+##########
+
+Parameterized modules use signatures as a type system for their parameters.
+There are three categories of signatures: **predicate signatures**, **type signatures**, and **module signatures**.
+
+Predicate signatures
+====================
+
+Predicate signatures declare module parameters that will be substituted with predicates when the module is instantiated.
+
+The substitution of predicate signatures relies on structural typing. That is, predicates do not have to be explicitly
+defined as implementing a predicate signature - they just have to match the return and argument types.
+
+Predicate signatures are defined much like predicates themselves, but they do not have a body.
+In detail, a predicate signature definition consists of:
+
+#. The keyword ``signature``.
+#. The keyword ``predicate`` (allows subsitution with a :ref:`predicate without result <predicates-without-result>`),
+   or the type of the result (allows subsitution with a :ref:`predicate with result <predicates-with-result>`).
+#. The name of the predicate signature. This is an `identifier <https://codeql.github.com/docs/ql-language-reference/ql-language-specification/#identifiers>`_
+   starting with a lowercase letter.
+#. The arguments to the predicate signature, if any, separated by commas.
+   For each argument, specify the argument type and an identifier for the argument variable.
+#. A semicolon ``;``.
+
+For example:
+
+.. code-block:: ql
+
+    signature int operator(int lhs, int rhs);
+
+Type signatures
+===============
+
+Type signatures declare module parameters that will be substituted with types when the module is instantiated.
+Type signatures are used to specify supertypes and are the simplest category of signatures.
+
+The substitution of type signatures relies on structural typing. That is, types do not have to be explicitly defined as
+implementing a type signature - they just need to have the specified (transitive) supertypes.
+
+In detail, a type signature definition consists of:
+
+#. The keyword ``signature``.
+#. The keyword ``class``.
+#. The name of the type signature. This is an `identifier <https://codeql.github.com/docs/ql-language-reference/ql-language-specification/#identifiers>`_
+   starting with a uppercase letter.
+#. Optionally, the keyword ``extends`` followed by a list of types, separated by commas.
+#. A semicolon ``;``.
+
+For example:
+
+.. code-block:: ql
+
+    signature class ExtendsInt extends int;
+
+Module signatures
+=================
+
+Module signatures declare module parameters that will be substituted with modules when the module is instantiated.
+Module signatures specify a collection of types and predicates that a module needs to contain under given names and
+matching given signatures.
+
+Unlike type signatures and predicate signatures, the substitution of type signatures relies on nominal typing.
+That is, the definition of a module must declare the module signatures it implements.
+
+In detail, a type signature definition consists of:
+
+#. The keyword ``signature``.
+#. The keyword ``module``.
+#. The name of the module signature. This is an `identifier <https://codeql.github.com/docs/ql-language-reference/ql-language-specification/#identifiers>`_
+   starting with a uppercase letter.
+#. Optionally, a list of parameters for :ref:`parameterized module signatures <parameterized-module-signatures>`.
+#. The module signature body, consisting of type signatures and predicate signatures enclosed in braces.
+   The ``signature`` keyword is omitted for these contained signatures.
+
+For example:
+
+.. code-block:: ql
+
+    signature module MSig {
+      class T;
+      predicate restriction(T t);
+    }
+
+    module Module implements MSig {
+      newtype T = A() or B();
+
+      predicate restriction(T t) { t = A() }
+    }
+
+.. _parameterized-module-signatures:
+
+Parameterized module signatures
+-------------------------------
+
+Module signatures can themselves be parameterized in exactly the same way as parameterized modules.
+This is particularly useful in combination with the dependent typing of module parameters.
+
+For example:
+
+.. code-block:: ql
+
+    signature class NodeSig;
+
+    signature module EdgeSig<NodeSig Node> {
+      predicate apply(Node src, Node dst);
+    }
+
+    module Reachability<NodeSig Node, EdgeSig<Node> Edge> {
+      Node reachableFrom(Node src) {
+        Edge::apply+(src, result)
+      }
+    }
diff --git a/docs/codeql/reusables/download-github-database.rst b/docs/codeql/reusables/download-github-database.rst
index 732d4479ba7..56e15078740 100644
--- a/docs/codeql/reusables/download-github-database.rst
+++ b/docs/codeql/reusables/download-github-database.rst
@@ -7,8 +7,8 @@ For example, to check for CodeQL databases using the `GitHub CLI <https://cli.gi
 
 This command returns information about any CodeQL databases that are available for a repository, including the language the database represents, and when the database was last updated. If no CodeQL databases are available, the response is empty.
 
-When you have confirmed that a CodeQL database exists for the language you are interested in, you can download it using the following command:: 
+When you have confirmed that a CodeQL database exists for the language you are interested in, you can download it using the following command::
 
    gh api /repos/<owner>/<repo>/code-scanning/codeql/databases/<language> -H 'Accept: application/zip' > path/to/local/database.zip
 
-For more information, see the documentation for the `Get CodeQL database <https://docs.github.com/en/rest/reference/code-scanning#get-codeql-database>`__ endpoint in the GitHub REST API documentation.
\ No newline at end of file
+For more information, see the documentation for the `Get CodeQL database <https://docs.github.com/en/rest/code-scanning#get-a-codeql-database-for-a-repository>`__ endpoint in the GitHub REST API documentation.
diff --git a/docs/codeql/support/reusables/versions-compilers.rst b/docs/codeql/support/reusables/versions-compilers.rst
index c734cf65ff3..21a0526af5f 100644
--- a/docs/codeql/support/reusables/versions-compilers.rst
+++ b/docs/codeql/support/reusables/versions-compilers.rst
@@ -23,7 +23,7 @@
    JavaScript,ECMAScript 2022 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhtm``, ``.xhtml``, ``.vue``, ``.hbs``, ``.ejs``, ``.njk``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [6]_"
    Python,"2.7, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10",Not applicable,``.py``
    Ruby [7]_,"up to 3.0.2",Not applicable,"``.rb``, ``.erb``, ``.gemspec``, ``Gemfile``"
-   TypeScript [8]_,"2.6-4.7",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
+   TypeScript [8]_,"2.6-4.8",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
 
 .. container:: footnote-group
 
diff --git a/docs/ql-design-patterns.md b/docs/ql-design-patterns.md
index 6984088e925..b6d7eab88fc 100644
--- a/docs/ql-design-patterns.md
+++ b/docs/ql-design-patterns.md
@@ -31,13 +31,9 @@ Applying the `::Range` pattern yields the following:
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `MySpecialExpr::Range` instead.
  */
-class MySpecialExpr extends Expr {
-  MySpecialExpr::Range range;
-
-  MySpecialExpr() { this = range }
-
+class MySpecialExpr extends Expr instanceof MySpecialExpr::Range {
   /** <QLDoc...> */
-  int memberPredicate() { result = range.memberPredicate() }
+  int memberPredicate() { result = super.memberPredicate() }
 }
 
 /** Provides a class for modeling new <...> APIs. */
@@ -56,22 +52,18 @@ module MySpecialExpr {
 ```
 Now, a concrete subclass can derive from `MySpecialExpr::Range` if it wants to extend the set of values in `MySpecialExpr`, and it will be required to implement the abstract `memberPredicate()`. Conversely, if it wants to refine `MySpecialExpr` and override `memberPredicate` for all extensions, it can do so by deriving from `MySpecialExpr` directly.
 
-The key element of the pattern is to provide a field of type `MySpecialExpr::Range`, equating it to `this` in the characteristic predicate of `MySpecialExpr`. In member predicates, we can use either `this` or `range`, depending on which type has the API we need.
-
 </details>
 
-Note that in some libraries, the `range` field is in fact called `self`. While we do recommend using `range` for consistency, the name of the field does not matter (and using `range` avoids confusion in contexts like Python analysis that has strong usage of `self`).
-
 ### Rationale
 
-Let's use an example from the Go libraries: https://github.com/github/codeql-go/blob/2ba9bbfd8ba1818b5ee9f6009c86a605189c9ef3/ql/src/semmle/go/Concepts.qll#L119-L157
+Let's use an example from the Python libraries: https://github.com/github/codeql/blob/46751e515c40c6b4c9b61758cc840eec1894a624/python/ql/lib/semmle/python/Concepts.qll#L601-L683
 
-`EscapeFunction`, as the name suggests, models various APIs that escape meta-characters. It has a member-predicate `kind()` that tells you what sort of escaping the modelled function does. For example, if the result of that predicate is `"js"`, then this means that the escaping function is meant to make things safe to embed inside JavaScript.
-`EscapeFunction::Range` is subclassed to model various APIs, and `kind()` is implemented accordingly.
-But we can also subclass `EscapeFunction` to, as in the above example, talk about all JS-escaping functions.
+`Escaping`, as the name suggests, models various APIs that escape meta-characters. It has a member-predicate `getKind()` that tells you what sort of escaping the modeled function does. For example, if the result of that predicate is `"html"`, then this means that the escaping function is meant to make things safe to embed inside HTML.
+`Escaping::Range` is subclassed to model various APIs, and `kind()` is implemented accordingly (this typically happens in library models).
+But we can also subclass `Escaping`, as in the above example, where `HtmlEscaping` represents all HTML-escaping functions.
 
 You can, of course, do the same without the `::Range` pattern, but it's a little cumbersome:
-If you only had an `abstract class EscapeFunction { ... }`, then `JsEscapeFunction` would need to be implemented in a slightly tricky way to prevent it from extending `EscapeFunction` (instead of refining it). You would have to give it a charpred `this instanceof EscapeFunction`, which looks useless but isn't. And additionally, you'd have to provide trivial `none()` overrides of all the abstract predicates defined in `EscapeFunction`. This is all pretty awkward, and we can avoid it by distinguishing between `EscapeFunction` and `EscapeFunction::Range`.
+If you only had an `abstract class Escaping { ... }`, then `HtmlEscaping` would need to be implemented in a slightly tricky way to prevent it from extending `Escaping` (instead of refining it). You would have to give it a charpred `this instanceof Escaping`, which looks useless but isn't. And additionally, you'd have to provide trivial `none()` overrides of all the abstract predicates defined in `Escaping`. This is all pretty awkward, and we can avoid it by distinguishing between `Escaping` and `Escaping::Range`.
 
 
 ## Importing all subclasses of a class
diff --git a/docs/query-metadata-style-guide.md b/docs/query-metadata-style-guide.md
index 5660a08f72e..9b4b291a75a 100644
--- a/docs/query-metadata-style-guide.md
+++ b/docs/query-metadata-style-guide.md
@@ -179,7 +179,15 @@ The select clause of each alert query defines the alert message that is displaye
 * The message should factually describe the problem that is being highlighted–it should not contain recommendations about how to fix the problem or value judgements.
 * Program element references should be in 'single quotes' to distinguish them from ordinary words. Quotes are not needed around substitutions (`$@`).
 * Avoid constant alert message strings and include some context, if possible. For example, `The class 'Foo' is duplicated as 'Bar'.` is preferable to `This class is duplicated here.`
+* If a reference to the current location can't be avoided use "this location" instead of "here". For example, `Bad thing at this location.` is preferable to `Bad thing here.`. This avoids the "click here" anti-pattern.
+* For path queries, if possible, try to follow the template: `This path depends on a [user-provided value].`, or alternatively (if the first option doesn't work) `[User-provided value] flows to this location and is used in a path.`. 
+* Taint tracking queries generally have a sink that "depends on" the source, and dataflow queries generally have a source that "flows to" the sink.
+
+### Links in alert messages
+
 * Where you reference another program element, link to it if possible using a substitution (`$@`). Links should be used inline in the sentence, rather than as parenthesised lists or appositions.
+* Avoid using link texts that don't describe what they link to. For example, rewrite `This sensitive data is written to a logfile unescaped [here]` to `This sensitive data is [written to a logfile unescaped]`. 
+* Make link text as concise and precise as possible. For example, avoid starting a link text with an indefinite article (a, an). `Path construction depends on a [user-provided value]` is preferable to `Path construction depends on [a user-provided value]`. (Where the square brackets indicate a link.) See [the W3C guide on link texts](https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-in-context.html) for further information. 
 * When a message contains multiple links, construct a sentence that has the most variable link (that is, the link with most targets) last. For further information, see [Defining the results of a query](https://codeql.github.com/docs/writing-codeql-queries/defining-the-results-of-a-query/).
 
 For examples of select clauses and alert messages, see the query source files at the following pages:
diff --git a/go/Makefile b/go/Makefile
index b7da089c48a..419b1991775 100644
--- a/go/Makefile
+++ b/go/Makefile
@@ -14,7 +14,7 @@ CODEQL_PLATFORM = osx64
 endif
 endif
 
-CODEQL_TOOLS = $(addprefix codeql-tools/,autobuild.cmd autobuild.sh pre-finalize.cmd pre-finalize.sh index.cmd index.sh linux64 osx64 win64 tracing-config.lua)
+CODEQL_TOOLS = $(addprefix codeql-tools/,autobuild.cmd autobuild.sh pre-finalize.cmd pre-finalize.sh index.cmd index.sh tracing-config.lua)
 
 EXTRACTOR_PACK_OUT = build/codeql-extractor-go
 
diff --git a/go/codeql-tools/linux64/compiler-tracing.spec b/go/codeql-tools/linux64/compiler-tracing.spec
deleted file mode 100644
index 2055555c21a..00000000000
--- a/go/codeql-tools/linux64/compiler-tracing.spec
+++ /dev/null
@@ -1,7 +0,0 @@
-**/go-autobuilder:
-  order compiler
-  trace no
-**/go:
-  invoke ${config_dir}/go-extractor
-  prepend --mimic
-  prepend "${compiler}"
diff --git a/go/codeql-tools/osx64/compiler-tracing.spec b/go/codeql-tools/osx64/compiler-tracing.spec
deleted file mode 100644
index 2055555c21a..00000000000
--- a/go/codeql-tools/osx64/compiler-tracing.spec
+++ /dev/null
@@ -1,7 +0,0 @@
-**/go-autobuilder:
-  order compiler
-  trace no
-**/go:
-  invoke ${config_dir}/go-extractor
-  prepend --mimic
-  prepend "${compiler}"
diff --git a/go/codeql-tools/win64/compiler-tracing.spec b/go/codeql-tools/win64/compiler-tracing.spec
deleted file mode 100644
index 76a6b011405..00000000000
--- a/go/codeql-tools/win64/compiler-tracing.spec
+++ /dev/null
@@ -1,7 +0,0 @@
-**/go-autobuilder.exe:
-  order compiler
-  trace no
-**/go.exe:
-  invoke ${config_dir}/go-extractor.exe
-  prepend --mimic
-  prepend "${compiler}"
diff --git a/go/ql/lib/change-notes/2022-09-12-uppercase.md b/go/ql/lib/change-notes/2022-09-12-uppercase.md
new file mode 100644
index 00000000000..996861f1c2c
--- /dev/null
+++ b/go/ql/lib/change-notes/2022-09-12-uppercase.md
@@ -0,0 +1,5 @@
+---
+category: deprecated
+---
+* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
+  The old name still exists as a deprecated alias.
\ No newline at end of file
diff --git a/go/ql/lib/semmle/go/Concepts.qll b/go/ql/lib/semmle/go/Concepts.qll
index f3920c2ec5c..c6043ae46b3 100644
--- a/go/ql/lib/semmle/go/Concepts.qll
+++ b/go/ql/lib/semmle/go/Concepts.qll
@@ -16,16 +16,12 @@ import semmle.go.concepts.GeneratedFile
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `SystemCommandExecution::Range` instead.
  */
-class SystemCommandExecution extends DataFlow::Node {
-  SystemCommandExecution::Range self;
-
-  SystemCommandExecution() { this = self }
-
+class SystemCommandExecution extends DataFlow::Node instanceof SystemCommandExecution::Range {
   /** Gets the argument that specifies the command to be executed. */
-  DataFlow::Node getCommandName() { result = self.getCommandName() }
+  DataFlow::Node getCommandName() { result = super.getCommandName() }
 
   /** Holds if this node is sanitized whenever it follows `--` in an argument list. */
-  predicate doubleDashIsSanitizing() { self.doubleDashIsSanitizing() }
+  predicate doubleDashIsSanitizing() { super.doubleDashIsSanitizing() }
 }
 
 /** Provides a class for modeling new system-command execution APIs. */
@@ -52,22 +48,18 @@ module SystemCommandExecution {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `TemplateInstantiation::Range` instead.
  */
-class TemplateInstantiation extends DataFlow::Node {
-  TemplateInstantiation::Range self;
-
-  TemplateInstantiation() { this = self }
-
+class TemplateInstantiation extends DataFlow::Node instanceof TemplateInstantiation::Range {
   /**
    * Gets the argument to this template instantiation that is the template being
    * instantiated.
    */
-  DataFlow::Node getTemplateArgument() { result = self.getTemplateArgument() }
+  DataFlow::Node getTemplateArgument() { result = super.getTemplateArgument() }
 
   /**
    * Gets an argument to this template instantiation that is data being inserted
    * into the template.
    */
-  DataFlow::Node getADataArgument() { result = self.getADataArgument() }
+  DataFlow::Node getADataArgument() { result = super.getADataArgument() }
 }
 
 /** Provides a class for modeling new template-instantiation APIs. */
@@ -100,13 +92,9 @@ module TemplateInstantiation {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `FileSystemAccess::Range` instead.
  */
-class FileSystemAccess extends DataFlow::Node {
-  FileSystemAccess::Range self;
-
-  FileSystemAccess() { this = self }
-
+class FileSystemAccess extends DataFlow::Node instanceof FileSystemAccess::Range {
   /** Gets an argument to this file system access that is interpreted as a path. */
-  DataFlow::Node getAPathArgument() { result = self.getAPathArgument() }
+  DataFlow::Node getAPathArgument() { result = super.getAPathArgument() }
 }
 
 /** Provides a class for modeling new file-system access APIs. */
@@ -125,17 +113,13 @@ module FileSystemAccess {
 }
 
 /** A function that escapes meta-characters to prevent injection attacks. */
-class EscapeFunction extends Function {
-  EscapeFunction::Range self;
-
-  EscapeFunction() { this = self }
-
+class EscapeFunction extends Function instanceof EscapeFunction::Range {
   /**
    * The context that this function escapes for.
    *
    * Currently, this can be "js", "html", or "url".
    */
-  string kind() { result = self.kind() }
+  string kind() { result = super.kind() }
 }
 
 /** Provides a class for modeling new escape-function APIs. */
@@ -161,7 +145,7 @@ module EscapeFunction {
  * JavaScript string literal.
  */
 class JsEscapeFunction extends EscapeFunction {
-  JsEscapeFunction() { self.kind() = "js" }
+  JsEscapeFunction() { super.kind() = "js" }
 }
 
 /**
@@ -170,7 +154,7 @@ class JsEscapeFunction extends EscapeFunction {
  * `<p>{}</p>`.
  */
 class HtmlEscapeFunction extends EscapeFunction {
-  HtmlEscapeFunction() { self.kind() = "html" }
+  HtmlEscapeFunction() { super.kind() = "html" }
 }
 
 /**
@@ -178,7 +162,7 @@ class HtmlEscapeFunction extends EscapeFunction {
  * of a URL.
  */
 class UrlEscapeFunction extends EscapeFunction {
-  UrlEscapeFunction() { self.kind() = "url" }
+  UrlEscapeFunction() { super.kind() = "url" }
 }
 
 /**
@@ -187,27 +171,23 @@ class UrlEscapeFunction extends EscapeFunction {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `RegexpPattern::Range` instead.
  */
-class RegexpPattern extends DataFlow::Node {
-  RegexpPattern::Range self;
-
-  RegexpPattern() { this = self }
-
+class RegexpPattern extends DataFlow::Node instanceof RegexpPattern::Range {
   /**
    * Gets the node where this pattern is parsed as a part of a regular
    * expression.
    */
-  DataFlow::Node getAParse() { result = self.getAParse() }
+  DataFlow::Node getAParse() { result = super.getAParse() }
 
   /**
    * Gets this regexp pattern as a string.
    */
-  string getPattern() { result = self.getPattern() }
+  string getPattern() { result = super.getPattern() }
 
   /**
    * Gets a use of this pattern, either as itself in an argument to a function or as a compiled
    * regexp object.
    */
-  DataFlow::Node getAUse() { result = self.getAUse() }
+  DataFlow::Node getAUse() { result = super.getAUse() }
 }
 
 /** Provides a class for modeling new regular-expression APIs. */
@@ -244,15 +224,11 @@ module RegexpPattern {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `RegexpMatchFunction::Range` instead.
  */
-class RegexpMatchFunction extends Function {
-  RegexpMatchFunction::Range self;
-
-  RegexpMatchFunction() { this = self }
-
+class RegexpMatchFunction extends Function instanceof RegexpMatchFunction::Range {
   /**
    * Gets the function input that is the regexp being matched.
    */
-  FunctionInput getRegexpArg() { result = self.getRegexpArg() }
+  FunctionInput getRegexpArg() { result = super.getRegexpArg() }
 
   /**
    * Gets the regexp pattern that is used in the call to this function `call`.
@@ -264,12 +240,12 @@ class RegexpMatchFunction extends Function {
   /**
    * Gets the function input that is the string being matched against.
    */
-  FunctionInput getValue() { result = self.getValue() }
+  FunctionInput getValue() { result = super.getValue() }
 
   /**
    * Gets the function output that is the Boolean result of the match function.
    */
-  FunctionOutput getResult() { result = self.getResult() }
+  FunctionOutput getResult() { result = super.getResult() }
 }
 
 /** Provides a class for modeling new regular-expression matcher APIs. */
@@ -304,15 +280,11 @@ module RegexpMatchFunction {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `RegexpReplaceFunction::Range` instead.
  */
-class RegexpReplaceFunction extends Function {
-  RegexpReplaceFunction::Range self;
-
-  RegexpReplaceFunction() { this = self }
-
+class RegexpReplaceFunction extends Function instanceof RegexpReplaceFunction::Range {
   /**
    * Gets the function input that is the regexp that matches text to replace.
    */
-  FunctionInput getRegexpArg() { result = self.getRegexpArg() }
+  FunctionInput getRegexpArg() { result = super.getRegexpArg() }
 
   /**
    * Gets the regexp pattern that is used to match patterns to replace in the call to this function
@@ -326,13 +298,13 @@ class RegexpReplaceFunction extends Function {
    * Gets the function input corresponding to the source value, that is, the value that is having
    * its contents replaced.
    */
-  FunctionInput getSource() { result = self.getSource() }
+  FunctionInput getSource() { result = super.getSource() }
 
   /**
    * Gets the function output corresponding to the result, that is, the value after replacement has
    * occurred.
    */
-  FunctionOutput getResult() { result = self.getResult() }
+  FunctionOutput getResult() { result = super.getResult() }
 }
 
 /** Provides a class for modeling new regular-expression replacer APIs. */
@@ -369,13 +341,9 @@ module RegexpReplaceFunction {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `LoggerCall::Range` instead.
  */
-class LoggerCall extends DataFlow::Node {
-  LoggerCall::Range self;
-
-  LoggerCall() { this = self }
-
+class LoggerCall extends DataFlow::Node instanceof LoggerCall::Range {
   /** Gets a node that is a part of the logged message. */
-  DataFlow::Node getAMessageComponent() { result = self.getAMessageComponent() }
+  DataFlow::Node getAMessageComponent() { result = super.getAMessageComponent() }
 }
 
 /** Provides a class for modeling new logging APIs. */
@@ -398,19 +366,15 @@ module LoggerCall {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `MarshalingFunction::Range` instead.
  */
-class MarshalingFunction extends Function {
-  MarshalingFunction::Range self;
-
-  MarshalingFunction() { this = self }
-
+class MarshalingFunction extends Function instanceof MarshalingFunction::Range {
   /** Gets an input that is encoded by this function. */
-  FunctionInput getAnInput() { result = self.getAnInput() }
+  FunctionInput getAnInput() { result = super.getAnInput() }
 
   /** Gets the output that contains the encoded data produced by this function. */
-  FunctionOutput getOutput() { result = self.getOutput() }
+  FunctionOutput getOutput() { result = super.getOutput() }
 
   /** Gets an identifier for the format this function encodes into, such as "JSON". */
-  string getFormat() { result = self.getFormat() }
+  string getFormat() { result = super.getFormat() }
 }
 
 /** Provides a class for modeling new marshaling APIs. */
@@ -439,19 +403,15 @@ module MarshalingFunction {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `UnmarshalingFunction::Range` instead.
  */
-class UnmarshalingFunction extends Function {
-  UnmarshalingFunction::Range self;
-
-  UnmarshalingFunction() { this = self }
-
+class UnmarshalingFunction extends Function instanceof UnmarshalingFunction::Range {
   /** Gets an input that is decoded by this function. */
-  FunctionInput getAnInput() { result = self.getAnInput() }
+  FunctionInput getAnInput() { result = super.getAnInput() }
 
   /** Gets the output that contains the decoded data produced by this function. */
-  FunctionOutput getOutput() { result = self.getOutput() }
+  FunctionOutput getOutput() { result = super.getOutput() }
 
   /** Gets an identifier for the format this function decodes from, such as "JSON". */
-  string getFormat() { result = self.getFormat() }
+  string getFormat() { result = super.getFormat() }
 }
 
 /** Provides a class for modeling new unmarshaling APIs. */
diff --git a/go/ql/lib/semmle/go/StringOps.qll b/go/ql/lib/semmle/go/StringOps.qll
index 70f83328c05..d88aea71e23 100644
--- a/go/ql/lib/semmle/go/StringOps.qll
+++ b/go/ql/lib/semmle/go/StringOps.qll
@@ -12,20 +12,16 @@ module StringOps {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `StringOps::HasPrefix::Range` instead.
    */
-  class HasPrefix extends DataFlow::Node {
-    HasPrefix::Range range;
-
-    HasPrefix() { range = this }
-
+  class HasPrefix extends DataFlow::Node instanceof HasPrefix::Range {
     /**
      * Gets the `A` in `strings.HasPrefix(A, B)`.
      */
-    DataFlow::Node getBaseString() { result = range.getBaseString() }
+    DataFlow::Node getBaseString() { result = super.getBaseString() }
 
     /**
      * Gets the `B` in `strings.HasPrefix(A, B)`.
      */
-    DataFlow::Node getSubstring() { result = range.getSubstring() }
+    DataFlow::Node getSubstring() { result = super.getSubstring() }
 
     /**
      * Gets the polarity of the check.
@@ -33,7 +29,7 @@ module StringOps {
      * If the polarity is `false` the check returns `true` if the string does not start
      * with the given substring.
      */
-    boolean getPolarity() { result = range.getPolarity() }
+    boolean getPolarity() { result = super.getPolarity() }
   }
 
   class StartsWith = HasPrefix;
@@ -241,25 +237,21 @@ module StringOps {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `StringOps::Concatenation::Range` instead.
    */
-  class Concatenation extends DataFlow::Node {
-    Concatenation::Range self;
-
-    Concatenation() { this = self }
-
+  class Concatenation extends DataFlow::Node instanceof Concatenation::Range {
     /**
      * Gets the `n`th operand of this string concatenation, if there is a data-flow node for it.
      */
-    DataFlow::Node getOperand(int n) { result = self.getOperand(n) }
+    DataFlow::Node getOperand(int n) { result = super.getOperand(n) }
 
     /**
      * Gets the string value of the `n`th operand of this string concatenation, if it is a constant.
      */
-    string getOperandStringValue(int n) { result = self.getOperandStringValue(n) }
+    string getOperandStringValue(int n) { result = super.getOperandStringValue(n) }
 
     /**
      * Gets the number of operands of this string concatenation.
      */
-    int getNumOperand() { result = self.getNumOperand() }
+    int getNumOperand() { result = super.getNumOperand() }
   }
 
   /** Provides predicates and classes for working with string concatenations. */
diff --git a/go/ql/lib/semmle/go/Util.qll b/go/ql/lib/semmle/go/Util.qll
index ff597cdcc28..8c089054d90 100644
--- a/go/ql/lib/semmle/go/Util.qll
+++ b/go/ql/lib/semmle/go/Util.qll
@@ -12,7 +12,10 @@ class Boolean extends boolean {
 /**
  * Gets a regexp pattern that matches common top-level domain names.
  */
-string commonTLD() {
+string commonTld() {
   // according to ranking by http://google.com/search?q=site:.<<TLD>>
   result = "(?:com|org|edu|gov|uk|net|io)(?![a-z0-9])"
 }
+
+/** DEPRECATED: Alias for commonTld */
+deprecated string commonTLD() { result = commonTld() }
diff --git a/go/ql/lib/semmle/go/concepts/GeneratedFile.qll b/go/ql/lib/semmle/go/concepts/GeneratedFile.qll
index dec6872120c..d1067b60ad0 100644
--- a/go/ql/lib/semmle/go/concepts/GeneratedFile.qll
+++ b/go/ql/lib/semmle/go/concepts/GeneratedFile.qll
@@ -43,8 +43,4 @@ module GeneratedFile {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `GeneratedFile::Range` instead.
  */
-class GeneratedFile extends File {
-  GeneratedFile::Range self;
-
-  GeneratedFile() { this = self }
-}
+class GeneratedFile extends File instanceof GeneratedFile::Range { }
diff --git a/go/ql/lib/semmle/go/concepts/HTTP.qll b/go/ql/lib/semmle/go/concepts/HTTP.qll
index 89a716d4f1a..770f577b1ff 100644
--- a/go/ql/lib/semmle/go/concepts/HTTP.qll
+++ b/go/ql/lib/semmle/go/concepts/HTTP.qll
@@ -5,7 +5,7 @@
 import go
 
 /** Provides classes for modeling HTTP-related APIs. */
-module HTTP {
+module Http {
   /** Provides a class for modeling new HTTP response-writer APIs. */
   module ResponseWriter {
     /**
@@ -31,11 +31,7 @@ module HTTP {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `HTTP::ResponseWriter::Range` instead.
    */
-  class ResponseWriter extends Variable {
-    ResponseWriter::Range self;
-
-    ResponseWriter() { this = self }
-
+  class ResponseWriter extends Variable instanceof ResponseWriter::Range {
     /** Gets the body that is written in this HTTP response. */
     ResponseBody getBody() { result.getResponseWriter() = this }
 
@@ -47,8 +43,8 @@ module HTTP {
 
     /** Gets a data-flow node that is a use of this response writer. */
     DataFlow::Node getANode() {
-      result = self.getANode() or
-      result.(DataFlow::PostUpdateNode).getPreUpdateNode() = self.getANode()
+      result = super.getANode() or
+      result.(DataFlow::PostUpdateNode).getPreUpdateNode() = super.getANode()
     }
   }
 
@@ -100,19 +96,15 @@ module HTTP {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `HTTP::HeaderWrite::Range` instead.
    */
-  class HeaderWrite extends DataFlow::ExprNode {
-    HeaderWrite::Range self;
-
-    HeaderWrite() { this = self }
-
+  class HeaderWrite extends DataFlow::ExprNode instanceof HeaderWrite::Range {
     /** Gets the (lower-case) name of a header set by this definition. */
-    string getHeaderName() { result = self.getHeaderName() }
+    string getHeaderName() { result = super.getHeaderName() }
 
     /** Gets the value of the header set by this definition. */
-    string getHeaderValue() { result = self.getHeaderValue() }
+    string getHeaderValue() { result = super.getHeaderValue() }
 
     /** Holds if this header write defines the header `header`. */
-    predicate definesHeader(string header, string value) { self.definesHeader(header, value) }
+    predicate definesHeader(string header, string value) { super.definesHeader(header, value) }
 
     /**
      * Gets the node representing the name of the header defined by this write.
@@ -121,13 +113,13 @@ module HTTP {
      * sets the `Content-Type` header) may not have such a node, so callers should use
      * `getHeaderName` in preference to this method).
      */
-    DataFlow::Node getName() { result = self.getName() }
+    DataFlow::Node getName() { result = super.getName() }
 
     /** Gets the node representing the value of the header defined by this write. */
-    DataFlow::Node getValue() { result = self.getValue() }
+    DataFlow::Node getValue() { result = super.getValue() }
 
     /** Gets the response writer associated with this header write, if any. */
-    ResponseWriter getResponseWriter() { result = self.getResponseWriter() }
+    ResponseWriter getResponseWriter() { result = super.getResponseWriter() }
   }
 
   /** A data-flow node whose value is written to an HTTP header. */
@@ -171,11 +163,7 @@ module HTTP {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `HTTP::RequestBody::Range` instead.
    */
-  class RequestBody extends DataFlow::Node {
-    RequestBody::Range self;
-
-    RequestBody() { this = self }
-  }
+  class RequestBody extends DataFlow::Node instanceof RequestBody::Range { }
 
   /** Provides a class for modeling new HTTP response-body APIs. */
   module ResponseBody {
@@ -191,7 +179,7 @@ module HTTP {
 
       /** Gets a content-type associated with this body. */
       string getAContentType() {
-        exists(HTTP::HeaderWrite hw | hw = this.getResponseWriter().getAHeaderWrite() |
+        exists(Http::HeaderWrite hw | hw = this.getResponseWriter().getAHeaderWrite() |
           hw.getHeaderName() = "content-type" and
           result = hw.getHeaderValue()
         )
@@ -201,7 +189,7 @@ module HTTP {
 
       /** Gets a dataflow node for a content-type associated with this body. */
       DataFlow::Node getAContentTypeNode() {
-        exists(HTTP::HeaderWrite hw | hw = this.getResponseWriter().getAHeaderWrite() |
+        exists(Http::HeaderWrite hw | hw = this.getResponseWriter().getAHeaderWrite() |
           hw.getHeaderName() = "content-type" and
           result = hw.getValue()
         )
@@ -215,19 +203,15 @@ module HTTP {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `HTTP::ResponseBody::Range` instead.
    */
-  class ResponseBody extends DataFlow::Node {
-    ResponseBody::Range self;
-
-    ResponseBody() { this = self }
-
+  class ResponseBody extends DataFlow::Node instanceof ResponseBody::Range {
     /** Gets the response writer associated with this header write, if any. */
-    ResponseWriter getResponseWriter() { result = self.getResponseWriter() }
+    ResponseWriter getResponseWriter() { result = super.getResponseWriter() }
 
     /** Gets a content-type associated with this body. */
-    string getAContentType() { result = self.getAContentType() }
+    string getAContentType() { result = super.getAContentType() }
 
     /** Gets a dataflow node for a content-type associated with this body. */
-    DataFlow::Node getAContentTypeNode() { result = self.getAContentTypeNode() }
+    DataFlow::Node getAContentTypeNode() { result = super.getAContentTypeNode() }
   }
 
   /** Provides a class for modeling new HTTP template response-body APIs. */
@@ -250,13 +234,9 @@ module HTTP {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `HTTP::TemplateResponseBody::Range` instead.
    */
-  class TemplateResponseBody extends ResponseBody {
-    override TemplateResponseBody::Range self;
-
-    TemplateResponseBody() { this = self }
-
+  class TemplateResponseBody extends ResponseBody instanceof TemplateResponseBody::Range {
     /** Gets the read of the variable inside the template where this value is read. */
-    HtmlTemplate::TemplateRead getRead() { result = self.getRead() }
+    HtmlTemplate::TemplateRead getRead() { result = super.getRead() }
   }
 
   /** Provides a class for modeling new HTTP client request APIs. */
@@ -285,15 +265,11 @@ module HTTP {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `HTTP::ClientRequest::Range` instead.
    */
-  class ClientRequest extends DataFlow::Node {
-    ClientRequest::Range self;
-
-    ClientRequest() { this = self }
-
+  class ClientRequest extends DataFlow::Node instanceof ClientRequest::Range {
     /**
      * Gets the URL of the request.
      */
-    DataFlow::Node getUrl() { result = self.getUrl() }
+    DataFlow::Node getUrl() { result = super.getUrl() }
   }
 
   /** Provides a class for modeling new HTTP redirect APIs. */
@@ -337,16 +313,12 @@ module HTTP {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `HTTP::Redirect::Range` instead.
    */
-  class Redirect extends DataFlow::Node {
-    Redirect::Range self;
-
-    Redirect() { this = self }
-
+  class Redirect extends DataFlow::Node instanceof Redirect::Range {
     /** Gets the data-flow node representing the URL being redirected to. */
-    DataFlow::Node getUrl() { result = self.getUrl() }
+    DataFlow::Node getUrl() { result = super.getUrl() }
 
     /** Gets the response writer that this redirect is sent on, if any. */
-    ResponseWriter getResponseWriter() { result = self.getResponseWriter() }
+    ResponseWriter getResponseWriter() { result = super.getResponseWriter() }
   }
 
   /** Provides a class for modeling new HTTP handler APIs. */
@@ -369,12 +341,11 @@ module HTTP {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `HTTP::RequestHandler::Range` instead.
    */
-  class RequestHandler extends DataFlow::Node {
-    RequestHandler::Range self;
-
-    RequestHandler() { this = self }
-
+  class RequestHandler extends DataFlow::Node instanceof RequestHandler::Range {
     /** Gets a node that is used in a check that is tested before this handler is run. */
-    predicate guardedBy(DataFlow::Node check) { self.guardedBy(check) }
+    predicate guardedBy(DataFlow::Node check) { super.guardedBy(check) }
   }
 }
+
+/** DEPRECATED: Alias for Http */
+deprecated module HTTP = Http;
diff --git a/go/ql/lib/semmle/go/dataflow/GlobalValueNumbering.qll b/go/ql/lib/semmle/go/dataflow/GlobalValueNumbering.qll
index c9c0c58b33e..511bbd4ddce 100644
--- a/go/ql/lib/semmle/go/dataflow/GlobalValueNumbering.qll
+++ b/go/ql/lib/semmle/go/dataflow/GlobalValueNumbering.qll
@@ -114,7 +114,7 @@ private predicate entryNode(ControlFlow::Node node) { node.isEntryNode() }
  * graph so that we can use the dominator tree to find the most recent
  * side-effect.
  */
-private predicate sideEffectCFG(ControlFlow::Node src, ControlFlow::Node dst) {
+private predicate sideEffectCfg(ControlFlow::Node src, ControlFlow::Node dst) {
   src.getASuccessor() = dst
   or
   // Add an edge from the entry point to any node that might have a side
@@ -128,7 +128,7 @@ private predicate sideEffectCFG(ControlFlow::Node src, ControlFlow::Node dst) {
  * the side-effect CFG.
  */
 private predicate iDomEffect(ControlFlow::Node dominator, ControlFlow::Node node) =
-  idominance(entryNode/1, sideEffectCFG/2)(_, dominator, node)
+  idominance(entryNode/1, sideEffectCfg/2)(_, dominator, node)
 
 /**
  * Gets the most recent side effect. To be more precise, `result` is a
@@ -190,7 +190,7 @@ private ControlFlow::Node mostRecentSideEffect(ControlFlow::Node node) {
 
 /** Used to represent the "global value number" of an expression. */
 cached
-private newtype GVNBase =
+private newtype GvnBase =
   MkNumericConst(string val) { mkNumericConst(_, val) } or
   MkStringConst(string val) { mkStringConst(_, val) } or
   MkBoolConst(boolean val) { mkBoolConst(_, val) } or
@@ -204,7 +204,7 @@ private newtype GVNBase =
   MkOtherVariable(ValueEntity x, ControlFlow::Node dominator) { mkOtherVariable(_, x, dominator) } or
   MkMethodAccess(GVN base, Function m) { mkMethodAccess(_, base, m) } or
   MkFieldRead(GVN base, Field f, ControlFlow::Node dominator) { mkFieldRead(_, base, f, dominator) } or
-  MkPureCall(Function f, GVN callee, GVNList args) { mkPureCall(_, f, callee, args) } or
+  MkPureCall(Function f, GVN callee, GvnList args) { mkPureCall(_, f, callee, args) } or
   MkIndex(GVN base, GVN index, ControlFlow::Node dominator) { mkIndex(_, base, index, dominator) } or
   // Dereference a pointer. The value might have changed since the last
   // time the pointer was dereferenced, so we need to include a definition
@@ -217,22 +217,22 @@ private newtype GVNBase =
   // given a unique number based on the expression itself.
   MkUnanalyzable(DataFlow::Node e) { not analyzableExpr(e) }
 
-private newtype GVNList =
+private newtype GvnList =
   MkNil() or
-  MkCons(GVN head, GVNList tail) { globalValueNumbers(_, _, head, tail) }
+  MkCons(GVN head, GvnList tail) { globalValueNumbers(_, _, head, tail) }
 
-private GVNList globalValueNumbers(DataFlow::CallNode ce, int start) {
+private GvnList globalValueNumbers(DataFlow::CallNode ce, int start) {
   analyzableCall(ce, _) and
   start = ce.getNumArgument() and
   result = MkNil()
   or
-  exists(GVN head, GVNList tail |
+  exists(GVN head, GvnList tail |
     globalValueNumbers(ce, start, head, tail) and
     result = MkCons(head, tail)
   )
 }
 
-private predicate globalValueNumbers(DataFlow::CallNode ce, int start, GVN head, GVNList tail) {
+private predicate globalValueNumbers(DataFlow::CallNode ce, int start, GVN head, GvnList tail) {
   analyzableCall(ce, _) and
   head = globalValueNumber(ce.getArgument(start)) and
   tail = globalValueNumbers(ce, start + 1)
@@ -254,8 +254,8 @@ private predicate globalValueNumbers(DataFlow::CallNode ce, int start, GVN head,
  * expression with this `GVN` and using its `toString` and `getLocation`
  * methods.
  */
-class GVN extends GVNBase {
-  GVN() { this instanceof GVNBase }
+class GVN extends GvnBase {
+  GVN() { this instanceof GvnBase }
 
   /** Gets a data-flow node that has this GVN. */
   DataFlow::Node getANode() { this = globalValueNumber(result) }
@@ -386,7 +386,7 @@ private predicate analyzableCall(DataFlow::CallNode ce, Function f) {
   not ce.isConst()
 }
 
-private predicate mkPureCall(DataFlow::CallNode ce, Function f, GVN callee, GVNList args) {
+private predicate mkPureCall(DataFlow::CallNode ce, Function f, GVN callee, GvnList args) {
   analyzableCall(ce, f) and
   callee = globalValueNumber(ce.getCalleeNode()) and
   args = globalValueNumbers(ce, 0)
@@ -523,7 +523,7 @@ GVN globalValueNumber(DataFlow::Node nd) {
     result = MkFieldRead(qualifier, target, dominator)
   )
   or
-  exists(Function f, GVN callee, GVNList args |
+  exists(Function f, GVN callee, GvnList args |
     mkPureCall(nd, f, callee, args) and
     result = MkPureCall(f, callee, args)
   )
diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll
index 7f4d87adbb5..ea3f757b440 100644
--- a/go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll
+++ b/go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll
@@ -341,13 +341,9 @@ module Public {
   }
 
   /** A function, viewed as a node in a data flow graph. */
-  class FunctionNode extends Node {
-    FunctionNode::Range self;
-
-    FunctionNode() { this = self }
-
+  class FunctionNode extends Node instanceof FunctionNode::Range {
     /** Gets the `i`th parameter of this function. */
-    ParameterNode getParameter(int i) { result = self.getParameter(i) }
+    ParameterNode getParameter(int i) { result = super.getParameter(i) }
 
     /** Gets a parameter of this function. */
     ParameterNode getAParameter() { result = this.getParameter(_) }
@@ -356,18 +352,18 @@ module Public {
     int getNumParameter() { result = count(this.getAParameter()) }
 
     /** Gets the name of this function, if it has one. */
-    string getName() { result = self.getName() }
+    string getName() { result = super.getName() }
 
     /**
      * Gets the dataflow node holding the value of the receiver, if any.
      */
-    ReceiverNode getReceiver() { result = self.getReceiver() }
+    ReceiverNode getReceiver() { result = super.getReceiver() }
 
     /**
      * Gets a value returned by the given function via a return statement or an assignment to a
      * result variable.
      */
-    ResultNode getAResult() { result = self.getAResult() }
+    ResultNode getAResult() { result = super.getAResult() }
 
     /**
      * Gets the data-flow node corresponding to the `i`th result of this function.
@@ -379,7 +375,7 @@ module Public {
      *
      * Note that this predicate has no result for function literals.
      */
-    Function getFunction() { result = self.getFunction() }
+    Function getFunction() { result = super.getFunction() }
   }
 
   /** A representation of a function that is declared in the module scope. */
diff --git a/go/ql/lib/semmle/go/frameworks/Beego.qll b/go/ql/lib/semmle/go/frameworks/Beego.qll
index edcf383c6be..6d927112584 100644
--- a/go/ql/lib/semmle/go/frameworks/Beego.qll
+++ b/go/ql/lib/semmle/go/frameworks/Beego.qll
@@ -114,7 +114,7 @@ module Beego {
     }
   }
 
-  private class BeegoOutputInstance extends HTTP::ResponseWriter::Range {
+  private class BeegoOutputInstance extends Http::ResponseWriter::Range {
     SsaWithFields v;
 
     BeegoOutputInstance() {
@@ -131,7 +131,7 @@ module Beego {
     }
   }
 
-  private class BeegoHeaderWrite extends HTTP::HeaderWrite::Range, DataFlow::MethodCallNode {
+  private class BeegoHeaderWrite extends Http::HeaderWrite::Range, DataFlow::MethodCallNode {
     string methodName;
 
     BeegoHeaderWrite() {
@@ -142,7 +142,7 @@ module Beego {
     override DataFlow::Node getName() { methodName = "Header" and result = this.getArgument(0) }
 
     override string getHeaderName() {
-      result = HTTP::HeaderWrite::Range.super.getHeaderName()
+      result = Http::HeaderWrite::Range.super.getHeaderName()
       or
       methodName = "ContentType" and result = "content-type"
     }
@@ -153,12 +153,12 @@ module Beego {
       else result = this.getArgument(1)
     }
 
-    override HTTP::ResponseWriter getResponseWriter() {
+    override Http::ResponseWriter getResponseWriter() {
       result.(BeegoOutputInstance).getAHeaderObject() = this
     }
   }
 
-  private class BeegoResponseBody extends HTTP::ResponseBody::Range {
+  private class BeegoResponseBody extends Http::ResponseBody::Range {
     DataFlow::MethodCallNode call;
     string methodName;
 
@@ -170,7 +170,7 @@ module Beego {
       methodName in ["Body", "JSON", "JSONP", "ServeFormatted", "XML", "YAML"]
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = call.getReceiver() }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = call.getReceiver() }
 
     override string getAContentType() {
       // Super-method provides content-types for `Body`, which requires us to search
@@ -192,7 +192,7 @@ module Beego {
     }
   }
 
-  private class ControllerResponseBody extends HTTP::ResponseBody::Range {
+  private class ControllerResponseBody extends Http::ResponseBody::Range {
     string name;
 
     ControllerResponseBody() {
@@ -203,7 +203,7 @@ module Beego {
       )
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
 
     override string getAContentType() {
       // Actually SetData can serve JSON, XML or YAML depending on the incoming
@@ -213,7 +213,7 @@ module Beego {
     }
   }
 
-  private class ContextResponseBody extends HTTP::ResponseBody::Range {
+  private class ContextResponseBody extends Http::ResponseBody::Range {
     string name;
 
     ContextResponseBody() {
@@ -224,7 +224,7 @@ module Beego {
       )
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
 
     // Neither method is likely to be used with well-typed data such as JSON output,
     // because there are better methods to do this. Assume the Content-Type could
@@ -314,7 +314,7 @@ module Beego {
     }
   }
 
-  private class RedirectMethods extends HTTP::Redirect::Range, DataFlow::CallNode {
+  private class RedirectMethods extends Http::Redirect::Range, DataFlow::CallNode {
     string package;
     string className;
 
@@ -333,7 +333,7 @@ module Beego {
       className = "Context" and result = this.getArgument(1)
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
   }
 
   private class UtilsTaintPropagators extends TaintTracking::FunctionModel {
diff --git a/go/ql/lib/semmle/go/frameworks/Echo.qll b/go/ql/lib/semmle/go/frameworks/Echo.qll
index df58b492b87..c4d243b504c 100644
--- a/go/ql/lib/semmle/go/frameworks/Echo.qll
+++ b/go/ql/lib/semmle/go/frameworks/Echo.qll
@@ -29,7 +29,7 @@ private module Echo {
   /**
    * Data from a `Context` interface method that is not generally exploitable for open-redirect attacks.
    */
-  private class EchoContextRedirectUnexploitableSource extends HTTP::Redirect::UnexploitableSource {
+  private class EchoContextRedirectUnexploitableSource extends Http::Redirect::UnexploitableSource {
     EchoContextRedirectUnexploitableSource() {
       exists(DataFlow::MethodCallNode call, string methodName |
         methodName = ["FormValue", "FormParams", "FormFile", "MultipartForm", "Cookie", "Cookies"] and
@@ -77,14 +77,14 @@ private module Echo {
   /**
    * `echo.Context` methods which set the content-type to `text/html` and write a result in one operation.
    */
-  private class EchoHtmlOutputs extends HTTP::ResponseBody::Range {
+  private class EchoHtmlOutputs extends Http::ResponseBody::Range {
     EchoHtmlOutputs() {
       exists(Method m | m.hasQualifiedName(packagePath(), "Context", ["HTML", "HTMLBlob"]) |
         this = m.getACall().getArgument(1)
       )
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
 
     override string getAContentType() { result = "text/html" }
   }
@@ -92,7 +92,7 @@ private module Echo {
   /**
    * `echo.Context` methods which take a content-type as a parameter.
    */
-  private class EchoParameterizedOutputs extends HTTP::ResponseBody::Range {
+  private class EchoParameterizedOutputs extends Http::ResponseBody::Range {
     DataFlow::CallNode callNode;
 
     EchoParameterizedOutputs() {
@@ -101,7 +101,7 @@ private module Echo {
       )
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
 
     override DataFlow::Node getAContentTypeNode() { result = callNode.getArgument(1) }
   }
@@ -109,7 +109,7 @@ private module Echo {
   /**
    * The `echo.Context.Redirect` method.
    */
-  private class EchoRedirectMethod extends HTTP::Redirect::Range, DataFlow::CallNode {
+  private class EchoRedirectMethod extends Http::Redirect::Range, DataFlow::CallNode {
     EchoRedirectMethod() {
       exists(Method m | m.hasQualifiedName(packagePath(), "Context", "Redirect") |
         this = m.getACall()
@@ -118,6 +118,6 @@ private module Echo {
 
     override DataFlow::Node getUrl() { result = this.getArgument(1) }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
   }
 }
diff --git a/go/ql/lib/semmle/go/frameworks/ElazarlGoproxy.qll b/go/ql/lib/semmle/go/frameworks/ElazarlGoproxy.qll
index 87c091fc3c5..42fb474a5f0 100644
--- a/go/ql/lib/semmle/go/frameworks/ElazarlGoproxy.qll
+++ b/go/ql/lib/semmle/go/frameworks/ElazarlGoproxy.qll
@@ -11,7 +11,7 @@ module ElazarlGoproxy {
   /** Gets the package name. */
   string packagePath() { result = package("github.com/elazarl/goproxy", "") }
 
-  private class NewResponse extends HTTP::HeaderWrite::Range, DataFlow::CallNode {
+  private class NewResponse extends Http::HeaderWrite::Range, DataFlow::CallNode {
     NewResponse() { this.getTarget().hasQualifiedName(packagePath(), "NewResponse") }
 
     override string getHeaderName() { this.definesHeader(result, _) }
@@ -28,21 +28,21 @@ module ElazarlGoproxy {
       header = "content-type" and value = this.getArgument(1).getStringValue()
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
   }
 
   /** A body argument to a `NewResponse` call. */
-  private class NewResponseBody extends HTTP::ResponseBody::Range {
+  private class NewResponseBody extends Http::ResponseBody::Range {
     NewResponse call;
 
     NewResponseBody() { this = call.getArgument(3) }
 
     override DataFlow::Node getAContentTypeNode() { result = call.getArgument(1) }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
   }
 
-  private class TextResponse extends HTTP::HeaderWrite::Range, DataFlow::CallNode {
+  private class TextResponse extends Http::HeaderWrite::Range, DataFlow::CallNode {
     TextResponse() { this.getTarget().hasQualifiedName(packagePath(), "TextResponse") }
 
     override string getHeaderName() { this.definesHeader(result, _) }
@@ -59,22 +59,22 @@ module ElazarlGoproxy {
       header = "content-type" and value = "text/plain"
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
   }
 
   /** A body argument to a `TextResponse` call. */
-  private class TextResponseBody extends HTTP::ResponseBody::Range, TextResponse {
+  private class TextResponseBody extends Http::ResponseBody::Range, TextResponse {
     TextResponse call;
 
     TextResponseBody() { this = call.getArgument(2) }
 
     override DataFlow::Node getAContentTypeNode() { result = call.getArgument(1) }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
   }
 
   /** A handler attached to a goproxy proxy type. */
-  private class ProxyHandler extends HTTP::RequestHandler::Range {
+  private class ProxyHandler extends Http::RequestHandler::Range {
     DataFlow::MethodCallNode handlerReg;
 
     ProxyHandler() {
diff --git a/go/ql/lib/semmle/go/frameworks/Email.qll b/go/ql/lib/semmle/go/frameworks/Email.qll
index 049af5f87bf..340cdad3d10 100644
--- a/go/ql/lib/semmle/go/frameworks/Email.qll
+++ b/go/ql/lib/semmle/go/frameworks/Email.qll
@@ -9,11 +9,7 @@ import go
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `EmailData::Range` instead.
  */
-class EmailData extends DataFlow::Node {
-  EmailData::Range self;
-
-  EmailData() { this = self }
-}
+class EmailData extends DataFlow::Node instanceof EmailData::Range { }
 
 /** Provides classes for working with data that is incorporated into an email. */
 module EmailData {
diff --git a/go/ql/lib/semmle/go/frameworks/Macaron.qll b/go/ql/lib/semmle/go/frameworks/Macaron.qll
index a38b2b20da0..f107ec208ee 100644
--- a/go/ql/lib/semmle/go/frameworks/Macaron.qll
+++ b/go/ql/lib/semmle/go/frameworks/Macaron.qll
@@ -5,7 +5,7 @@
 import go
 
 private module Macaron {
-  private class Context extends HTTP::ResponseWriter::Range {
+  private class Context extends Http::ResponseWriter::Range {
     SsaWithFields v;
 
     Context() {
@@ -18,13 +18,13 @@ private module Macaron {
     override DataFlow::Node getANode() { result = v.similar().getAUse().getASuccessor*() }
   }
 
-  private class RedirectCall extends HTTP::Redirect::Range, DataFlow::MethodCallNode {
+  private class RedirectCall extends Http::Redirect::Range, DataFlow::MethodCallNode {
     RedirectCall() {
       this.getTarget().hasQualifiedName("gopkg.in/macaron.v1", "Context", "Redirect")
     }
 
     override DataFlow::Node getUrl() { result = this.getArgument(0) }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = this.getReceiver() }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = this.getReceiver() }
   }
 }
diff --git a/go/ql/lib/semmle/go/frameworks/NoSQL.qll b/go/ql/lib/semmle/go/frameworks/NoSQL.qll
index 578cf67d33f..ff8190d854d 100644
--- a/go/ql/lib/semmle/go/frameworks/NoSQL.qll
+++ b/go/ql/lib/semmle/go/frameworks/NoSQL.qll
@@ -12,11 +12,7 @@ module NoSql {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `NoSQL::Query::Range` instead.
    */
-  class Query extends DataFlow::Node {
-    Query::Range self;
-
-    Query() { this = self }
-  }
+  class Query extends DataFlow::Node instanceof Query::Range { }
 
   /** Provides classes for working with NoSql queries. */
   module Query {
diff --git a/go/ql/lib/semmle/go/frameworks/Revel.qll b/go/ql/lib/semmle/go/frameworks/Revel.qll
index 1ccad431b84..d006f46b2ee 100644
--- a/go/ql/lib/semmle/go/frameworks/Revel.qll
+++ b/go/ql/lib/semmle/go/frameworks/Revel.qll
@@ -114,7 +114,7 @@ module Revel {
    * We look particularly for html file extensions, since these are the only ones we currently have special rules
    * for (in particular, detecting XSS vulnerabilities).
    */
-  private class ControllerRenderMethods extends HTTP::ResponseBody::Range {
+  private class ControllerRenderMethods extends Http::ResponseBody::Range {
     string contentType;
 
     ControllerRenderMethods() {
@@ -149,7 +149,7 @@ module Revel {
       )
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
 
     override string getAContentType() { result = contentType }
   }
@@ -174,7 +174,7 @@ module Revel {
    * It is currently assumed that a tainted `value` in `Redirect(url, value)`, which calls `Sprintf(url, value)`
    * internally, cannot lead to an open redirect vulnerability.
    */
-  private class ControllerRedirectMethod extends HTTP::Redirect::Range, DataFlow::CallNode {
+  private class ControllerRedirectMethod extends Http::Redirect::Range, DataFlow::CallNode {
     ControllerRedirectMethod() {
       exists(Method m | m.hasQualifiedName(packagePath(), "Controller", "Redirect") |
         this = m.getACall()
@@ -183,7 +183,7 @@ module Revel {
 
     override DataFlow::Node getUrl() { result = this.getArgument(0) }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
   }
 
   /**
@@ -226,7 +226,7 @@ module Revel {
   /**
    * A write to a template argument field that is read raw inside of a template.
    */
-  private class RawTemplateArgument extends HTTP::TemplateResponseBody::Range {
+  private class RawTemplateArgument extends Http::TemplateResponseBody::Range {
     RawTemplateRead read;
 
     RawTemplateArgument() {
@@ -261,7 +261,7 @@ module Revel {
 
     override string getAContentType() { result = "text/html" }
 
-    override HTTP::ResponseWriter getResponseWriter() { none() }
+    override Http::ResponseWriter getResponseWriter() { none() }
 
     override HtmlTemplate::TemplateRead getRead() { result = read }
   }
diff --git a/go/ql/lib/semmle/go/frameworks/SQL.qll b/go/ql/lib/semmle/go/frameworks/SQL.qll
index 66566f7540c..322d17a420a 100644
--- a/go/ql/lib/semmle/go/frameworks/SQL.qll
+++ b/go/ql/lib/semmle/go/frameworks/SQL.qll
@@ -12,13 +12,9 @@ module SQL {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `SQL::Query::Range` instead.
    */
-  class Query extends DataFlow::Node {
-    Query::Range self;
-
-    Query() { this = self }
-
+  class Query extends DataFlow::Node instanceof Query::Range {
     /** Gets a result of this query execution. */
-    DataFlow::Node getAResult() { result = self.getAResult() }
+    DataFlow::Node getAResult() { result = super.getAResult() }
 
     /**
      * Gets a query string that is used as (part of) this SQL query.
@@ -26,7 +22,7 @@ module SQL {
      * Note that this may not resolve all `QueryString`s that should be associated with this
      * query due to data flow.
      */
-    QueryString getAQueryString() { result = self.getAQueryString() }
+    QueryString getAQueryString() { result = super.getAQueryString() }
   }
 
   /**
@@ -59,11 +55,7 @@ module SQL {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `SQL::QueryString::Range` instead.
    */
-  class QueryString extends DataFlow::Node {
-    QueryString::Range self;
-
-    QueryString() { this = self }
-  }
+  class QueryString extends DataFlow::Node instanceof QueryString::Range { }
 
   /** Provides classes for working with SQL query strings. */
   module QueryString {
diff --git a/go/ql/lib/semmle/go/frameworks/Stdlib.qll b/go/ql/lib/semmle/go/frameworks/Stdlib.qll
index b8481175216..db46167d205 100644
--- a/go/ql/lib/semmle/go/frameworks/Stdlib.qll
+++ b/go/ql/lib/semmle/go/frameworks/Stdlib.qll
@@ -128,7 +128,7 @@ module IntegerParser {
 }
 
 /** Provides models of commonly used functions in the `net/url` package. */
-module URL {
+module Url {
   /** The `PathEscape` or `QueryEscape` function. */
   class Escaper extends TaintTracking::FunctionModel {
     Escaper() {
@@ -263,3 +263,6 @@ module URL {
     }
   }
 }
+
+/** DEPRECATED: Alias for Url */
+deprecated module URL = Url;
diff --git a/go/ql/lib/semmle/go/frameworks/Testing.qll b/go/ql/lib/semmle/go/frameworks/Testing.qll
index 2df3d6c0ddd..f56e58288e5 100644
--- a/go/ql/lib/semmle/go/frameworks/Testing.qll
+++ b/go/ql/lib/semmle/go/frameworks/Testing.qll
@@ -8,11 +8,7 @@ import go
  * Extend this class to refine existing models of testing frameworks. If you want to model new
  * frameworks, extend `TestCase::Range` instead.
  */
-class TestCase extends AstNode {
-  TestCase::Range self;
-
-  TestCase() { this = self }
-}
+class TestCase extends AstNode instanceof TestCase::Range { }
 
 /** Provides classes for working with test cases. */
 module TestCase {
@@ -47,11 +43,7 @@ module TestCase {
  * Extend this class to refine existing models of testing frameworks. If you want to model new
  * frameworks, extend `TestFile::Range` instead.
  */
-class TestFile extends File {
-  TestFile::Range self;
-
-  TestFile() { this = self }
-}
+class TestFile extends File instanceof TestFile::Range { }
 
 /** Provides classes for working with test files. */
 module TestFile {
diff --git a/go/ql/lib/semmle/go/frameworks/WebSocket.qll b/go/ql/lib/semmle/go/frameworks/WebSocket.qll
index d3264467b45..44445b538b2 100644
--- a/go/ql/lib/semmle/go/frameworks/WebSocket.qll
+++ b/go/ql/lib/semmle/go/frameworks/WebSocket.qll
@@ -8,13 +8,9 @@ import go
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `WebSocketRequestCall::Range` instead.
  */
-class WebSocketRequestCall extends DataFlow::CallNode {
-  WebSocketRequestCall::Range self;
-
-  WebSocketRequestCall() { this = self }
-
+class WebSocketRequestCall extends DataFlow::CallNode instanceof WebSocketRequestCall::Range {
   /** Gets the URL of the request. */
-  DataFlow::Node getRequestUrl() { result = self.getRequestUrl() }
+  DataFlow::Node getRequestUrl() { result = super.getRequestUrl() }
 }
 
 /** Provides classes for working with WebSocket request functions. */
@@ -143,13 +139,9 @@ class WebSocketReaderAsSource extends UntrustedFlowSource::Range {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `WebSocketReader::Range` instead.
  */
-class WebSocketReader extends Function {
-  WebSocketReader::Range self;
-
-  WebSocketReader() { this = self }
-
+class WebSocketReader extends Function instanceof WebSocketReader::Range {
   /** Gets an output of this function containing data that is read from a WebSocket connection. */
-  FunctionOutput getAnOutput() { result = self.getAnOutput() }
+  FunctionOutput getAnOutput() { result = super.getAnOutput() }
 }
 
 /** Provides classes for working with messages read from a WebSocket. */
diff --git a/go/ql/lib/semmle/go/frameworks/XPath.qll b/go/ql/lib/semmle/go/frameworks/XPath.qll
index 896007f4641..e3b7282c4e3 100644
--- a/go/ql/lib/semmle/go/frameworks/XPath.qll
+++ b/go/ql/lib/semmle/go/frameworks/XPath.qll
@@ -12,11 +12,7 @@ module XPath {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `XPath::XPathExpressionString::Range` instead.
    */
-  class XPathExpressionString extends DataFlow::Node {
-    XPathExpressionString::Range self;
-
-    XPathExpressionString() { this = self }
-  }
+  class XPathExpressionString extends DataFlow::Node instanceof XPathExpressionString::Range { }
 
   /** Provides classes for working with XPath expression strings. */
   module XPathExpressionString {
diff --git a/go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll b/go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll
index c5e48e7d295..e0518ecf465 100644
--- a/go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll
+++ b/go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll
@@ -35,7 +35,7 @@ module NetHttp {
   }
 
   /** The declaration of a variable which either is or has a field that implements the http.ResponseWriter type */
-  private class StdlibResponseWriter extends HTTP::ResponseWriter::Range {
+  private class StdlibResponseWriter extends Http::ResponseWriter::Range {
     SsaWithFields v;
 
     StdlibResponseWriter() {
@@ -52,7 +52,7 @@ module NetHttp {
     }
   }
 
-  private class HeaderWriteCall extends HTTP::HeaderWrite::Range, DataFlow::MethodCallNode {
+  private class HeaderWriteCall extends Http::HeaderWrite::Range, DataFlow::MethodCallNode {
     HeaderWriteCall() {
       this.getTarget().hasQualifiedName("net/http", "Header", "Add") or
       this.getTarget().hasQualifiedName("net/http", "Header", "Set")
@@ -62,7 +62,7 @@ module NetHttp {
 
     override DataFlow::Node getValue() { result = this.getArgument(1) }
 
-    override HTTP::ResponseWriter getResponseWriter() {
+    override Http::ResponseWriter getResponseWriter() {
       // find `v` in
       // ```
       // header := v.Header()
@@ -72,7 +72,7 @@ module NetHttp {
     }
   }
 
-  private class MapWrite extends HTTP::HeaderWrite::Range, DataFlow::Node {
+  private class MapWrite extends Http::HeaderWrite::Range, DataFlow::Node {
     Write write;
     DataFlow::Node index;
     DataFlow::Node rhs;
@@ -86,7 +86,7 @@ module NetHttp {
 
     override DataFlow::Node getValue() { result = rhs }
 
-    override HTTP::ResponseWriter getResponseWriter() {
+    override Http::ResponseWriter getResponseWriter() {
       // find `v` in
       // ```
       // header := v.Header()
@@ -96,7 +96,7 @@ module NetHttp {
     }
   }
 
-  private class ResponseWriteHeaderCall extends HTTP::HeaderWrite::Range, DataFlow::MethodCallNode {
+  private class ResponseWriteHeaderCall extends Http::HeaderWrite::Range, DataFlow::MethodCallNode {
     ResponseWriteHeaderCall() {
       this.getTarget().implements("net/http", "ResponseWriter", "WriteHeader")
     }
@@ -107,10 +107,10 @@ module NetHttp {
 
     override DataFlow::Node getValue() { result = this.getArgument(0) }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = this.getReceiver() }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = this.getReceiver() }
   }
 
-  private class ResponseErrorCall extends HTTP::HeaderWrite::Range, DataFlow::CallNode {
+  private class ResponseErrorCall extends Http::HeaderWrite::Range, DataFlow::CallNode {
     ResponseErrorCall() { this.getTarget().hasQualifiedName("net/http", "Error") }
 
     override string getHeaderName() { result = "status" }
@@ -119,10 +119,10 @@ module NetHttp {
 
     override DataFlow::Node getValue() { result = this.getArgument(2) }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = this.getArgument(0) }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = this.getArgument(0) }
   }
 
-  private class RequestBody extends HTTP::RequestBody::Range, DataFlow::ExprNode {
+  private class RequestBody extends Http::RequestBody::Range, DataFlow::ExprNode {
     RequestBody() {
       exists(Function newRequest |
         newRequest.hasQualifiedName("net/http", "NewRequest") and
@@ -137,7 +137,7 @@ module NetHttp {
     }
   }
 
-  private class ResponseBody extends HTTP::ResponseBody::Range, DataFlow::ArgumentNode {
+  private class ResponseBody extends Http::ResponseBody::Range, DataFlow::ArgumentNode {
     DataFlow::Node responseWriter;
 
     ResponseBody() {
@@ -156,19 +156,19 @@ module NetHttp {
       )
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = responseWriter }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = responseWriter }
   }
 
-  private class RedirectCall extends HTTP::Redirect::Range, DataFlow::CallNode {
+  private class RedirectCall extends Http::Redirect::Range, DataFlow::CallNode {
     RedirectCall() { this.getTarget().hasQualifiedName("net/http", "Redirect") }
 
     override DataFlow::Node getUrl() { result = this.getArgument(2) }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = this.getArgument(0) }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = this.getArgument(0) }
   }
 
   /** A call to a function in the `net/http` package that performs an HTTP request to a URL. */
-  private class RequestCall extends HTTP::ClientRequest::Range, DataFlow::CallNode {
+  private class RequestCall extends Http::ClientRequest::Range, DataFlow::CallNode {
     RequestCall() {
       exists(string functionName |
         (
@@ -185,7 +185,7 @@ module NetHttp {
   }
 
   /** A call to the Client.Do function in the `net/http` package. */
-  private class ClientDo extends HTTP::ClientRequest::Range, DataFlow::MethodCallNode {
+  private class ClientDo extends Http::ClientRequest::Range, DataFlow::MethodCallNode {
     ClientDo() { this.getTarget().hasQualifiedName("net/http", "Client", "Do") }
 
     override DataFlow::Node getUrl() {
@@ -212,7 +212,7 @@ module NetHttp {
   }
 
   /** A call to the `Transport.RoundTrip` function in the `net/http` package. */
-  private class TransportRoundTrip extends HTTP::ClientRequest::Range, DataFlow::MethodCallNode {
+  private class TransportRoundTrip extends Http::ClientRequest::Range, DataFlow::MethodCallNode {
     TransportRoundTrip() { this.getTarget().hasQualifiedName("net/http", "Transport", "RoundTrip") }
 
     override DataFlow::Node getUrl() {
@@ -239,7 +239,7 @@ module NetHttp {
   }
 
   /** Fields and methods of `net/http.Request` that are not generally exploitable in an open-redirect attack. */
-  private class RedirectUnexploitableRequestFields extends HTTP::Redirect::UnexploitableSource {
+  private class RedirectUnexploitableRequestFields extends Http::Redirect::UnexploitableSource {
     RedirectUnexploitableRequestFields() {
       exists(Field f, string fieldName |
         f.hasQualifiedName("net/http", "Request", fieldName) and
@@ -257,7 +257,7 @@ module NetHttp {
     }
   }
 
-  private class Handler extends HTTP::RequestHandler::Range {
+  private class Handler extends Http::RequestHandler::Range {
     DataFlow::CallNode handlerReg;
 
     Handler() {
diff --git a/go/ql/lib/semmle/go/security/FlowSources.qll b/go/ql/lib/semmle/go/security/FlowSources.qll
index c1e08710e06..de8fb5c3732 100644
--- a/go/ql/lib/semmle/go/security/FlowSources.qll
+++ b/go/ql/lib/semmle/go/security/FlowSources.qll
@@ -11,11 +11,7 @@ private import semmle.go.dataflow.ExternalFlow as ExternalFlow
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `UntrustedFlowSource::Range` instead.
  */
-class UntrustedFlowSource extends DataFlow::Node {
-  UntrustedFlowSource::Range self;
-
-  UntrustedFlowSource() { this = self }
-}
+class UntrustedFlowSource extends DataFlow::Node instanceof UntrustedFlowSource::Range { }
 
 /** Provides a class for modeling new sources of untrusted data. */
 module UntrustedFlowSource {
diff --git a/go/ql/lib/semmle/go/security/InsecureRandomness.qll b/go/ql/lib/semmle/go/security/InsecureRandomness.qll
index f2db5860073..6de3071b598 100644
--- a/go/ql/lib/semmle/go/security/InsecureRandomness.qll
+++ b/go/ql/lib/semmle/go/security/InsecureRandomness.qll
@@ -29,5 +29,7 @@ module InsecureRandomness {
 
     /** Holds if `sink` is a sink for this configuration with kind `kind`. */
     predicate isSink(Sink sink, string kind) { kind = sink.getKind() }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
   }
 }
diff --git a/go/ql/lib/semmle/go/security/OpenUrlRedirectCustomizations.qll b/go/ql/lib/semmle/go/security/OpenUrlRedirectCustomizations.qll
index d883c3c0101..80b9bb4a126 100644
--- a/go/ql/lib/semmle/go/security/OpenUrlRedirectCustomizations.qll
+++ b/go/ql/lib/semmle/go/security/OpenUrlRedirectCustomizations.qll
@@ -56,7 +56,7 @@ module OpenUrlRedirect {
     UntrustedFlowAsSource() {
       // exclude some fields and methods of URLs that are generally not attacker-controllable for
       // open redirect exploits
-      not this instanceof HTTP::Redirect::UnexploitableSource
+      not this instanceof Http::Redirect::UnexploitableSource
     }
   }
 
@@ -64,7 +64,7 @@ module OpenUrlRedirect {
    * An HTTP redirect, considered as a sink for `Configuration`.
    */
   class RedirectSink extends Sink, DataFlow::Node {
-    RedirectSink() { this = any(HTTP::Redirect redir).getUrl() }
+    RedirectSink() { this = any(Http::Redirect redir).getUrl() }
   }
 
   /**
@@ -73,7 +73,7 @@ module OpenUrlRedirect {
    */
   class LocationHeaderSink extends Sink, DataFlow::Node {
     LocationHeaderSink() {
-      exists(HTTP::HeaderWrite hw | hw.getHeaderName() = "location" | this = hw.getValue())
+      exists(Http::HeaderWrite hw | hw.getHeaderName() = "location" | this = hw.getValue())
     }
   }
 
diff --git a/go/ql/lib/semmle/go/security/RequestForgeryCustomizations.qll b/go/ql/lib/semmle/go/security/RequestForgeryCustomizations.qll
index b75b3503d55..b11157daa06 100644
--- a/go/ql/lib/semmle/go/security/RequestForgeryCustomizations.qll
+++ b/go/ql/lib/semmle/go/security/RequestForgeryCustomizations.qll
@@ -48,7 +48,7 @@ module RequestForgery {
    * The URL of an HTTP request, viewed as a sink for request forgery.
    */
   private class ClientRequestUrlAsSink extends Sink {
-    HTTP::ClientRequest request;
+    Http::ClientRequest request;
 
     ClientRequestUrlAsSink() { this = request.getUrl() }
 
diff --git a/go/ql/lib/semmle/go/security/SafeUrlFlowCustomizations.qll b/go/ql/lib/semmle/go/security/SafeUrlFlowCustomizations.qll
index de0f95f8f3a..dbdb96a10a7 100644
--- a/go/ql/lib/semmle/go/security/SafeUrlFlowCustomizations.qll
+++ b/go/ql/lib/semmle/go/security/SafeUrlFlowCustomizations.qll
@@ -27,7 +27,7 @@ module SafeUrlFlow {
   /**
    * A method on a `net/url.URL` that is considered unsafe to use.
    */
-  private class UnsafeUrlMethod extends URL::UrlGetter {
+  private class UnsafeUrlMethod extends Url::UrlGetter {
     UnsafeUrlMethod() { this.getName() = "Query" }
   }
 
diff --git a/go/ql/lib/semmle/go/security/Xss.qll b/go/ql/lib/semmle/go/security/Xss.qll
index 2ed5c5761a7..98b6da02fe8 100644
--- a/go/ql/lib/semmle/go/security/Xss.qll
+++ b/go/ql/lib/semmle/go/security/Xss.qll
@@ -6,8 +6,11 @@ import go
 
 /** Provides classes and predicates shared between the XSS queries. */
 module SharedXss {
-  /** A data flow source for XSS vulnerabilities. */
-  abstract class Source extends DataFlow::Node { }
+  /**
+   * DEPRECATED: This class is not used.
+   * A data flow source for XSS vulnerabilities.
+   */
+  abstract deprecated class Source extends DataFlow::Node { }
 
   /** A data flow sink for XSS vulnerabilities. */
   abstract class Sink extends DataFlow::Node {
@@ -46,14 +49,14 @@ module SharedXss {
    * a content type that does not (case-insensitively) contain the string "html". This
    * is to prevent us from flagging plain-text or JSON responses as vulnerable.
    */
-  class HttpResponseBodySink extends Sink, HTTP::ResponseBody {
+  class HttpResponseBodySink extends Sink, Http::ResponseBody {
     HttpResponseBodySink() { not nonHtmlContentType(this) }
   }
 
   /**
    * An expression that is rendered as part of a template.
    */
-  class RawTemplateInstantiationSink extends HttpResponseBodySink, HTTP::TemplateResponseBody {
+  class RawTemplateInstantiationSink extends HttpResponseBodySink, Http::TemplateResponseBody {
     override string getSinkKind() { result = "rawtemplate" }
 
     override Locatable getAssociatedLoc() { result = this.getRead().getEnclosingTextNode() }
@@ -62,7 +65,7 @@ module SharedXss {
   /**
    * Holds if `body` may send a response with a content type other than HTML.
    */
-  private predicate nonHtmlContentType(HTTP::ResponseBody body) {
+  private predicate nonHtmlContentType(Http::ResponseBody body) {
     not htmlTypeSpecified(body) and
     (
       exists(body.getAContentType())
@@ -90,7 +93,7 @@ module SharedXss {
   /**
    * Holds if `body` specifies the response's content type to be HTML.
    */
-  private predicate htmlTypeSpecified(HTTP::ResponseBody body) {
+  private predicate htmlTypeSpecified(Http::ResponseBody body) {
     body.getAContentType().regexpMatch("(?i).*html.*")
   }
 
diff --git a/go/ql/src/RedundantCode/DuplicateCondition.ql b/go/ql/src/RedundantCode/DuplicateCondition.ql
index ac3c586eda4..3d7416450dc 100644
--- a/go/ql/src/RedundantCode/DuplicateCondition.ql
+++ b/go/ql/src/RedundantCode/DuplicateCondition.ql
@@ -24,10 +24,10 @@ Expr getCondition(IfStmt stmt, int i) {
 }
 
 /** Gets the global value number of `e`, which is the `i`th condition of `is`. */
-GVN conditionGVN(IfStmt is, int i, Expr e) {
+GVN conditionGvn(IfStmt is, int i, Expr e) {
   e = getCondition(is, i) and result = e.getGlobalValueNumber()
 }
 
 from IfStmt is, Expr e, Expr f, int i, int j
-where conditionGVN(is, i, e) = conditionGVN(is, j, f) and i < j
+where conditionGvn(is, i, e) = conditionGvn(is, j, f) and i < j
 select f, "This condition is a duplicate of $@.", e, "an earlier condition"
diff --git a/go/ql/src/RedundantCode/DuplicateSwitchCase.ql b/go/ql/src/RedundantCode/DuplicateSwitchCase.ql
index 7af97b76875..b2777a1131f 100644
--- a/go/ql/src/RedundantCode/DuplicateSwitchCase.ql
+++ b/go/ql/src/RedundantCode/DuplicateSwitchCase.ql
@@ -14,10 +14,10 @@
 import go
 
 /** Gets the global value number of `e`, which is the `i`th case label of `switch`. */
-GVN switchCaseGVN(SwitchStmt switch, int i, Expr e) {
+GVN switchCaseGvn(SwitchStmt switch, int i, Expr e) {
   e = switch.getCase(i).getExpr(0) and result = e.getGlobalValueNumber()
 }
 
 from SwitchStmt switch, int i, Expr e, int j, Expr f
-where switchCaseGVN(switch, i, e) = switchCaseGVN(switch, j, f) and i < j
+where switchCaseGvn(switch, i, e) = switchCaseGvn(switch, j, f) and i < j
 select f, "This case is a duplicate of $@.", e, "an earlier case"
diff --git a/go/ql/src/Security/CWE-020/IncompleteHostnameRegexp.ql b/go/ql/src/Security/CWE-020/IncompleteHostnameRegexp.ql
index ef0ec60d871..4272d1cc27e 100644
--- a/go/ql/src/Security/CWE-020/IncompleteHostnameRegexp.ql
+++ b/go/ql/src/Security/CWE-020/IncompleteHostnameRegexp.ql
@@ -28,12 +28,12 @@ predicate isIncompleteHostNameRegexpPattern(string pattern, string hostPart) {
             "(?<!\\\\)[.]" +
             // immediately followed by a sequence of subdomains, perhaps with some regex characters mixed in,
             // followed by a known TLD
-            "(([():|?a-z0-9-]+(\\\\)?[.])?" + commonTLD() + ")" + ".*", 1)
+            "(([():|?a-z0-9-]+(\\\\)?[.])?" + commonTld() + ")" + ".*", 1)
 }
 
 /** Holds if `b` sets the HTTP status code (represented by a pseudo-header named  `status`) */
 predicate writesHttpError(ReachableBasicBlock b) {
-  forex(HTTP::HeaderWrite hw |
+  forex(Http::HeaderWrite hw |
     hw.getHeaderName() = "status" and hw.asInstruction().getBasicBlock() = b
   |
     exists(string code | code.matches("4__") or code.matches("5__") |
@@ -65,7 +65,7 @@ DataFlow::Node getASafeHandler() {
 }
 
 /** Holds if `regexp` is used in a check before `handler` is called. */
-predicate regexpGuardsHandler(RegexpPattern regexp, HTTP::RequestHandler handler) {
+predicate regexpGuardsHandler(RegexpPattern regexp, Http::RequestHandler handler) {
   handler.guardedBy(DataFlow::exprNode(regexp.getAUse().asExpr().getParent*()))
 }
 
@@ -99,7 +99,7 @@ class Config extends DataFlow::Configuration {
 
   override predicate isSink(DataFlow::Node sink) {
     sink instanceof RegexpPattern and
-    forall(HTTP::RequestHandler handler | regexpGuardsHandler(sink, handler) |
+    forall(Http::RequestHandler handler | regexpGuardsHandler(sink, handler) |
       not handler = getASafeHandler()
     ) and
     not regexpGuardsError(sink)
diff --git a/go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql b/go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql
index 2114038f786..8538e435819 100644
--- a/go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql
+++ b/go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql
@@ -52,7 +52,7 @@ predicate isInterestingSemiAnchoredRegexpString(string re, string msg) {
 bindingset[re]
 predicate isInterestingUnanchoredRegexpString(string re, string msg) {
   // a substring sequence of a protocol and subdomains, perhaps with some regex characters mixed in, followed by a known TLD
-  re.regexpMatch("(?i)[():|?a-z0-9-\\\\./]+[.]" + commonTLD() + "([/#?():]\\S*)?") and
+  re.regexpMatch("(?i)[():|?a-z0-9-\\\\./]+[.]" + commonTld() + "([/#?():]\\S*)?") and
   // without any anchors
   not re.regexpMatch(".*(\\$|\\^|\\\\A|\\\\z).*") and
   msg =
diff --git a/go/ql/src/Security/CWE-022/TaintedPath.ql b/go/ql/src/Security/CWE-022/TaintedPath.ql
index 36487970d44..34738292f09 100644
--- a/go/ql/src/Security/CWE-022/TaintedPath.ql
+++ b/go/ql/src/Security/CWE-022/TaintedPath.ql
@@ -21,5 +21,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "This path depends on $@.", source.getNode(),
-  "a user-provided value"
+select sink.getNode(), source, sink, "$@ flows to here and is used in a path.", source.getNode(),
+  "User-provided value"
diff --git a/go/ql/src/Security/CWE-209/StackTraceExposure.ql b/go/ql/src/Security/CWE-209/StackTraceExposure.ql
index b3cb4107319..369c8109d47 100644
--- a/go/ql/src/Security/CWE-209/StackTraceExposure.ql
+++ b/go/ql/src/Security/CWE-209/StackTraceExposure.ql
@@ -60,7 +60,7 @@ class StackTraceExposureConfig extends TaintTracking::Configuration {
     node = any(DebugStackFunction f).getACall().getResult()
   }
 
-  override predicate isSink(DataFlow::Node node) { node instanceof HTTP::ResponseBody }
+  override predicate isSink(DataFlow::Node node) { node instanceof Http::ResponseBody }
 
   override predicate isSanitizer(DataFlow::Node node) {
     // Sanitise everything controlled by an is-debug-mode check.
@@ -76,5 +76,6 @@ class StackTraceExposureConfig extends TaintTracking::Configuration {
 
 from StackTraceExposureConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select source.getNode(), source, sink, "This stack trace is exposed to a remote user $@.",
-  sink.getNode(), "here"
+select sink.getNode(), source, sink,
+  "Stack trace information from $@ may be exposed to an external user here.", source.getNode(),
+  "here"
diff --git a/go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql b/go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql
index f27ca8b9042..452e3b94108 100644
--- a/go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql
+++ b/go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql
@@ -3,9 +3,11 @@
  * @description Detects insecure SSL client configurations with an implementation of the `HostKeyCallback` that accepts all host keys.
  * @kind path-problem
  * @problem.severity warning
+ * @security-severity 8.2
  * @precision high
  * @id go/insecure-hostkeycallback
  * @tags security
+ *       external/cwe/cwe-322
  */
 
 import go
diff --git a/go/ql/src/Security/CWE-643/XPathInjection.ql b/go/ql/src/Security/CWE-643/XPathInjection.ql
index 4028fa14a8c..24642d5a1dd 100644
--- a/go/ql/src/Security/CWE-643/XPathInjection.ql
+++ b/go/ql/src/Security/CWE-643/XPathInjection.ql
@@ -24,5 +24,5 @@ predicate isStringOrByte(DataFlow::PathNode node) {
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink) and isStringOrByte(sink)
-select sink.getNode(), source, sink, "$@ flows here and is used in an XPath expression.",
-  source.getNode(), "A user-provided value"
+select sink.getNode(), source, sink, "$@ flows to here and is used in an XPath expression.",
+  source.getNode(), "User-provided value"
diff --git a/go/ql/src/change-notes/2022-08-23-alert-messages.md b/go/ql/src/change-notes/2022-08-23-alert-messages.md
new file mode 100644
index 00000000000..22f4c5c6682
--- /dev/null
+++ b/go/ql/src/change-notes/2022-08-23-alert-messages.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The alert message of many queries have been changed to make the message consistent with other languages.
\ No newline at end of file
diff --git a/go/ql/src/change-notes/2022-08-29-add-security-severity.md b/go/ql/src/change-notes/2022-08-29-add-security-severity.md
new file mode 100644
index 00000000000..9451c11f6a1
--- /dev/null
+++ b/go/ql/src/change-notes/2022-08-29-add-security-severity.md
@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Added the `security-severity` tag and CWE tag to the `go/insecure-hostkeycallback` query.
diff --git a/go/ql/src/experimental/CWE-285/PamAuthBypass.ql b/go/ql/src/experimental/CWE-285/PamAuthBypass.ql
index 06f2904599e..4a9d953fc40 100644
--- a/go/ql/src/experimental/CWE-285/PamAuthBypass.ql
+++ b/go/ql/src/experimental/CWE-285/PamAuthBypass.ql
@@ -3,7 +3,7 @@
  * @description Not using `pam.AcctMgmt` after `pam.Authenticate` to check the validity of a login can lead to authorization bypass.
  * @kind problem
  * @problem.severity warning
- * @id go/unreachable-statement
+ * @id go/pam-auth-bypass
  * @tags maintainability
  *       correctness
  *       external/cwe/cwe-561
diff --git a/go/ql/src/experimental/CWE-918/SSRF.qll b/go/ql/src/experimental/CWE-918/SSRF.qll
index b7a408902d0..cf264c8c0b6 100644
--- a/go/ql/src/experimental/CWE-918/SSRF.qll
+++ b/go/ql/src/experimental/CWE-918/SSRF.qll
@@ -74,7 +74,7 @@ module ServerSideRequestForgery {
    * The URL of an HTTP request, viewed as a sink for request forgery.
    */
   private class ClientRequestUrlAsSink extends Sink {
-    HTTP::ClientRequest request;
+    Http::ClientRequest request;
 
     ClientRequestUrlAsSink() { this = request.getUrl() }
 
diff --git a/go/ql/src/experimental/CWE-942/CorsMisconfiguration.ql b/go/ql/src/experimental/CWE-942/CorsMisconfiguration.ql
index 4e4b452fb8e..372b1c21642 100644
--- a/go/ql/src/experimental/CWE-942/CorsMisconfiguration.ql
+++ b/go/ql/src/experimental/CWE-942/CorsMisconfiguration.ql
@@ -41,14 +41,14 @@ string headerAllowCredentials() { result = "Access-Control-Allow-Credentials".to
 /**
  * An `Access-Control-Allow-Origin` header write.
  */
-class AllowOriginHeaderWrite extends HTTP::HeaderWrite {
+class AllowOriginHeaderWrite extends Http::HeaderWrite {
   AllowOriginHeaderWrite() { this.getHeaderName() = headerAllowOrigin() }
 }
 
 /**
  * An `Access-Control-Allow-Credentials` header write.
  */
-class AllowCredentialsHeaderWrite extends HTTP::HeaderWrite {
+class AllowCredentialsHeaderWrite extends Http::HeaderWrite {
   AllowCredentialsHeaderWrite() { this.getHeaderName() = headerAllowCredentials() }
 }
 
diff --git a/go/ql/src/experimental/frameworks/CleverGo.qll b/go/ql/src/experimental/frameworks/CleverGo.qll
index c061c416b88..99d57a46189 100644
--- a/go/ql/src/experimental/frameworks/CleverGo.qll
+++ b/go/ql/src/experimental/frameworks/CleverGo.qll
@@ -174,7 +174,7 @@ private module CleverGo {
   /**
    * Models HTTP redirects.
    */
-  private class HttpRedirect extends HTTP::Redirect::Range, DataFlow::CallNode {
+  private class HttpRedirect extends Http::Redirect::Range, DataFlow::CallNode {
     string package;
     DataFlow::Node urlNode;
 
@@ -191,13 +191,13 @@ private module CleverGo {
 
     override DataFlow::Node getUrl() { result = urlNode }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = this.getReceiver() }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = this.getReceiver() }
   }
 
   /**
    * Models HTTP ResponseBody where the content-type is static and non-modifiable.
    */
-  private class HttpResponseBodyStaticContentType extends HTTP::ResponseBody::Range {
+  private class HttpResponseBodyStaticContentType extends Http::ResponseBody::Range {
     string contentTypeString;
     DataFlow::Node receiverNode;
 
@@ -209,7 +209,7 @@ private module CleverGo {
 
     override string getAContentType() { result = contentTypeString }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
   }
 
   // Holds for a call that sets the body; the content-type is implicitly set.
@@ -304,7 +304,7 @@ private module CleverGo {
   /**
    * Models HTTP ResponseBody where the content-type can be dynamically set by the caller.
    */
-  private class HttpResponseBodyDynamicContentType extends HTTP::ResponseBody::Range {
+  private class HttpResponseBodyDynamicContentType extends Http::ResponseBody::Range {
     DataFlow::Node contentTypeNode;
     DataFlow::Node receiverNode;
 
@@ -316,7 +316,7 @@ private module CleverGo {
 
     override DataFlow::Node getAContentTypeNode() { result = contentTypeNode }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
   }
 
   // Holds for a call that sets the body; the content-type is a parameter.
@@ -352,7 +352,7 @@ private module CleverGo {
   /**
    * Models HTTP ResponseBody where only the body is set.
    */
-  private class HttpResponseBodyNoContentType extends HTTP::ResponseBody::Range {
+  private class HttpResponseBodyNoContentType extends Http::ResponseBody::Range {
     DataFlow::Node receiverNode;
 
     HttpResponseBodyNoContentType() {
@@ -361,7 +361,7 @@ private module CleverGo {
       )
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
   }
 
   // Holds for a call that sets the body. The content-type is not defined.
@@ -394,7 +394,7 @@ private module CleverGo {
    * Models HTTP header writers.
    * The write is done with a call where you can set both the key and the value of the header.
    */
-  private class HeaderWrite extends HTTP::HeaderWrite::Range, DataFlow::CallNode {
+  private class HeaderWrite extends Http::HeaderWrite::Range, DataFlow::CallNode {
     DataFlow::Node receiverNode;
     DataFlow::Node headerNameNode;
     DataFlow::Node headerValueNode;
@@ -407,7 +407,7 @@ private module CleverGo {
 
     override DataFlow::Node getValue() { result = headerValueNode }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
   }
 
   // Holds for a call that sets a header with a key-value combination.
@@ -437,7 +437,7 @@ private module CleverGo {
   /**
    * Models an HTTP static content-type header setter.
    */
-  private class StaticContentTypeHeaderSetter extends HTTP::HeaderWrite::Range, DataFlow::CallNode {
+  private class StaticContentTypeHeaderSetter extends Http::HeaderWrite::Range, DataFlow::CallNode {
     DataFlow::Node receiverNode;
     string valueString;
 
@@ -453,7 +453,7 @@ private module CleverGo {
 
     override DataFlow::Node getValue() { none() }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
   }
 
   // Holds for a call that sets the content-type header (implicit).
@@ -494,7 +494,7 @@ private module CleverGo {
   /**
    * Models an HTTP dynamic content-type header setter.
    */
-  private class DynamicContentTypeHeaderSetter extends HTTP::HeaderWrite::Range, DataFlow::CallNode {
+  private class DynamicContentTypeHeaderSetter extends Http::HeaderWrite::Range, DataFlow::CallNode {
     DataFlow::Node receiverNode;
     DataFlow::Node valueNode;
 
@@ -508,7 +508,7 @@ private module CleverGo {
 
     override DataFlow::Node getValue() { result = valueNode }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
   }
 
   // Holds for a call that sets the content-type header via a parameter.
diff --git a/go/ql/src/experimental/frameworks/Fiber.qll b/go/ql/src/experimental/frameworks/Fiber.qll
index a3240a0b85a..3a7e71e204e 100644
--- a/go/ql/src/experimental/frameworks/Fiber.qll
+++ b/go/ql/src/experimental/frameworks/Fiber.qll
@@ -129,7 +129,7 @@ private module Fiber {
   /**
    * Models HTTP redirects.
    */
-  private class Redirect extends HTTP::Redirect::Range, DataFlow::CallNode {
+  private class Redirect extends Http::Redirect::Range, DataFlow::CallNode {
     string package;
     DataFlow::Node urlNode;
 
@@ -146,14 +146,14 @@ private module Fiber {
 
     override DataFlow::Node getUrl() { result = urlNode }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = this.getReceiver() }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = this.getReceiver() }
   }
 
   /**
    * Models HTTP header writers.
    * The write is done with a call where you can set both the key and the value of the header.
    */
-  private class HeaderWrite extends HTTP::HeaderWrite::Range, DataFlow::CallNode {
+  private class HeaderWrite extends Http::HeaderWrite::Range, DataFlow::CallNode {
     DataFlow::Node receiverNode;
     DataFlow::Node headerNameNode;
     DataFlow::Node headerValueNode;
@@ -166,7 +166,7 @@ private module Fiber {
 
     override DataFlow::Node getValue() { result = headerValueNode }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
   }
 
   // Holds for a call that sets a header with a key-value combination.
@@ -201,7 +201,7 @@ private module Fiber {
   /**
    * Models HTTP ResponseBody where the content-type is static and non-modifiable.
    */
-  private class ResponseBodyStaticContentType extends HTTP::ResponseBody::Range {
+  private class ResponseBodyStaticContentType extends Http::ResponseBody::Range {
     string contentTypeString;
     DataFlow::Node receiverNode;
 
@@ -213,7 +213,7 @@ private module Fiber {
 
     override string getAContentType() { result = contentTypeString }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
   }
 
   // Holds for a call that sets the body; the content-type is implicitly set.
@@ -248,7 +248,7 @@ private module Fiber {
   /**
    * Models HTTP ResponseBody where only the body is set.
    */
-  private class ResponseBodyNoContentType extends HTTP::ResponseBody::Range {
+  private class ResponseBodyNoContentType extends Http::ResponseBody::Range {
     DataFlow::Node receiverNode;
 
     ResponseBodyNoContentType() {
@@ -257,7 +257,7 @@ private module Fiber {
       )
     }
 
-    override HTTP::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
+    override Http::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
   }
 
   // Holds for a call that sets the body. The content-type is not defined.
diff --git a/go/ql/test/experimental/frameworks/CleverGo/HeaderWrite.ql b/go/ql/test/experimental/frameworks/CleverGo/HeaderWrite.ql
index 3f33ae98248..20dc73705a8 100644
--- a/go/ql/test/experimental/frameworks/CleverGo/HeaderWrite.ql
+++ b/go/ql/test/experimental/frameworks/CleverGo/HeaderWrite.ql
@@ -11,7 +11,7 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     // Dynamic key-value header:
-    exists(HTTP::HeaderWrite hw |
+    exists(Http::HeaderWrite hw |
       hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       (
@@ -26,7 +26,7 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
     )
     or
     // Static key, dynamic value header:
-    exists(HTTP::HeaderWrite hw |
+    exists(Http::HeaderWrite hw |
       hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       (
@@ -41,7 +41,7 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
     )
     or
     // Static key, static value header:
-    exists(HTTP::HeaderWrite hw |
+    exists(Http::HeaderWrite hw |
       hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       (
diff --git a/go/ql/test/experimental/frameworks/CleverGo/HttpRedirect.ql b/go/ql/test/experimental/frameworks/CleverGo/HttpRedirect.ql
index 5ceb813cec9..4b7bcb7823c 100644
--- a/go/ql/test/experimental/frameworks/CleverGo/HttpRedirect.ql
+++ b/go/ql/test/experimental/frameworks/CleverGo/HttpRedirect.ql
@@ -9,7 +9,7 @@ class HttpRedirectTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     tag = "redirectUrl" and
-    exists(HTTP::Redirect rd |
+    exists(Http::Redirect rd |
       rd.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       element = rd.getUrl().toString() and
diff --git a/go/ql/test/experimental/frameworks/CleverGo/HttpResponseBody.ql b/go/ql/test/experimental/frameworks/CleverGo/HttpResponseBody.ql
index 33c3f94ec07..a2b3dc62167 100644
--- a/go/ql/test/experimental/frameworks/CleverGo/HttpResponseBody.ql
+++ b/go/ql/test/experimental/frameworks/CleverGo/HttpResponseBody.ql
@@ -8,7 +8,7 @@ class HttpResponseBodyTest extends InlineExpectationsTest {
   override string getARelevantTag() { result = ["contentType", "responseBody"] }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(HTTP::ResponseBody rd |
+    exists(Http::ResponseBody rd |
       rd.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       (
diff --git a/go/ql/test/experimental/frameworks/Fiber/HeaderWrite.ql b/go/ql/test/experimental/frameworks/Fiber/HeaderWrite.ql
index d83883f45a7..0130172e7d0 100644
--- a/go/ql/test/experimental/frameworks/Fiber/HeaderWrite.ql
+++ b/go/ql/test/experimental/frameworks/Fiber/HeaderWrite.ql
@@ -11,7 +11,7 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     // Dynamic key-value header:
-    exists(HTTP::HeaderWrite hw |
+    exists(Http::HeaderWrite hw |
       hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       (
@@ -26,7 +26,7 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
     )
     or
     // Static key, dynamic value header:
-    exists(HTTP::HeaderWrite hw |
+    exists(Http::HeaderWrite hw |
       hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       (
@@ -41,7 +41,7 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
     )
     or
     // Static key, static value header:
-    exists(HTTP::HeaderWrite hw |
+    exists(Http::HeaderWrite hw |
       hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       (
diff --git a/go/ql/test/experimental/frameworks/Fiber/Redirect.ql b/go/ql/test/experimental/frameworks/Fiber/Redirect.ql
index 68d5bee465c..37bb0f97bfb 100644
--- a/go/ql/test/experimental/frameworks/Fiber/Redirect.ql
+++ b/go/ql/test/experimental/frameworks/Fiber/Redirect.ql
@@ -9,7 +9,7 @@ class HttpRedirectTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     tag = "redirectUrl" and
-    exists(HTTP::Redirect rd |
+    exists(Http::Redirect rd |
       rd.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       element = rd.getUrl().toString() and
diff --git a/go/ql/test/experimental/frameworks/Fiber/ResponseBody.ql b/go/ql/test/experimental/frameworks/Fiber/ResponseBody.ql
index 4361b2fda6a..74a9008749d 100644
--- a/go/ql/test/experimental/frameworks/Fiber/ResponseBody.ql
+++ b/go/ql/test/experimental/frameworks/Fiber/ResponseBody.ql
@@ -8,7 +8,7 @@ class HttpResponseBodyTest extends InlineExpectationsTest {
   override string getARelevantTag() { result = ["contentType", "responseBody"] }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(HTTP::ResponseBody rd |
+    exists(Http::ResponseBody rd |
       rd.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       (
diff --git a/go/ql/test/library-tests/semmle/go/concepts/HTTP/Handler.ql b/go/ql/test/library-tests/semmle/go/concepts/HTTP/Handler.ql
index e0b0acd426b..c6972eba275 100644
--- a/go/ql/test/library-tests/semmle/go/concepts/HTTP/Handler.ql
+++ b/go/ql/test/library-tests/semmle/go/concepts/HTTP/Handler.ql
@@ -8,7 +8,7 @@ class HttpHandler extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     tag = "handler" and
-    exists(HTTP::RequestHandler h, DataFlow::Node check |
+    exists(Http::RequestHandler h, DataFlow::Node check |
       element = h.toString() and value = check.toString()
     |
       h.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
diff --git a/go/ql/test/library-tests/semmle/go/concepts/HTTP/Header.ql b/go/ql/test/library-tests/semmle/go/concepts/HTTP/Header.ql
index e5449bf3e53..0ec82e5ad89 100644
--- a/go/ql/test/library-tests/semmle/go/concepts/HTTP/Header.ql
+++ b/go/ql/test/library-tests/semmle/go/concepts/HTTP/Header.ql
@@ -1,6 +1,6 @@
 import go
 
-from HTTP::HeaderWrite headerWrite, string name, string value, string definedName, string definedVal
+from Http::HeaderWrite headerWrite, string name, string value, string definedName, string definedVal
 where
   (
     name = headerWrite.getName().toString()
diff --git a/go/ql/test/library-tests/semmle/go/concepts/HTTP/RequestBody.ql b/go/ql/test/library-tests/semmle/go/concepts/HTTP/RequestBody.ql
index d49b7e95bb4..90d58b2db8d 100644
--- a/go/ql/test/library-tests/semmle/go/concepts/HTTP/RequestBody.ql
+++ b/go/ql/test/library-tests/semmle/go/concepts/HTTP/RequestBody.ql
@@ -1,4 +1,4 @@
 import go
 
-from HTTP::RequestBody rb
+from Http::RequestBody rb
 select rb
diff --git a/go/ql/test/library-tests/semmle/go/concepts/HTTP/ResponseBody.ql b/go/ql/test/library-tests/semmle/go/concepts/HTTP/ResponseBody.ql
index d8d89b7f5bb..80394628bfc 100644
--- a/go/ql/test/library-tests/semmle/go/concepts/HTTP/ResponseBody.ql
+++ b/go/ql/test/library-tests/semmle/go/concepts/HTTP/ResponseBody.ql
@@ -1,4 +1,4 @@
 import go
 
-from HTTP::ResponseBody rb
+from Http::ResponseBody rb
 select rb
diff --git a/go/ql/test/library-tests/semmle/go/frameworks/Beego/TaintedPath.expected b/go/ql/test/library-tests/semmle/go/frameworks/Beego/TaintedPath.expected
index c9f9651cdad..1ebdc8c4797 100644
--- a/go/ql/test/library-tests/semmle/go/frameworks/Beego/TaintedPath.expected
+++ b/go/ql/test/library-tests/semmle/go/frameworks/Beego/TaintedPath.expected
@@ -9,6 +9,6 @@ nodes
 | test.go:211:35:211:43 | untrusted | semmle.label | untrusted |
 subpaths
 #select
-| test.go:209:18:209:26 | untrusted | test.go:208:15:208:26 | call to Data : map type | test.go:209:18:209:26 | untrusted | This path depends on $@. | test.go:208:15:208:26 | call to Data | a user-provided value |
-| test.go:210:10:210:18 | untrusted | test.go:208:15:208:26 | call to Data : map type | test.go:210:10:210:18 | untrusted | This path depends on $@. | test.go:208:15:208:26 | call to Data | a user-provided value |
-| test.go:211:35:211:43 | untrusted | test.go:208:15:208:26 | call to Data : map type | test.go:211:35:211:43 | untrusted | This path depends on $@. | test.go:208:15:208:26 | call to Data | a user-provided value |
+| test.go:209:18:209:26 | untrusted | test.go:208:15:208:26 | call to Data : map type | test.go:209:18:209:26 | untrusted | $@ flows to here and is used in a path. | test.go:208:15:208:26 | call to Data | User-provided value |
+| test.go:210:10:210:18 | untrusted | test.go:208:15:208:26 | call to Data : map type | test.go:210:10:210:18 | untrusted | $@ flows to here and is used in a path. | test.go:208:15:208:26 | call to Data | User-provided value |
+| test.go:211:35:211:43 | untrusted | test.go:208:15:208:26 | call to Data : map type | test.go:211:35:211:43 | untrusted | $@ flows to here and is used in a path. | test.go:208:15:208:26 | call to Data | User-provided value |
diff --git a/go/ql/test/library-tests/semmle/go/frameworks/ElazarlGoproxy/test.ql b/go/ql/test/library-tests/semmle/go/frameworks/ElazarlGoproxy/test.ql
index 106d28b48f5..0b07a0a20f0 100644
--- a/go/ql/test/library-tests/semmle/go/frameworks/ElazarlGoproxy/test.ql
+++ b/go/ql/test/library-tests/semmle/go/frameworks/ElazarlGoproxy/test.ql
@@ -23,7 +23,7 @@ class HeaderWriteTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     tag = "headerwrite" and
-    exists(HTTP::HeaderWrite hw, string name, string val | element = hw.toString() |
+    exists(Http::HeaderWrite hw, string name, string val | element = hw.toString() |
       hw.definesHeader(name, val) and
       value = name + ":" + val and
       hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
diff --git a/go/ql/test/library-tests/semmle/go/frameworks/Macaron/Redirect.ql b/go/ql/test/library-tests/semmle/go/frameworks/Macaron/Redirect.ql
index 813ad53f2e0..c73e0dac04c 100644
--- a/go/ql/test/library-tests/semmle/go/frameworks/Macaron/Redirect.ql
+++ b/go/ql/test/library-tests/semmle/go/frameworks/Macaron/Redirect.ql
@@ -1,4 +1,4 @@
 import go
 
-from HTTP::Redirect redir
+from Http::Redirect redir
 select redir, redir.getResponseWriter()
diff --git a/go/ql/test/library-tests/semmle/go/frameworks/Revel/TaintedPath.expected b/go/ql/test/library-tests/semmle/go/frameworks/Revel/TaintedPath.expected
index c9f7cc5623f..1a066ff92d4 100644
--- a/go/ql/test/library-tests/semmle/go/frameworks/Revel/TaintedPath.expected
+++ b/go/ql/test/library-tests/semmle/go/frameworks/Revel/TaintedPath.expected
@@ -20,5 +20,5 @@ nodes
 | EndToEnd.go:64:26:64:55 | call to Get | semmle.label | call to Get |
 subpaths
 #select
-| EndToEnd.go:58:18:58:47 | call to Get | EndToEnd.go:58:18:58:25 | selection of Params : pointer type | EndToEnd.go:58:18:58:47 | call to Get | This path depends on $@. | EndToEnd.go:58:18:58:25 | selection of Params | a user-provided value |
-| EndToEnd.go:64:26:64:55 | call to Get | EndToEnd.go:64:26:64:33 | selection of Params : pointer type | EndToEnd.go:64:26:64:55 | call to Get | This path depends on $@. | EndToEnd.go:64:26:64:33 | selection of Params | a user-provided value |
+| EndToEnd.go:58:18:58:47 | call to Get | EndToEnd.go:58:18:58:25 | selection of Params : pointer type | EndToEnd.go:58:18:58:47 | call to Get | $@ flows to here and is used in a path. | EndToEnd.go:58:18:58:25 | selection of Params | User-provided value |
+| EndToEnd.go:64:26:64:55 | call to Get | EndToEnd.go:64:26:64:33 | selection of Params : pointer type | EndToEnd.go:64:26:64:55 | call to Get | $@ flows to here and is used in a path. | EndToEnd.go:64:26:64:33 | selection of Params | User-provided value |
diff --git a/go/ql/test/library-tests/semmle/go/frameworks/Revel/test.ql b/go/ql/test/library-tests/semmle/go/frameworks/Revel/test.ql
index e3d2cd16be4..9d2b876d803 100644
--- a/go/ql/test/library-tests/semmle/go/frameworks/Revel/test.ql
+++ b/go/ql/test/library-tests/semmle/go/frameworks/Revel/test.ql
@@ -39,7 +39,7 @@ class HttpResponseBodyTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     tag = "responsebody" and
-    exists(HTTP::ResponseBody rb |
+    exists(Http::ResponseBody rb |
       rb.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
         location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
       element = rb.toString() and
diff --git a/go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected b/go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
index 430cd9e64b7..8bd09ca706f 100644
--- a/go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
+++ b/go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
@@ -14,6 +14,6 @@ nodes
 | tst.go:17:41:17:56 | selection of Filename | semmle.label | selection of Filename |
 subpaths
 #select
-| TaintedPath.go:16:29:16:40 | tainted_path | TaintedPath.go:13:18:13:22 | selection of URL : pointer type | TaintedPath.go:16:29:16:40 | tainted_path | This path depends on $@. | TaintedPath.go:13:18:13:22 | selection of URL | a user-provided value |
-| TaintedPath.go:20:28:20:69 | call to Join | TaintedPath.go:13:18:13:22 | selection of URL : pointer type | TaintedPath.go:20:28:20:69 | call to Join | This path depends on $@. | TaintedPath.go:13:18:13:22 | selection of URL | a user-provided value |
-| tst.go:17:41:17:56 | selection of Filename | tst.go:14:2:14:39 | ... := ...[1] : pointer type | tst.go:17:41:17:56 | selection of Filename | This path depends on $@. | tst.go:14:2:14:39 | ... := ...[1] | a user-provided value |
+| TaintedPath.go:16:29:16:40 | tainted_path | TaintedPath.go:13:18:13:22 | selection of URL : pointer type | TaintedPath.go:16:29:16:40 | tainted_path | $@ flows to here and is used in a path. | TaintedPath.go:13:18:13:22 | selection of URL | User-provided value |
+| TaintedPath.go:20:28:20:69 | call to Join | TaintedPath.go:13:18:13:22 | selection of URL : pointer type | TaintedPath.go:20:28:20:69 | call to Join | $@ flows to here and is used in a path. | TaintedPath.go:13:18:13:22 | selection of URL | User-provided value |
+| tst.go:17:41:17:56 | selection of Filename | tst.go:14:2:14:39 | ... := ...[1] : pointer type | tst.go:17:41:17:56 | selection of Filename | $@ flows to here and is used in a path. | tst.go:14:2:14:39 | ... := ...[1] | User-provided value |
diff --git a/go/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected b/go/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
index 1826338206a..8ef001d1a29 100644
--- a/go/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
+++ b/go/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
@@ -5,4 +5,4 @@ nodes
 | test.go:17:10:17:12 | buf | semmle.label | buf |
 subpaths
 #select
-| test.go:14:2:14:4 | definition of buf | test.go:14:2:14:4 | definition of buf : slice type | test.go:17:10:17:12 | buf | This stack trace is exposed to a remote user $@. | test.go:17:10:17:12 | buf | here |
+| test.go:17:10:17:12 | buf | test.go:14:2:14:4 | definition of buf : slice type | test.go:17:10:17:12 | buf | Stack trace information from $@ may be exposed to an external user here. | test.go:14:2:14:4 | definition of buf | here |
diff --git a/go/ql/test/query-tests/Security/CWE-643/XPathInjection.expected b/go/ql/test/query-tests/Security/CWE-643/XPathInjection.expected
index 27215cbdc65..42c6f9cda2a 100644
--- a/go/ql/test/query-tests/Security/CWE-643/XPathInjection.expected
+++ b/go/ql/test/query-tests/Security/CWE-643/XPathInjection.expected
@@ -85,43 +85,43 @@ nodes
 | tst.go:180:27:180:122 | ...+... | semmle.label | ...+... |
 subpaths
 #select
-| XPathInjection.go:16:29:16:91 | ...+... | XPathInjection.go:13:14:13:19 | selection of Form : Values | XPathInjection.go:16:29:16:91 | ...+... | $@ flows here and is used in an XPath expression. | XPathInjection.go:13:14:13:19 | selection of Form | A user-provided value |
-| tst.go:35:23:35:85 | ...+... | tst.go:32:14:32:19 | selection of Form : Values | tst.go:35:23:35:85 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:32:14:32:19 | selection of Form | A user-provided value |
-| tst.go:38:24:38:86 | ...+... | tst.go:32:14:32:19 | selection of Form : Values | tst.go:38:24:38:86 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:32:14:32:19 | selection of Form | A user-provided value |
-| tst.go:41:24:41:82 | ...+... | tst.go:32:14:32:19 | selection of Form : Values | tst.go:41:24:41:82 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:32:14:32:19 | selection of Form | A user-provided value |
-| tst.go:49:26:49:84 | ...+... | tst.go:46:14:46:19 | selection of Form : Values | tst.go:49:26:49:84 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:46:14:46:19 | selection of Form | A user-provided value |
-| tst.go:52:29:52:87 | ...+... | tst.go:46:14:46:19 | selection of Form : Values | tst.go:52:29:52:87 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:46:14:46:19 | selection of Form | A user-provided value |
-| tst.go:55:33:55:91 | ...+... | tst.go:46:14:46:19 | selection of Form : Values | tst.go:55:33:55:91 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:46:14:46:19 | selection of Form | A user-provided value |
-| tst.go:58:30:58:88 | ...+... | tst.go:46:14:46:19 | selection of Form : Values | tst.go:58:30:58:88 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:46:14:46:19 | selection of Form | A user-provided value |
-| tst.go:66:25:66:83 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:66:25:66:83 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | A user-provided value |
-| tst.go:69:28:69:86 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:69:28:69:86 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | A user-provided value |
-| tst.go:72:25:72:83 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:72:25:72:83 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | A user-provided value |
-| tst.go:75:34:75:92 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:75:34:75:92 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | A user-provided value |
-| tst.go:78:32:78:90 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:78:32:78:90 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | A user-provided value |
-| tst.go:81:29:81:87 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:81:29:81:87 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | A user-provided value |
-| tst.go:84:23:84:85 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:84:23:84:85 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | A user-provided value |
-| tst.go:87:22:87:84 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:87:22:87:84 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | A user-provided value |
-| tst.go:95:26:95:84 | ...+... | tst.go:92:14:92:19 | selection of Form : Values | tst.go:95:26:95:84 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:92:14:92:19 | selection of Form | A user-provided value |
-| tst.go:98:29:98:87 | ...+... | tst.go:92:14:92:19 | selection of Form : Values | tst.go:98:29:98:87 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:92:14:92:19 | selection of Form | A user-provided value |
-| tst.go:101:33:101:91 | ...+... | tst.go:92:14:92:19 | selection of Form : Values | tst.go:101:33:101:91 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:92:14:92:19 | selection of Form | A user-provided value |
-| tst.go:104:30:104:88 | ...+... | tst.go:92:14:92:19 | selection of Form : Values | tst.go:104:30:104:88 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:92:14:92:19 | selection of Form | A user-provided value |
-| tst.go:112:25:112:87 | ...+... | tst.go:109:14:109:19 | selection of Form : Values | tst.go:112:25:112:87 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:109:14:109:19 | selection of Form | A user-provided value |
-| tst.go:115:26:115:88 | ...+... | tst.go:109:14:109:19 | selection of Form : Values | tst.go:115:26:115:88 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:109:14:109:19 | selection of Form | A user-provided value |
-| tst.go:124:23:124:126 | ...+... | tst.go:120:14:120:19 | selection of Form : Values | tst.go:124:23:124:126 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:120:14:120:19 | selection of Form | A user-provided value |
-| tst.go:124:23:124:126 | ...+... | tst.go:121:14:121:19 | selection of Form : Values | tst.go:124:23:124:126 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:121:14:121:19 | selection of Form | A user-provided value |
-| tst.go:127:24:127:127 | ...+... | tst.go:120:14:120:19 | selection of Form : Values | tst.go:127:24:127:127 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:120:14:120:19 | selection of Form | A user-provided value |
-| tst.go:127:24:127:127 | ...+... | tst.go:121:14:121:19 | selection of Form : Values | tst.go:127:24:127:127 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:121:14:121:19 | selection of Form | A user-provided value |
-| tst.go:130:27:130:122 | ...+... | tst.go:120:14:120:19 | selection of Form : Values | tst.go:130:27:130:122 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:120:14:120:19 | selection of Form | A user-provided value |
-| tst.go:130:27:130:122 | ...+... | tst.go:121:14:121:19 | selection of Form : Values | tst.go:130:27:130:122 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:121:14:121:19 | selection of Form | A user-provided value |
-| tst.go:141:27:141:89 | ...+... | tst.go:138:14:138:19 | selection of Form : Values | tst.go:141:27:141:89 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:138:14:138:19 | selection of Form | A user-provided value |
-| tst.go:144:28:144:90 | ...+... | tst.go:138:14:138:19 | selection of Form : Values | tst.go:144:28:144:90 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:138:14:138:19 | selection of Form | A user-provided value |
-| tst.go:153:33:153:136 | ...+... | tst.go:149:14:149:19 | selection of Form : Values | tst.go:153:33:153:136 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:149:14:149:19 | selection of Form | A user-provided value |
-| tst.go:153:33:153:136 | ...+... | tst.go:150:14:150:19 | selection of Form : Values | tst.go:153:33:153:136 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:150:14:150:19 | selection of Form | A user-provided value |
-| tst.go:156:18:156:121 | ...+... | tst.go:149:14:149:19 | selection of Form : Values | tst.go:156:18:156:121 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:149:14:149:19 | selection of Form | A user-provided value |
-| tst.go:156:18:156:121 | ...+... | tst.go:150:14:150:19 | selection of Form : Values | tst.go:156:18:156:121 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:150:14:150:19 | selection of Form | A user-provided value |
-| tst.go:162:31:162:126 | ...+... | tst.go:149:14:149:19 | selection of Form : Values | tst.go:162:31:162:126 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:149:14:149:19 | selection of Form | A user-provided value |
-| tst.go:162:31:162:126 | ...+... | tst.go:150:14:150:19 | selection of Form : Values | tst.go:162:31:162:126 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:150:14:150:19 | selection of Form | A user-provided value |
-| tst.go:171:21:171:116 | ...+... | tst.go:149:14:149:19 | selection of Form : Values | tst.go:171:21:171:116 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:149:14:149:19 | selection of Form | A user-provided value |
-| tst.go:171:21:171:116 | ...+... | tst.go:150:14:150:19 | selection of Form : Values | tst.go:171:21:171:116 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:150:14:150:19 | selection of Form | A user-provided value |
-| tst.go:180:27:180:122 | ...+... | tst.go:149:14:149:19 | selection of Form : Values | tst.go:180:27:180:122 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:149:14:149:19 | selection of Form | A user-provided value |
-| tst.go:180:27:180:122 | ...+... | tst.go:150:14:150:19 | selection of Form : Values | tst.go:180:27:180:122 | ...+... | $@ flows here and is used in an XPath expression. | tst.go:150:14:150:19 | selection of Form | A user-provided value |
+| XPathInjection.go:16:29:16:91 | ...+... | XPathInjection.go:13:14:13:19 | selection of Form : Values | XPathInjection.go:16:29:16:91 | ...+... | $@ flows to here and is used in an XPath expression. | XPathInjection.go:13:14:13:19 | selection of Form | User-provided value |
+| tst.go:35:23:35:85 | ...+... | tst.go:32:14:32:19 | selection of Form : Values | tst.go:35:23:35:85 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:32:14:32:19 | selection of Form | User-provided value |
+| tst.go:38:24:38:86 | ...+... | tst.go:32:14:32:19 | selection of Form : Values | tst.go:38:24:38:86 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:32:14:32:19 | selection of Form | User-provided value |
+| tst.go:41:24:41:82 | ...+... | tst.go:32:14:32:19 | selection of Form : Values | tst.go:41:24:41:82 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:32:14:32:19 | selection of Form | User-provided value |
+| tst.go:49:26:49:84 | ...+... | tst.go:46:14:46:19 | selection of Form : Values | tst.go:49:26:49:84 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:46:14:46:19 | selection of Form | User-provided value |
+| tst.go:52:29:52:87 | ...+... | tst.go:46:14:46:19 | selection of Form : Values | tst.go:52:29:52:87 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:46:14:46:19 | selection of Form | User-provided value |
+| tst.go:55:33:55:91 | ...+... | tst.go:46:14:46:19 | selection of Form : Values | tst.go:55:33:55:91 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:46:14:46:19 | selection of Form | User-provided value |
+| tst.go:58:30:58:88 | ...+... | tst.go:46:14:46:19 | selection of Form : Values | tst.go:58:30:58:88 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:46:14:46:19 | selection of Form | User-provided value |
+| tst.go:66:25:66:83 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:66:25:66:83 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | User-provided value |
+| tst.go:69:28:69:86 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:69:28:69:86 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | User-provided value |
+| tst.go:72:25:72:83 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:72:25:72:83 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | User-provided value |
+| tst.go:75:34:75:92 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:75:34:75:92 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | User-provided value |
+| tst.go:78:32:78:90 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:78:32:78:90 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | User-provided value |
+| tst.go:81:29:81:87 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:81:29:81:87 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | User-provided value |
+| tst.go:84:23:84:85 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:84:23:84:85 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | User-provided value |
+| tst.go:87:22:87:84 | ...+... | tst.go:63:14:63:19 | selection of Form : Values | tst.go:87:22:87:84 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:63:14:63:19 | selection of Form | User-provided value |
+| tst.go:95:26:95:84 | ...+... | tst.go:92:14:92:19 | selection of Form : Values | tst.go:95:26:95:84 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:92:14:92:19 | selection of Form | User-provided value |
+| tst.go:98:29:98:87 | ...+... | tst.go:92:14:92:19 | selection of Form : Values | tst.go:98:29:98:87 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:92:14:92:19 | selection of Form | User-provided value |
+| tst.go:101:33:101:91 | ...+... | tst.go:92:14:92:19 | selection of Form : Values | tst.go:101:33:101:91 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:92:14:92:19 | selection of Form | User-provided value |
+| tst.go:104:30:104:88 | ...+... | tst.go:92:14:92:19 | selection of Form : Values | tst.go:104:30:104:88 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:92:14:92:19 | selection of Form | User-provided value |
+| tst.go:112:25:112:87 | ...+... | tst.go:109:14:109:19 | selection of Form : Values | tst.go:112:25:112:87 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:109:14:109:19 | selection of Form | User-provided value |
+| tst.go:115:26:115:88 | ...+... | tst.go:109:14:109:19 | selection of Form : Values | tst.go:115:26:115:88 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:109:14:109:19 | selection of Form | User-provided value |
+| tst.go:124:23:124:126 | ...+... | tst.go:120:14:120:19 | selection of Form : Values | tst.go:124:23:124:126 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:120:14:120:19 | selection of Form | User-provided value |
+| tst.go:124:23:124:126 | ...+... | tst.go:121:14:121:19 | selection of Form : Values | tst.go:124:23:124:126 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:121:14:121:19 | selection of Form | User-provided value |
+| tst.go:127:24:127:127 | ...+... | tst.go:120:14:120:19 | selection of Form : Values | tst.go:127:24:127:127 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:120:14:120:19 | selection of Form | User-provided value |
+| tst.go:127:24:127:127 | ...+... | tst.go:121:14:121:19 | selection of Form : Values | tst.go:127:24:127:127 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:121:14:121:19 | selection of Form | User-provided value |
+| tst.go:130:27:130:122 | ...+... | tst.go:120:14:120:19 | selection of Form : Values | tst.go:130:27:130:122 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:120:14:120:19 | selection of Form | User-provided value |
+| tst.go:130:27:130:122 | ...+... | tst.go:121:14:121:19 | selection of Form : Values | tst.go:130:27:130:122 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:121:14:121:19 | selection of Form | User-provided value |
+| tst.go:141:27:141:89 | ...+... | tst.go:138:14:138:19 | selection of Form : Values | tst.go:141:27:141:89 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:138:14:138:19 | selection of Form | User-provided value |
+| tst.go:144:28:144:90 | ...+... | tst.go:138:14:138:19 | selection of Form : Values | tst.go:144:28:144:90 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:138:14:138:19 | selection of Form | User-provided value |
+| tst.go:153:33:153:136 | ...+... | tst.go:149:14:149:19 | selection of Form : Values | tst.go:153:33:153:136 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:149:14:149:19 | selection of Form | User-provided value |
+| tst.go:153:33:153:136 | ...+... | tst.go:150:14:150:19 | selection of Form : Values | tst.go:153:33:153:136 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:150:14:150:19 | selection of Form | User-provided value |
+| tst.go:156:18:156:121 | ...+... | tst.go:149:14:149:19 | selection of Form : Values | tst.go:156:18:156:121 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:149:14:149:19 | selection of Form | User-provided value |
+| tst.go:156:18:156:121 | ...+... | tst.go:150:14:150:19 | selection of Form : Values | tst.go:156:18:156:121 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:150:14:150:19 | selection of Form | User-provided value |
+| tst.go:162:31:162:126 | ...+... | tst.go:149:14:149:19 | selection of Form : Values | tst.go:162:31:162:126 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:149:14:149:19 | selection of Form | User-provided value |
+| tst.go:162:31:162:126 | ...+... | tst.go:150:14:150:19 | selection of Form : Values | tst.go:162:31:162:126 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:150:14:150:19 | selection of Form | User-provided value |
+| tst.go:171:21:171:116 | ...+... | tst.go:149:14:149:19 | selection of Form : Values | tst.go:171:21:171:116 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:149:14:149:19 | selection of Form | User-provided value |
+| tst.go:171:21:171:116 | ...+... | tst.go:150:14:150:19 | selection of Form : Values | tst.go:171:21:171:116 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:150:14:150:19 | selection of Form | User-provided value |
+| tst.go:180:27:180:122 | ...+... | tst.go:149:14:149:19 | selection of Form : Values | tst.go:180:27:180:122 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:149:14:149:19 | selection of Form | User-provided value |
+| tst.go:180:27:180:122 | ...+... | tst.go:150:14:150:19 | selection of Form : Values | tst.go:180:27:180:122 | ...+... | $@ flows to here and is used in an XPath expression. | tst.go:150:14:150:19 | selection of Form | User-provided value |
diff --git a/java/documentation/library-coverage/coverage.csv b/java/documentation/library-coverage/coverage.csv
index c40d5259ee4..029f1b41e91 100644
--- a/java/documentation/library-coverage/coverage.csv
+++ b/java/documentation/library-coverage/coverage.csv
@@ -1,12 +1,13 @@
 package,sink,source,summary,sink:bean-validation,sink:create-file,sink:groovy,sink:header-splitting,sink:information-leak,sink:intent-start,sink:jdbc-url,sink:jexl,sink:jndi-injection,sink:ldap,sink:logging,sink:mvel,sink:ognl-injection,sink:open-url,sink:pending-intent-sent,sink:regex-use[-1],sink:regex-use[0],sink:regex-use[],sink:regex-use[f-1],sink:regex-use[f1],sink:regex-use[f],sink:set-hostname-verifier,sink:sql,sink:url-open-stream,sink:url-redirect,sink:write-file,sink:xpath,sink:xslt,sink:xss,source:android-external-storage-dir,source:android-widget,source:contentprovider,source:remote,summary:taint,summary:value
-android.app,16,,103,,,,,,7,,,,,,,,,9,,,,,,,,,,,,,,,,,,,18,85
-android.content,24,31,108,,,,,,16,,,,,,,,,,,,,,,,,8,,,,,,,4,,27,,31,77
-android.database,59,,30,,,,,,,,,,,,,,,,,,,,,,,59,,,,,,,,,,,30,
+android.app,24,,103,,,,,,7,,,,,,,,,17,,,,,,,,,,,,,,,,,,,18,85
+android.content,24,31,154,,,,,,16,,,,,,,,,,,,,,,,,8,,,,,,,4,,27,,63,91
+android.database,59,,39,,,,,,,,,,,,,,,,,,,,,,,59,,,,,,,,,,,39,
 android.net,,,60,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,45,15
 android.os,,2,122,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,41,81
 android.util,6,16,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,16,,
 android.webkit,3,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,2,,
 android.widget,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,1,
+androidx.core.app,6,,95,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,12,83
 androidx.slice,2,5,88,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,5,,27,61
 cn.hutool.core.codec,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
 com.esotericsoftware.kryo.io,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
@@ -32,7 +33,7 @@ jakarta.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
 jakarta.ws.rs.core,2,,149,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,94,55
 java.beans,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
 java.io,37,,39,,15,,,,,,,,,,,,,,,,,,,,,,,,22,,,,,,,,39,
-java.lang,13,,58,,,,,,,,,,,8,,,,,4,,,1,,,,,,,,,,,,,,,46,12
+java.lang,13,,66,,,,,,,,,,,8,,,,,4,,,1,,,,,,,,,,,,,,,54,12
 java.net,10,3,7,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,3,7,
 java.nio,15,,11,,13,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,11,
 java.sql,11,,,,,,,,,4,,,,,,,,,,,,,,,,7,,,,,,,,,,,,
@@ -52,14 +53,14 @@ javax.ws.rs.core,3,,149,,,,1,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,94,55
 javax.xml.transform,1,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,6,
 javax.xml.xpath,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,
 jodd.json,,,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10
-kotlin.jvm.internal,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1
+kotlin,12,,1835,,10,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,1828,7
 net.sf.saxon.s9api,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,,,,,,,
 ognl,6,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,
 okhttp3,2,,47,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,22,25
 org.apache.commons.codec,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
 org.apache.commons.collections,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
 org.apache.commons.collections4,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
-org.apache.commons.io,104,,561,,89,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,547,14
+org.apache.commons.io,106,,556,,91,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,542,14
 org.apache.commons.jexl2,15,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,
 org.apache.commons.jexl3,15,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,
 org.apache.commons.lang3,,,424,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,293,131
@@ -91,6 +92,7 @@ org.springframework.beans,,,30,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,30
 org.springframework.boot.jdbc,1,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,
 org.springframework.cache,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13
 org.springframework.context,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
+org.springframework.data.repository,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1
 org.springframework.http,14,,70,,,,,,,,,,,,,,14,,,,,,,,,,,,,,,,,,,,60,10
 org.springframework.jdbc.core,10,,,,,,,,,,,,,,,,,,,,,,,,,10,,,,,,,,,,,,
 org.springframework.jdbc.datasource,4,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,
diff --git a/java/documentation/library-coverage/coverage.rst b/java/documentation/library-coverage/coverage.rst
index 2a9b297a550..a9b34147fbb 100644
--- a/java/documentation/library-coverage/coverage.rst
+++ b/java/documentation/library-coverage/coverage.rst
@@ -7,17 +7,17 @@ Java framework & library support
    :widths: auto
 
    Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE‑022` :sub:`Path injection`,`CWE‑036` :sub:`Path traversal`,`CWE‑079` :sub:`Cross-site scripting`,`CWE‑089` :sub:`SQL injection`,`CWE‑090` :sub:`LDAP injection`,`CWE‑094` :sub:`Code injection`,`CWE‑319` :sub:`Cleartext transmission`
-   Android,``android.*``,52,424,108,,,3,67,,,
+   Android,``android.*``,52,479,116,,,3,67,,,
    `Apache Commons Collections <https://commons.apache.org/proper/commons-collections/>`_,"``org.apache.commons.collections``, ``org.apache.commons.collections4``",,1600,,,,,,,,
-   `Apache Commons IO <https://commons.apache.org/proper/commons-io/>`_,``org.apache.commons.io``,,561,104,89,,,,,,15
+   `Apache Commons IO <https://commons.apache.org/proper/commons-io/>`_,``org.apache.commons.io``,,556,106,91,,,,,,15
    `Apache Commons Lang <https://commons.apache.org/proper/commons-lang/>`_,``org.apache.commons.lang3``,,424,,,,,,,,
    `Apache Commons Text <https://commons.apache.org/proper/commons-text/>`_,``org.apache.commons.text``,,272,,,,,,,,
    `Apache HttpComponents <https://hc.apache.org/>`_,"``org.apache.hc.core5.*``, ``org.apache.http``",5,136,28,,,3,,,,25
    `Google Guava <https://guava.dev/>`_,``com.google.common.*``,,728,39,,6,,,,,
    `JSON-java <https://github.com/stleary/JSON-java>`_,``org.json``,,236,,,,,,,,
-   Java Standard Library,``java.*``,3,577,130,28,,,7,,,10
+   Java Standard Library,``java.*``,3,585,130,28,,,7,,,10
    Java extensions,"``javax.*``, ``jakarta.*``",63,609,32,,,4,,1,1,2
-   `Spring <https://spring.io/>`_,``org.springframework.*``,29,476,101,,,,19,14,,29
-   Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.rabbitmq.client``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``kotlin.jvm.internal``, ``net.sf.saxon.s9api``, ``ognl``, ``okhttp3``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``retrofit2``",65,395,932,,,,14,18,,3
-   Totals,,217,6438,1474,117,6,10,107,33,1,84
+   `Spring <https://spring.io/>`_,``org.springframework.*``,29,477,101,,,,19,14,,29
+   Others,"``androidx.core.app``, ``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.rabbitmq.client``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``kotlin``, ``net.sf.saxon.s9api``, ``ognl``, ``okhttp3``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``retrofit2``",65,2324,950,10,,,14,18,,5
+   Totals,,217,8426,1502,129,6,10,107,33,1,86
 
diff --git a/java/kotlin-extractor/build.py b/java/kotlin-extractor/build.py
index 3f14eb0b28e..a4da1a2ea23 100755
--- a/java/kotlin-extractor/build.py
+++ b/java/kotlin-extractor/build.py
@@ -86,7 +86,8 @@ def compile_to_dir(srcs, classpath, java_classpath, output):
     run_process([kotlinc,
                  # kotlinc can default to 256M, which isn't enough when we are extracting the build
                  '-J-Xmx2G',
-                 '-Xopt-in=kotlin.RequiresOptIn',
+                 '-Werror',
+                 '-opt-in=kotlin.RequiresOptIn',
                  '-d', output,
                  '-module-name', 'codeql-kotlin-extractor',
                  '-no-reflect', '-no-stdlib',
diff --git a/java/kotlin-extractor/generate_dbscheme.py b/java/kotlin-extractor/generate_dbscheme.py
index 9e517505469..fb891fb105c 100755
--- a/java/kotlin-extractor/generate_dbscheme.py
+++ b/java/kotlin-extractor/generate_dbscheme.py
@@ -171,13 +171,12 @@ with open('src/main/kotlin/KotlinExtractorDbScheme.kt', 'w') as kt:
             for num, typ in mapping:
                 genTable(kt, relname, columns, enum, kind, num, typ)
 
+    kt.write('sealed interface AnyDbType\n')
     for typ in sorted(supertypes):
-        kt.write('sealed interface Db' + upperFirst(typ))
+        kt.write('sealed interface Db' + upperFirst(typ) + ': AnyDbType')
         # Sorting makes the output deterministic.
         names = sorted(supertypes[typ])
-        if names:
-            kt.write(': ')
-            kt.write(', '.join(map(lambda name: 'Db' + upperFirst(name), names)))
+        kt.write(''.join(map(lambda name: ', Db' + upperFirst(name), names)))
         kt.write('\n')
     for alias in sorted(type_aliases):
         kt.write('typealias Db' + upperFirst(alias) + ' = Db' + upperFirst(type_aliases[alias]) + '\n')
diff --git a/java/kotlin-extractor/src/main/java/com/semmle/extractor/java/OdasaOutput.java b/java/kotlin-extractor/src/main/java/com/semmle/extractor/java/OdasaOutput.java
index 73dc090f69b..22fcbdf0011 100644
--- a/java/kotlin-extractor/src/main/java/com/semmle/extractor/java/OdasaOutput.java
+++ b/java/kotlin-extractor/src/main/java/com/semmle/extractor/java/OdasaOutput.java
@@ -255,17 +255,6 @@ public class OdasaOutput {
 	 * Trap writers.
 	 */
 
-	/**
-	 * A {@link TrapFileManager} to output facts for the given source file,
-	 * or <code>null</code> if the source file should not be populated.
-	 */
-	private TrapFileManager getTrapWriterForCurrentSourceFile() {
-		File trapFile = getTrapFileForCurrentSourceFile();
-		if (trapFile==null)
-			return null;
-		return trapWriter(trapFile, null, null);
-	}
-
 	/**
 	 * Get a {@link TrapFileManager} to write members
 	 * about a declaration, or <code>null</code> if the declaration shouldn't be populated.
diff --git a/java/kotlin-extractor/src/main/kotlin/KotlinExtractorExtension.kt b/java/kotlin-extractor/src/main/kotlin/KotlinExtractorExtension.kt
index d6f25d73efa..3b58400eca5 100644
--- a/java/kotlin-extractor/src/main/kotlin/KotlinExtractorExtension.kt
+++ b/java/kotlin-extractor/src/main/kotlin/KotlinExtractorExtension.kt
@@ -354,7 +354,12 @@ private fun getTrapFileWriter(compression: Compression, logger: FileLogger, trap
     return when (compression) {
         Compression.NONE -> NonCompressedTrapFileWriter(logger, trapFileName)
         Compression.GZIP -> GZipCompressedTrapFileWriter(logger, trapFileName)
-        Compression.BROTLI -> throw Exception("Brotli compression is not supported by the Kotlin extractor")
+        Compression.BROTLI -> {
+            // Brotli should have been replaced with gzip earlier, but
+            // if we somehow manage to get here then keep going
+            logger.error("Impossible Brotli compression requested. Using Gzip instead.")
+            getTrapFileWriter(Compression.GZIP, logger, trapFileName)
+        }
     }
 }
 
diff --git a/java/kotlin-extractor/src/main/kotlin/KotlinFileExtractor.kt b/java/kotlin-extractor/src/main/kotlin/KotlinFileExtractor.kt
index 30a5f7380bd..45636455806 100644
--- a/java/kotlin-extractor/src/main/kotlin/KotlinFileExtractor.kt
+++ b/java/kotlin-extractor/src/main/kotlin/KotlinFileExtractor.kt
@@ -83,8 +83,12 @@ open class KotlinFileExtractor(
             }
 
             file.declarations.forEach { extractDeclaration(it, extractPrivateMembers = true, extractFunctionBodies = true) }
-            extractStaticInitializer(file, null)
+            extractStaticInitializer(file, { extractFileClass(file) })
             CommentExtractor(this, file, tw.fileId).extract()
+
+            if (!declarationStack.isEmpty()) {
+                logger.errorElement("Declaration stack is not empty after processing the file", file)
+            }
         }
     }
 
@@ -159,31 +163,6 @@ open class KotlinFileExtractor(
         }
     }
 
-
-
-    fun getLabel(element: IrElement) : String? {
-        when (element) {
-            is IrClass -> return getClassLabel(element, listOf()).classLabel
-            is IrTypeParameter -> return getTypeParameterLabel(element)
-            is IrFunction -> return getFunctionLabel(element, null)
-            is IrValueParameter -> return getValueParameterLabel(element, null)
-            is IrProperty -> return getPropertyLabel(element)
-            is IrField -> return getFieldLabel(element)
-            is IrEnumEntry -> return getEnumEntryLabel(element)
-            is IrTypeAlias -> return getTypeAliasLabel(element)
-
-            // Fresh entities:
-            is IrBody -> return null
-            is IrExpression -> return null
-
-            // todo add others:
-            else -> {
-                logger.errorElement("Unhandled element type: ${element::class}", element)
-                return null
-            }
-        }
-    }
-
     private fun extractTypeParameter(tp: IrTypeParameter, apparentIndex: Int, javaTypeParameter: JavaTypeParameter?): Label<out DbTypevariable>? {
         with("type parameter", tp) {
             val parentId = getTypeParameterParentLabel(tp) ?: return null
@@ -331,7 +310,7 @@ open class KotlinFileExtractor(
                 }
             }.firstOrNull { it != null } ?: false)
 
-            extractEnclosingClass(c, id, locId, if (useBoundOuterType) argsIncludingOuterClasses?.drop(c.typeParameters.size) else listOf())
+            extractEnclosingClass(c.parent, id, c, locId, if (useBoundOuterType) argsIncludingOuterClasses?.drop(c.typeParameters.size) else listOf())
 
             return id
         }
@@ -414,11 +393,7 @@ open class KotlinFileExtractor(
         with("class source", c) {
             DeclarationStackAdjuster(c).use {
 
-                val id = if (c.isAnonymousObject) {
-                    useAnonymousClass(c).javaResult.id.cast<DbClass>()
-                } else {
-                    useClassSource(c)
-                }
+                val id = useClassSource(c)
                 val pkg = c.packageFqName?.asString() ?: ""
                 val cls = if (c.isAnonymousObject) "" else c.name.asString()
                 val pkgId = extractPackage(pkg)
@@ -444,7 +419,7 @@ open class KotlinFileExtractor(
                 val locId = tw.getLocation(c)
                 tw.writeHasLocation(id, locId)
 
-                extractEnclosingClass(c, id, locId, listOf())
+                extractEnclosingClass(c.parent, id, c, locId, listOf())
 
                 val javaClass = (c.source as? JavaSourceElement)?.javaElement as? JavaClass
 
@@ -452,7 +427,7 @@ open class KotlinFileExtractor(
                 if (extractDeclarations) {
                     c.declarations.forEach { extractDeclaration(it, extractPrivateMembers = extractPrivateMembers, extractFunctionBodies = extractFunctionBodies) }
                     if (extractStaticInitializer)
-                        extractStaticInitializer(c, id)
+                        extractStaticInitializer(c, { id })
                     extractJvmStaticProxyMethods(c, id, extractPrivateMembers, extractFunctionBodies)
                 }
                 if (c.isNonCompanionObject) {
@@ -551,10 +526,21 @@ open class KotlinFileExtractor(
         }
     }
 
-    // If `parentClassTypeArguments` is null, the parent class is a raw type.
-    private fun extractEnclosingClass(innerDeclaration: IrDeclaration, innerId: Label<out DbClassorinterface>, innerLocId: Label<DbLocation>, parentClassTypeArguments: List<IrTypeArgument>?) {
-        with("enclosing class", innerDeclaration) {
-            var parent: IrDeclarationParent? = innerDeclaration.parent
+    /**
+     * This function traverses the declaration-parent hierarchy upwards, and retrieves the enclosing class of a class to extract the `enclInReftype` relation.
+     * Additionally, it extracts a companion field for a companion object into its parent class.
+     *
+     * Note that the nested class can also be a local class declared inside a function, so the upwards traversal is skipping the non-class parents. Also, in some cases the file class is the enclosing one, which has no IR representation.
+     */
+    private fun extractEnclosingClass(
+        declarationParent: IrDeclarationParent,             // The declaration parent of the element for which we are extracting the enclosing class
+        innerId: Label<out DbClassorinterface>,             // ID of the inner class
+        innerClass: IrClass?,                               // The inner class, if available. It's not available if the enclosing class of a generated class is being extracted
+        innerLocId: Label<DbLocation>,                      // Location of the inner class
+        parentClassTypeArguments: List<IrTypeArgument>?     // Type arguments of the parent class. If `parentClassTypeArguments` is null, the parent class is a raw type
+    ) {
+        with("enclosing class", declarationParent) {
+            var parent: IrDeclarationParent? = declarationParent
             while (parent != null) {
                 if (parent is IrClass) {
                     val parentId =
@@ -564,13 +550,13 @@ open class KotlinFileExtractor(
                             useClassInstance(parent, parentClassTypeArguments).typeResult.id
                         }
                     tw.writeEnclInReftype(innerId, parentId)
-                    if (innerDeclaration is IrClass && innerDeclaration.isCompanion) {
+                    if (innerClass != null && innerClass.isCompanion) {
                         // If we are a companion then our parent has a
                         //     public static final ParentClass$CompanionObjectClass CompanionObjectName;
                         // that we need to fabricate here
-                        val instance = useCompanionObjectClassInstance(innerDeclaration)
+                        val instance = useCompanionObjectClassInstance(innerClass)
                         if (instance != null) {
-                            val type = useSimpleTypeClass(innerDeclaration, emptyList(), false)
+                            val type = useSimpleTypeClass(innerClass, emptyList(), false)
                             tw.writeFields(instance.id, instance.name, type.javaResult.id, parentId, instance.id)
                             tw.writeFieldsKotlinType(instance.id, type.kotlinResult.id)
                             tw.writeHasLocation(instance.id, innerLocId)
@@ -581,7 +567,7 @@ open class KotlinFileExtractor(
 
                     break
                 } else if (parent is IrFile) {
-                    if (innerDeclaration is IrClass) {
+                    if (innerClass != null) {
                         // We don't have to extract file class containers for classes
                         break
                     }
@@ -667,13 +653,18 @@ open class KotlinFileExtractor(
         return type
     }
 
-    private fun extractStaticInitializer(container: IrDeclarationContainer, classLabel: Label<out DbClassorinterface>?) {
+    /**
+     * mkContainerLabel is a lambda so that we get laziness: If the
+     * container is a file, then we don't want to extract the file class
+     * unless something actually needs it.
+     */
+    private fun extractStaticInitializer(container: IrDeclarationContainer, mkContainerLabel: () -> Label<out DbClassorinterface>) {
         with("static initializer extraction", container) {
             extractDeclInitializers(container.declarations, true) {
-                val parentId = classLabel ?: extractFileClass(container as IrFile)
+                val containerId = mkContainerLabel()
                 val clinitLabel = getFunctionLabel(
                     container,
-                    parentId,
+                    containerId,
                     "<clinit>",
                     listOf(),
                     pluginContext.irBuiltIns.unitType,
@@ -686,7 +677,7 @@ open class KotlinFileExtractor(
                 )
                 val clinitId = tw.getLabelFor<DbMethod>(clinitLabel)
                 val returnType = useType(pluginContext.irBuiltIns.unitType, TypeContext.RETURN)
-                tw.writeMethods(clinitId, "<clinit>", "<clinit>()", returnType.javaResult.id, parentId, clinitId)
+                tw.writeMethods(clinitId, "<clinit>", "<clinit>()", returnType.javaResult.id, containerId, clinitId)
                 tw.writeMethodsKotlinType(clinitId, returnType.kotlinResult.id)
 
                 tw.writeCompiler_generated(clinitId, CompilerGeneratedKinds.CLASS_INITIALISATION_METHOD.kind)
@@ -934,7 +925,6 @@ open class KotlinFileExtractor(
     private fun extractField(f: IrField, parentId: Label<out DbReftype>): Label<out DbField> {
         with("field", f) {
            DeclarationStackAdjuster(f).use {
-               declarationStack.push(f)
                val fNameSuffix = getExtensionReceiverType(f)?.let { it.classFqName?.asString()?.replace(".", "$$") } ?: ""
                return extractField(useField(f), "${f.name.asString()}$fNameSuffix", f.type, parentId, tw.getLocation(f), f.visibility, f, isExternalDeclaration(f), f.isFinal)
            }
@@ -1343,6 +1333,14 @@ open class KotlinFileExtractor(
         val receiverClass = receiverType.classifier.owner as? IrClass ?: return listOf()
         val ancestorTypes = ArrayList<IrSimpleType>()
 
+        // KFunctionX doesn't implement FunctionX on versions before 1.7.0:
+        if ((callTarget.name.asString() == "invoke") &&
+            (receiverClass.fqNameWhenAvailable?.asString()?.startsWith("kotlin.reflect.KFunction") == true) &&
+            (callTarget.parentClassOrNull?.fqNameWhenAvailable?.asString()?.startsWith("kotlin.Function") == true)
+        ) {
+            return receiverType.arguments
+        }
+
         // Populate ancestorTypes with the path from receiverType's class to its ancestor, callTarget's declaring type.
         fun walkFrom(c: IrClass): Boolean {
             if(declaringType == c)
@@ -1361,16 +1359,25 @@ open class KotlinFileExtractor(
         }
 
         // If a path was found, repeatedly substitute types to get the corresponding specialisation of that ancestor.
-        return if (!walkFrom(receiverClass)) {
+        if (!walkFrom(receiverClass)) {
             logger.errorElement("Failed to find a class declaring ${callTarget.name} starting at ${receiverClass.name}", callTarget)
-            listOf()
+            return listOf()
         } else {
-            var subbedType = receiverType
+            var subbedType: IrSimpleType = receiverType
             ancestorTypes.forEach {
-                val thisClass = subbedType.classifier.owner as IrClass
-                subbedType = it.substituteTypeArguments(thisClass.typeParameters, subbedType.arguments) as IrSimpleType
+                val thisClass = subbedType.classifier.owner
+                if (thisClass !is IrClass) {
+                    logger.errorElement("Found ancestor with unexpected type ${thisClass.javaClass}", callTarget)
+                    return listOf()
+                }
+                val itSubbed = it.substituteTypeArguments(thisClass.typeParameters, subbedType.arguments)
+                if (itSubbed !is IrSimpleType) {
+                    logger.errorElement("Substituted type has unexpected type ${itSubbed.javaClass}", callTarget)
+                    return listOf()
+                }
+                subbedType = itSubbed
             }
-            subbedType.arguments
+            return subbedType.arguments
         }
     }
 
@@ -1452,12 +1459,14 @@ open class KotlinFileExtractor(
         // type arguments at index -2, -3, ...
         extractTypeArguments(typeArguments, locId, id, enclosingCallable, enclosingStmt, -2, true)
 
-        val isFunctionInvoke = drType != null
-                && drType is IrSimpleType
-                && drType.isFunctionOrKFunction()
-                && callTarget.name.asString() == OperatorNameConventions.INVOKE.asString()
-        val isBigArityFunctionInvoke = isFunctionInvoke
-                && (drType as IrSimpleType).arguments.size > BuiltInFunctionArity.BIG_ARITY
+        val (isFunctionInvoke, isBigArityFunctionInvoke) =
+                if (drType is IrSimpleType &&
+                    drType.isFunctionOrKFunction() &&
+                    callTarget.name.asString() == OperatorNameConventions.INVOKE.asString()) {
+                    Pair(true, drType.arguments.size > BuiltInFunctionArity.BIG_ARITY)
+                } else {
+                    Pair(false, false)
+                }
 
         if (callTarget.isLocalFunction()) {
             val ids = getLocallyVisibleFunctionLabels(callTarget)
@@ -1468,7 +1477,7 @@ open class KotlinFileExtractor(
             extractNewExprForLocalFunction(ids, id, locId, enclosingCallable, enclosingStmt)
         } else {
             val methodId =
-                if (drType != null && extractClassTypeArguments && drType is IrSimpleType && !isUnspecialised(drType)) {
+                if (extractClassTypeArguments && drType is IrSimpleType && !isUnspecialised(drType, logger)) {
 
                     val extractionMethod = if (isFunctionInvoke) {
                         // For `kotlin.FunctionX` and `kotlin.reflect.KFunctionX` interfaces, we're making sure that we
@@ -1544,19 +1553,18 @@ open class KotlinFileExtractor(
     }
 
     private fun extractStaticTypeAccessQualifier(target: IrDeclaration, parentExpr: Label<out DbExprparent>, locId: Label<DbLocation>, enclosingCallable: Label<out DbCallable>, enclosingStmt: Label<out DbStmt>) {
-        if (target.shouldExtractAsStaticMemberOfClass) {
-            extractTypeAccessRecursive(target.parentAsClass.toRawType(), locId, parentExpr, -1, enclosingCallable, enclosingStmt)
-        } else if (target.shouldExtractAsStaticMemberOfFile) {
-            extractTypeAccess(useFileClassType(target.parent as IrFile), locId, parentExpr, -1, enclosingCallable, enclosingStmt)
+        if (target.shouldExtractAsStatic) {
+            val parent = target.parent
+            if (parent is IrClass) {
+                extractTypeAccessRecursive(parent.toRawType(), locId, parentExpr, -1, enclosingCallable, enclosingStmt)
+            } else if (parent is IrFile) {
+                extractTypeAccess(useFileClassType(parent), locId, parentExpr, -1, enclosingCallable, enclosingStmt)
+            } else {
+                logger.warnElement("Unexpected static type access qualifer ${parent.javaClass}", target)
+            }
         }
     }
 
-    private val IrDeclaration.shouldExtractAsStaticMemberOfClass: Boolean
-        get() = this.shouldExtractAsStatic && parent is IrClass
-
-    private val IrDeclaration.shouldExtractAsStaticMemberOfFile: Boolean
-        get() = this.shouldExtractAsStatic && parent is IrFile
-
     private fun isStaticAnnotatedNonCompanionMember(f: IrSimpleFunction) =
         f.parentClassOrNull?.isNonCompanionObject == true &&
                 (f.hasAnnotation(jvmStaticFqName) || f.correspondingPropertySymbol?.owner?.hasAnnotation(jvmStaticFqName) == true)
@@ -1584,7 +1592,7 @@ open class KotlinFileExtractor(
         }
     }
 
-    private fun findFunction(cls: IrClass, name: String): IrFunction? = cls.declarations.find { it is IrFunction && it.name.asString() == name } as IrFunction?
+    private fun findFunction(cls: IrClass, name: String): IrFunction? = cls.declarations.findSubType<IrFunction> { it.name.asString() == name }
 
     val jvmIntrinsicsClass by lazy {
         val result = pluginContext.referenceClass(FqName("kotlin.jvm.internal.Intrinsics"))?.owner
@@ -1600,11 +1608,13 @@ open class KotlinFileExtractor(
         return result
     }
 
-    private fun findTopLevelFunctionOrWarn(functionFilter: String, type: String, warnAgainstElement: IrElement): IrFunction? {
+    private fun findTopLevelFunctionOrWarn(functionFilter: String, type: String, parameterTypes: Array<String>, warnAgainstElement: IrElement): IrFunction? {
 
         val fn = pluginContext.referenceFunctions(FqName(functionFilter))
-            .firstOrNull { it.owner.parentClassOrNull?.fqNameWhenAvailable?.asString() == type }
-            ?.owner
+            .firstOrNull { fnSymbol ->
+                fnSymbol.owner.parentClassOrNull?.fqNameWhenAvailable?.asString() == type &&
+                fnSymbol.owner.valueParameters.map { it.type.classFqName?.asString() }.toTypedArray() contentEquals parameterTypes
+            }?.owner
 
         if (fn != null) {
             if (fn.parentClassOrNull != null) {
@@ -1641,12 +1651,11 @@ open class KotlinFileExtractor(
     }
 
     val stringValueOfObjectMethod by lazy {
-        val result = javaLangString?.declarations?.find {
-            it is IrFunction &&
+        val result = javaLangString?.declarations?.findSubType<IrFunction> {
             it.name.asString() == "valueOf" &&
             it.valueParameters.size == 1 &&
             it.valueParameters[0].type == pluginContext.irBuiltIns.anyNType
-        } as IrFunction?
+        }
         if (result == null) {
             logger.error("Couldn't find declaration java.lang.String.valueOf(Object)")
         }
@@ -1654,9 +1663,9 @@ open class KotlinFileExtractor(
     }
 
     val objectCloneMethod by lazy {
-        val result = javaLangObject?.declarations?.find {
-            it is IrFunction && it.name.asString() == "clone"
-        } as IrFunction?
+        val result = javaLangObject?.declarations?.findSubType<IrFunction> {
+            it.name.asString() == "clone"
+        }
         if (result == null) {
             logger.error("Couldn't find declaration java.lang.Object.clone(...)")
         }
@@ -1670,10 +1679,9 @@ open class KotlinFileExtractor(
     }
 
     val kotlinNoWhenBranchMatchedConstructor by lazy {
-        val result = kotlinNoWhenBranchMatchedExn?.declarations?.find {
-            it is IrConstructor &&
+        val result = kotlinNoWhenBranchMatchedExn?.declarations?.findSubType<IrConstructor> {
             it.valueParameters.isEmpty()
-        } as IrConstructor?
+        }
         if (result == null) {
             logger.error("Couldn't find no-arg constructor for kotlin.NoWhenBranchMatchedException")
         }
@@ -1686,7 +1694,7 @@ open class KotlinFileExtractor(
         result
     }
 
-    private fun isFunction(target: IrFunction, pkgName: String, classNameLogged: String, classNamePredicate: (String) -> Boolean, fName: String, hasQuestionMark: Boolean? = false): Boolean {
+    private fun isFunction(target: IrFunction, pkgName: String, classNameLogged: String, classNamePredicate: (String) -> Boolean, fName: String, isNullable: Boolean? = false): Boolean {
         val verbose = false
         fun verboseln(s: String) { if(verbose) println(s) }
         verboseln("Attempting match for $pkgName $classNameLogged $fName")
@@ -1696,14 +1704,14 @@ open class KotlinFileExtractor(
         }
         val extensionReceiverParameter = target.extensionReceiverParameter
         val targetClass = if (extensionReceiverParameter == null) {
-            if (hasQuestionMark == true) {
+            if (isNullable == true) {
                 verboseln("Nullablility of type didn't match (target is not an extension method)")
                 return false
             }
             target.parent
         } else {
             val st = extensionReceiverParameter.type as? IrSimpleType
-            if (hasQuestionMark != null && st?.hasQuestionMark != hasQuestionMark) {
+            if (isNullable != null && st?.isNullable() != isNullable) {
                 verboseln("Nullablility of type didn't match")
                 return false
             }
@@ -1730,8 +1738,8 @@ open class KotlinFileExtractor(
         return true
     }
 
-    private fun isFunction(target: IrFunction, pkgName: String, className: String, fName: String, hasQuestionMark: Boolean? = false) =
-        isFunction(target, pkgName, className, { it == className }, fName, hasQuestionMark)
+    private fun isFunction(target: IrFunction, pkgName: String, className: String, fName: String, isNullable: Boolean? = false) =
+        isFunction(target, pkgName, className, { it == className }, fName, isNullable)
 
     private fun isNumericFunction(target: IrFunction, fName: String): Boolean {
         return isFunction(target, "kotlin", "Int", fName) ||
@@ -1756,6 +1764,12 @@ open class KotlinFileExtractor(
             else -> false
         }
 
+    private fun isGenericArrayType(typeName: String) =
+        when(typeName) {
+            "Array" -> true
+            else -> false
+        }
+
     private fun extractCall(c: IrCall, callable: Label<out DbCallable>, stmtExprParent: StmtExprParent) {
         with("call", c) {
             val target = tryReplaceSyntheticFunction(c.symbol.owner)
@@ -1798,13 +1812,35 @@ open class KotlinFileExtractor(
                     return
                 }
 
-                val func = ((c.getTypeArgument(0) as? IrSimpleType)?.classifier?.owner as? IrClass)?.declarations?.find { it is IrFunction && it.name.asString() == fnName }
-                if (func == null) {
-                    logger.errorElement("Couldn't find function $fnName on enum type", c)
+                val enumType = (c.getTypeArgument(0) as? IrSimpleType)?.classifier?.owner
+                if (enumType == null) {
+                    logger.errorElement("Couldn't find type of enum type", c)
                     return
                 }
 
-                extractMethodAccess(func as IrFunction, false)
+                if (enumType is IrClass) {
+                    val func = enumType.declarations.findSubType<IrFunction> { it.name.asString() == fnName }
+                    if (func == null) {
+                        logger.errorElement("Couldn't find function $fnName on enum type", c)
+                        return
+                    }
+
+                    extractMethodAccess(func, false)
+                } else if (enumType is IrTypeParameter && enumType.isReified) {
+                    // A call to `enumValues<T>()` is being extracted, where `T` is a reified type parameter of an `inline` function.
+                    // We can't generate a valid expression here, because we would need to know the type of T on the call site.
+                    // TODO: replace error expression with something that better shows this expression is unrepresentable.
+                    val id = tw.getFreshIdLabel<DbErrorexpr>()
+                    val type = useType(c.type)
+
+                    tw.writeExprs_errorexpr(id, type.javaResult.id, parent, idx)
+                    tw.writeExprsKotlinType(id, type.kotlinResult.id)
+                    tw.writeHasLocation(id, tw.getLocation(c))
+                    tw.writeCallableEnclosingExpr(id, callable)
+                    tw.writeStatementEnclosingExpr(id, enclosingStmt)
+                } else {
+                    logger.errorElement("Unexpected enum type rep ${enumType.javaClass}", c)
+                }
             }
 
             fun binopReceiver(id: Label<out DbExpr>, receiver: IrExpression?, receiverDescription: String) {
@@ -2177,30 +2213,47 @@ open class KotlinFileExtractor(
                         extractRawMethodAccess(getter, c, callable, parent, idx, enclosingStmt, listOf(), null, ext, typeArguments)
                     }
                 }
-                isFunction(target, "kotlin", "(some array type)", { isArrayType(it) }, "iterator") && c.origin == IrStatementOrigin.FOR_LOOP_ITERATOR -> {
-                    findTopLevelFunctionOrWarn("kotlin.jvm.internal.iterator", "kotlin.jvm.internal.ArrayIteratorKt", c)?.let { iteratorFn ->
+                isFunction(target, "kotlin", "(some array type)", { isArrayType(it) }, "iterator") -> {
+                    val parentClass = target.parent
+                    if (parentClass !is IrClass) {
+                        logger.errorElement("Iterator parent is not a class", c)
+                        return
+                    }
+
+                    var typeFilter = if (isGenericArrayType(parentClass.name.asString())) {
+                        "kotlin.jvm.internal.ArrayIteratorKt"
+                    } else {
+                        "kotlin.jvm.internal.ArrayIteratorsKt"
+                    }
+
+                    findTopLevelFunctionOrWarn("kotlin.jvm.internal.iterator", typeFilter, arrayOf(parentClass.kotlinFqName.asString()), c)?.let { iteratorFn ->
                         val dispatchReceiver = c.dispatchReceiver
                         if (dispatchReceiver == null) {
                             logger.errorElement("No dispatch receiver found for array iterator call", c)
                         } else {
-                            val typeArgs = (dispatchReceiver.type as IrSimpleType).arguments.map {
-                                when(it) {
-                                    is IrTypeProjection -> it.type
-                                    else -> pluginContext.irBuiltIns.anyNType
+                            val drType = dispatchReceiver.type
+                            if (drType !is IrSimpleType) {
+                                logger.errorElement("Dispatch receiver with unexpected type rep found for array iterator call: ${drType.javaClass}", c)
+                            } else {
+                                val typeArgs = drType.arguments.map {
+                                    when(it) {
+                                        is IrTypeProjection -> it.type
+                                        else -> pluginContext.irBuiltIns.anyNType
+                                    }
                                 }
+                                extractRawMethodAccess(iteratorFn, c, callable, parent, idx, enclosingStmt, listOf(c.dispatchReceiver), null, null, typeArgs)
                             }
-                            extractRawMethodAccess(iteratorFn, c, callable, parent, idx, enclosingStmt, listOf(c.dispatchReceiver), null, null, typeArgs)
                         }
                     }
                 }
-                isFunction(target, "kotlin", "(some array type)", { isArrayType(it) }, "get") && c.origin == IrStatementOrigin.GET_ARRAY_ELEMENT -> {
+                isFunction(target, "kotlin", "(some array type)", { isArrayType(it) }, "get") && c.origin == IrStatementOrigin.GET_ARRAY_ELEMENT && c.dispatchReceiver != null -> {
                     val id = tw.getFreshIdLabel<DbArrayaccess>()
                     val type = useType(c.type)
                     tw.writeExprs_arrayaccess(id, type.javaResult.id, parent, idx)
                     tw.writeExprsKotlinType(id, type.kotlinResult.id)
                     binopDisp(id)
                 }
-                isFunction(target, "kotlin", "(some array type)", { isArrayType(it) }, "set") && c.origin == IrStatementOrigin.EQ -> {
+                isFunction(target, "kotlin", "(some array type)", { isArrayType(it) }, "set") && c.origin == IrStatementOrigin.EQ && c.dispatchReceiver != null -> {
                     val array = c.dispatchReceiver
                     val arrayIdx = c.getValueArgument(0)
                     val assignedValue = c.getValueArgument(1)
@@ -2273,10 +2326,10 @@ open class KotlinFileExtractor(
                         logger.errorElement("Argument to dataClassArrayMemberToString not a class", c)
                         return
                     }
-                    val realCallee = javaUtilArrays?.declarations?.find { decl ->
-                        decl is IrFunction && decl.name.asString() == "toString" && decl.valueParameters.size == 1 &&
+                    val realCallee = javaUtilArrays?.declarations?.findSubType<IrFunction> { decl ->
+                        decl.name.asString() == "toString" && decl.valueParameters.size == 1 &&
                                 decl.valueParameters[0].type.classOrNull?.let { it == realArrayClass } == true
-                    } as IrFunction?
+                    }
                     if (realCallee == null) {
                         logger.errorElement("Couldn't find a java.lang.Arrays.toString method matching class ${realArrayClass.owner.name}", c)
                     } else {
@@ -2300,10 +2353,10 @@ open class KotlinFileExtractor(
                         logger.errorElement("Argument to dataClassArrayMemberHashCode not a class", c)
                         return
                     }
-                    val realCallee = javaUtilArrays?.declarations?.find { decl ->
-                        decl is IrFunction && decl.name.asString() == "hashCode" && decl.valueParameters.size == 1 &&
+                    val realCallee = javaUtilArrays?.declarations?.findSubType<IrFunction> { decl ->
+                        decl.name.asString() == "hashCode" && decl.valueParameters.size == 1 &&
                                 decl.valueParameters[0].type.classOrNull?.let { it == realArrayClass } == true
-                    } as IrFunction?
+                    }
                     if (realCallee == null) {
                         logger.errorElement("Couldn't find a java.lang.Arrays.hashCode method matching class ${realArrayClass.owner.name}", c)
                     } else {
@@ -2380,18 +2433,27 @@ open class KotlinFileExtractor(
         callable: Label<out DbCallable>,
         enclosingStmt: Label<out DbStmt>
     ) {
-        val isAnonymous = e.type.isAnonymous
+        val eType = e.type
+        if (eType !is IrSimpleType) {
+            logger.errorElement("Constructor call has non-simple type ${eType.javaClass}", e)
+            return
+        }
+        val isAnonymous = eType.isAnonymous
         val type: TypeResults = if (isAnonymous) {
             if (e.typeArgumentsCount > 0) {
-                logger.warn("Unexpected type arguments for anonymous class constructor call")
+                logger.warnElement("Unexpected type arguments (${e.typeArgumentsCount}) for anonymous class constructor call", e)
+            }
+            val c = eType.classifier.owner
+            if (c !is IrClass) {
+                logger.errorElement("Anonymous constructor call type not a class (${c.javaClass})", e)
+                return
             }
-            val c = (e.type as IrSimpleType).classifier.owner as IrClass
             useAnonymousClass(c)
         } else {
-            useType(e.type)
+            useType(eType)
         }
         val locId = tw.getLocation(e)
-        val id = extractNewExpr(e.symbol.owner, (e.type as? IrSimpleType)?.arguments, type, locId, parent, idx, callable, enclosingStmt)
+        val id = extractNewExpr(e.symbol.owner, eType.arguments, type, locId, parent, idx, callable, enclosingStmt)
 
         if (isAnonymous) {
             tw.writeIsAnonymClass(type.javaResult.id.cast<DbClass>(), id)
@@ -2405,8 +2467,11 @@ open class KotlinFileExtractor(
         }
 
         val typeAccessType = if (isAnonymous) {
-            val c = (e.type as IrSimpleType).classifier.owner as IrClass
-            if (c.superTypes.size == 1) {
+            val c = eType.classifier.owner
+            if (c !is IrClass) {
+                logger.warnElement("Anonymous type not a class (${c.javaClass})", e)
+            }
+            if ((c as? IrClass)?.superTypes?.size == 1) {
                 useType(c.superTypes.first())
             } else {
                 useType(pluginContext.irBuiltIns.anyType)
@@ -2416,7 +2481,7 @@ open class KotlinFileExtractor(
         }
 
         if (e is IrConstructorCall) {
-            extractConstructorTypeAccess(e.type, typeAccessType, e.symbol, locId, id, -3, callable, enclosingStmt)
+            extractConstructorTypeAccess(eType, typeAccessType, e.symbol, locId, id, -3, callable, enclosingStmt)
         } else {
             val typeAccessId =
                 extractTypeAccess(typeAccessType, locId, id, -3, callable, enclosingStmt)
@@ -2425,9 +2490,6 @@ open class KotlinFileExtractor(
         }
     }
 
-    // todo: calculating the enclosing ref type could be done through this, instead of walking up the declaration parent chain
-    private val declarationStack: Stack<IrDeclaration> = Stack()
-
     abstract inner class StmtExprParent {
         abstract fun stmt(e: IrExpression, callable: Label<out DbCallable>): StmtParent
         abstract fun expr(e: IrExpression, callable: Label<out DbCallable>): ExprParent
@@ -2520,8 +2582,8 @@ open class KotlinFileExtractor(
                     indexVarDecl.initializer?.let { indexVarInitializer ->
                         (e.statements[2] as? IrCall)?.let { arraySetCall ->
                             if (isFunction(arraySetCall.symbol.owner, "kotlin", "(some array type)", { isArrayType(it) }, "set")) {
-                                val updateRhs = arraySetCall.getValueArgument(1)
-                                if (updateRhs == null) {
+                                val updateRhs0 = arraySetCall.getValueArgument(1)
+                                if (updateRhs0 == null) {
                                     logger.errorElement("Update RHS not found", e)
                                     return false
                                 }
@@ -2534,7 +2596,7 @@ open class KotlinFileExtractor(
                                             receiverVal -> receiverVal.symbol.owner == arrayVarDecl.symbol.owner
                                         } ?: false
                                     },
-                                    updateRhs
+                                    updateRhs0
                                 )?.let { updateRhs ->
                                     val origin = e.origin
                                     if (origin == null) {
@@ -2601,8 +2663,15 @@ open class KotlinFileExtractor(
 
                     val irCallable = declarationStack.peek()
 
-                    val delegatingClass = e.symbol.owner.parent as IrClass
-                    val currentClass = irCallable.parent as IrClass
+                    val delegatingClass = e.symbol.owner.parent
+                    val currentClass = irCallable.parent
+
+                    if (delegatingClass !is IrClass) {
+                        logger.warnElement("Delegating class isn't a class: " + delegatingClass.javaClass, e)
+                    }
+                    if (currentClass !is IrClass) {
+                        logger.warnElement("Current class isn't a class: " + currentClass.javaClass, e)
+                    }
 
                     val id: Label<out DbStmt>
                     if (delegatingClass != currentClass) {
@@ -3036,7 +3105,14 @@ open class KotlinFileExtractor(
                     extractTypeOperatorCall(e, callable, exprParent.parent, exprParent.idx, exprParent.enclosingStmt)
                 }
                 is IrVararg -> {
-                    logger.errorElement("Unexpected IrVararg", e)
+                    var spread = e.elements.getOrNull(0) as? IrSpreadElement
+                    if (spread == null || e.elements.size != 1) {
+                        logger.errorElement("Unexpected IrVararg", e)
+                        return
+                    }
+                    // There are lowered IR cases when the vararg expression is not within a call, such as
+                    // val temp0 = [*expr]
+                    extractExpression(spread.expression, callable, parent)
                 }
                 is IrGetObjectValue -> {
                     // For `object MyObject { ... }`, the .class has an
@@ -3345,15 +3421,11 @@ open class KotlinFileExtractor(
 
     data class ReceiverInfo(val receiver: IrExpression, val type: IrType, val field: Label<DbField>, val indexOffset: Int)
 
-    private fun makeReceiverInfo(callableReferenceExpr: IrCallableReference<out IrSymbol>, receiver: IrExpression?, indexOffset: Int): ReceiverInfo? {
+    private fun makeReceiverInfo(receiver: IrExpression?, indexOffset: Int): ReceiverInfo? {
         if (receiver == null) {
             return null
         }
         val type = receiver.type
-        if (type == null) {
-            logger.warnElement("Receiver has no type", callableReferenceExpr)
-            return null
-        }
         val field: Label<DbField> = tw.getFreshIdLabel()
         return ReceiverInfo(receiver, type, field, indexOffset)
     }
@@ -3366,8 +3438,8 @@ open class KotlinFileExtractor(
         : GeneratedClassHelper(locId, ids) {
 
         // Only one of the receivers can be non-null, but we defensively handle the case when both are null anyway
-        private val dispatchReceiverInfo = makeReceiverInfo(callableReferenceExpr, callableReferenceExpr.dispatchReceiver, 0)
-        private val extensionReceiverInfo = makeReceiverInfo(callableReferenceExpr, callableReferenceExpr.extensionReceiver, if (dispatchReceiverInfo == null) 0 else 1)
+        private val dispatchReceiverInfo = makeReceiverInfo(callableReferenceExpr.dispatchReceiver, 0)
+        private val extensionReceiverInfo = makeReceiverInfo(callableReferenceExpr.extensionReceiver, if (dispatchReceiverInfo == null) 0 else 1)
 
         fun extractReceiverField() {
             val firstAssignmentStmtIdx = 1
@@ -3658,6 +3730,11 @@ open class KotlinFileExtractor(
                 logger.errorElement("Cannot find class for kPropertyType. ${kPropertyType.classFqName?.asString()}", propertyReferenceExpr)
                 return
             }
+            val parameterTypes = kPropertyType.arguments.map { it as? IrType }.requireNoNullsOrNull()
+            if (parameterTypes == null) {
+                logger.errorElement("Unexpected: Non-IrType parameter.", propertyReferenceExpr)
+                return
+            }
 
             val locId = tw.getLocation(propertyReferenceExpr)
 
@@ -3670,15 +3747,14 @@ open class KotlinFileExtractor(
                 constructorBlock = tw.getFreshIdLabel()
             )
 
-            val currentDeclaration = declarationStack.peek()
+            val declarationParent = declarationStack.peekAsDeclarationParent(propertyReferenceExpr) ?: return
             val prefix = if (kPropertyClass.owner.name.asString().startsWith("KMutableProperty")) "Mutable" else ""
             val baseClass = pluginContext.referenceClass(FqName("kotlin.jvm.internal.${prefix}PropertyReference${kPropertyType.arguments.size - 1}"))?.owner?.typeWith()
                 ?: pluginContext.irBuiltIns.anyType
 
-            val classId = extractGeneratedClass(ids, listOf(baseClass, kPropertyType), locId, currentDeclaration)
+            val classId = extractGeneratedClass(ids, listOf(baseClass, kPropertyType), locId, propertyReferenceExpr, declarationParent)
 
             val helper = PropertyReferenceHelper(propertyReferenceExpr, locId, ids)
-            val parameterTypes = kPropertyType.arguments.map { it as IrType }
 
             helper.extractReceiverField()
 
@@ -3825,7 +3901,11 @@ open class KotlinFileExtractor(
                 return
             }
 
-            val parameterTypes = type.arguments.map { it as IrType }
+            val parameterTypes = type.arguments.map { it as? IrType }.requireNoNullsOrNull()
+            if (parameterTypes == null) {
+                logger.errorElement("Unexpected: Non-IrType parameter.", functionReferenceExpr)
+                return
+            }
 
             val dispatchReceiverIdx: Int
             val expressionTypeArguments: List<IrType>
@@ -3874,12 +3954,12 @@ open class KotlinFileExtractor(
             if (fnInterfaceType == null) {
                 logger.warnElement("Cannot find functional interface type for function reference", functionReferenceExpr)
             } else {
-                val currentDeclaration = declarationStack.peek()
+                val declarationParent = declarationStack.peekAsDeclarationParent(functionReferenceExpr) ?: return
                 // `FunctionReference` base class is required, because that's implementing `KFunction`.
                 val baseClass = pluginContext.referenceClass(FqName("kotlin.jvm.internal.FunctionReference"))?.owner?.typeWith()
                     ?: pluginContext.irBuiltIns.anyType
 
-                val classId = extractGeneratedClass(ids, listOf(baseClass, fnInterfaceType), locId, currentDeclaration)
+                val classId = extractGeneratedClass(ids, listOf(baseClass, fnInterfaceType), locId, functionReferenceExpr, declarationParent)
 
                 helper.extractReceiverField()
 
@@ -4233,6 +4313,8 @@ open class KotlinFileExtractor(
      * Extracts a type access expression and its child type access expressions in case of a generic type. Nested generics are also handled.
      */
     private fun extractTypeAccessRecursive(t: IrType, location: Label<DbLocation>, parent: Label<out DbExprparent>, idx: Int, enclosingCallable: Label<out DbCallable>, enclosingStmt: Label<out DbStmt>, typeContext: TypeContext = TypeContext.OTHER): Label<out DbExpr> {
+        // TODO: `useType` substitutes types to their java equivalent, and sometimes that also means changing the number of type arguments. The below logic doesn't take this into account.
+        // For example `KFunction2<Int,Double,String>` becomes `KFunction<String>` with three child type access expressions: `Int`, `Double`, `String`.
         val typeAccessId = extractTypeAccess(useType(t, typeContext), location, parent, idx, enclosingCallable, enclosingStmt)
         if (t is IrSimpleType) {
             extractTypeArguments(t.arguments.filterIsInstance<IrType>(), location, typeAccessId, enclosingCallable, enclosingStmt)
@@ -4452,7 +4534,7 @@ open class KotlinFileExtractor(
                         return
                     }
 
-                    val invokeMethod = functionType.classOrNull?.owner?.declarations?.filterIsInstance<IrFunction>()?.find { it.name.asString() == OperatorNameConventions.INVOKE.asString()}
+                    val invokeMethod = functionType.classOrNull?.owner?.declarations?.findSubType<IrFunction> { it.name.asString() == OperatorNameConventions.INVOKE.asString()}
                     if (invokeMethod == null) {
                         logger.errorElement("Couldn't find `invoke` method on functional interface.", e)
                         return
@@ -4463,7 +4545,7 @@ open class KotlinFileExtractor(
                         logger.errorElement("Expected to find SAM conversion to IrClass. Found '${typeOwner.javaClass}' instead. Can't implement SAM interface.", e)
                         return
                     }
-                    val samMember = typeOwner.declarations.filterIsInstance<IrFunction>().find { it is IrOverridableMember && it.modality == Modality.ABSTRACT }
+                    val samMember = typeOwner.declarations.findSubType<IrFunction> { it is IrOverridableMember && it.modality == Modality.ABSTRACT }
                     if (samMember == null) {
                         logger.errorElement("Couldn't find SAM member in type '${typeOwner.kotlinFqName.asString()}'. Can't implement SAM interface.", e)
                         return
@@ -4481,8 +4563,8 @@ open class KotlinFileExtractor(
                     val locId = tw.getLocation(e)
                     val helper = GeneratedClassHelper(locId, ids)
 
-                    val currentDeclaration = declarationStack.peek()
-                    val classId = extractGeneratedClass(ids, listOf(pluginContext.irBuiltIns.anyType, e.typeOperand), locId, currentDeclaration)
+                    val declarationParent = declarationStack.peekAsDeclarationParent(e) ?: return
+                    val classId = extractGeneratedClass(ids, listOf(pluginContext.irBuiltIns.anyType, e.typeOperand), locId, e, declarationParent)
 
                     // add field
                     val fieldId = tw.getFreshIdLabel<DbField>()
@@ -4624,7 +4706,8 @@ open class KotlinFileExtractor(
         ids: GeneratedClassLabels,
         superTypes: List<IrType>,
         locId: Label<DbLocation>,
-        currentDeclaration: IrDeclaration
+        elementToReportOn: IrElement,
+        declarationParent: IrDeclarationParent
     ): Label<out DbClass> {
         // Write class
         val id = ids.type.javaResult.id.cast<DbClass>()
@@ -4647,23 +4730,27 @@ open class KotlinFileExtractor(
         // Super call
         val baseClass = superTypes.first().classOrNull
         if (baseClass == null) {
-            logger.warnElement("Cannot find base class", currentDeclaration)
+            logger.warnElement("Cannot find base class", elementToReportOn)
         } else {
-            val superCallId = tw.getFreshIdLabel<DbSuperconstructorinvocationstmt>()
-            tw.writeStmts_superconstructorinvocationstmt(superCallId, constructorBlockId, 0, ids.constructor)
+            val baseConstructor = baseClass.owner.declarations.findSubType<IrFunction> { it.symbol is IrConstructorSymbol }
+            if (baseConstructor == null) {
+                logger.warnElement("Cannot find base constructor", elementToReportOn)
+            } else {
+                val superCallId = tw.getFreshIdLabel<DbSuperconstructorinvocationstmt>()
+                tw.writeStmts_superconstructorinvocationstmt(superCallId, constructorBlockId, 0, ids.constructor)
 
-            val baseConstructor = baseClass.owner.declarations.find { it is IrFunction && it.symbol is IrConstructorSymbol }
-            val baseConstructorId = useFunction<DbConstructor>(baseConstructor as IrFunction)
+                val baseConstructorId = useFunction<DbConstructor>(baseConstructor)
 
-            tw.writeHasLocation(superCallId, locId)
-            tw.writeCallableBinding(superCallId.cast<DbCaller>(), baseConstructorId)
+                tw.writeHasLocation(superCallId, locId)
+                tw.writeCallableBinding(superCallId.cast<DbCaller>(), baseConstructorId)
+            }
         }
 
         addModifiers(id, "final")
         addVisibilityModifierToLocalOrAnonymousClass(id)
         extractClassSupertypes(superTypes, listOf(), id, inReceiverContext = true)
 
-        extractEnclosingClass(currentDeclaration, id, locId, listOf())
+        extractEnclosingClass(declarationParent, id, null, locId, listOf())
 
         return id
     }
@@ -4675,7 +4762,7 @@ open class KotlinFileExtractor(
         with("generated class", localFunction) {
             val ids = getLocallyVisibleFunctionLabels(localFunction)
 
-            val id = extractGeneratedClass(ids, superTypes, tw.getLocation(localFunction), localFunction)
+            val id = extractGeneratedClass(ids, superTypes, tw.getLocation(localFunction), localFunction, localFunction.parent)
 
             // Extract local function as a member
             extractFunction(localFunction, id, extractBody = true, extractMethodAndParameterTypeAccesses = true, null, listOf())
@@ -4684,6 +4771,34 @@ open class KotlinFileExtractor(
         }
     }
 
+    // todo: calculating the enclosing ref type could be done through this, instead of walking up the declaration parent chain
+    private val declarationStack = DeclarationStack()
+
+    private inner class DeclarationStack {
+        private val stack: Stack<IrDeclaration> = Stack()
+
+        fun push(item: IrDeclaration) = stack.push(item)
+
+        fun pop() = stack.pop()
+
+        fun isEmpty() = stack.isEmpty()
+
+        fun peek() = stack.peek()
+
+        fun peekAsDeclarationParent(elementToReportOn: IrElement): IrDeclarationParent? {
+            val trapWriter = tw
+            if (isEmpty() && trapWriter is SourceFileTrapWriter) {
+                // If the current declaration is used as a parent, we might end up with an empty stack. In this case, the source file is the parent.
+                return trapWriter.irFile
+            }
+
+            val dp = peek() as? IrDeclarationParent
+            if (dp == null) {
+                logger.errorElement("Couldn't find current declaration parent", elementToReportOn)
+            }
+            return dp
+        }
+    }
 
     private inner class DeclarationStackAdjuster(declaration: IrDeclaration): Closeable {
         init {
diff --git a/java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt b/java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt
index db25b2b84a7..8a3dd214837 100644
--- a/java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt
+++ b/java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt
@@ -220,7 +220,7 @@ open class KotlinUsesExtractor(
         val extractedTypeArgs = when {
             extractClass.symbol.isKFunction() && typeArgs != null && typeArgs.isNotEmpty() -> listOf(typeArgs.last())
             extractClass.fqNameWhenAvailable == FqName("kotlin.jvm.functions.FunctionN") && typeArgs != null && typeArgs.isNotEmpty() -> listOf(typeArgs.last())
-            typeArgs != null && isUnspecialised(c, typeArgs) -> listOf()
+            typeArgs != null && isUnspecialised(c, typeArgs, logger) -> listOf()
             else -> typeArgs
         }
 
@@ -326,11 +326,11 @@ open class KotlinUsesExtractor(
         if (replacementClass === parentClass)
             return f
         return globalExtensionState.syntheticToRealFunctionMap.getOrPut(f) {
-            val result = replacementClass.declarations.find { replacementDecl ->
-                replacementDecl is IrSimpleFunction && replacementDecl.name == f.name && replacementDecl.valueParameters.size == f.valueParameters.size && replacementDecl.valueParameters.zip(f.valueParameters).all {
+            val result = replacementClass.declarations.findSubType<IrSimpleFunction> { replacementDecl ->
+                replacementDecl.name == f.name && replacementDecl.valueParameters.size == f.valueParameters.size && replacementDecl.valueParameters.zip(f.valueParameters).all {
                     erase(it.first.type) == erase(it.second.type)
                 }
-            } as IrFunction?
+            }
             if (result == null) {
                 logger.warn("Failed to replace synthetic class function ${f.name}")
             } else {
@@ -351,9 +351,9 @@ open class KotlinUsesExtractor(
         if (replacementClass === parentClass)
             return f
         return globalExtensionState.syntheticToRealFieldMap.getOrPut(f) {
-            val result = replacementClass.declarations.find { replacementDecl ->
-                replacementDecl is IrField && replacementDecl.name == f.name
-            } as IrField?
+            val result = replacementClass.declarations.findSubType<IrField> { replacementDecl ->
+                replacementDecl.name == f.name
+            }
             if (result == null) {
                 logger.warn("Failed to replace synthetic class field ${f.name}")
             } else {
@@ -479,7 +479,7 @@ open class KotlinUsesExtractor(
     fun useSimpleTypeClass(c: IrClass, args: List<IrTypeArgument>?, hasQuestionMark: Boolean): TypeResults {
         if (c.isAnonymousObject) {
             args?.let {
-                if (it.isNotEmpty() && !isUnspecialised(c, it)) {
+                if (it.isNotEmpty() && !isUnspecialised(c, it, logger)) {
                     logger.error("Unexpected specialised instance of generic anonymous class")
                 }
             }
@@ -539,15 +539,52 @@ open class KotlinUsesExtractor(
                 )
         }
 
-    private fun useArrayType(arrayType: IrSimpleType, componentType: IrType, elementType: IrType, dimensions: Int, isPrimitiveArray: Boolean): TypeResults {
+    data class ArrayInfo(val elementTypeResults: TypeResults,
+                         val componentTypeResults: TypeResults,
+                         val dimensions: Int)
 
-        // Ensure we extract Array<Int> as Integer[], not int[], for example:
-        fun nullableIfNotPrimitive(type: IrType) = if (type.isPrimitiveType() && !isPrimitiveArray) type.makeNullable() else type
+    /**
+     * `t` is somewhere in a stack of array types, or possibly the
+     * element type of the innermost array. For example, in
+     * `Array<Array<Int>>`, we will be called with `t` being
+     * `Array<Array<Int>>`, then `Array<Int>`, then `Int`.
+     * `isPrimitiveArray` is true if we are immediately nested
+     * inside a primitive array.
+     */
+    private fun useArrayType(t: IrType, isPrimitiveArray: Boolean): ArrayInfo {
 
-        val componentTypeResults = useType(nullableIfNotPrimitive(componentType))
-        val elementTypeLabel = useType(nullableIfNotPrimitive(elementType)).javaResult.id
+        if (!t.isBoxedArray && !t.isPrimitiveArray()) {
+            val nullableT = if (t.isPrimitiveType() && !isPrimitiveArray) t.makeNullable() else t
+            val typeResults = useType(nullableT)
+            return ArrayInfo(typeResults, typeResults, 0)
+        }
 
-        val javaShortName = componentTypeResults.javaResult.shortName + "[]"
+        if (t !is IrSimpleType) {
+            logger.error("Unexpected non-simple array type: ${t.javaClass}")
+            return ArrayInfo(extractErrorType(), extractErrorType(), 0)
+        }
+
+        val arrayClass = t.classifier.owner
+        if (arrayClass !is IrClass) {
+            logger.error("Unexpected owner type for array type: ${arrayClass.javaClass}")
+            return ArrayInfo(extractErrorType(), extractErrorType(), 0)
+        }
+
+        // Because Java's arrays are covariant, Kotlin will render
+        // Array<in X> as Object[], Array<Array<in X>> as Object[][] etc.
+        val elementType = if ((t.arguments.singleOrNull() as? IrTypeProjection)?.variance == Variance.IN_VARIANCE) {
+            pluginContext.irBuiltIns.anyType
+        } else {
+            t.getArrayElementType(pluginContext.irBuiltIns)
+        }
+
+        val recInfo = useArrayType(elementType, t.isPrimitiveArray())
+
+        val javaShortName = recInfo.componentTypeResults.javaResult.shortName + "[]"
+        val kotlinShortName = recInfo.componentTypeResults.kotlinResult.shortName + "[]"
+        val elementTypeLabel = recInfo.elementTypeResults.javaResult.id
+        val componentTypeLabel = recInfo.componentTypeResults.javaResult.id
+        val dimensions = recInfo.dimensions + 1
 
         val id = tw.getLabelFor<DbArray>("@\"array;$dimensions;{${elementTypeLabel}}\"") {
             tw.writeArrays(
@@ -555,9 +592,9 @@ open class KotlinUsesExtractor(
                 javaShortName,
                 elementTypeLabel,
                 dimensions,
-                componentTypeResults.javaResult.id)
+                componentTypeLabel)
 
-            extractClassSupertypes(arrayType.classifier.owner as IrClass, it, ExtractSupertypesMode.Specialised(arrayType.arguments))
+            extractClassSupertypes(arrayClass, it, ExtractSupertypesMode.Specialised(t.arguments))
 
             // array.length
             val length = tw.getLabelFor<DbField>("@\"field;{$it};length\"")
@@ -568,7 +605,7 @@ open class KotlinUsesExtractor(
 
             // Note we will only emit one `clone()` method per Java array type, so we choose `Array<C?>` as its Kotlin
             // return type, where C is the component type with any nested arrays themselves invariant and nullable.
-            val kotlinCloneReturnType = getInvariantNullableArrayType(arrayType).makeNullable()
+            val kotlinCloneReturnType = getInvariantNullableArrayType(t).makeNullable()
             val kotlinCloneReturnTypeLabel = useType(kotlinCloneReturnType).kotlinResult.id
 
             val clone = tw.getLabelFor<DbMethod>("@\"callable;{$it}.clone(){$it}\"")
@@ -579,11 +616,15 @@ open class KotlinUsesExtractor(
 
         val javaResult = TypeResult(
             id,
-            componentTypeResults.javaResult.signature + "[]",
+            recInfo.componentTypeResults.javaResult.signature + "[]",
             javaShortName)
+        val kotlinResult = TypeResult(
+            fakeKotlinType(),
+            recInfo.componentTypeResults.kotlinResult.signature + "[]",
+            kotlinShortName)
+        val typeResults = TypeResults(javaResult, kotlinResult)
 
-        val arrayClassResult = useSimpleTypeClass(arrayType.classifier.owner as IrClass, arrayType.arguments, arrayType.hasQuestionMark)
-        return TypeResults(javaResult, arrayClassResult.kotlinResult)
+        return ArrayInfo(recInfo.elementTypeResults, typeResults, dimensions)
     }
 
     enum class TypeContext {
@@ -609,7 +650,7 @@ open class KotlinUsesExtractor(
                           otherIsPrimitive: Boolean,
                           javaClass: IrClass,
                           kotlinPackageName: String, kotlinClassName: String): TypeResults {
-            val javaResult = if ((context == TypeContext.RETURN || (context == TypeContext.OTHER && otherIsPrimitive)) && !s.hasQuestionMark && primitiveName != null) {
+            val javaResult = if ((context == TypeContext.RETURN || (context == TypeContext.OTHER && otherIsPrimitive)) && !s.isNullable() && primitiveName != null) {
                     val label: Label<DbPrimitive> = tw.getLabelFor("@\"type;$primitiveName\"", {
                         tw.writePrimitives(it, primitiveName)
                     })
@@ -619,7 +660,7 @@ open class KotlinUsesExtractor(
                 }
             val kotlinClassId = useClassInstance(kotlinClass, listOf()).typeResult.id
             val kotlinResult = if (true) TypeResult(fakeKotlinType(), "TODO", "TODO") else
-                if (s.hasQuestionMark) {
+                if (s.isNullable()) {
                     val kotlinSignature = "$kotlinPackageName.$kotlinClassName?" // TODO: Is this right?
                     val kotlinLabel = "@\"kt_type;nullable;$kotlinPackageName.$kotlinClassName\""
                     val kotlinId: Label<DbKt_nullable_type> = tw.getLabelFor(kotlinLabel, {
@@ -637,66 +678,39 @@ open class KotlinUsesExtractor(
             return TypeResults(javaResult, kotlinResult)
         }
 
+        val owner = s.classifier.owner
         val primitiveInfo = primitiveTypeMapping.getPrimitiveInfo(s)
 
         when {
-            primitiveInfo != null -> return primitiveType(
-                s.classifier.owner as IrClass,
-                primitiveInfo.primitiveName, primitiveInfo.otherIsPrimitive,
-                primitiveInfo.javaClass,
-                primitiveInfo.kotlinPackageName, primitiveInfo.kotlinClassName
-            )
+            primitiveInfo != null -> {
+                if (owner is IrClass) {
+                    return primitiveType(
+                        owner,
+                        primitiveInfo.primitiveName, primitiveInfo.otherIsPrimitive,
+                        primitiveInfo.javaClass,
+                        primitiveInfo.kotlinPackageName, primitiveInfo.kotlinClassName
+                    )
+                } else {
+                    logger.error("Got primitive info for non-class (${owner.javaClass}) for ${s.render()}")
+                    return extractErrorType()
+                }
+            }
 
             (s.isBoxedArray && s.arguments.isNotEmpty()) || s.isPrimitiveArray() -> {
-
-                fun replaceComponentTypeWithAny(t: IrSimpleType, dimensions: Int): IrSimpleType =
-                    if (dimensions == 0)
-                        pluginContext.irBuiltIns.anyType as IrSimpleType
-                    else
-                        t.toBuilder().also { it.arguments = (it.arguments[0] as IrTypeProjection)
-                            .let { oldArg ->
-                                listOf(makeTypeProjection(replaceComponentTypeWithAny(oldArg.type as IrSimpleType, dimensions - 1), oldArg.variance))
-                            }
-                        }.buildSimpleType()
-
-                var componentType = s.getArrayElementType(pluginContext.irBuiltIns)
-                var isPrimitiveArray = false
-                var dimensions = 0
-                var elementType: IrType = s
-                while (elementType.isBoxedArray || elementType.isPrimitiveArray()) {
-                    dimensions++
-                    if (elementType.isPrimitiveArray())
-                        isPrimitiveArray = true
-                    if (((elementType as IrSimpleType).arguments.singleOrNull() as? IrTypeProjection)?.variance == Variance.IN_VARIANCE) {
-                        // Because Java's arrays are covariant, Kotlin will render Array<in X> as Object[], Array<Array<in X>> as Object[][] etc.
-                        componentType = replaceComponentTypeWithAny(s, dimensions - 1)
-                        elementType = pluginContext.irBuiltIns.anyType as IrSimpleType
-                        break
-                    }
-                    elementType = elementType.getArrayElementType(pluginContext.irBuiltIns)
-                }
-
-                return useArrayType(
-                    s,
-                    componentType,
-                    elementType,
-                    dimensions,
-                    isPrimitiveArray
-                )
+                val arrayInfo = useArrayType(s, false)
+                return arrayInfo.componentTypeResults
             }
 
-            s.classifier.owner is IrClass -> {
-                val classifier: IrClassifierSymbol = s.classifier
-                val cls: IrClass = classifier.owner as IrClass
+            owner is IrClass -> {
                 val args = if (s.isRawType()) null else s.arguments
 
-                return useSimpleTypeClass(cls, args, s.hasQuestionMark)
+                return useSimpleTypeClass(owner, args, s.isNullable())
             }
-            s.classifier.owner is IrTypeParameter -> {
-                val javaResult = useTypeParameter(s.classifier.owner as IrTypeParameter)
+            owner is IrTypeParameter -> {
+                val javaResult = useTypeParameter(owner)
                 val aClassId = makeClass("kotlin", "TypeParam") // TODO: Wrong
                 val kotlinResult = if (true) TypeResult(fakeKotlinType(), "TODO", "TODO") else
-                    if (s.hasQuestionMark) {
+                    if (s.isNullable()) {
                         val kotlinSignature = "${javaResult.signature}?" // TODO: Wrong
                         val kotlinLabel = "@\"kt_type;nullable;type_param\"" // TODO: Wrong
                         val kotlinId: Label<DbKt_nullable_type> = tw.getLabelFor(kotlinLabel, {
@@ -905,10 +919,17 @@ open class KotlinUsesExtractor(
         }
 
     private fun extendsAdditionAllowed(t: IrType) =
-        if (t.isBoxedArray)
-            arrayExtendsAdditionAllowed(t as IrSimpleType)
-        else
+        if (t.isBoxedArray) {
+            if (t is IrSimpleType) {
+                arrayExtendsAdditionAllowed(t)
+            } else {
+                logger.warn("Boxed array of unexpected kind ${t.javaClass}")
+                // Return false, for no particular reason
+                false
+            }
+        } else {
             ((t as? IrSimpleType)?.classOrNull?.owner?.isFinalClass) != true
+        }
 
     private fun wildcardAdditionAllowed(v: Variance, t: IrType, addByDefault: Boolean) =
         when {
@@ -1097,7 +1118,7 @@ open class KotlinUsesExtractor(
             return f.returnType
         }
 
-        val otherKeySet = parentClass.declarations.filterIsInstance<IrFunction>().find { it.name.asString() == "keySet" && it.valueParameters.size == 1 }
+        val otherKeySet = parentClass.declarations.findSubType<IrFunction> { it.name.asString() == "keySet" && it.valueParameters.size == 1 }
             ?: return f.returnType
 
         return otherKeySet.returnType.codeQlWithHasQuestionMark(false)
@@ -1117,10 +1138,6 @@ open class KotlinUsesExtractor(
         // Note not using `parentsWithSelf` as that only works if `d` is an IrDeclarationParent
         d.parents.any { (it as? IrAnnotationContainer)?.hasAnnotation(jvmWildcardSuppressionAnnotaton) == true }
 
-    protected fun IrFunction.isLocalFunction(): Boolean {
-        return this.visibility == DescriptorVisibilities.LOCAL
-    }
-
     /**
      * Class to hold labels for generated classes around local functions, lambdas, function references, and property references.
      */
@@ -1162,6 +1179,14 @@ open class KotlinUsesExtractor(
         return res
     }
 
+    fun getExistingLocallyVisibleFunctionLabel(f: IrFunction): Label<DbMethod>? {
+        if (!f.isLocalFunction()){
+            return null
+        }
+
+        return tw.lm.locallyVisibleFunctionLabelMapping[f]?.function
+    }
+
     // These are classes with Java equivalents, but whose methods don't all exist on those Java equivalents--
     // for example, the numeric classes define arithmetic functions (Int.plus, Long.or and so on) that lower to
     // primitive arithmetic on the JVM, but which we extract as calls to reflect the source syntax more closely.
@@ -1169,17 +1194,17 @@ open class KotlinUsesExtractor(
         "kotlin.Boolean", "kotlin.Byte", "kotlin.Char", "kotlin.Double", "kotlin.Float", "kotlin.Int", "kotlin.Long", "kotlin.Number", "kotlin.Short"
     )
 
-    private fun kotlinFunctionToJavaEquivalent(f: IrFunction, noReplace: Boolean) =
+    private fun kotlinFunctionToJavaEquivalent(f: IrFunction, noReplace: Boolean): IrFunction =
         if (noReplace)
             f
         else
             f.parentClassOrNull?.let { parentClass ->
                 getJavaEquivalentClass(parentClass)?.let { javaClass ->
-                    if (javaClass != parentClass)
+                    if (javaClass != parentClass) {
+                        val jvmName = getJvmName(f) ?: f.name.asString()
                         // Look for an exact type match...
-                        javaClass.declarations.find { decl ->
-                            decl is IrFunction &&
-                            decl.name == f.name &&
+                        javaClass.declarations.findSubType<IrFunction> { decl ->
+                            decl.name.asString() == jvmName &&
                             decl.valueParameters.size == f.valueParameters.size &&
                             // Note matching by classifier not the whole type so that generic arguments are allowed to differ,
                             // as they always will for method type parameters occurring in parameter types (e.g. <T> toArray(T[] array)
@@ -1187,23 +1212,20 @@ open class KotlinUsesExtractor(
                             decl.valueParameters.zip(f.valueParameters).all { p -> p.first.type.classifierOrNull == p.second.type.classifierOrNull }
                         } ?:
                         // Or if there is none, look for the only viable overload
-                        javaClass.declarations.singleOrNull { decl ->
-                            decl is IrFunction &&
-                            decl.name == f.name &&
+                        javaClass.declarations.singleOrNullSubType<IrFunction> { decl ->
+                            decl.name.asString() == jvmName &&
                             decl.valueParameters.size == f.valueParameters.size
                         } ?:
                         // Or check property accessors:
-                        if (f.isAccessor) {
-                            val prop = javaClass.declarations.filterIsInstance<IrProperty>().find { decl ->
-                                decl.name == (f.propertyIfAccessor as IrProperty).name
+                        (f.propertyIfAccessor as? IrProperty)?.let { kotlinProp ->
+                            val javaProp = javaClass.declarations.findSubType<IrProperty> { decl ->
+                                decl.name == kotlinProp.name
                             }
-                            if (prop?.getter?.name == f.name)
-                                prop.getter
-                            else if (prop?.setter?.name == f.name)
-                                prop.setter
+                            if (javaProp?.getter?.name == f.name)
+                                javaProp.getter
+                            else if (javaProp?.setter?.name == f.name)
+                                javaProp.setter
                             else null
-                        } else {
-                            null
                         } ?: run {
                             val parentFqName = parentClass.fqNameWhenAvailable?.asString()
                             if (!expectedMissingEquivalents.contains(parentFqName)) {
@@ -1211,10 +1233,11 @@ open class KotlinUsesExtractor(
                             }
                             null
                         }
+                    }
                     else
                         null
                 }
-            } as IrFunction? ?: f
+            } ?: f
 
     fun <T: DbCallable> useFunction(f: IrFunction, classTypeArgsIncludingOuterClasses: List<IrTypeArgument>? = null, noReplace: Boolean = false): Label<out T> {
         return useFunction(f, null, classTypeArgsIncludingOuterClasses, noReplace)
@@ -1416,12 +1439,11 @@ open class KotlinUsesExtractor(
         for(t in subbedSupertypes) {
             when(t) {
                 is IrSimpleType -> {
-                    when (t.classifier.owner) {
+                    val owner = t.classifier.owner
+                    when (owner) {
                         is IrClass -> {
-                            val classifier: IrClassifierSymbol = t.classifier
-                            val tcls: IrClass = classifier.owner as IrClass
                             val typeArgs = if (t.arguments.isNotEmpty() && mode is ExtractSupertypesMode.Raw) null else t.arguments
-                            val l = useClassInstance(tcls, typeArgs, inReceiverContext).typeResult.id
+                            val l = useClassInstance(owner, typeArgs, inReceiverContext).typeResult.id
                             tw.writeExtendsReftype(id, l)
                         }
                         else -> {
@@ -1459,13 +1481,13 @@ open class KotlinUsesExtractor(
                 return eraseTypeParameter(owner)
             }
 
-            if (t.isArray() || t.isNullableArray()) {
-                val elementType = t.getArrayElementType(pluginContext.irBuiltIns)
-                val erasedElementType = erase(elementType)
-                return (classifier as IrClassSymbol).typeWith(erasedElementType).codeQlWithHasQuestionMark(t.hasQuestionMark)
-            }
-
             if (owner is IrClass) {
+                if (t.isArray() || t.isNullableArray()) {
+                    val elementType = t.getArrayElementType(pluginContext.irBuiltIns)
+                    val erasedElementType = erase(elementType)
+                    return owner.typeWith(erasedElementType).codeQlWithHasQuestionMark(t.isNullable())
+                }
+
                 return if (t.arguments.isNotEmpty())
                     t.addAnnotations(listOf(RawTypeAnnotation.annotationConstructor))
                 else
diff --git a/java/kotlin-extractor/src/main/kotlin/Label.kt b/java/kotlin-extractor/src/main/kotlin/Label.kt
index 10459319a76..5a116bb0115 100644
--- a/java/kotlin-extractor/src/main/kotlin/Label.kt
+++ b/java/kotlin-extractor/src/main/kotlin/Label.kt
@@ -6,8 +6,8 @@ import java.io.StringWriter
 /**
  * This represents a label (`#...`) in a TRAP file.
  */
-interface Label<T> {
-    fun <U> cast(): Label<U> {
+interface Label<T: AnyDbType> {
+    fun <U: AnyDbType> cast(): Label<U> {
         @Suppress("UNCHECKED_CAST")
         return this as Label<U>
     }
@@ -17,7 +17,7 @@ interface Label<T> {
  * The label `#i`, e.g. `#123`. Most labels we generate are of this
  * form.
  */
-class IntLabel<T>(val i: Int): Label<T> {
+class IntLabel<T: AnyDbType>(val i: Int): Label<T> {
     override fun toString(): String = "#$i"
 }
 
@@ -26,6 +26,6 @@ class IntLabel<T>(val i: Int): Label<T> {
  * shared between different components (e.g. when both the interceptor
  * and the extractor need to refer to the same label).
  */
-class StringLabel<T>(val name: String): Label<T> {
+class StringLabel<T: AnyDbType>(val name: String): Label<T> {
     override fun toString(): String = "#$name"
 }
diff --git a/java/kotlin-extractor/src/main/kotlin/TrapWriter.kt b/java/kotlin-extractor/src/main/kotlin/TrapWriter.kt
index a4902dc10c9..2fae0a1e5d9 100644
--- a/java/kotlin-extractor/src/main/kotlin/TrapWriter.kt
+++ b/java/kotlin-extractor/src/main/kotlin/TrapWriter.kt
@@ -26,7 +26,7 @@ class TrapLabelManager {
     private var nextInt: Int = 100
 
     /** Returns a fresh label. */
-    fun <T> getFreshLabel(): Label<T> {
+    fun <T: AnyDbType> getFreshLabel(): Label<T> {
         return IntLabel(nextInt++)
     }
 
@@ -64,7 +64,7 @@ open class TrapWriter (protected val loggerBase: LoggerBase, val lm: TrapLabelMa
      * `getLabelFor` instead, which allows non-existent labels to be
      * initialised.
      */
-    fun <T> getExistingLabelFor(key: String): Label<T>? {
+    fun <T: AnyDbType> getExistingLabelFor(key: String): Label<T>? {
         return lm.labelMapping.get(key)?.cast<T>()
     }
     /**
@@ -73,7 +73,7 @@ open class TrapWriter (protected val loggerBase: LoggerBase, val lm: TrapLabelMa
      * is run on it, and it is returned.
      */
     @JvmOverloads // Needed so Java can call a method with an optional argument
-    fun <T> getLabelFor(key: String, initialise: (Label<T>) -> Unit = {}): Label<T> {
+    fun <T: AnyDbType> getLabelFor(key: String, initialise: (Label<T>) -> Unit = {}): Label<T> {
         val maybeLabel: Label<T>? = getExistingLabelFor(key)
         if(maybeLabel == null) {
             val label: Label<T> = lm.getFreshLabel()
@@ -89,7 +89,7 @@ open class TrapWriter (protected val loggerBase: LoggerBase, val lm: TrapLabelMa
     /**
      * Returns a label for a fresh ID (i.e. a new label bound to `*`).
      */
-    fun <T> getFreshIdLabel(): Label<T> {
+    fun <T: AnyDbType> getFreshIdLabel(): Label<T> {
         val label: Label<T> = lm.getFreshLabel()
         writeTrap("$label = *\n")
         return label
@@ -319,7 +319,7 @@ class SourceFileTrapWriter (
     lm: TrapLabelManager,
     bw: BufferedWriter,
     diagnosticTrapWriter: TrapWriter?,
-    irFile: IrFile,
+    val irFile: IrFile,
     populateFileTables: Boolean) :
     FileTrapWriter(loggerBase, lm, bw, diagnosticTrapWriter, irFile.path, populateFileTables) {
 
diff --git a/java/kotlin-extractor/src/main/kotlin/comments/CommentExtractor.kt b/java/kotlin-extractor/src/main/kotlin/comments/CommentExtractor.kt
index 03f032f8810..c1a1d566a74 100644
--- a/java/kotlin-extractor/src/main/kotlin/comments/CommentExtractor.kt
+++ b/java/kotlin-extractor/src/main/kotlin/comments/CommentExtractor.kt
@@ -2,11 +2,15 @@ package com.github.codeql.comments
 
 import com.github.codeql.*
 import com.github.codeql.utils.IrVisitorLookup
+import com.github.codeql.utils.isLocalFunction
 import com.github.codeql.utils.versions.Psi2Ir
 import com.intellij.psi.PsiComment
 import com.intellij.psi.PsiElement
 import org.jetbrains.kotlin.ir.IrElement
 import org.jetbrains.kotlin.ir.declarations.*
+import org.jetbrains.kotlin.ir.expressions.IrBody
+import org.jetbrains.kotlin.ir.expressions.IrExpression
+import org.jetbrains.kotlin.ir.util.parentClassOrNull
 import org.jetbrains.kotlin.kdoc.psi.api.KDoc
 import org.jetbrains.kotlin.lexer.KtTokens
 import org.jetbrains.kotlin.psi.KtVisitor
@@ -89,38 +93,88 @@ class CommentExtractor(private val fileExtractor: KotlinFileExtractor, private v
                 file.accept(IrVisitorLookup(psi2Ir, ownerPsi, file), owners)
 
                 for (ownerIr in owners) {
-                    val ownerLabel =
-                        if (ownerIr == file)
-                            fileLabel
-                        else {
-                            if (ownerIr is IrValueParameter && ownerIr.index == -1) {
-                                // Don't attribute comments to the implicit `this` parameter of a function.
-                                continue
-                            }
-                            val label: String
-                            val existingLabel = if (ownerIr is IrVariable) {
-                                label = "variable ${ownerIr.name.asString()}"
-                                tw.getExistingVariableLabelFor(ownerIr)
-                            } else {
-                                label = fileExtractor.getLabel(ownerIr) ?: continue
-                                tw.getExistingLabelFor<DbTop>(label)
-                            }
-                            if (existingLabel == null) {
-                                logger.warn("Couldn't get existing label for $label")
-                                continue
-                            }
-                            existingLabel
-                        }
-                    tw.writeKtCommentOwners(commentLabel, ownerLabel)
+                    val ownerLabel = getLabel(ownerIr)
+                    if (ownerLabel != null) {
+                        tw.writeKtCommentOwners(commentLabel, ownerLabel)
+                    }
                 }
             }
 
             private fun getKDocOwner(comment: KDoc) : PsiElement? {
                 val owner = comment.owner
                 if (owner == null) {
-                    logger.warn("Couldn't get owner of KDoc.")
+                    logger.warn("Couldn't get owner of KDoc. The comment is extracted without an owner.")
                 }
                 return owner
             }
+
+            private fun getLabel(element: IrElement): Label<out DbTop>? {
+                if (element == file)
+                    return fileLabel
+
+                if (element is IrValueParameter && element.index == -1) {
+                    // Don't attribute comments to the implicit `this` parameter of a function.
+                    return null
+                }
+
+                val label: String
+                val existingLabel = if (element is IrVariable) {
+                    // local variables are not named globally, so we need to get them from the variable label cache
+                    label = "variable ${element.name.asString()}"
+                    tw.getExistingVariableLabelFor(element)
+                } else if (element is IrFunction && element.isLocalFunction()) {
+                    // local functions are not named globally, so we need to get them from the local function label cache
+                    label = "local function ${element.name.asString()}"
+                    fileExtractor.getExistingLocallyVisibleFunctionLabel(element)
+                }
+                else {
+                    label = getLabelForNamedElement(element) ?: return null
+                    tw.getExistingLabelFor<DbTop>(label)
+                }
+                if (existingLabel == null) {
+                    logger.warn("Couldn't get existing label for $label")
+                    return null
+                }
+                return existingLabel
+            }
+
+            private fun getLabelForNamedElement(element: IrElement) : String? {
+                when (element) {
+                    is IrClass -> return fileExtractor.getClassLabel(element, listOf()).classLabel
+                    is IrTypeParameter -> return fileExtractor.getTypeParameterLabel(element)
+                    is IrFunction -> {
+                        return if (element.isLocalFunction()) {
+                            null
+                        } else {
+                            fileExtractor.getFunctionLabel(element, null)
+                        }
+                    }
+                    is IrValueParameter -> return fileExtractor.getValueParameterLabel(element, null)
+                    is IrProperty -> return fileExtractor.getPropertyLabel(element)
+                    is IrField -> return fileExtractor.getFieldLabel(element)
+                    is IrEnumEntry -> return fileExtractor.getEnumEntryLabel(element)
+                    is IrTypeAlias -> return fileExtractor.getTypeAliasLabel(element)
+
+                    is IrAnonymousInitializer -> {
+                        val parentClass = element.parentClassOrNull
+                        if (parentClass == null) {
+                            logger.warnElement("Parent of anonymous initializer is not a class", element)
+                            return null
+                        }
+                        // Assign the comment to the class. The content of the `init` blocks might be extracted in multiple constructors.
+                        return getLabelForNamedElement(parentClass)
+                    }
+
+                    // Fresh entities, not named elements:
+                    is IrBody -> return null
+                    is IrExpression -> return null
+
+                    // todo add others:
+                    else -> {
+                        logger.warnElement("Unhandled element type found during comment extraction: ${element::class}", element)
+                        return null
+                    }
+                }
         }
+    }
 }
diff --git a/java/kotlin-extractor/src/main/kotlin/utils/Helpers.kt b/java/kotlin-extractor/src/main/kotlin/utils/Helpers.kt
new file mode 100644
index 00000000000..c1f498beda2
--- /dev/null
+++ b/java/kotlin-extractor/src/main/kotlin/utils/Helpers.kt
@@ -0,0 +1,8 @@
+package com.github.codeql.utils
+
+import org.jetbrains.kotlin.descriptors.DescriptorVisibilities
+import org.jetbrains.kotlin.ir.declarations.IrFunction
+
+fun IrFunction.isLocalFunction(): Boolean {
+    return this.visibility == DescriptorVisibilities.LOCAL
+}
\ No newline at end of file
diff --git a/java/kotlin-extractor/src/main/kotlin/utils/Iterable.kt b/java/kotlin-extractor/src/main/kotlin/utils/Iterable.kt
new file mode 100644
index 00000000000..c21c4729d40
--- /dev/null
+++ b/java/kotlin-extractor/src/main/kotlin/utils/Iterable.kt
@@ -0,0 +1,26 @@
+package com.github.codeql
+
+import org.jetbrains.kotlin.ir.declarations.IrDeclaration
+
+/**
+ * This behaves the same as Iterable<IrDeclaration>.find, but requires
+ * that the value found is of the subtype S, and it casts
+ * the result for you appropriately.
+ */
+inline fun <reified S: IrDeclaration> Iterable<IrDeclaration>.findSubType(
+    predicate: (S) -> Boolean
+): S? {
+    return this.find { it is S && predicate(it) } as S?
+}
+
+/**
+ * This behaves the same as Iterable<IrDeclaration>.singleOrNull, but
+ * requires that the value found is of the subtype S, and it casts
+ * the result for you appropriately.
+ */
+inline fun <reified S: IrDeclaration> Iterable<IrDeclaration>.singleOrNullSubType(
+    predicate: (S) -> Boolean
+): S? {
+    return this.singleOrNull { it is S && predicate(it) } as S?
+}
+
diff --git a/java/kotlin-extractor/src/main/kotlin/utils/TypeResults.kt b/java/kotlin-extractor/src/main/kotlin/utils/TypeResults.kt
index 7dde30cf932..428c7dab718 100644
--- a/java/kotlin-extractor/src/main/kotlin/utils/TypeResults.kt
+++ b/java/kotlin-extractor/src/main/kotlin/utils/TypeResults.kt
@@ -12,10 +12,10 @@ package com.github.codeql
  * `shortName` is a Java primitive name (e.g. "int"), a class short name with Java-style type arguments ("InnerClass<E>" or
  * "OuterClass<ConcreteArgument>" or "OtherClass<? extends Bound>") or an array ("componentShortName[]").
  */
-data class TypeResultGeneric<SignatureType,out LabelType>(val id: Label<out LabelType>, val signature: SignatureType, val shortName: String) {
-    fun <U> cast(): TypeResult<U> {
+data class TypeResultGeneric<SignatureType,out LabelType: AnyDbType>(val id: Label<out LabelType>, val signature: SignatureType, val shortName: String) {
+    fun <U: AnyDbType> cast(): TypeResultGeneric<SignatureType,U> {
         @Suppress("UNCHECKED_CAST")
-        return this as TypeResult<U>
+        return this as TypeResultGeneric<SignatureType,U>
     }
 }
 data class TypeResultsGeneric<SignatureType>(val javaResult: TypeResultGeneric<SignatureType,DbType>, val kotlinResult: TypeResultGeneric<SignatureType,DbKt_type>)
@@ -25,6 +25,6 @@ typealias TypeResultWithoutSignature<T> = TypeResultGeneric<Unit,T>
 typealias TypeResults = TypeResultsGeneric<String>
 typealias TypeResultsWithoutSignatures = TypeResultsGeneric<Unit>
 
-fun <T> TypeResult<T>.forgetSignature(): TypeResultWithoutSignature<T> {
+fun <T: AnyDbType> TypeResult<T>.forgetSignature(): TypeResultWithoutSignature<T> {
     return TypeResultWithoutSignature(this.id, Unit, this.shortName)
 }
diff --git a/java/kotlin-extractor/src/main/kotlin/utils/TypeSubstitution.kt b/java/kotlin-extractor/src/main/kotlin/utils/TypeSubstitution.kt
index e8a8b506d73..b402eee0030 100644
--- a/java/kotlin-extractor/src/main/kotlin/utils/TypeSubstitution.kt
+++ b/java/kotlin-extractor/src/main/kotlin/utils/TypeSubstitution.kt
@@ -1,6 +1,7 @@
 package com.github.codeql.utils
 
 import com.github.codeql.KotlinUsesExtractor
+import com.github.codeql.Logger
 import com.github.codeql.getJavaEquivalentClassId
 import com.github.codeql.utils.versions.codeQlWithHasQuestionMark
 import com.github.codeql.utils.versions.createImplicitParameterDeclarationWithWrappedDescriptor
@@ -25,6 +26,7 @@ import org.jetbrains.kotlin.ir.types.impl.makeTypeProjection
 import org.jetbrains.kotlin.ir.util.classId
 import org.jetbrains.kotlin.ir.util.constructedClassType
 import org.jetbrains.kotlin.ir.util.constructors
+import org.jetbrains.kotlin.ir.util.kotlinFqName
 import org.jetbrains.kotlin.name.FqName
 import org.jetbrains.kotlin.name.Name
 import org.jetbrains.kotlin.types.Variance
@@ -54,7 +56,7 @@ private fun IrSimpleType.substituteTypeArguments(substitutionMap: Map<IrTypePara
 
     return IrSimpleTypeImpl(
         classifier,
-        hasQuestionMark,
+        isNullable(),
         newArguments,
         annotations
     )
@@ -90,7 +92,7 @@ private fun subProjectedType(substitutionMap: Map<IrTypeParameterSymbol, IrTypeA
             if (conflictingVariance(outerVariance, substitutedTypeArg.variance))
                 IrStarProjectionImpl
             else {
-                val newProjectedType = substitutedTypeArg.type.let { if (t.hasQuestionMark) it.codeQlWithHasQuestionMark(true) else it }
+                val newProjectedType = substitutedTypeArg.type.let { if (t.isNullable()) it.codeQlWithHasQuestionMark(true) else it }
                 val newVariance = combineVariance(outerVariance, substitutedTypeArg.variance)
                 makeTypeProjection(newProjectedType, newVariance)
             }
@@ -123,14 +125,17 @@ private fun IrTypeArgument.lowerBound(context: IrPluginContext) =
 
 fun IrType.substituteTypeAndArguments(substitutionMap: Map<IrTypeParameterSymbol, IrTypeArgument>?, useContext: KotlinUsesExtractor.TypeContext, pluginContext: IrPluginContext): IrType =
     substitutionMap?.let { substMap ->
-        this.classifierOrNull?.let { typeClassifier ->
+        if (this is IrSimpleType) {
+            val typeClassifier = this.classifier
             substMap[typeClassifier]?.let {
                 when(useContext) {
                     KotlinUsesExtractor.TypeContext.RETURN -> it.upperBound(pluginContext)
                     else -> it.lowerBound(pluginContext)
                 }
-            } ?: (this as IrSimpleType).substituteTypeArguments(substMap)
-        } ?: this
+            } ?: this.substituteTypeArguments(substMap)
+        } else {
+            this
+        }
     } ?: this
 
 object RawTypeAnnotation {
@@ -191,7 +196,7 @@ fun IrTypeArgument.withQuestionMark(b: Boolean): IrTypeArgument =
         is IrStarProjection -> this
         is IrTypeProjection ->
             this.type.let { when(it) {
-                is IrSimpleType -> if (it.hasQuestionMark == b) this else makeTypeProjection(it.codeQlWithHasQuestionMark(b), this.variance)
+                is IrSimpleType -> if (it.isNullable() == b) this else makeTypeProjection(it.codeQlWithHasQuestionMark(b), this.variance)
                 else -> this
             }}
         else -> this
@@ -212,27 +217,34 @@ private fun matchingTypeParameters(l: IrTypeParameter?, r: IrTypeParameter): Boo
 }
 
 // Returns true if type is C<T1, T2, ...> where C is declared `class C<T1, T2, ...> { ... }`
-fun isUnspecialised(paramsContainer: IrTypeParametersContainer, args: List<IrTypeArgument>): Boolean {
+fun isUnspecialised(paramsContainer: IrTypeParametersContainer, args: List<IrTypeArgument>, logger: Logger): Boolean {
+    return isUnspecialised(paramsContainer, args, logger, paramsContainer)
+}
+
+private fun isUnspecialised(paramsContainer: IrTypeParametersContainer, args: List<IrTypeArgument>, logger: Logger, origParamsContainer: IrTypeParametersContainer): Boolean {
     val unspecialisedHere = paramsContainer.typeParameters.zip(args).all { paramAndArg ->
         (paramAndArg.second as? IrTypeProjection)?.let {
             // Type arg refers to the class' own type parameter?
             it.variance == Variance.INVARIANT &&
-            matchingTypeParameters(it.type.classifierOrNull?.owner as? IrTypeParameter, paramAndArg.first)
+                    matchingTypeParameters(it.type.classifierOrNull?.owner as? IrTypeParameter, paramAndArg.first)
         } ?: false
     }
     val remainingArgs = args.drop(paramsContainer.typeParameters.size)
 
-    val parentClass = paramsContainer.parents.firstIsInstanceOrNull<IrClass>()
+    val parentTypeContainer = paramsContainer.parents.firstIsInstanceOrNull<IrTypeParametersContainer>()
 
     val parentUnspecialised = when {
         remainingArgs.isEmpty() -> true
-        parentClass == null -> false
-        else -> isUnspecialised(parentClass, remainingArgs)
+        parentTypeContainer == null -> {
+            logger.error("Found more type arguments than parameters: ${origParamsContainer.kotlinFqName.asString()}")
+            false
+        }
+        else -> isUnspecialised(parentTypeContainer, remainingArgs, logger, origParamsContainer)
     }
     return unspecialisedHere && parentUnspecialised
 }
 
 // Returns true if type is C<T1, T2, ...> where C is declared `class C<T1, T2, ...> { ... }`
-fun isUnspecialised(type: IrSimpleType) = (type.classifier.owner as? IrClass)?.let {
-    isUnspecialised(it, type.arguments)
+fun isUnspecialised(type: IrSimpleType, logger: Logger) = (type.classifier.owner as? IrClass)?.let {
+    isUnspecialised(it, type.arguments, logger)
 } ?: false
diff --git a/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/app/build.gradle b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/app/build.gradle
new file mode 100644
index 00000000000..c0bc3340524
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/app/build.gradle
@@ -0,0 +1,25 @@
+/*
+ * This file was generated by the Gradle 'init' task.
+ *
+ * This generated file contains a sample Kotlin application project to get you started.
+ * For more details take a look at the 'Building Java & JVM projects' chapter in the Gradle
+ * User Manual available at https://docs.gradle.org/7.0.2/userguide/building_java_projects.html
+ */
+
+plugins {
+    // Apply the org.jetbrains.kotlin.jvm Plugin to add support for Kotlin.
+    id 'org.jetbrains.kotlin.jvm' version '1.7.0'
+
+    // Apply the application plugin to add support for building a CLI application in Java.
+    id 'application'
+}
+
+repositories {
+    // Use Maven Central for resolving dependencies.
+    mavenCentral()
+}
+
+application {
+    // Define the main class for the application.
+    mainClass = 'testProject.AppKt'
+}
diff --git a/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/app/src/main/kotlin/testProject/App.kt b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/app/src/main/kotlin/testProject/App.kt
new file mode 100644
index 00000000000..0ed9df24a57
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/app/src/main/kotlin/testProject/App.kt
@@ -0,0 +1,15 @@
+/*
+ * This Kotlin source file was generated by the Gradle 'init' task.
+ */
+package testProject
+
+class App {
+    val greeting: String
+        get() {
+            return "Hello World!"
+        }
+}
+
+fun main() {
+    // TODO: println(App().greeting)
+}
diff --git a/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/compArgs.expected b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/compArgs.expected
new file mode 100644
index 00000000000..d560b9b520d
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/compArgs.expected
@@ -0,0 +1,15 @@
+| 0 | -Xallow-no-source-files |
+| 1 | -classpath |
+| 2 | <PATH> |
+| 3 | -d |
+| 4 | app/build/classes/kotlin/main |
+| 5 | -jdk-home |
+| 6 | <PATH> |
+| 7 | -module-name |
+| 8 | app |
+| 9 | -no-reflect |
+| 10 | -no-stdlib |
+| 11 | <PLUGINS> |
+| 12 | app/src/main/kotlin/testProject/App.kt |
+| 13 | -jvm-target |
+| 14 | 1.8 |
diff --git a/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/compArgs.ql b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/compArgs.ql
new file mode 100644
index 00000000000..fe4bedba634
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/compArgs.ql
@@ -0,0 +1,15 @@
+import java
+
+private string getArgument(Compilation c, int i) {
+  exists(string arg | arg = c.getArgument(i) |
+    if exists(arg.indexOf("-Xplugin="))
+    then result = "<PLUGINS>"
+    else
+      if c.getArgument(i - 1) = ["-classpath", "-jdk-home"]
+      then result = "<PATH>"
+      else result = arg
+  )
+}
+
+from Compilation c, int i
+select i, getArgument(c, i)
diff --git a/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/settings.gradle b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/settings.gradle
new file mode 100644
index 00000000000..a56fb7dd11c
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/settings.gradle
@@ -0,0 +1,11 @@
+/*
+ * This file was generated by the Gradle 'init' task.
+ *
+ * The settings file is used to specify which projects to include in your build.
+ *
+ * Detailed information about configuring a multi-project build in Gradle can be found
+ * in the user manual at https://docs.gradle.org/7.0.2/userguide/multi_project_builds.html
+ */
+
+rootProject.name = 'testProject'
+include('app')
diff --git a/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/test.py b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/test.py
new file mode 100644
index 00000000000..e5e9aca69bc
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/compiler_arguments/test.py
@@ -0,0 +1,5 @@
+from create_database_utils import *
+
+run_codeql_database_create(
+    ["gradle build --no-daemon --no-build-cache"], lang="java")
+runSuccessfully(["gradle", "clean"])
diff --git a/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/app/build.gradle b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/app/build.gradle
new file mode 100644
index 00000000000..924524190cf
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/app/build.gradle
@@ -0,0 +1,25 @@
+/*
+ * This file was generated by the Gradle 'init' task.
+ *
+ * This generated file contains a sample Kotlin application project to get you started.
+ * For more details take a look at the 'Building Java & JVM projects' chapter in the Gradle
+ * User Manual available at https://docs.gradle.org/7.0.2/userguide/building_java_projects.html
+ */
+
+plugins {
+    // Apply the org.jetbrains.kotlin.jvm Plugin to add support for Kotlin.
+    id 'org.jetbrains.kotlin.jvm' version '1.6.20'
+
+    // Apply the application plugin to add support for building a CLI application in Java.
+    id 'application'
+}
+
+repositories {
+    // Use Maven Central for resolving dependencies.
+    mavenCentral()
+}
+
+application {
+    // Define the main class for the application.
+    mainClass = 'testProject.AppKt'
+}
diff --git a/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/app/src/main/kotlin/testProject/App.kt b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/app/src/main/kotlin/testProject/App.kt
new file mode 100644
index 00000000000..283f9270626
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/app/src/main/kotlin/testProject/App.kt
@@ -0,0 +1,10 @@
+import kotlin.reflect.*
+
+fun fn() {
+    val ref: KFunction2<Ccc, Int, Double> = Ccc::m
+    ref.invoke(Ccc(), 1)
+}
+
+class Ccc {
+    fun m(i:Int):Double = 5.0
+}
diff --git a/java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidDatabaseTest.expected b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/diagnostics.expected
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidDatabaseTest.expected
rename to java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/diagnostics.expected
diff --git a/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/diagnostics.ql b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/diagnostics.ql
new file mode 100644
index 00000000000..071cbb1b6ec
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/diagnostics.ql
@@ -0,0 +1,4 @@
+import java
+import semmle.code.java.Diagnostics
+
+query predicate diag(Diagnostic d) { any() }
diff --git a/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/settings.gradle b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/settings.gradle
new file mode 100644
index 00000000000..a56fb7dd11c
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/settings.gradle
@@ -0,0 +1,11 @@
+/*
+ * This file was generated by the Gradle 'init' task.
+ *
+ * The settings file is used to specify which projects to include in your build.
+ *
+ * Detailed information about configuring a multi-project build in Gradle can be found
+ * in the user manual at https://docs.gradle.org/7.0.2/userguide/multi_project_builds.html
+ */
+
+rootProject.name = 'testProject'
+include('app')
diff --git a/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/test.py b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/test.py
new file mode 100644
index 00000000000..3a4f9d2032e
--- /dev/null
+++ b/java/ql/integration-tests/posix-only/kotlin/kotlin_kfunction/test.py
@@ -0,0 +1,5 @@
+from create_database_utils import *
+
+run_codeql_database_create(
+    ["gradle build --no-daemon --no-build-cache --rerun-tasks"], lang="java")
+runSuccessfully(["gradle", "clean"])
diff --git a/java/ql/lib/change-notes/2022-04-01-annotation-deprecations.md b/java/ql/lib/change-notes/2022-04-01-annotation-deprecations.md
new file mode 100644
index 00000000000..8c8046670a1
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-04-01-annotation-deprecations.md
@@ -0,0 +1,7 @@
+---
+category: deprecated
+---
+* The predicate `Annotation.getAValue()` has been deprecated because it might lead to obtaining the value of the wrong annotation element by accident. `getValue(string)` (or one of the value type specific predicates) should be used to explicitly specify the name of the annotation element.
+* The predicate `Annotation.getAValue(string)` has been renamed to `getAnArrayValue(string)`.
+* The predicate `SuppressWarningsAnnotation.getASuppressedWarningLiteral()` has been deprecated because it unnecessarily restricts the result type; `getASuppressedWarning()` should be used instead.
+* The predicates `TargetAnnotation.getATargetExpression()` and `RetentionAnnotation.getRetentionPolicyExpression()` have been deprecated because getting the enum constant read expression is rarely useful, instead the corresponding predicates for getting the name of the referenced enum constants should be used.
diff --git a/java/ql/lib/change-notes/2022-04-01-annotation-features.md b/java/ql/lib/change-notes/2022-04-01-annotation-features.md
new file mode 100644
index 00000000000..3a2d6e2561c
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-04-01-annotation-features.md
@@ -0,0 +1,9 @@
+---
+category: feature
+---
+* The predicates of the CodeQL class `Annotation` have been improved:
+  * Convenience value type specific predicates have been added, such as `getEnumConstantValue(string)` or `getStringValue(string)`.
+  * Convenience predicates for elements with array values have been added, such as `getAnEnumConstantArrayValue(string)`. While the behavior of the existing predicates has not changed, usage of them should be reviewed (or replaced with the newly added predicate) to make sure they work correctly for elements with array values.
+  * Some internal CodeQL usage of the `Annotation` predicates has been adjusted and corrected; this might affect the results of some queries.
+* New predicates have been added to the CodeQL class `Annotatable` to support getting declared and associated annotations. As part of that, `hasAnnotation()` has been changed to also consider inherited annotations, to be consistent with `hasAnnotation(string, string)` and `getAnAnnotation()`. The newly added predicate `hasDeclaredAnnotation()` can be used as replacement for the old functionality.
+* New predicates have been added to the CodeQL class `AnnotationType` to simplify getting information about usage of JDK meta-annotations, such as `@Retention`.
diff --git a/java/ql/lib/change-notes/2022-08-18-android-manifest-backup-predicate.md b/java/ql/lib/change-notes/2022-08-18-android-manifest-backup-predicate.md
new file mode 100644
index 00000000000..0af4f964170
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-08-18-android-manifest-backup-predicate.md
@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added a new predicate, `allowsBackup`, in the `AndroidApplicationXmlElement` class. This predicate detects if the application element does not disable the `android:allowBackup` attribute.
diff --git a/java/ql/lib/change-notes/2022-08-19-string-taint-models.md b/java/ql/lib/change-notes/2022-08-19-string-taint-models.md
new file mode 100644
index 00000000000..7d7404755ea
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-08-19-string-taint-models.md
@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Added taint flow models for the `java.lang.String.(charAt|getBytes)` methods.
+* Improved taint flow models for the `java.lang.String.(replace|replaceFirst|replaceAll)` methods. Additional results may be found where users do not properly sanitize their inputs.
diff --git a/java/ql/lib/change-notes/2022-08-23-contentresolver-summaries.md b/java/ql/lib/change-notes/2022-08-23-contentresolver-summaries.md
new file mode 100644
index 00000000000..03790ce61c6
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-08-23-contentresolver-summaries.md
@@ -0,0 +1,10 @@
+---
+category: minorAnalysis
+---
+* Added new flow steps for the following Android classes:
+  * `android.content.ContentResolver`
+  * `android.content.ContentProviderClient`
+  * `android.content.ContentProviderOperation`
+  * `android.content.ContentProviderOperation$Builder`
+  * `android.content.ContentProviderResult`
+  * `android.database.Cursor`
diff --git a/java/ql/lib/change-notes/2022-08-25-taint-model-spring-crudrepository.md b/java/ql/lib/change-notes/2022-08-25-taint-model-spring-crudrepository.md
new file mode 100644
index 00000000000..2d5fce9346f
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-08-25-taint-model-spring-crudrepository.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added flow summary for `org.springframework.data.repository.CrudRepository.save()`.
diff --git a/java/ql/lib/change-notes/2022-08-31-kotlin-stdlib.md b/java/ql/lib/change-notes/2022-08-31-kotlin-stdlib.md
new file mode 100644
index 00000000000..c1288fd6568
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-08-31-kotlin-stdlib.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added flow sinks, sources and summaries for the Kotlin standard library.
\ No newline at end of file
diff --git a/java/ql/lib/change-notes/2022-09-06-notificationcompat-summaries.md b/java/ql/lib/change-notes/2022-09-06-notificationcompat-summaries.md
new file mode 100644
index 00000000000..e95ad457844
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-09-06-notificationcompat-summaries.md
@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Added new flow steps for `androidx.core.app.NotificationCompat` and its inner classes.
+  
\ No newline at end of file
diff --git a/java/ql/lib/change-notes/2022-09-07-implicit-pendingintents-compat-sinks.md b/java/ql/lib/change-notes/2022-09-07-implicit-pendingintents-compat-sinks.md
new file mode 100644
index 00000000000..a1ae10ac7d5
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-09-07-implicit-pendingintents-compat-sinks.md
@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Added new sinks to the query `java/android/implict-pendingintents` to take into account the classes `androidx.core.app.NotificationManagerCompat` and `androidx.core.app.AlarmManagerCompat`.
+  
\ No newline at end of file
diff --git a/java/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md b/java/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md
new file mode 100644
index 00000000000..efdaf85f2ed
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed an issue in the taint tracking analysis where implicit reads were not allowed by default in sinks or additional taint steps that used flow states.
\ No newline at end of file
diff --git a/java/ql/lib/change-notes/2022-09-13-Member-getQualifiedName.md b/java/ql/lib/change-notes/2022-09-13-Member-getQualifiedName.md
new file mode 100644
index 00000000000..70b897911a8
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-09-13-Member-getQualifiedName.md
@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* The `Member.getQualifiedName()` predicate result now includes the qualified name of the declaring type.
diff --git a/java/ql/lib/change-notes/2022-09-16-dispatch-confidence.md b/java/ql/lib/change-notes/2022-09-16-dispatch-confidence.md
new file mode 100644
index 00000000000..9287e9abae3
--- /dev/null
+++ b/java/ql/lib/change-notes/2022-09-16-dispatch-confidence.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* The virtual dispatch relation used in data flow now favors summary models over source code for dispatch to interface methods from `java.util` unless there is evidence that a specific source implementation is reachable. This should provide increased precision for any projects that include, for example, custom `List` or `Map` implementations.
diff --git a/java/ql/lib/change-notes/released/0.3.4.md b/java/ql/lib/change-notes/released/0.3.4.md
index 3fcd4f17053..4270abf9774 100644
--- a/java/ql/lib/change-notes/released/0.3.4.md
+++ b/java/ql/lib/change-notes/released/0.3.4.md
@@ -19,7 +19,7 @@
 
 ### Minor Analysis Improvements
 
-* Added new flow steps for the classes `java.io.Path` and `java.nio.Paths`.
+* Added new flow steps for the classes `java.nio.file.Path` and `java.nio.file.Paths`.
 * The class `AndroidFragment` now also models the Android Jetpack version of the `Fragment` class (`androidx.fragment.app.Fragment`).
 * Java 19 builds can now be extracted. There are no non-preview new language features in this release, so the only user-visible change is that the CodeQL extractor will now correctly trace compilations using the JDK 19 release of `javac`.
 * Classes and methods that are seen with several different paths during the extraction process (for example, packaged into different JAR files) now report an arbitrarily selected location via their `getLocation` and `hasLocationInfo` predicates, rather than reporting all of them. This may lead to reduced alert duplication.
diff --git a/java/ql/lib/semmle/code/Location.qll b/java/ql/lib/semmle/code/Location.qll
index c906b9f2407..256b831a8ad 100644
--- a/java/ql/lib/semmle/code/Location.qll
+++ b/java/ql/lib/semmle/code/Location.qll
@@ -216,7 +216,7 @@ private predicate fixedHasLocation(Top l, Location loc, File f) {
     min(Location candidateLoc |
       hasLocation(l, candidateLoc)
     |
-      candidateLoc order by candidateLoc.getFile().toString()
+      candidateLoc order by candidateLoc.getFile().getAbsolutePath()
     ) and
   not hasSourceLocation(l, _, _) and
   locations_default(loc, f, _, _, _, _)
diff --git a/java/ql/lib/semmle/code/java/Annotation.qll b/java/ql/lib/semmle/code/java/Annotation.qll
index 0b83d3b435e..28f994053a2 100644
--- a/java/ql/lib/semmle/code/java/Annotation.qll
+++ b/java/ql/lib/semmle/code/java/Annotation.qll
@@ -44,12 +44,100 @@ class Annotation extends @annotation, Expr {
     result = this.getType().getAnnotationElement(name)
   }
 
-  /** Gets a value of an annotation element. */
-  Expr getAValue() { filteredAnnotValue(this, _, result) }
+  /**
+   * DEPRECATED: Getting the value of _any_ annotation element is error-prone because
+   * it could lead to selecting the value of the wrong element by accident (for example
+   * when an annotation type is extended in the future). Prefer the predicate `getValue(string)`
+   * and explicitly specify the element name. Use `getValue(_)` if it is really desired to
+   * get the value of any element.
+   *
+   * Gets a value of an annotation element. This includes default values in case
+   * no explicit value is specified. For elements with an array value type this
+   * might have an `ArrayInit` as result. To properly handle array values, prefer
+   * the predicate `getAnArrayValue`.
+   */
+  deprecated Expr getAValue() { filteredAnnotValue(this, _, result) }
 
-  /** Gets the value of the annotation element with the specified `name`. */
+  /**
+   * Gets the value of the annotation element with the specified `name`.
+   * This includes default values in case no explicit value is specified.
+   * For elements with an array value type this might get an `ArrayInit` instance.
+   * To properly handle array values, prefer the predicate `getAnArrayValue`.
+   */
   Expr getValue(string name) { filteredAnnotValue(this, this.getAnnotationElement(name), result) }
 
+  /**
+   * Gets the value of the annotation element, if its type is not an array.
+   * This guarantees that for consistency even elements of type array with a
+   * single value have no result, to prevent accidental error-prone usage.
+   */
+  private Expr getNonArrayValue(string name) {
+    result = this.getValue(name) and
+    not this.getAnnotationElement(name).getType() instanceof Array
+  }
+
+  /**
+   * If the value type of the annotation element with the specified `name` is an enum type,
+   * gets the enum constant used as value for that element. This includes default values in
+   * case no explicit value is specified.
+   *
+   * If the element value type is an enum type array, use `getAnEnumConstantArrayValue`.
+   */
+  EnumConstant getEnumConstantValue(string name) {
+    result = this.getNonArrayValue(name).(FieldRead).getField()
+  }
+
+  /**
+   * If the value type of the annotation element with the specified `name` is `String`,
+   * gets the string value used for that element. This includes default values in case no
+   * explicit value is specified.
+   *
+   * If the element value type is a string array, use `getAStringArrayValue`.
+   */
+  string getStringValue(string name) {
+    // Uses CompileTimeConstantExpr instead of StringLiteral because this can for example
+    // be a read from a final variable as well.
+    result = this.getNonArrayValue(name).(CompileTimeConstantExpr).getStringValue()
+  }
+
+  /**
+   * If the value type of the annotation element with the specified `name` is `int` or
+   * a smaller integral type or `char`, gets the int value used for that element.
+   * This includes default values in case no explicit value is specified.
+   *
+   * If the element value type is an `int` array or an array of a smaller integral
+   * type or `char`, use `getAnIntArrayValue`.
+   */
+  int getIntValue(string name) {
+    // Uses CompileTimeConstantExpr instead of IntegerLiteral because this can for example
+    // be a read from a final variable as well.
+    result = this.getNonArrayValue(name).(CompileTimeConstantExpr).getIntValue() and
+    // Verify that type is integral; ignore floating point elements with IntegerLiteral as value
+    this.getAnnotationElement(name).getType().hasName(["byte", "short", "int", "char"])
+  }
+
+  /**
+   * If the value type of the annotation element with the specified `name` is `boolean`,
+   * gets the boolean value used for that element. This includes default values in case
+   * no explicit value is specified.
+   */
+  boolean getBooleanValue(string name) {
+    // Uses CompileTimeConstantExpr instead of BooleanLiteral because this can for example
+    // be a read from a final variable as well.
+    result = this.getNonArrayValue(name).(CompileTimeConstantExpr).getBooleanValue()
+  }
+
+  /**
+   * If the value type of the annotation element with the specified `name` is `java.lang.Class`,
+   * gets the type referred to by that `Class`. This includes default values in case no explicit
+   * value is specified.
+   *
+   * If the element value type is a `Class` array, use `getATypeArrayValue`.
+   */
+  Type getTypeValue(string name) {
+    result = this.getNonArrayValue(name).(TypeLiteral).getReferencedType()
+  }
+
   /** Gets the element being annotated. */
   Element getTarget() { result = this.getAnnotatedElement() }
 
@@ -60,16 +148,83 @@ class Annotation extends @annotation, Expr {
 
   /**
    * Gets a value of the annotation element with the specified `name`, which must be declared as an array
-   * type.
+   * type. This includes default values in case no explicit value is specified.
    *
-   * If the annotation element is defined with an array initializer, then the returned value will
-   * be one of the elements of that array. Otherwise, the returned value will be the single
-   * expression defined for the value.
+   * If the annotation element is defined with an array initializer, then the result will be one of the
+   * elements of that array. Otherwise, the result will be the single expression used as value.
    */
-  Expr getAValue(string name) {
+  Expr getAnArrayValue(string name) { result = this.getArrayValue(name, _) }
+
+  /**
+   * DEPRECATED: Predicate has been renamed to `getAnArrayValue`
+   */
+  deprecated Expr getAValue(string name) { result = this.getAnArrayValue(name) }
+
+  /**
+   * Gets a value of the annotation element with the specified `name`, which must be declared as an enum
+   * type array. This includes default values in case no explicit value is specified.
+   *
+   * If the annotation element is defined with an array initializer, then the result will be one of the
+   * elements of that array. Otherwise, the result will be the single expression used as value.
+   */
+  EnumConstant getAnEnumConstantArrayValue(string name) {
+    result = this.getAnArrayValue(name).(FieldRead).getField()
+  }
+
+  /**
+   * Gets a value of the annotation element with the specified `name`, which must be declared as a string
+   * array. This includes default values in case no explicit value is specified.
+   *
+   * If the annotation element is defined with an array initializer, then the result will be one of the
+   * elements of that array. Otherwise, the result will be the single expression used as value.
+   */
+  string getAStringArrayValue(string name) {
+    result = this.getAnArrayValue(name).(CompileTimeConstantExpr).getStringValue()
+  }
+
+  /**
+   * Gets a value of the annotation element with the specified `name`, which must be declared as an `int`
+   * array or an array of a smaller integral type or `char`. This includes default values in case no
+   * explicit value is specified.
+   *
+   * If the annotation element is defined with an array initializer, then the result will be one of the
+   * elements of that array. Otherwise, the result will be the single expression used as value.
+   */
+  int getAnIntArrayValue(string name) {
+    result = this.getAnArrayValue(name).(CompileTimeConstantExpr).getIntValue() and
+    // Verify that type is integral; ignore floating point elements with IntegerLiteral as value
+    this.getAnnotationElement(name).getType().hasName(["byte[]", "short[]", "int[]", "char[]"])
+  }
+
+  /**
+   * Gets a value of the annotation element with the specified `name`, which must be declared as a `Class`
+   * array. This includes default values in case no explicit value is specified.
+   *
+   * If the annotation element is defined with an array initializer, then the result will be one of the
+   * elements of that array. Otherwise, the result will be the single expression used as value.
+   */
+  Type getATypeArrayValue(string name) {
+    result = this.getAnArrayValue(name).(TypeLiteral).getReferencedType()
+  }
+
+  /**
+   * Gets the value at a given index of the annotation element with the specified `name`, which must be
+   * declared as an array type. This includes default values in case no explicit value is specified.
+   *
+   * If the annotation element is defined with an array initializer, then the result will be the element
+   * at the given index of that array, starting at 0. Otherwise, the result will be the single expression
+   * defined for the value and the `index` will be 0.
+   */
+  Expr getArrayValue(string name, int index) {
     this.getType().getAnnotationElement(name).getType() instanceof Array and
     exists(Expr value | value = this.getValue(name) |
-      if value instanceof ArrayInit then result = value.(ArrayInit).getAnInit() else result = value
+      if value instanceof ArrayInit
+      then
+        // TODO: Currently reports incorrect index values in some cases, see https://github.com/github/codeql/issues/8645
+        result = value.(ArrayInit).getInit(index)
+      else (
+        index = 0 and result = value
+      )
     )
   }
 
@@ -99,19 +254,86 @@ private predicate sourceAnnotValue(Annotation a, Method m, Expr val) {
 
 /** An abstract representation of language elements that can be annotated. */
 class Annotatable extends Element {
-  /** Holds if this element has an annotation. */
-  predicate hasAnnotation() { exists(Annotation a | a.getAnnotatedElement() = this) }
+  /**
+   * Holds if this element has an annotation, including inherited annotations.
+   * The retention policy of the annotation type is not considered.
+   */
+  predicate hasAnnotation() { exists(this.getAnAnnotation()) }
 
-  /** Holds if this element has the specified annotation. */
+  /**
+   * Holds if this element has a declared annotation, excluding inherited annotations.
+   * The retention policy of the annotation type is not considered.
+   */
+  predicate hasDeclaredAnnotation() { exists(this.getADeclaredAnnotation()) }
+
+  /**
+   * Holds if this element has the specified annotation, including inherited
+   * annotations. The retention policy of the annotation type is not considered.
+   */
   predicate hasAnnotation(string package, string name) {
     exists(AnnotationType at | at = this.getAnAnnotation().getType() |
       at.nestedName() = name and at.getPackage().getName() = package
     )
   }
 
-  /** Gets an annotation that applies to this element. */
+  /**
+   * Gets an annotation that applies to this element, including inherited annotations.
+   * The results only include _direct_ annotations; _indirect_ annotations, that is
+   * repeated annotations in an (implicit) container annotation, are not included.
+   * The retention policy of the annotation type is not considered.
+   */
   cached
-  Annotation getAnAnnotation() { result.getAnnotatedElement() = this }
+  Annotation getAnAnnotation() {
+    // This predicate is overridden by Class to consider inherited annotations
+    result = this.getADeclaredAnnotation()
+  }
+
+  /**
+   * Gets an annotation that is declared on this element, excluding inherited annotations.
+   * The retention policy of the annotation type is not considered.
+   */
+  Annotation getADeclaredAnnotation() { result.getAnnotatedElement() = this }
+
+  /** Gets an _indirect_ (= repeated) annotation. */
+  private Annotation getAnIndirectAnnotation() {
+    // 'indirect' as defined by https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/lang/reflect/AnnotatedElement.html
+    exists(AnnotationType t, Annotation containerAnn |
+      t = result.getType() and
+      containerAnn = this.getADeclaredAnnotation() and
+      containerAnn.getType() = t.getContainingAnnotationType()
+    |
+      result = containerAnn.getAnArrayValue("value")
+    )
+  }
+
+  private Annotation getADeclaredAssociatedAnnotation(AnnotationType t) {
+    // Direct or indirect annotation
+    result.getType() = t and
+    result = [this.getADeclaredAnnotation(), this.getAnIndirectAnnotation()]
+  }
+
+  private Annotation getAnAssociatedAnnotation(AnnotationType t) {
+    // 'associated' as defined by https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/lang/reflect/AnnotatedElement.html
+    if exists(this.getADeclaredAssociatedAnnotation(t))
+    then result = this.getADeclaredAssociatedAnnotation(t)
+    else (
+      // Only if neither a direct nor an indirect annotation is present look for an inherited one
+      t.isInherited() and
+      // @Inherited only works for classes; cast to Annotatable is necessary because predicate is private
+      result = this.(Class).getASupertype().(Class).(Annotatable).getAnAssociatedAnnotation(t)
+    )
+  }
+
+  /**
+   * Gets an annotation _associated_ with this element, that is:
+   * - An annotation directly present on this element, or
+   * - An annotation indirectly present on this element (in the form of a repeated annotation), or
+   * - If an annotation of a type is neither directly nor indirectly present
+   *   the result is an associated inherited annotation (recursively)
+   *
+   * The retention policy of the annotation type is not considered.
+   */
+  Annotation getAnAssociatedAnnotation() { result = this.getAnAssociatedAnnotation(_) }
 
   /**
    * Holds if this or any enclosing `Annotatable` has a `@SuppressWarnings("<category>")`
@@ -128,6 +350,11 @@ class Annotatable extends Element {
     or
     this.(NestedClass).getEnclosingType().suppressesWarningsAbout(category)
     or
+    this.(LocalClassOrInterface)
+        .getLocalTypeDeclStmt()
+        .getEnclosingCallable()
+        .suppressesWarningsAbout(category)
+    or
     this.(LocalVariableDecl).getCallable().suppressesWarningsAbout(category)
   }
 }
@@ -146,10 +373,79 @@ class AnnotationType extends Interface {
 
   /** Holds if this annotation type is annotated with the meta-annotation `@Inherited`. */
   predicate isInherited() {
-    exists(Annotation ann |
-      ann.getAnnotatedElement() = this and
-      ann.getType().hasQualifiedName("java.lang.annotation", "Inherited")
-    )
+    this.getADeclaredAnnotation().getType().hasQualifiedName("java.lang.annotation", "Inherited")
+  }
+
+  /** Holds if this annotation type is annotated with the meta-annotation `@Documented`. */
+  predicate isDocumented() {
+    this.getADeclaredAnnotation().getType().hasQualifiedName("java.lang.annotation", "Documented")
+  }
+
+  /**
+   * Gets the retention policy of this annotation type, that is, the name of one of the
+   * enum constants of `java.lang.annotation.RetentionPolicy`. If this annotation type
+   * has no `@Retention` annotation, the result is `CLASS`.
+   */
+  string getRetentionPolicy() {
+    if this.getADeclaredAnnotation() instanceof RetentionAnnotation
+    then result = this.getADeclaredAnnotation().(RetentionAnnotation).getRetentionPolicy()
+    else
+      // If not explicitly specified retention is CLASS
+      result = "CLASS"
+  }
+
+  /**
+   * Holds if the element type is a possible target for this annotation type.
+   * The `elementType` is the name of one of the `java.lang.annotation.ElementType`
+   * enum constants.
+   *
+   * If this annotation type has no `@Target` annotation, it is considered to be applicable
+   * in all declaration contexts. This matches the behavior of the latest Java versions
+   * but differs from the behavior of older Java versions. This predicate must only be
+   * called with names of `ElementType` enum constants; for other values it might hold
+   * erroneously.
+   */
+  bindingset[elementType]
+  predicate isATargetType(string elementType) {
+    /*
+     * Note: Cannot use a predicate with string as result because annotation type without
+     * explicit @Target can be applied in all declaration contexts, requiring to hardcode
+     * element types here; then the results could become outdated if this predicate is not
+     * updated for future JDK versions, or it could have irritating results, e.g. RECORD_COMPONENT
+     * for a database created for Java 8.
+     *
+     * Could in theory read java.lang.annotation.ElementType constants from database, but might
+     * be brittle in case ElementType is not present in the database for whatever reason.
+     */
+
+    if this.getADeclaredAnnotation() instanceof TargetAnnotation
+    then elementType = this.getADeclaredAnnotation().(TargetAnnotation).getATargetElementType()
+    else
+      /*
+       * Behavior for missing @Target annotation changed between Java versions. In older Java
+       * versions it allowed usage in most (but not all) declaration contexts. Then for Java 14
+       * JDK-8231435 changed it to allow usage in all declaration and type contexts. In Java 17
+       * it was changed by JDK-8261610 to only allow usage in all declaration contexts, but not
+       * in type contexts anymore. However, during these changes javac did not always comply with
+       * the specification, see for example JDK-8254023.
+       *
+       * For simplicity pretend the latest behavior defined by the JLS applied in all versions;
+       * that means any declaration context is allowed, but type contexts (represented by TYPE_USE,
+       * see JLS 17 section 9.6.4.1) are not allowed.
+       */
+
+      elementType != "TYPE_USE"
+  }
+
+  /** Holds if this annotation type is annotated with the meta-annotation `@Repeatable`. */
+  predicate isRepeatable() { this.getADeclaredAnnotation() instanceof RepeatableAnnotation }
+
+  /**
+   * If this annotation type is annotated with the meta-annotation `@Repeatable`,
+   * gets the annotation type which acts as _containing annotation type_.
+   */
+  AnnotationType getContainingAnnotationType() {
+    result = this.getADeclaredAnnotation().(RepeatableAnnotation).getContainingType()
   }
 }
 
diff --git a/java/ql/lib/semmle/code/java/Dependency.qll b/java/ql/lib/semmle/code/java/Dependency.qll
index a2bd8a84fdc..17236c6d05e 100644
--- a/java/ql/lib/semmle/code/java/Dependency.qll
+++ b/java/ql/lib/semmle/code/java/Dependency.qll
@@ -71,7 +71,8 @@ predicate depends(RefType t, RefType dep) {
       a.getAnnotatedElement().(Member).getDeclaringType() = t
     |
       usesType(a.getType(), dep) or
-      usesType(a.getAValue().getType(), dep)
+      usesType(a.getValue(_).getType(), dep) or
+      usesType(a.getAnArrayValue(_).getType(), dep)
     )
     or
     // the type accessed in an `instanceof` expression in `t`.
diff --git a/java/ql/lib/semmle/code/java/DependencyCounts.qll b/java/ql/lib/semmle/code/java/DependencyCounts.qll
index b775e5fcf06..1010be48055 100644
--- a/java/ql/lib/semmle/code/java/DependencyCounts.qll
+++ b/java/ql/lib/semmle/code/java/DependencyCounts.qll
@@ -90,7 +90,7 @@ predicate numDepends(RefType t, RefType dep, int value) {
       |
         elem = a and usesType(a.getType(), dep)
         or
-        elem = a.getAValue() and
+        elem = [a.getValue(_), a.getAnArrayValue(_)] and
         elem.getFile().getExtension() = "java" and
         usesType(elem.(Expr).getType(), dep)
       )
diff --git a/java/ql/lib/semmle/code/java/JDKAnnotations.qll b/java/ql/lib/semmle/code/java/JDKAnnotations.qll
index 2dff70c4d8e..502aef09075 100644
--- a/java/ql/lib/semmle/code/java/JDKAnnotations.qll
+++ b/java/ql/lib/semmle/code/java/JDKAnnotations.qll
@@ -18,14 +18,16 @@ class OverrideAnnotation extends Annotation {
 class SuppressWarningsAnnotation extends Annotation {
   SuppressWarningsAnnotation() { this.getType().hasQualifiedName("java.lang", "SuppressWarnings") }
 
-  /** Gets the `StringLiteral` of a warning suppressed by this annotation. */
-  StringLiteral getASuppressedWarningLiteral() {
-    result = this.getAValue() or
-    result = this.getAValue().(ArrayInit).getAnInit()
-  }
+  /**
+   * DEPRECATED: This predicate restricts the results to `StringLiteral`; prefer `getASuppressedWarning()`
+   * to get the name of a suppressed warning.
+   *
+   * Gets the `StringLiteral` of a warning suppressed by this annotation.
+   */
+  deprecated StringLiteral getASuppressedWarningLiteral() { result = this.getAnArrayValue("value") }
 
   /** Gets the name of a warning suppressed by this annotation. */
-  string getASuppressedWarning() { result = this.getASuppressedWarningLiteral().getValue() }
+  string getASuppressedWarning() { result = this.getAStringArrayValue("value") }
 }
 
 /** A `@Target` annotation. */
@@ -33,18 +35,15 @@ class TargetAnnotation extends Annotation {
   TargetAnnotation() { this.getType().hasQualifiedName("java.lang.annotation", "Target") }
 
   /**
+   * DEPRECATED: Getting the field access expression is rarely useful. Use `getATargetElementType()`
+   * to get the name of the target element.
+   *
    * Gets a target expression within this annotation.
    *
    * For example, the field access `ElementType.FIELD` is a target expression in
    * `@Target({ElementType.FIELD, ElementType.METHOD})`.
    */
-  Expr getATargetExpression() {
-    not result instanceof ArrayInit and
-    (
-      result = this.getAValue() or
-      result = this.getAValue().(ArrayInit).getAnInit()
-    )
-  }
+  deprecated Expr getATargetExpression() { result = this.getAnArrayValue("value") }
 
   /**
    * Gets the name of a target element type.
@@ -52,14 +51,7 @@ class TargetAnnotation extends Annotation {
    * For example, `METHOD` is the name of a target element type in
    * `@Target({ElementType.FIELD, ElementType.METHOD})`.
    */
-  string getATargetElementType() {
-    exists(EnumConstant ec |
-      ec = this.getATargetExpression().(VarAccess).getVariable() and
-      ec.getDeclaringType().hasQualifiedName("java.lang.annotation", "ElementType")
-    |
-      result = ec.getName()
-    )
-  }
+  string getATargetElementType() { result = this.getAnEnumConstantArrayValue("value").getName() }
 }
 
 /** A `@Retention` annotation. */
@@ -67,12 +59,15 @@ class RetentionAnnotation extends Annotation {
   RetentionAnnotation() { this.getType().hasQualifiedName("java.lang.annotation", "Retention") }
 
   /**
+   * DEPRECATED: Getting the field access expression is rarely useful. Use `getRetentionPolicy()`
+   * to get the name of the retention policy.
+   *
    * Gets the retention policy expression within this annotation.
    *
    * For example, the field access `RetentionPolicy.RUNTIME` is the
    * retention policy expression in `@Retention(RetentionPolicy.RUNTIME)`.
    */
-  Expr getRetentionPolicyExpression() { result = this.getValue("value") }
+  deprecated Expr getRetentionPolicyExpression() { result = this.getValue("value") }
 
   /**
    * Gets the name of the retention policy of this annotation.
@@ -80,14 +75,18 @@ class RetentionAnnotation extends Annotation {
    * For example, `RUNTIME` is the name of the retention policy
    * in `@Retention(RetentionPolicy.RUNTIME)`.
    */
-  string getRetentionPolicy() {
-    exists(EnumConstant ec |
-      ec = this.getRetentionPolicyExpression().(VarAccess).getVariable() and
-      ec.getDeclaringType().hasQualifiedName("java.lang.annotation", "RetentionPolicy")
-    |
-      result = ec.getName()
-    )
-  }
+  string getRetentionPolicy() { result = this.getEnumConstantValue("value").getName() }
+}
+
+/** A `@Repeatable` annotation. */
+class RepeatableAnnotation extends Annotation {
+  RepeatableAnnotation() { this.getType().hasQualifiedName("java.lang.annotation", "Repeatable") }
+
+  /**
+   * Gets the annotation type which acts as _containing type_, grouping multiple
+   * repeatable annotations together.
+   */
+  AnnotationType getContainingType() { result = this.getTypeValue("value") }
 }
 
 /**
@@ -119,11 +118,7 @@ abstract class NonReflectiveAnnotation extends Annotation { }
 
 library class StandardNonReflectiveAnnotation extends NonReflectiveAnnotation {
   StandardNonReflectiveAnnotation() {
-    exists(AnnotationType anntp | anntp = this.getType() |
-      anntp.hasQualifiedName("java.lang", "Override") or
-      anntp.hasQualifiedName("java.lang", "Deprecated") or
-      anntp.hasQualifiedName("java.lang", "SuppressWarnings") or
-      anntp.hasQualifiedName("java.lang", "SafeVarargs")
-    )
+    this.getType()
+        .hasQualifiedName("java.lang", ["Override", "Deprecated", "SuppressWarnings", "SafeVarargs"])
   }
 }
diff --git a/java/ql/lib/semmle/code/java/JMX.qll b/java/ql/lib/semmle/code/java/JMX.qll
index 16c8736059f..66aa951ba28 100644
--- a/java/ql/lib/semmle/code/java/JMX.qll
+++ b/java/ql/lib/semmle/code/java/JMX.qll
@@ -27,7 +27,7 @@ class MXBean extends ManagedBean {
 class RegisteredManagedBeanImpl extends Class {
   RegisteredManagedBeanImpl() {
     this.getAnAncestor() instanceof ManagedBean and
-    exists(JMXRegistrationCall registerCall | registerCall.getObjectArgument().getType() = this)
+    exists(JmxRegistrationCall registerCall | registerCall.getObjectArgument().getType() = this)
   }
 
   /**
@@ -39,32 +39,35 @@ class RegisteredManagedBeanImpl extends Class {
 /**
  * A call that registers an object with the `MBeanServer`, directly or indirectly.
  */
-class JMXRegistrationCall extends MethodAccess {
-  JMXRegistrationCall() { this.getCallee() instanceof JMXRegistrationMethod }
+class JmxRegistrationCall extends MethodAccess {
+  JmxRegistrationCall() { this.getCallee() instanceof JmxRegistrationMethod }
 
   /**
    * Gets the argument that represents the object in the registration call.
    */
   Expr getObjectArgument() {
-    result = this.getArgument(this.getCallee().(JMXRegistrationMethod).getObjectPosition())
+    result = this.getArgument(this.getCallee().(JmxRegistrationMethod).getObjectPosition())
   }
 }
 
+/** DEPRECATED: Alias for JmxRegistrationCall */
+deprecated class JMXRegistrationCall = JmxRegistrationCall;
+
 /**
  * A method used to register `MBean` and `MXBean` instances with the `MBeanServer`.
  *
  * This is either the `registerMBean` method on `MBeanServer`, or it is a wrapper around that
  * registration method.
  */
-class JMXRegistrationMethod extends Method {
-  JMXRegistrationMethod() {
+class JmxRegistrationMethod extends Method {
+  JmxRegistrationMethod() {
     // A direct registration with the `MBeanServer`.
     this.getDeclaringType().hasQualifiedName("javax.management", "MBeanServer") and
     this.getName() = "registerMBean"
     or
     // The `MBeanServer` is often wrapped by an application specific management class, so identify
-    // methods that wrap a call to another `JMXRegistrationMethod`.
-    exists(JMXRegistrationCall c |
+    // methods that wrap a call to another `JmxRegistrationMethod`.
+    exists(JmxRegistrationCall c |
       // This must be a call to another JMX registration method, where the object argument is an access
       // of one of the parameters of this method.
       c.getObjectArgument().(VarAccess).getVariable() = this.getAParameter()
@@ -81,25 +84,37 @@ class JMXRegistrationMethod extends Method {
     result = 0
     or
     // Identify the position in this method where the object parameter should be passed.
-    exists(JMXRegistrationCall c |
+    exists(JmxRegistrationCall c |
       c.getObjectArgument().(VarAccess).getVariable() = this.getParameter(result)
     )
   }
 }
 
+/** DEPRECATED: Alias for JmxRegistrationMethod */
+deprecated class JMXRegistrationMethod = JmxRegistrationMethod;
+
 /** The class `javax.management.remote.JMXConnectorFactory`. */
-class TypeJMXConnectorFactory extends Class {
-  TypeJMXConnectorFactory() {
+class TypeJmxConnectorFactory extends Class {
+  TypeJmxConnectorFactory() {
     this.hasQualifiedName("javax.management.remote", "JMXConnectorFactory")
   }
 }
 
+/** DEPRECATED: Alias for TypeJmxConnectorFactory */
+deprecated class TypeJMXConnectorFactory = TypeJmxConnectorFactory;
+
 /** The class `javax.management.remote.JMXServiceURL`. */
-class TypeJMXServiceURL extends Class {
-  TypeJMXServiceURL() { this.hasQualifiedName("javax.management.remote", "JMXServiceURL") }
+class TypeJmxServiceUrl extends Class {
+  TypeJmxServiceUrl() { this.hasQualifiedName("javax.management.remote", "JMXServiceURL") }
 }
 
+/** DEPRECATED: Alias for TypeJmxServiceUrl */
+deprecated class TypeJMXServiceURL = TypeJmxServiceUrl;
+
 /** The class `javax.management.remote.rmi.RMIConnector`. */
-class TypeRMIConnector extends Class {
-  TypeRMIConnector() { this.hasQualifiedName("javax.management.remote.rmi", "RMIConnector") }
+class TypeRmiConnector extends Class {
+  TypeRmiConnector() { this.hasQualifiedName("javax.management.remote.rmi", "RMIConnector") }
 }
+
+/** DEPRECATED: Alias for TypeRmiConnector */
+deprecated class TypeRMIConnector = TypeRmiConnector;
diff --git a/java/ql/lib/semmle/code/java/Member.qll b/java/ql/lib/semmle/code/java/Member.qll
index ef3546b0af8..456e6e8b12a 100644
--- a/java/ql/lib/semmle/code/java/Member.qll
+++ b/java/ql/lib/semmle/code/java/Member.qll
@@ -20,8 +20,14 @@ class Member extends Element, Annotatable, Modifiable, @member {
   /** Gets the type in which this member is declared. */
   RefType getDeclaringType() { declaresMember(result, this) }
 
-  /** Gets the qualified name of this member. */
-  string getQualifiedName() { result = this.getDeclaringType().getName() + "." + this.getName() }
+  /**
+   * Gets the qualified name of this member.
+   * This is useful for debugging, but for normal use `hasQualifiedName`
+   * is recommended, as it is more efficient.
+   */
+  string getQualifiedName() {
+    result = this.getDeclaringType().getQualifiedName() + "." + this.getName()
+  }
 
   /**
    * Holds if this member has the specified name and is declared in the
diff --git a/java/ql/lib/semmle/code/java/Modifier.qll b/java/ql/lib/semmle/code/java/Modifier.qll
index 8f947383d1e..3d03851fcf5 100644
--- a/java/ql/lib/semmle/code/java/Modifier.qll
+++ b/java/ql/lib/semmle/code/java/Modifier.qll
@@ -7,7 +7,13 @@ import Element
 /** A modifier such as `private`, `static` or `abstract`. */
 class Modifier extends Element, @modifier {
   /** Gets the element to which this modifier applies. */
-  Element getElement() { hasModifier(result, this) }
+  Element getElement() {
+    hasModifier(result, this) and
+    // Kotlin "internal" elements may also get "public" modifiers, so we want to filter those out
+    not exists(Modifier mod2 |
+      hasModifier(result, mod2) and modifiers(this, "public") and modifiers(mod2, "internal")
+    )
+  }
 
   override string getAPrimaryQlClass() { result = "Modifier" }
 }
@@ -20,7 +26,7 @@ abstract class Modifiable extends Element {
    * For most purposes, the more specialized predicates `isAbstract`, `isPublic`, etc.
    * should be used.
    *
-   * Both this method and those specialized predicates take implicit modifiers into account.
+   * Those specialized predicates also take implicit modifiers into account.
    * For instance, non-default instance methods in interfaces are implicitly
    * abstract, so `isAbstract()` will hold for them even if `hasModifier("abstract")`
    * does not.
diff --git a/java/ql/lib/semmle/code/java/NumberFormatException.qll b/java/ql/lib/semmle/code/java/NumberFormatException.qll
index f8aab0ba26f..e3b83811cf0 100644
--- a/java/ql/lib/semmle/code/java/NumberFormatException.qll
+++ b/java/ql/lib/semmle/code/java/NumberFormatException.qll
@@ -15,7 +15,7 @@ private class SpecialMethodAccess extends MethodAccess {
     this.getQualifier().getType().(RefType).hasQualifiedName("java.lang", klass)
   }
 
-  predicate throwsNFE() {
+  predicate throwsNfe() {
     this.isParseMethod("Byte", "parseByte") or
     this.isParseMethod("Short", "parseShort") or
     this.isParseMethod("Integer", "parseInt") or
@@ -33,6 +33,9 @@ private class SpecialMethodAccess extends MethodAccess {
     this.isValueOfMethod("Float") or
     this.isValueOfMethod("Double")
   }
+
+  /** DEPRECATED: Alias for throwsNfe */
+  deprecated predicate throwsNFE() { this.throwsNfe() }
 }
 
 /** A `ClassInstanceExpr` that constructs a number from its string representation. */
@@ -43,7 +46,7 @@ private class SpecialClassInstanceExpr extends ClassInstanceExpr {
     this.getNumArgument() = 1
   }
 
-  predicate throwsNFE() {
+  predicate throwsNfe() {
     this.isStringConstructor("Byte") or
     this.isStringConstructor("Short") or
     this.isStringConstructor("Integer") or
@@ -51,6 +54,9 @@ private class SpecialClassInstanceExpr extends ClassInstanceExpr {
     this.isStringConstructor("Float") or
     this.isStringConstructor("Double")
   }
+
+  /** DEPRECATED: Alias for throwsNfe */
+  deprecated predicate throwsNFE() { this.throwsNfe() }
 }
 
 /** The class `java.lang.NumberFormatException`. */
@@ -59,7 +65,7 @@ class NumberFormatException extends RefType {
 }
 
 /** Holds if `java.lang.NumberFormatException` is caught. */
-predicate catchesNFE(TryStmt t) {
+predicate catchesNfe(TryStmt t) {
   exists(CatchClause cc, LocalVariableDeclExpr v |
     t.getACatchClause() = cc and
     cc.getVariable() = v and
@@ -67,7 +73,13 @@ predicate catchesNFE(TryStmt t) {
   )
 }
 
+/** DEPRECATED: Alias for catchesNfe */
+deprecated predicate catchesNFE = catchesNfe/1;
+
 /** Holds if `java.lang.NumberFormatException` can be thrown. */
-predicate throwsNFE(Expr e) {
-  e.(SpecialClassInstanceExpr).throwsNFE() or e.(SpecialMethodAccess).throwsNFE()
+predicate throwsNfe(Expr e) {
+  e.(SpecialClassInstanceExpr).throwsNfe() or e.(SpecialMethodAccess).throwsNfe()
 }
+
+/** DEPRECATED: Alias for throwsNfe */
+deprecated predicate throwsNFE = throwsNfe/1;
diff --git a/java/ql/lib/semmle/code/java/PrintAst.qll b/java/ql/lib/semmle/code/java/PrintAst.qll
index 9d88550faa3..b2937d67940 100644
--- a/java/ql/lib/semmle/code/java/PrintAst.qll
+++ b/java/ql/lib/semmle/code/java/PrintAst.qll
@@ -120,7 +120,7 @@ private newtype TPrintAstNode =
     shouldPrint(lvde, _) and lvde.getParent() instanceof SingleLocalVarDeclParent
   } or
   TAnnotationsNode(Annotatable ann) {
-    shouldPrint(ann, _) and ann.hasAnnotation() and not partOfAnnotation(ann)
+    shouldPrint(ann, _) and ann.hasDeclaredAnnotation() and not partOfAnnotation(ann)
   } or
   TParametersNode(Callable c) { shouldPrint(c, _) and not c.hasNoParameters() } or
   TBaseTypesNode(ClassOrInterface ty) { shouldPrint(ty, _) } or
diff --git a/java/ql/lib/semmle/code/java/UnitTests.qll b/java/ql/lib/semmle/code/java/UnitTests.qll
index e56b9a6dc23..38f37fa4ff0 100644
--- a/java/ql/lib/semmle/code/java/UnitTests.qll
+++ b/java/ql/lib/semmle/code/java/UnitTests.qll
@@ -161,15 +161,13 @@ class TestNGTestMethod extends Method {
     exists(TestNGTestAnnotation testAnnotation |
       testAnnotation = this.getAnAnnotation() and
       // The data provider must have the same name as the referenced data provider
-      result.getDataProviderName() =
-        testAnnotation.getValue("dataProvider").(StringLiteral).getValue()
+      result.getDataProviderName() = testAnnotation.getStringValue("dataProvider")
     |
       // Either the data provider should be on the current class, or a supertype
       this.getDeclaringType().getAnAncestor() = result.getDeclaringType()
       or
       // Or the data provider class should be declared
-      result.getDeclaringType() =
-        testAnnotation.getValue("dataProviderClass").(TypeLiteral).getReferencedType()
+      result.getDeclaringType() = testAnnotation.getTypeValue("dataProviderClass")
     )
   }
 }
@@ -227,9 +225,7 @@ class TestNGListenersAnnotation extends TestNGAnnotation {
   /**
    * Gets a listener defined in this annotation.
    */
-  TestNGListenerImpl getAListener() {
-    result = this.getAValue("value").(TypeLiteral).getReferencedType()
-  }
+  TestNGListenerImpl getAListener() { result = this.getATypeArrayValue("value") }
 }
 
 /**
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
index d3f0492089d..5dada4f8532 100644
--- a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -12,6 +12,7 @@
  *   `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
  * - Negative Summaries:
  *   `namespace; type; name; signature; provenance`
+ *   A negative summary is used to indicate that there is no flow via a callable.
  *
  * The interpretation of a row is similar to API-graphs with a left-to-right
  * reading.
@@ -116,10 +117,12 @@ private module Frameworks {
   private import semmle.code.java.frameworks.Retrofit
   private import semmle.code.java.frameworks.Stream
   private import semmle.code.java.frameworks.Strings
+  private import semmle.code.java.frameworks.Thymeleaf
   private import semmle.code.java.frameworks.ratpack.Ratpack
   private import semmle.code.java.frameworks.ratpack.RatpackExec
   private import semmle.code.java.frameworks.spring.SpringCache
   private import semmle.code.java.frameworks.spring.SpringContext
+  private import semmle.code.java.frameworks.spring.SpringData
   private import semmle.code.java.frameworks.spring.SpringHttp
   private import semmle.code.java.frameworks.spring.SpringUtil
   private import semmle.code.java.frameworks.spring.SpringUi
@@ -139,6 +142,7 @@ private module Frameworks {
   private import semmle.code.java.security.LdapInjection
   private import semmle.code.java.security.MvelInjection
   private import semmle.code.java.security.OgnlInjection
+  private import semmle.code.java.security.TemplateInjection
   private import semmle.code.java.security.XPath
   private import semmle.code.java.security.XsltInjection
   private import semmle.code.java.frameworks.Jdbc
@@ -151,7 +155,7 @@ private module Frameworks {
   private import semmle.code.java.frameworks.JMS
   private import semmle.code.java.frameworks.RabbitMQ
   private import semmle.code.java.regex.RegexFlowModels
-  private import semmle.code.java.frameworks.KotlinStdLib
+  private import semmle.code.java.frameworks.kotlin.StdLib
 }
 
 /**
@@ -623,7 +627,7 @@ module CsvValidation {
           "open-url", "jndi-injection", "ldap", "sql", "jdbc-url", "logging", "mvel", "xpath",
           "groovy", "xss", "ognl-injection", "intent-start", "pending-intent-sent",
           "url-open-stream", "url-redirect", "create-file", "write-file", "set-hostname-verifier",
-          "header-splitting", "information-leak", "xslt", "jexl", "bean-validation"
+          "header-splitting", "information-leak", "xslt", "jexl", "bean-validation", "ssti"
         ] and
       not kind.matches("regex-use%") and
       not kind.matches("qltest%") and
diff --git a/java/ql/lib/semmle/code/java/dataflow/FlowSources.qll b/java/ql/lib/semmle/code/java/dataflow/FlowSources.qll
index fcd4fe90b6d..a6189337751 100644
--- a/java/ql/lib/semmle/code/java/dataflow/FlowSources.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/FlowSources.qll
@@ -88,7 +88,7 @@ private class ReverseDnsSource extends RemoteFlowSource {
   ReverseDnsSource() {
     // Try not to trigger on `localhost`.
     exists(MethodAccess m | m = this.asExpr() |
-      m.getMethod() instanceof ReverseDNSMethod and
+      m.getMethod() instanceof ReverseDnsMethod and
       not exists(MethodAccess l |
         (variableStep(l, m.getQualifier()) or l = m.getQualifier()) and
         l.getMethod().getName() = "getLocalHost"
@@ -221,8 +221,8 @@ class TypeInetAddr extends RefType {
 }
 
 /** A reverse DNS method. */
-class ReverseDNSMethod extends Method {
-  ReverseDNSMethod() {
+class ReverseDnsMethod extends Method {
+  ReverseDnsMethod() {
     this.getDeclaringType() instanceof TypeInetAddr and
     (
       this.getName() = "getHostName" or
@@ -231,6 +231,9 @@ class ReverseDNSMethod extends Method {
   }
 }
 
+/** DEPRECATED: Alias for ReverseDnsMethod */
+deprecated class ReverseDNSMethod = ReverseDnsMethod;
+
 /** Android `Intent` that may have come from a hostile application. */
 class AndroidIntentInput extends DataFlow::Node {
   Type receiverType;
diff --git a/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll b/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll
index 1b9842b9383..c3fd63cbf26 100644
--- a/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll
@@ -53,6 +53,16 @@ private class TypeFlowNode extends TTypeFlowNode {
   }
 }
 
+private int getNodeKind(TypeFlowNode n) {
+  result = 1 and n instanceof TField
+  or
+  result = 2 and n instanceof TSsa
+  or
+  result = 3 and n instanceof TExpr
+  or
+  result = 4 and n instanceof TMethod
+}
+
 /** Gets `t` if it is a `RefType` or the boxed type if `t` is a primitive type. */
 private RefType boxIfNeeded(Type t) {
   t.(PrimitiveType).getBoxedType() = result or
@@ -146,46 +156,199 @@ private predicate joinStep(TypeFlowNode n1, TypeFlowNode n2) {
   joinStep0(n1, n2) and not isNull(n1)
 }
 
-private predicate joinStepRank1(int r, TypeFlowNode n1, TypeFlowNode n2) {
-  n1 =
-    rank[r](TypeFlowNode n |
-      joinStep(n, n2)
-    |
-      n order by n.getLocation().getStartLine(), n.getLocation().getStartColumn()
+private predicate anyStep(TypeFlowNode n1, TypeFlowNode n2) { joinStep(n1, n2) or step(n1, n2) }
+
+private import SccReduction
+
+/**
+ * SCC reduction.
+ *
+ * This ought to be as easy as `equivalenceRelation(sccEdge/2)(n, scc)`, but
+ * this HOP is not currently supported for newtypes.
+ *
+ * A straightforward implementation would be:
+ * ```ql
+ * predicate sccRepr(TypeFlowNode n, TypeFlowNode scc) {
+ *  scc =
+ *    max(TypeFlowNode n2 |
+ *      sccEdge+(n, n2)
+ *    |
+ *      n2
+ *      order by
+ *        n2.getLocation().getStartLine(), n2.getLocation().getStartColumn(), getNodeKind(n2)
+ *    )
+ * }
+ *
+ * ```
+ * but this is quadratic in the size of the SCCs.
+ *
+ * Instead we find local maxima by following SCC edges and determine the SCC
+ * representatives from those.
+ * (This is still worst-case quadratic in the size of the SCCs, but generally
+ * performs better.)
+ */
+private module SccReduction {
+  private predicate sccEdge(TypeFlowNode n1, TypeFlowNode n2) {
+    anyStep(n1, n2) and anyStep+(n2, n1)
+  }
+
+  private predicate sccEdgeWithMax(TypeFlowNode n1, TypeFlowNode n2, TypeFlowNode m) {
+    sccEdge(n1, n2) and
+    m =
+      max(TypeFlowNode n |
+        n = [n1, n2]
+      |
+        n order by n.getLocation().getStartLine(), n.getLocation().getStartColumn(), getNodeKind(n)
+      )
+  }
+
+  private predicate hasLargerNeighbor(TypeFlowNode n) {
+    exists(TypeFlowNode n2 |
+      sccEdgeWithMax(n, n2, n2) and
+      not sccEdgeWithMax(n, n2, n)
+      or
+      sccEdgeWithMax(n2, n, n2) and
+      not sccEdgeWithMax(n2, n, n)
     )
+  }
+
+  private predicate localMax(TypeFlowNode m) {
+    sccEdgeWithMax(_, _, m) and
+    not hasLargerNeighbor(m)
+  }
+
+  private predicate sccReprFromLocalMax(TypeFlowNode scc) {
+    exists(TypeFlowNode m |
+      localMax(m) and
+      scc =
+        max(TypeFlowNode n2 |
+          sccEdge+(m, n2) and localMax(n2)
+        |
+          n2
+          order by
+            n2.getLocation().getStartLine(), n2.getLocation().getStartColumn(), getNodeKind(n2)
+        )
+    )
+  }
+
+  /** Holds if `n` is part of an SCC of size 2 or more represented by `scc`. */
+  predicate sccRepr(TypeFlowNode n, TypeFlowNode scc) {
+    sccEdge+(n, scc) and sccReprFromLocalMax(scc)
+  }
+
+  predicate sccJoinStep(TypeFlowNode n, TypeFlowNode scc) {
+    exists(TypeFlowNode mid |
+      joinStep(n, mid) and
+      sccRepr(mid, scc) and
+      not sccRepr(n, scc)
+    )
+  }
 }
 
-private predicate joinStepRank2(int r2, int r1, TypeFlowNode n) {
-  r1 = rank[r2](int r | joinStepRank1(r, _, n) | r)
+private signature predicate edgeSig(TypeFlowNode n1, TypeFlowNode n2);
+
+private signature module RankedEdge {
+  predicate edgeRank(int r, TypeFlowNode n1, TypeFlowNode n2);
+
+  int lastRank(TypeFlowNode n);
 }
 
-private predicate joinStepRank(int r, TypeFlowNode n1, TypeFlowNode n2) {
-  exists(int r1 |
-    joinStepRank1(r1, n1, n2) and
-    joinStepRank2(r, r1, n2)
-  )
+private module RankEdge<edgeSig/2 edge> implements RankedEdge {
+  /**
+   * Holds if `r` is a ranking of the incoming edges `(n1,n2)` to `n2`. The used
+   * ordering is not necessarily total, so the ranking may have gaps.
+   */
+  private predicate edgeRank1(int r, TypeFlowNode n1, TypeFlowNode n2) {
+    n1 =
+      rank[r](TypeFlowNode n |
+        edge(n, n2)
+      |
+        n order by n.getLocation().getStartLine(), n.getLocation().getStartColumn()
+      )
+  }
+
+  /**
+   * Holds if `r2` is a ranking of the ranks from `edgeRank1`. This removes the
+   * gaps from the ranking.
+   */
+  private predicate edgeRank2(int r2, int r1, TypeFlowNode n) {
+    r1 = rank[r2](int r | edgeRank1(r, _, n) | r)
+  }
+
+  /** Holds if `r` is a ranking of the incoming edges `(n1,n2)` to `n2`. */
+  predicate edgeRank(int r, TypeFlowNode n1, TypeFlowNode n2) {
+    exists(int r1 |
+      edgeRank1(r1, n1, n2) and
+      edgeRank2(r, r1, n2)
+    )
+  }
+
+  int lastRank(TypeFlowNode n) { result = max(int r | edgeRank(r, _, n)) }
 }
 
-private int lastRank(TypeFlowNode n) { result = max(int r | joinStepRank(r, _, n)) }
+private signature module TypePropagation {
+  class Typ;
+
+  predicate candType(TypeFlowNode n, Typ t);
+
+  bindingset[t]
+  predicate supportsType(TypeFlowNode n, Typ t);
+}
+
+/** Implements recursion through `forall` by way of edge ranking. */
+private module ForAll<RankedEdge Edge, TypePropagation T> {
+  /**
+   * Holds if `t` is a bound that holds on one of the incoming edges to `n` and
+   * thus is a candidate bound for `n`.
+   */
+  pragma[nomagic]
+  private predicate candJoinType(TypeFlowNode n, T::Typ t) {
+    exists(TypeFlowNode mid |
+      T::candType(mid, t) and
+      Edge::edgeRank(_, mid, n)
+    )
+  }
+
+  /**
+   * Holds if `t` is a candidate bound for `n` that is also valid for data coming
+   * through the edges into `n` ranked from `1` to `r`.
+   */
+  private predicate flowJoin(int r, TypeFlowNode n, T::Typ t) {
+    (
+      r = 1 and candJoinType(n, t)
+      or
+      flowJoin(r - 1, n, t) and Edge::edgeRank(r, _, n)
+    ) and
+    forall(TypeFlowNode mid | Edge::edgeRank(r, mid, n) | T::supportsType(mid, t))
+  }
+
+  /**
+   * Holds if `t` is a candidate bound for `n` that is also valid for data
+   * coming through all the incoming edges, and therefore is a valid bound for
+   * `n`.
+   */
+  predicate flowJoin(TypeFlowNode n, T::Typ t) { flowJoin(Edge::lastRank(n), n, t) }
+}
+
+module RankedJoinStep = RankEdge<joinStep/2>;
+
+module RankedSccJoinStep = RankEdge<sccJoinStep/2>;
 
 private predicate exactTypeBase(TypeFlowNode n, RefType t) {
   exists(ClassInstanceExpr e |
     n.asExpr() = e and
     e.getType() = t and
     not e instanceof FunctionalExpr and
-    exists(RefType sub | sub.getASourceSupertype() = t.getSourceDeclaration())
+    exists(SrcRefType sub | sub.getASourceSupertype() = t.getSourceDeclaration())
   )
 }
 
-private predicate exactTypeRank(int r, TypeFlowNode n, RefType t) {
-  forall(TypeFlowNode mid | joinStepRank(r, mid, n) | exactType(mid, t)) and
-  joinStepRank(r, _, n)
-}
+private module ExactTypePropagation implements TypePropagation {
+  class Typ = RefType;
 
-private predicate exactTypeJoin(int r, TypeFlowNode n, RefType t) {
-  exactTypeRank(1, n, t) and r = 1
-  or
-  exactTypeJoin(r - 1, n, t) and exactTypeRank(r, n, t)
+  predicate candType = exactType/2;
+
+  predicate supportsType = exactType/2;
 }
 
 /**
@@ -199,43 +362,60 @@ private predicate exactType(TypeFlowNode n, RefType t) {
   or
   // The following is an optimized version of
   // `forex(TypeFlowNode mid | joinStep(mid, n) | exactType(mid, t))`
-  exactTypeJoin(lastRank(n), n, t)
+  ForAll<RankedJoinStep, ExactTypePropagation>::flowJoin(n, t)
+  or
+  exists(TypeFlowNode scc |
+    sccRepr(n, scc) and
+    // Optimized version of
+    // `forex(TypeFlowNode mid | sccJoinStep(mid, scc) | exactType(mid, t))`
+    ForAll<RankedSccJoinStep, ExactTypePropagation>::flowJoin(scc, t)
+  )
 }
 
 /**
  * Holds if `n` occurs in a position where type information might be discarded;
- * `t` is the potentially boxed type of `n`, `t1` is the erasure of `t`, and
- * `t2` is the erased type of the implicit or explicit cast.
+ * `t1` is the type of `n`, `t1e` is the erasure of `t1`, `t2` is the type of
+ * the implicit or explicit cast, and `t2e` is the erasure of `t2`.
  */
-pragma[noinline]
-private predicate upcastCand(TypeFlowNode n, RefType t, RefType t1, RefType t2) {
-  t = boxIfNeeded(n.getType()) and
-  t.getErasure() = t1 and
-  (
-    exists(Variable v | v.getAnAssignedValue() = n.asExpr() and t2 = v.getType().getErasure())
-    or
-    exists(CastingExpr c | c.getExpr() = n.asExpr() and t2 = c.getType().getErasure())
-    or
-    exists(ReturnStmt ret |
-      ret.getResult() = n.asExpr() and t2 = ret.getEnclosingCallable().getReturnType().getErasure()
-    )
-    or
-    exists(MethodAccess ma | viableImpl_v1(ma) = n.asMethod() and t2 = ma.getType())
-    or
-    exists(Parameter p | privateParamArg(p, n.asExpr()) and t2 = p.getType().getErasure())
-    or
-    exists(ChooseExpr cond |
-      cond.getAResultExpr() = n.asExpr() and
-      t2 = cond.getType().getErasure()
-    )
+pragma[nomagic]
+private predicate upcastCand(TypeFlowNode n, RefType t1, RefType t1e, RefType t2, RefType t2e) {
+  exists(TypeFlowNode next | step(n, next) or joinStep(n, next) |
+    n.getType() = t1 and
+    next.getType() = t2 and
+    t1.getErasure() = t1e and
+    t2.getErasure() = t2e and
+    t1 != t2
+  )
+}
+
+private predicate unconstrained(BoundedType t) {
+  t.(Wildcard).isUnconstrained()
+  or
+  t.getUpperBoundType() instanceof TypeObject and
+  not t.(Wildcard).hasLowerBound()
+  or
+  unconstrained(t.getUpperBoundType())
+  or
+  unconstrained(t.(Wildcard).getLowerBoundType())
+}
+
+/** Holds if `t` is a raw type or parameterised type with unrestricted type arguments. */
+private predicate unbound(RefType t) {
+  t instanceof RawType
+  or
+  exists(ParameterizedType pt | pt = t |
+    forex(RefType arg | arg = pt.getATypeArgument() | unconstrained(arg))
   )
 }
 
 /** Holds if `n` occurs in a position where type information is discarded. */
-private predicate upcast(TypeFlowNode n, RefType t) {
-  exists(RefType t1, RefType t2 |
-    upcastCand(n, t, t1, t2) and
-    t1.getASourceSupertype+() = t2
+private predicate upcast(TypeFlowNode n, RefType t1) {
+  exists(RefType t1e, RefType t2, RefType t2e | upcastCand(n, t1, t1e, t2, t2e) |
+    t1e.getASourceSupertype+() = t2e
+    or
+    t1e = t2e and
+    unbound(t2) and
+    not unbound(t1)
   )
 }
 
@@ -322,9 +502,10 @@ predicate arrayInstanceOfGuarded(ArrayAccess aa, RefType t) {
 
 /**
  * Holds if `n` has type `t` and this information is discarded, such that `t`
- * might be a better type bound for nodes where `n` flows to.
+ * might be a better type bound for nodes where `n` flows to. This might include
+ * multiple bounds for a single node.
  */
-private predicate typeFlowBase(TypeFlowNode n, RefType t) {
+private predicate typeFlowBaseCand(TypeFlowNode n, RefType t) {
   exists(RefType srctype |
     upcast(n, srctype) or
     upcastEnhancedForStmt(n.asSsa(), srctype) or
@@ -340,29 +521,36 @@ private predicate typeFlowBase(TypeFlowNode n, RefType t) {
 }
 
 /**
- * Holds if `t` is a bound that holds on one of the incoming edges to `n` and
- * thus is a candidate bound for `n`.
+ * Holds if `n` has type `t` and this information is discarded, such that `t`
+ * might be a better type bound for nodes where `n` flows to. This only includes
+ * the best such bound for each node.
  */
-pragma[noinline]
-private predicate typeFlowJoinCand(TypeFlowNode n, RefType t) {
-  exists(TypeFlowNode mid | joinStep(mid, n) | typeFlow(mid, t))
+private predicate typeFlowBase(TypeFlowNode n, RefType t) {
+  exists(RefType te |
+    typeFlowBaseCand(n, t) and
+    te = t.getErasure() and
+    not exists(RefType better |
+      typeFlowBaseCand(n, better) and
+      better != t and
+      not t.getASupertype+() = better
+    |
+      better.getASupertype+() = t or
+      better.getErasure().(RefType).getASourceSupertype+() = te
+    )
+  )
 }
 
-/**
- * Holds if `t` is a candidate bound for `n` that is also valid for data coming
- * through the edges into `n` ranked from `1` to `r`.
- */
-private predicate typeFlowJoin(int r, TypeFlowNode n, RefType t) {
-  (
-    r = 1 and typeFlowJoinCand(n, t)
-    or
-    typeFlowJoin(r - 1, n, t) and joinStepRank(r, _, n)
-  ) and
-  forall(TypeFlowNode mid | joinStepRank(r, mid, n) |
+private module TypeFlowPropagation implements TypePropagation {
+  class Typ = RefType;
+
+  predicate candType = typeFlow/2;
+
+  bindingset[t]
+  predicate supportsType(TypeFlowNode mid, RefType t) {
     exists(RefType midtyp | exactType(mid, midtyp) or typeFlow(mid, midtyp) |
       pragma[only_bind_out](midtyp).getAnAncestor() = t
     )
-  )
+  }
 }
 
 /**
@@ -374,7 +562,12 @@ private predicate typeFlow(TypeFlowNode n, RefType t) {
   or
   exists(TypeFlowNode mid | typeFlow(mid, t) and step(mid, n))
   or
-  typeFlowJoin(lastRank(n), n, t)
+  ForAll<RankedJoinStep, TypeFlowPropagation>::flowJoin(n, t)
+  or
+  exists(TypeFlowNode scc |
+    sccRepr(n, scc) and
+    ForAll<RankedSccJoinStep, TypeFlowPropagation>::flowJoin(scc, t)
+  )
 }
 
 pragma[nomagic]
@@ -429,6 +622,175 @@ private predicate bestTypeFlow(TypeFlowNode n, RefType t) {
   not irrelevantBound(n, t)
 }
 
+private predicate bestTypeFlow(TypeFlowNode n, RefType t, boolean exact) {
+  exactType(n, t) and exact = true
+  or
+  not exactType(n, _) and bestTypeFlow(n, t) and exact = false
+}
+
+private predicate bestTypeFlowOrTypeFlowBase(TypeFlowNode n, RefType t, boolean exact) {
+  bestTypeFlow(n, t, exact)
+  or
+  typeFlowBase(n, t) and
+  exact = false and
+  not bestTypeFlow(n, _, _)
+}
+
+/**
+ * Holds if `n` has type `t` and this information is not propagated as a
+ * universal bound to a subsequent node, such that `t` might form the basis for
+ * a union type bound for that node.
+ */
+private predicate unionTypeFlowBaseCand(TypeFlowNode n, RefType t, boolean exact) {
+  exists(TypeFlowNode next |
+    joinStep(n, next) and
+    bestTypeFlowOrTypeFlowBase(n, t, exact) and
+    not bestTypeFlowOrTypeFlowBase(next, t, exact) and
+    not exactType(next, _)
+  )
+}
+
+/**
+ * Holds if `ioe` checks `v`, its true-successor is `bb`, and `bb` has multiple
+ * predecessors.
+ */
+private predicate instanceofDisjunct(InstanceOfExpr ioe, BasicBlock bb, BaseSsaVariable v) {
+  ioe.getExpr() = v.getAUse() and
+  strictcount(bb.getABBPredecessor()) > 1 and
+  exists(ConditionBlock cb | cb.getCondition() = ioe and cb.getTestSuccessor(true) = bb)
+}
+
+/** Holds if `bb` is disjunctively guarded by multiple `instanceof` tests on `v`. */
+private predicate instanceofDisjunction(BasicBlock bb, BaseSsaVariable v) {
+  strictcount(InstanceOfExpr ioe | instanceofDisjunct(ioe, bb, v)) =
+    strictcount(bb.getABBPredecessor())
+}
+
+/**
+ * Holds if `n` is a value that is guarded by a disjunction of
+ * `instanceof t_i` where `t` is one of those `t_i`.
+ */
+private predicate instanceofDisjunctionGuarded(TypeFlowNode n, RefType t) {
+  exists(BasicBlock bb, InstanceOfExpr ioe, BaseSsaVariable v, VarAccess va |
+    instanceofDisjunction(bb, v) and
+    bb.bbDominates(va.getBasicBlock()) and
+    va = v.getAUse() and
+    instanceofDisjunct(ioe, bb, v) and
+    t = ioe.getCheckedType() and
+    n.asExpr() = va
+  )
+}
+
+private module HasUnionTypePropagation implements TypePropagation {
+  class Typ = Unit;
+
+  predicate candType(TypeFlowNode mid, Unit unit) {
+    exists(unit) and
+    (unionTypeFlowBaseCand(mid, _, _) or hasUnionTypeFlow(mid))
+  }
+
+  predicate supportsType = candType/2;
+}
+
+/**
+ * Holds if all incoming type flow can be traced back to a
+ * `unionTypeFlowBaseCand`, such that we can compute a union type bound for `n`.
+ * Disregards nodes for which we have an exact bound.
+ */
+private predicate hasUnionTypeFlow(TypeFlowNode n) {
+  not exactType(n, _) and
+  (
+    // Optimized version of
+    // `forex(TypeFlowNode mid | joinStep(mid, n) | unionTypeFlowBaseCand(mid, _, _) or hasUnionTypeFlow(mid))`
+    ForAll<RankedJoinStep, HasUnionTypePropagation>::flowJoin(n, _)
+    or
+    exists(TypeFlowNode scc |
+      sccRepr(n, scc) and
+      // Optimized version of
+      // `forex(TypeFlowNode mid | sccJoinStep(mid, scc) | unionTypeFlowBaseCand(mid, _, _) or hasUnionTypeFlow(mid))`
+      ForAll<RankedSccJoinStep, HasUnionTypePropagation>::flowJoin(scc, _)
+    )
+    or
+    exists(TypeFlowNode mid | step(mid, n) and hasUnionTypeFlow(mid))
+    or
+    instanceofDisjunctionGuarded(n, _)
+  )
+}
+
+pragma[nomagic]
+private RefType getTypeBound(TypeFlowNode n) {
+  bestTypeFlow(n, result)
+  or
+  not bestTypeFlow(n, _) and result = n.getType()
+}
+
+pragma[nomagic]
+private predicate unionTypeFlow0(TypeFlowNode n, RefType t, boolean exact) {
+  hasUnionTypeFlow(n) and
+  (
+    exists(TypeFlowNode mid | anyStep(mid, n) |
+      unionTypeFlowBaseCand(mid, t, exact) or unionTypeFlow(mid, t, exact)
+    )
+    or
+    instanceofDisjunctionGuarded(n, t) and exact = false
+  )
+}
+
+/** Holds if we have a union type bound for `n` and `t` is one of its parts. */
+private predicate unionTypeFlow(TypeFlowNode n, RefType t, boolean exact) {
+  unionTypeFlow0(n, t, exact) and
+  // filter impossible union parts:
+  if exact = true
+  then t.getErasure().(RefType).getASourceSupertype*() = getTypeBound(n).getErasure()
+  else haveIntersection(getTypeBound(n), t)
+}
+
+/**
+ * Holds if the inferred union type bound for `n` contains the best universal
+ * bound and thus is irrelevant.
+ */
+private predicate irrelevantUnionType(TypeFlowNode n) {
+  exists(RefType t, RefType nt, RefType te, RefType nte |
+    unionTypeFlow(n, t, false) and
+    nt = getTypeBound(n) and
+    te = t.getErasure() and
+    nte = nt.getErasure()
+  |
+    nt.getASupertype*() = t
+    or
+    nte.getASourceSupertype+() = te
+    or
+    nte = te and unbound(t)
+  )
+}
+
+/**
+ * Holds if `t` is an irrelevant part of the union type bound for `n` due to
+ * being contained in another part of the union type bound.
+ */
+private predicate irrelevantUnionTypePart(TypeFlowNode n, RefType t, boolean exact) {
+  unionTypeFlow(n, t, exact) and
+  not irrelevantUnionType(n) and
+  exists(RefType weaker |
+    unionTypeFlow(n, weaker, false) and
+    t.getASupertype*() = weaker
+  |
+    exact = true or not weaker.getASupertype*() = t
+  )
+}
+
+/**
+ * Holds if the runtime type of `n` is bounded by a union type and if this
+ * bound is likely to be better than the static type of `n`. The union type is
+ * made up of the types `t` related to `n` by this predicate, and the flag
+ * `exact` indicates whether `t` is an exact bound or merely an upper bound.
+ */
+private predicate bestUnionType(TypeFlowNode n, RefType t, boolean exact) {
+  unionTypeFlow(n, t, exact) and
+  not irrelevantUnionType(n) and
+  not irrelevantUnionTypePart(n, t, exact)
+}
+
 cached
 private module TypeFlowBounds {
   /**
@@ -440,11 +802,7 @@ private module TypeFlowBounds {
   predicate fieldTypeFlow(Field f, RefType t, boolean exact) {
     exists(TypeFlowNode n |
       n.asField() = f and
-      (
-        exactType(n, t) and exact = true
-        or
-        not exactType(n, _) and bestTypeFlow(n, t) and exact = false
-      )
+      bestTypeFlow(n, t, exact)
     )
   }
 
@@ -457,11 +815,21 @@ private module TypeFlowBounds {
   predicate exprTypeFlow(Expr e, RefType t, boolean exact) {
     exists(TypeFlowNode n |
       n.asExpr() = e and
-      (
-        exactType(n, t) and exact = true
-        or
-        not exactType(n, _) and bestTypeFlow(n, t) and exact = false
-      )
+      bestTypeFlow(n, t, exact)
+    )
+  }
+
+  /**
+   * Holds if the runtime type of `e` is bounded by a union type and if this
+   * bound is likely to be better than the static type of `e`. The union type is
+   * made up of the types `t` related to `e` by this predicate, and the flag
+   * `exact` indicates whether `t` is an exact bound or merely an upper bound.
+   */
+  cached
+  predicate exprUnionTypeFlow(Expr e, RefType t, boolean exact) {
+    exists(TypeFlowNode n |
+      n.asExpr() = e and
+      bestUnionType(n, t, exact)
     )
   }
 }
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
index 543c392817c..a57d1ca32be 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
@@ -4,11 +4,31 @@ private import DataFlowUtil
 private import semmle.code.java.dataflow.InstanceAccess
 private import semmle.code.java.dataflow.FlowSummary
 private import semmle.code.java.dispatch.VirtualDispatch as VirtualDispatch
+private import semmle.code.java.dataflow.TypeFlow
+private import semmle.code.java.dispatch.internal.Unification
 
 private module DispatchImpl {
+  private predicate hasHighConfidenceTarget(Call c) {
+    exists(SummarizedCallable sc |
+      sc = c.getCallee().getSourceDeclaration() and not sc.isAutoGenerated()
+    )
+    or
+    exists(Callable srcTgt |
+      srcTgt = VirtualDispatch::viableCallable(c) and
+      not VirtualDispatch::lowConfidenceDispatchTarget(c, srcTgt)
+    )
+  }
+
+  private Callable sourceDispatch(Call c) {
+    result = VirtualDispatch::viableCallable(c) and
+    if VirtualDispatch::lowConfidenceDispatchTarget(c, result)
+    then not hasHighConfidenceTarget(c)
+    else any()
+  }
+
   /** Gets a viable implementation of the target of the given `Call`. */
   DataFlowCallable viableCallable(DataFlowCall c) {
-    result.asCallable() = VirtualDispatch::viableCallable(c.asCall())
+    result.asCallable() = sourceDispatch(c.asCall())
     or
     result.asSummarizedCallable() = c.asCall().getCallee().getSourceDeclaration()
   }
@@ -20,7 +40,7 @@ private module DispatchImpl {
    */
   private predicate mayBenefitFromCallContext(MethodAccess ma, Callable c, int i) {
     exists(Parameter p |
-      2 <= strictcount(VirtualDispatch::viableImpl(ma)) and
+      2 <= strictcount(sourceDispatch(ma)) and
       ma.getQualifier().(VarAccess).getVariable() = p and
       p.getPosition() = i and
       c.getAParameter() = p and
@@ -29,7 +49,7 @@ private module DispatchImpl {
     )
     or
     exists(OwnInstanceAccess ia |
-      2 <= strictcount(VirtualDispatch::viableImpl(ma)) and
+      2 <= strictcount(sourceDispatch(ma)) and
       (ia.isExplicit(ma.getQualifier()) or ia.isImplicitMethodQualifier(ma)) and
       i = -1 and
       c = ma.getEnclosingCallable()
@@ -45,7 +65,7 @@ private module DispatchImpl {
   private predicate relevantContext(Call ctx, int i) {
     exists(Callable c |
       mayBenefitFromCallContext(_, c, i) and
-      c = VirtualDispatch::viableCallable(ctx)
+      c = sourceDispatch(ctx)
     )
   }
 
@@ -62,15 +82,21 @@ private module DispatchImpl {
   private predicate contextArgHasType(Call ctx, int i, RefType t, boolean exact) {
     relevantContext(ctx, i) and
     exists(RefType srctype |
-      exists(Expr arg, Expr src |
+      exists(Expr arg |
         i = -1 and
         ctx.getQualifier() = arg
         or
         ctx.getArgument(i) = arg
       |
-        src = VirtualDispatch::variableTrack(arg) and
-        srctype = getPreciseType(src) and
-        if src instanceof ClassInstanceExpr then exact = true else exact = false
+        exprTypeFlow(arg, srctype, exact)
+        or
+        not exprTypeFlow(arg, _, _) and
+        exprUnionTypeFlow(arg, srctype, exact)
+        or
+        not exprTypeFlow(arg, _, _) and
+        not exprUnionTypeFlow(arg, _, _) and
+        srctype = getPreciseType(arg) and
+        if arg instanceof ClassInstanceExpr then exact = true else exact = false
       )
       or
       exists(Node arg |
@@ -115,74 +141,20 @@ private module DispatchImpl {
       exact = false and
       exists(RefType t2 |
         result.asCallable() = VirtualDispatch::viableMethodImpl(def, t.getSourceDeclaration(), t2) and
-        not failsUnification(t, t2)
+        not Unification::failsUnification(t, t2)
       )
       or
       result.asSummarizedCallable() = def
     )
   }
 
-  pragma[noinline]
-  private predicate unificationTargetLeft(ParameterizedType t1, GenericType g) {
-    contextArgHasType(_, _, t1, _) and t1.getGenericType() = g
+  private predicate unificationTargetLeft(ParameterizedType t1) { contextArgHasType(_, _, t1, _) }
+
+  private predicate unificationTargetRight(ParameterizedType t2) {
+    exists(VirtualDispatch::viableMethodImpl(_, _, t2))
   }
 
-  pragma[noinline]
-  private predicate unificationTargetRight(ParameterizedType t2, GenericType g) {
-    exists(VirtualDispatch::viableMethodImpl(_, _, t2)) and t2.getGenericType() = g
-  }
-
-  private predicate unificationTargets(Type t1, Type t2) {
-    exists(GenericType g | unificationTargetLeft(t1, g) and unificationTargetRight(t2, g))
-    or
-    exists(Array a1, Array a2 |
-      unificationTargets(a1, a2) and
-      t1 = a1.getComponentType() and
-      t2 = a2.getComponentType()
-    )
-    or
-    exists(ParameterizedType pt1, ParameterizedType pt2, int pos |
-      unificationTargets(pt1, pt2) and
-      not pt1.getSourceDeclaration() != pt2.getSourceDeclaration() and
-      t1 = pt1.getTypeArgument(pos) and
-      t2 = pt2.getTypeArgument(pos)
-    )
-  }
-
-  pragma[noinline]
-  private predicate typeArgsOfUnificationTargets(
-    ParameterizedType t1, ParameterizedType t2, int pos, RefType arg1, RefType arg2
-  ) {
-    unificationTargets(t1, t2) and
-    arg1 = t1.getTypeArgument(pos) and
-    arg2 = t2.getTypeArgument(pos)
-  }
-
-  private predicate failsUnification(Type t1, Type t2) {
-    unificationTargets(t1, t2) and
-    (
-      exists(RefType arg1, RefType arg2 |
-        typeArgsOfUnificationTargets(t1, t2, _, arg1, arg2) and
-        failsUnification(arg1, arg2)
-      )
-      or
-      failsUnification(t1.(Array).getComponentType(), t2.(Array).getComponentType())
-      or
-      not (
-        t1 instanceof Array and t2 instanceof Array
-        or
-        t1.(PrimitiveType) = t2.(PrimitiveType)
-        or
-        t1.(Class).getSourceDeclaration() = t2.(Class).getSourceDeclaration()
-        or
-        t1.(Interface).getSourceDeclaration() = t2.(Interface).getSourceDeclaration()
-        or
-        t1 instanceof BoundedType and t2 instanceof RefType
-        or
-        t1 instanceof RefType and t2 instanceof BoundedType
-      )
-    )
-  }
+  private module Unification = MkUnification<unificationTargetLeft/1, unificationTargetRight/1>;
 
   private int parameterPosition() { result in [-1, any(Parameter p).getPosition()] }
 
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll b/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
index e00fc952e1c..d857cdaa359 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
@@ -226,15 +226,6 @@ module Public {
       none()
     }
 
-    /**
-     * Holds if values stored inside `content` are cleared on objects passed as
-     * arguments at position `pos` to this callable.
-     *
-     * TODO: Remove once all languages support `WithoutContent` tokens.
-     */
-    pragma[nomagic]
-    predicate clearsContent(ParameterPosition pos, ContentSet content) { none() }
-
     /**
      * Holds if the summary is auto generated.
      */
@@ -328,23 +319,6 @@ module Private {
           SummaryComponentStack::singleton(TArgumentSummaryComponent(_))) and
       preservesValue = preservesValue1.booleanAnd(preservesValue2)
     )
-    or
-    exists(ParameterPosition ppos, ContentSet cs |
-      c.clearsContent(ppos, cs) and
-      input = SummaryComponentStack::push(SummaryComponent::withoutContent(cs), output) and
-      output = SummaryComponentStack::argument(ppos) and
-      preservesValue = true
-    )
-  }
-
-  private class MkClearStack extends RequiredSummaryComponentStack {
-    override predicate required(SummaryComponent head, SummaryComponentStack tail) {
-      exists(SummarizedCallable sc, ParameterPosition ppos, ContentSet cs |
-        sc.clearsContent(ppos, cs) and
-        head = SummaryComponent::withoutContent(cs) and
-        tail = SummaryComponentStack::argument(ppos)
-      )
-    }
   }
 
   /**
@@ -945,8 +919,7 @@ module Private {
         AccessPath inSpec, AccessPath outSpec, string kind
       ) {
         summaryElement(this, inSpec, outSpec, kind, true) and
-        not summaryElement(this, _, _, _, false) and
-        not this.clearsContent(_, _)
+        not summaryElement(this, _, _, _, false)
       }
 
       private predicate relevantSummaryElement(AccessPath inSpec, AccessPath outSpec, string kind) {
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/NegativeSummary.qll b/java/ql/lib/semmle/code/java/dataflow/internal/NegativeSummary.qll
new file mode 100644
index 00000000000..e7b6b7b8838
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/NegativeSummary.qll
@@ -0,0 +1,9 @@
+/** Provides modules for importing negative summaries. */
+
+/**
+ * A module importing the frameworks that provide external flow data,
+ * ensuring that they are visible to the taint tracking / data flow library.
+ */
+private module Frameworks {
+  private import semmle.code.java.frameworks.GeneratedNegative
+}
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
index e00dee7c8dd..d52b340e67a 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -251,7 +251,7 @@ private predicate qualifierToArgumentStep(Expr tracked, Expr sink) {
 
 /** Access to a method that passes taint from the qualifier. */
 private predicate qualifierToMethodStep(Expr tracked, MethodAccess sink) {
-  (taintPreservingQualifierToMethod(sink.getMethod()) or unsafeEscape(sink)) and
+  taintPreservingQualifierToMethod(sink.getMethod()) and
   tracked = sink.getQualifier()
 }
 
@@ -282,28 +282,6 @@ private predicate taintPreservingQualifierToMethod(Method m) {
   )
 }
 
-private class StringReplaceMethod extends TaintPreservingCallable {
-  StringReplaceMethod() {
-    this.getDeclaringType() instanceof TypeString and
-    (
-      this.hasName("replace") or
-      this.hasName("replaceAll") or
-      this.hasName("replaceFirst")
-    )
-  }
-
-  override predicate returnsTaintFrom(int arg) { arg = 1 }
-}
-
-private predicate unsafeEscape(MethodAccess ma) {
-  // Removing `<script>` tags using a string-replace method is
-  // unsafe if such a tag is embedded inside another one (e.g. `<scr<script>ipt>`).
-  exists(StringReplaceMethod m | ma.getMethod() = m |
-    ma.getArgument(0).(StringLiteral).getValue() = "(<script>)" and
-    ma.getArgument(1).(StringLiteral).getValue() = ""
-  )
-}
-
 /** Access to a method that passes taint from an argument. */
 private predicate argToMethodStep(Expr tracked, MethodAccess sink) {
   exists(Method m, int i |
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll b/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll b/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking3/TaintTrackingImpl.qll b/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/java/ql/lib/semmle/code/java/deadcode/DeadCode.qll b/java/ql/lib/semmle/code/java/deadcode/DeadCode.qll
index f0ddffa9aa2..8dbb9bb530e 100644
--- a/java/ql/lib/semmle/code/java/deadcode/DeadCode.qll
+++ b/java/ql/lib/semmle/code/java/deadcode/DeadCode.qll
@@ -162,7 +162,7 @@ class LiveClass extends SourceClassOrInterface {
     exists(LiveField f | f.getDeclaringType() = this |
       // A `serialVersionUID` field is considered to be a live field, but is
       // not be enough to be make this class live.
-      not f instanceof SerialVersionUIDField
+      not f instanceof SerialVersionUidField
     )
     or
     // If this is a namespace class, it is live if there is at least one live nested class.
@@ -250,7 +250,7 @@ class DeadMethod extends Callable {
     // These getters and setters are often generated in an ad-hoc way by the developer, which leads to
     // methods that are theoretically dead, but uninteresting. We therefore ignore them, so long as
     // they are "simple".
-    not exists(JPAReadField readField | this.getDeclaringType() = readField.getDeclaringType() |
+    not exists(JpaReadField readField | this.getDeclaringType() = readField.getDeclaringType() |
       this.(GetterMethod).getField() = readField or
       this.(SetterMethod).getField() = readField
     )
diff --git a/java/ql/lib/semmle/code/java/deadcode/DeadField.qll b/java/ql/lib/semmle/code/java/deadcode/DeadField.qll
index dcd58987b94..4499c6d63c8 100644
--- a/java/ql/lib/semmle/code/java/deadcode/DeadField.qll
+++ b/java/ql/lib/semmle/code/java/deadcode/DeadField.qll
@@ -87,8 +87,8 @@ abstract class WhitelistedLiveField extends Field { }
  * A static, final, long field named `serialVersionUID` in a class that extends `Serializable` acts as
  * a version number for the serialization framework.
  */
-class SerialVersionUIDField extends ReflectivelyReadField {
-  SerialVersionUIDField() {
+class SerialVersionUidField extends ReflectivelyReadField {
+  SerialVersionUidField() {
     this.hasName("serialVersionUID") and
     this.isStatic() and
     this.isFinal() and
@@ -97,6 +97,9 @@ class SerialVersionUIDField extends ReflectivelyReadField {
   }
 }
 
+/** DEPRECATED: Alias for SerialVersionUidField */
+deprecated class SerialVersionUIDField = SerialVersionUidField;
+
 /**
  * A field is read by the JAXB during serialization if it is a JAXB bound field, and if the
  * containing class is considered "live".
@@ -154,8 +157,8 @@ class JacksonMixinReflextivelyReadField extends ReflectivelyReadField {
 /**
  * A field which is read by a JPA compatible Java persistence framework.
  */
-class JPAReadField extends ReflectivelyReadField {
-  JPAReadField() {
+class JpaReadField extends ReflectivelyReadField {
+  JpaReadField() {
     exists(PersistentEntity entity |
       this = entity.getAField() and
       (
@@ -169,3 +172,6 @@ class JPAReadField extends ReflectivelyReadField {
     )
   }
 }
+
+/** DEPRECATED: Alias for JpaReadField */
+deprecated class JPAReadField = JpaReadField;
diff --git a/java/ql/lib/semmle/code/java/deadcode/EntryPoints.qll b/java/ql/lib/semmle/code/java/deadcode/EntryPoints.qll
index 4a12730b60f..d6d0653c1ea 100644
--- a/java/ql/lib/semmle/code/java/deadcode/EntryPoints.qll
+++ b/java/ql/lib/semmle/code/java/deadcode/EntryPoints.qll
@@ -128,8 +128,9 @@ class JacksonMixinCallableEntryPoint extends EntryPoint {
   override Callable getALiveCallable() { result = this }
 }
 
-class JAXAnnotationReflectivelyConstructedClass extends ReflectivelyConstructedClass {
-  JAXAnnotationReflectivelyConstructedClass() {
+/** A JAX annotation seen as a reflectively constructed class. */
+class JaxAnnotationReflectivelyConstructedClass extends ReflectivelyConstructedClass {
+  JaxAnnotationReflectivelyConstructedClass() {
     this instanceof JaxWsEndpoint or
     this instanceof JaxbXmlRegistry or
     this instanceof JaxRsResourceClass or
@@ -137,6 +138,10 @@ class JAXAnnotationReflectivelyConstructedClass extends ReflectivelyConstructedC
   }
 }
 
+/** DEPRECATED: Alias for JaxAnnotationReflectivelyConstructedClass */
+deprecated class JAXAnnotationReflectivelyConstructedClass =
+  JaxAnnotationReflectivelyConstructedClass;
+
 class DeserializedClass extends ReflectivelyConstructedClass {
   DeserializedClass() {
     exists(CastingExpr cast, ReadObjectMethod readObject |
@@ -342,8 +347,9 @@ class GsonDeserializationEntryPoint extends ReflectivelyConstructedClass {
   }
 }
 
-class JAXBDeserializationEntryPoint extends ReflectivelyConstructedClass {
-  JAXBDeserializationEntryPoint() {
+/** A JAXB deserialization entry point seen as a reflectively constructed class. */
+class JaxbDeserializationEntryPoint extends ReflectivelyConstructedClass {
+  JaxbDeserializationEntryPoint() {
     // A class can be deserialized by JAXB if it's an `XmlRootElement`...
     this.getAnAnnotation().getType().hasQualifiedName("javax.xml.bind.annotation", "XmlRootElement")
     or
@@ -356,6 +362,9 @@ class JAXBDeserializationEntryPoint extends ReflectivelyConstructedClass {
   }
 }
 
+/** DEPRECATED: Alias for JaxbDeserializationEntryPoint */
+deprecated class JAXBDeserializationEntryPoint = JaxbDeserializationEntryPoint;
+
 /**
  * A `javax.annotation` for a method that is called after or before dependency injection on a type.
  *
diff --git a/java/ql/lib/semmle/code/java/deadcode/SpringEntryPoints.qll b/java/ql/lib/semmle/code/java/deadcode/SpringEntryPoints.qll
index 562c7ef7c1c..fd2dc8974f7 100644
--- a/java/ql/lib/semmle/code/java/deadcode/SpringEntryPoints.qll
+++ b/java/ql/lib/semmle/code/java/deadcode/SpringEntryPoints.qll
@@ -104,8 +104,8 @@ class SpringAspect extends CallableEntryPoint {
 /**
  * Spring Shell provides annotations for identifying methods that contribute CLI commands.
  */
-class SpringCLI extends CallableEntryPoint {
-  SpringCLI() {
+class SpringCli extends CallableEntryPoint {
+  SpringCli() {
     (
       hasAnnotation("org.springframework.shell.core.annotation", "CliCommand") or
       hasAnnotation("org.springframework.shell.core.annotation", "CliAvailabilityIndicator")
@@ -116,6 +116,9 @@ class SpringCLI extends CallableEntryPoint {
   }
 }
 
+/** DEPRECATED: Alias for SpringCli */
+deprecated class SpringCLI = SpringCli;
+
 /**
  * An entry point which acts as a remote API for a Flex application to access a Spring application.
  */
diff --git a/java/ql/lib/semmle/code/java/deadcode/WebEntryPoints.qll b/java/ql/lib/semmle/code/java/deadcode/WebEntryPoints.qll
index 836ad5a1f55..5f2f215802f 100644
--- a/java/ql/lib/semmle/code/java/deadcode/WebEntryPoints.qll
+++ b/java/ql/lib/semmle/code/java/deadcode/WebEntryPoints.qll
@@ -58,15 +58,18 @@ class ServletFilterClass extends ReflectivelyConstructedClass {
 /**
  * An entry point into a GWT application.
  */
-class GWTEntryPointConstructedClass extends ReflectivelyConstructedClass {
-  GWTEntryPointConstructedClass() { this.(GwtEntryPointClass).isLive() }
+class GwtEntryPointConstructedClass extends ReflectivelyConstructedClass {
+  GwtEntryPointConstructedClass() { this.(GwtEntryPointClass).isLive() }
 }
 
+/** DEPRECATED: Alias for GwtEntryPointConstructedClass */
+deprecated class GWTEntryPointConstructedClass = GwtEntryPointConstructedClass;
+
 /**
  * Servlets referred to from a GWT module config file.
  */
-class GWTServletClass extends ReflectivelyConstructedClass {
-  GWTServletClass() {
+class GwtServletClass extends ReflectivelyConstructedClass {
+  GwtServletClass() {
     this instanceof ServletClass and
     // There must be evidence that GWT is being used, otherwise missing `*.gwt.xml` files could cause
     // all `Servlet`s to be live.
@@ -81,6 +84,9 @@ class GWTServletClass extends ReflectivelyConstructedClass {
   }
 }
 
+/** DEPRECATED: Alias for GwtServletClass */
+deprecated class GWTServletClass = GwtServletClass;
+
 /**
  * Methods that may be called reflectively by the UiHandler framework.
  */
diff --git a/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll b/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll
index a05553eb373..29e93f426dc 100644
--- a/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll
+++ b/java/ql/lib/semmle/code/java/dispatch/ObjFlow.qll
@@ -15,6 +15,7 @@ private import semmle.code.java.dataflow.internal.DataFlowUtil
 private import semmle.code.java.dataflow.internal.DataFlowPrivate
 private import semmle.code.java.dataflow.internal.ContainerFlow
 private import semmle.code.java.dataflow.InstanceAccess
+private import semmle.code.java.dispatch.internal.Unification
 
 /**
  * Gets a viable dispatch target for `ma`. This is the input dispatch relation.
@@ -266,67 +267,10 @@ Method viableImpl_out(MethodAccess ma) {
   )
 }
 
-private module Unification {
-  pragma[noinline]
-  private predicate unificationTargetLeft(ParameterizedType t1, GenericType g) {
-    objectToStringQualType(_, t1) and t1.getGenericType() = g
-  }
+private predicate unificationTargetLeft(ParameterizedType t1) { objectToStringQualType(_, t1) }
 
-  pragma[noinline]
-  private predicate unificationTargetRight(ParameterizedType t2, GenericType g) {
-    exists(viableMethodImpl(_, _, t2)) and t2.getGenericType() = g
-  }
-
-  private predicate unificationTargets(Type t1, Type t2) {
-    exists(GenericType g | unificationTargetLeft(t1, g) and unificationTargetRight(t2, g))
-    or
-    exists(Array a1, Array a2 |
-      unificationTargets(a1, a2) and
-      t1 = a1.getComponentType() and
-      t2 = a2.getComponentType()
-    )
-    or
-    exists(ParameterizedType pt1, ParameterizedType pt2, int pos |
-      unificationTargets(pt1, pt2) and
-      not pt1.getSourceDeclaration() != pt2.getSourceDeclaration() and
-      t1 = pt1.getTypeArgument(pos) and
-      t2 = pt2.getTypeArgument(pos)
-    )
-  }
-
-  pragma[noinline]
-  private predicate typeArgsOfUnificationTargets(
-    ParameterizedType t1, ParameterizedType t2, int pos, RefType arg1, RefType arg2
-  ) {
-    unificationTargets(t1, t2) and
-    arg1 = t1.getTypeArgument(pos) and
-    arg2 = t2.getTypeArgument(pos)
-  }
-
-  pragma[nomagic]
-  predicate failsUnification(Type t1, Type t2) {
-    unificationTargets(t1, t2) and
-    (
-      exists(RefType arg1, RefType arg2 |
-        typeArgsOfUnificationTargets(t1, t2, _, arg1, arg2) and
-        failsUnification(arg1, arg2)
-      )
-      or
-      failsUnification(t1.(Array).getComponentType(), t2.(Array).getComponentType())
-      or
-      not (
-        t1 instanceof Array and t2 instanceof Array
-        or
-        t1.(PrimitiveType) = t2.(PrimitiveType)
-        or
-        t1.(Class).getSourceDeclaration() = t2.(Class).getSourceDeclaration()
-        or
-        t1.(Interface).getSourceDeclaration() = t2.(Interface).getSourceDeclaration()
-        or
-        t1 instanceof BoundedType and t2 instanceof RefType
-        or
-        t1 instanceof RefType and t2 instanceof BoundedType
-      )
-    )
-  }
+private predicate unificationTargetRight(ParameterizedType t2) {
+  exists(viableMethodImpl(_, _, t2))
 }
+
+private module Unification = MkUnification<unificationTargetLeft/1, unificationTargetRight/1>;
diff --git a/java/ql/lib/semmle/code/java/dispatch/VirtualDispatch.qll b/java/ql/lib/semmle/code/java/dispatch/VirtualDispatch.qll
index 7d4b617ca19..56385e89877 100644
--- a/java/ql/lib/semmle/code/java/dispatch/VirtualDispatch.qll
+++ b/java/ql/lib/semmle/code/java/dispatch/VirtualDispatch.qll
@@ -9,6 +9,7 @@ private import DispatchFlow as DispatchFlow
 private import ObjFlow as ObjFlow
 private import semmle.code.java.dataflow.internal.BaseSSA
 private import semmle.code.java.controlflow.Guards
+private import semmle.code.java.dispatch.internal.Unification
 
 /**
  * A conservative analysis that returns a single method - if we can establish
@@ -53,6 +54,16 @@ private module Dispatch {
   cached
   Method viableImpl(MethodAccess ma) { result = ObjFlow::viableImpl_out(ma) }
 
+  /**
+   * Holds if `m` is a viable implementation of the method called in `ma` for
+   * which we only have imprecise open-world type-based dispatch resolution, and
+   * the dispatch type is likely to yield implausible dispatch targets.
+   */
+  cached
+  predicate lowConfidenceDispatchTarget(MethodAccess ma, Method m) {
+    m = viableImpl(ma) and lowConfidenceDispatch(ma)
+  }
+
   /**
    * INTERNAL: Use `viableImpl` instead.
    *
@@ -61,8 +72,42 @@ private module Dispatch {
   cached
   Method viableImpl_v3(MethodAccess ma) { result = DispatchFlow::viableImpl_out(ma) }
 
-  private predicate qualType(VirtualMethodAccess ma, RefType t, boolean exact) {
-    exprTypeFlow(ma.getQualifier(), t, exact)
+  /**
+   * Holds if the best type bounds for the qualifier of `ma` are likely to
+   * contain implausible dispatch targets.
+   */
+  private predicate lowConfidenceDispatch(VirtualMethodAccess ma) {
+    exists(RefType t | hasQualifierType(ma, t, false) |
+      lowConfidenceDispatchType(t.getSourceDeclaration())
+    ) and
+    (
+      not qualType(ma, _, _)
+      or
+      exists(RefType t | qualType(ma, t, false) |
+        lowConfidenceDispatchType(t.getSourceDeclaration())
+      )
+    ) and
+    (
+      not qualUnionType(ma, _, _)
+      or
+      exists(RefType t | qualUnionType(ma, t, false) |
+        lowConfidenceDispatchType(t.getSourceDeclaration())
+      )
+    )
+  }
+
+  private predicate lowConfidenceDispatchType(SrcRefType t) {
+    t instanceof TypeObject
+    or
+    t instanceof FunctionalInterface
+    or
+    t.hasQualifiedName("java.io", "Serializable")
+    or
+    t.hasQualifiedName("java.lang", "Cloneable")
+    or
+    t.getPackage().hasName("java.util") and t instanceof Interface
+    or
+    t.hasQualifiedName("java.util", "Hashtable")
   }
 
   /**
@@ -72,6 +117,35 @@ private module Dispatch {
    */
   cached
   Method viableImpl_v2(MethodAccess ma) {
+    result = viableImpl_v2_cand(pragma[only_bind_into](ma)) and
+    exists(Method def, RefType t, boolean exact |
+      qualUnionType(pragma[only_bind_into](ma), pragma[only_bind_into](t),
+        pragma[only_bind_into](exact)) and
+      def = ma.getMethod().getSourceDeclaration()
+    |
+      exact = true and result = exactMethodImpl(def, t.getSourceDeclaration())
+      or
+      exact = false and
+      exists(RefType t2 |
+        result = viableMethodImpl(def, t.getSourceDeclaration(), t2) and
+        not Unification_v2::failsUnification(t, t2)
+      )
+    )
+    or
+    result = viableImpl_v2_cand(ma) and
+    not qualUnionType(ma, _, _)
+  }
+
+  private predicate qualUnionType(VirtualMethodAccess ma, RefType t, boolean exact) {
+    exprUnionTypeFlow(ma.getQualifier(), t, exact)
+  }
+
+  private predicate unificationTargetLeft_v2(ParameterizedType t1) { qualUnionType(_, t1, _) }
+
+  private module Unification_v2 =
+    MkUnification<unificationTargetLeft_v2/1, unificationTargetRight/1>;
+
+  private Method viableImpl_v2_cand(MethodAccess ma) {
     result = viableImpl_v1(ma) and
     (
       exists(Method def, RefType t, boolean exact |
@@ -83,7 +157,7 @@ private module Dispatch {
         exact = false and
         exists(RefType t2 |
           result = viableMethodImpl(def, t.getSourceDeclaration(), t2) and
-          not Unification_v2::failsUnification(t, t2)
+          not Unification_v2_cand::failsUnification(t, t2)
         )
       )
       or
@@ -91,70 +165,15 @@ private module Dispatch {
     )
   }
 
-  private module Unification_v2 {
-    pragma[noinline]
-    private predicate unificationTargetLeft(ParameterizedType t1, GenericType g) {
-      qualType(_, t1, _) and t1.getGenericType() = g
-    }
-
-    pragma[noinline]
-    private predicate unificationTargetRight(ParameterizedType t2, GenericType g) {
-      exists(viableMethodImpl(_, _, t2)) and t2.getGenericType() = g
-    }
-
-    private predicate unificationTargets(Type t1, Type t2) {
-      exists(GenericType g | unificationTargetLeft(t1, g) and unificationTargetRight(t2, g))
-      or
-      exists(Array a1, Array a2 |
-        unificationTargets(a1, a2) and
-        t1 = a1.getComponentType() and
-        t2 = a2.getComponentType()
-      )
-      or
-      exists(ParameterizedType pt1, ParameterizedType pt2, int pos |
-        unificationTargets(pt1, pt2) and
-        not pt1.getSourceDeclaration() != pt2.getSourceDeclaration() and
-        t1 = pt1.getTypeArgument(pos) and
-        t2 = pt2.getTypeArgument(pos)
-      )
-    }
-
-    pragma[noinline]
-    private predicate typeArgsOfUnificationTargets(
-      ParameterizedType t1, ParameterizedType t2, int pos, RefType arg1, RefType arg2
-    ) {
-      unificationTargets(t1, t2) and
-      arg1 = t1.getTypeArgument(pos) and
-      arg2 = t2.getTypeArgument(pos)
-    }
-
-    predicate failsUnification(Type t1, Type t2) {
-      unificationTargets(t1, t2) and
-      (
-        exists(RefType arg1, RefType arg2 |
-          typeArgsOfUnificationTargets(t1, t2, _, arg1, arg2) and
-          failsUnification(arg1, arg2)
-        )
-        or
-        failsUnification(t1.(Array).getComponentType(), t2.(Array).getComponentType())
-        or
-        not (
-          t1 instanceof Array and t2 instanceof Array
-          or
-          t1.(PrimitiveType) = t2.(PrimitiveType)
-          or
-          t1.(Class).getSourceDeclaration() = t2.(Class).getSourceDeclaration()
-          or
-          t1.(Interface).getSourceDeclaration() = t2.(Interface).getSourceDeclaration()
-          or
-          t1 instanceof BoundedType and t2 instanceof RefType
-          or
-          t1 instanceof RefType and t2 instanceof BoundedType
-        )
-      )
-    }
+  private predicate qualType(VirtualMethodAccess ma, RefType t, boolean exact) {
+    exprTypeFlow(ma.getQualifier(), t, exact)
   }
 
+  private predicate unificationTargetLeft_v2_cand(ParameterizedType t1) { qualType(_, t1, _) }
+
+  private module Unification_v2_cand =
+    MkUnification<unificationTargetLeft_v2_cand/1, unificationTargetRight/1>;
+
   /**
    * INTERNAL: Use `viableImpl` instead.
    *
@@ -203,70 +222,15 @@ private module Dispatch {
     else result = source.getMethod().getSourceDeclaration()
   }
 
-  private module Unification_v1 {
-    pragma[noinline]
-    private predicate unificationTargetLeft(ParameterizedType t1, GenericType g) {
-      hasQualifierType(_, t1, _) and t1.getGenericType() = g
-    }
+  private predicate unificationTargetLeft_v1(ParameterizedType t1) { hasQualifierType(_, t1, _) }
 
-    pragma[noinline]
-    private predicate unificationTargetRight(ParameterizedType t2, GenericType g) {
-      exists(viableMethodImpl(_, _, t2)) and t2.getGenericType() = g
-    }
-
-    private predicate unificationTargets(Type t1, Type t2) {
-      exists(GenericType g | unificationTargetLeft(t1, g) and unificationTargetRight(t2, g))
-      or
-      exists(Array a1, Array a2 |
-        unificationTargets(a1, a2) and
-        t1 = a1.getComponentType() and
-        t2 = a2.getComponentType()
-      )
-      or
-      exists(ParameterizedType pt1, ParameterizedType pt2, int pos |
-        unificationTargets(pt1, pt2) and
-        not pt1.getSourceDeclaration() != pt2.getSourceDeclaration() and
-        t1 = pt1.getTypeArgument(pos) and
-        t2 = pt2.getTypeArgument(pos)
-      )
-    }
-
-    pragma[noinline]
-    private predicate typeArgsOfUnificationTargets(
-      ParameterizedType t1, ParameterizedType t2, int pos, RefType arg1, RefType arg2
-    ) {
-      unificationTargets(t1, t2) and
-      arg1 = t1.getTypeArgument(pos) and
-      arg2 = t2.getTypeArgument(pos)
-    }
-
-    predicate failsUnification(Type t1, Type t2) {
-      unificationTargets(t1, t2) and
-      (
-        exists(RefType arg1, RefType arg2 |
-          typeArgsOfUnificationTargets(t1, t2, _, arg1, arg2) and
-          failsUnification(arg1, arg2)
-        )
-        or
-        failsUnification(t1.(Array).getComponentType(), t2.(Array).getComponentType())
-        or
-        not (
-          t1 instanceof Array and t2 instanceof Array
-          or
-          t1.(PrimitiveType) = t2.(PrimitiveType)
-          or
-          t1.(Class).getSourceDeclaration() = t2.(Class).getSourceDeclaration()
-          or
-          t1.(Interface).getSourceDeclaration() = t2.(Interface).getSourceDeclaration()
-          or
-          t1 instanceof BoundedType and t2 instanceof RefType
-          or
-          t1 instanceof RefType and t2 instanceof BoundedType
-        )
-      )
-    }
+  private predicate unificationTargetRight(ParameterizedType t2) {
+    exists(viableMethodImpl(_, _, t2))
   }
 
+  private module Unification_v1 =
+    MkUnification<unificationTargetLeft_v1/1, unificationTargetRight/1>;
+
   private RefType getPreciseType(Expr e) {
     result = e.(FunctionalExpr).getConstructedType()
     or
@@ -274,9 +238,8 @@ private module Dispatch {
   }
 
   private predicate hasQualifierType(VirtualMethodAccess ma, RefType t, boolean exact) {
-    exists(Expr src | src = variableTrack(ma.getQualifier()) |
-      // If we have a qualifier, then we track it through variable assignments
-      // and take the type of the assigned value.
+    exists(Expr src | src = ma.getQualifier() |
+      // If we have a qualifier, then we take its type.
       exists(RefType srctype | srctype = getPreciseType(src) |
         exists(BoundedType bd | bd = srctype |
           t = bd.getAnUltimateUpperBoundType()
@@ -324,43 +287,20 @@ private module Dispatch {
     exists(Method m | t.hasMethod(m, _, _) and impl = m.getSourceDeclaration())
   }
 
+  private predicate isAbstractWithSubclass(SrcRefType t) {
+    t.isAbstract() and exists(Class c | c.getASourceSupertype() = t)
+  }
+
   private predicate hasViableSubtype(RefType t, SrcRefType sub) {
     sub.extendsOrImplements*(t) and
     not sub instanceof Interface and
-    not sub.isAbstract()
+    not isAbstractWithSubclass(sub)
   }
 }
 
 import Dispatch
 
-private Expr variableTrackStep(Expr use) {
-  exists(Variable v |
-    pragma[only_bind_out](use) = v.getAnAccess() and
-    use.getType() instanceof RefType and
-    not result instanceof NullLiteral and
-    not v.(LocalVariableDecl).getDeclExpr().hasImplicitInit()
-  |
-    not v instanceof Parameter and
-    result = v.getAnAssignedValue()
-    or
-    exists(Parameter p | p = v and p.getCallable().isPrivate() |
-      result = p.getAnAssignedValue() or
-      result = p.getAnArgument()
-    )
-  )
-}
-
-private Expr variableTrackPath(Expr use) {
-  result = variableTrackStep*(use) and
-  not exists(variableTrackStep(result))
-}
-
 /**
- * Gets an expression by tracking `use` backwards through variable assignments.
+ * DEPRECATED: Use `TypeFlow` instead.
  */
-pragma[inline]
-Expr variableTrack(Expr use) {
-  result = variableTrackPath(use)
-  or
-  not exists(variableTrackPath(use)) and result = use
-}
+deprecated Expr variableTrack(Expr use) { result = use }
diff --git a/java/ql/lib/semmle/code/java/dispatch/internal/Unification.qll b/java/ql/lib/semmle/code/java/dispatch/internal/Unification.qll
new file mode 100644
index 00000000000..46bcc3a2201
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/dispatch/internal/Unification.qll
@@ -0,0 +1,136 @@
+/**
+ * Provides a module to check whether two `ParameterizedType`s are unifiable.
+ */
+
+import java
+
+/** Holds if `t` is a relevant type to consider for unification. */
+signature predicate unificationTarget(ParameterizedType t);
+
+/**
+ * Given two sets of parameterised types to consider for unification, returns
+ * the set of pairs that are not unifiable.
+ */
+module MkUnification<unificationTarget/1 targetLeft, unificationTarget/1 targetRight> {
+  pragma[noinline]
+  private predicate unificationTargetLeft(ParameterizedType t1, GenericType g) {
+    targetLeft(t1) and t1.getGenericType() = g
+  }
+
+  pragma[noinline]
+  private predicate unificationTargetRight(ParameterizedType t2, GenericType g) {
+    targetRight(t2) and t2.getGenericType() = g
+  }
+
+  private predicate unificationTargets(Type t1, Type t2) {
+    exists(GenericType g | unificationTargetLeft(t1, g) and unificationTargetRight(t2, g))
+    or
+    exists(Array a1, Array a2 |
+      unificationTargets(a1, a2) and
+      t1 = a1.getComponentType() and
+      t2 = a2.getComponentType()
+    )
+    or
+    exists(ParameterizedType pt1, ParameterizedType pt2, int pos |
+      unificationTargets(pt1, pt2) and
+      not pt1.getSourceDeclaration() != pt2.getSourceDeclaration() and
+      t1 = pt1.getTypeArgument(pos) and
+      t2 = pt2.getTypeArgument(pos)
+    )
+  }
+
+  pragma[noinline]
+  private predicate typeArgsOfUnificationTargets(
+    ParameterizedType t1, ParameterizedType t2, int pos, RefType arg1, RefType arg2
+  ) {
+    unificationTargets(t1, t2) and
+    arg1 = t1.getTypeArgument(pos) and
+    arg2 = t2.getTypeArgument(pos)
+  }
+
+  private RefType getUpperBound(RefType t) {
+    if t instanceof BoundedType
+    then result = t.(BoundedType).getAnUltimateUpperBoundType()
+    else result = t
+  }
+
+  /**
+   * Holds if `t1` and `t2` are not unifiable.
+   *
+   * Restricted to only consider pairs of types such that `targetLeft(t1)`,
+   * `targetRight(t2)`, and that both are parameterised instances of the same
+   * generic type.
+   */
+  pragma[nomagic]
+  predicate failsUnification(Type t1, Type t2) {
+    unificationTargets(t1, t2) and
+    (
+      exists(RefType arg1, RefType arg2 |
+        typeArgsOfUnificationTargets(t1, t2, _, arg1, arg2) and
+        failsUnification(arg1, arg2)
+      )
+      or
+      failsUnification(t1.(Array).getComponentType(), t2.(Array).getComponentType())
+      or
+      // Can't unify an `extends` bound against a concrete type that doesn't
+      // descend from that upper bound:
+      exists(RefType upperbound, RefType other |
+        t1.(BoundedType).getAnUltimateUpperBoundType().getSourceDeclaration() = upperbound and
+        t2.(RefType).getSourceDeclaration() = other and
+        not t2 instanceof BoundedType
+        or
+        t2.(BoundedType).getAnUltimateUpperBoundType().getSourceDeclaration() = upperbound and
+        t1.(RefType).getSourceDeclaration() = other and
+        not t1 instanceof BoundedType
+      |
+        not other.getASourceSupertype*() = upperbound
+      )
+      or
+      // Can't unify two `extends` bounds that don't intersect:
+      exists(RefType upperbound1, RefType upperbound2 |
+        t1.(BoundedType).getAnUltimateUpperBoundType() = upperbound1 and
+        t2.(BoundedType).getAnUltimateUpperBoundType() = upperbound2 and
+        notHaveIntersection(upperbound1, upperbound2)
+      )
+      or
+      // Can't unify `? super X` against `Y` or `_ extends Y` where `Y` isn't an
+      // ancestor of `X`:
+      exists(RefType lowerbound, RefType upperbound |
+        t1.(Wildcard).getLowerBoundType().(RefType).getSourceDeclaration() = lowerbound and
+        getUpperBound(t2).getSourceDeclaration() = upperbound
+        or
+        t2.(Wildcard).getLowerBoundType().(RefType).getSourceDeclaration() = lowerbound and
+        getUpperBound(t1).getSourceDeclaration() = upperbound
+      |
+        not lowerbound instanceof BoundedType and
+        not lowerbound.getASourceSupertype*() = upperbound
+      )
+      or
+      // Can't unify `? super T`, where `T` is a type variable `T extends S`,
+      // with a type that doesn't intersect with `S`:
+      exists(BoundedType lowerbound, RefType upperbound |
+        t1.(Wildcard).getLowerBoundType() = lowerbound and
+        getUpperBound(t2) = upperbound
+        or
+        t2.(Wildcard).getLowerBoundType() = lowerbound and
+        getUpperBound(t1) = upperbound
+      |
+        notHaveIntersection(lowerbound.getUpperBoundType(), upperbound)
+      )
+      or
+      not (
+        t1 instanceof Array and t2 instanceof Array
+        or
+        t1.(PrimitiveType) = t2.(PrimitiveType)
+        or
+        t1.(Class).getSourceDeclaration() = t2.(Class).getSourceDeclaration()
+        or
+        t1.(Interface).getSourceDeclaration() = t2.(Interface).getSourceDeclaration()
+        or
+        t1 instanceof BoundedType and t2 instanceof RefType
+        or
+        t1 instanceof RefType and t2 instanceof BoundedType
+      )
+    )
+  }
+}
diff --git a/java/ql/lib/semmle/code/java/frameworks/Camel.qll b/java/ql/lib/semmle/code/java/frameworks/Camel.qll
index c72c884220b..4a1cf58779e 100644
--- a/java/ql/lib/semmle/code/java/frameworks/Camel.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/Camel.qll
@@ -13,7 +13,7 @@ import semmle.code.java.frameworks.camel.CamelJavaAnnotations
 class CamelToUri extends string {
   CamelToUri() {
     exists(SpringCamelXmlToElement toXmlElement | this = toXmlElement.getUri()) or
-    exists(CamelJavaDSLToDecl toJavaDSL | this = toJavaDSL.getUri())
+    exists(CamelJavaDslToDecl toJavaDsl | this = toJavaDsl.getUri())
   }
 }
 
@@ -77,13 +77,13 @@ class CamelTargetClass extends Class {
       this = xmlMethod.getBeanType()
     )
     or
-    exists(CamelJavaDSLMethodDecl methodDecl | this = methodDecl.getABean())
+    exists(CamelJavaDslMethodDecl methodDecl | this = methodDecl.getABean())
     or
     // Any beans referred to in Java DSL bean or beanRef elements are considered as possible
     // targets. Whether the route builder is ever constructed or called is not considered.
-    exists(CamelJavaDSLBeanDecl beanDecl | this = beanDecl.getABeanClass())
+    exists(CamelJavaDslBeanDecl beanDecl | this = beanDecl.getABeanClass())
     or
-    exists(CamelJavaDSLBeanRefDecl beanRefDecl | this = beanRefDecl.getABeanClass())
+    exists(CamelJavaDslBeanRefDecl beanRefDecl | this = beanRefDecl.getABeanClass())
   }
 
   /**
diff --git a/java/ql/lib/semmle/code/java/frameworks/GeneratedNegative.qll b/java/ql/lib/semmle/code/java/frameworks/GeneratedNegative.qll
new file mode 100644
index 00000000000..c12c6c3be16
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/frameworks/GeneratedNegative.qll
@@ -0,0 +1,8 @@
+/** Provides a module for importing negative models. */
+
+/**
+ * A module importing all generated negative Models as Data models.
+ */
+private module GeneratedFrameworks {
+  private import apache.NegativeIOGenerated
+}
diff --git a/java/ql/lib/semmle/code/java/frameworks/JAXB.qll b/java/ql/lib/semmle/code/java/frameworks/JAXB.qll
index a7ea3aba8aa..c9c9aee71b5 100644
--- a/java/ql/lib/semmle/code/java/frameworks/JAXB.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/JAXB.qll
@@ -2,20 +2,26 @@
 
 import semmle.code.java.Type
 
-library class JAXBElement extends Class {
-  JAXBElement() {
+library class JaxbElement extends Class {
+  JaxbElement() {
     this.getAnAncestor().getQualifiedName() = "javax.xml.bind.JAXBElement" or
     this.getAnAnnotation().getType().getName() = "XmlRootElement"
   }
 }
 
-library class JAXBMarshalMethod extends Method {
-  JAXBMarshalMethod() {
+/** DEPRECATED: Alias for JaxbElement */
+deprecated class JAXBElement = JaxbElement;
+
+library class JaxbMarshalMethod extends Method {
+  JaxbMarshalMethod() {
     this.getDeclaringType().getQualifiedName() = "javax.xml.bind.Marshaller" and
     this.getName() = "marshal"
   }
 }
 
+/** DEPRECATED: Alias for JaxbMarshalMethod */
+deprecated class JAXBMarshalMethod = JaxbMarshalMethod;
+
 class JaxbAnnotationType extends AnnotationType {
   JaxbAnnotationType() { this.getPackage().getName() = "javax.xml.bind.annotation" }
 }
@@ -54,7 +60,7 @@ class JaxbType extends Class {
       this.getAnAnnotation() = a and
       a.getType().(JaxbAnnotationType).hasName("XmlAccessorType")
     |
-      result.getAnAccess() = a.getValue("value")
+      result = a.getEnumConstantValue("value")
     )
   }
 
diff --git a/java/ql/lib/semmle/code/java/frameworks/JUnitAnnotations.qll b/java/ql/lib/semmle/code/java/frameworks/JUnitAnnotations.qll
index 8716f7d625c..d74fe683f06 100644
--- a/java/ql/lib/semmle/code/java/frameworks/JUnitAnnotations.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/JUnitAnnotations.qll
@@ -64,5 +64,5 @@ class RunWithAnnotation extends Annotation {
   /**
    * Gets the runner that will be used.
    */
-  Type getRunner() { result = this.getValue("value").(TypeLiteral).getReferencedType() }
+  Type getRunner() { result = this.getTypeValue("value") }
 }
diff --git a/java/ql/lib/semmle/code/java/frameworks/JaxWS.qll b/java/ql/lib/semmle/code/java/frameworks/JaxWS.qll
index ab83bab8049..c60c3ff0369 100644
--- a/java/ql/lib/semmle/code/java/frameworks/JaxWS.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/JaxWS.qll
@@ -296,11 +296,7 @@ class JaxRSProducesAnnotation extends JaxRSAnnotation {
   /**
    * Gets a declared content type that can be produced by this resource.
    */
-  Expr getADeclaredContentTypeExpr() {
-    result = this.getAValue() and not result instanceof ArrayInit
-    or
-    result = this.getAValue().(ArrayInit).getAnInit()
-  }
+  Expr getADeclaredContentTypeExpr() { result = this.getAnArrayValue("value") }
 }
 
 /** An `@Consumes` annotation that describes content types can be consumed by this resource. */
diff --git a/java/ql/lib/semmle/code/java/frameworks/KotlinStdLib.qll b/java/ql/lib/semmle/code/java/frameworks/KotlinStdLib.qll
deleted file mode 100644
index ebd6517d277..00000000000
--- a/java/ql/lib/semmle/code/java/frameworks/KotlinStdLib.qll
+++ /dev/null
@@ -1,11 +0,0 @@
-/** Definitions of taint steps in the KotlinStdLib framework */
-
-import java
-private import semmle.code.java.dataflow.ExternalFlow
-
-private class KotlinStdLibSummaryCsv extends SummaryModelCsv {
-  override predicate row(string row) {
-    row =
-      "kotlin.jvm.internal;ArrayIteratorKt;false;iterator;(Object[]);;Argument[0].ArrayElement;ReturnValue.Element;value;manual"
-  }
-}
diff --git a/java/ql/lib/semmle/code/java/frameworks/MyBatis.qll b/java/ql/lib/semmle/code/java/frameworks/MyBatis.qll
index 19744ca2c68..6c16bb168bb 100644
--- a/java/ql/lib/semmle/code/java/frameworks/MyBatis.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/MyBatis.qll
@@ -85,9 +85,7 @@ class IbatisSqlOperationAnnotation extends Annotation {
   /**
    * Gets this annotation's SQL statement string.
    */
-  string getSqlValue() {
-    result = this.getAValue("value").(CompileTimeConstantExpr).getStringValue()
-  }
+  string getSqlValue() { result = this.getAStringArrayValue("value") }
 }
 
 /**
diff --git a/java/ql/lib/semmle/code/java/frameworks/Strings.qll b/java/ql/lib/semmle/code/java/frameworks/Strings.qll
index 63c83d0157d..c09b959254d 100644
--- a/java/ql/lib/semmle/code/java/frameworks/Strings.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/Strings.qll
@@ -20,10 +20,17 @@ private class StringSummaryCsv extends SummaryModelCsv {
         "java.lang;String;false;formatted;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;manual",
         "java.lang;String;false;getChars;;;Argument[-1];Argument[2];taint;manual",
         "java.lang;String;false;getBytes;;;Argument[-1];ReturnValue;taint;manual",
+        "java.lang;String;false;getBytes;;;Argument[-1];Argument[2];taint;manual",
         "java.lang;String;false;indent;;;Argument[-1];ReturnValue;taint;manual",
         "java.lang;String;false;intern;;;Argument[-1];ReturnValue;taint;manual",
         "java.lang;String;false;join;;;Argument[0..1];ReturnValue;taint;manual",
         "java.lang;String;false;repeat;(int);;Argument[-1];ReturnValue;taint;manual",
+        "java.lang;String;false;replace;;;Argument[-1];ReturnValue;taint;manual",
+        "java.lang;String;false;replace;;;Argument[1];ReturnValue;taint;manual",
+        "java.lang;String;false;replaceAll;;;Argument[-1];ReturnValue;taint;manual",
+        "java.lang;String;false;replaceAll;;;Argument[1];ReturnValue;taint;manual",
+        "java.lang;String;false;replaceFirst;;;Argument[-1];ReturnValue;taint;manual",
+        "java.lang;String;false;replaceFirst;;;Argument[1];ReturnValue;taint;manual",
         "java.lang;String;false;split;;;Argument[-1];ReturnValue;taint;manual",
         "java.lang;String;false;String;;;Argument[0];Argument[-1];taint;manual",
         "java.lang;String;false;strip;;;Argument[-1];ReturnValue;taint;manual",
@@ -55,6 +62,7 @@ private class StringSummaryCsv extends SummaryModelCsv {
         "java.lang;StringBuffer;true;StringBuffer;(CharSequence);;Argument[0];Argument[-1];taint;manual",
         "java.lang;StringBuffer;true;StringBuffer;(String);;Argument[0];Argument[-1];taint;manual",
         "java.lang;StringBuilder;true;StringBuilder;;;Argument[0];Argument[-1];taint;manual",
+        "java.lang;CharSequence;true;charAt;;;Argument[-1];ReturnValue;taint;manual",
         "java.lang;CharSequence;true;subSequence;;;Argument[-1];ReturnValue;taint;manual",
         "java.lang;CharSequence;true;toString;;;Argument[-1];ReturnValue;taint;manual"
       ]
diff --git a/java/ql/lib/semmle/code/java/frameworks/Thymeleaf.qll b/java/ql/lib/semmle/code/java/frameworks/Thymeleaf.qll
new file mode 100644
index 00000000000..3c550d5441c
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/frameworks/Thymeleaf.qll
@@ -0,0 +1,16 @@
+/**
+ * Provides classes and predicates for working with the Thymeleaf template engine.
+ */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+
+private class ThymeleafSummaryModels extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual",
+        "org.thymeleaf;TemplateSpec;false;getTemplate;;;Argument[-1];ReturnValue;taint;manual",
+      ]
+  }
+}
diff --git a/java/ql/lib/semmle/code/java/frameworks/UnboundId.qll b/java/ql/lib/semmle/code/java/frameworks/UnboundId.qll
index dfa7fd6286a..e19a6b43019 100644
--- a/java/ql/lib/semmle/code/java/frameworks/UnboundId.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/UnboundId.qll
@@ -58,13 +58,16 @@ class MethodUnboundIdFilterCreate extends Method {
 }
 
 /** A method with the name `createANDFilter` declared in `com.unboundid.ldap.sdk.Filter`. */
-class MethodUnboundIdFilterCreateANDFilter extends Method {
-  MethodUnboundIdFilterCreateANDFilter() {
+class MethodUnboundIdFilterCreateAndFilter extends Method {
+  MethodUnboundIdFilterCreateAndFilter() {
     this.getDeclaringType() instanceof TypeUnboundIdLdapFilter and
     this.hasName("createANDFilter")
   }
 }
 
+/** DEPRECATED: Alias for MethodUnboundIdFilterCreateAndFilter */
+deprecated class MethodUnboundIdFilterCreateANDFilter = MethodUnboundIdFilterCreateAndFilter;
+
 /** A method with the name `createORFilter` declared in `com.unboundid.ldap.sdk.Filter`. */
 class MethodUnboundIdFilterCreateORFilter extends Method {
   MethodUnboundIdFilterCreateORFilter() {
@@ -73,9 +76,12 @@ class MethodUnboundIdFilterCreateORFilter extends Method {
   }
 }
 
+/** DEPRECATED: Alias for MethodUnboundIdFilterCreateNOTFilter */
+deprecated class MethodUnboundIdFilterCreateNOTFilter = MethodUnboundIdFilterCreateNotFilter;
+
 /** A method with the name `createNOTFilter` declared in `com.unboundid.ldap.sdk.Filter`. */
-class MethodUnboundIdFilterCreateNOTFilter extends Method {
-  MethodUnboundIdFilterCreateNOTFilter() {
+class MethodUnboundIdFilterCreateNotFilter extends Method {
+  MethodUnboundIdFilterCreateNotFilter() {
     this.getDeclaringType() instanceof TypeUnboundIdLdapFilter and
     this.hasName("createNOTFilter")
   }
diff --git a/java/ql/lib/semmle/code/java/frameworks/android/ContentProviders.qll b/java/ql/lib/semmle/code/java/frameworks/android/ContentProviders.qll
index 1724bb0ece9..1e10a01d451 100644
--- a/java/ql/lib/semmle/code/java/frameworks/android/ContentProviders.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/android/ContentProviders.qll
@@ -53,7 +53,64 @@ private class SummaryModels extends SummaryModelCsv {
         "android.content;ContentValues;false;put;;;Argument[0];Argument[-1].MapKey;value;manual",
         "android.content;ContentValues;false;put;;;Argument[1];Argument[-1].MapValue;value;manual",
         "android.content;ContentValues;false;putAll;;;Argument[0].MapKey;Argument[-1].MapKey;value;manual",
-        "android.content;ContentValues;false;putAll;;;Argument[0].MapValue;Argument[-1].MapValue;value;manual"
+        "android.content;ContentValues;false;putAll;;;Argument[0].MapValue;Argument[-1].MapValue;value;manual",
+        "android.content;ContentResolver;true;acquireContentProviderClient;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;acquireUnstableContentProviderClient;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;acquireUnstableContentProviderClient;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;applyBatch;;;Argument[1];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;call;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;canonicalize;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;getStreamTypes;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;getType;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;insert;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;query;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;uncanonicalize;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentResolver;true;wrap;;;Argument[0];ReturnValue;taint;manual",
+        // ContentProviderClient is tainted at its creation, not by its arguments
+        "android.content;ContentProviderClient;true;applyBatch;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderClient;true;call;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderClient;true;canonicalize;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderClient;true;getLocalContentProvider;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderClient;true;getStreamTypes;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderClient;true;insert;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderClient;true;query;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderClient;true;uncanonicalize;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;apply;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;apply;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;getUri;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;newAssertQuery;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;newCall;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;newDelete;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;newInsert;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;newUpdate;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;resolveExtrasBackReferences;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;resolveSelectionArgsBackReferences;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation;false;resolveValueBackReferences;;;Argument[0];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation$Builder;false;build;;;Argument[-1];ReturnValue;taint;manual",
+        "android.content;ContentProviderOperation$Builder;false;withExceptionAllowed;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderOperation$Builder;false;withExpectedCount;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderOperation$Builder;false;withExtra;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderOperation$Builder;false;withExtraBackReference;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderOperation$Builder;false;withExtras;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderOperation$Builder;false;withSelection;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderOperation$Builder;false;withSelectionBackReference;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderOperation$Builder;false;withValue;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderOperation$Builder;false;withValueBackReference;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderOperation$Builder;false;withValues;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderOperation$Builder;false;withYieldAllowed;;;Argument[-1];ReturnValue;value;manual",
+        "android.content;ContentProviderResult;false;ContentProviderResult;(Uri);;Argument[0];Argument[-1].Field[android.content.ContentProviderResult.uri];value;manual",
+        "android.content;ContentProviderResult;false;ContentProviderResult;(Bundle);;Argument[0];Argument[-1].Field[android.content.ContentProviderResult.extras];value;manual",
+        "android.content;ContentProviderResult;false;ContentProviderResult;(Throwable);;Argument[0];Argument[-1].Field[android.content.ContentProviderResult.exception];value;manual",
+        "android.content;ContentProviderResult;false;ContentProviderResult;(Parcel);;Argument[0];Argument[-1];taint;manual",
+        "android.database;Cursor;true;copyStringToBuffer;;;Argument[-1];Argument[1];taint;manual",
+        "android.database;Cursor;true;getBlob;;;Argument[-1];ReturnValue;taint;manual",
+        "android.database;Cursor;true;getColumnName;;;Argument[-1];ReturnValue;taint;manual",
+        "android.database;Cursor;true;getColumnNames;;;Argument[-1];ReturnValue;taint;manual",
+        "android.database;Cursor;true;getExtras;;;Argument[-1];ReturnValue;taint;manual",
+        "android.database;Cursor;true;getNotificationUri;;;Argument[-1];ReturnValue;taint;manual",
+        "android.database;Cursor;true;getNotificationUris;;;Argument[-1];ReturnValue;taint;manual",
+        "android.database;Cursor;true;getString;;;Argument[-1];ReturnValue;taint;manual",
+        "android.database;Cursor;true;respond;;;Argument[-1];ReturnValue;taint;manual"
       ]
   }
 }
diff --git a/java/ql/lib/semmle/code/java/frameworks/android/Notifications.qll b/java/ql/lib/semmle/code/java/frameworks/android/Notifications.qll
index f16af6dcf89..0f69f0bbe1d 100644
--- a/java/ql/lib/semmle/code/java/frameworks/android/Notifications.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/android/Notifications.qll
@@ -19,6 +19,17 @@ private class NotificationBuildersSummaryModels extends SummaryModelCsv {
         "android.app;Notification$Action$Builder;true;build;;;Argument[-1];ReturnValue;taint;manual",
         "android.app;Notification$Action$Builder;true;build;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue.SyntheticField[android.content.Intent.extras];value;manual",
         "android.app;Notification$Action$Builder;true;getExtras;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue;value;manual",
+        "androidx.core.app;NotificationCompat$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual",
+        "androidx.core.app;NotificationCompat$Action;true;Action;(IconCompat,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual",
+        "androidx.core.app;NotificationCompat$Action;true;getExtras;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue;value;manual",
+        "androidx.core.app;NotificationCompat$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual",
+        "androidx.core.app;NotificationCompat$Action$Builder;true;Builder;(IconCompat,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual",
+        "androidx.core.app;NotificationCompat$Action$Builder;true;Builder;(Action);;Argument[0];Argument[-1];taint;manual",
+        "androidx.core.app;NotificationCompat$Action$Builder;true;addExtras;;;Argument[0].MapKey;Argument[-1].SyntheticField[android.content.Intent.extras].MapKey;value;manual",
+        "androidx.core.app;NotificationCompat$Action$Builder;true;addExtras;;;Argument[0].MapValue;Argument[-1].SyntheticField[android.content.Intent.extras].MapValue;value;manual",
+        "androidx.core.app;NotificationCompat$Action$Builder;true;build;;;Argument[-1];ReturnValue;taint;manual",
+        "androidx.core.app;NotificationCompat$Action$Builder;true;build;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue.SyntheticField[android.content.Intent.extras];value;manual",
+        "androidx.core.app;NotificationCompat$Action$Builder;true;getExtras;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue;value;manual",
         "android.app;Notification$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual",
         "android.app;Notification$Builder;true;addAction;(Action);;Argument[0];Argument[-1];taint;manual",
         "android.app;Notification$Builder;true;addExtras;;;Argument[0].MapKey;Argument[-1].SyntheticField[android.content.Intent.extras].MapKey;value;manual",
@@ -32,18 +43,30 @@ private class NotificationBuildersSummaryModels extends SummaryModelCsv {
         "android.app;Notification$Builder;true;setExtras;;;Argument[0];Argument[-1].SyntheticField[android.content.Intent.extras];value;manual",
         "android.app;Notification$Builder;true;setDeleteIntent;;;Argument[0];Argument[-1];taint;manual",
         "android.app;Notification$Builder;true;setPublicVersion;;;Argument[0];Argument[-1];taint;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;addAction;(Action);;Argument[0];Argument[-1];taint;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;addExtras;;;Argument[0].MapKey;Argument[-1].SyntheticField[android.content.Intent.extras].MapKey;value;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;addExtras;;;Argument[0].MapValue;Argument[-1].SyntheticField[android.content.Intent.extras].MapValue;value;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;build;;;Argument[-1];ReturnValue;taint;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;build;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue.Field[android.app.Notification.extras];value;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;setContentIntent;;;Argument[0];Argument[-1];taint;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;getExtras;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue;value;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;setExtras;;;Argument[0];Argument[-1].SyntheticField[android.content.Intent.extras];value;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;setDeleteIntent;;;Argument[0];Argument[-1];taint;manual",
+        "androidx.core.app;NotificationCompat$Builder;true;setPublicVersion;;;Argument[0];Argument[-1];taint;manual",
         "android.app;Notification$Style;true;build;;;Argument[-1];ReturnValue;taint;manual",
         "android.app;Notification$BigPictureStyle;true;BigPictureStyle;(Builder);;Argument[0];Argument[-1];taint;manual",
         "android.app;Notification$BigTextStyle;true;BigTextStyle;(Builder);;Argument[0];Argument[-1];taint;manual",
         "android.app;Notification$InboxStyle;true;InboxStyle;(Builder);;Argument[0];Argument[-1];taint;manual",
         "android.app;Notification$MediaStyle;true;MediaStyle;(Builder);;Argument[0];Argument[-1];taint;manual",
         // Fluent models
-        "android.app;Notification$Action$Builder;true;" +
+        ["android.app;Notification", "androidx.core.app;NotificationCompat"] +
+          "$Action$Builder;true;" +
           [
             "addExtras", "addRemoteInput", "extend", "setAllowGeneratedReplies",
             "setAuthenticationRequired", "setContextual", "setSemanticAction"
           ] + ";;;Argument[-1];ReturnValue;value;manual",
-        "android.app;Notification$Builder;true;" +
+        ["android.app;Notification", "androidx.core.app;NotificationCompat"] + "$Builder;true;" +
           [
             "addAction", "addExtras", "addPerson", "extend", "setActions", "setAutoCancel",
             "setBadgeIconType", "setBubbleMetadata", "setCategory", "setChannelId",
@@ -58,15 +81,16 @@ private class NotificationBuildersSummaryModels extends SummaryModelCsv {
             "setSubText", "setTicker", "setTimeoutAfter", "setUsesChronometer", "setVibrate",
             "setVisibility", "setWhen"
           ] + ";;;Argument[-1];ReturnValue;value;manual",
-        "android.app;Notification$BigPictureStyle;true;" +
+        ["android.app;Notification", "androidx.core.app;NotificationCompat"] +
+          "$BigPictureStyle;true;" +
           [
             "bigLargeIcon", "bigPicture", "setBigContentTitle", "setContentDescription",
             "setSummaryText", "showBigPictureWhenCollapsed"
           ] + ";;;Argument[-1];ReturnValue;value;manual",
-        "android.app;Notification$BigTextStyle;true;" +
-          ["bigText", "setBigContentTitle", "setSummaryText"] +
+        ["android.app;Notification", "androidx.core.app;NotificationCompat"] + "$BigTextStyle;true;"
+          + ["bigText", "setBigContentTitle", "setSummaryText"] +
           ";;;Argument[-1];ReturnValue;value;manual",
-        "android.app;Notification$InboxStyle;true;" +
+        ["android.app;Notification", "androidx.core.app;NotificationCompat"] + "$InboxStyle;true;" +
           ["addLine", "setBigContentTitle", "setSummaryText"] +
           ";;;Argument[-1];ReturnValue;value;manual",
         "android.app;Notification$MediaStyle;true;" +
diff --git a/java/ql/lib/semmle/code/java/frameworks/apache/IOGenerated.qll b/java/ql/lib/semmle/code/java/frameworks/apache/IOGenerated.qll
index 592473a88a1..931764d56d8 100644
--- a/java/ql/lib/semmle/code/java/frameworks/apache/IOGenerated.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/apache/IOGenerated.qll
@@ -13,7 +13,9 @@ private class IOGeneratedSinksCsv extends SinkModelCsv {
         "org.apache.commons.io.file;PathFilter;true;accept;(Path,BasicFileAttributes);;Argument[0];create-file;generated",
         "org.apache.commons.io.file;PathUtils;false;copyFile;(URL,Path,CopyOption[]);;Argument[0];open-url;generated",
         "org.apache.commons.io.file;PathUtils;false;copyFile;(URL,Path,CopyOption[]);;Argument[1];create-file;generated",
+        "org.apache.commons.io.file;PathUtils;false;copyFileToDirectory;(Path,Path,CopyOption[]);;Argument[1];create-file;generated",
         "org.apache.commons.io.file;PathUtils;false;copyFileToDirectory;(URL,Path,CopyOption[]);;Argument[0];open-url;generated",
+        "org.apache.commons.io.file;PathUtils;false;copyFileToDirectory;(URL,Path,CopyOption[]);;Argument[1];create-file;generated",
         "org.apache.commons.io.file;PathUtils;false;newOutputStream;(Path,boolean);;Argument[0];create-file;generated",
         "org.apache.commons.io.file;PathUtils;false;writeString;(Path,CharSequence,Charset,OpenOption[]);;Argument[0];create-file;generated",
         "org.apache.commons.io.filefilter;FileFilterUtils;true;filter;(IOFileFilter,File[]);;Argument[1];create-file;generated",
@@ -631,14 +633,10 @@ private class IOGeneratedSummaryCsv extends SummaryModelCsv {
         "org.apache.commons.io;IOUtils;true;readLines;(InputStream,Charset);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;readLines;(InputStream,String);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;readLines;(Reader);;Argument[0];ReturnValue;taint;generated",
-        "org.apache.commons.io;IOUtils;true;toBufferedInputStream;(InputStream);;Argument[0];ReturnValue;taint;generated",
-        "org.apache.commons.io;IOUtils;true;toBufferedInputStream;(InputStream,int);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toBufferedReader;(Reader);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toBufferedReader;(Reader,int);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toByteArray;(InputStream,int);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toByteArray;(InputStream,long);;Argument[0];ReturnValue;taint;generated",
-        "org.apache.commons.io;IOUtils;true;toByteArray;(Reader);;Argument[0];ReturnValue;taint;generated",
-        "org.apache.commons.io;IOUtils;true;toByteArray;(Reader,String);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toByteArray;(String);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toCharArray;(InputStream);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toCharArray;(InputStream,Charset);;Argument[0];ReturnValue;taint;generated",
@@ -669,7 +667,6 @@ private class IOGeneratedSummaryCsv extends SummaryModelCsv {
         "org.apache.commons.io;IOUtils;true;writeLines;(Collection,String,OutputStream);;Argument[1];Argument[2];taint;generated",
         "org.apache.commons.io;IOUtils;true;writeLines;(Collection,String,OutputStream,Charset);;Argument[1];Argument[2];taint;generated",
         "org.apache.commons.io;IOUtils;true;writeLines;(Collection,String,OutputStream,String);;Argument[1];Argument[2];taint;generated",
-        "org.apache.commons.io;IOUtils;true;writeLines;(Collection,String,Writer);;Argument[0].Element;Argument[2];taint;generated",
         "org.apache.commons.io;IOUtils;true;writeLines;(Collection,String,Writer);;Argument[1];Argument[2];taint;generated",
         "org.apache.commons.io;IOUtils;true;writer;(Appendable);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;LineIterator;true;LineIterator;(Reader);;Argument[0];Argument[-1];taint;generated",
diff --git a/java/ql/lib/semmle/code/java/frameworks/apache/NegativeIOGenerated.qll b/java/ql/lib/semmle/code/java/frameworks/apache/NegativeIOGenerated.qll
new file mode 100644
index 00000000000..4a9a6394aaf
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/frameworks/apache/NegativeIOGenerated.qll
@@ -0,0 +1,769 @@
+/**
+ * THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+ * Definitions of negative summaries in the IOGenerated framework.
+ */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+
+private class IOGeneratedNegativesummaryCsv extends NegativeSummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "org.apache.commons.io.charset;CharsetDecoders;CharsetDecoders;();generated",
+        "org.apache.commons.io.charset;CharsetEncoders;CharsetEncoders;();generated",
+        "org.apache.commons.io.comparator;DefaultFileComparator;DefaultFileComparator;();generated",
+        "org.apache.commons.io.comparator;DirectoryFileComparator;DirectoryFileComparator;();generated",
+        "org.apache.commons.io.comparator;ExtensionFileComparator;ExtensionFileComparator;();generated",
+        "org.apache.commons.io.comparator;ExtensionFileComparator;ExtensionFileComparator;(IOCase);generated",
+        "org.apache.commons.io.comparator;ExtensionFileComparator;toString;();generated",
+        "org.apache.commons.io.comparator;LastModifiedFileComparator;LastModifiedFileComparator;();generated",
+        "org.apache.commons.io.comparator;NameFileComparator;NameFileComparator;();generated",
+        "org.apache.commons.io.comparator;NameFileComparator;NameFileComparator;(IOCase);generated",
+        "org.apache.commons.io.comparator;NameFileComparator;toString;();generated",
+        "org.apache.commons.io.comparator;PathFileComparator;PathFileComparator;();generated",
+        "org.apache.commons.io.comparator;PathFileComparator;PathFileComparator;(IOCase);generated",
+        "org.apache.commons.io.comparator;PathFileComparator;toString;();generated",
+        "org.apache.commons.io.comparator;SizeFileComparator;SizeFileComparator;();generated",
+        "org.apache.commons.io.comparator;SizeFileComparator;SizeFileComparator;(boolean);generated",
+        "org.apache.commons.io.comparator;SizeFileComparator;toString;();generated",
+        "org.apache.commons.io.file.attribute;FileTimes;minusMillis;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;minusNanos;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;minusSeconds;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;now;();generated",
+        "org.apache.commons.io.file.attribute;FileTimes;ntfsTimeToDate;(long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;ntfsTimeToFileTime;(long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;plusMillis;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;plusNanos;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;plusSeconds;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;setLastModifiedTime;(Path);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;toDate;(FileTime);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;toFileTime;(Date);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;toNtfsTime;(Date);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;toNtfsTime;(FileTime);generated",
+        "org.apache.commons.io.file.spi;FileSystemProviders;getFileSystemProvider;(Path);generated",
+        "org.apache.commons.io.file.spi;FileSystemProviders;installed;();generated",
+        "org.apache.commons.io.file;AccumulatorPathVisitor;AccumulatorPathVisitor;();generated",
+        "org.apache.commons.io.file;AccumulatorPathVisitor;relativizeDirectories;(Path,boolean,Comparator);generated",
+        "org.apache.commons.io.file;AccumulatorPathVisitor;relativizeFiles;(Path,boolean,Comparator);generated",
+        "org.apache.commons.io.file;AccumulatorPathVisitor;withBigIntegerCounters;();generated",
+        "org.apache.commons.io.file;AccumulatorPathVisitor;withLongCounters;();generated",
+        "org.apache.commons.io.file;CleaningPathVisitor;withBigIntegerCounters;();generated",
+        "org.apache.commons.io.file;CleaningPathVisitor;withLongCounters;();generated",
+        "org.apache.commons.io.file;Counters$Counter;add;(long);generated",
+        "org.apache.commons.io.file;Counters$Counter;get;();generated",
+        "org.apache.commons.io.file;Counters$Counter;getBigInteger;();generated",
+        "org.apache.commons.io.file;Counters$Counter;getLong;();generated",
+        "org.apache.commons.io.file;Counters$Counter;increment;();generated",
+        "org.apache.commons.io.file;Counters$Counter;reset;();generated",
+        "org.apache.commons.io.file;Counters$PathCounters;getByteCounter;();generated",
+        "org.apache.commons.io.file;Counters$PathCounters;getDirectoryCounter;();generated",
+        "org.apache.commons.io.file;Counters$PathCounters;getFileCounter;();generated",
+        "org.apache.commons.io.file;Counters$PathCounters;reset;();generated",
+        "org.apache.commons.io.file;Counters;Counters;();generated",
+        "org.apache.commons.io.file;Counters;bigIntegerCounter;();generated",
+        "org.apache.commons.io.file;Counters;bigIntegerPathCounters;();generated",
+        "org.apache.commons.io.file;Counters;longCounter;();generated",
+        "org.apache.commons.io.file;Counters;longPathCounters;();generated",
+        "org.apache.commons.io.file;Counters;noopCounter;();generated",
+        "org.apache.commons.io.file;Counters;noopPathCounters;();generated",
+        "org.apache.commons.io.file;CountingPathVisitor;toString;();generated",
+        "org.apache.commons.io.file;CountingPathVisitor;withBigIntegerCounters;();generated",
+        "org.apache.commons.io.file;CountingPathVisitor;withLongCounters;();generated",
+        "org.apache.commons.io.file;DeletingPathVisitor;withBigIntegerCounters;();generated",
+        "org.apache.commons.io.file;DeletingPathVisitor;withLongCounters;();generated",
+        "org.apache.commons.io.file;NoopPathVisitor;NoopPathVisitor;();generated",
+        "org.apache.commons.io.file;PathFilter;accept;(Path,BasicFileAttributes);generated",
+        "org.apache.commons.io.file;PathUtils;cleanDirectory;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;cleanDirectory;(Path,DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;copyDirectory;(Path,Path,CopyOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;copyFileToDirectory;(Path,Path,CopyOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;countDirectory;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;countDirectoryAsBigInteger;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;createParentDirectories;(Path,FileAttribute[]);generated",
+        "org.apache.commons.io.file;PathUtils;createParentDirectories;(Path,LinkOption,FileAttribute[]);generated",
+        "org.apache.commons.io.file;PathUtils;current;();generated",
+        "org.apache.commons.io.file;PathUtils;delete;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;delete;(Path,DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;delete;(Path,LinkOption[],DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;deleteDirectory;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;deleteDirectory;(Path,DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;deleteDirectory;(Path,LinkOption[],DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;deleteFile;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;deleteFile;(Path,DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;deleteFile;(Path,LinkOption[],DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;directoryAndFileContentEquals;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;directoryAndFileContentEquals;(Path,Path,LinkOption[],OpenOption[],FileVisitOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;directoryContentEquals;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;directoryContentEquals;(Path,Path,int,LinkOption[],FileVisitOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;fileContentEquals;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;fileContentEquals;(Path,Path,LinkOption[],OpenOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;filter;(PathFilter,Path[]);generated",
+        "org.apache.commons.io.file;PathUtils;getAclEntryList;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;getAclFileAttributeView;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;getDosFileAttributeView;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;getPosixFileAttributeView;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;getTempDirectory;();generated",
+        "org.apache.commons.io.file;PathUtils;isDirectory;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isEmpty;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;isEmptyDirectory;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;isEmptyFile;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;isNewer;(Path,ChronoZonedDateTime,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isNewer;(Path,FileTime,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isNewer;(Path,Instant,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isNewer;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;isNewer;(Path,long,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isOlder;(Path,FileTime,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isOlder;(Path,Instant,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isOlder;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;isOlder;(Path,long,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isPosix;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isRegularFile;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;newDirectoryStream;(Path,PathFilter);generated",
+        "org.apache.commons.io.file;PathUtils;newOutputStream;(Path,boolean);generated",
+        "org.apache.commons.io.file;PathUtils;noFollowLinkOptionArray;();generated",
+        "org.apache.commons.io.file;PathUtils;readAttributes;(Path,Class,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;readBasicFileAttributes;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;readBasicFileAttributes;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;readBasicFileAttributesUnchecked;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;readDosFileAttributes;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;readOsFileAttributes;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;readPosixFileAttributes;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;readString;(Path,Charset);generated",
+        "org.apache.commons.io.file;PathUtils;setLastModifiedTime;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;sizeOf;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;sizeOfAsBigInteger;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;sizeOfDirectory;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;sizeOfDirectoryAsBigInteger;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;waitFor;(Path,Duration,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;walk;(Path,PathFilter,int,boolean,FileVisitOption[]);generated",
+        "org.apache.commons.io.file;StandardDeleteOption;overrideReadOnly;(DeleteOption[]);generated",
+        "org.apache.commons.io.filefilter;AbstractFileFilter;AbstractFileFilter;();generated",
+        "org.apache.commons.io.filefilter;AbstractFileFilter;toString;();generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(Date);generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(Date,boolean);generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(File);generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(File,boolean);generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(long);generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(long,boolean);generated",
+        "org.apache.commons.io.filefilter;AndFileFilter;AndFileFilter;();generated",
+        "org.apache.commons.io.filefilter;ConditionalFileFilter;addFileFilter;(IOFileFilter);generated",
+        "org.apache.commons.io.filefilter;ConditionalFileFilter;getFileFilters;();generated",
+        "org.apache.commons.io.filefilter;ConditionalFileFilter;removeFileFilter;(IOFileFilter);generated",
+        "org.apache.commons.io.filefilter;ConditionalFileFilter;setFileFilters;(List);generated",
+        "org.apache.commons.io.filefilter;FalseFileFilter;toString;();generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;FileFilterUtils;();generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(Date);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(Date,boolean);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(File);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(File,boolean);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(long);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(long,boolean);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;directoryFileFilter;();generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;falseFileFilter;();generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;fileFileFilter;();generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filter;(IOFileFilter,File[]);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filter;(IOFileFilter,Iterable);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filterList;(IOFileFilter,File[]);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filterList;(IOFileFilter,Iterable);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filterSet;(IOFileFilter,File[]);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filterSet;(IOFileFilter,Iterable);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;sizeFileFilter;(long);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;sizeFileFilter;(long,boolean);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;sizeRangeFileFilter;(long,long);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;trueFileFilter;();generated",
+        "org.apache.commons.io.filefilter;IOFileFilter;and;(IOFileFilter);generated",
+        "org.apache.commons.io.filefilter;IOFileFilter;negate;();generated",
+        "org.apache.commons.io.filefilter;IOFileFilter;or;(IOFileFilter);generated",
+        "org.apache.commons.io.filefilter;OrFileFilter;OrFileFilter;();generated",
+        "org.apache.commons.io.filefilter;RegexFileFilter;RegexFileFilter;(String);generated",
+        "org.apache.commons.io.filefilter;RegexFileFilter;RegexFileFilter;(String,IOCase);generated",
+        "org.apache.commons.io.filefilter;RegexFileFilter;RegexFileFilter;(String,int);generated",
+        "org.apache.commons.io.filefilter;SizeFileFilter;SizeFileFilter;(long);generated",
+        "org.apache.commons.io.filefilter;SizeFileFilter;SizeFileFilter;(long,boolean);generated",
+        "org.apache.commons.io.filefilter;SizeFileFilter;toString;();generated",
+        "org.apache.commons.io.filefilter;SymbolicLinkFileFilter;SymbolicLinkFileFilter;(FileVisitResult,FileVisitResult);generated",
+        "org.apache.commons.io.filefilter;TrueFileFilter;toString;();generated",
+        "org.apache.commons.io.function;IOBiConsumer;accept;(Object,Object);generated",
+        "org.apache.commons.io.function;IOBiConsumer;andThen;(IOBiConsumer);generated",
+        "org.apache.commons.io.function;IOBiFunction;andThen;(Function);generated",
+        "org.apache.commons.io.function;IOBiFunction;andThen;(IOFunction);generated",
+        "org.apache.commons.io.function;IOBiFunction;apply;(Object,Object);generated",
+        "org.apache.commons.io.function;IOConsumer;accept;(Object);generated",
+        "org.apache.commons.io.function;IOConsumer;andThen;(IOConsumer);generated",
+        "org.apache.commons.io.function;IOConsumer;forEach;(Object[],IOConsumer);generated",
+        "org.apache.commons.io.function;IOConsumer;forEachIndexed;(Stream,IOConsumer);generated",
+        "org.apache.commons.io.function;IOConsumer;noop;();generated",
+        "org.apache.commons.io.function;IOFunction;andThen;(Consumer);generated",
+        "org.apache.commons.io.function;IOFunction;andThen;(Function);generated",
+        "org.apache.commons.io.function;IOFunction;andThen;(IOConsumer);generated",
+        "org.apache.commons.io.function;IOFunction;andThen;(IOFunction);generated",
+        "org.apache.commons.io.function;IOFunction;apply;(Object);generated",
+        "org.apache.commons.io.function;IOFunction;compose;(Function);generated",
+        "org.apache.commons.io.function;IOFunction;compose;(IOFunction);generated",
+        "org.apache.commons.io.function;IOFunction;compose;(IOSupplier);generated",
+        "org.apache.commons.io.function;IOFunction;compose;(Supplier);generated",
+        "org.apache.commons.io.function;IOFunction;identity;();generated",
+        "org.apache.commons.io.function;IORunnable;run;();generated",
+        "org.apache.commons.io.function;IOSupplier;get;();generated",
+        "org.apache.commons.io.function;IOTriFunction;andThen;(Function);generated",
+        "org.apache.commons.io.function;IOTriFunction;andThen;(IOFunction);generated",
+        "org.apache.commons.io.function;IOTriFunction;apply;(Object,Object,Object);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;CircularByteBuffer;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;CircularByteBuffer;(int);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;add;(byte);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;add;(byte[],int,int);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;clear;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;getCurrentNumberOfBytes;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;getSpace;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;hasBytes;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;hasSpace;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;hasSpace;(int);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;peek;(byte[],int,int);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;read;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;read;(byte[],int,int);generated",
+        "org.apache.commons.io.input.buffer;PeekableInputStream;peek;(byte[]);generated",
+        "org.apache.commons.io.input.buffer;PeekableInputStream;peek;(byte[],int,int);generated",
+        "org.apache.commons.io.input;AutoCloseInputStream;AutoCloseInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;BOMInputStream;BOMInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;BOMInputStream;BOMInputStream;(InputStream,boolean);generated",
+        "org.apache.commons.io.input;BOMInputStream;hasBOM;();generated",
+        "org.apache.commons.io.input;BOMInputStream;hasBOM;(ByteOrderMark);generated",
+        "org.apache.commons.io.input;BoundedInputStream;isPropagateClose;();generated",
+        "org.apache.commons.io.input;BoundedInputStream;setPropagateClose;(boolean);generated",
+        "org.apache.commons.io.input;BoundedInputStream;toString;();generated",
+        "org.apache.commons.io.input;BrokenInputStream;BrokenInputStream;();generated",
+        "org.apache.commons.io.input;BrokenInputStream;BrokenInputStream;(IOException);generated",
+        "org.apache.commons.io.input;BrokenReader;BrokenReader;();generated",
+        "org.apache.commons.io.input;BrokenReader;BrokenReader;(IOException);generated",
+        "org.apache.commons.io.input;BufferedFileChannelInputStream;BufferedFileChannelInputStream;(File);generated",
+        "org.apache.commons.io.input;BufferedFileChannelInputStream;BufferedFileChannelInputStream;(File,int);generated",
+        "org.apache.commons.io.input;BufferedFileChannelInputStream;BufferedFileChannelInputStream;(Path);generated",
+        "org.apache.commons.io.input;BufferedFileChannelInputStream;BufferedFileChannelInputStream;(Path,int);generated",
+        "org.apache.commons.io.input;CharSequenceInputStream;CharSequenceInputStream;(CharSequence,Charset);generated",
+        "org.apache.commons.io.input;CharSequenceInputStream;CharSequenceInputStream;(CharSequence,Charset,int);generated",
+        "org.apache.commons.io.input;CharSequenceInputStream;CharSequenceInputStream;(CharSequence,String);generated",
+        "org.apache.commons.io.input;CharSequenceInputStream;CharSequenceInputStream;(CharSequence,String,int);generated",
+        "org.apache.commons.io.input;CharacterFilterReader;CharacterFilterReader;(Reader,int);generated",
+        "org.apache.commons.io.input;CharacterSetFilterReader;CharacterSetFilterReader;(Reader,Integer[]);generated",
+        "org.apache.commons.io.input;CharacterSetFilterReader;CharacterSetFilterReader;(Reader,Set);generated",
+        "org.apache.commons.io.input;CloseShieldInputStream;CloseShieldInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;CloseShieldReader;CloseShieldReader;(Reader);generated",
+        "org.apache.commons.io.input;CloseShieldReader;wrap;(Reader);generated",
+        "org.apache.commons.io.input;ClosedInputStream;ClosedInputStream;();generated",
+        "org.apache.commons.io.input;ClosedReader;ClosedReader;();generated",
+        "org.apache.commons.io.input;CountingInputStream;CountingInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;CountingInputStream;getByteCount;();generated",
+        "org.apache.commons.io.input;CountingInputStream;getCount;();generated",
+        "org.apache.commons.io.input;CountingInputStream;resetByteCount;();generated",
+        "org.apache.commons.io.input;CountingInputStream;resetCount;();generated",
+        "org.apache.commons.io.input;DemuxInputStream;DemuxInputStream;();generated",
+        "org.apache.commons.io.input;DemuxInputStream;bindStream;(InputStream);generated",
+        "org.apache.commons.io.input;MarkShieldInputStream;MarkShieldInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;MemoryMappedFileInputStream;MemoryMappedFileInputStream;(Path);generated",
+        "org.apache.commons.io.input;MemoryMappedFileInputStream;MemoryMappedFileInputStream;(Path,int);generated",
+        "org.apache.commons.io.input;MessageDigestCalculatingInputStream;MessageDigestCalculatingInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;MessageDigestCalculatingInputStream;MessageDigestCalculatingInputStream;(InputStream,String);generated",
+        "org.apache.commons.io.input;NullInputStream;NullInputStream;();generated",
+        "org.apache.commons.io.input;NullInputStream;NullInputStream;(long);generated",
+        "org.apache.commons.io.input;NullInputStream;NullInputStream;(long,boolean,boolean);generated",
+        "org.apache.commons.io.input;NullInputStream;getPosition;();generated",
+        "org.apache.commons.io.input;NullInputStream;getSize;();generated",
+        "org.apache.commons.io.input;NullReader;NullReader;();generated",
+        "org.apache.commons.io.input;NullReader;NullReader;(long);generated",
+        "org.apache.commons.io.input;NullReader;NullReader;(long,boolean,boolean);generated",
+        "org.apache.commons.io.input;NullReader;getPosition;();generated",
+        "org.apache.commons.io.input;NullReader;getSize;();generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;Observer;();generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;closed;();generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;data;(byte[],int,int);generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;data;(int);generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;error;(IOException);generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;finished;();generated",
+        "org.apache.commons.io.input;ObservableInputStream;ObservableInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;ObservableInputStream;consume;();generated",
+        "org.apache.commons.io.input;ObservableInputStream;remove;(Observer);generated",
+        "org.apache.commons.io.input;ObservableInputStream;removeAllObservers;();generated",
+        "org.apache.commons.io.input;ProxyInputStream;ProxyInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;ProxyReader;ProxyReader;(Reader);generated",
+        "org.apache.commons.io.input;QueueInputStream;QueueInputStream;();generated",
+        "org.apache.commons.io.input;QueueInputStream;QueueInputStream;(BlockingQueue);generated",
+        "org.apache.commons.io.input;QueueInputStream;newQueueOutputStream;();generated",
+        "org.apache.commons.io.input;RandomAccessFileInputStream;availableLong;();generated",
+        "org.apache.commons.io.input;RandomAccessFileInputStream;isCloseOnClose;();generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(File);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(File,Charset);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(File,int,Charset);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(File,int,String);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(Path,Charset);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(Path,int,Charset);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(Path,int,String);generated",
+        "org.apache.commons.io.input;SwappedDataInputStream;SwappedDataInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;TaggedInputStream;TaggedInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;TaggedInputStream;isCauseOf;(Throwable);generated",
+        "org.apache.commons.io.input;TaggedInputStream;throwIfCauseOf;(Throwable);generated",
+        "org.apache.commons.io.input;TaggedReader;TaggedReader;(Reader);generated",
+        "org.apache.commons.io.input;TaggedReader;isCauseOf;(Throwable);generated",
+        "org.apache.commons.io.input;TaggedReader;throwIfCauseOf;(Throwable);generated",
+        "org.apache.commons.io.input;Tailer$RandomAccessResourceBridge;getPointer;();generated",
+        "org.apache.commons.io.input;Tailer$RandomAccessResourceBridge;read;(byte[]);generated",
+        "org.apache.commons.io.input;Tailer$RandomAccessResourceBridge;seek;(long);generated",
+        "org.apache.commons.io.input;Tailer$Tailable;getRandomAccess;(String);generated",
+        "org.apache.commons.io.input;Tailer$Tailable;isNewer;(FileTime);generated",
+        "org.apache.commons.io.input;Tailer$Tailable;lastModifiedFileTime;();generated",
+        "org.apache.commons.io.input;Tailer$Tailable;size;();generated",
+        "org.apache.commons.io.input;Tailer;getDelay;();generated",
+        "org.apache.commons.io.input;Tailer;stop;();generated",
+        "org.apache.commons.io.input;TailerListener;fileNotFound;();generated",
+        "org.apache.commons.io.input;TailerListener;fileRotated;();generated",
+        "org.apache.commons.io.input;TailerListener;handle;(Exception);generated",
+        "org.apache.commons.io.input;TailerListener;handle;(String);generated",
+        "org.apache.commons.io.input;TailerListener;init;(Tailer);generated",
+        "org.apache.commons.io.input;TailerListenerAdapter;TailerListenerAdapter;();generated",
+        "org.apache.commons.io.input;TailerListenerAdapter;endOfFileReached;();generated",
+        "org.apache.commons.io.input;TimestampedObserver;TimestampedObserver;();generated",
+        "org.apache.commons.io.input;TimestampedObserver;getOpenToCloseDuration;();generated",
+        "org.apache.commons.io.input;TimestampedObserver;getOpenToNowDuration;();generated",
+        "org.apache.commons.io.input;UncheckedFilterInputStream;UncheckedFilterInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;UncheckedFilterReader;UncheckedFilterReader;(Reader);generated",
+        "org.apache.commons.io.input;UncheckedFilterReader;on;(Reader);generated",
+        "org.apache.commons.io.input;XmlStreamReader;XmlStreamReader;(File);generated",
+        "org.apache.commons.io.input;XmlStreamReader;XmlStreamReader;(Path);generated",
+        "org.apache.commons.io.input;XmlStreamReader;XmlStreamReader;(URL);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onDirectoryChange;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onDirectoryCreate;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onDirectoryDelete;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onFileChange;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onFileCreate;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onFileDelete;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onStart;(FileAlterationObserver);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onStop;(FileAlterationObserver);generated",
+        "org.apache.commons.io.monitor;FileAlterationListenerAdaptor;FileAlterationListenerAdaptor;();generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;FileAlterationMonitor;();generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;FileAlterationMonitor;(long);generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;getInterval;();generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;removeObserver;(FileAlterationObserver);generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;start;();generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;stop;();generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;stop;(long);generated",
+        "org.apache.commons.io.monitor;FileAlterationObserver;checkAndNotify;();generated",
+        "org.apache.commons.io.monitor;FileAlterationObserver;destroy;();generated",
+        "org.apache.commons.io.monitor;FileAlterationObserver;initialize;();generated",
+        "org.apache.commons.io.monitor;FileAlterationObserver;removeListener;(FileAlterationListener);generated",
+        "org.apache.commons.io.monitor;FileEntry;getLastModified;();generated",
+        "org.apache.commons.io.monitor;FileEntry;getLength;();generated",
+        "org.apache.commons.io.monitor;FileEntry;getLevel;();generated",
+        "org.apache.commons.io.monitor;FileEntry;isDirectory;();generated",
+        "org.apache.commons.io.monitor;FileEntry;isExists;();generated",
+        "org.apache.commons.io.monitor;FileEntry;refresh;(File);generated",
+        "org.apache.commons.io.monitor;FileEntry;setDirectory;(boolean);generated",
+        "org.apache.commons.io.monitor;FileEntry;setExists;(boolean);generated",
+        "org.apache.commons.io.monitor;FileEntry;setLastModified;(long);generated",
+        "org.apache.commons.io.monitor;FileEntry;setLength;(long);generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;AbstractByteArrayOutputStream;();generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;reset;();generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;size;();generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;toByteArray;();generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;toInputStream;();generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;write;(InputStream);generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;writeTo;(OutputStream);generated",
+        "org.apache.commons.io.output;BrokenOutputStream;BrokenOutputStream;();generated",
+        "org.apache.commons.io.output;BrokenOutputStream;BrokenOutputStream;(IOException);generated",
+        "org.apache.commons.io.output;BrokenWriter;BrokenWriter;();generated",
+        "org.apache.commons.io.output;BrokenWriter;BrokenWriter;(IOException);generated",
+        "org.apache.commons.io.output;ByteArrayOutputStream;ByteArrayOutputStream;();generated",
+        "org.apache.commons.io.output;ByteArrayOutputStream;ByteArrayOutputStream;(int);generated",
+        "org.apache.commons.io.output;ByteArrayOutputStream;toBufferedInputStream;(InputStream);generated",
+        "org.apache.commons.io.output;ByteArrayOutputStream;toBufferedInputStream;(InputStream,int);generated",
+        "org.apache.commons.io.output;ChunkedWriter;ChunkedWriter;(Writer);generated",
+        "org.apache.commons.io.output;ChunkedWriter;ChunkedWriter;(Writer,int);generated",
+        "org.apache.commons.io.output;CloseShieldWriter;CloseShieldWriter;(Writer);generated",
+        "org.apache.commons.io.output;CloseShieldWriter;wrap;(Writer);generated",
+        "org.apache.commons.io.output;ClosedOutputStream;ClosedOutputStream;();generated",
+        "org.apache.commons.io.output;ClosedWriter;ClosedWriter;();generated",
+        "org.apache.commons.io.output;CountingOutputStream;getByteCount;();generated",
+        "org.apache.commons.io.output;CountingOutputStream;getCount;();generated",
+        "org.apache.commons.io.output;CountingOutputStream;resetByteCount;();generated",
+        "org.apache.commons.io.output;CountingOutputStream;resetCount;();generated",
+        "org.apache.commons.io.output;DeferredFileOutputStream;isInMemory;();generated",
+        "org.apache.commons.io.output;DeferredFileOutputStream;toInputStream;();generated",
+        "org.apache.commons.io.output;DemuxOutputStream;DemuxOutputStream;();generated",
+        "org.apache.commons.io.output;DemuxOutputStream;bindStream;(OutputStream);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,Charset);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,Charset,boolean);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,CharsetEncoder);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,CharsetEncoder,boolean);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,String);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,String,boolean);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,Charset);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,Charset,boolean);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,CharsetEncoder);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,CharsetEncoder,boolean);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,String);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,String,boolean);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(File);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(File,Charset);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(File,String);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(File,boolean);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(String);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(String,boolean);generated",
+        "org.apache.commons.io.output;NullOutputStream;NullOutputStream;();generated",
+        "org.apache.commons.io.output;NullPrintStream;NullPrintStream;();generated",
+        "org.apache.commons.io.output;NullWriter;NullWriter;();generated",
+        "org.apache.commons.io.output;ProxyWriter;ProxyWriter;(Writer);generated",
+        "org.apache.commons.io.output;QueueOutputStream;QueueOutputStream;();generated",
+        "org.apache.commons.io.output;QueueOutputStream;QueueOutputStream;(BlockingQueue);generated",
+        "org.apache.commons.io.output;QueueOutputStream;newQueueInputStream;();generated",
+        "org.apache.commons.io.output;StringBuilderWriter;StringBuilderWriter;();generated",
+        "org.apache.commons.io.output;StringBuilderWriter;StringBuilderWriter;(int);generated",
+        "org.apache.commons.io.output;TaggedOutputStream;isCauseOf;(Exception);generated",
+        "org.apache.commons.io.output;TaggedOutputStream;throwIfCauseOf;(Exception);generated",
+        "org.apache.commons.io.output;TaggedWriter;TaggedWriter;(Writer);generated",
+        "org.apache.commons.io.output;TaggedWriter;isCauseOf;(Exception);generated",
+        "org.apache.commons.io.output;TaggedWriter;throwIfCauseOf;(Exception);generated",
+        "org.apache.commons.io.output;ThresholdingOutputStream;ThresholdingOutputStream;(int);generated",
+        "org.apache.commons.io.output;ThresholdingOutputStream;getByteCount;();generated",
+        "org.apache.commons.io.output;ThresholdingOutputStream;getThreshold;();generated",
+        "org.apache.commons.io.output;ThresholdingOutputStream;isThresholdExceeded;();generated",
+        "org.apache.commons.io.output;UncheckedFilterWriter;on;(Writer);generated",
+        "org.apache.commons.io.output;UnsynchronizedByteArrayOutputStream;UnsynchronizedByteArrayOutputStream;();generated",
+        "org.apache.commons.io.output;UnsynchronizedByteArrayOutputStream;UnsynchronizedByteArrayOutputStream;(int);generated",
+        "org.apache.commons.io.output;UnsynchronizedByteArrayOutputStream;toBufferedInputStream;(InputStream);generated",
+        "org.apache.commons.io.output;UnsynchronizedByteArrayOutputStream;toBufferedInputStream;(InputStream,int);generated",
+        "org.apache.commons.io.output;XmlStreamWriter;XmlStreamWriter;(File);generated",
+        "org.apache.commons.io.serialization;ClassNameMatcher;matches;(String);generated",
+        "org.apache.commons.io;ByteOrderMark;get;(int);generated",
+        "org.apache.commons.io;ByteOrderMark;getBytes;();generated",
+        "org.apache.commons.io;ByteOrderMark;length;();generated",
+        "org.apache.commons.io;ByteOrderParser;parseByteOrder;(String);generated",
+        "org.apache.commons.io;Charsets;Charsets;();generated",
+        "org.apache.commons.io;Charsets;requiredCharsets;();generated",
+        "org.apache.commons.io;Charsets;toCharset;(Charset);generated",
+        "org.apache.commons.io;Charsets;toCharset;(String);generated",
+        "org.apache.commons.io;CopyUtils;CopyUtils;();generated",
+        "org.apache.commons.io;CopyUtils;copy;(Reader,OutputStream);generated",
+        "org.apache.commons.io;CopyUtils;copy;(Reader,OutputStream,String);generated",
+        "org.apache.commons.io;CopyUtils;copy;(String,OutputStream);generated",
+        "org.apache.commons.io;CopyUtils;copy;(String,OutputStream,String);generated",
+        "org.apache.commons.io;DirectoryWalker$CancelException;getDepth;();generated",
+        "org.apache.commons.io;EndianUtils;EndianUtils;();generated",
+        "org.apache.commons.io;EndianUtils;readSwappedDouble;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedDouble;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedFloat;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedFloat;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedInteger;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedInteger;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedLong;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedLong;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedShort;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedShort;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedUnsignedInteger;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedUnsignedInteger;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedUnsignedShort;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedUnsignedShort;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;swapDouble;(double);generated",
+        "org.apache.commons.io;EndianUtils;swapFloat;(float);generated",
+        "org.apache.commons.io;EndianUtils;swapInteger;(int);generated",
+        "org.apache.commons.io;EndianUtils;swapLong;(long);generated",
+        "org.apache.commons.io;EndianUtils;swapShort;(short);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedDouble;(OutputStream,double);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedDouble;(byte[],int,double);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedFloat;(OutputStream,float);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedFloat;(byte[],int,float);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedInteger;(OutputStream,int);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedInteger;(byte[],int,int);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedLong;(OutputStream,long);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedLong;(byte[],int,long);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedShort;(OutputStream,short);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedShort;(byte[],int,short);generated",
+        "org.apache.commons.io;FileCleaner;FileCleaner;();generated",
+        "org.apache.commons.io;FileCleaner;exitWhenFinished;();generated",
+        "org.apache.commons.io;FileCleaner;getInstance;();generated",
+        "org.apache.commons.io;FileCleaner;getTrackCount;();generated",
+        "org.apache.commons.io;FileCleaner;track;(File,Object);generated",
+        "org.apache.commons.io;FileCleaner;track;(File,Object,FileDeleteStrategy);generated",
+        "org.apache.commons.io;FileCleaner;track;(String,Object);generated",
+        "org.apache.commons.io;FileCleaner;track;(String,Object,FileDeleteStrategy);generated",
+        "org.apache.commons.io;FileCleaningTracker;FileCleaningTracker;();generated",
+        "org.apache.commons.io;FileCleaningTracker;exitWhenFinished;();generated",
+        "org.apache.commons.io;FileCleaningTracker;getTrackCount;();generated",
+        "org.apache.commons.io;FileCleaningTracker;track;(File,Object);generated",
+        "org.apache.commons.io;FileCleaningTracker;track;(File,Object,FileDeleteStrategy);generated",
+        "org.apache.commons.io;FileCleaningTracker;track;(String,Object);generated",
+        "org.apache.commons.io;FileCleaningTracker;track;(String,Object,FileDeleteStrategy);generated",
+        "org.apache.commons.io;FileDeleteStrategy;delete;(File);generated",
+        "org.apache.commons.io;FileDeleteStrategy;deleteQuietly;(File);generated",
+        "org.apache.commons.io;FileExistsException;FileExistsException;();generated",
+        "org.apache.commons.io;FileExistsException;FileExistsException;(File);generated",
+        "org.apache.commons.io;FileExistsException;FileExistsException;(String);generated",
+        "org.apache.commons.io;FileSystem;getCurrent;();generated",
+        "org.apache.commons.io;FileSystem;getIllegalFileNameChars;();generated",
+        "org.apache.commons.io;FileSystem;getMaxFileNameLength;();generated",
+        "org.apache.commons.io;FileSystem;getMaxPathLength;();generated",
+        "org.apache.commons.io;FileSystem;getNameSeparator;();generated",
+        "org.apache.commons.io;FileSystem;getReservedFileNames;();generated",
+        "org.apache.commons.io;FileSystem;isCasePreserving;();generated",
+        "org.apache.commons.io;FileSystem;isCaseSensitive;();generated",
+        "org.apache.commons.io;FileSystem;isLegalFileName;(CharSequence);generated",
+        "org.apache.commons.io;FileSystem;isReservedFileName;(CharSequence);generated",
+        "org.apache.commons.io;FileSystem;normalizeSeparators;(String);generated",
+        "org.apache.commons.io;FileSystem;supportsDriveLetter;();generated",
+        "org.apache.commons.io;FileSystemUtils;FileSystemUtils;();generated",
+        "org.apache.commons.io;FileSystemUtils;freeSpace;(String);generated",
+        "org.apache.commons.io;FileSystemUtils;freeSpaceKb;();generated",
+        "org.apache.commons.io;FileSystemUtils;freeSpaceKb;(String);generated",
+        "org.apache.commons.io;FileSystemUtils;freeSpaceKb;(String,long);generated",
+        "org.apache.commons.io;FileSystemUtils;freeSpaceKb;(long);generated",
+        "org.apache.commons.io;FileUtils;FileUtils;();generated",
+        "org.apache.commons.io;FileUtils;byteCountToDisplaySize;(BigInteger);generated",
+        "org.apache.commons.io;FileUtils;byteCountToDisplaySize;(Number);generated",
+        "org.apache.commons.io;FileUtils;byteCountToDisplaySize;(long);generated",
+        "org.apache.commons.io;FileUtils;checksumCRC32;(File);generated",
+        "org.apache.commons.io;FileUtils;cleanDirectory;(File);generated",
+        "org.apache.commons.io;FileUtils;contentEquals;(File,File);generated",
+        "org.apache.commons.io;FileUtils;contentEqualsIgnoreEOL;(File,File,String);generated",
+        "org.apache.commons.io;FileUtils;copyDirectory;(File,File);generated",
+        "org.apache.commons.io;FileUtils;copyDirectory;(File,File,FileFilter);generated",
+        "org.apache.commons.io;FileUtils;copyDirectory;(File,File,FileFilter,boolean);generated",
+        "org.apache.commons.io;FileUtils;copyDirectory;(File,File,FileFilter,boolean,CopyOption[]);generated",
+        "org.apache.commons.io;FileUtils;copyDirectory;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;copyDirectoryToDirectory;(File,File);generated",
+        "org.apache.commons.io;FileUtils;copyFile;(File,File);generated",
+        "org.apache.commons.io;FileUtils;copyFile;(File,File,CopyOption[]);generated",
+        "org.apache.commons.io;FileUtils;copyFile;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;copyFile;(File,File,boolean,CopyOption[]);generated",
+        "org.apache.commons.io;FileUtils;copyFile;(File,OutputStream);generated",
+        "org.apache.commons.io;FileUtils;copyFileToDirectory;(File,File);generated",
+        "org.apache.commons.io;FileUtils;copyFileToDirectory;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;copyInputStreamToFile;(InputStream,File);generated",
+        "org.apache.commons.io;FileUtils;copyToDirectory;(File,File);generated",
+        "org.apache.commons.io;FileUtils;copyToDirectory;(Iterable,File);generated",
+        "org.apache.commons.io;FileUtils;copyToFile;(InputStream,File);generated",
+        "org.apache.commons.io;FileUtils;copyURLToFile;(URL,File);generated",
+        "org.apache.commons.io;FileUtils;copyURLToFile;(URL,File,int,int);generated",
+        "org.apache.commons.io;FileUtils;createParentDirectories;(File);generated",
+        "org.apache.commons.io;FileUtils;current;();generated",
+        "org.apache.commons.io;FileUtils;deleteDirectory;(File);generated",
+        "org.apache.commons.io;FileUtils;deleteQuietly;(File);generated",
+        "org.apache.commons.io;FileUtils;directoryContains;(File,File);generated",
+        "org.apache.commons.io;FileUtils;forceDelete;(File);generated",
+        "org.apache.commons.io;FileUtils;forceDeleteOnExit;(File);generated",
+        "org.apache.commons.io;FileUtils;forceMkdir;(File);generated",
+        "org.apache.commons.io;FileUtils;forceMkdirParent;(File);generated",
+        "org.apache.commons.io;FileUtils;getTempDirectory;();generated",
+        "org.apache.commons.io;FileUtils;getTempDirectoryPath;();generated",
+        "org.apache.commons.io;FileUtils;getUserDirectory;();generated",
+        "org.apache.commons.io;FileUtils;getUserDirectoryPath;();generated",
+        "org.apache.commons.io;FileUtils;isDirectory;(File,LinkOption[]);generated",
+        "org.apache.commons.io;FileUtils;isEmptyDirectory;(File);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,ChronoLocalDate);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,ChronoLocalDate,LocalTime);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,ChronoLocalDateTime);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,ChronoLocalDateTime,ZoneId);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,ChronoZonedDateTime);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,Date);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,File);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,FileTime);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,Instant);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,long);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,ChronoLocalDate);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,ChronoLocalDate,LocalTime);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,ChronoLocalDateTime);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,ChronoLocalDateTime,ZoneId);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,ChronoZonedDateTime);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,Date);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,File);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,FileTime);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,Instant);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,long);generated",
+        "org.apache.commons.io;FileUtils;isRegularFile;(File,LinkOption[]);generated",
+        "org.apache.commons.io;FileUtils;isSymlink;(File);generated",
+        "org.apache.commons.io;FileUtils;iterateFiles;(File,IOFileFilter,IOFileFilter);generated",
+        "org.apache.commons.io;FileUtils;iterateFiles;(File,String[],boolean);generated",
+        "org.apache.commons.io;FileUtils;iterateFilesAndDirs;(File,IOFileFilter,IOFileFilter);generated",
+        "org.apache.commons.io;FileUtils;lastModified;(File);generated",
+        "org.apache.commons.io;FileUtils;lastModifiedFileTime;(File);generated",
+        "org.apache.commons.io;FileUtils;lastModifiedUnchecked;(File);generated",
+        "org.apache.commons.io;FileUtils;lineIterator;(File);generated",
+        "org.apache.commons.io;FileUtils;lineIterator;(File,String);generated",
+        "org.apache.commons.io;FileUtils;listFiles;(File,IOFileFilter,IOFileFilter);generated",
+        "org.apache.commons.io;FileUtils;listFiles;(File,String[],boolean);generated",
+        "org.apache.commons.io;FileUtils;listFilesAndDirs;(File,IOFileFilter,IOFileFilter);generated",
+        "org.apache.commons.io;FileUtils;moveDirectory;(File,File);generated",
+        "org.apache.commons.io;FileUtils;moveDirectoryToDirectory;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;moveFile;(File,File);generated",
+        "org.apache.commons.io;FileUtils;moveFile;(File,File,CopyOption[]);generated",
+        "org.apache.commons.io;FileUtils;moveFileToDirectory;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;moveToDirectory;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;newOutputStream;(File,boolean);generated",
+        "org.apache.commons.io;FileUtils;openInputStream;(File);generated",
+        "org.apache.commons.io;FileUtils;openOutputStream;(File);generated",
+        "org.apache.commons.io;FileUtils;openOutputStream;(File,boolean);generated",
+        "org.apache.commons.io;FileUtils;readFileToByteArray;(File);generated",
+        "org.apache.commons.io;FileUtils;readFileToString;(File);generated",
+        "org.apache.commons.io;FileUtils;readFileToString;(File,Charset);generated",
+        "org.apache.commons.io;FileUtils;readFileToString;(File,String);generated",
+        "org.apache.commons.io;FileUtils;readLines;(File);generated",
+        "org.apache.commons.io;FileUtils;readLines;(File,Charset);generated",
+        "org.apache.commons.io;FileUtils;readLines;(File,String);generated",
+        "org.apache.commons.io;FileUtils;sizeOf;(File);generated",
+        "org.apache.commons.io;FileUtils;sizeOfAsBigInteger;(File);generated",
+        "org.apache.commons.io;FileUtils;sizeOfDirectory;(File);generated",
+        "org.apache.commons.io;FileUtils;sizeOfDirectoryAsBigInteger;(File);generated",
+        "org.apache.commons.io;FileUtils;streamFiles;(File,boolean,String[]);generated",
+        "org.apache.commons.io;FileUtils;toFile;(URL);generated",
+        "org.apache.commons.io;FileUtils;toFiles;(URL[]);generated",
+        "org.apache.commons.io;FileUtils;touch;(File);generated",
+        "org.apache.commons.io;FileUtils;waitFor;(File,int);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence,Charset);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence,Charset,boolean);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence,String);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence,String,boolean);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeByteArrayToFile;(File,byte[]);generated",
+        "org.apache.commons.io;FileUtils;writeByteArrayToFile;(File,byte[],boolean);generated",
+        "org.apache.commons.io;FileUtils;writeByteArrayToFile;(File,byte[],int,int);generated",
+        "org.apache.commons.io;FileUtils;writeByteArrayToFile;(File,byte[],int,int,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,Collection);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,Collection,String);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,Collection,String,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,Collection,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,String,Collection);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,String,Collection,String);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,String,Collection,String,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,String,Collection,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String,Charset);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String,Charset,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String,String);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String,String,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String,boolean);generated",
+        "org.apache.commons.io;FilenameUtils;FilenameUtils;();generated",
+        "org.apache.commons.io;FilenameUtils;directoryContains;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;equals;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;equals;(String,String,boolean,IOCase);generated",
+        "org.apache.commons.io;FilenameUtils;equalsNormalized;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;equalsNormalizedOnSystem;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;equalsOnSystem;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;getPrefixLength;(String);generated",
+        "org.apache.commons.io;FilenameUtils;indexOfExtension;(String);generated",
+        "org.apache.commons.io;FilenameUtils;indexOfLastSeparator;(String);generated",
+        "org.apache.commons.io;FilenameUtils;isExtension;(String,Collection);generated",
+        "org.apache.commons.io;FilenameUtils;isExtension;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;isExtension;(String,String[]);generated",
+        "org.apache.commons.io;FilenameUtils;separatorsToSystem;(String);generated",
+        "org.apache.commons.io;FilenameUtils;separatorsToUnix;(String);generated",
+        "org.apache.commons.io;FilenameUtils;separatorsToWindows;(String);generated",
+        "org.apache.commons.io;FilenameUtils;wildcardMatch;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;wildcardMatch;(String,String,IOCase);generated",
+        "org.apache.commons.io;FilenameUtils;wildcardMatchOnSystem;(String,String);generated",
+        "org.apache.commons.io;HexDump;HexDump;();generated",
+        "org.apache.commons.io;HexDump;dump;(byte[],long,OutputStream,int);generated",
+        "org.apache.commons.io;IOCase;checkCompareTo;(String,String);generated",
+        "org.apache.commons.io;IOCase;checkEndsWith;(String,String);generated",
+        "org.apache.commons.io;IOCase;checkEquals;(String,String);generated",
+        "org.apache.commons.io;IOCase;checkIndexOf;(String,int,String);generated",
+        "org.apache.commons.io;IOCase;checkRegionMatches;(String,int,String);generated",
+        "org.apache.commons.io;IOCase;checkStartsWith;(String,String);generated",
+        "org.apache.commons.io;IOCase;forName;(String);generated",
+        "org.apache.commons.io;IOCase;getName;();generated",
+        "org.apache.commons.io;IOCase;isCaseSensitive;();generated",
+        "org.apache.commons.io;IOCase;isCaseSensitive;(IOCase);generated",
+        "org.apache.commons.io;IOCase;toString;();generated",
+        "org.apache.commons.io;IOCase;value;(IOCase,IOCase);generated",
+        "org.apache.commons.io;IOExceptionList;checkEmpty;(List,Object);generated",
+        "org.apache.commons.io;IOExceptionList;getCause;(int,Class);generated",
+        "org.apache.commons.io;IOExceptionWithCause;IOExceptionWithCause;(String,Throwable);generated",
+        "org.apache.commons.io;IOExceptionWithCause;IOExceptionWithCause;(Throwable);generated",
+        "org.apache.commons.io;IOIndexedException;IOIndexedException;(int,Throwable);generated",
+        "org.apache.commons.io;IOIndexedException;getIndex;();generated",
+        "org.apache.commons.io;IOUtils;IOUtils;();generated",
+        "org.apache.commons.io;IOUtils;byteArray;();generated",
+        "org.apache.commons.io;IOUtils;byteArray;(int);generated",
+        "org.apache.commons.io;IOUtils;close;(Closeable);generated",
+        "org.apache.commons.io;IOUtils;close;(Closeable,IOConsumer);generated",
+        "org.apache.commons.io;IOUtils;close;(Closeable[]);generated",
+        "org.apache.commons.io;IOUtils;close;(URLConnection);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Closeable);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Closeable,Consumer);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Closeable[]);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(InputStream);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(OutputStream);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Reader);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Selector);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(ServerSocket);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Socket);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Writer);generated",
+        "org.apache.commons.io;IOUtils;consume;(InputStream);generated",
+        "org.apache.commons.io;IOUtils;contentEquals;(InputStream,InputStream);generated",
+        "org.apache.commons.io;IOUtils;contentEquals;(Reader,Reader);generated",
+        "org.apache.commons.io;IOUtils;contentEqualsIgnoreEOL;(Reader,Reader);generated",
+        "org.apache.commons.io;IOUtils;copy;(ByteArrayOutputStream);generated",
+        "org.apache.commons.io;IOUtils;copy;(Reader,OutputStream);generated",
+        "org.apache.commons.io;IOUtils;copy;(Reader,OutputStream,Charset);generated",
+        "org.apache.commons.io;IOUtils;copy;(Reader,OutputStream,String);generated",
+        "org.apache.commons.io;IOUtils;copy;(URL,File);generated",
+        "org.apache.commons.io;IOUtils;copy;(URL,OutputStream);generated",
+        "org.apache.commons.io;IOUtils;length;(CharSequence);generated",
+        "org.apache.commons.io;IOUtils;length;(Object[]);generated",
+        "org.apache.commons.io;IOUtils;length;(byte[]);generated",
+        "org.apache.commons.io;IOUtils;length;(char[]);generated",
+        "org.apache.commons.io;IOUtils;resourceToByteArray;(String);generated",
+        "org.apache.commons.io;IOUtils;resourceToByteArray;(String,ClassLoader);generated",
+        "org.apache.commons.io;IOUtils;resourceToString;(String,Charset);generated",
+        "org.apache.commons.io;IOUtils;resourceToString;(String,Charset,ClassLoader);generated",
+        "org.apache.commons.io;IOUtils;resourceToURL;(String);generated",
+        "org.apache.commons.io;IOUtils;resourceToURL;(String,ClassLoader);generated",
+        "org.apache.commons.io;IOUtils;skip;(InputStream,long);generated",
+        "org.apache.commons.io;IOUtils;skip;(ReadableByteChannel,long);generated",
+        "org.apache.commons.io;IOUtils;skip;(Reader,long);generated",
+        "org.apache.commons.io;IOUtils;skipFully;(InputStream,long);generated",
+        "org.apache.commons.io;IOUtils;skipFully;(ReadableByteChannel,long);generated",
+        "org.apache.commons.io;IOUtils;skipFully;(Reader,long);generated",
+        "org.apache.commons.io;IOUtils;toBufferedInputStream;(InputStream);generated",
+        "org.apache.commons.io;IOUtils;toBufferedInputStream;(InputStream,int);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(InputStream);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(Reader);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(Reader,Charset);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(Reader,String);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(URI);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(URL);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(URLConnection);generated",
+        "org.apache.commons.io;IOUtils;toString;(URI);generated",
+        "org.apache.commons.io;IOUtils;toString;(URI,Charset);generated",
+        "org.apache.commons.io;IOUtils;toString;(URI,String);generated",
+        "org.apache.commons.io;IOUtils;toString;(URL);generated",
+        "org.apache.commons.io;IOUtils;toString;(URL,Charset);generated",
+        "org.apache.commons.io;IOUtils;toString;(URL,String);generated",
+        "org.apache.commons.io;IOUtils;write;(CharSequence,OutputStream);generated",
+        "org.apache.commons.io;IOUtils;write;(CharSequence,OutputStream,Charset);generated",
+        "org.apache.commons.io;IOUtils;write;(CharSequence,OutputStream,String);generated",
+        "org.apache.commons.io;IOUtils;write;(String,OutputStream);generated",
+        "org.apache.commons.io;IOUtils;write;(String,OutputStream,Charset);generated",
+        "org.apache.commons.io;IOUtils;write;(String,OutputStream,String);generated",
+        "org.apache.commons.io;IOUtils;write;(StringBuffer,OutputStream);generated",
+        "org.apache.commons.io;IOUtils;write;(StringBuffer,OutputStream,String);generated",
+        "org.apache.commons.io;IOUtils;write;(char[],OutputStream);generated",
+        "org.apache.commons.io;IOUtils;write;(char[],OutputStream,Charset);generated",
+        "org.apache.commons.io;IOUtils;write;(char[],OutputStream,String);generated",
+        "org.apache.commons.io;LineIterator;closeQuietly;(LineIterator);generated",
+        "org.apache.commons.io;RandomAccessFileMode;create;(File);generated",
+        "org.apache.commons.io;RandomAccessFileMode;create;(Path);generated",
+        "org.apache.commons.io;RandomAccessFileMode;create;(String);generated",
+        "org.apache.commons.io;RandomAccessFileMode;toString;();generated",
+        "org.apache.commons.io;StandardLineSeparator;getBytes;(Charset);generated",
+        "org.apache.commons.io;StandardLineSeparator;getString;();generated",
+        "org.apache.commons.io;TaggedIOException;isTaggedWith;(Throwable,Object);generated",
+        "org.apache.commons.io;TaggedIOException;throwCauseIfTaggedWith;(Throwable,Object);generated",
+        "org.apache.commons.io;UncheckedIO;UncheckedIO;();generated",
+        "org.apache.commons.io;UncheckedIO;accept;(IOConsumer,Object);generated",
+        "org.apache.commons.io;UncheckedIO;apply;(IOBiFunction,Object,Object);generated",
+        "org.apache.commons.io;UncheckedIO;get;(IOSupplier);generated",
+        "org.apache.commons.io;UncheckedIO;run;(IORunnable);generated",
+        "org.apache.commons.io;UncheckedIOExceptions;UncheckedIOExceptions;();generated",
+        "org.apache.commons.io;UncheckedIOExceptions;create;(Object);generated",
+        "org.apache.commons.io;UncheckedIOExceptions;wrap;(IOException,Object);generated"
+      ]
+  }
+}
diff --git a/java/ql/lib/semmle/code/java/frameworks/camel/CamelJavaDSL.qll b/java/ql/lib/semmle/code/java/frameworks/camel/CamelJavaDSL.qll
index e4b687a73b0..b59f7a94cdb 100644
--- a/java/ql/lib/semmle/code/java/frameworks/camel/CamelJavaDSL.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/camel/CamelJavaDSL.qll
@@ -35,8 +35,8 @@ library class ProcessorDefinitionElement extends MethodAccess {
  *
  * This declares a "target" for this route, described by the URI given as the first argument.
  */
-class CamelJavaDSLToDecl extends ProcessorDefinitionElement {
-  CamelJavaDSLToDecl() { getMethod().hasName("to") }
+class CamelJavaDslToDecl extends ProcessorDefinitionElement {
+  CamelJavaDslToDecl() { getMethod().hasName("to") }
 
   /**
    * Gets the URI specified by this `to` declaration.
@@ -47,14 +47,17 @@ class CamelJavaDSLToDecl extends ProcessorDefinitionElement {
   deprecated string getURI() { result = getUri() }
 }
 
+/** DEPRECATED: Alias for CamelJavaDslToDecl */
+deprecated class CamelJavaDSLToDecl = CamelJavaDslToDecl;
+
 /**
  * A declaration of a "bean" target in the Apache Camel Java DSL.
  *
  * This declares a bean to call for this route. The bean is defined either by a Class<?> reference,
  * or the bean object itself.
  */
-class CamelJavaDSLBeanDecl extends ProcessorDefinitionElement {
-  CamelJavaDSLBeanDecl() { getMethod().hasName("bean") }
+class CamelJavaDslBeanDecl extends ProcessorDefinitionElement {
+  CamelJavaDslBeanDecl() { getMethod().hasName("bean") }
 
   /**
    * Gets a bean class that may be registered as a target by this `bean()` declaration.
@@ -71,6 +74,9 @@ class CamelJavaDSLBeanDecl extends ProcessorDefinitionElement {
   }
 }
 
+/** DEPRECATED: Alias for CamelJavaDslBeanDecl */
+deprecated class CamelJavaDSLBeanDecl = CamelJavaDslBeanDecl;
+
 /**
  * A declaration of a "beanRef" target in the Apache Camel Java DSL.
  *
@@ -78,8 +84,8 @@ class CamelJavaDSLBeanDecl extends ProcessorDefinitionElement {
  * the bean reference is dependent on which registries are used by Apache Camel, but we make the
  * assumption that it either represetns a qualified name, or a Srping bean identifier.
  */
-class CamelJavaDSLBeanRefDecl extends ProcessorDefinitionElement {
-  CamelJavaDSLBeanRefDecl() { getMethod().hasName("beanRef") }
+class CamelJavaDslBeanRefDecl extends ProcessorDefinitionElement {
+  CamelJavaDslBeanRefDecl() { getMethod().hasName("beanRef") }
 
   /**
    * Gets the string describing the bean referred to.
@@ -98,13 +104,16 @@ class CamelJavaDSLBeanRefDecl extends ProcessorDefinitionElement {
   }
 }
 
+/** DEPRECATED: Alias for CamelJavaDslBeanRefDecl */
+deprecated class CamelJavaDSLBeanRefDecl = CamelJavaDslBeanRefDecl;
+
 /**
  * A "method" Camel expression in the Apache Camel Java DSL.
  *
  * An expression that represents a call to a bean, or particular method on a bean.
  */
-class CamelJavaDSLMethodDecl extends MethodAccess {
-  CamelJavaDSLMethodDecl() {
+class CamelJavaDslMethodDecl extends MethodAccess {
+  CamelJavaDslMethodDecl() {
     getMethod()
         .getDeclaringType()
         .getSourceDeclaration()
@@ -129,3 +138,6 @@ class CamelJavaDSLMethodDecl extends MethodAccess {
       else result = getArgument(0).getType()
   }
 }
+
+/** DEPRECATED: Alias for CamelJavaDslMethodDecl */
+deprecated class CamelJavaDSLMethodDecl = CamelJavaDslMethodDecl;
diff --git a/java/ql/lib/semmle/code/java/frameworks/generated.qll b/java/ql/lib/semmle/code/java/frameworks/generated.qll
index adf537e2c51..7a16e24890e 100644
--- a/java/ql/lib/semmle/code/java/frameworks/generated.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/generated.qll
@@ -6,4 +6,5 @@ import java
 
 private module GeneratedFrameworks {
   private import apache.IOGenerated
+  private import kotlin.StdLibGenerated
 }
diff --git a/java/ql/lib/semmle/code/java/frameworks/javaee/Persistence.qll b/java/ql/lib/semmle/code/java/frameworks/javaee/Persistence.qll
index 82569754394..e60659426e5 100644
--- a/java/ql/lib/semmle/code/java/frameworks/javaee/Persistence.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/javaee/Persistence.qll
@@ -33,12 +33,12 @@ class PersistentEntity extends RefType {
   }
 
   /**
-   * Gets the access type for this entity as defined by a `@javax.persistence.Access` annotation, if any.
+   * Gets the access type for this entity as defined by a `@javax.persistence.Access` annotation,
+   * if any, in lower case.
    */
   string getAccessTypeFromAnnotation() {
     exists(AccessAnnotation accessType | accessType = this.getAnAnnotation() |
-      result =
-        accessType.getValue("value").(FieldRead).getField().(EnumConstant).getName().toLowerCase()
+      result = accessType.getEnumConstantValue("value").getName().toLowerCase()
     )
   }
 }
diff --git a/java/ql/lib/semmle/code/java/frameworks/kotlin/NegativeStdLibGenerated.qll b/java/ql/lib/semmle/code/java/frameworks/kotlin/NegativeStdLibGenerated.qll
new file mode 100644
index 00000000000..412390f139e
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/frameworks/kotlin/NegativeStdLibGenerated.qll
@@ -0,0 +1,4414 @@
+/**
+ * THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+ * Definitions of negative summaries in the Kotlin StdLib @30ce58cea74 framework.
+ */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+
+private class StdLibGeneratedNegativesummaryCsv extends NegativeSummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "kotlin.annotation;AnnotationRetention;valueOf;(String);generated",
+        "kotlin.annotation;AnnotationRetention;values;();generated",
+        "kotlin.annotation;AnnotationTarget;valueOf;(String);generated",
+        "kotlin.annotation;AnnotationTarget;values;();generated",
+        "kotlin.annotation;MustBeDocumented;MustBeDocumented;();generated",
+        "kotlin.annotation;Repeatable;Repeatable;();generated",
+        "kotlin.annotation;Retention;Retention;(AnnotationRetention);generated",
+        "kotlin.annotation;Retention;value;();generated",
+        "kotlin.annotation;Target;Target;(AnnotationTarget[]);generated",
+        "kotlin.annotation;Target;allowedTargets;();generated",
+        "kotlin.collections.builders;SerializedCollection$Companion;getTagList;();generated",
+        "kotlin.collections.builders;SerializedCollection$Companion;getTagSet;();generated",
+        "kotlin.collections;AbstractIterator;AbstractIterator;();generated",
+        "kotlin.collections;AbstractList;equals;(Object);generated",
+        "kotlin.collections;AbstractList;hashCode;();generated",
+        "kotlin.collections;AbstractMap;equals;(Object);generated",
+        "kotlin.collections;AbstractMap;hashCode;();generated",
+        "kotlin.collections;AbstractMap;toString;();generated",
+        "kotlin.collections;AbstractSet;equals;(Object);generated",
+        "kotlin.collections;AbstractSet;hashCode;();generated",
+        "kotlin.collections;ArrayDeque;ArrayDeque;();generated",
+        "kotlin.collections;ArrayDeque;ArrayDeque;(int);generated",
+        "kotlin.collections;ArrayList;ArrayList;();generated",
+        "kotlin.collections;ArrayList;ArrayList;(Collection);generated",
+        "kotlin.collections;ArrayList;ArrayList;(int);generated",
+        "kotlin.collections;ArrayList;ensureCapacity;(int);generated",
+        "kotlin.collections;ArrayList;trimToSize;();generated",
+        "kotlin.collections;ArraysKt;all;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;all;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;all;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;all;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;all;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;all;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;all;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;all;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;all;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;any;(Object[]);generated",
+        "kotlin.collections;ArraysKt;any;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;any;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;any;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;any;(byte[]);generated",
+        "kotlin.collections;ArraysKt;any;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;any;(char[]);generated",
+        "kotlin.collections;ArraysKt;any;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;any;(double[]);generated",
+        "kotlin.collections;ArraysKt;any;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;any;(float[]);generated",
+        "kotlin.collections;ArraysKt;any;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;any;(int[]);generated",
+        "kotlin.collections;ArraysKt;any;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;any;(long[]);generated",
+        "kotlin.collections;ArraysKt;any;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;any;(short[]);generated",
+        "kotlin.collections;ArraysKt;any;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;asIterable;(Object[]);generated",
+        "kotlin.collections;ArraysKt;asIterable;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;asIterable;(byte[]);generated",
+        "kotlin.collections;ArraysKt;asIterable;(char[]);generated",
+        "kotlin.collections;ArraysKt;asIterable;(double[]);generated",
+        "kotlin.collections;ArraysKt;asIterable;(float[]);generated",
+        "kotlin.collections;ArraysKt;asIterable;(int[]);generated",
+        "kotlin.collections;ArraysKt;asIterable;(long[]);generated",
+        "kotlin.collections;ArraysKt;asIterable;(short[]);generated",
+        "kotlin.collections;ArraysKt;asList;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;asList;(byte[]);generated",
+        "kotlin.collections;ArraysKt;asList;(char[]);generated",
+        "kotlin.collections;ArraysKt;asList;(double[]);generated",
+        "kotlin.collections;ArraysKt;asList;(float[]);generated",
+        "kotlin.collections;ArraysKt;asList;(int[]);generated",
+        "kotlin.collections;ArraysKt;asList;(long[]);generated",
+        "kotlin.collections;ArraysKt;asList;(short[]);generated",
+        "kotlin.collections;ArraysKt;asSequence;(Object[]);generated",
+        "kotlin.collections;ArraysKt;asSequence;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;asSequence;(byte[]);generated",
+        "kotlin.collections;ArraysKt;asSequence;(char[]);generated",
+        "kotlin.collections;ArraysKt;asSequence;(double[]);generated",
+        "kotlin.collections;ArraysKt;asSequence;(float[]);generated",
+        "kotlin.collections;ArraysKt;asSequence;(int[]);generated",
+        "kotlin.collections;ArraysKt;asSequence;(long[]);generated",
+        "kotlin.collections;ArraysKt;asSequence;(short[]);generated",
+        "kotlin.collections;ArraysKt;associate;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;associate;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;associate;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;associate;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;associate;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;associate;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;associate;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;associate;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;associate;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(Object[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(boolean[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(byte[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(char[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(double[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(float[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(int[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(long[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateBy;(short[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;associateWith;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateWith;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateWith;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateWith;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateWith;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateWith;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateWith;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateWith;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;associateWith;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;average;(byte[]);generated",
+        "kotlin.collections;ArraysKt;average;(double[]);generated",
+        "kotlin.collections;ArraysKt;average;(float[]);generated",
+        "kotlin.collections;ArraysKt;average;(int[]);generated",
+        "kotlin.collections;ArraysKt;average;(long[]);generated",
+        "kotlin.collections;ArraysKt;average;(short[]);generated",
+        "kotlin.collections;ArraysKt;averageOfByte;(Byte[]);generated",
+        "kotlin.collections;ArraysKt;averageOfDouble;(Double[]);generated",
+        "kotlin.collections;ArraysKt;averageOfFloat;(Float[]);generated",
+        "kotlin.collections;ArraysKt;averageOfInt;(Integer[]);generated",
+        "kotlin.collections;ArraysKt;averageOfLong;(Long[]);generated",
+        "kotlin.collections;ArraysKt;averageOfShort;(Short[]);generated",
+        "kotlin.collections;ArraysKt;binarySearch;(Object[],Object,Comparator,int,int);generated",
+        "kotlin.collections;ArraysKt;binarySearch;(Object[],Object,int,int);generated",
+        "kotlin.collections;ArraysKt;binarySearch;(byte[],byte,int,int);generated",
+        "kotlin.collections;ArraysKt;binarySearch;(char[],char,int,int);generated",
+        "kotlin.collections;ArraysKt;binarySearch;(double[],double,int,int);generated",
+        "kotlin.collections;ArraysKt;binarySearch;(float[],float,int,int);generated",
+        "kotlin.collections;ArraysKt;binarySearch;(int[],int,int,int);generated",
+        "kotlin.collections;ArraysKt;binarySearch;(long[],long,int,int);generated",
+        "kotlin.collections;ArraysKt;binarySearch;(short[],short,int,int);generated",
+        "kotlin.collections;ArraysKt;component1;(Object[]);generated",
+        "kotlin.collections;ArraysKt;component1;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;component1;(byte[]);generated",
+        "kotlin.collections;ArraysKt;component1;(char[]);generated",
+        "kotlin.collections;ArraysKt;component1;(double[]);generated",
+        "kotlin.collections;ArraysKt;component1;(float[]);generated",
+        "kotlin.collections;ArraysKt;component1;(int[]);generated",
+        "kotlin.collections;ArraysKt;component1;(long[]);generated",
+        "kotlin.collections;ArraysKt;component1;(short[]);generated",
+        "kotlin.collections;ArraysKt;component2;(Object[]);generated",
+        "kotlin.collections;ArraysKt;component2;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;component2;(byte[]);generated",
+        "kotlin.collections;ArraysKt;component2;(char[]);generated",
+        "kotlin.collections;ArraysKt;component2;(double[]);generated",
+        "kotlin.collections;ArraysKt;component2;(float[]);generated",
+        "kotlin.collections;ArraysKt;component2;(int[]);generated",
+        "kotlin.collections;ArraysKt;component2;(long[]);generated",
+        "kotlin.collections;ArraysKt;component2;(short[]);generated",
+        "kotlin.collections;ArraysKt;component3;(Object[]);generated",
+        "kotlin.collections;ArraysKt;component3;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;component3;(byte[]);generated",
+        "kotlin.collections;ArraysKt;component3;(char[]);generated",
+        "kotlin.collections;ArraysKt;component3;(double[]);generated",
+        "kotlin.collections;ArraysKt;component3;(float[]);generated",
+        "kotlin.collections;ArraysKt;component3;(int[]);generated",
+        "kotlin.collections;ArraysKt;component3;(long[]);generated",
+        "kotlin.collections;ArraysKt;component3;(short[]);generated",
+        "kotlin.collections;ArraysKt;component4;(Object[]);generated",
+        "kotlin.collections;ArraysKt;component4;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;component4;(byte[]);generated",
+        "kotlin.collections;ArraysKt;component4;(char[]);generated",
+        "kotlin.collections;ArraysKt;component4;(double[]);generated",
+        "kotlin.collections;ArraysKt;component4;(float[]);generated",
+        "kotlin.collections;ArraysKt;component4;(int[]);generated",
+        "kotlin.collections;ArraysKt;component4;(long[]);generated",
+        "kotlin.collections;ArraysKt;component4;(short[]);generated",
+        "kotlin.collections;ArraysKt;component5;(Object[]);generated",
+        "kotlin.collections;ArraysKt;component5;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;component5;(byte[]);generated",
+        "kotlin.collections;ArraysKt;component5;(char[]);generated",
+        "kotlin.collections;ArraysKt;component5;(double[]);generated",
+        "kotlin.collections;ArraysKt;component5;(float[]);generated",
+        "kotlin.collections;ArraysKt;component5;(int[]);generated",
+        "kotlin.collections;ArraysKt;component5;(long[]);generated",
+        "kotlin.collections;ArraysKt;component5;(short[]);generated",
+        "kotlin.collections;ArraysKt;contains;(Object[],Object);generated",
+        "kotlin.collections;ArraysKt;contains;(boolean[],boolean);generated",
+        "kotlin.collections;ArraysKt;contains;(byte[],byte);generated",
+        "kotlin.collections;ArraysKt;contains;(char[],char);generated",
+        "kotlin.collections;ArraysKt;contains;(double[],double);generated",
+        "kotlin.collections;ArraysKt;contains;(float[],float);generated",
+        "kotlin.collections;ArraysKt;contains;(int[],int);generated",
+        "kotlin.collections;ArraysKt;contains;(long[],long);generated",
+        "kotlin.collections;ArraysKt;contains;(short[],short);generated",
+        "kotlin.collections;ArraysKt;contentDeepEqualsInline;(Object[],Object[]);generated",
+        "kotlin.collections;ArraysKt;contentDeepEqualsNullable;(Object[],Object[]);generated",
+        "kotlin.collections;ArraysKt;contentDeepHashCodeInline;(Object[]);generated",
+        "kotlin.collections;ArraysKt;contentDeepHashCodeNullable;(Object[]);generated",
+        "kotlin.collections;ArraysKt;contentDeepToStringInline;(Object[]);generated",
+        "kotlin.collections;ArraysKt;contentDeepToStringNullable;(Object[]);generated",
+        "kotlin.collections;ArraysKt;contentEquals;(Object[],Object[]);generated",
+        "kotlin.collections;ArraysKt;contentEquals;(boolean[],boolean[]);generated",
+        "kotlin.collections;ArraysKt;contentEquals;(byte[],byte[]);generated",
+        "kotlin.collections;ArraysKt;contentEquals;(char[],char[]);generated",
+        "kotlin.collections;ArraysKt;contentEquals;(double[],double[]);generated",
+        "kotlin.collections;ArraysKt;contentEquals;(float[],float[]);generated",
+        "kotlin.collections;ArraysKt;contentEquals;(int[],int[]);generated",
+        "kotlin.collections;ArraysKt;contentEquals;(long[],long[]);generated",
+        "kotlin.collections;ArraysKt;contentEquals;(short[],short[]);generated",
+        "kotlin.collections;ArraysKt;contentEqualsNullable;(Object[],Object[]);generated",
+        "kotlin.collections;ArraysKt;contentEqualsNullable;(boolean[],boolean[]);generated",
+        "kotlin.collections;ArraysKt;contentEqualsNullable;(byte[],byte[]);generated",
+        "kotlin.collections;ArraysKt;contentEqualsNullable;(char[],char[]);generated",
+        "kotlin.collections;ArraysKt;contentEqualsNullable;(double[],double[]);generated",
+        "kotlin.collections;ArraysKt;contentEqualsNullable;(float[],float[]);generated",
+        "kotlin.collections;ArraysKt;contentEqualsNullable;(int[],int[]);generated",
+        "kotlin.collections;ArraysKt;contentEqualsNullable;(long[],long[]);generated",
+        "kotlin.collections;ArraysKt;contentEqualsNullable;(short[],short[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCode;(Object[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCode;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCode;(byte[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCode;(char[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCode;(double[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCode;(float[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCode;(int[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCode;(long[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCode;(short[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCodeNullable;(Object[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCodeNullable;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCodeNullable;(byte[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCodeNullable;(char[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCodeNullable;(double[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCodeNullable;(float[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCodeNullable;(int[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCodeNullable;(long[]);generated",
+        "kotlin.collections;ArraysKt;contentHashCodeNullable;(short[]);generated",
+        "kotlin.collections;ArraysKt;contentToString;(Object[]);generated",
+        "kotlin.collections;ArraysKt;contentToString;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;contentToString;(byte[]);generated",
+        "kotlin.collections;ArraysKt;contentToString;(char[]);generated",
+        "kotlin.collections;ArraysKt;contentToString;(double[]);generated",
+        "kotlin.collections;ArraysKt;contentToString;(float[]);generated",
+        "kotlin.collections;ArraysKt;contentToString;(int[]);generated",
+        "kotlin.collections;ArraysKt;contentToString;(long[]);generated",
+        "kotlin.collections;ArraysKt;contentToString;(short[]);generated",
+        "kotlin.collections;ArraysKt;contentToStringNullable;(Object[]);generated",
+        "kotlin.collections;ArraysKt;contentToStringNullable;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;contentToStringNullable;(byte[]);generated",
+        "kotlin.collections;ArraysKt;contentToStringNullable;(char[]);generated",
+        "kotlin.collections;ArraysKt;contentToStringNullable;(double[]);generated",
+        "kotlin.collections;ArraysKt;contentToStringNullable;(float[]);generated",
+        "kotlin.collections;ArraysKt;contentToStringNullable;(int[]);generated",
+        "kotlin.collections;ArraysKt;contentToStringNullable;(long[]);generated",
+        "kotlin.collections;ArraysKt;contentToStringNullable;(short[]);generated",
+        "kotlin.collections;ArraysKt;copyInto;(boolean[],boolean[],int,int,int);generated",
+        "kotlin.collections;ArraysKt;copyInto;(double[],double[],int,int,int);generated",
+        "kotlin.collections;ArraysKt;copyInto;(float[],float[],int,int,int);generated",
+        "kotlin.collections;ArraysKt;copyInto;(int[],int[],int,int,int);generated",
+        "kotlin.collections;ArraysKt;copyInto;(long[],long[],int,int,int);generated",
+        "kotlin.collections;ArraysKt;copyInto;(short[],short[],int,int,int);generated",
+        "kotlin.collections;ArraysKt;copyOf;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;copyOf;(boolean[],int);generated",
+        "kotlin.collections;ArraysKt;copyOf;(double[]);generated",
+        "kotlin.collections;ArraysKt;copyOf;(double[],int);generated",
+        "kotlin.collections;ArraysKt;copyOf;(float[]);generated",
+        "kotlin.collections;ArraysKt;copyOf;(float[],int);generated",
+        "kotlin.collections;ArraysKt;copyOf;(int[]);generated",
+        "kotlin.collections;ArraysKt;copyOf;(int[],int);generated",
+        "kotlin.collections;ArraysKt;copyOf;(long[]);generated",
+        "kotlin.collections;ArraysKt;copyOf;(long[],int);generated",
+        "kotlin.collections;ArraysKt;copyOf;(short[]);generated",
+        "kotlin.collections;ArraysKt;copyOf;(short[],int);generated",
+        "kotlin.collections;ArraysKt;copyOfRangeInline;(boolean[],int,int);generated",
+        "kotlin.collections;ArraysKt;copyOfRangeInline;(double[],int,int);generated",
+        "kotlin.collections;ArraysKt;copyOfRangeInline;(float[],int,int);generated",
+        "kotlin.collections;ArraysKt;copyOfRangeInline;(int[],int,int);generated",
+        "kotlin.collections;ArraysKt;copyOfRangeInline;(long[],int,int);generated",
+        "kotlin.collections;ArraysKt;copyOfRangeInline;(short[],int,int);generated",
+        "kotlin.collections;ArraysKt;count;(Object[]);generated",
+        "kotlin.collections;ArraysKt;count;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;count;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;count;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;count;(byte[]);generated",
+        "kotlin.collections;ArraysKt;count;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;count;(char[]);generated",
+        "kotlin.collections;ArraysKt;count;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;count;(double[]);generated",
+        "kotlin.collections;ArraysKt;count;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;count;(float[]);generated",
+        "kotlin.collections;ArraysKt;count;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;count;(int[]);generated",
+        "kotlin.collections;ArraysKt;count;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;count;(long[]);generated",
+        "kotlin.collections;ArraysKt;count;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;count;(short[]);generated",
+        "kotlin.collections;ArraysKt;count;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;distinct;(Object[]);generated",
+        "kotlin.collections;ArraysKt;distinct;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;distinct;(byte[]);generated",
+        "kotlin.collections;ArraysKt;distinct;(char[]);generated",
+        "kotlin.collections;ArraysKt;distinct;(double[]);generated",
+        "kotlin.collections;ArraysKt;distinct;(float[]);generated",
+        "kotlin.collections;ArraysKt;distinct;(int[]);generated",
+        "kotlin.collections;ArraysKt;distinct;(long[]);generated",
+        "kotlin.collections;ArraysKt;distinct;(short[]);generated",
+        "kotlin.collections;ArraysKt;distinctBy;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;distinctBy;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;distinctBy;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;distinctBy;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;distinctBy;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;distinctBy;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;distinctBy;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;distinctBy;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;distinctBy;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;drop;(boolean[],int);generated",
+        "kotlin.collections;ArraysKt;drop;(byte[],int);generated",
+        "kotlin.collections;ArraysKt;drop;(char[],int);generated",
+        "kotlin.collections;ArraysKt;drop;(double[],int);generated",
+        "kotlin.collections;ArraysKt;drop;(float[],int);generated",
+        "kotlin.collections;ArraysKt;drop;(int[],int);generated",
+        "kotlin.collections;ArraysKt;drop;(long[],int);generated",
+        "kotlin.collections;ArraysKt;drop;(short[],int);generated",
+        "kotlin.collections;ArraysKt;dropLast;(boolean[],int);generated",
+        "kotlin.collections;ArraysKt;dropLast;(byte[],int);generated",
+        "kotlin.collections;ArraysKt;dropLast;(char[],int);generated",
+        "kotlin.collections;ArraysKt;dropLast;(double[],int);generated",
+        "kotlin.collections;ArraysKt;dropLast;(float[],int);generated",
+        "kotlin.collections;ArraysKt;dropLast;(int[],int);generated",
+        "kotlin.collections;ArraysKt;dropLast;(long[],int);generated",
+        "kotlin.collections;ArraysKt;dropLast;(short[],int);generated",
+        "kotlin.collections;ArraysKt;dropLastWhile;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropLastWhile;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropLastWhile;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropLastWhile;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropLastWhile;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropLastWhile;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropLastWhile;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropLastWhile;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropWhile;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropWhile;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropWhile;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropWhile;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropWhile;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropWhile;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropWhile;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropWhile;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;dropWhile;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;elementAt;(Object[],int);generated",
+        "kotlin.collections;ArraysKt;elementAt;(boolean[],int);generated",
+        "kotlin.collections;ArraysKt;elementAt;(byte[],int);generated",
+        "kotlin.collections;ArraysKt;elementAt;(char[],int);generated",
+        "kotlin.collections;ArraysKt;elementAt;(double[],int);generated",
+        "kotlin.collections;ArraysKt;elementAt;(float[],int);generated",
+        "kotlin.collections;ArraysKt;elementAt;(int[],int);generated",
+        "kotlin.collections;ArraysKt;elementAt;(long[],int);generated",
+        "kotlin.collections;ArraysKt;elementAt;(short[],int);generated",
+        "kotlin.collections;ArraysKt;elementAtOrElse;(Object[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;elementAtOrElse;(boolean[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;elementAtOrElse;(byte[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;elementAtOrElse;(char[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;elementAtOrElse;(double[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;elementAtOrElse;(float[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;elementAtOrElse;(int[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;elementAtOrElse;(long[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;elementAtOrElse;(short[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;elementAtOrNull;(Object[],int);generated",
+        "kotlin.collections;ArraysKt;elementAtOrNull;(boolean[],int);generated",
+        "kotlin.collections;ArraysKt;elementAtOrNull;(byte[],int);generated",
+        "kotlin.collections;ArraysKt;elementAtOrNull;(char[],int);generated",
+        "kotlin.collections;ArraysKt;elementAtOrNull;(double[],int);generated",
+        "kotlin.collections;ArraysKt;elementAtOrNull;(float[],int);generated",
+        "kotlin.collections;ArraysKt;elementAtOrNull;(int[],int);generated",
+        "kotlin.collections;ArraysKt;elementAtOrNull;(long[],int);generated",
+        "kotlin.collections;ArraysKt;elementAtOrNull;(short[],int);generated",
+        "kotlin.collections;ArraysKt;fill;(boolean[],boolean,int,int);generated",
+        "kotlin.collections;ArraysKt;fill;(byte[],byte,int,int);generated",
+        "kotlin.collections;ArraysKt;fill;(char[],char,int,int);generated",
+        "kotlin.collections;ArraysKt;fill;(double[],double,int,int);generated",
+        "kotlin.collections;ArraysKt;fill;(float[],float,int,int);generated",
+        "kotlin.collections;ArraysKt;fill;(int[],int,int,int);generated",
+        "kotlin.collections;ArraysKt;fill;(long[],long,int,int);generated",
+        "kotlin.collections;ArraysKt;fill;(short[],short,int,int);generated",
+        "kotlin.collections;ArraysKt;filter;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;filter;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;filter;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;filter;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;filter;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;filter;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;filter;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;filter;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;filter;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;filterIndexed;(Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;filterIndexed;(boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;filterIndexed;(byte[],Function2);generated",
+        "kotlin.collections;ArraysKt;filterIndexed;(char[],Function2);generated",
+        "kotlin.collections;ArraysKt;filterIndexed;(double[],Function2);generated",
+        "kotlin.collections;ArraysKt;filterIndexed;(float[],Function2);generated",
+        "kotlin.collections;ArraysKt;filterIndexed;(int[],Function2);generated",
+        "kotlin.collections;ArraysKt;filterIndexed;(long[],Function2);generated",
+        "kotlin.collections;ArraysKt;filterIndexed;(short[],Function2);generated",
+        "kotlin.collections;ArraysKt;filterIsInstance;(Object[]);generated",
+        "kotlin.collections;ArraysKt;filterIsInstance;(Object[],Class);generated",
+        "kotlin.collections;ArraysKt;filterNot;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;filterNot;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;filterNot;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;filterNot;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;filterNot;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;filterNot;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;filterNot;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;filterNot;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;filterNot;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;filterNotNull;(Object[]);generated",
+        "kotlin.collections;ArraysKt;find;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;find;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;find;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;find;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;find;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;find;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;find;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;find;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;find;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;findLast;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;findLast;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;findLast;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;findLast;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;findLast;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;findLast;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;findLast;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;findLast;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;first;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;first;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;first;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;first;(byte[]);generated",
+        "kotlin.collections;ArraysKt;first;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;first;(char[]);generated",
+        "kotlin.collections;ArraysKt;first;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;first;(double[]);generated",
+        "kotlin.collections;ArraysKt;first;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;first;(float[]);generated",
+        "kotlin.collections;ArraysKt;first;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;first;(int[]);generated",
+        "kotlin.collections;ArraysKt;first;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;first;(long[]);generated",
+        "kotlin.collections;ArraysKt;first;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;first;(short[]);generated",
+        "kotlin.collections;ArraysKt;first;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstNotNullOf;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstNotNullOfOrNull;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(byte[]);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(char[]);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(double[]);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(float[]);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(int[]);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(long[]);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(short[]);generated",
+        "kotlin.collections;ArraysKt;firstOrNull;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatMap;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatMap;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatMap;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatMap;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatMap;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatMap;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatMap;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatMap;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatMap;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatMapIndexedIterable;(Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;flatMapIndexedIterable;(boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;flatMapIndexedIterable;(byte[],Function2);generated",
+        "kotlin.collections;ArraysKt;flatMapIndexedIterable;(char[],Function2);generated",
+        "kotlin.collections;ArraysKt;flatMapIndexedIterable;(double[],Function2);generated",
+        "kotlin.collections;ArraysKt;flatMapIndexedIterable;(float[],Function2);generated",
+        "kotlin.collections;ArraysKt;flatMapIndexedIterable;(int[],Function2);generated",
+        "kotlin.collections;ArraysKt;flatMapIndexedIterable;(long[],Function2);generated",
+        "kotlin.collections;ArraysKt;flatMapIndexedIterable;(short[],Function2);generated",
+        "kotlin.collections;ArraysKt;flatMapIndexedSequence;(Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;flatMapSequence;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;flatten;(Object[][]);generated",
+        "kotlin.collections;ArraysKt;forEach;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;forEach;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;forEach;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;forEach;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;forEach;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;forEach;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;forEach;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;forEach;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;forEach;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;forEachIndexed;(Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;forEachIndexed;(boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;forEachIndexed;(byte[],Function2);generated",
+        "kotlin.collections;ArraysKt;forEachIndexed;(char[],Function2);generated",
+        "kotlin.collections;ArraysKt;forEachIndexed;(double[],Function2);generated",
+        "kotlin.collections;ArraysKt;forEachIndexed;(float[],Function2);generated",
+        "kotlin.collections;ArraysKt;forEachIndexed;(int[],Function2);generated",
+        "kotlin.collections;ArraysKt;forEachIndexed;(long[],Function2);generated",
+        "kotlin.collections;ArraysKt;forEachIndexed;(short[],Function2);generated",
+        "kotlin.collections;ArraysKt;getIndices;(Object[]);generated",
+        "kotlin.collections;ArraysKt;getIndices;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;getIndices;(byte[]);generated",
+        "kotlin.collections;ArraysKt;getIndices;(char[]);generated",
+        "kotlin.collections;ArraysKt;getIndices;(double[]);generated",
+        "kotlin.collections;ArraysKt;getIndices;(float[]);generated",
+        "kotlin.collections;ArraysKt;getIndices;(int[]);generated",
+        "kotlin.collections;ArraysKt;getIndices;(long[]);generated",
+        "kotlin.collections;ArraysKt;getIndices;(short[]);generated",
+        "kotlin.collections;ArraysKt;getLastIndex;(Object[]);generated",
+        "kotlin.collections;ArraysKt;getLastIndex;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;getLastIndex;(byte[]);generated",
+        "kotlin.collections;ArraysKt;getLastIndex;(char[]);generated",
+        "kotlin.collections;ArraysKt;getLastIndex;(double[]);generated",
+        "kotlin.collections;ArraysKt;getLastIndex;(float[]);generated",
+        "kotlin.collections;ArraysKt;getLastIndex;(int[]);generated",
+        "kotlin.collections;ArraysKt;getLastIndex;(long[]);generated",
+        "kotlin.collections;ArraysKt;getLastIndex;(short[]);generated",
+        "kotlin.collections;ArraysKt;getOrElse;(Object[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;getOrElse;(boolean[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;getOrElse;(byte[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;getOrElse;(char[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;getOrElse;(double[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;getOrElse;(float[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;getOrElse;(int[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;getOrElse;(long[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;getOrElse;(short[],int,Function1);generated",
+        "kotlin.collections;ArraysKt;getOrNull;(Object[],int);generated",
+        "kotlin.collections;ArraysKt;getOrNull;(boolean[],int);generated",
+        "kotlin.collections;ArraysKt;getOrNull;(byte[],int);generated",
+        "kotlin.collections;ArraysKt;getOrNull;(char[],int);generated",
+        "kotlin.collections;ArraysKt;getOrNull;(double[],int);generated",
+        "kotlin.collections;ArraysKt;getOrNull;(float[],int);generated",
+        "kotlin.collections;ArraysKt;getOrNull;(int[],int);generated",
+        "kotlin.collections;ArraysKt;getOrNull;(long[],int);generated",
+        "kotlin.collections;ArraysKt;getOrNull;(short[],int);generated",
+        "kotlin.collections;ArraysKt;groupBy;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(Object[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(boolean[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(byte[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(char[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(double[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(float[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(int[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(long[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;groupBy;(short[],Function1,Function1);generated",
+        "kotlin.collections;ArraysKt;groupingBy;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOf;(Object[],Object);generated",
+        "kotlin.collections;ArraysKt;indexOf;(boolean[],boolean);generated",
+        "kotlin.collections;ArraysKt;indexOf;(byte[],byte);generated",
+        "kotlin.collections;ArraysKt;indexOf;(char[],char);generated",
+        "kotlin.collections;ArraysKt;indexOf;(double[],double);generated",
+        "kotlin.collections;ArraysKt;indexOf;(float[],float);generated",
+        "kotlin.collections;ArraysKt;indexOf;(int[],int);generated",
+        "kotlin.collections;ArraysKt;indexOf;(long[],long);generated",
+        "kotlin.collections;ArraysKt;indexOf;(short[],short);generated",
+        "kotlin.collections;ArraysKt;indexOfFirst;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfFirst;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfFirst;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfFirst;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfFirst;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfFirst;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfFirst;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfFirst;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfFirst;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfLast;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfLast;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfLast;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfLast;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfLast;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfLast;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfLast;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfLast;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;indexOfLast;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;intersect;(Object[],Iterable);generated",
+        "kotlin.collections;ArraysKt;intersect;(boolean[],Iterable);generated",
+        "kotlin.collections;ArraysKt;intersect;(byte[],Iterable);generated",
+        "kotlin.collections;ArraysKt;intersect;(char[],Iterable);generated",
+        "kotlin.collections;ArraysKt;intersect;(double[],Iterable);generated",
+        "kotlin.collections;ArraysKt;intersect;(float[],Iterable);generated",
+        "kotlin.collections;ArraysKt;intersect;(int[],Iterable);generated",
+        "kotlin.collections;ArraysKt;intersect;(long[],Iterable);generated",
+        "kotlin.collections;ArraysKt;intersect;(short[],Iterable);generated",
+        "kotlin.collections;ArraysKt;isEmpty;(Object[]);generated",
+        "kotlin.collections;ArraysKt;isEmpty;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;isEmpty;(byte[]);generated",
+        "kotlin.collections;ArraysKt;isEmpty;(char[]);generated",
+        "kotlin.collections;ArraysKt;isEmpty;(double[]);generated",
+        "kotlin.collections;ArraysKt;isEmpty;(float[]);generated",
+        "kotlin.collections;ArraysKt;isEmpty;(int[]);generated",
+        "kotlin.collections;ArraysKt;isEmpty;(long[]);generated",
+        "kotlin.collections;ArraysKt;isEmpty;(short[]);generated",
+        "kotlin.collections;ArraysKt;isNotEmpty;(Object[]);generated",
+        "kotlin.collections;ArraysKt;isNotEmpty;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;isNotEmpty;(byte[]);generated",
+        "kotlin.collections;ArraysKt;isNotEmpty;(char[]);generated",
+        "kotlin.collections;ArraysKt;isNotEmpty;(double[]);generated",
+        "kotlin.collections;ArraysKt;isNotEmpty;(float[]);generated",
+        "kotlin.collections;ArraysKt;isNotEmpty;(int[]);generated",
+        "kotlin.collections;ArraysKt;isNotEmpty;(long[]);generated",
+        "kotlin.collections;ArraysKt;isNotEmpty;(short[]);generated",
+        "kotlin.collections;ArraysKt;isNullOrEmpty;(Object[]);generated",
+        "kotlin.collections;ArraysKt;last;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;last;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;last;(byte[]);generated",
+        "kotlin.collections;ArraysKt;last;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;last;(char[]);generated",
+        "kotlin.collections;ArraysKt;last;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;last;(double[]);generated",
+        "kotlin.collections;ArraysKt;last;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;last;(float[]);generated",
+        "kotlin.collections;ArraysKt;last;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;last;(int[]);generated",
+        "kotlin.collections;ArraysKt;last;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;last;(long[]);generated",
+        "kotlin.collections;ArraysKt;last;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;last;(short[]);generated",
+        "kotlin.collections;ArraysKt;last;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;lastIndexOf;(Object[],Object);generated",
+        "kotlin.collections;ArraysKt;lastIndexOf;(boolean[],boolean);generated",
+        "kotlin.collections;ArraysKt;lastIndexOf;(byte[],byte);generated",
+        "kotlin.collections;ArraysKt;lastIndexOf;(char[],char);generated",
+        "kotlin.collections;ArraysKt;lastIndexOf;(double[],double);generated",
+        "kotlin.collections;ArraysKt;lastIndexOf;(float[],float);generated",
+        "kotlin.collections;ArraysKt;lastIndexOf;(int[],int);generated",
+        "kotlin.collections;ArraysKt;lastIndexOf;(long[],long);generated",
+        "kotlin.collections;ArraysKt;lastIndexOf;(short[],short);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(byte[]);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(char[]);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(double[]);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(float[]);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(int[]);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(long[]);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(short[]);generated",
+        "kotlin.collections;ArraysKt;lastOrNull;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;map;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;map;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;map;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;map;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;map;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;map;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;map;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;map;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;map;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;mapIndexed;(Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;mapIndexed;(boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;mapIndexed;(byte[],Function2);generated",
+        "kotlin.collections;ArraysKt;mapIndexed;(char[],Function2);generated",
+        "kotlin.collections;ArraysKt;mapIndexed;(double[],Function2);generated",
+        "kotlin.collections;ArraysKt;mapIndexed;(float[],Function2);generated",
+        "kotlin.collections;ArraysKt;mapIndexed;(int[],Function2);generated",
+        "kotlin.collections;ArraysKt;mapIndexed;(long[],Function2);generated",
+        "kotlin.collections;ArraysKt;mapIndexed;(short[],Function2);generated",
+        "kotlin.collections;ArraysKt;mapIndexedNotNull;(Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;mapNotNull;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;max;(Double[]);generated",
+        "kotlin.collections;ArraysKt;max;(Float[]);generated",
+        "kotlin.collections;ArraysKt;max;(byte[]);generated",
+        "kotlin.collections;ArraysKt;max;(char[]);generated",
+        "kotlin.collections;ArraysKt;max;(double[]);generated",
+        "kotlin.collections;ArraysKt;max;(float[]);generated",
+        "kotlin.collections;ArraysKt;max;(int[]);generated",
+        "kotlin.collections;ArraysKt;max;(long[]);generated",
+        "kotlin.collections;ArraysKt;max;(short[]);generated",
+        "kotlin.collections;ArraysKt;maxBy;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxBy;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxBy;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxBy;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxBy;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxBy;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxBy;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxBy;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrNull;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrNull;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrNull;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrNull;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrNull;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrNull;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrNull;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrNull;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrThrow;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrThrow;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrThrow;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrThrow;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrThrow;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrThrow;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrThrow;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxByOrThrow;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOf;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOf;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOf;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOf;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOf;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOf;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOf;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOf;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOf;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfOrNull;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfOrNull;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfOrNull;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfOrNull;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfOrNull;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfOrNull;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfOrNull;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfOrNull;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfOrNull;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWith;(boolean[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWith;(byte[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWith;(char[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWith;(double[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWith;(float[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWith;(int[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWith;(long[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWith;(short[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWithOrNull;(boolean[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWithOrNull;(byte[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWithOrNull;(char[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWithOrNull;(double[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWithOrNull;(float[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWithOrNull;(int[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWithOrNull;(long[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOfWithOrNull;(short[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;maxOrNull;(Double[]);generated",
+        "kotlin.collections;ArraysKt;maxOrNull;(Float[]);generated",
+        "kotlin.collections;ArraysKt;maxOrNull;(byte[]);generated",
+        "kotlin.collections;ArraysKt;maxOrNull;(char[]);generated",
+        "kotlin.collections;ArraysKt;maxOrNull;(double[]);generated",
+        "kotlin.collections;ArraysKt;maxOrNull;(float[]);generated",
+        "kotlin.collections;ArraysKt;maxOrNull;(int[]);generated",
+        "kotlin.collections;ArraysKt;maxOrNull;(long[]);generated",
+        "kotlin.collections;ArraysKt;maxOrNull;(short[]);generated",
+        "kotlin.collections;ArraysKt;maxOrThrow;(Double[]);generated",
+        "kotlin.collections;ArraysKt;maxOrThrow;(Float[]);generated",
+        "kotlin.collections;ArraysKt;maxOrThrow;(byte[]);generated",
+        "kotlin.collections;ArraysKt;maxOrThrow;(char[]);generated",
+        "kotlin.collections;ArraysKt;maxOrThrow;(double[]);generated",
+        "kotlin.collections;ArraysKt;maxOrThrow;(float[]);generated",
+        "kotlin.collections;ArraysKt;maxOrThrow;(int[]);generated",
+        "kotlin.collections;ArraysKt;maxOrThrow;(long[]);generated",
+        "kotlin.collections;ArraysKt;maxOrThrow;(short[]);generated",
+        "kotlin.collections;ArraysKt;maxWith;(boolean[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWith;(byte[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWith;(char[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWith;(double[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWith;(float[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWith;(int[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWith;(long[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWith;(short[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrNull;(boolean[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrNull;(byte[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrNull;(char[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrNull;(double[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrNull;(float[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrNull;(int[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrNull;(long[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrNull;(short[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrThrow;(boolean[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrThrow;(byte[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrThrow;(char[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrThrow;(double[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrThrow;(float[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrThrow;(int[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrThrow;(long[],Comparator);generated",
+        "kotlin.collections;ArraysKt;maxWithOrThrow;(short[],Comparator);generated",
+        "kotlin.collections;ArraysKt;min;(Double[]);generated",
+        "kotlin.collections;ArraysKt;min;(Float[]);generated",
+        "kotlin.collections;ArraysKt;min;(byte[]);generated",
+        "kotlin.collections;ArraysKt;min;(char[]);generated",
+        "kotlin.collections;ArraysKt;min;(double[]);generated",
+        "kotlin.collections;ArraysKt;min;(float[]);generated",
+        "kotlin.collections;ArraysKt;min;(int[]);generated",
+        "kotlin.collections;ArraysKt;min;(long[]);generated",
+        "kotlin.collections;ArraysKt;min;(short[]);generated",
+        "kotlin.collections;ArraysKt;minBy;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;minBy;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;minBy;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;minBy;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;minBy;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;minBy;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;minBy;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;minBy;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrNull;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrNull;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrNull;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrNull;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrNull;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrNull;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrNull;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrNull;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrThrow;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrThrow;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrThrow;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrThrow;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrThrow;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrThrow;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrThrow;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;minByOrThrow;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOf;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOf;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOf;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOf;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOf;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOf;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOf;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOf;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOf;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOfOrNull;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOfOrNull;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOfOrNull;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOfOrNull;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOfOrNull;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOfOrNull;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOfOrNull;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOfOrNull;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOfOrNull;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWith;(boolean[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWith;(byte[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWith;(char[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWith;(double[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWith;(float[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWith;(int[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWith;(long[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWith;(short[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWithOrNull;(boolean[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWithOrNull;(byte[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWithOrNull;(char[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWithOrNull;(double[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWithOrNull;(float[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWithOrNull;(int[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWithOrNull;(long[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOfWithOrNull;(short[],Comparator,Function1);generated",
+        "kotlin.collections;ArraysKt;minOrNull;(Double[]);generated",
+        "kotlin.collections;ArraysKt;minOrNull;(Float[]);generated",
+        "kotlin.collections;ArraysKt;minOrNull;(byte[]);generated",
+        "kotlin.collections;ArraysKt;minOrNull;(char[]);generated",
+        "kotlin.collections;ArraysKt;minOrNull;(double[]);generated",
+        "kotlin.collections;ArraysKt;minOrNull;(float[]);generated",
+        "kotlin.collections;ArraysKt;minOrNull;(int[]);generated",
+        "kotlin.collections;ArraysKt;minOrNull;(long[]);generated",
+        "kotlin.collections;ArraysKt;minOrNull;(short[]);generated",
+        "kotlin.collections;ArraysKt;minOrThrow;(Double[]);generated",
+        "kotlin.collections;ArraysKt;minOrThrow;(Float[]);generated",
+        "kotlin.collections;ArraysKt;minOrThrow;(byte[]);generated",
+        "kotlin.collections;ArraysKt;minOrThrow;(char[]);generated",
+        "kotlin.collections;ArraysKt;minOrThrow;(double[]);generated",
+        "kotlin.collections;ArraysKt;minOrThrow;(float[]);generated",
+        "kotlin.collections;ArraysKt;minOrThrow;(int[]);generated",
+        "kotlin.collections;ArraysKt;minOrThrow;(long[]);generated",
+        "kotlin.collections;ArraysKt;minOrThrow;(short[]);generated",
+        "kotlin.collections;ArraysKt;minWith;(boolean[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWith;(byte[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWith;(char[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWith;(double[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWith;(float[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWith;(int[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWith;(long[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWith;(short[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrNull;(boolean[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrNull;(byte[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrNull;(char[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrNull;(double[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrNull;(float[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrNull;(int[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrNull;(long[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrNull;(short[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrThrow;(boolean[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrThrow;(byte[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrThrow;(char[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrThrow;(double[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrThrow;(float[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrThrow;(int[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrThrow;(long[],Comparator);generated",
+        "kotlin.collections;ArraysKt;minWithOrThrow;(short[],Comparator);generated",
+        "kotlin.collections;ArraysKt;none;(Object[]);generated",
+        "kotlin.collections;ArraysKt;none;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;none;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;none;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;none;(byte[]);generated",
+        "kotlin.collections;ArraysKt;none;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;none;(char[]);generated",
+        "kotlin.collections;ArraysKt;none;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;none;(double[]);generated",
+        "kotlin.collections;ArraysKt;none;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;none;(float[]);generated",
+        "kotlin.collections;ArraysKt;none;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;none;(int[]);generated",
+        "kotlin.collections;ArraysKt;none;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;none;(long[]);generated",
+        "kotlin.collections;ArraysKt;none;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;none;(short[]);generated",
+        "kotlin.collections;ArraysKt;none;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;onEach;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;onEach;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;onEach;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;onEach;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;onEach;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;onEach;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;onEachIndexed;(boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;onEachIndexed;(double[],Function2);generated",
+        "kotlin.collections;ArraysKt;onEachIndexed;(float[],Function2);generated",
+        "kotlin.collections;ArraysKt;onEachIndexed;(int[],Function2);generated",
+        "kotlin.collections;ArraysKt;onEachIndexed;(long[],Function2);generated",
+        "kotlin.collections;ArraysKt;onEachIndexed;(short[],Function2);generated",
+        "kotlin.collections;ArraysKt;partition;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;partition;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;partition;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;partition;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;partition;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;partition;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;partition;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;partition;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;partition;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;plus;(boolean[],Collection);generated",
+        "kotlin.collections;ArraysKt;plus;(boolean[],boolean);generated",
+        "kotlin.collections;ArraysKt;plus;(boolean[],boolean[]);generated",
+        "kotlin.collections;ArraysKt;plus;(double[],Collection);generated",
+        "kotlin.collections;ArraysKt;plus;(double[],double);generated",
+        "kotlin.collections;ArraysKt;plus;(double[],double[]);generated",
+        "kotlin.collections;ArraysKt;plus;(float[],Collection);generated",
+        "kotlin.collections;ArraysKt;plus;(float[],float);generated",
+        "kotlin.collections;ArraysKt;plus;(float[],float[]);generated",
+        "kotlin.collections;ArraysKt;plus;(int[],Collection);generated",
+        "kotlin.collections;ArraysKt;plus;(int[],int);generated",
+        "kotlin.collections;ArraysKt;plus;(int[],int[]);generated",
+        "kotlin.collections;ArraysKt;plus;(long[],Collection);generated",
+        "kotlin.collections;ArraysKt;plus;(long[],long);generated",
+        "kotlin.collections;ArraysKt;plus;(long[],long[]);generated",
+        "kotlin.collections;ArraysKt;plus;(short[],Collection);generated",
+        "kotlin.collections;ArraysKt;plus;(short[],short);generated",
+        "kotlin.collections;ArraysKt;plus;(short[],short[]);generated",
+        "kotlin.collections;ArraysKt;random;(Object[]);generated",
+        "kotlin.collections;ArraysKt;random;(Object[],Random);generated",
+        "kotlin.collections;ArraysKt;random;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;random;(boolean[],Random);generated",
+        "kotlin.collections;ArraysKt;random;(byte[]);generated",
+        "kotlin.collections;ArraysKt;random;(byte[],Random);generated",
+        "kotlin.collections;ArraysKt;random;(char[]);generated",
+        "kotlin.collections;ArraysKt;random;(char[],Random);generated",
+        "kotlin.collections;ArraysKt;random;(double[]);generated",
+        "kotlin.collections;ArraysKt;random;(double[],Random);generated",
+        "kotlin.collections;ArraysKt;random;(float[]);generated",
+        "kotlin.collections;ArraysKt;random;(float[],Random);generated",
+        "kotlin.collections;ArraysKt;random;(int[]);generated",
+        "kotlin.collections;ArraysKt;random;(int[],Random);generated",
+        "kotlin.collections;ArraysKt;random;(long[]);generated",
+        "kotlin.collections;ArraysKt;random;(long[],Random);generated",
+        "kotlin.collections;ArraysKt;random;(short[]);generated",
+        "kotlin.collections;ArraysKt;random;(short[],Random);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(Object[]);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(Object[],Random);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(boolean[],Random);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(byte[]);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(byte[],Random);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(char[]);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(char[],Random);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(double[]);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(double[],Random);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(float[]);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(float[],Random);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(int[]);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(int[],Random);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(long[]);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(long[],Random);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(short[]);generated",
+        "kotlin.collections;ArraysKt;randomOrNull;(short[],Random);generated",
+        "kotlin.collections;ArraysKt;reduce;(boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduce;(byte[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduce;(char[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduce;(double[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduce;(float[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduce;(int[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduce;(long[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduce;(short[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceIndexed;(boolean[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexed;(byte[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexed;(char[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexed;(double[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexed;(float[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexed;(int[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexed;(long[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexed;(short[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexedOrNull;(boolean[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexedOrNull;(byte[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexedOrNull;(char[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexedOrNull;(double[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexedOrNull;(float[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexedOrNull;(int[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexedOrNull;(long[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceIndexedOrNull;(short[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceOrNull;(boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceOrNull;(byte[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceOrNull;(char[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceOrNull;(double[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceOrNull;(float[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceOrNull;(int[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceOrNull;(long[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceOrNull;(short[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRight;(Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRight;(boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRight;(byte[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRight;(char[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRight;(double[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRight;(float[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRight;(int[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRight;(long[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRight;(short[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexed;(Object[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexed;(boolean[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexed;(byte[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexed;(char[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexed;(double[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexed;(float[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexed;(int[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexed;(long[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexed;(short[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexedOrNull;(Object[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexedOrNull;(boolean[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexedOrNull;(byte[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexedOrNull;(char[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexedOrNull;(double[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexedOrNull;(float[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexedOrNull;(int[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexedOrNull;(long[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightIndexedOrNull;(short[],Function3);generated",
+        "kotlin.collections;ArraysKt;reduceRightOrNull;(Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRightOrNull;(boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRightOrNull;(byte[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRightOrNull;(char[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRightOrNull;(double[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRightOrNull;(float[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRightOrNull;(int[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRightOrNull;(long[],Function2);generated",
+        "kotlin.collections;ArraysKt;reduceRightOrNull;(short[],Function2);generated",
+        "kotlin.collections;ArraysKt;reverse;(Object[]);generated",
+        "kotlin.collections;ArraysKt;reverse;(Object[],int,int);generated",
+        "kotlin.collections;ArraysKt;reverse;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;reverse;(boolean[],int,int);generated",
+        "kotlin.collections;ArraysKt;reverse;(byte[]);generated",
+        "kotlin.collections;ArraysKt;reverse;(byte[],int,int);generated",
+        "kotlin.collections;ArraysKt;reverse;(char[]);generated",
+        "kotlin.collections;ArraysKt;reverse;(char[],int,int);generated",
+        "kotlin.collections;ArraysKt;reverse;(double[]);generated",
+        "kotlin.collections;ArraysKt;reverse;(double[],int,int);generated",
+        "kotlin.collections;ArraysKt;reverse;(float[]);generated",
+        "kotlin.collections;ArraysKt;reverse;(float[],int,int);generated",
+        "kotlin.collections;ArraysKt;reverse;(int[]);generated",
+        "kotlin.collections;ArraysKt;reverse;(int[],int,int);generated",
+        "kotlin.collections;ArraysKt;reverse;(long[]);generated",
+        "kotlin.collections;ArraysKt;reverse;(long[],int,int);generated",
+        "kotlin.collections;ArraysKt;reverse;(short[]);generated",
+        "kotlin.collections;ArraysKt;reverse;(short[],int,int);generated",
+        "kotlin.collections;ArraysKt;reversed;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;reversed;(byte[]);generated",
+        "kotlin.collections;ArraysKt;reversed;(char[]);generated",
+        "kotlin.collections;ArraysKt;reversed;(double[]);generated",
+        "kotlin.collections;ArraysKt;reversed;(float[]);generated",
+        "kotlin.collections;ArraysKt;reversed;(int[]);generated",
+        "kotlin.collections;ArraysKt;reversed;(long[]);generated",
+        "kotlin.collections;ArraysKt;reversed;(short[]);generated",
+        "kotlin.collections;ArraysKt;reversedArray;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;reversedArray;(double[]);generated",
+        "kotlin.collections;ArraysKt;reversedArray;(float[]);generated",
+        "kotlin.collections;ArraysKt;reversedArray;(int[]);generated",
+        "kotlin.collections;ArraysKt;reversedArray;(long[]);generated",
+        "kotlin.collections;ArraysKt;reversedArray;(short[]);generated",
+        "kotlin.collections;ArraysKt;runningReduce;(Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;runningReduce;(boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;runningReduce;(byte[],Function2);generated",
+        "kotlin.collections;ArraysKt;runningReduce;(char[],Function2);generated",
+        "kotlin.collections;ArraysKt;runningReduce;(double[],Function2);generated",
+        "kotlin.collections;ArraysKt;runningReduce;(float[],Function2);generated",
+        "kotlin.collections;ArraysKt;runningReduce;(int[],Function2);generated",
+        "kotlin.collections;ArraysKt;runningReduce;(long[],Function2);generated",
+        "kotlin.collections;ArraysKt;runningReduce;(short[],Function2);generated",
+        "kotlin.collections;ArraysKt;runningReduceIndexed;(Object[],Function3);generated",
+        "kotlin.collections;ArraysKt;runningReduceIndexed;(boolean[],Function3);generated",
+        "kotlin.collections;ArraysKt;runningReduceIndexed;(byte[],Function3);generated",
+        "kotlin.collections;ArraysKt;runningReduceIndexed;(char[],Function3);generated",
+        "kotlin.collections;ArraysKt;runningReduceIndexed;(double[],Function3);generated",
+        "kotlin.collections;ArraysKt;runningReduceIndexed;(float[],Function3);generated",
+        "kotlin.collections;ArraysKt;runningReduceIndexed;(int[],Function3);generated",
+        "kotlin.collections;ArraysKt;runningReduceIndexed;(long[],Function3);generated",
+        "kotlin.collections;ArraysKt;runningReduceIndexed;(short[],Function3);generated",
+        "kotlin.collections;ArraysKt;shuffle;(Object[]);generated",
+        "kotlin.collections;ArraysKt;shuffle;(Object[],Random);generated",
+        "kotlin.collections;ArraysKt;shuffle;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;shuffle;(boolean[],Random);generated",
+        "kotlin.collections;ArraysKt;shuffle;(byte[]);generated",
+        "kotlin.collections;ArraysKt;shuffle;(byte[],Random);generated",
+        "kotlin.collections;ArraysKt;shuffle;(char[]);generated",
+        "kotlin.collections;ArraysKt;shuffle;(char[],Random);generated",
+        "kotlin.collections;ArraysKt;shuffle;(double[]);generated",
+        "kotlin.collections;ArraysKt;shuffle;(double[],Random);generated",
+        "kotlin.collections;ArraysKt;shuffle;(float[]);generated",
+        "kotlin.collections;ArraysKt;shuffle;(float[],Random);generated",
+        "kotlin.collections;ArraysKt;shuffle;(int[]);generated",
+        "kotlin.collections;ArraysKt;shuffle;(int[],Random);generated",
+        "kotlin.collections;ArraysKt;shuffle;(long[]);generated",
+        "kotlin.collections;ArraysKt;shuffle;(long[],Random);generated",
+        "kotlin.collections;ArraysKt;shuffle;(short[]);generated",
+        "kotlin.collections;ArraysKt;shuffle;(short[],Random);generated",
+        "kotlin.collections;ArraysKt;single;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;single;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;single;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;single;(byte[]);generated",
+        "kotlin.collections;ArraysKt;single;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;single;(char[]);generated",
+        "kotlin.collections;ArraysKt;single;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;single;(double[]);generated",
+        "kotlin.collections;ArraysKt;single;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;single;(float[]);generated",
+        "kotlin.collections;ArraysKt;single;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;single;(int[]);generated",
+        "kotlin.collections;ArraysKt;single;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;single;(long[]);generated",
+        "kotlin.collections;ArraysKt;single;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;single;(short[]);generated",
+        "kotlin.collections;ArraysKt;single;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(byte[]);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(char[]);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(double[]);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(float[]);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(int[]);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(long[]);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(short[]);generated",
+        "kotlin.collections;ArraysKt;singleOrNull;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;slice;(Object[],Iterable);generated",
+        "kotlin.collections;ArraysKt;slice;(boolean[],IntRange);generated",
+        "kotlin.collections;ArraysKt;slice;(boolean[],Iterable);generated",
+        "kotlin.collections;ArraysKt;slice;(byte[],IntRange);generated",
+        "kotlin.collections;ArraysKt;slice;(byte[],Iterable);generated",
+        "kotlin.collections;ArraysKt;slice;(char[],IntRange);generated",
+        "kotlin.collections;ArraysKt;slice;(char[],Iterable);generated",
+        "kotlin.collections;ArraysKt;slice;(double[],IntRange);generated",
+        "kotlin.collections;ArraysKt;slice;(double[],Iterable);generated",
+        "kotlin.collections;ArraysKt;slice;(float[],IntRange);generated",
+        "kotlin.collections;ArraysKt;slice;(float[],Iterable);generated",
+        "kotlin.collections;ArraysKt;slice;(int[],IntRange);generated",
+        "kotlin.collections;ArraysKt;slice;(int[],Iterable);generated",
+        "kotlin.collections;ArraysKt;slice;(long[],IntRange);generated",
+        "kotlin.collections;ArraysKt;slice;(long[],Iterable);generated",
+        "kotlin.collections;ArraysKt;slice;(short[],IntRange);generated",
+        "kotlin.collections;ArraysKt;slice;(short[],Iterable);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(boolean[],Collection);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(boolean[],IntRange);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(byte[],Collection);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(char[],Collection);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(double[],Collection);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(double[],IntRange);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(float[],Collection);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(float[],IntRange);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(int[],Collection);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(int[],IntRange);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(long[],Collection);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(long[],IntRange);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(short[],Collection);generated",
+        "kotlin.collections;ArraysKt;sliceArray;(short[],IntRange);generated",
+        "kotlin.collections;ArraysKt;sort;(Comparable[]);generated",
+        "kotlin.collections;ArraysKt;sort;(Comparable[],int,int);generated",
+        "kotlin.collections;ArraysKt;sort;(Object[]);generated",
+        "kotlin.collections;ArraysKt;sort;(Object[],int,int);generated",
+        "kotlin.collections;ArraysKt;sort;(byte[]);generated",
+        "kotlin.collections;ArraysKt;sort;(byte[],int,int);generated",
+        "kotlin.collections;ArraysKt;sort;(char[]);generated",
+        "kotlin.collections;ArraysKt;sort;(char[],int,int);generated",
+        "kotlin.collections;ArraysKt;sort;(double[]);generated",
+        "kotlin.collections;ArraysKt;sort;(double[],int,int);generated",
+        "kotlin.collections;ArraysKt;sort;(float[]);generated",
+        "kotlin.collections;ArraysKt;sort;(float[],int,int);generated",
+        "kotlin.collections;ArraysKt;sort;(int[]);generated",
+        "kotlin.collections;ArraysKt;sort;(int[],int,int);generated",
+        "kotlin.collections;ArraysKt;sort;(long[]);generated",
+        "kotlin.collections;ArraysKt;sort;(long[],int,int);generated",
+        "kotlin.collections;ArraysKt;sort;(short[]);generated",
+        "kotlin.collections;ArraysKt;sort;(short[],int,int);generated",
+        "kotlin.collections;ArraysKt;sortBy;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortByDescending;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(Comparable[]);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(Comparable[],int,int);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(byte[]);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(byte[],int,int);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(char[]);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(char[],int,int);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(double[]);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(double[],int,int);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(float[]);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(float[],int,int);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(int[]);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(int[],int,int);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(long[]);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(long[],int,int);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(short[]);generated",
+        "kotlin.collections;ArraysKt;sortDescending;(short[],int,int);generated",
+        "kotlin.collections;ArraysKt;sortWith;(Object[],Comparator);generated",
+        "kotlin.collections;ArraysKt;sortWith;(Object[],Comparator,int,int);generated",
+        "kotlin.collections;ArraysKt;sorted;(byte[]);generated",
+        "kotlin.collections;ArraysKt;sorted;(char[]);generated",
+        "kotlin.collections;ArraysKt;sorted;(double[]);generated",
+        "kotlin.collections;ArraysKt;sorted;(float[]);generated",
+        "kotlin.collections;ArraysKt;sorted;(int[]);generated",
+        "kotlin.collections;ArraysKt;sorted;(long[]);generated",
+        "kotlin.collections;ArraysKt;sorted;(short[]);generated",
+        "kotlin.collections;ArraysKt;sortedArray;(double[]);generated",
+        "kotlin.collections;ArraysKt;sortedArray;(float[]);generated",
+        "kotlin.collections;ArraysKt;sortedArray;(int[]);generated",
+        "kotlin.collections;ArraysKt;sortedArray;(long[]);generated",
+        "kotlin.collections;ArraysKt;sortedArray;(short[]);generated",
+        "kotlin.collections;ArraysKt;sortedArrayDescending;(double[]);generated",
+        "kotlin.collections;ArraysKt;sortedArrayDescending;(float[]);generated",
+        "kotlin.collections;ArraysKt;sortedArrayDescending;(int[]);generated",
+        "kotlin.collections;ArraysKt;sortedArrayDescending;(long[]);generated",
+        "kotlin.collections;ArraysKt;sortedArrayDescending;(short[]);generated",
+        "kotlin.collections;ArraysKt;sortedBy;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedBy;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedBy;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedBy;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedBy;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedBy;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedBy;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedBy;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedByDescending;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedByDescending;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedByDescending;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedByDescending;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedByDescending;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedByDescending;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedByDescending;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedByDescending;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;sortedDescending;(byte[]);generated",
+        "kotlin.collections;ArraysKt;sortedDescending;(char[]);generated",
+        "kotlin.collections;ArraysKt;sortedDescending;(double[]);generated",
+        "kotlin.collections;ArraysKt;sortedDescending;(float[]);generated",
+        "kotlin.collections;ArraysKt;sortedDescending;(int[]);generated",
+        "kotlin.collections;ArraysKt;sortedDescending;(long[]);generated",
+        "kotlin.collections;ArraysKt;sortedDescending;(short[]);generated",
+        "kotlin.collections;ArraysKt;sortedWith;(boolean[],Comparator);generated",
+        "kotlin.collections;ArraysKt;sortedWith;(byte[],Comparator);generated",
+        "kotlin.collections;ArraysKt;sortedWith;(char[],Comparator);generated",
+        "kotlin.collections;ArraysKt;sortedWith;(double[],Comparator);generated",
+        "kotlin.collections;ArraysKt;sortedWith;(float[],Comparator);generated",
+        "kotlin.collections;ArraysKt;sortedWith;(int[],Comparator);generated",
+        "kotlin.collections;ArraysKt;sortedWith;(long[],Comparator);generated",
+        "kotlin.collections;ArraysKt;sortedWith;(short[],Comparator);generated",
+        "kotlin.collections;ArraysKt;subtract;(Object[],Iterable);generated",
+        "kotlin.collections;ArraysKt;subtract;(boolean[],Iterable);generated",
+        "kotlin.collections;ArraysKt;subtract;(byte[],Iterable);generated",
+        "kotlin.collections;ArraysKt;subtract;(char[],Iterable);generated",
+        "kotlin.collections;ArraysKt;subtract;(double[],Iterable);generated",
+        "kotlin.collections;ArraysKt;subtract;(float[],Iterable);generated",
+        "kotlin.collections;ArraysKt;subtract;(int[],Iterable);generated",
+        "kotlin.collections;ArraysKt;subtract;(long[],Iterable);generated",
+        "kotlin.collections;ArraysKt;subtract;(short[],Iterable);generated",
+        "kotlin.collections;ArraysKt;sum;(byte[]);generated",
+        "kotlin.collections;ArraysKt;sum;(double[]);generated",
+        "kotlin.collections;ArraysKt;sum;(float[]);generated",
+        "kotlin.collections;ArraysKt;sum;(int[]);generated",
+        "kotlin.collections;ArraysKt;sum;(long[]);generated",
+        "kotlin.collections;ArraysKt;sum;(short[]);generated",
+        "kotlin.collections;ArraysKt;sumBy;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumBy;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumBy;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumBy;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumBy;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumBy;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumBy;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumBy;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumBy;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumByDouble;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumByDouble;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumByDouble;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumByDouble;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumByDouble;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumByDouble;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumByDouble;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumByDouble;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumByDouble;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigDecimal;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigDecimal;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigDecimal;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigDecimal;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigDecimal;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigDecimal;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigDecimal;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigDecimal;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigDecimal;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigInteger;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigInteger;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigInteger;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigInteger;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigInteger;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigInteger;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigInteger;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigInteger;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfBigInteger;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfByte;(Byte[]);generated",
+        "kotlin.collections;ArraysKt;sumOfDouble;(Double[]);generated",
+        "kotlin.collections;ArraysKt;sumOfDouble;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfDouble;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfDouble;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfDouble;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfDouble;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfDouble;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfDouble;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfDouble;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfDouble;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfFloat;(Float[]);generated",
+        "kotlin.collections;ArraysKt;sumOfInt;(Integer[]);generated",
+        "kotlin.collections;ArraysKt;sumOfInt;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfInt;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfInt;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfInt;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfInt;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfInt;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfInt;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfInt;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfInt;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfLong;(Long[]);generated",
+        "kotlin.collections;ArraysKt;sumOfLong;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfLong;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfLong;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfLong;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfLong;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfLong;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfLong;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfLong;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfLong;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfShort;(Short[]);generated",
+        "kotlin.collections;ArraysKt;sumOfUInt;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfUInt;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfUInt;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfUInt;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfUInt;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfUInt;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfUInt;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfUInt;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfUInt;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfULong;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfULong;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfULong;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfULong;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfULong;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfULong;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfULong;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfULong;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;sumOfULong;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;take;(boolean[],int);generated",
+        "kotlin.collections;ArraysKt;take;(byte[],int);generated",
+        "kotlin.collections;ArraysKt;take;(char[],int);generated",
+        "kotlin.collections;ArraysKt;take;(double[],int);generated",
+        "kotlin.collections;ArraysKt;take;(float[],int);generated",
+        "kotlin.collections;ArraysKt;take;(int[],int);generated",
+        "kotlin.collections;ArraysKt;take;(long[],int);generated",
+        "kotlin.collections;ArraysKt;take;(short[],int);generated",
+        "kotlin.collections;ArraysKt;takeLast;(boolean[],int);generated",
+        "kotlin.collections;ArraysKt;takeLast;(byte[],int);generated",
+        "kotlin.collections;ArraysKt;takeLast;(char[],int);generated",
+        "kotlin.collections;ArraysKt;takeLast;(double[],int);generated",
+        "kotlin.collections;ArraysKt;takeLast;(float[],int);generated",
+        "kotlin.collections;ArraysKt;takeLast;(int[],int);generated",
+        "kotlin.collections;ArraysKt;takeLast;(long[],int);generated",
+        "kotlin.collections;ArraysKt;takeLast;(short[],int);generated",
+        "kotlin.collections;ArraysKt;takeLastWhile;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeLastWhile;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeLastWhile;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeLastWhile;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeLastWhile;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeLastWhile;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeLastWhile;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeLastWhile;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeWhile;(Object[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeWhile;(boolean[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeWhile;(byte[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeWhile;(char[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeWhile;(double[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeWhile;(float[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeWhile;(int[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeWhile;(long[],Function1);generated",
+        "kotlin.collections;ArraysKt;takeWhile;(short[],Function1);generated",
+        "kotlin.collections;ArraysKt;toBooleanArray;(Boolean[]);generated",
+        "kotlin.collections;ArraysKt;toByteArray;(Byte[]);generated",
+        "kotlin.collections;ArraysKt;toCharArray;(Character[]);generated",
+        "kotlin.collections;ArraysKt;toDoubleArray;(Double[]);generated",
+        "kotlin.collections;ArraysKt;toFloatArray;(Float[]);generated",
+        "kotlin.collections;ArraysKt;toHashSet;(Object[]);generated",
+        "kotlin.collections;ArraysKt;toHashSet;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;toHashSet;(byte[]);generated",
+        "kotlin.collections;ArraysKt;toHashSet;(char[]);generated",
+        "kotlin.collections;ArraysKt;toHashSet;(double[]);generated",
+        "kotlin.collections;ArraysKt;toHashSet;(float[]);generated",
+        "kotlin.collections;ArraysKt;toHashSet;(int[]);generated",
+        "kotlin.collections;ArraysKt;toHashSet;(long[]);generated",
+        "kotlin.collections;ArraysKt;toHashSet;(short[]);generated",
+        "kotlin.collections;ArraysKt;toIntArray;(Integer[]);generated",
+        "kotlin.collections;ArraysKt;toList;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;toList;(byte[]);generated",
+        "kotlin.collections;ArraysKt;toList;(char[]);generated",
+        "kotlin.collections;ArraysKt;toList;(double[]);generated",
+        "kotlin.collections;ArraysKt;toList;(float[]);generated",
+        "kotlin.collections;ArraysKt;toList;(int[]);generated",
+        "kotlin.collections;ArraysKt;toList;(long[]);generated",
+        "kotlin.collections;ArraysKt;toList;(short[]);generated",
+        "kotlin.collections;ArraysKt;toLongArray;(Long[]);generated",
+        "kotlin.collections;ArraysKt;toMutableList;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;toMutableList;(byte[]);generated",
+        "kotlin.collections;ArraysKt;toMutableList;(char[]);generated",
+        "kotlin.collections;ArraysKt;toMutableList;(double[]);generated",
+        "kotlin.collections;ArraysKt;toMutableList;(float[]);generated",
+        "kotlin.collections;ArraysKt;toMutableList;(int[]);generated",
+        "kotlin.collections;ArraysKt;toMutableList;(long[]);generated",
+        "kotlin.collections;ArraysKt;toMutableList;(short[]);generated",
+        "kotlin.collections;ArraysKt;toMutableSet;(Object[]);generated",
+        "kotlin.collections;ArraysKt;toMutableSet;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;toMutableSet;(byte[]);generated",
+        "kotlin.collections;ArraysKt;toMutableSet;(char[]);generated",
+        "kotlin.collections;ArraysKt;toMutableSet;(double[]);generated",
+        "kotlin.collections;ArraysKt;toMutableSet;(float[]);generated",
+        "kotlin.collections;ArraysKt;toMutableSet;(int[]);generated",
+        "kotlin.collections;ArraysKt;toMutableSet;(long[]);generated",
+        "kotlin.collections;ArraysKt;toMutableSet;(short[]);generated",
+        "kotlin.collections;ArraysKt;toSet;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;toSet;(byte[]);generated",
+        "kotlin.collections;ArraysKt;toSet;(char[]);generated",
+        "kotlin.collections;ArraysKt;toSet;(double[]);generated",
+        "kotlin.collections;ArraysKt;toSet;(float[]);generated",
+        "kotlin.collections;ArraysKt;toSet;(int[]);generated",
+        "kotlin.collections;ArraysKt;toSet;(long[]);generated",
+        "kotlin.collections;ArraysKt;toSet;(short[]);generated",
+        "kotlin.collections;ArraysKt;toShortArray;(Short[]);generated",
+        "kotlin.collections;ArraysKt;toSortedSet;(Comparable[]);generated",
+        "kotlin.collections;ArraysKt;toSortedSet;(Object[],Comparator);generated",
+        "kotlin.collections;ArraysKt;toSortedSet;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;toSortedSet;(byte[]);generated",
+        "kotlin.collections;ArraysKt;toSortedSet;(char[]);generated",
+        "kotlin.collections;ArraysKt;toSortedSet;(double[]);generated",
+        "kotlin.collections;ArraysKt;toSortedSet;(float[]);generated",
+        "kotlin.collections;ArraysKt;toSortedSet;(int[]);generated",
+        "kotlin.collections;ArraysKt;toSortedSet;(long[]);generated",
+        "kotlin.collections;ArraysKt;toSortedSet;(short[]);generated",
+        "kotlin.collections;ArraysKt;toTypedArray;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;toTypedArray;(byte[]);generated",
+        "kotlin.collections;ArraysKt;toTypedArray;(char[]);generated",
+        "kotlin.collections;ArraysKt;toTypedArray;(double[]);generated",
+        "kotlin.collections;ArraysKt;toTypedArray;(float[]);generated",
+        "kotlin.collections;ArraysKt;toTypedArray;(int[]);generated",
+        "kotlin.collections;ArraysKt;toTypedArray;(long[]);generated",
+        "kotlin.collections;ArraysKt;toTypedArray;(short[]);generated",
+        "kotlin.collections;ArraysKt;union;(boolean[],Iterable);generated",
+        "kotlin.collections;ArraysKt;union;(double[],Iterable);generated",
+        "kotlin.collections;ArraysKt;union;(float[],Iterable);generated",
+        "kotlin.collections;ArraysKt;union;(int[],Iterable);generated",
+        "kotlin.collections;ArraysKt;union;(long[],Iterable);generated",
+        "kotlin.collections;ArraysKt;union;(short[],Iterable);generated",
+        "kotlin.collections;ArraysKt;unzip;(Pair[]);generated",
+        "kotlin.collections;ArraysKt;withIndex;(Object[]);generated",
+        "kotlin.collections;ArraysKt;withIndex;(boolean[]);generated",
+        "kotlin.collections;ArraysKt;withIndex;(byte[]);generated",
+        "kotlin.collections;ArraysKt;withIndex;(char[]);generated",
+        "kotlin.collections;ArraysKt;withIndex;(double[]);generated",
+        "kotlin.collections;ArraysKt;withIndex;(float[]);generated",
+        "kotlin.collections;ArraysKt;withIndex;(int[]);generated",
+        "kotlin.collections;ArraysKt;withIndex;(long[]);generated",
+        "kotlin.collections;ArraysKt;withIndex;(short[]);generated",
+        "kotlin.collections;ArraysKt;zip;(boolean[],Iterable);generated",
+        "kotlin.collections;ArraysKt;zip;(boolean[],Iterable,Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(boolean[],Object[]);generated",
+        "kotlin.collections;ArraysKt;zip;(boolean[],Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(boolean[],boolean[]);generated",
+        "kotlin.collections;ArraysKt;zip;(boolean[],boolean[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(byte[],Iterable);generated",
+        "kotlin.collections;ArraysKt;zip;(byte[],Iterable,Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(byte[],Object[]);generated",
+        "kotlin.collections;ArraysKt;zip;(byte[],Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(byte[],byte[]);generated",
+        "kotlin.collections;ArraysKt;zip;(byte[],byte[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(char[],Iterable);generated",
+        "kotlin.collections;ArraysKt;zip;(char[],Iterable,Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(char[],Object[]);generated",
+        "kotlin.collections;ArraysKt;zip;(char[],Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(char[],char[]);generated",
+        "kotlin.collections;ArraysKt;zip;(char[],char[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(double[],Iterable);generated",
+        "kotlin.collections;ArraysKt;zip;(double[],Iterable,Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(double[],Object[]);generated",
+        "kotlin.collections;ArraysKt;zip;(double[],Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(double[],double[]);generated",
+        "kotlin.collections;ArraysKt;zip;(double[],double[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(float[],Iterable);generated",
+        "kotlin.collections;ArraysKt;zip;(float[],Iterable,Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(float[],Object[]);generated",
+        "kotlin.collections;ArraysKt;zip;(float[],Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(float[],float[]);generated",
+        "kotlin.collections;ArraysKt;zip;(float[],float[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(int[],Iterable);generated",
+        "kotlin.collections;ArraysKt;zip;(int[],Iterable,Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(int[],Object[]);generated",
+        "kotlin.collections;ArraysKt;zip;(int[],Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(int[],int[]);generated",
+        "kotlin.collections;ArraysKt;zip;(int[],int[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(long[],Iterable);generated",
+        "kotlin.collections;ArraysKt;zip;(long[],Iterable,Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(long[],Object[]);generated",
+        "kotlin.collections;ArraysKt;zip;(long[],Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(long[],long[]);generated",
+        "kotlin.collections;ArraysKt;zip;(long[],long[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(short[],Iterable);generated",
+        "kotlin.collections;ArraysKt;zip;(short[],Iterable,Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(short[],Object[]);generated",
+        "kotlin.collections;ArraysKt;zip;(short[],Object[],Function2);generated",
+        "kotlin.collections;ArraysKt;zip;(short[],short[]);generated",
+        "kotlin.collections;ArraysKt;zip;(short[],short[],Function2);generated",
+        "kotlin.collections;BooleanIterator;BooleanIterator;();generated",
+        "kotlin.collections;BooleanIterator;nextBoolean;();generated",
+        "kotlin.collections;ByteIterator;ByteIterator;();generated",
+        "kotlin.collections;ByteIterator;nextByte;();generated",
+        "kotlin.collections;CharIterator;CharIterator;();generated",
+        "kotlin.collections;CharIterator;nextChar;();generated",
+        "kotlin.collections;CollectionsHKt;eachCount;(Grouping);generated",
+        "kotlin.collections;CollectionsHKt;fill;(List,Object);generated",
+        "kotlin.collections;CollectionsHKt;orEmpty;(Object[]);generated",
+        "kotlin.collections;CollectionsHKt;shuffle;(List);generated",
+        "kotlin.collections;CollectionsHKt;shuffled;(Iterable);generated",
+        "kotlin.collections;CollectionsHKt;sort;(List);generated",
+        "kotlin.collections;CollectionsHKt;sortWith;(List,Comparator);generated",
+        "kotlin.collections;CollectionsHKt;toTypedArray;(Collection);generated",
+        "kotlin.collections;CollectionsKt;Iterable;(Function0);generated",
+        "kotlin.collections;CollectionsKt;List;(int,Function1);generated",
+        "kotlin.collections;CollectionsKt;MutableList;(int,Function1);generated",
+        "kotlin.collections;CollectionsKt;all;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;any;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;any;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;arrayListOf;();generated",
+        "kotlin.collections;CollectionsKt;asSequence;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;averageOfByte;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;averageOfDouble;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;averageOfFloat;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;averageOfInt;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;averageOfLong;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;averageOfShort;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;binarySearch;(List,Comparable,int,int);generated",
+        "kotlin.collections;CollectionsKt;binarySearch;(List,Object,Comparator,int,int);generated",
+        "kotlin.collections;CollectionsKt;binarySearch;(List,int,int,Function1);generated",
+        "kotlin.collections;CollectionsKt;binarySearchBy;(List,Comparable,int,int,Function1);generated",
+        "kotlin.collections;CollectionsKt;buildList;(Function1);generated",
+        "kotlin.collections;CollectionsKt;buildList;(int,Function1);generated",
+        "kotlin.collections;CollectionsKt;chunked;(Iterable,int);generated",
+        "kotlin.collections;CollectionsKt;chunked;(Iterable,int,Function1);generated",
+        "kotlin.collections;CollectionsKt;contains;(Iterable,Object);generated",
+        "kotlin.collections;CollectionsKt;containsAll;(Collection,Collection);generated",
+        "kotlin.collections;CollectionsKt;count;(Collection);generated",
+        "kotlin.collections;CollectionsKt;count;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;count;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;emptyList;();generated",
+        "kotlin.collections;CollectionsKt;filterIndexed;(Iterable,Function2);generated",
+        "kotlin.collections;CollectionsKt;flatMap;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;flatMapIndexedIterable;(Iterable,Function2);generated",
+        "kotlin.collections;CollectionsKt;flatMapIndexedSequence;(Iterable,Function2);generated",
+        "kotlin.collections;CollectionsKt;flatMapSequence;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;forEach;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;forEach;(Iterator,Function1);generated",
+        "kotlin.collections;CollectionsKt;forEachIndexed;(Iterable,Function2);generated",
+        "kotlin.collections;CollectionsKt;getIndices;(Collection);generated",
+        "kotlin.collections;CollectionsKt;getLastIndex;(List);generated",
+        "kotlin.collections;CollectionsKt;groupBy;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;groupBy;(Iterable,Function1,Function1);generated",
+        "kotlin.collections;CollectionsKt;groupingBy;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;indexOf;(Iterable,Object);generated",
+        "kotlin.collections;CollectionsKt;indexOf;(List,Object);generated",
+        "kotlin.collections;CollectionsKt;indexOfFirst;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;indexOfFirst;(List,Function1);generated",
+        "kotlin.collections;CollectionsKt;indexOfLast;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;indexOfLast;(List,Function1);generated",
+        "kotlin.collections;CollectionsKt;isNotEmpty;(Collection);generated",
+        "kotlin.collections;CollectionsKt;isNullOrEmpty;(Collection);generated",
+        "kotlin.collections;CollectionsKt;iterator;(Enumeration);generated",
+        "kotlin.collections;CollectionsKt;lastIndexOf;(Iterable,Object);generated",
+        "kotlin.collections;CollectionsKt;lastIndexOf;(List,Object);generated",
+        "kotlin.collections;CollectionsKt;listOf;();generated",
+        "kotlin.collections;CollectionsKt;listOfNotNull;(Object[]);generated",
+        "kotlin.collections;CollectionsKt;mapIndexed;(Iterable,Function2);generated",
+        "kotlin.collections;CollectionsKt;mapIndexedNotNull;(Iterable,Function2);generated",
+        "kotlin.collections;CollectionsKt;mapNotNull;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;max;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;maxOf;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;maxOfOrNull;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;maxOrNull;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;maxOrThrow;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;min;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;minOf;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;minOfOrNull;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;minOrNull;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;minOrThrow;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;minusAssign;(Collection,Iterable);generated",
+        "kotlin.collections;CollectionsKt;minusAssign;(Collection,Object);generated",
+        "kotlin.collections;CollectionsKt;minusAssign;(Collection,Object[]);generated",
+        "kotlin.collections;CollectionsKt;minusAssign;(Collection,Sequence);generated",
+        "kotlin.collections;CollectionsKt;mutableListOf;();generated",
+        "kotlin.collections;CollectionsKt;none;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;none;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;remove;(Collection,Object);generated",
+        "kotlin.collections;CollectionsKt;removeAll;(Collection,Collection);generated",
+        "kotlin.collections;CollectionsKt;removeAll;(Collection,Iterable);generated",
+        "kotlin.collections;CollectionsKt;removeAll;(Collection,Object[]);generated",
+        "kotlin.collections;CollectionsKt;removeAll;(Collection,Sequence);generated",
+        "kotlin.collections;CollectionsKt;removeAll;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;removeAll;(List,Function1);generated",
+        "kotlin.collections;CollectionsKt;retainAll;(Collection,Collection);generated",
+        "kotlin.collections;CollectionsKt;retainAll;(Collection,Iterable);generated",
+        "kotlin.collections;CollectionsKt;retainAll;(Collection,Object[]);generated",
+        "kotlin.collections;CollectionsKt;retainAll;(Collection,Sequence);generated",
+        "kotlin.collections;CollectionsKt;retainAll;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;retainAll;(List,Function1);generated",
+        "kotlin.collections;CollectionsKt;reverse;(List);generated",
+        "kotlin.collections;CollectionsKt;runningReduce;(Iterable,Function2);generated",
+        "kotlin.collections;CollectionsKt;runningReduceIndexed;(Iterable,Function3);generated",
+        "kotlin.collections;CollectionsKt;shuffle;(List);generated",
+        "kotlin.collections;CollectionsKt;shuffle;(List,Random);generated",
+        "kotlin.collections;CollectionsKt;sort;(List);generated",
+        "kotlin.collections;CollectionsKt;sort;(List,Comparator);generated",
+        "kotlin.collections;CollectionsKt;sort;(List,Function2);generated",
+        "kotlin.collections;CollectionsKt;sortBy;(List,Function1);generated",
+        "kotlin.collections;CollectionsKt;sortByDescending;(List,Function1);generated",
+        "kotlin.collections;CollectionsKt;sortDescending;(List);generated",
+        "kotlin.collections;CollectionsKt;sortWith;(List,Comparator);generated",
+        "kotlin.collections;CollectionsKt;sumBy;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;sumByDouble;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;sumOfBigDecimal;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;sumOfBigInteger;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;sumOfByte;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;sumOfDouble;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;sumOfDouble;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;sumOfFloat;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;sumOfInt;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;sumOfInt;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;sumOfLong;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;sumOfLong;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;sumOfShort;(Iterable);generated",
+        "kotlin.collections;CollectionsKt;sumOfUInt;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;sumOfULong;(Iterable,Function1);generated",
+        "kotlin.collections;CollectionsKt;toBooleanArray;(Collection);generated",
+        "kotlin.collections;CollectionsKt;toByteArray;(Collection);generated",
+        "kotlin.collections;CollectionsKt;toCharArray;(Collection);generated",
+        "kotlin.collections;CollectionsKt;toDoubleArray;(Collection);generated",
+        "kotlin.collections;CollectionsKt;toFloatArray;(Collection);generated",
+        "kotlin.collections;CollectionsKt;toIntArray;(Collection);generated",
+        "kotlin.collections;CollectionsKt;toLongArray;(Collection);generated",
+        "kotlin.collections;CollectionsKt;toShortArray;(Collection);generated",
+        "kotlin.collections;CollectionsKt;windowed;(Iterable,int,int,boolean);generated",
+        "kotlin.collections;CollectionsKt;windowed;(Iterable,int,int,boolean,Function1);generated",
+        "kotlin.collections;CollectionsKt;withIndex;(Iterable);generated",
+        "kotlin.collections;DoubleIterator;DoubleIterator;();generated",
+        "kotlin.collections;DoubleIterator;nextDouble;();generated",
+        "kotlin.collections;FloatIterator;FloatIterator;();generated",
+        "kotlin.collections;FloatIterator;nextFloat;();generated",
+        "kotlin.collections;Grouping;keyOf;(Object);generated",
+        "kotlin.collections;Grouping;sourceIterator;();generated",
+        "kotlin.collections;GroupingKt;aggregate;(Grouping,Function4);generated",
+        "kotlin.collections;GroupingKt;eachCount;(Grouping);generated",
+        "kotlin.collections;GroupingKt;fold;(Grouping,Function2,Function3);generated",
+        "kotlin.collections;GroupingKt;fold;(Grouping,Object,Function2);generated",
+        "kotlin.collections;GroupingKt;reduce;(Grouping,Function3);generated",
+        "kotlin.collections;HashMap;HashMap;();generated",
+        "kotlin.collections;HashMap;HashMap;(Map);generated",
+        "kotlin.collections;HashMap;HashMap;(int);generated",
+        "kotlin.collections;HashMap;HashMap;(int,float);generated",
+        "kotlin.collections;HashSet;HashSet;();generated",
+        "kotlin.collections;HashSet;HashSet;(Collection);generated",
+        "kotlin.collections;HashSet;HashSet;(int);generated",
+        "kotlin.collections;HashSet;HashSet;(int,float);generated",
+        "kotlin.collections;IndexedValue;component1;();generated",
+        "kotlin.collections;IndexedValue;equals;(Object);generated",
+        "kotlin.collections;IndexedValue;getIndex;();generated",
+        "kotlin.collections;IndexedValue;hashCode;();generated",
+        "kotlin.collections;IntIterator;IntIterator;();generated",
+        "kotlin.collections;IntIterator;nextInt;();generated",
+        "kotlin.collections;LinkedHashMap;LinkedHashMap;();generated",
+        "kotlin.collections;LinkedHashMap;LinkedHashMap;(Map);generated",
+        "kotlin.collections;LinkedHashMap;LinkedHashMap;(int);generated",
+        "kotlin.collections;LinkedHashMap;LinkedHashMap;(int,float);generated",
+        "kotlin.collections;LinkedHashSet;LinkedHashSet;();generated",
+        "kotlin.collections;LinkedHashSet;LinkedHashSet;(Collection);generated",
+        "kotlin.collections;LinkedHashSet;LinkedHashSet;(int);generated",
+        "kotlin.collections;LinkedHashSet;LinkedHashSet;(int,float);generated",
+        "kotlin.collections;LongIterator;LongIterator;();generated",
+        "kotlin.collections;LongIterator;nextLong;();generated",
+        "kotlin.collections;MapsKt;all;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;any;(Map);generated",
+        "kotlin.collections;MapsKt;any;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;asSequence;(Map);generated",
+        "kotlin.collections;MapsKt;buildMap;(Function1);generated",
+        "kotlin.collections;MapsKt;buildMap;(int,Function1);generated",
+        "kotlin.collections;MapsKt;contains;(Map,Object);generated",
+        "kotlin.collections;MapsKt;containsKey;(Map,Object);generated",
+        "kotlin.collections;MapsKt;containsValue;(Map,Object);generated",
+        "kotlin.collections;MapsKt;count;(Map);generated",
+        "kotlin.collections;MapsKt;count;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;emptyMap;();generated",
+        "kotlin.collections;MapsKt;flatMap;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;flatMapSequence;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;forEach;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;hashMapOf;();generated",
+        "kotlin.collections;MapsKt;hashMapOf;(Pair[]);generated",
+        "kotlin.collections;MapsKt;isNotEmpty;(Map);generated",
+        "kotlin.collections;MapsKt;isNullOrEmpty;(Map);generated",
+        "kotlin.collections;MapsKt;linkedMapOf;();generated",
+        "kotlin.collections;MapsKt;linkedMapOf;(Pair[]);generated",
+        "kotlin.collections;MapsKt;mapNotNull;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;mapOf;();generated",
+        "kotlin.collections;MapsKt;mapOf;(Pair[]);generated",
+        "kotlin.collections;MapsKt;maxOf;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;maxOfOrNull;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;minOf;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;minOfOrNull;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;minusAssign;(Map,Iterable);generated",
+        "kotlin.collections;MapsKt;minusAssign;(Map,Object);generated",
+        "kotlin.collections;MapsKt;minusAssign;(Map,Object[]);generated",
+        "kotlin.collections;MapsKt;minusAssign;(Map,Sequence);generated",
+        "kotlin.collections;MapsKt;mutableMapOf;();generated",
+        "kotlin.collections;MapsKt;mutableMapOf;(Pair[]);generated",
+        "kotlin.collections;MapsKt;none;(Map);generated",
+        "kotlin.collections;MapsKt;none;(Map,Function1);generated",
+        "kotlin.collections;MapsKt;plusAssign;(Map,Pair[]);generated",
+        "kotlin.collections;MapsKt;putAll;(Map,Pair[]);generated",
+        "kotlin.collections;MapsKt;sortedMapOf;(Comparator,Pair[]);generated",
+        "kotlin.collections;MapsKt;sortedMapOf;(Pair[]);generated",
+        "kotlin.collections;MapsKt;toMap;(Sequence);generated",
+        "kotlin.collections;MapsKt;toProperties;(Map);generated",
+        "kotlin.collections;MapsKt;toSortedMap;(Map,Comparator);generated",
+        "kotlin.collections;SetsKt;buildSet;(Function1);generated",
+        "kotlin.collections;SetsKt;buildSet;(int,Function1);generated",
+        "kotlin.collections;SetsKt;emptySet;();generated",
+        "kotlin.collections;SetsKt;hashSetOf;();generated",
+        "kotlin.collections;SetsKt;hashSetOf;(Object[]);generated",
+        "kotlin.collections;SetsKt;linkedSetOf;();generated",
+        "kotlin.collections;SetsKt;linkedSetOf;(Object[]);generated",
+        "kotlin.collections;SetsKt;mutableSetOf;();generated",
+        "kotlin.collections;SetsKt;mutableSetOf;(Object[]);generated",
+        "kotlin.collections;SetsKt;setOf;();generated",
+        "kotlin.collections;SetsKt;setOfNotNull;(Object[]);generated",
+        "kotlin.collections;SetsKt;sortedSetOf;(Comparator,Object[]);generated",
+        "kotlin.collections;SetsKt;sortedSetOf;(Object[]);generated",
+        "kotlin.collections;ShortIterator;ShortIterator;();generated",
+        "kotlin.collections;ShortIterator;nextShort;();generated",
+        "kotlin.collections;UArraysKt;all;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;all;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;all;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;all;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;any;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;any;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;any;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;any;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;any;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;any;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;any;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;any;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;asIntArray;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;asList;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;asList;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;asList;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;asList;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;asLongArray;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;asShortArray;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;asUIntArray;(int[]);generated",
+        "kotlin.collections;UArraysKt;asULongArray;(long[]);generated",
+        "kotlin.collections;UArraysKt;asUShortArray;(short[]);generated",
+        "kotlin.collections;UArraysKt;associateWith;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;associateWith;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;associateWith;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;associateWith;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;binarySearch;(UByteArray,byte,int,int);generated",
+        "kotlin.collections;UArraysKt;binarySearch;(UIntArray,int,int,int);generated",
+        "kotlin.collections;UArraysKt;binarySearch;(ULongArray,long,int,int);generated",
+        "kotlin.collections;UArraysKt;binarySearch;(UShortArray,short,int,int);generated",
+        "kotlin.collections;UArraysKt;component1;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;component1;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;component1;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;component1;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;component2;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;component2;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;component2;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;component2;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;component3;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;component3;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;component3;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;component3;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;component4;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;component4;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;component4;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;component4;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;component5;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;component5;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;component5;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;component5;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;contentEquals;(UByteArray,UByteArray);generated",
+        "kotlin.collections;UArraysKt;contentEquals;(UIntArray,UIntArray);generated",
+        "kotlin.collections;UArraysKt;contentEquals;(ULongArray,ULongArray);generated",
+        "kotlin.collections;UArraysKt;contentEquals;(UShortArray,UShortArray);generated",
+        "kotlin.collections;UArraysKt;contentHashCode;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;contentHashCode;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;contentHashCode;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;contentHashCode;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;copyOf;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;copyOf;(UIntArray,int);generated",
+        "kotlin.collections;UArraysKt;copyOf;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;copyOf;(ULongArray,int);generated",
+        "kotlin.collections;UArraysKt;copyOf;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;copyOf;(UShortArray,int);generated",
+        "kotlin.collections;UArraysKt;copyOfRange;(UIntArray,int,int);generated",
+        "kotlin.collections;UArraysKt;copyOfRange;(ULongArray,int,int);generated",
+        "kotlin.collections;UArraysKt;copyOfRange;(UShortArray,int,int);generated",
+        "kotlin.collections;UArraysKt;count;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;count;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;count;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;count;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;dropWhile;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;dropWhile;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;dropWhile;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;dropWhile;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;elementAt;(UByteArray,int);generated",
+        "kotlin.collections;UArraysKt;elementAt;(UIntArray,int);generated",
+        "kotlin.collections;UArraysKt;elementAt;(ULongArray,int);generated",
+        "kotlin.collections;UArraysKt;elementAt;(UShortArray,int);generated",
+        "kotlin.collections;UArraysKt;elementAtOrElse;(UByteArray,int,Function1);generated",
+        "kotlin.collections;UArraysKt;elementAtOrElse;(UIntArray,int,Function1);generated",
+        "kotlin.collections;UArraysKt;elementAtOrElse;(ULongArray,int,Function1);generated",
+        "kotlin.collections;UArraysKt;elementAtOrElse;(UShortArray,int,Function1);generated",
+        "kotlin.collections;UArraysKt;elementAtOrNull;(UByteArray,int);generated",
+        "kotlin.collections;UArraysKt;elementAtOrNull;(UIntArray,int);generated",
+        "kotlin.collections;UArraysKt;elementAtOrNull;(ULongArray,int);generated",
+        "kotlin.collections;UArraysKt;elementAtOrNull;(UShortArray,int);generated",
+        "kotlin.collections;UArraysKt;fill;(UByteArray,byte,int,int);generated",
+        "kotlin.collections;UArraysKt;fill;(UIntArray,int,int,int);generated",
+        "kotlin.collections;UArraysKt;fill;(ULongArray,long,int,int);generated",
+        "kotlin.collections;UArraysKt;fill;(UShortArray,short,int,int);generated",
+        "kotlin.collections;UArraysKt;filter;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;filter;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;filter;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;filter;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;filterIndexed;(UByteArray,Function2);generated",
+        "kotlin.collections;UArraysKt;filterIndexed;(UIntArray,Function2);generated",
+        "kotlin.collections;UArraysKt;filterIndexed;(ULongArray,Function2);generated",
+        "kotlin.collections;UArraysKt;filterIndexed;(UShortArray,Function2);generated",
+        "kotlin.collections;UArraysKt;filterNot;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;filterNot;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;filterNot;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;filterNot;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;find;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;find;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;find;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;find;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;findLast;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;findLast;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;findLast;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;findLast;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;first;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;first;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;first;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;first;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;first;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;first;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;first;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;first;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;firstOrNull;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;firstOrNull;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;firstOrNull;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;firstOrNull;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;firstOrNull;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;firstOrNull;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;firstOrNull;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;firstOrNull;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;flatMap;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;flatMap;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;flatMap;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;flatMap;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;flatMapIndexed;(UByteArray,Function2);generated",
+        "kotlin.collections;UArraysKt;flatMapIndexed;(UIntArray,Function2);generated",
+        "kotlin.collections;UArraysKt;flatMapIndexed;(ULongArray,Function2);generated",
+        "kotlin.collections;UArraysKt;flatMapIndexed;(UShortArray,Function2);generated",
+        "kotlin.collections;UArraysKt;forEach;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;forEach;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;forEach;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;forEach;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;forEachIndexed;(UByteArray,Function2);generated",
+        "kotlin.collections;UArraysKt;forEachIndexed;(UIntArray,Function2);generated",
+        "kotlin.collections;UArraysKt;forEachIndexed;(ULongArray,Function2);generated",
+        "kotlin.collections;UArraysKt;forEachIndexed;(UShortArray,Function2);generated",
+        "kotlin.collections;UArraysKt;getIndices;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;getIndices;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;getIndices;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;getIndices;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;getLastIndex;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;getLastIndex;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;getLastIndex;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;getLastIndex;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;getOrElse;(UByteArray,int,Function1);generated",
+        "kotlin.collections;UArraysKt;getOrElse;(UIntArray,int,Function1);generated",
+        "kotlin.collections;UArraysKt;getOrElse;(ULongArray,int,Function1);generated",
+        "kotlin.collections;UArraysKt;getOrElse;(UShortArray,int,Function1);generated",
+        "kotlin.collections;UArraysKt;getOrNull;(UByteArray,int);generated",
+        "kotlin.collections;UArraysKt;getOrNull;(UIntArray,int);generated",
+        "kotlin.collections;UArraysKt;getOrNull;(ULongArray,int);generated",
+        "kotlin.collections;UArraysKt;getOrNull;(UShortArray,int);generated",
+        "kotlin.collections;UArraysKt;groupBy;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;groupBy;(UByteArray,Function1,Function1);generated",
+        "kotlin.collections;UArraysKt;groupBy;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;groupBy;(UIntArray,Function1,Function1);generated",
+        "kotlin.collections;UArraysKt;groupBy;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;groupBy;(ULongArray,Function1,Function1);generated",
+        "kotlin.collections;UArraysKt;groupBy;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;groupBy;(UShortArray,Function1,Function1);generated",
+        "kotlin.collections;UArraysKt;indexOf;(UByteArray,byte);generated",
+        "kotlin.collections;UArraysKt;indexOf;(UIntArray,int);generated",
+        "kotlin.collections;UArraysKt;indexOf;(ULongArray,long);generated",
+        "kotlin.collections;UArraysKt;indexOf;(UShortArray,short);generated",
+        "kotlin.collections;UArraysKt;indexOfFirst;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;indexOfFirst;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;indexOfFirst;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;indexOfFirst;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;indexOfLast;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;indexOfLast;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;indexOfLast;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;indexOfLast;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;last;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;last;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;last;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;last;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;last;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;last;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;last;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;last;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;lastIndexOf;(UByteArray,byte);generated",
+        "kotlin.collections;UArraysKt;lastIndexOf;(UIntArray,int);generated",
+        "kotlin.collections;UArraysKt;lastIndexOf;(ULongArray,long);generated",
+        "kotlin.collections;UArraysKt;lastIndexOf;(UShortArray,short);generated",
+        "kotlin.collections;UArraysKt;lastOrNull;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;lastOrNull;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;lastOrNull;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;lastOrNull;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;lastOrNull;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;lastOrNull;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;lastOrNull;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;lastOrNull;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;map;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;map;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;map;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;map;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;mapIndexed;(UByteArray,Function2);generated",
+        "kotlin.collections;UArraysKt;mapIndexed;(UIntArray,Function2);generated",
+        "kotlin.collections;UArraysKt;mapIndexed;(ULongArray,Function2);generated",
+        "kotlin.collections;UArraysKt;mapIndexed;(UShortArray,Function2);generated",
+        "kotlin.collections;UArraysKt;max;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;max;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;max;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;max;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;maxBy;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxBy;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxBy;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxBy;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxByOrNull;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxByOrNull;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxByOrNull;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxByOrNull;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxByOrThrow-U;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxByOrThrow-U;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxByOrThrow-U;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxByOrThrow-U;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOf;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOf;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOf;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOf;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfOrNull;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfOrNull;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfOrNull;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfOrNull;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfWith;(UByteArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfWith;(UIntArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfWith;(ULongArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfWith;(UShortArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfWithOrNull;(UByteArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfWithOrNull;(UIntArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfWithOrNull;(ULongArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOfWithOrNull;(UShortArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;maxOrNull;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;maxOrNull;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;maxOrNull;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;maxOrNull;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;maxOrThrow-U;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;maxOrThrow-U;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;maxOrThrow-U;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;maxOrThrow-U;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;maxWith;(UByteArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWith;(UIntArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWith;(ULongArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWith;(UShortArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWithOrNull;(UByteArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWithOrNull;(UIntArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWithOrNull;(ULongArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWithOrNull;(UShortArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWithOrThrow-U;(UByteArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWithOrThrow-U;(UIntArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWithOrThrow-U;(ULongArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;maxWithOrThrow-U;(UShortArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;min;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;min;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;min;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;min;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;minBy;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minBy;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minBy;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minBy;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minByOrNull;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minByOrNull;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minByOrNull;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minByOrNull;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minByOrThrow-U;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minByOrThrow-U;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minByOrThrow-U;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minByOrThrow-U;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minOf;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minOf;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minOf;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minOf;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfOrNull;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfOrNull;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfOrNull;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfOrNull;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfWith;(UByteArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfWith;(UIntArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfWith;(ULongArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfWith;(UShortArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfWithOrNull;(UByteArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfWithOrNull;(UIntArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfWithOrNull;(ULongArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;minOfWithOrNull;(UShortArray,Comparator,Function1);generated",
+        "kotlin.collections;UArraysKt;minOrNull;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;minOrNull;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;minOrNull;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;minOrNull;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;minOrThrow-U;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;minOrThrow-U;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;minOrThrow-U;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;minOrThrow-U;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;minWith;(UByteArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWith;(UIntArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWith;(ULongArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWith;(UShortArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWithOrNull;(UByteArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWithOrNull;(UIntArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWithOrNull;(ULongArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWithOrNull;(UShortArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWithOrThrow-U;(UByteArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWithOrThrow-U;(UIntArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWithOrThrow-U;(ULongArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;minWithOrThrow-U;(UShortArray,Comparator);generated",
+        "kotlin.collections;UArraysKt;none;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;none;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;none;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;none;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;none;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;none;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;none;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;none;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;plus;(UIntArray,Collection);generated",
+        "kotlin.collections;UArraysKt;plus;(UIntArray,UIntArray);generated",
+        "kotlin.collections;UArraysKt;plus;(UIntArray,int);generated",
+        "kotlin.collections;UArraysKt;plus;(ULongArray,Collection);generated",
+        "kotlin.collections;UArraysKt;plus;(ULongArray,ULongArray);generated",
+        "kotlin.collections;UArraysKt;plus;(ULongArray,long);generated",
+        "kotlin.collections;UArraysKt;plus;(UShortArray,Collection);generated",
+        "kotlin.collections;UArraysKt;plus;(UShortArray,UShortArray);generated",
+        "kotlin.collections;UArraysKt;plus;(UShortArray,short);generated",
+        "kotlin.collections;UArraysKt;random;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;random;(UByteArray,Random);generated",
+        "kotlin.collections;UArraysKt;random;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;random;(UIntArray,Random);generated",
+        "kotlin.collections;UArraysKt;random;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;random;(ULongArray,Random);generated",
+        "kotlin.collections;UArraysKt;random;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;random;(UShortArray,Random);generated",
+        "kotlin.collections;UArraysKt;randomOrNull;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;randomOrNull;(UByteArray,Random);generated",
+        "kotlin.collections;UArraysKt;randomOrNull;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;randomOrNull;(UIntArray,Random);generated",
+        "kotlin.collections;UArraysKt;randomOrNull;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;randomOrNull;(ULongArray,Random);generated",
+        "kotlin.collections;UArraysKt;randomOrNull;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;randomOrNull;(UShortArray,Random);generated",
+        "kotlin.collections;UArraysKt;reduce;(UByteArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduce;(UIntArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduce;(ULongArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduce;(UShortArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceIndexed;(UByteArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceIndexed;(UIntArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceIndexed;(ULongArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceIndexed;(UShortArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceIndexedOrNull;(UByteArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceIndexedOrNull;(UIntArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceIndexedOrNull;(ULongArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceIndexedOrNull;(UShortArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceOrNull;(UByteArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceOrNull;(UIntArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceOrNull;(ULongArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceOrNull;(UShortArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceRight;(UByteArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceRight;(UIntArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceRight;(ULongArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceRight;(UShortArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceRightIndexed;(UByteArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceRightIndexed;(UIntArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceRightIndexed;(ULongArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceRightIndexed;(UShortArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceRightIndexedOrNull;(UByteArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceRightIndexedOrNull;(UIntArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceRightIndexedOrNull;(ULongArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceRightIndexedOrNull;(UShortArray,Function3);generated",
+        "kotlin.collections;UArraysKt;reduceRightOrNull;(UByteArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceRightOrNull;(UIntArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceRightOrNull;(ULongArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reduceRightOrNull;(UShortArray,Function2);generated",
+        "kotlin.collections;UArraysKt;reverse;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;reverse;(UByteArray,int,int);generated",
+        "kotlin.collections;UArraysKt;reverse;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;reverse;(UIntArray,int,int);generated",
+        "kotlin.collections;UArraysKt;reverse;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;reverse;(ULongArray,int,int);generated",
+        "kotlin.collections;UArraysKt;reverse;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;reverse;(UShortArray,int,int);generated",
+        "kotlin.collections;UArraysKt;reversedArray;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;reversedArray;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;reversedArray;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;runningReduce;(UByteArray,Function2);generated",
+        "kotlin.collections;UArraysKt;runningReduce;(UIntArray,Function2);generated",
+        "kotlin.collections;UArraysKt;runningReduce;(ULongArray,Function2);generated",
+        "kotlin.collections;UArraysKt;runningReduce;(UShortArray,Function2);generated",
+        "kotlin.collections;UArraysKt;runningReduceIndexed;(UByteArray,Function3);generated",
+        "kotlin.collections;UArraysKt;runningReduceIndexed;(UIntArray,Function3);generated",
+        "kotlin.collections;UArraysKt;runningReduceIndexed;(ULongArray,Function3);generated",
+        "kotlin.collections;UArraysKt;runningReduceIndexed;(UShortArray,Function3);generated",
+        "kotlin.collections;UArraysKt;shuffle;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;shuffle;(UByteArray,Random);generated",
+        "kotlin.collections;UArraysKt;shuffle;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;shuffle;(UIntArray,Random);generated",
+        "kotlin.collections;UArraysKt;shuffle;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;shuffle;(ULongArray,Random);generated",
+        "kotlin.collections;UArraysKt;shuffle;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;shuffle;(UShortArray,Random);generated",
+        "kotlin.collections;UArraysKt;single;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;single;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;single;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;single;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;single;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;single;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;single;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;single;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;singleOrNull;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;singleOrNull;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;singleOrNull;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;singleOrNull;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;singleOrNull;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;singleOrNull;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;singleOrNull;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;singleOrNull;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;slice;(UByteArray,IntRange);generated",
+        "kotlin.collections;UArraysKt;slice;(UByteArray,Iterable);generated",
+        "kotlin.collections;UArraysKt;slice;(UIntArray,IntRange);generated",
+        "kotlin.collections;UArraysKt;slice;(UIntArray,Iterable);generated",
+        "kotlin.collections;UArraysKt;slice;(ULongArray,IntRange);generated",
+        "kotlin.collections;UArraysKt;slice;(ULongArray,Iterable);generated",
+        "kotlin.collections;UArraysKt;slice;(UShortArray,IntRange);generated",
+        "kotlin.collections;UArraysKt;slice;(UShortArray,Iterable);generated",
+        "kotlin.collections;UArraysKt;sliceArray;(UByteArray,Collection);generated",
+        "kotlin.collections;UArraysKt;sliceArray;(UIntArray,Collection);generated",
+        "kotlin.collections;UArraysKt;sliceArray;(UIntArray,IntRange);generated",
+        "kotlin.collections;UArraysKt;sliceArray;(ULongArray,Collection);generated",
+        "kotlin.collections;UArraysKt;sliceArray;(ULongArray,IntRange);generated",
+        "kotlin.collections;UArraysKt;sliceArray;(UShortArray,Collection);generated",
+        "kotlin.collections;UArraysKt;sliceArray;(UShortArray,IntRange);generated",
+        "kotlin.collections;UArraysKt;sort;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;sort;(UByteArray,int,int);generated",
+        "kotlin.collections;UArraysKt;sort;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;sort;(UIntArray,int,int);generated",
+        "kotlin.collections;UArraysKt;sort;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;sort;(ULongArray,int,int);generated",
+        "kotlin.collections;UArraysKt;sort;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;sort;(UShortArray,int,int);generated",
+        "kotlin.collections;UArraysKt;sortDescending;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;sortDescending;(UByteArray,int,int);generated",
+        "kotlin.collections;UArraysKt;sortDescending;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;sortDescending;(UIntArray,int,int);generated",
+        "kotlin.collections;UArraysKt;sortDescending;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;sortDescending;(ULongArray,int,int);generated",
+        "kotlin.collections;UArraysKt;sortDescending;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;sortDescending;(UShortArray,int,int);generated",
+        "kotlin.collections;UArraysKt;sorted;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;sorted;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;sorted;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;sorted;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;sortedDescending;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;sortedDescending;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;sortedDescending;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;sum;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;sum;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;sum;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;sum;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;sumBy;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumBy;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumBy;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumBy;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumByDouble;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumByDouble;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumByDouble;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumByDouble;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfBigDecimal;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfBigDecimal;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfBigDecimal;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfBigDecimal;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfBigInteger;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfBigInteger;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfBigInteger;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfBigInteger;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfDouble;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfDouble;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfDouble;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfDouble;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfInt;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfInt;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfInt;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfInt;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfLong;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfLong;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfLong;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfLong;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfUByte;(byte[]);generated",
+        "kotlin.collections;UArraysKt;sumOfUInt;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfUInt;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfUInt;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfUInt;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfUInt;(int[]);generated",
+        "kotlin.collections;UArraysKt;sumOfULong;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfULong;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfULong;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfULong;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;sumOfULong;(long[]);generated",
+        "kotlin.collections;UArraysKt;sumOfUShort;(short[]);generated",
+        "kotlin.collections;UArraysKt;takeWhile;(UByteArray,Function1);generated",
+        "kotlin.collections;UArraysKt;takeWhile;(UIntArray,Function1);generated",
+        "kotlin.collections;UArraysKt;takeWhile;(ULongArray,Function1);generated",
+        "kotlin.collections;UArraysKt;takeWhile;(UShortArray,Function1);generated",
+        "kotlin.collections;UArraysKt;toIntArray;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;toLongArray;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;toShortArray;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;toTypedArray;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;toTypedArray;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;toTypedArray;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;toTypedArray;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;toUIntArray;(int[]);generated",
+        "kotlin.collections;UArraysKt;toULongArray;(long[]);generated",
+        "kotlin.collections;UArraysKt;toUShortArray;(short[]);generated",
+        "kotlin.collections;UArraysKt;withIndex;(UByteArray);generated",
+        "kotlin.collections;UArraysKt;withIndex;(UIntArray);generated",
+        "kotlin.collections;UArraysKt;withIndex;(ULongArray);generated",
+        "kotlin.collections;UArraysKt;withIndex;(UShortArray);generated",
+        "kotlin.collections;UArraysKt;zip;(UByteArray,Iterable);generated",
+        "kotlin.collections;UArraysKt;zip;(UByteArray,Iterable,Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(UByteArray,Object[]);generated",
+        "kotlin.collections;UArraysKt;zip;(UByteArray,Object[],Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(UByteArray,UByteArray);generated",
+        "kotlin.collections;UArraysKt;zip;(UByteArray,UByteArray,Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(UIntArray,Iterable);generated",
+        "kotlin.collections;UArraysKt;zip;(UIntArray,Iterable,Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(UIntArray,Object[]);generated",
+        "kotlin.collections;UArraysKt;zip;(UIntArray,Object[],Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(UIntArray,UIntArray);generated",
+        "kotlin.collections;UArraysKt;zip;(UIntArray,UIntArray,Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(ULongArray,Iterable);generated",
+        "kotlin.collections;UArraysKt;zip;(ULongArray,Iterable,Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(ULongArray,Object[]);generated",
+        "kotlin.collections;UArraysKt;zip;(ULongArray,Object[],Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(ULongArray,ULongArray);generated",
+        "kotlin.collections;UArraysKt;zip;(ULongArray,ULongArray,Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(UShortArray,Iterable);generated",
+        "kotlin.collections;UArraysKt;zip;(UShortArray,Iterable,Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(UShortArray,Object[]);generated",
+        "kotlin.collections;UArraysKt;zip;(UShortArray,Object[],Function2);generated",
+        "kotlin.collections;UArraysKt;zip;(UShortArray,UShortArray);generated",
+        "kotlin.collections;UArraysKt;zip;(UShortArray,UShortArray,Function2);generated",
+        "kotlin.collections;UCollectionsKt;sumOfUByte;(Iterable);generated",
+        "kotlin.collections;UCollectionsKt;sumOfUInt;(Iterable);generated",
+        "kotlin.collections;UCollectionsKt;sumOfULong;(Iterable);generated",
+        "kotlin.collections;UCollectionsKt;sumOfUShort;(Iterable);generated",
+        "kotlin.collections;UCollectionsKt;toUByteArray;(Collection);generated",
+        "kotlin.collections;UCollectionsKt;toUIntArray;(Collection);generated",
+        "kotlin.collections;UCollectionsKt;toULongArray;(Collection);generated",
+        "kotlin.collections;UCollectionsKt;toUShortArray;(Collection);generated",
+        "kotlin.comparisons;ComparisonsKt;compareBy;();generated",
+        "kotlin.comparisons;ComparisonsKt;compareBy;(Comparator,Function1);generated",
+        "kotlin.comparisons;ComparisonsKt;compareBy;(Function1);generated",
+        "kotlin.comparisons;ComparisonsKt;compareByDescending;(Comparator,Function1);generated",
+        "kotlin.comparisons;ComparisonsKt;compareByDescending;(Function1);generated",
+        "kotlin.comparisons;ComparisonsKt;compareValues;(Comparable,Comparable);generated",
+        "kotlin.comparisons;ComparisonsKt;compareValuesBy;(Object,Object);generated",
+        "kotlin.comparisons;ComparisonsKt;compareValuesBy;(Object,Object,Comparator,Function1);generated",
+        "kotlin.comparisons;ComparisonsKt;compareValuesBy;(Object,Object,Function1);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(byte,byte);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(byte,byte,byte);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(byte,byte[]);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(double,double);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(double,double,double);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(double,double[]);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(float,float);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(float,float,float);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(float,float[]);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(int,int);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(int,int,int);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(int,int[]);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(long,long);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(long,long,long);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(long,long[]);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(short,short);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(short,short,short);generated",
+        "kotlin.comparisons;ComparisonsKt;maxOf;(short,short[]);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(byte,byte);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(byte,byte,byte);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(byte,byte[]);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(double,double);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(double,double,double);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(double,double[]);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(float,float);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(float,float,float);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(float,float[]);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(int,int);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(int,int,int);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(int,int[]);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(long,long);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(long,long,long);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(long,long[]);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(short,short);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(short,short,short);generated",
+        "kotlin.comparisons;ComparisonsKt;minOf;(short,short[]);generated",
+        "kotlin.comparisons;ComparisonsKt;naturalOrder;();generated",
+        "kotlin.comparisons;ComparisonsKt;nullsFirst;();generated",
+        "kotlin.comparisons;ComparisonsKt;nullsFirst;(Comparator);generated",
+        "kotlin.comparisons;ComparisonsKt;nullsLast;();generated",
+        "kotlin.comparisons;ComparisonsKt;nullsLast;(Comparator);generated",
+        "kotlin.comparisons;ComparisonsKt;reverseOrder;();generated",
+        "kotlin.comparisons;ComparisonsKt;then;(Comparator,Comparator);generated",
+        "kotlin.comparisons;ComparisonsKt;thenBy;(Comparator,Comparator,Function1);generated",
+        "kotlin.comparisons;ComparisonsKt;thenBy;(Comparator,Function1);generated",
+        "kotlin.comparisons;ComparisonsKt;thenByDescending;(Comparator,Comparator,Function1);generated",
+        "kotlin.comparisons;ComparisonsKt;thenByDescending;(Comparator,Function1);generated",
+        "kotlin.comparisons;ComparisonsKt;thenComparator;(Comparator,Function2);generated",
+        "kotlin.comparisons;ComparisonsKt;thenDescending;(Comparator,Comparator);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(byte,UByteArray);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(byte,byte);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(byte,byte,byte);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(int,UIntArray);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(int,int);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(int,int,int);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(long,ULongArray);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(long,long);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(long,long,long);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(short,UShortArray);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(short,short);generated",
+        "kotlin.comparisons;UComparisonsKt;maxOf;(short,short,short);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(byte,UByteArray);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(byte,byte);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(byte,byte,byte);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(int,UIntArray);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(int,int);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(int,int,int);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(long,ULongArray);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(long,long);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(long,long,long);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(short,UShortArray);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(short,short);generated",
+        "kotlin.comparisons;UComparisonsKt;minOf;(short,short,short);generated",
+        "kotlin.concurrent;LocksKt;read;(ReentrantReadWriteLock,Function0);generated",
+        "kotlin.concurrent;LocksKt;withLock;(Lock,Function0);generated",
+        "kotlin.concurrent;LocksKt;write;(ReentrantReadWriteLock,Function0);generated",
+        "kotlin.concurrent;ThreadsKt;getOrSet;(ThreadLocal,Function0);generated",
+        "kotlin.concurrent;ThreadsKt;thread;(boolean,boolean,ClassLoader,String,int,Function0);generated",
+        "kotlin.concurrent;TimersKt;fixedRateTimer;(String,boolean,Date,long,Function1);generated",
+        "kotlin.concurrent;TimersKt;fixedRateTimer;(String,boolean,long,long,Function1);generated",
+        "kotlin.concurrent;TimersKt;schedule;(Timer,Date,Function1);generated",
+        "kotlin.concurrent;TimersKt;schedule;(Timer,Date,long,Function1);generated",
+        "kotlin.concurrent;TimersKt;schedule;(Timer,long,Function1);generated",
+        "kotlin.concurrent;TimersKt;schedule;(Timer,long,long,Function1);generated",
+        "kotlin.concurrent;TimersKt;scheduleAtFixedRate;(Timer,Date,long,Function1);generated",
+        "kotlin.concurrent;TimersKt;scheduleAtFixedRate;(Timer,long,long,Function1);generated",
+        "kotlin.concurrent;TimersKt;timer;(String,boolean,Date,long,Function1);generated",
+        "kotlin.concurrent;TimersKt;timer;(String,boolean,long,long,Function1);generated",
+        "kotlin.concurrent;TimersKt;timerTask;(Function1);generated",
+        "kotlin.contracts;ContractBuilder;callsInPlace;(Function,InvocationKind);generated",
+        "kotlin.contracts;ContractBuilder;returns;();generated",
+        "kotlin.contracts;ContractBuilder;returns;(Object);generated",
+        "kotlin.contracts;ContractBuilder;returnsNotNull;();generated",
+        "kotlin.contracts;ContractBuilderKt;contract;(Function1);generated",
+        "kotlin.contracts;ExperimentalContracts;ExperimentalContracts;();generated",
+        "kotlin.contracts;InvocationKind;valueOf;(String);generated",
+        "kotlin.contracts;InvocationKind;values;();generated",
+        "kotlin.contracts;SimpleEffect;implies;(boolean);generated",
+        "kotlin.coroutines.cancellation;CancellationException;CancellationException;();generated",
+        "kotlin.coroutines.cancellation;CancellationException;CancellationException;(String);generated",
+        "kotlin.coroutines.cancellation;CancellationExceptionHKt;CancellationException;(String,Throwable);generated",
+        "kotlin.coroutines.cancellation;CancellationExceptionHKt;CancellationException;(Throwable);generated",
+        "kotlin.coroutines.cancellation;CancellationExceptionKt;CancellationException;(String,Throwable);generated",
+        "kotlin.coroutines.cancellation;CancellationExceptionKt;CancellationException;(Throwable);generated",
+        "kotlin.coroutines.intrinsics;CoroutinesIntrinsicsHKt;createCoroutineUnintercepted;(SuspendFunction0,Continuation);generated",
+        "kotlin.coroutines.intrinsics;CoroutinesIntrinsicsHKt;createCoroutineUnintercepted;(SuspendFunction1,Object,Continuation);generated",
+        "kotlin.coroutines.intrinsics;CoroutinesIntrinsicsHKt;intercepted;(Continuation);generated",
+        "kotlin.coroutines.intrinsics;CoroutinesIntrinsicsHKt;startCoroutineUninterceptedOrReturn;(SuspendFunction0,Continuation);generated",
+        "kotlin.coroutines.intrinsics;CoroutinesIntrinsicsHKt;startCoroutineUninterceptedOrReturn;(SuspendFunction1,Object,Continuation);generated",
+        "kotlin.coroutines.intrinsics;IntrinsicsKt;createCoroutineUnintercepted;(SuspendFunction0,Continuation);generated",
+        "kotlin.coroutines.intrinsics;IntrinsicsKt;createCoroutineUnintercepted;(SuspendFunction1,Object,Continuation);generated",
+        "kotlin.coroutines.intrinsics;IntrinsicsKt;getCOROUTINE_SUSPENDED;();generated",
+        "kotlin.coroutines.intrinsics;IntrinsicsKt;startCoroutineUninterceptedOrReturn;(SuspendFunction0,Continuation);generated",
+        "kotlin.coroutines.intrinsics;IntrinsicsKt;startCoroutineUninterceptedOrReturn;(SuspendFunction1,Object,Continuation);generated",
+        "kotlin.coroutines.intrinsics;IntrinsicsKt;suspendCoroutineUninterceptedOrReturn;(Function1);generated",
+        "kotlin.coroutines.jvm.internal;CoroutineStackFrame;getCallerFrame;();generated",
+        "kotlin.coroutines.jvm.internal;CoroutineStackFrame;getStackTraceElement;();generated",
+        "kotlin.coroutines;Continuation;getContext;();generated",
+        "kotlin.coroutines;Continuation;resumeWith;(Result);generated",
+        "kotlin.coroutines;ContinuationInterceptor;interceptContinuation;(Continuation);generated",
+        "kotlin.coroutines;ContinuationInterceptor;releaseInterceptedContinuation;(Continuation);generated",
+        "kotlin.coroutines;ContinuationKt;Continuation;(CoroutineContext,Function1);generated",
+        "kotlin.coroutines;ContinuationKt;createCoroutine;(SuspendFunction0,Continuation);generated",
+        "kotlin.coroutines;ContinuationKt;createCoroutine;(SuspendFunction1,Object,Continuation);generated",
+        "kotlin.coroutines;ContinuationKt;getCoroutineContext;();generated",
+        "kotlin.coroutines;ContinuationKt;resume;(Continuation,Object);generated",
+        "kotlin.coroutines;ContinuationKt;resumeWithException;(Continuation,Throwable);generated",
+        "kotlin.coroutines;ContinuationKt;startCoroutine;(SuspendFunction0,Continuation);generated",
+        "kotlin.coroutines;ContinuationKt;startCoroutine;(SuspendFunction1,Object,Continuation);generated",
+        "kotlin.coroutines;ContinuationKt;suspendCoroutine;(Function1);generated",
+        "kotlin.coroutines;CoroutineContext$Element;getKey;();generated",
+        "kotlin.coroutines;CoroutineContext;fold;(Object,Function2);generated",
+        "kotlin.coroutines;CoroutineContext;get;(Key);generated",
+        "kotlin.coroutines;CoroutineContext;minusKey;(Key);generated",
+        "kotlin.coroutines;EmptyCoroutineContext;hashCode;();generated",
+        "kotlin.coroutines;EmptyCoroutineContext;toString;();generated",
+        "kotlin.coroutines;RestrictsSuspension;RestrictsSuspension;();generated",
+        "kotlin.experimental;BitwiseOperationsKt;and;(byte,byte);generated",
+        "kotlin.experimental;BitwiseOperationsKt;and;(short,short);generated",
+        "kotlin.experimental;BitwiseOperationsKt;inv;(byte);generated",
+        "kotlin.experimental;BitwiseOperationsKt;inv;(short);generated",
+        "kotlin.experimental;BitwiseOperationsKt;or;(byte,byte);generated",
+        "kotlin.experimental;BitwiseOperationsKt;or;(short,short);generated",
+        "kotlin.experimental;BitwiseOperationsKt;xor;(byte,byte);generated",
+        "kotlin.experimental;BitwiseOperationsKt;xor;(short,short);generated",
+        "kotlin.experimental;ExperimentalTypeInference;ExperimentalTypeInference;();generated",
+        "kotlin.io;ByteStreamsKt;bufferedWriter;(OutputStream,Charset);generated",
+        "kotlin.io;ByteStreamsKt;iterator;(BufferedInputStream);generated",
+        "kotlin.io;ByteStreamsKt;writer;(OutputStream,Charset);generated",
+        "kotlin.io;ConsoleKt;print;(Object);generated",
+        "kotlin.io;ConsoleKt;print;(boolean);generated",
+        "kotlin.io;ConsoleKt;print;(byte);generated", "kotlin.io;ConsoleKt;print;(char);generated",
+        "kotlin.io;ConsoleKt;print;(char[]);generated",
+        "kotlin.io;ConsoleKt;print;(double);generated",
+        "kotlin.io;ConsoleKt;print;(float);generated", "kotlin.io;ConsoleKt;print;(int);generated",
+        "kotlin.io;ConsoleKt;print;(long);generated", "kotlin.io;ConsoleKt;print;(short);generated",
+        "kotlin.io;ConsoleKt;println;();generated",
+        "kotlin.io;ConsoleKt;println;(Object);generated",
+        "kotlin.io;ConsoleKt;println;(boolean);generated",
+        "kotlin.io;ConsoleKt;println;(byte);generated",
+        "kotlin.io;ConsoleKt;println;(char);generated",
+        "kotlin.io;ConsoleKt;println;(char[]);generated",
+        "kotlin.io;ConsoleKt;println;(double);generated",
+        "kotlin.io;ConsoleKt;println;(float);generated",
+        "kotlin.io;ConsoleKt;println;(int);generated",
+        "kotlin.io;ConsoleKt;println;(long);generated",
+        "kotlin.io;ConsoleKt;println;(short);generated",
+        "kotlin.io;ConsoleKt;readLine;();generated", "kotlin.io;ConsoleKt;readln;();generated",
+        "kotlin.io;ConsoleKt;readlnOrNull;();generated",
+        "kotlin.io;ConstantsKt;getDEFAULT_BUFFER_SIZE;();generated",
+        "kotlin.io;FileWalkDirection;valueOf;(String);generated",
+        "kotlin.io;FileWalkDirection;values;();generated",
+        "kotlin.io;FilesKt;appendBytes;(File,byte[]);generated",
+        "kotlin.io;FilesKt;appendText;(File,String,Charset);generated",
+        "kotlin.io;FilesKt;bufferedReader;(File,Charset,int);generated",
+        "kotlin.io;FilesKt;bufferedWriter;(File,Charset,int);generated",
+        "kotlin.io;FilesKt;copyRecursively;(File,File,boolean,Function2);generated",
+        "kotlin.io;FilesKt;createTempDir;(String,String,File);generated",
+        "kotlin.io;FilesKt;createTempFile;(String,String,File);generated",
+        "kotlin.io;FilesKt;deleteRecursively;(File);generated",
+        "kotlin.io;FilesKt;endsWith;(File,File);generated",
+        "kotlin.io;FilesKt;endsWith;(File,String);generated",
+        "kotlin.io;FilesKt;forEachBlock;(File,Function2);generated",
+        "kotlin.io;FilesKt;forEachBlock;(File,int,Function2);generated",
+        "kotlin.io;FilesKt;forEachLine;(File,Charset,Function1);generated",
+        "kotlin.io;FilesKt;getExtension;(File);generated",
+        "kotlin.io;FilesKt;getInvariantSeparatorsPath;(File);generated",
+        "kotlin.io;FilesKt;getNameWithoutExtension;(File);generated",
+        "kotlin.io;FilesKt;inputStream;(File);generated",
+        "kotlin.io;FilesKt;isRooted;(File);generated",
+        "kotlin.io;FilesKt;normalize;(File);generated",
+        "kotlin.io;FilesKt;outputStream;(File);generated",
+        "kotlin.io;FilesKt;printWriter;(File,Charset);generated",
+        "kotlin.io;FilesKt;readBytes;(File);generated",
+        "kotlin.io;FilesKt;readLines;(File,Charset);generated",
+        "kotlin.io;FilesKt;readText;(File,Charset);generated",
+        "kotlin.io;FilesKt;reader;(File,Charset);generated",
+        "kotlin.io;FilesKt;relativeTo;(File,File);generated",
+        "kotlin.io;FilesKt;relativeToOrNull;(File,File);generated",
+        "kotlin.io;FilesKt;startsWith;(File,File);generated",
+        "kotlin.io;FilesKt;startsWith;(File,String);generated",
+        "kotlin.io;FilesKt;toRelativeString;(File,File);generated",
+        "kotlin.io;FilesKt;useLines;(File,Charset,Function1);generated",
+        "kotlin.io;FilesKt;writeBytes;(File,byte[]);generated",
+        "kotlin.io;FilesKt;writeText;(File,String,Charset);generated",
+        "kotlin.io;FilesKt;writer;(File,Charset);generated",
+        "kotlin.io;IoHKt;print;(Object);generated", "kotlin.io;IoHKt;println;();generated",
+        "kotlin.io;IoHKt;println;(Object);generated", "kotlin.io;IoHKt;readln;();generated",
+        "kotlin.io;IoHKt;readlnOrNull;();generated",
+        "kotlin.io;OnErrorAction;valueOf;(String);generated",
+        "kotlin.io;OnErrorAction;values;();generated",
+        "kotlin.io;TextStreamsKt;readBytes;(URL);generated",
+        "kotlin.io;TextStreamsKt;readLines;(Reader);generated",
+        "kotlin.io;TextStreamsKt;readText;(URL,Charset);generated",
+        "kotlin.js;ExperimentalJsExport;ExperimentalJsExport;();generated",
+        "kotlin.js;JsExport;JsExport;();generated", "kotlin.js;JsName;JsName;(String);generated",
+        "kotlin.js;JsName;name;();generated", "kotlin.jvm.functions;Function0;invoke;();generated",
+        "kotlin.jvm.functions;Function10;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function11;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function12;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function13;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function14;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function15;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function16;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function17;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function18;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function19;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function1;invoke;(Object);generated",
+        "kotlin.jvm.functions;Function20;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function21;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function22;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function2;invoke;(Object,Object);generated",
+        "kotlin.jvm.functions;Function3;invoke;(Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function4;invoke;(Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function5;invoke;(Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function6;invoke;(Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function7;invoke;(Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function8;invoke;(Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;Function9;invoke;(Object,Object,Object,Object,Object,Object,Object,Object,Object);generated",
+        "kotlin.jvm.functions;FunctionN;invoke;(Object[]);generated",
+        "kotlin.jvm.internal;AdaptedFunctionReference;equals;(Object);generated",
+        "kotlin.jvm.internal;AdaptedFunctionReference;getOwner;();generated",
+        "kotlin.jvm.internal;AdaptedFunctionReference;hashCode;();generated",
+        "kotlin.jvm.internal;AdaptedFunctionReference;toString;();generated",
+        "kotlin.jvm.internal;ArrayIteratorsKt;iterator;(boolean[]);generated",
+        "kotlin.jvm.internal;ArrayIteratorsKt;iterator;(double[]);generated",
+        "kotlin.jvm.internal;ArrayIteratorsKt;iterator;(float[]);generated",
+        "kotlin.jvm.internal;ArrayIteratorsKt;iterator;(int[]);generated",
+        "kotlin.jvm.internal;ArrayIteratorsKt;iterator;(long[]);generated",
+        "kotlin.jvm.internal;ArrayIteratorsKt;iterator;(short[]);generated",
+        "kotlin.jvm.internal;BooleanSpreadBuilder;BooleanSpreadBuilder;(int);generated",
+        "kotlin.jvm.internal;BooleanSpreadBuilder;add;(boolean);generated",
+        "kotlin.jvm.internal;BooleanSpreadBuilder;toArray;();generated",
+        "kotlin.jvm.internal;ByteSpreadBuilder;ByteSpreadBuilder;(int);generated",
+        "kotlin.jvm.internal;ByteSpreadBuilder;add;(byte);generated",
+        "kotlin.jvm.internal;CallableReference;CallableReference;();generated",
+        "kotlin.jvm.internal;CallableReference;getOwner;();generated",
+        "kotlin.jvm.internal;CharSpreadBuilder;CharSpreadBuilder;(int);generated",
+        "kotlin.jvm.internal;CharSpreadBuilder;add;(char);generated",
+        "kotlin.jvm.internal;ClassBasedDeclarationContainer;getJClass;();generated",
+        "kotlin.jvm.internal;ClassReference$Companion;isInstance;(Object,Class);generated",
+        "kotlin.jvm.internal;ClassReference;ClassReference;(Class);generated",
+        "kotlin.jvm.internal;ClassReference;equals;(Object);generated",
+        "kotlin.jvm.internal;ClassReference;hashCode;();generated",
+        "kotlin.jvm.internal;ClassReference;toString;();generated",
+        "kotlin.jvm.internal;DoubleSpreadBuilder;DoubleSpreadBuilder;(int);generated",
+        "kotlin.jvm.internal;DoubleSpreadBuilder;add;(double);generated",
+        "kotlin.jvm.internal;DoubleSpreadBuilder;toArray;();generated",
+        "kotlin.jvm.internal;FloatSpreadBuilder;FloatSpreadBuilder;(int);generated",
+        "kotlin.jvm.internal;FloatSpreadBuilder;add;(float);generated",
+        "kotlin.jvm.internal;FloatSpreadBuilder;toArray;();generated",
+        "kotlin.jvm.internal;FunInterfaceConstructorReference;FunInterfaceConstructorReference;(Class);generated",
+        "kotlin.jvm.internal;FunInterfaceConstructorReference;equals;(Object);generated",
+        "kotlin.jvm.internal;FunInterfaceConstructorReference;hashCode;();generated",
+        "kotlin.jvm.internal;FunInterfaceConstructorReference;toString;();generated",
+        "kotlin.jvm.internal;FunctionAdapter;getFunctionDelegate;();generated",
+        "kotlin.jvm.internal;FunctionBase;getArity;();generated",
+        "kotlin.jvm.internal;FunctionImpl;FunctionImpl;();generated",
+        "kotlin.jvm.internal;FunctionImpl;getArity;();generated",
+        "kotlin.jvm.internal;FunctionImpl;invokeVararg;(Object[]);generated",
+        "kotlin.jvm.internal;FunctionReference;FunctionReference;(int);generated",
+        "kotlin.jvm.internal;FunctionReference;equals;(Object);generated",
+        "kotlin.jvm.internal;FunctionReference;hashCode;();generated",
+        "kotlin.jvm.internal;InlineMarker;InlineMarker;();generated",
+        "kotlin.jvm.internal;InlineMarker;afterInlineCall;();generated",
+        "kotlin.jvm.internal;InlineMarker;beforeInlineCall;();generated",
+        "kotlin.jvm.internal;InlineMarker;finallyEnd;(int);generated",
+        "kotlin.jvm.internal;InlineMarker;finallyStart;(int);generated",
+        "kotlin.jvm.internal;InlineMarker;mark;(String);generated",
+        "kotlin.jvm.internal;InlineMarker;mark;(int);generated",
+        "kotlin.jvm.internal;IntSpreadBuilder;IntSpreadBuilder;(int);generated",
+        "kotlin.jvm.internal;IntSpreadBuilder;add;(int);generated",
+        "kotlin.jvm.internal;IntSpreadBuilder;toArray;();generated",
+        "kotlin.jvm.internal;Intrinsics;areEqual;(Double,Double);generated",
+        "kotlin.jvm.internal;Intrinsics;areEqual;(Double,double);generated",
+        "kotlin.jvm.internal;Intrinsics;areEqual;(Float,Float);generated",
+        "kotlin.jvm.internal;Intrinsics;areEqual;(Float,float);generated",
+        "kotlin.jvm.internal;Intrinsics;areEqual;(Object,Object);generated",
+        "kotlin.jvm.internal;Intrinsics;areEqual;(double,Double);generated",
+        "kotlin.jvm.internal;Intrinsics;areEqual;(float,Float);generated",
+        "kotlin.jvm.internal;Intrinsics;checkExpressionValueIsNotNull;(Object,String);generated",
+        "kotlin.jvm.internal;Intrinsics;checkFieldIsNotNull;(Object,String);generated",
+        "kotlin.jvm.internal;Intrinsics;checkFieldIsNotNull;(Object,String,String);generated",
+        "kotlin.jvm.internal;Intrinsics;checkHasClass;(String);generated",
+        "kotlin.jvm.internal;Intrinsics;checkHasClass;(String,String);generated",
+        "kotlin.jvm.internal;Intrinsics;checkNotNull;(Object);generated",
+        "kotlin.jvm.internal;Intrinsics;checkNotNull;(Object,String);generated",
+        "kotlin.jvm.internal;Intrinsics;checkNotNullExpressionValue;(Object,String);generated",
+        "kotlin.jvm.internal;Intrinsics;checkNotNullParameter;(Object,String);generated",
+        "kotlin.jvm.internal;Intrinsics;checkParameterIsNotNull;(Object,String);generated",
+        "kotlin.jvm.internal;Intrinsics;checkReturnedValueIsNotNull;(Object,String);generated",
+        "kotlin.jvm.internal;Intrinsics;checkReturnedValueIsNotNull;(Object,String,String);generated",
+        "kotlin.jvm.internal;Intrinsics;compare;(int,int);generated",
+        "kotlin.jvm.internal;Intrinsics;compare;(long,long);generated",
+        "kotlin.jvm.internal;Intrinsics;needClassReification;();generated",
+        "kotlin.jvm.internal;Intrinsics;needClassReification;(String);generated",
+        "kotlin.jvm.internal;Intrinsics;reifiedOperationMarker;(int,String);generated",
+        "kotlin.jvm.internal;Intrinsics;reifiedOperationMarker;(int,String,String);generated",
+        "kotlin.jvm.internal;Intrinsics;throwAssert;();generated",
+        "kotlin.jvm.internal;Intrinsics;throwAssert;(String);generated",
+        "kotlin.jvm.internal;Intrinsics;throwIllegalArgument;();generated",
+        "kotlin.jvm.internal;Intrinsics;throwIllegalArgument;(String);generated",
+        "kotlin.jvm.internal;Intrinsics;throwIllegalState;();generated",
+        "kotlin.jvm.internal;Intrinsics;throwIllegalState;(String);generated",
+        "kotlin.jvm.internal;Intrinsics;throwJavaNpe;();generated",
+        "kotlin.jvm.internal;Intrinsics;throwJavaNpe;(String);generated",
+        "kotlin.jvm.internal;Intrinsics;throwNpe;();generated",
+        "kotlin.jvm.internal;Intrinsics;throwNpe;(String);generated",
+        "kotlin.jvm.internal;Intrinsics;throwUndefinedForReified;();generated",
+        "kotlin.jvm.internal;Intrinsics;throwUndefinedForReified;(String);generated",
+        "kotlin.jvm.internal;Intrinsics;throwUninitializedProperty;(String);generated",
+        "kotlin.jvm.internal;Intrinsics;throwUninitializedPropertyAccessException;(String);generated",
+        "kotlin.jvm.internal;KTypeBase;getJavaType;();generated",
+        "kotlin.jvm.internal;Lambda;Lambda;(int);generated",
+        "kotlin.jvm.internal;Lambda;toString;();generated",
+        "kotlin.jvm.internal;LocalVariableReference;LocalVariableReference;();generated",
+        "kotlin.jvm.internal;LongSpreadBuilder;LongSpreadBuilder;(int);generated",
+        "kotlin.jvm.internal;LongSpreadBuilder;add;(long);generated",
+        "kotlin.jvm.internal;LongSpreadBuilder;toArray;();generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;MagicApiIntrinsics;();generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;anyMagicApiCall;(Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;anyMagicApiCall;(int);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;anyMagicApiCall;(int,Object,Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;anyMagicApiCall;(int,Object,Object,Object,Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;anyMagicApiCall;(int,long,Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;anyMagicApiCall;(int,long,long,Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;intMagicApiCall;(Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;intMagicApiCall;(int);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;intMagicApiCall;(int,Object,Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;intMagicApiCall;(int,Object,Object,Object,Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;intMagicApiCall;(int,long,Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;intMagicApiCall;(int,long,long,Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;voidMagicApiCall;(Object);generated",
+        "kotlin.jvm.internal;MagicApiIntrinsics;voidMagicApiCall;(int);generated",
+        "kotlin.jvm.internal;MutableLocalVariableReference;MutableLocalVariableReference;();generated",
+        "kotlin.jvm.internal;MutablePropertyReference0;MutablePropertyReference0;();generated",
+        "kotlin.jvm.internal;MutablePropertyReference1;MutablePropertyReference1;();generated",
+        "kotlin.jvm.internal;MutablePropertyReference2;MutablePropertyReference2;();generated",
+        "kotlin.jvm.internal;MutablePropertyReference;MutablePropertyReference;();generated",
+        "kotlin.jvm.internal;PackageReference;equals;(Object);generated",
+        "kotlin.jvm.internal;PackageReference;hashCode;();generated",
+        "kotlin.jvm.internal;PackageReference;toString;();generated",
+        "kotlin.jvm.internal;PrimitiveSpreadBuilder;PrimitiveSpreadBuilder;(int);generated",
+        "kotlin.jvm.internal;PropertyReference0;PropertyReference0;();generated",
+        "kotlin.jvm.internal;PropertyReference1;PropertyReference1;();generated",
+        "kotlin.jvm.internal;PropertyReference2;PropertyReference2;();generated",
+        "kotlin.jvm.internal;PropertyReference;PropertyReference;();generated",
+        "kotlin.jvm.internal;PropertyReference;equals;(Object);generated",
+        "kotlin.jvm.internal;PropertyReference;hashCode;();generated",
+        "kotlin.jvm.internal;Ref$BooleanRef;BooleanRef;();generated",
+        "kotlin.jvm.internal;Ref$BooleanRef;toString;();generated",
+        "kotlin.jvm.internal;Ref$ByteRef;ByteRef;();generated",
+        "kotlin.jvm.internal;Ref$ByteRef;toString;();generated",
+        "kotlin.jvm.internal;Ref$CharRef;CharRef;();generated",
+        "kotlin.jvm.internal;Ref$CharRef;toString;();generated",
+        "kotlin.jvm.internal;Ref$DoubleRef;DoubleRef;();generated",
+        "kotlin.jvm.internal;Ref$DoubleRef;toString;();generated",
+        "kotlin.jvm.internal;Ref$FloatRef;FloatRef;();generated",
+        "kotlin.jvm.internal;Ref$FloatRef;toString;();generated",
+        "kotlin.jvm.internal;Ref$IntRef;IntRef;();generated",
+        "kotlin.jvm.internal;Ref$IntRef;toString;();generated",
+        "kotlin.jvm.internal;Ref$LongRef;LongRef;();generated",
+        "kotlin.jvm.internal;Ref$LongRef;toString;();generated",
+        "kotlin.jvm.internal;Ref$ObjectRef;ObjectRef;();generated",
+        "kotlin.jvm.internal;Ref$ObjectRef;toString;();generated",
+        "kotlin.jvm.internal;Ref$ShortRef;ShortRef;();generated",
+        "kotlin.jvm.internal;Ref$ShortRef;toString;();generated",
+        "kotlin.jvm.internal;Reflection;Reflection;();generated",
+        "kotlin.jvm.internal;Reflection;createKotlinClass;(Class);generated",
+        "kotlin.jvm.internal;Reflection;createKotlinClass;(Class,String);generated",
+        "kotlin.jvm.internal;Reflection;getOrCreateKotlinClass;(Class);generated",
+        "kotlin.jvm.internal;Reflection;getOrCreateKotlinClass;(Class,String);generated",
+        "kotlin.jvm.internal;Reflection;getOrCreateKotlinClasses;(Class[]);generated",
+        "kotlin.jvm.internal;Reflection;getOrCreateKotlinPackage;(Class);generated",
+        "kotlin.jvm.internal;Reflection;nullableTypeOf;(Class);generated",
+        "kotlin.jvm.internal;Reflection;nullableTypeOf;(Class,KTypeProjection[]);generated",
+        "kotlin.jvm.internal;Reflection;renderLambdaToString;(FunctionBase);generated",
+        "kotlin.jvm.internal;Reflection;renderLambdaToString;(Lambda);generated",
+        "kotlin.jvm.internal;Reflection;setUpperBounds;(KTypeParameter,KType[]);generated",
+        "kotlin.jvm.internal;Reflection;typeOf;(Class);generated",
+        "kotlin.jvm.internal;Reflection;typeOf;(Class,KTypeProjection[]);generated",
+        "kotlin.jvm.internal;ReflectionFactory;ReflectionFactory;();generated",
+        "kotlin.jvm.internal;ReflectionFactory;createKotlinClass;(Class);generated",
+        "kotlin.jvm.internal;ReflectionFactory;createKotlinClass;(Class,String);generated",
+        "kotlin.jvm.internal;ReflectionFactory;getOrCreateKotlinClass;(Class);generated",
+        "kotlin.jvm.internal;ReflectionFactory;getOrCreateKotlinClass;(Class,String);generated",
+        "kotlin.jvm.internal;ReflectionFactory;renderLambdaToString;(FunctionBase);generated",
+        "kotlin.jvm.internal;ReflectionFactory;renderLambdaToString;(Lambda);generated",
+        "kotlin.jvm.internal;SerializedIr;SerializedIr;(String[]);generated",
+        "kotlin.jvm.internal;SerializedIr;b;();generated",
+        "kotlin.jvm.internal;ShortSpreadBuilder;ShortSpreadBuilder;(int);generated",
+        "kotlin.jvm.internal;ShortSpreadBuilder;add;(short);generated",
+        "kotlin.jvm.internal;ShortSpreadBuilder;toArray;();generated",
+        "kotlin.jvm.internal;SpreadBuilder;SpreadBuilder;(int);generated",
+        "kotlin.jvm.internal;SpreadBuilder;size;();generated",
+        "kotlin.jvm.internal;TypeIntrinsics;TypeIntrinsics;();generated",
+        "kotlin.jvm.internal;TypeIntrinsics;getFunctionArity;(Object);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;isFunctionOfArity;(Object,int);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;isMutableCollection;(Object);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;isMutableIterable;(Object);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;isMutableIterator;(Object);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;isMutableList;(Object);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;isMutableListIterator;(Object);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;isMutableMap;(Object);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;isMutableMapEntry;(Object);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;isMutableSet;(Object);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;throwCce;(ClassCastException);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;throwCce;(Object,String);generated",
+        "kotlin.jvm.internal;TypeIntrinsics;throwCce;(String);generated",
+        "kotlin.jvm.internal;TypeParameterReference$Companion;toString;(KTypeParameter);generated",
+        "kotlin.jvm.internal;TypeParameterReference;equals;(Object);generated",
+        "kotlin.jvm.internal;TypeParameterReference;hashCode;();generated",
+        "kotlin.jvm.internal;TypeParameterReference;toString;();generated",
+        "kotlin.jvm.internal;TypeReference;equals;(Object);generated",
+        "kotlin.jvm.internal;TypeReference;hashCode;();generated",
+        "kotlin.jvm;JvmClassMappingKt;getAnnotationClass;(Annotation);generated",
+        "kotlin.jvm;JvmClassMappingKt;getDeclaringJavaClass;(Enum);generated",
+        "kotlin.jvm;JvmClassMappingKt;getJavaClass;(KClass);generated",
+        "kotlin.jvm;JvmClassMappingKt;getJavaClass;(Object);generated",
+        "kotlin.jvm;JvmClassMappingKt;getJavaObjectType;(KClass);generated",
+        "kotlin.jvm;JvmClassMappingKt;getJavaPrimitiveType;(KClass);generated",
+        "kotlin.jvm;JvmClassMappingKt;getKotlinClass;(Class);generated",
+        "kotlin.jvm;JvmClassMappingKt;getRuntimeClassOfKClassInstance;(KClass);generated",
+        "kotlin.jvm;JvmClassMappingKt;isArrayOf;(Object[]);generated",
+        "kotlin.jvm;JvmDefault;JvmDefault;();generated",
+        "kotlin.jvm;JvmDefaultWithCompatibility;JvmDefaultWithCompatibility;();generated",
+        "kotlin.jvm;JvmDefaultWithoutCompatibility;JvmDefaultWithoutCompatibility;();generated",
+        "kotlin.jvm;JvmField;JvmField;();generated", "kotlin.jvm;JvmInline;JvmInline;();generated",
+        "kotlin.jvm;JvmMultifileClass;JvmMultifileClass;();generated",
+        "kotlin.jvm;JvmName;JvmName;(String);generated", "kotlin.jvm;JvmName;name;();generated",
+        "kotlin.jvm;JvmOverloads;JvmOverloads;();generated",
+        "kotlin.jvm;JvmRecord;JvmRecord;();generated",
+        "kotlin.jvm;JvmStatic;JvmStatic;();generated",
+        "kotlin.jvm;JvmSuppressWildcards;JvmSuppressWildcards;(boolean);generated",
+        "kotlin.jvm;JvmSuppressWildcards;suppress;();generated",
+        "kotlin.jvm;JvmSynthetic;JvmSynthetic;();generated",
+        "kotlin.jvm;JvmWildcard;JvmWildcard;();generated",
+        "kotlin.jvm;KotlinReflectionNotSupportedError;KotlinReflectionNotSupportedError;();generated",
+        "kotlin.jvm;KotlinReflectionNotSupportedError;KotlinReflectionNotSupportedError;(String);generated",
+        "kotlin.jvm;KotlinReflectionNotSupportedError;KotlinReflectionNotSupportedError;(String,Throwable);generated",
+        "kotlin.jvm;KotlinReflectionNotSupportedError;KotlinReflectionNotSupportedError;(Throwable);generated",
+        "kotlin.jvm;PurelyImplements;PurelyImplements;(String);generated",
+        "kotlin.jvm;PurelyImplements;value;();generated",
+        "kotlin.jvm;Strictfp;Strictfp;();generated",
+        "kotlin.jvm;Synchronized;Synchronized;();generated",
+        "kotlin.jvm;Throws;Throws;(KClass[]);generated",
+        "kotlin.jvm;Throws;exceptionClasses;();generated",
+        "kotlin.jvm;Transient;Transient;();generated", "kotlin.jvm;Volatile;Volatile;();generated",
+        "kotlin.math;MathKt;IEEErem;(double,double);generated",
+        "kotlin.math;MathKt;IEEErem;(float,float);generated",
+        "kotlin.math;MathKt;abs;(double);generated", "kotlin.math;MathKt;abs;(float);generated",
+        "kotlin.math;MathKt;abs;(int);generated", "kotlin.math;MathKt;abs;(long);generated",
+        "kotlin.math;MathKt;acos;(double);generated", "kotlin.math;MathKt;acos;(float);generated",
+        "kotlin.math;MathKt;acosh;(double);generated", "kotlin.math;MathKt;acosh;(float);generated",
+        "kotlin.math;MathKt;asin;(double);generated", "kotlin.math;MathKt;asin;(float);generated",
+        "kotlin.math;MathKt;asinh;(double);generated", "kotlin.math;MathKt;asinh;(float);generated",
+        "kotlin.math;MathKt;atan2;(double,double);generated",
+        "kotlin.math;MathKt;atan2;(float,float);generated",
+        "kotlin.math;MathKt;atan;(double);generated", "kotlin.math;MathKt;atan;(float);generated",
+        "kotlin.math;MathKt;atanh;(double);generated", "kotlin.math;MathKt;atanh;(float);generated",
+        "kotlin.math;MathKt;cbrt;(double);generated", "kotlin.math;MathKt;cbrt;(float);generated",
+        "kotlin.math;MathKt;ceil;(double);generated", "kotlin.math;MathKt;ceil;(float);generated",
+        "kotlin.math;MathKt;cos;(double);generated", "kotlin.math;MathKt;cos;(float);generated",
+        "kotlin.math;MathKt;cosh;(double);generated", "kotlin.math;MathKt;cosh;(float);generated",
+        "kotlin.math;MathKt;exp;(double);generated", "kotlin.math;MathKt;exp;(float);generated",
+        "kotlin.math;MathKt;expm1;(double);generated", "kotlin.math;MathKt;expm1;(float);generated",
+        "kotlin.math;MathKt;floor;(double);generated", "kotlin.math;MathKt;floor;(float);generated",
+        "kotlin.math;MathKt;getAbsoluteValue;(double);generated",
+        "kotlin.math;MathKt;getAbsoluteValue;(float);generated",
+        "kotlin.math;MathKt;getAbsoluteValue;(int);generated",
+        "kotlin.math;MathKt;getAbsoluteValue;(long);generated",
+        "kotlin.math;MathKt;getE;();generated", "kotlin.math;MathKt;getPI;();generated",
+        "kotlin.math;MathKt;getSign;(double);generated",
+        "kotlin.math;MathKt;getSign;(float);generated",
+        "kotlin.math;MathKt;getSign;(int);generated", "kotlin.math;MathKt;getSign;(long);generated",
+        "kotlin.math;MathKt;getUlp;(double);generated",
+        "kotlin.math;MathKt;getUlp;(float);generated",
+        "kotlin.math;MathKt;hypot;(double,double);generated",
+        "kotlin.math;MathKt;hypot;(float,float);generated",
+        "kotlin.math;MathKt;ln1p;(double);generated", "kotlin.math;MathKt;ln1p;(float);generated",
+        "kotlin.math;MathKt;ln;(double);generated", "kotlin.math;MathKt;ln;(float);generated",
+        "kotlin.math;MathKt;log10;(double);generated", "kotlin.math;MathKt;log10;(float);generated",
+        "kotlin.math;MathKt;log2;(double);generated", "kotlin.math;MathKt;log2;(float);generated",
+        "kotlin.math;MathKt;log;(double,double);generated",
+        "kotlin.math;MathKt;log;(float,float);generated",
+        "kotlin.math;MathKt;max;(double,double);generated",
+        "kotlin.math;MathKt;max;(float,float);generated",
+        "kotlin.math;MathKt;max;(int,int);generated",
+        "kotlin.math;MathKt;max;(long,long);generated",
+        "kotlin.math;MathKt;min;(double,double);generated",
+        "kotlin.math;MathKt;min;(float,float);generated",
+        "kotlin.math;MathKt;min;(int,int);generated",
+        "kotlin.math;MathKt;min;(long,long);generated",
+        "kotlin.math;MathKt;nextDown;(double);generated",
+        "kotlin.math;MathKt;nextDown;(float);generated",
+        "kotlin.math;MathKt;nextTowards;(double,double);generated",
+        "kotlin.math;MathKt;nextTowards;(float,float);generated",
+        "kotlin.math;MathKt;nextUp;(double);generated",
+        "kotlin.math;MathKt;nextUp;(float);generated",
+        "kotlin.math;MathKt;pow;(double,double);generated",
+        "kotlin.math;MathKt;pow;(double,int);generated",
+        "kotlin.math;MathKt;pow;(float,float);generated",
+        "kotlin.math;MathKt;pow;(float,int);generated",
+        "kotlin.math;MathKt;round;(double);generated", "kotlin.math;MathKt;round;(float);generated",
+        "kotlin.math;MathKt;roundToInt;(double);generated",
+        "kotlin.math;MathKt;roundToInt;(float);generated",
+        "kotlin.math;MathKt;roundToLong;(double);generated",
+        "kotlin.math;MathKt;roundToLong;(float);generated",
+        "kotlin.math;MathKt;sign;(double);generated", "kotlin.math;MathKt;sign;(float);generated",
+        "kotlin.math;MathKt;sin;(double);generated", "kotlin.math;MathKt;sin;(float);generated",
+        "kotlin.math;MathKt;sinh;(double);generated", "kotlin.math;MathKt;sinh;(float);generated",
+        "kotlin.math;MathKt;sqrt;(double);generated", "kotlin.math;MathKt;sqrt;(float);generated",
+        "kotlin.math;MathKt;tan;(double);generated", "kotlin.math;MathKt;tan;(float);generated",
+        "kotlin.math;MathKt;tanh;(double);generated", "kotlin.math;MathKt;tanh;(float);generated",
+        "kotlin.math;MathKt;truncate;(double);generated",
+        "kotlin.math;MathKt;truncate;(float);generated",
+        "kotlin.math;MathKt;withSign;(double,double);generated",
+        "kotlin.math;MathKt;withSign;(double,int);generated",
+        "kotlin.math;MathKt;withSign;(float,float);generated",
+        "kotlin.math;MathKt;withSign;(float,int);generated",
+        "kotlin.math;UMathKt;max;(int,int);generated",
+        "kotlin.math;UMathKt;max;(long,long);generated",
+        "kotlin.math;UMathKt;min;(int,int);generated",
+        "kotlin.math;UMathKt;min;(long,long);generated",
+        "kotlin.native.concurrent;SharedImmutable;SharedImmutable;();generated",
+        "kotlin.native.concurrent;ThreadLocal;ThreadLocal;();generated",
+        "kotlin.native;CName;CName;(String,String);generated",
+        "kotlin.native;CName;externName;();generated", "kotlin.native;CName;shortName;();generated",
+        "kotlin.properties;Delegates;notNull;();generated",
+        "kotlin.properties;Delegates;observable;(Object,Function3);generated",
+        "kotlin.properties;Delegates;vetoable;(Object,Function3);generated",
+        "kotlin.properties;PropertyDelegateProvider;provideDelegate;(Object,KProperty);generated",
+        "kotlin.properties;ReadOnlyProperty;getValue;(Object,KProperty);generated",
+        "kotlin.properties;ReadWriteProperty;setValue;(Object,KProperty,Object);generated",
+        "kotlin.random;Random;Random;();generated", "kotlin.random;Random;nextBits;(int);generated",
+        "kotlin.random;Random;nextBoolean;();generated",
+        "kotlin.random;Random;nextBytes;(int);generated",
+        "kotlin.random;Random;nextDouble;();generated",
+        "kotlin.random;Random;nextDouble;(double);generated",
+        "kotlin.random;Random;nextDouble;(double,double);generated",
+        "kotlin.random;Random;nextFloat;();generated", "kotlin.random;Random;nextInt;();generated",
+        "kotlin.random;Random;nextInt;(int);generated",
+        "kotlin.random;Random;nextInt;(int,int);generated",
+        "kotlin.random;Random;nextLong;();generated",
+        "kotlin.random;Random;nextLong;(long);generated",
+        "kotlin.random;Random;nextLong;(long,long);generated",
+        "kotlin.random;RandomKt;Random;(int);generated",
+        "kotlin.random;RandomKt;Random;(long);generated",
+        "kotlin.random;RandomKt;nextInt;(Random,IntRange);generated",
+        "kotlin.random;RandomKt;nextLong;(Random,LongRange);generated",
+        "kotlin.random;URandomKt;nextUBytes;(Random,int);generated",
+        "kotlin.random;URandomKt;nextUInt;(Random);generated",
+        "kotlin.random;URandomKt;nextUInt;(Random,UIntRange);generated",
+        "kotlin.random;URandomKt;nextUInt;(Random,int);generated",
+        "kotlin.random;URandomKt;nextUInt;(Random,int,int);generated",
+        "kotlin.random;URandomKt;nextULong;(Random);generated",
+        "kotlin.random;URandomKt;nextULong;(Random,ULongRange);generated",
+        "kotlin.random;URandomKt;nextULong;(Random,long);generated",
+        "kotlin.random;URandomKt;nextULong;(Random,long,long);generated",
+        "kotlin.ranges;CharProgression$Companion;fromClosedRange;(char,char,int);generated",
+        "kotlin.ranges;CharProgression;equals;(Object);generated",
+        "kotlin.ranges;CharProgression;getFirst;();generated",
+        "kotlin.ranges;CharProgression;getLast;();generated",
+        "kotlin.ranges;CharProgression;getStep;();generated",
+        "kotlin.ranges;CharProgression;hashCode;();generated",
+        "kotlin.ranges;CharProgression;isEmpty;();generated",
+        "kotlin.ranges;CharProgression;toString;();generated",
+        "kotlin.ranges;CharRange;CharRange;(char,char);generated",
+        "kotlin.ranges;CharRange;contains;(char);generated",
+        "kotlin.ranges;CharRange;equals;(Object);generated",
+        "kotlin.ranges;CharRange;hashCode;();generated",
+        "kotlin.ranges;CharRange;toString;();generated",
+        "kotlin.ranges;ClosedFloatingPointRange;lessThanOrEquals;(Comparable,Comparable);generated",
+        "kotlin.ranges;ClosedRange;contains;(Comparable);generated",
+        "kotlin.ranges;ClosedRange;getEndInclusive;();generated",
+        "kotlin.ranges;ClosedRange;getStart;();generated",
+        "kotlin.ranges;ClosedRange;isEmpty;();generated",
+        "kotlin.ranges;IntProgression$Companion;fromClosedRange;(int,int,int);generated",
+        "kotlin.ranges;IntProgression;equals;(Object);generated",
+        "kotlin.ranges;IntProgression;getFirst;();generated",
+        "kotlin.ranges;IntProgression;getLast;();generated",
+        "kotlin.ranges;IntProgression;getStep;();generated",
+        "kotlin.ranges;IntProgression;hashCode;();generated",
+        "kotlin.ranges;IntProgression;isEmpty;();generated",
+        "kotlin.ranges;IntProgression;toString;();generated",
+        "kotlin.ranges;IntRange;IntRange;(int,int);generated",
+        "kotlin.ranges;IntRange;contains;(int);generated",
+        "kotlin.ranges;IntRange;equals;(Object);generated",
+        "kotlin.ranges;IntRange;hashCode;();generated",
+        "kotlin.ranges;IntRange;toString;();generated",
+        "kotlin.ranges;LongProgression$Companion;fromClosedRange;(long,long,long);generated",
+        "kotlin.ranges;LongProgression;equals;(Object);generated",
+        "kotlin.ranges;LongProgression;getFirst;();generated",
+        "kotlin.ranges;LongProgression;getLast;();generated",
+        "kotlin.ranges;LongProgression;getStep;();generated",
+        "kotlin.ranges;LongProgression;hashCode;();generated",
+        "kotlin.ranges;LongProgression;isEmpty;();generated",
+        "kotlin.ranges;LongProgression;toString;();generated",
+        "kotlin.ranges;LongRange;LongRange;(long,long);generated",
+        "kotlin.ranges;LongRange;contains;(long);generated",
+        "kotlin.ranges;LongRange;equals;(Object);generated",
+        "kotlin.ranges;LongRange;hashCode;();generated",
+        "kotlin.ranges;LongRange;toString;();generated",
+        "kotlin.ranges;OpenEndRange;contains;(Comparable);generated",
+        "kotlin.ranges;OpenEndRange;getEndExclusive;();generated",
+        "kotlin.ranges;OpenEndRange;getStart;();generated",
+        "kotlin.ranges;OpenEndRange;isEmpty;();generated",
+        "kotlin.ranges;RangesKt;byteRangeContains;(ClosedRange,double);generated",
+        "kotlin.ranges;RangesKt;byteRangeContains;(ClosedRange,float);generated",
+        "kotlin.ranges;RangesKt;byteRangeContains;(ClosedRange,int);generated",
+        "kotlin.ranges;RangesKt;byteRangeContains;(ClosedRange,long);generated",
+        "kotlin.ranges;RangesKt;byteRangeContains;(ClosedRange,short);generated",
+        "kotlin.ranges;RangesKt;byteRangeContains;(OpenEndRange,int);generated",
+        "kotlin.ranges;RangesKt;byteRangeContains;(OpenEndRange,long);generated",
+        "kotlin.ranges;RangesKt;byteRangeContains;(OpenEndRange,short);generated",
+        "kotlin.ranges;RangesKt;coerceAtLeast;(byte,byte);generated",
+        "kotlin.ranges;RangesKt;coerceAtLeast;(double,double);generated",
+        "kotlin.ranges;RangesKt;coerceAtLeast;(float,float);generated",
+        "kotlin.ranges;RangesKt;coerceAtLeast;(int,int);generated",
+        "kotlin.ranges;RangesKt;coerceAtLeast;(long,long);generated",
+        "kotlin.ranges;RangesKt;coerceAtLeast;(short,short);generated",
+        "kotlin.ranges;RangesKt;coerceAtMost;(byte,byte);generated",
+        "kotlin.ranges;RangesKt;coerceAtMost;(double,double);generated",
+        "kotlin.ranges;RangesKt;coerceAtMost;(float,float);generated",
+        "kotlin.ranges;RangesKt;coerceAtMost;(int,int);generated",
+        "kotlin.ranges;RangesKt;coerceAtMost;(long,long);generated",
+        "kotlin.ranges;RangesKt;coerceAtMost;(short,short);generated",
+        "kotlin.ranges;RangesKt;coerceIn;(byte,byte,byte);generated",
+        "kotlin.ranges;RangesKt;coerceIn;(double,double,double);generated",
+        "kotlin.ranges;RangesKt;coerceIn;(float,float,float);generated",
+        "kotlin.ranges;RangesKt;coerceIn;(int,ClosedRange);generated",
+        "kotlin.ranges;RangesKt;coerceIn;(int,int,int);generated",
+        "kotlin.ranges;RangesKt;coerceIn;(long,ClosedRange);generated",
+        "kotlin.ranges;RangesKt;coerceIn;(long,long,long);generated",
+        "kotlin.ranges;RangesKt;coerceIn;(short,short,short);generated",
+        "kotlin.ranges;RangesKt;contains;(CharRange,Character);generated",
+        "kotlin.ranges;RangesKt;contains;(ClosedRange,Object);generated",
+        "kotlin.ranges;RangesKt;contains;(IntRange,Integer);generated",
+        "kotlin.ranges;RangesKt;contains;(IntRange,byte);generated",
+        "kotlin.ranges;RangesKt;contains;(IntRange,long);generated",
+        "kotlin.ranges;RangesKt;contains;(IntRange,short);generated",
+        "kotlin.ranges;RangesKt;contains;(LongRange,Long);generated",
+        "kotlin.ranges;RangesKt;contains;(LongRange,byte);generated",
+        "kotlin.ranges;RangesKt;contains;(LongRange,int);generated",
+        "kotlin.ranges;RangesKt;contains;(LongRange,short);generated",
+        "kotlin.ranges;RangesKt;contains;(OpenEndRange,Object);generated",
+        "kotlin.ranges;RangesKt;doubleRangeContains;(ClosedRange,byte);generated",
+        "kotlin.ranges;RangesKt;doubleRangeContains;(ClosedRange,float);generated",
+        "kotlin.ranges;RangesKt;doubleRangeContains;(ClosedRange,int);generated",
+        "kotlin.ranges;RangesKt;doubleRangeContains;(ClosedRange,long);generated",
+        "kotlin.ranges;RangesKt;doubleRangeContains;(ClosedRange,short);generated",
+        "kotlin.ranges;RangesKt;doubleRangeContains;(OpenEndRange,float);generated",
+        "kotlin.ranges;RangesKt;downTo;(byte,byte);generated",
+        "kotlin.ranges;RangesKt;downTo;(byte,int);generated",
+        "kotlin.ranges;RangesKt;downTo;(byte,long);generated",
+        "kotlin.ranges;RangesKt;downTo;(byte,short);generated",
+        "kotlin.ranges;RangesKt;downTo;(char,char);generated",
+        "kotlin.ranges;RangesKt;downTo;(int,byte);generated",
+        "kotlin.ranges;RangesKt;downTo;(int,int);generated",
+        "kotlin.ranges;RangesKt;downTo;(int,long);generated",
+        "kotlin.ranges;RangesKt;downTo;(int,short);generated",
+        "kotlin.ranges;RangesKt;downTo;(long,byte);generated",
+        "kotlin.ranges;RangesKt;downTo;(long,int);generated",
+        "kotlin.ranges;RangesKt;downTo;(long,long);generated",
+        "kotlin.ranges;RangesKt;downTo;(long,short);generated",
+        "kotlin.ranges;RangesKt;downTo;(short,byte);generated",
+        "kotlin.ranges;RangesKt;downTo;(short,int);generated",
+        "kotlin.ranges;RangesKt;downTo;(short,long);generated",
+        "kotlin.ranges;RangesKt;downTo;(short,short);generated",
+        "kotlin.ranges;RangesKt;first;(CharProgression);generated",
+        "kotlin.ranges;RangesKt;first;(IntProgression);generated",
+        "kotlin.ranges;RangesKt;first;(LongProgression);generated",
+        "kotlin.ranges;RangesKt;firstOrNull;(CharProgression);generated",
+        "kotlin.ranges;RangesKt;firstOrNull;(IntProgression);generated",
+        "kotlin.ranges;RangesKt;firstOrNull;(LongProgression);generated",
+        "kotlin.ranges;RangesKt;floatRangeContains;(ClosedRange,byte);generated",
+        "kotlin.ranges;RangesKt;floatRangeContains;(ClosedRange,double);generated",
+        "kotlin.ranges;RangesKt;floatRangeContains;(ClosedRange,int);generated",
+        "kotlin.ranges;RangesKt;floatRangeContains;(ClosedRange,long);generated",
+        "kotlin.ranges;RangesKt;floatRangeContains;(ClosedRange,short);generated",
+        "kotlin.ranges;RangesKt;intRangeContains;(ClosedRange,byte);generated",
+        "kotlin.ranges;RangesKt;intRangeContains;(ClosedRange,double);generated",
+        "kotlin.ranges;RangesKt;intRangeContains;(ClosedRange,float);generated",
+        "kotlin.ranges;RangesKt;intRangeContains;(ClosedRange,long);generated",
+        "kotlin.ranges;RangesKt;intRangeContains;(ClosedRange,short);generated",
+        "kotlin.ranges;RangesKt;intRangeContains;(OpenEndRange,byte);generated",
+        "kotlin.ranges;RangesKt;intRangeContains;(OpenEndRange,long);generated",
+        "kotlin.ranges;RangesKt;intRangeContains;(OpenEndRange,short);generated",
+        "kotlin.ranges;RangesKt;last;(CharProgression);generated",
+        "kotlin.ranges;RangesKt;last;(IntProgression);generated",
+        "kotlin.ranges;RangesKt;last;(LongProgression);generated",
+        "kotlin.ranges;RangesKt;lastOrNull;(CharProgression);generated",
+        "kotlin.ranges;RangesKt;lastOrNull;(IntProgression);generated",
+        "kotlin.ranges;RangesKt;lastOrNull;(LongProgression);generated",
+        "kotlin.ranges;RangesKt;longRangeContains;(ClosedRange,byte);generated",
+        "kotlin.ranges;RangesKt;longRangeContains;(ClosedRange,double);generated",
+        "kotlin.ranges;RangesKt;longRangeContains;(ClosedRange,float);generated",
+        "kotlin.ranges;RangesKt;longRangeContains;(ClosedRange,int);generated",
+        "kotlin.ranges;RangesKt;longRangeContains;(ClosedRange,short);generated",
+        "kotlin.ranges;RangesKt;longRangeContains;(OpenEndRange,byte);generated",
+        "kotlin.ranges;RangesKt;longRangeContains;(OpenEndRange,int);generated",
+        "kotlin.ranges;RangesKt;longRangeContains;(OpenEndRange,short);generated",
+        "kotlin.ranges;RangesKt;random;(CharRange);generated",
+        "kotlin.ranges;RangesKt;random;(CharRange,Random);generated",
+        "kotlin.ranges;RangesKt;random;(IntRange);generated",
+        "kotlin.ranges;RangesKt;random;(IntRange,Random);generated",
+        "kotlin.ranges;RangesKt;random;(LongRange);generated",
+        "kotlin.ranges;RangesKt;random;(LongRange,Random);generated",
+        "kotlin.ranges;RangesKt;randomOrNull;(CharRange);generated",
+        "kotlin.ranges;RangesKt;randomOrNull;(CharRange,Random);generated",
+        "kotlin.ranges;RangesKt;randomOrNull;(IntRange);generated",
+        "kotlin.ranges;RangesKt;randomOrNull;(IntRange,Random);generated",
+        "kotlin.ranges;RangesKt;randomOrNull;(LongRange);generated",
+        "kotlin.ranges;RangesKt;randomOrNull;(LongRange,Random);generated",
+        "kotlin.ranges;RangesKt;rangeTo;(double,double);generated",
+        "kotlin.ranges;RangesKt;rangeTo;(float,float);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(byte,byte);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(byte,int);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(byte,long);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(byte,short);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(char,char);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(double,double);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(float,float);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(int,byte);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(int,int);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(int,long);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(int,short);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(long,byte);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(long,int);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(long,long);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(long,short);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(short,byte);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(short,int);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(short,long);generated",
+        "kotlin.ranges;RangesKt;rangeUntil;(short,short);generated",
+        "kotlin.ranges;RangesKt;reversed;(CharProgression);generated",
+        "kotlin.ranges;RangesKt;reversed;(IntProgression);generated",
+        "kotlin.ranges;RangesKt;reversed;(LongProgression);generated",
+        "kotlin.ranges;RangesKt;shortRangeContains;(ClosedRange,byte);generated",
+        "kotlin.ranges;RangesKt;shortRangeContains;(ClosedRange,double);generated",
+        "kotlin.ranges;RangesKt;shortRangeContains;(ClosedRange,float);generated",
+        "kotlin.ranges;RangesKt;shortRangeContains;(ClosedRange,int);generated",
+        "kotlin.ranges;RangesKt;shortRangeContains;(ClosedRange,long);generated",
+        "kotlin.ranges;RangesKt;shortRangeContains;(OpenEndRange,byte);generated",
+        "kotlin.ranges;RangesKt;shortRangeContains;(OpenEndRange,int);generated",
+        "kotlin.ranges;RangesKt;shortRangeContains;(OpenEndRange,long);generated",
+        "kotlin.ranges;RangesKt;step;(CharProgression,int);generated",
+        "kotlin.ranges;RangesKt;step;(IntProgression,int);generated",
+        "kotlin.ranges;RangesKt;step;(LongProgression,long);generated",
+        "kotlin.ranges;RangesKt;until;(byte,byte);generated",
+        "kotlin.ranges;RangesKt;until;(byte,int);generated",
+        "kotlin.ranges;RangesKt;until;(byte,long);generated",
+        "kotlin.ranges;RangesKt;until;(byte,short);generated",
+        "kotlin.ranges;RangesKt;until;(char,char);generated",
+        "kotlin.ranges;RangesKt;until;(int,byte);generated",
+        "kotlin.ranges;RangesKt;until;(int,int);generated",
+        "kotlin.ranges;RangesKt;until;(int,long);generated",
+        "kotlin.ranges;RangesKt;until;(int,short);generated",
+        "kotlin.ranges;RangesKt;until;(long,byte);generated",
+        "kotlin.ranges;RangesKt;until;(long,int);generated",
+        "kotlin.ranges;RangesKt;until;(long,long);generated",
+        "kotlin.ranges;RangesKt;until;(long,short);generated",
+        "kotlin.ranges;RangesKt;until;(short,byte);generated",
+        "kotlin.ranges;RangesKt;until;(short,int);generated",
+        "kotlin.ranges;RangesKt;until;(short,long);generated",
+        "kotlin.ranges;RangesKt;until;(short,short);generated",
+        "kotlin.ranges;UIntProgression$Companion;fromClosedRange;(int,int,int);generated",
+        "kotlin.ranges;UIntProgression;equals;(Object);generated",
+        "kotlin.ranges;UIntProgression;getFirst;();generated",
+        "kotlin.ranges;UIntProgression;getLast;();generated",
+        "kotlin.ranges;UIntProgression;getStep;();generated",
+        "kotlin.ranges;UIntProgression;hashCode;();generated",
+        "kotlin.ranges;UIntProgression;isEmpty;();generated",
+        "kotlin.ranges;UIntProgression;toString;();generated",
+        "kotlin.ranges;UIntRange;UIntRange;(int,int);generated",
+        "kotlin.ranges;UIntRange;contains;(int);generated",
+        "kotlin.ranges;UIntRange;equals;(Object);generated",
+        "kotlin.ranges;UIntRange;hashCode;();generated",
+        "kotlin.ranges;UIntRange;toString;();generated",
+        "kotlin.ranges;ULongProgression$Companion;fromClosedRange;(long,long,long);generated",
+        "kotlin.ranges;ULongProgression;equals;(Object);generated",
+        "kotlin.ranges;ULongProgression;getFirst;();generated",
+        "kotlin.ranges;ULongProgression;getLast;();generated",
+        "kotlin.ranges;ULongProgression;getStep;();generated",
+        "kotlin.ranges;ULongProgression;hashCode;();generated",
+        "kotlin.ranges;ULongProgression;isEmpty;();generated",
+        "kotlin.ranges;ULongProgression;toString;();generated",
+        "kotlin.ranges;ULongRange;ULongRange;(long,long);generated",
+        "kotlin.ranges;ULongRange;contains;(long);generated",
+        "kotlin.ranges;ULongRange;equals;(Object);generated",
+        "kotlin.ranges;ULongRange;hashCode;();generated",
+        "kotlin.ranges;ULongRange;toString;();generated",
+        "kotlin.ranges;URangesKt;coerceAtLeast;(byte,byte);generated",
+        "kotlin.ranges;URangesKt;coerceAtLeast;(int,int);generated",
+        "kotlin.ranges;URangesKt;coerceAtLeast;(long,long);generated",
+        "kotlin.ranges;URangesKt;coerceAtLeast;(short,short);generated",
+        "kotlin.ranges;URangesKt;coerceAtMost;(byte,byte);generated",
+        "kotlin.ranges;URangesKt;coerceAtMost;(int,int);generated",
+        "kotlin.ranges;URangesKt;coerceAtMost;(long,long);generated",
+        "kotlin.ranges;URangesKt;coerceAtMost;(short,short);generated",
+        "kotlin.ranges;URangesKt;coerceIn;(byte,byte,byte);generated",
+        "kotlin.ranges;URangesKt;coerceIn;(int,ClosedRange);generated",
+        "kotlin.ranges;URangesKt;coerceIn;(int,int,int);generated",
+        "kotlin.ranges;URangesKt;coerceIn;(long,ClosedRange);generated",
+        "kotlin.ranges;URangesKt;coerceIn;(long,long,long);generated",
+        "kotlin.ranges;URangesKt;coerceIn;(short,short,short);generated",
+        "kotlin.ranges;URangesKt;contains;(UIntRange,UInt);generated",
+        "kotlin.ranges;URangesKt;contains;(UIntRange,byte);generated",
+        "kotlin.ranges;URangesKt;contains;(UIntRange,long);generated",
+        "kotlin.ranges;URangesKt;contains;(UIntRange,short);generated",
+        "kotlin.ranges;URangesKt;contains;(ULongRange,ULong);generated",
+        "kotlin.ranges;URangesKt;contains;(ULongRange,byte);generated",
+        "kotlin.ranges;URangesKt;contains;(ULongRange,int);generated",
+        "kotlin.ranges;URangesKt;contains;(ULongRange,short);generated",
+        "kotlin.ranges;URangesKt;downTo;(byte,byte);generated",
+        "kotlin.ranges;URangesKt;downTo;(int,int);generated",
+        "kotlin.ranges;URangesKt;downTo;(long,long);generated",
+        "kotlin.ranges;URangesKt;downTo;(short,short);generated",
+        "kotlin.ranges;URangesKt;first;(UIntProgression);generated",
+        "kotlin.ranges;URangesKt;first;(ULongProgression);generated",
+        "kotlin.ranges;URangesKt;firstOrNull;(UIntProgression);generated",
+        "kotlin.ranges;URangesKt;firstOrNull;(ULongProgression);generated",
+        "kotlin.ranges;URangesKt;last;(UIntProgression);generated",
+        "kotlin.ranges;URangesKt;last;(ULongProgression);generated",
+        "kotlin.ranges;URangesKt;lastOrNull;(UIntProgression);generated",
+        "kotlin.ranges;URangesKt;lastOrNull;(ULongProgression);generated",
+        "kotlin.ranges;URangesKt;random;(UIntRange);generated",
+        "kotlin.ranges;URangesKt;random;(UIntRange,Random);generated",
+        "kotlin.ranges;URangesKt;random;(ULongRange);generated",
+        "kotlin.ranges;URangesKt;random;(ULongRange,Random);generated",
+        "kotlin.ranges;URangesKt;randomOrNull;(UIntRange);generated",
+        "kotlin.ranges;URangesKt;randomOrNull;(UIntRange,Random);generated",
+        "kotlin.ranges;URangesKt;randomOrNull;(ULongRange);generated",
+        "kotlin.ranges;URangesKt;randomOrNull;(ULongRange,Random);generated",
+        "kotlin.ranges;URangesKt;rangeUntil;(byte,byte);generated",
+        "kotlin.ranges;URangesKt;rangeUntil;(int,int);generated",
+        "kotlin.ranges;URangesKt;rangeUntil;(long,long);generated",
+        "kotlin.ranges;URangesKt;rangeUntil;(short,short);generated",
+        "kotlin.ranges;URangesKt;reversed;(UIntProgression);generated",
+        "kotlin.ranges;URangesKt;reversed;(ULongProgression);generated",
+        "kotlin.ranges;URangesKt;step;(UIntProgression,int);generated",
+        "kotlin.ranges;URangesKt;step;(ULongProgression,long);generated",
+        "kotlin.ranges;URangesKt;until;(byte,byte);generated",
+        "kotlin.ranges;URangesKt;until;(int,int);generated",
+        "kotlin.ranges;URangesKt;until;(long,long);generated",
+        "kotlin.ranges;URangesKt;until;(short,short);generated",
+        "kotlin.reflect;KAnnotatedElement;getAnnotations;();generated",
+        "kotlin.reflect;KCallable;call;(Object[]);generated",
+        "kotlin.reflect;KCallable;callBy;(Map);generated",
+        "kotlin.reflect;KCallable;getName;();generated",
+        "kotlin.reflect;KCallable;getParameters;();generated",
+        "kotlin.reflect;KCallable;getReturnType;();generated",
+        "kotlin.reflect;KCallable;getTypeParameters;();generated",
+        "kotlin.reflect;KCallable;getVisibility;();generated",
+        "kotlin.reflect;KCallable;isAbstract;();generated",
+        "kotlin.reflect;KCallable;isFinal;();generated",
+        "kotlin.reflect;KCallable;isOpen;();generated",
+        "kotlin.reflect;KCallable;isSuspend;();generated",
+        "kotlin.reflect;KClass;equals;(Object);generated",
+        "kotlin.reflect;KClass;getConstructors;();generated",
+        "kotlin.reflect;KClass;getNestedClasses;();generated",
+        "kotlin.reflect;KClass;getObjectInstance;();generated",
+        "kotlin.reflect;KClass;getQualifiedName;();generated",
+        "kotlin.reflect;KClass;getSealedSubclasses;();generated",
+        "kotlin.reflect;KClass;getSimpleName;();generated",
+        "kotlin.reflect;KClass;getSupertypes;();generated",
+        "kotlin.reflect;KClass;getTypeParameters;();generated",
+        "kotlin.reflect;KClass;getVisibility;();generated",
+        "kotlin.reflect;KClass;hashCode;();generated",
+        "kotlin.reflect;KClass;isAbstract;();generated",
+        "kotlin.reflect;KClass;isCompanion;();generated",
+        "kotlin.reflect;KClass;isData;();generated", "kotlin.reflect;KClass;isFinal;();generated",
+        "kotlin.reflect;KClass;isFun;();generated", "kotlin.reflect;KClass;isInner;();generated",
+        "kotlin.reflect;KClass;isInstance;(Object);generated",
+        "kotlin.reflect;KClass;isOpen;();generated", "kotlin.reflect;KClass;isSealed;();generated",
+        "kotlin.reflect;KClass;isValue;();generated",
+        "kotlin.reflect;KDeclarationContainer;getMembers;();generated",
+        "kotlin.reflect;KFunction;isExternal;();generated",
+        "kotlin.reflect;KFunction;isInfix;();generated",
+        "kotlin.reflect;KFunction;isInline;();generated",
+        "kotlin.reflect;KFunction;isOperator;();generated",
+        "kotlin.reflect;KMutableProperty0;set;(Object);generated",
+        "kotlin.reflect;KMutableProperty1;set;(Object,Object);generated",
+        "kotlin.reflect;KMutableProperty2;set;(Object,Object,Object);generated",
+        "kotlin.reflect;KMutableProperty;getSetter;();generated",
+        "kotlin.reflect;KParameter$Kind;valueOf;(String);generated",
+        "kotlin.reflect;KParameter$Kind;values;();generated",
+        "kotlin.reflect;KParameter;getIndex;();generated",
+        "kotlin.reflect;KParameter;getKind;();generated",
+        "kotlin.reflect;KParameter;getName;();generated",
+        "kotlin.reflect;KParameter;getType;();generated",
+        "kotlin.reflect;KParameter;isOptional;();generated",
+        "kotlin.reflect;KParameter;isVararg;();generated",
+        "kotlin.reflect;KProperty$Accessor;getProperty;();generated",
+        "kotlin.reflect;KProperty0;get;();generated",
+        "kotlin.reflect;KProperty0;getDelegate;();generated",
+        "kotlin.reflect;KProperty1;get;(Object);generated",
+        "kotlin.reflect;KProperty1;getDelegate;(Object);generated",
+        "kotlin.reflect;KProperty2;get;(Object,Object);generated",
+        "kotlin.reflect;KProperty2;getDelegate;(Object,Object);generated",
+        "kotlin.reflect;KProperty;getGetter;();generated",
+        "kotlin.reflect;KProperty;isConst;();generated",
+        "kotlin.reflect;KProperty;isLateinit;();generated",
+        "kotlin.reflect;KType;getArguments;();generated",
+        "kotlin.reflect;KType;getClassifier;();generated",
+        "kotlin.reflect;KType;isMarkedNullable;();generated",
+        "kotlin.reflect;KTypeParameter;getName;();generated",
+        "kotlin.reflect;KTypeParameter;getUpperBounds;();generated",
+        "kotlin.reflect;KTypeParameter;getVariance;();generated",
+        "kotlin.reflect;KTypeParameter;isReified;();generated",
+        "kotlin.reflect;KTypeProjection$Companion;getSTAR;();generated",
+        "kotlin.reflect;KTypeProjection;component1;();generated",
+        "kotlin.reflect;KTypeProjection;equals;(Object);generated",
+        "kotlin.reflect;KTypeProjection;getVariance;();generated",
+        "kotlin.reflect;KTypeProjection;hashCode;();generated",
+        "kotlin.reflect;KVariance;valueOf;(String);generated",
+        "kotlin.reflect;KVariance;values;();generated",
+        "kotlin.reflect;KVisibility;valueOf;(String);generated",
+        "kotlin.reflect;KVisibility;values;();generated",
+        "kotlin.reflect;TypeOfKt;typeOf;();generated",
+        "kotlin.sequences;Sequence;iterator;();generated",
+        "kotlin.sequences;SequenceScope;yield;(Object);generated",
+        "kotlin.sequences;SequenceScope;yieldAll;(Iterable);generated",
+        "kotlin.sequences;SequenceScope;yieldAll;(Iterator);generated",
+        "kotlin.sequences;SequencesKt;Sequence;(Function0);generated",
+        "kotlin.sequences;SequencesKt;all;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;any;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;any;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;asIterable;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;asSequence;(Enumeration);generated",
+        "kotlin.sequences;SequencesKt;asSequence;(Iterator);generated",
+        "kotlin.sequences;SequencesKt;associate;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;associateBy;(Sequence,Function1,Function1);generated",
+        "kotlin.sequences;SequencesKt;averageOfByte;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;averageOfDouble;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;averageOfFloat;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;averageOfInt;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;averageOfLong;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;averageOfShort;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;chunked;(Sequence,int);generated",
+        "kotlin.sequences;SequencesKt;contains;(Sequence,Object);generated",
+        "kotlin.sequences;SequencesKt;count;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;count;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;emptySequence;();generated",
+        "kotlin.sequences;SequencesKt;filterIndexed;(Sequence,Function2);generated",
+        "kotlin.sequences;SequencesKt;flatMapIndexedIterable;(Sequence,Function2);generated",
+        "kotlin.sequences;SequencesKt;flatMapIndexedSequence;(Sequence,Function2);generated",
+        "kotlin.sequences;SequencesKt;forEach;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;forEachIndexed;(Sequence,Function2);generated",
+        "kotlin.sequences;SequencesKt;groupBy;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;groupBy;(Sequence,Function1,Function1);generated",
+        "kotlin.sequences;SequencesKt;groupingBy;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;ifEmpty;(Sequence,Function0);generated",
+        "kotlin.sequences;SequencesKt;indexOf;(Sequence,Object);generated",
+        "kotlin.sequences;SequencesKt;indexOfFirst;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;indexOfLast;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;iterator;(SuspendFunction1);generated",
+        "kotlin.sequences;SequencesKt;lastIndexOf;(Sequence,Object);generated",
+        "kotlin.sequences;SequencesKt;max;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;maxOf;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;maxOfOrNull;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;maxOrNull;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;maxOrThrow;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;min;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;minOf;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;minOfOrNull;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;minOrNull;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;minOrThrow;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;minus;(Sequence,Iterable);generated",
+        "kotlin.sequences;SequencesKt;minus;(Sequence,Object);generated",
+        "kotlin.sequences;SequencesKt;minus;(Sequence,Sequence);generated",
+        "kotlin.sequences;SequencesKt;minusElement;(Sequence,Object);generated",
+        "kotlin.sequences;SequencesKt;none;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;none;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;plus;(Sequence,Iterable);generated",
+        "kotlin.sequences;SequencesKt;plus;(Sequence,Object);generated",
+        "kotlin.sequences;SequencesKt;plus;(Sequence,Object[]);generated",
+        "kotlin.sequences;SequencesKt;plus;(Sequence,Sequence);generated",
+        "kotlin.sequences;SequencesKt;plusElement;(Sequence,Object);generated",
+        "kotlin.sequences;SequencesKt;runningFold;(Sequence,Object,Function2);generated",
+        "kotlin.sequences;SequencesKt;runningFoldIndexed;(Sequence,Object,Function3);generated",
+        "kotlin.sequences;SequencesKt;runningReduce;(Sequence,Function2);generated",
+        "kotlin.sequences;SequencesKt;runningReduceIndexed;(Sequence,Function3);generated",
+        "kotlin.sequences;SequencesKt;scan;(Sequence,Object,Function2);generated",
+        "kotlin.sequences;SequencesKt;scanIndexed;(Sequence,Object,Function3);generated",
+        "kotlin.sequences;SequencesKt;sequence;(SuspendFunction1);generated",
+        "kotlin.sequences;SequencesKt;sequenceOf;(Object[]);generated",
+        "kotlin.sequences;SequencesKt;shuffled;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;shuffled;(Sequence,Random);generated",
+        "kotlin.sequences;SequencesKt;sorted;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;sortedBy;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;sortedByDescending;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;sortedDescending;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;sortedWith;(Sequence,Comparator);generated",
+        "kotlin.sequences;SequencesKt;sumBy;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;sumByDouble;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;sumOfBigDecimal;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;sumOfBigInteger;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;sumOfByte;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;sumOfDouble;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;sumOfDouble;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;sumOfFloat;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;sumOfInt;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;sumOfInt;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;sumOfLong;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;sumOfLong;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;sumOfShort;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;sumOfUInt;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;sumOfULong;(Sequence,Function1);generated",
+        "kotlin.sequences;SequencesKt;windowed;(Sequence,int,int,boolean);generated",
+        "kotlin.sequences;SequencesKt;zipWithNext;(Sequence);generated",
+        "kotlin.sequences;SequencesKt;zipWithNext;(Sequence,Function2);generated",
+        "kotlin.sequences;USequencesKt;sumOfUByte;(Sequence);generated",
+        "kotlin.sequences;USequencesKt;sumOfUInt;(Sequence);generated",
+        "kotlin.sequences;USequencesKt;sumOfULong;(Sequence);generated",
+        "kotlin.sequences;USequencesKt;sumOfUShort;(Sequence);generated",
+        "kotlin.system;ProcessKt;exitProcess;(int);generated",
+        "kotlin.system;TimingKt;measureNanoTime;(Function0);generated",
+        "kotlin.system;TimingKt;measureTimeMillis;(Function0);generated",
+        "kotlin.text;Appendable;append;(CharSequence);generated",
+        "kotlin.text;Appendable;append;(CharSequence,int,int);generated",
+        "kotlin.text;Appendable;append;(char);generated",
+        "kotlin.text;CharCategory$Companion;valueOf;(int);generated",
+        "kotlin.text;CharCategory;contains;(char);generated",
+        "kotlin.text;CharCategory;getCode;();generated",
+        "kotlin.text;CharCategory;getValue;();generated",
+        "kotlin.text;CharCategory;valueOf;(String);generated",
+        "kotlin.text;CharCategory;values;();generated",
+        "kotlin.text;CharDirectionality$Companion;valueOf;(int);generated",
+        "kotlin.text;CharDirectionality;getValue;();generated",
+        "kotlin.text;CharDirectionality;valueOf;(String);generated",
+        "kotlin.text;CharDirectionality;values;();generated",
+        "kotlin.text;CharacterCodingException;CharacterCodingException;();generated",
+        "kotlin.text;CharsKt;digitToChar;(int);generated",
+        "kotlin.text;CharsKt;digitToChar;(int,int);generated",
+        "kotlin.text;CharsKt;digitToInt;(char);generated",
+        "kotlin.text;CharsKt;digitToInt;(char,int);generated",
+        "kotlin.text;CharsKt;digitToIntOrNull;(char);generated",
+        "kotlin.text;CharsKt;digitToIntOrNull;(char,int);generated",
+        "kotlin.text;CharsKt;equals;(char,char,boolean);generated",
+        "kotlin.text;CharsKt;getCategory;(char);generated",
+        "kotlin.text;CharsKt;getDirectionality;(char);generated",
+        "kotlin.text;CharsKt;isDefined;(char);generated",
+        "kotlin.text;CharsKt;isDigit;(char);generated",
+        "kotlin.text;CharsKt;isHighSurrogate;(char);generated",
+        "kotlin.text;CharsKt;isISOControl;(char);generated",
+        "kotlin.text;CharsKt;isIdentifierIgnorable;(char);generated",
+        "kotlin.text;CharsKt;isJavaIdentifierPart;(char);generated",
+        "kotlin.text;CharsKt;isJavaIdentifierStart;(char);generated",
+        "kotlin.text;CharsKt;isLetter;(char);generated",
+        "kotlin.text;CharsKt;isLetterOrDigit;(char);generated",
+        "kotlin.text;CharsKt;isLowSurrogate;(char);generated",
+        "kotlin.text;CharsKt;isLowerCase;(char);generated",
+        "kotlin.text;CharsKt;isSurrogate;(char);generated",
+        "kotlin.text;CharsKt;isTitleCase;(char);generated",
+        "kotlin.text;CharsKt;isUpperCase;(char);generated",
+        "kotlin.text;CharsKt;isWhitespace;(char);generated",
+        "kotlin.text;CharsKt;lowercase;(char);generated",
+        "kotlin.text;CharsKt;lowercase;(char,Locale);generated",
+        "kotlin.text;CharsKt;lowercaseChar;(char);generated",
+        "kotlin.text;CharsKt;titlecase;(char);generated",
+        "kotlin.text;CharsKt;titlecase;(char,Locale);generated",
+        "kotlin.text;CharsKt;titlecaseChar;(char);generated",
+        "kotlin.text;CharsKt;toLowerCase;(char);generated",
+        "kotlin.text;CharsKt;toTitleCase;(char);generated",
+        "kotlin.text;CharsKt;toUpperCase;(char);generated",
+        "kotlin.text;CharsKt;uppercase;(char);generated",
+        "kotlin.text;CharsKt;uppercase;(char,Locale);generated",
+        "kotlin.text;CharsKt;uppercaseChar;(char);generated",
+        "kotlin.text;Charsets;UTF32;();generated", "kotlin.text;Charsets;UTF32_BE;();generated",
+        "kotlin.text;Charsets;UTF32_LE;();generated",
+        "kotlin.text;Charsets;getISO_8859_1;();generated",
+        "kotlin.text;Charsets;getUS_ASCII;();generated",
+        "kotlin.text;Charsets;getUTF_16;();generated",
+        "kotlin.text;Charsets;getUTF_16BE;();generated",
+        "kotlin.text;Charsets;getUTF_16LE;();generated",
+        "kotlin.text;Charsets;getUTF_8;();generated",
+        "kotlin.text;CharsetsKt;charset;(String);generated",
+        "kotlin.text;FlagEnum;getMask;();generated", "kotlin.text;FlagEnum;getValue;();generated",
+        "kotlin.text;MatchGroup;equals;(Object);generated",
+        "kotlin.text;MatchGroup;hashCode;();generated",
+        "kotlin.text;MatchGroupCollection;get;(int);generated",
+        "kotlin.text;MatchNamedGroupCollection;get;(String);generated",
+        "kotlin.text;MatchResult;getGroupValues;();generated",
+        "kotlin.text;MatchResult;getGroups;();generated",
+        "kotlin.text;MatchResult;getRange;();generated",
+        "kotlin.text;MatchResult;getValue;();generated",
+        "kotlin.text;MatchResult;next;();generated",
+        "kotlin.text;Regex$Companion;escapeReplacement;(String);generated",
+        "kotlin.text;Regex$Companion;fromLiteral;(String);generated",
+        "kotlin.text;Regex;Regex;(String);generated",
+        "kotlin.text;Regex;Regex;(String,RegexOption);generated",
+        "kotlin.text;Regex;Regex;(String,Set);generated",
+        "kotlin.text;Regex;containsMatchIn;(CharSequence);generated",
+        "kotlin.text;Regex;findAll;(CharSequence,int);generated",
+        "kotlin.text;Regex;getPattern;();generated",
+        "kotlin.text;Regex;matchAt;(CharSequence,int);generated",
+        "kotlin.text;Regex;matches;(CharSequence);generated",
+        "kotlin.text;Regex;matchesAt;(CharSequence,int);generated",
+        "kotlin.text;Regex;split;(CharSequence,int);generated",
+        "kotlin.text;Regex;splitToSequence;(CharSequence,int);generated",
+        "kotlin.text;Regex;toString;();generated",
+        "kotlin.text;RegexOption;valueOf;(String);generated",
+        "kotlin.text;RegexOption;values;();generated",
+        "kotlin.text;StringBuilder;StringBuilder;();generated",
+        "kotlin.text;StringBuilder;StringBuilder;(CharSequence);generated",
+        "kotlin.text;StringBuilder;StringBuilder;(String);generated",
+        "kotlin.text;StringBuilder;StringBuilder;(int);generated",
+        "kotlin.text;StringBuilder;append;(Object);generated",
+        "kotlin.text;StringBuilder;append;(String);generated",
+        "kotlin.text;StringBuilder;append;(boolean);generated",
+        "kotlin.text;StringBuilder;append;(char[]);generated",
+        "kotlin.text;StringBuilder;capacity;();generated",
+        "kotlin.text;StringBuilder;ensureCapacity;(int);generated",
+        "kotlin.text;StringBuilder;get;(int);generated",
+        "kotlin.text;StringBuilder;indexOf;(String);generated",
+        "kotlin.text;StringBuilder;indexOf;(String,int);generated",
+        "kotlin.text;StringBuilder;insert;(int,CharSequence);generated",
+        "kotlin.text;StringBuilder;insert;(int,Object);generated",
+        "kotlin.text;StringBuilder;insert;(int,String);generated",
+        "kotlin.text;StringBuilder;insert;(int,boolean);generated",
+        "kotlin.text;StringBuilder;insert;(int,char);generated",
+        "kotlin.text;StringBuilder;insert;(int,char[]);generated",
+        "kotlin.text;StringBuilder;lastIndexOf;(String);generated",
+        "kotlin.text;StringBuilder;lastIndexOf;(String,int);generated",
+        "kotlin.text;StringBuilder;reverse;();generated",
+        "kotlin.text;StringBuilder;setLength;(int);generated",
+        "kotlin.text;StringBuilder;substring;(int);generated",
+        "kotlin.text;StringBuilder;substring;(int,int);generated",
+        "kotlin.text;StringBuilder;trimToSize;();generated",
+        "kotlin.text;StringsKt;String;(int[],int,int);generated",
+        "kotlin.text;StringsKt;all;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;any;(CharSequence);generated",
+        "kotlin.text;StringsKt;any;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;asIterable;(CharSequence);generated",
+        "kotlin.text;StringsKt;asSequence;(CharSequence);generated",
+        "kotlin.text;StringsKt;associate;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;associateBy;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;associateBy;(CharSequence,Function1,Function1);generated",
+        "kotlin.text;StringsKt;associateWith;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;buildString;(Function1);generated",
+        "kotlin.text;StringsKt;buildString;(int,Function1);generated",
+        "kotlin.text;StringsKt;chunked;(CharSequence,int);generated",
+        "kotlin.text;StringsKt;chunked;(CharSequence,int,Function1);generated",
+        "kotlin.text;StringsKt;chunkedSequence;(CharSequence,int);generated",
+        "kotlin.text;StringsKt;chunkedSequence;(CharSequence,int,Function1);generated",
+        "kotlin.text;StringsKt;codePointAt;(String,int);generated",
+        "kotlin.text;StringsKt;codePointBefore;(String,int);generated",
+        "kotlin.text;StringsKt;codePointCount;(String,int,int);generated",
+        "kotlin.text;StringsKt;commonPrefixWith;(CharSequence,CharSequence,boolean);generated",
+        "kotlin.text;StringsKt;commonSuffixWith;(CharSequence,CharSequence,boolean);generated",
+        "kotlin.text;StringsKt;compareTo;(String,String,boolean);generated",
+        "kotlin.text;StringsKt;contains;(CharSequence,CharSequence,boolean);generated",
+        "kotlin.text;StringsKt;contains;(CharSequence,Regex);generated",
+        "kotlin.text;StringsKt;contains;(CharSequence,char,boolean);generated",
+        "kotlin.text;StringsKt;contentEquals;(CharSequence,CharSequence);generated",
+        "kotlin.text;StringsKt;contentEquals;(CharSequence,CharSequence,boolean);generated",
+        "kotlin.text;StringsKt;contentEquals;(String,CharSequence);generated",
+        "kotlin.text;StringsKt;contentEquals;(String,StringBuffer);generated",
+        "kotlin.text;StringsKt;count;(CharSequence);generated",
+        "kotlin.text;StringsKt;count;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;deleteAt;(StringBuilder,int);generated",
+        "kotlin.text;StringsKt;deleteRange;(StringBuilder,int,int);generated",
+        "kotlin.text;StringsKt;elementAt;(CharSequence,int);generated",
+        "kotlin.text;StringsKt;elementAtOrElse;(CharSequence,int,Function1);generated",
+        "kotlin.text;StringsKt;elementAtOrNull;(CharSequence,int);generated",
+        "kotlin.text;StringsKt;endsWith;(CharSequence,CharSequence,boolean);generated",
+        "kotlin.text;StringsKt;endsWith;(CharSequence,char,boolean);generated",
+        "kotlin.text;StringsKt;endsWith;(String,String,boolean);generated",
+        "kotlin.text;StringsKt;equals;(String,String,boolean);generated",
+        "kotlin.text;StringsKt;filter;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;filter;(String,Function1);generated",
+        "kotlin.text;StringsKt;filterIndexed;(CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;filterIndexed;(String,Function2);generated",
+        "kotlin.text;StringsKt;filterNot;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;filterNot;(String,Function1);generated",
+        "kotlin.text;StringsKt;find;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;findLast;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;first;(CharSequence);generated",
+        "kotlin.text;StringsKt;first;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;firstNotNullOf;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;firstNotNullOfOrNull;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;firstOrNull;(CharSequence);generated",
+        "kotlin.text;StringsKt;firstOrNull;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;flatMap;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;flatMapIndexedIterable;(CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;forEach;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;forEachIndexed;(CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;getCASE_INSENSITIVE_ORDER;(StringCompanionObject);generated",
+        "kotlin.text;StringsKt;getIndices;(CharSequence);generated",
+        "kotlin.text;StringsKt;getLastIndex;(CharSequence);generated",
+        "kotlin.text;StringsKt;getOrElse;(CharSequence,int,Function1);generated",
+        "kotlin.text;StringsKt;getOrNull;(CharSequence,int);generated",
+        "kotlin.text;StringsKt;groupBy;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;groupBy;(CharSequence,Function1,Function1);generated",
+        "kotlin.text;StringsKt;groupingBy;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;hasSurrogatePairAt;(CharSequence,int);generated",
+        "kotlin.text;StringsKt;indexOf;(CharSequence,String,int,boolean);generated",
+        "kotlin.text;StringsKt;indexOf;(CharSequence,char,int,boolean);generated",
+        "kotlin.text;StringsKt;indexOfAny;(CharSequence,Collection,int,boolean);generated",
+        "kotlin.text;StringsKt;indexOfAny;(CharSequence,char[],int,boolean);generated",
+        "kotlin.text;StringsKt;indexOfFirst;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;indexOfLast;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;isBlank;(CharSequence);generated",
+        "kotlin.text;StringsKt;isEmpty;(CharSequence);generated",
+        "kotlin.text;StringsKt;isNotBlank;(CharSequence);generated",
+        "kotlin.text;StringsKt;isNotEmpty;(CharSequence);generated",
+        "kotlin.text;StringsKt;isNullOrBlank;(CharSequence);generated",
+        "kotlin.text;StringsKt;isNullOrEmpty;(CharSequence);generated",
+        "kotlin.text;StringsKt;iterator;(CharSequence);generated",
+        "kotlin.text;StringsKt;last;(CharSequence);generated",
+        "kotlin.text;StringsKt;last;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;lastIndexOf;(CharSequence,String,int,boolean);generated",
+        "kotlin.text;StringsKt;lastIndexOf;(CharSequence,char,int,boolean);generated",
+        "kotlin.text;StringsKt;lastIndexOfAny;(CharSequence,Collection,int,boolean);generated",
+        "kotlin.text;StringsKt;lastIndexOfAny;(CharSequence,char[],int,boolean);generated",
+        "kotlin.text;StringsKt;lastOrNull;(CharSequence);generated",
+        "kotlin.text;StringsKt;lastOrNull;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;map;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;mapIndexed;(CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;mapIndexedNotNull;(CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;mapNotNull;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;matches;(CharSequence,Regex);generated",
+        "kotlin.text;StringsKt;max;(CharSequence);generated",
+        "kotlin.text;StringsKt;maxBy;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;maxByOrNull;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;maxByOrThrow;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;maxOf;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;maxOfOrNull;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;maxOfWith;(CharSequence,Comparator,Function1);generated",
+        "kotlin.text;StringsKt;maxOfWithOrNull;(CharSequence,Comparator,Function1);generated",
+        "kotlin.text;StringsKt;maxOrNull;(CharSequence);generated",
+        "kotlin.text;StringsKt;maxOrThrow;(CharSequence);generated",
+        "kotlin.text;StringsKt;maxWith;(CharSequence,Comparator);generated",
+        "kotlin.text;StringsKt;maxWithOrNull;(CharSequence,Comparator);generated",
+        "kotlin.text;StringsKt;maxWithOrThrow;(CharSequence,Comparator);generated",
+        "kotlin.text;StringsKt;min;(CharSequence);generated",
+        "kotlin.text;StringsKt;minBy;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;minByOrNull;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;minByOrThrow;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;minOf;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;minOfOrNull;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;minOfWith;(CharSequence,Comparator,Function1);generated",
+        "kotlin.text;StringsKt;minOfWithOrNull;(CharSequence,Comparator,Function1);generated",
+        "kotlin.text;StringsKt;minOrNull;(CharSequence);generated",
+        "kotlin.text;StringsKt;minOrThrow;(CharSequence);generated",
+        "kotlin.text;StringsKt;minWith;(CharSequence,Comparator);generated",
+        "kotlin.text;StringsKt;minWithOrNull;(CharSequence,Comparator);generated",
+        "kotlin.text;StringsKt;minWithOrThrow;(CharSequence,Comparator);generated",
+        "kotlin.text;StringsKt;none;(CharSequence);generated",
+        "kotlin.text;StringsKt;none;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;offsetByCodePoints;(String,int,int);generated",
+        "kotlin.text;StringsKt;padEnd;(String,int,char);generated",
+        "kotlin.text;StringsKt;padStart;(String,int,char);generated",
+        "kotlin.text;StringsKt;partition;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;partition;(String,Function1);generated",
+        "kotlin.text;StringsKt;random;(CharSequence);generated",
+        "kotlin.text;StringsKt;random;(CharSequence,Random);generated",
+        "kotlin.text;StringsKt;randomOrNull;(CharSequence);generated",
+        "kotlin.text;StringsKt;randomOrNull;(CharSequence,Random);generated",
+        "kotlin.text;StringsKt;reduce;(CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;reduceIndexed;(CharSequence,Function3);generated",
+        "kotlin.text;StringsKt;reduceIndexedOrNull;(CharSequence,Function3);generated",
+        "kotlin.text;StringsKt;reduceOrNull;(CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;reduceRight;(CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;reduceRightIndexed;(CharSequence,Function3);generated",
+        "kotlin.text;StringsKt;reduceRightIndexedOrNull;(CharSequence,Function3);generated",
+        "kotlin.text;StringsKt;reduceRightOrNull;(CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;regionMatches;(CharSequence,int,CharSequence,int,int,boolean);generated",
+        "kotlin.text;StringsKt;regionMatches;(String,int,String,int,int,boolean);generated",
+        "kotlin.text;StringsKt;removeRange;(String,IntRange);generated",
+        "kotlin.text;StringsKt;removeRange;(String,int,int);generated",
+        "kotlin.text;StringsKt;replace;(String,String,String,boolean);generated",
+        "kotlin.text;StringsKt;replaceIndent;(String,String);generated",
+        "kotlin.text;StringsKt;replaceIndentByMargin;(String,String,String);generated",
+        "kotlin.text;StringsKt;replaceRange;(String,IntRange,CharSequence);generated",
+        "kotlin.text;StringsKt;replaceRange;(String,int,int,CharSequence);generated",
+        "kotlin.text;StringsKt;reversed;(String);generated",
+        "kotlin.text;StringsKt;runningReduce;(CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;runningReduceIndexed;(CharSequence,Function3);generated",
+        "kotlin.text;StringsKt;set;(StringBuilder,int,char);generated",
+        "kotlin.text;StringsKt;single;(CharSequence);generated",
+        "kotlin.text;StringsKt;single;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;singleOrNull;(CharSequence);generated",
+        "kotlin.text;StringsKt;singleOrNull;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;slice;(CharSequence,Iterable);generated",
+        "kotlin.text;StringsKt;slice;(String,Iterable);generated",
+        "kotlin.text;StringsKt;split;(CharSequence,Regex,int);generated",
+        "kotlin.text;StringsKt;split;(CharSequence,String[],boolean,int);generated",
+        "kotlin.text;StringsKt;split;(CharSequence,char[],boolean,int);generated",
+        "kotlin.text;StringsKt;splitToSequence;(CharSequence,Regex,int);generated",
+        "kotlin.text;StringsKt;startsWith;(CharSequence,CharSequence,boolean);generated",
+        "kotlin.text;StringsKt;startsWith;(CharSequence,CharSequence,int,boolean);generated",
+        "kotlin.text;StringsKt;startsWith;(CharSequence,char,boolean);generated",
+        "kotlin.text;StringsKt;startsWith;(String,String,boolean);generated",
+        "kotlin.text;StringsKt;startsWith;(String,String,int,boolean);generated",
+        "kotlin.text;StringsKt;substring;(CharSequence,IntRange);generated",
+        "kotlin.text;StringsKt;substring;(CharSequence,int,int);generated",
+        "kotlin.text;StringsKt;sumBy;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;sumByDouble;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;sumOfBigDecimal;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;sumOfBigInteger;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;sumOfDouble;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;sumOfInt;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;sumOfLong;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;sumOfUInt;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;sumOfULong;(CharSequence,Function1);generated",
+        "kotlin.text;StringsKt;toBigDecimal;(String);generated",
+        "kotlin.text;StringsKt;toBigDecimal;(String,MathContext);generated",
+        "kotlin.text;StringsKt;toBigDecimalOrNull;(String);generated",
+        "kotlin.text;StringsKt;toBigDecimalOrNull;(String,MathContext);generated",
+        "kotlin.text;StringsKt;toBigInteger;(String);generated",
+        "kotlin.text;StringsKt;toBigInteger;(String,int);generated",
+        "kotlin.text;StringsKt;toBigIntegerOrNull;(String);generated",
+        "kotlin.text;StringsKt;toBigIntegerOrNull;(String,int);generated",
+        "kotlin.text;StringsKt;toBoolean;(String);generated",
+        "kotlin.text;StringsKt;toBooleanNullable;(String);generated",
+        "kotlin.text;StringsKt;toBooleanStrict;(String);generated",
+        "kotlin.text;StringsKt;toBooleanStrictOrNull;(String);generated",
+        "kotlin.text;StringsKt;toByte;(String);generated",
+        "kotlin.text;StringsKt;toByte;(String,int);generated",
+        "kotlin.text;StringsKt;toByteOrNull;(String);generated",
+        "kotlin.text;StringsKt;toByteOrNull;(String,int);generated",
+        "kotlin.text;StringsKt;toDouble;(String);generated",
+        "kotlin.text;StringsKt;toDoubleOrNull;(String);generated",
+        "kotlin.text;StringsKt;toFloat;(String);generated",
+        "kotlin.text;StringsKt;toFloatOrNull;(String);generated",
+        "kotlin.text;StringsKt;toHashSet;(CharSequence);generated",
+        "kotlin.text;StringsKt;toInt;(String);generated",
+        "kotlin.text;StringsKt;toInt;(String,int);generated",
+        "kotlin.text;StringsKt;toIntOrNull;(String);generated",
+        "kotlin.text;StringsKt;toIntOrNull;(String,int);generated",
+        "kotlin.text;StringsKt;toList;(CharSequence);generated",
+        "kotlin.text;StringsKt;toLong;(String);generated",
+        "kotlin.text;StringsKt;toLong;(String,int);generated",
+        "kotlin.text;StringsKt;toLongOrNull;(String);generated",
+        "kotlin.text;StringsKt;toLongOrNull;(String,int);generated",
+        "kotlin.text;StringsKt;toMutableList;(CharSequence);generated",
+        "kotlin.text;StringsKt;toPattern;(String,int);generated",
+        "kotlin.text;StringsKt;toRegex;(String);generated",
+        "kotlin.text;StringsKt;toRegex;(String,RegexOption);generated",
+        "kotlin.text;StringsKt;toRegex;(String,Set);generated",
+        "kotlin.text;StringsKt;toSet;(CharSequence);generated",
+        "kotlin.text;StringsKt;toShort;(String);generated",
+        "kotlin.text;StringsKt;toShort;(String,int);generated",
+        "kotlin.text;StringsKt;toShortOrNull;(String);generated",
+        "kotlin.text;StringsKt;toShortOrNull;(String,int);generated",
+        "kotlin.text;StringsKt;toSortedSet;(CharSequence);generated",
+        "kotlin.text;StringsKt;toString;(byte,int);generated",
+        "kotlin.text;StringsKt;toString;(int,int);generated",
+        "kotlin.text;StringsKt;toString;(long,int);generated",
+        "kotlin.text;StringsKt;toString;(short,int);generated",
+        "kotlin.text;StringsKt;trim;(String);generated",
+        "kotlin.text;StringsKt;trim;(String,Function1);generated",
+        "kotlin.text;StringsKt;trim;(String,char[]);generated",
+        "kotlin.text;StringsKt;trimEnd;(String);generated",
+        "kotlin.text;StringsKt;trimEnd;(String,Function1);generated",
+        "kotlin.text;StringsKt;trimEnd;(String,char[]);generated",
+        "kotlin.text;StringsKt;trimIndent;(String);generated",
+        "kotlin.text;StringsKt;trimMargin;(String,String);generated",
+        "kotlin.text;StringsKt;trimStart;(String);generated",
+        "kotlin.text;StringsKt;trimStart;(String,Function1);generated",
+        "kotlin.text;StringsKt;trimStart;(String,char[]);generated",
+        "kotlin.text;StringsKt;windowed;(CharSequence,int,int,boolean);generated",
+        "kotlin.text;StringsKt;windowed;(CharSequence,int,int,boolean,Function1);generated",
+        "kotlin.text;StringsKt;windowedSequence;(CharSequence,int,int,boolean);generated",
+        "kotlin.text;StringsKt;windowedSequence;(CharSequence,int,int,boolean,Function1);generated",
+        "kotlin.text;StringsKt;withIndex;(CharSequence);generated",
+        "kotlin.text;StringsKt;zip;(CharSequence,CharSequence);generated",
+        "kotlin.text;StringsKt;zip;(CharSequence,CharSequence,Function2);generated",
+        "kotlin.text;StringsKt;zipWithNext;(CharSequence);generated",
+        "kotlin.text;StringsKt;zipWithNext;(CharSequence,Function2);generated",
+        "kotlin.text;TextHKt;String;(char[]);generated",
+        "kotlin.text;TextHKt;String;(char[],int,int);generated",
+        "kotlin.text;TextHKt;compareTo;(String,String,boolean);generated",
+        "kotlin.text;TextHKt;concatToString;(char[]);generated",
+        "kotlin.text;TextHKt;concatToString;(char[],int,int);generated",
+        "kotlin.text;TextHKt;decodeToString;(byte[]);generated",
+        "kotlin.text;TextHKt;decodeToString;(byte[],int,int,boolean);generated",
+        "kotlin.text;TextHKt;encodeToByteArray;(String);generated",
+        "kotlin.text;TextHKt;encodeToByteArray;(String,int,int,boolean);generated",
+        "kotlin.text;TextHKt;endsWith;(String,String,boolean);generated",
+        "kotlin.text;TextHKt;equals;(String,String,boolean);generated",
+        "kotlin.text;TextHKt;getCASE_INSENSITIVE_ORDER;(StringCompanionObject);generated",
+        "kotlin.text;TextHKt;isBlank;(CharSequence);generated",
+        "kotlin.text;TextHKt;isHighSurrogate;(char);generated",
+        "kotlin.text;TextHKt;isLowSurrogate;(char);generated",
+        "kotlin.text;TextHKt;regionMatches;(CharSequence,int,CharSequence,int,int,boolean);generated",
+        "kotlin.text;TextHKt;repeat;(CharSequence,int);generated",
+        "kotlin.text;TextHKt;replace;(String,String,String,boolean);generated",
+        "kotlin.text;TextHKt;replace;(String,char,char,boolean);generated",
+        "kotlin.text;TextHKt;replaceFirst;(String,String,String,boolean);generated",
+        "kotlin.text;TextHKt;replaceFirst;(String,char,char,boolean);generated",
+        "kotlin.text;TextHKt;startsWith;(String,String,boolean);generated",
+        "kotlin.text;TextHKt;startsWith;(String,String,int,boolean);generated",
+        "kotlin.text;TextHKt;substring;(String,int);generated",
+        "kotlin.text;TextHKt;substring;(String,int,int);generated",
+        "kotlin.text;TextHKt;toBoolean;(String);generated",
+        "kotlin.text;TextHKt;toByte;(String);generated",
+        "kotlin.text;TextHKt;toByte;(String,int);generated",
+        "kotlin.text;TextHKt;toCharArray;(String);generated",
+        "kotlin.text;TextHKt;toCharArray;(String,int,int);generated",
+        "kotlin.text;TextHKt;toDouble;(String);generated",
+        "kotlin.text;TextHKt;toDoubleOrNull;(String);generated",
+        "kotlin.text;TextHKt;toFloat;(String);generated",
+        "kotlin.text;TextHKt;toFloatOrNull;(String);generated",
+        "kotlin.text;TextHKt;toInt;(String);generated",
+        "kotlin.text;TextHKt;toInt;(String,int);generated",
+        "kotlin.text;TextHKt;toLong;(String);generated",
+        "kotlin.text;TextHKt;toLong;(String,int);generated",
+        "kotlin.text;TextHKt;toShort;(String);generated",
+        "kotlin.text;TextHKt;toShort;(String,int);generated",
+        "kotlin.text;TextHKt;toString;(byte,int);generated",
+        "kotlin.text;TextHKt;toString;(int,int);generated",
+        "kotlin.text;TextHKt;toString;(long,int);generated",
+        "kotlin.text;TextHKt;toString;(short,int);generated",
+        "kotlin.text;Typography;getAlmostEqual;();generated",
+        "kotlin.text;Typography;getAmp;();generated",
+        "kotlin.text;Typography;getBullet;();generated",
+        "kotlin.text;Typography;getCent;();generated",
+        "kotlin.text;Typography;getCopyright;();generated",
+        "kotlin.text;Typography;getDagger;();generated",
+        "kotlin.text;Typography;getDegree;();generated",
+        "kotlin.text;Typography;getDollar;();generated",
+        "kotlin.text;Typography;getDoubleDagger;();generated",
+        "kotlin.text;Typography;getDoublePrime;();generated",
+        "kotlin.text;Typography;getEllipsis;();generated",
+        "kotlin.text;Typography;getEuro;();generated",
+        "kotlin.text;Typography;getGreater;();generated",
+        "kotlin.text;Typography;getGreaterOrEqual;();generated",
+        "kotlin.text;Typography;getHalf;();generated",
+        "kotlin.text;Typography;getLeftDoubleQuote;();generated",
+        "kotlin.text;Typography;getLeftGuillemet;();generated",
+        "kotlin.text;Typography;getLeftGuillemete;();generated",
+        "kotlin.text;Typography;getLeftSingleQuote;();generated",
+        "kotlin.text;Typography;getLess;();generated",
+        "kotlin.text;Typography;getLessOrEqual;();generated",
+        "kotlin.text;Typography;getLowDoubleQuote;();generated",
+        "kotlin.text;Typography;getLowSingleQuote;();generated",
+        "kotlin.text;Typography;getMdash;();generated",
+        "kotlin.text;Typography;getMiddleDot;();generated",
+        "kotlin.text;Typography;getNbsp;();generated",
+        "kotlin.text;Typography;getNdash;();generated",
+        "kotlin.text;Typography;getNotEqual;();generated",
+        "kotlin.text;Typography;getParagraph;();generated",
+        "kotlin.text;Typography;getPlusMinus;();generated",
+        "kotlin.text;Typography;getPound;();generated",
+        "kotlin.text;Typography;getPrime;();generated",
+        "kotlin.text;Typography;getQuote;();generated",
+        "kotlin.text;Typography;getRegistered;();generated",
+        "kotlin.text;Typography;getRightDoubleQuote;();generated",
+        "kotlin.text;Typography;getRightGuillemet;();generated",
+        "kotlin.text;Typography;getRightGuillemete;();generated",
+        "kotlin.text;Typography;getRightSingleQuote;();generated",
+        "kotlin.text;Typography;getSection;();generated",
+        "kotlin.text;Typography;getTimes;();generated", "kotlin.text;Typography;getTm;();generated",
+        "kotlin.text;UStringsKt;toString;(byte,int);generated",
+        "kotlin.text;UStringsKt;toString;(int,int);generated",
+        "kotlin.text;UStringsKt;toString;(long,int);generated",
+        "kotlin.text;UStringsKt;toString;(short,int);generated",
+        "kotlin.text;UStringsKt;toUByte;(String);generated",
+        "kotlin.text;UStringsKt;toUByte;(String,int);generated",
+        "kotlin.text;UStringsKt;toUByteOrNull;(String);generated",
+        "kotlin.text;UStringsKt;toUByteOrNull;(String,int);generated",
+        "kotlin.text;UStringsKt;toUInt;(String);generated",
+        "kotlin.text;UStringsKt;toUInt;(String,int);generated",
+        "kotlin.text;UStringsKt;toUIntOrNull;(String);generated",
+        "kotlin.text;UStringsKt;toUIntOrNull;(String,int);generated",
+        "kotlin.text;UStringsKt;toULong;(String);generated",
+        "kotlin.text;UStringsKt;toULong;(String,int);generated",
+        "kotlin.text;UStringsKt;toULongOrNull;(String);generated",
+        "kotlin.text;UStringsKt;toULongOrNull;(String,int);generated",
+        "kotlin.text;UStringsKt;toUShort;(String);generated",
+        "kotlin.text;UStringsKt;toUShort;(String,int);generated",
+        "kotlin.text;UStringsKt;toUShortOrNull;(String);generated",
+        "kotlin.text;UStringsKt;toUShortOrNull;(String,int);generated",
+        "kotlin.time;AbstractDoubleTimeSource;AbstractDoubleTimeSource;(DurationUnit);generated",
+        "kotlin.time;AbstractLongTimeSource;AbstractLongTimeSource;(DurationUnit);generated",
+        "kotlin.time;Duration$Companion;convert;(double,DurationUnit,DurationUnit);generated",
+        "kotlin.time;Duration$Companion;days;(double);generated",
+        "kotlin.time;Duration$Companion;days;(int);generated",
+        "kotlin.time;Duration$Companion;days;(long);generated",
+        "kotlin.time;Duration$Companion;getDays;(double);generated",
+        "kotlin.time;Duration$Companion;getDays;(int);generated",
+        "kotlin.time;Duration$Companion;getDays;(long);generated",
+        "kotlin.time;Duration$Companion;getHours;(double);generated",
+        "kotlin.time;Duration$Companion;getHours;(int);generated",
+        "kotlin.time;Duration$Companion;getHours;(long);generated",
+        "kotlin.time;Duration$Companion;getMicroseconds;(double);generated",
+        "kotlin.time;Duration$Companion;getMicroseconds;(int);generated",
+        "kotlin.time;Duration$Companion;getMicroseconds;(long);generated",
+        "kotlin.time;Duration$Companion;getMilliseconds;(double);generated",
+        "kotlin.time;Duration$Companion;getMilliseconds;(int);generated",
+        "kotlin.time;Duration$Companion;getMilliseconds;(long);generated",
+        "kotlin.time;Duration$Companion;getMinutes;(double);generated",
+        "kotlin.time;Duration$Companion;getMinutes;(int);generated",
+        "kotlin.time;Duration$Companion;getMinutes;(long);generated",
+        "kotlin.time;Duration$Companion;getNanoseconds;(double);generated",
+        "kotlin.time;Duration$Companion;getNanoseconds;(int);generated",
+        "kotlin.time;Duration$Companion;getNanoseconds;(long);generated",
+        "kotlin.time;Duration$Companion;getSeconds;(double);generated",
+        "kotlin.time;Duration$Companion;getSeconds;(int);generated",
+        "kotlin.time;Duration$Companion;getSeconds;(long);generated",
+        "kotlin.time;Duration$Companion;hours;(double);generated",
+        "kotlin.time;Duration$Companion;hours;(int);generated",
+        "kotlin.time;Duration$Companion;hours;(long);generated",
+        "kotlin.time;Duration$Companion;microseconds;(double);generated",
+        "kotlin.time;Duration$Companion;microseconds;(int);generated",
+        "kotlin.time;Duration$Companion;microseconds;(long);generated",
+        "kotlin.time;Duration$Companion;milliseconds;(double);generated",
+        "kotlin.time;Duration$Companion;milliseconds;(int);generated",
+        "kotlin.time;Duration$Companion;milliseconds;(long);generated",
+        "kotlin.time;Duration$Companion;minutes;(double);generated",
+        "kotlin.time;Duration$Companion;minutes;(int);generated",
+        "kotlin.time;Duration$Companion;minutes;(long);generated",
+        "kotlin.time;Duration$Companion;nanoseconds;(double);generated",
+        "kotlin.time;Duration$Companion;nanoseconds;(int);generated",
+        "kotlin.time;Duration$Companion;nanoseconds;(long);generated",
+        "kotlin.time;Duration$Companion;parse;(String);generated",
+        "kotlin.time;Duration$Companion;parseIsoString;(String);generated",
+        "kotlin.time;Duration$Companion;parseIsoStringOrNull;(String);generated",
+        "kotlin.time;Duration$Companion;parseOrNull;(String);generated",
+        "kotlin.time;Duration$Companion;seconds;(double);generated",
+        "kotlin.time;Duration$Companion;seconds;(int);generated",
+        "kotlin.time;Duration$Companion;seconds;(long);generated",
+        "kotlin.time;Duration;div;(Duration);generated",
+        "kotlin.time;Duration;equals;(Object);generated",
+        "kotlin.time;Duration;getInDays;();generated",
+        "kotlin.time;Duration;getInHours;();generated",
+        "kotlin.time;Duration;getInMicroseconds;();generated",
+        "kotlin.time;Duration;getInMilliseconds;();generated",
+        "kotlin.time;Duration;getInMinutes;();generated",
+        "kotlin.time;Duration;getInNanoseconds;();generated",
+        "kotlin.time;Duration;getInSeconds;();generated",
+        "kotlin.time;Duration;getInWholeDays;();generated",
+        "kotlin.time;Duration;getInWholeHours;();generated",
+        "kotlin.time;Duration;getInWholeMicroseconds;();generated",
+        "kotlin.time;Duration;getInWholeMilliseconds;();generated",
+        "kotlin.time;Duration;getInWholeMinutes;();generated",
+        "kotlin.time;Duration;getInWholeNanoseconds;();generated",
+        "kotlin.time;Duration;getInWholeSeconds;();generated",
+        "kotlin.time;Duration;hashCode;();generated", "kotlin.time;Duration;isFinite;();generated",
+        "kotlin.time;Duration;isInfinite;();generated",
+        "kotlin.time;Duration;isNegative;();generated",
+        "kotlin.time;Duration;isPositive;();generated",
+        "kotlin.time;Duration;toComponents;(Function2);generated",
+        "kotlin.time;Duration;toComponents;(Function3);generated",
+        "kotlin.time;Duration;toComponents;(Function4);generated",
+        "kotlin.time;Duration;toComponents;(Function5);generated",
+        "kotlin.time;Duration;toDouble;(DurationUnit);generated",
+        "kotlin.time;Duration;toInt;(DurationUnit);generated",
+        "kotlin.time;Duration;toIsoString;();generated",
+        "kotlin.time;Duration;toLong;(DurationUnit);generated",
+        "kotlin.time;Duration;toLongMilliseconds;();generated",
+        "kotlin.time;Duration;toLongNanoseconds;();generated",
+        "kotlin.time;Duration;toString;();generated",
+        "kotlin.time;Duration;toString;(DurationUnit,int);generated",
+        "kotlin.time;Duration;unaryMinus;();generated",
+        "kotlin.time;DurationKt;getDays;(double);generated",
+        "kotlin.time;DurationKt;getDays;(int);generated",
+        "kotlin.time;DurationKt;getDays;(long);generated",
+        "kotlin.time;DurationKt;getHours;(double);generated",
+        "kotlin.time;DurationKt;getHours;(int);generated",
+        "kotlin.time;DurationKt;getHours;(long);generated",
+        "kotlin.time;DurationKt;getMicroseconds;(double);generated",
+        "kotlin.time;DurationKt;getMicroseconds;(int);generated",
+        "kotlin.time;DurationKt;getMicroseconds;(long);generated",
+        "kotlin.time;DurationKt;getMilliseconds;(double);generated",
+        "kotlin.time;DurationKt;getMilliseconds;(int);generated",
+        "kotlin.time;DurationKt;getMilliseconds;(long);generated",
+        "kotlin.time;DurationKt;getMinutes;(double);generated",
+        "kotlin.time;DurationKt;getMinutes;(int);generated",
+        "kotlin.time;DurationKt;getMinutes;(long);generated",
+        "kotlin.time;DurationKt;getNanoseconds;(double);generated",
+        "kotlin.time;DurationKt;getNanoseconds;(int);generated",
+        "kotlin.time;DurationKt;getNanoseconds;(long);generated",
+        "kotlin.time;DurationKt;getSeconds;(double);generated",
+        "kotlin.time;DurationKt;getSeconds;(int);generated",
+        "kotlin.time;DurationKt;getSeconds;(long);generated",
+        "kotlin.time;DurationKt;toDuration;(double,DurationUnit);generated",
+        "kotlin.time;DurationKt;toDuration;(int,DurationUnit);generated",
+        "kotlin.time;DurationKt;toDuration;(long,DurationUnit);generated",
+        "kotlin.time;DurationUnit;valueOf;(String);generated",
+        "kotlin.time;DurationUnit;values;();generated",
+        "kotlin.time;DurationUnitKt;toDurationUnit;(TimeUnit);generated",
+        "kotlin.time;DurationUnitKt;toTimeUnit;(DurationUnit);generated",
+        "kotlin.time;ExperimentalTime;ExperimentalTime;();generated",
+        "kotlin.time;MeasureTimeKt;measureTime;(Function0);generated",
+        "kotlin.time;MeasureTimeKt;measureTime;(Monotonic,Function0);generated",
+        "kotlin.time;MeasureTimeKt;measureTime;(TimeSource,Function0);generated",
+        "kotlin.time;MeasureTimeKt;measureTimedValue;(Function0);generated",
+        "kotlin.time;MeasureTimeKt;measureTimedValue;(Monotonic,Function0);generated",
+        "kotlin.time;MeasureTimeKt;measureTimedValue;(TimeSource,Function0);generated",
+        "kotlin.time;TestTimeSource;TestTimeSource;();generated",
+        "kotlin.time;TestTimeSource;plusAssign;(Duration);generated",
+        "kotlin.time;TimeMark;elapsedNow;();generated",
+        "kotlin.time;TimeMark;hasNotPassedNow;();generated",
+        "kotlin.time;TimeMark;hasPassedNow;();generated",
+        "kotlin.time;TimeMark;minus;(Duration);generated",
+        "kotlin.time;TimeMark;plus;(Duration);generated",
+        "kotlin.time;TimeSource$Monotonic$ValueTimeMark;equals;(Object);generated",
+        "kotlin.time;TimeSource$Monotonic$ValueTimeMark;hashCode;();generated",
+        "kotlin.time;TimeSource$Monotonic$ValueTimeMark;toString;();generated",
+        "kotlin.time;TimeSource$Monotonic;toString;();generated",
+        "kotlin.time;TimeSource;markNow;();generated",
+        "kotlin.time;TimeSourceKt;compareTo;(TimeMark,TimeMark);generated",
+        "kotlin.time;TimeSourceKt;minus;(TimeMark,TimeMark);generated",
+        "kotlin.time;TimedValue;equals;(Object);generated",
+        "kotlin.time;TimedValue;hashCode;();generated",
+        "kotlin;ArithmeticException;ArithmeticException;();generated",
+        "kotlin;ArithmeticException;ArithmeticException;(String);generated",
+        "kotlin;ArrayIntrinsicsKt;emptyArray;();generated",
+        "kotlin;AssertionError;AssertionError;();generated",
+        "kotlin;AssertionError;AssertionError;(Object);generated",
+        "kotlin;BuilderInference;BuilderInference;();generated",
+        "kotlin;CharCodeJVMKt;Char;(short);generated", "kotlin;CharCodeKt;Char;(int);generated",
+        "kotlin;CharCodeKt;Char;(short);generated", "kotlin;CharCodeKt;getCode;(char);generated",
+        "kotlin;ClassCastException;ClassCastException;();generated",
+        "kotlin;ClassCastException;ClassCastException;(String);generated",
+        "kotlin;Comparator;compare;(Object,Object);generated",
+        "kotlin;CompareToKt;compareTo;(Comparable,Object);generated",
+        "kotlin;ConcurrentModificationException;ConcurrentModificationException;();generated",
+        "kotlin;ConcurrentModificationException;ConcurrentModificationException;(String);generated",
+        "kotlin;ConcurrentModificationException;ConcurrentModificationException;(String,Throwable);generated",
+        "kotlin;ConcurrentModificationException;ConcurrentModificationException;(Throwable);generated",
+        "kotlin;ContextFunctionTypeParams;ContextFunctionTypeParams;(int);generated",
+        "kotlin;ContextFunctionTypeParams;count;();generated",
+        "kotlin;DeepRecursiveKt;invoke;(DeepRecursiveFunction,Object);generated",
+        "kotlin;DeepRecursiveScope;callRecursive;(DeepRecursiveFunction,Object);generated",
+        "kotlin;DeepRecursiveScope;callRecursive;(Object);generated",
+        "kotlin;DeepRecursiveScope;invoke;(DeepRecursiveFunction,Object);generated",
+        "kotlin;Deprecated;Deprecated;(String,ReplaceWith,DeprecationLevel);generated",
+        "kotlin;Deprecated;level;();generated", "kotlin;Deprecated;message;();generated",
+        "kotlin;Deprecated;replaceWith;();generated",
+        "kotlin;DeprecatedSinceKotlin;DeprecatedSinceKotlin;(String,String,String);generated",
+        "kotlin;DeprecatedSinceKotlin;errorSince;();generated",
+        "kotlin;DeprecatedSinceKotlin;hiddenSince;();generated",
+        "kotlin;DeprecatedSinceKotlin;warningSince;();generated",
+        "kotlin;DeprecationLevel;valueOf;(String);generated",
+        "kotlin;DeprecationLevel;values;();generated", "kotlin;DslMarker;DslMarker;();generated",
+        "kotlin;Error;Error;();generated", "kotlin;Error;Error;(String);generated",
+        "kotlin;Error;Error;(String,Throwable);generated",
+        "kotlin;Error;Error;(Throwable);generated", "kotlin;Exception;Exception;();generated",
+        "kotlin;Exception;Exception;(String);generated",
+        "kotlin;Exception;Exception;(String,Throwable);generated",
+        "kotlin;Exception;Exception;(Throwable);generated",
+        "kotlin;ExceptionsHKt;addSuppressed;(Throwable,Throwable);generated",
+        "kotlin;ExceptionsHKt;getSuppressedExceptions;(Throwable);generated",
+        "kotlin;ExceptionsHKt;printStackTrace;(Throwable);generated",
+        "kotlin;ExceptionsHKt;stackTraceToString;(Throwable);generated",
+        "kotlin;ExceptionsKt;addSuppressed;(Throwable,Throwable);generated",
+        "kotlin;ExceptionsKt;getStackTrace;(Throwable);generated",
+        "kotlin;ExceptionsKt;getSuppressedExceptions;(Throwable);generated",
+        "kotlin;ExceptionsKt;printStackTrace;(Throwable);generated",
+        "kotlin;ExceptionsKt;printStackTrace;(Throwable,PrintStream);generated",
+        "kotlin;ExceptionsKt;printStackTrace;(Throwable,PrintWriter);generated",
+        "kotlin;ExceptionsKt;stackTraceToString;(Throwable);generated",
+        "kotlin;Experimental$Level;valueOf;(String);generated",
+        "kotlin;Experimental$Level;values;();generated",
+        "kotlin;Experimental;Experimental;(Level);generated",
+        "kotlin;Experimental;level;();generated",
+        "kotlin;ExperimentalMultiplatform;ExperimentalMultiplatform;();generated",
+        "kotlin;ExperimentalStdlibApi;ExperimentalStdlibApi;();generated",
+        "kotlin;ExperimentalUnsignedTypes;ExperimentalUnsignedTypes;();generated",
+        "kotlin;ExtensionFunctionType;ExtensionFunctionType;();generated",
+        "kotlin;HashCodeKt;hashCode;(Object);generated",
+        "kotlin;IllegalArgumentException;IllegalArgumentException;();generated",
+        "kotlin;IllegalArgumentException;IllegalArgumentException;(String);generated",
+        "kotlin;IllegalArgumentException;IllegalArgumentException;(String,Throwable);generated",
+        "kotlin;IllegalArgumentException;IllegalArgumentException;(Throwable);generated",
+        "kotlin;IllegalStateException;IllegalStateException;();generated",
+        "kotlin;IllegalStateException;IllegalStateException;(String);generated",
+        "kotlin;IllegalStateException;IllegalStateException;(String,Throwable);generated",
+        "kotlin;IllegalStateException;IllegalStateException;(Throwable);generated",
+        "kotlin;IndexOutOfBoundsException;IndexOutOfBoundsException;();generated",
+        "kotlin;IndexOutOfBoundsException;IndexOutOfBoundsException;(String);generated",
+        "kotlin;KotlinHKt;fromBits;(DoubleCompanionObject,long);generated",
+        "kotlin;KotlinHKt;fromBits;(FloatCompanionObject,int);generated",
+        "kotlin;KotlinHKt;isFinite;(double);generated",
+        "kotlin;KotlinHKt;isFinite;(float);generated",
+        "kotlin;KotlinHKt;isInfinite;(double);generated",
+        "kotlin;KotlinHKt;isInfinite;(float);generated",
+        "kotlin;KotlinHKt;isNaN;(double);generated", "kotlin;KotlinHKt;isNaN;(float);generated",
+        "kotlin;KotlinHKt;lazy;(Function0);generated",
+        "kotlin;KotlinHKt;lazy;(LazyThreadSafetyMode,Function0);generated",
+        "kotlin;KotlinHKt;lazy;(Object,Function0);generated",
+        "kotlin;KotlinHKt;toBits;(double);generated", "kotlin;KotlinHKt;toBits;(float);generated",
+        "kotlin;KotlinHKt;toRawBits;(double);generated",
+        "kotlin;KotlinHKt;toRawBits;(float);generated",
+        "kotlin;KotlinNullPointerException;KotlinNullPointerException;();generated",
+        "kotlin;KotlinNullPointerException;KotlinNullPointerException;(String);generated",
+        "kotlin;KotlinVersion$Companion;getMAX_COMPONENT_VALUE;();generated",
+        "kotlin;KotlinVersion;KotlinVersion;(int,int);generated",
+        "kotlin;KotlinVersion;KotlinVersion;(int,int,int);generated",
+        "kotlin;KotlinVersion;equals;(Object);generated",
+        "kotlin;KotlinVersion;getMajor;();generated", "kotlin;KotlinVersion;getMinor;();generated",
+        "kotlin;KotlinVersion;getPatch;();generated", "kotlin;KotlinVersion;hashCode;();generated",
+        "kotlin;KotlinVersion;isAtLeast;(int,int);generated",
+        "kotlin;KotlinVersion;isAtLeast;(int,int,int);generated",
+        "kotlin;KotlinVersion;toString;();generated",
+        "kotlin;LateinitKt;isInitialized;(KProperty0);generated",
+        "kotlin;Lazy;getValue;();generated", "kotlin;Lazy;isInitialized;();generated",
+        "kotlin;LazyThreadSafetyMode;valueOf;(String);generated",
+        "kotlin;LazyThreadSafetyMode;values;();generated",
+        "kotlin;Metadata;Metadata;(int,int[],int[],String[],String[],String,String,int);generated",
+        "kotlin;Metadata;bv;();generated", "kotlin;Metadata;d1;();generated",
+        "kotlin;Metadata;d2;();generated", "kotlin;Metadata;k;();generated",
+        "kotlin;Metadata;mv;();generated", "kotlin;Metadata;pn;();generated",
+        "kotlin;Metadata;xi;();generated", "kotlin;Metadata;xs;();generated",
+        "kotlin;NoSuchElementException;NoSuchElementException;();generated",
+        "kotlin;NoSuchElementException;NoSuchElementException;(String);generated",
+        "kotlin;NoWhenBranchMatchedException;NoWhenBranchMatchedException;();generated",
+        "kotlin;NoWhenBranchMatchedException;NoWhenBranchMatchedException;(String);generated",
+        "kotlin;NoWhenBranchMatchedException;NoWhenBranchMatchedException;(String,Throwable);generated",
+        "kotlin;NoWhenBranchMatchedException;NoWhenBranchMatchedException;(Throwable);generated",
+        "kotlin;NotImplementedError;NotImplementedError;(String);generated",
+        "kotlin;NullPointerException;NullPointerException;();generated",
+        "kotlin;NullPointerException;NullPointerException;(String);generated",
+        "kotlin;NumberFormatException;NumberFormatException;();generated",
+        "kotlin;NumberFormatException;NumberFormatException;(String);generated",
+        "kotlin;NumbersKt;and;(BigInteger,BigInteger);generated",
+        "kotlin;NumbersKt;countLeadingZeroBits;(byte);generated",
+        "kotlin;NumbersKt;countLeadingZeroBits;(int);generated",
+        "kotlin;NumbersKt;countLeadingZeroBits;(long);generated",
+        "kotlin;NumbersKt;countLeadingZeroBits;(short);generated",
+        "kotlin;NumbersKt;countOneBits;(byte);generated",
+        "kotlin;NumbersKt;countOneBits;(int);generated",
+        "kotlin;NumbersKt;countOneBits;(long);generated",
+        "kotlin;NumbersKt;countOneBits;(short);generated",
+        "kotlin;NumbersKt;countTrailingZeroBits;(byte);generated",
+        "kotlin;NumbersKt;countTrailingZeroBits;(int);generated",
+        "kotlin;NumbersKt;countTrailingZeroBits;(long);generated",
+        "kotlin;NumbersKt;countTrailingZeroBits;(short);generated",
+        "kotlin;NumbersKt;dec;(BigDecimal);generated",
+        "kotlin;NumbersKt;dec;(BigInteger);generated",
+        "kotlin;NumbersKt;div;(BigDecimal,BigDecimal);generated",
+        "kotlin;NumbersKt;div;(BigInteger,BigInteger);generated",
+        "kotlin;NumbersKt;floorDiv;(byte,byte);generated",
+        "kotlin;NumbersKt;floorDiv;(byte,int);generated",
+        "kotlin;NumbersKt;floorDiv;(byte,long);generated",
+        "kotlin;NumbersKt;floorDiv;(byte,short);generated",
+        "kotlin;NumbersKt;floorDiv;(int,byte);generated",
+        "kotlin;NumbersKt;floorDiv;(int,int);generated",
+        "kotlin;NumbersKt;floorDiv;(int,long);generated",
+        "kotlin;NumbersKt;floorDiv;(int,short);generated",
+        "kotlin;NumbersKt;floorDiv;(long,byte);generated",
+        "kotlin;NumbersKt;floorDiv;(long,int);generated",
+        "kotlin;NumbersKt;floorDiv;(long,long);generated",
+        "kotlin;NumbersKt;floorDiv;(long,short);generated",
+        "kotlin;NumbersKt;floorDiv;(short,byte);generated",
+        "kotlin;NumbersKt;floorDiv;(short,int);generated",
+        "kotlin;NumbersKt;floorDiv;(short,long);generated",
+        "kotlin;NumbersKt;floorDiv;(short,short);generated",
+        "kotlin;NumbersKt;fromBits;(DoubleCompanionObject,long);generated",
+        "kotlin;NumbersKt;fromBits;(FloatCompanionObject,int);generated",
+        "kotlin;NumbersKt;inc;(BigDecimal);generated",
+        "kotlin;NumbersKt;inc;(BigInteger);generated",
+        "kotlin;NumbersKt;inv;(BigInteger);generated",
+        "kotlin;NumbersKt;isFinite;(double);generated",
+        "kotlin;NumbersKt;isFinite;(float);generated",
+        "kotlin;NumbersKt;isInfinite;(double);generated",
+        "kotlin;NumbersKt;isInfinite;(float);generated",
+        "kotlin;NumbersKt;isNaN;(double);generated", "kotlin;NumbersKt;isNaN;(float);generated",
+        "kotlin;NumbersKt;minus;(BigDecimal,BigDecimal);generated",
+        "kotlin;NumbersKt;minus;(BigInteger,BigInteger);generated",
+        "kotlin;NumbersKt;mod;(byte,byte);generated", "kotlin;NumbersKt;mod;(byte,int);generated",
+        "kotlin;NumbersKt;mod;(byte,long);generated", "kotlin;NumbersKt;mod;(byte,short);generated",
+        "kotlin;NumbersKt;mod;(double,double);generated",
+        "kotlin;NumbersKt;mod;(double,float);generated",
+        "kotlin;NumbersKt;mod;(float,double);generated",
+        "kotlin;NumbersKt;mod;(float,float);generated", "kotlin;NumbersKt;mod;(int,byte);generated",
+        "kotlin;NumbersKt;mod;(int,int);generated", "kotlin;NumbersKt;mod;(int,long);generated",
+        "kotlin;NumbersKt;mod;(int,short);generated", "kotlin;NumbersKt;mod;(long,byte);generated",
+        "kotlin;NumbersKt;mod;(long,int);generated", "kotlin;NumbersKt;mod;(long,long);generated",
+        "kotlin;NumbersKt;mod;(long,short);generated",
+        "kotlin;NumbersKt;mod;(short,byte);generated", "kotlin;NumbersKt;mod;(short,int);generated",
+        "kotlin;NumbersKt;mod;(short,long);generated",
+        "kotlin;NumbersKt;mod;(short,short);generated",
+        "kotlin;NumbersKt;or;(BigInteger,BigInteger);generated",
+        "kotlin;NumbersKt;plus;(BigDecimal,BigDecimal);generated",
+        "kotlin;NumbersKt;plus;(BigInteger,BigInteger);generated",
+        "kotlin;NumbersKt;rem;(BigDecimal,BigDecimal);generated",
+        "kotlin;NumbersKt;rem;(BigInteger,BigInteger);generated",
+        "kotlin;NumbersKt;rotateLeft;(byte,int);generated",
+        "kotlin;NumbersKt;rotateLeft;(int,int);generated",
+        "kotlin;NumbersKt;rotateLeft;(long,int);generated",
+        "kotlin;NumbersKt;rotateLeft;(short,int);generated",
+        "kotlin;NumbersKt;rotateRight;(byte,int);generated",
+        "kotlin;NumbersKt;rotateRight;(int,int);generated",
+        "kotlin;NumbersKt;rotateRight;(long,int);generated",
+        "kotlin;NumbersKt;rotateRight;(short,int);generated",
+        "kotlin;NumbersKt;shl;(BigInteger,int);generated",
+        "kotlin;NumbersKt;shr;(BigInteger,int);generated",
+        "kotlin;NumbersKt;takeHighestOneBit;(byte);generated",
+        "kotlin;NumbersKt;takeHighestOneBit;(int);generated",
+        "kotlin;NumbersKt;takeHighestOneBit;(long);generated",
+        "kotlin;NumbersKt;takeHighestOneBit;(short);generated",
+        "kotlin;NumbersKt;takeLowestOneBit;(byte);generated",
+        "kotlin;NumbersKt;takeLowestOneBit;(int);generated",
+        "kotlin;NumbersKt;takeLowestOneBit;(long);generated",
+        "kotlin;NumbersKt;takeLowestOneBit;(short);generated",
+        "kotlin;NumbersKt;times;(BigDecimal,BigDecimal);generated",
+        "kotlin;NumbersKt;times;(BigInteger,BigInteger);generated",
+        "kotlin;NumbersKt;toBigDecimal;(BigInteger);generated",
+        "kotlin;NumbersKt;toBigDecimal;(BigInteger,int,MathContext);generated",
+        "kotlin;NumbersKt;toBigDecimal;(double);generated",
+        "kotlin;NumbersKt;toBigDecimal;(double,MathContext);generated",
+        "kotlin;NumbersKt;toBigDecimal;(float);generated",
+        "kotlin;NumbersKt;toBigDecimal;(float,MathContext);generated",
+        "kotlin;NumbersKt;toBigDecimal;(int);generated",
+        "kotlin;NumbersKt;toBigDecimal;(int,MathContext);generated",
+        "kotlin;NumbersKt;toBigDecimal;(long);generated",
+        "kotlin;NumbersKt;toBigDecimal;(long,MathContext);generated",
+        "kotlin;NumbersKt;toBigInteger;(int);generated",
+        "kotlin;NumbersKt;toBigInteger;(long);generated",
+        "kotlin;NumbersKt;toBits;(double);generated", "kotlin;NumbersKt;toBits;(float);generated",
+        "kotlin;NumbersKt;toRawBits;(double);generated",
+        "kotlin;NumbersKt;toRawBits;(float);generated",
+        "kotlin;NumbersKt;unaryMinus;(BigDecimal);generated",
+        "kotlin;NumbersKt;unaryMinus;(BigInteger);generated",
+        "kotlin;NumbersKt;xor;(BigInteger,BigInteger);generated",
+        "kotlin;OptIn;OptIn;(KClass[]);generated", "kotlin;OptIn;markerClass;();generated",
+        "kotlin;OptionalExpectation;OptionalExpectation;();generated",
+        "kotlin;OverloadResolutionByLambdaReturnType;OverloadResolutionByLambdaReturnType;();generated",
+        "kotlin;Pair;equals;(Object);generated", "kotlin;Pair;hashCode;();generated",
+        "kotlin;ParameterName;ParameterName;(String);generated",
+        "kotlin;ParameterName;name;();generated",
+        "kotlin;PreconditionsKt;assert;(boolean);generated",
+        "kotlin;PreconditionsKt;assert;(boolean,Function0);generated",
+        "kotlin;PreconditionsKt;check;(boolean);generated",
+        "kotlin;PreconditionsKt;check;(boolean,Function0);generated",
+        "kotlin;PreconditionsKt;error;(Object);generated",
+        "kotlin;PreconditionsKt;require;(boolean);generated",
+        "kotlin;PreconditionsKt;require;(boolean,Function0);generated",
+        "kotlin;PropertyReferenceDelegatesKt;getValue;(KProperty0,Object,KProperty);generated",
+        "kotlin;PropertyReferenceDelegatesKt;getValue;(KProperty1,Object,KProperty);generated",
+        "kotlin;PropertyReferenceDelegatesKt;setValue;(KMutableProperty0,Object,KProperty,Object);generated",
+        "kotlin;PropertyReferenceDelegatesKt;setValue;(KMutableProperty1,Object,KProperty,Object);generated",
+        "kotlin;PublishedApi;PublishedApi;();generated",
+        "kotlin;ReplaceWith;ReplaceWith;(String,String[]);generated",
+        "kotlin;ReplaceWith;expression;();generated", "kotlin;ReplaceWith;imports;();generated",
+        "kotlin;RequiresOptIn$Level;valueOf;(String);generated",
+        "kotlin;RequiresOptIn$Level;values;();generated",
+        "kotlin;RequiresOptIn;RequiresOptIn;(String,Level);generated",
+        "kotlin;RequiresOptIn;level;();generated", "kotlin;RequiresOptIn;message;();generated",
+        "kotlin;Result;equals;(Object);generated", "kotlin;Result;hashCode;();generated",
+        "kotlin;Result;isFailure;();generated", "kotlin;Result;isSuccess;();generated",
+        "kotlin;ResultKt;runCatching;(Function0);generated",
+        "kotlin;ResultKt;runCatching;(Object,Function1);generated",
+        "kotlin;RuntimeException;RuntimeException;();generated",
+        "kotlin;RuntimeException;RuntimeException;(String);generated",
+        "kotlin;RuntimeException;RuntimeException;(String,Throwable);generated",
+        "kotlin;RuntimeException;RuntimeException;(Throwable);generated",
+        "kotlin;SinceKotlin;SinceKotlin;(String);generated",
+        "kotlin;SinceKotlin;version;();generated", "kotlin;StandardKt;TODO;();generated",
+        "kotlin;StandardKt;TODO;(String);generated",
+        "kotlin;StandardKt;repeat;(int,Function1);generated",
+        "kotlin;StandardKt;run;(Function0);generated",
+        "kotlin;StandardKt;synchronized;(Object,Function0);generated",
+        "kotlin;Suppress;Suppress;(String[]);generated", "kotlin;Suppress;names;();generated",
+        "kotlin;Throws;Throws;(KClass[]);generated", "kotlin;Throws;exceptionClasses;();generated",
+        "kotlin;Triple;equals;(Object);generated", "kotlin;Triple;hashCode;();generated",
+        "kotlin;TypeCastException;TypeCastException;();generated",
+        "kotlin;TypeCastException;TypeCastException;(String);generated",
+        "kotlin;UByte$Companion;getMAX_VALUE;();generated",
+        "kotlin;UByte$Companion;getMIN_VALUE;();generated",
+        "kotlin;UByte$Companion;getSIZE_BITS;();generated",
+        "kotlin;UByte$Companion;getSIZE_BYTES;();generated", "kotlin;UByte;and;(byte);generated",
+        "kotlin;UByte;compareTo;(byte);generated", "kotlin;UByte;compareTo;(int);generated",
+        "kotlin;UByte;compareTo;(long);generated", "kotlin;UByte;compareTo;(short);generated",
+        "kotlin;UByte;dec;();generated", "kotlin;UByte;div;(byte);generated",
+        "kotlin;UByte;div;(int);generated", "kotlin;UByte;div;(long);generated",
+        "kotlin;UByte;div;(short);generated", "kotlin;UByte;equals;(Object);generated",
+        "kotlin;UByte;floorDiv;(byte);generated", "kotlin;UByte;floorDiv;(int);generated",
+        "kotlin;UByte;floorDiv;(long);generated", "kotlin;UByte;floorDiv;(short);generated",
+        "kotlin;UByte;hashCode;();generated", "kotlin;UByte;inc;();generated",
+        "kotlin;UByte;inv;();generated", "kotlin;UByte;minus;(byte);generated",
+        "kotlin;UByte;minus;(int);generated", "kotlin;UByte;minus;(long);generated",
+        "kotlin;UByte;minus;(short);generated", "kotlin;UByte;mod;(byte);generated",
+        "kotlin;UByte;mod;(int);generated", "kotlin;UByte;mod;(long);generated",
+        "kotlin;UByte;mod;(short);generated", "kotlin;UByte;or;(byte);generated",
+        "kotlin;UByte;plus;(byte);generated", "kotlin;UByte;plus;(int);generated",
+        "kotlin;UByte;plus;(long);generated", "kotlin;UByte;plus;(short);generated",
+        "kotlin;UByte;rangeTo;(byte);generated", "kotlin;UByte;rem;(byte);generated",
+        "kotlin;UByte;rem;(int);generated", "kotlin;UByte;rem;(long);generated",
+        "kotlin;UByte;rem;(short);generated", "kotlin;UByte;times;(byte);generated",
+        "kotlin;UByte;times;(int);generated", "kotlin;UByte;times;(long);generated",
+        "kotlin;UByte;times;(short);generated", "kotlin;UByte;toByte;();generated",
+        "kotlin;UByte;toDouble;();generated", "kotlin;UByte;toFloat;();generated",
+        "kotlin;UByte;toInt;();generated", "kotlin;UByte;toLong;();generated",
+        "kotlin;UByte;toShort;();generated", "kotlin;UByte;toString;();generated",
+        "kotlin;UByte;toUInt;();generated", "kotlin;UByte;toULong;();generated",
+        "kotlin;UByte;toUShort;();generated", "kotlin;UByte;xor;(byte);generated",
+        "kotlin;UByteArray;UByteArray;(int);generated",
+        "kotlin;UByteArray;equals;(Object);generated", "kotlin;UByteArray;get;(int);generated",
+        "kotlin;UByteArray;hashCode;();generated", "kotlin;UByteArray;set;(int,byte);generated",
+        "kotlin;UByteArray;toString;();generated",
+        "kotlin;UByteArrayKt;UByteArray;(int,Function1);generated",
+        "kotlin;UByteKt;toUByte;(byte);generated", "kotlin;UByteKt;toUByte;(int);generated",
+        "kotlin;UByteKt;toUByte;(long);generated", "kotlin;UByteKt;toUByte;(short);generated",
+        "kotlin;UInt$Companion;getMAX_VALUE;();generated",
+        "kotlin;UInt$Companion;getMIN_VALUE;();generated",
+        "kotlin;UInt$Companion;getSIZE_BITS;();generated",
+        "kotlin;UInt$Companion;getSIZE_BYTES;();generated", "kotlin;UInt;and;(int);generated",
+        "kotlin;UInt;compareTo;(byte);generated", "kotlin;UInt;compareTo;(int);generated",
+        "kotlin;UInt;compareTo;(long);generated", "kotlin;UInt;compareTo;(short);generated",
+        "kotlin;UInt;dec;();generated", "kotlin;UInt;div;(byte);generated",
+        "kotlin;UInt;div;(int);generated", "kotlin;UInt;div;(long);generated",
+        "kotlin;UInt;div;(short);generated", "kotlin;UInt;equals;(Object);generated",
+        "kotlin;UInt;floorDiv;(byte);generated", "kotlin;UInt;floorDiv;(int);generated",
+        "kotlin;UInt;floorDiv;(long);generated", "kotlin;UInt;floorDiv;(short);generated",
+        "kotlin;UInt;hashCode;();generated", "kotlin;UInt;inc;();generated",
+        "kotlin;UInt;inv;();generated", "kotlin;UInt;minus;(byte);generated",
+        "kotlin;UInt;minus;(int);generated", "kotlin;UInt;minus;(long);generated",
+        "kotlin;UInt;minus;(short);generated", "kotlin;UInt;mod;(byte);generated",
+        "kotlin;UInt;mod;(int);generated", "kotlin;UInt;mod;(long);generated",
+        "kotlin;UInt;mod;(short);generated", "kotlin;UInt;or;(int);generated",
+        "kotlin;UInt;plus;(byte);generated", "kotlin;UInt;plus;(int);generated",
+        "kotlin;UInt;plus;(long);generated", "kotlin;UInt;plus;(short);generated",
+        "kotlin;UInt;rangeTo;(int);generated", "kotlin;UInt;rem;(byte);generated",
+        "kotlin;UInt;rem;(int);generated", "kotlin;UInt;rem;(long);generated",
+        "kotlin;UInt;rem;(short);generated", "kotlin;UInt;shl;(int);generated",
+        "kotlin;UInt;shr;(int);generated", "kotlin;UInt;times;(byte);generated",
+        "kotlin;UInt;times;(int);generated", "kotlin;UInt;times;(long);generated",
+        "kotlin;UInt;times;(short);generated", "kotlin;UInt;toByte;();generated",
+        "kotlin;UInt;toDouble;();generated", "kotlin;UInt;toFloat;();generated",
+        "kotlin;UInt;toInt;();generated", "kotlin;UInt;toLong;();generated",
+        "kotlin;UInt;toShort;();generated", "kotlin;UInt;toString;();generated",
+        "kotlin;UInt;toUByte;();generated", "kotlin;UInt;toULong;();generated",
+        "kotlin;UInt;toUShort;();generated", "kotlin;UInt;xor;(int);generated",
+        "kotlin;UIntArray;UIntArray;(int);generated", "kotlin;UIntArray;equals;(Object);generated",
+        "kotlin;UIntArray;get;(int);generated", "kotlin;UIntArray;hashCode;();generated",
+        "kotlin;UIntArray;set;(int,int);generated", "kotlin;UIntArray;toString;();generated",
+        "kotlin;UIntArrayKt;UIntArray;(int,Function1);generated",
+        "kotlin;UIntKt;toUInt;(byte);generated", "kotlin;UIntKt;toUInt;(double);generated",
+        "kotlin;UIntKt;toUInt;(float);generated", "kotlin;UIntKt;toUInt;(int);generated",
+        "kotlin;UIntKt;toUInt;(long);generated", "kotlin;UIntKt;toUInt;(short);generated",
+        "kotlin;ULong$Companion;getMAX_VALUE;();generated",
+        "kotlin;ULong$Companion;getMIN_VALUE;();generated",
+        "kotlin;ULong$Companion;getSIZE_BITS;();generated",
+        "kotlin;ULong$Companion;getSIZE_BYTES;();generated", "kotlin;ULong;and;(long);generated",
+        "kotlin;ULong;compareTo;(byte);generated", "kotlin;ULong;compareTo;(int);generated",
+        "kotlin;ULong;compareTo;(long);generated", "kotlin;ULong;compareTo;(short);generated",
+        "kotlin;ULong;dec;();generated", "kotlin;ULong;div;(byte);generated",
+        "kotlin;ULong;div;(int);generated", "kotlin;ULong;div;(long);generated",
+        "kotlin;ULong;div;(short);generated", "kotlin;ULong;equals;(Object);generated",
+        "kotlin;ULong;floorDiv;(byte);generated", "kotlin;ULong;floorDiv;(int);generated",
+        "kotlin;ULong;floorDiv;(long);generated", "kotlin;ULong;floorDiv;(short);generated",
+        "kotlin;ULong;hashCode;();generated", "kotlin;ULong;inc;();generated",
+        "kotlin;ULong;inv;();generated", "kotlin;ULong;minus;(byte);generated",
+        "kotlin;ULong;minus;(int);generated", "kotlin;ULong;minus;(long);generated",
+        "kotlin;ULong;minus;(short);generated", "kotlin;ULong;mod;(byte);generated",
+        "kotlin;ULong;mod;(int);generated", "kotlin;ULong;mod;(long);generated",
+        "kotlin;ULong;mod;(short);generated", "kotlin;ULong;or;(long);generated",
+        "kotlin;ULong;plus;(byte);generated", "kotlin;ULong;plus;(int);generated",
+        "kotlin;ULong;plus;(long);generated", "kotlin;ULong;plus;(short);generated",
+        "kotlin;ULong;rangeTo;(long);generated", "kotlin;ULong;rem;(byte);generated",
+        "kotlin;ULong;rem;(int);generated", "kotlin;ULong;rem;(long);generated",
+        "kotlin;ULong;rem;(short);generated", "kotlin;ULong;shl;(int);generated",
+        "kotlin;ULong;shr;(int);generated", "kotlin;ULong;times;(byte);generated",
+        "kotlin;ULong;times;(int);generated", "kotlin;ULong;times;(long);generated",
+        "kotlin;ULong;times;(short);generated", "kotlin;ULong;toByte;();generated",
+        "kotlin;ULong;toDouble;();generated", "kotlin;ULong;toFloat;();generated",
+        "kotlin;ULong;toInt;();generated", "kotlin;ULong;toLong;();generated",
+        "kotlin;ULong;toShort;();generated", "kotlin;ULong;toString;();generated",
+        "kotlin;ULong;toUByte;();generated", "kotlin;ULong;toUInt;();generated",
+        "kotlin;ULong;toUShort;();generated", "kotlin;ULong;xor;(long);generated",
+        "kotlin;ULongArray;ULongArray;(int);generated",
+        "kotlin;ULongArray;equals;(Object);generated", "kotlin;ULongArray;get;(int);generated",
+        "kotlin;ULongArray;hashCode;();generated", "kotlin;ULongArray;set;(int,long);generated",
+        "kotlin;ULongArray;toString;();generated",
+        "kotlin;ULongArrayKt;ULongArray;(int,Function1);generated",
+        "kotlin;ULongKt;toULong;(byte);generated", "kotlin;ULongKt;toULong;(double);generated",
+        "kotlin;ULongKt;toULong;(float);generated", "kotlin;ULongKt;toULong;(int);generated",
+        "kotlin;ULongKt;toULong;(long);generated", "kotlin;ULongKt;toULong;(short);generated",
+        "kotlin;UNumbersKt;countLeadingZeroBits;(byte);generated",
+        "kotlin;UNumbersKt;countLeadingZeroBits;(int);generated",
+        "kotlin;UNumbersKt;countLeadingZeroBits;(long);generated",
+        "kotlin;UNumbersKt;countLeadingZeroBits;(short);generated",
+        "kotlin;UNumbersKt;countOneBits;(byte);generated",
+        "kotlin;UNumbersKt;countOneBits;(int);generated",
+        "kotlin;UNumbersKt;countOneBits;(long);generated",
+        "kotlin;UNumbersKt;countOneBits;(short);generated",
+        "kotlin;UNumbersKt;countTrailingZeroBits;(byte);generated",
+        "kotlin;UNumbersKt;countTrailingZeroBits;(int);generated",
+        "kotlin;UNumbersKt;countTrailingZeroBits;(long);generated",
+        "kotlin;UNumbersKt;countTrailingZeroBits;(short);generated",
+        "kotlin;UNumbersKt;rotateLeft;(byte,int);generated",
+        "kotlin;UNumbersKt;rotateLeft;(int,int);generated",
+        "kotlin;UNumbersKt;rotateLeft;(long,int);generated",
+        "kotlin;UNumbersKt;rotateLeft;(short,int);generated",
+        "kotlin;UNumbersKt;rotateRight;(byte,int);generated",
+        "kotlin;UNumbersKt;rotateRight;(int,int);generated",
+        "kotlin;UNumbersKt;rotateRight;(long,int);generated",
+        "kotlin;UNumbersKt;rotateRight;(short,int);generated",
+        "kotlin;UNumbersKt;takeHighestOneBit;(byte);generated",
+        "kotlin;UNumbersKt;takeHighestOneBit;(int);generated",
+        "kotlin;UNumbersKt;takeHighestOneBit;(long);generated",
+        "kotlin;UNumbersKt;takeHighestOneBit;(short);generated",
+        "kotlin;UNumbersKt;takeLowestOneBit;(byte);generated",
+        "kotlin;UNumbersKt;takeLowestOneBit;(int);generated",
+        "kotlin;UNumbersKt;takeLowestOneBit;(long);generated",
+        "kotlin;UNumbersKt;takeLowestOneBit;(short);generated",
+        "kotlin;UShort$Companion;getMAX_VALUE;();generated",
+        "kotlin;UShort$Companion;getMIN_VALUE;();generated",
+        "kotlin;UShort$Companion;getSIZE_BITS;();generated",
+        "kotlin;UShort$Companion;getSIZE_BYTES;();generated", "kotlin;UShort;and;(short);generated",
+        "kotlin;UShort;compareTo;(byte);generated", "kotlin;UShort;compareTo;(int);generated",
+        "kotlin;UShort;compareTo;(long);generated", "kotlin;UShort;compareTo;(short);generated",
+        "kotlin;UShort;dec;();generated", "kotlin;UShort;div;(byte);generated",
+        "kotlin;UShort;div;(int);generated", "kotlin;UShort;div;(long);generated",
+        "kotlin;UShort;div;(short);generated", "kotlin;UShort;equals;(Object);generated",
+        "kotlin;UShort;floorDiv;(byte);generated", "kotlin;UShort;floorDiv;(int);generated",
+        "kotlin;UShort;floorDiv;(long);generated", "kotlin;UShort;floorDiv;(short);generated",
+        "kotlin;UShort;hashCode;();generated", "kotlin;UShort;inc;();generated",
+        "kotlin;UShort;inv;();generated", "kotlin;UShort;minus;(byte);generated",
+        "kotlin;UShort;minus;(int);generated", "kotlin;UShort;minus;(long);generated",
+        "kotlin;UShort;minus;(short);generated", "kotlin;UShort;mod;(byte);generated",
+        "kotlin;UShort;mod;(int);generated", "kotlin;UShort;mod;(long);generated",
+        "kotlin;UShort;mod;(short);generated", "kotlin;UShort;or;(short);generated",
+        "kotlin;UShort;plus;(byte);generated", "kotlin;UShort;plus;(int);generated",
+        "kotlin;UShort;plus;(long);generated", "kotlin;UShort;plus;(short);generated",
+        "kotlin;UShort;rangeTo;(short);generated", "kotlin;UShort;rem;(byte);generated",
+        "kotlin;UShort;rem;(int);generated", "kotlin;UShort;rem;(long);generated",
+        "kotlin;UShort;rem;(short);generated", "kotlin;UShort;times;(byte);generated",
+        "kotlin;UShort;times;(int);generated", "kotlin;UShort;times;(long);generated",
+        "kotlin;UShort;times;(short);generated", "kotlin;UShort;toByte;();generated",
+        "kotlin;UShort;toDouble;();generated", "kotlin;UShort;toFloat;();generated",
+        "kotlin;UShort;toInt;();generated", "kotlin;UShort;toLong;();generated",
+        "kotlin;UShort;toShort;();generated", "kotlin;UShort;toString;();generated",
+        "kotlin;UShort;toUByte;();generated", "kotlin;UShort;toUInt;();generated",
+        "kotlin;UShort;toULong;();generated", "kotlin;UShort;xor;(short);generated",
+        "kotlin;UShortArray;UShortArray;(int);generated",
+        "kotlin;UShortArray;equals;(Object);generated", "kotlin;UShortArray;get;(int);generated",
+        "kotlin;UShortArray;hashCode;();generated", "kotlin;UShortArray;set;(int,short);generated",
+        "kotlin;UShortArray;toString;();generated",
+        "kotlin;UShortArrayKt;UShortArray;(int,Function1);generated",
+        "kotlin;UShortKt;toUShort;(byte);generated", "kotlin;UShortKt;toUShort;(int);generated",
+        "kotlin;UShortKt;toUShort;(long);generated", "kotlin;UShortKt;toUShort;(short);generated",
+        "kotlin;UninitializedPropertyAccessException;UninitializedPropertyAccessException;();generated",
+        "kotlin;UninitializedPropertyAccessException;UninitializedPropertyAccessException;(String);generated",
+        "kotlin;UninitializedPropertyAccessException;UninitializedPropertyAccessException;(String,Throwable);generated",
+        "kotlin;UninitializedPropertyAccessException;UninitializedPropertyAccessException;(Throwable);generated",
+        "kotlin;Unit;toString;();generated", "kotlin;UnsafeVariance;UnsafeVariance;();generated",
+        "kotlin;UnsupportedOperationException;UnsupportedOperationException;();generated",
+        "kotlin;UnsupportedOperationException;UnsupportedOperationException;(String);generated",
+        "kotlin;UnsupportedOperationException;UnsupportedOperationException;(String,Throwable);generated",
+        "kotlin;UnsupportedOperationException;UnsupportedOperationException;(Throwable);generated",
+        "kotlin;UseExperimental;UseExperimental;(KClass[]);generated",
+        "kotlin;UseExperimental;markerClass;();generated"
+      ]
+  }
+}
diff --git a/java/ql/lib/semmle/code/java/frameworks/kotlin/StdLib.qll b/java/ql/lib/semmle/code/java/frameworks/kotlin/StdLib.qll
new file mode 100644
index 00000000000..3d70961cf37
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/frameworks/kotlin/StdLib.qll
@@ -0,0 +1,14 @@
+/** Definitions of taint steps in the KotlinStdLib framework */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+
+private class KotlinStdLibSummaryCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "kotlin.jvm.internal;ArrayIteratorKt;false;iterator;(Object[]);;Argument[0].ArrayElement;ReturnValue.Element;value;manual",
+        "kotlin.collections;ArraysKt;false;withIndex;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;manual"
+      ]
+  }
+}
diff --git a/java/ql/lib/semmle/code/java/frameworks/kotlin/StdLibGenerated.qll b/java/ql/lib/semmle/code/java/frameworks/kotlin/StdLibGenerated.qll
new file mode 100644
index 00000000000..ed2b0165f47
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/frameworks/kotlin/StdLibGenerated.qll
@@ -0,0 +1,1868 @@
+/**
+ * THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+ * Definitions of taint steps in the Kotlin StdLib @30ce58cea74 framework.
+ */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+
+private class StdLibGeneratedSinksCsv extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "kotlin.io;FilesKt;false;appendBytes;(File,byte[]);;Argument[0];create-file;generated",
+        "kotlin.io;FilesKt;false;appendText;(File,String,Charset);;Argument[0];create-file;generated",
+        "kotlin.io;FilesKt;false;bufferedWriter;(File,Charset,int);;Argument[0];create-file;generated",
+        "kotlin.io;FilesKt;false;copyRecursively;(File,File,boolean,Function2);;Argument[1];create-file;generated",
+        "kotlin.io;FilesKt;false;copyTo;(File,File,boolean,int);;Argument[1];create-file;generated",
+        "kotlin.io;FilesKt;false;outputStream;(File);;Argument[0];create-file;generated",
+        "kotlin.io;FilesKt;false;printWriter;(File,Charset);;Argument[0];create-file;generated",
+        "kotlin.io;FilesKt;false;writeBytes;(File,byte[]);;Argument[0];create-file;generated",
+        "kotlin.io;FilesKt;false;writeText;(File,String,Charset);;Argument[0];create-file;generated",
+        "kotlin.io;FilesKt;false;writer;(File,Charset);;Argument[0];create-file;generated",
+        "kotlin.io;TextStreamsKt;false;readBytes;(URL);;Argument[0];open-url;generated",
+        "kotlin.io;TextStreamsKt;false;readText;(URL,Charset);;Argument[0];open-url;generated"
+      ]
+  }
+}
+
+private class StdLibGeneratedSummaryCsv extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "kotlin.collections;AbstractCollection;true;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;ArrayDeque;false;ArrayDeque;(Collection);;Argument[0].Element;Argument[-1];taint;generated",
+        "kotlin.collections;ArrayDeque;false;addFirst;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.collections;ArrayDeque;false;addLast;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.collections;ArrayDeque;false;first;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;ArrayDeque;false;firstOrNull;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;ArrayDeque;false;last;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;ArrayDeque;false;lastOrNull;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;ArrayDeque;false;removeFirst;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;ArrayDeque;false;removeFirstOrNull;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;ArrayDeque;false;removeLast;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;ArrayDeque;false;removeLastOrNull;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;asList;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(Object[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(Object[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(boolean[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(boolean[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(byte[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(byte[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(char[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(char[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(double[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(double[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(float[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(float[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(int[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(int[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(long[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(long[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(short[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateByTo;(short[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateTo;(Object[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateTo;(boolean[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateTo;(byte[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateTo;(char[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateTo;(double[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateTo;(float[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateTo;(int[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateTo;(long[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateTo;(short[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateWithTo;(Object[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateWithTo;(boolean[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateWithTo;(byte[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateWithTo;(char[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateWithTo;(double[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateWithTo;(float[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateWithTo;(int[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateWithTo;(long[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;associateWithTo;(short[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyInto;(Object[],Object[],int,int,int);;Argument[0].ArrayElement;Argument[1].ArrayElement;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyInto;(Object[],Object[],int,int,int);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyInto;(Object[],Object[],int,int,int);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyInto;(byte[],byte[],int,int,int);;Argument[0];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;copyInto;(byte[],byte[],int,int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyInto;(byte[],byte[],int,int,int);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyInto;(char[],char[],int,int,int);;Argument[0];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;copyInto;(char[],char[],int,int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyInto;(char[],char[],int,int,int);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyOf;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyOf;(Object[],int);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyOf;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyOf;(byte[],int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyOf;(char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyOf;(char[],int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyOfRangeInline;(Object[],int,int);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyOfRangeInline;(byte[],int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;copyOfRangeInline;(char[],int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;drop;(Object[],int);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;dropLast;(Object[],int);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;dropLastWhile;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;fill;(Object[],Object,int,int);;Argument[1];Argument[0].ArrayElement;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIndexedTo;(Object[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIndexedTo;(boolean[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIndexedTo;(byte[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIndexedTo;(char[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIndexedTo;(double[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIndexedTo;(float[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIndexedTo;(int[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIndexedTo;(long[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIndexedTo;(short[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIsInstanceTo;(Object[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterIsInstanceTo;(Object[],Collection,Class);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterNotNullTo;(Object[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterNotTo;(Object[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterNotTo;(boolean[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterNotTo;(byte[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterNotTo;(char[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterNotTo;(double[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterNotTo;(float[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterNotTo;(int[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterNotTo;(long[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterNotTo;(short[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterTo;(Object[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterTo;(boolean[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterTo;(byte[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterTo;(char[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterTo;(double[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterTo;(float[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterTo;(int[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterTo;(long[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;filterTo;(short[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;findLast;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;first;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;firstOrNull;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapIndexedIterableTo;(Object[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapIndexedIterableTo;(boolean[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapIndexedIterableTo;(byte[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapIndexedIterableTo;(char[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapIndexedIterableTo;(double[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapIndexedIterableTo;(float[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapIndexedIterableTo;(int[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapIndexedIterableTo;(long[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapIndexedIterableTo;(short[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapIndexedSequenceTo;(Object[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapSequenceTo;(Object[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapTo;(Object[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapTo;(boolean[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapTo;(byte[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapTo;(char[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapTo;(double[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapTo;(float[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapTo;(int[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapTo;(long[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;flatMapTo;(short[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;fold;(Object[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;fold;(boolean[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;fold;(byte[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;fold;(char[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;fold;(double[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;fold;(float[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;fold;(int[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;fold;(long[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;fold;(short[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldIndexed;(Object[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldIndexed;(boolean[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldIndexed;(byte[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldIndexed;(char[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldIndexed;(double[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldIndexed;(float[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldIndexed;(int[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldIndexed;(long[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldIndexed;(short[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRight;(Object[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRight;(boolean[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRight;(byte[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRight;(char[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRight;(double[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRight;(float[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRight;(int[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRight;(long[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRight;(short[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRightIndexed;(Object[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRightIndexed;(boolean[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRightIndexed;(byte[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRightIndexed;(char[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRightIndexed;(double[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRightIndexed;(float[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRightIndexed;(int[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRightIndexed;(long[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;foldRightIndexed;(short[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(Object[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(Object[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(boolean[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(boolean[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(byte[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(byte[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(char[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(char[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(double[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(double[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(float[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(float[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(int[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(int[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(long[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(long[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(short[],Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;groupByTo;(short[],Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;ifEmpty;(Object[],Function0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(Object[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(Object[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(Object[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(Object[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(Object[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(Object[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(Object[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(Object[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(Object[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(boolean[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(boolean[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(boolean[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(boolean[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(boolean[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(boolean[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(boolean[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(boolean[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(boolean[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(byte[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(byte[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(byte[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(byte[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(byte[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(byte[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(byte[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(byte[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(byte[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(char[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(char[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(char[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(char[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(char[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(char[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(char[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(char[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(char[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(double[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(double[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(double[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(double[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(double[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(double[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(double[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(double[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(double[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(float[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(float[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(float[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(float[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(float[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(float[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(float[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(float[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(float[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(int[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(int[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(int[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(int[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(int[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(int[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(int[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(int[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(int[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(long[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(long[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(long[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(long[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(long[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(long[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(long[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(long[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(long[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(short[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(short[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(short[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(short[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(short[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(short[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(short[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(short[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.collections;ArraysKt;false;joinTo;(short[],Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(Object[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(Object[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(Object[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(Object[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(boolean[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(boolean[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(boolean[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(boolean[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(byte[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(byte[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(byte[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(byte[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(char[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(char[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(char[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(char[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(double[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(double[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(double[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(double[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(float[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(float[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(float[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(float[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(int[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(int[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(int[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(int[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(long[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(long[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(long[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(long[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(short[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(short[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(short[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;joinToString;(short[],CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;last;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;last;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;lastOrNull;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;lastOrNull;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapIndexedNotNullTo;(Object[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapIndexedTo;(Object[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapIndexedTo;(boolean[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapIndexedTo;(byte[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapIndexedTo;(char[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapIndexedTo;(double[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapIndexedTo;(float[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapIndexedTo;(int[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapIndexedTo;(long[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapIndexedTo;(short[],Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapNotNullTo;(Object[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapTo;(Object[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapTo;(boolean[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapTo;(byte[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapTo;(char[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapTo;(double[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapTo;(float[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapTo;(int[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapTo;(long[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;mapTo;(short[],Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;max;(Comparable[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;maxBy;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;maxByOrNull;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;maxByOrThrow;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;maxOfWith;(Object[],Comparator,Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;maxOfWithOrNull;(Object[],Comparator,Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;maxOrNull;(Comparable[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;maxOrThrow;(Comparable[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;maxWith;(Object[],Comparator);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;maxWithOrNull;(Object[],Comparator);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;maxWithOrThrow;(Object[],Comparator);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;min;(Comparable[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;minBy;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;minByOrNull;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;minByOrThrow;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;minOfWith;(Object[],Comparator,Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;minOfWithOrNull;(Object[],Comparator,Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;minOrNull;(Comparable[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;minOrThrow;(Comparable[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;minWith;(Object[],Comparator);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;minWithOrNull;(Object[],Comparator);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;minWithOrThrow;(Object[],Comparator);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;onEach;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;onEach;(byte[],Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;onEach;(char[],Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;onEachIndexed;(Object[],Function2);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;onEachIndexed;(byte[],Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;onEachIndexed;(char[],Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;orEmpty;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(Object[],Collection);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(Object[],Object);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(Object[],Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(Object[],Object[]);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(byte[],Collection);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(byte[],byte);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(byte[],byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(byte[],byte[]);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(char[],Collection);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(char[],char);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(char[],char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plus;(char[],char[]);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;plusElement;(Object[],Object);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;reduce;(Object[],Function2);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;reduceIndexed;(Object[],Function3);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;reduceIndexedOrNull;(Object[],Function3);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;reduceOrNull;(Object[],Function2);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;requireNoNulls;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;reversed;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;reversedArray;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;reversedArray;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;reversedArray;(char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFold;(Object[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFold;(boolean[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFold;(byte[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFold;(char[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFold;(double[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFold;(float[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFold;(int[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFold;(long[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFold;(short[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFoldIndexed;(Object[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFoldIndexed;(boolean[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFoldIndexed;(byte[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFoldIndexed;(char[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFoldIndexed;(double[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFoldIndexed;(float[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFoldIndexed;(int[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFoldIndexed;(long[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;runningFoldIndexed;(short[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scan;(Object[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scan;(boolean[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scan;(byte[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scan;(char[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scan;(double[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scan;(float[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scan;(int[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scan;(long[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scan;(short[],Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scanIndexed;(Object[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scanIndexed;(boolean[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scanIndexed;(byte[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scanIndexed;(char[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scanIndexed;(double[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scanIndexed;(float[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scanIndexed;(int[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scanIndexed;(long[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;scanIndexed;(short[],Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;single;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;singleOrNull;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;slice;(Object[],IntRange);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sliceArray;(Object[],Collection);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sliceArray;(Object[],IntRange);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sliceArray;(byte[],IntRange);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sliceArray;(char[],IntRange);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sorted;(Comparable[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedArray;(Comparable[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedArray;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedArray;(char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedArrayDescending;(Comparable[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedArrayDescending;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedArrayDescending;(char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedArrayWith;(Object[],Comparator);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedBy;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedByDescending;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedDescending;(Comparable[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;sortedWith;(Object[],Comparator);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;take;(Object[],int);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;takeLast;(Object[],int);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;takeLastWhile;(Object[],Function1);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toCollection;(Object[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toCollection;(boolean[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toCollection;(byte[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toCollection;(char[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toCollection;(double[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toCollection;(float[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toCollection;(int[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toCollection;(long[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toCollection;(short[],Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toList;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toMutableList;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toSet;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toString;(byte[],Charset);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;toTypedArray;(Collection);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;union;(Object[],Iterable);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;union;(byte[],Iterable);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;union;(char[],Iterable);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;zip;(Object[],Iterable);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;zip;(Object[],Iterable);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;zip;(Object[],Iterable,Function2);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;zip;(Object[],Iterable,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;zip;(Object[],Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;zip;(Object[],Object[]);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;zip;(Object[],Object[],Function2);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;ArraysKt;false;zip;(Object[],Object[],Function2);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;addAll;(Collection,Iterable);;Argument[1].Element;Argument[0].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;addAll;(Collection,Object[]);;Argument[1].ArrayElement;Argument[0].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;addAll;(Collection,Sequence);;Argument[1];Argument[0].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;arrayListOf;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;asIterable;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;asReversed;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;asReversedMutable;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associate;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateBy;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateBy;(Iterable,Function1,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateByTo;(Iterable,Map,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateByTo;(Iterable,Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateByTo;(Iterable,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateByTo;(Iterable,Map,Function1,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateByTo;(Iterable,Map,Function1,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateByTo;(Iterable,Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateTo;(Iterable,Map,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateTo;(Iterable,Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateTo;(Iterable,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateWith;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateWithTo;(Iterable,Map,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateWithTo;(Iterable,Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;associateWithTo;(Iterable,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;component1;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;component2;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;component3;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;component4;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;component5;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;distinct;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;distinctBy;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;drop;(Iterable,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;dropLast;(List,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;dropLastWhile;(List,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;dropWhile;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;elementAt;(Iterable,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;elementAt;(List,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;elementAtOrElse;(Iterable,int,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;elementAtOrElse;(List,int,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;elementAtOrNull;(Iterable,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;elementAtOrNull;(List,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;fill;(List,Object);;Argument[1];Argument[0].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filter;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterIndexedTo;(Iterable,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterIsInstance;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterIsInstance;(Iterable,Class);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterIsInstanceTo;(Iterable,Collection);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterIsInstanceTo;(Iterable,Collection);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterIsInstanceTo;(Iterable,Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterIsInstanceTo;(Iterable,Collection,Class);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterIsInstanceTo;(Iterable,Collection,Class);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterIsInstanceTo;(Iterable,Collection,Class);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterNot;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterNotNull;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterNotNullTo;(Iterable,Collection);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterNotNullTo;(Iterable,Collection);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterNotNullTo;(Iterable,Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterNotTo;(Iterable,Collection,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterNotTo;(Iterable,Collection,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterNotTo;(Iterable,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterTo;(Iterable,Collection,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterTo;(Iterable,Collection,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;filterTo;(Iterable,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;find;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;findLast;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;findLast;(List,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;first;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;first;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;first;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;firstNotNullOf;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;firstNotNullOfOrNull;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;firstOrNull;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;firstOrNull;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;firstOrNull;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;flatMapIndexedIterableTo;(Iterable,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;flatMapIndexedSequenceTo;(Iterable,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;flatMapSequenceTo;(Iterable,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;flatMapTo;(Iterable,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;flatten;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;fold;(Iterable,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;foldIndexed;(Iterable,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;foldRight;(List,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;foldRightIndexed;(List,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;getOrElse;(List,int,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;getOrNull;(List,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;groupByTo;(Iterable,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;groupByTo;(Iterable,Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;ifEmpty;(Collection,Function0);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;intersect;(Iterable,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;iterator;(Iterator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[0].Element;Argument[1];taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinTo;(Iterable,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinToString;(Iterable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinToString;(Iterable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinToString;(Iterable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinToString;(Iterable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;joinToString;(Iterable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;last;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;last;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;last;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;last;(List,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;lastOrNull;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;lastOrNull;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;lastOrNull;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;lastOrNull;(List,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;listOf;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;listOf;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;listOfNotNull;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;map;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;mapIndexedNotNullTo;(Iterable,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;mapIndexedTo;(Iterable,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;mapNotNullTo;(Iterable,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;mapTo;(Iterable,Collection,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;mapTo;(Iterable,Collection,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;mapTo;(Iterable,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;max;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;maxBy;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;maxByOrNull;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;maxByOrThrow;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;maxOfWith;(Iterable,Comparator,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;maxOfWithOrNull;(Iterable,Comparator,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;maxOrNull;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;maxOrThrow;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;maxWith;(Iterable,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;maxWithOrNull;(Iterable,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;maxWithOrThrow;(Iterable,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;min;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minBy;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minByOrNull;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minByOrThrow;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minOfWith;(Iterable,Comparator,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minOfWithOrNull;(Iterable,Comparator,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minOrNull;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minOrThrow;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minWith;(Iterable,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minWithOrNull;(Iterable,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minWithOrThrow;(Iterable,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minus;(Iterable,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minus;(Iterable,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minus;(Iterable,Object[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minus;(Iterable,Sequence);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;minusElement;(Iterable,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;mutableListOf;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;onEach;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;onEachIndexed;(Iterable,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;orEmpty;(Collection);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;orEmpty;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;partition;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Collection,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Collection,Iterable);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Collection,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Collection,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Collection,Object[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Collection,Object[]);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Collection,Sequence);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Collection,Sequence);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Iterable,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Iterable,Iterable);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Iterable,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Iterable,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Iterable,Object[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Iterable,Object[]);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Iterable,Sequence);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plus;(Iterable,Sequence);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plusAssign;(Collection,Iterable);;Argument[1].Element;Argument[0].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plusAssign;(Collection,Object);;Argument[1];Argument[0].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plusAssign;(Collection,Object[]);;Argument[1].ArrayElement;Argument[0].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plusAssign;(Collection,Sequence);;Argument[1];Argument[0].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plusElement;(Collection,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plusElement;(Collection,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plusElement;(Iterable,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;plusElement;(Iterable,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;random;(Collection);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;random;(Collection,Random);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;randomOrNull;(Collection);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;randomOrNull;(Collection,Random);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;reduce;(Iterable,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;reduceIndexed;(Iterable,Function3);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;reduceIndexedOrNull;(Iterable,Function3);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;reduceOrNull;(Iterable,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;reduceRight;(List,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;reduceRightIndexed;(List,Function3);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;reduceRightIndexedOrNull;(List,Function3);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;reduceRightOrNull;(List,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;remove;(List,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;removeFirst;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;removeFirstOrNull;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;removeLast;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;removeLastOrNull;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;requireNoNulls;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;requireNoNulls;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;reversed;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;runningFold;(Iterable,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;runningFoldIndexed;(Iterable,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;scan;(Iterable,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;scanIndexed;(Iterable,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;shuffled;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;shuffled;(Iterable,Random);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;single;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;single;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;single;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;singleOrNull;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;singleOrNull;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;singleOrNull;(List);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;slice;(List,IntRange);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;slice;(List,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;sorted;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;sortedBy;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;sortedByDescending;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;sortedDescending;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;sortedWith;(Iterable,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;subtract;(Iterable,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;take;(Iterable,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;takeLast;(List,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;takeLastWhile;(List,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;takeWhile;(Iterable,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toCollection;(Iterable,Collection);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toCollection;(Iterable,Collection);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toCollection;(Iterable,Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toHashSet;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toList;(Enumeration);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toList;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toMutableList;(Collection);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toMutableList;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toMutableSet;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toSet;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toSortedSet;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;toSortedSet;(Iterable,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;union;(Iterable,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;union;(Iterable,Iterable);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;unzip;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;withIndex;(Iterator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;zip;(Iterable,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;zip;(Iterable,Iterable);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;zip;(Iterable,Iterable,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;zip;(Iterable,Iterable,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;zip;(Iterable,Object[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;zip;(Iterable,Object[]);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;zip;(Iterable,Object[],Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;zip;(Iterable,Object[],Function2);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;zipWithNext;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;CollectionsKt;false;zipWithNext;(Iterable,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;GroupingKt;false;aggregateTo;(Grouping,Map,Function4);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;GroupingKt;false;eachCountTo;(Grouping,Map);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;GroupingKt;false;foldTo;(Grouping,Map,Function2,Function3);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;GroupingKt;false;foldTo;(Grouping,Map,Object,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;GroupingKt;false;reduceTo;(Grouping,Map,Function3);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;IndexedValue;false;IndexedValue;(int,Object);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.collections;IndexedValue;false;component2;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;IndexedValue;false;copy;(int,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;IndexedValue;false;getValue;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;IndexedValue;false;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.collections;MapAccessorsKt;false;getValue;(Map,Object,KProperty);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapAccessorsKt;false;getVar;(Map,Object,KProperty);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapAccessorsKt;false;setValue;(Map,Object,KProperty,Object);;Argument[2];Argument[0].Element;taint;generated",
+        "kotlin.collections;MapAccessorsKt;false;setValue;(Map,Object,KProperty,Object);;Argument[3];Argument[0].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;asIterable;(Map);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;component1;(Entry);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;component2;(Entry);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;filter;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;filterKeys;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;filterNot;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;filterNotTo;(Map,Map,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;filterNotTo;(Map,Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;filterNotTo;(Map,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;filterTo;(Map,Map,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;filterTo;(Map,Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;filterTo;(Map,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;filterValues;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;firstNotNullOf;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;firstNotNullOfOrNull;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;flatMapSequenceTo;(Map,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;flatMapTo;(Map,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;get;(Map,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;getOrElse;(Map,Object,Function0);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;getOrPut;(ConcurrentMap,Object,Function0);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;getOrPut;(Map,Object,Function0);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;getOrPut;(Map,Object,Function0);;Argument[1];Argument[0].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;getValue;(Map,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;ifEmpty;(Map,Function0);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;iterator;(Map);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;map;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mapKeys;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mapKeysTo;(Map,Map,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;mapKeysTo;(Map,Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mapKeysTo;(Map,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mapNotNullTo;(Map,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mapOf;(Pair);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mapTo;(Map,Collection,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;mapTo;(Map,Collection,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mapTo;(Map,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mapValues;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mapValuesTo;(Map,Map,Function1);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;mapValuesTo;(Map,Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mapValuesTo;(Map,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;maxBy;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;maxByOrNull;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;maxByOrThrow;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;maxOfWith;(Map,Comparator,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;maxOfWithOrNull;(Map,Comparator,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;maxWith;(Map,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;maxWithOrNull;(Map,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;maxWithOrThrow;(Map,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minBy;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minByOrNull;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minByOrThrow;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minOfWith;(Map,Comparator,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minOfWithOrNull;(Map,Comparator,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minWith;(Map,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minWithOrNull;(Map,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minWithOrThrow;(Map,Comparator);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minus;(Map,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minus;(Map,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minus;(Map,Object[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;minus;(Map,Sequence);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;mutableIterator;(Map);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;onEach;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;onEachIndexed;(Map,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;orEmpty;(Map);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;plus;(Map,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;plus;(Map,Iterable);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;plus;(Map,Map);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;plus;(Map,Pair);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;plus;(Map,Pair);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;plus;(Map,Pair[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;plus;(Map,Pair[]);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;plus;(Map,Sequence);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;plusAssign;(Map,Iterable);;Argument[1].Element;Argument[0].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;plusAssign;(Map,Map);;Argument[1].Element;Argument[0].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;plusAssign;(Map,Pair);;Argument[1];Argument[0].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;plusAssign;(Map,Sequence);;Argument[1];Argument[0].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;putAll;(Map,Iterable);;Argument[1].Element;Argument[0].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;putAll;(Map,Sequence);;Argument[1];Argument[0].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;remove;(Map,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;set;(Map,Object,Object);;Argument[1];Argument[0].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;set;(Map,Object,Object);;Argument[2];Argument[0].Element;taint;generated",
+        "kotlin.collections;MapsKt;false;toList;(Map);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;toMap;(Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;toMap;(Iterable,Map);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;toMap;(Map);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;toMap;(Map,Map);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;toMap;(Pair[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;toMap;(Pair[],Map);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;toMap;(Sequence,Map);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;toMutableMap;(Map);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;toPair;(Entry);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;toSortedMap;(Map);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;withDefault;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;withDefault;(Map,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;withDefaultMutable;(Map,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;MapsKt;false;withDefaultMutable;(Map,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;minus;(Set,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;minus;(Set,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;minus;(Set,Object[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;minus;(Set,Sequence);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;minusElement;(Set,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;orEmpty;(Set);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;plus;(Set,Iterable);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;plus;(Set,Iterable);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;plus;(Set,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;plus;(Set,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;plus;(Set,Object[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;plus;(Set,Object[]);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;plus;(Set,Sequence);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;plus;(Set,Sequence);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;plusElement;(Set,Object);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;plusElement;(Set,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;setOf;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;setOf;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.collections;SetsKt;false;setOfNotNull;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;asByteArray;(UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;asUByteArray;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;associateWithTo;(UByteArray,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;associateWithTo;(UIntArray,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;associateWithTo;(ULongArray,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;associateWithTo;(UShortArray,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;contentToString;(UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;contentToString;(UIntArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;contentToString;(ULongArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;contentToString;(UShortArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;copyInto;(UByteArray,UByteArray,int,int,int);;Argument[0].Element;Argument[1].Element;taint;generated",
+        "kotlin.collections;UArraysKt;false;copyInto;(UByteArray,UByteArray,int,int,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;copyInto;(UByteArray,UByteArray,int,int,int);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;copyInto;(UIntArray,UIntArray,int,int,int);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;copyInto;(ULongArray,ULongArray,int,int,int);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;copyInto;(UShortArray,UShortArray,int,int,int);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;copyOf;(UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;copyOf;(UByteArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;copyOfRange;(UByteArray,int,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;drop;(UByteArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;drop;(UIntArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;drop;(ULongArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;drop;(UShortArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;dropLast;(UByteArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;dropLast;(UIntArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;dropLast;(ULongArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;dropLast;(UShortArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;dropLastWhile;(UByteArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;dropLastWhile;(UIntArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;dropLastWhile;(ULongArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;dropLastWhile;(UShortArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterIndexedTo;(UByteArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterIndexedTo;(UIntArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterIndexedTo;(ULongArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterIndexedTo;(UShortArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterNotTo;(UByteArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterNotTo;(UIntArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterNotTo;(ULongArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterNotTo;(UShortArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterTo;(UByteArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterTo;(UIntArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterTo;(ULongArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;filterTo;(UShortArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;flatMapIndexedTo;(UByteArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;flatMapIndexedTo;(UIntArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;flatMapIndexedTo;(ULongArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;flatMapIndexedTo;(UShortArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;flatMapTo;(UByteArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;flatMapTo;(UIntArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;flatMapTo;(ULongArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;flatMapTo;(UShortArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;fold;(UByteArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;fold;(UIntArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;fold;(ULongArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;fold;(UShortArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldIndexed;(UByteArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldIndexed;(UIntArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldIndexed;(ULongArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldIndexed;(UShortArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldRight;(UByteArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldRight;(UIntArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldRight;(ULongArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldRight;(UShortArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldRightIndexed;(UByteArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldRightIndexed;(UIntArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldRightIndexed;(ULongArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;foldRightIndexed;(UShortArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;groupByTo;(UByteArray,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;groupByTo;(UByteArray,Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;groupByTo;(UIntArray,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;groupByTo;(UIntArray,Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;groupByTo;(ULongArray,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;groupByTo;(ULongArray,Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;groupByTo;(UShortArray,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;groupByTo;(UShortArray,Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;mapIndexedTo;(UByteArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;mapIndexedTo;(UIntArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;mapIndexedTo;(ULongArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;mapIndexedTo;(UShortArray,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;mapTo;(UByteArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;mapTo;(UIntArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;mapTo;(ULongArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;mapTo;(UShortArray,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;onEach;(UByteArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;onEach;(UIntArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;onEach;(ULongArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;onEach;(UShortArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;onEachIndexed;(UByteArray,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;onEachIndexed;(UIntArray,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;onEachIndexed;(ULongArray,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;onEachIndexed;(UShortArray,Function2);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;plus;(UByteArray,Collection);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;plus;(UByteArray,UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;plus;(UByteArray,UByteArray);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;plus;(UByteArray,byte);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;reversed;(UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;reversed;(UIntArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;reversed;(ULongArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;reversed;(UShortArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;reversedArray;(UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;runningFold;(UByteArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;runningFold;(UIntArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;runningFold;(ULongArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;runningFold;(UShortArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;runningFoldIndexed;(UByteArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;runningFoldIndexed;(UIntArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;runningFoldIndexed;(ULongArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;runningFoldIndexed;(UShortArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;scan;(UByteArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;scan;(UIntArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;scan;(ULongArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;scan;(UShortArray,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;scanIndexed;(UByteArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;scanIndexed;(UIntArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;scanIndexed;(ULongArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;scanIndexed;(UShortArray,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;sliceArray;(UByteArray,IntRange);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;sortedArray;(UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;sortedArray;(UIntArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;sortedArray;(ULongArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;sortedArray;(UShortArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;sortedArrayDescending;(UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;sortedArrayDescending;(UIntArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;sortedArrayDescending;(ULongArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;sortedArrayDescending;(UShortArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;sortedDescending;(UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;take;(UByteArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;take;(UIntArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;take;(ULongArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;take;(UShortArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;takeLast;(UByteArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;takeLast;(UIntArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;takeLast;(ULongArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;takeLast;(UShortArray,int);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;takeLastWhile;(UByteArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;takeLastWhile;(UIntArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;takeLastWhile;(ULongArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;takeLastWhile;(UShortArray,Function1);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;toByteArray;(UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.collections;UArraysKt;false;toUByteArray;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Comparable,Comparable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Comparable,Comparable);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Comparable,Comparable,Comparable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Comparable,Comparable,Comparable);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Comparable,Comparable,Comparable);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Comparable,Comparable[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Object,Object,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Object,Object,Comparator);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Object,Object,Object,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Object,Object,Object,Comparator);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Object,Object,Object,Comparator);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;maxOf;(Object,Object[],Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Comparable,Comparable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Comparable,Comparable);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Comparable,Comparable,Comparable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Comparable,Comparable,Comparable);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Comparable,Comparable,Comparable);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Comparable,Comparable[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Object,Object,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Object,Object,Comparator);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Object,Object,Object,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Object,Object,Object,Comparator);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Object,Object,Object,Comparator);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;minOf;(Object,Object[],Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.comparisons;ComparisonsKt;false;reversed;(Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.coroutines.intrinsics;IntrinsicsKt;false;intercepted;(Continuation);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.coroutines.jvm.internal;CoroutineStackFrame;true;getCallerFrame;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.coroutines;AbstractCoroutineContextElement;true;AbstractCoroutineContextElement;(Key);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.coroutines;AbstractCoroutineContextKey;true;AbstractCoroutineContextKey;(Key,Function1);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.coroutines;AbstractCoroutineContextKey;true;AbstractCoroutineContextKey;(Key,Function1);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.coroutines;CoroutineContext$Element;true;getKey;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.coroutines;CoroutineContext;true;fold;(Object,Function2);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.coroutines;CoroutineContext;true;fold;(Object,Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.coroutines;CoroutineContext;true;get;(Key);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.coroutines;CoroutineContext;true;minusKey;(Key);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.coroutines;CoroutineContext;true;minusKey;(Key);;Argument[-1];ReturnValue;value;generated",
+        "kotlin.coroutines;CoroutineContext;true;plus;(CoroutineContext);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.coroutines;CoroutineContext;true;plus;(CoroutineContext);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.coroutines;CoroutineContextImplKt;false;getPolymorphicElement;(Element,Key);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.coroutines;CoroutineContextImplKt;false;minusPolymorphicKey;(Element,Key);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;AccessDeniedException;false;AccessDeniedException;(File,File,String);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.io;AccessDeniedException;false;AccessDeniedException;(File,File,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.io;AccessDeniedException;false;AccessDeniedException;(File,File,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.io;ByteStreamsKt;false;buffered;(InputStream,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;ByteStreamsKt;false;buffered;(OutputStream,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;ByteStreamsKt;false;bufferedReader;(InputStream,Charset);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;ByteStreamsKt;false;byteInputStream;(String,Charset);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;ByteStreamsKt;false;copyTo;(InputStream,OutputStream,int);;Argument[0];Argument[1];taint;generated",
+        "kotlin.io;ByteStreamsKt;false;inputStream;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;ByteStreamsKt;false;inputStream;(byte[],int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;ByteStreamsKt;false;readBytes;(InputStream);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;ByteStreamsKt;false;readBytes;(InputStream,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;ByteStreamsKt;false;reader;(InputStream,Charset);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;CloseableKt;false;use;(Closeable,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;FileAlreadyExistsException;false;FileAlreadyExistsException;(File,File,String);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.io;FileAlreadyExistsException;false;FileAlreadyExistsException;(File,File,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.io;FileAlreadyExistsException;false;FileAlreadyExistsException;(File,File,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.io;FileSystemException;true;FileSystemException;(File,File,String);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.io;FileSystemException;true;FileSystemException;(File,File,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.io;FileSystemException;true;FileSystemException;(File,File,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.io;FileSystemException;true;getFile;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.io;FileSystemException;true;getOther;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.io;FileSystemException;true;getReason;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.io;FileTreeWalk;false;maxDepth;(int);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.io;FileTreeWalk;false;onEnter;(Function1);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.io;FileTreeWalk;false;onEnter;(Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;FileTreeWalk;false;onFail;(Function2);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.io;FileTreeWalk;false;onFail;(Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;FileTreeWalk;false;onLeave;(Function1);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.io;FileTreeWalk;false;onLeave;(Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;FilesKt;false;copyTo;(File,File,boolean,int);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.io;FilesKt;false;relativeToOrSelf;(File,File);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;FilesKt;false;resolve;(File,File);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.io;FilesKt;false;resolve;(File,String);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.io;FilesKt;false;resolveSibling;(File,File);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.io;FilesKt;false;resolveSibling;(File,String);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.io;FilesKt;false;walk;(File,FileWalkDirection);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;FilesKt;false;walkBottomUp;(File);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;FilesKt;false;walkTopDown;(File);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;NoSuchFileException;false;NoSuchFileException;(File,File,String);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.io;NoSuchFileException;false;NoSuchFileException;(File,File,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.io;NoSuchFileException;false;NoSuchFileException;(File,File,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.io;TextStreamsKt;false;buffered;(Reader,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;TextStreamsKt;false;buffered;(Writer,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;TextStreamsKt;false;copyTo;(Reader,Writer,int);;Argument[0];Argument[1];taint;generated",
+        "kotlin.io;TextStreamsKt;false;forEachLine;(Reader,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;TextStreamsKt;false;lineSequence;(BufferedReader);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;TextStreamsKt;false;readText;(Reader);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;TextStreamsKt;false;reader;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.io;TextStreamsKt;false;useLines;(Reader,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;AdaptedFunctionReference;true;AdaptedFunctionReference;(int,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;AdaptedFunctionReference;true;AdaptedFunctionReference;(int,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;AdaptedFunctionReference;true;AdaptedFunctionReference;(int,Object,Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;AdaptedFunctionReference;true;AdaptedFunctionReference;(int,Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;AdaptedFunctionReference;true;AdaptedFunctionReference;(int,Object,Class,String,String,int);;Argument[4];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;ArrayIteratorKt;false;iterator;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ArrayIteratorsKt;false;iterator;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ArrayIteratorsKt;false;iterator;(char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ByteSpreadBuilder;false;toArray;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;CallableReference;true;compute;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;CallableReference;true;getBoundReceiver;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;CallableReference;true;getSignature;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;CharSpreadBuilder;false;toArray;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ClassReference$Companion;false;getClassQualifiedName;(Class);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ClassReference$Companion;false;getClassSimpleName;(Class);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;CollectionToArray;false;toArray;(Collection);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.jvm.internal;CollectionToArray;false;toArray;(Collection,Object[]);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin.jvm.internal;FunctionReference;true;FunctionReference;(int,Object);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;FunctionReference;true;FunctionReference;(int,Object,Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;FunctionReference;true;FunctionReference;(int,Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;FunctionReference;true;FunctionReference;(int,Object,Class,String,String,int);;Argument[4];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;FunctionReference;true;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;FunctionReferenceImpl;true;FunctionReferenceImpl;(int,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;FunctionReferenceImpl;true;FunctionReferenceImpl;(int,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;FunctionReferenceImpl;true;FunctionReferenceImpl;(int,KDeclarationContainer,String,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;FunctionReferenceImpl;true;FunctionReferenceImpl;(int,KDeclarationContainer,String,String);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;FunctionReferenceImpl;true;FunctionReferenceImpl;(int,Object,Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;FunctionReferenceImpl;true;FunctionReferenceImpl;(int,Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;FunctionReferenceImpl;true;FunctionReferenceImpl;(int,Object,Class,String,String,int);;Argument[4];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;Intrinsics;true;stringPlus;(String,Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Intrinsics;true;stringPlus;(String,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0;true;MutablePropertyReference0;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0;true;MutablePropertyReference0;(Object,Class,String,String,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0;true;MutablePropertyReference0;(Object,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0;true;MutablePropertyReference0;(Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0Impl;true;MutablePropertyReference0Impl;(Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0Impl;true;MutablePropertyReference0Impl;(Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0Impl;true;MutablePropertyReference0Impl;(KDeclarationContainer,String,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0Impl;true;MutablePropertyReference0Impl;(KDeclarationContainer,String,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0Impl;true;MutablePropertyReference0Impl;(Object,Class,String,String,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0Impl;true;MutablePropertyReference0Impl;(Object,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference0Impl;true;MutablePropertyReference0Impl;(Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1;true;MutablePropertyReference1;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1;true;MutablePropertyReference1;(Object,Class,String,String,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1;true;MutablePropertyReference1;(Object,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1;true;MutablePropertyReference1;(Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1Impl;true;MutablePropertyReference1Impl;(Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1Impl;true;MutablePropertyReference1Impl;(Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1Impl;true;MutablePropertyReference1Impl;(KDeclarationContainer,String,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1Impl;true;MutablePropertyReference1Impl;(KDeclarationContainer,String,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1Impl;true;MutablePropertyReference1Impl;(Object,Class,String,String,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1Impl;true;MutablePropertyReference1Impl;(Object,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference1Impl;true;MutablePropertyReference1Impl;(Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference2;true;MutablePropertyReference2;(Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference2;true;MutablePropertyReference2;(Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference2Impl;true;MutablePropertyReference2Impl;(Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference2Impl;true;MutablePropertyReference2Impl;(Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference2Impl;true;MutablePropertyReference2Impl;(KDeclarationContainer,String,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference2Impl;true;MutablePropertyReference2Impl;(KDeclarationContainer,String,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference;true;MutablePropertyReference;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference;true;MutablePropertyReference;(Object,Class,String,String,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference;true;MutablePropertyReference;(Object,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;MutablePropertyReference;true;MutablePropertyReference;(Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PackageReference;false;PackageReference;(Class,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PrimitiveSpreadBuilder;true;addSpread;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0;true;PropertyReference0;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0;true;PropertyReference0;(Object,Class,String,String,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0;true;PropertyReference0;(Object,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0;true;PropertyReference0;(Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0Impl;true;PropertyReference0Impl;(Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0Impl;true;PropertyReference0Impl;(Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0Impl;true;PropertyReference0Impl;(KDeclarationContainer,String,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0Impl;true;PropertyReference0Impl;(KDeclarationContainer,String,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0Impl;true;PropertyReference0Impl;(Object,Class,String,String,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0Impl;true;PropertyReference0Impl;(Object,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference0Impl;true;PropertyReference0Impl;(Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1;true;PropertyReference1;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1;true;PropertyReference1;(Object,Class,String,String,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1;true;PropertyReference1;(Object,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1;true;PropertyReference1;(Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1Impl;true;PropertyReference1Impl;(Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1Impl;true;PropertyReference1Impl;(Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1Impl;true;PropertyReference1Impl;(KDeclarationContainer,String,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1Impl;true;PropertyReference1Impl;(KDeclarationContainer,String,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1Impl;true;PropertyReference1Impl;(Object,Class,String,String,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1Impl;true;PropertyReference1Impl;(Object,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference1Impl;true;PropertyReference1Impl;(Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference2;true;PropertyReference2;(Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference2;true;PropertyReference2;(Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference2Impl;true;PropertyReference2Impl;(Class,String,String,int);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference2Impl;true;PropertyReference2Impl;(Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference2Impl;true;PropertyReference2Impl;(KDeclarationContainer,String,String);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference2Impl;true;PropertyReference2Impl;(KDeclarationContainer,String,String);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference;true;PropertyReference;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference;true;PropertyReference;(Object,Class,String,String,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference;true;PropertyReference;(Object,Class,String,String,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference;true;PropertyReference;(Object,Class,String,String,int);;Argument[3];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;PropertyReference;true;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;function;(FunctionReference);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;getOrCreateKotlinPackage;(Class,String);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;mutableCollectionType;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;mutableProperty0;(MutablePropertyReference0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;mutableProperty1;(MutablePropertyReference1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;mutableProperty2;(MutablePropertyReference2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;nothingType;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;nullableTypeOf;(Class,KTypeProjection);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;nullableTypeOf;(Class,KTypeProjection,KTypeProjection);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;nullableTypeOf;(Class,KTypeProjection,KTypeProjection);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;nullableTypeOf;(KClassifier);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;platformType;(KType,KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;platformType;(KType,KType);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;property0;(PropertyReference0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;property1;(PropertyReference1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;property2;(PropertyReference2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;setUpperBounds;(KTypeParameter,KType);;Argument[1];Argument[0];taint;generated",
+        "kotlin.jvm.internal;Reflection;true;typeOf;(Class,KTypeProjection);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;typeOf;(Class,KTypeProjection,KTypeProjection);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;typeOf;(Class,KTypeProjection,KTypeProjection);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;typeOf;(KClassifier);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;typeParameter;(Object,String,KVariance,boolean);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;Reflection;true;typeParameter;(Object,String,KVariance,boolean);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;function;(FunctionReference);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;getOrCreateKotlinPackage;(Class,String);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;mutableCollectionType;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;mutableProperty0;(MutablePropertyReference0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;mutableProperty1;(MutablePropertyReference1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;mutableProperty2;(MutablePropertyReference2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;nothingType;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;platformType;(KType,KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;platformType;(KType,KType);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;property0;(PropertyReference0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;property1;(PropertyReference1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;property2;(PropertyReference2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;setUpperBounds;(KTypeParameter,List);;Argument[1].Element;Argument[0];taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;typeOf;(KClassifier,List,boolean);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;typeOf;(KClassifier,List,boolean);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;typeParameter;(Object,String,KVariance,boolean);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;ReflectionFactory;true;typeParameter;(Object,String,KVariance,boolean);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;SpreadBuilder;true;add;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;SpreadBuilder;true;addSpread;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;SpreadBuilder;true;toArray;(Object[]);;Argument[-1];Argument[0].ArrayElement;taint;generated",
+        "kotlin.jvm.internal;SpreadBuilder;true;toArray;(Object[]);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableCollection;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableCollection;(Object,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableIterable;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableIterable;(Object,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableIterator;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableIterator;(Object,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableList;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableList;(Object,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableListIterator;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableListIterator;(Object,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableMap;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableMap;(Object,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableMapEntry;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableMapEntry;(Object,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableSet;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;asMutableSet;(Object,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;beforeCheckcastToFunctionOfArity;(Object,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;beforeCheckcastToFunctionOfArity;(Object,int,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;castToCollection;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;castToIterable;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;castToIterator;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;castToList;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;castToListIterator;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;castToMap;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;castToMapEntry;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeIntrinsics;true;castToSet;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.jvm.internal;TypeParameterReference;false;TypeParameterReference;(Object,String,KVariance,boolean);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;TypeParameterReference;false;TypeParameterReference;(Object,String,KVariance,boolean);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;TypeParameterReference;false;setUpperBounds;(List);;Argument[0].Element;Argument[-1];taint;generated",
+        "kotlin.jvm.internal;TypeReference;false;TypeReference;(KClassifier,List,KType,int);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;TypeReference;false;TypeReference;(KClassifier,List,KType,int);;Argument[1].Element;Argument[-1];taint;generated",
+        "kotlin.jvm.internal;TypeReference;false;TypeReference;(KClassifier,List,KType,int);;Argument[2];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;TypeReference;false;TypeReference;(KClassifier,List,boolean);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.jvm.internal;TypeReference;false;TypeReference;(KClassifier,List,boolean);;Argument[1].Element;Argument[-1];taint;generated",
+        "kotlin.jvm.internal;TypeReference;false;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.properties;ObservableProperty;true;ObservableProperty;(Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.random;PlatformRandomKt;false;asJavaRandom;(Random);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.random;PlatformRandomKt;false;asKotlinRandom;(Random);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.random;Random;true;nextBytes;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.random;Random;true;nextBytes;(byte[],int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.random;URandomKt;false;nextUBytes;(Random,UByteArray);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.random;URandomKt;false;nextUBytes;(Random,UByteArray,int,int);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.ranges;CharRange$Companion;false;getEMPTY;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.ranges;IntRange$Companion;false;getEMPTY;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.ranges;LongRange$Companion;false;getEMPTY;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;coerceAtLeast;(Comparable,Comparable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;coerceAtLeast;(Comparable,Comparable);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;coerceAtMost;(Comparable,Comparable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;coerceAtMost;(Comparable,Comparable);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;coerceIn;(Comparable,ClosedFloatingPointRange);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;coerceIn;(Comparable,ClosedRange);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;coerceIn;(Comparable,Comparable,Comparable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;coerceIn;(Comparable,Comparable,Comparable);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;coerceIn;(Comparable,Comparable,Comparable);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;rangeTo;(Comparable,Comparable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;rangeTo;(Comparable,Comparable);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;rangeUntil;(Comparable,Comparable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.ranges;RangesKt;false;rangeUntil;(Comparable,Comparable);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.ranges;UIntRange$Companion;false;getEMPTY;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.ranges;ULongRange$Companion;false;getEMPTY;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.reflect;KClasses;false;cast;(KClass,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.reflect;KClasses;false;safeCast;(KClass,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.reflect;KType;true;getArguments;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.reflect;KType;true;getClassifier;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeParameter;true;getName;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeParameter;true;getUpperBounds;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeProjection$Companion;false;contravariant;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeProjection$Companion;false;covariant;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeProjection$Companion;false;invariant;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeProjection;false;KTypeProjection;(KVariance,KType);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.reflect;KTypeProjection;false;component2;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeProjection;false;contravariant;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeProjection;false;copy;(KVariance,KType);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeProjection;false;covariant;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeProjection;false;getType;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeProjection;false;invariant;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.reflect;KTypeProjection;false;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.reflect;TypesJVMKt;false;getJavaType;(KType);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.reflect;WildcardTypeImpl$Companion;false;getSTAR;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequenceScope;true;yieldAll;(Sequence);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.sequences;SequencesKt;false;asSequence;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;associateBy;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;associateByTo;(Sequence,Map,Function1);;Argument[0];Argument[1].Element;taint;generated",
+        "kotlin.sequences;SequencesKt;false;associateByTo;(Sequence,Map,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;associateByTo;(Sequence,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;associateByTo;(Sequence,Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;associateTo;(Sequence,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;associateWith;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;associateWithTo;(Sequence,Map,Function1);;Argument[0];Argument[1].Element;taint;generated",
+        "kotlin.sequences;SequencesKt;false;associateWithTo;(Sequence,Map,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;associateWithTo;(Sequence,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;chunked;(Sequence,int,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;constrainOnce;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;distinct;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;distinctBy;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;distinctBy;(Sequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;drop;(Sequence,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;dropWhile;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;dropWhile;(Sequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;elementAt;(Sequence,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;elementAtOrElse;(Sequence,int,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;elementAtOrNull;(Sequence,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filter;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filter;(Sequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterIndexedTo;(Sequence,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterIsInstance;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterIsInstance;(Sequence,Class);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterIsInstanceTo;(Sequence,Collection);;Argument[0];Argument[1].Element;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterIsInstanceTo;(Sequence,Collection);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterIsInstanceTo;(Sequence,Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterIsInstanceTo;(Sequence,Collection,Class);;Argument[0];Argument[1].Element;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterIsInstanceTo;(Sequence,Collection,Class);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterIsInstanceTo;(Sequence,Collection,Class);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterNot;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterNot;(Sequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterNotNull;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterNotNullTo;(Sequence,Collection);;Argument[0];Argument[1].Element;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterNotNullTo;(Sequence,Collection);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterNotNullTo;(Sequence,Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterNotTo;(Sequence,Collection,Function1);;Argument[0];Argument[1].Element;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterNotTo;(Sequence,Collection,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterNotTo;(Sequence,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterTo;(Sequence,Collection,Function1);;Argument[0];Argument[1].Element;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterTo;(Sequence,Collection,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;filterTo;(Sequence,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;find;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;findLast;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;first;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;first;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;firstNotNullOf;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;firstNotNullOfOrNull;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;firstOrNull;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;firstOrNull;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;flatMap;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;flatMap;(Sequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;flatMapIndexedIterableTo;(Sequence,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;flatMapIndexedSequenceTo;(Sequence,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;flatMapIterable;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;flatMapIterable;(Sequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;flatMapIterableTo;(Sequence,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;flatMapTo;(Sequence,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;flatten;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;flattenSequenceOfIterable;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;fold;(Sequence,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;foldIndexed;(Sequence,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;generateSequence;(Function0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;generateSequence;(Function0,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;generateSequence;(Function0,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;generateSequence;(Object,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;groupByTo;(Sequence,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;groupByTo;(Sequence,Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[0];Argument[1];taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];Argument[1];taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];Argument[1];taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];Argument[1];taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];Argument[1];taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinTo;(Sequence,Appendable,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[6];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinToString;(Sequence,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinToString;(Sequence,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinToString;(Sequence,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinToString;(Sequence,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;joinToString;(Sequence,CharSequence,CharSequence,CharSequence,int,CharSequence,Function1);;Argument[5];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;last;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;last;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;lastOrNull;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;lastOrNull;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;map;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;map;(Sequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapIndexed;(Sequence,Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapIndexed;(Sequence,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapIndexedNotNull;(Sequence,Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapIndexedNotNull;(Sequence,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapIndexedNotNullTo;(Sequence,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapIndexedTo;(Sequence,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapNotNull;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapNotNull;(Sequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapNotNullTo;(Sequence,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapTo;(Sequence,Collection,Function1);;Argument[0];Argument[1].Element;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapTo;(Sequence,Collection,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;mapTo;(Sequence,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;max;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;maxBy;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;maxByOrNull;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;maxByOrThrow;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;maxOfWith;(Sequence,Comparator,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;maxOfWithOrNull;(Sequence,Comparator,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;maxOrNull;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;maxOrThrow;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;maxWith;(Sequence,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;maxWithOrNull;(Sequence,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;maxWithOrThrow;(Sequence,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;min;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minBy;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minByOrNull;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minByOrThrow;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minOfWith;(Sequence,Comparator,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minOfWithOrNull;(Sequence,Comparator,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minOrNull;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minOrThrow;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minWith;(Sequence,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minWithOrNull;(Sequence,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minWithOrThrow;(Sequence,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;minus;(Sequence,Object[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;onEach;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;onEachIndexed;(Sequence,Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;orEmpty;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;partition;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;reduce;(Sequence,Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;reduceIndexed;(Sequence,Function3);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;reduceIndexedOrNull;(Sequence,Function3);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;reduceOrNull;(Sequence,Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;requireNoNulls;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;single;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;single;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;singleOrNull;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;singleOrNull;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;take;(Sequence,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;takeWhile;(Sequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;takeWhile;(Sequence,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;toCollection;(Sequence,Collection);;Argument[0];Argument[1].Element;taint;generated",
+        "kotlin.sequences;SequencesKt;false;toCollection;(Sequence,Collection);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;toCollection;(Sequence,Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;toHashSet;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;toList;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;toMutableList;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;toMutableSet;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;toSet;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;toSortedSet;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;toSortedSet;(Sequence,Comparator);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;unzip;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;windowed;(Sequence,int,int,boolean,Function1);;Argument[4];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;withIndex;(Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;zip;(Sequence,Sequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;zip;(Sequence,Sequence);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;zip;(Sequence,Sequence,Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;zip;(Sequence,Sequence,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.sequences;SequencesKt;false;zip;(Sequence,Sequence,Function2);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;CharsKt;false;plus;(char,String);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;MatchGroup;false;MatchGroup;(String,IntRange);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.text;MatchGroup;false;MatchGroup;(String,IntRange);;Argument[1].Element;Argument[-1];taint;generated",
+        "kotlin.text;MatchGroup;false;component1;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchGroup;false;component2;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchGroup;false;copy;(String,IntRange);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;MatchGroup;false;copy;(String,IntRange);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;MatchGroup;false;getRange;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchGroup;false;getValue;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchGroup;false;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;component10;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;component1;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;component2;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;component3;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;component4;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;component5;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;component6;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;component7;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;component8;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;component9;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;getMatch;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult$Destructured;false;toList;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult;true;getDestructured;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult;true;getGroupValues;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult;true;getGroups;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;MatchResult;true;next;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;Regex$Companion;false;escape;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;Regex;false;find;(CharSequence,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;Regex;false;getOptions;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;Regex;false;matchEntire;(CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;Regex;false;replace;(CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;Regex;false;replace;(CharSequence,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;Regex;false;replace;(CharSequence,String);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;Regex;false;replaceFirst;(CharSequence,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;Regex;false;replaceFirst;(CharSequence,String);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;Regex;false;toPattern;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;String;(StringBuffer);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;String;(StringBuilder);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;String;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;String;(byte[],Charset);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;String;(byte[],int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;String;(byte[],int,int,Charset);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;String;(char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;String;(char[],int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;append;(Appendable,CharSequence[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;append;(StringBuilder,Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;append;(StringBuilder,Object);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;append;(StringBuilder,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;append;(StringBuilder,Object[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;append;(StringBuilder,String[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(Appendable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(Appendable,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(Appendable,CharSequence);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(Appendable,CharSequence);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(Appendable,char);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,CharSequence);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,CharSequence);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,Object);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,String);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,String);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,StringBuffer);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,StringBuffer);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,StringBuffer);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,StringBuilder);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,StringBuilder);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,StringBuilder);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,boolean);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,byte);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,char);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,char[]);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,char[]);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,double);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,float);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,long);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendLine;(StringBuilder,short);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendRange;(Appendable,CharSequence,int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendRange;(Appendable,CharSequence,int,int);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendRange;(Appendable,CharSequence,int,int);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendRange;(StringBuilder,CharSequence,int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendRange;(StringBuilder,CharSequence,int,int);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendRange;(StringBuilder,CharSequence,int,int);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendRange;(StringBuilder,char[],int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendRange;(StringBuilder,char[],int,int);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendRange;(StringBuilder,char[],int,int);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(Appendable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(Appendable,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(Appendable,CharSequence);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(Appendable,CharSequence);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(Appendable,char);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,CharSequence);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,CharSequence);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,Object);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,String);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,String);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,StringBuffer);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,StringBuffer);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,StringBuffer);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,StringBuilder);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,StringBuilder);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,StringBuilder);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,boolean);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,byte);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,char);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,char[]);;Argument[1];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,char[]);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,double);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,float);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,long);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;appendln;(StringBuilder,short);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;associateByTo;(CharSequence,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;associateByTo;(CharSequence,Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;associateTo;(CharSequence,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;associateWithTo;(CharSequence,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;capitalize;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;capitalize;(String,Locale);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;clear;(StringBuilder);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;concatToString;(char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;concatToString;(char[],int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;decapitalize;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;decapitalize;(String,Locale);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;decodeToString;(byte[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;decodeToString;(byte[],int,int,boolean);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;drop;(CharSequence,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;drop;(String,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;dropLast;(CharSequence,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;dropLast;(String,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;dropLastWhile;(CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;dropLastWhile;(String,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;dropWhile;(CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;dropWhile;(String,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;encodeToByteArray;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;encodeToByteArray;(String,int,int,boolean);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;filterIndexedTo;(CharSequence,Appendable,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;filterNotTo;(CharSequence,Appendable,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;filterTo;(CharSequence,Appendable,Function1);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;findAnyOf;(CharSequence,Collection,int,boolean);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;findLastAnyOf;(CharSequence,Collection,int,boolean);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;flatMapIndexedIterableTo;(CharSequence,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;flatMapTo;(CharSequence,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;fold;(CharSequence,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;foldIndexed;(CharSequence,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;foldRight;(CharSequence,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;foldRightIndexed;(CharSequence,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;format;(String,Locale,Object[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;format;(String,Locale,Object[]);;Argument[2].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;format;(String,Object[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;format;(String,Object[]);;Argument[1].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;format;(StringCompanionObject,Locale,String,Object[]);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;format;(StringCompanionObject,Locale,String,Object[]);;Argument[3].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;format;(StringCompanionObject,String,Object[]);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;format;(StringCompanionObject,String,Object[]);;Argument[2].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;formatNullable;(String,Locale,Object[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;formatNullable;(String,Locale,Object[]);;Argument[2].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;formatNullable;(StringCompanionObject,Locale,String,Object[]);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;formatNullable;(StringCompanionObject,Locale,String,Object[]);;Argument[3].ArrayElement;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;groupByTo;(CharSequence,Map,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;groupByTo;(CharSequence,Map,Function1,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;ifBlank;(CharSequence,Function0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;ifEmpty;(CharSequence,Function0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;insertRange;(StringBuilder,int,CharSequence,int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;insertRange;(StringBuilder,int,CharSequence,int,int);;Argument[2];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;insertRange;(StringBuilder,int,CharSequence,int,int);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;insertRange;(StringBuilder,int,char[],int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;insertRange;(StringBuilder,int,char[],int,int);;Argument[2];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;insertRange;(StringBuilder,int,char[],int,int);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;intern;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;lineSequence;(CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;lines;(CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;lowercase;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;lowercase;(String,Locale);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;mapIndexedNotNullTo;(CharSequence,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;mapIndexedTo;(CharSequence,Collection,Function2);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;mapNotNullTo;(CharSequence,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;mapTo;(CharSequence,Collection,Function1);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;onEach;(CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;onEachIndexed;(CharSequence,Function2);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;orEmpty;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;padEnd;(CharSequence,int,char);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;padStart;(CharSequence,int,char);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;prependIndent;(String,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;removePrefix;(CharSequence,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;removePrefix;(String,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;removeRange;(CharSequence,IntRange);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;removeRange;(CharSequence,int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;removeSuffix;(CharSequence,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;removeSuffix;(String,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;removeSurrounding;(CharSequence,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;removeSurrounding;(CharSequence,CharSequence,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;removeSurrounding;(String,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;removeSurrounding;(String,CharSequence,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;repeat;(CharSequence,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replace;(CharSequence,Regex,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replace;(CharSequence,Regex,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replace;(CharSequence,Regex,String);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replace;(String,char,char,boolean);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceAfter;(String,String,String,String);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceAfter;(String,char,String,String);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceAfterLast;(String,String,String,String);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceAfterLast;(String,char,String,String);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceBefore;(String,String,String,String);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceBefore;(String,char,String,String);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceBeforeLast;(String,String,String,String);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceBeforeLast;(String,char,String,String);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceFirst;(CharSequence,Regex,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceFirst;(CharSequence,Regex,String);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceFirst;(String,String,String,boolean);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceFirst;(String,char,char,boolean);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceFirstCharWithChar;(String,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceFirstCharWithCharSequence;(String,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceRange;(CharSequence,IntRange,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceRange;(CharSequence,IntRange,CharSequence);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceRange;(CharSequence,int,int,CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;replaceRange;(CharSequence,int,int,CharSequence);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;reversed;(CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;runningFold;(CharSequence,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;runningFoldIndexed;(CharSequence,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;scan;(CharSequence,Object,Function2);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;scanIndexed;(CharSequence,Object,Function3);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;setRange;(StringBuilder,int,int,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;setRange;(StringBuilder,int,int,String);;Argument[3];Argument[0];taint;generated",
+        "kotlin.text;StringsKt;false;setRange;(StringBuilder,int,int,String);;Argument[3];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;slice;(CharSequence,IntRange);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;slice;(String,IntRange);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;split;(CharSequence,Pattern,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;splitToSequence;(CharSequence,String[],boolean,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;splitToSequence;(CharSequence,char[],boolean,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;subSequence;(CharSequence,IntRange);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;subSequence;(String,int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substring;(String,IntRange);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substring;(String,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substring;(String,int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringAfter;(String,String,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringAfter;(String,String,String);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringAfter;(String,char,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringAfter;(String,char,String);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringAfterLast;(String,String,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringAfterLast;(String,String,String);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringAfterLast;(String,char,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringAfterLast;(String,char,String);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringBefore;(String,String,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringBefore;(String,String,String);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringBefore;(String,char,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringBefore;(String,char,String);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringBeforeLast;(String,String,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringBeforeLast;(String,String,String);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringBeforeLast;(String,char,String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;substringBeforeLast;(String,char,String);;Argument[2];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;take;(CharSequence,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;take;(String,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;takeLast;(CharSequence,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;takeLast;(String,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;takeLastWhile;(CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;takeLastWhile;(String,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;takeWhile;(CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;takeWhile;(String,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toByteArray;(String,Charset);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toCharArray;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toCharArray;(String,char[],int,int,int);;Argument[0];Argument[1];taint;generated",
+        "kotlin.text;StringsKt;false;toCharArray;(String,char[],int,int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toCharArray;(String,char[],int,int,int);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toCharArray;(String,int,int);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toCharArray;(StringBuilder,char[],int,int,int);;Argument[0];Argument[1];taint;generated",
+        "kotlin.text;StringsKt;false;toCollection;(CharSequence,Collection);;Argument[1].Element;ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toLowerCase;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toLowerCase;(String,Locale);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toRegex;(Pattern);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toUpperCase;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;toUpperCase;(String,Locale);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;trim;(CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;trim;(CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;trim;(CharSequence,char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;trimEnd;(CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;trimEnd;(CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;trimEnd;(CharSequence,char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;trimStart;(CharSequence);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;trimStart;(CharSequence,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;trimStart;(CharSequence,char[]);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;uppercase;(String);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.text;StringsKt;false;uppercase;(String,Locale);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.time;Duration$Companion;false;getINFINITE;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;Duration$Companion;false;getZERO;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;Duration;false;div;(double);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;Duration;false;div;(int);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;Duration;false;getAbsoluteValue;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;Duration;false;minus;(Duration);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;Duration;false;plus;(Duration);;Argument[-1];ReturnValue;value;generated",
+        "kotlin.time;Duration;false;times;(double);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;Duration;false;times;(int);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;DurationKt;false;times;(double,Duration);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.time;DurationKt;false;times;(int,Duration);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.time;TimeMark;true;minus;(Duration);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;TimeMark;true;plus;(Duration);;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;TimeMark;true;plus;(Duration);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.time;TimeSource;true;markNow;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;TimedValue;false;TimedValue;(Object,Duration);;Argument[0];Argument[-1];taint;generated",
+        "kotlin.time;TimedValue;false;TimedValue;(Object,Duration);;Argument[1];Argument[-1];taint;generated",
+        "kotlin.time;TimedValue;false;component1;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;TimedValue;false;component2;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;TimedValue;false;copy;(Object,Duration);;Argument[0];ReturnValue;taint;generated",
+        "kotlin.time;TimedValue;false;copy;(Object,Duration);;Argument[1];ReturnValue;taint;generated",
+        "kotlin.time;TimedValue;false;getDuration;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;TimedValue;false;getValue;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin.time;TimedValue;false;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;DeepRecursiveFunction;false;DeepRecursiveFunction;(SuspendFunction2);;Argument[0];Argument[-1];taint;generated",
+        "kotlin;KotlinVersion$Companion;false;getCURRENT;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;LazyKt;false;getValue;(Lazy,Object,KProperty);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;LazyKt;false;lazy;(Function0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;LazyKt;false;lazy;(LazyThreadSafetyMode,Function0);;Argument[1];ReturnValue;taint;generated",
+        "kotlin;LazyKt;false;lazy;(Object,Function0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;LazyKt;false;lazy;(Object,Function0);;Argument[1];ReturnValue;taint;generated",
+        "kotlin;LazyKt;false;lazyOf;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;Pair;false;Pair;(Object,Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin;Pair;false;Pair;(Object,Object);;Argument[1];Argument[-1];taint;generated",
+        "kotlin;Pair;false;component1;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Pair;false;component2;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Pair;false;copy;(Object,Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;Pair;false;copy;(Object,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin;Pair;false;getFirst;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Pair;false;getSecond;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Pair;false;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;PreconditionsKt;false;checkNotNull;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;PreconditionsKt;false;checkNotNull;(Object,Function0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;PreconditionsKt;false;requireNotNull;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;PreconditionsKt;false;requireNotNull;(Object,Function0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;Result$Companion;false;failure;(Throwable);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;Result$Companion;false;success;(Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;Result;false;exceptionOrNull;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Result;false;getOrNull;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Result;false;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;fold;(Result,Function1,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;getOrDefault;(Result,Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;getOrDefault;(Result,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;getOrElse;(Result,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;getOrThrow;(Result);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;map;(Result,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;mapCatching;(Result,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;onFailure;(Result,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;onSuccess;(Result,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;recover;(Result,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;ResultKt;false;recoverCatching;(Result,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;StandardKt;false;also;(Object,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;StandardKt;false;apply;(Object,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;StandardKt;false;let;(Object,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;StandardKt;false;run;(Object,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;StandardKt;false;takeIf;(Object,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;StandardKt;false;takeUnless;(Object,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;StandardKt;false;with;(Object,Function1);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;SuspendKt;false;suspend;(SuspendFunction0);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;Triple;false;Triple;(Object,Object,Object);;Argument[0];Argument[-1];taint;generated",
+        "kotlin;Triple;false;Triple;(Object,Object,Object);;Argument[1];Argument[-1];taint;generated",
+        "kotlin;Triple;false;Triple;(Object,Object,Object);;Argument[2];Argument[-1];taint;generated",
+        "kotlin;Triple;false;component1;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Triple;false;component2;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Triple;false;component3;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Triple;false;copy;(Object,Object,Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;Triple;false;copy;(Object,Object,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin;Triple;false;copy;(Object,Object,Object);;Argument[2];ReturnValue;taint;generated",
+        "kotlin;Triple;false;getFirst;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Triple;false;getSecond;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Triple;false;getThird;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;Triple;false;toString;();;Argument[-1];ReturnValue;taint;generated",
+        "kotlin;TuplesKt;false;to;(Object,Object);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;TuplesKt;false;to;(Object,Object);;Argument[1];ReturnValue;taint;generated",
+        "kotlin;TuplesKt;false;toList;(Pair);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;TuplesKt;false;toList;(Triple);;Argument[0];ReturnValue;taint;generated",
+        "kotlin;UByte;false;toUByte;();;Argument[-1];ReturnValue;value;generated",
+        "kotlin;UByteArrayKt;false;ubyteArrayOf;(UByteArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin;UInt;false;toUInt;();;Argument[-1];ReturnValue;value;generated",
+        "kotlin;UIntArrayKt;false;uintArrayOf;(UIntArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin;ULong;false;toULong;();;Argument[-1];ReturnValue;value;generated",
+        "kotlin;ULongArrayKt;false;ulongArrayOf;(ULongArray);;Argument[0].Element;ReturnValue;taint;generated",
+        "kotlin;UShort;false;toUShort;();;Argument[-1];ReturnValue;value;generated",
+        "kotlin;UShortArrayKt;false;ushortArrayOf;(UShortArray);;Argument[0].Element;ReturnValue;taint;generated"
+      ]
+  }
+}
diff --git a/java/ql/lib/semmle/code/java/frameworks/spring/Spring.qll b/java/ql/lib/semmle/code/java/frameworks/spring/Spring.qll
index cfc318190c4..fd3008e5f00 100644
--- a/java/ql/lib/semmle/code/java/frameworks/spring/Spring.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/spring/Spring.qll
@@ -13,6 +13,7 @@ import semmle.code.java.frameworks.spring.SpringContext
 import semmle.code.java.frameworks.spring.SpringComponentScan
 import semmle.code.java.frameworks.spring.SpringConstructorArg
 import semmle.code.java.frameworks.spring.SpringController
+import semmle.code.java.frameworks.spring.SpringData
 import semmle.code.java.frameworks.spring.SpringDescription
 import semmle.code.java.frameworks.spring.SpringEntry
 import semmle.code.java.frameworks.spring.SpringFlex
diff --git a/java/ql/lib/semmle/code/java/frameworks/spring/SpringAutowire.qll b/java/ql/lib/semmle/code/java/frameworks/spring/SpringAutowire.qll
index b99dafecc65..1dd6dfd292f 100644
--- a/java/ql/lib/semmle/code/java/frameworks/spring/SpringAutowire.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/spring/SpringAutowire.qll
@@ -311,9 +311,7 @@ class SpringQualifierDefinitionAnnotation extends Annotation {
   /**
    * Gets the value of the qualifier field for this qualifier.
    */
-  string getQualifierValue() {
-    result = this.getValue("value").(CompileTimeConstantExpr).getStringValue()
-  }
+  string getQualifierValue() { result = this.getStringValue("value") }
 }
 
 /**
@@ -325,9 +323,7 @@ class SpringQualifierAnnotation extends Annotation {
   /**
    * Gets the value of the qualifier field for this qualifier.
    */
-  string getQualifierValue() {
-    result = this.getValue("value").(CompileTimeConstantExpr).getStringValue()
-  }
+  string getQualifierValue() { result = this.getStringValue("value") }
 
   /**
    * Gets the bean definition in an XML file that this qualifier resolves to, if any.
@@ -350,9 +346,7 @@ class SpringResourceAnnotation extends Annotation {
   /**
    * Gets the specified name value, if any.
    */
-  string getNameValue() {
-    result = this.getValue("name").(CompileTimeConstantExpr).getStringValue()
-  }
+  string getNameValue() { result = this.getStringValue("name") }
 
   /**
    * Gets the bean definition in an XML file that the resource resolves to, if any.
diff --git a/java/ql/lib/semmle/code/java/frameworks/spring/SpringComponentScan.qll b/java/ql/lib/semmle/code/java/frameworks/spring/SpringComponentScan.qll
index 1c037adefd6..f3380c45458 100644
--- a/java/ql/lib/semmle/code/java/frameworks/spring/SpringComponentScan.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/spring/SpringComponentScan.qll
@@ -40,16 +40,10 @@ class SpringComponentScan extends Annotation {
    */
   string getBasePackages() {
     // "value" and "basePackages" are synonymous, and are simple strings
-    result = this.getAValue("basePackages").(StringLiteral).getValue()
+    result = this.getAStringArrayValue(["basePackages", "value"])
     or
-    result = this.getAValue("value").(StringLiteral).getValue()
-    or
-    exists(TypeLiteral typeLiteral |
-      // Base package classes are type literals whose package should be considered a base package.
-      typeLiteral = this.getAValue("basePackageClasses")
-    |
-      result = typeLiteral.getReferencedType().(RefType).getPackage().getName()
-    )
+    // Base package classes are type literals whose package should be considered a base package.
+    result = this.getATypeArrayValue("basePackageClasses").(RefType).getPackage().getName()
   }
 }
 
@@ -144,8 +138,7 @@ class SpringComponent extends RefType {
     if exists(this.getComponentAnnotation().getValue("value"))
     then
       // If the name has been specified in the component annotation, use that.
-      result =
-        this.getComponentAnnotation().getValue("value").(CompileTimeConstantExpr).getStringValue()
+      result = this.getComponentAnnotation().getStringValue("value")
     else
       // Otherwise use the name of the class, with the initial letter lower cased.
       exists(string name | name = this.getName() |
@@ -204,7 +197,7 @@ class SpringComponent extends RefType {
           .getType()
           .hasQualifiedName("org.springframework.context.annotation", "Profile")
     |
-      result = profileAnnotation.getAValue("value").(StringLiteral).getValue()
+      result = profileAnnotation.getAStringArrayValue("value")
     )
   }
 }
diff --git a/java/ql/lib/semmle/code/java/frameworks/spring/SpringController.qll b/java/ql/lib/semmle/code/java/frameworks/spring/SpringController.qll
index 53829d02752..d40d1608969 100644
--- a/java/ql/lib/semmle/code/java/frameworks/spring/SpringController.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/spring/SpringController.qll
@@ -154,9 +154,7 @@ class SpringRequestMappingMethod extends SpringControllerMethod {
   }
 
   /** Gets the "value" @RequestMapping annotation value, if present. */
-  string getValue() {
-    result = requestMappingAnnotation.getValue("value").(CompileTimeConstantExpr).getStringValue()
-  }
+  string getValue() { result = requestMappingAnnotation.getStringValue("value") }
 
   /** Holds if this is considered an `@ResponseBody` method. */
   predicate isResponseBody() {
diff --git a/java/ql/lib/semmle/code/java/frameworks/spring/SpringData.qll b/java/ql/lib/semmle/code/java/frameworks/spring/SpringData.qll
new file mode 100644
index 00000000000..52c8579b4c7
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/frameworks/spring/SpringData.qll
@@ -0,0 +1,17 @@
+/**
+ * Provides classes and predicates for working with Spring classes and interfaces from
+ * `org.springframework.data`.
+ */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+
+/**
+ * Provides models for the `org.springframework.data` package.
+ */
+private class FlowSummaries extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      "org.springframework.data.repository;CrudRepository;true;save;;;Argument[0];ReturnValue;value;manual"
+  }
+}
diff --git a/java/ql/lib/semmle/code/java/frameworks/struts/StrutsAnnotations.qll b/java/ql/lib/semmle/code/java/frameworks/struts/StrutsAnnotations.qll
index 27ada4d6ff0..d97415354b3 100644
--- a/java/ql/lib/semmle/code/java/frameworks/struts/StrutsAnnotations.qll
+++ b/java/ql/lib/semmle/code/java/frameworks/struts/StrutsAnnotations.qll
@@ -34,5 +34,5 @@ class StrutsActionsAnnotation extends StrutsAnnotation {
   /**
    * Gets an Action annotation contained in this Actions annotation.
    */
-  StrutsActionAnnotation getAnAction() { result = this.getAValue("value") }
+  StrutsActionAnnotation getAnAction() { result = this.getAnArrayValue("value") }
 }
diff --git a/java/ql/lib/semmle/code/java/security/CleartextStorageClassQuery.qll b/java/ql/lib/semmle/code/java/security/CleartextStorageClassQuery.qll
index a236d4d8af6..3fe06a2de08 100644
--- a/java/ql/lib/semmle/code/java/security/CleartextStorageClassQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/CleartextStorageClassQuery.qll
@@ -49,7 +49,7 @@ private class Serializable extends ClassStore {
 
 /** The instantiation of a marshallable class, which can be stored to disk as XML. */
 private class Marshallable extends ClassStore {
-  Marshallable() { this.getConstructor().getDeclaringType() instanceof JAXBElement }
+  Marshallable() { this.getConstructor().getDeclaringType() instanceof JaxbElement }
 
   /** Gets a store, for example `marshaller.marshal(instance)`. */
   override Expr getAStore() {
@@ -69,7 +69,7 @@ private Expr getInstanceInput(DataFlow::Node instance, RefType t) {
     fa.getField().getDeclaringType() = t
   |
     t.getASourceSupertype*() instanceof TypeSerializable or
-    t instanceof JAXBElement
+    t instanceof JaxbElement
   )
 }
 
@@ -98,7 +98,7 @@ private predicate serializableStore(DataFlow::Node instance, Expr store) {
 private predicate marshallableStore(DataFlow::Node instance, Expr store) {
   exists(MethodAccess m |
     store = m and
-    m.getMethod() instanceof JAXBMarshalMethod and
+    m.getMethod() instanceof JaxbMarshalMethod and
     instance.asExpr() = m.getArgument(0)
   )
 }
diff --git a/java/ql/lib/semmle/code/java/security/ExternalAPIs.qll b/java/ql/lib/semmle/code/java/security/ExternalAPIs.qll
index 74d8c2e1577..ccd4e5a757a 100644
--- a/java/ql/lib/semmle/code/java/security/ExternalAPIs.qll
+++ b/java/ql/lib/semmle/code/java/security/ExternalAPIs.qll
@@ -24,7 +24,7 @@ private class DefaultSafeExternalApiMethod extends SafeExternalApiMethod {
     or
     this.getDeclaringType().hasQualifiedName("org.apache.commons.lang3", "Validate")
     or
-    this.getQualifiedName() = "Objects.equals"
+    this.hasQualifiedName("java.util", "Objects", "equals")
     or
     this.getDeclaringType() instanceof TypeString and this.getName() = "equals"
     or
@@ -92,10 +92,7 @@ class ExternalApiDataNode extends DataFlow::Node {
   int getIndex() { result = i }
 
   /** Gets the description of the method being called. */
-  string getMethodDescription() {
-    result =
-      this.getMethod().getDeclaringType().getPackage() + "." + this.getMethod().getQualifiedName()
-  }
+  string getMethodDescription() { result = this.getMethod().getQualifiedName() }
 }
 
 /** DEPRECATED: Alias for ExternalApiDataNode */
diff --git a/java/ql/lib/semmle/code/java/security/ImplicitPendingIntents.qll b/java/ql/lib/semmle/code/java/security/ImplicitPendingIntents.qll
index 15fe3e2f859..3441cfaef18 100644
--- a/java/ql/lib/semmle/code/java/security/ImplicitPendingIntents.qll
+++ b/java/ql/lib/semmle/code/java/security/ImplicitPendingIntents.qll
@@ -102,11 +102,25 @@ private class PendingIntentSentSinkModels extends SinkModelCsv {
         "android.app;NotificationManager;true;notify;(String,int,Notification);;Argument[2];pending-intent-sent;manual",
         "android.app;NotificationManager;true;notifyAsPackage;(String,String,int,Notification);;Argument[3];pending-intent-sent;manual",
         "android.app;NotificationManager;true;notifyAsUser;(String,int,Notification,UserHandle);;Argument[2];pending-intent-sent;manual",
+        "androidx.core.app;NotificationManagerCompat;true;notify;(int,Notification);;Argument[1];pending-intent-sent;manual",
+        "androidx.core.app;NotificationManagerCompat;true;notify;(String,int,Notification);;Argument[2];pending-intent-sent;manual",
         "android.app;PendingIntent;false;send;(Context,int,Intent,OnFinished,Handler,String,Bundle);;Argument[2];pending-intent-sent;manual",
         "android.app;PendingIntent;false;send;(Context,int,Intent,OnFinished,Handler,String);;Argument[2];pending-intent-sent;manual",
         "android.app;PendingIntent;false;send;(Context,int,Intent,OnFinished,Handler);;Argument[2];pending-intent-sent;manual",
         "android.app;PendingIntent;false;send;(Context,int,Intent);;Argument[2];pending-intent-sent;manual",
-        "android.app;Activity;true;setResult;(int,Intent);;Argument[1];pending-intent-sent;manual"
+        "android.app;Activity;true;setResult;(int,Intent);;Argument[1];pending-intent-sent;manual",
+        "android.app;AlarmManager;true;set;(int,long,PendingIntent);;Argument[2];pending-intent-sent;manual",
+        "android.app;AlarmManager;true;setAlarmClock;;;Argument[1];pending-intent-sent;manual",
+        "android.app;AlarmManager;true;setAndAllowWhileIdle;;;Argument[2];pending-intent-sent;manual",
+        "android.app;AlarmManager;true;setExact;(int,long,PendingIntent);;Argument[2];pending-intent-sent;manual",
+        "android.app;AlarmManager;true;setExactAndAllowWhileIdle;;;Argument[2];pending-intent-sent;manual",
+        "android.app;AlarmManager;true;setInexactRepeating;;;Argument[3];pending-intent-sent;manual",
+        "android.app;AlarmManager;true;setRepeating;;;Argument[3];pending-intent-sent;manual",
+        "android.app;AlarmManager;true;setWindow;(int,long,long,PendingIntent);;Argument[3];pending-intent-sent;manual",
+        "androidx.core.app;AlarmManagerCompat;true;setAlarmClock;;;Argument[2..3];pending-intent-sent;manual",
+        "androidx.core.app;AlarmManagerCompat;true;setAndAllowWhileIdle;;;Argument[3];pending-intent-sent;manual",
+        "androidx.core.app;AlarmManagerCompat;true;setExact;;;Argument[3];pending-intent-sent;manual",
+        "androidx.core.app;AlarmManagerCompat;true;setExactAndAllowWhileIdle;;;Argument[3];pending-intent-sent;manual",
       ]
   }
 }
diff --git a/java/ql/lib/semmle/code/java/security/JndiInjection.qll b/java/ql/lib/semmle/code/java/security/JndiInjection.qll
index 543ce2bc859..9dca731af80 100644
--- a/java/ql/lib/semmle/code/java/security/JndiInjection.qll
+++ b/java/ql/lib/semmle/code/java/security/JndiInjection.qll
@@ -176,7 +176,7 @@ private predicate nameAddStep(DataFlow::ExprNode n1, DataFlow::ExprNode n2) {
  * by calling `new JMXServiceURL(tainted)`.
  */
 private predicate jmxServiceUrlStep(DataFlow::ExprNode n1, DataFlow::ExprNode n2) {
-  exists(ConstructorCall cc | cc.getConstructedType() instanceof TypeJMXServiceURL |
+  exists(ConstructorCall cc | cc.getConstructedType() instanceof TypeJmxServiceUrl |
     n1.asExpr() = cc.getAnArgument() and
     n2.asExpr() = cc
   )
@@ -189,7 +189,7 @@ private predicate jmxServiceUrlStep(DataFlow::ExprNode n1, DataFlow::ExprNode n2
 private predicate jmxConnectorStep(DataFlow::ExprNode n1, DataFlow::ExprNode n2) {
   exists(MethodAccess ma, Method m | n1.asExpr() = ma.getArgument(0) and n2.asExpr() = ma |
     ma.getMethod() = m and
-    m.getDeclaringType() instanceof TypeJMXConnectorFactory and
+    m.getDeclaringType() instanceof TypeJmxConnectorFactory and
     m.hasName("newJMXConnector")
   )
 }
@@ -199,7 +199,7 @@ private predicate jmxConnectorStep(DataFlow::ExprNode n1, DataFlow::ExprNode n2)
  * `RMIConnector` by calling `new RMIConnector(tainted)`.
  */
 private predicate rmiConnectorStep(DataFlow::ExprNode n1, DataFlow::ExprNode n2) {
-  exists(ConstructorCall cc | cc.getConstructedType() instanceof TypeRMIConnector |
+  exists(ConstructorCall cc | cc.getConstructedType() instanceof TypeRmiConnector |
     n1.asExpr() = cc.getAnArgument() and
     n2.asExpr() = cc
   )
diff --git a/java/ql/lib/semmle/code/java/security/LdapInjection.qll b/java/ql/lib/semmle/code/java/security/LdapInjection.qll
index 54e0dff2eb2..35c59279f4e 100644
--- a/java/ql/lib/semmle/code/java/security/LdapInjection.qll
+++ b/java/ql/lib/semmle/code/java/security/LdapInjection.qll
@@ -140,8 +140,8 @@ private predicate filterStep(DataFlow::ExprNode n1, DataFlow::ExprNode n2) {
     ma.getMethod() = m
   |
     m instanceof MethodUnboundIdFilterCreate or
-    m instanceof MethodUnboundIdFilterCreateANDFilter or
-    m instanceof MethodUnboundIdFilterCreateNOTFilter or
+    m instanceof MethodUnboundIdFilterCreateAndFilter or
+    m instanceof MethodUnboundIdFilterCreateNotFilter or
     m instanceof MethodUnboundIdFilterCreateORFilter or
     m instanceof MethodUnboundIdFilterSimplifyFilter
   )
diff --git a/java/ql/lib/semmle/code/java/security/OverlyLargeRangeQuery.qll b/java/ql/lib/semmle/code/java/security/OverlyLargeRangeQuery.qll
index f83a6411618..65e662f0bc5 100644
--- a/java/ql/lib/semmle/code/java/security/OverlyLargeRangeQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/OverlyLargeRangeQuery.qll
@@ -96,7 +96,10 @@ class OverlyWideRange extends RegExpCharacterRange {
       toCodePoint("A") <= high
       or
       // a non-alphanumeric char as part of the range boundaries
-      exists(int bound | bound = [low, high] | not isAlphanumeric(bound.toUnicode()))
+      exists(int bound | bound = [low, high] | not isAlphanumeric(bound.toUnicode())) and
+      // while still being ascii
+      low < 128 and
+      high < 128
     ) and
     // allowlist for known ranges
     not this = allowedWideRanges()
@@ -173,7 +176,7 @@ module RangePrinter {
   }
 
   /** Gets the number of parts we should print for a given `range`. */
-  private int parts(OverlyWideRange range) { result = 1 + strictcount(cutoff(range, _)) }
+  private int parts(OverlyWideRange range) { result = 1 + count(cutoff(range, _)) }
 
   /** Holds if the given part of a range should span from `low` to `high`. */
   private predicate part(OverlyWideRange range, int part, string low, string high) {
diff --git a/java/ql/lib/semmle/code/java/security/TemplateInjection.qll b/java/ql/lib/semmle/code/java/security/TemplateInjection.qll
new file mode 100644
index 00000000000..079ef551bb3
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/security/TemplateInjection.qll
@@ -0,0 +1,108 @@
+/** Definitions related to the server-side template injection (SST) query. */
+
+import java
+private import semmle.code.java.dataflow.FlowSources
+private import semmle.code.java.dataflow.ExternalFlow
+private import semmle.code.java.dataflow.TaintTracking
+
+/**
+ * A source for server-side template injection (SST) vulnerabilities.
+ */
+abstract class TemplateInjectionSource extends DataFlow::Node {
+  /** Holds if this source has the specified `state`. */
+  predicate hasState(DataFlow::FlowState state) { state instanceof DataFlow::FlowStateEmpty }
+}
+
+/**
+ * A sink for server-side template injection (SST) vulnerabilities.
+ */
+abstract class TemplateInjectionSink extends DataFlow::Node {
+  /** Holds if this sink has the specified `state`. */
+  predicate hasState(DataFlow::FlowState state) { state instanceof DataFlow::FlowStateEmpty }
+}
+
+/**
+ * A unit class for adding additional taint steps.
+ *
+ * Extend this class to add additional taint steps that should apply to flows related to
+ * server-side template injection (SST) vulnerabilities.
+ */
+class TemplateInjectionAdditionalTaintStep extends Unit {
+  /**
+   * Holds if the step from `node1` to `node2` should be considered a taint
+   * step for flows related to server-side template injection (SST) vulnerabilities.
+   */
+  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
+
+  /**
+   * Holds if the step from `node1` to `node2` should be considered a taint
+   * step for flows related toserver-side template injection (SST) vulnerabilities.
+   * This step is only applicable in `state1` and updates the flow state to `state2`.
+   */
+  predicate isAdditionalTaintStep(
+    DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+    DataFlow::FlowState state2
+  ) {
+    none()
+  }
+}
+
+/**
+ * A sanitizer for server-side template injection (SST) vulnerabilities.
+ */
+abstract class TemplateInjectionSanitizer extends DataFlow::Node { }
+
+/**
+ * A sanitizer for server-side template injection (SST) vulnerabilities.
+ * This sanitizer is only applicable when `TemplateInjectionSanitizerWithState::hasState`
+ * holds for the flow state.
+ */
+abstract class TemplateInjectionSanitizerWithState extends DataFlow::Node {
+  /** Holds if this sanitizer has the specified `state`. */
+  abstract predicate hasState(DataFlow::FlowState state);
+}
+
+private class DefaultTemplateInjectionSource extends TemplateInjectionSource instanceof RemoteFlowSource {
+}
+
+private class DefaultTemplateInjectionSink extends TemplateInjectionSink {
+  DefaultTemplateInjectionSink() { sinkNode(this, "ssti") }
+}
+
+private class DefaultTemplateInjectionSanitizer extends TemplateInjectionSanitizer {
+  DefaultTemplateInjectionSanitizer() {
+    this.getType() instanceof PrimitiveType or
+    this.getType() instanceof BoxedType or
+    this.getType() instanceof NumericType
+  }
+}
+
+private class TemplateInjectionSinkModels extends SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "freemarker.template;Template;true;Template;(String,Reader);;Argument[1];ssti;manual",
+        "freemarker.template;Template;true;Template;(String,Reader,Configuration);;Argument[1];ssti;manual",
+        "freemarker.template;Template;true;Template;(String,Reader,Configuration,String);;Argument[1];ssti;manual",
+        "freemarker.template;Template;true;Template;(String,String,Reader,Configuration);;Argument[2];ssti;manual",
+        "freemarker.template;Template;true;Template;(String,String,Reader,Configuration,String);;Argument[2];ssti;manual",
+        "freemarker.template;Template;true;Template;(String,String,Reader,Configuration,ParserConfiguration,String);;Argument[2];ssti;manual",
+        "freemarker.template;Template;true;Template;(String,String,Configuration);;Argument[1];ssti;manual",
+        "freemarker.cache;StringTemplateLoader;true;putTemplate;;;Argument[1];ssti;manual",
+        "com.mitchellbosecke.pebble;PebbleEngine;true;getTemplate;;;Argument[0];ssti;manual",
+        "com.mitchellbosecke.pebble;PebbleEngine;true;getLiteralTemplate;;;Argument[0];ssti;manual",
+        "com.hubspot.jinjava;Jinjava;true;renderForResult;;;Argument[0];ssti;manual",
+        "com.hubspot.jinjava;Jinjava;true;render;;;Argument[0];ssti;manual",
+        "org.thymeleaf;ITemplateEngine;true;process;;;Argument[0];ssti;manual",
+        "org.thymeleaf;ITemplateEngine;true;processThrottled;;;Argument[0];ssti;manual",
+        "org.apache.velocity.app;Velocity;true;evaluate;;;Argument[3];ssti;manual",
+        "org.apache.velocity.app;Velocity;true;mergeTemplate;;;Argument[2];ssti;manual",
+        "org.apache.velocity.app;VelocityEngine;true;evaluate;;;Argument[3];ssti;manual",
+        "org.apache.velocity.app;VelocityEngine;true;mergeTemplate;;;Argument[2];ssti;manual",
+        "org.apache.velocity.runtime.resource.util;StringResourceRepository;true;putStringResource;;;Argument[1];ssti;manual",
+        "org.apache.velocity.runtime;RuntimeServices;true;evaluate;;;Argument[3];ssti;manual",
+        "org.apache.velocity.runtime;RuntimeServices;true;parse;;;Argument[0];ssti;manual",
+        "org.apache.velocity.runtime;RuntimeSingleton;true;parse;;;Argument[0];ssti;manual"
+      ]
+  }
+}
diff --git a/java/ql/lib/semmle/code/java/security/TemplateInjectionQuery.qll b/java/ql/lib/semmle/code/java/security/TemplateInjectionQuery.qll
new file mode 100644
index 00000000000..e8ed6f5aea9
--- /dev/null
+++ b/java/ql/lib/semmle/code/java/security/TemplateInjectionQuery.qll
@@ -0,0 +1,38 @@
+/** Provides a taint tracking configuration for server-side template injection (SST) vulnerabilities */
+
+import java
+import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.security.TemplateInjection
+
+/** A taint tracking configuration to reason about server-side template injection (SST) vulnerabilities */
+class TemplateInjectionFlowConfig extends TaintTracking::Configuration {
+  TemplateInjectionFlowConfig() { this = "TemplateInjectionFlowConfig" }
+
+  override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+    source.(TemplateInjectionSource).hasState(state)
+  }
+
+  override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+    sink.(TemplateInjectionSink).hasState(state)
+  }
+
+  override predicate isSanitizer(DataFlow::Node sanitizer) {
+    sanitizer instanceof TemplateInjectionSanitizer
+  }
+
+  override predicate isSanitizer(DataFlow::Node sanitizer, DataFlow::FlowState state) {
+    sanitizer.(TemplateInjectionSanitizerWithState).hasState(state)
+  }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
+    any(TemplateInjectionAdditionalTaintStep a).isAdditionalTaintStep(node1, node2)
+  }
+
+  override predicate isAdditionalTaintStep(
+    DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+    DataFlow::FlowState state2
+  ) {
+    any(TemplateInjectionAdditionalTaintStep a).isAdditionalTaintStep(node1, state1, node2, state2)
+  }
+}
diff --git a/java/ql/lib/semmle/code/java/security/regexp/ExponentialBackTracking.qll b/java/ql/lib/semmle/code/java/security/regexp/ExponentialBackTracking.qll
index 000c247fc71..d006837466b 100644
--- a/java/ql/lib/semmle/code/java/security/regexp/ExponentialBackTracking.qll
+++ b/java/ql/lib/semmle/code/java/security/regexp/ExponentialBackTracking.qll
@@ -115,6 +115,7 @@ private newtype TStatePair =
 private int rankState(State state) {
   state =
     rank[result](State s, Location l |
+      stateInsideBacktracking(s) and
       l = s.getRepr().getLocation()
     |
       s order by l.getStartLine(), l.getStartColumn(), s.toString()
diff --git a/java/ql/lib/semmle/code/java/security/regexp/NfaUtils.qll b/java/ql/lib/semmle/code/java/security/regexp/NfaUtils.qll
index fdcb10c2f85..5112bdad11e 100644
--- a/java/ql/lib/semmle/code/java/security/regexp/NfaUtils.qll
+++ b/java/ql/lib/semmle/code/java/security/regexp/NfaUtils.qll
@@ -93,8 +93,6 @@ class RegExpRoot extends RegExpTerm {
    * Holds if this root term is relevant to the ReDoS analysis.
    */
   predicate isRelevant() {
-    // there is at least one repetition
-    getRoot(any(InfiniteRepetitionQuantifier q)) = this and
     // is actually used as a RegExp
     this.isUsedAsRegExp() and
     // not excluded for library specific reasons
@@ -877,6 +875,107 @@ predicate isStartState(State state) {
  */
 signature predicate isCandidateSig(State state, string pump);
 
+/**
+ * Holds if `state` is a candidate for ReDoS.
+ */
+signature predicate isCandidateSig(State state);
+
+/**
+ * Predicates for constructing a prefix string that leads to a given state.
+ */
+module PrefixConstruction<isCandidateSig/1 isCandidate> {
+  /**
+   * Holds if `state` is the textually last start state for the regular expression.
+   */
+  private predicate lastStartState(RelevantState state) {
+    exists(RegExpRoot root |
+      state =
+        max(RelevantState s, Location l |
+          isStartState(s) and
+          getRoot(s.getRepr()) = root and
+          l = s.getRepr().getLocation()
+        |
+          s
+          order by
+            l.getStartLine(), l.getStartColumn(), s.getRepr().toString(), l.getEndColumn(),
+            l.getEndLine()
+        )
+    )
+  }
+
+  /**
+   * Holds if there exists any transition (Epsilon() or other) from `a` to `b`.
+   */
+  private predicate existsTransition(State a, State b) { delta(a, _, b) }
+
+  /**
+   * Gets the minimum number of transitions it takes to reach `state` from the `start` state.
+   */
+  int prefixLength(State start, State state) =
+    shortestDistances(lastStartState/1, existsTransition/2)(start, state, result)
+
+  /**
+   * Gets the minimum number of transitions it takes to reach `state` from the start state.
+   */
+  private int lengthFromStart(State state) { result = prefixLength(_, state) }
+
+  /**
+   * Gets a string for which the regular expression will reach `state`.
+   *
+   * Has at most one result for any given `state`.
+   * This predicate will not always have a result even if there is a ReDoS issue in
+   * the regular expression.
+   */
+  string prefix(State state) {
+    lastStartState(state) and
+    result = ""
+    or
+    // the search stops past the last redos candidate state.
+    lengthFromStart(state) <= max(lengthFromStart(any(State s | isCandidate(s)))) and
+    exists(State prev |
+      // select a unique predecessor (by an arbitrary measure)
+      prev =
+        min(State s, Location loc |
+          lengthFromStart(s) = lengthFromStart(state) - 1 and
+          loc = s.getRepr().getLocation() and
+          delta(s, _, state)
+        |
+          s
+          order by
+            loc.getStartLine(), loc.getStartColumn(), loc.getEndLine(), loc.getEndColumn(),
+            s.getRepr().toString()
+        )
+    |
+      // greedy search for the shortest prefix
+      result = prefix(prev) and delta(prev, Epsilon(), state)
+      or
+      not delta(prev, Epsilon(), state) and
+      result = prefix(prev) + getCanonicalEdgeChar(prev, state)
+    )
+  }
+
+  /**
+   * Gets a canonical char for which there exists a transition from `prev` to `next` in the NFA.
+   */
+  private string getCanonicalEdgeChar(State prev, State next) {
+    result =
+      min(string c | delta(prev, any(InputSymbol symbol | c = intersect(Any(), symbol)), next))
+  }
+
+  /** A state within a regular expression that contains a candidate state. */
+  class RelevantState instanceof State {
+    RelevantState() {
+      exists(State s | isCandidate(s) | getRoot(s.getRepr()) = getRoot(this.getRepr()))
+    }
+
+    /** Gets a string representation for this state in a regular expression. */
+    string toString() { result = State.super.toString() }
+
+    /** Gets the term represented by this state. */
+    RegExpTerm getRepr() { result = State.super.getRepr() }
+  }
+}
+
 /**
  * A module for pruning candidate ReDoS states.
  * The candidates are specified by the `isCandidate` signature predicate.
@@ -910,95 +1009,11 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
   /** Gets a state that can reach the `accept-any` state using only epsilon steps. */
   private State acceptsAnySuffix() { epsilonSucc*(result) = AcceptAnySuffix(_) }
 
-  /**
-   * Predicates for constructing a prefix string that leads to a given state.
-   */
-  private module PrefixConstruction {
-    /**
-     * Holds if `state` is the textually last start state for the regular expression.
-     */
-    private predicate lastStartState(State state) {
-      exists(RegExpRoot root |
-        state =
-          max(State s, Location l |
-            s = stateInPumpableRegexp() and
-            isStartState(s) and
-            getRoot(s.getRepr()) = root and
-            l = s.getRepr().getLocation()
-          |
-            s
-            order by
-              l.getStartLine(), l.getStartColumn(), s.getRepr().toString(), l.getEndColumn(),
-              l.getEndLine()
-          )
-      )
-    }
+  predicate isCandidateState(State s) { isReDoSCandidate(s, _) }
 
-    /**
-     * Holds if there exists any transition (Epsilon() or other) from `a` to `b`.
-     */
-    private predicate existsTransition(State a, State b) { delta(a, _, b) }
+  import PrefixConstruction<isCandidateState/1> as Prefix
 
-    /**
-     * Gets the minimum number of transitions it takes to reach `state` from the `start` state.
-     */
-    int prefixLength(State start, State state) =
-      shortestDistances(lastStartState/1, existsTransition/2)(start, state, result)
-
-    /**
-     * Gets the minimum number of transitions it takes to reach `state` from the start state.
-     */
-    private int lengthFromStart(State state) { result = prefixLength(_, state) }
-
-    /**
-     * Gets a string for which the regular expression will reach `state`.
-     *
-     * Has at most one result for any given `state`.
-     * This predicate will not always have a result even if there is a ReDoS issue in
-     * the regular expression.
-     */
-    string prefix(State state) {
-      lastStartState(state) and
-      result = ""
-      or
-      // the search stops past the last redos candidate state.
-      lengthFromStart(state) <= max(lengthFromStart(any(State s | isReDoSCandidate(s, _)))) and
-      exists(State prev |
-        // select a unique predecessor (by an arbitrary measure)
-        prev =
-          min(State s, Location loc |
-            lengthFromStart(s) = lengthFromStart(state) - 1 and
-            loc = s.getRepr().getLocation() and
-            delta(s, _, state)
-          |
-            s
-            order by
-              loc.getStartLine(), loc.getStartColumn(), loc.getEndLine(), loc.getEndColumn(),
-              s.getRepr().toString()
-          )
-      |
-        // greedy search for the shortest prefix
-        result = prefix(prev) and delta(prev, Epsilon(), state)
-        or
-        not delta(prev, Epsilon(), state) and
-        result = prefix(prev) + getCanonicalEdgeChar(prev, state)
-      )
-    }
-
-    /**
-     * Gets a canonical char for which there exists a transition from `prev` to `next` in the NFA.
-     */
-    private string getCanonicalEdgeChar(State prev, State next) {
-      result =
-        min(string c | delta(prev, any(InputSymbol symbol | c = intersect(Any(), symbol)), next))
-    }
-
-    /** Gets a state within a regular expression that has a pumpable state. */
-    pragma[noinline]
-    State stateInPumpableRegexp() {
-      exists(State s | isReDoSCandidate(s, _) | getRoot(s.getRepr()) = getRoot(result.getRepr()))
-    }
-  }
+  class RelevantState = Prefix::RelevantState;
 
   /**
    * Predicates for testing the presence of a rejecting suffix.
@@ -1018,8 +1033,6 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
    * using epsilon transitions. But any attempt at repeating `w` will end in a state that accepts all suffixes.
    */
   private module SuffixConstruction {
-    import PrefixConstruction
-
     /**
      * Holds if all states reachable from `fork` by repeating `w`
      * are likely rejectable by appending some suffix.
@@ -1035,32 +1048,26 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * This predicate might find impossible suffixes when searching for suffixes of length > 1, which can cause FPs.
      */
     pragma[noinline]
-    private predicate isLikelyRejectable(State s) {
-      s = stateInPumpableRegexp() and
-      (
-        // exists a reject edge with some char.
-        hasRejectEdge(s)
-        or
-        hasEdgeToLikelyRejectable(s)
-        or
-        // stopping here is rejection
-        isRejectState(s)
-      )
+    private predicate isLikelyRejectable(RelevantState s) {
+      // exists a reject edge with some char.
+      hasRejectEdge(s)
+      or
+      hasEdgeToLikelyRejectable(s)
+      or
+      // stopping here is rejection
+      isRejectState(s)
     }
 
     /**
      * Holds if `s` is not an accept state, and there is no epsilon transition to an accept state.
      */
-    predicate isRejectState(State s) {
-      s = stateInPumpableRegexp() and not epsilonSucc*(s) = Accept(_)
-    }
+    predicate isRejectState(RelevantState s) { not epsilonSucc*(s) = Accept(_) }
 
     /**
      * Holds if there is likely a non-empty suffix leading to rejection starting in `s`.
      */
     pragma[noopt]
-    predicate hasEdgeToLikelyRejectable(State s) {
-      s = stateInPumpableRegexp() and
+    predicate hasEdgeToLikelyRejectable(RelevantState s) {
       // all edges (at least one) with some char leads to another state that is rejectable.
       // the `next` states might not share a common suffix, which can cause FPs.
       exists(string char | char = hasEdgeToLikelyRejectableHelper(s) |
@@ -1075,8 +1082,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * and `s` has not been found to be rejectable by `hasRejectEdge` or `isRejectState`.
      */
     pragma[noinline]
-    private string hasEdgeToLikelyRejectableHelper(State s) {
-      s = stateInPumpableRegexp() and
+    private string hasEdgeToLikelyRejectableHelper(RelevantState s) {
       not hasRejectEdge(s) and
       not isRejectState(s) and
       deltaClosedChar(s, result, _)
@@ -1087,9 +1093,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * along epsilon edges, such that there is a transition from
      * `prev` to `next` that the character symbol `char`.
      */
-    predicate deltaClosedChar(State prev, string char, State next) {
-      prev = stateInPumpableRegexp() and
-      next = stateInPumpableRegexp() and
+    predicate deltaClosedChar(RelevantState prev, string char, RelevantState next) {
       deltaClosed(prev, getAnInputSymbolMatchingRelevant(char), next)
     }
 
@@ -1099,18 +1103,28 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
       result = getAnInputSymbolMatching(char)
     }
 
+    pragma[noinline]
+    RegExpRoot relevantRoot() {
+      exists(RegExpTerm term, State s |
+        s.getRepr() = term and isCandidateState(s) and result = term.getRootTerm()
+      )
+    }
+
     /**
      * Gets a char used for finding possible suffixes inside `root`.
      */
     pragma[noinline]
     private string relevant(RegExpRoot root) {
-      exists(ascii(result)) and exists(root)
-      or
-      exists(InputSymbol s | belongsTo(s, root) | result = intersect(s, _))
-      or
-      // The characters from `hasSimpleRejectEdge`. Only `\n` is really needed (as `\n` is not in the `ascii` relation).
-      // The three chars must be kept in sync with `hasSimpleRejectEdge`.
-      result = ["|", "\n", "Z"] and exists(root)
+      root = relevantRoot() and
+      (
+        exists(ascii(result)) and exists(root)
+        or
+        exists(InputSymbol s | belongsTo(s, root) | result = intersect(s, _))
+        or
+        // The characters from `hasSimpleRejectEdge`. Only `\n` is really needed (as `\n` is not in the `ascii` relation).
+        // The three chars must be kept in sync with `hasSimpleRejectEdge`.
+        result = ["|", "\n", "Z"] and exists(root)
+      )
     }
 
     /**
@@ -1208,12 +1222,12 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
   predicate hasReDoSResult(RegExpTerm t, string pump, State s, string prefixMsg) {
     isReDoSAttackable(t, pump, s) and
     (
-      prefixMsg = "starting with '" + escape(PrefixConstruction::prefix(s)) + "' and " and
-      not PrefixConstruction::prefix(s) = ""
+      prefixMsg = "starting with '" + escape(Prefix::prefix(s)) + "' and " and
+      not Prefix::prefix(s) = ""
       or
-      PrefixConstruction::prefix(s) = "" and prefixMsg = ""
+      Prefix::prefix(s) = "" and prefixMsg = ""
       or
-      not exists(PrefixConstruction::prefix(s)) and prefixMsg = ""
+      not exists(Prefix::prefix(s)) and prefixMsg = ""
     )
   }
 
diff --git a/java/ql/lib/semmle/code/xml/AndroidManifest.qll b/java/ql/lib/semmle/code/xml/AndroidManifest.qll
index b5c79efa853..f53da67a650 100644
--- a/java/ql/lib/semmle/code/xml/AndroidManifest.qll
+++ b/java/ql/lib/semmle/code/xml/AndroidManifest.qll
@@ -72,6 +72,56 @@ class AndroidApplicationXmlElement extends XmlElement {
    * Holds if this application element has explicitly set a value for its `android:permission` attribute.
    */
   predicate requiresPermissions() { this.getAnAttribute().(AndroidPermissionXmlAttribute).isFull() }
+
+  /**
+   * Holds if this application element does not disable the `android:allowBackup` attribute.
+   *
+   * https://developer.android.com/guide/topics/data/autobackup
+   */
+  predicate allowsBackup() {
+    not this.getFile().(AndroidManifestXmlFile).isInBuildDirectory() and
+    (
+      // explicitly sets android:allowBackup="true"
+      this.allowsBackupExplicitly()
+      or
+      // Manifest providing the main intent for an application, and does not explicitly
+      // disallow the allowBackup attribute
+      this.providesMainIntent() and
+      // Check that android:allowBackup="false" is not present
+      not exists(AndroidXmlAttribute attr |
+        this.getAnAttribute() = attr and
+        attr.getName() = "allowBackup" and
+        attr.getValue() = "false"
+      )
+    )
+  }
+
+  /**
+   * Holds if this application element sets the `android:allowBackup` attribute to `true`.
+   *
+   * https://developer.android.com/guide/topics/data/autobackup
+   */
+  private predicate allowsBackupExplicitly() {
+    exists(AndroidXmlAttribute attr |
+      this.getAnAttribute() = attr and
+      attr.getName() = "allowBackup" and
+      attr.getValue() = "true"
+    )
+  }
+
+  /**
+   * Holds if the application element contains a child element which provides the
+   * `android.intent.action.MAIN` intent.
+   */
+  private predicate providesMainIntent() {
+    exists(AndroidActivityXmlElement activity |
+      activity = this.getAChild() and
+      exists(AndroidIntentFilterXmlElement intentFilter |
+        intentFilter = activity.getAChild() and
+        intentFilter.getAnActionElement().getActionName() = "android.intent.action.MAIN"
+      )
+    )
+  }
 }
 
 /**
diff --git a/java/ql/src/Advisory/Deprecated Code/AvoidDeprecatedCallableAccess.ql b/java/ql/src/Advisory/Deprecated Code/AvoidDeprecatedCallableAccess.ql
index 354b82fe165..f20be6d7f34 100644
--- a/java/ql/src/Advisory/Deprecated Code/AvoidDeprecatedCallableAccess.ql	
+++ b/java/ql/src/Advisory/Deprecated Code/AvoidDeprecatedCallableAccess.ql	
@@ -20,7 +20,7 @@ private predicate isDeprecatedCallable(Callable c) {
 
 from Call ca, Callable c
 where
-  ca.getCallee() = c and
+  ca.getCallee().getSourceDeclaration() = c and
   isDeprecatedCallable(c) and
   // Exclude deprecated calls from within deprecated code.
   not isDeprecatedCallable(ca.getCaller())
diff --git a/java/ql/src/AlertSuppressionAnnotations.ql b/java/ql/src/AlertSuppressionAnnotations.ql
index aa9fd275ad1..7f0ee74a0d8 100644
--- a/java/ql/src/AlertSuppressionAnnotations.ql
+++ b/java/ql/src/AlertSuppressionAnnotations.ql
@@ -23,7 +23,7 @@ class SuppressionAnnotation extends SuppressWarningsAnnotation {
   string text;
 
   SuppressionAnnotation() {
-    text = this.getASuppressedWarningLiteral().getValue() and
+    text = this.getASuppressedWarning() and
     exists(getAnnotationText(text))
   }
 
diff --git a/java/ql/src/Architecture/Refactoring Opportunities/HubClasses.ql b/java/ql/src/Architecture/Refactoring Opportunities/HubClasses.ql
index d50e1d3b5d9..97101414527 100644
--- a/java/ql/src/Architecture/Refactoring Opportunities/HubClasses.ql	
+++ b/java/ql/src/Architecture/Refactoring Opportunities/HubClasses.ql	
@@ -19,6 +19,6 @@ where
   eff = t.getMetrics().getEfferentSourceCoupling() and
   aff > 15 and
   eff > 15
-select t as Class,
+select t as class_,
   "Hub class: this class depends on " + eff.toString() + " classes and is used by " + aff.toString()
     + " classes."
diff --git a/java/ql/src/DeadCode/UselessParameter.ql b/java/ql/src/DeadCode/UselessParameter.ql
index 71e9d2606fa..3d29c8faf10 100644
--- a/java/ql/src/DeadCode/UselessParameter.ql
+++ b/java/ql/src/DeadCode/UselessParameter.ql
@@ -14,4 +14,4 @@ import semmle.code.java.deadcode.DeadCode
 
 from RootdefCallable c
 where not c.whitelisted()
-select c.unusedParameter() as p, "The parameter " + p + " is unused."
+select c.unusedParameter() as p, "The parameter '" + p + "' is never used."
diff --git a/java/ql/src/Frameworks/JavaEE/EJB/EjbContainerInterference.ql b/java/ql/src/Frameworks/JavaEE/EJB/EjbContainerInterference.ql
index cbd74a838f3..79dd15510e8 100644
--- a/java/ql/src/Frameworks/JavaEE/EJB/EjbContainerInterference.ql
+++ b/java/ql/src/Frameworks/JavaEE/EJB/EjbContainerInterference.ql
@@ -7,7 +7,6 @@
  *              Such operations could interfere with the EJB container's operation.
  * @kind problem
  * @problem.severity error
- * @security-severity 5.8
  * @precision low
  * @id java/ejb/container-interference
  * @tags reliability
diff --git a/java/ql/src/Frameworks/JavaEE/EJB/EjbFileIO.ql b/java/ql/src/Frameworks/JavaEE/EJB/EjbFileIO.ql
index ec406ac3171..51f0105cb07 100644
--- a/java/ql/src/Frameworks/JavaEE/EJB/EjbFileIO.ql
+++ b/java/ql/src/Frameworks/JavaEE/EJB/EjbFileIO.ql
@@ -5,7 +5,6 @@
  *              for enterprise components.
  * @kind problem
  * @problem.severity error
- * @security-severity 5.8
  * @precision low
  * @id java/ejb/file-io
  * @tags reliability
diff --git a/java/ql/src/Frameworks/JavaEE/EJB/EjbNative.ql b/java/ql/src/Frameworks/JavaEE/EJB/EjbNative.ql
index bbc57fca5e9..16736a1669e 100644
--- a/java/ql/src/Frameworks/JavaEE/EJB/EjbNative.ql
+++ b/java/ql/src/Frameworks/JavaEE/EJB/EjbNative.ql
@@ -4,7 +4,6 @@
  *              Such use could compromise security and system stability.
  * @kind problem
  * @problem.severity error
- * @security-severity 5.8
  * @precision low
  * @id java/ejb/native-code
  * @tags reliability
diff --git a/java/ql/src/Frameworks/JavaEE/EJB/EjbReflection.ql b/java/ql/src/Frameworks/JavaEE/EJB/EjbReflection.ql
index 7bc062209df..fa28edc7393 100644
--- a/java/ql/src/Frameworks/JavaEE/EJB/EjbReflection.ql
+++ b/java/ql/src/Frameworks/JavaEE/EJB/EjbReflection.ql
@@ -4,7 +4,6 @@
  *              as this could compromise security.
  * @kind problem
  * @problem.severity error
- * @security-severity 5.8
  * @precision low
  * @id java/ejb/reflection
  * @tags external/cwe/cwe-573
diff --git a/java/ql/src/Frameworks/JavaEE/EJB/EjbSecurityConfiguration.ql b/java/ql/src/Frameworks/JavaEE/EJB/EjbSecurityConfiguration.ql
index ea8a7087d26..eb08dcb8060 100644
--- a/java/ql/src/Frameworks/JavaEE/EJB/EjbSecurityConfiguration.ql
+++ b/java/ql/src/Frameworks/JavaEE/EJB/EjbSecurityConfiguration.ql
@@ -5,7 +5,6 @@
  *              This functionality is reserved for the EJB container for security reasons.
  * @kind problem
  * @problem.severity error
- * @security-severity 5.8
  * @precision low
  * @id java/ejb/security-configuration-access
  * @tags external/cwe/cwe-573
diff --git a/java/ql/src/Frameworks/JavaEE/EJB/EjbSerialization.ql b/java/ql/src/Frameworks/JavaEE/EJB/EjbSerialization.ql
index 7de0a0f8aed..d6e5c1fc9b1 100644
--- a/java/ql/src/Frameworks/JavaEE/EJB/EjbSerialization.ql
+++ b/java/ql/src/Frameworks/JavaEE/EJB/EjbSerialization.ql
@@ -4,7 +4,6 @@
  *              the Java serialization protocol, since their use could compromise security.
  * @kind problem
  * @problem.severity error
- * @security-severity 5.8
  * @precision low
  * @id java/ejb/substitution-in-serialization
  * @tags external/cwe/cwe-573
diff --git a/java/ql/src/Frameworks/JavaEE/EJB/EjbSetSocketOrUrlFactory.ql b/java/ql/src/Frameworks/JavaEE/EJB/EjbSetSocketOrUrlFactory.ql
index e8b898b00cc..4a1524ee1b3 100644
--- a/java/ql/src/Frameworks/JavaEE/EJB/EjbSetSocketOrUrlFactory.ql
+++ b/java/ql/src/Frameworks/JavaEE/EJB/EjbSetSocketOrUrlFactory.ql
@@ -5,7 +5,6 @@
  *              compromise security or interfere with the EJB container's operation.
  * @kind problem
  * @problem.severity error
- * @security-severity 5.8
  * @precision low
  * @id java/ejb/socket-or-stream-handler-factory
  * @tags reliability
diff --git a/java/ql/src/Likely Bugs/Collections/IteratorRemoveMayFail.ql b/java/ql/src/Likely Bugs/Collections/IteratorRemoveMayFail.ql
index b350eecae7f..46b7c599f24 100644
--- a/java/ql/src/Likely Bugs/Collections/IteratorRemoveMayFail.ql	
+++ b/java/ql/src/Likely Bugs/Collections/IteratorRemoveMayFail.ql	
@@ -36,11 +36,11 @@ predicate containsSpecialCollection(Expr e, SpecialCollectionCreation origin) {
   or
   exists(Call c, int i |
     containsSpecialCollection(c.getArgument(i), origin) and
-    e = c.getCallee().getParameter(i).getAnAccess()
+    e = c.getCallee().getSourceDeclaration().getParameter(i).getAnAccess()
   )
   or
   exists(Call c, ReturnStmt r | e = c |
-    r.getEnclosingCallable() = c.getCallee() and
+    r.getEnclosingCallable() = c.getCallee().getSourceDeclaration() and
     containsSpecialCollection(r.getResult(), origin)
   )
 }
@@ -58,11 +58,11 @@ predicate iterOfSpecialCollection(Expr e, SpecialCollectionCreation origin) {
   or
   exists(Call c, int i |
     iterOfSpecialCollection(c.getArgument(i), origin) and
-    e = c.getCallee().getParameter(i).getAnAccess()
+    e = c.getCallee().getSourceDeclaration().getParameter(i).getAnAccess()
   )
   or
   exists(Call c, ReturnStmt r | e = c |
-    r.getEnclosingCallable() = c.getCallee() and
+    r.getEnclosingCallable() = c.getCallee().getSourceDeclaration() and
     iterOfSpecialCollection(r.getResult(), origin)
   )
 }
diff --git a/java/ql/src/Likely Bugs/Comparison/BitwiseSignCheck.ql b/java/ql/src/Likely Bugs/Comparison/BitwiseSignCheck.ql
index 4ed6845c70e..4ef249524a6 100644
--- a/java/ql/src/Likely Bugs/Comparison/BitwiseSignCheck.ql	
+++ b/java/ql/src/Likely Bugs/Comparison/BitwiseSignCheck.ql	
@@ -16,4 +16,4 @@ where
   e.isStrict() and
   e.getGreaterOperand() instanceof BitwiseExpr and
   e.getLesserOperand().(IntegerLiteral).getIntValue() = 0
-select e, "Sign check of a bitwise operation."
+select e, "Potentially unsafe sign check of a bitwise operation."
diff --git a/java/ql/src/Likely Bugs/Comparison/MissingInstanceofInEquals.ql b/java/ql/src/Likely Bugs/Comparison/MissingInstanceofInEquals.ql
index 346b21bb847..0b8b1b9098b 100644
--- a/java/ql/src/Likely Bugs/Comparison/MissingInstanceofInEquals.ql	
+++ b/java/ql/src/Likely Bugs/Comparison/MissingInstanceofInEquals.ql	
@@ -77,4 +77,4 @@ where
   // Exclude `equals` methods that implement reference-equality.
   not m instanceof ReferenceEquals and
   not m instanceof UnimplementedEquals
-select m, "equals() method does not seem to check argument type."
+select m, "equals() method does not check argument type."
diff --git a/java/ql/src/Likely Bugs/Reflection/AnnotationPresentCheck.ql b/java/ql/src/Likely Bugs/Reflection/AnnotationPresentCheck.ql
index 22729eebd66..2bffa1ea4f4 100644
--- a/java/ql/src/Likely Bugs/Reflection/AnnotationPresentCheck.ql	
+++ b/java/ql/src/Likely Bugs/Reflection/AnnotationPresentCheck.ql	
@@ -19,8 +19,5 @@ where
   m.getNumberOfParameters() = 1 and
   c.getArgument(0).getType() = p and
   p.getATypeArgument() = t and
-  not exists(RetentionAnnotation a |
-    t.getAnAnnotation() = a and
-    a.getAValue().(VarAccess).getVariable().hasName("RUNTIME")
-  )
+  t.getRetentionPolicy() != "RUNTIME"
 select c, "Call to isAnnotationPresent where no annotation has the RUNTIME retention policy."
diff --git a/java/ql/src/Performance/InnerClassCouldBeStatic.ql b/java/ql/src/Performance/InnerClassCouldBeStatic.ql
index 02ca5544da2..67ee835b747 100644
--- a/java/ql/src/Performance/InnerClassCouldBeStatic.ql
+++ b/java/ql/src/Performance/InnerClassCouldBeStatic.ql
@@ -78,7 +78,7 @@ RefType enclosingInstanceAccess(Expr expr) {
       result = ma.getMethod().getDeclaringType() and
       not exists(ma.getQualifier()) and
       not ma.getMethod().isStatic() and
-      not exists(Method m | m.getSourceDeclaration() = ma.getMethod() | enclosing.inherits(m))
+      not enclosing.inherits(ma.getMethod())
     )
   )
 }
diff --git a/java/ql/src/Security/CWE/CWE-022/TaintedPath.ql b/java/ql/src/Security/CWE/CWE-022/TaintedPath.ql
index 671e9b00b4d..c9ea50c6f29 100644
--- a/java/ql/src/Security/CWE/CWE-022/TaintedPath.ql
+++ b/java/ql/src/Security/CWE/CWE-022/TaintedPath.ql
@@ -48,6 +48,10 @@ class TaintedPathConfig extends TaintTracking::Configuration {
     or
     node = DataFlow::BarrierGuard<containsDotDotSanitizer/3>::getABarrierNode()
   }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
+    any(TaintedPathAdditionalTaintStep s).step(n1, n2)
+  }
 }
 
 /**
diff --git a/java/ql/src/Security/CWE/CWE-022/TaintedPathCommon.qll b/java/ql/src/Security/CWE/CWE-022/TaintedPathCommon.qll
index beea2d5f666..0e826a6fc01 100644
--- a/java/ql/src/Security/CWE/CWE-022/TaintedPathCommon.qll
+++ b/java/ql/src/Security/CWE/CWE-022/TaintedPathCommon.qll
@@ -5,6 +5,49 @@
 import java
 import semmle.code.java.controlflow.Guards
 import semmle.code.java.security.PathCreation
+import semmle.code.java.frameworks.Networking
+import semmle.code.java.dataflow.DataFlow
+
+/**
+ * A unit class for adding additional taint steps.
+ *
+ * Extend this class to add additional taint steps that should apply to tainted path flow configurations.
+ */
+class TaintedPathAdditionalTaintStep extends Unit {
+  abstract predicate step(DataFlow::Node n1, DataFlow::Node n2);
+}
+
+private class DefaultTaintedPathAdditionalTaintStep extends TaintedPathAdditionalTaintStep {
+  override predicate step(DataFlow::Node n1, DataFlow::Node n2) {
+    exists(Argument a |
+      a = n1.asExpr() and
+      a.getCall() = n2.asExpr() and
+      a = any(TaintPreservingUriCtorParam tpp).getAnArgument()
+    )
+  }
+}
+
+private class TaintPreservingUriCtorParam extends Parameter {
+  TaintPreservingUriCtorParam() {
+    exists(Constructor ctor, int idx, int nParams |
+      ctor.getDeclaringType() instanceof TypeUri and
+      this = ctor.getParameter(idx) and
+      nParams = ctor.getNumberOfParameters()
+    |
+      // URI(String scheme, String ssp, String fragment)
+      idx = 1 and nParams = 3
+      or
+      // URI(String scheme, String host, String path, String fragment)
+      idx = [1, 2] and nParams = 4
+      or
+      // URI(String scheme, String authority, String path, String query, String fragment)
+      idx = 2 and nParams = 5
+      or
+      // URI(String scheme, String userInfo, String host, int port, String path, String query, String fragment)
+      idx = 4 and nParams = 7
+    )
+  }
+}
 
 private predicate inWeakCheck(Expr e) {
   // None of these are sufficient to guarantee that a string is safe.
diff --git a/java/ql/src/Security/CWE/CWE-022/TaintedPathLocal.ql b/java/ql/src/Security/CWE/CWE-022/TaintedPathLocal.ql
index ebd9c4f079d..9f138d138a6 100644
--- a/java/ql/src/Security/CWE/CWE-022/TaintedPathLocal.ql
+++ b/java/ql/src/Security/CWE/CWE-022/TaintedPathLocal.ql
@@ -27,6 +27,10 @@ class TaintedPathLocalConfig extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) {
     sink.asExpr() = any(PathCreation p).getAnInput()
   }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
+    any(TaintedPathAdditionalTaintStep s).step(n1, n2)
+  }
 }
 
 from
diff --git a/java/ql/src/Security/CWE/CWE-079/XSS.java b/java/ql/src/Security/CWE/CWE-079/XSS.java
index 273da84901c..8b9a26825bc 100644
--- a/java/ql/src/Security/CWE/CWE-079/XSS.java
+++ b/java/ql/src/Security/CWE/CWE-079/XSS.java
@@ -1,8 +1,9 @@
 public class XSS extends HttpServlet {
 	protected void doGet(HttpServletRequest request, HttpServletResponse response)
 	throws ServletException, IOException {
-		// BAD: a request parameter is written directly to an error response page
-		response.sendError(HttpServletResponse.SC_NOT_FOUND,
+		// BAD: a request parameter is written directly to the Servlet response stream
+		response.getWriter().print(
 				"The page \"" + request.getParameter("page") + "\" was not found.");
+
 	}
 }
diff --git a/java/ql/src/Security/CWE/CWE-079/XSS.qhelp b/java/ql/src/Security/CWE/CWE-079/XSS.qhelp
index 428b44c8db9..05b0f268002 100644
--- a/java/ql/src/Security/CWE/CWE-079/XSS.qhelp
+++ b/java/ql/src/Security/CWE/CWE-079/XSS.qhelp
@@ -18,7 +18,7 @@ reference.</p>
 </recommendation>
 <example>
 
-<p>The following example shows the page parameter being written directly to the server error page,
+<p>The following example shows the <code>page</code> parameter being written directly to the page,
 leaving the website vulnerable to cross-site scripting.</p>
 
 <sample src="XSS.java" />
diff --git a/java/ql/src/Security/CWE/CWE-089/SqlTainted.ql b/java/ql/src/Security/CWE/CWE-089/SqlTainted.ql
index 50dfe9d725a..576b0820e0a 100644
--- a/java/ql/src/Security/CWE/CWE-089/SqlTainted.ql
+++ b/java/ql/src/Security/CWE/CWE-089/SqlTainted.ql
@@ -19,4 +19,5 @@ import DataFlow::PathGraph
 
 from QueryInjectionSink query, DataFlow::PathNode source, DataFlow::PathNode sink
 where queryTaintedBy(query, source, sink)
-select query, source, sink, "Query might include code from $@.", source.getNode(), "this user input"
+select query, source, sink, "This SQL query depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/SSTIBad.java b/java/ql/src/Security/CWE/CWE-094/SSTIBad.java
similarity index 100%
rename from java/ql/src/experimental/Security/CWE/CWE-094/SSTIBad.java
rename to java/ql/src/Security/CWE/CWE-094/SSTIBad.java
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/SSTIGood.java b/java/ql/src/Security/CWE/CWE-094/SSTIGood.java
similarity index 100%
rename from java/ql/src/experimental/Security/CWE/CWE-094/SSTIGood.java
rename to java/ql/src/Security/CWE/CWE-094/SSTIGood.java
diff --git a/java/ql/src/Security/CWE/CWE-094/TemplateInjection.qhelp b/java/ql/src/Security/CWE/CWE-094/TemplateInjection.qhelp
new file mode 100644
index 00000000000..c14fa5784de
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-094/TemplateInjection.qhelp
@@ -0,0 +1,32 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+<overview>
+<p>
+Template injection occurs when user input is embedded in a template's code in an unsafe manner.
+An attacker can use native template syntax to inject a malicious payload into a template, which is then executed server-side.
+This permits the attacker to run arbitrary code in the server's context.
+</p>
+</overview>
+<recommendation>
+<p>
+To fix this, ensure that untrusted input is not used as part of a template's code. If the application requirements do not allow this,
+use a sandboxed environment where access to unsafe attributes and methods is prohibited.
+</p>
+</recommendation>
+<example>
+<p>
+In the example given below, an untrusted HTTP parameter <code>code</code> is used as a Velocity template string. 
+This can lead to remote code execution.
+</p>
+<sample src="SSTIBad.java" />
+
+<p>
+In the next example, the problem is avoided by using a fixed template string <code>s</code>.
+Since the template's code is not attacker-controlled in this case, this solution prevents the execution of untrusted code.
+</p>
+<sample src="SSTIGood.java" />
+</example>
+<references>
+<li>Portswigger: <a href="https://portswigger.net/web-security/server-side-template-injection">Server Side Template Injection</a>.</li>
+</references>
+</qhelp>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/TemplateInjection.ql b/java/ql/src/Security/CWE/CWE-094/TemplateInjection.ql
similarity index 66%
rename from java/ql/src/experimental/Security/CWE/CWE-094/TemplateInjection.ql
rename to java/ql/src/Security/CWE/CWE-094/TemplateInjection.ql
index 18e47d2c6b3..6ddd8cfd2c9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/TemplateInjection.ql
+++ b/java/ql/src/Security/CWE/CWE-094/TemplateInjection.ql
@@ -1,16 +1,18 @@
 /**
- * @name Server Side Template Injection
- * @description Untrusted input used as a template parameter can lead to remote code execution.
+ * @name Server-side template injection
+ * @description Untrusted input interpreted as a template can lead to remote code execution.
  * @kind path-problem
  * @problem.severity error
+ * @security-severity 9.3
  * @precision high
  * @id java/server-side-template-injection
  * @tags security
+ *       external/cwe/cwe-1336
  *       external/cwe/cwe-094
  */
 
 import java
-import TemplateInjection
+import semmle.code.java.security.TemplateInjectionQuery
 import DataFlow::PathGraph
 
 from TemplateInjectionFlowConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
diff --git a/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql b/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql
index d32e7544f3e..a6c14986cdb 100644
--- a/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql
+++ b/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql
@@ -27,8 +27,21 @@ class ResponseSplittingConfig extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) { sink instanceof HeaderSplittingSink }
 
   override predicate isSanitizer(DataFlow::Node node) {
-    node.getType() instanceof PrimitiveType or
+    node.getType() instanceof PrimitiveType
+    or
     node.getType() instanceof BoxedType
+    or
+    exists(MethodAccess ma, string methodName, CompileTimeConstantExpr target |
+      node.asExpr() = ma and
+      ma.getMethod().hasQualifiedName("java.lang", "String", methodName) and
+      target = ma.getArgument(0) and
+      (
+        methodName = "replace" and target.getIntValue() = [10, 13] // 10 == "\n", 13 == "\r"
+        or
+        methodName = "replaceAll" and
+        target.getStringValue().regexpMatch(".*([\n\r]|\\[\\^[^\\]\r\n]*\\]).*")
+      )
+    )
   }
 }
 
diff --git a/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.qhelp b/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.qhelp
new file mode 100644
index 00000000000..4f57a2659f0
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.qhelp
@@ -0,0 +1,45 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>In the Android manifest file, you can use the <code>android:allowBackup</code> attribute of the <code>application</code> element to define whether the
+application will have automatic backups or not.</p>
+
+<p>If your application uses any sensitive data, you should disable automatic backups to prevent attackers from extracting it.</p>
+</overview>
+
+<recommendation>
+<p>For Android applications which process sensitive data, set <code>android:allowBackup</code> to <code>false</code> in the manifest
+file.</p>
+
+<p>Note: Since Android 6.0 (Marshmallow), automatic backups for applications are switched on by default. 
+</p>
+</recommendation>
+
+<example>
+
+<p>In the following two (bad) examples, the <code>android:allowBackup</code> setting is enabled:</p>
+
+<sample src="AllowBackupTrue.xml" />
+
+<sample src="AllowBackupEmpty.xml"/>
+
+<p>In the following (good) example, <code>android:allowBackup</code> is set to <code>false</code>:</p>
+
+<sample src="AllowBackupFalse.xml"/>
+
+</example>
+<references>
+<li>
+   Android Documentation:
+   <a href="https://developer.android.com/guide/topics/data/autobackup#EnablingAutoBackup">Back up user data with Auto Backup</a>
+</li>
+<li>
+   OWASP Mobile Security Testing Guide:
+   <a href="https://github.com/OWASP/owasp-mstg/blob/b7a93a2e5e0557cc9a12e55fc3f6675f6986bb86/Document/0x05d-Testing-Data-Storage.md#backups">
+    Android Backups
+   </a>
+</li>
+</references>
+</qhelp>
\ No newline at end of file
diff --git a/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql b/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql
new file mode 100644
index 00000000000..d2810d70250
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Application backup allowed
+ * @description Allowing application backups may allow an attacker to extract sensitive data.
+ * @kind problem
+ * @problem.severity recommendation
+ * @security-severity 7.5
+ * @id java/android/backup-enabled
+ * @tags security
+ *       external/cwe/cwe-312
+ * @precision very-high
+ */
+
+import java
+import semmle.code.xml.AndroidManifest
+
+from AndroidApplicationXmlElement androidAppElem
+where androidAppElem.allowsBackup()
+select androidAppElem, "Backups are allowed in this Android application."
diff --git a/java/ql/src/Security/CWE/CWE-312/AllowBackupEmpty.xml b/java/ql/src/Security/CWE/CWE-312/AllowBackupEmpty.xml
new file mode 100644
index 00000000000..e3e9159b726
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-312/AllowBackupEmpty.xml
@@ -0,0 +1,7 @@
+<manifest ... >
+    <!-- BAD: no 'android:allowBackup' set, defaults to 'true' -->
+    <application>
+        <activity ... >
+        </activity>
+    </application>
+</manifest>
diff --git a/java/ql/src/Security/CWE/CWE-312/AllowBackupFalse.xml b/java/ql/src/Security/CWE/CWE-312/AllowBackupFalse.xml
new file mode 100644
index 00000000000..cf0a90bb60c
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-312/AllowBackupFalse.xml
@@ -0,0 +1,8 @@
+<manifest ... >
+    <!-- GOOD: 'android:allowBackup' set to 'false' -->
+    <application
+        android:allowBackup="false">
+        <activity ... >
+        </activity>
+    </application>
+</manifest>
diff --git a/java/ql/src/Security/CWE/CWE-312/AllowBackupTrue.xml b/java/ql/src/Security/CWE/CWE-312/AllowBackupTrue.xml
new file mode 100644
index 00000000000..bdec443a6c5
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-312/AllowBackupTrue.xml
@@ -0,0 +1,8 @@
+<manifest ... >
+    <!-- BAD: 'android:allowBackup' set to 'true' -->
+    <application
+        android:allowBackup="true">
+        <activity ... >
+        </activity>
+    </application>
+</manifest>
diff --git a/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql b/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
index e187320ba5d..49de716b1dc 100644
--- a/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
+++ b/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
@@ -38,7 +38,7 @@ predicate objectToString(MethodAccess ma) {
   exists(ToStringMethod m |
     m = ma.getMethod() and
     m.getDeclaringType() instanceof TypeObject and
-    variableTrack(ma.getQualifier()).getType().getErasure() instanceof TypeObject
+    exprNode(ma.getQualifier()).getTypeBound().getErasure() instanceof TypeObject
   )
 }
 
diff --git a/java/ql/src/Security/CWE/CWE-611/XXE.ql b/java/ql/src/Security/CWE/CWE-611/XXE.ql
index b50c9c7fef8..d00480a815d 100644
--- a/java/ql/src/Security/CWE/CWE-611/XXE.ql
+++ b/java/ql/src/Security/CWE/CWE-611/XXE.ql
@@ -51,5 +51,6 @@ class XxeConfig extends TaintTracking::Configuration {
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, XxeConfig conf
 where conf.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Unsafe parsing of XML file from $@.", source.getNode(),
-  "user input"
+select sink.getNode(), source, sink,
+  "A $@ is parsed as XML without guarding against external entity expansion.", source.getNode(),
+  "user-provided value"
diff --git a/java/ql/src/Telemetry/UnsupportedExternalAPIs.ql b/java/ql/src/Telemetry/UnsupportedExternalAPIs.ql
index dde454dd00d..a6666637f16 100644
--- a/java/ql/src/Telemetry/UnsupportedExternalAPIs.ql
+++ b/java/ql/src/Telemetry/UnsupportedExternalAPIs.ql
@@ -8,6 +8,7 @@
 
 import java
 import semmle.code.java.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
+import semmle.code.java.dataflow.internal.NegativeSummary
 import ExternalApi
 
 private predicate getRelevantUsages(ExternalApi api, int usages) {
diff --git a/java/ql/src/Violations of Best Practice/Comments/TodoComments.ql b/java/ql/src/Violations of Best Practice/Comments/TodoComments.ql
index 37ec6695a51..ef0b604ac5e 100644
--- a/java/ql/src/Violations of Best Practice/Comments/TodoComments.ql	
+++ b/java/ql/src/Violations of Best Practice/Comments/TodoComments.ql	
@@ -17,4 +17,4 @@ from JavadocText c
 where
   c.getText().matches("%TODO%") or
   c.getText().matches("%FIXME%")
-select c, "TODO/FIXME comment."
+select c, "TODO comments should be addressed."
diff --git a/java/ql/src/Violations of Best Practice/Dead Code/DeadStoreOfLocalUnread.ql b/java/ql/src/Violations of Best Practice/Dead Code/DeadStoreOfLocalUnread.ql
index ccca6818ad1..582e109e35e 100644
--- a/java/ql/src/Violations of Best Practice/Dead Code/DeadStoreOfLocalUnread.ql	
+++ b/java/ql/src/Violations of Best Practice/Dead Code/DeadStoreOfLocalUnread.ql	
@@ -21,4 +21,4 @@ where
   read(v) and
   not def.(AssignExpr).getSource() instanceof NullLiteral and
   (def instanceof Assignment or def.(UnaryAssignExpr).getParent() instanceof ExprStmt)
-select def, "This assignment to " + v.getName() + " is useless: the value is never read."
+select def, "This definition of " + v.getName() + " is never used."
diff --git a/java/ql/src/Violations of Best Practice/Dead Code/NonAssignedFields.ql b/java/ql/src/Violations of Best Practice/Dead Code/NonAssignedFields.ql
index 6c32937a2a9..3e1d7cfd135 100644
--- a/java/ql/src/Violations of Best Practice/Dead Code/NonAssignedFields.ql	
+++ b/java/ql/src/Violations of Best Practice/Dead Code/NonAssignedFields.ql	
@@ -86,5 +86,6 @@ where
   ) and
   // Exclude special VM classes.
   not isVMObserver(f.getDeclaringType())
-select f, "Field " + f.getName() + " never assigned non-null value, yet it is read at $@.", fr,
-  fr.getFile().getStem() + ".java:" + fr.getLocation().getStartLine()
+select f,
+  "The field '" + f.getName() + "' is never explicitly assigned a value, yet it is read $@.", fr,
+  "here"
diff --git a/java/ql/src/Violations of Best Practice/Exception Handling/NumberFormatException.ql b/java/ql/src/Violations of Best Practice/Exception Handling/NumberFormatException.ql
index 2b48745a01c..6a7928b4561 100644
--- a/java/ql/src/Violations of Best Practice/Exception Handling/NumberFormatException.ql	
+++ b/java/ql/src/Violations of Best Practice/Exception Handling/NumberFormatException.ql	
@@ -15,10 +15,10 @@ import semmle.code.java.NumberFormatException
 
 from Expr e
 where
-  throwsNFE(e) and
+  throwsNfe(e) and
   not exists(TryStmt t |
     t.getBlock() = e.getEnclosingStmt().getEnclosingStmt*() and
-    catchesNFE(t)
+    catchesNfe(t)
   ) and
   not exists(Callable c |
     e.getEnclosingCallable() = c and
diff --git a/java/ql/src/Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql b/java/ql/src/Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql
index 817634f7d2c..8fe3d4e6ba6 100644
--- a/java/ql/src/Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql	
+++ b/java/ql/src/Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql	
@@ -72,7 +72,7 @@ predicate mayWriteToArray(Expr modified) {
   // return __array__;    ...  method()[1] = 0
   exists(ReturnStmt rs | modified = rs.getResult() and relevantType(modified.getType()) |
     exists(Callable enclosing, MethodAccess ma |
-      enclosing = rs.getEnclosingCallable() and ma.getMethod() = enclosing
+      enclosing = rs.getEnclosingCallable() and ma.getMethod().getSourceDeclaration() = enclosing
     |
       mayWriteToArray(ma)
     )
@@ -100,7 +100,7 @@ VarAccess varPassedInto(Callable c, int i) {
 predicate exposesByReturn(Callable c, Field f, Expr why, string whyText) {
   returnsArray(c, f) and
   exists(MethodAccess ma |
-    ma.getMethod() = c and ma.getCompilationUnit() != c.getCompilationUnit()
+    ma.getMethod().getSourceDeclaration() = c and ma.getCompilationUnit() != c.getCompilationUnit()
   |
     mayWriteToArray(ma) and
     why = ma and
diff --git a/java/ql/src/Violations of Best Practice/Implementation Hiding/StaticArray.ql b/java/ql/src/Violations of Best Practice/Implementation Hiding/StaticArray.ql
index 33fe1cdb46d..84bc421ee66 100644
--- a/java/ql/src/Violations of Best Practice/Implementation Hiding/StaticArray.ql	
+++ b/java/ql/src/Violations of Best Practice/Implementation Hiding/StaticArray.ql	
@@ -41,4 +41,4 @@ where
   f.getType() instanceof Array and
   f.fromSource() and
   forall(AssignExpr a | a.getDest() = f.getAnAccess() | nonEmptyArrayLiteralOrNull(a.getSource()))
-select f, "The array constant " + f.getName() + " is vulnerable to mutation."
+select f, "The array constant '" + f.getName() + "' is vulnerable to mutation."
diff --git a/java/ql/src/Violations of Best Practice/Naming Conventions/AmbiguousOuterSuper.ql b/java/ql/src/Violations of Best Practice/Naming Conventions/AmbiguousOuterSuper.ql
index ec71b1207fa..f4161160303 100644
--- a/java/ql/src/Violations of Best Practice/Naming Conventions/AmbiguousOuterSuper.ql	
+++ b/java/ql/src/Violations of Best Practice/Naming Conventions/AmbiguousOuterSuper.ql	
@@ -27,7 +27,7 @@ predicate callToInheritedMethod(RefType lexicalScope, MethodAccess ma, string si
   not ma.getMethod().isStatic() and
   not ma.hasQualifier() and
   ma.getEnclosingCallable().getDeclaringType() = lexicalScope and
-  nestedSupertypePlus(lexicalScope).getAMethod() = ma.getMethod() and
+  nestedSupertypePlus(lexicalScope).getAMethod() = ma.getMethod().getSourceDeclaration() and
   signature = ma.getMethod().getSignature()
 }
 
diff --git a/java/ql/src/Violations of Best Practice/legacy/UnnecessaryImport.ql b/java/ql/src/Violations of Best Practice/legacy/UnnecessaryImport.ql
index 096cd8b551f..04b7c9f2516 100644
--- a/java/ql/src/Violations of Best Practice/legacy/UnnecessaryImport.ql	
+++ b/java/ql/src/Violations of Best Practice/legacy/UnnecessaryImport.ql	
@@ -71,4 +71,4 @@ where
   not neededImport(i) and
   not i instanceof ImportStaticOnDemand and
   not i instanceof ImportStaticTypeMember
-select i, "The statement '" + i + "' is unnecessary."
+select i, "Import of '" + i + "' is not used."
diff --git a/java/ql/src/change-notes/2022-08-18-android-allowbackup-query.md b/java/ql/src/change-notes/2022-08-18-android-allowbackup-query.md
new file mode 100644
index 00000000000..e37abd0d755
--- /dev/null
+++ b/java/ql/src/change-notes/2022-08-18-android-allowbackup-query.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query, `java/android/backup-enabled`, to detect if Android applications allow backups.
diff --git a/java/ql/src/change-notes/2022-08-23-alert-messages.md b/java/ql/src/change-notes/2022-08-23-alert-messages.md
new file mode 100644
index 00000000000..22f4c5c6682
--- /dev/null
+++ b/java/ql/src/change-notes/2022-08-23-alert-messages.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The alert message of many queries have been changed to make the message consistent with other languages.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2022-08-29-remove-security-tag.md b/java/ql/src/change-notes/2022-08-29-remove-security-tag.md
new file mode 100644
index 00000000000..8770494e631
--- /dev/null
+++ b/java/ql/src/change-notes/2022-08-29-remove-security-tag.md
@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Removed the `@security-severity` tag from several queries not in the `Security/` folder that also had missing `security` tags.
diff --git a/java/ql/src/change-notes/2022-09-01-implicit-pendingintents-new-sinks.md b/java/ql/src/change-notes/2022-09-01-implicit-pendingintents-new-sinks.md
new file mode 100644
index 00000000000..7ac374be58f
--- /dev/null
+++ b/java/ql/src/change-notes/2022-09-01-implicit-pendingintents-new-sinks.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added new sinks related to Android's `AlarmManager` to the query `java/android/implicit-pendingintents`.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2022-09-08-server-side-template-injection-query.md b/java/ql/src/change-notes/2022-09-08-server-side-template-injection-query.md
new file mode 100644
index 00000000000..a62dc864f44
--- /dev/null
+++ b/java/ql/src/change-notes/2022-09-08-server-side-template-injection-query.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* The query "Server-side template injection" (`java/server-side-template-injection`) has been promoted from experimental to the main query pack. This query was originally [submitted as an experimental query by @porcupineyhairs](https://github.com/github/codeql/pull/5935).
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2022-09-13-flow-model-for-uri-constructors.md b/java/ql/src/change-notes/2022-09-13-flow-model-for-uri-constructors.md
new file mode 100644
index 00000000000..254fc55d42a
--- /dev/null
+++ b/java/ql/src/change-notes/2022-09-13-flow-model-for-uri-constructors.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added taint model for arguments of `java.net.URI` constructors to the queries `java/path-injection` and `java/path-injection-local`.
diff --git a/java/ql/src/change-notes/2022-09-15-implicit-this-generic-method.md b/java/ql/src/change-notes/2022-09-15-implicit-this-generic-method.md
new file mode 100644
index 00000000000..be30188b05d
--- /dev/null
+++ b/java/ql/src/change-notes/2022-09-15-implicit-this-generic-method.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The Java extractor now populates the `Method` relating to a `MethodAccess` consistently for calls using an explicit and implicit `this` qualifier. Previously if the method `foo` was inherited from a specialised generic type `ParentType<String>`, then an explicit call `this.foo()` would yield a `MethodAccess` whose `getMethod()` accessor returned the bound method `ParentType<String>.foo`, whereas an implicitly-qualified `foo()` `MethodAccess`'s `getMethod()` would return the unbound method `ParentType.foo`. Now both scenarios produce a bound method. This means that all data-flow queries may return more results where a relevant path transits a call to such an implicitly-qualified call to a member method with a bound generic type, while queries that inspect the result of `MethodAccess.getMethod()` may need to tolerate bound generic methods in more circumstances. The queries `java/iterator-remove-failure`, `java/non-static-nested-class`, `java/internal-representation-exposure`, `java/subtle-inherited-call` and `java/deprecated-call` have been amended to properly handle calls to bound generic methods, and in some instances may now produce more results in the explicit-`this` case as well.
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/TemplateInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/TemplateInjection.qhelp
deleted file mode 100644
index 882e9cecab1..00000000000
--- a/java/ql/src/experimental/Security/CWE/CWE-094/TemplateInjection.qhelp
+++ /dev/null
@@ -1,31 +0,0 @@
-<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
-<qhelp>
-  <overview>
-    <p>
-            Template Injection occurs when user input is embedded in a template in an unsafe manner.
-            An attacker can use native template syntax to inject a malicious payload into a template, which is then executed server-side. This permits the attacker to run arbitrary code in the server's context.</p>
-  </overview>
-  <recommendation>
-    <p>
-            To fix this, ensure that an untrusted value is not used as a template. If the application requirements do not allow this, use a sandboxed environment where access to unsafe attributes and methods is prohibited.
-        </p>
-  </recommendation>
-  <example>
-    <p>
-      In the example given below, an untrusted HTTP parameter
-      <code>code</code>
-      is used as a Velocity template string. This can lead to remote code execution.
-    </p>
-    <sample src="SSTIBad.java" />
-
-    <p>
-      In the next example the problem is avoided by using a fixed template string
-      <code>s</code>
-      . Since, the template is not attacker controlled in this case, we prevent untrusted code execution.
-    </p>
-    <sample src="SSTIGood.java" />
-  </example>
-  <references>
-    <li>Portswigger : [Server Side Template Injection](https://portswigger.net/web-security/server-side-template-injection)</li>
-  </references>
-</qhelp>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/TemplateInjection.qll b/java/ql/src/experimental/Security/CWE/CWE-094/TemplateInjection.qll
deleted file mode 100644
index 2f3113123aa..00000000000
--- a/java/ql/src/experimental/Security/CWE/CWE-094/TemplateInjection.qll
+++ /dev/null
@@ -1,209 +0,0 @@
-/** Definitions related to the Server Side Template Injection (SSTI) query. */
-
-import java
-import semmle.code.java.dataflow.TaintTracking
-import semmle.code.java.dataflow.FlowSources
-import experimental.semmle.code.java.frameworks.FreeMarker
-import experimental.semmle.code.java.frameworks.Velocity
-import experimental.semmle.code.java.frameworks.JinJava
-import experimental.semmle.code.java.frameworks.Pebble
-import experimental.semmle.code.java.frameworks.Thymeleaf
-
-/** A taint tracking configuration to reason about Server Side Template Injection (SSTI) vulnerabilities */
-class TemplateInjectionFlowConfig extends TaintTracking::Configuration {
-  TemplateInjectionFlowConfig() { this = "TemplateInjectionFlowConfig" }
-
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
-
-  override predicate isSanitizer(DataFlow::Node node) {
-    node.getType() instanceof PrimitiveType or node.getType() instanceof BoxedType
-  }
-
-  override predicate isAdditionalTaintStep(DataFlow::Node prev, DataFlow::Node succ) {
-    exists(AdditionalFlowStep a | a.isAdditionalTaintStep(prev, succ))
-  }
-}
-
-/**
- * A data flow sink for Server Side Template Injection (SSTI) vulnerabilities
- */
-abstract private class Sink extends DataFlow::ExprNode { }
-
-/**
- * A data flow step for Server Side Template Injection (SSTI) vulnerabilities
- */
-private class AdditionalFlowStep extends Unit {
-  abstract predicate isAdditionalTaintStep(DataFlow::Node prev, DataFlow::Node succ);
-}
-
-/**
- * An argument to FreeMarker template engine's `process` method call.
- */
-private class FreeMarkerProcessSink extends Sink {
-  FreeMarkerProcessSink() {
-    exists(MethodAccess m |
-      m.getCallee() instanceof MethodFreeMarkerTemplateProcess and
-      m.getArgument(0) = this.getExpr()
-    )
-  }
-}
-
-/**
- * An reader passed an argument to FreeMarker template engine's `Template`
- *   construtor call.
- */
-private class FreeMarkerConstructorSink extends Sink {
-  FreeMarkerConstructorSink() {
-    // Template(java.lang.String name, java.io.Reader reader)
-    // Template(java.lang.String name, java.io.Reader reader, Configuration cfg)
-    // Template(java.lang.String name, java.io.Reader reader, Configuration cfg, java.lang.String encoding)
-    // Template(java.lang.String name, java.lang.String sourceName, java.io.Reader reader, Configuration cfg)
-    // Template(java.lang.String name, java.lang.String sourceName, java.io.Reader reader, Configuration cfg, ParserConfiguration customParserConfiguration, java.lang.String encoding)
-    // Template(java.lang.String name, java.lang.String sourceName, java.io.Reader reader, Configuration cfg, java.lang.String encoding)
-    exists(ConstructorCall cc, Expr e |
-      cc.getConstructor().getDeclaringType() instanceof TypeFreeMarkerTemplate and
-      e = cc.getAnArgument() and
-      (
-        e.getType().(RefType).hasQualifiedName("java.io", "Reader") and
-        this.asExpr() = e
-      )
-    )
-    or
-    exists(ConstructorCall cc |
-      cc.getConstructor().getDeclaringType() instanceof TypeFreeMarkerTemplate and
-      // Template(java.lang.String name, java.lang.String sourceCode, Configuration cfg)
-      cc.getNumArgument() = 3 and
-      cc.getArgument(1).getType() instanceof TypeString and
-      this.asExpr() = cc.getArgument(1)
-    )
-  }
-}
-
-/**
- * An argument to FreeMarker template engine's `putTemplate` method call.
- */
-private class FreeMarkerStringTemplateLoaderPutTemplateSink extends Sink {
-  FreeMarkerStringTemplateLoaderPutTemplateSink() {
-    exists(MethodAccess ma |
-      this.asExpr() = ma.getArgument(1) and
-      ma.getMethod() instanceof MethodFreeMarkerStringTemplateLoaderPutTemplate
-    )
-  }
-}
-
-/**
- * An argument to Pebble template engine's `getLiteralTemplate` or `getTemplate` method call.
- */
-private class PebbleGetTemplateSinkTemplateSink extends Sink {
-  PebbleGetTemplateSinkTemplateSink() {
-    exists(MethodAccess ma |
-      this.asExpr() = ma.getArgument(0) and
-      ma.getMethod() instanceof MethodPebbleGetTemplate
-    )
-  }
-}
-
-/**
- * An argument to JinJava template engine's `render` or `renderForResult` method call.
- */
-private class JinjavaRenderSink extends Sink {
-  JinjavaRenderSink() {
-    exists(MethodAccess ma |
-      this.asExpr() = ma.getArgument(0) and
-      (
-        ma.getMethod() instanceof MethodJinjavaRenderForResult
-        or
-        ma.getMethod() instanceof MethodJinjavaRender
-      )
-    )
-  }
-}
-
-/**
- * An argument to ThymeLeaf template engine's `process` method call.
- */
-private class ThymeLeafRenderSink extends Sink {
-  ThymeLeafRenderSink() {
-    exists(MethodAccess ma |
-      this.asExpr() = ma.getArgument(0) and
-      ma.getMethod() instanceof MethodThymeleafProcess
-    )
-  }
-}
-
-/**
- * Tainted data flowing into a Velocity Context through `put` method taints the context.
- */
-private class VelocityContextFlow extends AdditionalFlowStep {
-  override predicate isAdditionalTaintStep(DataFlow::Node prev, DataFlow::Node succ) {
-    exists(MethodAccess m | m.getMethod() instanceof MethodVelocityContextPut |
-      m.getArgument(1) = prev.asExpr() and
-      succ.asExpr() = m.getQualifier()
-    )
-  }
-}
-
-/**
- * An argument to Velocity template engine's `mergeTemplate` method call.
- */
-private class VelocityMergeTempSink extends Sink {
-  VelocityMergeTempSink() {
-    exists(MethodAccess m |
-      // static boolean	mergeTemplate(String templateName, String encoding, Context context, Writer writer)
-      m.getCallee() instanceof MethodVelocityMergeTemplate and
-      m.getArgument(2) = this.getExpr()
-    )
-  }
-}
-
-/**
- * An argument to Velocity template engine's `mergeTemplate` method call.
- */
-private class VelocityMergeSink extends Sink {
-  VelocityMergeSink() {
-    exists(MethodAccess m |
-      m.getCallee() instanceof MethodVelocityMerge and
-      // public void merge(Context context, Writer writer)
-      // public void merge(Context context, Writer writer, List<String> macroLibraries)
-      m.getArgument(0) = this.getExpr()
-    )
-  }
-}
-
-/**
- * An argument to Velocity template engine's `evaluate` method call.
- */
-private class VelocityEvaluateSink extends Sink {
-  VelocityEvaluateSink() {
-    exists(MethodAccess m |
-      m.getCallee() instanceof MethodVelocityEvaluate and
-      m.getArgument([0, 3]) = this.getExpr()
-    )
-  }
-}
-
-/**
- * An argument to Velocity template engine's `parse` method call.
- */
-private class VelocityParseSink extends Sink {
-  VelocityParseSink() {
-    exists(MethodAccess ma |
-      this.asExpr() = ma.getArgument(0) and
-      ma.getMethod() instanceof MethodVelocityParse
-    )
-  }
-}
-
-/**
- * An argument to Velocity template engine's `putStringResource` method call.
- */
-private class VelocityPutStringResSink extends Sink {
-  VelocityPutStringResSink() {
-    exists(MethodAccess ma |
-      this.asExpr() = ma.getArgument(1) and
-      ma.getMethod() instanceof MethodVelocityPutStringResource
-    )
-  }
-}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql b/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
index f917936a33f..4510bbbc869 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
@@ -117,12 +117,12 @@ predicate hasShortAsymmetricKeyPair(MethodAccess ma, string msg, string type) {
 }
 
 /** Holds if a DSA `KeyPairGenerator` initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
-predicate hasShortDSAKeyPair(MethodAccess ma, string msg) {
+predicate hasShortDsaKeyPair(MethodAccess ma, string msg) {
   hasShortAsymmetricKeyPair(ma, msg, "DSA") or hasShortAsymmetricKeyPair(ma, msg, "DH")
 }
 
 /** Holds if a RSA `KeyPairGenerator` initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
-predicate hasShortRSAKeyPair(MethodAccess ma, string msg) {
+predicate hasShortRsaKeyPair(MethodAccess ma, string msg) {
   hasShortAsymmetricKeyPair(ma, msg, "RSA")
 }
 
@@ -147,7 +147,7 @@ predicate hasShortECKeyPair(MethodAccess ma, string msg) {
 from Expr e, string msg
 where
   hasShortAESKey(e, msg) or
-  hasShortDSAKeyPair(e, msg) or
-  hasShortRSAKeyPair(e, msg) or
+  hasShortDsaKeyPair(e, msg) or
+  hasShortRsaKeyPair(e, msg) or
   hasShortECKeyPair(e, msg)
 select e, msg
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
index bb16099ddc3..cc1552b59b9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -47,8 +47,8 @@ class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod
         .getType()
         .hasQualifiedName("org.springframework.web.bind.annotation", "RequestMapping") and
     (
-      this.getAnAnnotation().getValue("method").(VarAccess).getVariable().getName() = "GET" or
-      this.getAnAnnotation().getValue("method").(ArrayInit).getSize() = 0 //Java code example: @RequestMapping(value = "test")
+      this.getAnAnnotation().getAnEnumConstantArrayValue("method").getName() = "GET" or
+      not exists(this.getAnAnnotation().getAnArrayValue("method")) //Java code example: @RequestMapping(value = "test")
     ) and
     not this.getAParamType().getName() = "MultipartFile"
   }
diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql b/java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql
index 864692ed8b6..d61119fc853 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql
@@ -48,4 +48,4 @@ where
   )
   or
   hasEmbeddedPassword(nameAttr.getValue().trim()) // Attribute value matches password pattern
-select nameAttr, "Plaintext password in configuration file."
+select nameAttr, "Avoid plaintext passwords in configuration files."
diff --git a/java/ql/src/experimental/Security/CWE/CWE-601/SpringUrlRedirect.ql b/java/ql/src/experimental/Security/CWE/CWE-601/SpringUrlRedirect.ql
index a69928ba0bd..3cef2b4fc41 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-601/SpringUrlRedirect.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-601/SpringUrlRedirect.ql
@@ -11,7 +11,7 @@
  */
 
 import java
-import SpringUrlRedirect
+import experimental.semmle.code.java.security.SpringUrlRedirect
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.controlflow.Guards
 import DataFlow::PathGraph
diff --git a/java/ql/src/experimental/Security/CWE/CWE-625/DotRegex.java b/java/ql/src/experimental/Security/CWE/CWE-625/DotRegex.java
new file mode 100644
index 00000000000..c5fcb13ec78
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-625/DotRegex.java
@@ -0,0 +1,32 @@
+String PROTECTED_PATTERN = "/protected/.*";
+String CONSTRAINT_PATTERN = "/protected/xyz\\.xml";
+
+// BAD: A string with line return e.g. `/protected/%0dxyz` can bypass the path check
+Pattern p = Pattern.compile(PROTECTED_PATTERN);
+Matcher m = p.matcher(path);
+
+// GOOD: A string with line return e.g. `/protected/%0dxyz` cannot bypass the path check
+Pattern p = Pattern.compile(PROTECTED_PATTERN, Pattern.DOTALL);
+Matcher m = p.matcher(path);
+
+// GOOD: Only a specific path can pass the validation
+Pattern p = Pattern.compile(CONSTRAINT_PATTERN);
+Matcher m = p.matcher(path);
+
+if (m.matches()) {
+    // Protected page - check access token and redirect to login page
+} else {
+    // Not protected page - render content
+}
+
+// BAD: A string with line return e.g. `/protected/%0axyz` can bypass the path check
+boolean matches = path.matches(PROTECTED_PATTERN);
+
+// BAD: A string with line return e.g. `/protected/%0axyz` can bypass the path check
+boolean matches = Pattern.matches(PROTECTED_PATTERN, path);
+
+if (matches) {
+    // Protected page - check access token and redirect to login page
+} else {
+    // Not protected page - render content
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegex.qhelp b/java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegex.qhelp
new file mode 100644
index 00000000000..cc7843e7455
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegex.qhelp
@@ -0,0 +1,37 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>By default, a "dot" (<code>.</code>) in a regular expression matches all characters except the newline characters <code>\n</code> and
+<code>\r</code>. Regular expressions containing a dot can be bypassed with the characters <code>\r</code>(<code>%0a</code>) and 
+<code>\n</code>(<code>%0d</code>) when the default Java regular expression matching implementations are used. This becomes a security issue
+if these regular expressions are used to decide whether to grant access to protected application resources.</p>
+</overview>
+
+<recommendation>
+<p>To guard against unauthorized access, it is advisable to properly specify regex patterns for validating user input. The Java
+Pattern Matcher API <code>Pattern.compile(PATTERN, Pattern.DOTALL)</code> with the <code>DOTALL</code> flag set can be adopted
+to address this vulnerability.</p>
+</recommendation>
+
+<example>
+<p>The following snippets show a vulnerable example and a secure example respectively. The <code>bad</code> methods show a regex pattern allowing
+a bypass by using line break characters. In the <code>good</code> methods, it is shown how to solve this problem by either specifying the regex 
+pattern correctly or using a Java API that properly matches new line characters.
+</p>
+
+<sample src="DotRegex.java" />
+</example>
+
+<references>
+<li>Apache Shiro:
+  <a href="https://github.com/apache/shiro/commit/6bcb92e06fa588b9c7790dd01bc02135d58d3f5b">Address the RegexRequestMatcher issue in 1.9.1</a>.
+</li>
+<li>CVE-2022-32532:
+  <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32532">Applications using RegExPatternMatcher with "." in the regular expression are possibly vulnerable to an authorization bypass</a>.
+</li>
+</references>
+
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegex.ql b/java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegex.ql
new file mode 100644
index 00000000000..7319c75320a
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegex.ql
@@ -0,0 +1,22 @@
+/**
+ * @name URL matched by permissive `.` in a regular expression
+ * @description URLs validated with a permissive `.` in regular expressions may be vulnerable
+ *              to an authorization bypass.
+ * @kind path-problem
+ * @problem.severity warning
+ * @precision high
+ * @id java/permissive-dot-regex
+ * @tags security
+ *       external/cwe-625
+ *       external/cwe-863
+ */
+
+import java
+import semmle.code.java.dataflow.FlowSources
+import DataFlow::PathGraph
+import PermissiveDotRegexQuery
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, MatchRegexConfiguration conf
+where conf.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "Potentially authentication bypass due to $@.",
+  source.getNode(), "user-provided value"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegexQuery.qll b/java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegexQuery.qll
new file mode 100644
index 00000000000..21a44ebbb8f
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegexQuery.qll
@@ -0,0 +1,223 @@
+/** Provides classes related to security-centered regular expression matching. */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+private import semmle.code.java.dataflow.FlowSources
+import experimental.semmle.code.java.security.SpringUrlRedirect
+import semmle.code.java.controlflow.Guards
+import semmle.code.java.security.UrlRedirect
+import Regex
+
+/** A string that ends with `.*` not prefixed with `\`. */
+private class PermissiveDotStr extends StringLiteral {
+  PermissiveDotStr() {
+    exists(string s, int i | this.getValue() = s |
+      s.indexOf(".*") = i and
+      not s.charAt(i - 1) = "\\" and
+      s.length() = i + 2
+    )
+  }
+}
+
+/** Remote flow sources obtained from the URI of a servlet request. */
+private class GetServletUriSource extends SourceModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "javax.servlet.http;HttpServletRequest;false;getPathInfo;();;ReturnValue;uri-path;manual",
+        "javax.servlet.http;HttpServletRequest;false;getPathTranslated;();;ReturnValue;uri-path;manual",
+        "javax.servlet.http;HttpServletRequest;false;getRequestURI;();;ReturnValue;uri-path;manual",
+        "javax.servlet.http;HttpServletRequest;false;getRequestURL;();;ReturnValue;uri-path;manual",
+        "javax.servlet.http;HttpServletRequest;false;getServletPath;();;ReturnValue;uri-path;manual"
+      ]
+  }
+}
+
+/** The qualifier of a request dispatch method call. */
+private class UrlDispatchSink extends UrlRedirectSink {
+  UrlDispatchSink() {
+    exists(MethodAccess ma |
+      ma.getMethod() instanceof RequestDispatchMethod and
+      this.asExpr() = ma.getQualifier()
+    )
+  }
+}
+
+/** The `doFilter` method of `javax.servlet.FilterChain`. */
+private class ServletFilterMethod extends Method {
+  ServletFilterMethod() {
+    this.getDeclaringType().getASupertype*().hasQualifiedName("javax.servlet", "FilterChain") and
+    this.hasName("doFilter")
+  }
+}
+
+/** The qualifier of a servlet filter method call. */
+private class UrlFilterSink extends UrlRedirectSink {
+  UrlFilterSink() {
+    exists(MethodAccess ma |
+      ma.getMethod() instanceof ServletFilterMethod and
+      this.asExpr() = ma.getQualifier()
+    )
+  }
+}
+
+/** A Spring framework annotation indicating that a URI is user-provided. */
+private class SpringUriInputAnnotation extends Annotation {
+  SpringUriInputAnnotation() {
+    this.getType()
+        .hasQualifiedName("org.springframework.web.bind.annotation",
+          ["PathVariable", "RequestParam"])
+  }
+}
+
+/** A user-provided URI parameter of a request mapping method. */
+private class SpringUriInputParameterSource extends DataFlow::Node {
+  SpringUriInputParameterSource() {
+    this.asParameter() =
+      any(SpringRequestMappingParameter srmp |
+        srmp.getAnAnnotation() instanceof SpringUriInputAnnotation
+      )
+  }
+}
+
+/**
+ * A data flow sink to construct regular expressions.
+ */
+private class CompileRegexSink extends DataFlow::ExprNode {
+  CompileRegexSink() {
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
+      (
+        ma.getArgument(0) = this.asExpr() and
+        (
+          m instanceof StringMatchMethod // input.matches(regexPattern)
+          or
+          m instanceof PatternCompileMethod // p = Pattern.compile(regexPattern)
+          or
+          m instanceof PatternMatchMethod // p = Pattern.matches(regexPattern, input)
+        )
+      )
+    )
+  }
+}
+
+/**
+ * A data flow configuration for regular expressions that include permissive dots.
+ */
+private class PermissiveDotRegexConfig extends DataFlow2::Configuration {
+  PermissiveDotRegexConfig() { this = "PermissiveDotRegex::PermissiveDotRegexConfig" }
+
+  override predicate isSource(DataFlow2::Node src) { src.asExpr() instanceof PermissiveDotStr }
+
+  override predicate isSink(DataFlow2::Node sink) { sink instanceof CompileRegexSink }
+
+  override predicate isBarrier(DataFlow2::Node node) {
+    exists(
+      MethodAccess ma, Field f // Pattern.compile(PATTERN, Pattern.DOTALL)
+    |
+      ma.getMethod() instanceof PatternCompileMethod and
+      ma.getArgument(1) = f.getAnAccess() and
+      f.hasName("DOTALL") and
+      f.getDeclaringType() instanceof Pattern and
+      node.asExpr() = ma.getArgument(0)
+    )
+  }
+}
+
+/**
+ * A taint-tracking configuration for untrusted user input used to match regular expressions
+ * that include permissive dots.
+ */
+class MatchRegexConfiguration extends TaintTracking::Configuration {
+  MatchRegexConfiguration() { this = "PermissiveDotRegex::MatchRegexConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    sourceNode(source, "uri-path") or // Servlet uri source
+    source instanceof SpringUriInputParameterSource // Spring uri source
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink instanceof MatchRegexSink and
+    exists(
+      Guard guard, Expr se, Expr ce // used in a condition to control url redirect, which is a typical security enforcement
+    |
+      (
+        sink.asExpr() = ce.(MethodAccess).getQualifier() or
+        sink.asExpr() = ce.(MethodAccess).getAnArgument() or
+        sink.asExpr() = ce
+      ) and
+      (
+        DataFlow::localExprFlow(ce, guard.(MethodAccess).getQualifier()) or
+        DataFlow::localExprFlow(ce, guard.(MethodAccess).getAnArgument())
+      ) and
+      (
+        DataFlow::exprNode(se) instanceof UrlRedirectSink or
+        DataFlow::exprNode(se) instanceof SpringUrlRedirectSink
+      ) and
+      guard.controls(se.getBasicBlock(), true)
+    ) and
+    exists(MethodAccess ma | any(PermissiveDotRegexConfig conf2).hasFlowToExpr(ma.getArgument(0)) |
+      // input.matches(regexPattern)
+      ma.getMethod() instanceof StringMatchMethod and
+      ma.getQualifier() = sink.asExpr()
+      or
+      // p = Pattern.compile(regexPattern); p.matcher(input)
+      ma.getMethod() instanceof PatternCompileMethod and
+      exists(MethodAccess pma |
+        pma.getMethod() instanceof PatternMatcherMethod and
+        sink.asExpr() = pma.getArgument(0) and
+        DataFlow::localExprFlow(ma, pma.getQualifier())
+      )
+      or
+      // p = Pattern.matches(regexPattern, input)
+      ma.getMethod() instanceof PatternMatchMethod and
+      sink.asExpr() = ma.getArgument(1)
+    )
+  }
+}
+
+/**
+ * A data flow sink representing a string being matched against a regular expression.
+ */
+abstract class MatchRegexSink extends DataFlow::ExprNode { }
+
+/**
+ * A string being matched against a regular expression.
+ */
+private class StringMatchRegexSink extends MatchRegexSink {
+  StringMatchRegexSink() {
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
+      (
+        m instanceof StringMatchMethod and
+        ma.getQualifier() = this.asExpr()
+      )
+    )
+  }
+}
+
+/**
+ * A string being matched against a regular expression using a pattern.
+ */
+private class PatternMatchRegexSink extends MatchRegexSink {
+  PatternMatchRegexSink() {
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
+      (
+        m instanceof PatternMatchMethod and
+        ma.getArgument(1) = this.asExpr()
+      )
+    )
+  }
+}
+
+/**
+ * A string being used to create a pattern matcher.
+ */
+private class PatternMatcherRegexSink extends MatchRegexSink {
+  PatternMatcherRegexSink() {
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
+      (
+        m instanceof PatternMatcherMethod and
+        ma.getArgument(0) = this.asExpr()
+      )
+    )
+  }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-625/Regex.qll b/java/ql/src/experimental/Security/CWE/CWE-625/Regex.qll
new file mode 100644
index 00000000000..8287eb78fb2
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-625/Regex.qll
@@ -0,0 +1,50 @@
+/** Provides methods related to regular expression matching. */
+
+import java
+
+/**
+ * The class `java.util.regex.Pattern`.
+ */
+class Pattern extends RefType {
+  Pattern() { this.hasQualifiedName("java.util.regex", "Pattern") }
+}
+
+/**
+ * The method `compile` of `java.util.regex.Pattern`.
+ */
+class PatternCompileMethod extends Method {
+  PatternCompileMethod() {
+    this.getDeclaringType().getASupertype*() instanceof Pattern and
+    this.hasName("compile")
+  }
+}
+
+/**
+ * The method `matches` of `java.util.regex.Pattern`.
+ */
+class PatternMatchMethod extends Method {
+  PatternMatchMethod() {
+    this.getDeclaringType().getASupertype*() instanceof Pattern and
+    this.hasName("matches")
+  }
+}
+
+/**
+ * The method `matcher` of `java.util.regex.Pattern`.
+ */
+class PatternMatcherMethod extends Method {
+  PatternMatcherMethod() {
+    this.getDeclaringType().getASupertype*() instanceof Pattern and
+    this.hasName("matcher")
+  }
+}
+
+/**
+ * The method `matches` of `java.lang.String`.
+ */
+class StringMatchMethod extends Method {
+  StringMatchMethod() {
+    this.getDeclaringType().getASupertype*() instanceof TypeString and
+    this.hasName("matches")
+  }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-730/RegexInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-730/RegexInjection.ql
index 3b8b5dc759a..f60e5d9070b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-730/RegexInjection.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-730/RegexInjection.ql
@@ -85,5 +85,5 @@ class RegexInjectionConfiguration extends TaintTracking::Configuration {
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, RegexInjectionConfiguration c
 where c.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ is user controlled.", source.getNode(),
-  "This regular expression pattern"
+select sink.getNode(), source, sink, "This regular expression is constructed from a $@.",
+  source.getNode(), "user-provided value"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql b/java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql
index b737c460fa9..9793430a2ee 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql
@@ -21,8 +21,8 @@ import DataFlow::PathGraph
 /**
  * Taint configuration tracking flow from untrusted inputs to number conversion calls in exported Android compononents.
  */
-class NFELocalDoSConfiguration extends TaintTracking::Configuration {
-  NFELocalDoSConfiguration() { this = "NFELocalDoSConfiguration" }
+class NfeLocalDoSConfiguration extends TaintTracking::Configuration {
+  NfeLocalDoSConfiguration() { this = "NFELocalDoSConfiguration" }
 
   /** Holds if source is a remote flow source */
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
@@ -31,17 +31,17 @@ class NFELocalDoSConfiguration extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) {
     exists(Expr e |
       e.getEnclosingCallable().getDeclaringType().(ExportableAndroidComponent).isExported() and
-      throwsNFE(e) and
+      throwsNfe(e) and
       not exists(TryStmt t |
         t.getBlock() = e.getAnEnclosingStmt() and
-        catchesNFE(t)
+        catchesNfe(t)
       ) and
       sink.asExpr() = e
     )
   }
 }
 
-from DataFlow::PathNode source, DataFlow::PathNode sink, NFELocalDoSConfiguration conf
+from DataFlow::PathNode source, DataFlow::PathNode sink, NfeLocalDoSConfiguration conf
 where conf.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
   "Uncaught NumberFormatException in an exported Android component due to $@.", source.getNode(),
diff --git a/java/ql/src/experimental/semmle/code/java/frameworks/FreeMarker.qll b/java/ql/src/experimental/semmle/code/java/frameworks/FreeMarker.qll
deleted file mode 100644
index 84cea7f013e..00000000000
--- a/java/ql/src/experimental/semmle/code/java/frameworks/FreeMarker.qll
+++ /dev/null
@@ -1,29 +0,0 @@
-/** Definitions related to the FreeMarker Templating library. */
-
-import java
-
-/** The `Template` class of the FreeMarker Template Engine */
-class TypeFreeMarkerTemplate extends Class {
-  TypeFreeMarkerTemplate() { this.hasQualifiedName("freemarker.template", "Template") }
-}
-
-/** The `process` method of the FreeMarker Template Engine's `Template` class */
-class MethodFreeMarkerTemplateProcess extends Method {
-  MethodFreeMarkerTemplateProcess() {
-    this.getDeclaringType() instanceof TypeFreeMarkerTemplate and
-    this.hasName("process")
-  }
-}
-
-/** The `StringTemplateLoader` class of the FreeMarker Template Engine */
-class TypeFreeMarkerStringLoader extends Class {
-  TypeFreeMarkerStringLoader() { this.hasQualifiedName("freemarker.cache", "StringTemplateLoader") }
-}
-
-/** The `process` method of the FreeMarker Template Engine's `StringTemplateLoader` class */
-class MethodFreeMarkerStringTemplateLoaderPutTemplate extends Method {
-  MethodFreeMarkerStringTemplateLoaderPutTemplate() {
-    this.getDeclaringType() instanceof TypeFreeMarkerStringLoader and
-    this.hasName("putTemplate")
-  }
-}
diff --git a/java/ql/src/experimental/semmle/code/java/frameworks/JinJava.qll b/java/ql/src/experimental/semmle/code/java/frameworks/JinJava.qll
deleted file mode 100644
index f0f3bcf603b..00000000000
--- a/java/ql/src/experimental/semmle/code/java/frameworks/JinJava.qll
+++ /dev/null
@@ -1,24 +0,0 @@
-/** Definitions related to the Jinjava Templating library. */
-
-import java
-
-/** The `Jinjava` class of the Jinjava Templating Engine. */
-class TypeJinjava extends Class {
-  TypeJinjava() { this.hasQualifiedName("com.hubspot.jinjava", "Jinjava") }
-}
-
-/** The `render` method of the Jinjava Templating Engine. */
-class MethodJinjavaRender extends Method {
-  MethodJinjavaRender() {
-    this.getDeclaringType() instanceof TypeJinjava and
-    this.hasName("render")
-  }
-}
-
-/** The `render` method of the Jinjava Templating Engine. */
-class MethodJinjavaRenderForResult extends Method {
-  MethodJinjavaRenderForResult() {
-    this.getDeclaringType() instanceof TypeJinjava and
-    this.hasName("renderForResult")
-  }
-}
diff --git a/java/ql/src/experimental/semmle/code/java/frameworks/Pebble.qll b/java/ql/src/experimental/semmle/code/java/frameworks/Pebble.qll
deleted file mode 100644
index 9850e5dbf4d..00000000000
--- a/java/ql/src/experimental/semmle/code/java/frameworks/Pebble.qll
+++ /dev/null
@@ -1,16 +0,0 @@
-/** Definitions related to the Pebble Templating library. */
-
-import java
-
-/** The `PebbleEngine` class of the Pebble Templating Engine. */
-class TypePebbleEngine extends Class {
-  TypePebbleEngine() { this.hasQualifiedName("com.mitchellbosecke.pebble", "PebbleEngine") }
-}
-
-/** The `getTemplate` method of the Pebble Templating Engine. */
-class MethodPebbleGetTemplate extends Method {
-  MethodPebbleGetTemplate() {
-    this.getDeclaringType() instanceof TypePebbleEngine and
-    this.hasName(["getTemplate", "getLiteralTemplate"])
-  }
-}
diff --git a/java/ql/src/experimental/semmle/code/java/frameworks/Thymeleaf.qll b/java/ql/src/experimental/semmle/code/java/frameworks/Thymeleaf.qll
deleted file mode 100644
index e93f2739be1..00000000000
--- a/java/ql/src/experimental/semmle/code/java/frameworks/Thymeleaf.qll
+++ /dev/null
@@ -1,25 +0,0 @@
-/** Definitions related to the Thymeleaf Templating library. */
-
-import java
-
-/**
- * A class implementing the `ITemplateEngine` interface of the Thymeleaf
- * Templating Engine such as the `TemplateEngine` class.
- */
-class TypeThymeleafTemplateEngine extends Class {
-  TypeThymeleafTemplateEngine() {
-    this.hasQualifiedName("org.thymeleaf", "TemplateEngine")
-    or
-    exists(Type t | this.getASupertype*().extendsOrImplements(t) |
-      t.hasName("org.thymeleaf.ITemplateEngine")
-    )
-  }
-}
-
-/** The `process` or `processThrottled` method of the Thymeleaf Templating Engine. */
-class MethodThymeleafProcess extends Method {
-  MethodThymeleafProcess() {
-    this.getDeclaringType() instanceof TypeThymeleafTemplateEngine and
-    this.hasName(["process", "processThrottled"])
-  }
-}
diff --git a/java/ql/src/experimental/semmle/code/java/frameworks/Velocity.qll b/java/ql/src/experimental/semmle/code/java/frameworks/Velocity.qll
deleted file mode 100644
index f2d298833c6..00000000000
--- a/java/ql/src/experimental/semmle/code/java/frameworks/Velocity.qll
+++ /dev/null
@@ -1,119 +0,0 @@
-/** Definitions related to the Apache Velocity Templating library. */
-
-import java
-
-/** The `org.apache.velocity.context.AbstractContext` class of the Velocity Templating Engine. */
-class TypeVelocityAbstractContext extends Class {
-  TypeVelocityAbstractContext() {
-    this.hasQualifiedName("org.apache.velocity.context", "AbstractContext")
-  }
-}
-
-/** The `org.apache.velocity.runtime.RuntimeServices` class of the Velocity Templating Engine. */
-class TypeVelocityRuntimeRuntimeServices extends Class {
-  TypeVelocityRuntimeRuntimeServices() {
-    this.hasQualifiedName("org.apache.velocity.runtime", "RuntimeServices")
-  }
-}
-
-/** The `org.apache.velocity.Template` class of the Velocity Templating Engine. */
-class TypeVelocityTemplate extends Class {
-  TypeVelocityTemplate() { this.hasQualifiedName("org.apache.velocity", "Template") }
-}
-
-/** The `org.apache.velocity.runtime.RuntimeSingleton` classTemplating Engine. */
-class TypeVelocityRuntimeRuntimeSingleton extends Class {
-  TypeVelocityRuntimeRuntimeSingleton() {
-    this.hasQualifiedName("org.apache.velocity.runtime", "RuntimeSingleton")
-  }
-}
-
-/** The `org.apache.velocity.VelocityEngine` class of the Velocity Templating Engine. */
-class TypeVelocityVelocityEngine extends Class {
-  TypeVelocityVelocityEngine() { this.hasQualifiedName("org.apache.velocity", "VelocityEngine") }
-}
-
-/** The `org.apache.velocity.app.VelocityEngine` class of the Velocity Templating Engine. */
-class TypeVelocityAppVelocityEngine extends RefType {
-  TypeVelocityAppVelocityEngine() {
-    this.hasQualifiedName("org.apache.velocity.app", "VelocityEngine")
-  }
-}
-
-/** The `org.apache.velocity.app.Velocity` class of the Velocity Templating Engine. */
-class TypeVelocityAppVelocity extends RefType {
-  TypeVelocityAppVelocity() { this.hasQualifiedName("org.apache.velocity.app", "Velocity") }
-}
-
-/**
- * The `org.apache.velocity.runtime.resource.util.StringResourceRepository` interface
- * of the Velocity Templating Engine.
- */
-class TypeVelocityStringResourceRepo extends RefType {
-  TypeVelocityStringResourceRepo() {
-    this.hasQualifiedName("org.apache.velocity.runtime.resource.util", "StringResourceRepository")
-  }
-}
-
-/** The `internalPut` and `put` methods of the Velocity Templating Engine. */
-class MethodVelocityContextPut extends Method {
-  MethodVelocityContextPut() {
-    this.getDeclaringType().getASupertype*() instanceof TypeVelocityAbstractContext and
-    this.hasName(["put", "internalPut"])
-  }
-}
-
-/** The `evaluate` method of the Velocity Templating Engine. */
-class MethodVelocityEvaluate extends Method {
-  MethodVelocityEvaluate() {
-    // static boolean evaluate(Context context, Writer out, String logTag, String instring)
-    // static boolean evaluate(Context context, Writer writer, String logTag, Reader reader)
-    (
-      this.getDeclaringType() instanceof TypeVelocityAppVelocity or
-      this.getDeclaringType() instanceof TypeVelocityAppVelocityEngine or
-      this.getDeclaringType().getASupertype*() instanceof TypeVelocityRuntimeRuntimeServices
-    ) and
-    this.hasName("evaluate")
-  }
-}
-
-/** The `mergeTemplate` method of the Velocity Templating Engine. */
-class MethodVelocityMergeTemplate extends Method {
-  MethodVelocityMergeTemplate() {
-    // static boolean	mergeTemplate(String templateName, String encoding, Context context, Writer writer)
-    (
-      this.getDeclaringType() instanceof TypeVelocityAppVelocity or
-      this.getDeclaringType() instanceof TypeVelocityAppVelocityEngine
-    ) and
-    this.hasName("mergeTemplate")
-  }
-}
-
-/** The `merge` method of the Velocity Templating Engine. */
-class MethodVelocityMerge extends Method {
-  MethodVelocityMerge() {
-    // void merge(Context context, Writer writer)
-    // void merge(Context context, Writer writer, List<String> macroLibraries)
-    this.getDeclaringType() instanceof TypeVelocityTemplate and
-    this.hasName("merge")
-  }
-}
-
-/** The `parse` method of the Velocity Templating Engine. */
-class MethodVelocityParse extends Method {
-  MethodVelocityParse() {
-    (
-      this.getDeclaringType().getASupertype*() instanceof TypeVelocityRuntimeRuntimeSingleton or
-      this.getDeclaringType().getASupertype*() instanceof TypeVelocityRuntimeRuntimeServices
-    ) and
-    this.hasName("parse")
-  }
-}
-
-/** The `putStringResource` method of the Velocity Templating Engine. */
-class MethodVelocityPutStringResource extends Method {
-  MethodVelocityPutStringResource() {
-    this.getDeclaringType().getASupertype*() instanceof TypeVelocityStringResourceRepo and
-    this.hasName("putStringResource")
-  }
-}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-601/SpringUrlRedirect.qll b/java/ql/src/experimental/semmle/code/java/security/SpringUrlRedirect.qll
similarity index 91%
rename from java/ql/src/experimental/Security/CWE/CWE-601/SpringUrlRedirect.qll
rename to java/ql/src/experimental/semmle/code/java/security/SpringUrlRedirect.qll
index 1aded71c661..8a91ff5dcf0 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-601/SpringUrlRedirect.qll
+++ b/java/ql/src/experimental/semmle/code/java/security/SpringUrlRedirect.qll
@@ -1,9 +1,7 @@
-import java
-import DataFlow
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.DataFlow2
-import semmle.code.java.dataflow.TaintTracking
-import semmle.code.java.frameworks.spring.SpringController
+/** Provides classes and predicates related to Spring URL redirect. */
+
+private import java
+private import semmle.code.java.dataflow.FlowSources
 
 /**
  * A concatenate expression using the string `redirect:` or `ajaxredirect:` or `forward:` on the left.
@@ -42,6 +40,13 @@ abstract class SpringUrlRedirectSink extends DataFlow::Node { }
  */
 private class SpringViewUrlRedirectSink extends SpringUrlRedirectSink {
   SpringViewUrlRedirectSink() {
+    // Hardcoded redirect such as "redirect:login"
+    this.asExpr()
+        .(CompileTimeConstantExpr)
+        .getStringValue()
+        .indexOf(["redirect:", "ajaxredirect:", "forward:"]) = 0 and
+    any(SpringRequestMappingMethod sqmm).polyCalls*(this.getEnclosingCallable())
+    or
     exists(RedirectBuilderExpr rbe |
       rbe.getRightOperand() = this.asExpr() and
       any(SpringRequestMappingMethod sqmm).polyCalls*(this.getEnclosingCallable())
diff --git a/java/ql/src/utils/model-generator/CaptureNegativeSummaryModels.ql b/java/ql/src/utils/model-generator/CaptureNegativeSummaryModels.ql
index 60bf8351de2..49ed16aa1dc 100644
--- a/java/ql/src/utils/model-generator/CaptureNegativeSummaryModels.ql
+++ b/java/ql/src/utils/model-generator/CaptureNegativeSummaryModels.ql
@@ -6,9 +6,9 @@
  * @tags model-generator
  */
 
-private import internal.CaptureModels
-private import internal.CaptureSummaryFlow
+import internal.CaptureModels
+import internal.CaptureSummaryFlow
 
-from TargetApi api, string noflow
+from DataFlowTargetApi api, string noflow
 where noflow = captureNoFlow(api)
 select noflow order by noflow
diff --git a/java/ql/src/utils/model-generator/CaptureSinkModels.ql b/java/ql/src/utils/model-generator/CaptureSinkModels.ql
index 405b9fab772..154c87928fc 100644
--- a/java/ql/src/utils/model-generator/CaptureSinkModels.ql
+++ b/java/ql/src/utils/model-generator/CaptureSinkModels.ql
@@ -6,8 +6,8 @@
  * @tags model-generator
  */
 
-private import internal.CaptureModels
+import internal.CaptureModels
 
-from TargetApi api, string sink
+from DataFlowTargetApi api, string sink
 where sink = captureSink(api)
 select sink order by sink
diff --git a/java/ql/src/utils/model-generator/CaptureSourceModels.ql b/java/ql/src/utils/model-generator/CaptureSourceModels.ql
index d37cf5e78fb..8c7de037a90 100644
--- a/java/ql/src/utils/model-generator/CaptureSourceModels.ql
+++ b/java/ql/src/utils/model-generator/CaptureSourceModels.ql
@@ -6,8 +6,8 @@
  * @tags model-generator
  */
 
-private import internal.CaptureModels
+import internal.CaptureModels
 
-from TargetApi api, string source
+from DataFlowTargetApi api, string source
 where source = captureSource(api)
 select source order by source
diff --git a/java/ql/src/utils/model-generator/CaptureSummaryModels.ql b/java/ql/src/utils/model-generator/CaptureSummaryModels.ql
index a4eaea9c4e8..981c6fe73fc 100644
--- a/java/ql/src/utils/model-generator/CaptureSummaryModels.ql
+++ b/java/ql/src/utils/model-generator/CaptureSummaryModels.ql
@@ -6,9 +6,9 @@
  * @tags model-generator
  */
 
-private import internal.CaptureModels
-private import internal.CaptureSummaryFlow
+import internal.CaptureModels
+import internal.CaptureSummaryFlow
 
-from TargetApi api, string flow
+from DataFlowTargetApi api, string flow
 where flow = captureFlow(api)
 select flow order by flow
diff --git a/java/ql/src/utils/model-generator/internal/CaptureModels.qll b/java/ql/src/utils/model-generator/internal/CaptureModels.qll
index 2547b058e18..82c6fbd1bbb 100644
--- a/java/ql/src/utils/model-generator/internal/CaptureModels.qll
+++ b/java/ql/src/utils/model-generator/internal/CaptureModels.qll
@@ -5,7 +5,9 @@
 
 private import CaptureModelsSpecific
 
-class TargetApi = TargetApiSpecific;
+class DataFlowTargetApi extends TargetApiSpecific {
+  DataFlowTargetApi() { isRelevantForDataFlowModels(this) }
+}
 
 /**
  * Holds if data can flow from `node1` to `node2` either via a read or a write of an intermediate field `f`.
@@ -40,7 +42,7 @@ private predicate isRelevantContent(DataFlow::Content c) {
  * Gets the summary model for `api` with `input`, `output` and `kind`.
  */
 bindingset[input, output, kind]
-private string asSummaryModel(TargetApi api, string input, string output, string kind) {
+private string asSummaryModel(TargetApiSpecific api, string input, string output, string kind) {
   result =
     asPartialModel(api) + input + ";" //
       + output + ";" //
@@ -48,13 +50,15 @@ private string asSummaryModel(TargetApi api, string input, string output, string
       + "generated"
 }
 
-string asNegativeSummaryModel(TargetApi api) { result = asPartialNegativeModel(api) + "generated" }
+string asNegativeSummaryModel(TargetApiSpecific api) {
+  result = asPartialNegativeModel(api) + "generated"
+}
 
 /**
  * Gets the value summary model for `api` with `input` and `output`.
  */
 bindingset[input, output]
-private string asValueModel(TargetApi api, string input, string output) {
+string asValueModel(TargetApiSpecific api, string input, string output) {
   result = asSummaryModel(api, input, output, "value")
 }
 
@@ -62,7 +66,7 @@ private string asValueModel(TargetApi api, string input, string output) {
  * Gets the taint summary model for `api` with `input` and `output`.
  */
 bindingset[input, output]
-private string asTaintModel(TargetApi api, string input, string output) {
+private string asTaintModel(TargetApiSpecific api, string input, string output) {
   result = asSummaryModel(api, input, output, "taint")
 }
 
@@ -70,7 +74,7 @@ private string asTaintModel(TargetApi api, string input, string output) {
  * Gets the sink model for `api` with `input` and `kind`.
  */
 bindingset[input, kind]
-private string asSinkModel(TargetApi api, string input, string kind) {
+private string asSinkModel(TargetApiSpecific api, string input, string kind) {
   result =
     asPartialModel(api) + input + ";" //
       + kind + ";" //
@@ -81,7 +85,7 @@ private string asSinkModel(TargetApi api, string input, string kind) {
  * Gets the source model for `api` with `output` and `kind`.
  */
 bindingset[output, kind]
-private string asSourceModel(TargetApi api, string output, string kind) {
+private string asSourceModel(TargetApiSpecific api, string output, string kind) {
   result =
     asPartialModel(api) + output + ";" //
       + kind + ";" //
@@ -91,7 +95,7 @@ private string asSourceModel(TargetApi api, string output, string kind) {
 /**
  * Gets the summary model of `api`, if it follows the `fluent` programming pattern (returns `this`).
  */
-string captureQualifierFlow(TargetApi api) {
+string captureQualifierFlow(TargetApiSpecific api) {
   exists(DataFlowImplCommon::ReturnNodeExt ret |
     api = returnNodeEnclosingCallable(ret) and
     isOwnInstanceAccessNode(ret)
@@ -140,7 +144,7 @@ private class ThroughFlowConfig extends TaintTracking::Configuration {
 
   override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
     source instanceof DataFlow::ParameterNode and
-    source.getEnclosingCallable() instanceof TargetApi and
+    source.getEnclosingCallable() instanceof DataFlowTargetApi and
     state.(TaintRead).getStep() = 0
   }
 
@@ -184,7 +188,7 @@ private class ThroughFlowConfig extends TaintTracking::Configuration {
 /**
  * Gets the summary model(s) of `api`, if there is flow from parameters to return value or parameter.
  */
-string captureThroughFlow(TargetApi api) {
+string captureThroughFlow(DataFlowTargetApi api) {
   exists(
     ThroughFlowConfig config, DataFlow::ParameterNode p,
     DataFlowImplCommon::ReturnNodeExt returnNodeExt, string input, string output
@@ -211,7 +215,7 @@ private class FromSourceConfiguration extends TaintTracking::Configuration {
   override predicate isSource(DataFlow::Node source) { ExternalFlow::sourceNode(source, _) }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(TargetApi c |
+    exists(DataFlowTargetApi c |
       sink instanceof DataFlowImplCommon::ReturnNodeExt and
       sink.getEnclosingCallable() = c
     )
@@ -229,11 +233,12 @@ private class FromSourceConfiguration extends TaintTracking::Configuration {
 /**
  * Gets the source model(s) of `api`, if there is flow from an existing known source to the return of `api`.
  */
-string captureSource(TargetApi api) {
+string captureSource(DataFlowTargetApi api) {
   exists(DataFlow::Node source, DataFlow::Node sink, FromSourceConfiguration config, string kind |
     config.hasFlow(source, sink) and
     ExternalFlow::sourceNode(source, kind) and
     api = sink.getEnclosingCallable() and
+    isRelevantSourceKind(kind) and
     result = asSourceModel(api, returnNodeAsOutput(sink), kind)
   )
 }
@@ -258,7 +263,7 @@ private class PropagateToSinkConfiguration extends PropagateToSinkConfigurationS
 /**
  * Gets the sink model(s) of `api`, if there is flow from a parameter to an existing known sink.
  */
-string captureSink(TargetApi api) {
+string captureSink(DataFlowTargetApi api) {
   exists(DataFlow::Node src, DataFlow::Node sink, PropagateToSinkConfiguration config, string kind |
     config.hasFlow(src, sink) and
     ExternalFlow::sinkNode(sink, kind) and
diff --git a/java/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll b/java/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll
index 3a900131291..2e630ec5214 100644
--- a/java/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll
+++ b/java/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll
@@ -55,9 +55,15 @@ private predicate isJdkInternal(J::CompilationUnit cu) {
 private predicate isRelevantForModels(J::Callable api) {
   not isInTestFile(api.getCompilationUnit().getFile()) and
   not isJdkInternal(api.getCompilationUnit()) and
-  not api instanceof J::MainMethod
+  not api instanceof J::MainMethod and
+  not api instanceof J::StaticInitializer
 }
 
+/**
+ * Holds if it is relevant to generate models for `api` based on data flow analysis.
+ */
+predicate isRelevantForDataFlowModels = isRelevantForModels/1;
+
 /**
  * A class of Callables that are relevant for generating summary, source and sinks models for.
  *
@@ -259,3 +265,9 @@ predicate isRelevantSinkKind(string kind) {
   not kind.matches("regex-use%") and
   not kind = "write-file"
 }
+
+/**
+ * Holds if `kind` is a relevant source kind for creating source models.
+ */
+bindingset[kind]
+predicate isRelevantSourceKind(string kind) { any() }
diff --git a/java/ql/src/utils/model-generator/internal/CaptureSummaryFlow.qll b/java/ql/src/utils/model-generator/internal/CaptureSummaryFlow.qll
index 196b2189e94..dce9ce9cfef 100644
--- a/java/ql/src/utils/model-generator/internal/CaptureSummaryFlow.qll
+++ b/java/ql/src/utils/model-generator/internal/CaptureSummaryFlow.qll
@@ -67,7 +67,7 @@ private import CaptureModels
  * Captured Model:
  * ```p;Foo;true;addToList;;Argument[0];Argument[1];taint```
  */
-string captureFlow(TargetApi api) {
+string captureFlow(DataFlowTargetApi api) {
   result = captureQualifierFlow(api) or
   result = captureThroughFlow(api)
 }
@@ -76,7 +76,7 @@ string captureFlow(TargetApi api) {
  * Gets the negative summary for `api`, if any.
  * A negative summary is generated, if there does not exist any positive flow.
  */
-string captureNoFlow(TargetApi api) {
+string captureNoFlow(DataFlowTargetApi api) {
   not exists(captureFlow(api)) and
   result = asNegativeSummaryModel(api)
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/TemplateInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/TemplateInjection.expected
deleted file mode 100644
index 9b739f8d1da..00000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-094/TemplateInjection.expected
+++ /dev/null
@@ -1,136 +0,0 @@
-edges
-| FreemarkerSSTI.java:23:17:23:44 | getParameter(...) : String | FreemarkerSSTI.java:24:36:24:39 | code : String |
-| FreemarkerSSTI.java:24:19:24:40 | new StringReader(...) : StringReader | FreemarkerSSTI.java:27:35:27:40 | reader |
-| FreemarkerSSTI.java:24:36:24:39 | code : String | FreemarkerSSTI.java:24:19:24:40 | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:33:17:33:44 | getParameter(...) : String | FreemarkerSSTI.java:34:36:34:39 | code : String |
-| FreemarkerSSTI.java:34:19:34:40 | new StringReader(...) : StringReader | FreemarkerSSTI.java:38:35:38:40 | reader |
-| FreemarkerSSTI.java:34:36:34:39 | code : String | FreemarkerSSTI.java:34:19:34:40 | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:44:17:44:44 | getParameter(...) : String | FreemarkerSSTI.java:45:36:45:39 | code : String |
-| FreemarkerSSTI.java:45:19:45:40 | new StringReader(...) : StringReader | FreemarkerSSTI.java:50:35:50:40 | reader |
-| FreemarkerSSTI.java:45:36:45:39 | code : String | FreemarkerSSTI.java:45:19:45:40 | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:56:23:56:56 | getParameter(...) : String | FreemarkerSSTI.java:61:35:61:44 | sourceCode |
-| FreemarkerSSTI.java:67:17:67:44 | getParameter(...) : String | FreemarkerSSTI.java:69:36:69:39 | code : String |
-| FreemarkerSSTI.java:69:19:69:40 | new StringReader(...) : StringReader | FreemarkerSSTI.java:73:47:73:52 | reader |
-| FreemarkerSSTI.java:69:36:69:39 | code : String | FreemarkerSSTI.java:69:19:69:40 | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:79:17:79:44 | getParameter(...) : String | FreemarkerSSTI.java:82:36:82:39 | code : String |
-| FreemarkerSSTI.java:82:19:82:40 | new StringReader(...) : StringReader | FreemarkerSSTI.java:87:47:87:52 | reader |
-| FreemarkerSSTI.java:82:36:82:39 | code : String | FreemarkerSSTI.java:82:19:82:40 | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:93:17:93:44 | getParameter(...) : String | FreemarkerSSTI.java:96:36:96:39 | code : String |
-| FreemarkerSSTI.java:96:19:96:40 | new StringReader(...) : StringReader | FreemarkerSSTI.java:100:47:100:52 | reader |
-| FreemarkerSSTI.java:96:36:96:39 | code : String | FreemarkerSSTI.java:96:19:96:40 | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:105:17:105:44 | getParameter(...) : String | FreemarkerSSTI.java:109:42:109:45 | code |
-| FreemarkerSSTI.java:114:17:114:44 | getParameter(...) : String | FreemarkerSSTI.java:119:42:119:45 | code |
-| FreemarkerSSTI.java:125:17:125:44 | getParameter(...) : String | FreemarkerSSTI.java:126:26:126:29 | code : String |
-| FreemarkerSSTI.java:126:9:126:12 | root [post update] [<map.value>] : String | FreemarkerSSTI.java:130:22:130:25 | root |
-| FreemarkerSSTI.java:126:26:126:29 | code : String | FreemarkerSSTI.java:126:9:126:12 | root [post update] [<map.value>] : String |
-| JinJavaSSTI.java:21:21:21:52 | getParameter(...) : String | JinJavaSSTI.java:25:44:25:51 | template |
-| JinJavaSSTI.java:30:21:30:52 | getParameter(...) : String | JinJavaSSTI.java:34:55:34:62 | template |
-| JinJavaSSTI.java:39:21:39:52 | getParameter(...) : String | JinJavaSSTI.java:46:55:46:62 | template |
-| PebbleSSTI.java:18:17:18:44 | getParameter(...) : String | PebbleSSTI.java:21:56:21:59 | code |
-| PebbleSSTI.java:25:17:25:44 | getParameter(...) : String | PebbleSSTI.java:28:63:28:66 | code |
-| ThymeleafSSTI.java:22:17:22:44 | getParameter(...) : String | ThymeleafSSTI.java:27:27:27:30 | code |
-| VelocitySSTI.java:31:17:31:44 | getParameter(...) : String | VelocitySSTI.java:38:45:38:48 | code |
-| VelocitySSTI.java:44:17:44:44 | getParameter(...) : String | VelocitySSTI.java:50:42:50:45 | code : String |
-| VelocitySSTI.java:50:25:50:46 | new StringReader(...) : StringReader | VelocitySSTI.java:53:45:53:50 | reader |
-| VelocitySSTI.java:50:42:50:45 | code : String | VelocitySSTI.java:50:25:50:46 | new StringReader(...) : StringReader |
-| VelocitySSTI.java:59:17:59:44 | getParameter(...) : String | VelocitySSTI.java:62:42:62:45 | code : String |
-| VelocitySSTI.java:62:25:62:46 | new StringReader(...) : StringReader | VelocitySSTI.java:63:25:63:30 | reader |
-| VelocitySSTI.java:62:42:62:45 | code : String | VelocitySSTI.java:62:25:62:46 | new StringReader(...) : StringReader |
-| VelocitySSTI.java:69:17:69:44 | getParameter(...) : String | VelocitySSTI.java:77:21:77:27 | context |
-| VelocitySSTI.java:83:17:83:44 | getParameter(...) : String | VelocitySSTI.java:89:60:89:66 | context |
-| VelocitySSTI.java:95:17:95:44 | getParameter(...) : String | VelocitySSTI.java:102:11:102:17 | context |
-| VelocitySSTI.java:108:17:108:44 | getParameter(...) : String | VelocitySSTI.java:115:11:115:17 | context |
-| VelocitySSTI.java:120:17:120:44 | getParameter(...) : String | VelocitySSTI.java:123:37:123:40 | code |
-nodes
-| FreemarkerSSTI.java:23:17:23:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| FreemarkerSSTI.java:24:19:24:40 | new StringReader(...) : StringReader | semmle.label | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:24:36:24:39 | code : String | semmle.label | code : String |
-| FreemarkerSSTI.java:27:35:27:40 | reader | semmle.label | reader |
-| FreemarkerSSTI.java:33:17:33:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| FreemarkerSSTI.java:34:19:34:40 | new StringReader(...) : StringReader | semmle.label | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:34:36:34:39 | code : String | semmle.label | code : String |
-| FreemarkerSSTI.java:38:35:38:40 | reader | semmle.label | reader |
-| FreemarkerSSTI.java:44:17:44:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| FreemarkerSSTI.java:45:19:45:40 | new StringReader(...) : StringReader | semmle.label | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:45:36:45:39 | code : String | semmle.label | code : String |
-| FreemarkerSSTI.java:50:35:50:40 | reader | semmle.label | reader |
-| FreemarkerSSTI.java:56:23:56:56 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| FreemarkerSSTI.java:61:35:61:44 | sourceCode | semmle.label | sourceCode |
-| FreemarkerSSTI.java:67:17:67:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| FreemarkerSSTI.java:69:19:69:40 | new StringReader(...) : StringReader | semmle.label | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:69:36:69:39 | code : String | semmle.label | code : String |
-| FreemarkerSSTI.java:73:47:73:52 | reader | semmle.label | reader |
-| FreemarkerSSTI.java:79:17:79:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| FreemarkerSSTI.java:82:19:82:40 | new StringReader(...) : StringReader | semmle.label | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:82:36:82:39 | code : String | semmle.label | code : String |
-| FreemarkerSSTI.java:87:47:87:52 | reader | semmle.label | reader |
-| FreemarkerSSTI.java:93:17:93:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| FreemarkerSSTI.java:96:19:96:40 | new StringReader(...) : StringReader | semmle.label | new StringReader(...) : StringReader |
-| FreemarkerSSTI.java:96:36:96:39 | code : String | semmle.label | code : String |
-| FreemarkerSSTI.java:100:47:100:52 | reader | semmle.label | reader |
-| FreemarkerSSTI.java:105:17:105:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| FreemarkerSSTI.java:109:42:109:45 | code | semmle.label | code |
-| FreemarkerSSTI.java:114:17:114:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| FreemarkerSSTI.java:119:42:119:45 | code | semmle.label | code |
-| FreemarkerSSTI.java:125:17:125:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| FreemarkerSSTI.java:126:9:126:12 | root [post update] [<map.value>] : String | semmle.label | root [post update] [<map.value>] : String |
-| FreemarkerSSTI.java:126:26:126:29 | code : String | semmle.label | code : String |
-| FreemarkerSSTI.java:130:22:130:25 | root | semmle.label | root |
-| JinJavaSSTI.java:21:21:21:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JinJavaSSTI.java:25:44:25:51 | template | semmle.label | template |
-| JinJavaSSTI.java:30:21:30:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JinJavaSSTI.java:34:55:34:62 | template | semmle.label | template |
-| JinJavaSSTI.java:39:21:39:52 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| JinJavaSSTI.java:46:55:46:62 | template | semmle.label | template |
-| PebbleSSTI.java:18:17:18:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| PebbleSSTI.java:21:56:21:59 | code | semmle.label | code |
-| PebbleSSTI.java:25:17:25:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| PebbleSSTI.java:28:63:28:66 | code | semmle.label | code |
-| ThymeleafSSTI.java:22:17:22:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| ThymeleafSSTI.java:27:27:27:30 | code | semmle.label | code |
-| VelocitySSTI.java:31:17:31:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| VelocitySSTI.java:38:45:38:48 | code | semmle.label | code |
-| VelocitySSTI.java:44:17:44:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| VelocitySSTI.java:50:25:50:46 | new StringReader(...) : StringReader | semmle.label | new StringReader(...) : StringReader |
-| VelocitySSTI.java:50:42:50:45 | code : String | semmle.label | code : String |
-| VelocitySSTI.java:53:45:53:50 | reader | semmle.label | reader |
-| VelocitySSTI.java:59:17:59:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| VelocitySSTI.java:62:25:62:46 | new StringReader(...) : StringReader | semmle.label | new StringReader(...) : StringReader |
-| VelocitySSTI.java:62:42:62:45 | code : String | semmle.label | code : String |
-| VelocitySSTI.java:63:25:63:30 | reader | semmle.label | reader |
-| VelocitySSTI.java:69:17:69:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| VelocitySSTI.java:77:21:77:27 | context | semmle.label | context |
-| VelocitySSTI.java:83:17:83:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| VelocitySSTI.java:89:60:89:66 | context | semmle.label | context |
-| VelocitySSTI.java:95:17:95:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| VelocitySSTI.java:102:11:102:17 | context | semmle.label | context |
-| VelocitySSTI.java:108:17:108:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| VelocitySSTI.java:115:11:115:17 | context | semmle.label | context |
-| VelocitySSTI.java:120:17:120:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
-| VelocitySSTI.java:123:37:123:40 | code | semmle.label | code |
-subpaths
-#select
-| FreemarkerSSTI.java:27:35:27:40 | reader | FreemarkerSSTI.java:23:17:23:44 | getParameter(...) : String | FreemarkerSSTI.java:27:35:27:40 | reader | Potential arbitrary code execution due to $@. | FreemarkerSSTI.java:23:17:23:44 | getParameter(...) | a template value loaded from a remote source. |
-| FreemarkerSSTI.java:38:35:38:40 | reader | FreemarkerSSTI.java:33:17:33:44 | getParameter(...) : String | FreemarkerSSTI.java:38:35:38:40 | reader | Potential arbitrary code execution due to $@. | FreemarkerSSTI.java:33:17:33:44 | getParameter(...) | a template value loaded from a remote source. |
-| FreemarkerSSTI.java:50:35:50:40 | reader | FreemarkerSSTI.java:44:17:44:44 | getParameter(...) : String | FreemarkerSSTI.java:50:35:50:40 | reader | Potential arbitrary code execution due to $@. | FreemarkerSSTI.java:44:17:44:44 | getParameter(...) | a template value loaded from a remote source. |
-| FreemarkerSSTI.java:61:35:61:44 | sourceCode | FreemarkerSSTI.java:56:23:56:56 | getParameter(...) : String | FreemarkerSSTI.java:61:35:61:44 | sourceCode | Potential arbitrary code execution due to $@. | FreemarkerSSTI.java:56:23:56:56 | getParameter(...) | a template value loaded from a remote source. |
-| FreemarkerSSTI.java:73:47:73:52 | reader | FreemarkerSSTI.java:67:17:67:44 | getParameter(...) : String | FreemarkerSSTI.java:73:47:73:52 | reader | Potential arbitrary code execution due to $@. | FreemarkerSSTI.java:67:17:67:44 | getParameter(...) | a template value loaded from a remote source. |
-| FreemarkerSSTI.java:87:47:87:52 | reader | FreemarkerSSTI.java:79:17:79:44 | getParameter(...) : String | FreemarkerSSTI.java:87:47:87:52 | reader | Potential arbitrary code execution due to $@. | FreemarkerSSTI.java:79:17:79:44 | getParameter(...) | a template value loaded from a remote source. |
-| FreemarkerSSTI.java:100:47:100:52 | reader | FreemarkerSSTI.java:93:17:93:44 | getParameter(...) : String | FreemarkerSSTI.java:100:47:100:52 | reader | Potential arbitrary code execution due to $@. | FreemarkerSSTI.java:93:17:93:44 | getParameter(...) | a template value loaded from a remote source. |
-| FreemarkerSSTI.java:109:42:109:45 | code | FreemarkerSSTI.java:105:17:105:44 | getParameter(...) : String | FreemarkerSSTI.java:109:42:109:45 | code | Potential arbitrary code execution due to $@. | FreemarkerSSTI.java:105:17:105:44 | getParameter(...) | a template value loaded from a remote source. |
-| FreemarkerSSTI.java:119:42:119:45 | code | FreemarkerSSTI.java:114:17:114:44 | getParameter(...) : String | FreemarkerSSTI.java:119:42:119:45 | code | Potential arbitrary code execution due to $@. | FreemarkerSSTI.java:114:17:114:44 | getParameter(...) | a template value loaded from a remote source. |
-| FreemarkerSSTI.java:130:22:130:25 | root | FreemarkerSSTI.java:125:17:125:44 | getParameter(...) : String | FreemarkerSSTI.java:130:22:130:25 | root | Potential arbitrary code execution due to $@. | FreemarkerSSTI.java:125:17:125:44 | getParameter(...) | a template value loaded from a remote source. |
-| JinJavaSSTI.java:25:44:25:51 | template | JinJavaSSTI.java:21:21:21:52 | getParameter(...) : String | JinJavaSSTI.java:25:44:25:51 | template | Potential arbitrary code execution due to $@. | JinJavaSSTI.java:21:21:21:52 | getParameter(...) | a template value loaded from a remote source. |
-| JinJavaSSTI.java:34:55:34:62 | template | JinJavaSSTI.java:30:21:30:52 | getParameter(...) : String | JinJavaSSTI.java:34:55:34:62 | template | Potential arbitrary code execution due to $@. | JinJavaSSTI.java:30:21:30:52 | getParameter(...) | a template value loaded from a remote source. |
-| JinJavaSSTI.java:46:55:46:62 | template | JinJavaSSTI.java:39:21:39:52 | getParameter(...) : String | JinJavaSSTI.java:46:55:46:62 | template | Potential arbitrary code execution due to $@. | JinJavaSSTI.java:39:21:39:52 | getParameter(...) | a template value loaded from a remote source. |
-| PebbleSSTI.java:21:56:21:59 | code | PebbleSSTI.java:18:17:18:44 | getParameter(...) : String | PebbleSSTI.java:21:56:21:59 | code | Potential arbitrary code execution due to $@. | PebbleSSTI.java:18:17:18:44 | getParameter(...) | a template value loaded from a remote source. |
-| PebbleSSTI.java:28:63:28:66 | code | PebbleSSTI.java:25:17:25:44 | getParameter(...) : String | PebbleSSTI.java:28:63:28:66 | code | Potential arbitrary code execution due to $@. | PebbleSSTI.java:25:17:25:44 | getParameter(...) | a template value loaded from a remote source. |
-| ThymeleafSSTI.java:27:27:27:30 | code | ThymeleafSSTI.java:22:17:22:44 | getParameter(...) : String | ThymeleafSSTI.java:27:27:27:30 | code | Potential arbitrary code execution due to $@. | ThymeleafSSTI.java:22:17:22:44 | getParameter(...) | a template value loaded from a remote source. |
-| VelocitySSTI.java:38:45:38:48 | code | VelocitySSTI.java:31:17:31:44 | getParameter(...) : String | VelocitySSTI.java:38:45:38:48 | code | Potential arbitrary code execution due to $@. | VelocitySSTI.java:31:17:31:44 | getParameter(...) | a template value loaded from a remote source. |
-| VelocitySSTI.java:53:45:53:50 | reader | VelocitySSTI.java:44:17:44:44 | getParameter(...) : String | VelocitySSTI.java:53:45:53:50 | reader | Potential arbitrary code execution due to $@. | VelocitySSTI.java:44:17:44:44 | getParameter(...) | a template value loaded from a remote source. |
-| VelocitySSTI.java:63:25:63:30 | reader | VelocitySSTI.java:59:17:59:44 | getParameter(...) : String | VelocitySSTI.java:63:25:63:30 | reader | Potential arbitrary code execution due to $@. | VelocitySSTI.java:59:17:59:44 | getParameter(...) | a template value loaded from a remote source. |
-| VelocitySSTI.java:77:21:77:27 | context | VelocitySSTI.java:69:17:69:44 | getParameter(...) : String | VelocitySSTI.java:77:21:77:27 | context | Potential arbitrary code execution due to $@. | VelocitySSTI.java:69:17:69:44 | getParameter(...) | a template value loaded from a remote source. |
-| VelocitySSTI.java:89:60:89:66 | context | VelocitySSTI.java:83:17:83:44 | getParameter(...) : String | VelocitySSTI.java:89:60:89:66 | context | Potential arbitrary code execution due to $@. | VelocitySSTI.java:83:17:83:44 | getParameter(...) | a template value loaded from a remote source. |
-| VelocitySSTI.java:102:11:102:17 | context | VelocitySSTI.java:95:17:95:44 | getParameter(...) : String | VelocitySSTI.java:102:11:102:17 | context | Potential arbitrary code execution due to $@. | VelocitySSTI.java:95:17:95:44 | getParameter(...) | a template value loaded from a remote source. |
-| VelocitySSTI.java:115:11:115:17 | context | VelocitySSTI.java:108:17:108:44 | getParameter(...) : String | VelocitySSTI.java:115:11:115:17 | context | Potential arbitrary code execution due to $@. | VelocitySSTI.java:108:17:108:44 | getParameter(...) | a template value loaded from a remote source. |
-| VelocitySSTI.java:123:37:123:40 | code | VelocitySSTI.java:120:17:120:44 | getParameter(...) : String | VelocitySSTI.java:123:37:123:40 | code | Potential arbitrary code execution due to $@. | VelocitySSTI.java:120:17:120:44 | getParameter(...) | a template value loaded from a remote source. |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/TemplateInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-094/TemplateInjection.qlref
deleted file mode 100644
index 2febc9b780f..00000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-094/TemplateInjection.qlref
+++ /dev/null
@@ -1 +0,0 @@
-experimental/Security/CWE/CWE-094/TemplateInjection.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/ThymeleafSSTI.java b/java/ql/test/experimental/query-tests/security/CWE-094/ThymeleafSSTI.java
deleted file mode 100644
index 2b32a4603c7..00000000000
--- a/java/ql/test/experimental/query-tests/security/CWE-094/ThymeleafSSTI.java
+++ /dev/null
@@ -1,31 +0,0 @@
-import javax.imageio.stream.FileImageInputStream;
-import javax.servlet.http.HttpServletRequest;
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-
-import java.lang.String;
-import java.io.File;
-import java.io.FileWriter;
-import java.io.Reader;
-import java.io.StringReader;
-import java.io.Writer;
-
-import org.thymeleaf.*;
-import org.thymeleaf.context.Context;
-
-@Controller
-public class ThymeleafSSTI {
-	String sourceName = "sourceName";
-
-	@GetMapping(value = "bad1")
-	public void bad1(HttpServletRequest request) {
-		String code = request.getParameter("code");
-		Context ctx = new Context();
-		try {
-			FileWriter fw = new FileWriter(new File("as"));
-			TemplateEngine templateEngine = new TemplateEngine();
-			templateEngine.process(code, ctx, fw);
-		} catch (Exception e) {
-		}
-	}
-}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected b/java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected
index fac44a3c2ec..c6e5515918f 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/PasswordInConfigurationFile.expected
@@ -1,3 +1,3 @@
-| applicationContext.xml:9:3:9:48 | name=password | Plaintext password in configuration file. |
-| context.xml:4:2:8:50 | password=1234 | Plaintext password in configuration file. |
-| custom-config.xml:3:2:3:137 | value=server=myoracle.example.com;port=1521;database=testdb;username=root;password=test1234 | Plaintext password in configuration file. |
+| applicationContext.xml:9:3:9:48 | name=password | Avoid plaintext passwords in configuration files. |
+| context.xml:4:2:8:50 | password=1234 | Avoid plaintext passwords in configuration files. |
+| custom-config.xml:3:2:3:137 | value=server=myoracle.example.com;port=1521;database=testdb;username=root;password=test1234 | Avoid plaintext passwords in configuration files. |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-625/DotRegexFilter.java b/java/ql/test/experimental/query-tests/security/CWE-625/DotRegexFilter.java
new file mode 100644
index 00000000000..6ce97453d8f
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-625/DotRegexFilter.java
@@ -0,0 +1,70 @@
+import java.io.IOException;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class DotRegexFilter implements Filter {
+	private static final String PROTECTED_PATTERN = "/protected/.*";
+	private static final String CONSTRAINT_PATTERN = "/protected/xyz\\.xml";
+
+	private ServletContext context;
+
+	public void init(FilterConfig config) throws ServletException {
+		this.context = config.getServletContext();
+	}
+
+	// BAD: A string with line return e.g. `/protected/%0dxyz` can bypass the path check
+	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+		HttpServletRequest httpRequest = (HttpServletRequest) request;
+		HttpServletResponse httpResponse = (HttpServletResponse) response;
+		String source = httpRequest.getPathInfo();
+
+		Pattern p = Pattern.compile(PROTECTED_PATTERN);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!httpRequest.getSession().getAttribute("secAttr").equals("secValue")) {
+				// Redirect to the login page
+				httpResponse.sendRedirect("/login.html");
+			} else {
+				// Not protected page - pass the request along the filter chain
+				chain.doFilter(request, response);
+			}
+		}
+	}
+
+	// GOOD: A string with line return e.g. `/protected/%0dxyz` cannot bypass the path check
+	public void doFilter2(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+		HttpServletRequest httpRequest = (HttpServletRequest) request;
+		HttpServletResponse httpResponse = (HttpServletResponse) response;
+		String source = httpRequest.getPathInfo();
+
+		Pattern p = Pattern.compile(CONSTRAINT_PATTERN);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!httpRequest.getSession().getAttribute("secAttr").equals("secValue")) {
+				// Redirect to the login page
+				httpResponse.sendRedirect("/login.html");
+			} else {
+				// Not protected page - pass the request along the filter chain
+				chain.doFilter(request, response);
+			}
+		}
+	}
+
+	public void destroy() {
+		// Close resources
+	}
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-625/DotRegexServlet.java b/java/ql/test/experimental/query-tests/security/CWE-625/DotRegexServlet.java
new file mode 100644
index 00000000000..47d3175afcf
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-625/DotRegexServlet.java
@@ -0,0 +1,150 @@
+import java.io.IOException;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.RequestDispatcher;
+import javax.servlet.ServletException;
+
+public class DotRegexServlet extends HttpServlet {
+	private static final String PROTECTED_PATTERN = "/protected/.*";
+	private static final String CONSTRAINT_PATTERN = "/protected/xyz\\.xml";
+
+	@Override
+	// BAD: A string with line return e.g. `/protected/%0dxyz` can bypass the path check
+	protected void doGet(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		Pattern p = Pattern.compile(PROTECTED_PATTERN);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				response.sendRedirect("/login.html");
+				return;
+			} else {
+				// Not protected page - render content
+			}
+		}
+	}
+
+	// GOOD: A string with line return e.g. `/protected/%0dxyz` cannot bypass the path check
+	protected void doGet2(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		Pattern p = Pattern.compile(PROTECTED_PATTERN, Pattern.DOTALL);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				response.sendRedirect("/login.html");
+				return;
+			} else {
+				// Not protected page - render content
+			}
+		}
+	}
+
+	// BAD: A string with line return e.g. `/protected/%0axyz` can bypass the path check
+	protected void doGet3(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getRequestURI();
+
+		boolean matches = source.matches(PROTECTED_PATTERN);
+
+		if (matches) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				response.sendRedirect("/login.html");
+				return;
+			} else {
+				// Not protected page - render content
+			}
+		}
+	}
+
+	// BAD: A string with line return e.g. `/protected/%0axyz` can bypass the path check
+	protected void doGet4(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		boolean matches = Pattern.matches(PROTECTED_PATTERN, source);
+
+		if (matches) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				response.sendRedirect("/login.html");
+				return;
+			} else {
+				// Not protected page - render content
+			}
+		}
+	}
+
+	// GOOD: Only a specific path can pass the validation
+	protected void doGet5(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		Pattern p = Pattern.compile(CONSTRAINT_PATTERN);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				response.sendRedirect("/login.html");
+				return;
+			} else {
+				// Not protected page - render content
+			}
+		}
+	}
+
+	// BAD: A string with line return e.g. `/protected/%0dxyz` can bypass the path check
+	protected void doGet6(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		Pattern p = Pattern.compile(PROTECTED_PATTERN);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				RequestDispatcher dispatcher = getServletContext().getRequestDispatcher("/login");
+				dispatcher.forward(request, response);
+			} else {
+				// Not protected page - render content
+				RequestDispatcher dispatcher = getServletContext().getRequestDispatcher(source);
+				dispatcher.forward(request, response);
+			}
+		}
+	}
+
+	// GOOD: A string with line return e.g. `/protected/%0dxyz` cannot bypass the path check
+	protected void doGet7(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		Pattern p = Pattern.compile(PROTECTED_PATTERN, Pattern.DOTALL);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				RequestDispatcher dispatcher = getServletContext().getRequestDispatcher("/login");
+				dispatcher.forward(request, response);
+			} else {
+				// Not protected page - render content
+				RequestDispatcher dispatcher = getServletContext().getRequestDispatcher(source);
+				dispatcher.include(request, response);
+			}
+		}
+	}
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-625/DotRegexSpring.java b/java/ql/test/experimental/query-tests/security/CWE-625/DotRegexSpring.java
new file mode 100644
index 00000000000..4651508fe19
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-625/DotRegexSpring.java
@@ -0,0 +1,75 @@
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.servlet.view.RedirectView;
+
+import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+@Controller
+public class DotRegexSpring {
+	private static final String PROTECTED_PATTERN = "/protected/.*";
+	private static final String CONSTRAINT_PATTERN = "/protected/xyz\\.xml";
+	
+	@GetMapping("param")
+	// BAD: A string with line return e.g. `/protected/%0dxyz` can bypass the path check
+	public String withParam(@RequestParam String path, Model model) throws UnsupportedEncodingException {
+		Pattern p = Pattern.compile(PROTECTED_PATTERN);
+		path = decodePath(path);
+		Matcher m = p.matcher(path);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (model.getAttribute("secAttr") == null || !model.getAttribute("secAttr").equals("secValue")) {
+				return "redirect:login";
+			}
+		}
+		// Not protected page - render content
+		return path;
+	}
+
+	@GetMapping("{path}")
+	// BAD: A string with line return e.g. `%252Fprotected%252F%250dxyz` can bypass the path check
+	public RedirectView withPathVariable1(@PathVariable String path, Model model) throws UnsupportedEncodingException {
+		Pattern p = Pattern.compile(PROTECTED_PATTERN);
+		path = decodePath(path);
+		Matcher m = p.matcher(path);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (model.getAttribute("secAttr") == null || !model.getAttribute("secAttr").equals("secValue")) {
+				RedirectView redirectView = new RedirectView("login", true);
+				return redirectView;
+			}
+		}
+		return null;
+	}
+	
+	@GetMapping("/sp/{path}")
+	// GOOD: A string with line return e.g. `%252Fprotected%252F%250dxyz` cannot bypass the path check
+	public String withPathVariable2(@PathVariable String path, Model model) throws UnsupportedEncodingException {
+		Pattern p = Pattern.compile(CONSTRAINT_PATTERN);
+		path = decodePath(path);
+		Matcher m = p.matcher(path);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (model.getAttribute("secAttr") == null || !model.getAttribute("secAttr").equals("secValue")) {
+				return "redirect:login";
+			}	
+		}
+		// Not protected page - render content
+		return path;
+	}
+
+	private String decodePath(String path) throws UnsupportedEncodingException {
+		while (path.indexOf("%") > -1) {
+			path = URLDecoder.decode(path, "UTF-8");
+		}
+		return path;
+	}
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-625/PermissiveDotRegex.expected b/java/ql/test/experimental/query-tests/security/CWE-625/PermissiveDotRegex.expected
new file mode 100644
index 00000000000..c8a387fa33d
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-625/PermissiveDotRegex.expected
@@ -0,0 +1,53 @@
+edges
+| DotRegexFilter.java:29:19:29:43 | getPathInfo(...) : String | DotRegexFilter.java:32:25:32:30 | source |
+| DotRegexServlet.java:19:19:19:39 | getPathInfo(...) : String | DotRegexServlet.java:22:25:22:30 | source |
+| DotRegexServlet.java:57:19:57:41 | getRequestURI(...) : String | DotRegexServlet.java:59:21:59:26 | source |
+| DotRegexServlet.java:75:19:75:39 | getPathInfo(...) : String | DotRegexServlet.java:77:56:77:61 | source |
+| DotRegexServlet.java:112:19:112:39 | getPathInfo(...) : String | DotRegexServlet.java:115:25:115:30 | source |
+| DotRegexSpring.java:20:26:20:50 | path : String | DotRegexSpring.java:22:21:22:24 | path : String |
+| DotRegexSpring.java:22:10:22:25 | decodePath(...) : String | DotRegexSpring.java:23:25:23:28 | path |
+| DotRegexSpring.java:22:21:22:24 | path : String | DotRegexSpring.java:22:10:22:25 | decodePath(...) : String |
+| DotRegexSpring.java:22:21:22:24 | path : String | DotRegexSpring.java:69:28:69:38 | path : String |
+| DotRegexSpring.java:37:40:37:64 | path : String | DotRegexSpring.java:39:21:39:24 | path : String |
+| DotRegexSpring.java:39:10:39:25 | decodePath(...) : String | DotRegexSpring.java:40:25:40:28 | path |
+| DotRegexSpring.java:39:21:39:24 | path : String | DotRegexSpring.java:39:10:39:25 | decodePath(...) : String |
+| DotRegexSpring.java:39:21:39:24 | path : String | DotRegexSpring.java:69:28:69:38 | path : String |
+| DotRegexSpring.java:69:28:69:38 | path : String | DotRegexSpring.java:71:29:71:32 | path : String |
+| DotRegexSpring.java:69:28:69:38 | path : String | DotRegexSpring.java:73:10:73:13 | path : String |
+| DotRegexSpring.java:71:11:71:42 | decode(...) : String | DotRegexSpring.java:71:29:71:32 | path : String |
+| DotRegexSpring.java:71:11:71:42 | decode(...) : String | DotRegexSpring.java:73:10:73:13 | path : String |
+| DotRegexSpring.java:71:29:71:32 | path : String | DotRegexSpring.java:71:11:71:42 | decode(...) : String |
+nodes
+| DotRegexFilter.java:29:19:29:43 | getPathInfo(...) : String | semmle.label | getPathInfo(...) : String |
+| DotRegexFilter.java:32:25:32:30 | source | semmle.label | source |
+| DotRegexServlet.java:19:19:19:39 | getPathInfo(...) : String | semmle.label | getPathInfo(...) : String |
+| DotRegexServlet.java:22:25:22:30 | source | semmle.label | source |
+| DotRegexServlet.java:57:19:57:41 | getRequestURI(...) : String | semmle.label | getRequestURI(...) : String |
+| DotRegexServlet.java:59:21:59:26 | source | semmle.label | source |
+| DotRegexServlet.java:75:19:75:39 | getPathInfo(...) : String | semmle.label | getPathInfo(...) : String |
+| DotRegexServlet.java:77:56:77:61 | source | semmle.label | source |
+| DotRegexServlet.java:112:19:112:39 | getPathInfo(...) : String | semmle.label | getPathInfo(...) : String |
+| DotRegexServlet.java:115:25:115:30 | source | semmle.label | source |
+| DotRegexSpring.java:20:26:20:50 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:22:10:22:25 | decodePath(...) : String | semmle.label | decodePath(...) : String |
+| DotRegexSpring.java:22:21:22:24 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:23:25:23:28 | path | semmle.label | path |
+| DotRegexSpring.java:37:40:37:64 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:39:10:39:25 | decodePath(...) : String | semmle.label | decodePath(...) : String |
+| DotRegexSpring.java:39:21:39:24 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:40:25:40:28 | path | semmle.label | path |
+| DotRegexSpring.java:69:28:69:38 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:71:11:71:42 | decode(...) : String | semmle.label | decode(...) : String |
+| DotRegexSpring.java:71:29:71:32 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:73:10:73:13 | path : String | semmle.label | path : String |
+subpaths
+| DotRegexSpring.java:22:21:22:24 | path : String | DotRegexSpring.java:69:28:69:38 | path : String | DotRegexSpring.java:73:10:73:13 | path : String | DotRegexSpring.java:22:10:22:25 | decodePath(...) : String |
+| DotRegexSpring.java:39:21:39:24 | path : String | DotRegexSpring.java:69:28:69:38 | path : String | DotRegexSpring.java:73:10:73:13 | path : String | DotRegexSpring.java:39:10:39:25 | decodePath(...) : String |
+#select
+| DotRegexFilter.java:32:25:32:30 | source | DotRegexFilter.java:29:19:29:43 | getPathInfo(...) : String | DotRegexFilter.java:32:25:32:30 | source | Potentially authentication bypass due to $@. | DotRegexFilter.java:29:19:29:43 | getPathInfo(...) | user-provided value |
+| DotRegexServlet.java:22:25:22:30 | source | DotRegexServlet.java:19:19:19:39 | getPathInfo(...) : String | DotRegexServlet.java:22:25:22:30 | source | Potentially authentication bypass due to $@. | DotRegexServlet.java:19:19:19:39 | getPathInfo(...) | user-provided value |
+| DotRegexServlet.java:59:21:59:26 | source | DotRegexServlet.java:57:19:57:41 | getRequestURI(...) : String | DotRegexServlet.java:59:21:59:26 | source | Potentially authentication bypass due to $@. | DotRegexServlet.java:57:19:57:41 | getRequestURI(...) | user-provided value |
+| DotRegexServlet.java:77:56:77:61 | source | DotRegexServlet.java:75:19:75:39 | getPathInfo(...) : String | DotRegexServlet.java:77:56:77:61 | source | Potentially authentication bypass due to $@. | DotRegexServlet.java:75:19:75:39 | getPathInfo(...) | user-provided value |
+| DotRegexServlet.java:115:25:115:30 | source | DotRegexServlet.java:112:19:112:39 | getPathInfo(...) : String | DotRegexServlet.java:115:25:115:30 | source | Potentially authentication bypass due to $@. | DotRegexServlet.java:112:19:112:39 | getPathInfo(...) | user-provided value |
+| DotRegexSpring.java:23:25:23:28 | path | DotRegexSpring.java:20:26:20:50 | path : String | DotRegexSpring.java:23:25:23:28 | path | Potentially authentication bypass due to $@. | DotRegexSpring.java:20:26:20:50 | path | user-provided value |
+| DotRegexSpring.java:40:25:40:28 | path | DotRegexSpring.java:37:40:37:64 | path : String | DotRegexSpring.java:40:25:40:28 | path | Potentially authentication bypass due to $@. | DotRegexSpring.java:37:40:37:64 | path | user-provided value |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-625/PermissiveDotRegex.qlref b/java/ql/test/experimental/query-tests/security/CWE-625/PermissiveDotRegex.qlref
new file mode 100644
index 00000000000..c1c303b93b0
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-625/PermissiveDotRegex.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-625/PermissiveDotRegex.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-625/options b/java/ql/test/experimental/query-tests/security/CWE-625/options
new file mode 100644
index 00000000000..5f11b982510
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-625/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/springframework-5.3.8
diff --git a/java/ql/test/experimental/query-tests/security/CWE-730/RegexInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-730/RegexInjection.expected
index 375b65d88b0..a795f1591ad 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-730/RegexInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-730/RegexInjection.expected
@@ -56,18 +56,18 @@ nodes
 subpaths
 | RegexInjection.java:68:36:68:42 | pattern : String | RegexInjection.java:71:14:71:23 | str : String | RegexInjection.java:72:12:72:14 | str : String | RegexInjection.java:68:32:68:43 | foo(...) : String |
 #select
-| RegexInjection.java:16:26:16:47 | ... + ... | RegexInjection.java:13:22:13:52 | getParameter(...) : String | RegexInjection.java:16:26:16:47 | ... + ... | $@ is user controlled. | RegexInjection.java:13:22:13:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:23:24:23:30 | pattern | RegexInjection.java:20:22:20:52 | getParameter(...) : String | RegexInjection.java:23:24:23:30 | pattern | $@ is user controlled. | RegexInjection.java:20:22:20:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:30:31:30:37 | pattern | RegexInjection.java:27:22:27:52 | getParameter(...) : String | RegexInjection.java:30:31:30:37 | pattern | $@ is user controlled. | RegexInjection.java:27:22:27:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:37:29:37:35 | pattern | RegexInjection.java:34:22:34:52 | getParameter(...) : String | RegexInjection.java:37:29:37:35 | pattern | $@ is user controlled. | RegexInjection.java:34:22:34:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:44:34:44:40 | pattern | RegexInjection.java:41:22:41:52 | getParameter(...) : String | RegexInjection.java:44:34:44:40 | pattern | $@ is user controlled. | RegexInjection.java:41:22:41:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:54:28:54:34 | pattern | RegexInjection.java:51:22:51:52 | getParameter(...) : String | RegexInjection.java:54:28:54:34 | pattern | $@ is user controlled. | RegexInjection.java:51:22:51:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:61:28:61:34 | pattern | RegexInjection.java:58:22:58:52 | getParameter(...) : String | RegexInjection.java:61:28:61:34 | pattern | $@ is user controlled. | RegexInjection.java:58:22:58:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:68:26:68:52 | ... + ... | RegexInjection.java:65:22:65:52 | getParameter(...) : String | RegexInjection.java:68:26:68:52 | ... + ... | $@ is user controlled. | RegexInjection.java:65:22:65:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:90:26:90:47 | ... + ... | RegexInjection.java:84:22:84:52 | getParameter(...) : String | RegexInjection.java:90:26:90:47 | ... + ... | $@ is user controlled. | RegexInjection.java:84:22:84:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:103:40:103:46 | pattern | RegexInjection.java:100:22:100:52 | getParameter(...) : String | RegexInjection.java:103:40:103:46 | pattern | $@ is user controlled. | RegexInjection.java:100:22:100:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:110:42:110:48 | pattern | RegexInjection.java:107:22:107:52 | getParameter(...) : String | RegexInjection.java:110:42:110:48 | pattern | $@ is user controlled. | RegexInjection.java:107:22:107:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:117:44:117:50 | pattern | RegexInjection.java:114:22:114:52 | getParameter(...) : String | RegexInjection.java:117:44:117:50 | pattern | $@ is user controlled. | RegexInjection.java:114:22:114:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:124:41:124:47 | pattern | RegexInjection.java:121:22:121:52 | getParameter(...) : String | RegexInjection.java:124:41:124:47 | pattern | $@ is user controlled. | RegexInjection.java:121:22:121:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:131:43:131:49 | pattern | RegexInjection.java:128:22:128:52 | getParameter(...) : String | RegexInjection.java:131:43:131:49 | pattern | $@ is user controlled. | RegexInjection.java:128:22:128:52 | getParameter(...) | This regular expression pattern |
-| RegexInjection.java:146:45:146:51 | pattern | RegexInjection.java:143:22:143:52 | getParameter(...) : String | RegexInjection.java:146:45:146:51 | pattern | $@ is user controlled. | RegexInjection.java:143:22:143:52 | getParameter(...) | This regular expression pattern |
+| RegexInjection.java:16:26:16:47 | ... + ... | RegexInjection.java:13:22:13:52 | getParameter(...) : String | RegexInjection.java:16:26:16:47 | ... + ... | This regular expression is constructed from a $@. | RegexInjection.java:13:22:13:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:23:24:23:30 | pattern | RegexInjection.java:20:22:20:52 | getParameter(...) : String | RegexInjection.java:23:24:23:30 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:20:22:20:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:30:31:30:37 | pattern | RegexInjection.java:27:22:27:52 | getParameter(...) : String | RegexInjection.java:30:31:30:37 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:27:22:27:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:37:29:37:35 | pattern | RegexInjection.java:34:22:34:52 | getParameter(...) : String | RegexInjection.java:37:29:37:35 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:34:22:34:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:44:34:44:40 | pattern | RegexInjection.java:41:22:41:52 | getParameter(...) : String | RegexInjection.java:44:34:44:40 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:41:22:41:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:54:28:54:34 | pattern | RegexInjection.java:51:22:51:52 | getParameter(...) : String | RegexInjection.java:54:28:54:34 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:51:22:51:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:61:28:61:34 | pattern | RegexInjection.java:58:22:58:52 | getParameter(...) : String | RegexInjection.java:61:28:61:34 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:58:22:58:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:68:26:68:52 | ... + ... | RegexInjection.java:65:22:65:52 | getParameter(...) : String | RegexInjection.java:68:26:68:52 | ... + ... | This regular expression is constructed from a $@. | RegexInjection.java:65:22:65:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:90:26:90:47 | ... + ... | RegexInjection.java:84:22:84:52 | getParameter(...) : String | RegexInjection.java:90:26:90:47 | ... + ... | This regular expression is constructed from a $@. | RegexInjection.java:84:22:84:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:103:40:103:46 | pattern | RegexInjection.java:100:22:100:52 | getParameter(...) : String | RegexInjection.java:103:40:103:46 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:100:22:100:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:110:42:110:48 | pattern | RegexInjection.java:107:22:107:52 | getParameter(...) : String | RegexInjection.java:110:42:110:48 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:107:22:107:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:117:44:117:50 | pattern | RegexInjection.java:114:22:114:52 | getParameter(...) : String | RegexInjection.java:117:44:117:50 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:114:22:114:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:124:41:124:47 | pattern | RegexInjection.java:121:22:121:52 | getParameter(...) : String | RegexInjection.java:124:41:124:47 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:121:22:121:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:131:43:131:49 | pattern | RegexInjection.java:128:22:128:52 | getParameter(...) : String | RegexInjection.java:131:43:131:49 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:128:22:128:52 | getParameter(...) | user-provided value |
+| RegexInjection.java:146:45:146:51 | pattern | RegexInjection.java:143:22:143:52 | getParameter(...) : String | RegexInjection.java:146:45:146:51 | pattern | This regular expression is constructed from a $@. | RegexInjection.java:143:22:143:52 | getParameter(...) | user-provided value |
diff --git a/java/ql/test/kotlin/library-tests/arrays/arrayIterators.expected b/java/ql/test/kotlin/library-tests/arrays/arrayIterators.expected
new file mode 100644
index 00000000000..cd1884eb00e
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/arrays/arrayIterators.expected
@@ -0,0 +1,6 @@
+| arrayIterators.kt:6:15:6:15 | iterator(...) | iterator(java.lang.Object[]) | kotlin.jvm.internal.ArrayIteratorKt |
+| arrayIterators.kt:7:15:7:15 | iterator(...) | iterator(int[]) | kotlin.jvm.internal.ArrayIteratorsKt |
+| arrayIterators.kt:8:15:8:15 | iterator(...) | iterator(boolean[]) | kotlin.jvm.internal.ArrayIteratorsKt |
+| arrayIterators.kt:10:16:10:25 | iterator(...) | iterator(java.lang.Object[]) | kotlin.jvm.internal.ArrayIteratorKt |
+| arrayIterators.kt:11:16:11:25 | iterator(...) | iterator(int[]) | kotlin.jvm.internal.ArrayIteratorsKt |
+| arrayIterators.kt:12:16:12:25 | iterator(...) | iterator(boolean[]) | kotlin.jvm.internal.ArrayIteratorsKt |
diff --git a/java/ql/test/kotlin/library-tests/arrays/arrayIterators.kt b/java/ql/test/kotlin/library-tests/arrays/arrayIterators.kt
new file mode 100644
index 00000000000..45a49b80097
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/arrays/arrayIterators.kt
@@ -0,0 +1,13 @@
+fun test(
+    a: Array<Int>,
+    b: IntArray,
+    c: BooleanArray) {
+
+    for (i in a) { }
+    for (i in b) { }
+    for (i in c) { }
+
+    val i1 = a.iterator()
+    val i2 = b.iterator()
+    val i3 = c.iterator()
+}
diff --git a/java/ql/test/kotlin/library-tests/arrays/arrayIterators.ql b/java/ql/test/kotlin/library-tests/arrays/arrayIterators.ql
new file mode 100644
index 00000000000..442e454424a
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/arrays/arrayIterators.ql
@@ -0,0 +1,10 @@
+import java
+
+query predicate iterator(MethodAccess ma, string mn, string t) {
+  exists(Method m |
+    ma.getMethod() = m and
+    m.getName() = "iterator" and
+    mn = m.getSignature() and
+    t = ma.getMethod().getDeclaringType().getQualifiedName()
+  )
+}
diff --git a/java/ql/test/kotlin/library-tests/arrays/test.expected b/java/ql/test/kotlin/library-tests/arrays/test.expected
index 8ef00e41d6f..7693b3acd6b 100644
--- a/java/ql/test/kotlin/library-tests/arrays/test.expected
+++ b/java/ql/test/kotlin/library-tests/arrays/test.expected
@@ -18,6 +18,7 @@ sourceSignatures
 | arrayCreations.kt:27:24:27:38 | invoke | invoke(int) |
 | arrayGetsSets.kt:1:1:22:1 | arrayGetSet | arrayGetSet(int[],short[],byte[],long[],float[],double[],boolean[],char[],java.lang.Object[]) |
 | arrayGetsSets.kt:24:1:41:1 | arrayGetSetInPlace | arrayGetSetInPlace(int[],long[],float[],double[]) |
+| arrayIterators.kt:1:1:13:1 | test | test(java.lang.Integer[],int[],boolean[]) |
 | primitiveArrays.kt:3:1:7:1 | Test | Test() |
 | primitiveArrays.kt:5:3:5:123 | test | test(java.lang.Integer[],java.lang.Integer[],int[],java.lang.Integer[][],java.lang.Integer[][],int[][]) |
 #select
diff --git a/java/ql/test/kotlin/library-tests/classes/PrintAst.expected b/java/ql/test/kotlin/library-tests/classes/PrintAst.expected
index 1ba8a3396bf..86186e98855 100644
--- a/java/ql/test/kotlin/library-tests/classes/PrintAst.expected
+++ b/java/ql/test/kotlin/library-tests/classes/PrintAst.expected
@@ -498,6 +498,66 @@ classes.kt:
 #  127|               1: [ExprStmt] <Expr>;
 #  127|                 0: [ClassInstanceExpr] new (...)
 #  127|                   -3: [TypeAccess] Object
+#  138|   25: [Class,GenericType,ParameterizedType] Cl0
+#-----|     -2: (Generic Parameters)
+#  138|       0: [TypeVariable] U0
+#  138|     1: [Constructor] Cl0
+#  138|       5: [BlockStmt] { ... }
+#  138|         0: [SuperConstructorInvocationStmt] super(...)
+#  138|         1: [BlockStmt] { ... }
+#  139|     2: [Method] func1
+#-----|       2: (Generic Parameters)
+#  139|         0: [TypeVariable] U1
+#  139|       3: [TypeAccess] Unit
+#  139|       5: [BlockStmt] { ... }
+#  140|         0: [LocalTypeDeclStmt] class ...
+#  140|           0: [LocalClass] 
+#  140|             1: [Constructor] 
+#  140|               5: [BlockStmt] { ... }
+#  140|                 0: [SuperConstructorInvocationStmt] super(...)
+#  140|             2: [Method] func2
+#-----|               2: (Generic Parameters)
+#  140|                 0: [TypeVariable] U2
+#  140|               3: [TypeAccess] Unit
+#  140|               5: [BlockStmt] { ... }
+#  141|                 0: [LocalTypeDeclStmt] class ...
+#  141|                   0: [Class,GenericType,LocalClass,ParameterizedType] Cl1
+#-----|                     -2: (Generic Parameters)
+#  141|                       0: [TypeVariable] U3
+#  141|                     1: [Constructor] Cl1
+#  141|                       5: [BlockStmt] { ... }
+#  141|                         0: [SuperConstructorInvocationStmt] super(...)
+#  141|                         1: [BlockStmt] { ... }
+#  142|                     2: [Method] fn
+#  142|                       3: [TypeAccess] Unit
+#  142|                       5: [BlockStmt] { ... }
+#  143|                         0: [LocalVariableDeclStmt] var ...;
+#  143|                           1: [LocalVariableDeclExpr] x
+#  143|                             0: [ClassInstanceExpr] new Cl1(...)
+#  143|                               -3: [TypeAccess] Cl1
+#  143|                                 0: [TypeAccess] U3
+#  150|   26: [Class,GenericType,ParameterizedType] Cl00
+#-----|     -2: (Generic Parameters)
+#  150|       0: [TypeVariable] U0
+#  150|     1: [Constructor] Cl00
+#  150|       5: [BlockStmt] { ... }
+#  150|         0: [SuperConstructorInvocationStmt] super(...)
+#  150|         1: [BlockStmt] { ... }
+#  151|     2: [Class,GenericType,ParameterizedType] Cl01
+#-----|       -2: (Generic Parameters)
+#  151|         0: [TypeVariable] U1
+#  151|       1: [Constructor] Cl01
+#  151|         5: [BlockStmt] { ... }
+#  151|           0: [SuperConstructorInvocationStmt] super(...)
+#  151|           1: [BlockStmt] { ... }
+#  152|       2: [Method] fn
+#  152|         3: [TypeAccess] Unit
+#  152|         5: [BlockStmt] { ... }
+#  153|           0: [LocalVariableDeclStmt] var ...;
+#  153|             1: [LocalVariableDeclExpr] x
+#  153|               0: [ClassInstanceExpr] new Cl01(...)
+#  153|                 -3: [TypeAccess] Cl01
+#  153|                   0: [TypeAccess] U1
 generic_anonymous.kt:
 #    0| [CompilationUnit] generic_anonymous
 #    0|   1: [Class] Generic_anonymousKt
@@ -592,6 +652,114 @@ generic_anonymous.kt:
 #    7|           0: [MethodAccess] getMember(...)
 #    7|             -1: [MethodAccess] getX$private(...)
 #    7|               -1: [ThisAccess] this
+#   15|   3: [Class,GenericType,ParameterizedType] Outer
+#-----|     -2: (Generic Parameters)
+#   15|       0: [TypeVariable] T0
+#   15|     6: [Constructor] Outer
+#   15|       5: [BlockStmt] { ... }
+#   15|         0: [SuperConstructorInvocationStmt] super(...)
+#   15|         1: [BlockStmt] { ... }
+#   16|     7: [GenericType,Interface,ParameterizedType] C0
+#-----|       -2: (Generic Parameters)
+#   16|         0: [TypeVariable] T0
+#   17|       1: [Method] fn0
+#   17|         3: [TypeAccess] T0
+#   17|         5: [BlockStmt] { ... }
+#   17|           0: [ReturnStmt] return ...
+#   17|             0: [NullLiteral] null
+#   20|     8: [GenericType,Interface,ParameterizedType] C1
+#-----|       -2: (Generic Parameters)
+#   20|         0: [TypeVariable] T1
+#   21|       1: [Method] fn1
+#   21|         3: [TypeAccess] T1
+#   21|         5: [BlockStmt] { ... }
+#   21|           0: [ReturnStmt] return ...
+#   21|             0: [NullLiteral] null
+#   24|     9: [Method] func1
+#-----|       2: (Generic Parameters)
+#   24|         0: [TypeVariable] U2
+#   24|       3: [TypeAccess] Unit
+#   24|       5: [BlockStmt] { ... }
+#   25|         0: [LocalTypeDeclStmt] class ...
+#   25|           0: [LocalClass] 
+#   25|             1: [Constructor] 
+#   25|               5: [BlockStmt] { ... }
+#   25|                 0: [SuperConstructorInvocationStmt] super(...)
+#   25|             2: [Method] func2
+#-----|               2: (Generic Parameters)
+#   25|                 0: [TypeVariable] U3
+#   25|               3: [TypeAccess] Unit
+#   25|               5: [BlockStmt] { ... }
+#   26|                 0: [ExprStmt] <Expr>;
+#   26|                   0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#   26|                     0: [TypeAccess] Unit
+#   26|                     1: [StmtExpr] <Stmt>
+#   26|                       0: [BlockStmt] { ... }
+#   26|                         0: [LocalTypeDeclStmt] class ...
+#   26|                           0: [AnonymousClass,LocalClass] new Object(...) { ... }
+#   26|                             1: [Constructor] 
+#   26|                               5: [BlockStmt] { ... }
+#   26|                                 0: [SuperConstructorInvocationStmt] super(...)
+#   26|                                 1: [BlockStmt] { ... }
+#   26|                         1: [ExprStmt] <Expr>;
+#   26|                           0: [ClassInstanceExpr] new (...)
+#   26|                             -3: [TypeAccess] Object
+#   27|                 1: [ExprStmt] <Expr>;
+#   27|                   0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#   27|                     0: [TypeAccess] Unit
+#   27|                     1: [StmtExpr] <Stmt>
+#   27|                       0: [BlockStmt] { ... }
+#   27|                         0: [LocalTypeDeclStmt] class ...
+#   27|                           0: [AnonymousClass,LocalClass] new Object(...) { ... }
+#   27|                             1: [Constructor] 
+#   27|                               5: [BlockStmt] { ... }
+#   27|                                 0: [SuperConstructorInvocationStmt] super(...)
+#   27|                                 1: [BlockStmt] { ... }
+#   27|                         1: [ExprStmt] <Expr>;
+#   27|                           0: [ClassInstanceExpr] new (...)
+#   27|                             -3: [TypeAccess] Object
+#   28|                 2: [ExprStmt] <Expr>;
+#   28|                   0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#   28|                     0: [TypeAccess] Unit
+#   28|                     1: [StmtExpr] <Stmt>
+#   28|                       0: [BlockStmt] { ... }
+#   28|                         0: [LocalTypeDeclStmt] class ...
+#   28|                           0: [AnonymousClass,LocalClass] new Object(...) { ... }
+#   28|                             1: [Constructor] 
+#   28|                               5: [BlockStmt] { ... }
+#   28|                                 0: [SuperConstructorInvocationStmt] super(...)
+#   28|                                 1: [BlockStmt] { ... }
+#   28|                         1: [ExprStmt] <Expr>;
+#   28|                           0: [ClassInstanceExpr] new (...)
+#   28|                             -3: [TypeAccess] Object
+#   29|                 3: [ExprStmt] <Expr>;
+#   29|                   0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#   29|                     0: [TypeAccess] Unit
+#   29|                     1: [StmtExpr] <Stmt>
+#   29|                       0: [BlockStmt] { ... }
+#   29|                         0: [LocalTypeDeclStmt] class ...
+#   29|                           0: [AnonymousClass,LocalClass] new C0<U2>(...) { ... }
+#   29|                             1: [Constructor] 
+#   29|                               5: [BlockStmt] { ... }
+#   29|                                 0: [SuperConstructorInvocationStmt] super(...)
+#   29|                                 1: [BlockStmt] { ... }
+#   29|                         1: [ExprStmt] <Expr>;
+#   29|                           0: [ClassInstanceExpr] new (...)
+#   29|                             -3: [TypeAccess] C0<U2>
+#   30|                 4: [ExprStmt] <Expr>;
+#   30|                   0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#   30|                     0: [TypeAccess] Unit
+#   30|                     1: [StmtExpr] <Stmt>
+#   30|                       0: [BlockStmt] { ... }
+#   30|                         0: [LocalTypeDeclStmt] class ...
+#   30|                           0: [AnonymousClass,LocalClass] new C0<String>(...) { ... }
+#   30|                             1: [Constructor] 
+#   30|                               5: [BlockStmt] { ... }
+#   30|                                 0: [SuperConstructorInvocationStmt] super(...)
+#   30|                                 1: [BlockStmt] { ... }
+#   30|                         1: [ExprStmt] <Expr>;
+#   30|                           0: [ClassInstanceExpr] new (...)
+#   30|                             -3: [TypeAccess] C0<String>
 localClassField.kt:
 #    0| [CompilationUnit] localClassField
 #    1|   1: [Class] A
diff --git a/java/ql/test/kotlin/library-tests/classes/anonymousClasses.expected b/java/ql/test/kotlin/library-tests/classes/anonymousClasses.expected
index 686eb8a9159..e8e58d04440 100644
--- a/java/ql/test/kotlin/library-tests/classes/anonymousClasses.expected
+++ b/java/ql/test/kotlin/library-tests/classes/anonymousClasses.expected
@@ -7,6 +7,11 @@
 | classes.kt:89:16:89:44 | new Interface3<Integer>(...) { ... } | classes.kt:89:16:89:44 | new (...) |  | classes.kt:89:16:89:44 | Interface3<Integer> | classes.kt:89:16:89:44 | class ... |
 | classes.kt:127:16:134:9 | new Object(...) { ... } | classes.kt:127:16:134:9 | new (...) |  | classes.kt:127:16:134:9 | Object | classes.kt:127:16:134:9 | class ... |
 | generic_anonymous.kt:3:19:5:3 | new Object(...) { ... } | generic_anonymous.kt:3:19:5:3 | new (...) |  | generic_anonymous.kt:3:19:5:3 | Object | generic_anonymous.kt:3:19:5:3 | class ... |
+| generic_anonymous.kt:26:13:26:37 | new Object(...) { ... } | generic_anonymous.kt:26:13:26:37 | new (...) |  | generic_anonymous.kt:26:13:26:37 | Object | generic_anonymous.kt:26:13:26:37 | class ... |
+| generic_anonymous.kt:27:13:27:37 | new Object(...) { ... } | generic_anonymous.kt:27:13:27:37 | new (...) |  | generic_anonymous.kt:27:13:27:37 | Object | generic_anonymous.kt:27:13:27:37 | class ... |
+| generic_anonymous.kt:28:13:28:41 | new Object(...) { ... } | generic_anonymous.kt:28:13:28:41 | new (...) |  | generic_anonymous.kt:28:13:28:41 | Object | generic_anonymous.kt:28:13:28:41 | class ... |
+| generic_anonymous.kt:29:13:29:29 | new C0<U2>(...) { ... } | generic_anonymous.kt:29:13:29:29 | new (...) |  | generic_anonymous.kt:29:13:29:29 | C0<U2> | generic_anonymous.kt:29:13:29:29 | class ... |
+| generic_anonymous.kt:30:13:30:33 | new C0<String>(...) { ... } | generic_anonymous.kt:30:13:30:33 | new (...) |  | generic_anonymous.kt:30:13:30:33 | C0<String> | generic_anonymous.kt:30:13:30:33 | class ... |
 | local_anonymous.kt:5:16:7:9 | new Object(...) { ... } | local_anonymous.kt:5:16:7:9 | new (...) |  | local_anonymous.kt:5:16:7:9 | Object | local_anonymous.kt:5:16:7:9 | class ... |
 | local_anonymous.kt:29:31:35:5 | new Object(...) { ... } | local_anonymous.kt:29:31:35:5 | new (...) |  | local_anonymous.kt:29:31:35:5 | Object | local_anonymous.kt:29:31:35:5 | class ... |
 | local_anonymous.kt:40:14:44:5 | new Interface2(...) { ... } | local_anonymous.kt:40:14:44:5 | new (...) |  | local_anonymous.kt:40:14:44:5 | Interface2 | local_anonymous.kt:40:14:44:5 | class ... |
diff --git a/java/ql/test/kotlin/library-tests/classes/classes.expected b/java/ql/test/kotlin/library-tests/classes/classes.expected
index 2e3fd5a4305..d2f085665e1 100644
--- a/java/ql/test/kotlin/library-tests/classes/classes.expected
+++ b/java/ql/test/kotlin/library-tests/classes/classes.expected
@@ -34,9 +34,21 @@
 | classes.kt:119:13:121:13 | Local2 | C1$Local2 | final, private |
 | classes.kt:127:16:134:9 | new Object(...) { ... } | <anonymous class> | final, private |
 | classes.kt:129:17:131:17 | Local3 | C1$$Local3 | final, private |
+| classes.kt:138:1:148:1 | Cl0 | Cl0 | final, public |
+| classes.kt:140:9:146:9 |  | Cl0$ | final, private |
+| classes.kt:141:13:145:13 | Cl1 | Cl0$Cl1 | final, private |
+| classes.kt:150:1:156:1 | Cl00 | Cl00 | final, public |
+| classes.kt:151:5:155:5 | Cl01 | Cl00$Cl01 | final, public |
 | generic_anonymous.kt:0:0:0:0 | Generic_anonymousKt | Generic_anonymousKt | final, public |
 | generic_anonymous.kt:1:1:9:1 | Generic | Generic | final, private |
 | generic_anonymous.kt:3:19:5:3 | new Object(...) { ... } | <anonymous class> | final, private |
+| generic_anonymous.kt:15:1:33:1 | Outer | Outer | final, public |
+| generic_anonymous.kt:25:9:31:9 |  | Outer$ | final, private |
+| generic_anonymous.kt:26:13:26:37 | new Object(...) { ... } | <anonymous class> | final, private |
+| generic_anonymous.kt:27:13:27:37 | new Object(...) { ... } | <anonymous class> | final, private |
+| generic_anonymous.kt:28:13:28:41 | new Object(...) { ... } | <anonymous class> | final, private |
+| generic_anonymous.kt:29:13:29:29 | new C0<U2>(...) { ... } | <anonymous class> | final, private |
+| generic_anonymous.kt:30:13:30:33 | new C0<String>(...) { ... } | <anonymous class> | final, private |
 | localClassField.kt:1:1:11:1 | A | A | final, public |
 | localClassField.kt:3:9:3:19 | L | A$L | final, private |
 | localClassField.kt:8:9:8:19 | L | A$L | final, private |
diff --git a/java/ql/test/kotlin/library-tests/classes/classes.kt b/java/ql/test/kotlin/library-tests/classes/classes.kt
index a5c73dbea75..d43ebf248ca 100644
--- a/java/ql/test/kotlin/library-tests/classes/classes.kt
+++ b/java/ql/test/kotlin/library-tests/classes/classes.kt
@@ -133,4 +133,24 @@ class C1 {
             }
         }
     }
+}
+
+class Cl0<U0> {
+    fun <U1> func1() {
+        fun <U2> func2() {
+            class Cl1<U3>{
+                fun fn() {
+                    val x = Cl1<U3>()
+                }
+            }
+        }
+    }
+}
+
+class Cl00<U0> {
+    class Cl01<U1>{
+        fun fn() {
+            val x = Cl01<U1>()
+        }
+    }
 }
\ No newline at end of file
diff --git a/java/ql/test/kotlin/library-tests/classes/ctorCalls.expected b/java/ql/test/kotlin/library-tests/classes/ctorCalls.expected
index 6567b235b6c..1b2abb08056 100644
--- a/java/ql/test/kotlin/library-tests/classes/ctorCalls.expected
+++ b/java/ql/test/kotlin/library-tests/classes/ctorCalls.expected
@@ -34,8 +34,20 @@ superCall
 | classes.kt:119:13:121:13 | super(...) |
 | classes.kt:127:16:134:9 | super(...) |
 | classes.kt:129:17:131:17 | super(...) |
+| classes.kt:138:1:148:1 | super(...) |
+| classes.kt:140:9:146:9 | super(...) |
+| classes.kt:141:13:145:13 | super(...) |
+| classes.kt:150:1:156:1 | super(...) |
+| classes.kt:151:5:155:5 | super(...) |
 | generic_anonymous.kt:1:1:9:1 | super(...) |
 | generic_anonymous.kt:3:19:5:3 | super(...) |
+| generic_anonymous.kt:15:1:33:1 | super(...) |
+| generic_anonymous.kt:25:9:31:9 | super(...) |
+| generic_anonymous.kt:26:13:26:37 | super(...) |
+| generic_anonymous.kt:27:13:27:37 | super(...) |
+| generic_anonymous.kt:28:13:28:41 | super(...) |
+| generic_anonymous.kt:29:13:29:29 | super(...) |
+| generic_anonymous.kt:30:13:30:33 | super(...) |
 | localClassField.kt:1:1:11:1 | super(...) |
 | localClassField.kt:3:9:3:19 | super(...) |
 | localClassField.kt:8:9:8:19 | super(...) |
diff --git a/java/ql/test/kotlin/library-tests/classes/genericExprTypes.expected b/java/ql/test/kotlin/library-tests/classes/genericExprTypes.expected
index aa9514774a6..f4628d21bf8 100644
--- a/java/ql/test/kotlin/library-tests/classes/genericExprTypes.expected
+++ b/java/ql/test/kotlin/library-tests/classes/genericExprTypes.expected
@@ -44,3 +44,34 @@
 | generic_anonymous.kt:13:27:13:41 | new Generic<Integer>(...) | Generic<Integer> |
 | generic_anonymous.kt:13:40:13:40 | i | int |
 | generic_anonymous.kt:13:43:13:47 | get(...) | int |
+| generic_anonymous.kt:17:9:17:29 | T0 | T0 |
+| generic_anonymous.kt:17:26:17:29 | null | Void |
+| generic_anonymous.kt:21:9:21:29 | T1 | T1 |
+| generic_anonymous.kt:21:26:21:29 | null | Void |
+| generic_anonymous.kt:24:5:32:5 | Unit | Unit |
+| generic_anonymous.kt:25:9:31:9 | Unit | Unit |
+| generic_anonymous.kt:26:13:26:37 | <Stmt> | new Object(...) { ... } |
+| generic_anonymous.kt:26:13:26:37 | <implicit coercion to unit> | Unit |
+| generic_anonymous.kt:26:13:26:37 | Object | Object |
+| generic_anonymous.kt:26:13:26:37 | Unit | Unit |
+| generic_anonymous.kt:26:13:26:37 | new (...) | new Object(...) { ... } |
+| generic_anonymous.kt:27:13:27:37 | <Stmt> | new Object(...) { ... } |
+| generic_anonymous.kt:27:13:27:37 | <implicit coercion to unit> | Unit |
+| generic_anonymous.kt:27:13:27:37 | Object | Object |
+| generic_anonymous.kt:27:13:27:37 | Unit | Unit |
+| generic_anonymous.kt:27:13:27:37 | new (...) | new Object(...) { ... } |
+| generic_anonymous.kt:28:13:28:41 | <Stmt> | new Object(...) { ... } |
+| generic_anonymous.kt:28:13:28:41 | <implicit coercion to unit> | Unit |
+| generic_anonymous.kt:28:13:28:41 | Object | Object |
+| generic_anonymous.kt:28:13:28:41 | Unit | Unit |
+| generic_anonymous.kt:28:13:28:41 | new (...) | new Object(...) { ... } |
+| generic_anonymous.kt:29:13:29:29 | <Stmt> | new C0<U2>(...) { ... } |
+| generic_anonymous.kt:29:13:29:29 | <implicit coercion to unit> | Unit |
+| generic_anonymous.kt:29:13:29:29 | C0<U2> | C0<U2> |
+| generic_anonymous.kt:29:13:29:29 | Unit | Unit |
+| generic_anonymous.kt:29:13:29:29 | new (...) | new C0<U2>(...) { ... } |
+| generic_anonymous.kt:30:13:30:33 | <Stmt> | new C0<String>(...) { ... } |
+| generic_anonymous.kt:30:13:30:33 | <implicit coercion to unit> | Unit |
+| generic_anonymous.kt:30:13:30:33 | C0<String> | C0<String> |
+| generic_anonymous.kt:30:13:30:33 | Unit | Unit |
+| generic_anonymous.kt:30:13:30:33 | new (...) | new C0<String>(...) { ... } |
diff --git a/java/ql/test/kotlin/library-tests/classes/generic_anonymous.kt b/java/ql/test/kotlin/library-tests/classes/generic_anonymous.kt
index df8d3a2a894..cca9b0e4668 100644
--- a/java/ql/test/kotlin/library-tests/classes/generic_anonymous.kt
+++ b/java/ql/test/kotlin/library-tests/classes/generic_anonymous.kt
@@ -11,3 +11,23 @@ private class Generic<T>(val t: T) {
 fun stringIdentity(s: String) = Generic<String>(s).get()
 
 fun intIdentity(i: Int) = Generic<Int>(i).get()
+
+class Outer<T0> {
+    open interface C0<T0> {
+        fun fn0(): T0? = null
+    }
+
+    open interface C1<T1> {
+        fun fn1(): T1? = null
+    }
+
+    fun <U2> func1() {
+        fun <U3> func2() {
+            object: C0<U2>, C1<U3> {}
+            object: C0<U2>, C1<U2> {}
+            object: C0<U2>, C1<String> {}
+            object: C0<U2> {}
+            object: C0<String> {}
+        }
+    }
+}
diff --git a/java/ql/test/kotlin/library-tests/classes/interfaces.expected b/java/ql/test/kotlin/library-tests/classes/interfaces.expected
index 79faca1ad6a..ffe6722111c 100644
--- a/java/ql/test/kotlin/library-tests/classes/interfaces.expected
+++ b/java/ql/test/kotlin/library-tests/classes/interfaces.expected
@@ -3,4 +3,6 @@
 | classes.kt:59:1:59:23 | Interface1 |
 | classes.kt:60:1:60:23 | Interface2 |
 | classes.kt:61:1:61:26 | Interface3 |
+| generic_anonymous.kt:16:5:18:5 | C0 |
+| generic_anonymous.kt:20:5:22:5 | C1 |
 | local_anonymous.kt:38:1:38:23 | Interface2 |
diff --git a/java/ql/test/kotlin/library-tests/classes/localClass.expected b/java/ql/test/kotlin/library-tests/classes/localClass.expected
index 751b6649982..a53a8b3d477 100644
--- a/java/ql/test/kotlin/library-tests/classes/localClass.expected
+++ b/java/ql/test/kotlin/library-tests/classes/localClass.expected
@@ -2,6 +2,9 @@
 | classes.kt:118:9:123:9 | class ... | classes.kt:118:9:123:9 |  | classes.kt:117:5:124:5 | fn2 | classes.kt:109:1:136:1 | C1 |
 | classes.kt:119:13:121:13 | class ... | classes.kt:119:13:121:13 | Local2 | classes.kt:118:9:123:9 | localFn | classes.kt:109:1:136:1 | C1 |
 | classes.kt:129:17:131:17 | class ... | classes.kt:129:17:131:17 | Local3 | classes.kt:128:13:133:13 | fn | classes.kt:127:16:134:9 | new Object(...) { ... } |
+| classes.kt:140:9:146:9 | class ... | classes.kt:140:9:146:9 |  | classes.kt:139:5:147:5 | func1 | classes.kt:138:1:148:1 | Cl0 |
+| classes.kt:141:13:145:13 | class ... | classes.kt:141:13:145:13 | Cl1 | classes.kt:140:9:146:9 | func2 | classes.kt:138:1:148:1 | Cl0 |
+| generic_anonymous.kt:25:9:31:9 | class ... | generic_anonymous.kt:25:9:31:9 |  | generic_anonymous.kt:24:5:32:5 | func1 | generic_anonymous.kt:15:1:33:1 | Outer |
 | localClassField.kt:3:9:3:19 | class ... | localClassField.kt:3:9:3:19 | L | localClassField.kt:1:1:11:1 | A | localClassField.kt:1:1:11:1 | A |
 | localClassField.kt:8:9:8:19 | class ... | localClassField.kt:8:9:8:19 | L | localClassField.kt:1:1:11:1 | A | localClassField.kt:1:1:11:1 | A |
 | local_anonymous.kt:11:9:11:24 | class ... | local_anonymous.kt:11:9:11:24 |  | local_anonymous.kt:10:5:13:5 | fn2 | local_anonymous.kt:3:1:36:1 | Class1 |
diff --git a/java/ql/test/kotlin/library-tests/classes/paramTypes.expected b/java/ql/test/kotlin/library-tests/classes/paramTypes.expected
index 4c18ea2ed72..65cac719f4b 100644
--- a/java/ql/test/kotlin/library-tests/classes/paramTypes.expected
+++ b/java/ql/test/kotlin/library-tests/classes/paramTypes.expected
@@ -1,6 +1,10 @@
 | classes.kt:111:9:113:9 | Local1 | 0 | classes.kt:111:22:111:23 | T1 |
 | classes.kt:119:13:121:13 | Local2 | 0 | classes.kt:119:26:119:27 | T1 |
 | classes.kt:129:17:131:17 | Local3 | 0 | classes.kt:129:30:129:31 | T1 |
+| classes.kt:138:1:148:1 | Cl0 | 0 | classes.kt:138:11:138:12 | U0 |
+| classes.kt:141:13:145:13 | Cl1 | 0 | classes.kt:141:23:141:24 | U3 |
+| classes.kt:150:1:156:1 | Cl00 | 0 | classes.kt:150:12:150:13 | U0 |
+| classes.kt:151:5:155:5 | Cl01 | 0 | classes.kt:151:16:151:17 | U1 |
 | file://<external>/C1$<no name provided>$Local3.class:0:0:0:0 | Local3<Integer> | 0 | file://<external>/Integer.class:0:0:0:0 | Integer |
 | file://<external>/C1$Local1.class:0:0:0:0 | Local1<Integer> | 0 | file://<external>/Integer.class:0:0:0:0 | Integer |
 | file://<external>/C1$Local2.class:0:0:0:0 | Local2<Integer> | 0 | file://<external>/Integer.class:0:0:0:0 | Integer |
@@ -13,6 +17,7 @@
 | file://<external>/SuperChain2.class:0:0:0:0 | SuperChain2<T5,String> | 0 | superChain.kt:3:24:3:25 | T5 |
 | file://<external>/SuperChain2.class:0:0:0:0 | SuperChain2<T5,String> | 1 | file://<external>/String.class:0:0:0:0 | String |
 | generic_anonymous.kt:1:1:9:1 | Generic | 0 | generic_anonymous.kt:1:23:1:23 | T |
+| generic_anonymous.kt:15:1:33:1 | Outer | 0 | generic_anonymous.kt:15:13:15:14 | T0 |
 | superChain.kt:1:1:1:33 | SuperChain1 | 0 | superChain.kt:1:24:1:25 | T1 |
 | superChain.kt:1:1:1:33 | SuperChain1 | 1 | superChain.kt:1:28:1:29 | T2 |
 | superChain.kt:2:1:2:60 | SuperChain2 | 0 | superChain.kt:2:24:2:25 | T3 |
diff --git a/java/ql/test/kotlin/library-tests/classes/superTypes.expected b/java/ql/test/kotlin/library-tests/classes/superTypes.expected
index f0b7f0ca3e9..5df9a115973 100644
--- a/java/ql/test/kotlin/library-tests/classes/superTypes.expected
+++ b/java/ql/test/kotlin/library-tests/classes/superTypes.expected
@@ -39,6 +39,11 @@
 | classes.kt:119:13:121:13 | Local2 | file://<external>/Object.class:0:0:0:0 | Object |
 | classes.kt:127:16:134:9 | new Object(...) { ... } | file://<external>/Object.class:0:0:0:0 | Object |
 | classes.kt:129:17:131:17 | Local3 | file://<external>/Object.class:0:0:0:0 | Object |
+| classes.kt:138:1:148:1 | Cl0 | file://<external>/Object.class:0:0:0:0 | Object |
+| classes.kt:140:9:146:9 |  | file://<external>/Object.class:0:0:0:0 | Object |
+| classes.kt:141:13:145:13 | Cl1 | file://<external>/Object.class:0:0:0:0 | Object |
+| classes.kt:150:1:156:1 | Cl00 | file://<external>/Object.class:0:0:0:0 | Object |
+| classes.kt:151:5:155:5 | Cl01 | file://<external>/Object.class:0:0:0:0 | Object |
 | file://<external>/C1$<no name provided>$Local3.class:0:0:0:0 | Local3<Integer> | file://<external>/Object.class:0:0:0:0 | Object |
 | file://<external>/C1$Local1.class:0:0:0:0 | Local1<Integer> | file://<external>/Object.class:0:0:0:0 | Object |
 | file://<external>/C1$Local2.class:0:0:0:0 | Local2<Integer> | file://<external>/Object.class:0:0:0:0 | Object |
@@ -49,6 +54,16 @@
 | file://<external>/SuperChain2.class:0:0:0:0 | SuperChain2<T5,String> | file://<external>/SuperChain1.class:0:0:0:0 | SuperChain1<T5,String> |
 | generic_anonymous.kt:1:1:9:1 | Generic | file://<external>/Object.class:0:0:0:0 | Object |
 | generic_anonymous.kt:3:19:5:3 | new Object(...) { ... } | file://<external>/Object.class:0:0:0:0 | Object |
+| generic_anonymous.kt:15:1:33:1 | Outer | file://<external>/Object.class:0:0:0:0 | Object |
+| generic_anonymous.kt:25:9:31:9 |  | file://<external>/Object.class:0:0:0:0 | Object |
+| generic_anonymous.kt:26:13:26:37 | new Object(...) { ... } | file://<external>/Outer$C0.class:0:0:0:0 | C0<U2> |
+| generic_anonymous.kt:26:13:26:37 | new Object(...) { ... } | file://<external>/Outer$C1.class:0:0:0:0 | C1<U3> |
+| generic_anonymous.kt:27:13:27:37 | new Object(...) { ... } | file://<external>/Outer$C0.class:0:0:0:0 | C0<U2> |
+| generic_anonymous.kt:27:13:27:37 | new Object(...) { ... } | file://<external>/Outer$C1.class:0:0:0:0 | C1<U2> |
+| generic_anonymous.kt:28:13:28:41 | new Object(...) { ... } | file://<external>/Outer$C0.class:0:0:0:0 | C0<U2> |
+| generic_anonymous.kt:28:13:28:41 | new Object(...) { ... } | file://<external>/Outer$C1.class:0:0:0:0 | C1<String> |
+| generic_anonymous.kt:29:13:29:29 | new C0<U2>(...) { ... } | file://<external>/Outer$C0.class:0:0:0:0 | C0<U2> |
+| generic_anonymous.kt:30:13:30:33 | new C0<String>(...) { ... } | file://<external>/Outer$C0.class:0:0:0:0 | C0<String> |
 | localClassField.kt:1:1:11:1 | A | file://<external>/Object.class:0:0:0:0 | Object |
 | localClassField.kt:3:9:3:19 | L | file://<external>/Object.class:0:0:0:0 | Object |
 | localClassField.kt:8:9:8:19 | L | file://<external>/Object.class:0:0:0:0 | Object |
diff --git a/java/ql/test/kotlin/library-tests/comments/comments.expected b/java/ql/test/kotlin/library-tests/comments/comments.expected
index 904df44e5db..3a5ce1ff39a 100644
--- a/java/ql/test/kotlin/library-tests/comments/comments.expected
+++ b/java/ql/test/kotlin/library-tests/comments/comments.expected
@@ -7,8 +7,13 @@ comments
 | comments.kt:28:5:30:6 | /*\n    A block comment\n    */ | /*\n    A block comment\n    */ |
 | comments.kt:35:5:35:34 | /** Medium is in the middle */ | /** Medium is in the middle */ |
 | comments.kt:37:5:37:23 | /** This is high */ | /** This is high */ |
-| comments.kt:42:5:44:6 | /**\n     * A variable.\n    */ | /**\n     * A variable.\n    */ |
+| comments.kt:42:5:44:7 | /**\n     * A variable.\n     */ | /**\n     * A variable.\n     */ |
 | comments.kt:48:1:50:3 | /**\n * A type alias comment\n */ | /**\n * A type alias comment\n */ |
+| comments.kt:54:5:56:7 | /**\n     * An init block comment\n     */ | /**\n     * An init block comment\n     */ |
+| comments.kt:61:5:63:7 | /**\n     * A prop comment\n     */ | /**\n     * A prop comment\n     */ |
+| comments.kt:65:9:67:11 | /**\n         * An accessor comment\n         */ | /**\n         * An accessor comment\n         */ |
+| comments.kt:71:9:73:11 | /**\n         * An anonymous function comment\n         */ | /**\n         * An anonymous function comment\n         */ |
+| comments.kt:79:9:81:11 | /**\n         * A local function comment\n         */ | /**\n         * A local function comment\n         */ |
 commentOwners
 | comments.kt:4:1:11:3 | /**\n * A group of *members*.\n *\n * This class has no useful logic; it's just a documentation example.\n *\n * @property name the name of this group.\n * @constructor Creates an empty group.\n */ | comments.kt:12:1:31:1 | Group |
 | comments.kt:4:1:11:3 | /**\n * A group of *members*.\n *\n * This class has no useful logic; it's just a documentation example.\n *\n * @property name the name of this group.\n * @constructor Creates an empty group.\n */ | comments.kt:12:1:31:1 | Group |
@@ -18,8 +23,19 @@ commentOwners
 | comments.kt:19:5:22:7 | /**\n     * Adds a [member] to this group.\n     * @return the new size of the group.\n     */ | comments.kt:23:5:26:5 | add |
 | comments.kt:35:5:35:34 | /** Medium is in the middle */ | comments.kt:36:5:36:14 | Medium |
 | comments.kt:37:5:37:23 | /** This is high */ | comments.kt:38:5:38:11 | High |
-| comments.kt:42:5:44:6 | /**\n     * A variable.\n    */ | comments.kt:45:5:45:13 | int a |
+| comments.kt:42:5:44:7 | /**\n     * A variable.\n     */ | comments.kt:45:5:45:13 | int a |
 | comments.kt:48:1:50:3 | /**\n * A type alias comment\n */ | comments.kt:51:1:51:24 | MyType |
+| comments.kt:54:5:56:7 | /**\n     * An init block comment\n     */ | comments.kt:53:1:58:1 | InitBlock |
+| comments.kt:61:5:63:7 | /**\n     * A prop comment\n     */ | comments.kt:64:5:68:17 | prop |
+| comments.kt:65:9:67:11 | /**\n         * An accessor comment\n         */ | comments.kt:68:9:68:17 | getProp |
+| comments.kt:71:9:73:11 | /**\n         * An anonymous function comment\n         */ | comments.kt:70:5:76:10 | getL |
+| comments.kt:71:9:73:11 | /**\n         * An anonymous function comment\n         */ | comments.kt:70:5:76:10 | l |
+| comments.kt:71:9:73:11 | /**\n         * An anonymous function comment\n         */ | comments.kt:70:5:76:10 | l |
+| comments.kt:79:9:81:11 | /**\n         * A local function comment\n         */ | comments.kt:82:9:82:24 | localFn |
+commentNoOwners
+| comments.kt:1:1:1:25 | /** Kdoc with no owner */ |
+| comments.kt:24:9:24:25 | // A line comment |
+| comments.kt:28:5:30:6 | /*\n    A block comment\n    */ |
 commentSections
 | comments.kt:1:1:1:25 | /** Kdoc with no owner */ | Kdoc with no owner |
 | comments.kt:4:1:11:3 | /**\n * A group of *members*.\n *\n * This class has no useful logic; it's just a documentation example.\n *\n * @property name the name of this group.\n * @constructor Creates an empty group.\n */ | A group of *members*.\n\nThis class has no useful logic; it's just a documentation example.\n\n |
@@ -29,13 +45,23 @@ commentSections
 | comments.kt:19:5:22:7 | /**\n     * Adds a [member] to this group.\n     * @return the new size of the group.\n     */ | Adds a [member] to this group.\n |
 | comments.kt:35:5:35:34 | /** Medium is in the middle */ | Medium is in the middle |
 | comments.kt:37:5:37:23 | /** This is high */ | This is high |
-| comments.kt:42:5:44:6 | /**\n     * A variable.\n    */ | A variable. |
+| comments.kt:42:5:44:7 | /**\n     * A variable.\n     */ | A variable. |
 | comments.kt:48:1:50:3 | /**\n * A type alias comment\n */ | A type alias comment |
+| comments.kt:54:5:56:7 | /**\n     * An init block comment\n     */ | An init block comment |
+| comments.kt:61:5:63:7 | /**\n     * A prop comment\n     */ | A prop comment |
+| comments.kt:65:9:67:11 | /**\n         * An accessor comment\n         */ | An accessor comment |
+| comments.kt:71:9:73:11 | /**\n         * An anonymous function comment\n         */ | An anonymous function comment |
+| comments.kt:79:9:81:11 | /**\n         * A local function comment\n         */ | A local function comment |
 commentSectionContents
 | A group of *members*.\n\nThis class has no useful logic; it's just a documentation example.\n\n | A group of *members*.\n\nThis class has no useful logic; it's just a documentation example.\n\n |
+| A local function comment | A local function comment |
+| A prop comment | A prop comment |
 | A type alias comment | A type alias comment |
 | A variable. | A variable. |
 | Adds a [member] to this group.\n | Adds a [member] to this group.\n |
+| An accessor comment | An accessor comment |
+| An anonymous function comment | An anonymous function comment |
+| An init block comment | An init block comment |
 | Creates an empty group. | Creates an empty group. |
 | Kdoc with no owner | Kdoc with no owner |
 | Medium is in the middle | Medium is in the middle |
diff --git a/java/ql/test/kotlin/library-tests/comments/comments.kt b/java/ql/test/kotlin/library-tests/comments/comments.kt
index e208d8eb44c..d242a24d65f 100644
--- a/java/ql/test/kotlin/library-tests/comments/comments.kt
+++ b/java/ql/test/kotlin/library-tests/comments/comments.kt
@@ -41,7 +41,7 @@ enum class Severity(val sev: Int) {
 fun fn1() {
     /**
      * A variable.
-    */
+     */
     val a = 1
 }
 
@@ -49,3 +49,36 @@ fun fn1() {
  * A type alias comment
  */
 typealias MyType = Group
+
+class InitBlock {
+    /**
+     * An init block comment
+     */
+    init { }
+}
+
+class X {
+    /**
+     * A prop comment
+     */
+    val prop: Int
+        /**
+         * An accessor comment
+         */
+        get() = 5
+
+    val l: Lazy<Int> = lazy(
+        /**
+         * An anonymous function comment
+         */
+        fun(): Int {
+            return 5
+        })
+
+    fun fn() {
+        /**
+         * A local function comment
+         */
+        fun localFn() {}
+    }
+}
diff --git a/java/ql/test/kotlin/library-tests/comments/comments.ql b/java/ql/test/kotlin/library-tests/comments/comments.ql
index 457ac5f5bf1..ef4414550f3 100644
--- a/java/ql/test/kotlin/library-tests/comments/comments.ql
+++ b/java/ql/test/kotlin/library-tests/comments/comments.ql
@@ -4,6 +4,8 @@ query predicate comments(KtComment c, string s) { c.getText() = s }
 
 query predicate commentOwners(KtComment c, Top t) { c.getOwner() = t }
 
+query predicate commentNoOwners(KtComment c) { not exists(c.getOwner()) }
+
 query predicate commentSections(KtComment c, KtCommentSection s) { c.getSections() = s }
 
 query predicate commentSectionContents(KtCommentSection s, string c) { s.getContent() = c }
diff --git a/java/ql/test/kotlin/library-tests/data-classes/callees.expected b/java/ql/test/kotlin/library-tests/data-classes/callees.expected
index c4b66f2d3a0..4c01e2402fa 100644
--- a/java/ql/test/kotlin/library-tests/data-classes/callees.expected
+++ b/java/ql/test/kotlin/library-tests/data-classes/callees.expected
@@ -1,8 +1,8 @@
-| dc.kt:0:0:0:0 | hashCode(...) | Arrays.hashCode |
-| dc.kt:0:0:0:0 | hashCode(...) | Arrays.hashCode |
+| dc.kt:0:0:0:0 | hashCode(...) | java.util.Arrays.hashCode |
+| dc.kt:0:0:0:0 | hashCode(...) | java.util.Arrays.hashCode |
 | dc.kt:0:0:0:0 | new ProtoMapValue(...) | ProtoMapValue.ProtoMapValue |
-| dc.kt:0:0:0:0 | plus(...) | Int.plus |
-| dc.kt:0:0:0:0 | times(...) | Int.times |
-| dc.kt:0:0:0:0 | toString(...) | Arrays.toString |
-| dc.kt:0:0:0:0 | toString(...) | Arrays.toString |
-| dc.kt:1:1:1:71 | super(...) | Object.Object |
+| dc.kt:0:0:0:0 | plus(...) | kotlin.Int.plus |
+| dc.kt:0:0:0:0 | times(...) | kotlin.Int.times |
+| dc.kt:0:0:0:0 | toString(...) | java.util.Arrays.toString |
+| dc.kt:0:0:0:0 | toString(...) | java.util.Arrays.toString |
+| dc.kt:1:1:1:71 | super(...) | java.lang.Object.Object |
diff --git a/java/ql/test/kotlin/library-tests/dataflow/summaries/list.kt b/java/ql/test/kotlin/library-tests/dataflow/summaries/list.kt
index c15f000f668..31353295182 100644
--- a/java/ql/test/kotlin/library-tests/dataflow/summaries/list.kt
+++ b/java/ql/test/kotlin/library-tests/dataflow/summaries/list.kt
@@ -4,17 +4,17 @@ class ListFlowTest {
 
     fun test(l: MutableList<String>) {
         l[0] = taint("a")
-        sink(l)
-        sink(l[0])
+        sink(l)             // $ hasTaintFlow=a
+        sink(l[0])          // $ hasValueFlow=a
         for (s in l) {
-            sink(s)
+            sink(s)         // $ hasValueFlow=a
         }
 
-        val a = arrayOf(taint("a"), "b")
-        sink(a)
-        sink(a[0])
+        val a = arrayOf(taint("b"), "c")
+        sink(a)             // $ hasTaintFlow=b
+        sink(a[0])          // $ hasValueFlow=b
         for (s in a) {
-            sink(s)
+            sink(s)         // $ hasValueFlow=b
         }
     }
 }
diff --git a/java/ql/test/kotlin/library-tests/dataflow/summaries/test.expected b/java/ql/test/kotlin/library-tests/dataflow/summaries/test.expected
index e946708bee5..1fa6a5179fd 100644
--- a/java/ql/test/kotlin/library-tests/dataflow/summaries/test.expected
+++ b/java/ql/test/kotlin/library-tests/dataflow/summaries/test.expected
@@ -1,6 +1,5 @@
-| list.kt:6:23:6:23 | a | list.kt:7:14:7:14 | l |
-| list.kt:6:23:6:23 | a | list.kt:8:14:8:17 | get(...) |
-| list.kt:6:23:6:23 | a | list.kt:10:18:10:18 | s |
-| list.kt:13:32:13:32 | a | list.kt:14:14:14:14 | a |
-| list.kt:13:32:13:32 | a | list.kt:15:14:15:17 | ...[...] |
-| list.kt:13:32:13:32 | a | list.kt:17:18:17:18 | s |
+| test.kt:28:16:28:21 | getSecond(...) | Unexpected result: hasTaintFlow=a |
+| test.kt:35:16:35:27 | component1(...) | Unexpected result: hasTaintFlow=d |
+| test.kt:41:17:41:22 | getSecond(...) | Unexpected result: hasTaintFlow=e |
+| test.kt:53:17:53:24 | getDuration(...) | Unexpected result: hasTaintFlow=f |
+| test.kt:58:18:58:29 | component2(...) | Unexpected result: hasTaintFlow=g |
diff --git a/java/ql/test/kotlin/library-tests/dataflow/summaries/test.kt b/java/ql/test/kotlin/library-tests/dataflow/summaries/test.kt
new file mode 100644
index 00000000000..6b41ab26557
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/dataflow/summaries/test.kt
@@ -0,0 +1,75 @@
+import kotlin.time.Duration
+import kotlin.time.ExperimentalTime
+import kotlin.time.TimedValue
+
+class Test {
+    fun <T> taint(t: T) = t
+    fun sink(a: Any) {}
+
+    @OptIn(ExperimentalTime::class)
+    fun test(b: ByteArray,
+             f: kotlin.io.FileTreeWalk,
+             c1: CharArray,
+             c2: CharArray,
+             c3: CharArray,) {
+
+        sink(taint(b).copyOf())                     // $ hasTaintFlow
+        sink(taint(f).maxDepth(1))                  // $ hasTaintFlow
+
+        val sb = StringBuilder()
+        sink(sb.insertRange(0, taint(c1), 0, 0))    // $ hasTaintFlow
+        sink(sb)                                    // $ hasTaintFlow
+
+        sink(taint(c2) + c3)                        // $ hasTaintFlow
+
+        val p = Pair(taint("a"), "")
+        sink(p)                                     // $ hasTaintFlow=a
+        sink(p.component1())                        // $ hasTaintFlow=a
+        sink(p.second)
+
+        sink(taint("b").capitalize())                   // $ hasTaintFlow=b
+        sink(taint("c").replaceFirstChar { _ -> 'x' })  // $ hasTaintFlow=c
+
+        val t = Triple("", taint("d"), "")
+        sink(t)                                     // $ hasTaintFlow=d
+        sink(t.component1())
+        sink(t.second)                              // $ hasTaintFlow=d
+
+        val p1 = taint("e") to ""
+        sink(p1)                                    // $ hasTaintFlow=e
+        sink(p1.component1())                       // $ hasTaintFlow=e
+        sink(p1.second)
+
+        val l = p.toList()
+        sink(l)                                     // $ hasTaintFlow=a
+        sink(l[0])                                  // $ hasTaintFlow=a
+        for (s in l) {
+            sink(s)                                 // $ hasTaintFlow=a
+        }
+
+        val tv = TimedValue(taint("f"), Duration.parse(""))
+        sink(tv)                                    // $ hasTaintFlow=f
+        sink(tv.component1())                       // $ hasTaintFlow=f
+        sink(tv.duration)
+
+        val mg0 = MatchGroup(taint("g"), IntRange(0, 10))
+        sink(mg0)                                   // $ hasTaintFlow=g
+        sink(mg0.value)                             // $ hasTaintFlow=g
+        sink(mg0.component2())
+
+        val iv = IndexedValue<String>(5, taint("h"))
+        sink(iv)                                    // $ hasTaintFlow=h
+        sink(iv.index)
+        sink(iv.component2())                       // $ hasTaintFlow=h
+
+        val strings = arrayOf("", taint("i"))
+        sink(strings.withIndex())                   // $ hasTaintFlow=i
+        sink(strings.withIndex().toList())          // $ hasTaintFlow=i
+        sink(strings.withIndex().toList()[0].value) // $ hasTaintFlow=i
+        sink(strings.withIndex().toList()[0].index)
+        for (x in strings.withIndex()) {
+            sink(x.value)                           // $ hasTaintFlow=i
+            sink(x.index)
+        }
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/kotlin/library-tests/dataflow/summaries/test.ql b/java/ql/test/kotlin/library-tests/dataflow/summaries/test.ql
index 086a6e80343..5d91e4e8e26 100644
--- a/java/ql/test/kotlin/library-tests/dataflow/summaries/test.ql
+++ b/java/ql/test/kotlin/library-tests/dataflow/summaries/test.ql
@@ -1,19 +1,2 @@
 import java
-import semmle.code.java.dataflow.TaintTracking
-import semmle.code.java.dataflow.ExternalFlow
-
-class Conf extends TaintTracking::Configuration {
-  Conf() { this = "qltest:mad-summaries" }
-
-  override predicate isSource(DataFlow::Node n) {
-    n.asExpr().(Argument).getCall().getCallee().hasName("taint")
-  }
-
-  override predicate isSink(DataFlow::Node n) {
-    n.asExpr().(Argument).getCall().getCallee().hasName("sink")
-  }
-}
-
-from DataFlow::Node src, DataFlow::Node sink, Conf conf
-where conf.hasFlow(src, sink)
-select src, sink
+import TestUtilities.InlineFlowTest
diff --git a/java/ql/test/kotlin/library-tests/declaration-stack/Test.kt b/java/ql/test/kotlin/library-tests/declaration-stack/Test.kt
new file mode 100644
index 00000000000..129a35c0a29
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/declaration-stack/Test.kt
@@ -0,0 +1,5 @@
+abstract class Base(func:() -> Unit = {}) { }
+
+class Derived : Base({
+    data class Dc(val foo: String)
+})
diff --git a/java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidFilesystemTest.expected b/java/ql/test/kotlin/library-tests/declaration-stack/test.expected
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidFilesystemTest.expected
rename to java/ql/test/kotlin/library-tests/declaration-stack/test.expected
diff --git a/java/ql/test/kotlin/library-tests/declaration-stack/test.ql b/java/ql/test/kotlin/library-tests/declaration-stack/test.ql
new file mode 100644
index 00000000000..7762d11c8f7
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/declaration-stack/test.ql
@@ -0,0 +1,5 @@
+import java
+import semmle.code.java.Diagnostics
+
+from Diagnostic d
+select d
diff --git a/java/ql/test/kotlin/library-tests/exprs/CONSISTENCY/cfgDeadEnds.expected b/java/ql/test/kotlin/library-tests/exprs/CONSISTENCY/cfgDeadEnds.expected
new file mode 100644
index 00000000000..88eef7c2ce3
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/exprs/CONSISTENCY/cfgDeadEnds.expected
@@ -0,0 +1,2 @@
+| exprs.kt:272:52:272:66 | <error expr> | ErrorExpr | unexpected dead end |
+| exprs.kt:272:52:272:66 | { ... } | BlockStmt | unexpected dead end |
diff --git a/java/ql/test/kotlin/library-tests/exprs/PrintAst.expected b/java/ql/test/kotlin/library-tests/exprs/PrintAst.expected
index 19aebc86c66..785a79aab08 100644
--- a/java/ql/test/kotlin/library-tests/exprs/PrintAst.expected
+++ b/java/ql/test/kotlin/library-tests/exprs/PrintAst.expected
@@ -2832,6 +2832,28 @@ exprs.kt:
 #  268|           0: [AssignRemExpr] ...%=...
 #  268|             0: [VarAccess] updated
 #  268|             1: [IntegerLiteral] 1
+#  272|     12: [Method] getEnumValues
+#-----|       2: (Generic Parameters)
+#  272|         0: [TypeVariable] T
+#  272|       3: [TypeAccess] T[]
+#  272|         0: [TypeAccess] T
+#  272|       5: [BlockStmt] { ... }
+#  272|         0: [ReturnStmt] return ...
+#  272|           0: [ErrorExpr] <error expr>
+#  274|     13: [Method] callToEnumValues
+#  274|       3: [TypeAccess] Unit
+#  274|       5: [BlockStmt] { ... }
+#  275|         0: [ExprStmt] <Expr>;
+#  275|           0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#  275|             0: [TypeAccess] Unit
+#  275|             1: [MethodAccess] values(...)
+#  275|               -1: [TypeAccess] Color
+#  276|         1: [ExprStmt] <Expr>;
+#  276|           0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#  276|             0: [TypeAccess] Unit
+#  276|             1: [MethodAccess] getEnumValues(...)
+#  276|               -2: [TypeAccess] Color
+#  276|               -1: [TypeAccess] ExprsKt
 #  142|   2: [Class] C
 #  142|     1: [Constructor] C
 #-----|       4: (Parameters)
diff --git a/java/ql/test/kotlin/library-tests/exprs/exprs.expected b/java/ql/test/kotlin/library-tests/exprs/exprs.expected
index ef41238ca79..06adff46fbf 100644
--- a/java/ql/test/kotlin/library-tests/exprs/exprs.expected
+++ b/java/ql/test/kotlin/library-tests/exprs/exprs.expected
@@ -1723,6 +1723,19 @@
 | exprs.kt:268:3:268:9 | updated | exprs.kt:261:1:270:1 | inPlaceOperators | VarAccess |
 | exprs.kt:268:3:268:14 | ...%=... | exprs.kt:261:1:270:1 | inPlaceOperators | AssignRemExpr |
 | exprs.kt:268:14:268:14 | 1 | exprs.kt:261:1:270:1 | inPlaceOperators | IntegerLiteral |
+| exprs.kt:272:8:272:66 | T | file://:0:0:0:0 | <none> | TypeAccess |
+| exprs.kt:272:8:272:66 | T[] | file://:0:0:0:0 | <none> | TypeAccess |
+| exprs.kt:272:52:272:66 | <error expr> | exprs.kt:272:8:272:66 | getEnumValues | ErrorExpr |
+| exprs.kt:274:1:277:1 | Unit | file://:0:0:0:0 | <none> | TypeAccess |
+| exprs.kt:275:5:275:23 | <implicit coercion to unit> | exprs.kt:274:1:277:1 | callToEnumValues | ImplicitCoercionToUnitExpr |
+| exprs.kt:275:5:275:23 | Color | exprs.kt:274:1:277:1 | callToEnumValues | TypeAccess |
+| exprs.kt:275:5:275:23 | Unit | exprs.kt:274:1:277:1 | callToEnumValues | TypeAccess |
+| exprs.kt:275:5:275:23 | values(...) | exprs.kt:274:1:277:1 | callToEnumValues | MethodAccess |
+| exprs.kt:276:5:276:26 | <implicit coercion to unit> | exprs.kt:274:1:277:1 | callToEnumValues | ImplicitCoercionToUnitExpr |
+| exprs.kt:276:5:276:26 | Color | exprs.kt:274:1:277:1 | callToEnumValues | TypeAccess |
+| exprs.kt:276:5:276:26 | ExprsKt | exprs.kt:274:1:277:1 | callToEnumValues | TypeAccess |
+| exprs.kt:276:5:276:26 | Unit | exprs.kt:274:1:277:1 | callToEnumValues | TypeAccess |
+| exprs.kt:276:5:276:26 | getEnumValues(...) | exprs.kt:274:1:277:1 | callToEnumValues | MethodAccess |
 | funcExprs.kt:1:1:1:46 | Unit | file://:0:0:0:0 | <none> | TypeAccess |
 | funcExprs.kt:1:26:1:37 | Function0<Integer> | file://:0:0:0:0 | <none> | TypeAccess |
 | funcExprs.kt:1:26:1:37 | Integer | file://:0:0:0:0 | <none> | TypeAccess |
diff --git a/java/ql/test/kotlin/library-tests/exprs/exprs.kt b/java/ql/test/kotlin/library-tests/exprs/exprs.kt
index 85a550ba1ee..bd401f30e21 100644
--- a/java/ql/test/kotlin/library-tests/exprs/exprs.kt
+++ b/java/ql/test/kotlin/library-tests/exprs/exprs.kt
@@ -268,3 +268,10 @@ fun inPlaceOperators() {
   updated %= 1
 
 }
+
+inline fun <reified T : Enum<T>> getEnumValues() = enumValues<T>()
+
+fun callToEnumValues() {
+    enumValues<Color>()
+    getEnumValues<Color>()
+}
diff --git a/java/ql/test/kotlin/library-tests/generics-location/locations.expected b/java/ql/test/kotlin/library-tests/generics-location/locations.expected
index c0c37948cb6..bafdc26e216 100644
--- a/java/ql/test/kotlin/library-tests/generics-location/locations.expected
+++ b/java/ql/test/kotlin/library-tests/generics-location/locations.expected
@@ -12,15 +12,15 @@ classLocations
 | main.B<String> | file:///!unknown-binary-location/main/B.class:0:0:0:0 | file:///!unknown-binary-location/main/B.class:0:0:0:0 |
 | main.B<String> | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 |
 callableLocations
-| A.fn | A.class:0:0:0:0 | A.class:0:0:0:0 |
-| A.fn | A.java:4:17:4:18 | A.java:4:17:4:18 |
-| A<Integer>.fn | A.class:0:0:0:0 | A.class:0:0:0:0 |
-| A<Object>.fn | file:///!unknown-binary-location/main/A.class:0:0:0:0 | file:///!unknown-binary-location/main/A.class:0:0:0:0 |
-| A<String>.fn | A.class:0:0:0:0 | A.class:0:0:0:0 |
-| A<String>.fn | file:///!unknown-binary-location/main/A.class:0:0:0:0 | file:///!unknown-binary-location/main/A.class:0:0:0:0 |
-| B.fn | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 |
-| B.fn | generics.kt:4:5:10:5 | generics.kt:4:5:10:5 |
-| B<Integer>.fn | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 |
-| B<Object>.fn | file:///!unknown-binary-location/main/B.class:0:0:0:0 | file:///!unknown-binary-location/main/B.class:0:0:0:0 |
-| B<String>.fn | file:///!unknown-binary-location/main/B.class:0:0:0:0 | file:///!unknown-binary-location/main/B.class:0:0:0:0 |
-| B<String>.fn | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 |
+| main.A.fn | A.class:0:0:0:0 | A.class:0:0:0:0 |
+| main.A.fn | A.java:4:17:4:18 | A.java:4:17:4:18 |
+| main.A<Integer>.fn | A.class:0:0:0:0 | A.class:0:0:0:0 |
+| main.A<Object>.fn | file:///!unknown-binary-location/main/A.class:0:0:0:0 | file:///!unknown-binary-location/main/A.class:0:0:0:0 |
+| main.A<String>.fn | A.class:0:0:0:0 | A.class:0:0:0:0 |
+| main.A<String>.fn | file:///!unknown-binary-location/main/A.class:0:0:0:0 | file:///!unknown-binary-location/main/A.class:0:0:0:0 |
+| main.B.fn | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 |
+| main.B.fn | generics.kt:4:5:10:5 | generics.kt:4:5:10:5 |
+| main.B<Integer>.fn | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 |
+| main.B<Object>.fn | file:///!unknown-binary-location/main/B.class:0:0:0:0 | file:///!unknown-binary-location/main/B.class:0:0:0:0 |
+| main.B<String>.fn | file:///!unknown-binary-location/main/B.class:0:0:0:0 | file:///!unknown-binary-location/main/B.class:0:0:0:0 |
+| main.B<String>.fn | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 | generics-location.testproj/test.class.files/main/B.class:0:0:0:0 |
diff --git a/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/Java.java b/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/Java.java
new file mode 100644
index 00000000000..73be4ea80bb
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/Java.java
@@ -0,0 +1,5 @@
+public class Java {
+	void javaFun() {
+		new Kotlin().kotlinFun$main();
+	}
+}
diff --git a/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/Kotlin.kt b/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/Kotlin.kt
new file mode 100644
index 00000000000..989efa69fae
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/Kotlin.kt
@@ -0,0 +1,4 @@
+public class Kotlin {
+	internal fun kotlinFun() {
+	}
+}
diff --git a/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/visibility.expected b/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/visibility.expected
new file mode 100644
index 00000000000..3edb62a6505
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/visibility.expected
@@ -0,0 +1,9 @@
+isPublic
+isInternal
+| Kotlin.kt:2:11:3:2 | kotlinFun$main |
+modifiers_methods
+| file://:0:0:0:0 | final | Kotlin.kt:2:11:3:2 | kotlinFun$main |
+| file://:0:0:0:0 | internal | Kotlin.kt:2:11:3:2 | kotlinFun$main |
+#select
+| Kotlin.kt:2:11:3:2 | kotlinFun$main | final |
+| Kotlin.kt:2:11:3:2 | kotlinFun$main | internal |
diff --git a/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/visibility.ql b/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/visibility.ql
new file mode 100644
index 00000000000..452cee9b3c6
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/java_and_kotlin_internal/visibility.ql
@@ -0,0 +1,13 @@
+import java
+
+from Method m, string s
+where m.fromSource() and m.hasModifier(s)
+select m, s
+
+query predicate isPublic(Method m) { m.fromSource() and m.isPublic() }
+
+query predicate isInternal(Method m) { m.fromSource() and m.isInternal() }
+
+query predicate modifiers_methods(Modifier mo, Method me) {
+  mo.getElement() = me and me.fromSource()
+}
diff --git a/java/ql/test/kotlin/library-tests/methods-mixed-java-and-kotlin/test.expected b/java/ql/test/kotlin/library-tests/methods-mixed-java-and-kotlin/test.expected
index dc6cb870289..12654f3142a 100644
--- a/java/ql/test/kotlin/library-tests/methods-mixed-java-and-kotlin/test.expected
+++ b/java/ql/test/kotlin/library-tests/methods-mixed-java-and-kotlin/test.expected
@@ -1,6 +1,6 @@
-| A.class:0:0:0:0 | foo | A<String>.foo | foo(java.lang.String) | A.java:4:10:4:12 | foo | A.foo |
-| A.java:4:10:4:12 | foo | A.foo | foo(java.lang.Object) | A.java:4:10:4:12 | foo | A.foo |
-| B.java:4:17:4:19 | foo | B.foo | foo(java.lang.String) | B.java:4:17:4:19 | foo | B.foo |
-| W.kt:4:5:4:17 | foo | A.foo | foo(java.lang.Object) | W.kt:4:5:4:17 | foo | A.foo |
-| W.kt:8:14:8:34 | foo | B.foo | foo(java.lang.String) | W.kt:8:14:8:34 | foo | B.foo |
-| file:///!unknown-binary-location/k/A.class:0:0:0:0 | foo | A<String>.foo | foo(java.lang.String) | W.kt:4:5:4:17 | foo | A.foo |
+| A.class:0:0:0:0 | foo | j.A<String>.foo | foo(java.lang.String) | A.java:4:10:4:12 | foo | j.A.foo |
+| A.java:4:10:4:12 | foo | j.A.foo | foo(java.lang.Object) | A.java:4:10:4:12 | foo | j.A.foo |
+| B.java:4:17:4:19 | foo | j.B.foo | foo(java.lang.String) | B.java:4:17:4:19 | foo | j.B.foo |
+| W.kt:4:5:4:17 | foo | k.A.foo | foo(java.lang.Object) | W.kt:4:5:4:17 | foo | k.A.foo |
+| W.kt:8:14:8:34 | foo | k.B.foo | foo(java.lang.String) | W.kt:8:14:8:34 | foo | k.B.foo |
+| file:///!unknown-binary-location/k/A.class:0:0:0:0 | foo | k.A<String>.foo | foo(java.lang.String) | W.kt:4:5:4:17 | foo | k.A.foo |
diff --git a/java/ql/test/kotlin/library-tests/multiple_files/method_accesses.expected b/java/ql/test/kotlin/library-tests/multiple_files/method_accesses.expected
index fdb38b16ff7..849ae5204e9 100644
--- a/java/ql/test/kotlin/library-tests/multiple_files/method_accesses.expected
+++ b/java/ql/test/kotlin/library-tests/multiple_files/method_accesses.expected
@@ -1,5 +1,5 @@
 | file1.kt:4:18:4:23 | fun2(...) | file2.kt:3:5:3:18 | fun2 | Class2.fun2 | file2.kt:2:1:4:1 | Class2 |
 | file1.kt:5:9:5:14 | fun3(...) | file3.kt:5:1:6:1 | fun3 | MyJvmName.fun3 | file3.kt:0:0:0:0 | MyJvmName |
 | file1.kt:6:9:6:14 | fun4(...) | file4.kt:4:1:5:1 | fun4 | File4Kt.fun4 | file4.kt:0:0:0:0 | File4Kt |
-| file1.kt:11:29:11:56 | toArray(...) | file://<external>/CollectionToArray.class:0:0:0:0 | toArray | CollectionToArray.toArray | file://<external>/CollectionToArray.class:0:0:0:0 | CollectionToArray |
-| file1.kt:11:47:11:55 | listOf(...) | file://<external>/CollectionsKt.class:0:0:0:0 | listOf | CollectionsKt.listOf | file://<external>/CollectionsKt.class:0:0:0:0 | CollectionsKt |
+| file1.kt:11:29:11:56 | toArray(...) | file://<external>/CollectionToArray.class:0:0:0:0 | toArray | kotlin.jvm.internal.CollectionToArray.toArray | file://<external>/CollectionToArray.class:0:0:0:0 | CollectionToArray |
+| file1.kt:11:47:11:55 | listOf(...) | file://<external>/CollectionsKt.class:0:0:0:0 | listOf | kotlin.collections.CollectionsKt.listOf | file://<external>/CollectionsKt.class:0:0:0:0 | CollectionsKt |
diff --git a/java/ql/test/kotlin/library-tests/operator-overloads/PrintAst.expected b/java/ql/test/kotlin/library-tests/operator-overloads/PrintAst.expected
new file mode 100644
index 00000000000..af62c3e412e
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/operator-overloads/PrintAst.expected
@@ -0,0 +1,103 @@
+test.kt:
+#    0| [CompilationUnit] test
+#    0|   1: [Class] TestKt
+#    1|     1: [Method] fn
+#    1|       3: [TypeAccess] Unit
+#-----|       4: (Parameters)
+#    1|         0: [Parameter] arr
+#    1|           0: [TypeAccess] byte[]
+#    1|         1: [Parameter] mt
+#    1|           0: [TypeAccess] C
+#    1|       5: [BlockStmt] { ... }
+#    2|         0: [ExprStmt] <Expr>;
+#    2|           0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#    2|             0: [TypeAccess] Unit
+#    2|             1: [ArrayAccess] ...[...]
+#    2|               0: [VarAccess] arr
+#    2|               1: [IntegerLiteral] 1
+#    3|         1: [ExprStmt] <Expr>;
+#    3|           0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#    3|             0: [TypeAccess] Unit
+#    3|             1: [MethodAccess] get(...)
+#    3|               -1: [TypeAccess] TestKt
+#    3|               0: [VarAccess] arr
+#    3|               1: [IntegerLiteral] 1
+#    3|               2: [IntegerLiteral] 2
+#    4|         2: [ExprStmt] <Expr>;
+#    4|           0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#    4|             0: [TypeAccess] Unit
+#    4|             1: [MethodAccess] get(...)
+#    4|               -1: [VarAccess] mt
+#    4|               0: [IntegerLiteral] 1
+#    4|               1: [IntegerLiteral] 2
+#    6|         3: [ExprStmt] <Expr>;
+#    6|           0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#    6|             0: [TypeAccess] Unit
+#    6|             1: [MethodAccess] set(...)
+#    6|               -1: [TypeAccess] TestKt
+#    6|               0: [VarAccess] arr
+#    6|               1: [IntegerLiteral] 1
+#    6|               2: [IntegerLiteral] 2
+#    6|               3: [IntegerLiteral] 3
+#    7|         4: [ExprStmt] <Expr>;
+#    7|           0: [ImplicitCoercionToUnitExpr] <implicit coercion to unit>
+#    7|             0: [TypeAccess] Unit
+#    7|             1: [MethodAccess] set(...)
+#    7|               -1: [TypeAccess] TestKt
+#    7|               0: [VarAccess] arr
+#    7|               1: [IntegerLiteral] 1
+#    7|               2: [ClassInstanceExpr] new C(...)
+#    7|                 -3: [TypeAccess] C
+#   10|     2: [ExtensionMethod] get
+#   10|       3: [TypeAccess] String
+#-----|       4: (Parameters)
+#   10|         0: [Parameter] <this>
+#   10|           0: [TypeAccess] byte[]
+#   10|         1: [Parameter] i
+#   10|           0: [TypeAccess] int
+#   10|         2: [Parameter] j
+#   10|           0: [TypeAccess] int
+#   10|       5: [BlockStmt] { ... }
+#   10|         0: [ReturnStmt] return ...
+#   10|           0: [StringLiteral] 
+#   11|     3: [ExtensionMethod] set
+#   11|       3: [TypeAccess] String
+#-----|       4: (Parameters)
+#   11|         0: [Parameter] <this>
+#   11|           0: [TypeAccess] byte[]
+#   11|         1: [Parameter] i
+#   11|           0: [TypeAccess] int
+#   11|         2: [Parameter] j
+#   11|           0: [TypeAccess] int
+#   11|         3: [Parameter] k
+#   11|           0: [TypeAccess] int
+#   11|       5: [BlockStmt] { ... }
+#   11|         0: [ReturnStmt] return ...
+#   11|           0: [StringLiteral] 
+#   12|     4: [ExtensionMethod] set
+#   12|       3: [TypeAccess] String
+#-----|       4: (Parameters)
+#   12|         0: [Parameter] <this>
+#   12|           0: [TypeAccess] byte[]
+#   12|         1: [Parameter] i
+#   12|           0: [TypeAccess] int
+#   12|         2: [Parameter] c
+#   12|           0: [TypeAccess] C
+#   12|       5: [BlockStmt] { ... }
+#   12|         0: [ReturnStmt] return ...
+#   12|           0: [StringLiteral] 
+#   15|   2: [Class] C
+#   15|     1: [Constructor] C
+#   15|       5: [BlockStmt] { ... }
+#   15|         0: [SuperConstructorInvocationStmt] super(...)
+#   15|         1: [BlockStmt] { ... }
+#   16|     2: [Method] get
+#   16|       3: [TypeAccess] String
+#-----|       4: (Parameters)
+#   16|         0: [Parameter] i
+#   16|           0: [TypeAccess] int
+#   16|         1: [Parameter] j
+#   16|           0: [TypeAccess] int
+#   16|       5: [BlockStmt] { ... }
+#   16|         0: [ReturnStmt] return ...
+#   16|           0: [StringLiteral] 
diff --git a/java/ql/test/kotlin/library-tests/operator-overloads/PrintAst.qlref b/java/ql/test/kotlin/library-tests/operator-overloads/PrintAst.qlref
new file mode 100644
index 00000000000..c7fd5faf239
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/operator-overloads/PrintAst.qlref
@@ -0,0 +1 @@
+semmle/code/java/PrintAst.ql
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-312/CleartextStorageSharedPrefsTest.expected b/java/ql/test/kotlin/library-tests/operator-overloads/test.expected
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/CleartextStorageSharedPrefsTest.expected
rename to java/ql/test/kotlin/library-tests/operator-overloads/test.expected
diff --git a/java/ql/test/kotlin/library-tests/operator-overloads/test.kt b/java/ql/test/kotlin/library-tests/operator-overloads/test.kt
new file mode 100644
index 00000000000..d332c995148
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/operator-overloads/test.kt
@@ -0,0 +1,17 @@
+fun fn(arr: ByteArray, mt: C) {
+    arr[1]
+    arr[1, 2]
+    mt[1, 2]
+
+    arr[1, 2] = 3
+    arr[1] = C()
+}
+
+public operator fun ByteArray.get(i: Int, j: Int) = ""
+public operator fun ByteArray.set(i: Int, j: Int, k: Int) = ""
+public operator fun ByteArray.set(i: Int, c: C) = ""
+
+
+public class C {
+    public operator fun get(i: Int, j: Int) = ""
+}
diff --git a/java/ql/test/kotlin/library-tests/operator-overloads/test.ql b/java/ql/test/kotlin/library-tests/operator-overloads/test.ql
new file mode 100644
index 00000000000..16d62d79b3c
--- /dev/null
+++ b/java/ql/test/kotlin/library-tests/operator-overloads/test.ql
@@ -0,0 +1,6 @@
+import java
+import java
+import semmle.code.java.Diagnostics
+
+from Diagnostic d
+select d
diff --git a/java/ql/test/kotlin/library-tests/reflection/reflection.expected b/java/ql/test/kotlin/library-tests/reflection/reflection.expected
index 9b6899f4b6e..12bbfb4db98 100644
--- a/java/ql/test/kotlin/library-tests/reflection/reflection.expected
+++ b/java/ql/test/kotlin/library-tests/reflection/reflection.expected
@@ -73,48 +73,48 @@ propertySetReferences
 | reflection.kt:68:17:68:34 | ...::... | reflection.kt:68:17:68:34 | set | file://<external>/Class1$Generic.class:0:0:0:0 | setP2 |
 | reflection.kt:109:17:109:27 | ...::... | reflection.kt:109:17:109:27 | set | reflection.kt:105:18:105:31 | setProp1 |
 callsInsideInvocationMethods
-| reflection.kt:7:49:7:54 | ...::... | reflection.kt:7:49:7:54 | new Function2<Ccc,Integer,Double>(...) { ... } | reflection.kt:7:49:7:54 | invoke | reflection.kt:7:49:7:54 | m(...) | Ccc.m |
-| reflection.kt:10:38:10:42 | ...::... | reflection.kt:10:38:10:42 | new KProperty1<C,Integer>(...) { ... } | reflection.kt:10:38:10:42 | get | reflection.kt:10:38:10:42 | getP0(...) | C.getP0 |
-| reflection.kt:10:38:10:42 | ...::... | reflection.kt:10:38:10:42 | new KProperty1<C,Integer>(...) { ... } | reflection.kt:10:38:10:42 | invoke | reflection.kt:10:38:10:42 | get(...) | .get |
-| reflection.kt:14:38:14:44 | ...::... | reflection.kt:14:38:14:44 | new Function1<C,Integer>(...) { ... } | reflection.kt:14:38:14:44 | invoke | reflection.kt:14:38:14:44 | get(...) | KProperty1<C,Integer>.get |
-| reflection.kt:15:35:15:41 | ...::... | reflection.kt:15:35:15:41 | new KProperty0<Integer>(...) { ... } | reflection.kt:15:35:15:41 | get | reflection.kt:15:35:15:41 | getP0(...) | C.getP0 |
-| reflection.kt:15:35:15:41 | ...::... | reflection.kt:15:35:15:41 | new KProperty0<Integer>(...) { ... } | reflection.kt:15:35:15:41 | invoke | reflection.kt:15:35:15:41 | get(...) | .get |
-| reflection.kt:17:45:17:49 | ...::... | reflection.kt:17:45:17:49 | new KMutableProperty1<C,Integer>(...) { ... } | reflection.kt:17:45:17:49 | get | reflection.kt:17:45:17:49 | getP1(...) | C.getP1 |
-| reflection.kt:17:45:17:49 | ...::... | reflection.kt:17:45:17:49 | new KMutableProperty1<C,Integer>(...) { ... } | reflection.kt:17:45:17:49 | invoke | reflection.kt:17:45:17:49 | get(...) | .get |
-| reflection.kt:17:45:17:49 | ...::... | reflection.kt:17:45:17:49 | new KMutableProperty1<C,Integer>(...) { ... } | reflection.kt:17:45:17:49 | set | reflection.kt:17:45:17:49 | setP1(...) | C.setP1 |
-| reflection.kt:21:44:21:50 | ...::... | reflection.kt:21:44:21:50 | new Function2<C,Integer,Unit>(...) { ... } | reflection.kt:21:44:21:50 | invoke | reflection.kt:21:44:21:50 | set(...) | KMutableProperty1<C,Integer>.set |
-| reflection.kt:22:42:22:48 | ...::... | reflection.kt:22:42:22:48 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:22:42:22:48 | get | reflection.kt:22:42:22:48 | getP1(...) | C.getP1 |
-| reflection.kt:22:42:22:48 | ...::... | reflection.kt:22:42:22:48 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:22:42:22:48 | invoke | reflection.kt:22:42:22:48 | get(...) | .get |
-| reflection.kt:22:42:22:48 | ...::... | reflection.kt:22:42:22:48 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:22:42:22:48 | set | reflection.kt:22:42:22:48 | setP1(...) | C.setP1 |
+| reflection.kt:7:49:7:54 | ...::... | reflection.kt:7:49:7:54 | new Function2<Ccc,Integer,Double>(...) { ... } | reflection.kt:7:49:7:54 | invoke | reflection.kt:7:49:7:54 | m(...) | Reflection$Ccc.m |
+| reflection.kt:10:38:10:42 | ...::... | reflection.kt:10:38:10:42 | new KProperty1<C,Integer>(...) { ... } | reflection.kt:10:38:10:42 | get | reflection.kt:10:38:10:42 | getP0(...) | Reflection$C.getP0 |
+| reflection.kt:10:38:10:42 | ...::... | reflection.kt:10:38:10:42 | new KProperty1<C,Integer>(...) { ... } | reflection.kt:10:38:10:42 | invoke | reflection.kt:10:38:10:42 | get(...) | <anonymous class>.get |
+| reflection.kt:14:38:14:44 | ...::... | reflection.kt:14:38:14:44 | new Function1<C,Integer>(...) { ... } | reflection.kt:14:38:14:44 | invoke | reflection.kt:14:38:14:44 | get(...) | kotlin.reflect.KProperty1<C,Integer>.get |
+| reflection.kt:15:35:15:41 | ...::... | reflection.kt:15:35:15:41 | new KProperty0<Integer>(...) { ... } | reflection.kt:15:35:15:41 | get | reflection.kt:15:35:15:41 | getP0(...) | Reflection$C.getP0 |
+| reflection.kt:15:35:15:41 | ...::... | reflection.kt:15:35:15:41 | new KProperty0<Integer>(...) { ... } | reflection.kt:15:35:15:41 | invoke | reflection.kt:15:35:15:41 | get(...) | <anonymous class>.get |
+| reflection.kt:17:45:17:49 | ...::... | reflection.kt:17:45:17:49 | new KMutableProperty1<C,Integer>(...) { ... } | reflection.kt:17:45:17:49 | get | reflection.kt:17:45:17:49 | getP1(...) | Reflection$C.getP1 |
+| reflection.kt:17:45:17:49 | ...::... | reflection.kt:17:45:17:49 | new KMutableProperty1<C,Integer>(...) { ... } | reflection.kt:17:45:17:49 | invoke | reflection.kt:17:45:17:49 | get(...) | <anonymous class>.get |
+| reflection.kt:17:45:17:49 | ...::... | reflection.kt:17:45:17:49 | new KMutableProperty1<C,Integer>(...) { ... } | reflection.kt:17:45:17:49 | set | reflection.kt:17:45:17:49 | setP1(...) | Reflection$C.setP1 |
+| reflection.kt:21:44:21:50 | ...::... | reflection.kt:21:44:21:50 | new Function2<C,Integer,Unit>(...) { ... } | reflection.kt:21:44:21:50 | invoke | reflection.kt:21:44:21:50 | set(...) | kotlin.reflect.KMutableProperty1<C,Integer>.set |
+| reflection.kt:22:42:22:48 | ...::... | reflection.kt:22:42:22:48 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:22:42:22:48 | get | reflection.kt:22:42:22:48 | getP1(...) | Reflection$C.getP1 |
+| reflection.kt:22:42:22:48 | ...::... | reflection.kt:22:42:22:48 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:22:42:22:48 | invoke | reflection.kt:22:42:22:48 | get(...) | <anonymous class>.get |
+| reflection.kt:22:42:22:48 | ...::... | reflection.kt:22:42:22:48 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:22:42:22:48 | set | reflection.kt:22:42:22:48 | setP1(...) | Reflection$C.setP1 |
 | reflection.kt:50:13:50:28 | ...::... | reflection.kt:50:13:50:28 | new KProperty1<String,Character>(...) { ... } | reflection.kt:50:13:50:28 | get | reflection.kt:50:13:50:28 | getLastChar(...) | ReflectionKt.getLastChar |
-| reflection.kt:50:13:50:28 | ...::... | reflection.kt:50:13:50:28 | new KProperty1<String,Character>(...) { ... } | reflection.kt:50:13:50:28 | invoke | reflection.kt:50:13:50:28 | get(...) | .get |
+| reflection.kt:50:13:50:28 | ...::... | reflection.kt:50:13:50:28 | new KProperty1<String,Character>(...) { ... } | reflection.kt:50:13:50:28 | invoke | reflection.kt:50:13:50:28 | get(...) | <anonymous class>.get |
 | reflection.kt:51:13:51:28 | ...::... | reflection.kt:51:13:51:28 | new KProperty0<Character>(...) { ... } | reflection.kt:51:13:51:28 | get | reflection.kt:51:13:51:28 | getLastChar(...) | ReflectionKt.getLastChar |
-| reflection.kt:51:13:51:28 | ...::... | reflection.kt:51:13:51:28 | new KProperty0<Character>(...) { ... } | reflection.kt:51:13:51:28 | invoke | reflection.kt:51:13:51:28 | get(...) | .get |
-| reflection.kt:60:17:60:32 | ...::... | reflection.kt:60:17:60:32 | new Function2<Generic<Integer>,Integer,String>(...) { ... } | reflection.kt:60:17:60:32 | invoke | reflection.kt:60:17:60:32 | m1(...) | Generic<Integer>.m1 |
-| reflection.kt:61:17:61:34 | ...::... | reflection.kt:61:17:61:34 | new Function1<Integer,String>(...) { ... } | reflection.kt:61:17:61:34 | invoke | reflection.kt:61:17:61:34 | m1(...) | Generic<Integer>.m1 |
+| reflection.kt:51:13:51:28 | ...::... | reflection.kt:51:13:51:28 | new KProperty0<Character>(...) { ... } | reflection.kt:51:13:51:28 | invoke | reflection.kt:51:13:51:28 | get(...) | <anonymous class>.get |
+| reflection.kt:60:17:60:32 | ...::... | reflection.kt:60:17:60:32 | new Function2<Generic<Integer>,Integer,String>(...) { ... } | reflection.kt:60:17:60:32 | invoke | reflection.kt:60:17:60:32 | m1(...) | Class1$Generic<Integer>.m1 |
+| reflection.kt:61:17:61:34 | ...::... | reflection.kt:61:17:61:34 | new Function1<Integer,String>(...) { ... } | reflection.kt:61:17:61:34 | invoke | reflection.kt:61:17:61:34 | m1(...) | Class1$Generic<Integer>.m1 |
 | reflection.kt:62:17:62:34 | ...::... | reflection.kt:62:17:62:34 | new Function1<Generic<Integer>,String>(...) { ... } | reflection.kt:62:17:62:34 | invoke | reflection.kt:62:17:62:34 | ext1(...) | ReflectionKt.ext1 |
 | reflection.kt:63:17:63:36 | ...::... | reflection.kt:63:17:63:36 | new Function0<String>(...) { ... } | reflection.kt:63:17:63:36 | invoke | reflection.kt:63:17:63:36 | ext1(...) | ReflectionKt.ext1 |
 | reflection.kt:64:17:64:34 | ...::... | reflection.kt:64:17:64:34 | new Function1<Generic<Integer>,String>(...) { ... } | reflection.kt:64:17:64:34 | invoke | reflection.kt:64:17:64:34 | ext2(...) | ReflectionKt.ext2 |
 | reflection.kt:65:17:65:36 | ...::... | reflection.kt:65:17:65:36 | new Function0<String>(...) { ... } | reflection.kt:65:17:65:36 | invoke | reflection.kt:65:17:65:36 | ext2(...) | ReflectionKt.ext2 |
-| reflection.kt:67:17:67:32 | ...::... | reflection.kt:67:17:67:32 | new KMutableProperty1<Generic<Integer>,Integer>(...) { ... } | reflection.kt:67:17:67:32 | get | reflection.kt:67:17:67:32 | getP2(...) | Generic<Integer>.getP2 |
-| reflection.kt:67:17:67:32 | ...::... | reflection.kt:67:17:67:32 | new KMutableProperty1<Generic<Integer>,Integer>(...) { ... } | reflection.kt:67:17:67:32 | invoke | reflection.kt:67:17:67:32 | get(...) | .get |
-| reflection.kt:67:17:67:32 | ...::... | reflection.kt:67:17:67:32 | new KMutableProperty1<Generic<Integer>,Integer>(...) { ... } | reflection.kt:67:17:67:32 | set | reflection.kt:67:17:67:32 | setP2(...) | Generic<Integer>.setP2 |
-| reflection.kt:68:17:68:34 | ...::... | reflection.kt:68:17:68:34 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:68:17:68:34 | get | reflection.kt:68:17:68:34 | getP2(...) | Generic<Integer>.getP2 |
-| reflection.kt:68:17:68:34 | ...::... | reflection.kt:68:17:68:34 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:68:17:68:34 | invoke | reflection.kt:68:17:68:34 | get(...) | .get |
-| reflection.kt:68:17:68:34 | ...::... | reflection.kt:68:17:68:34 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:68:17:68:34 | set | reflection.kt:68:17:68:34 | setP2(...) | Generic<Integer>.setP2 |
-| reflection.kt:70:17:70:30 | ...::... | reflection.kt:70:17:70:30 | new KProperty0<Integer>(...) { ... } | reflection.kt:70:17:70:30 | get | reflection.kt:70:17:70:30 | getMAX_VALUE(...) | IntCompanionObject.getMAX_VALUE |
-| reflection.kt:70:17:70:30 | ...::... | reflection.kt:70:17:70:30 | new KProperty0<Integer>(...) { ... } | reflection.kt:70:17:70:30 | invoke | reflection.kt:70:17:70:30 | get(...) | .get |
-| reflection.kt:71:17:71:34 | ...::... | reflection.kt:71:17:71:34 | new KProperty0<Integer>(...) { ... } | reflection.kt:71:17:71:34 | invoke | reflection.kt:71:17:71:34 | get(...) | .get |
-| reflection.kt:72:17:72:35 | ...::... | reflection.kt:72:17:72:35 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:72:17:72:35 | invoke | reflection.kt:72:17:72:35 | get(...) | .get |
-| reflection.kt:90:18:90:24 | ...::... | reflection.kt:90:18:90:24 | new Function1<String,Inner<String>>(...) { ... } | reflection.kt:90:18:90:24 | invoke | reflection.kt:90:18:90:24 | new Inner<String>(...) | Inner<String>.Inner<String> |
+| reflection.kt:67:17:67:32 | ...::... | reflection.kt:67:17:67:32 | new KMutableProperty1<Generic<Integer>,Integer>(...) { ... } | reflection.kt:67:17:67:32 | get | reflection.kt:67:17:67:32 | getP2(...) | Class1$Generic<Integer>.getP2 |
+| reflection.kt:67:17:67:32 | ...::... | reflection.kt:67:17:67:32 | new KMutableProperty1<Generic<Integer>,Integer>(...) { ... } | reflection.kt:67:17:67:32 | invoke | reflection.kt:67:17:67:32 | get(...) | <anonymous class>.get |
+| reflection.kt:67:17:67:32 | ...::... | reflection.kt:67:17:67:32 | new KMutableProperty1<Generic<Integer>,Integer>(...) { ... } | reflection.kt:67:17:67:32 | set | reflection.kt:67:17:67:32 | setP2(...) | Class1$Generic<Integer>.setP2 |
+| reflection.kt:68:17:68:34 | ...::... | reflection.kt:68:17:68:34 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:68:17:68:34 | get | reflection.kt:68:17:68:34 | getP2(...) | Class1$Generic<Integer>.getP2 |
+| reflection.kt:68:17:68:34 | ...::... | reflection.kt:68:17:68:34 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:68:17:68:34 | invoke | reflection.kt:68:17:68:34 | get(...) | <anonymous class>.get |
+| reflection.kt:68:17:68:34 | ...::... | reflection.kt:68:17:68:34 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:68:17:68:34 | set | reflection.kt:68:17:68:34 | setP2(...) | Class1$Generic<Integer>.setP2 |
+| reflection.kt:70:17:70:30 | ...::... | reflection.kt:70:17:70:30 | new KProperty0<Integer>(...) { ... } | reflection.kt:70:17:70:30 | get | reflection.kt:70:17:70:30 | getMAX_VALUE(...) | kotlin.jvm.internal.IntCompanionObject.getMAX_VALUE |
+| reflection.kt:70:17:70:30 | ...::... | reflection.kt:70:17:70:30 | new KProperty0<Integer>(...) { ... } | reflection.kt:70:17:70:30 | invoke | reflection.kt:70:17:70:30 | get(...) | <anonymous class>.get |
+| reflection.kt:71:17:71:34 | ...::... | reflection.kt:71:17:71:34 | new KProperty0<Integer>(...) { ... } | reflection.kt:71:17:71:34 | invoke | reflection.kt:71:17:71:34 | get(...) | <anonymous class>.get |
+| reflection.kt:72:17:72:35 | ...::... | reflection.kt:72:17:72:35 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:72:17:72:35 | invoke | reflection.kt:72:17:72:35 | get(...) | <anonymous class>.get |
+| reflection.kt:90:18:90:24 | ...::... | reflection.kt:90:18:90:24 | new Function1<String,Inner<String>>(...) { ... } | reflection.kt:90:18:90:24 | invoke | reflection.kt:90:18:90:24 | new Inner<String>(...) | Class2$Inner<String>.Inner<String> |
 | reflection.kt:97:14:97:21 | ...::... | reflection.kt:97:14:97:21 | new Function1<String,Class2<String>>(...) { ... } | reflection.kt:97:14:97:21 | invoke | reflection.kt:97:14:97:21 | new Class2<String>(...) | Class2<String>.Class2<String> |
 | reflection.kt:98:14:98:17 | ...::... | reflection.kt:98:14:98:17 | new Function1<String,Unit>(...) { ... } | reflection.kt:98:14:98:17 | invoke | reflection.kt:98:14:98:17 | fn(...) | ReflectionKt.fn |
-| reflection.kt:99:14:99:29 | ...::... | reflection.kt:99:14:99:29 | new Function1<String,Inner<String>>(...) { ... } | reflection.kt:99:14:99:29 | invoke | reflection.kt:99:14:99:29 | new Inner<String>(...) | Inner<String>.Inner<String> |
+| reflection.kt:99:14:99:29 | ...::... | reflection.kt:99:14:99:29 | new Function1<String,Inner<String>>(...) { ... } | reflection.kt:99:14:99:29 | invoke | reflection.kt:99:14:99:29 | new Inner<String>(...) | Class2<Integer>$Inner<String>.Inner<String> |
 | reflection.kt:109:17:109:27 | ...::... | reflection.kt:109:17:109:27 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:109:17:109:27 | get | reflection.kt:109:17:109:27 | getProp1(...) | Base1.getProp1 |
-| reflection.kt:109:17:109:27 | ...::... | reflection.kt:109:17:109:27 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:109:17:109:27 | invoke | reflection.kt:109:17:109:27 | get(...) | .get |
+| reflection.kt:109:17:109:27 | ...::... | reflection.kt:109:17:109:27 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:109:17:109:27 | invoke | reflection.kt:109:17:109:27 | get(...) | <anonymous class>.get |
 | reflection.kt:109:17:109:27 | ...::... | reflection.kt:109:17:109:27 | new KMutableProperty0<Integer>(...) { ... } | reflection.kt:109:17:109:27 | set | reflection.kt:109:17:109:27 | setProp1(...) | Base1.setProp1 |
-| reflection.kt:116:40:116:44 | ...::... | reflection.kt:116:40:116:44 | new Function1<Integer,Unit>(...) { ... } | reflection.kt:116:40:116:44 | invoke | reflection.kt:116:40:116:44 | fn1(...) | .fn1 |
-| reflection.kt:116:40:116:44 | ...::... | reflection.kt:116:40:116:44 | new Function1<Integer,Unit>(...) { ... } | reflection.kt:116:40:116:44 | invoke | reflection.kt:116:40:116:44 | new (...) | . |
+| reflection.kt:116:40:116:44 | ...::... | reflection.kt:116:40:116:44 | new Function1<Integer,Unit>(...) { ... } | reflection.kt:116:40:116:44 | invoke | reflection.kt:116:40:116:44 | fn1(...) | LocalFn$.fn1 |
+| reflection.kt:116:40:116:44 | ...::... | reflection.kt:116:40:116:44 | new Function1<Integer,Unit>(...) { ... } | reflection.kt:116:40:116:44 | invoke | reflection.kt:116:40:116:44 | new (...) | LocalFn$. |
 | reflection.kt:126:9:126:13 | ...::... | reflection.kt:126:9:126:13 | new Function0<Unit>(...) { ... } | reflection.kt:126:9:126:13 | invoke | reflection.kt:126:9:126:13 | fn1(...) | ReflectionKt.fn1 |
 fieldAccessInsideInvocationMethods
 | reflection.kt:14:38:14:44 | ...::... | reflection.kt:14:38:14:44 | new Function1<C,Integer>(...) { ... } | reflection.kt:14:38:14:44 | invoke | reflection.kt:14:38:14:44 | this.<dispatchReceiver> |
diff --git a/java/ql/test/kotlin/library-tests/special-method-getters/test.expected b/java/ql/test/kotlin/library-tests/special-method-getters/test.expected
index fdec7b0e605..da020f1e146 100644
--- a/java/ql/test/kotlin/library-tests/special-method-getters/test.expected
+++ b/java/ql/test/kotlin/library-tests/special-method-getters/test.expected
@@ -1,9 +1,11 @@
-| test.kt:1:84:1:89 | length(...) | length |
-| test.kt:1:97:1:100 | size(...) | size |
-| test.kt:1:108:1:111 | size(...) | size |
-| test.kt:1:119:1:122 | keySet(...) | keySet |
-| test.kt:1:124:1:127 | size(...) | size |
-| test.kt:1:135:1:140 | values(...) | values |
-| test.kt:1:142:1:145 | size(...) | size |
-| test.kt:1:153:1:159 | entrySet(...) | entrySet |
-| test.kt:1:161:1:164 | size(...) | size |
+diag
+#select
+| test.kt:1:84:1:89 | length(...) | java.lang.CharSequence | length |
+| test.kt:1:97:1:100 | size(...) | java.util.Collection<String> | size |
+| test.kt:1:108:1:111 | size(...) | java.util.Map<String,String> | size |
+| test.kt:1:119:1:122 | keySet(...) | java.util.Map<String,String> | keySet |
+| test.kt:1:124:1:127 | size(...) | java.util.Set<String> | size |
+| test.kt:1:135:1:140 | values(...) | java.util.Map<String,String> | values |
+| test.kt:1:142:1:145 | size(...) | java.util.Collection<String> | size |
+| test.kt:1:153:1:159 | entrySet(...) | java.util.Map<String,String> | entrySet |
+| test.kt:1:161:1:164 | size(...) | java.util.Set<Entry<String,String>> | size |
diff --git a/java/ql/test/kotlin/library-tests/special-method-getters/test.ql b/java/ql/test/kotlin/library-tests/special-method-getters/test.ql
index 257b3344501..748756aefef 100644
--- a/java/ql/test/kotlin/library-tests/special-method-getters/test.ql
+++ b/java/ql/test/kotlin/library-tests/special-method-getters/test.ql
@@ -1,4 +1,7 @@
 import java
+import semmle.code.java.Diagnostics
 
 from MethodAccess ma
-select ma, ma.getCallee().toString()
+select ma, ma.getCallee().getDeclaringType().getQualifiedName(), ma.getCallee().getName()
+
+query predicate diag(Diagnostic d) { any() }
diff --git a/java/ql/test/kotlin/library-tests/vararg/args.expected b/java/ql/test/kotlin/library-tests/vararg/args.expected
index 3d6a2347a95..317a907bdc8 100644
--- a/java/ql/test/kotlin/library-tests/vararg/args.expected
+++ b/java/ql/test/kotlin/library-tests/vararg/args.expected
@@ -1,9 +1,11 @@
+diag
 varargsParams
 | test.kt:8:15:8:28 | xs | file://:0:0:0:0 | int[] |
 | test.kt:12:26:12:39 | xs | file://:0:0:0:0 | int[] |
 | test.kt:20:24:20:37 | xs | file://:0:0:0:0 | int[] |
 | test.kt:24:50:24:63 | xs | file://:0:0:0:0 | int[] |
 | test.kt:28:37:28:50 | xs | file://:0:0:0:0 | int[] |
+| test.kt:50:5:50:31 | s | file://:0:0:0:0 | String[] |
 explicitVarargsArguments
 | test.kt:12:50:12:51 | xs | test.kt:12:44:12:52 | this(...) |
 | test.kt:38:25:38:29 | array | test.kt:38:5:38:30 | funWithOnlyVarArgs(...) |
@@ -11,6 +13,7 @@ explicitVarargsArguments
 | test.kt:40:34:40:38 | array | test.kt:40:5:40:49 | funWithMiddleVarArgs(...) |
 | test.kt:44:27:44:31 | array | test.kt:44:5:44:32 | new HasVarargConstructor(...) |
 | test.kt:45:34:45:38 | array | test.kt:45:5:45:39 | new HasVarargConstructor(...) |
+| test.kt:55:15:55:35 | tmp0_s | test.kt:55:13:55:43 | new X(...) |
 implicitVarargsArguments
 | intList.kt:3:21:3:22 | 10 | intList.kt:3:14:3:31 | listOf(...) | 0 |
 | intList.kt:3:25:3:26 | 11 | intList.kt:3:14:3:31 | listOf(...) | 1 |
@@ -78,3 +81,6 @@ implicitVarargsArguments
 | test.kt:44:5:44:32 | new HasVarargConstructor(...) | 0 | test.kt:44:27:44:31 | array |
 | test.kt:45:5:45:39 | new HasVarargConstructor(...) | 0 | test.kt:45:27:45:29 | foo |
 | test.kt:45:5:45:39 | new HasVarargConstructor(...) | 1 | test.kt:45:34:45:38 | array |
+| test.kt:55:13:55:43 | new X(...) | 0 | test.kt:55:42:55:42 | 1 |
+| test.kt:55:13:55:43 | new X(...) | 1 | test.kt:55:15:55:35 | tmp0_s |
+| test.kt:55:22:55:35 | toTypedArray(...) | 0 | test.kt:55:19:55:20 | sl |
diff --git a/java/ql/test/kotlin/library-tests/vararg/args.ql b/java/ql/test/kotlin/library-tests/vararg/args.ql
index e58bf622e98..4173094463b 100644
--- a/java/ql/test/kotlin/library-tests/vararg/args.ql
+++ b/java/ql/test/kotlin/library-tests/vararg/args.ql
@@ -1,4 +1,7 @@
 import java
+import semmle.code.java.Diagnostics
+
+query predicate diag(Diagnostic d) { d.getMessage() = "Unexpected IrVararg" }
 
 query predicate varargsParams(Parameter p, Type t) {
   p.getCallable().fromSource() and
diff --git a/java/ql/test/kotlin/library-tests/vararg/test.kt b/java/ql/test/kotlin/library-tests/vararg/test.kt
index 00dc8f13d78..966f9d0f5a9 100644
--- a/java/ql/test/kotlin/library-tests/vararg/test.kt
+++ b/java/ql/test/kotlin/library-tests/vararg/test.kt
@@ -1,6 +1,6 @@
 
 fun sink(sunk: Int) {
-    
+
 }
 
 open class HasVarargConstructor {
@@ -44,3 +44,13 @@ fun myFun() {
     HasVarargConstructor(*array)
     HasVarargConstructor("foo", *array)
 }
+
+open class X(
+    i: Int,
+    public vararg val s: String
+) { }
+
+fun fn(sl: List<String>) {
+    // reordered args:
+    val x = X(s = sl.toTypedArray(), i = 1)
+}
diff --git a/java/ql/test/library-tests/MemberRefExpr/MemberRefExpr.expected b/java/ql/test/library-tests/MemberRefExpr/MemberRefExpr.expected
index b02fa9c0e9a..3260a055b94 100644
--- a/java/ql/test/library-tests/MemberRefExpr/MemberRefExpr.expected
+++ b/java/ql/test/library-tests/MemberRefExpr/MemberRefExpr.expected
@@ -1,14 +1,14 @@
-| Test.java:24:26:24:51 | ...::... | Inner<>.Inner<> | Test$Generic$Inner.class:0:0:0:0 | Inner<> |
-| Test.java:38:29:38:42 | ...::... | Object.toString | Test.java:1:7:1:10 | Test |
-| Test.java:39:29:39:42 | ...::... | Object.hashCode | Test.java:1:7:1:10 | Test |
-| Test.java:40:29:40:39 | ...::... | Object.clone | Test.java:1:7:1:10 | Test |
-| Test.java:41:40:41:64 | ...::... | Object.toString | Test$Generic.class:0:0:0:0 | Generic<String> |
-| Test.java:43:23:43:36 | ...::... | Object.toString | Test.java:1:7:1:10 | Test |
-| Test.java:44:23:44:36 | ...::... | Object.hashCode | Test.java:1:7:1:10 | Test |
-| Test.java:45:23:45:33 | ...::... | Object.clone | Test.java:1:7:1:10 | Test |
-| Test.java:48:22:48:35 | ...::... | Object.toString | Test.java:1:7:1:10 | Test |
+| Test.java:24:26:24:51 | ...::... | Test$Generic<Number>$Inner<>.Inner<> | Test$Generic$Inner.class:0:0:0:0 | Inner<> |
+| Test.java:38:29:38:42 | ...::... | java.lang.Object.toString | Test.java:1:7:1:10 | Test |
+| Test.java:39:29:39:42 | ...::... | java.lang.Object.hashCode | Test.java:1:7:1:10 | Test |
+| Test.java:40:29:40:39 | ...::... | java.lang.Object.clone | Test.java:1:7:1:10 | Test |
+| Test.java:41:40:41:64 | ...::... | java.lang.Object.toString | Test$Generic.class:0:0:0:0 | Generic<String> |
+| Test.java:43:23:43:36 | ...::... | java.lang.Object.toString | Test.java:1:7:1:10 | Test |
+| Test.java:44:23:44:36 | ...::... | java.lang.Object.hashCode | Test.java:1:7:1:10 | Test |
+| Test.java:45:23:45:33 | ...::... | java.lang.Object.clone | Test.java:1:7:1:10 | Test |
+| Test.java:48:22:48:35 | ...::... | java.lang.Object.toString | Test.java:1:7:1:10 | Test |
 | Test.java:51:13:51:21 | ...::... | Test.Test | Test.java:1:7:1:10 | Test |
-| Test.java:52:13:52:32 | ...::... | Generic<String>.Generic<String> | Test$Generic.class:0:0:0:0 | Generic<String> |
+| Test.java:52:13:52:32 | ...::... | Test$Generic<String>.Generic<String> | Test$Generic.class:0:0:0:0 | Generic<String> |
 | Test.java:56:13:56:22 | ...::... |  | file://:0:0:0:0 | int[] |
 | Test.java:57:13:57:26 | ...::... |  | file://:0:0:0:0 | Generic<>[] |
 | Test.java:61:31:61:47 | ...::... | Test.doSomething | Test.java:1:7:1:10 | Test |
diff --git a/java/ql/test/library-tests/annotation-arrays/Test.java b/java/ql/test/library-tests/annotation-arrays/Test.java
new file mode 100644
index 00000000000..d7e721d8ad2
--- /dev/null
+++ b/java/ql/test/library-tests/annotation-arrays/Test.java
@@ -0,0 +1,14 @@
+class Test {
+
+  @interface CustomAnnotation {
+    String value();
+  }
+
+  @interface ArrayValues {
+    CustomAnnotation[] annotationValues();
+  }
+
+  @ArrayValues(annotationValues = @CustomAnnotation(value = "only")) private int fieldWithSingular;
+  @ArrayValues(annotationValues = {@CustomAnnotation(value = "val1"), @CustomAnnotation(value = "val2")}) private int fieldWithMultiple;
+
+}
diff --git a/java/ql/test/library-tests/annotation-arrays/test.expected b/java/ql/test/library-tests/annotation-arrays/test.expected
new file mode 100644
index 00000000000..cd7c8dc15cc
--- /dev/null
+++ b/java/ql/test/library-tests/annotation-arrays/test.expected
@@ -0,0 +1,3 @@
+| Test.java:11:82:11:98 | fieldWithSingular | Test.java:11:3:11:68 | ArrayValues | Test.java:11:35:11:67 | {...} | Test.java:11:35:11:67 | CustomAnnotation |
+| Test.java:12:119:12:135 | fieldWithMultiple | Test.java:12:3:12:105 | ArrayValues | Test.java:12:35:12:104 | {...} | Test.java:12:36:12:68 | CustomAnnotation |
+| Test.java:12:119:12:135 | fieldWithMultiple | Test.java:12:3:12:105 | ArrayValues | Test.java:12:35:12:104 | {...} | Test.java:12:71:12:103 | CustomAnnotation |
diff --git a/java/ql/test/library-tests/annotation-arrays/test.ql b/java/ql/test/library-tests/annotation-arrays/test.ql
new file mode 100644
index 00000000000..4598687c915
--- /dev/null
+++ b/java/ql/test/library-tests/annotation-arrays/test.ql
@@ -0,0 +1,9 @@
+import java
+
+from Field f, Annotation ann, Expr value, Expr valueChild
+where
+  f.getDeclaringType().fromSource() and
+  ann = f.getAnAnnotation() and
+  value = ann.getValue(_) and
+  valueChild.getParent() = value
+select f, ann, value, valueChild
diff --git a/java/ql/test/library-tests/annotations/Annotatable.expected b/java/ql/test/library-tests/annotations/Annotatable.expected
new file mode 100644
index 00000000000..7708e78a305
--- /dev/null
+++ b/java/ql/test/library-tests/annotations/Annotatable.expected
@@ -0,0 +1,101 @@
+declaredAnnotation
+| Annotatable.java:8:16:8:40 | CustomInheritedAnnotation | Annotatable.java:7:5:7:14 | Inherited |
+| Annotatable.java:14:11:14:22 | WithDeclared | Annotatable.java:12:5:12:21 | CustomAnnotation |
+| Annotatable.java:14:11:14:22 | WithDeclared | Annotatable.java:13:5:13:38 | CustomInheritedAnnotation |
+| Annotatable.java:17:14:17:31 | methodWithDeclared | Annotatable.java:16:9:16:49 | CustomInheritedAnnotation |
+| Annotatable.java:22:14:22:31 | methodWithDeclared | Annotatable.java:21:9:21:17 | Override |
+| Annotatable.java:30:11:30:41 | SubclassDeclaringSameAnnotation | Annotatable.java:29:5:29:37 | CustomInheritedAnnotation |
+| Annotatable.java:35:15:35:35 | InterfaceWithDeclared | Annotatable.java:34:5:34:38 | CustomInheritedAnnotation |
+| Annotatable.java:47:16:47:35 | RepeatableAnnotation | Annotatable.java:46:5:46:42 | Repeatable |
+| Annotatable.java:52:16:52:43 | InheritedContainerAnnotation | Annotatable.java:51:5:51:14 | Inherited |
+| Annotatable.java:58:16:58:44 | InheritedRepeatableAnnotation | Annotatable.java:56:5:56:14 | Inherited |
+| Annotatable.java:58:16:58:44 | InheritedRepeatableAnnotation | Annotatable.java:57:5:57:51 | Repeatable |
+| Annotatable.java:63:16:63:44 | InheritedContainerAnnotation2 | Annotatable.java:62:5:62:14 | Inherited |
+| Annotatable.java:71:16:71:47 | NonInheritedRepeatableAnnotation | Annotatable.java:70:5:70:52 | Repeatable |
+| Annotatable.java:78:11:78:30 | WithAssociatedSingle | Annotatable.java:75:5:75:33 | RepeatableAnnotation |
+| Annotatable.java:78:11:78:30 | WithAssociatedSingle | Annotatable.java:76:5:76:42 | InheritedRepeatableAnnotation |
+| Annotatable.java:78:11:78:30 | WithAssociatedSingle | Annotatable.java:77:5:77:45 | NonInheritedRepeatableAnnotation |
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.class:0:0:0:0 | ContainerAnnotation |
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation |
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation2 |
+| Annotatable.java:92:11:92:44 | SubclassOfSingleWithEmptyContainer | Annotatable.java:90:5:90:37 | InheritedContainerAnnotation |
+| Annotatable.java:92:11:92:44 | SubclassOfSingleWithEmptyContainer | Annotatable.java:91:5:91:38 | InheritedContainerAnnotation2 |
+| Annotatable.java:98:15:98:37 | InterfaceWithAssociated | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation |
+| Annotatable.java:113:11:113:32 | WithAssociatedMultiple | Annotatable.class:0:0:0:0 | ContainerAnnotation |
+| Annotatable.java:113:11:113:32 | WithAssociatedMultiple | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation |
+| Annotatable.java:113:11:113:32 | WithAssociatedMultiple | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation2 |
+| Annotatable.java:116:14:116:39 | methodWithAssociatedSingle | Annotatable.java:115:9:115:53 | InheritedRepeatableAnnotation |
+| Annotatable.java:121:14:121:33 | methodWithAssociated | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation |
+| Annotatable.java:126:14:126:39 | methodWithAssociatedSingle | Annotatable.java:125:9:125:17 | Override |
+| Annotatable.java:129:14:129:33 | methodWithAssociated | Annotatable.java:128:9:128:17 | Override |
+| Annotatable.java:138:11:138:28 | SubclassWithSingle | Annotatable.java:135:5:135:34 | RepeatableAnnotation |
+| Annotatable.java:138:11:138:28 | SubclassWithSingle | Annotatable.java:136:5:136:43 | InheritedRepeatableAnnotation |
+| Annotatable.java:138:11:138:28 | SubclassWithSingle | Annotatable.java:137:5:137:46 | NonInheritedRepeatableAnnotation |
+| Annotatable.java:144:11:144:46 | SubclassOfMultipleWithEmptyContainer | Annotatable.java:142:5:142:37 | InheritedContainerAnnotation |
+| Annotatable.java:144:11:144:46 | SubclassOfMultipleWithEmptyContainer | Annotatable.java:143:5:143:38 | InheritedContainerAnnotation2 |
+| Annotatable.java:150:35:153:5 | {...} | Annotatable.java:151:9:151:53 | InheritedRepeatableAnnotation |
+| Annotatable.java:150:35:153:5 | {...} | Annotatable.java:152:9:152:53 | InheritedRepeatableAnnotation |
+| Annotatable.java:154:11:154:45 | ExplicitContainerAndSingleContained | Annotatable.java:148:5:148:44 | InheritedRepeatableAnnotation |
+| Annotatable.java:154:11:154:45 | ExplicitContainerAndSingleContained | Annotatable.java:150:5:153:6 | InheritedContainerAnnotation |
+| Annotatable.java:160:16:160:41 | NestedAnnotationContainer1 | Annotatable.java:159:5:159:14 | Inherited |
+| Annotatable.java:166:16:166:32 | NestedAnnotation1 | Annotatable.java:164:5:164:14 | Inherited |
+| Annotatable.java:166:16:166:32 | NestedAnnotation1 | Annotatable.java:165:5:165:49 | Repeatable |
+| Annotatable.java:172:16:172:32 | NestedAnnotation2 | Annotatable.java:170:5:170:14 | Inherited |
+| Annotatable.java:172:16:172:32 | NestedAnnotation2 | Annotatable.java:171:5:171:40 | Repeatable |
+| Annotatable.java:182:11:182:30 | WithNestedAssociated | Annotatable.class:0:0:0:0 | NestedAnnotationContainer1 |
+| Annotatable.java:182:11:182:30 | WithNestedAssociated | Annotatable.java:177:5:177:27 | NestedAnnotation2 |
+| Annotatable.java:189:11:189:48 | WithNestedAssociatedExplicitContainers | Annotatable.class:0:0:0:0 | NestedAnnotationContainer1 |
+annotationAdditional
+| Annotatable.java:20:11:20:18 | Subclass | Annotatable.java:13:5:13:38 | CustomInheritedAnnotation |
+| Annotatable.java:26:11:26:21 | SubSubclass | Annotatable.java:13:5:13:38 | CustomInheritedAnnotation |
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.java:76:5:76:42 | InheritedRepeatableAnnotation |
+| Annotatable.java:92:11:92:44 | SubclassOfSingleWithEmptyContainer | Annotatable.java:76:5:76:42 | InheritedRepeatableAnnotation |
+| Annotatable.java:124:11:124:32 | WithAssociatedSubclass | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation |
+| Annotatable.java:124:11:124:32 | WithAssociatedSubclass | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation2 |
+| Annotatable.java:133:11:133:35 | WithAssociatedSubSubclass | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation |
+| Annotatable.java:133:11:133:35 | WithAssociatedSubSubclass | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation2 |
+| Annotatable.java:138:11:138:28 | SubclassWithSingle | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation |
+| Annotatable.java:138:11:138:28 | SubclassWithSingle | Annotatable.class:0:0:0:0 | InheritedContainerAnnotation2 |
+| Annotatable.java:156:11:156:35 | ExplicitContainerSubclass | Annotatable.java:148:5:148:44 | InheritedRepeatableAnnotation |
+| Annotatable.java:156:11:156:35 | ExplicitContainerSubclass | Annotatable.java:150:5:153:6 | InheritedContainerAnnotation |
+| Annotatable.java:184:11:184:38 | WithNestedAssociatedSubclass | Annotatable.class:0:0:0:0 | NestedAnnotationContainer1 |
+| Annotatable.java:184:11:184:38 | WithNestedAssociatedSubclass | Annotatable.java:177:5:177:27 | NestedAnnotation2 |
+| Annotatable.java:191:11:191:56 | WithNestedAssociatedExplicitContainersSubclass | Annotatable.class:0:0:0:0 | NestedAnnotationContainer1 |
+bugAnnotationAdditional
+associatedAnnotationAdditional
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.class:0:0:0:0 | NonInheritedRepeatableAnnotation |
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.class:0:0:0:0 | NonInheritedRepeatableAnnotation |
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.class:0:0:0:0 | RepeatableAnnotation |
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.class:0:0:0:0 | RepeatableAnnotation |
+| Annotatable.java:98:15:98:37 | InterfaceWithAssociated | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:98:15:98:37 | InterfaceWithAssociated | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:113:11:113:32 | WithAssociatedMultiple | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:113:11:113:32 | WithAssociatedMultiple | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:113:11:113:32 | WithAssociatedMultiple | Annotatable.class:0:0:0:0 | NonInheritedRepeatableAnnotation |
+| Annotatable.java:113:11:113:32 | WithAssociatedMultiple | Annotatable.class:0:0:0:0 | NonInheritedRepeatableAnnotation |
+| Annotatable.java:113:11:113:32 | WithAssociatedMultiple | Annotatable.class:0:0:0:0 | RepeatableAnnotation |
+| Annotatable.java:113:11:113:32 | WithAssociatedMultiple | Annotatable.class:0:0:0:0 | RepeatableAnnotation |
+| Annotatable.java:121:14:121:33 | methodWithAssociated | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:121:14:121:33 | methodWithAssociated | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:124:11:124:32 | WithAssociatedSubclass | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:124:11:124:32 | WithAssociatedSubclass | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:133:11:133:35 | WithAssociatedSubSubclass | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:133:11:133:35 | WithAssociatedSubSubclass | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:144:11:144:46 | SubclassOfMultipleWithEmptyContainer | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:144:11:144:46 | SubclassOfMultipleWithEmptyContainer | Annotatable.class:0:0:0:0 | InheritedRepeatableAnnotation |
+| Annotatable.java:154:11:154:45 | ExplicitContainerAndSingleContained | Annotatable.java:151:9:151:53 | InheritedRepeatableAnnotation |
+| Annotatable.java:154:11:154:45 | ExplicitContainerAndSingleContained | Annotatable.java:152:9:152:53 | InheritedRepeatableAnnotation |
+| Annotatable.java:156:11:156:35 | ExplicitContainerSubclass | Annotatable.java:151:9:151:53 | InheritedRepeatableAnnotation |
+| Annotatable.java:156:11:156:35 | ExplicitContainerSubclass | Annotatable.java:152:9:152:53 | InheritedRepeatableAnnotation |
+| Annotatable.java:182:11:182:30 | WithNestedAssociated | Annotatable.class:0:0:0:0 | NestedAnnotation1 |
+| Annotatable.java:182:11:182:30 | WithNestedAssociated | Annotatable.class:0:0:0:0 | NestedAnnotation1 |
+| Annotatable.java:184:11:184:38 | WithNestedAssociatedSubclass | Annotatable.class:0:0:0:0 | NestedAnnotation1 |
+| Annotatable.java:184:11:184:38 | WithNestedAssociatedSubclass | Annotatable.class:0:0:0:0 | NestedAnnotation1 |
+| Annotatable.java:189:11:189:48 | WithNestedAssociatedExplicitContainers | Annotatable.class:0:0:0:0 | NestedAnnotation1 |
+| Annotatable.java:189:11:189:48 | WithNestedAssociatedExplicitContainers | Annotatable.class:0:0:0:0 | NestedAnnotation1 |
+| Annotatable.java:191:11:191:56 | WithNestedAssociatedExplicitContainersSubclass | Annotatable.class:0:0:0:0 | NestedAnnotation1 |
+| Annotatable.java:191:11:191:56 | WithNestedAssociatedExplicitContainersSubclass | Annotatable.class:0:0:0:0 | NestedAnnotation1 |
+associatedAnnotationNotInherited
+| Annotatable.java:86:11:86:30 | SubclassWithMultiple | Annotatable.java:76:5:76:42 | InheritedRepeatableAnnotation |
diff --git a/java/ql/test/library-tests/annotations/Annotatable.java b/java/ql/test/library-tests/annotations/Annotatable.java
new file mode 100644
index 00000000000..e73d48bb24d
--- /dev/null
+++ b/java/ql/test/library-tests/annotations/Annotatable.java
@@ -0,0 +1,192 @@
+import java.lang.annotation.Inherited;
+import java.lang.annotation.Repeatable;
+
+class Annotatable {
+    @interface CustomAnnotation {}
+
+    @Inherited
+    @interface CustomInheritedAnnotation {
+        String value();
+    }
+
+    @CustomAnnotation
+    @CustomInheritedAnnotation("base")
+    class WithDeclared {
+        // Annotations on methods are not inherited
+        @CustomInheritedAnnotation("base-method")
+        void methodWithDeclared() {}
+    }
+
+    class Subclass extends WithDeclared {
+        @Override
+        void methodWithDeclared() {}
+    }
+
+    // Inheritance from super-superclass
+    class SubSubclass extends Subclass {}
+
+    // Prevents inheriting annotation of same type
+    @CustomInheritedAnnotation("sub")
+    class SubclassDeclaringSameAnnotation extends WithDeclared {}
+
+
+    // Annotations on interfaces are not inherited
+    @CustomInheritedAnnotation("base")
+    interface InterfaceWithDeclared {}
+
+    interface ExtendingInterface extends InterfaceWithDeclared {}
+
+    class ImplementingInterface implements InterfaceWithDeclared {}
+
+
+    @interface ContainerAnnotation {
+        RepeatableAnnotation[] value();
+    }
+
+    @Repeatable(ContainerAnnotation.class)
+    @interface RepeatableAnnotation {
+        String value();
+    }
+
+    @Inherited
+    @interface InheritedContainerAnnotation {
+        InheritedRepeatableAnnotation[] value();
+    }
+
+    @Inherited
+    @Repeatable(InheritedContainerAnnotation.class)
+    @interface InheritedRepeatableAnnotation {
+        String value();
+    }
+
+    @Inherited
+    @interface InheritedContainerAnnotation2 {
+        NonInheritedRepeatableAnnotation[] value();
+    }
+
+    // Container is marked as @Inherited, but this annotation type is not
+    // This is allowed, but means that associated annotations will not be inherited,
+    // see java.lang.reflect.AnnotatedElement documentation
+    @Repeatable(InheritedContainerAnnotation2.class)
+    @interface NonInheritedRepeatableAnnotation {
+        String value();
+    }
+
+    @RepeatableAnnotation("base")
+    @InheritedRepeatableAnnotation("base")
+    @NonInheritedRepeatableAnnotation("base")
+    class WithAssociatedSingle {}
+
+    @RepeatableAnnotation("sub-1")
+    @RepeatableAnnotation("sub-2")
+    @InheritedRepeatableAnnotation("sub-1")
+    @InheritedRepeatableAnnotation("sub-2")
+    @NonInheritedRepeatableAnnotation("sub-1")
+    @NonInheritedRepeatableAnnotation("sub-2")
+    class SubclassWithMultiple extends WithAssociatedSingle {}
+
+
+    // Empty container annotations have no effect; annotations are inherited from superclass
+    @InheritedContainerAnnotation({})
+    @InheritedContainerAnnotation2({})
+    class SubclassOfSingleWithEmptyContainer extends WithAssociatedSingle {}
+
+
+    // Annotations on interfaces are not inherited
+    @InheritedRepeatableAnnotation("base-1")
+    @InheritedRepeatableAnnotation("base-2")
+    interface InterfaceWithAssociated {}
+
+    interface ExtendingInterfaceWithAssociated extends InterfaceWithAssociated {}
+
+    class ImplementingInterfaceWithAssociated implements InterfaceWithAssociated {}
+
+
+    @RepeatableAnnotation("base-1")
+    @RepeatableAnnotation("base-2")
+    @InheritedRepeatableAnnotation("base-1")
+    @InheritedRepeatableAnnotation("base-2")
+    // These annotations are not inherited, but their (implicit) container annotation
+    // is inherited
+    @NonInheritedRepeatableAnnotation("base-1")
+    @NonInheritedRepeatableAnnotation("base-2")
+    class WithAssociatedMultiple {
+        // Annotations on methods are not inherited
+        @InheritedRepeatableAnnotation("base-method")
+        void methodWithAssociatedSingle() {}
+
+        // Annotations on methods are not inherited
+        @InheritedRepeatableAnnotation("base-method-1")
+        @InheritedRepeatableAnnotation("base-method-2")
+        void methodWithAssociated() {}
+    }
+
+    class WithAssociatedSubclass extends WithAssociatedMultiple {
+        @Override
+        void methodWithAssociatedSingle() {}
+
+        @Override
+        void methodWithAssociated() {}
+    }
+
+    // Inheritance from super-superclass
+    class WithAssociatedSubSubclass extends WithAssociatedSubclass {}
+
+    @RepeatableAnnotation("sub-1")
+    @InheritedRepeatableAnnotation("sub-1")
+    @NonInheritedRepeatableAnnotation("sub-1")
+    class SubclassWithSingle extends WithAssociatedMultiple {}
+
+
+    // Empty container annotations have no effect; associated annotations are inherited from superclass
+    @InheritedContainerAnnotation({})
+    @InheritedContainerAnnotation2({})
+    class SubclassOfMultipleWithEmptyContainer extends WithAssociatedMultiple {}
+
+
+    // This annotation exists on its own without a container
+    @InheritedRepeatableAnnotation("single")
+    // TODO: Has currently spurious results for ArrayInit due to https://github.com/github/codeql/issues/8647
+    @InheritedContainerAnnotation({
+        @InheritedRepeatableAnnotation("container-1"),
+        @InheritedRepeatableAnnotation("container-2")
+    })
+    class ExplicitContainerAndSingleContained {}
+
+    class ExplicitContainerSubclass extends ExplicitContainerAndSingleContained {}
+
+
+    @Inherited
+    @interface NestedAnnotationContainer1 {
+        NestedAnnotation1[] value();
+    }
+
+    @Inherited
+    @Repeatable(NestedAnnotationContainer1.class)
+    @interface NestedAnnotation1 {
+        NestedAnnotation2[] value();
+    }
+
+    @Inherited
+    @Repeatable(NestedAnnotation1.class)
+    @interface NestedAnnotation2 {
+        String value();
+    }
+
+    // This annotation exists on its own without a container
+    @NestedAnnotation2("1")
+    // But these are nested inside an implicit @NestedAnnotationContainer1
+    // Nested repeated annotations (@NestedAnnotation2) are not considered associated
+    @NestedAnnotation1({@NestedAnnotation2("1-1"), @NestedAnnotation2("1-2")})
+    @NestedAnnotation1({@NestedAnnotation2("2-1"), @NestedAnnotation2("2-2")})
+    class WithNestedAssociated {}
+
+    class WithNestedAssociatedSubclass extends WithNestedAssociated {}
+
+    // Nested repeated annotations (@NestedAnnotation2) are not considered associated
+    @NestedAnnotation1({@NestedAnnotation2("1-1"), @NestedAnnotation2("1-2")})
+    @NestedAnnotation1({@NestedAnnotation2("2-1"), @NestedAnnotation2("2-2")})
+    class WithNestedAssociatedExplicitContainers {}
+
+    class WithNestedAssociatedExplicitContainersSubclass extends WithNestedAssociatedExplicitContainers {}
+}
diff --git a/java/ql/test/library-tests/annotations/Annotatable.ql b/java/ql/test/library-tests/annotations/Annotatable.ql
new file mode 100644
index 00000000000..12745eb42fc
--- /dev/null
+++ b/java/ql/test/library-tests/annotations/Annotatable.ql
@@ -0,0 +1,34 @@
+import java
+
+class RelevantAnnotatable extends Annotatable {
+  RelevantAnnotatable() {
+    getCompilationUnit().hasName("Annotatable") and getCompilationUnit().fromSource()
+  }
+}
+
+query Annotation declaredAnnotation(RelevantAnnotatable a) { result = a.getADeclaredAnnotation() }
+
+/** Note: Only has the annotations as result which are not also considered _declared_. */
+query Annotation annotationAdditional(RelevantAnnotatable a) {
+  result = a.getAnAnnotation() and not result = a.getADeclaredAnnotation()
+}
+
+/** Sanity check to verify that `getADeclaredAnnotation()` is a subset of `getAnAnnotation()` */
+query Annotation bugAnnotationAdditional(RelevantAnnotatable a) {
+  result = a.getADeclaredAnnotation() and not result = a.getAnAnnotation()
+}
+
+/** Note: Only has the annotations as result which are not part of `getAnAnnotation()`. */
+query Annotation associatedAnnotationAdditional(RelevantAnnotatable a) {
+  result = a.getAnAssociatedAnnotation() and not result = a.getAnAnnotation()
+}
+
+/**
+ * Covers all results of `getAnAssociatedAnnotation()` which are not also a result of `getAnAnnotation()`.
+ * This should only be the case for a base class using an inheritable annotation `A` and a subclass which
+ * has an annotation `CA` of the container type of `A`. In that case `A` is not considered _associated_
+ * and the _indirect_ annotations from `CA` are considered instead.
+ */
+query Annotation associatedAnnotationNotInherited(RelevantAnnotatable a) {
+  result = a.getAnAnnotation() and not result = a.getAnAssociatedAnnotation()
+}
diff --git a/java/ql/test/library-tests/annotations/Annotation-values.expected b/java/ql/test/library-tests/annotations/Annotation-values.expected
new file mode 100644
index 00000000000..55c86f3a124
--- /dev/null
+++ b/java/ql/test/library-tests/annotations/Annotation-values.expected
@@ -0,0 +1,215 @@
+value
+| AnnotationValues.java:39:5:39:17 | SingleValues | annotationValue | AnnotationValues.class:0:0:0:0 | CustomAnnotation |
+| AnnotationValues.java:39:5:39:17 | SingleValues | booleanValue | AnnotationValues.class:0:0:0:0 | false |
+| AnnotationValues.java:39:5:39:17 | SingleValues | byteValue | AnnotationValues.class:0:0:0:0 | -1 |
+| AnnotationValues.java:39:5:39:17 | SingleValues | charValue | AnnotationValues.class:0:0:0:0 | \uffff |
+| AnnotationValues.java:39:5:39:17 | SingleValues | classValue | AnnotationValues.class:0:0:0:0 | AnnotationValues.class |
+| AnnotationValues.java:39:5:39:17 | SingleValues | doubleValue | AnnotationValues.class:0:0:0:0 | -1.0 |
+| AnnotationValues.java:39:5:39:17 | SingleValues | enumValue | AnnotationValues.class:0:0:0:0 | DEFAULT |
+| AnnotationValues.java:39:5:39:17 | SingleValues | floatValue | AnnotationValues.class:0:0:0:0 | -1.0 |
+| AnnotationValues.java:39:5:39:17 | SingleValues | intValue | AnnotationValues.class:0:0:0:0 | -1 |
+| AnnotationValues.java:39:5:39:17 | SingleValues | longValue | AnnotationValues.class:0:0:0:0 | -1 |
+| AnnotationValues.java:39:5:39:17 | SingleValues | shortValue | AnnotationValues.class:0:0:0:0 | -1 |
+| AnnotationValues.java:39:5:39:17 | SingleValues | stringValue | AnnotationValues.class:0:0:0:0 | "\u0000" |
+| AnnotationValues.java:42:5:55:5 | SingleValues | annotationValue | AnnotationValues.java:54:27:54:53 | CustomAnnotation |
+| AnnotationValues.java:42:5:55:5 | SingleValues | booleanValue | AnnotationValues.java:49:24:49:27 | true |
+| AnnotationValues.java:42:5:55:5 | SingleValues | byteValue | AnnotationValues.java:43:21:43:21 | 1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | charValue | AnnotationValues.java:50:21:50:21 | 1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | classValue | AnnotationValues.java:52:22:52:39 | SingleValues.class |
+| AnnotationValues.java:42:5:55:5 | SingleValues | doubleValue | AnnotationValues.java:48:23:48:23 | 1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | enumValue | AnnotationValues.java:53:21:53:32 | CustomEnum.A |
+| AnnotationValues.java:42:5:55:5 | SingleValues | floatValue | AnnotationValues.java:47:22:47:22 | 1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | intValue | AnnotationValues.java:45:20:45:20 | 1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | longValue | AnnotationValues.java:46:21:46:21 | 1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | shortValue | AnnotationValues.java:44:22:44:22 | 1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | stringValue | AnnotationValues.java:51:23:51:25 | "a" |
+| AnnotationValues.java:54:27:54:53 | CustomAnnotation | value | AnnotationValues.java:54:45:54:52 | "single" |
+| AnnotationValues.java:58:5:71:5 | SingleValues | annotationValue | AnnotationValues.java:70:27:70:53 | CustomAnnotation |
+| AnnotationValues.java:58:5:71:5 | SingleValues | booleanValue | AnnotationValues.java:65:24:65:30 | BOOLEAN |
+| AnnotationValues.java:58:5:71:5 | SingleValues | byteValue | AnnotationValues.java:59:21:59:24 | BYTE |
+| AnnotationValues.java:58:5:71:5 | SingleValues | charValue | AnnotationValues.java:66:21:66:24 | CHAR |
+| AnnotationValues.java:58:5:71:5 | SingleValues | classValue | AnnotationValues.java:68:22:68:39 | SingleValues.class |
+| AnnotationValues.java:58:5:71:5 | SingleValues | doubleValue | AnnotationValues.java:64:23:64:28 | DOUBLE |
+| AnnotationValues.java:58:5:71:5 | SingleValues | enumValue | AnnotationValues.java:69:21:69:32 | CustomEnum.A |
+| AnnotationValues.java:58:5:71:5 | SingleValues | floatValue | AnnotationValues.java:63:22:63:26 | FLOAT |
+| AnnotationValues.java:58:5:71:5 | SingleValues | intValue | AnnotationValues.java:61:20:61:22 | INT |
+| AnnotationValues.java:58:5:71:5 | SingleValues | longValue | AnnotationValues.java:62:21:62:24 | LONG |
+| AnnotationValues.java:58:5:71:5 | SingleValues | shortValue | AnnotationValues.java:60:22:60:26 | SHORT |
+| AnnotationValues.java:58:5:71:5 | SingleValues | stringValue | AnnotationValues.java:67:23:67:28 | STRING |
+| AnnotationValues.java:70:27:70:53 | CustomAnnotation | value | AnnotationValues.java:70:45:70:52 | "single" |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | annotationValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | booleanValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | byteValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | charValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | classValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | doubleValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | enumValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | floatValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | intValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | longValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | shortValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | stringValues | AnnotationValues.class:0:0:0:0 | {...} |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | annotationValues | AnnotationValues.java:105:28:105:54 | {...} |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | booleanValues | AnnotationValues.java:100:25:100:28 | true |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | byteValues | AnnotationValues.java:94:22:94:22 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | charValues | AnnotationValues.java:101:22:101:24 | 'a' |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | classValues | AnnotationValues.java:103:23:103:39 | ArrayValues.class |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | doubleValues | AnnotationValues.java:99:24:99:24 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | enumValues | AnnotationValues.java:104:22:104:33 | CustomEnum.A |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | floatValues | AnnotationValues.java:98:23:98:23 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | intValues | AnnotationValues.java:96:21:96:21 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | longValues | AnnotationValues.java:97:22:97:22 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | shortValues | AnnotationValues.java:95:23:95:23 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | stringValues | AnnotationValues.java:102:24:102:26 | "a" |
+| AnnotationValues.java:105:28:105:54 | CustomAnnotation | value | AnnotationValues.java:105:46:105:53 | "single" |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | annotationValues | AnnotationValues.java:121:28:121:84 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | booleanValues | AnnotationValues.java:116:25:116:40 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | byteValues | AnnotationValues.java:110:22:110:30 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | charValues | AnnotationValues.java:117:22:117:32 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | classValues | AnnotationValues.java:119:23:119:61 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | doubleValues | AnnotationValues.java:115:24:115:34 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | enumValues | AnnotationValues.java:120:22:120:49 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | floatValues | AnnotationValues.java:114:23:114:32 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | intValues | AnnotationValues.java:112:21:112:28 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | longValues | AnnotationValues.java:113:22:113:30 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | shortValues | AnnotationValues.java:111:23:111:32 | {...} |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | stringValues | AnnotationValues.java:118:24:118:33 | {...} |
+| AnnotationValues.java:121:29:121:54 | CustomAnnotation | value | AnnotationValues.java:121:47:121:53 | "first" |
+| AnnotationValues.java:121:57:121:83 | CustomAnnotation | value | AnnotationValues.java:121:75:121:82 | "second" |
+enumConstantValue
+| AnnotationValues.java:39:5:39:17 | SingleValues | enumValue | AnnotationValues.java:14:9:14:15 | DEFAULT |
+| AnnotationValues.java:42:5:55:5 | SingleValues | enumValue | AnnotationValues.java:15:9:15:9 | A |
+| AnnotationValues.java:58:5:71:5 | SingleValues | enumValue | AnnotationValues.java:15:9:15:9 | A |
+stringValue
+| AnnotationValues.java:39:5:39:17 | SingleValues | stringValue | \u0000 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | stringValue | a |
+| AnnotationValues.java:54:27:54:53 | CustomAnnotation | value | single |
+| AnnotationValues.java:58:5:71:5 | SingleValues | stringValue | b |
+| AnnotationValues.java:70:27:70:53 | CustomAnnotation | value | single |
+| AnnotationValues.java:105:28:105:54 | CustomAnnotation | value | single |
+| AnnotationValues.java:121:29:121:54 | CustomAnnotation | value | first |
+| AnnotationValues.java:121:57:121:83 | CustomAnnotation | value | second |
+intValue
+| AnnotationValues.java:39:5:39:17 | SingleValues | byteValue | -1 |
+| AnnotationValues.java:39:5:39:17 | SingleValues | charValue | 65535 |
+| AnnotationValues.java:39:5:39:17 | SingleValues | intValue | -1 |
+| AnnotationValues.java:39:5:39:17 | SingleValues | shortValue | -1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | byteValue | 1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | charValue | 1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | intValue | 1 |
+| AnnotationValues.java:42:5:55:5 | SingleValues | shortValue | 1 |
+| AnnotationValues.java:58:5:71:5 | SingleValues | byteValue | 2 |
+| AnnotationValues.java:58:5:71:5 | SingleValues | charValue | 98 |
+| AnnotationValues.java:58:5:71:5 | SingleValues | intValue | 2 |
+| AnnotationValues.java:58:5:71:5 | SingleValues | shortValue | 2 |
+booleanValue
+| AnnotationValues.java:39:5:39:17 | SingleValues | booleanValue | false |
+| AnnotationValues.java:42:5:55:5 | SingleValues | booleanValue | true |
+| AnnotationValues.java:58:5:71:5 | SingleValues | booleanValue | true |
+typeValue
+| AnnotationValues.java:39:5:39:17 | SingleValues | classValue | AnnotationValues.java:1:7:1:22 | AnnotationValues |
+| AnnotationValues.java:42:5:55:5 | SingleValues | classValue | AnnotationValues.java:23:16:23:27 | SingleValues |
+| AnnotationValues.java:58:5:71:5 | SingleValues | classValue | AnnotationValues.java:23:16:23:27 | SingleValues |
+arrayValue
+| AnnotationValues.java:90:5:90:16 | ArrayValues | annotationValues | 0 | AnnotationValues.class:0:0:0:0 | CustomAnnotation |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | booleanValues | 0 | AnnotationValues.class:0:0:0:0 | false |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | byteValues | 0 | AnnotationValues.class:0:0:0:0 | -1 |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | charValues | 0 | AnnotationValues.class:0:0:0:0 | \uffff |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | classValues | 0 | AnnotationValues.class:0:0:0:0 | AnnotationValues.class |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | doubleValues | 0 | AnnotationValues.class:0:0:0:0 | -1.0 |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | enumValues | 0 | AnnotationValues.class:0:0:0:0 | DEFAULT |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | floatValues | 0 | AnnotationValues.class:0:0:0:0 | -1.0 |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | intValues | 0 | AnnotationValues.class:0:0:0:0 | -1 |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | longValues | 0 | AnnotationValues.class:0:0:0:0 | -1 |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | shortValues | 0 | AnnotationValues.class:0:0:0:0 | -1 |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | stringValues | 0 | AnnotationValues.class:0:0:0:0 | "\u0000" |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | annotationValues | 0 | AnnotationValues.java:105:28:105:54 | CustomAnnotation |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | booleanValues | 0 | AnnotationValues.java:100:25:100:28 | true |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | byteValues | 0 | AnnotationValues.java:94:22:94:22 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | charValues | 0 | AnnotationValues.java:101:22:101:24 | 'a' |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | classValues | 0 | AnnotationValues.java:103:23:103:39 | ArrayValues.class |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | doubleValues | 0 | AnnotationValues.java:99:24:99:24 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | enumValues | 0 | AnnotationValues.java:104:22:104:33 | CustomEnum.A |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | floatValues | 0 | AnnotationValues.java:98:23:98:23 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | intValues | 0 | AnnotationValues.java:96:21:96:21 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | longValues | 0 | AnnotationValues.java:97:22:97:22 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | shortValues | 0 | AnnotationValues.java:95:23:95:23 | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | stringValues | 0 | AnnotationValues.java:102:24:102:26 | "a" |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | annotationValues | 0 | AnnotationValues.java:121:29:121:54 | CustomAnnotation |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | annotationValues | 1 | AnnotationValues.java:121:57:121:83 | CustomAnnotation |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | booleanValues | 0 | AnnotationValues.class:0:0:0:0 | false |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | booleanValues | 1 | AnnotationValues.class:0:0:0:0 | true |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | booleanValues | -1 | AnnotationValues.java:116:26:116:30 | false |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | booleanValues | -2 | AnnotationValues.java:116:33:116:39 | BOOLEAN |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | byteValues | 0 | AnnotationValues.class:0:0:0:0 | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | byteValues | 1 | AnnotationValues.class:0:0:0:0 | 2 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | byteValues | -1 | AnnotationValues.java:110:23:110:23 | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | byteValues | -2 | AnnotationValues.java:110:26:110:29 | BYTE |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | charValues | 0 | AnnotationValues.class:0:0:0:0 | a |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | charValues | 1 | AnnotationValues.class:0:0:0:0 | b |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | charValues | -1 | AnnotationValues.java:117:23:117:25 | 'a' |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | charValues | -2 | AnnotationValues.java:117:28:117:31 | CHAR |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | classValues | 0 | AnnotationValues.class:0:0:0:0 | SingleValues.class |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | classValues | 1 | AnnotationValues.class:0:0:0:0 | ArrayValues.class |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | classValues | -1 | AnnotationValues.java:119:24:119:41 | SingleValues.class |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | classValues | -2 | AnnotationValues.java:119:44:119:60 | ArrayValues.class |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | doubleValues | 0 | AnnotationValues.class:0:0:0:0 | 1.0 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | doubleValues | 1 | AnnotationValues.class:0:0:0:0 | 2.0 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | doubleValues | -1 | AnnotationValues.java:115:25:115:25 | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | doubleValues | -2 | AnnotationValues.java:115:28:115:33 | DOUBLE |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | enumValues | 0 | AnnotationValues.class:0:0:0:0 | A |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | enumValues | 1 | AnnotationValues.class:0:0:0:0 | B |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | enumValues | -1 | AnnotationValues.java:120:23:120:34 | CustomEnum.A |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | enumValues | -2 | AnnotationValues.java:120:37:120:48 | CustomEnum.B |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | floatValues | 0 | AnnotationValues.class:0:0:0:0 | 1.0 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | floatValues | 1 | AnnotationValues.class:0:0:0:0 | 2.0 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | floatValues | -1 | AnnotationValues.java:114:24:114:24 | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | floatValues | -2 | AnnotationValues.java:114:27:114:31 | FLOAT |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | intValues | 0 | AnnotationValues.class:0:0:0:0 | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | intValues | 1 | AnnotationValues.class:0:0:0:0 | 2 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | intValues | -1 | AnnotationValues.java:112:22:112:22 | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | intValues | -2 | AnnotationValues.java:112:25:112:27 | INT |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | longValues | 0 | AnnotationValues.class:0:0:0:0 | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | longValues | 1 | AnnotationValues.class:0:0:0:0 | 2 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | longValues | -1 | AnnotationValues.java:113:23:113:23 | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | longValues | -2 | AnnotationValues.java:113:26:113:29 | LONG |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | shortValues | 0 | AnnotationValues.class:0:0:0:0 | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | shortValues | 1 | AnnotationValues.class:0:0:0:0 | 2 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | shortValues | -1 | AnnotationValues.java:111:24:111:24 | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | shortValues | -2 | AnnotationValues.java:111:27:111:31 | SHORT |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | stringValues | 0 | AnnotationValues.class:0:0:0:0 | "a" |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | stringValues | 1 | AnnotationValues.class:0:0:0:0 | "b" |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | stringValues | -1 | AnnotationValues.java:118:25:118:27 | "a" |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | stringValues | -2 | AnnotationValues.java:118:30:118:32 | "b" |
+enumConstantArrayValue
+| AnnotationValues.java:90:5:90:16 | ArrayValues | enumValues | AnnotationValues.java:14:9:14:15 | DEFAULT |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | enumValues | AnnotationValues.java:15:9:15:9 | A |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | enumValues | AnnotationValues.java:15:9:15:9 | A |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | enumValues | AnnotationValues.java:16:9:16:9 | B |
+stringArrayValue
+| AnnotationValues.java:90:5:90:16 | ArrayValues | stringValues | \u0000 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | stringValues | a |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | stringValues | a |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | stringValues | b |
+intArrayValue
+| AnnotationValues.java:90:5:90:16 | ArrayValues | byteValues | -1 |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | charValues | 65535 |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | intValues | -1 |
+| AnnotationValues.java:90:5:90:16 | ArrayValues | shortValues | -1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | byteValues | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | charValues | 97 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | intValues | 1 |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | shortValues | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | byteValues | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | byteValues | 2 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | charValues | 97 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | charValues | 98 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | intValues | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | intValues | 2 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | shortValues | 1 |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | shortValues | 2 |
+typeArrayValue
+| AnnotationValues.java:90:5:90:16 | ArrayValues | classValues | AnnotationValues.java:1:7:1:22 | AnnotationValues |
+| AnnotationValues.java:93:5:106:5 | ArrayValues | classValues | AnnotationValues.java:74:16:74:26 | ArrayValues |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | classValues | AnnotationValues.java:23:16:23:27 | SingleValues |
+| AnnotationValues.java:109:5:122:5 | ArrayValues | classValues | AnnotationValues.java:74:16:74:26 | ArrayValues |
diff --git a/java/ql/test/library-tests/annotations/Annotation-values.ql b/java/ql/test/library-tests/annotations/Annotation-values.ql
new file mode 100644
index 00000000000..65e7be6650c
--- /dev/null
+++ b/java/ql/test/library-tests/annotations/Annotation-values.ql
@@ -0,0 +1,37 @@
+import java
+
+class RelevantAnnotation extends Annotation {
+  RelevantAnnotation() {
+    getCompilationUnit().hasName("AnnotationValues") and getCompilationUnit().fromSource()
+  }
+}
+
+query Expr value(RelevantAnnotation a, string name) { result = a.getValue(name) }
+
+query EnumConstant enumConstantValue(RelevantAnnotation a, string name) {
+  result = a.getEnumConstantValue(name)
+}
+
+query string stringValue(RelevantAnnotation a, string name) { result = a.getStringValue(name) }
+
+query int intValue(RelevantAnnotation a, string name) { result = a.getIntValue(name) }
+
+query boolean booleanValue(RelevantAnnotation a, string name) { result = a.getBooleanValue(name) }
+
+query Type typeValue(RelevantAnnotation a, string name) { result = a.getTypeValue(name) }
+
+query Expr arrayValue(RelevantAnnotation a, string name, int index) {
+  result = a.getArrayValue(name, index)
+}
+
+query EnumConstant enumConstantArrayValue(RelevantAnnotation a, string name) {
+  result = a.getAnEnumConstantArrayValue(name)
+}
+
+query string stringArrayValue(RelevantAnnotation a, string name) {
+  result = a.getAStringArrayValue(name)
+}
+
+query int intArrayValue(RelevantAnnotation a, string name) { result = a.getAnIntArrayValue(name) }
+
+query Type typeArrayValue(RelevantAnnotation a, string name) { result = a.getATypeArrayValue(name) }
diff --git a/java/ql/test/library-tests/annotations/AnnotationType.expected b/java/ql/test/library-tests/annotations/AnnotationType.expected
new file mode 100644
index 00000000000..77d9abf5016
--- /dev/null
+++ b/java/ql/test/library-tests/annotations/AnnotationType.expected
@@ -0,0 +1,13 @@
+annotationType
+| AnnotationType.java:11:16:11:34 | InheritedAnnotation | inherited | <any-target> | CLASS |
+| AnnotationType.java:14:16:14:35 | DocumentedAnnotation | documented | <any-target> | CLASS |
+| AnnotationType.java:16:16:16:34 | ContainerAnnotation |  | <any-target> | CLASS |
+| AnnotationType.java:21:16:21:35 | RepeatableAnnotation | repeatable | <any-target> | CLASS |
+| AnnotationType.java:25:16:25:26 | EmptyTarget |  |  | CLASS |
+| AnnotationType.java:28:16:28:27 | SingleTarget |  | ANNOTATION_TYPE | CLASS |
+| AnnotationType.java:43:16:43:25 | AllTargets |  | ANNOTATION_TYPE,CONSTRUCTOR,FIELD,LOCAL_VARIABLE,METHOD,MODULE,PACKAGE,PARAMETER,RECORD_COMPONENT,TYPE_PARAMETER,TYPE_USE | CLASS |
+| AnnotationType.java:47:16:47:29 | ClassRetention |  | <any-target> | CLASS |
+| AnnotationType.java:50:16:50:31 | RuntimeRetention |  | <any-target> | RUNTIME |
+| AnnotationType.java:53:16:53:30 | SourceRetention |  | <any-target> | SOURCE |
+containingAnnotationType
+| AnnotationType.java:21:16:21:35 | RepeatableAnnotation | AnnotationType.java:16:16:16:34 | ContainerAnnotation |
diff --git a/java/ql/test/library-tests/annotations/AnnotationType.java b/java/ql/test/library-tests/annotations/AnnotationType.java
new file mode 100644
index 00000000000..94498ce36f2
--- /dev/null
+++ b/java/ql/test/library-tests/annotations/AnnotationType.java
@@ -0,0 +1,54 @@
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Inherited;
+import java.lang.annotation.Repeatable;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+class AnnotationType {
+    @Inherited
+    @interface InheritedAnnotation {}
+
+    @Documented
+    @interface DocumentedAnnotation {}
+
+    @interface ContainerAnnotation {
+        RepeatableAnnotation[] value();
+    }
+
+    @Repeatable(ContainerAnnotation.class)
+    @interface RepeatableAnnotation {}
+
+
+    @Target({})
+    @interface EmptyTarget {}
+
+    @Target(ElementType.ANNOTATION_TYPE)
+    @interface SingleTarget {}
+
+    @Target({
+        ElementType.ANNOTATION_TYPE,
+        ElementType.CONSTRUCTOR,
+        ElementType.FIELD,
+        ElementType.LOCAL_VARIABLE,
+        ElementType.METHOD,
+        ElementType.MODULE,
+        ElementType.PACKAGE,
+        ElementType.PARAMETER,
+        ElementType.RECORD_COMPONENT,
+        ElementType.TYPE_PARAMETER,
+        ElementType.TYPE_USE
+    })
+    @interface AllTargets {}
+
+
+    @Retention(RetentionPolicy.CLASS)
+    @interface ClassRetention {}
+
+    @Retention(RetentionPolicy.RUNTIME)
+    @interface RuntimeRetention {}
+
+    @Retention(RetentionPolicy.SOURCE)
+    @interface SourceRetention {}
+}
diff --git a/java/ql/test/library-tests/annotations/AnnotationType.ql b/java/ql/test/library-tests/annotations/AnnotationType.ql
new file mode 100644
index 00000000000..268bc876448
--- /dev/null
+++ b/java/ql/test/library-tests/annotations/AnnotationType.ql
@@ -0,0 +1,46 @@
+import java
+
+class RelevantAnnotationType extends AnnotationType {
+  RelevantAnnotationType() { getCompilationUnit().hasName("AnnotationType") }
+}
+
+query predicate annotationType(
+  RelevantAnnotationType t, string flagsString, string targets, string retentionPolicy
+) {
+  flagsString =
+    concat(string s |
+      t.isInherited() and s = "inherited"
+      or
+      t.isDocumented() and s = "documented"
+      or
+      t.isRepeatable() and s = "repeatable"
+    |
+      s, "," order by s
+    ) and
+  (
+    // Workaround to test if no explicit @Target is specified; in that case any string except
+    // TYPE_USE, which represents type contexts, is considered a target because it might be
+    // added to ElementType in a future JDK version
+    if t.isATargetType("<any-target>")
+    then
+      if t.isATargetType("TYPE_USE")
+      then targets = "BUG: Includes TYPE_USE"
+      else targets = "<any-target>"
+    else
+      targets =
+        concat(string s |
+          exists(EnumConstant elementType |
+            elementType.getDeclaringType().hasQualifiedName("java.lang.annotation", "ElementType") and
+            s = elementType.getName() and
+            t.isATargetType(s)
+          )
+        |
+          s, "," order by s
+        )
+  ) and
+  retentionPolicy = t.getRetentionPolicy()
+}
+
+query AnnotationType containingAnnotationType(RelevantAnnotationType t) {
+  result = t.getContainingAnnotationType()
+}
diff --git a/java/ql/test/library-tests/annotations/AnnotationValues.java b/java/ql/test/library-tests/annotations/AnnotationValues.java
new file mode 100644
index 00000000000..a40085fe015
--- /dev/null
+++ b/java/ql/test/library-tests/annotations/AnnotationValues.java
@@ -0,0 +1,124 @@
+class AnnotationValues {
+    private static final byte BYTE = 2;
+    private static final short SHORT = 2;
+    private static final int INT = 2;
+    private static final long LONG = 2;
+    private static final float FLOAT = 2;
+    private static final double DOUBLE = 2;
+    private static final boolean BOOLEAN = true;
+    private static final char CHAR = 'b';
+
+    private static final String STRING = "b";
+
+    enum CustomEnum {
+        DEFAULT,
+        A,
+        B
+    }
+
+    @interface CustomAnnotation {
+        String value();
+    }
+
+    @interface SingleValues {
+        byte byteValue() default -1;
+        short shortValue() default -1;
+        int intValue() default -1;
+        long longValue() default -1;
+        float floatValue() default -1;
+        double doubleValue() default -1;
+        boolean booleanValue() default false;
+        char charValue() default '\uFFFF';
+
+        String stringValue() default "\0";
+        Class<?> classValue() default AnnotationValues.class;
+        CustomEnum enumValue() default CustomEnum.DEFAULT;
+        CustomAnnotation annotationValue() default @CustomAnnotation("default");
+    }
+
+    @SingleValues
+    private int singleValuesDefault;
+
+    @SingleValues(
+        byteValue = 1,
+        shortValue = 1,
+        intValue = 1,
+        longValue = 1,
+        floatValue = 1,
+        doubleValue = 1,
+        booleanValue = true,
+        charValue = 1,
+        stringValue = "a",
+        classValue = SingleValues.class,
+        enumValue = CustomEnum.A,
+        annotationValue = @CustomAnnotation("single")
+    )
+    private int singleValues;
+
+    @SingleValues(
+        byteValue = BYTE,
+        shortValue = SHORT,
+        intValue = INT,
+        longValue = LONG,
+        floatValue = FLOAT,
+        doubleValue = DOUBLE,
+        booleanValue = BOOLEAN,
+        charValue = CHAR,
+        stringValue = STRING,
+        classValue = SingleValues.class,
+        enumValue = CustomEnum.A,
+        annotationValue = @CustomAnnotation("single")
+    )
+    private int singleValuesConstants;
+
+    @interface ArrayValues {
+        byte[] byteValues() default -1;
+        short[] shortValues() default -1;
+        int[] intValues() default -1;
+        long[] longValues() default -1;
+        float[] floatValues() default -1;
+        double[] doubleValues() default -1;
+        boolean[] booleanValues() default false;
+        char[] charValues() default '\uFFFF';
+
+        String[] stringValues() default "\0";
+        Class<?>[] classValues() default AnnotationValues.class;
+        CustomEnum[] enumValues() default CustomEnum.DEFAULT;
+        CustomAnnotation[] annotationValues() default @CustomAnnotation("default");
+    }
+
+    @ArrayValues
+    private int arrayValuesDefault;
+
+    @ArrayValues(
+        byteValues = 1,
+        shortValues = 1,
+        intValues = 1,
+        longValues = 1,
+        floatValues = 1,
+        doubleValues = 1,
+        booleanValues = true,
+        charValues = 'a',
+        stringValues = "a",
+        classValues = ArrayValues.class,
+        enumValues = CustomEnum.A,
+        annotationValues = @CustomAnnotation("single")
+    )
+    private int arrayValuesSingleExpr;
+
+    @ArrayValues(
+        byteValues = {1, BYTE},
+        shortValues = {1, SHORT},
+        intValues = {1, INT},
+        longValues = {1, LONG},
+        floatValues = {1, FLOAT},
+        doubleValues = {1, DOUBLE},
+        booleanValues = {false, BOOLEAN},
+        charValues = {'a', CHAR},
+        stringValues = {"a", "b"},
+        classValues = {SingleValues.class, ArrayValues.class},
+        enumValues = {CustomEnum.A, CustomEnum.B},
+        annotationValues = {@CustomAnnotation("first"), @CustomAnnotation("second")}
+    )
+    private int arrayValues;
+}
diff --git a/java/ql/test/library-tests/annotations/options b/java/ql/test/library-tests/annotations/options
new file mode 100644
index 00000000000..fc57fe025b9
--- /dev/null
+++ b/java/ql/test/library-tests/annotations/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -source 16 -target 16
diff --git a/java/ql/test/library-tests/dataflow/callctx/A.java b/java/ql/test/library-tests/dataflow/callctx/A.java
index 3bb6382b356..99a3bed4f07 100644
--- a/java/ql/test/library-tests/dataflow/callctx/A.java
+++ b/java/ql/test/library-tests/dataflow/callctx/A.java
@@ -1,7 +1,7 @@
 public class A {
   static void sink(Object x) { }
 
-  static Object source() { return null; }
+  static Object source(String srctag) { return null; }
 
   static class C1 {
     C1() { }
@@ -20,7 +20,7 @@ public class A {
 
     void foo(Object x) {
       Object c1 = x;
-      sink(c1);
+      sink(c1); // $ hasValueFlow=c.1 hasValueFlow=c.2 hasValueFlow=c.3 hasValueFlow=C1 hasValueFlow=C1.1 hasValueFlow=C1.2 hasValueFlow=C1.3
     }
   }
 
@@ -33,11 +33,11 @@ public class A {
 
     void foo(Object x) {
       Object c2 = x;
-      sink(c2);
+      sink(c2); // $ hasValueFlow=2 hasValueFlow=c.1 hasValueFlow=c.2 hasValueFlow=c.3 hasValueFlow=C2 hasValueFlow=C2.1 hasValueFlow=C2.2 hasValueFlow=C2.3
     }
 
     void callWrapFoo2() {
-      wrapFoo2(source());
+      wrapFoo2(source("2"));
     }
   }
 
@@ -46,18 +46,54 @@ public class A {
   }
 
   void test(C1 c) {
-    c.wrapFoo1(source());
-    c.wrapFoo2(source());
-    wrapFoo3(c, source());
+    c.wrapFoo1(source("c.1"));
+    c.wrapFoo2(source("c.2"));
+    wrapFoo3(c, source("c.3"));
 
-    new C1(source());
-    new C1().wrapFoo1(source());
-    new C1().wrapFoo2(source());
-    wrapFoo3(new C1(), source());
+    new C1(source("C1"));
+    new C1().wrapFoo1(source("C1.1"));
+    new C1().wrapFoo2(source("C1.2"));
+    wrapFoo3(new C1(), source("C1.3"));
 
-    new C2(source());
-    new C2().wrapFoo1(source());
-    new C2().wrapFoo2(source());
-    wrapFoo3(new C2(), source());
+    new C2(source("C2"));
+    new C2().wrapFoo1(source("C2.1"));
+    new C2().wrapFoo2(source("C2.2"));
+    wrapFoo3(new C2(), source("C2.3"));
+  }
+
+  static class Sup {
+    void wrap(Object x) {
+      tgt(x);
+    }
+
+    void tgt(Object x) {
+      sink(x); // $ hasValueFlow=s
+    }
+  }
+
+  static class A1 extends Sup {
+    void tgt(Object x) {
+      sink(x); // $ hasValueFlow=s hasValueFlow=s12
+    }
+  }
+
+  static class A2 extends Sup {
+    void tgt(Object x) {
+      sink(x); // $ hasValueFlow=s hasValueFlow=s12
+    }
+  }
+
+  static class A3 extends Sup {
+    void tgt(Object x) {
+      sink(x); // $ hasValueFlow=s
+    }
+  }
+
+  void test2(Sup s) {
+    s.wrap(source("s"));
+
+    if (s instanceof A1 || s instanceof A2) {
+      s.wrap(source("s12"));
+    }
   }
 }
diff --git a/java/ql/test/library-tests/dataflow/callctx/test.expected b/java/ql/test/library-tests/dataflow/callctx/test.expected
index d633eae89ce..e69de29bb2d 100644
--- a/java/ql/test/library-tests/dataflow/callctx/test.expected
+++ b/java/ql/test/library-tests/dataflow/callctx/test.expected
@@ -1,15 +0,0 @@
-| A.java:40:16:40:23 | source(...) | A.java:36:12:36:13 | c2 |
-| A.java:49:16:49:23 | source(...) | A.java:23:12:23:13 | c1 |
-| A.java:49:16:49:23 | source(...) | A.java:36:12:36:13 | c2 |
-| A.java:50:16:50:23 | source(...) | A.java:23:12:23:13 | c1 |
-| A.java:50:16:50:23 | source(...) | A.java:36:12:36:13 | c2 |
-| A.java:51:17:51:24 | source(...) | A.java:23:12:23:13 | c1 |
-| A.java:51:17:51:24 | source(...) | A.java:36:12:36:13 | c2 |
-| A.java:53:12:53:19 | source(...) | A.java:23:12:23:13 | c1 |
-| A.java:54:23:54:30 | source(...) | A.java:23:12:23:13 | c1 |
-| A.java:55:23:55:30 | source(...) | A.java:23:12:23:13 | c1 |
-| A.java:56:24:56:31 | source(...) | A.java:23:12:23:13 | c1 |
-| A.java:58:12:58:19 | source(...) | A.java:36:12:36:13 | c2 |
-| A.java:59:23:59:30 | source(...) | A.java:36:12:36:13 | c2 |
-| A.java:60:23:60:30 | source(...) | A.java:36:12:36:13 | c2 |
-| A.java:61:24:61:31 | source(...) | A.java:36:12:36:13 | c2 |
diff --git a/java/ql/test/library-tests/dataflow/callctx/test.ql b/java/ql/test/library-tests/dataflow/callctx/test.ql
index 36ba2f3d17b..5d91e4e8e26 100644
--- a/java/ql/test/library-tests/dataflow/callctx/test.ql
+++ b/java/ql/test/library-tests/dataflow/callctx/test.ql
@@ -1,15 +1,2 @@
 import java
-import semmle.code.java.dataflow.DataFlow
-import DataFlow
-
-class Conf extends Configuration {
-  Conf() { this = "qqconf" }
-
-  override predicate isSource(Node n) { n.asExpr().(MethodAccess).getMethod().hasName("source") }
-
-  override predicate isSink(Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("sink") }
-}
-
-from Node src, Node sink, Conf c
-where c.hasFlow(src, sink)
-select src, sink
+import TestUtilities.InlineFlowTest
diff --git a/swift/integration-tests/osx-only/frontend-invocations/A.swift b/java/ql/test/library-tests/dataflow/external-models/negativesummaries.expected
similarity index 100%
rename from swift/integration-tests/osx-only/frontend-invocations/A.swift
rename to java/ql/test/library-tests/dataflow/external-models/negativesummaries.expected
diff --git a/java/ql/test/library-tests/dataflow/external-models/negativesummaries.ql b/java/ql/test/library-tests/dataflow/external-models/negativesummaries.ql
new file mode 100644
index 00000000000..8425cf880b0
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/external-models/negativesummaries.ql
@@ -0,0 +1,8 @@
+/**
+ * CSV Validation of negative summaries.
+ */
+
+import java
+import semmle.code.java.dataflow.ExternalFlow
+import CsvValidation
+import semmle.code.java.dataflow.internal.NegativeSummary
diff --git a/java/ql/test/library-tests/dataflow/state/A.java b/java/ql/test/library-tests/dataflow/state/A.java
index a09aad6d1eb..59bdcdbf7c7 100644
--- a/java/ql/test/library-tests/dataflow/state/A.java
+++ b/java/ql/test/library-tests/dataflow/state/A.java
@@ -1,15 +1,20 @@
+import java.util.Map;
 import java.util.function.*;
 
 public class A {
-  Object source(String state) { return null; }
+  Object source(String state) {
+    return null;
+  }
 
-  void sink(Object x, String state) { }
+  void sink(Object x, String state) {}
 
-  void stateBarrier(Object x, String state) { }
+  void stateBarrier(Object x, String state) {}
 
-  Object step(Object x, String s1, String s2) { return null; }
+  Object step(Object x, String s1, String s2) {
+    return null;
+  }
 
-  void check(Object x) { }
+  void check(Object x) {}
 
   void test1() {
     Object x = source("A");
@@ -31,4 +36,13 @@ public class A {
     sink(x, "B"); // $ flow=B
     sink(x, "C"); // $ flow=B
   }
+
+  void test3(Map m) {
+    // Test implicit reads
+    Object x = source("A");
+    m.put("k", x);
+    sink(m, "A"); // $ flow=A
+    Object y = step(m, "A", "B");
+    sink(y, "B"); // $ flow=A
+  }
 }
diff --git a/java/ql/test/library-tests/dataflow/state/test.ql b/java/ql/test/library-tests/dataflow/state/test.ql
index a982b451fb6..d80f017246e 100644
--- a/java/ql/test/library-tests/dataflow/state/test.ql
+++ b/java/ql/test/library-tests/dataflow/state/test.ql
@@ -1,5 +1,5 @@
 import java
-import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.TaintTracking
 import TestUtilities.InlineExpectationsTest
 import DataFlow
 
@@ -39,16 +39,16 @@ predicate step(Node n1, Node n2, string s1, string s2) {
 
 predicate checkNode(Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("check") }
 
-class Conf extends Configuration {
+class Conf extends TaintTracking::Configuration {
   Conf() { this = "qltest:state" }
 
   override predicate isSource(Node n, FlowState s) { src(n, s) }
 
   override predicate isSink(Node n, FlowState s) { sink(n, s) }
 
-  override predicate isBarrier(Node n, FlowState s) { bar(n, s) }
+  override predicate isSanitizer(Node n, FlowState s) { bar(n, s) }
 
-  override predicate isAdditionalFlowStep(Node n1, FlowState s1, Node n2, FlowState s2) {
+  override predicate isAdditionalTaintStep(Node n1, FlowState s1, Node n2, FlowState s2) {
     step(n1, n2, s1, s2)
   }
 
diff --git a/java/ql/test/library-tests/dataflow/taint/B.java b/java/ql/test/library-tests/dataflow/taint/B.java
index 94a09dd915f..af659283b13 100644
--- a/java/ql/test/library-tests/dataflow/taint/B.java
+++ b/java/ql/test/library-tests/dataflow/taint/B.java
@@ -41,7 +41,7 @@ public class B {
     String valueOfSubstring = String.valueOf(complex.toCharArray(), 0, 1);
     sink(valueOfSubstring);
     // tainted - unsafe escape
-    String badEscape = constructed.replaceAll("(<script>)", "");
+    String badEscape = constructed.replaceAll("irrelevant", "irrelevant");
     sink(badEscape);
     // tainted - tokenized string
     String token = new StringTokenizer(badEscape).nextToken();
@@ -189,4 +189,32 @@ public class B {
   public static boolean safe() {
     return true;
   }
+
+  public static void extendedTests(){
+    String s = taint()[0];
+
+    String replReceiver = s.replace("irrelevant", "irrelevant");
+    sink(replReceiver);
+
+    String replChar = "a".replace('a', s.charAt(0));
+    sink(replChar);
+
+    String replCharReceiver = s.replace('a', 'b');
+    sink(replCharReceiver);
+
+    String charAt = "";
+    for(int i = 0; i < 10; i++)
+        charAt = charAt + s.charAt(i);
+    sink(charAt);
+
+    byte[] bytes = new byte[10];
+    s.getBytes(0, 1, bytes, 0);
+    sink(bytes);
+
+    String replAll = s.replaceAll("irrelevant", "irrelevant");
+    sink(replAll);
+
+    String replFirst = s.replaceFirst("irrelevant", "irrelevant");
+    sink(replFirst);
+  }
 }
diff --git a/java/ql/test/library-tests/dataflow/taint/test.expected b/java/ql/test/library-tests/dataflow/taint/test.expected
index 451248e18c0..8b7d85321b4 100644
--- a/java/ql/test/library-tests/dataflow/taint/test.expected
+++ b/java/ql/test/library-tests/dataflow/taint/test.expected
@@ -43,6 +43,13 @@
 | B.java:15:21:15:27 | taint(...) | B.java:157:10:157:46 | toFile(...) |
 | B.java:15:21:15:27 | taint(...) | B.java:160:10:160:46 | getAbsoluteFile(...) |
 | B.java:15:21:15:27 | taint(...) | B.java:163:10:163:47 | getCanonicalFile(...) |
+| B.java:194:16:194:22 | taint(...) | B.java:197:10:197:21 | replReceiver |
+| B.java:194:16:194:22 | taint(...) | B.java:200:10:200:17 | replChar |
+| B.java:194:16:194:22 | taint(...) | B.java:203:10:203:25 | replCharReceiver |
+| B.java:194:16:194:22 | taint(...) | B.java:208:10:208:15 | charAt |
+| B.java:194:16:194:22 | taint(...) | B.java:212:10:212:14 | bytes |
+| B.java:194:16:194:22 | taint(...) | B.java:215:10:215:16 | replAll |
+| B.java:194:16:194:22 | taint(...) | B.java:218:10:218:18 | replFirst |
 | CharSeq.java:7:26:7:32 | taint(...) | CharSeq.java:8:12:8:14 | seq |
 | CharSeq.java:7:26:7:32 | taint(...) | CharSeq.java:11:12:11:21 | seqFromSeq |
 | CharSeq.java:7:26:7:32 | taint(...) | CharSeq.java:14:12:14:24 | stringFromSeq |
diff --git a/java/ql/test/library-tests/dispatch/ViableCallable4.java b/java/ql/test/library-tests/dispatch/ViableCallable4.java
new file mode 100644
index 00000000000..bb1a5f4a678
--- /dev/null
+++ b/java/ql/test/library-tests/dispatch/ViableCallable4.java
@@ -0,0 +1,23 @@
+public class ViableCallable4 {
+  static class Sup {
+    void f() { }
+  }
+  static class A1 extends Sup {
+    @Override void f() { }
+  }
+  static class A2 extends Sup {
+    @Override void f() { }
+  }
+  static class A3 extends Sup {
+    @Override void f() { }
+  }
+
+  void foo(Sup s, boolean b) {
+    s.f();
+    if (s instanceof A1 || s instanceof A2) {
+      s.f();
+    }
+    Sup s2 = b ? new A3() : new Sup();
+    s2.f();
+  }
+}
diff --git a/java/ql/test/library-tests/dispatch/viableCallable.expected b/java/ql/test/library-tests/dispatch/viableCallable.expected
index 7490e4693b9..15ff247a514 100644
--- a/java/ql/test/library-tests/dispatch/viableCallable.expected
+++ b/java/ql/test/library-tests/dispatch/viableCallable.expected
@@ -7,6 +7,14 @@
 | ViableCallable3.java:12:5:12:9 | h(...) | h | 1 | ViableCallable3 |
 | ViableCallable3.java:17:9:17:17 | get(...) | get | 9 | new Func(...) { ... } |
 | ViableCallable3.java:18:9:18:18 | get(...) | get | 10 | new Func(...) { ... } |
+| ViableCallable4.java:16:5:16:9 | f(...) | f | 2 | Sup |
+| ViableCallable4.java:16:5:16:9 | f(...) | f | 5 | A1 |
+| ViableCallable4.java:16:5:16:9 | f(...) | f | 8 | A2 |
+| ViableCallable4.java:16:5:16:9 | f(...) | f | 11 | A3 |
+| ViableCallable4.java:18:7:18:11 | f(...) | f | 5 | A1 |
+| ViableCallable4.java:18:7:18:11 | f(...) | f | 8 | A2 |
+| ViableCallable4.java:21:5:21:10 | f(...) | f | 2 | Sup |
+| ViableCallable4.java:21:5:21:10 | f(...) | f | 11 | A3 |
 | ViableCallable.java:5:3:5:13 | M(...) | M | 81 | C2 |
 | ViableCallable.java:5:3:5:13 | M(...) | M | 86 | C3 |
 | ViableCallable.java:5:3:5:13 | M(...) | M | 91 | C4 |
diff --git a/java/ql/test/library-tests/frameworks/android/content-provider-summaries/Test.java b/java/ql/test/library-tests/frameworks/android/content-provider-summaries/Test.java
new file mode 100644
index 00000000000..eb9de7bcca6
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/android/content-provider-summaries/Test.java
@@ -0,0 +1,697 @@
+package generatedtest;
+
+import android.content.ContentProvider;
+import android.content.ContentProviderClient;
+import android.content.ContentProviderOperation;
+import android.content.ContentProviderResult;
+import android.content.ContentResolver;
+import android.content.ContentValues;
+import android.database.CharArrayBuffer;
+import android.database.Cursor;
+import android.net.Uri;
+import android.os.Bundle;
+import android.os.Parcel;
+import java.util.ArrayList;
+import java.util.List;
+
+// Test case generated by GenerateFlowTestCase.ql
+public class Test {
+
+	Object getMapKeyDefault(Object container) {
+		return null;
+	}
+
+	Object getMapValueDefault(Object container) {
+		return null;
+	}
+
+	Object newWithMapKeyDefault(Object element) {
+		return null;
+	}
+
+	Object newWithMapValueDefault(Object element) {
+		return null;
+	}
+
+	Object source() {
+		return null;
+	}
+
+	void sink(Object o) {}
+
+	public void test() throws Exception {
+
+		{
+			// "android.content;ContentProviderClient;true;applyBatch;;;Argument[-1];ReturnValue;taint;manual"
+			ContentProviderResult[] out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.applyBatch(null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;applyBatch;;;Argument[-1];ReturnValue;taint;manual"
+			ContentProviderResult[] out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.applyBatch(null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;call;;;Argument[-1];ReturnValue;taint;manual"
+			Bundle out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.call(null, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;call;;;Argument[-1];ReturnValue;taint;manual"
+			Bundle out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.call(null, null, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;canonicalize;;;Argument[-1];ReturnValue;taint;manual"
+			Uri out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.canonicalize(null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;getLocalContentProvider;;;Argument[-1];ReturnValue;taint;manual"
+			ContentProvider out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.getLocalContentProvider();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;getStreamTypes;;;Argument[-1];ReturnValue;taint;manual"
+			String[] out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.getStreamTypes(null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;insert;;;Argument[-1];ReturnValue;taint;manual"
+			Uri out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.insert(null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;insert;;;Argument[-1];ReturnValue;taint;manual"
+			Uri out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.insert(null, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;query;;;Argument[-1];ReturnValue;taint;manual"
+			Cursor out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.query(null, null, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;query;;;Argument[-1];ReturnValue;taint;manual"
+			Cursor out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.query(null, null, null, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;query;;;Argument[-1];ReturnValue;taint;manual"
+			Cursor out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.query(null, null, null, null, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderClient;true;uncanonicalize;;;Argument[-1];ReturnValue;taint;manual"
+			Uri out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = in.uncanonicalize(null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;build;;;Argument[-1];ReturnValue;taint;manual"
+			ContentProviderOperation out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.build();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withExceptionAllowed;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withExceptionAllowed(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withExpectedCount;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withExpectedCount(0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withExtra;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withExtra(null, null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withExtraBackReference;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withExtraBackReference(null, 0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withExtraBackReference;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withExtraBackReference(null, 0, null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withExtras;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withExtras(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withSelection;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withSelection(null, null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withSelectionBackReference;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withSelectionBackReference(0, 0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withSelectionBackReference;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withSelectionBackReference(0, 0, null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withValue;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withValue(null, null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withValueBackReference;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withValueBackReference(null, 0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withValueBackReference;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withValueBackReference(null, 0, null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withValues;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withValues(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation$Builder;false;withYieldAllowed;;;Argument[-1];ReturnValue;value;manual"
+			ContentProviderOperation.Builder out = null;
+			ContentProviderOperation.Builder in = (ContentProviderOperation.Builder) source();
+			out = in.withYieldAllowed(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;apply;;;Argument[-1];ReturnValue;taint;manual"
+			ContentProviderResult out = null;
+			ContentProviderOperation in = (ContentProviderOperation) source();
+			out = in.apply(null, null, 0);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;apply;;;Argument[0];ReturnValue;taint;manual"
+			ContentProviderResult out = null;
+			ContentProvider in = (ContentProvider) source();
+			ContentProviderOperation instance = null;
+			out = instance.apply(in, null, 0);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;getUri;;;Argument[-1];ReturnValue;taint;manual"
+			Uri out = null;
+			ContentProviderOperation in = (ContentProviderOperation) source();
+			out = in.getUri();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;newAssertQuery;;;Argument[0];ReturnValue;taint;manual"
+			ContentProviderOperation.Builder out = null;
+			Uri in = (Uri) source();
+			out = ContentProviderOperation.newAssertQuery(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;newCall;;;Argument[0];ReturnValue;taint;manual"
+			ContentProviderOperation.Builder out = null;
+			Uri in = (Uri) source();
+			out = ContentProviderOperation.newCall(in, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;newDelete;;;Argument[0];ReturnValue;taint;manual"
+			ContentProviderOperation.Builder out = null;
+			Uri in = (Uri) source();
+			out = ContentProviderOperation.newDelete(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;newInsert;;;Argument[0];ReturnValue;taint;manual"
+			ContentProviderOperation.Builder out = null;
+			Uri in = (Uri) source();
+			out = ContentProviderOperation.newInsert(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;newUpdate;;;Argument[0];ReturnValue;taint;manual"
+			ContentProviderOperation.Builder out = null;
+			Uri in = (Uri) source();
+			out = ContentProviderOperation.newUpdate(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;resolveExtrasBackReferences;;;Argument[0];ReturnValue;taint;manual"
+			Bundle out = null;
+			ContentProviderResult[] in = (ContentProviderResult[]) source();
+			ContentProviderOperation instance = null;
+			out = instance.resolveExtrasBackReferences(in, 0);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;resolveSelectionArgsBackReferences;;;Argument[0];ReturnValue;taint;manual"
+			String[] out = null;
+			ContentProviderResult[] in = (ContentProviderResult[]) source();
+			ContentProviderOperation instance = null;
+			out = instance.resolveSelectionArgsBackReferences(in, 0);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderOperation;false;resolveValueBackReferences;;;Argument[0];ReturnValue;taint;manual"
+			ContentValues out = null;
+			ContentProviderResult[] in = (ContentProviderResult[]) source();
+			ContentProviderOperation instance = null;
+			out = instance.resolveValueBackReferences(in, 0);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderResult;false;ContentProviderResult;(Bundle);;Argument[0];Argument[-1].Field[android.content.ContentProviderResult.extras];value;manual"
+			ContentProviderResult out = null;
+			Bundle in = (Bundle) source();
+			out = new ContentProviderResult(in);
+			sink(out.extras); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderResult;false;ContentProviderResult;(Parcel);;Argument[0];Argument[-1];taint;manual"
+			ContentProviderResult out = null;
+			Parcel in = (Parcel) source();
+			out = new ContentProviderResult(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentProviderResult;false;ContentProviderResult;(Throwable);;Argument[0];Argument[-1].Field[android.content.ContentProviderResult.exception];value;manual"
+			ContentProviderResult out = null;
+			Throwable in = (Throwable) source();
+			out = new ContentProviderResult(in);
+			sink(out.exception); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentProviderResult;false;ContentProviderResult;(Uri);;Argument[0];Argument[-1].Field[android.content.ContentProviderResult.uri];value;manual"
+			ContentProviderResult out = null;
+			Uri in = (Uri) source();
+			out = new ContentProviderResult(in);
+			sink(out.uri); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentResolver;true;acquireContentProviderClient;;;Argument[0];ReturnValue;taint;manual"
+			ContentProviderClient out = null;
+			String in = (String) source();
+			ContentResolver instance = null;
+			out = instance.acquireContentProviderClient(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;acquireContentProviderClient;;;Argument[0];ReturnValue;taint;manual"
+			ContentProviderClient out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.acquireContentProviderClient(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;acquireUnstableContentProviderClient;;;Argument[0];ReturnValue;taint;manual"
+			ContentProviderClient out = null;
+			String in = (String) source();
+			ContentResolver instance = null;
+			out = instance.acquireUnstableContentProviderClient(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;acquireUnstableContentProviderClient;;;Argument[0];ReturnValue;taint;manual"
+			ContentProviderClient out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.acquireUnstableContentProviderClient(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;applyBatch;;;Argument[1];ReturnValue;taint;manual"
+			ContentProviderResult[] out = null;
+			ArrayList in = (ArrayList) source();
+			ContentResolver instance = null;
+			out = instance.applyBatch(null, in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;call;;;Argument[0];ReturnValue;taint;manual"
+			Bundle out = null;
+			String in = (String) source();
+			ContentResolver instance = null;
+			out = instance.call(in, (String) null, (String) null, (Bundle) null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;call;;;Argument[0];ReturnValue;taint;manual"
+			Bundle out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.call(in, (String) null, (String) null, (Bundle) null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;canonicalize;;;Argument[0];ReturnValue;taint;manual"
+			Uri out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.canonicalize(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;getStreamTypes;;;Argument[0];ReturnValue;taint;manual"
+			String[] out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.getStreamTypes(in, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;getType;;;Argument[0];ReturnValue;taint;manual"
+			String out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.getType(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;insert;;;Argument[0];ReturnValue;taint;manual"
+			Uri out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.insert(in, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;insert;;;Argument[0];ReturnValue;taint;manual"
+			Uri out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.insert(in, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;query;;;Argument[0];ReturnValue;taint;manual"
+			Cursor out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.query(in, null, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;query;;;Argument[0];ReturnValue;taint;manual"
+			Cursor out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.query(in, null, null, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;query;;;Argument[0];ReturnValue;taint;manual"
+			Cursor out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.query(in, null, null, null, null, null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;uncanonicalize;;;Argument[0];ReturnValue;taint;manual"
+			Uri out = null;
+			Uri in = (Uri) source();
+			ContentResolver instance = null;
+			out = instance.uncanonicalize(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;wrap;;;Argument[0];ReturnValue;taint;manual"
+			ContentResolver out = null;
+			ContentProvider in = (ContentProvider) source();
+			out = ContentResolver.wrap(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentResolver;true;wrap;;;Argument[0];ReturnValue;taint;manual"
+			ContentResolver out = null;
+			ContentProviderClient in = (ContentProviderClient) source();
+			out = ContentResolver.wrap(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[0];Argument[-1].MapKey;value;manual"
+			ContentValues out = null;
+			String in = (String) source();
+			out.put(in, (Boolean) null);
+			sink(getMapKeyDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[0];Argument[-1].MapKey;value;manual"
+			ContentValues out = null;
+			String in = (String) source();
+			out.put(in, (Byte) null);
+			sink(getMapKeyDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[0];Argument[-1].MapKey;value;manual"
+			ContentValues out = null;
+			String in = (String) source();
+			out.put(in, (Double) null);
+			sink(getMapKeyDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[0];Argument[-1].MapKey;value;manual"
+			ContentValues out = null;
+			String in = (String) source();
+			out.put(in, (Float) null);
+			sink(getMapKeyDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[0];Argument[-1].MapKey;value;manual"
+			ContentValues out = null;
+			String in = (String) source();
+			out.put(in, (Integer) null);
+			sink(getMapKeyDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[0];Argument[-1].MapKey;value;manual"
+			ContentValues out = null;
+			String in = (String) source();
+			out.put(in, (Long) null);
+			sink(getMapKeyDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[0];Argument[-1].MapKey;value;manual"
+			ContentValues out = null;
+			String in = (String) source();
+			out.put(in, (Short) null);
+			sink(getMapKeyDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[0];Argument[-1].MapKey;value;manual"
+			ContentValues out = null;
+			String in = (String) source();
+			out.put(in, (String) null);
+			sink(getMapKeyDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[0];Argument[-1].MapKey;value;manual"
+			ContentValues out = null;
+			String in = (String) source();
+			out.put(in, (byte[]) null);
+			sink(getMapKeyDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[1];Argument[-1].MapValue;value;manual"
+			ContentValues out = null;
+			Boolean in = (Boolean) source();
+			out.put((String) null, in);
+			sink(getMapValueDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[1];Argument[-1].MapValue;value;manual"
+			ContentValues out = null;
+			Byte in = (Byte) source();
+			out.put((String) null, in);
+			sink(getMapValueDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[1];Argument[-1].MapValue;value;manual"
+			ContentValues out = null;
+			Double in = (Double) source();
+			out.put((String) null, in);
+			sink(getMapValueDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[1];Argument[-1].MapValue;value;manual"
+			ContentValues out = null;
+			Float in = (Float) source();
+			out.put((String) null, in);
+			sink(getMapValueDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[1];Argument[-1].MapValue;value;manual"
+			ContentValues out = null;
+			Integer in = (Integer) source();
+			out.put((String) null, in);
+			sink(getMapValueDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[1];Argument[-1].MapValue;value;manual"
+			ContentValues out = null;
+			Long in = (Long) source();
+			out.put((String) null, in);
+			sink(getMapValueDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[1];Argument[-1].MapValue;value;manual"
+			ContentValues out = null;
+			Short in = (Short) source();
+			out.put((String) null, in);
+			sink(getMapValueDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[1];Argument[-1].MapValue;value;manual"
+			ContentValues out = null;
+			String in = (String) source();
+			out.put((String) null, in);
+			sink(getMapValueDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;put;;;Argument[1];Argument[-1].MapValue;value;manual"
+			ContentValues out = null;
+			byte[] in = (byte[]) source();
+			out.put((String) null, in);
+			sink(getMapValueDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;putAll;;;Argument[0].MapKey;Argument[-1].MapKey;value;manual"
+			ContentValues out = null;
+			ContentValues in = (ContentValues) newWithMapKeyDefault(source());
+			out.putAll(in);
+			sink(getMapKeyDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.content;ContentValues;false;putAll;;;Argument[0].MapValue;Argument[-1].MapValue;value;manual"
+			ContentValues out = null;
+			ContentValues in = (ContentValues) newWithMapValueDefault(source());
+			out.putAll(in);
+			sink(getMapValueDefault(out)); // $ hasValueFlow
+		}
+		{
+			// "android.database;Cursor;true;copyStringToBuffer;;;Argument[-1];Argument[1];taint;manual"
+			CharArrayBuffer out = null;
+			Cursor in = (Cursor) source();
+			in.copyStringToBuffer(0, out);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.database;Cursor;true;getBlob;;;Argument[-1];ReturnValue;taint;manual"
+			byte[] out = null;
+			Cursor in = (Cursor) source();
+			out = in.getBlob(0);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.database;Cursor;true;getColumnName;;;Argument[-1];ReturnValue;taint;manual"
+			String out = null;
+			Cursor in = (Cursor) source();
+			out = in.getColumnName(0);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.database;Cursor;true;getColumnNames;;;Argument[-1];ReturnValue;taint;manual"
+			String[] out = null;
+			Cursor in = (Cursor) source();
+			out = in.getColumnNames();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.database;Cursor;true;getExtras;;;Argument[-1];ReturnValue;taint;manual"
+			Bundle out = null;
+			Cursor in = (Cursor) source();
+			out = in.getExtras();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.database;Cursor;true;getNotificationUri;;;Argument[-1];ReturnValue;taint;manual"
+			Uri out = null;
+			Cursor in = (Cursor) source();
+			out = in.getNotificationUri();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.database;Cursor;true;getNotificationUris;;;Argument[-1];ReturnValue;taint;manual"
+			List out = null;
+			Cursor in = (Cursor) source();
+			out = in.getNotificationUris();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.database;Cursor;true;getString;;;Argument[-1];ReturnValue;taint;manual"
+			String out = null;
+			Cursor in = (Cursor) source();
+			out = in.getString(0);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "android.database;Cursor;true;respond;;;Argument[-1];ReturnValue;taint;manual"
+			Bundle out = null;
+			Cursor in = (Cursor) source();
+			out = in.respond(null);
+			sink(out); // $ hasTaintFlow
+		}
+
+	}
+
+}
diff --git a/java/ql/test/library-tests/frameworks/android/content-provider-summaries/options b/java/ql/test/library-tests/frameworks/android/content-provider-summaries/options
new file mode 100644
index 00000000000..33cdc1ea940
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/android/content-provider-summaries/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/google-android-9.0.0
diff --git a/swift/integration-tests/osx-only/frontend-invocations/B.swift b/java/ql/test/library-tests/frameworks/android/content-provider-summaries/test.expected
similarity index 100%
rename from swift/integration-tests/osx-only/frontend-invocations/B.swift
rename to java/ql/test/library-tests/frameworks/android/content-provider-summaries/test.expected
diff --git a/java/ql/test/library-tests/frameworks/android/content-provider-summaries/test.ql b/java/ql/test/library-tests/frameworks/android/content-provider-summaries/test.ql
new file mode 100644
index 00000000000..2fa9dc00fd8
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/android/content-provider-summaries/test.ql
@@ -0,0 +1,15 @@
+import java
+import TestUtilities.InlineFlowTest
+
+class SummaryModelTest extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        //"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
+        "generatedtest;Test;false;newWithMapValueDefault;(Object);;Argument[0];ReturnValue.MapValue;value;manual",
+        "generatedtest;Test;false;newWithMapKeyDefault;(Object);;Argument[0];ReturnValue.MapKey;value;manual",
+        "generatedtest;Test;false;getMapValueDefault;(Object);;Argument[0].MapValue;ReturnValue;value;manual",
+        "generatedtest;Test;false;getMapKeyDefault;(Object);;Argument[0].MapKey;ReturnValue;value;manual"
+      ]
+  }
+}
diff --git a/java/ql/test/library-tests/frameworks/android/notification/Test.java b/java/ql/test/library-tests/frameworks/android/notification/Test.java
index 566c52b0a6e..d669e7421bf 100644
--- a/java/ql/test/library-tests/frameworks/android/notification/Test.java
+++ b/java/ql/test/library-tests/frameworks/android/notification/Test.java
@@ -1,11 +1,13 @@
 package generatedtest;
 
 import android.app.Notification;
+import androidx.core.app.NotificationCompat;
 import android.app.PendingIntent;
 import android.app.Person;
 import android.app.Notification.Action;
 import android.graphics.Bitmap;
 import android.graphics.drawable.Icon;
+import androidx.core.graphics.drawable.IconCompat;
 import android.media.AudioAttributes;
 import android.net.Uri;
 import android.os.Bundle;
@@ -103,7 +105,8 @@ public class Test {
 		}
 		{
 			// "android.app;Notification$Action$Builder;true;build;;;SyntheticField[android.content.Intent.extras]
-			// of Argument[-1];SyntheticField[android.content.Intent.extras] of ReturnValue;value;manual"
+			// of Argument[-1];SyntheticField[android.content.Intent.extras] of
+			// ReturnValue;value;manual"
 			Notification.Action out = null;
 			Notification.Action.Builder builder = null;
 			Bundle in = (Bundle) newWithMapValueDefault(source());
@@ -814,6 +817,647 @@ public class Test {
 			Notification.MediaStyle out = in.setShowActionsInCompactView(null);
 			sink(out); // $ hasValueFlow
 		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;Builder;(Action);;Argument[0];Argument[-1];taint;manual"
+			NotificationCompat.Action.Builder out = null;
+			NotificationCompat.Action in = (NotificationCompat.Action) source();
+			out = new NotificationCompat.Action.Builder(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;Builder;(IconCompat,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual"
+			NotificationCompat.Action.Builder out = null;
+			PendingIntent in = (PendingIntent) source();
+			out = new NotificationCompat.Action.Builder((IconCompat) null, (CharSequence) null, in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;Builder;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual"
+			NotificationCompat.Action.Builder out = null;
+			PendingIntent in = (PendingIntent) source();
+			out = new NotificationCompat.Action.Builder(0, (CharSequence) null, in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;addExtras;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Action.Builder out = null;
+			NotificationCompat.Action.Builder in = (NotificationCompat.Action.Builder) source();
+			out = in.addExtras(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;addExtras;;;Argument[0].MapKey;Argument[-1].SyntheticField[android.content.Intent.extras].MapKey;value;manual"
+			NotificationCompat.Action.Builder out = null;
+			Bundle in = (Bundle) newWithMapKeyDefault(source());
+			out.addExtras(in);
+			sink(getMapKeyDefault(out.getExtras())); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;addExtras;;;Argument[0].MapValue;Argument[-1].SyntheticField[android.content.Intent.extras].MapValue;value;manual"
+			NotificationCompat.Action.Builder out = null;
+			Bundle in = (Bundle) newWithMapValueDefault(source());
+			out.addExtras(in);
+			sink(getMapValueDefault(out.getExtras())); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;addRemoteInput;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Action.Builder out = null;
+			NotificationCompat.Action.Builder in = (NotificationCompat.Action.Builder) source();
+			out = in.addRemoteInput(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;build;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue.SyntheticField[android.content.Intent.extras];value;manual"
+			NotificationCompat.Action out = null;
+			NotificationCompat.Action.Builder builder = null;
+			Bundle in = (Bundle) newWithMapValueDefault(source());
+			builder.addExtras(in);
+			out = builder.build();
+			sink(getMapValueDefault(out.getExtras())); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;build;;;Argument[-1];ReturnValue;taint;manual"
+			NotificationCompat.Action out = null;
+			NotificationCompat.Action.Builder in = (NotificationCompat.Action.Builder) source();
+			out = in.build();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;extend;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Action.Builder out = null;
+			NotificationCompat.Action.Builder in = (NotificationCompat.Action.Builder) source();
+			out = in.extend(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;getExtras;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue;value;manual"
+			Bundle out = null;
+			NotificationCompat.Action.Builder in = (NotificationCompat.Action.Builder) source();
+			out = in.getExtras();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;setAllowGeneratedReplies;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Action.Builder out = null;
+			NotificationCompat.Action.Builder in = (NotificationCompat.Action.Builder) source();
+			out = in.setAllowGeneratedReplies(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;setContextual;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Action.Builder out = null;
+			NotificationCompat.Action.Builder in = (NotificationCompat.Action.Builder) source();
+			out = in.setContextual(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action$Builder;true;setSemanticAction;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Action.Builder out = null;
+			NotificationCompat.Action.Builder in = (NotificationCompat.Action.Builder) source();
+			out = in.setSemanticAction(0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action;true;Action;(IconCompat,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual"
+			NotificationCompat.Action out = null;
+			PendingIntent in = (PendingIntent) source();
+			out = new NotificationCompat.Action((IconCompat) null, (CharSequence) null, in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action;true;Action;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual"
+			NotificationCompat.Action out = null;
+			PendingIntent in = (PendingIntent) source();
+			out = new NotificationCompat.Action(0, (CharSequence) null, in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Action;true;getExtras;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue;value;manual"
+			Bundle out = null;
+			NotificationCompat.Action in = (NotificationCompat.Action) source();
+			out = in.getExtras();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$BigPictureStyle;true;bigLargeIcon;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.BigPictureStyle out = null;
+			NotificationCompat.BigPictureStyle in = (NotificationCompat.BigPictureStyle) source();
+			out = in.bigLargeIcon(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$BigPictureStyle;true;bigPicture;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.BigPictureStyle out = null;
+			NotificationCompat.BigPictureStyle in = (NotificationCompat.BigPictureStyle) source();
+			out = in.bigPicture(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$BigPictureStyle;true;setBigContentTitle;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.BigPictureStyle out = null;
+			NotificationCompat.BigPictureStyle in = (NotificationCompat.BigPictureStyle) source();
+			out = in.setBigContentTitle(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$BigPictureStyle;true;setSummaryText;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.BigPictureStyle out = null;
+			NotificationCompat.BigPictureStyle in = (NotificationCompat.BigPictureStyle) source();
+			out = in.setSummaryText(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$BigTextStyle;true;bigText;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.BigTextStyle out = null;
+			NotificationCompat.BigTextStyle in = (NotificationCompat.BigTextStyle) source();
+			out = in.bigText(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$BigTextStyle;true;setBigContentTitle;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.BigTextStyle out = null;
+			NotificationCompat.BigTextStyle in = (NotificationCompat.BigTextStyle) source();
+			out = in.setBigContentTitle(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$BigTextStyle;true;setSummaryText;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.BigTextStyle out = null;
+			NotificationCompat.BigTextStyle in = (NotificationCompat.BigTextStyle) source();
+			out = in.setSummaryText(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;addAction;(Action);;Argument[0];Argument[-1];taint;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Action in = (NotificationCompat.Action) source();
+			out.addAction(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;addAction;(int,CharSequence,PendingIntent);;Argument[2];Argument[-1];taint;manual"
+			NotificationCompat.Builder out = null;
+			PendingIntent in = (PendingIntent) source();
+			out.addAction(0, null, in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;addAction;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.addAction(0, null, null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;addAction;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.addAction(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;addExtras;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.addExtras(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;addExtras;;;Argument[0].MapKey;Argument[-1].SyntheticField[android.content.Intent.extras].MapKey;value;manual"
+			NotificationCompat.Builder out = null;
+			Bundle in = (Bundle) newWithMapKeyDefault(source());
+			out.addExtras(in);
+			sink(getMapKeyDefault(out.getExtras())); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;addExtras;;;Argument[0].MapValue;Argument[-1].SyntheticField[android.content.Intent.extras].MapValue;value;manual"
+			NotificationCompat.Builder out = null;
+			Bundle in = (Bundle) newWithMapValueDefault(source());
+			out.addExtras(in);
+			sink(getMapValueDefault(out.getExtras())); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;addPerson;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.addPerson(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;build;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue.Field[android.app.Notification.extras];value;manual"
+			Notification out = null;
+			NotificationCompat.Builder builder = null;
+			Bundle in = (Bundle) newWithMapValueDefault(source());
+			builder.addExtras(in);
+			out = builder.build();
+			sink(getMapValueDefault(out.extras)); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;build;;;Argument[-1];ReturnValue;taint;manual"
+			Notification out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.build();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;extend;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.extend(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;getExtras;;;Argument[-1].SyntheticField[android.content.Intent.extras];ReturnValue;value;manual"
+			Bundle out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.getExtras();
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setAutoCancel;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setAutoCancel(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setBadgeIconType;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setBadgeIconType(0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setBubbleMetadata;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setBubbleMetadata(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setCategory;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setCategory(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setChannelId;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setChannelId(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setChronometerCountDown;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setChronometerCountDown(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setColor;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setColor(0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setColorized;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setColorized(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setContent;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setContent(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setContentInfo;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setContentInfo(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setContentIntent;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setContentIntent(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setContentIntent;;;Argument[0];Argument[-1];taint;manual"
+			NotificationCompat.Builder out = null;
+			PendingIntent in = (PendingIntent) source();
+			out.setContentIntent(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setContentText;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setContentText(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setContentTitle;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setContentTitle(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setCustomBigContentView;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setCustomBigContentView(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setCustomHeadsUpContentView;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setCustomHeadsUpContentView(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setDefaults;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setDefaults(0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setDeleteIntent;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setDeleteIntent(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setDeleteIntent;;;Argument[0];Argument[-1];taint;manual"
+			NotificationCompat.Builder out = null;
+			PendingIntent in = (PendingIntent) source();
+			out.setDeleteIntent(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setExtras;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setExtras(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setExtras;;;Argument[0];Argument[-1].SyntheticField[android.content.Intent.extras];value;manual"
+			NotificationCompat.Builder out = null;
+			Bundle in = (Bundle) source();
+			out.setExtras(in);
+			sink(out.getExtras()); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setFullScreenIntent;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setFullScreenIntent(null, false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setGroup;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setGroup(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setGroupAlertBehavior;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setGroupAlertBehavior(0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setGroupSummary;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setGroupSummary(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setLargeIcon;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setLargeIcon(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setLights;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setLights(0, 0, 0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setLocalOnly;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setLocalOnly(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setNumber;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setNumber(0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setOngoing;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setOngoing(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setOnlyAlertOnce;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setOnlyAlertOnce(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setPriority;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setPriority(0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setProgress;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setProgress(0, 0, false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setPublicVersion;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setPublicVersion(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setPublicVersion;;;Argument[0];Argument[-1];taint;manual"
+			NotificationCompat.Builder out = null;
+			Notification in = (Notification) source();
+			out.setPublicVersion(in);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setRemoteInputHistory;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setRemoteInputHistory(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setShortcutId;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setShortcutId(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setShowWhen;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setShowWhen(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setSmallIcon;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setSmallIcon(0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setSmallIcon;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setSmallIcon(0, 0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setSortKey;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setSortKey(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setSound;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setSound(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setSound;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setSound(null, 0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setStyle;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setStyle(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setSubText;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setSubText(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setTicker;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setTicker(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setTicker;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setTicker(null, null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setTimeoutAfter;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setTimeoutAfter(0L);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setUsesChronometer;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setUsesChronometer(false);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setVibrate;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setVibrate(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setVisibility;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setVisibility(0);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$Builder;true;setWhen;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.Builder out = null;
+			NotificationCompat.Builder in = (NotificationCompat.Builder) source();
+			out = in.setWhen(0L);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$InboxStyle;true;addLine;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.InboxStyle out = null;
+			NotificationCompat.InboxStyle in = (NotificationCompat.InboxStyle) source();
+			out = in.addLine(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$InboxStyle;true;setBigContentTitle;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.InboxStyle out = null;
+			NotificationCompat.InboxStyle in = (NotificationCompat.InboxStyle) source();
+			out = in.setBigContentTitle(null);
+			sink(out); // $ hasValueFlow
+		}
+		{
+			// "androidx.core.app;NotificationCompat$InboxStyle;true;setSummaryText;;;Argument[-1];ReturnValue;value;manual"
+			NotificationCompat.InboxStyle out = null;
+			NotificationCompat.InboxStyle in = (NotificationCompat.InboxStyle) source();
+			out = in.setSummaryText(null);
+			sink(out); // $ hasValueFlow
+		}
 	}
 
 }
diff --git a/java/ql/test/library-tests/frameworks/play/PlayMvcHttpRequestHeader.expected b/java/ql/test/library-tests/frameworks/play/PlayMvcHttpRequestHeader.expected
index 79ab2a9ded6..9ccaba383d1 100644
--- a/java/ql/test/library-tests/frameworks/play/PlayMvcHttpRequestHeader.expected
+++ b/java/ql/test/library-tests/frameworks/play/PlayMvcHttpRequestHeader.expected
@@ -1,27 +1,27 @@
-| play.mvc.Http$RequestHeader | RequestHeader.acceptLanguages |
-| play.mvc.Http$RequestHeader | RequestHeader.accepts |
-| play.mvc.Http$RequestHeader | RequestHeader.addAttr |
-| play.mvc.Http$RequestHeader | RequestHeader.attrs |
-| play.mvc.Http$RequestHeader | RequestHeader.charset |
-| play.mvc.Http$RequestHeader | RequestHeader.clientCertificateChain |
-| play.mvc.Http$RequestHeader | RequestHeader.contentType |
-| play.mvc.Http$RequestHeader | RequestHeader.cookie |
-| play.mvc.Http$RequestHeader | RequestHeader.cookies |
-| play.mvc.Http$RequestHeader | RequestHeader.getHeader |
-| play.mvc.Http$RequestHeader | RequestHeader.getHeaders |
-| play.mvc.Http$RequestHeader | RequestHeader.getQueryString |
-| play.mvc.Http$RequestHeader | RequestHeader.hasBody |
-| play.mvc.Http$RequestHeader | RequestHeader.hasHeader |
-| play.mvc.Http$RequestHeader | RequestHeader.header |
-| play.mvc.Http$RequestHeader | RequestHeader.headers |
-| play.mvc.Http$RequestHeader | RequestHeader.host |
-| play.mvc.Http$RequestHeader | RequestHeader.method |
-| play.mvc.Http$RequestHeader | RequestHeader.path |
-| play.mvc.Http$RequestHeader | RequestHeader.queryString |
-| play.mvc.Http$RequestHeader | RequestHeader.remoteAddress |
-| play.mvc.Http$RequestHeader | RequestHeader.secure |
-| play.mvc.Http$RequestHeader | RequestHeader.tags |
-| play.mvc.Http$RequestHeader | RequestHeader.uri |
-| play.mvc.Http$RequestHeader | RequestHeader.version |
-| play.mvc.Http$RequestHeader | RequestHeader.withAttrs |
-| play.mvc.Http$RequestHeader | RequestHeader.withBody |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.acceptLanguages |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.accepts |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.addAttr |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.attrs |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.charset |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.clientCertificateChain |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.contentType |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.cookie |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.cookies |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.getHeader |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.getHeaders |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.getQueryString |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.hasBody |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.hasHeader |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.header |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.headers |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.host |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.method |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.path |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.queryString |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.remoteAddress |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.secure |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.tags |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.uri |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.version |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.withAttrs |
+| play.mvc.Http$RequestHeader | play.mvc.Http$RequestHeader.withBody |
diff --git a/java/ql/test/library-tests/frameworks/play/PlayMvcResultsClass.expected b/java/ql/test/library-tests/frameworks/play/PlayMvcResultsClass.expected
index 4553e207bf6..0659069aa13 100644
--- a/java/ql/test/library-tests/frameworks/play/PlayMvcResultsClass.expected
+++ b/java/ql/test/library-tests/frameworks/play/PlayMvcResultsClass.expected
@@ -1,19 +1,19 @@
-| play.mvc.Results | Results.<clinit> |
-| play.mvc.Results | Results.badRequest |
-| play.mvc.Results | Results.created |
-| play.mvc.Results | Results.forbidden |
-| play.mvc.Results | Results.found |
-| play.mvc.Results | Results.internalServerError |
-| play.mvc.Results | Results.movedPermanently |
-| play.mvc.Results | Results.noContent |
-| play.mvc.Results | Results.notAcceptable |
-| play.mvc.Results | Results.notFound |
-| play.mvc.Results | Results.ok |
-| play.mvc.Results | Results.paymentRequired |
-| play.mvc.Results | Results.permanentRedirect |
-| play.mvc.Results | Results.redirect |
-| play.mvc.Results | Results.seeOther |
-| play.mvc.Results | Results.status |
-| play.mvc.Results | Results.temporaryRedirect |
-| play.mvc.Results | Results.unauthorized |
-| play.mvc.Results | Results.unsupportedMediaType |
+| play.mvc.Results | play.mvc.Results.<clinit> |
+| play.mvc.Results | play.mvc.Results.badRequest |
+| play.mvc.Results | play.mvc.Results.created |
+| play.mvc.Results | play.mvc.Results.forbidden |
+| play.mvc.Results | play.mvc.Results.found |
+| play.mvc.Results | play.mvc.Results.internalServerError |
+| play.mvc.Results | play.mvc.Results.movedPermanently |
+| play.mvc.Results | play.mvc.Results.noContent |
+| play.mvc.Results | play.mvc.Results.notAcceptable |
+| play.mvc.Results | play.mvc.Results.notFound |
+| play.mvc.Results | play.mvc.Results.ok |
+| play.mvc.Results | play.mvc.Results.paymentRequired |
+| play.mvc.Results | play.mvc.Results.permanentRedirect |
+| play.mvc.Results | play.mvc.Results.redirect |
+| play.mvc.Results | play.mvc.Results.seeOther |
+| play.mvc.Results | play.mvc.Results.status |
+| play.mvc.Results | play.mvc.Results.temporaryRedirect |
+| play.mvc.Results | play.mvc.Results.unauthorized |
+| play.mvc.Results | play.mvc.Results.unsupportedMediaType |
diff --git a/java/ql/test/library-tests/frameworks/spring/data/Test.java b/java/ql/test/library-tests/frameworks/spring/data/Test.java
new file mode 100644
index 00000000000..e23fc652692
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/spring/data/Test.java
@@ -0,0 +1,19 @@
+import org.springframework.data.repository.CrudRepository;
+
+class Struct {
+  public String field;
+  public Struct(String f){
+    this.field = f;
+  }
+}
+
+public class Test {
+  String source() { return null; }
+  void sink(Object o) {}
+
+  void testCrudRepository(CrudRepository<Struct, Integer> cr) {
+    Struct s = new Struct(source());
+    s = cr.save(s);
+    sink(s.field); //$hasValueFlow
+  }
+}
diff --git a/java/ql/test/library-tests/frameworks/spring/data/options b/java/ql/test/library-tests/frameworks/spring/data/options
new file mode 100644
index 00000000000..4bbebb24131
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/spring/data/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/spring-data-commons-2.5.1
diff --git a/swift/integration-tests/osx-only/frontend-invocations/C.swift b/java/ql/test/library-tests/frameworks/spring/data/test.expected
similarity index 100%
rename from swift/integration-tests/osx-only/frontend-invocations/C.swift
rename to java/ql/test/library-tests/frameworks/spring/data/test.expected
diff --git a/java/ql/test/library-tests/frameworks/spring/data/test.ql b/java/ql/test/library-tests/frameworks/spring/data/test.ql
new file mode 100644
index 00000000000..5d91e4e8e26
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/spring/data/test.ql
@@ -0,0 +1,2 @@
+import java
+import TestUtilities.InlineFlowTest
diff --git a/java/ql/test/library-tests/frameworks/thymeleaf/Test.java b/java/ql/test/library-tests/frameworks/thymeleaf/Test.java
new file mode 100644
index 00000000000..7d0d193715f
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/thymeleaf/Test.java
@@ -0,0 +1,61 @@
+package generatedtest;
+
+import java.util.Map;
+import java.util.Set;
+import org.thymeleaf.TemplateSpec;
+import org.thymeleaf.templatemode.TemplateMode;
+
+// Test case generated by GenerateFlowTestCase.ql
+public class Test {
+
+	Object source() { return null; }
+	void sink(Object o) { }
+
+	public void test() throws Exception {
+
+		{
+			// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
+			TemplateSpec out = null;
+			String in = (String)source();
+			out = new TemplateSpec(in, (Map)null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
+			TemplateSpec out = null;
+			String in = (String)source();
+			out = new TemplateSpec(in, (Set)null, (String)null, (Map)null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
+			TemplateSpec out = null;
+			String in = (String)source();
+			out = new TemplateSpec(in, (Set)null, (TemplateMode)null, (Map)null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
+			TemplateSpec out = null;
+			String in = (String)source();
+			out = new TemplateSpec(in, (String)null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "org.thymeleaf;TemplateSpec;false;TemplateSpec;;;Argument[0];Argument[-1];taint;manual"
+			TemplateSpec out = null;
+			String in = (String)source();
+			out = new TemplateSpec(in, (TemplateMode)null);
+			sink(out); // $ hasTaintFlow
+		}
+		{
+			// "org.thymeleaf;TemplateSpec;false;getTemplate;;;Argument[-1];ReturnValue;taint;manual"
+			String out = null;
+			TemplateSpec in = (TemplateSpec)source();
+			out = in.getTemplate();
+			sink(out); // $ hasTaintFlow
+		}
+
+	}
+
+}
\ No newline at end of file
diff --git a/java/ql/test/library-tests/frameworks/thymeleaf/options b/java/ql/test/library-tests/frameworks/thymeleaf/options
new file mode 100644
index 00000000000..061e53d9ece
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/thymeleaf/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/thymeleaf-3.0.14
\ No newline at end of file
diff --git a/swift/integration-tests/osx-only/frontend-invocations/D.swift b/java/ql/test/library-tests/frameworks/thymeleaf/test.expected
similarity index 100%
rename from swift/integration-tests/osx-only/frontend-invocations/D.swift
rename to java/ql/test/library-tests/frameworks/thymeleaf/test.expected
diff --git a/java/ql/test/library-tests/frameworks/thymeleaf/test.ql b/java/ql/test/library-tests/frameworks/thymeleaf/test.ql
new file mode 100644
index 00000000000..5d91e4e8e26
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/thymeleaf/test.ql
@@ -0,0 +1,2 @@
+import java
+import TestUtilities.InlineFlowTest
diff --git a/java/ql/test/library-tests/implicit-this-type/Test.java b/java/ql/test/library-tests/implicit-this-type/Test.java
new file mode 100644
index 00000000000..0eff32dddaf
--- /dev/null
+++ b/java/ql/test/library-tests/implicit-this-type/Test.java
@@ -0,0 +1,83 @@
+class Gen<T> {
+  void m(T t) { }
+}
+
+class SubSpec extends Gen<String> {
+  void foo() {
+    m("direct implicit this");
+    this.m("direct explicit this");
+  }
+
+  class Inner {
+    void bar() {
+      m("direct implicit this from inner");
+      SubSpec.this.m("direct explicit this from inner");
+    }
+  }
+
+  void hasLocal() {
+    class Local {
+      void baz() {
+        m("direct implicit this from local");
+        SubSpec.this.m("direct explicit this from local");
+      }
+    }
+  }
+}
+
+class SubGen<S> extends Gen<S> {
+  void foo() {
+    m((S)"direct implicit this (generic sub)");
+    this.m((S)"direct explicit this (generic sub)");
+  }
+
+  class Inner {
+    void bar() {
+      m((S)"direct implicit this from inner (generic sub)");
+      SubGen.this.m((S)"direct explicit this from inner (generic sub)");
+    }
+  }
+}
+
+class Intermediate<S> extends Gen<S> { }
+
+class GrandchildSpec extends Intermediate<String> {
+  void foo() {
+    m("indirect implicit this");
+    this.m("indirect explicit this");
+  }
+
+  class Inner {
+    void bar() {
+      m("indirect implicit this from inner");
+      GrandchildSpec.this.m("indirect explicit this from inner");
+    }
+  }
+}
+
+class GrandchildGen<R> extends Intermediate<R> {
+  void foo() {
+    m((R)"indirect implicit this (generic sub)");
+    this.m((R)"indirect explicit this (generic sub)");
+  }
+
+  class Inner {
+    void bar() {
+      m((R)"indirect implicit this from inner (generic sub)");
+      GrandchildGen.this.m((R)"indirect explicit this from inner (generic sub)");
+    }
+  }
+}
+
+class UninvolvedOuter {
+  class InnerGen<T> {
+    void m(T t) { }
+  }
+  
+  class InnerSpec extends InnerGen<String> {
+    void foo() {
+      m("direct implicit this, from inner to inner");
+      this.m("direct explicit this, from inner to inner");
+    }
+  }
+}
diff --git a/java/ql/test/library-tests/implicit-this-type/test.expected b/java/ql/test/library-tests/implicit-this-type/test.expected
new file mode 100644
index 00000000000..3ce0796397b
--- /dev/null
+++ b/java/ql/test/library-tests/implicit-this-type/test.expected
@@ -0,0 +1,20 @@
+| Test.java:7:5:7:29 | m(...) | Test.java:7:7:7:28 | "direct implicit this" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<String> |
+| Test.java:8:5:8:34 | m(...) | Test.java:8:12:8:33 | "direct explicit this" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<String> |
+| Test.java:13:7:13:42 | m(...) | Test.java:13:9:13:41 | "direct implicit this from inner" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<String> |
+| Test.java:14:7:14:55 | m(...) | Test.java:14:22:14:54 | "direct explicit this from inner" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<String> |
+| Test.java:21:9:21:44 | m(...) | Test.java:21:11:21:43 | "direct implicit this from local" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<String> |
+| Test.java:22:9:22:57 | m(...) | Test.java:22:24:22:56 | "direct explicit this from local" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<String> |
+| Test.java:30:5:30:46 | m(...) | Test.java:30:10:30:45 | "direct implicit this (generic sub)" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<S> |
+| Test.java:31:5:31:51 | m(...) | Test.java:31:15:31:50 | "direct explicit this (generic sub)" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<S> |
+| Test.java:36:7:36:59 | m(...) | Test.java:36:12:36:58 | "direct implicit this from inner (generic sub)" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<S> |
+| Test.java:37:7:37:71 | m(...) | Test.java:37:24:37:70 | "direct explicit this from inner (generic sub)" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<S> |
+| Test.java:46:5:46:31 | m(...) | Test.java:46:7:46:30 | "indirect implicit this" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<String> |
+| Test.java:47:5:47:36 | m(...) | Test.java:47:12:47:35 | "indirect explicit this" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<String> |
+| Test.java:52:7:52:44 | m(...) | Test.java:52:9:52:43 | "indirect implicit this from inner" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<String> |
+| Test.java:53:7:53:64 | m(...) | Test.java:53:29:53:63 | "indirect explicit this from inner" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<String> |
+| Test.java:60:5:60:48 | m(...) | Test.java:60:10:60:47 | "indirect implicit this (generic sub)" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<R> |
+| Test.java:61:5:61:53 | m(...) | Test.java:61:15:61:52 | "indirect explicit this (generic sub)" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<R> |
+| Test.java:66:7:66:61 | m(...) | Test.java:66:12:66:60 | "indirect implicit this from inner (generic sub)" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<R> |
+| Test.java:67:7:67:80 | m(...) | Test.java:67:31:67:79 | "indirect explicit this from inner (generic sub)" | Gen.class:0:0:0:0 | m | Gen.class:0:0:0:0 | Gen<R> |
+| Test.java:79:7:79:52 | m(...) | Test.java:79:9:79:51 | "direct implicit this, from inner to inner" | UninvolvedOuter$InnerGen.class:0:0:0:0 | m | UninvolvedOuter$InnerGen.class:0:0:0:0 | InnerGen<String> |
+| Test.java:80:7:80:57 | m(...) | Test.java:80:14:80:56 | "direct explicit this, from inner to inner" | UninvolvedOuter$InnerGen.class:0:0:0:0 | m | UninvolvedOuter$InnerGen.class:0:0:0:0 | InnerGen<String> |
diff --git a/java/ql/test/library-tests/implicit-this-type/test.ql b/java/ql/test/library-tests/implicit-this-type/test.ql
new file mode 100644
index 00000000000..f3b1774ff6b
--- /dev/null
+++ b/java/ql/test/library-tests/implicit-this-type/test.ql
@@ -0,0 +1,5 @@
+import java
+
+from MethodAccess ma
+select ma, ma.getAnArgument().getAChildExpr*().(StringLiteral), ma.getCallee(),
+  ma.getCallee().getDeclaringType()
diff --git a/java/ql/test/library-tests/typeflow/UnionTypes.java b/java/ql/test/library-tests/typeflow/UnionTypes.java
new file mode 100644
index 00000000000..a82b3828d2f
--- /dev/null
+++ b/java/ql/test/library-tests/typeflow/UnionTypes.java
@@ -0,0 +1,54 @@
+import java.util.*;
+import java.util.concurrent.*;
+
+public class UnionTypes {
+  public void m1() {
+    m1_map_put(new LinkedHashMap<>(), "k", "v");
+    m1_map_put(new ConcurrentHashMap<>(), "k", "v");
+  }
+
+  private void m1_map_put(Map<String, String> m, String k, String v) {
+    m.put(k, v);
+  }
+
+  static class Sup { }
+  interface Inter { }
+
+  static class A1 extends Sup implements Inter { }
+  static class A2 extends Sup implements Inter { }
+  static class A3 extends Sup { }
+  static class A4 extends Sup implements Inter { }
+  static class A2sub extends A2 { }
+
+  private void m2(boolean b) {
+    scc1(new A1(), 10);
+    Sup x = b ? new A2() : new A3();
+    scc2(x, 10);
+  }
+
+  private void scc1(Sup x1, int i) {
+    scc2(x1, i);
+  }
+
+  private void scc2(Sup x2, int i) {
+    scc3(x2, i);
+  }
+
+  private void scc3(Sup x3, int i) {
+    next(x3);
+    if (i > 0)
+      scc1(x3, --i);
+  }
+
+  private void next(Sup x) {
+    if (x instanceof Inter) {
+      x.hashCode();
+    }
+  }
+
+  void m3(Object d) {
+    if (d instanceof A1 || d instanceof A2 || d instanceof A3) {
+      d.hashCode();
+    }
+  }
+}
diff --git a/java/ql/test/library-tests/typeflow/typeflow.expected b/java/ql/test/library-tests/typeflow/typeflow.expected
index 1f879fe37ea..021d04b55d3 100644
--- a/java/ql/test/library-tests/typeflow/typeflow.expected
+++ b/java/ql/test/library-tests/typeflow/typeflow.expected
@@ -13,3 +13,4 @@
 | A.java:67:22:67:22 | x | Integer | false |
 | A.java:70:23:70:24 | x2 | Integer | false |
 | A.java:92:18:92:18 | n | Integer | false |
+| UnionTypes.java:45:7:45:7 | x | Inter | false |
diff --git a/java/ql/test/library-tests/typeflow/uniontypeflow.expected b/java/ql/test/library-tests/typeflow/uniontypeflow.expected
new file mode 100644
index 00000000000..7c595175301
--- /dev/null
+++ b/java/ql/test/library-tests/typeflow/uniontypeflow.expected
@@ -0,0 +1,24 @@
+| UnionTypes.java:11:5:11:5 | m | 2 | ConcurrentHashMap<String,String> | false |
+| UnionTypes.java:11:5:11:5 | m | 2 | LinkedHashMap<String,String> | false |
+| UnionTypes.java:26:10:26:10 | x | 2 | A2 | true |
+| UnionTypes.java:26:10:26:10 | x | 2 | A3 | false |
+| UnionTypes.java:30:10:30:11 | x1 | 3 | A1 | false |
+| UnionTypes.java:30:10:30:11 | x1 | 3 | A2 | true |
+| UnionTypes.java:30:10:30:11 | x1 | 3 | A3 | false |
+| UnionTypes.java:34:10:34:11 | x2 | 3 | A1 | false |
+| UnionTypes.java:34:10:34:11 | x2 | 3 | A2 | true |
+| UnionTypes.java:34:10:34:11 | x2 | 3 | A3 | false |
+| UnionTypes.java:38:10:38:11 | x3 | 3 | A1 | false |
+| UnionTypes.java:38:10:38:11 | x3 | 3 | A2 | true |
+| UnionTypes.java:38:10:38:11 | x3 | 3 | A3 | false |
+| UnionTypes.java:40:12:40:13 | x3 | 3 | A1 | false |
+| UnionTypes.java:40:12:40:13 | x3 | 3 | A2 | true |
+| UnionTypes.java:40:12:40:13 | x3 | 3 | A3 | false |
+| UnionTypes.java:44:9:44:9 | x | 3 | A1 | false |
+| UnionTypes.java:44:9:44:9 | x | 3 | A2 | true |
+| UnionTypes.java:44:9:44:9 | x | 3 | A3 | false |
+| UnionTypes.java:45:7:45:7 | x | 2 | A1 | false |
+| UnionTypes.java:45:7:45:7 | x | 2 | A2 | true |
+| UnionTypes.java:51:7:51:7 | d | 3 | A1 | false |
+| UnionTypes.java:51:7:51:7 | d | 3 | A2 | false |
+| UnionTypes.java:51:7:51:7 | d | 3 | A3 | false |
diff --git a/java/ql/test/library-tests/typeflow/uniontypeflow.ql b/java/ql/test/library-tests/typeflow/uniontypeflow.ql
new file mode 100644
index 00000000000..769ac89172c
--- /dev/null
+++ b/java/ql/test/library-tests/typeflow/uniontypeflow.ql
@@ -0,0 +1,10 @@
+import java
+import semmle.code.java.dataflow.TypeFlow
+
+int countUnionTypes(Expr e) {
+  result = strictcount(RefType t, boolean exact | exprUnionTypeFlow(e, t, exact))
+}
+
+from RValue e, RefType t, boolean exact
+where exprUnionTypeFlow(e, t, exact)
+select e, countUnionTypes(e), t.toString(), exact
diff --git a/java/ql/test/query-tests/AmbiguousOuterSuper/AmbiguousOuterSuper.expected b/java/ql/test/query-tests/AmbiguousOuterSuper/AmbiguousOuterSuper.expected
new file mode 100644
index 00000000000..e8c6ba5752a
--- /dev/null
+++ b/java/ql/test/query-tests/AmbiguousOuterSuper/AmbiguousOuterSuper.expected
@@ -0,0 +1,2 @@
+| GenericTest.java:14:7:14:9 | f(...) | A $@ is called instead of a $@. | GenericTest.class:0:0:0:0 | f | method declared in a superclass | GenericTest.java:9:8:9:8 | f | method with the same signature in an enclosing class |
+| Test.java:14:7:14:9 | f(...) | A $@ is called instead of a $@. | Test.java:3:8:3:8 | f | method declared in a superclass | Test.java:9:8:9:8 | f | method with the same signature in an enclosing class |
diff --git a/java/ql/test/query-tests/AmbiguousOuterSuper/AmbiguousOuterSuper.qlref b/java/ql/test/query-tests/AmbiguousOuterSuper/AmbiguousOuterSuper.qlref
new file mode 100644
index 00000000000..70c62b8c851
--- /dev/null
+++ b/java/ql/test/query-tests/AmbiguousOuterSuper/AmbiguousOuterSuper.qlref
@@ -0,0 +1 @@
+Violations of Best Practice/Naming Conventions/AmbiguousOuterSuper.ql
\ No newline at end of file
diff --git a/java/ql/test/query-tests/AmbiguousOuterSuper/GenericTest.java b/java/ql/test/query-tests/AmbiguousOuterSuper/GenericTest.java
new file mode 100644
index 00000000000..f0d14dc4867
--- /dev/null
+++ b/java/ql/test/query-tests/AmbiguousOuterSuper/GenericTest.java
@@ -0,0 +1,19 @@
+public class GenericTest<T> {
+
+  void f() { }
+
+}
+
+class Outer2 {
+
+  void f() { }
+
+  class Inner<T> extends GenericTest<T> {
+
+    public void test() {
+      f();
+    }
+
+  }
+
+}
diff --git a/java/ql/test/query-tests/AmbiguousOuterSuper/Test.java b/java/ql/test/query-tests/AmbiguousOuterSuper/Test.java
new file mode 100644
index 00000000000..e2a506f1438
--- /dev/null
+++ b/java/ql/test/query-tests/AmbiguousOuterSuper/Test.java
@@ -0,0 +1,19 @@
+public class Test {
+
+  void f() { }
+
+}
+
+class Outer {
+
+  void f() { }
+
+  class Inner extends Test {
+
+    public void test() {
+      f();
+    }
+
+  }
+
+}
diff --git a/java/ql/test/query-tests/ExposeRepresentation/ExposeRepresentation.expected b/java/ql/test/query-tests/ExposeRepresentation/ExposeRepresentation.expected
new file mode 100644
index 00000000000..0056c25bb53
--- /dev/null
+++ b/java/ql/test/query-tests/ExposeRepresentation/ExposeRepresentation.expected
@@ -0,0 +1,7 @@
+| ExposesRep.java:11:19:11:28 | getStrings | getStrings exposes the internal representation stored in field strings. The value may be modified $@. | User.java:5:5:5:19 | User.java:5:5:5:19 | after this call to getStrings |
+| ExposesRep.java:11:19:11:28 | getStrings | getStrings exposes the internal representation stored in field strings. The value may be modified $@. | User.java:13:12:13:26 | User.java:13:12:13:26 | after this call to getStrings |
+| ExposesRep.java:11:19:11:28 | getStrings | getStrings exposes the internal representation stored in field strings. The value may be modified $@. | User.java:38:12:38:26 | User.java:38:12:38:26 | after this call to getStrings |
+| ExposesRep.java:13:30:13:41 | getStringMap | getStringMap exposes the internal representation stored in field stringMap. The value may be modified $@. | User.java:9:5:9:21 | User.java:9:5:9:21 | after this call to getStringMap |
+| ExposesRep.java:17:15:17:24 | setStrings | setStrings exposes the internal representation stored in field strings. The value may be modified $@. | User.java:22:5:22:6 | User.java:22:5:22:6 | through the variable ss |
+| ExposesRep.java:21:15:21:26 | setStringMap | setStringMap exposes the internal representation stored in field stringMap. The value may be modified $@. | User.java:27:5:27:5 | User.java:27:5:27:5 | through the variable m |
+| ExposesRep.java:29:14:29:21 | getArray | getArray exposes the internal representation stored in field array. The value may be modified $@. | User.java:31:5:31:18 | User.java:31:5:31:18 | after this call to getArray |
diff --git a/java/ql/test/query-tests/ExposeRepresentation/ExposeRepresentation.qlref b/java/ql/test/query-tests/ExposeRepresentation/ExposeRepresentation.qlref
new file mode 100644
index 00000000000..6452bb942d2
--- /dev/null
+++ b/java/ql/test/query-tests/ExposeRepresentation/ExposeRepresentation.qlref
@@ -0,0 +1 @@
+Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql
diff --git a/java/ql/test/query-tests/ExposeRepresentation/ExposesRep.java b/java/ql/test/query-tests/ExposeRepresentation/ExposesRep.java
new file mode 100644
index 00000000000..11cf4456788
--- /dev/null
+++ b/java/ql/test/query-tests/ExposeRepresentation/ExposesRep.java
@@ -0,0 +1,30 @@
+import java.util.Map;
+
+public class ExposesRep {
+  private String[] strings;
+  private Map<String, String> stringMap;
+
+  public ExposesRep() {
+    strings = new String[1];
+  }
+
+  public String[] getStrings() { return strings; }
+
+  public Map<String, String> getStringMap() {
+    return stringMap;
+  }
+
+  public void setStrings(String[] ss) {
+    this.strings = ss;
+  }
+
+  public void setStringMap(Map<String, String> m) {
+    this.stringMap = m;
+  }
+}
+
+class GenericExposesRep<T> {
+  private T[] array;
+
+  public T[] getArray() { return array; }
+}
diff --git a/java/ql/test/query-tests/ExposeRepresentation/User.java b/java/ql/test/query-tests/ExposeRepresentation/User.java
new file mode 100644
index 00000000000..e13580cfa32
--- /dev/null
+++ b/java/ql/test/query-tests/ExposeRepresentation/User.java
@@ -0,0 +1,45 @@
+import java.util.Map;
+
+public class User {
+  public static void test1(ExposesRep er) {
+    er.getStrings()[0] = "Hello world";
+  }
+
+  public static void test2(ExposesRep er) {
+    er.getStringMap().put("Hello", "world");
+  }
+
+  public String[] indirectGetStrings(ExposesRep er) {
+    return er.getStrings();
+  }
+
+  public void test3(ExposesRep er) {
+    indirectGetStrings(er)[0] = "Hello world";
+  }
+
+  public static void test4(ExposesRep er, String[] ss) {
+    er.setStrings(ss);
+    ss[0] = "Hello world";
+  }
+
+  public static void test5(ExposesRep er, Map<String, String> m) {
+    er.setStringMap(m);
+    m.put("Hello", "world");
+  }
+
+  public static void test6(GenericExposesRep<String> ger) {
+    ger.getArray()[0] = "Hello world";
+  }
+}
+
+class GenericUser<T> {
+
+  public String[] indirectGetStrings(ExposesRep er) {
+    return er.getStrings();
+  }
+
+  public static void test1(ExposesRep er, GenericUser<String> gu) {
+    gu.indirectGetStrings(er)[0] = "Hello world";
+  }
+
+}
diff --git a/java/ql/test/query-tests/IteratorRemoveMayFail/IteratorRemoveMayFail.expected b/java/ql/test/query-tests/IteratorRemoveMayFail/IteratorRemoveMayFail.expected
index 8509ce7dde7..85653b45351 100644
--- a/java/ql/test/query-tests/IteratorRemoveMayFail/IteratorRemoveMayFail.expected
+++ b/java/ql/test/query-tests/IteratorRemoveMayFail/IteratorRemoveMayFail.expected
@@ -1,2 +1,3 @@
 | Test.java:16:5:16:17 | remove(...) | This call may fail when iterating over the collection created $@, since it does not support element removal. | Test.java:29:16:29:32 | asList(...) | here |
 | Test.java:16:5:16:17 | remove(...) | This call may fail when iterating over the collection created $@, since it does not support element removal. | Test.java:33:16:33:43 | singletonList(...) | here |
+| Test.java:44:3:44:23 | remove(...) | This call may fail when iterating over the collection created $@, since it does not support element removal. | Test.java:52:15:52:31 | asList(...) | here |
diff --git a/java/ql/test/query-tests/IteratorRemoveMayFail/Test.java b/java/ql/test/query-tests/IteratorRemoveMayFail/Test.java
index 782c1d3b565..3ed2c563327 100644
--- a/java/ql/test/query-tests/IteratorRemoveMayFail/Test.java
+++ b/java/ql/test/query-tests/IteratorRemoveMayFail/Test.java
@@ -36,4 +36,20 @@ class A {
 	public List<Integer> getL() {
 		return l;
 	}
+}
+
+class Parent<T> {
+
+	public void removeFirst(List<T> l) {
+		l.iterator().remove();
+	}
+
+}
+
+class Child extends Parent<String> {
+
+	public void test(String... ss) {
+		removeFirst(Arrays.asList(ss));
+	}
+
 }
\ No newline at end of file
diff --git a/java/ql/test/query-tests/MissingInstanceofInEquals/MissingInstanceofInEquals.expected b/java/ql/test/query-tests/MissingInstanceofInEquals/MissingInstanceofInEquals.expected
index 3bedb52a4a8..fd1fbd7ede5 100644
--- a/java/ql/test/query-tests/MissingInstanceofInEquals/MissingInstanceofInEquals.expected
+++ b/java/ql/test/query-tests/MissingInstanceofInEquals/MissingInstanceofInEquals.expected
@@ -1 +1 @@
-| Bad.java:13:17:13:22 | equals | equals() method does not seem to check argument type. |
+| Bad.java:13:17:13:22 | equals | equals() method does not check argument type. |
diff --git a/java/ql/test/query-tests/StaticArray/StaticArray.expected b/java/ql/test/query-tests/StaticArray/StaticArray.expected
index 5eb4b7510af..69b16f41515 100644
--- a/java/ql/test/query-tests/StaticArray/StaticArray.expected
+++ b/java/ql/test/query-tests/StaticArray/StaticArray.expected
@@ -1,5 +1,5 @@
-| StaticArray.java:3:31:3:33 | bad | The array constant bad is vulnerable to mutation. |
-| StaticArray.java:14:35:14:54 | bad_multidimensional | The array constant bad_multidimensional is vulnerable to mutation. |
-| StaticArray.java:15:35:15:67 | bad_multidimensional_partial_init | The array constant bad_multidimensional_partial_init is vulnerable to mutation. |
-| StaticArray.java:17:31:17:47 | bad_separate_init | The array constant bad_separate_init is vulnerable to mutation. |
-| StaticArray.java:26:33:26:44 | bad_nonempty | The array constant bad_nonempty is vulnerable to mutation. |
+| StaticArray.java:3:31:3:33 | bad | The array constant 'bad' is vulnerable to mutation. |
+| StaticArray.java:14:35:14:54 | bad_multidimensional | The array constant 'bad_multidimensional' is vulnerable to mutation. |
+| StaticArray.java:15:35:15:67 | bad_multidimensional_partial_init | The array constant 'bad_multidimensional_partial_init' is vulnerable to mutation. |
+| StaticArray.java:17:31:17:47 | bad_separate_init | The array constant 'bad_separate_init' is vulnerable to mutation. |
+| StaticArray.java:26:33:26:44 | bad_nonempty | The array constant 'bad_nonempty' is vulnerable to mutation. |
diff --git a/java/ql/test/query-tests/UnreadLocal/DeadStoreOfLocalUnread.expected b/java/ql/test/query-tests/UnreadLocal/DeadStoreOfLocalUnread.expected
index e3434efd564..449d0da340f 100644
--- a/java/ql/test/query-tests/UnreadLocal/DeadStoreOfLocalUnread.expected
+++ b/java/ql/test/query-tests/UnreadLocal/DeadStoreOfLocalUnread.expected
@@ -1,2 +1,2 @@
-| A.java:29:13:29:21 | ...=... | This assignment to x is useless: the value is never read. |
-| UnreadLocal/ImplicitReads.java:38:5:38:9 | ...=... | This assignment to c is useless: the value is never read. |
+| A.java:29:13:29:21 | ...=... | This definition of x is never used. |
+| UnreadLocal/ImplicitReads.java:38:5:38:9 | ...=... | This definition of c is never used. |
diff --git a/java/ql/test/query-tests/dead-code/UselessParameter/UselessParameter.expected b/java/ql/test/query-tests/dead-code/UselessParameter/UselessParameter.expected
index 5100c651a2b..07f2c07fc55 100644
--- a/java/ql/test/query-tests/dead-code/UselessParameter/UselessParameter.expected
+++ b/java/ql/test/query-tests/dead-code/UselessParameter/UselessParameter.expected
@@ -1 +1 @@
-| Test.java:6:11:6:15 | x | The parameter x is unused. |
+| Test.java:6:11:6:15 | x | The parameter 'x' is never used. |
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
index 830f4d76085..1d2935fe0d4 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
@@ -9,6 +9,11 @@ edges
 | Test.java:80:31:80:32 | br : BufferedReader | Test.java:80:31:80:43 | readLine(...) : String |
 | Test.java:80:31:80:43 | readLine(...) : String | Test.java:82:67:82:81 | ... + ... |
 | Test.java:88:17:88:37 | getHostName(...) : String | Test.java:90:26:90:29 | temp |
+| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:97:12:97:33 | new URI(...) |
+| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:98:12:98:33 | new URI(...) |
+| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:12:99:33 | new URI(...) |
+| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:100:12:100:45 | new URI(...) |
+| Test.java:95:14:95:34 | getHostName(...) : String | Test.java:101:12:101:54 | new URI(...) |
 nodes
 | Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
 | Test.java:24:20:24:23 | temp | semmle.label | temp |
@@ -23,6 +28,12 @@ nodes
 | Test.java:82:67:82:81 | ... + ... | semmle.label | ... + ... |
 | Test.java:88:17:88:37 | getHostName(...) : String | semmle.label | getHostName(...) : String |
 | Test.java:90:26:90:29 | temp | semmle.label | temp |
+| Test.java:95:14:95:34 | getHostName(...) : String | semmle.label | getHostName(...) : String |
+| Test.java:97:12:97:33 | new URI(...) | semmle.label | new URI(...) |
+| Test.java:98:12:98:33 | new URI(...) | semmle.label | new URI(...) |
+| Test.java:99:12:99:33 | new URI(...) | semmle.label | new URI(...) |
+| Test.java:100:12:100:45 | new URI(...) | semmle.label | new URI(...) |
+| Test.java:101:12:101:54 | new URI(...) | semmle.label | new URI(...) |
 subpaths
 #select
 | Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
@@ -31,3 +42,8 @@ subpaths
 | Test.java:34:12:34:25 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
 | Test.java:82:52:82:88 | new FileWriter(...) | Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:82:67:82:81 | ... + ... | $@ flows to here and is used in a path. | Test.java:79:74:79:97 | getInputStream(...) | User-provided value |
 | Test.java:90:26:90:29 | temp | Test.java:88:17:88:37 | getHostName(...) : String | Test.java:90:26:90:29 | temp | $@ flows to here and is used in a path. | Test.java:88:17:88:37 | getHostName(...) | User-provided value |
+| Test.java:97:3:97:34 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:97:12:97:33 | new URI(...) | $@ flows to here and is used in a path. | Test.java:95:14:95:34 | getHostName(...) | User-provided value |
+| Test.java:98:3:98:34 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:98:12:98:33 | new URI(...) | $@ flows to here and is used in a path. | Test.java:95:14:95:34 | getHostName(...) | User-provided value |
+| Test.java:99:3:99:34 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:99:12:99:33 | new URI(...) | $@ flows to here and is used in a path. | Test.java:95:14:95:34 | getHostName(...) | User-provided value |
+| Test.java:100:3:100:46 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:100:12:100:45 | new URI(...) | $@ flows to here and is used in a path. | Test.java:95:14:95:34 | getHostName(...) | User-provided value |
+| Test.java:101:3:101:55 | new File(...) | Test.java:95:14:95:34 | getHostName(...) : String | Test.java:101:12:101:54 | new URI(...) | $@ flows to here and is used in a path. | Test.java:95:14:95:34 | getHostName(...) | User-provided value |
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java b/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
index f0d0147df08..46c3eeec001 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
@@ -6,7 +6,7 @@ import javax.servlet.http.*;
 import javax.servlet.ServletException;
 
 import java.io.*;
-import java.net.InetAddress;
+import java.net.*;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.nio.file.FileSystems;
@@ -89,4 +89,15 @@ class Test {
 		// BAD: open a file based on user input, using a MaD-documented API
 		new LockableFileWriter(temp);
 	}
+
+	void doGet5(InetAddress address)
+	throws URISyntaxException {
+		String t = address.getHostName();
+		// BAD: construct a file path with user input
+		new File(new URI(null, t, null));
+		new File(new URI(t, t, null, t));
+		new File(new URI(t, null, t, t));
+		new File(new URI(null, null, t, null, null));
+		new File(new URI(null, null, null, 0, t, null, null));
+	}
 }
diff --git a/java/ql/test/query-tests/security/CWE-089/semmle/examples/taintedString.expected b/java/ql/test/query-tests/security/CWE-089/semmle/examples/taintedString.expected
index 62c4fdc3c46..67c6629093a 100644
--- a/java/ql/test/query-tests/security/CWE-089/semmle/examples/taintedString.expected
+++ b/java/ql/test/query-tests/security/CWE-089/semmle/examples/taintedString.expected
@@ -64,5 +64,7 @@
 | Test.java:213:21:213:24 | main | 5 | Test.java:218:14:218:17 | args |
 | Validation.java:6:21:6:35 | checkIdentifier | 1 | Validation.java:7:23:7:24 | id |
 | Validation.java:6:21:6:35 | checkIdentifier | 2 | Validation.java:8:13:8:14 | id |
+| Validation.java:6:21:6:35 | checkIdentifier | 2 | Validation.java:8:13:8:24 | charAt(...) |
+| Validation.java:6:21:6:35 | checkIdentifier | 3 | Validation.java:9:28:9:28 | c |
 | Validation.java:6:21:6:35 | checkIdentifier | 4 | Validation.java:10:32:10:58 | ... + ... |
 | Validation.java:6:21:6:35 | checkIdentifier | 4 | Validation.java:10:57:10:58 | id |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/FreemarkerSSTI.java b/java/ql/test/query-tests/security/CWE-094/FreemarkerSSTI.java
similarity index 61%
rename from java/ql/test/experimental/query-tests/security/CWE-094/FreemarkerSSTI.java
rename to java/ql/test/query-tests/security/CWE-094/FreemarkerSSTI.java
index 3ac93749616..31eb634a5fe 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/FreemarkerSSTI.java
+++ b/java/ql/test/query-tests/security/CWE-094/FreemarkerSSTI.java
@@ -11,7 +11,7 @@ import java.util.HashMap;
 import freemarker.template.Template;
 import freemarker.template.Configuration;
 import freemarker.cache.StringTemplateLoader;
-import freemarker.template.ParserConfiguration;
+import freemarker.core.ParserConfiguration;
 
 @Controller
 public class FreemarkerSSTI {
@@ -23,8 +23,7 @@ public class FreemarkerSSTI {
 		String code = request.getParameter("code");
 		Reader reader = new StringReader(code);
 
-		// Template(java.lang.String name, java.io.Reader reader)
-		Template t = new Template(name, reader);
+		Template t = new Template(name, reader); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad2")
@@ -33,9 +32,8 @@ public class FreemarkerSSTI {
 		String code = request.getParameter("code");
 		Reader reader = new StringReader(code);
 		Configuration cfg = new Configuration();
-		
-		// Template(java.lang.String name, java.io.Reader reader, Configuration cfg)
-		Template t = new Template(name, reader, cfg);
+
+		Template t = new Template(name, reader, cfg); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad3")
@@ -45,9 +43,7 @@ public class FreemarkerSSTI {
 		Reader reader = new StringReader(code);
 		Configuration cfg = new Configuration();
 
-		// Template(java.lang.String name, java.io.Reader reader, Configuration cfg,
-		// java.lang.String encoding)
-		Template t = new Template(name, reader, cfg, "UTF-8");
+		Template t = new Template(name, reader, cfg, "UTF-8"); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad4")
@@ -56,9 +52,7 @@ public class FreemarkerSSTI {
 		String sourceCode = request.getParameter("sourceCode");
 		Configuration cfg = new Configuration();
 
-		// Template(java.lang.String name, java.lang.String sourceCode, Configuration
-		// cfg)
-		Template t = new Template(name, sourceCode, cfg);
+		Template t = new Template(name, sourceCode, cfg); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad5")
@@ -68,9 +62,7 @@ public class FreemarkerSSTI {
 		Configuration cfg = new Configuration();
 		Reader reader = new StringReader(code);
 
-		// Template(java.lang.String name, java.lang.String sourceName, java.io.Reader
-		// reader, Configuration cfg)
-		Template t = new Template(name, sourceName, reader, cfg);
+		Template t = new Template(name, sourceName, reader, cfg); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad6")
@@ -81,10 +73,8 @@ public class FreemarkerSSTI {
 		ParserConfiguration customParserConfiguration = new Configuration();
 		Reader reader = new StringReader(code);
 
-		// Template(java.lang.String name, java.lang.String sourceName, java.io.Reader
-		// reader, Configuration cfg, ParserConfiguration customParserConfiguration,
-		// java.lang.String encoding)
-		Template t = new Template(name, sourceName, reader, cfg, customParserConfiguration, "UTF-8");
+		Template t =
+				new Template(name, sourceName, reader, cfg, customParserConfiguration, "UTF-8"); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad7")
@@ -95,9 +85,7 @@ public class FreemarkerSSTI {
 		ParserConfiguration customParserConfiguration = new Configuration();
 		Reader reader = new StringReader(code);
 
-		// Template(java.lang.String name, java.lang.String sourceName, java.io.Reader
-		// reader, Configuration cfg, java.lang.String encoding)
-		Template t = new Template(name, sourceName, reader, cfg, "UTF-8");
+		Template t = new Template(name, sourceName, reader, cfg, "UTF-8"); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad8")
@@ -105,28 +93,25 @@ public class FreemarkerSSTI {
 		String code = request.getParameter("code");
 		StringTemplateLoader stringLoader = new StringTemplateLoader();
 
-		// void putTemplate(java.lang.String name, java.lang.String templateContent)
-		stringLoader.putTemplate("myTemplate", code);
+		stringLoader.putTemplate("myTemplate", code); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad9")
 	public void bad9(HttpServletRequest request) {
 		String code = request.getParameter("code");
 		StringTemplateLoader stringLoader = new StringTemplateLoader();
-		
-		// void putTemplate(java.lang.String name, java.lang.String templateContent,
-		// long lastModified)
-		stringLoader.putTemplate("myTemplate", code, 0);
+
+		stringLoader.putTemplate("myTemplate", code, 0); // $hasTemplateInjection
 	}
 
-	@GetMapping(value = "bad10")
-	public void bad10(HttpServletRequest request) {
-		HashMap root = new HashMap();
+	@GetMapping(value = "good1")
+	public void good1(HttpServletRequest request) {
+		HashMap<Object, Object> root = new HashMap();
 		String code = request.getParameter("code");
-        root.put("code", code);
+		root.put("code", code);
 		Configuration cfg = new Configuration();
-        Template temp = cfg.getTemplate("test.ftlh");        
-        OutputStreamWriter out = new OutputStreamWriter(System.out);
-        temp.process(root, out);
+		Template temp = cfg.getTemplate("test.ftlh");
+		OutputStreamWriter out = new OutputStreamWriter(System.out);
+		temp.process(root, out); // Safe
 	}
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JinJavaSSTI.java b/java/ql/test/query-tests/security/CWE-094/JinJavaSSTI.java
similarity index 79%
rename from java/ql/test/experimental/query-tests/security/CWE-094/JinJavaSSTI.java
rename to java/ql/test/query-tests/security/CWE-094/JinJavaSSTI.java
index a5791ae1d57..4341a44f192 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/JinJavaSSTI.java
+++ b/java/ql/test/query-tests/security/CWE-094/JinJavaSSTI.java
@@ -21,8 +21,7 @@ public class JinJavaSSTI {
 		String template = request.getParameter("template");
 		Jinjava jinjava = new Jinjava();
 		Map<String, Object> context = new HashMap<>();
-		// String render(String template, Map<String, ?> bindings)
-		String renderedTemplate = jinjava.render(template, context);
+		String renderedTemplate = jinjava.render(template, context); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad2")
@@ -30,8 +29,7 @@ public class JinJavaSSTI {
 		String template = request.getParameter("template");
 		Jinjava jinjava = new Jinjava();
 		Map<String, Object> bindings = new HashMap<>();
-		// RenderResult renderForResult (String template, Map<String, ?> bindings)
-		RenderResult renderResult = jinjava.renderForResult(template, bindings);
+		RenderResult renderResult = jinjava.renderForResult(template, bindings); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad3")
@@ -41,8 +39,6 @@ public class JinJavaSSTI {
 		Map<String, Object> bindings = new HashMap<>();
 		JinjavaConfig renderConfig = new JinjavaConfig();
 
-		// RenderResult renderForResult (String template, Map<String, ?> bindings,
-		// JinjavaConfig renderConfig)
-		RenderResult renderResult = jinjava.renderForResult(template, bindings, renderConfig);
+		RenderResult renderResult = jinjava.renderForResult(template, bindings, renderConfig); // $hasTemplateInjection
 	}
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/PebbleSSTI.java b/java/ql/test/query-tests/security/CWE-094/PebbleSSTI.java
similarity index 66%
rename from java/ql/test/experimental/query-tests/security/CWE-094/PebbleSSTI.java
rename to java/ql/test/query-tests/security/CWE-094/PebbleSSTI.java
index 13ed42a9b26..c026f98645b 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/PebbleSSTI.java
+++ b/java/ql/test/query-tests/security/CWE-094/PebbleSSTI.java
@@ -15,16 +15,15 @@ public class PebbleSSTI {
 
 	@GetMapping(value = "bad1")
 	public void bad1(HttpServletRequest request) {
-		String code = request.getParameter("code");
+		String templateName = request.getParameter("templateName");
 		PebbleEngine engine = new PebbleEngine.Builder().build();
-		// public PebbleTemplate getTemplate(String templateName) 
-		PebbleTemplate compiledTemplate = engine.getTemplate(code);
+		PebbleTemplate compiledTemplate = engine.getTemplate(templateName); // $hasTemplateInjection
 	}
+
 	@GetMapping(value = "bad2")
 	public void bad2(HttpServletRequest request) {
-		String code = request.getParameter("code");
+		String templateName = request.getParameter("templateName");
 		PebbleEngine engine = new PebbleEngine.Builder().build();
-		// public PebbleTemplate getLiteralTemplate(String templateName) 
-		PebbleTemplate compiledTemplate = engine.getLiteralTemplate(code);
+		PebbleTemplate compiledTemplate = engine.getLiteralTemplate(templateName); // $hasTemplateInjection
 	}
 }
diff --git a/swift/integration-tests/osx-only/frontend-invocations/E.swift b/java/ql/test/query-tests/security/CWE-094/TemplateInjectionTest.expected
similarity index 100%
rename from swift/integration-tests/osx-only/frontend-invocations/E.swift
rename to java/ql/test/query-tests/security/CWE-094/TemplateInjectionTest.expected
diff --git a/java/ql/test/query-tests/security/CWE-094/TemplateInjectionTest.ql b/java/ql/test/query-tests/security/CWE-094/TemplateInjectionTest.ql
new file mode 100644
index 00000000000..b8bb1080f3f
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-094/TemplateInjectionTest.ql
@@ -0,0 +1,20 @@
+import java
+import semmle.code.java.security.TemplateInjectionQuery
+import TestUtilities.InlineExpectationsTest
+
+class TemplateInjectionTest extends InlineExpectationsTest {
+  TemplateInjectionTest() { this = "TemplateInjectionTest" }
+
+  override string getARelevantTag() { result = "hasTemplateInjection" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    tag = "hasTemplateInjection" and
+    exists(DataFlow::Node src, DataFlow::Node sink, TemplateInjectionFlowConfig conf |
+      conf.hasFlow(src, sink)
+    |
+      sink.getLocation() = location and
+      element = sink.toString() and
+      value = ""
+    )
+  }
+}
diff --git a/java/ql/test/query-tests/security/CWE-094/ThymeleafSSTI.java b/java/ql/test/query-tests/security/CWE-094/ThymeleafSSTI.java
new file mode 100644
index 00000000000..4b390668948
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-094/ThymeleafSSTI.java
@@ -0,0 +1,38 @@
+import javax.imageio.stream.FileImageInputStream;
+import javax.servlet.http.HttpServletRequest;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+
+import java.lang.String;
+import java.io.File;
+import java.io.FileWriter;
+import java.io.Reader;
+import java.io.StringReader;
+import java.io.Writer;
+import java.util.Set;
+
+import org.thymeleaf.*;
+import org.thymeleaf.context.Context;
+
+@Controller
+public class ThymeleafSSTI {
+	@GetMapping(value = "bad1")
+	public void bad1(HttpServletRequest request) {
+		String code = request.getParameter("code");
+		try {
+			TemplateEngine templateEngine = new TemplateEngine();
+			templateEngine.process(code, (Set<String>) null, (Context) null); // $hasTemplateInjection
+			templateEngine.process(code, (Set<String>) null, (Context) null, (Writer) null); // $hasTemplateInjection
+			templateEngine.process(code, (Context) null); // $hasTemplateInjection
+			templateEngine.process(code, (Context) null, (Writer) null); // $hasTemplateInjection
+			templateEngine.processThrottled(code, (Set<String>) null, (Context) null); // $hasTemplateInjection
+			templateEngine.processThrottled(code, (Context) null); // $hasTemplateInjection
+
+			TemplateSpec spec = new TemplateSpec(code, "");
+			templateEngine.process(spec, (Context) null); // $hasTemplateInjection
+			templateEngine.process(spec, (Context) null, (Writer) null); // $hasTemplateInjection
+			templateEngine.processThrottled(spec, (Context) null); // $hasTemplateInjection
+		} catch (Exception e) {
+		}
+	}
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/VelocitySSTI.java b/java/ql/test/query-tests/security/CWE-094/VelocitySSTI.java
similarity index 71%
rename from java/ql/test/experimental/query-tests/security/CWE-094/VelocitySSTI.java
rename to java/ql/test/query-tests/security/CWE-094/VelocitySSTI.java
index c35dd9b0aae..09c7a07058f 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/VelocitySSTI.java
+++ b/java/ql/test/query-tests/security/CWE-094/VelocitySSTI.java
@@ -34,8 +34,7 @@ public class VelocitySSTI {
 
 		String s = "We are using $project $name to render this.";
 		StringWriter w = new StringWriter();
-		// evaluate( Context context, Writer out, String logTag, String instring )
-		Velocity.evaluate(context, w, "mystring", code);
+		Velocity.evaluate(context, w, "mystring", code); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad2")
@@ -49,8 +48,7 @@ public class VelocitySSTI {
 		StringWriter w = new StringWriter();
 		StringReader reader = new StringReader(code);
 
-		// evaluate(Context context, Writer writer, String logTag, Reader reader)
-		Velocity.evaluate(context, w, "mystring", reader);
+		Velocity.evaluate(context, w, "mystring", reader); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad3")
@@ -58,13 +56,13 @@ public class VelocitySSTI {
 		String name = "ttemplate";
 		String code = request.getParameter("code");
 
-		RuntimeServices runtimeServices = new RuntimeServices();
+		RuntimeServices runtimeServices = null;
 		StringReader reader = new StringReader(code);
-		runtimeServices.parse(reader, new Template());
+		runtimeServices.parse(reader, new Template()); // $hasTemplateInjection
 	}
 
-	@GetMapping(value = "bad4")
-	public void bad4(HttpServletRequest request) {
+	@GetMapping(value = "good1")
+	public void good1(HttpServletRequest request) {
 		String name = "ttemplate";
 		String code = request.getParameter("code");
 
@@ -74,7 +72,7 @@ public class VelocitySSTI {
 		StringWriter w = new StringWriter();
 		StringReader reader = new StringReader("test");
 
-		Velocity.evaluate(context, w, "mystring", reader);
+		Velocity.evaluate(context, w, "mystring", reader); // Safe
 	}
 
 	@GetMapping(value = "bad5")
@@ -86,41 +84,37 @@ public class VelocitySSTI {
 		context.put("code", code);
 
 		StringWriter w = new StringWriter();
-		VelocityEngine.mergeTemplate("testtemplate.vm", "UTF-8", context, w);
+		VelocityEngine engine = null;
+		engine.mergeTemplate("testtemplate.vm", "UTF-8", context, w); // Safe
+		AbstractContext ctx = null;
+		ctx.put("key", code);
+		engine.evaluate(ctx, null, null, (String) null); // Safe
+		engine.evaluate(ctx, null, null, (Reader) null); // Safe
+		engine.evaluate(null, null, null, code); // $hasTemplateInjection
+		engine.evaluate(null, null, null, new StringReader(code)); // $hasTemplateInjection
+	}
+
+	@GetMapping(value = "good2")
+	public void good2(HttpServletRequest request) {
+		String name = "ttemplate";
+		String code = request.getParameter("code");
+
+		VelocityContext context = new VelocityContext();
+		context.put("code", code);
+
+		StringWriter w = new StringWriter();
+		Template t = new Template();
+		t.merge(context, w); // Safe
+		t.merge(context, w, new LinkedList<String>()); // Safe
+
 	}
 
 	@GetMapping(value = "bad6")
 	public void bad6(HttpServletRequest request) {
-		String name = "ttemplate";
-		String code = request.getParameter("code");
-
-		VelocityContext context = new VelocityContext();
-		context.put("code", code);
-
-		StringWriter w = new StringWriter();
-		Template t = new Template();
-		t.merge(context, w);
-	}
-
-	@GetMapping(value = "bad7")
-	public void bad7(HttpServletRequest request) {
-		String name = "ttemplate";
-		String code = request.getParameter("code");
-
-		VelocityContext context = new VelocityContext();
-		context.put("code", code);
-
-		StringWriter w = new StringWriter();
-		Template t = new Template();
-		t.merge(context, w, new LinkedList<String>());
-	}
-
-	@GetMapping(value = "bad8")
-	public void bad8(HttpServletRequest request) {
 		String code = request.getParameter("code");
 
 		StringResourceRepository repo = new StringResourceRepositoryImpl();
-		repo.putStringResource("woogie2", code);
+		repo.putStringResource("woogie2", code); // $hasTemplateInjection
 
 	}
 }
diff --git a/java/ql/test/query-tests/security/CWE-094/options b/java/ql/test/query-tests/security/CWE-094/options
index 1b4bd12d17f..72dc22e6bd3 100644
--- a/java/ql/test/query-tests/security/CWE-094/options
+++ b/java/ql/test/query-tests/security/CWE-094/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/validation-api-2.0.1.Final:${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../stubs/apache-commons-logging-1.2:${testdir}/../../../stubs/mvel2-2.4.7:${testdir}/../../../stubs/groovy-all-3.0.7:${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/scriptengine:${testdir}/../../../stubs/jsr223-api
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/validation-api-2.0.1.Final:${testdir}/../../../stubs/springframework-5.3.8:${testdir}/../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../stubs/apache-commons-logging-1.2:${testdir}/../../../stubs/mvel2-2.4.7:${testdir}/../../../stubs/groovy-all-3.0.7:${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/scriptengine:${testdir}/../../../stubs/jsr223-api:${testdir}/../../../stubs/apache-freemarker-2.3.31:${testdir}/../../../stubs/jinjava-2.6.0:${testdir}/../../../stubs/pebble-3.1.5:${testdir}/../../../stubs/thymeleaf-3.0.14:${testdir}/../../../stubs/apache-velocity-2.3
diff --git a/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected b/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected
index 35cba00aa6b..011d9035f26 100644
--- a/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected
+++ b/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected
@@ -1,14 +1,20 @@
 edges
 | ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | ResponseSplitting.java:23:23:23:28 | cookie |
 | ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie |
+| ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | ResponseSplitting.java:59:27:59:27 | t : String |
+| ResponseSplitting.java:59:27:59:27 | t : String | ResponseSplitting.java:59:27:59:57 | replaceFirst(...) |
 nodes
 | ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
 | ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | ResponseSplitting.java:23:23:23:28 | cookie | semmle.label | cookie |
 | ResponseSplitting.java:28:38:28:72 | getParameter(...) | semmle.label | getParameter(...) |
 | ResponseSplitting.java:29:38:29:72 | getParameter(...) | semmle.label | getParameter(...) |
+| ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| ResponseSplitting.java:59:27:59:27 | t : String | semmle.label | t : String |
+| ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | semmle.label | replaceFirst(...) |
 subpaths
 #select
 | ResponseSplitting.java:23:23:23:28 | cookie | ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:23:23:23:28 | cookie | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:22:39:22:66 | getParameter(...) | user-provided value |
 | ResponseSplitting.java:28:38:28:72 | getParameter(...) | ResponseSplitting.java:28:38:28:72 | getParameter(...) | ResponseSplitting.java:28:38:28:72 | getParameter(...) | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:28:38:28:72 | getParameter(...) | user-provided value |
 | ResponseSplitting.java:29:38:29:72 | getParameter(...) | ResponseSplitting.java:29:38:29:72 | getParameter(...) | ResponseSplitting.java:29:38:29:72 | getParameter(...) | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:29:38:29:72 | getParameter(...) | user-provided value |
+| ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | Response-splitting vulnerability due to this $@. | ResponseSplitting.java:53:14:53:48 | getParameter(...) | user-provided value |
diff --git a/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.java b/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.java
index d8bdd7e1731..b2ea8780e8e 100644
--- a/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.java
+++ b/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.java
@@ -48,4 +48,32 @@ public class ResponseSplitting extends HttpServlet {
 		Cookie cookie2 = new Cookie("name", cookie.getName());
 		response.addCookie(cookie2);
 	}
+
+	public void sanitizerTests(HttpServletRequest request, HttpServletResponse response){
+		String t = request.getParameter("contentType");
+
+		// GOOD: whitelist-based sanitization
+		response.setHeader("h", t.replaceAll("[^a-zA-Z]", ""));
+
+		// BAD: not replacing all problematic characters
+		response.setHeader("h", t.replaceFirst("[^a-zA-Z]", ""));
+
+		// GOOD: replace all line breaks
+		response.setHeader("h", t.replace('\n', ' ').replace('\r', ' '));
+
+		// FALSE NEGATIVE: replace only some line breaks
+		response.setHeader("h", t.replace('\n', ' '));
+
+		// FALSE NEGATIVE: replace only some line breaks
+		response.setHeader("h", t.replaceAll("\r", ""));
+
+		// GOOD: replace all linebreaks with a simple regex
+		response.setHeader("h", t.replaceAll("\n", "").replaceAll("\r", ""));
+
+		// GOOD: replace all linebreaks with a complex regex
+		response.setHeader("h", t.replaceAll("[\n\r]", ""));
+
+		// GOOD: replace all linebreaks with a complex regex
+		response.setHeader("h", t.replaceAll("something|[a\nb\rc]+|somethingelse", ""));
+	}
 }
diff --git a/java/ql/test/query-tests/security/CWE-312/AndroidManifest.xml b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/AndroidManifest.xml
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/AndroidManifest.xml
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/AndroidManifest.xml
diff --git a/swift/integration-tests/osx-only/frontend-invocations/Esup.swift b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidDatabaseTest.expected
similarity index 100%
rename from swift/integration-tests/osx-only/frontend-invocations/Esup.swift
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidDatabaseTest.expected
diff --git a/java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidDatabaseTest.java b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidDatabaseTest.java
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidDatabaseTest.java
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidDatabaseTest.java
diff --git a/java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidDatabaseTest.ql b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidDatabaseTest.ql
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidDatabaseTest.ql
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidDatabaseTest.ql
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getType.expected b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidFilesystemTest.expected
similarity index 100%
rename from swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getType.expected
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidFilesystemTest.expected
diff --git a/java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidFilesystemTest.java b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidFilesystemTest.java
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidFilesystemTest.java
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidFilesystemTest.java
diff --git a/java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidFilesystemTest.ql b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidFilesystemTest.ql
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidFilesystemTest.ql
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageAndroidFilesystemTest.ql
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr_getType.expected b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageSharedPrefsTest.expected
similarity index 100%
rename from swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr_getType.expected
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageSharedPrefsTest.expected
diff --git a/java/ql/test/query-tests/security/CWE-312/CleartextStorageSharedPrefsTest.java b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageSharedPrefsTest.java
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/CleartextStorageSharedPrefsTest.java
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageSharedPrefsTest.java
diff --git a/java/ql/test/query-tests/security/CWE-312/CleartextStorageSharedPrefsTest.ql b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageSharedPrefsTest.ql
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/CleartextStorageSharedPrefsTest.ql
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageSharedPrefsTest.ql
diff --git a/java/ql/test/query-tests/security/CWE-312/CleartextStorageSharedPrefsTestKt.kt b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageSharedPrefsTestKt.kt
similarity index 100%
rename from java/ql/test/query-tests/security/CWE-312/CleartextStorageSharedPrefsTestKt.kt
rename to java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageSharedPrefsTestKt.kt
diff --git a/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/options b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/options
new file mode 100644
index 00000000000..250480dbe1a
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/options
@@ -0,0 +1,2 @@
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/google-android-9.0.0
+// codeql-extractor-kotlin-options: ${testdir}/../../../../../stubs/google-android-9.0.0
diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.expected b/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.expected
new file mode 100644
index 00000000000..a4e41d774ca
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.expected
@@ -0,0 +1,2 @@
+| TestExplicitlyEnabled/AndroidManifest.xml:6:5:27:19 | application | Backups are allowed in this Android application. |
+| TestMissing/AndroidManifest.xml:6:5:27:19 | application | Backups are allowed in this Android application. |
diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.java b/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.java
new file mode 100644
index 00000000000..f409a442f06
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.java
@@ -0,0 +1,3 @@
+class AllowBackupEnabledTest {
+
+}
diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.qlref b/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.qlref
new file mode 100644
index 00000000000..2b7a5375dab
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/backup/AllowBackupEnabledTest.qlref
@@ -0,0 +1 @@
+Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql
\ No newline at end of file
diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/TestEmptyManifest/AndroidManifest.xml b/java/ql/test/query-tests/security/CWE-312/android/backup/TestEmptyManifest/AndroidManifest.xml
new file mode 100644
index 00000000000..306f3852be8
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/backup/TestEmptyManifest/AndroidManifest.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.example.myapplication" />
diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/TestExplicitlyDisabled/AndroidManifest.xml b/java/ql/test/query-tests/security/CWE-312/android/backup/TestExplicitlyDisabled/AndroidManifest.xml
new file mode 100644
index 00000000000..5f35eb615d5
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/backup/TestExplicitlyDisabled/AndroidManifest.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    package="com.example.myapplication">
+
+    <!-- Safe: 'android:allowBackup' explicitly disabled --> <application
+        android:allowBackup="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:fullBackupContent="@xml/backup_rules"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.MyApplication"
+        tools:targetApi="31">
+        <activity
+            android:name=".MainActivity"
+            android:exported="true"
+            android:label="@string/app_name"
+            android:theme="@style/Theme.MyApplication.NoActionBar">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+
+</manifest>
diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/TestExplicitlyEnabled/AndroidManifest.xml b/java/ql/test/query-tests/security/CWE-312/android/backup/TestExplicitlyEnabled/AndroidManifest.xml
new file mode 100644
index 00000000000..4b69c52ccae
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/backup/TestExplicitlyEnabled/AndroidManifest.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    package="com.example.myapplication">
+
+    <application
+        android:allowBackup="true"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:fullBackupContent="@xml/backup_rules"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.MyApplication"
+        tools:targetApi="31">
+        <activity
+            android:name=".MainActivity"
+            android:exported="true"
+            android:label="@string/app_name"
+            android:theme="@style/Theme.MyApplication.NoActionBar">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+
+</manifest>
diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/TestLibrary/AndroidManifest.xml b/java/ql/test/query-tests/security/CWE-312/android/backup/TestLibrary/AndroidManifest.xml
new file mode 100644
index 00000000000..e83d18d59e9
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/backup/TestLibrary/AndroidManifest.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.example.myapplication" >
+    <!-- Safe: application element does not provide the MAIN intent --> <application  android:supportsRtl="true">
+    </application>
+</manifest>
diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/TestMissing/AndroidManifest.xml b/java/ql/test/query-tests/security/CWE-312/android/backup/TestMissing/AndroidManifest.xml
new file mode 100644
index 00000000000..9db4c7429fe
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/backup/TestMissing/AndroidManifest.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    package="com.example.myapplication">
+
+    <application
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:fullBackupContent="@xml/backup_rules"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.MyApplication"
+        tools:targetApi="31">
+        <activity
+            android:name=".ItemDetailHostActivity"
+            android:exported="true"
+            android:label="@string/app_name"
+            android:resizeableActivity="true"
+            tools:targetApi="24">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+
+</manifest>
diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/Testbuild/AndroidManifest.xml b/java/ql/test/query-tests/security/CWE-312/android/backup/Testbuild/AndroidManifest.xml
new file mode 100644
index 00000000000..097e7ed2b51
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/backup/Testbuild/AndroidManifest.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    package="com.example.myapplication">
+
+    <!-- Safe: files in the build directory are ignored --> <application
+        android:allowBackup="true"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:fullBackupContent="@xml/backup_rules"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.MyApplication"
+        tools:targetApi="31">
+        <activity
+            android:name=".MainActivity"
+            android:exported="true"
+            android:label="@string/app_name"
+            android:theme="@style/Theme.MyApplication.NoActionBar">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+
+</manifest>
diff --git a/java/ql/test/query-tests/security/CWE-312/android/backup/options b/java/ql/test/query-tests/security/CWE-312/android/backup/options
new file mode 100644
index 00000000000..250480dbe1a
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-312/android/backup/options
@@ -0,0 +1,2 @@
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/google-android-9.0.0
+// codeql-extractor-kotlin-options: ${testdir}/../../../../../stubs/google-android-9.0.0
diff --git a/java/ql/test/query-tests/security/CWE-312/options b/java/ql/test/query-tests/security/CWE-312/options
deleted file mode 100644
index 93845c4b2a8..00000000000
--- a/java/ql/test/query-tests/security/CWE-312/options
+++ /dev/null
@@ -1,2 +0,0 @@
-// semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/google-android-9.0.0
-// codeql-extractor-kotlin-options: ${testdir}/../../../stubs/google-android-9.0.0
diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
index 0b64242ffa0..25824c79394 100644
--- a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
+++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
@@ -1,14 +1,25 @@
 edges
+| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) |
+| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String |
 | UrlRedirect.java:36:58:36:89 | getParameter(...) : String | UrlRedirect.java:36:25:36:89 | ... + ... |
+| UrlRedirect.java:45:28:45:39 | input : String | UrlRedirect.java:46:10:46:14 | input : String |
+| UrlRedirect.java:46:10:46:14 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String |
 nodes
 | UrlRedirect.java:23:25:23:54 | getParameter(...) | semmle.label | getParameter(...) |
+| UrlRedirect.java:32:25:32:67 | weakCleanup(...) | semmle.label | weakCleanup(...) |
+| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | UrlRedirect.java:36:25:36:89 | ... + ... | semmle.label | ... + ... |
 | UrlRedirect.java:36:58:36:89 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | UrlRedirect.java:39:34:39:63 | getParameter(...) | semmle.label | getParameter(...) |
 | UrlRedirect.java:42:43:42:72 | getParameter(...) | semmle.label | getParameter(...) |
+| UrlRedirect.java:45:28:45:39 | input : String | semmle.label | input : String |
+| UrlRedirect.java:46:10:46:14 | input : String | semmle.label | input : String |
+| UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | semmle.label | replaceAll(...) : String |
 subpaths
+| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) |
 #select
 | UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | Potentially untrusted URL redirection due to $@. | UrlRedirect.java:23:25:23:54 | getParameter(...) | user-provided value |
+| UrlRedirect.java:32:25:32:67 | weakCleanup(...) | UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | Potentially untrusted URL redirection due to $@. | UrlRedirect.java:32:37:32:66 | getParameter(...) | user-provided value |
 | UrlRedirect.java:36:25:36:89 | ... + ... | UrlRedirect.java:36:58:36:89 | getParameter(...) : String | UrlRedirect.java:36:25:36:89 | ... + ... | Potentially untrusted URL redirection due to $@. | UrlRedirect.java:36:58:36:89 | getParameter(...) | user-provided value |
 | UrlRedirect.java:39:34:39:63 | getParameter(...) | UrlRedirect.java:39:34:39:63 | getParameter(...) | UrlRedirect.java:39:34:39:63 | getParameter(...) | Potentially untrusted URL redirection due to $@. | UrlRedirect.java:39:34:39:63 | getParameter(...) | user-provided value |
 | UrlRedirect.java:42:43:42:72 | getParameter(...) | UrlRedirect.java:42:43:42:72 | getParameter(...) | UrlRedirect.java:42:43:42:72 | getParameter(...) | Potentially untrusted URL redirection due to $@. | UrlRedirect.java:42:43:42:72 | getParameter(...) | user-provided value |
diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.java b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.java
index b8688c41fc0..318fdec9182 100644
--- a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.java
+++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.java
@@ -27,7 +27,7 @@ public class UrlRedirect extends HttpServlet {
 			response.sendRedirect(VALID_REDIRECT);
 		}
 		
-		// FALSE NEGATIVE: the user attempts to clean the string, but this will fail
+		// BAD: the user attempts to clean the string, but this will fail
 		// if the argument is "hthttp://tp://malicious.com"
 		response.sendRedirect(weakCleanup(request.getParameter("target")));
 		
diff --git a/java/ql/test/query-tests/security/CWE-611/XXE.expected b/java/ql/test/query-tests/security/CWE-611/XXE.expected
index 6bbb246cb6a..993a6012273 100644
--- a/java/ql/test/query-tests/security/CWE-611/XXE.expected
+++ b/java/ql/test/query-tests/security/CWE-611/XXE.expected
@@ -251,101 +251,101 @@ nodes
 | XmlInputFactoryTests.java:56:34:56:54 | getInputStream(...) | semmle.label | getInputStream(...) |
 subpaths
 #select
-| DocumentBuilderTests.java:14:19:14:39 | getInputStream(...) | DocumentBuilderTests.java:14:19:14:39 | getInputStream(...) | DocumentBuilderTests.java:14:19:14:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:14:19:14:39 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:28:19:28:39 | getInputStream(...) | DocumentBuilderTests.java:28:19:28:39 | getInputStream(...) | DocumentBuilderTests.java:28:19:28:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:28:19:28:39 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:35:19:35:39 | getInputStream(...) | DocumentBuilderTests.java:35:19:35:39 | getInputStream(...) | DocumentBuilderTests.java:35:19:35:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:35:19:35:39 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:42:19:42:39 | getInputStream(...) | DocumentBuilderTests.java:42:19:42:39 | getInputStream(...) | DocumentBuilderTests.java:42:19:42:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:42:19:42:39 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:49:19:49:39 | getInputStream(...) | DocumentBuilderTests.java:49:19:49:39 | getInputStream(...) | DocumentBuilderTests.java:49:19:49:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:49:19:49:39 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:64:19:64:39 | getInputStream(...) | DocumentBuilderTests.java:64:19:64:39 | getInputStream(...) | DocumentBuilderTests.java:64:19:64:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:64:19:64:39 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:71:19:71:39 | getInputStream(...) | DocumentBuilderTests.java:71:19:71:39 | getInputStream(...) | DocumentBuilderTests.java:71:19:71:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:71:19:71:39 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:79:19:79:39 | getInputStream(...) | DocumentBuilderTests.java:79:19:79:39 | getInputStream(...) | DocumentBuilderTests.java:79:19:79:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:79:19:79:39 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:87:19:87:39 | getInputStream(...) | DocumentBuilderTests.java:87:19:87:39 | getInputStream(...) | DocumentBuilderTests.java:87:19:87:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:87:19:87:39 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) | DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) | user input |
-| DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) | user input |
-| SAXBuilderTests.java:8:19:8:39 | getInputStream(...) | SAXBuilderTests.java:8:19:8:39 | getInputStream(...) | SAXBuilderTests.java:8:19:8:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXBuilderTests.java:8:19:8:39 | getInputStream(...) | user input |
-| SAXBuilderTests.java:20:19:20:39 | getInputStream(...) | SAXBuilderTests.java:20:19:20:39 | getInputStream(...) | SAXBuilderTests.java:20:19:20:39 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXBuilderTests.java:20:19:20:39 | getInputStream(...) | user input |
-| SAXParserTests.java:13:18:13:38 | getInputStream(...) | SAXParserTests.java:13:18:13:38 | getInputStream(...) | SAXParserTests.java:13:18:13:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXParserTests.java:13:18:13:38 | getInputStream(...) | user input |
-| SAXParserTests.java:30:18:30:38 | getInputStream(...) | SAXParserTests.java:30:18:30:38 | getInputStream(...) | SAXParserTests.java:30:18:30:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXParserTests.java:30:18:30:38 | getInputStream(...) | user input |
-| SAXParserTests.java:38:18:38:38 | getInputStream(...) | SAXParserTests.java:38:18:38:38 | getInputStream(...) | SAXParserTests.java:38:18:38:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXParserTests.java:38:18:38:38 | getInputStream(...) | user input |
-| SAXParserTests.java:46:18:46:38 | getInputStream(...) | SAXParserTests.java:46:18:46:38 | getInputStream(...) | SAXParserTests.java:46:18:46:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXParserTests.java:46:18:46:38 | getInputStream(...) | user input |
-| SAXParserTests.java:55:18:55:38 | getInputStream(...) | SAXParserTests.java:55:18:55:38 | getInputStream(...) | SAXParserTests.java:55:18:55:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXParserTests.java:55:18:55:38 | getInputStream(...) | user input |
-| SAXParserTests.java:64:18:64:38 | getInputStream(...) | SAXParserTests.java:64:18:64:38 | getInputStream(...) | SAXParserTests.java:64:18:64:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXParserTests.java:64:18:64:38 | getInputStream(...) | user input |
-| SAXParserTests.java:73:18:73:38 | getInputStream(...) | SAXParserTests.java:73:18:73:38 | getInputStream(...) | SAXParserTests.java:73:18:73:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXParserTests.java:73:18:73:38 | getInputStream(...) | user input |
-| SAXReaderTests.java:8:17:8:37 | getInputStream(...) | SAXReaderTests.java:8:17:8:37 | getInputStream(...) | SAXReaderTests.java:8:17:8:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:8:17:8:37 | getInputStream(...) | user input |
-| SAXReaderTests.java:23:17:23:37 | getInputStream(...) | SAXReaderTests.java:23:17:23:37 | getInputStream(...) | SAXReaderTests.java:23:17:23:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:23:17:23:37 | getInputStream(...) | user input |
-| SAXReaderTests.java:30:17:30:37 | getInputStream(...) | SAXReaderTests.java:30:17:30:37 | getInputStream(...) | SAXReaderTests.java:30:17:30:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:30:17:30:37 | getInputStream(...) | user input |
-| SAXReaderTests.java:37:17:37:37 | getInputStream(...) | SAXReaderTests.java:37:17:37:37 | getInputStream(...) | SAXReaderTests.java:37:17:37:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:37:17:37:37 | getInputStream(...) | user input |
-| SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | user input |
-| SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | user input |
-| SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | user input |
-| SAXSourceTests.java:20:18:20:23 | source | SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:20:18:20:23 | source | Unsafe parsing of XML file from $@. | SAXSourceTests.java:17:62:17:82 | getInputStream(...) | user input |
-| SchemaTests.java:12:39:12:77 | new StreamSource(...) | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:12:56:12:76 | getInputStream(...) | user input |
-| SchemaTests.java:25:39:25:77 | new StreamSource(...) | SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:25:56:25:76 | getInputStream(...) | user input |
-| SchemaTests.java:31:39:31:77 | new StreamSource(...) | SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:31:56:31:76 | getInputStream(...) | user input |
-| SchemaTests.java:38:39:38:77 | new StreamSource(...) | SchemaTests.java:38:56:38:76 | getInputStream(...) : InputStream | SchemaTests.java:38:39:38:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:38:56:38:76 | getInputStream(...) | user input |
-| SchemaTests.java:45:39:45:77 | new StreamSource(...) | SchemaTests.java:45:56:45:76 | getInputStream(...) : InputStream | SchemaTests.java:45:39:45:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:45:56:45:76 | getInputStream(...) | user input |
-| SimpleXMLTests.java:14:41:14:61 | getInputStream(...) | SimpleXMLTests.java:14:41:14:61 | getInputStream(...) | SimpleXMLTests.java:14:41:14:61 | getInputStream(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:14:41:14:61 | getInputStream(...) | user input |
-| SimpleXMLTests.java:19:41:19:61 | getInputStream(...) | SimpleXMLTests.java:19:41:19:61 | getInputStream(...) | SimpleXMLTests.java:19:41:19:61 | getInputStream(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:19:41:19:61 | getInputStream(...) | user input |
-| SimpleXMLTests.java:24:41:24:84 | new InputStreamReader(...) | SimpleXMLTests.java:24:63:24:83 | getInputStream(...) : InputStream | SimpleXMLTests.java:24:41:24:84 | new InputStreamReader(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:24:63:24:83 | getInputStream(...) | user input |
-| SimpleXMLTests.java:31:41:31:53 | new String(...) | SimpleXMLTests.java:30:5:30:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:31:41:31:53 | new String(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:30:5:30:25 | getInputStream(...) | user input |
-| SimpleXMLTests.java:38:41:38:53 | new String(...) | SimpleXMLTests.java:37:5:37:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:38:41:38:53 | new String(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:37:5:37:25 | getInputStream(...) | user input |
-| SimpleXMLTests.java:43:41:43:84 | new InputStreamReader(...) | SimpleXMLTests.java:43:63:43:83 | getInputStream(...) : InputStream | SimpleXMLTests.java:43:41:43:84 | new InputStreamReader(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:43:63:43:83 | getInputStream(...) | user input |
-| SimpleXMLTests.java:48:37:48:57 | getInputStream(...) | SimpleXMLTests.java:48:37:48:57 | getInputStream(...) | SimpleXMLTests.java:48:37:48:57 | getInputStream(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:48:37:48:57 | getInputStream(...) | user input |
-| SimpleXMLTests.java:53:37:53:57 | getInputStream(...) | SimpleXMLTests.java:53:37:53:57 | getInputStream(...) | SimpleXMLTests.java:53:37:53:57 | getInputStream(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:53:37:53:57 | getInputStream(...) | user input |
-| SimpleXMLTests.java:58:26:58:46 | getInputStream(...) | SimpleXMLTests.java:58:26:58:46 | getInputStream(...) | SimpleXMLTests.java:58:26:58:46 | getInputStream(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:58:26:58:46 | getInputStream(...) | user input |
-| SimpleXMLTests.java:63:26:63:46 | getInputStream(...) | SimpleXMLTests.java:63:26:63:46 | getInputStream(...) | SimpleXMLTests.java:63:26:63:46 | getInputStream(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:63:26:63:46 | getInputStream(...) | user input |
-| SimpleXMLTests.java:68:37:68:80 | new InputStreamReader(...) | SimpleXMLTests.java:68:59:68:79 | getInputStream(...) : InputStream | SimpleXMLTests.java:68:37:68:80 | new InputStreamReader(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:68:59:68:79 | getInputStream(...) | user input |
-| SimpleXMLTests.java:73:37:73:80 | new InputStreamReader(...) | SimpleXMLTests.java:73:59:73:79 | getInputStream(...) : InputStream | SimpleXMLTests.java:73:37:73:80 | new InputStreamReader(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:73:59:73:79 | getInputStream(...) | user input |
-| SimpleXMLTests.java:78:26:78:69 | new InputStreamReader(...) | SimpleXMLTests.java:78:48:78:68 | getInputStream(...) : InputStream | SimpleXMLTests.java:78:26:78:69 | new InputStreamReader(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:78:48:78:68 | getInputStream(...) | user input |
-| SimpleXMLTests.java:83:26:83:69 | new InputStreamReader(...) | SimpleXMLTests.java:83:48:83:68 | getInputStream(...) : InputStream | SimpleXMLTests.java:83:26:83:69 | new InputStreamReader(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:83:48:83:68 | getInputStream(...) | user input |
-| SimpleXMLTests.java:90:37:90:49 | new String(...) | SimpleXMLTests.java:89:5:89:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:90:37:90:49 | new String(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:89:5:89:25 | getInputStream(...) | user input |
-| SimpleXMLTests.java:97:37:97:49 | new String(...) | SimpleXMLTests.java:96:5:96:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:97:37:97:49 | new String(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:96:5:96:25 | getInputStream(...) | user input |
-| SimpleXMLTests.java:104:26:104:38 | new String(...) | SimpleXMLTests.java:103:5:103:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:104:26:104:38 | new String(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:103:5:103:25 | getInputStream(...) | user input |
-| SimpleXMLTests.java:111:26:111:38 | new String(...) | SimpleXMLTests.java:110:5:110:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:111:26:111:38 | new String(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:110:5:110:25 | getInputStream(...) | user input |
-| SimpleXMLTests.java:115:22:115:42 | getInputStream(...) | SimpleXMLTests.java:115:22:115:42 | getInputStream(...) | SimpleXMLTests.java:115:22:115:42 | getInputStream(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:115:22:115:42 | getInputStream(...) | user input |
-| SimpleXMLTests.java:119:22:119:65 | new InputStreamReader(...) | SimpleXMLTests.java:119:44:119:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:119:22:119:65 | new InputStreamReader(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:119:44:119:64 | getInputStream(...) | user input |
-| SimpleXMLTests.java:124:22:124:42 | getInputStream(...) | SimpleXMLTests.java:124:22:124:42 | getInputStream(...) | SimpleXMLTests.java:124:22:124:42 | getInputStream(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:124:22:124:42 | getInputStream(...) | user input |
-| SimpleXMLTests.java:129:22:129:65 | new InputStreamReader(...) | SimpleXMLTests.java:129:44:129:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:129:22:129:65 | new InputStreamReader(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:129:44:129:64 | getInputStream(...) | user input |
-| SimpleXMLTests.java:134:22:134:42 | getInputStream(...) | SimpleXMLTests.java:134:22:134:42 | getInputStream(...) | SimpleXMLTests.java:134:22:134:42 | getInputStream(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:134:22:134:42 | getInputStream(...) | user input |
-| SimpleXMLTests.java:139:22:139:65 | new InputStreamReader(...) | SimpleXMLTests.java:139:44:139:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:139:22:139:65 | new InputStreamReader(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:139:44:139:64 | getInputStream(...) | user input |
-| SimpleXMLTests.java:146:22:146:34 | new String(...) | SimpleXMLTests.java:145:5:145:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:146:22:146:34 | new String(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:145:5:145:25 | getInputStream(...) | user input |
-| SimpleXMLTests.java:153:22:153:34 | new String(...) | SimpleXMLTests.java:152:5:152:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:153:22:153:34 | new String(...) | Unsafe parsing of XML file from $@. | SimpleXMLTests.java:152:5:152:25 | getInputStream(...) | user input |
-| TransformerTests.java:20:27:20:65 | new StreamSource(...) | TransformerTests.java:20:44:20:64 | getInputStream(...) : InputStream | TransformerTests.java:20:27:20:65 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:20:44:20:64 | getInputStream(...) | user input |
-| TransformerTests.java:21:23:21:61 | new StreamSource(...) | TransformerTests.java:21:40:21:60 | getInputStream(...) : InputStream | TransformerTests.java:21:23:21:61 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:21:40:21:60 | getInputStream(...) | user input |
-| TransformerTests.java:71:27:71:65 | new StreamSource(...) | TransformerTests.java:71:44:71:64 | getInputStream(...) : InputStream | TransformerTests.java:71:27:71:65 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:71:44:71:64 | getInputStream(...) | user input |
-| TransformerTests.java:72:23:72:61 | new StreamSource(...) | TransformerTests.java:72:40:72:60 | getInputStream(...) : InputStream | TransformerTests.java:72:23:72:61 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:72:40:72:60 | getInputStream(...) | user input |
-| TransformerTests.java:79:27:79:65 | new StreamSource(...) | TransformerTests.java:79:44:79:64 | getInputStream(...) : InputStream | TransformerTests.java:79:27:79:65 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:79:44:79:64 | getInputStream(...) | user input |
-| TransformerTests.java:80:23:80:61 | new StreamSource(...) | TransformerTests.java:80:40:80:60 | getInputStream(...) : InputStream | TransformerTests.java:80:23:80:61 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:80:40:80:60 | getInputStream(...) | user input |
-| TransformerTests.java:88:27:88:65 | new StreamSource(...) | TransformerTests.java:88:44:88:64 | getInputStream(...) : InputStream | TransformerTests.java:88:27:88:65 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:88:44:88:64 | getInputStream(...) | user input |
-| TransformerTests.java:89:23:89:61 | new StreamSource(...) | TransformerTests.java:89:40:89:60 | getInputStream(...) : InputStream | TransformerTests.java:89:23:89:61 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:89:40:89:60 | getInputStream(...) | user input |
-| TransformerTests.java:97:27:97:65 | new StreamSource(...) | TransformerTests.java:97:44:97:64 | getInputStream(...) : InputStream | TransformerTests.java:97:27:97:65 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:97:44:97:64 | getInputStream(...) | user input |
-| TransformerTests.java:98:23:98:61 | new StreamSource(...) | TransformerTests.java:98:40:98:60 | getInputStream(...) : InputStream | TransformerTests.java:98:23:98:61 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:98:40:98:60 | getInputStream(...) | user input |
-| TransformerTests.java:103:21:103:59 | new StreamSource(...) | TransformerTests.java:103:38:103:58 | getInputStream(...) : InputStream | TransformerTests.java:103:21:103:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:103:38:103:58 | getInputStream(...) | user input |
-| TransformerTests.java:116:21:116:59 | new StreamSource(...) | TransformerTests.java:116:38:116:58 | getInputStream(...) : InputStream | TransformerTests.java:116:21:116:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:116:38:116:58 | getInputStream(...) | user input |
-| TransformerTests.java:122:21:122:59 | new StreamSource(...) | TransformerTests.java:122:38:122:58 | getInputStream(...) : InputStream | TransformerTests.java:122:21:122:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:122:38:122:58 | getInputStream(...) | user input |
-| TransformerTests.java:129:21:129:59 | new StreamSource(...) | TransformerTests.java:129:38:129:58 | getInputStream(...) : InputStream | TransformerTests.java:129:21:129:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:129:38:129:58 | getInputStream(...) | user input |
-| TransformerTests.java:136:21:136:59 | new StreamSource(...) | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | TransformerTests.java:136:21:136:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:136:38:136:58 | getInputStream(...) | user input |
-| TransformerTests.java:141:18:141:70 | new SAXSource(...) | TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | TransformerTests.java:141:18:141:70 | new SAXSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:141:48:141:68 | getInputStream(...) | user input |
-| UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | user input |
-| XMLReaderTests.java:16:18:16:55 | new InputSource(...) | XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:16:34:16:54 | getInputStream(...) | user input |
-| XMLReaderTests.java:56:18:56:55 | new InputSource(...) | XMLReaderTests.java:56:34:56:54 | getInputStream(...) : InputStream | XMLReaderTests.java:56:18:56:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:56:34:56:54 | getInputStream(...) | user input |
-| XMLReaderTests.java:63:18:63:55 | new InputSource(...) | XMLReaderTests.java:63:34:63:54 | getInputStream(...) : InputStream | XMLReaderTests.java:63:18:63:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:63:34:63:54 | getInputStream(...) | user input |
-| XMLReaderTests.java:70:18:70:55 | new InputSource(...) | XMLReaderTests.java:70:34:70:54 | getInputStream(...) : InputStream | XMLReaderTests.java:70:18:70:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:70:34:70:54 | getInputStream(...) | user input |
-| XMLReaderTests.java:78:18:78:55 | new InputSource(...) | XMLReaderTests.java:78:34:78:54 | getInputStream(...) : InputStream | XMLReaderTests.java:78:18:78:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:78:34:78:54 | getInputStream(...) | user input |
-| XMLReaderTests.java:86:18:86:55 | new InputSource(...) | XMLReaderTests.java:86:34:86:54 | getInputStream(...) : InputStream | XMLReaderTests.java:86:18:86:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:86:34:86:54 | getInputStream(...) | user input |
-| XMLReaderTests.java:94:18:94:55 | new InputSource(...) | XMLReaderTests.java:94:34:94:54 | getInputStream(...) : InputStream | XMLReaderTests.java:94:18:94:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:94:34:94:54 | getInputStream(...) | user input |
-| XMLReaderTests.java:100:18:100:55 | new InputSource(...) | XMLReaderTests.java:100:34:100:54 | getInputStream(...) : InputStream | XMLReaderTests.java:100:18:100:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:100:34:100:54 | getInputStream(...) | user input |
-| XPathExpressionTests.java:27:21:27:58 | new InputSource(...) | XPathExpressionTests.java:27:37:27:57 | getInputStream(...) : InputStream | XPathExpressionTests.java:27:21:27:58 | new InputSource(...) | Unsafe parsing of XML file from $@. | XPathExpressionTests.java:27:37:27:57 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:9:35:9:55 | getInputStream(...) | XmlInputFactoryTests.java:9:35:9:55 | getInputStream(...) | XmlInputFactoryTests.java:9:35:9:55 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:9:35:9:55 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:10:34:10:54 | getInputStream(...) | XmlInputFactoryTests.java:10:34:10:54 | getInputStream(...) | XmlInputFactoryTests.java:10:34:10:54 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:10:34:10:54 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:24:35:24:55 | getInputStream(...) | XmlInputFactoryTests.java:24:35:24:55 | getInputStream(...) | XmlInputFactoryTests.java:24:35:24:55 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:24:35:24:55 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:25:34:25:54 | getInputStream(...) | XmlInputFactoryTests.java:25:34:25:54 | getInputStream(...) | XmlInputFactoryTests.java:25:34:25:54 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:25:34:25:54 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:31:35:31:55 | getInputStream(...) | XmlInputFactoryTests.java:31:35:31:55 | getInputStream(...) | XmlInputFactoryTests.java:31:35:31:55 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:31:35:31:55 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:32:34:32:54 | getInputStream(...) | XmlInputFactoryTests.java:32:34:32:54 | getInputStream(...) | XmlInputFactoryTests.java:32:34:32:54 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:32:34:32:54 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:39:35:39:55 | getInputStream(...) | XmlInputFactoryTests.java:39:35:39:55 | getInputStream(...) | XmlInputFactoryTests.java:39:35:39:55 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:39:35:39:55 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:40:34:40:54 | getInputStream(...) | XmlInputFactoryTests.java:40:34:40:54 | getInputStream(...) | XmlInputFactoryTests.java:40:34:40:54 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:40:34:40:54 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:47:35:47:55 | getInputStream(...) | XmlInputFactoryTests.java:47:35:47:55 | getInputStream(...) | XmlInputFactoryTests.java:47:35:47:55 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:47:35:47:55 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:48:34:48:54 | getInputStream(...) | XmlInputFactoryTests.java:48:34:48:54 | getInputStream(...) | XmlInputFactoryTests.java:48:34:48:54 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:48:34:48:54 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:55:35:55:55 | getInputStream(...) | XmlInputFactoryTests.java:55:35:55:55 | getInputStream(...) | XmlInputFactoryTests.java:55:35:55:55 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:55:35:55:55 | getInputStream(...) | user input |
-| XmlInputFactoryTests.java:56:34:56:54 | getInputStream(...) | XmlInputFactoryTests.java:56:34:56:54 | getInputStream(...) | XmlInputFactoryTests.java:56:34:56:54 | getInputStream(...) | Unsafe parsing of XML file from $@. | XmlInputFactoryTests.java:56:34:56:54 | getInputStream(...) | user input |
+| DocumentBuilderTests.java:14:19:14:39 | getInputStream(...) | DocumentBuilderTests.java:14:19:14:39 | getInputStream(...) | DocumentBuilderTests.java:14:19:14:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:14:19:14:39 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:28:19:28:39 | getInputStream(...) | DocumentBuilderTests.java:28:19:28:39 | getInputStream(...) | DocumentBuilderTests.java:28:19:28:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:28:19:28:39 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:35:19:35:39 | getInputStream(...) | DocumentBuilderTests.java:35:19:35:39 | getInputStream(...) | DocumentBuilderTests.java:35:19:35:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:35:19:35:39 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:42:19:42:39 | getInputStream(...) | DocumentBuilderTests.java:42:19:42:39 | getInputStream(...) | DocumentBuilderTests.java:42:19:42:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:42:19:42:39 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:49:19:49:39 | getInputStream(...) | DocumentBuilderTests.java:49:19:49:39 | getInputStream(...) | DocumentBuilderTests.java:49:19:49:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:49:19:49:39 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:64:19:64:39 | getInputStream(...) | DocumentBuilderTests.java:64:19:64:39 | getInputStream(...) | DocumentBuilderTests.java:64:19:64:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:64:19:64:39 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:71:19:71:39 | getInputStream(...) | DocumentBuilderTests.java:71:19:71:39 | getInputStream(...) | DocumentBuilderTests.java:71:19:71:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:71:19:71:39 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:79:19:79:39 | getInputStream(...) | DocumentBuilderTests.java:79:19:79:39 | getInputStream(...) | DocumentBuilderTests.java:79:19:79:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:79:19:79:39 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:87:19:87:39 | getInputStream(...) | DocumentBuilderTests.java:87:19:87:39 | getInputStream(...) | DocumentBuilderTests.java:87:19:87:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:87:19:87:39 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) | DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) | user-provided value |
+| DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) | user-provided value |
+| SAXBuilderTests.java:8:19:8:39 | getInputStream(...) | SAXBuilderTests.java:8:19:8:39 | getInputStream(...) | SAXBuilderTests.java:8:19:8:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXBuilderTests.java:8:19:8:39 | getInputStream(...) | user-provided value |
+| SAXBuilderTests.java:20:19:20:39 | getInputStream(...) | SAXBuilderTests.java:20:19:20:39 | getInputStream(...) | SAXBuilderTests.java:20:19:20:39 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXBuilderTests.java:20:19:20:39 | getInputStream(...) | user-provided value |
+| SAXParserTests.java:13:18:13:38 | getInputStream(...) | SAXParserTests.java:13:18:13:38 | getInputStream(...) | SAXParserTests.java:13:18:13:38 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXParserTests.java:13:18:13:38 | getInputStream(...) | user-provided value |
+| SAXParserTests.java:30:18:30:38 | getInputStream(...) | SAXParserTests.java:30:18:30:38 | getInputStream(...) | SAXParserTests.java:30:18:30:38 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXParserTests.java:30:18:30:38 | getInputStream(...) | user-provided value |
+| SAXParserTests.java:38:18:38:38 | getInputStream(...) | SAXParserTests.java:38:18:38:38 | getInputStream(...) | SAXParserTests.java:38:18:38:38 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXParserTests.java:38:18:38:38 | getInputStream(...) | user-provided value |
+| SAXParserTests.java:46:18:46:38 | getInputStream(...) | SAXParserTests.java:46:18:46:38 | getInputStream(...) | SAXParserTests.java:46:18:46:38 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXParserTests.java:46:18:46:38 | getInputStream(...) | user-provided value |
+| SAXParserTests.java:55:18:55:38 | getInputStream(...) | SAXParserTests.java:55:18:55:38 | getInputStream(...) | SAXParserTests.java:55:18:55:38 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXParserTests.java:55:18:55:38 | getInputStream(...) | user-provided value |
+| SAXParserTests.java:64:18:64:38 | getInputStream(...) | SAXParserTests.java:64:18:64:38 | getInputStream(...) | SAXParserTests.java:64:18:64:38 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXParserTests.java:64:18:64:38 | getInputStream(...) | user-provided value |
+| SAXParserTests.java:73:18:73:38 | getInputStream(...) | SAXParserTests.java:73:18:73:38 | getInputStream(...) | SAXParserTests.java:73:18:73:38 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXParserTests.java:73:18:73:38 | getInputStream(...) | user-provided value |
+| SAXReaderTests.java:8:17:8:37 | getInputStream(...) | SAXReaderTests.java:8:17:8:37 | getInputStream(...) | SAXReaderTests.java:8:17:8:37 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXReaderTests.java:8:17:8:37 | getInputStream(...) | user-provided value |
+| SAXReaderTests.java:23:17:23:37 | getInputStream(...) | SAXReaderTests.java:23:17:23:37 | getInputStream(...) | SAXReaderTests.java:23:17:23:37 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXReaderTests.java:23:17:23:37 | getInputStream(...) | user-provided value |
+| SAXReaderTests.java:30:17:30:37 | getInputStream(...) | SAXReaderTests.java:30:17:30:37 | getInputStream(...) | SAXReaderTests.java:30:17:30:37 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXReaderTests.java:30:17:30:37 | getInputStream(...) | user-provided value |
+| SAXReaderTests.java:37:17:37:37 | getInputStream(...) | SAXReaderTests.java:37:17:37:37 | getInputStream(...) | SAXReaderTests.java:37:17:37:37 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXReaderTests.java:37:17:37:37 | getInputStream(...) | user-provided value |
+| SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | user-provided value |
+| SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | user-provided value |
+| SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | user-provided value |
+| SAXSourceTests.java:20:18:20:23 | source | SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:20:18:20:23 | source | A $@ is parsed as XML without guarding against external entity expansion. | SAXSourceTests.java:17:62:17:82 | getInputStream(...) | user-provided value |
+| SchemaTests.java:12:39:12:77 | new StreamSource(...) | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | SchemaTests.java:12:56:12:76 | getInputStream(...) | user-provided value |
+| SchemaTests.java:25:39:25:77 | new StreamSource(...) | SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | SchemaTests.java:25:56:25:76 | getInputStream(...) | user-provided value |
+| SchemaTests.java:31:39:31:77 | new StreamSource(...) | SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | SchemaTests.java:31:56:31:76 | getInputStream(...) | user-provided value |
+| SchemaTests.java:38:39:38:77 | new StreamSource(...) | SchemaTests.java:38:56:38:76 | getInputStream(...) : InputStream | SchemaTests.java:38:39:38:77 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | SchemaTests.java:38:56:38:76 | getInputStream(...) | user-provided value |
+| SchemaTests.java:45:39:45:77 | new StreamSource(...) | SchemaTests.java:45:56:45:76 | getInputStream(...) : InputStream | SchemaTests.java:45:39:45:77 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | SchemaTests.java:45:56:45:76 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:14:41:14:61 | getInputStream(...) | SimpleXMLTests.java:14:41:14:61 | getInputStream(...) | SimpleXMLTests.java:14:41:14:61 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:14:41:14:61 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:19:41:19:61 | getInputStream(...) | SimpleXMLTests.java:19:41:19:61 | getInputStream(...) | SimpleXMLTests.java:19:41:19:61 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:19:41:19:61 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:24:41:24:84 | new InputStreamReader(...) | SimpleXMLTests.java:24:63:24:83 | getInputStream(...) : InputStream | SimpleXMLTests.java:24:41:24:84 | new InputStreamReader(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:24:63:24:83 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:31:41:31:53 | new String(...) | SimpleXMLTests.java:30:5:30:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:31:41:31:53 | new String(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:30:5:30:25 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:38:41:38:53 | new String(...) | SimpleXMLTests.java:37:5:37:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:38:41:38:53 | new String(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:37:5:37:25 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:43:41:43:84 | new InputStreamReader(...) | SimpleXMLTests.java:43:63:43:83 | getInputStream(...) : InputStream | SimpleXMLTests.java:43:41:43:84 | new InputStreamReader(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:43:63:43:83 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:48:37:48:57 | getInputStream(...) | SimpleXMLTests.java:48:37:48:57 | getInputStream(...) | SimpleXMLTests.java:48:37:48:57 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:48:37:48:57 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:53:37:53:57 | getInputStream(...) | SimpleXMLTests.java:53:37:53:57 | getInputStream(...) | SimpleXMLTests.java:53:37:53:57 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:53:37:53:57 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:58:26:58:46 | getInputStream(...) | SimpleXMLTests.java:58:26:58:46 | getInputStream(...) | SimpleXMLTests.java:58:26:58:46 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:58:26:58:46 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:63:26:63:46 | getInputStream(...) | SimpleXMLTests.java:63:26:63:46 | getInputStream(...) | SimpleXMLTests.java:63:26:63:46 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:63:26:63:46 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:68:37:68:80 | new InputStreamReader(...) | SimpleXMLTests.java:68:59:68:79 | getInputStream(...) : InputStream | SimpleXMLTests.java:68:37:68:80 | new InputStreamReader(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:68:59:68:79 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:73:37:73:80 | new InputStreamReader(...) | SimpleXMLTests.java:73:59:73:79 | getInputStream(...) : InputStream | SimpleXMLTests.java:73:37:73:80 | new InputStreamReader(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:73:59:73:79 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:78:26:78:69 | new InputStreamReader(...) | SimpleXMLTests.java:78:48:78:68 | getInputStream(...) : InputStream | SimpleXMLTests.java:78:26:78:69 | new InputStreamReader(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:78:48:78:68 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:83:26:83:69 | new InputStreamReader(...) | SimpleXMLTests.java:83:48:83:68 | getInputStream(...) : InputStream | SimpleXMLTests.java:83:26:83:69 | new InputStreamReader(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:83:48:83:68 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:90:37:90:49 | new String(...) | SimpleXMLTests.java:89:5:89:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:90:37:90:49 | new String(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:89:5:89:25 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:97:37:97:49 | new String(...) | SimpleXMLTests.java:96:5:96:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:97:37:97:49 | new String(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:96:5:96:25 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:104:26:104:38 | new String(...) | SimpleXMLTests.java:103:5:103:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:104:26:104:38 | new String(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:103:5:103:25 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:111:26:111:38 | new String(...) | SimpleXMLTests.java:110:5:110:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:111:26:111:38 | new String(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:110:5:110:25 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:115:22:115:42 | getInputStream(...) | SimpleXMLTests.java:115:22:115:42 | getInputStream(...) | SimpleXMLTests.java:115:22:115:42 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:115:22:115:42 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:119:22:119:65 | new InputStreamReader(...) | SimpleXMLTests.java:119:44:119:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:119:22:119:65 | new InputStreamReader(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:119:44:119:64 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:124:22:124:42 | getInputStream(...) | SimpleXMLTests.java:124:22:124:42 | getInputStream(...) | SimpleXMLTests.java:124:22:124:42 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:124:22:124:42 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:129:22:129:65 | new InputStreamReader(...) | SimpleXMLTests.java:129:44:129:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:129:22:129:65 | new InputStreamReader(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:129:44:129:64 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:134:22:134:42 | getInputStream(...) | SimpleXMLTests.java:134:22:134:42 | getInputStream(...) | SimpleXMLTests.java:134:22:134:42 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:134:22:134:42 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:139:22:139:65 | new InputStreamReader(...) | SimpleXMLTests.java:139:44:139:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:139:22:139:65 | new InputStreamReader(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:139:44:139:64 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:146:22:146:34 | new String(...) | SimpleXMLTests.java:145:5:145:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:146:22:146:34 | new String(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:145:5:145:25 | getInputStream(...) | user-provided value |
+| SimpleXMLTests.java:153:22:153:34 | new String(...) | SimpleXMLTests.java:152:5:152:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:153:22:153:34 | new String(...) | A $@ is parsed as XML without guarding against external entity expansion. | SimpleXMLTests.java:152:5:152:25 | getInputStream(...) | user-provided value |
+| TransformerTests.java:20:27:20:65 | new StreamSource(...) | TransformerTests.java:20:44:20:64 | getInputStream(...) : InputStream | TransformerTests.java:20:27:20:65 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:20:44:20:64 | getInputStream(...) | user-provided value |
+| TransformerTests.java:21:23:21:61 | new StreamSource(...) | TransformerTests.java:21:40:21:60 | getInputStream(...) : InputStream | TransformerTests.java:21:23:21:61 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:21:40:21:60 | getInputStream(...) | user-provided value |
+| TransformerTests.java:71:27:71:65 | new StreamSource(...) | TransformerTests.java:71:44:71:64 | getInputStream(...) : InputStream | TransformerTests.java:71:27:71:65 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:71:44:71:64 | getInputStream(...) | user-provided value |
+| TransformerTests.java:72:23:72:61 | new StreamSource(...) | TransformerTests.java:72:40:72:60 | getInputStream(...) : InputStream | TransformerTests.java:72:23:72:61 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:72:40:72:60 | getInputStream(...) | user-provided value |
+| TransformerTests.java:79:27:79:65 | new StreamSource(...) | TransformerTests.java:79:44:79:64 | getInputStream(...) : InputStream | TransformerTests.java:79:27:79:65 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:79:44:79:64 | getInputStream(...) | user-provided value |
+| TransformerTests.java:80:23:80:61 | new StreamSource(...) | TransformerTests.java:80:40:80:60 | getInputStream(...) : InputStream | TransformerTests.java:80:23:80:61 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:80:40:80:60 | getInputStream(...) | user-provided value |
+| TransformerTests.java:88:27:88:65 | new StreamSource(...) | TransformerTests.java:88:44:88:64 | getInputStream(...) : InputStream | TransformerTests.java:88:27:88:65 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:88:44:88:64 | getInputStream(...) | user-provided value |
+| TransformerTests.java:89:23:89:61 | new StreamSource(...) | TransformerTests.java:89:40:89:60 | getInputStream(...) : InputStream | TransformerTests.java:89:23:89:61 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:89:40:89:60 | getInputStream(...) | user-provided value |
+| TransformerTests.java:97:27:97:65 | new StreamSource(...) | TransformerTests.java:97:44:97:64 | getInputStream(...) : InputStream | TransformerTests.java:97:27:97:65 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:97:44:97:64 | getInputStream(...) | user-provided value |
+| TransformerTests.java:98:23:98:61 | new StreamSource(...) | TransformerTests.java:98:40:98:60 | getInputStream(...) : InputStream | TransformerTests.java:98:23:98:61 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:98:40:98:60 | getInputStream(...) | user-provided value |
+| TransformerTests.java:103:21:103:59 | new StreamSource(...) | TransformerTests.java:103:38:103:58 | getInputStream(...) : InputStream | TransformerTests.java:103:21:103:59 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:103:38:103:58 | getInputStream(...) | user-provided value |
+| TransformerTests.java:116:21:116:59 | new StreamSource(...) | TransformerTests.java:116:38:116:58 | getInputStream(...) : InputStream | TransformerTests.java:116:21:116:59 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:116:38:116:58 | getInputStream(...) | user-provided value |
+| TransformerTests.java:122:21:122:59 | new StreamSource(...) | TransformerTests.java:122:38:122:58 | getInputStream(...) : InputStream | TransformerTests.java:122:21:122:59 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:122:38:122:58 | getInputStream(...) | user-provided value |
+| TransformerTests.java:129:21:129:59 | new StreamSource(...) | TransformerTests.java:129:38:129:58 | getInputStream(...) : InputStream | TransformerTests.java:129:21:129:59 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:129:38:129:58 | getInputStream(...) | user-provided value |
+| TransformerTests.java:136:21:136:59 | new StreamSource(...) | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | TransformerTests.java:136:21:136:59 | new StreamSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:136:38:136:58 | getInputStream(...) | user-provided value |
+| TransformerTests.java:141:18:141:70 | new SAXSource(...) | TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | TransformerTests.java:141:18:141:70 | new SAXSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | TransformerTests.java:141:48:141:68 | getInputStream(...) | user-provided value |
+| UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | user-provided value |
+| XMLReaderTests.java:16:18:16:55 | new InputSource(...) | XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | XMLReaderTests.java:16:34:16:54 | getInputStream(...) | user-provided value |
+| XMLReaderTests.java:56:18:56:55 | new InputSource(...) | XMLReaderTests.java:56:34:56:54 | getInputStream(...) : InputStream | XMLReaderTests.java:56:18:56:55 | new InputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | XMLReaderTests.java:56:34:56:54 | getInputStream(...) | user-provided value |
+| XMLReaderTests.java:63:18:63:55 | new InputSource(...) | XMLReaderTests.java:63:34:63:54 | getInputStream(...) : InputStream | XMLReaderTests.java:63:18:63:55 | new InputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | XMLReaderTests.java:63:34:63:54 | getInputStream(...) | user-provided value |
+| XMLReaderTests.java:70:18:70:55 | new InputSource(...) | XMLReaderTests.java:70:34:70:54 | getInputStream(...) : InputStream | XMLReaderTests.java:70:18:70:55 | new InputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | XMLReaderTests.java:70:34:70:54 | getInputStream(...) | user-provided value |
+| XMLReaderTests.java:78:18:78:55 | new InputSource(...) | XMLReaderTests.java:78:34:78:54 | getInputStream(...) : InputStream | XMLReaderTests.java:78:18:78:55 | new InputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | XMLReaderTests.java:78:34:78:54 | getInputStream(...) | user-provided value |
+| XMLReaderTests.java:86:18:86:55 | new InputSource(...) | XMLReaderTests.java:86:34:86:54 | getInputStream(...) : InputStream | XMLReaderTests.java:86:18:86:55 | new InputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | XMLReaderTests.java:86:34:86:54 | getInputStream(...) | user-provided value |
+| XMLReaderTests.java:94:18:94:55 | new InputSource(...) | XMLReaderTests.java:94:34:94:54 | getInputStream(...) : InputStream | XMLReaderTests.java:94:18:94:55 | new InputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | XMLReaderTests.java:94:34:94:54 | getInputStream(...) | user-provided value |
+| XMLReaderTests.java:100:18:100:55 | new InputSource(...) | XMLReaderTests.java:100:34:100:54 | getInputStream(...) : InputStream | XMLReaderTests.java:100:18:100:55 | new InputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | XMLReaderTests.java:100:34:100:54 | getInputStream(...) | user-provided value |
+| XPathExpressionTests.java:27:21:27:58 | new InputSource(...) | XPathExpressionTests.java:27:37:27:57 | getInputStream(...) : InputStream | XPathExpressionTests.java:27:21:27:58 | new InputSource(...) | A $@ is parsed as XML without guarding against external entity expansion. | XPathExpressionTests.java:27:37:27:57 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:9:35:9:55 | getInputStream(...) | XmlInputFactoryTests.java:9:35:9:55 | getInputStream(...) | XmlInputFactoryTests.java:9:35:9:55 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:9:35:9:55 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:10:34:10:54 | getInputStream(...) | XmlInputFactoryTests.java:10:34:10:54 | getInputStream(...) | XmlInputFactoryTests.java:10:34:10:54 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:10:34:10:54 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:24:35:24:55 | getInputStream(...) | XmlInputFactoryTests.java:24:35:24:55 | getInputStream(...) | XmlInputFactoryTests.java:24:35:24:55 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:24:35:24:55 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:25:34:25:54 | getInputStream(...) | XmlInputFactoryTests.java:25:34:25:54 | getInputStream(...) | XmlInputFactoryTests.java:25:34:25:54 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:25:34:25:54 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:31:35:31:55 | getInputStream(...) | XmlInputFactoryTests.java:31:35:31:55 | getInputStream(...) | XmlInputFactoryTests.java:31:35:31:55 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:31:35:31:55 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:32:34:32:54 | getInputStream(...) | XmlInputFactoryTests.java:32:34:32:54 | getInputStream(...) | XmlInputFactoryTests.java:32:34:32:54 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:32:34:32:54 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:39:35:39:55 | getInputStream(...) | XmlInputFactoryTests.java:39:35:39:55 | getInputStream(...) | XmlInputFactoryTests.java:39:35:39:55 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:39:35:39:55 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:40:34:40:54 | getInputStream(...) | XmlInputFactoryTests.java:40:34:40:54 | getInputStream(...) | XmlInputFactoryTests.java:40:34:40:54 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:40:34:40:54 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:47:35:47:55 | getInputStream(...) | XmlInputFactoryTests.java:47:35:47:55 | getInputStream(...) | XmlInputFactoryTests.java:47:35:47:55 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:47:35:47:55 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:48:34:48:54 | getInputStream(...) | XmlInputFactoryTests.java:48:34:48:54 | getInputStream(...) | XmlInputFactoryTests.java:48:34:48:54 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:48:34:48:54 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:55:35:55:55 | getInputStream(...) | XmlInputFactoryTests.java:55:35:55:55 | getInputStream(...) | XmlInputFactoryTests.java:55:35:55:55 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:55:35:55:55 | getInputStream(...) | user-provided value |
+| XmlInputFactoryTests.java:56:34:56:54 | getInputStream(...) | XmlInputFactoryTests.java:56:34:56:54 | getInputStream(...) | XmlInputFactoryTests.java:56:34:56:54 | getInputStream(...) | A $@ is parsed as XML without guarding against external entity expansion. | XmlInputFactoryTests.java:56:34:56:54 | getInputStream(...) | user-provided value |
diff --git a/java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.java b/java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.java
index 5ff375cdd16..9c8f098d467 100644
--- a/java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.java
+++ b/java/ql/test/query-tests/security/CWE-927/ImplicitPendingIntentsTest.java
@@ -2,6 +2,7 @@ package com.example.test;
 
 import java.io.FileNotFoundException;
 import android.app.Activity;
+import android.app.AlarmManager;
 import android.app.Notification;
 import android.app.NotificationManager;
 import android.app.PendingIntent;
@@ -13,6 +14,8 @@ import android.net.Uri;
 import android.os.Bundle;
 import android.os.CancellationSignal;
 import android.os.RemoteException;
+import androidx.core.app.AlarmManagerCompat;
+import androidx.core.app.NotificationManagerCompat;
 import androidx.core.graphics.drawable.IconCompat;
 import androidx.slice.Slice;
 import androidx.slice.SliceProvider;
@@ -181,7 +184,7 @@ public class ImplicitPendingIntentsTest {
             Notification.Builder nBuilder =
                     new Notification.Builder(ctx).addAction(aBuilder.build());
             Notification notification = nBuilder.build();
-            NotificationManager nManager = new NotificationManager();
+            NotificationManager nManager = null;
             nManager.notifyAsPackage("targetPackage", "tag", 0, notification); // $hasImplicitPendingIntent
             nManager.notify(0, notification); // $hasImplicitPendingIntent
             nManager.notifyAsUser("", 0, notification, null); // $hasImplicitPendingIntent
@@ -194,7 +197,7 @@ public class ImplicitPendingIntentsTest {
             Notification.Builder nBuilder =
                     new Notification.Builder(ctx).addAction(aBuilder.build());
             Notification notification = nBuilder.build();
-            NotificationManager nManager = new NotificationManager();
+            NotificationManager nManager = null;
             nManager.notify(0, notification); // Safe
         }
         {
@@ -211,10 +214,53 @@ public class ImplicitPendingIntentsTest {
             Notification.Action action = new Notification.Action(0, "", pi2);
             Notification.Builder nBuilder = new Notification.Builder(ctx).addAction(action);
             Notification notification = nBuilder.build();
-            NotificationManager noMan = new NotificationManager();
+            NotificationManager noMan = null;
             noMan.notify(0, notification); // Safe
         }
+        // Compat sinks
+        {
+            Intent baseIntent = new Intent();
+            PendingIntent pi = PendingIntent.getActivity(ctx, 0, baseIntent, 0);
+            Notification.Action.Builder aBuilder = new Notification.Action.Builder(0, "", pi);
+            Notification.Builder nBuilder =
+                    new Notification.Builder(ctx).addAction(aBuilder.build());
+            Notification notification = nBuilder.build();
+            NotificationManagerCompat nManager = null;
+            nManager.notify(0, notification); // $hasImplicitPendingIntent
+            nManager.notify("", 0, notification); // $hasImplicitPendingIntent
+        }
+    }
 
+    public static void testPendingIntentInAnAlarm(Context ctx) {
+        AlarmManager aManager = (AlarmManager) ctx.getSystemService(Context.ALARM_SERVICE);
+        {
+            Intent baseIntent = new Intent();
+            PendingIntent pi = PendingIntent.getActivity(ctx, 0, baseIntent, 0);
+            aManager.set(0, 0, pi); // $hasImplicitPendingIntent
+            aManager.setAlarmClock(null, pi); // $hasImplicitPendingIntent
+            aManager.setAndAllowWhileIdle(0, 0, pi); // $hasImplicitPendingIntent
+            aManager.setExact(0, 0, pi); // $hasImplicitPendingIntent
+            aManager.setExactAndAllowWhileIdle(0, 0, pi); // $hasImplicitPendingIntent
+            aManager.setInexactRepeating(0, 0, 0, pi); // $hasImplicitPendingIntent
+            aManager.setRepeating(0, 0, 0, pi); // $hasImplicitPendingIntent
+            aManager.setWindow(0, 0, 0, pi); // $hasImplicitPendingIntent
+        }
+        {
+            Intent baseIntent = new Intent();
+            PendingIntent pi =
+                    PendingIntent.getActivity(ctx, 0, baseIntent, PendingIntent.FLAG_IMMUTABLE); // Sanitizer
+            aManager.set(0, 0, pi); // Safe
+        }
+        // Compat sinks
+        {
+            Intent baseIntent = new Intent();
+            PendingIntent pi = PendingIntent.getActivity(ctx, 0, baseIntent, 0);
+            AlarmManagerCompat.setAlarmClock(aManager, 0, pi, null); // $hasImplicitPendingIntent
+            AlarmManagerCompat.setAlarmClock(aManager, 0, null, pi); // $hasImplicitPendingIntent
+            AlarmManagerCompat.setAndAllowWhileIdle(aManager, 0, 0, pi); // $hasImplicitPendingIntent
+            AlarmManagerCompat.setExact(aManager, 0, 0, pi); // $hasImplicitPendingIntent
+            AlarmManagerCompat.setExactAndAllowWhileIdle(aManager, 0, 0, pi); // $hasImplicitPendingIntent
+        }
     }
 
     static class TestActivity extends Activity {
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/CacheStorage.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/CacheStorage.java
new file mode 100644
index 00000000000..b654a411c48
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/CacheStorage.java
@@ -0,0 +1,12 @@
+// Generated automatically from freemarker.cache.CacheStorage for testing purposes
+
+package freemarker.cache;
+
+
+public interface CacheStorage
+{
+    Object get(Object p0);
+    void clear();
+    void put(Object p0, Object p1);
+    void remove(Object p0);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/StringTemplateLoader.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/StringTemplateLoader.java
new file mode 100644
index 00000000000..524b2d07621
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/StringTemplateLoader.java
@@ -0,0 +1,19 @@
+// Generated automatically from freemarker.cache.StringTemplateLoader for testing purposes
+
+package freemarker.cache;
+
+import freemarker.cache.TemplateLoader;
+import java.io.Reader;
+
+public class StringTemplateLoader implements TemplateLoader
+{
+    public Object findTemplateSource(String p0){ return null; }
+    public Reader getReader(Object p0, String p1){ return null; }
+    public String toString(){ return null; }
+    public StringTemplateLoader(){}
+    public boolean removeTemplate(String p0){ return false; }
+    public long getLastModified(Object p0){ return 0; }
+    public void closeTemplateSource(Object p0){}
+    public void putTemplate(String p0, String p1){}
+    public void putTemplate(String p0, String p1, long p2){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateConfigurationFactory.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateConfigurationFactory.java
new file mode 100644
index 00000000000..c61f916b8f1
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateConfigurationFactory.java
@@ -0,0 +1,15 @@
+// Generated automatically from freemarker.cache.TemplateConfigurationFactory for testing purposes
+
+package freemarker.cache;
+
+import freemarker.core.TemplateConfiguration;
+import freemarker.template.Configuration;
+
+abstract public class TemplateConfigurationFactory
+{
+    protected abstract void setConfigurationOfChildren(Configuration p0);
+    public Configuration getConfiguration(){ return null; }
+    public TemplateConfigurationFactory(){}
+    public abstract TemplateConfiguration get(String p0, Object p1);
+    public final void setConfiguration(Configuration p0){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLoader.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLoader.java
new file mode 100644
index 00000000000..a301fa50a89
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLoader.java
@@ -0,0 +1,13 @@
+// Generated automatically from freemarker.cache.TemplateLoader for testing purposes
+
+package freemarker.cache;
+
+import java.io.Reader;
+
+public interface TemplateLoader
+{
+    Object findTemplateSource(String p0);
+    Reader getReader(Object p0, String p1);
+    long getLastModified(Object p0);
+    void closeTemplateSource(Object p0);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLookupContext.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLookupContext.java
new file mode 100644
index 00000000000..42e29d77cf2
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLookupContext.java
@@ -0,0 +1,17 @@
+// Generated automatically from freemarker.cache.TemplateLookupContext for testing purposes
+
+package freemarker.cache;
+
+import freemarker.cache.TemplateLookupResult;
+import java.util.Locale;
+
+abstract public class TemplateLookupContext
+{
+    protected TemplateLookupContext() {}
+    public Locale getTemplateLocale(){ return null; }
+    public Object getCustomLookupCondition(){ return null; }
+    public String getTemplateName(){ return null; }
+    public TemplateLookupResult createNegativeLookupResult(){ return null; }
+    public abstract TemplateLookupResult lookupWithAcquisitionStrategy(String p0);
+    public abstract TemplateLookupResult lookupWithLocalizedThenAcquisitionStrategy(String p0, Locale p1);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLookupResult.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLookupResult.java
new file mode 100644
index 00000000000..1ed7bd94dbe
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLookupResult.java
@@ -0,0 +1,11 @@
+// Generated automatically from freemarker.cache.TemplateLookupResult for testing purposes
+
+package freemarker.cache;
+
+
+abstract public class TemplateLookupResult
+{
+    protected TemplateLookupResult() {}
+    public abstract String getTemplateSourceName();
+    public abstract boolean isPositive();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLookupStrategy.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLookupStrategy.java
new file mode 100644
index 00000000000..ef365997e57
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateLookupStrategy.java
@@ -0,0 +1,13 @@
+// Generated automatically from freemarker.cache.TemplateLookupStrategy for testing purposes
+
+package freemarker.cache;
+
+import freemarker.cache.TemplateLookupContext;
+import freemarker.cache.TemplateLookupResult;
+
+abstract public class TemplateLookupStrategy
+{
+    public TemplateLookupStrategy(){}
+    public abstract TemplateLookupResult lookup(TemplateLookupContext p0);
+    public static TemplateLookupStrategy DEFAULT_2_3_0 = null;
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateNameFormat.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateNameFormat.java
new file mode 100644
index 00000000000..78682aee7ec
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/cache/TemplateNameFormat.java
@@ -0,0 +1,11 @@
+// Generated automatically from freemarker.cache.TemplateNameFormat for testing purposes
+
+package freemarker.cache;
+
+
+abstract public class TemplateNameFormat
+{
+    protected TemplateNameFormat() {}
+    public static TemplateNameFormat DEFAULT_2_3_0 = null;
+    public static TemplateNameFormat DEFAULT_2_4_0 = null;
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/ArithmeticEngine.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/ArithmeticEngine.java
new file mode 100644
index 00000000000..34f0d04115e
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/ArithmeticEngine.java
@@ -0,0 +1,46 @@
+// Generated automatically from freemarker.core.ArithmeticEngine for testing purposes
+
+package freemarker.core;
+
+
+abstract public class ArithmeticEngine
+{
+    protected int maxScale = 0;
+    protected int minScale = 0;
+    protected int roundingPolicy = 0;
+    public ArithmeticEngine(){}
+    public abstract Number add(Number p0, Number p1);
+    public abstract Number divide(Number p0, Number p1);
+    public abstract Number modulus(Number p0, Number p1);
+    public abstract Number multiply(Number p0, Number p1);
+    public abstract Number subtract(Number p0, Number p1);
+    public abstract Number toNumber(String p0);
+    public abstract int compareNumbers(Number p0, Number p1);
+    public static ArithmeticEngine.BigDecimalEngine BIGDECIMAL_ENGINE = null;
+    public static ArithmeticEngine.ConservativeEngine CONSERVATIVE_ENGINE = null;
+    public void setMaxScale(int p0){}
+    public void setMinScale(int p0){}
+    public void setRoundingPolicy(int p0){}
+    static public class BigDecimalEngine extends ArithmeticEngine
+    {
+        public BigDecimalEngine(){}
+        public Number add(Number p0, Number p1){ return null; }
+        public Number divide(Number p0, Number p1){ return null; }
+        public Number modulus(Number p0, Number p1){ return null; }
+        public Number multiply(Number p0, Number p1){ return null; }
+        public Number subtract(Number p0, Number p1){ return null; }
+        public Number toNumber(String p0){ return null; }
+        public int compareNumbers(Number p0, Number p1){ return 0; }
+    }
+    static public class ConservativeEngine extends ArithmeticEngine
+    {
+        public ConservativeEngine(){}
+        public Number add(Number p0, Number p1){ return null; }
+        public Number divide(Number p0, Number p1){ return null; }
+        public Number modulus(Number p0, Number p1){ return null; }
+        public Number multiply(Number p0, Number p1){ return null; }
+        public Number subtract(Number p0, Number p1){ return null; }
+        public Number toNumber(String p0){ return null; }
+        public int compareNumbers(Number p0, Number p1){ return 0; }
+    }
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Configurable.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Configurable.java
new file mode 100644
index 00000000000..f92fd4bd038
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Configurable.java
@@ -0,0 +1,238 @@
+// Generated automatically from freemarker.core.Configurable for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.ArithmeticEngine;
+import freemarker.core.Environment;
+import freemarker.core.TemplateClassResolver;
+import freemarker.core.TemplateDateFormatFactory;
+import freemarker.core.TemplateNumberFormatFactory;
+import freemarker.core.TruncateBuiltinAlgorithm;
+import freemarker.template.AttemptExceptionReporter;
+import freemarker.template.ObjectWrapper;
+import freemarker.template.TemplateException;
+import freemarker.template.TemplateExceptionHandler;
+import freemarker.template.Version;
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Properties;
+import java.util.Set;
+import java.util.TimeZone;
+
+public class Configurable
+{
+    protected ArrayList parseAsList(String p0){ return null; }
+    protected ArrayList parseAsSegmentedList(String p0){ return null; }
+    protected Configurable(Version p0){}
+    protected Environment getEnvironment(){ return null; }
+    protected HashMap parseAsImportList(String p0){ return null; }
+    protected Object clone(){ return null; }
+    protected String getCorrectedNameForUnknownSetting(String p0){ return null; }
+    protected TemplateException invalidSettingValueException(String p0, String p1){ return null; }
+    protected TemplateException settingValueAssignmentException(String p0, String p1, Throwable p2){ return null; }
+    protected TemplateException unknownSettingException(String p0){ return null; }
+    protected void doAutoImportsAndIncludes(Environment p0){}
+    public ArithmeticEngine getArithmeticEngine(){ return null; }
+    public AttemptExceptionReporter getAttemptExceptionReporter(){ return null; }
+    public Boolean getLazyAutoImports(){ return null; }
+    public Configurable(){}
+    public Configurable(Configurable p0){}
+    public List<String> getAutoIncludes(){ return null; }
+    public List<String> getAutoIncludesWithoutFallback(){ return null; }
+    public Locale getLocale(){ return null; }
+    public Map getSettings(){ return null; }
+    public Map<String, ? extends TemplateDateFormatFactory> getCustomDateFormats(){ return null; }
+    public Map<String, ? extends TemplateDateFormatFactory> getCustomDateFormatsWithoutFallback(){ return null; }
+    public Map<String, ? extends TemplateNumberFormatFactory> getCustomNumberFormats(){ return null; }
+    public Map<String, ? extends TemplateNumberFormatFactory> getCustomNumberFormatsWithoutFallback(){ return null; }
+    public Map<String, String> getAutoImports(){ return null; }
+    public Map<String, String> getAutoImportsWithoutFallback(){ return null; }
+    public Object getCustomAttribute(String p0){ return null; }
+    public ObjectWrapper getObjectWrapper(){ return null; }
+    public Set<String> getSettingNames(boolean p0){ return null; }
+    public String getBooleanFormat(){ return null; }
+    public String getDateFormat(){ return null; }
+    public String getDateTimeFormat(){ return null; }
+    public String getNumberFormat(){ return null; }
+    public String getOutputEncoding(){ return null; }
+    public String getSetting(String p0){ return null; }
+    public String getTimeFormat(){ return null; }
+    public String getURLEscapingCharset(){ return null; }
+    public String[] getCustomAttributeNames(){ return null; }
+    public TemplateClassResolver getNewBuiltinClassResolver(){ return null; }
+    public TemplateDateFormatFactory getCustomDateFormat(String p0){ return null; }
+    public TemplateExceptionHandler getTemplateExceptionHandler(){ return null; }
+    public TemplateNumberFormatFactory getCustomNumberFormat(String p0){ return null; }
+    public TimeZone getSQLDateAndTimeTimeZone(){ return null; }
+    public TimeZone getTimeZone(){ return null; }
+    public TruncateBuiltinAlgorithm getTruncateBuiltinAlgorithm(){ return null; }
+    public boolean getAutoFlush(){ return false; }
+    public boolean getLazyImports(){ return false; }
+    public boolean getLogTemplateExceptions(){ return false; }
+    public boolean getShowErrorTips(){ return false; }
+    public boolean getWrapUncheckedExceptions(){ return false; }
+    public boolean hasCustomFormats(){ return false; }
+    public boolean isAPIBuiltinEnabled(){ return false; }
+    public boolean isAPIBuiltinEnabledSet(){ return false; }
+    public boolean isArithmeticEngineSet(){ return false; }
+    public boolean isAttemptExceptionReporterSet(){ return false; }
+    public boolean isAutoFlushSet(){ return false; }
+    public boolean isAutoImportsSet(){ return false; }
+    public boolean isAutoIncludesSet(){ return false; }
+    public boolean isBooleanFormatSet(){ return false; }
+    public boolean isClassicCompatible(){ return false; }
+    public boolean isClassicCompatibleSet(){ return false; }
+    public boolean isCustomDateFormatsSet(){ return false; }
+    public boolean isCustomNumberFormatsSet(){ return false; }
+    public boolean isDateFormatSet(){ return false; }
+    public boolean isDateTimeFormatSet(){ return false; }
+    public boolean isLazyAutoImportsSet(){ return false; }
+    public boolean isLazyImportsSet(){ return false; }
+    public boolean isLocaleSet(){ return false; }
+    public boolean isLogTemplateExceptionsSet(){ return false; }
+    public boolean isNewBuiltinClassResolverSet(){ return false; }
+    public boolean isNumberFormatSet(){ return false; }
+    public boolean isObjectWrapperSet(){ return false; }
+    public boolean isOutputEncodingSet(){ return false; }
+    public boolean isSQLDateAndTimeTimeZoneSet(){ return false; }
+    public boolean isShowErrorTipsSet(){ return false; }
+    public boolean isTemplateExceptionHandlerSet(){ return false; }
+    public boolean isTimeFormatSet(){ return false; }
+    public boolean isTimeZoneSet(){ return false; }
+    public boolean isTruncateBuiltinAlgorithmSet(){ return false; }
+    public boolean isURLEscapingCharsetSet(){ return false; }
+    public boolean isWrapUncheckedExceptionsSet(){ return false; }
+    public final Configurable getParent(){ return null; }
+    public int getClassicCompatibleAsInt(){ return 0; }
+    public static String API_BUILTIN_ENABLED_KEY = null;
+    public static String API_BUILTIN_ENABLED_KEY_CAMEL_CASE = null;
+    public static String API_BUILTIN_ENABLED_KEY_SNAKE_CASE = null;
+    public static String ARITHMETIC_ENGINE_KEY = null;
+    public static String ARITHMETIC_ENGINE_KEY_CAMEL_CASE = null;
+    public static String ARITHMETIC_ENGINE_KEY_SNAKE_CASE = null;
+    public static String ATTEMPT_EXCEPTION_REPORTER_KEY = null;
+    public static String ATTEMPT_EXCEPTION_REPORTER_KEY_CAMEL_CASE = null;
+    public static String ATTEMPT_EXCEPTION_REPORTER_KEY_SNAKE_CASE = null;
+    public static String AUTO_FLUSH_KEY = null;
+    public static String AUTO_FLUSH_KEY_CAMEL_CASE = null;
+    public static String AUTO_FLUSH_KEY_SNAKE_CASE = null;
+    public static String AUTO_IMPORT_KEY = null;
+    public static String AUTO_IMPORT_KEY_CAMEL_CASE = null;
+    public static String AUTO_IMPORT_KEY_SNAKE_CASE = null;
+    public static String AUTO_INCLUDE_KEY = null;
+    public static String AUTO_INCLUDE_KEY_CAMEL_CASE = null;
+    public static String AUTO_INCLUDE_KEY_SNAKE_CASE = null;
+    public static String BOOLEAN_FORMAT_KEY = null;
+    public static String BOOLEAN_FORMAT_KEY_CAMEL_CASE = null;
+    public static String BOOLEAN_FORMAT_KEY_SNAKE_CASE = null;
+    public static String CLASSIC_COMPATIBLE_KEY = null;
+    public static String CLASSIC_COMPATIBLE_KEY_CAMEL_CASE = null;
+    public static String CLASSIC_COMPATIBLE_KEY_SNAKE_CASE = null;
+    public static String CUSTOM_DATE_FORMATS_KEY = null;
+    public static String CUSTOM_DATE_FORMATS_KEY_CAMEL_CASE = null;
+    public static String CUSTOM_DATE_FORMATS_KEY_SNAKE_CASE = null;
+    public static String CUSTOM_NUMBER_FORMATS_KEY = null;
+    public static String CUSTOM_NUMBER_FORMATS_KEY_CAMEL_CASE = null;
+    public static String CUSTOM_NUMBER_FORMATS_KEY_SNAKE_CASE = null;
+    public static String DATETIME_FORMAT_KEY = null;
+    public static String DATETIME_FORMAT_KEY_CAMEL_CASE = null;
+    public static String DATETIME_FORMAT_KEY_SNAKE_CASE = null;
+    public static String DATE_FORMAT_KEY = null;
+    public static String DATE_FORMAT_KEY_CAMEL_CASE = null;
+    public static String DATE_FORMAT_KEY_SNAKE_CASE = null;
+    public static String LAZY_AUTO_IMPORTS_KEY = null;
+    public static String LAZY_AUTO_IMPORTS_KEY_CAMEL_CASE = null;
+    public static String LAZY_AUTO_IMPORTS_KEY_SNAKE_CASE = null;
+    public static String LAZY_IMPORTS_KEY = null;
+    public static String LAZY_IMPORTS_KEY_CAMEL_CASE = null;
+    public static String LAZY_IMPORTS_KEY_SNAKE_CASE = null;
+    public static String LOCALE_KEY = null;
+    public static String LOCALE_KEY_CAMEL_CASE = null;
+    public static String LOCALE_KEY_SNAKE_CASE = null;
+    public static String LOG_TEMPLATE_EXCEPTIONS_KEY = null;
+    public static String LOG_TEMPLATE_EXCEPTIONS_KEY_CAMEL_CASE = null;
+    public static String LOG_TEMPLATE_EXCEPTIONS_KEY_SNAKE_CASE = null;
+    public static String NEW_BUILTIN_CLASS_RESOLVER_KEY = null;
+    public static String NEW_BUILTIN_CLASS_RESOLVER_KEY_CAMEL_CASE = null;
+    public static String NEW_BUILTIN_CLASS_RESOLVER_KEY_SNAKE_CASE = null;
+    public static String NUMBER_FORMAT_KEY = null;
+    public static String NUMBER_FORMAT_KEY_CAMEL_CASE = null;
+    public static String NUMBER_FORMAT_KEY_SNAKE_CASE = null;
+    public static String OBJECT_WRAPPER_KEY = null;
+    public static String OBJECT_WRAPPER_KEY_CAMEL_CASE = null;
+    public static String OBJECT_WRAPPER_KEY_SNAKE_CASE = null;
+    public static String OUTPUT_ENCODING_KEY = null;
+    public static String OUTPUT_ENCODING_KEY_CAMEL_CASE = null;
+    public static String OUTPUT_ENCODING_KEY_SNAKE_CASE = null;
+    public static String SHOW_ERROR_TIPS_KEY = null;
+    public static String SHOW_ERROR_TIPS_KEY_CAMEL_CASE = null;
+    public static String SHOW_ERROR_TIPS_KEY_SNAKE_CASE = null;
+    public static String SQL_DATE_AND_TIME_TIME_ZONE_KEY = null;
+    public static String SQL_DATE_AND_TIME_TIME_ZONE_KEY_CAMEL_CASE = null;
+    public static String SQL_DATE_AND_TIME_TIME_ZONE_KEY_SNAKE_CASE = null;
+    public static String STRICT_BEAN_MODELS = null;
+    public static String STRICT_BEAN_MODELS_KEY = null;
+    public static String STRICT_BEAN_MODELS_KEY_CAMEL_CASE = null;
+    public static String STRICT_BEAN_MODELS_KEY_SNAKE_CASE = null;
+    public static String TEMPLATE_EXCEPTION_HANDLER_KEY = null;
+    public static String TEMPLATE_EXCEPTION_HANDLER_KEY_CAMEL_CASE = null;
+    public static String TEMPLATE_EXCEPTION_HANDLER_KEY_SNAKE_CASE = null;
+    public static String TIME_FORMAT_KEY = null;
+    public static String TIME_FORMAT_KEY_CAMEL_CASE = null;
+    public static String TIME_FORMAT_KEY_SNAKE_CASE = null;
+    public static String TIME_ZONE_KEY = null;
+    public static String TIME_ZONE_KEY_CAMEL_CASE = null;
+    public static String TIME_ZONE_KEY_SNAKE_CASE = null;
+    public static String TRUNCATE_BUILTIN_ALGORITHM_KEY = null;
+    public static String TRUNCATE_BUILTIN_ALGORITHM_KEY_CAMEL_CASE = null;
+    public static String TRUNCATE_BUILTIN_ALGORITHM_KEY_SNAKE_CASE = null;
+    public static String URL_ESCAPING_CHARSET_KEY = null;
+    public static String URL_ESCAPING_CHARSET_KEY_CAMEL_CASE = null;
+    public static String URL_ESCAPING_CHARSET_KEY_SNAKE_CASE = null;
+    public static String WRAP_UNCHECKED_EXCEPTIONS_KEY = null;
+    public static String WRAP_UNCHECKED_EXCEPTIONS_KEY_CAMEL_CASE = null;
+    public static String WRAP_UNCHECKED_EXCEPTIONS_KEY_SNAKE_CASE = null;
+    public void addAutoImport(String p0, String p1){}
+    public void addAutoInclude(String p0){}
+    public void removeAutoImport(String p0){}
+    public void removeAutoInclude(String p0){}
+    public void removeCustomAttribute(String p0){}
+    public void setAPIBuiltinEnabled(boolean p0){}
+    public void setArithmeticEngine(ArithmeticEngine p0){}
+    public void setAttemptExceptionReporter(AttemptExceptionReporter p0){}
+    public void setAutoFlush(boolean p0){}
+    public void setAutoImports(Map p0){}
+    public void setAutoIncludes(List p0){}
+    public void setBooleanFormat(String p0){}
+    public void setClassicCompatible(boolean p0){}
+    public void setClassicCompatibleAsInt(int p0){}
+    public void setCustomAttribute(String p0, Object p1){}
+    public void setCustomDateFormats(Map<String, ? extends TemplateDateFormatFactory> p0){}
+    public void setCustomNumberFormats(Map<String, ? extends TemplateNumberFormatFactory> p0){}
+    public void setDateFormat(String p0){}
+    public void setDateTimeFormat(String p0){}
+    public void setLazyAutoImports(Boolean p0){}
+    public void setLazyImports(boolean p0){}
+    public void setLocale(Locale p0){}
+    public void setLogTemplateExceptions(boolean p0){}
+    public void setNewBuiltinClassResolver(TemplateClassResolver p0){}
+    public void setNumberFormat(String p0){}
+    public void setObjectWrapper(ObjectWrapper p0){}
+    public void setOutputEncoding(String p0){}
+    public void setSQLDateAndTimeTimeZone(TimeZone p0){}
+    public void setSetting(String p0, String p1){}
+    public void setSettings(InputStream p0){}
+    public void setSettings(Properties p0){}
+    public void setShowErrorTips(boolean p0){}
+    public void setStrictBeanModels(boolean p0){}
+    public void setTemplateExceptionHandler(TemplateExceptionHandler p0){}
+    public void setTimeFormat(String p0){}
+    public void setTimeZone(TimeZone p0){}
+    public void setTruncateBuiltinAlgorithm(TruncateBuiltinAlgorithm p0){}
+    public void setURLEscapingCharset(String p0){}
+    public void setWrapUncheckedExceptions(boolean p0){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/DirectiveCallPlace.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/DirectiveCallPlace.java
new file mode 100644
index 00000000000..12546f43f7b
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/DirectiveCallPlace.java
@@ -0,0 +1,17 @@
+// Generated automatically from freemarker.core.DirectiveCallPlace for testing purposes
+
+package freemarker.core;
+
+import freemarker.template.Template;
+import freemarker.template.utility.ObjectFactory;
+
+public interface DirectiveCallPlace
+{
+    Object getOrCreateCustomData(Object p0, ObjectFactory p1);
+    Template getTemplate();
+    boolean isNestedOutputCacheable();
+    int getBeginColumn();
+    int getBeginLine();
+    int getEndColumn();
+    int getEndLine();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Environment.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Environment.java
new file mode 100644
index 00000000000..0ba487d9484
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Environment.java
@@ -0,0 +1,106 @@
+// Generated automatically from freemarker.core.Environment for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.Configurable;
+import freemarker.core.DirectiveCallPlace;
+import freemarker.core.TemplateDateFormat;
+import freemarker.core.TemplateElement;
+import freemarker.core.TemplateNumberFormat;
+import freemarker.template.Configuration;
+import freemarker.template.SimpleHash;
+import freemarker.template.Template;
+import freemarker.template.TemplateDirectiveModel;
+import freemarker.template.TemplateExceptionHandler;
+import freemarker.template.TemplateHashModel;
+import freemarker.template.TemplateModel;
+import freemarker.template.TemplateNodeModel;
+import java.io.PrintWriter;
+import java.io.Writer;
+import java.text.NumberFormat;
+import java.util.Date;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.TimeZone;
+
+public class Environment extends Configurable
+{
+    protected Environment() {}
+    public Configuration getConfiguration(){ return null; }
+    public DirectiveCallPlace getCurrentDirectiveCallPlace(){ return null; }
+    public Environment(Template p0, TemplateHashModel p1, Writer p2){}
+    public Environment.Namespace getCurrentNamespace(){ return null; }
+    public Environment.Namespace getGlobalNamespace(){ return null; }
+    public Environment.Namespace getMainNamespace(){ return null; }
+    public Environment.Namespace getNamespace(String p0){ return null; }
+    public Environment.Namespace importLib(String p0, String p1){ return null; }
+    public Environment.Namespace importLib(String p0, String p1, boolean p2){ return null; }
+    public Environment.Namespace importLib(Template p0, String p1){ return null; }
+    public NumberFormat getCNumberFormat(){ return null; }
+    public Object __getitem__(String p0){ return null; }
+    public Object getCustomState(Object p0){ return null; }
+    public Object setCustomState(Object p0, Object p1){ return null; }
+    public Set getKnownVariableNames(){ return null; }
+    public String getDefaultNS(){ return null; }
+    public String getNamespaceForPrefix(String p0){ return null; }
+    public String getPrefixForNamespace(String p0){ return null; }
+    public String rootBasedToAbsoluteTemplateName(String p0){ return null; }
+    public String toFullTemplateName(String p0, String p1){ return null; }
+    public Template getCurrentTemplate(){ return null; }
+    public Template getMainTemplate(){ return null; }
+    public Template getTemplate(){ return null; }
+    public Template getTemplateForImporting(String p0){ return null; }
+    public Template getTemplateForInclusion(String p0, String p1, boolean p2){ return null; }
+    public Template getTemplateForInclusion(String p0, String p1, boolean p2, boolean p3){ return null; }
+    public TemplateDateFormat getTemplateDateFormat(String p0, int p1, Class<? extends Date> p2){ return null; }
+    public TemplateDateFormat getTemplateDateFormat(String p0, int p1, Class<? extends Date> p2, Locale p3){ return null; }
+    public TemplateDateFormat getTemplateDateFormat(String p0, int p1, Class<? extends Date> p2, Locale p3, TimeZone p4, TimeZone p5){ return null; }
+    public TemplateDateFormat getTemplateDateFormat(String p0, int p1, Locale p2, TimeZone p3, boolean p4){ return null; }
+    public TemplateDateFormat getTemplateDateFormat(int p0, Class<? extends Date> p1){ return null; }
+    public TemplateHashModel getDataModel(){ return null; }
+    public TemplateHashModel getGlobalVariables(){ return null; }
+    public TemplateModel getDataModelOrSharedVariable(String p0){ return null; }
+    public TemplateModel getGlobalVariable(String p0){ return null; }
+    public TemplateModel getLocalVariable(String p0){ return null; }
+    public TemplateModel getVariable(String p0){ return null; }
+    public TemplateNodeModel getCurrentVisitorNode(){ return null; }
+    public TemplateNumberFormat getTemplateNumberFormat(){ return null; }
+    public TemplateNumberFormat getTemplateNumberFormat(String p0){ return null; }
+    public TemplateNumberFormat getTemplateNumberFormat(String p0, Locale p1){ return null; }
+    public Writer getOut(){ return null; }
+    public boolean applyEqualsOperator(TemplateModel p0, TemplateModel p1){ return false; }
+    public boolean applyEqualsOperatorLenient(TemplateModel p0, TemplateModel p1){ return false; }
+    public boolean applyGreaterThanOperator(TemplateModel p0, TemplateModel p1){ return false; }
+    public boolean applyLessThanOperator(TemplateModel p0, TemplateModel p1){ return false; }
+    public boolean applyLessThanOrEqualsOperator(TemplateModel p0, TemplateModel p1){ return false; }
+    public boolean applyWithGreaterThanOrEqualsOperator(TemplateModel p0, TemplateModel p1){ return false; }
+    public boolean isInAttemptBlock(){ return false; }
+    public class Namespace extends SimpleHash
+    {
+        public Template getTemplate(){ return null; }
+    }
+    public static Environment getCurrentEnvironment(){ return null; }
+    public void __setitem__(String p0, Object p1){}
+    public void include(String p0, String p1, boolean p2){}
+    public void include(Template p0){}
+    public void outputInstructionStack(PrintWriter p0){}
+    public void process(){}
+    public void setCurrentVisitorNode(TemplateNodeModel p0){}
+    public void setDateFormat(String p0){}
+    public void setDateTimeFormat(String p0){}
+    public void setGlobalVariable(String p0, TemplateModel p1){}
+    public void setLocalVariable(String p0, TemplateModel p1){}
+    public void setLocale(Locale p0){}
+    public void setNumberFormat(String p0){}
+    public void setOut(Writer p0){}
+    public void setOutputEncoding(String p0){}
+    public void setSQLDateAndTimeTimeZone(TimeZone p0){}
+    public void setTemplateExceptionHandler(TemplateExceptionHandler p0){}
+    public void setTimeFormat(String p0){}
+    public void setTimeZone(TimeZone p0){}
+    public void setURLEscapingCharset(String p0){}
+    public void setVariable(String p0, TemplateModel p1){}
+    public void visit(TemplateElement p0, TemplateDirectiveModel p1, Map p2, List p3){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Expression.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Expression.java
new file mode 100644
index 00000000000..7ed1c62835a
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Expression.java
@@ -0,0 +1,21 @@
+// Generated automatically from freemarker.core.Expression for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.Environment;
+import freemarker.core.TemplateObject;
+import freemarker.template.TemplateModel;
+
+abstract public class Expression extends TemplateObject {
+    protected abstract Expression deepCloneWithIdentifierReplaced_inner(String p0, Expression p1,
+            Expression.ReplacemenetState p2);
+
+    public Expression() {}
+
+    public final TemplateModel getAsTemplateModel(Environment p0) {
+        return null;
+    }
+
+    class ReplacemenetState {
+    }
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/LibraryLoad.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/LibraryLoad.java
new file mode 100644
index 00000000000..abc530760d3
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/LibraryLoad.java
@@ -0,0 +1,12 @@
+// Generated automatically from freemarker.core.LibraryLoad for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.TemplateElement;
+
+public class LibraryLoad extends TemplateElement
+{
+    protected LibraryLoad() {}
+    protected String dump(boolean p0){ return null; }
+    public String getTemplateName(){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/LocalContext.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/LocalContext.java
new file mode 100644
index 00000000000..4bd991a6275
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/LocalContext.java
@@ -0,0 +1,12 @@
+// Generated automatically from freemarker.core.LocalContext for testing purposes
+
+package freemarker.core;
+
+import freemarker.template.TemplateModel;
+import java.util.Collection;
+
+public interface LocalContext
+{
+    Collection getLocalVariableNames();
+    TemplateModel getLocalVariable(String p0);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Macro.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Macro.java
new file mode 100644
index 00000000000..6be750b4e26
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/Macro.java
@@ -0,0 +1,49 @@
+// Generated automatically from freemarker.core.Macro for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.LocalContext;
+import freemarker.core.TemplateElement;
+import freemarker.template.TemplateHashModelEx;
+import freemarker.template.TemplateModel;
+import freemarker.template.TemplateSequenceModel;
+import java.util.Collection;
+
+public class Macro extends TemplateElement implements TemplateModel {
+    protected Macro() {}
+
+    protected String dump(boolean p0) {
+        return null;
+    }
+
+    public Macro.WithArgs getWithArgs() {
+        return null;
+    }
+
+    public Object getNamespaceLookupKey() {
+        return null;
+    }
+
+    public String getCatchAll() {
+        return null;
+    }
+
+    public String getName() {
+        return null;
+    }
+
+    public String[] getArgumentNames() {
+        return null;
+    }
+
+    public boolean hasArgNamed(String p0) {
+        return false;
+    }
+
+    public boolean isFunction() {
+        return false;
+    }
+
+    class WithArgs {
+    }
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/OutputFormat.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/OutputFormat.java
new file mode 100644
index 00000000000..f6fd1f37982
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/OutputFormat.java
@@ -0,0 +1,14 @@
+// Generated automatically from freemarker.core.OutputFormat for testing purposes
+
+package freemarker.core;
+
+
+abstract public class OutputFormat
+{
+    protected String toStringExtraProperties(){ return null; }
+    public OutputFormat(){}
+    public abstract String getMimeType();
+    public abstract String getName();
+    public abstract boolean isOutputFormatMixingAllowed();
+    public final String toString(){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/ParserConfiguration.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/ParserConfiguration.java
new file mode 100644
index 00000000000..8a1fd56afc1
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/ParserConfiguration.java
@@ -0,0 +1,22 @@
+// Generated automatically from freemarker.core.ParserConfiguration for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.ArithmeticEngine;
+import freemarker.core.OutputFormat;
+import freemarker.template.Version;
+
+public interface ParserConfiguration
+{
+    ArithmeticEngine getArithmeticEngine();
+    OutputFormat getOutputFormat();
+    Version getIncompatibleImprovements();
+    boolean getRecognizeStandardFileExtensions();
+    boolean getStrictSyntaxMode();
+    boolean getWhitespaceStripping();
+    int getAutoEscapingPolicy();
+    int getInterpolationSyntax();
+    int getNamingConvention();
+    int getTabSize();
+    int getTagSyntax();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateClassResolver.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateClassResolver.java
new file mode 100644
index 00000000000..9ad07af08e7
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateClassResolver.java
@@ -0,0 +1,14 @@
+// Generated automatically from freemarker.core.TemplateClassResolver for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.Environment;
+import freemarker.template.Template;
+
+public interface TemplateClassResolver
+{
+    Class resolve(String p0, Environment p1, Template p2);
+    static TemplateClassResolver ALLOWS_NOTHING_RESOLVER = null;
+    static TemplateClassResolver SAFER_RESOLVER = null;
+    static TemplateClassResolver UNRESTRICTED_RESOLVER = null;
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateConfiguration.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateConfiguration.java
new file mode 100644
index 00000000000..7715cfb1636
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateConfiguration.java
@@ -0,0 +1,51 @@
+// Generated automatically from freemarker.core.TemplateConfiguration for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.Configurable;
+import freemarker.core.OutputFormat;
+import freemarker.core.ParserConfiguration;
+import freemarker.template.Configuration;
+import freemarker.template.Template;
+import freemarker.template.Version;
+
+public class TemplateConfiguration extends Configurable implements ParserConfiguration
+{
+    public Configuration getParentConfiguration(){ return null; }
+    public OutputFormat getOutputFormat(){ return null; }
+    public String getEncoding(){ return null; }
+    public TemplateConfiguration(){}
+    public Version getIncompatibleImprovements(){ return null; }
+    public boolean getRecognizeStandardFileExtensions(){ return false; }
+    public boolean getStrictSyntaxMode(){ return false; }
+    public boolean getWhitespaceStripping(){ return false; }
+    public boolean isAutoEscapingPolicySet(){ return false; }
+    public boolean isEncodingSet(){ return false; }
+    public boolean isInterpolationSyntaxSet(){ return false; }
+    public boolean isNamingConventionSet(){ return false; }
+    public boolean isOutputFormatSet(){ return false; }
+    public boolean isRecognizeStandardFileExtensionsSet(){ return false; }
+    public boolean isStrictSyntaxModeSet(){ return false; }
+    public boolean isTabSizeSet(){ return false; }
+    public boolean isTagSyntaxSet(){ return false; }
+    public boolean isWhitespaceStrippingSet(){ return false; }
+    public int getAutoEscapingPolicy(){ return 0; }
+    public int getInterpolationSyntax(){ return 0; }
+    public int getNamingConvention(){ return 0; }
+    public int getTabSize(){ return 0; }
+    public int getTagSyntax(){ return 0; }
+    public void apply(Template p0){}
+    public void merge(TemplateConfiguration p0){}
+    public void setAutoEscapingPolicy(int p0){}
+    public void setEncoding(String p0){}
+    public void setInterpolationSyntax(int p0){}
+    public void setNamingConvention(int p0){}
+    public void setOutputFormat(OutputFormat p0){}
+    public void setParentConfiguration(Configuration p0){}
+    public void setRecognizeStandardFileExtensions(boolean p0){}
+    public void setStrictBeanModels(boolean p0){}
+    public void setStrictSyntaxMode(boolean p0){}
+    public void setTabSize(int p0){}
+    public void setTagSyntax(int p0){}
+    public void setWhitespaceStripping(boolean p0){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateDateFormat.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateDateFormat.java
new file mode 100644
index 00000000000..6598080616f
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateDateFormat.java
@@ -0,0 +1,16 @@
+// Generated automatically from freemarker.core.TemplateDateFormat for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.TemplateValueFormat;
+import freemarker.template.TemplateDateModel;
+
+abstract public class TemplateDateFormat extends TemplateValueFormat
+{
+    public Object format(TemplateDateModel p0){ return null; }
+    public TemplateDateFormat(){}
+    public abstract Object parse(String p0, int p1);
+    public abstract String formatToPlainText(TemplateDateModel p0);
+    public abstract boolean isLocaleBound();
+    public abstract boolean isTimeZoneBound();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateDateFormatFactory.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateDateFormatFactory.java
new file mode 100644
index 00000000000..f251e28d0b6
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateDateFormatFactory.java
@@ -0,0 +1,15 @@
+// Generated automatically from freemarker.core.TemplateDateFormatFactory for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.Environment;
+import freemarker.core.TemplateDateFormat;
+import freemarker.core.TemplateValueFormatFactory;
+import java.util.Locale;
+import java.util.TimeZone;
+
+abstract public class TemplateDateFormatFactory extends TemplateValueFormatFactory
+{
+    public TemplateDateFormatFactory(){}
+    public abstract TemplateDateFormat get(String p0, int p1, Locale p2, TimeZone p3, boolean p4, Environment p5);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateElement.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateElement.java
new file mode 100644
index 00000000000..ff025939234
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateElement.java
@@ -0,0 +1,30 @@
+// Generated automatically from freemarker.core.TemplateElement for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.TemplateObject;
+import freemarker.template.TemplateNodeModel;
+import freemarker.template.TemplateSequenceModel;
+import java.util.Enumeration;
+import javax.swing.tree.TreeNode;
+
+abstract public class TemplateElement extends TemplateObject implements TreeNode
+{
+    protected abstract String dump(boolean p0);
+    public Enumeration children(){ return null; }
+    public String getNodeName(){ return null; }
+    public String getNodeNamespace(){ return null; }
+    public String getNodeType(){ return null; }
+    public TemplateElement(){}
+    public TemplateNodeModel getParentNode(){ return null; }
+    public TemplateSequenceModel getChildNodes(){ return null; }
+    public TreeNode getChildAt(int p0){ return null; }
+    public TreeNode getParent(){ return null; }
+    public boolean getAllowsChildren(){ return false; }
+    public boolean isLeaf(){ return false; }
+    public final String getCanonicalForm(){ return null; }
+    public final String getDescription(){ return null; }
+    public int getChildCount(){ return 0; }
+    public int getIndex(TreeNode p0){ return 0; }
+    public void setChildAt(int p0, TemplateElement p1){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateNumberFormat.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateNumberFormat.java
new file mode 100644
index 00000000000..3ed83f5fcd3
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateNumberFormat.java
@@ -0,0 +1,15 @@
+// Generated automatically from freemarker.core.TemplateNumberFormat for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.TemplateValueFormat;
+import freemarker.template.TemplateNumberModel;
+
+abstract public class TemplateNumberFormat extends TemplateValueFormat
+{
+    public Object format(TemplateNumberModel p0){ return null; }
+    public TemplateNumberFormat(){}
+    public abstract String formatToPlainText(TemplateNumberModel p0);
+    public abstract boolean isLocaleBound();
+    public final Object parse(String p0){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateNumberFormatFactory.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateNumberFormatFactory.java
new file mode 100644
index 00000000000..6ccd1ebd428
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateNumberFormatFactory.java
@@ -0,0 +1,14 @@
+// Generated automatically from freemarker.core.TemplateNumberFormatFactory for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.Environment;
+import freemarker.core.TemplateNumberFormat;
+import freemarker.core.TemplateValueFormatFactory;
+import java.util.Locale;
+
+abstract public class TemplateNumberFormatFactory extends TemplateValueFormatFactory
+{
+    public TemplateNumberFormatFactory(){}
+    public abstract TemplateNumberFormat get(String p0, Locale p1, Environment p2);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateObject.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateObject.java
new file mode 100644
index 00000000000..66a30450d02
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateObject.java
@@ -0,0 +1,23 @@
+// Generated automatically from freemarker.core.TemplateObject for testing purposes
+
+package freemarker.core;
+
+import freemarker.template.Template;
+
+abstract public class TemplateObject
+{
+    public String getEndLocation(){ return null; }
+    public String getEndLocationQuoted(){ return null; }
+    public String getStartLocation(){ return null; }
+    public String getStartLocationQuoted(){ return null; }
+    public String toString(){ return null; }
+    public Template getTemplate(){ return null; }
+    public TemplateObject(){}
+    public abstract String getCanonicalForm();
+    public boolean contains(int p0, int p1){ return false; }
+    public final String getSource(){ return null; }
+    public final int getBeginColumn(){ return 0; }
+    public final int getBeginLine(){ return 0; }
+    public final int getEndColumn(){ return 0; }
+    public final int getEndLine(){ return 0; }
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateValueFormat.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateValueFormat.java
new file mode 100644
index 00000000000..84f787a7468
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateValueFormat.java
@@ -0,0 +1,10 @@
+// Generated automatically from freemarker.core.TemplateValueFormat for testing purposes
+
+package freemarker.core;
+
+
+abstract public class TemplateValueFormat
+{
+    public TemplateValueFormat(){}
+    public abstract String getDescription();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateValueFormatFactory.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateValueFormatFactory.java
new file mode 100644
index 00000000000..f43a63c9a11
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TemplateValueFormatFactory.java
@@ -0,0 +1,9 @@
+// Generated automatically from freemarker.core.TemplateValueFormatFactory for testing purposes
+
+package freemarker.core;
+
+
+abstract public class TemplateValueFormatFactory
+{
+    public TemplateValueFormatFactory(){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TruncateBuiltinAlgorithm.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TruncateBuiltinAlgorithm.java
new file mode 100644
index 00000000000..36a20f26806
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/TruncateBuiltinAlgorithm.java
@@ -0,0 +1,18 @@
+// Generated automatically from freemarker.core.TruncateBuiltinAlgorithm for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.Environment;
+import freemarker.template.TemplateModel;
+import freemarker.template.TemplateScalarModel;
+
+abstract public class TruncateBuiltinAlgorithm
+{
+    public TruncateBuiltinAlgorithm(){}
+    public abstract TemplateModel truncateCM(String p0, int p1, TemplateModel p2, Integer p3, Environment p4);
+    public abstract TemplateModel truncateM(String p0, int p1, TemplateModel p2, Integer p3, Environment p4);
+    public abstract TemplateModel truncateWM(String p0, int p1, TemplateModel p2, Integer p3, Environment p4);
+    public abstract TemplateScalarModel truncate(String p0, int p1, TemplateScalarModel p2, Integer p3, Environment p4);
+    public abstract TemplateScalarModel truncateC(String p0, int p1, TemplateScalarModel p2, Integer p3, Environment p4);
+    public abstract TemplateScalarModel truncateW(String p0, int p1, TemplateScalarModel p2, Integer p3, Environment p4);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/_ErrorDescriptionBuilder.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/_ErrorDescriptionBuilder.java
new file mode 100644
index 00000000000..ab90808ab3e
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/core/_ErrorDescriptionBuilder.java
@@ -0,0 +1,24 @@
+// Generated automatically from freemarker.core._ErrorDescriptionBuilder for testing purposes
+
+package freemarker.core;
+
+import freemarker.core.Expression;
+import freemarker.core.TemplateElement;
+import freemarker.template.Template;
+
+public class _ErrorDescriptionBuilder
+{
+    protected _ErrorDescriptionBuilder() {}
+    public String toString(){ return null; }
+    public String toString(TemplateElement p0, boolean p1){ return null; }
+    public _ErrorDescriptionBuilder blame(Expression p0){ return null; }
+    public _ErrorDescriptionBuilder showBlamer(boolean p0){ return null; }
+    public _ErrorDescriptionBuilder template(Template p0){ return null; }
+    public _ErrorDescriptionBuilder tip(Object... p0){ return null; }
+    public _ErrorDescriptionBuilder tip(String p0){ return null; }
+    public _ErrorDescriptionBuilder tips(Object... p0){ return null; }
+    public _ErrorDescriptionBuilder(Object... p0){}
+    public _ErrorDescriptionBuilder(String p0){}
+    public static String toString(Object p0){ return null; }
+    public static String tryToString(Object p0){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/AttemptExceptionReporter.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/AttemptExceptionReporter.java
new file mode 100644
index 00000000000..a870a2d0d82
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/AttemptExceptionReporter.java
@@ -0,0 +1,13 @@
+// Generated automatically from freemarker.template.AttemptExceptionReporter for testing purposes
+
+package freemarker.template;
+
+import freemarker.core.Environment;
+import freemarker.template.TemplateException;
+
+public interface AttemptExceptionReporter
+{
+    static AttemptExceptionReporter LOG_ERROR_REPORTER = null;
+    static AttemptExceptionReporter LOG_WARN_REPORTER = null;
+    void report(TemplateException p0, Environment p1);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/Configuration.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/Configuration.java
new file mode 100644
index 00000000000..4c8c4cd5a84
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/Configuration.java
@@ -0,0 +1,253 @@
+// Generated automatically from freemarker.template.Configuration for testing purposes
+
+package freemarker.template;
+
+import freemarker.cache.CacheStorage;
+import freemarker.cache.TemplateConfigurationFactory;
+import freemarker.cache.TemplateLoader;
+import freemarker.cache.TemplateLookupStrategy;
+import freemarker.cache.TemplateNameFormat;
+import freemarker.core.Configurable;
+import freemarker.core.Environment;
+import freemarker.core.OutputFormat;
+import freemarker.core.ParserConfiguration;
+import freemarker.template.AttemptExceptionReporter;
+import freemarker.template.ObjectWrapper;
+import freemarker.template.Template;
+import freemarker.template.TemplateExceptionHandler;
+import freemarker.template.TemplateHashModelEx;
+import freemarker.template.TemplateModel;
+import freemarker.template.Version;
+import java.io.File;
+import java.util.Collection;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.TimeZone;
+
+public class Configuration extends Configurable implements Cloneable, ParserConfiguration
+{
+    protected String getCorrectedNameForUnknownSetting(String p0){ return null; }
+    protected void doAutoImportsAndIncludes(Environment p0){}
+    public CacheStorage getCacheStorage(){ return null; }
+    public Collection<? extends OutputFormat> getRegisteredCustomOutputFormats(){ return null; }
+    public Configuration(){}
+    public Configuration(Version p0){}
+    public Object clone(){ return null; }
+    public OutputFormat getOutputFormat(){ return null; }
+    public OutputFormat getOutputFormat(String p0){ return null; }
+    public Set getSharedVariableNames(){ return null; }
+    public Set getSupportedBuiltInDirectiveNames(){ return null; }
+    public Set getSupportedBuiltInNames(){ return null; }
+    public Set<String> getSettingNames(boolean p0){ return null; }
+    public Set<String> getSupportedBuiltInDirectiveNames(int p0){ return null; }
+    public Set<String> getSupportedBuiltInNames(int p0){ return null; }
+    public String getDefaultEncoding(){ return null; }
+    public String getEncoding(Locale p0){ return null; }
+    public String getIncompatibleEnhancements(){ return null; }
+    public Template getTemplate(String p0){ return null; }
+    public Template getTemplate(String p0, Locale p1){ return null; }
+    public Template getTemplate(String p0, Locale p1, Object p2, String p3, boolean p4, boolean p5){ return null; }
+    public Template getTemplate(String p0, Locale p1, String p2){ return null; }
+    public Template getTemplate(String p0, Locale p1, String p2, boolean p3){ return null; }
+    public Template getTemplate(String p0, Locale p1, String p2, boolean p3, boolean p4){ return null; }
+    public Template getTemplate(String p0, String p1){ return null; }
+    public TemplateConfigurationFactory getTemplateConfigurations(){ return null; }
+    public TemplateLoader getTemplateLoader(){ return null; }
+    public TemplateLookupStrategy getTemplateLookupStrategy(){ return null; }
+    public TemplateModel getSharedVariable(String p0){ return null; }
+    public TemplateNameFormat getTemplateNameFormat(){ return null; }
+    public Version getIncompatibleImprovements(){ return null; }
+    public boolean getFallbackOnNullLoopVariable(){ return false; }
+    public boolean getLocalizedLookup(){ return false; }
+    public boolean getRecognizeStandardFileExtensions(){ return false; }
+    public boolean getStrictSyntaxMode(){ return false; }
+    public boolean getWhitespaceStripping(){ return false; }
+    public boolean isAttemptExceptionReporterExplicitlySet(){ return false; }
+    public boolean isCacheStorageExplicitlySet(){ return false; }
+    public boolean isDefaultEncodingExplicitlySet(){ return false; }
+    public boolean isLocaleExplicitlySet(){ return false; }
+    public boolean isLogTemplateExceptionsExplicitlySet(){ return false; }
+    public boolean isObjectWrapperExplicitlySet(){ return false; }
+    public boolean isOutputFormatExplicitlySet(){ return false; }
+    public boolean isRecognizeStandardFileExtensionsExplicitlySet(){ return false; }
+    public boolean isTemplateExceptionHandlerExplicitlySet(){ return false; }
+    public boolean isTemplateLoaderExplicitlySet(){ return false; }
+    public boolean isTemplateLookupStrategyExplicitlySet(){ return false; }
+    public boolean isTemplateNameFormatExplicitlySet(){ return false; }
+    public boolean isTimeZoneExplicitlySet(){ return false; }
+    public boolean isWrapUncheckedExceptionsExplicitlySet(){ return false; }
+    public int getAutoEscapingPolicy(){ return 0; }
+    public int getInterpolationSyntax(){ return 0; }
+    public int getNamingConvention(){ return 0; }
+    public int getParsedIncompatibleEnhancements(){ return 0; }
+    public int getTabSize(){ return 0; }
+    public int getTagSyntax(){ return 0; }
+    public long getTemplateUpdateDelayMilliseconds(){ return 0; }
+    public static Configuration getDefaultConfiguration(){ return null; }
+    public static ObjectWrapper getDefaultObjectWrapper(Version p0){ return null; }
+    public static String AUTO_ESCAPING_POLICY_KEY = null;
+    public static String AUTO_ESCAPING_POLICY_KEY_CAMEL_CASE = null;
+    public static String AUTO_ESCAPING_POLICY_KEY_SNAKE_CASE = null;
+    public static String AUTO_IMPORT_KEY = null;
+    public static String AUTO_IMPORT_KEY_CAMEL_CASE = null;
+    public static String AUTO_IMPORT_KEY_SNAKE_CASE = null;
+    public static String AUTO_INCLUDE_KEY = null;
+    public static String AUTO_INCLUDE_KEY_CAMEL_CASE = null;
+    public static String AUTO_INCLUDE_KEY_SNAKE_CASE = null;
+    public static String CACHE_STORAGE_KEY = null;
+    public static String CACHE_STORAGE_KEY_CAMEL_CASE = null;
+    public static String CACHE_STORAGE_KEY_SNAKE_CASE = null;
+    public static String DEFAULT_ENCODING_KEY = null;
+    public static String DEFAULT_ENCODING_KEY_CAMEL_CASE = null;
+    public static String DEFAULT_ENCODING_KEY_SNAKE_CASE = null;
+    public static String DEFAULT_INCOMPATIBLE_ENHANCEMENTS = null;
+    public static String FALLBACK_ON_NULL_LOOP_VARIABLE_KEY = null;
+    public static String FALLBACK_ON_NULL_LOOP_VARIABLE_KEY_CAMEL_CASE = null;
+    public static String FALLBACK_ON_NULL_LOOP_VARIABLE_KEY_SNAKE_CASE = null;
+    public static String INCOMPATIBLE_ENHANCEMENTS = null;
+    public static String INCOMPATIBLE_IMPROVEMENTS = null;
+    public static String INCOMPATIBLE_IMPROVEMENTS_KEY = null;
+    public static String INCOMPATIBLE_IMPROVEMENTS_KEY_CAMEL_CASE = null;
+    public static String INCOMPATIBLE_IMPROVEMENTS_KEY_SNAKE_CASE = null;
+    public static String INTERPOLATION_SYNTAX_KEY = null;
+    public static String INTERPOLATION_SYNTAX_KEY_CAMEL_CASE = null;
+    public static String INTERPOLATION_SYNTAX_KEY_SNAKE_CASE = null;
+    public static String LOCALIZED_LOOKUP_KEY = null;
+    public static String LOCALIZED_LOOKUP_KEY_CAMEL_CASE = null;
+    public static String LOCALIZED_LOOKUP_KEY_SNAKE_CASE = null;
+    public static String NAMING_CONVENTION_KEY = null;
+    public static String NAMING_CONVENTION_KEY_CAMEL_CASE = null;
+    public static String NAMING_CONVENTION_KEY_SNAKE_CASE = null;
+    public static String OUTPUT_FORMAT_KEY = null;
+    public static String OUTPUT_FORMAT_KEY_CAMEL_CASE = null;
+    public static String OUTPUT_FORMAT_KEY_SNAKE_CASE = null;
+    public static String RECOGNIZE_STANDARD_FILE_EXTENSIONS_KEY = null;
+    public static String RECOGNIZE_STANDARD_FILE_EXTENSIONS_KEY_CAMEL_CASE = null;
+    public static String RECOGNIZE_STANDARD_FILE_EXTENSIONS_KEY_SNAKE_CASE = null;
+    public static String REGISTERED_CUSTOM_OUTPUT_FORMATS_KEY = null;
+    public static String REGISTERED_CUSTOM_OUTPUT_FORMATS_KEY_CAMEL_CASE = null;
+    public static String REGISTERED_CUSTOM_OUTPUT_FORMATS_KEY_SNAKE_CASE = null;
+    public static String STRICT_SYNTAX_KEY = null;
+    public static String STRICT_SYNTAX_KEY_CAMEL_CASE = null;
+    public static String STRICT_SYNTAX_KEY_SNAKE_CASE = null;
+    public static String TAB_SIZE_KEY = null;
+    public static String TAB_SIZE_KEY_CAMEL_CASE = null;
+    public static String TAB_SIZE_KEY_SNAKE_CASE = null;
+    public static String TAG_SYNTAX_KEY = null;
+    public static String TAG_SYNTAX_KEY_CAMEL_CASE = null;
+    public static String TAG_SYNTAX_KEY_SNAKE_CASE = null;
+    public static String TEMPLATE_CONFIGURATIONS_KEY = null;
+    public static String TEMPLATE_CONFIGURATIONS_KEY_CAMEL_CASE = null;
+    public static String TEMPLATE_CONFIGURATIONS_KEY_SNAKE_CASE = null;
+    public static String TEMPLATE_LOADER_KEY = null;
+    public static String TEMPLATE_LOADER_KEY_CAMEL_CASE = null;
+    public static String TEMPLATE_LOADER_KEY_SNAKE_CASE = null;
+    public static String TEMPLATE_LOOKUP_STRATEGY_KEY = null;
+    public static String TEMPLATE_LOOKUP_STRATEGY_KEY_CAMEL_CASE = null;
+    public static String TEMPLATE_LOOKUP_STRATEGY_KEY_SNAKE_CASE = null;
+    public static String TEMPLATE_NAME_FORMAT_KEY = null;
+    public static String TEMPLATE_NAME_FORMAT_KEY_CAMEL_CASE = null;
+    public static String TEMPLATE_NAME_FORMAT_KEY_SNAKE_CASE = null;
+    public static String TEMPLATE_UPDATE_DELAY_KEY = null;
+    public static String TEMPLATE_UPDATE_DELAY_KEY_CAMEL_CASE = null;
+    public static String TEMPLATE_UPDATE_DELAY_KEY_SNAKE_CASE = null;
+    public static String WHITESPACE_STRIPPING_KEY = null;
+    public static String WHITESPACE_STRIPPING_KEY_CAMEL_CASE = null;
+    public static String WHITESPACE_STRIPPING_KEY_SNAKE_CASE = null;
+    public static String getVersionNumber(){ return null; }
+    public static Version DEFAULT_INCOMPATIBLE_IMPROVEMENTS = null;
+    public static Version VERSION_2_3_0 = null;
+    public static Version VERSION_2_3_19 = null;
+    public static Version VERSION_2_3_20 = null;
+    public static Version VERSION_2_3_21 = null;
+    public static Version VERSION_2_3_22 = null;
+    public static Version VERSION_2_3_23 = null;
+    public static Version VERSION_2_3_24 = null;
+    public static Version VERSION_2_3_25 = null;
+    public static Version VERSION_2_3_26 = null;
+    public static Version VERSION_2_3_27 = null;
+    public static Version VERSION_2_3_28 = null;
+    public static Version VERSION_2_3_29 = null;
+    public static Version VERSION_2_3_30 = null;
+    public static Version VERSION_2_3_31 = null;
+    public static Version getVersion(){ return null; }
+    public static int ANGLE_BRACKET_TAG_SYNTAX = 0;
+    public static int AUTO_DETECT_NAMING_CONVENTION = 0;
+    public static int AUTO_DETECT_TAG_SYNTAX = 0;
+    public static int CAMEL_CASE_NAMING_CONVENTION = 0;
+    public static int DISABLE_AUTO_ESCAPING_POLICY = 0;
+    public static int DOLLAR_INTERPOLATION_SYNTAX = 0;
+    public static int ENABLE_IF_DEFAULT_AUTO_ESCAPING_POLICY = 0;
+    public static int ENABLE_IF_SUPPORTED_AUTO_ESCAPING_POLICY = 0;
+    public static int LEGACY_INTERPOLATION_SYNTAX = 0;
+    public static int LEGACY_NAMING_CONVENTION = 0;
+    public static int PARSED_DEFAULT_INCOMPATIBLE_ENHANCEMENTS = 0;
+    public static int SQUARE_BRACKET_INTERPOLATION_SYNTAX = 0;
+    public static int SQUARE_BRACKET_TAG_SYNTAX = 0;
+    public static void setDefaultConfiguration(Configuration p0){}
+    public void clearEncodingMap(){}
+    public void clearSharedVariables(){}
+    public void clearTemplateCache(){}
+    public void loadBuiltInEncodingMap(){}
+    public void removeTemplateFromCache(String p0){}
+    public void removeTemplateFromCache(String p0, Locale p1){}
+    public void removeTemplateFromCache(String p0, Locale p1, Object p2, String p3, boolean p4){}
+    public void removeTemplateFromCache(String p0, Locale p1, String p2){}
+    public void removeTemplateFromCache(String p0, Locale p1, String p2, boolean p3){}
+    public void removeTemplateFromCache(String p0, String p1){}
+    public void setAllSharedVariables(TemplateHashModelEx p0){}
+    public void setAttemptExceptionReporter(AttemptExceptionReporter p0){}
+    public void setAutoEscapingPolicy(int p0){}
+    public void setCacheStorage(CacheStorage p0){}
+    public void setClassForTemplateLoading(Class p0, String p1){}
+    public void setClassLoaderForTemplateLoading(ClassLoader p0, String p1){}
+    public void setDefaultEncoding(String p0){}
+    public void setDirectoryForTemplateLoading(File p0){}
+    public void setEncoding(Locale p0, String p1){}
+    public void setFallbackOnNullLoopVariable(boolean p0){}
+    public void setIncompatibleEnhancements(String p0){}
+    public void setIncompatibleImprovements(Version p0){}
+    public void setInterpolationSyntax(int p0){}
+    public void setLocale(Locale p0){}
+    public void setLocalizedLookup(boolean p0){}
+    public void setLogTemplateExceptions(boolean p0){}
+    public void setNamingConvention(int p0){}
+    public void setObjectWrapper(ObjectWrapper p0){}
+    public void setOutputFormat(OutputFormat p0){}
+    public void setRecognizeStandardFileExtensions(boolean p0){}
+    public void setRegisteredCustomOutputFormats(Collection<? extends OutputFormat> p0){}
+    public void setServletContextForTemplateLoading(Object p0, String p1){}
+    public void setSetting(String p0, String p1){}
+    public void setSharedVariable(String p0, Object p1){}
+    public void setSharedVariable(String p0, TemplateModel p1){}
+    public void setSharedVariables(Map<String, ? extends Object> p0){}
+    public void setSharedVaribles(Map p0){}
+    public void setStrictSyntaxMode(boolean p0){}
+    public void setTabSize(int p0){}
+    public void setTagSyntax(int p0){}
+    public void setTemplateConfigurations(TemplateConfigurationFactory p0){}
+    public void setTemplateExceptionHandler(TemplateExceptionHandler p0){}
+    public void setTemplateLoader(TemplateLoader p0){}
+    public void setTemplateLookupStrategy(TemplateLookupStrategy p0){}
+    public void setTemplateNameFormat(TemplateNameFormat p0){}
+    public void setTemplateUpdateDelay(int p0){}
+    public void setTemplateUpdateDelayMilliseconds(long p0){}
+    public void setTimeZone(TimeZone p0){}
+    public void setWhitespaceStripping(boolean p0){}
+    public void setWrapUncheckedExceptions(boolean p0){}
+    public void unsetAttemptExceptionReporter(){}
+    public void unsetCacheStorage(){}
+    public void unsetDefaultEncoding(){}
+    public void unsetLocale(){}
+    public void unsetLogTemplateExceptions(){}
+    public void unsetObjectWrapper(){}
+    public void unsetOutputFormat(){}
+    public void unsetRecognizeStandardFileExtensions(){}
+    public void unsetTemplateExceptionHandler(){}
+    public void unsetTemplateLoader(){}
+    public void unsetTemplateLookupStrategy(){}
+    public void unsetTemplateNameFormat(){}
+    public void unsetTimeZone(){}
+    public void unsetWrapUncheckedExceptions(){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/ObjectWrapper.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/ObjectWrapper.java
new file mode 100644
index 00000000000..c34a96ece19
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/ObjectWrapper.java
@@ -0,0 +1,13 @@
+// Generated automatically from freemarker.template.ObjectWrapper for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateModel;
+
+public interface ObjectWrapper
+{
+    TemplateModel wrap(Object p0);
+    static ObjectWrapper BEANS_WRAPPER = null;
+    static ObjectWrapper DEFAULT_WRAPPER = null;
+    static ObjectWrapper SIMPLE_WRAPPER = null;
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/SimpleHash.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/SimpleHash.java
new file mode 100644
index 00000000000..3e7095ab34a
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/SimpleHash.java
@@ -0,0 +1,35 @@
+// Generated automatically from freemarker.template.SimpleHash for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.ObjectWrapper;
+import freemarker.template.TemplateCollectionModel;
+import freemarker.template.TemplateHashModelEx2;
+import freemarker.template.TemplateModel;
+import freemarker.template.WrappingTemplateModel;
+import java.io.Serializable;
+import java.util.Map;
+
+public class SimpleHash extends WrappingTemplateModel implements Serializable, TemplateHashModelEx2
+{
+    protected Map copyMap(Map p0){ return null; }
+    public Map toMap(){ return null; }
+    public SimpleHash synchronizedWrapper(){ return null; }
+    public SimpleHash(){}
+    public SimpleHash(Map p0){}
+    public SimpleHash(Map p0, ObjectWrapper p1){}
+    public SimpleHash(Map<String, Object> p0, ObjectWrapper p1, int p2){}
+    public SimpleHash(ObjectWrapper p0){}
+    public String toString(){ return null; }
+    public TemplateCollectionModel keys(){ return null; }
+    public TemplateCollectionModel values(){ return null; }
+    public TemplateHashModelEx2.KeyValuePairIterator keyValuePairIterator(){ return null; }
+    public TemplateModel get(String p0){ return null; }
+    public boolean containsKey(String p0){ return false; }
+    public boolean isEmpty(){ return false; }
+    public int size(){ return 0; }
+    public void put(String p0, Object p1){}
+    public void put(String p0, boolean p1){}
+    public void putAll(Map p0){}
+    public void remove(String p0){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/Template.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/Template.java
new file mode 100644
index 00000000000..0a80e52cb1d
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/Template.java
@@ -0,0 +1,69 @@
+// Generated automatically from freemarker.template.Template for testing purposes
+
+package freemarker.template;
+
+import freemarker.core.Configurable;
+import freemarker.core.Environment;
+import freemarker.core.LibraryLoad;
+import freemarker.core.Macro;
+import freemarker.core.OutputFormat;
+import freemarker.core.ParserConfiguration;
+import freemarker.core.TemplateElement;
+import freemarker.template.Configuration;
+import freemarker.template.ObjectWrapper;
+import freemarker.template.TemplateNodeModel;
+import java.io.PrintStream;
+import java.io.Reader;
+import java.io.Writer;
+import java.util.List;
+import java.util.Map;
+import javax.swing.tree.TreePath;
+
+public class Template extends Configurable
+{
+    protected Template() {}
+    public Configuration getConfiguration(){ return null; }
+    public Environment createProcessingEnvironment(Object p0, Writer p1){ return null; }
+    public Environment createProcessingEnvironment(Object p0, Writer p1, ObjectWrapper p2){ return null; }
+    public List getImports(){ return null; }
+    public Map getMacros(){ return null; }
+    public Object getCustomLookupCondition(){ return null; }
+    public OutputFormat getOutputFormat(){ return null; }
+    public ParserConfiguration getParserConfiguration(){ return null; }
+    public String getDefaultNS(){ return null; }
+    public String getEncoding(){ return null; }
+    public String getName(){ return null; }
+    public String getNamespaceForPrefix(String p0){ return null; }
+    public String getPrefixForNamespace(String p0){ return null; }
+    public String getPrefixedName(String p0, String p1){ return null; }
+    public String getSource(int p0, int p1, int p2, int p3){ return null; }
+    public String getSourceName(){ return null; }
+    public String toString(){ return null; }
+    public Template(String p0, Reader p1){}
+    public Template(String p0, Reader p1, Configuration p2){}
+    public Template(String p0, Reader p1, Configuration p2, String p3){}
+    public Template(String p0, String p1, Configuration p2){}
+    public Template(String p0, String p1, Reader p2, Configuration p3){}
+    public Template(String p0, String p1, Reader p2, Configuration p3, ParserConfiguration p4, String p5){}
+    public Template(String p0, String p1, Reader p2, Configuration p3, String p4){}
+    public TemplateElement getRootTreeNode(){ return null; }
+    public TreePath containingElements(int p0, int p1){ return null; }
+    public boolean getAutoEscaping(){ return false; }
+    public int getActualNamingConvention(){ return 0; }
+    public int getActualTagSyntax(){ return 0; }
+    public int getInterpolationSyntax(){ return 0; }
+    public static String DEFAULT_NAMESPACE_PREFIX = null;
+    public static String NO_NS_PREFIX = null;
+    public static Template getPlainTextTemplate(String p0, String p1, Configuration p2){ return null; }
+    public static Template getPlainTextTemplate(String p0, String p1, String p2, Configuration p3){ return null; }
+    public void addImport(LibraryLoad p0){}
+    public void addMacro(Macro p0){}
+    public void addPrefixNSMapping(String p0, String p1){}
+    public void dump(PrintStream p0){}
+    public void dump(Writer p0){}
+    public void process(Object p0, Writer p1){}
+    public void process(Object p0, Writer p1, ObjectWrapper p2){}
+    public void process(Object p0, Writer p1, ObjectWrapper p2, TemplateNodeModel p3){}
+    public void setCustomLookupCondition(Object p0){}
+    public void setEncoding(String p0){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateCollectionModel.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateCollectionModel.java
new file mode 100644
index 00000000000..c56cd42301c
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateCollectionModel.java
@@ -0,0 +1,11 @@
+// Generated automatically from freemarker.template.TemplateCollectionModel for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateModel;
+import freemarker.template.TemplateModelIterator;
+
+public interface TemplateCollectionModel extends TemplateModel
+{
+    TemplateModelIterator iterator();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateDateModel.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateDateModel.java
new file mode 100644
index 00000000000..59c32cc5e6d
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateDateModel.java
@@ -0,0 +1,18 @@
+// Generated automatically from freemarker.template.TemplateDateModel for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateModel;
+import java.util.Date;
+import java.util.List;
+
+public interface TemplateDateModel extends TemplateModel
+{
+    Date getAsDate();
+    int getDateType();
+    static List TYPE_NAMES = null;
+    static int DATE = 0;
+    static int DATETIME = 0;
+    static int TIME = 0;
+    static int UNKNOWN = 0;
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateDirectiveBody.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateDirectiveBody.java
new file mode 100644
index 00000000000..d3d74da7c66
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateDirectiveBody.java
@@ -0,0 +1,10 @@
+// Generated automatically from freemarker.template.TemplateDirectiveBody for testing purposes
+
+package freemarker.template;
+
+import java.io.Writer;
+
+public interface TemplateDirectiveBody
+{
+    void render(Writer p0);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateDirectiveModel.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateDirectiveModel.java
new file mode 100644
index 00000000000..15f800d52c7
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateDirectiveModel.java
@@ -0,0 +1,13 @@
+// Generated automatically from freemarker.template.TemplateDirectiveModel for testing purposes
+
+package freemarker.template;
+
+import freemarker.core.Environment;
+import freemarker.template.TemplateDirectiveBody;
+import freemarker.template.TemplateModel;
+import java.util.Map;
+
+public interface TemplateDirectiveModel extends TemplateModel
+{
+    void execute(Environment p0, Map p1, TemplateModel[] p2, TemplateDirectiveBody p3);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateException.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateException.java
new file mode 100644
index 00000000000..930eb2167a8
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateException.java
@@ -0,0 +1,39 @@
+// Generated automatically from freemarker.template.TemplateException for testing purposes
+
+package freemarker.template;
+
+import freemarker.core.Environment;
+import freemarker.core.Expression;
+import freemarker.core._ErrorDescriptionBuilder;
+import java.io.PrintStream;
+import java.io.PrintWriter;
+
+public class TemplateException extends Exception
+{
+    protected TemplateException() {}
+    protected TemplateException(Throwable p0, Environment p1, Expression p2, _ErrorDescriptionBuilder p3){}
+    public Environment getEnvironment(){ return null; }
+    public Exception getCauseException(){ return null; }
+    public Integer getColumnNumber(){ return null; }
+    public Integer getEndColumnNumber(){ return null; }
+    public Integer getEndLineNumber(){ return null; }
+    public Integer getLineNumber(){ return null; }
+    public String getBlamedExpressionString(){ return null; }
+    public String getFTLInstructionStack(){ return null; }
+    public String getMessage(){ return null; }
+    public String getMessageWithoutStackTop(){ return null; }
+    public String getTemplateName(){ return null; }
+    public String getTemplateSourceName(){ return null; }
+    public TemplateException(Environment p0){}
+    public TemplateException(Exception p0, Environment p1){}
+    public TemplateException(String p0, Environment p1){}
+    public TemplateException(String p0, Exception p1, Environment p2){}
+    public TemplateException(String p0, Throwable p1, Environment p2){}
+    public TemplateException(Throwable p0, Environment p1){}
+    public void printStackTrace(PrintStream p0){}
+    public void printStackTrace(PrintStream p0, boolean p1, boolean p2, boolean p3){}
+    public void printStackTrace(PrintWriter p0){}
+    public void printStackTrace(PrintWriter p0, boolean p1, boolean p2, boolean p3){}
+    public void printStandardStackTrace(PrintStream p0){}
+    public void printStandardStackTrace(PrintWriter p0){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateExceptionHandler.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateExceptionHandler.java
new file mode 100644
index 00000000000..940f0be053d
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateExceptionHandler.java
@@ -0,0 +1,16 @@
+// Generated automatically from freemarker.template.TemplateExceptionHandler for testing purposes
+
+package freemarker.template;
+
+import freemarker.core.Environment;
+import freemarker.template.TemplateException;
+import java.io.Writer;
+
+public interface TemplateExceptionHandler
+{
+    static TemplateExceptionHandler DEBUG_HANDLER = null;
+    static TemplateExceptionHandler HTML_DEBUG_HANDLER = null;
+    static TemplateExceptionHandler IGNORE_HANDLER = null;
+    static TemplateExceptionHandler RETHROW_HANDLER = null;
+    void handleTemplateException(TemplateException p0, Environment p1, Writer p2);
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateHashModel.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateHashModel.java
new file mode 100644
index 00000000000..9c05dc3e98e
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateHashModel.java
@@ -0,0 +1,11 @@
+// Generated automatically from freemarker.template.TemplateHashModel for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateModel;
+
+public interface TemplateHashModel extends TemplateModel
+{
+    TemplateModel get(String p0);
+    boolean isEmpty();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateHashModelEx.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateHashModelEx.java
new file mode 100644
index 00000000000..ad2d690fb20
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateHashModelEx.java
@@ -0,0 +1,13 @@
+// Generated automatically from freemarker.template.TemplateHashModelEx for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateCollectionModel;
+import freemarker.template.TemplateHashModel;
+
+public interface TemplateHashModelEx extends TemplateHashModel
+{
+    TemplateCollectionModel keys();
+    TemplateCollectionModel values();
+    int size();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateHashModelEx2.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateHashModelEx2.java
new file mode 100644
index 00000000000..abcc7345891
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateHashModelEx2.java
@@ -0,0 +1,21 @@
+// Generated automatically from freemarker.template.TemplateHashModelEx2 for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateHashModelEx;
+import freemarker.template.TemplateModel;
+
+public interface TemplateHashModelEx2 extends TemplateHashModelEx
+{
+    TemplateHashModelEx2.KeyValuePairIterator keyValuePairIterator();
+    static public interface KeyValuePair
+    {
+        TemplateModel getKey();
+        TemplateModel getValue();
+    }
+    static public interface KeyValuePairIterator
+    {
+        TemplateHashModelEx2.KeyValuePair next();
+        boolean hasNext();
+    }
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateModel.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateModel.java
new file mode 100644
index 00000000000..e56340a1ea0
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateModel.java
@@ -0,0 +1,9 @@
+// Generated automatically from freemarker.template.TemplateModel for testing purposes
+
+package freemarker.template;
+
+
+public interface TemplateModel
+{
+    static TemplateModel NOTHING = null;
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateModelIterator.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateModelIterator.java
new file mode 100644
index 00000000000..439160b654a
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateModelIterator.java
@@ -0,0 +1,11 @@
+// Generated automatically from freemarker.template.TemplateModelIterator for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateModel;
+
+public interface TemplateModelIterator
+{
+    TemplateModel next();
+    boolean hasNext();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateNodeModel.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateNodeModel.java
new file mode 100644
index 00000000000..7fa5e8d47b1
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateNodeModel.java
@@ -0,0 +1,15 @@
+// Generated automatically from freemarker.template.TemplateNodeModel for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateModel;
+import freemarker.template.TemplateSequenceModel;
+
+public interface TemplateNodeModel extends TemplateModel
+{
+    String getNodeName();
+    String getNodeNamespace();
+    String getNodeType();
+    TemplateNodeModel getParentNode();
+    TemplateSequenceModel getChildNodes();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateNumberModel.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateNumberModel.java
new file mode 100644
index 00000000000..4dc02739565
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateNumberModel.java
@@ -0,0 +1,10 @@
+// Generated automatically from freemarker.template.TemplateNumberModel for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateModel;
+
+public interface TemplateNumberModel extends TemplateModel
+{
+    Number getAsNumber();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateScalarModel.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateScalarModel.java
new file mode 100644
index 00000000000..e1bc2596503
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateScalarModel.java
@@ -0,0 +1,11 @@
+// Generated automatically from freemarker.template.TemplateScalarModel for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateModel;
+
+public interface TemplateScalarModel extends TemplateModel
+{
+    String getAsString();
+    static TemplateModel EMPTY_STRING = null;
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateSequenceModel.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateSequenceModel.java
new file mode 100644
index 00000000000..1caa1b019a2
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/TemplateSequenceModel.java
@@ -0,0 +1,11 @@
+// Generated automatically from freemarker.template.TemplateSequenceModel for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.TemplateModel;
+
+public interface TemplateSequenceModel extends TemplateModel
+{
+    TemplateModel get(int p0);
+    int size();
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/Version.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/Version.java
new file mode 100644
index 00000000000..9ec313b634c
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/Version.java
@@ -0,0 +1,27 @@
+// Generated automatically from freemarker.template.Version for testing purposes
+
+package freemarker.template;
+
+import java.io.Serializable;
+import java.util.Date;
+
+public class Version implements Serializable
+{
+    protected Version() {}
+    public Boolean isGAECompliant(){ return null; }
+    public Date getBuildDate(){ return null; }
+    public String getExtraInfo(){ return null; }
+    public String toString(){ return null; }
+    public Version(String p0){}
+    public Version(String p0, Boolean p1, Date p2){}
+    public Version(int p0){}
+    public Version(int p0, int p1, int p2){}
+    public Version(int p0, int p1, int p2, String p3, Boolean p4, Date p5){}
+    public boolean equals(Object p0){ return false; }
+    public int getMajor(){ return 0; }
+    public int getMicro(){ return 0; }
+    public int getMinor(){ return 0; }
+    public int hashCode(){ return 0; }
+    public int intValue(){ return 0; }
+    public static int intValueFor(int p0, int p1, int p2){ return 0; }
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/WrappingTemplateModel.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/WrappingTemplateModel.java
new file mode 100644
index 00000000000..a300f9aec05
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/WrappingTemplateModel.java
@@ -0,0 +1,17 @@
+// Generated automatically from freemarker.template.WrappingTemplateModel for testing purposes
+
+package freemarker.template;
+
+import freemarker.template.ObjectWrapper;
+import freemarker.template.TemplateModel;
+
+abstract public class WrappingTemplateModel
+{
+    protected WrappingTemplateModel(){}
+    protected WrappingTemplateModel(ObjectWrapper p0){}
+    protected final TemplateModel wrap(Object p0){ return null; }
+    public ObjectWrapper getObjectWrapper(){ return null; }
+    public static ObjectWrapper getDefaultObjectWrapper(){ return null; }
+    public static void setDefaultObjectWrapper(ObjectWrapper p0){}
+    public void setObjectWrapper(ObjectWrapper p0){}
+}
diff --git a/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/utility/ObjectFactory.java b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/utility/ObjectFactory.java
new file mode 100644
index 00000000000..43fa80d72f1
--- /dev/null
+++ b/java/ql/test/stubs/apache-freemarker-2.3.31/freemarker/template/utility/ObjectFactory.java
@@ -0,0 +1,9 @@
+// Generated automatically from freemarker.template.utility.ObjectFactory for testing purposes
+
+package freemarker.template.utility;
+
+
+public interface ObjectFactory<T>
+{
+    T createObject();
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/Template.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/Template.java
new file mode 100644
index 00000000000..e9c1ee00f41
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/Template.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.Template for testing purposes
+
+package org.apache.velocity;
+
+import java.io.Writer;
+import java.util.List;
+import java.util.Map;
+import org.apache.velocity.context.Context;
+import org.apache.velocity.runtime.resource.Resource;
+
+public class Template extends Resource
+{
+    public Map<String, Object> getMacros(){ return null; }
+    public Template(){}
+    public boolean process(){ return false; }
+    public void initDocument(){}
+    public void merge(Context p0, Writer p1){}
+    public void merge(Context p0, Writer p1, List<String> p2){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/VelocityContext.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/VelocityContext.java
new file mode 100644
index 00000000000..05ab45a2f8d
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/VelocityContext.java
@@ -0,0 +1,22 @@
+// Generated automatically from org.apache.velocity.VelocityContext for testing purposes
+
+package org.apache.velocity;
+
+import java.io.Serializable;
+import java.util.Map;
+import org.apache.velocity.context.AbstractContext;
+import org.apache.velocity.context.Context;
+
+public class VelocityContext extends AbstractContext implements Cloneable, Serializable
+{
+    public Object clone(){ return null; }
+    public Object internalGet(String p0){ return null; }
+    public Object internalPut(String p0, Object p1){ return null; }
+    public Object internalRemove(String p0){ return null; }
+    public String[] internalGetKeys(){ return null; }
+    public VelocityContext(){}
+    public VelocityContext(Context p0){}
+    public VelocityContext(Map<String, Object> p0){}
+    public VelocityContext(Map<String, Object> p0, Context p1){}
+    public boolean internalContainsKey(String p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/Velocity.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/Velocity.java
new file mode 100644
index 00000000000..0e388794c61
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/Velocity.java
@@ -0,0 +1,36 @@
+// Generated automatically from org.apache.velocity.app.Velocity for testing purposes
+
+package org.apache.velocity.app;
+
+import java.io.Reader;
+import java.io.Writer;
+import java.util.Properties;
+import org.apache.velocity.Template;
+import org.apache.velocity.context.Context;
+import org.apache.velocity.runtime.RuntimeConstants;
+import org.slf4j.Logger;
+
+public class Velocity implements RuntimeConstants
+{
+    public Velocity(){}
+    public static Logger getLog(){ return null; }
+    public static Object getProperty(String p0){ return null; }
+    public static Template getTemplate(String p0){ return null; }
+    public static Template getTemplate(String p0, String p1){ return null; }
+    public static boolean evaluate(Context p0, Writer p1, String p2, Reader p3){ return false; }
+    public static boolean evaluate(Context p0, Writer p1, String p2, String p3){ return false; }
+    public static boolean invokeVelocimacro(String p0, String p1, String[] p2, Context p3, Writer p4){ return false; }
+    public static boolean mergeTemplate(String p0, String p1, Context p2, Writer p3){ return false; }
+    public static boolean resourceExists(String p0){ return false; }
+    public static void addProperty(String p0, Object p1){}
+    public static void clearProperty(String p0){}
+    public static void init(){}
+    public static void init(Properties p0){}
+    public static void init(String p0){}
+    public static void reset(){}
+    public static void setApplicationAttribute(Object p0, Object p1){}
+    public static void setProperties(Properties p0){}
+    public static void setProperty(String p0, Object p1){}
+    public void loadDirective(String p0){}
+    public void removeDirective(String p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/VelocityEngine.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/VelocityEngine.java
new file mode 100644
index 00000000000..d692a1d7c34
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/VelocityEngine.java
@@ -0,0 +1,40 @@
+// Generated automatically from org.apache.velocity.app.VelocityEngine for testing purposes
+
+package org.apache.velocity.app;
+
+import java.io.Reader;
+import java.io.Writer;
+import java.util.Properties;
+import org.apache.velocity.Template;
+import org.apache.velocity.context.Context;
+import org.apache.velocity.runtime.RuntimeConstants;
+import org.slf4j.Logger;
+
+public class VelocityEngine implements RuntimeConstants
+{
+    public Logger getLog(){ return null; }
+    public Object getApplicationAttribute(Object p0){ return null; }
+    public Object getProperty(String p0){ return null; }
+    public Template getTemplate(String p0){ return null; }
+    public Template getTemplate(String p0, String p1){ return null; }
+    public VelocityEngine(){}
+    public VelocityEngine(Properties p0){}
+    public VelocityEngine(String p0){}
+    public boolean evaluate(Context p0, Writer p1, String p2, Reader p3){ return false; }
+    public boolean evaluate(Context p0, Writer p1, String p2, String p3){ return false; }
+    public boolean invokeVelocimacro(String p0, String p1, String[] p2, Context p3, Writer p4){ return false; }
+    public boolean mergeTemplate(String p0, String p1, Context p2, Writer p3){ return false; }
+    public boolean resourceExists(String p0){ return false; }
+    public void addProperty(String p0, Object p1){}
+    public void clearProperty(String p0){}
+    public void init(){}
+    public void init(Properties p0){}
+    public void init(String p0){}
+    public void loadDirective(String p0){}
+    public void removeDirective(String p0){}
+    public void reset(){}
+    public void setApplicationAttribute(Object p0, Object p1){}
+    public void setProperties(Properties p0){}
+    public void setProperties(String p0){}
+    public void setProperty(String p0, Object p1){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/EventCartridge.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/EventCartridge.java
new file mode 100644
index 00000000000..9a3cc037501
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/EventCartridge.java
@@ -0,0 +1,35 @@
+// Generated automatically from org.apache.velocity.app.event.EventCartridge for testing purposes
+
+package org.apache.velocity.app.event;
+
+import org.apache.velocity.app.event.EventHandler;
+import org.apache.velocity.app.event.IncludeEventHandler;
+import org.apache.velocity.app.event.InvalidReferenceEventHandler;
+import org.apache.velocity.app.event.MethodExceptionEventHandler;
+import org.apache.velocity.app.event.ReferenceInsertionEventHandler;
+import org.apache.velocity.context.Context;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.RuntimeServices;
+import org.apache.velocity.util.introspection.Info;
+import org.slf4j.Logger;
+
+public class EventCartridge
+{
+    protected Logger getLog(){ return null; }
+    protected RuntimeServices rsvc = null;
+    public EventCartridge(){}
+    public Object invalidGetMethod(Context p0, String p1, Object p2, String p3, Info p4){ return null; }
+    public Object invalidMethod(Context p0, String p1, Object p2, String p3, Info p4){ return null; }
+    public Object methodException(Context p0, Class<? extends Object> p1, String p2, Exception p3, Info p4){ return null; }
+    public Object referenceInsert(InternalContextAdapter p0, String p1, Object p2){ return null; }
+    public String includeEvent(Context p0, String p1, String p2, String p3){ return null; }
+    public boolean addEventHandler(EventHandler p0){ return false; }
+    public boolean invalidSetMethod(Context p0, String p1, String p2, Info p3){ return false; }
+    public boolean removeEventHandler(EventHandler p0){ return false; }
+    public final boolean attachToContext(Context p0){ return false; }
+    public void addIncludeEventHandler(IncludeEventHandler p0){}
+    public void addInvalidReferenceEventHandler(InvalidReferenceEventHandler p0){}
+    public void addMethodExceptionHandler(MethodExceptionEventHandler p0){}
+    public void addReferenceInsertionEventHandler(ReferenceInsertionEventHandler p0){}
+    public void setRuntimeServices(RuntimeServices p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/EventHandler.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/EventHandler.java
new file mode 100644
index 00000000000..d1cbae049ce
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/EventHandler.java
@@ -0,0 +1,8 @@
+// Generated automatically from org.apache.velocity.app.event.EventHandler for testing purposes
+
+package org.apache.velocity.app.event;
+
+
+public interface EventHandler
+{
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/IncludeEventHandler.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/IncludeEventHandler.java
new file mode 100644
index 00000000000..2b7cf756d2f
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/IncludeEventHandler.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.apache.velocity.app.event.IncludeEventHandler for testing purposes
+
+package org.apache.velocity.app.event;
+
+import org.apache.velocity.app.event.EventHandler;
+import org.apache.velocity.context.Context;
+
+public interface IncludeEventHandler extends EventHandler
+{
+    String includeEvent(Context p0, String p1, String p2, String p3);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/InvalidReferenceEventHandler.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/InvalidReferenceEventHandler.java
new file mode 100644
index 00000000000..224785a2183
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/InvalidReferenceEventHandler.java
@@ -0,0 +1,14 @@
+// Generated automatically from org.apache.velocity.app.event.InvalidReferenceEventHandler for testing purposes
+
+package org.apache.velocity.app.event;
+
+import org.apache.velocity.app.event.EventHandler;
+import org.apache.velocity.context.Context;
+import org.apache.velocity.util.introspection.Info;
+
+public interface InvalidReferenceEventHandler extends EventHandler
+{
+    Object invalidGetMethod(Context p0, String p1, Object p2, String p3, Info p4);
+    Object invalidMethod(Context p0, String p1, Object p2, String p3, Info p4);
+    boolean invalidSetMethod(Context p0, String p1, String p2, Info p3);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/MethodExceptionEventHandler.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/MethodExceptionEventHandler.java
new file mode 100644
index 00000000000..8d4d1b87a6b
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/MethodExceptionEventHandler.java
@@ -0,0 +1,12 @@
+// Generated automatically from org.apache.velocity.app.event.MethodExceptionEventHandler for testing purposes
+
+package org.apache.velocity.app.event;
+
+import org.apache.velocity.app.event.EventHandler;
+import org.apache.velocity.context.Context;
+import org.apache.velocity.util.introspection.Info;
+
+public interface MethodExceptionEventHandler extends EventHandler
+{
+    Object methodException(Context p0, Class<? extends Object> p1, String p2, Exception p3, Info p4);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/ReferenceInsertionEventHandler.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/ReferenceInsertionEventHandler.java
new file mode 100644
index 00000000000..a9002cc5d1c
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/app/event/ReferenceInsertionEventHandler.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.apache.velocity.app.event.ReferenceInsertionEventHandler for testing purposes
+
+package org.apache.velocity.app.event;
+
+import org.apache.velocity.app.event.EventHandler;
+import org.apache.velocity.context.Context;
+
+public interface ReferenceInsertionEventHandler extends EventHandler
+{
+    Object referenceInsert(Context p0, String p1, Object p2);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/AbstractContext.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/AbstractContext.java
new file mode 100644
index 00000000000..9c02132c2a6
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/AbstractContext.java
@@ -0,0 +1,23 @@
+// Generated automatically from org.apache.velocity.context.AbstractContext for testing purposes
+
+package org.apache.velocity.context;
+
+import org.apache.velocity.context.Context;
+import org.apache.velocity.context.InternalContextBase;
+
+abstract public class AbstractContext extends InternalContextBase implements Context
+{
+    public AbstractContext(){}
+    public AbstractContext(Context p0){}
+    public Context getChainedContext(){ return null; }
+    public Object get(String p0){ return null; }
+    public Object put(String p0, Object p1){ return null; }
+    public Object remove(String p0){ return null; }
+    public String[] getKeys(){ return null; }
+    public abstract Object internalGet(String p0);
+    public abstract Object internalPut(String p0, Object p1);
+    public abstract Object internalRemove(String p0);
+    public abstract String[] internalGetKeys();
+    public abstract boolean internalContainsKey(String p0);
+    public boolean containsKey(String p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/Context.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/Context.java
new file mode 100644
index 00000000000..f1bea35ff73
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/Context.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.apache.velocity.context.Context for testing purposes
+
+package org.apache.velocity.context;
+
+
+public interface Context
+{
+    Object get(String p0);
+    Object put(String p0, Object p1);
+    Object remove(String p0);
+    String[] getKeys();
+    boolean containsKey(String p0);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalContextAdapter.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalContextAdapter.java
new file mode 100644
index 00000000000..05503221609
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalContextAdapter.java
@@ -0,0 +1,12 @@
+// Generated automatically from org.apache.velocity.context.InternalContextAdapter for testing purposes
+
+package org.apache.velocity.context;
+
+import org.apache.velocity.context.Context;
+import org.apache.velocity.context.InternalEventContext;
+import org.apache.velocity.context.InternalHousekeepingContext;
+import org.apache.velocity.context.InternalWrapperContext;
+
+public interface InternalContextAdapter extends Context, InternalEventContext, InternalHousekeepingContext, InternalWrapperContext
+{
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalContextBase.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalContextBase.java
new file mode 100644
index 00000000000..bb8631a18f5
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalContextBase.java
@@ -0,0 +1,32 @@
+// Generated automatically from org.apache.velocity.context.InternalContextBase for testing purposes
+
+package org.apache.velocity.context;
+
+import java.util.List;
+import org.apache.velocity.Template;
+import org.apache.velocity.app.event.EventCartridge;
+import org.apache.velocity.context.InternalEventContext;
+import org.apache.velocity.context.InternalHousekeepingContext;
+import org.apache.velocity.runtime.resource.Resource;
+import org.apache.velocity.util.introspection.IntrospectionCacheData;
+
+class InternalContextBase implements InternalEventContext, InternalHousekeepingContext
+{
+    public EventCartridge attachEventCartridge(EventCartridge p0){ return null; }
+    public EventCartridge getEventCartridge(){ return null; }
+    public IntrospectionCacheData icacheGet(Object p0){ return null; }
+    public List<Template> getMacroLibraries(){ return null; }
+    public Resource getCurrentResource(){ return null; }
+    public String getCurrentMacroName(){ return null; }
+    public String getCurrentTemplateName(){ return null; }
+    public String[] getMacroNameStack(){ return null; }
+    public String[] getTemplateNameStack(){ return null; }
+    public int getCurrentMacroCallDepth(){ return 0; }
+    public void icachePut(Object p0, IntrospectionCacheData p1){}
+    public void popCurrentMacroName(){}
+    public void popCurrentTemplateName(){}
+    public void pushCurrentMacroName(String p0){}
+    public void pushCurrentTemplateName(String p0){}
+    public void setCurrentResource(Resource p0){}
+    public void setMacroLibraries(List<Template> p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalEventContext.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalEventContext.java
new file mode 100644
index 00000000000..04bdf83105d
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalEventContext.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.apache.velocity.context.InternalEventContext for testing purposes
+
+package org.apache.velocity.context;
+
+import org.apache.velocity.app.event.EventCartridge;
+
+public interface InternalEventContext
+{
+    EventCartridge attachEventCartridge(EventCartridge p0);
+    EventCartridge getEventCartridge();
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalHousekeepingContext.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalHousekeepingContext.java
new file mode 100644
index 00000000000..36c8a9c73ca
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalHousekeepingContext.java
@@ -0,0 +1,27 @@
+// Generated automatically from org.apache.velocity.context.InternalHousekeepingContext for testing purposes
+
+package org.apache.velocity.context;
+
+import java.util.List;
+import org.apache.velocity.Template;
+import org.apache.velocity.runtime.resource.Resource;
+import org.apache.velocity.util.introspection.IntrospectionCacheData;
+
+interface InternalHousekeepingContext
+{
+    IntrospectionCacheData icacheGet(Object p0);
+    List<Template> getMacroLibraries();
+    Resource getCurrentResource();
+    String getCurrentMacroName();
+    String getCurrentTemplateName();
+    String[] getMacroNameStack();
+    String[] getTemplateNameStack();
+    int getCurrentMacroCallDepth();
+    void icachePut(Object p0, IntrospectionCacheData p1);
+    void popCurrentMacroName();
+    void popCurrentTemplateName();
+    void pushCurrentMacroName(String p0);
+    void pushCurrentTemplateName(String p0);
+    void setCurrentResource(Resource p0);
+    void setMacroLibraries(List<Template> p0);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalWrapperContext.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalWrapperContext.java
new file mode 100644
index 00000000000..4e6a97dfc26
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/context/InternalWrapperContext.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.apache.velocity.context.InternalWrapperContext for testing purposes
+
+package org.apache.velocity.context;
+
+import org.apache.velocity.context.Context;
+import org.apache.velocity.context.InternalContextAdapter;
+
+public interface InternalWrapperContext
+{
+    Context getInternalUserContext();
+    InternalContextAdapter getBaseContext();
+    Object get(String p0);
+    Object put(String p0, Object p1);
+    boolean containsKey(String p0);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/DeprecatedRuntimeConstants.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/DeprecatedRuntimeConstants.java
new file mode 100644
index 00000000000..afc8bf8d3eb
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/DeprecatedRuntimeConstants.java
@@ -0,0 +1,48 @@
+// Generated automatically from org.apache.velocity.runtime.DeprecatedRuntimeConstants for testing purposes
+
+package org.apache.velocity.runtime;
+
+
+public interface DeprecatedRuntimeConstants
+{
+    static String OLD_CHECK_EMPTY_OBJECTS = null;
+    static String OLD_CONTEXT_AUTOREFERENCE_KEY = null;
+    static String OLD_CONVERSION_HANDLER_CLASS = null;
+    static String OLD_CUSTOM_DIRECTIVES = null;
+    static String OLD_DEFINE_DIRECTIVE_MAXDEPTH = null;
+    static String OLD_DS_RESOURCE_LOADER_DATASOURCE = null;
+    static String OLD_DS_RESOURCE_LOADER_KEY_COLUMN = null;
+    static String OLD_DS_RESOURCE_LOADER_TEMPLATE_COLUMN = null;
+    static String OLD_DS_RESOURCE_LOADER_TIMESTAMP_COLUMN = null;
+    static String OLD_ERRORMSG_END = null;
+    static String OLD_ERRORMSG_START = null;
+    static String OLD_EVENTHANDLER_INCLUDE = null;
+    static String OLD_EVENTHANDLER_INVALIDREFERENCES = null;
+    static String OLD_EVENTHANDLER_METHODEXCEPTION = null;
+    static String OLD_EVENTHANDLER_REFERENCEINSERTION = null;
+    static String OLD_FILE_RESOURCE_LOADER_CACHE = null;
+    static String OLD_FILE_RESOURCE_LOADER_PATH = null;
+    static String OLD_INPUT_ENCODING = null;
+    static String OLD_INTERPOLATE_STRINGLITERALS = null;
+    static String OLD_MAX_NUMBER_LOOPS = null;
+    static String OLD_PARSE_DIRECTIVE_MAXDEPTH = null;
+    static String OLD_RESOURCE_LOADERS = null;
+    static String OLD_RESOURCE_LOADER_CHECK_INTERVAL = null;
+    static String OLD_RESOURCE_MANAGER_DEFAULTCACHE_SIZE = null;
+    static String OLD_RESOURCE_MANAGER_LOGWHENFOUND = null;
+    static String OLD_RUNTIME_LOG_REFERENCE_LOG_INVALID = null;
+    static String OLD_RUNTIME_REFERENCES_STRICT = null;
+    static String OLD_RUNTIME_REFERENCES_STRICT_ESCAPE = null;
+    static String OLD_SKIP_INVALID_ITERATOR = null;
+    static String OLD_SPACE_GOBBLING = null;
+    static String OLD_STRICT_MATH = null;
+    static String OLD_UBERSPECT_CLASSNAME = null;
+    static String OLD_VM_BODY_REFERENCE = null;
+    static String OLD_VM_ENABLE_BC_MODE = null;
+    static String OLD_VM_LIBRARY = null;
+    static String OLD_VM_LIBRARY_DEFAULT = null;
+    static String OLD_VM_MAX_DEPTH = null;
+    static String OLD_VM_PERM_ALLOW_INLINE = null;
+    static String OLD_VM_PERM_ALLOW_INLINE_REPLACE_GLOBAL = null;
+    static String OLD_VM_PERM_INLINE_LOCAL = null;
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/ParserConfiguration.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/ParserConfiguration.java
new file mode 100644
index 00000000000..f46167b4e1b
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/ParserConfiguration.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.apache.velocity.runtime.ParserConfiguration for testing purposes
+
+package org.apache.velocity.runtime;
+
+
+public class ParserConfiguration
+{
+    public ParserConfiguration(){}
+    public char getAsteriskChar(){ return '0'; }
+    public char getAtChar(){ return '0'; }
+    public char getDollarChar(){ return '0'; }
+    public char getHashChar(){ return '0'; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/Renderable.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/Renderable.java
new file mode 100644
index 00000000000..1cf682b4b0b
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/Renderable.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.apache.velocity.runtime.Renderable for testing purposes
+
+package org.apache.velocity.runtime;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+
+public interface Renderable
+{
+    boolean render(InternalContextAdapter p0, Writer p1);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/RuntimeConstants.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/RuntimeConstants.java
new file mode 100644
index 00000000000..0a8b4229fdc
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/RuntimeConstants.java
@@ -0,0 +1,90 @@
+// Generated automatically from org.apache.velocity.runtime.RuntimeConstants for testing purposes
+
+package org.apache.velocity.runtime;
+
+import org.apache.velocity.runtime.DeprecatedRuntimeConstants;
+
+public interface RuntimeConstants extends DeprecatedRuntimeConstants
+{
+    static String CHECK_EMPTY_OBJECTS = null;
+    static String CONTEXT_AUTOREFERENCE_KEY = null;
+    static String CONTEXT_SCOPE_CONTROL = null;
+    static String CONVERSION_HANDLER_CLASS = null;
+    static String CONVERSION_HANDLER_INSTANCE = null;
+    static String CUSTOM_DIRECTIVES = null;
+    static String DEFAULT_PARSER_CLASS = null;
+    static String DEFAULT_RUNTIME_DIRECTIVES = null;
+    static String DEFAULT_RUNTIME_LOG_NAME = null;
+    static String DEFAULT_RUNTIME_PROPERTIES = null;
+    static String DEFINE_DIRECTIVE_MAXDEPTH = null;
+    static String DS_RESOURCE_LOADER_DATASOURCE = null;
+    static String DS_RESOURCE_LOADER_KEY_COLUMN = null;
+    static String DS_RESOURCE_LOADER_TABLE = null;
+    static String DS_RESOURCE_LOADER_TEMPLATE_COLUMN = null;
+    static String DS_RESOURCE_LOADER_TIMESTAMP_COLUMN = null;
+    static String ENCODING_DEFAULT = null;
+    static String ERRORMSG_END = null;
+    static String ERRORMSG_START = null;
+    static String EVENTHANDLER_INCLUDE = null;
+    static String EVENTHANDLER_INVALIDREFERENCES = null;
+    static String EVENTHANDLER_INVALIDREFERENCES_NULL = null;
+    static String EVENTHANDLER_INVALIDREFERENCES_QUIET = null;
+    static String EVENTHANDLER_INVALIDREFERENCES_TESTED = null;
+    static String EVENTHANDLER_METHODEXCEPTION = null;
+    static String EVENTHANDLER_REFERENCEINSERTION = null;
+    static String FILE_RESOURCE_LOADER_CACHE = null;
+    static String FILE_RESOURCE_LOADER_PATH = null;
+    static String INPUT_ENCODING = null;
+    static String INTERPOLATE_STRINGLITERALS = null;
+    static String INTROSPECTOR_RESTRICT_CLASSES = null;
+    static String INTROSPECTOR_RESTRICT_PACKAGES = null;
+    static String MAX_NUMBER_LOOPS = null;
+    static String PARSER_CLASS = null;
+    static String PARSER_HYPHEN_ALLOWED = null;
+    static String PARSER_POOL_CLASS = null;
+    static String PARSER_POOL_SIZE = null;
+    static String PARSE_DIRECTIVE_MAXDEPTH = null;
+    static String PROVIDE_SCOPE_CONTROL = null;
+    static String RESOURCE_LOADER = null;
+    static String RESOURCE_LOADERS = null;
+    static String RESOURCE_LOADER_CACHE = null;
+    static String RESOURCE_LOADER_CHECK_INTERVAL = null;
+    static String RESOURCE_LOADER_CLASS = null;
+    static String RESOURCE_LOADER_IDENTIFIER = null;
+    static String RESOURCE_LOADER_INSTANCE = null;
+    static String RESOURCE_LOADER_PATHS = null;
+    static String RESOURCE_MANAGER_CACHE_CLASS = null;
+    static String RESOURCE_MANAGER_CLASS = null;
+    static String RESOURCE_MANAGER_DEFAULTCACHE_SIZE = null;
+    static String RESOURCE_MANAGER_INSTANCE = null;
+    static String RESOURCE_MANAGER_LOGWHENFOUND = null;
+    static String RUNTIME_LOG_INSTANCE = null;
+    static String RUNTIME_LOG_METHOD_CALL_LOG_INVALID = null;
+    static String RUNTIME_LOG_NAME = null;
+    static String RUNTIME_LOG_REFERENCE_LOG_INVALID = null;
+    static String RUNTIME_LOG_TRACK_LOCATION = null;
+    static String RUNTIME_REFERENCES_STRICT = null;
+    static String RUNTIME_REFERENCES_STRICT_ESCAPE = null;
+    static String RUNTIME_STRING_INTERNING = null;
+    static String SKIP_INVALID_ITERATOR = null;
+    static String SPACE_GOBBLING = null;
+    static String STRICT_MATH = null;
+    static String UBERSPECT_CLASSNAME = null;
+    static String VM_ARGUMENTS_STRICT = null;
+    static String VM_BODY_REFERENCE = null;
+    static String VM_ENABLE_BC_MODE = null;
+    static String VM_LIBRARY = null;
+    static String VM_LIBRARY_AUTORELOAD = null;
+    static String VM_LIBRARY_DEFAULT = null;
+    static String VM_MAX_DEPTH = null;
+    static String VM_MESSAGES_ON = null;
+    static String VM_PERM_ALLOW_INLINE = null;
+    static String VM_PERM_ALLOW_INLINE_REPLACE_GLOBAL = null;
+    static String VM_PERM_INLINE_LOCAL = null;
+    static int NUMBER_OF_PARSERS = 0;
+    static public enum SpaceGobbling
+    {
+        BC, LINES, NONE, STRUCTURED;
+        private SpaceGobbling() {}
+    }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/RuntimeServices.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/RuntimeServices.java
new file mode 100644
index 00000000000..34e2f8ade7a
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/RuntimeServices.java
@@ -0,0 +1,68 @@
+// Generated automatically from org.apache.velocity.runtime.RuntimeServices for testing purposes
+
+package org.apache.velocity.runtime;
+
+import java.io.Reader;
+import java.io.Writer;
+import java.util.List;
+import java.util.Properties;
+import org.apache.velocity.Template;
+import org.apache.velocity.app.event.EventCartridge;
+import org.apache.velocity.context.Context;
+import org.apache.velocity.runtime.ParserConfiguration;
+import org.apache.velocity.runtime.RuntimeConstants;
+import org.apache.velocity.runtime.directive.Directive;
+import org.apache.velocity.runtime.directive.Macro;
+import org.apache.velocity.runtime.parser.LogContext;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.Node;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+import org.apache.velocity.runtime.resource.ContentResource;
+import org.apache.velocity.util.ExtProperties;
+import org.apache.velocity.util.introspection.Uberspect;
+import org.slf4j.Logger;
+
+public interface RuntimeServices
+{
+    ContentResource getContent(String p0);
+    ContentResource getContent(String p0, String p1);
+    Directive getDirective(String p0);
+    Directive getVelocimacro(String p0, Template p1, Template p2);
+    EventCartridge getApplicationEventCartridge();
+    ExtProperties getConfiguration();
+    LogContext getLogContext();
+    Logger getLog();
+    Logger getLog(String p0);
+    Object getApplicationAttribute(Object p0);
+    Object getProperty(String p0);
+    Object setApplicationAttribute(Object p0, Object p1);
+    Parser createNewParser();
+    ParserConfiguration getParserConfiguration();
+    RuntimeConstants.SpaceGobbling getSpaceGobbling();
+    SimpleNode parse(Reader p0, Template p1);
+    String getLoaderNameForResource(String p0);
+    String getString(String p0);
+    String getString(String p0, String p1);
+    Template getTemplate(String p0);
+    Template getTemplate(String p0, String p1);
+    Uberspect getUberspect();
+    boolean addVelocimacro(String p0, Node p1, List<Macro.MacroArg> p2, Template p3);
+    boolean evaluate(Context p0, Writer p1, String p2, Reader p3);
+    boolean evaluate(Context p0, Writer p1, String p2, String p3);
+    boolean getBoolean(String p0, boolean p1);
+    boolean invokeVelocimacro(String p0, String p1, String[] p2, Context p3, Writer p4);
+    boolean isHyphenAllowedInIdentifiers();
+    boolean isInitialized();
+    boolean isScopeControlEnabled(String p0);
+    boolean isVelocimacro(String p0, Template p1);
+    boolean useStringInterning();
+    int getInt(String p0);
+    int getInt(String p0, int p1);
+    void addProperty(String p0, Object p1);
+    void clearProperty(String p0);
+    void init();
+    void init(Properties p0);
+    void init(String p0);
+    void setConfiguration(ExtProperties p0);
+    void setProperty(String p0, Object p1);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/Directive.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/Directive.java
new file mode 100644
index 00000000000..d4eeebb7265
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/Directive.java
@@ -0,0 +1,37 @@
+// Generated automatically from org.apache.velocity.runtime.directive.Directive for testing purposes
+
+package org.apache.velocity.runtime.directive;
+
+import java.io.Writer;
+import java.util.ArrayList;
+import org.apache.velocity.Template;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.RuntimeServices;
+import org.apache.velocity.runtime.directive.DirectiveConstants;
+import org.apache.velocity.runtime.directive.Scope;
+import org.apache.velocity.runtime.parser.Token;
+import org.apache.velocity.runtime.parser.node.Node;
+import org.slf4j.Logger;
+
+abstract public class Directive implements Cloneable, DirectiveConstants
+{
+    protected Logger log = null;
+    protected RuntimeServices rsvc = null;
+    protected Scope makeScope(Object p0){ return null; }
+    protected void postRender(InternalContextAdapter p0){}
+    protected void preRender(InternalContextAdapter p0){}
+    public Directive(){}
+    public String getScopeName(){ return null; }
+    public String getTemplateName(){ return null; }
+    public Template getTemplate(){ return null; }
+    public abstract String getName();
+    public abstract boolean render(InternalContextAdapter p0, Writer p1, Node p2);
+    public abstract int getType();
+    public boolean isScopeProvided(){ return false; }
+    public int getColumn(){ return 0; }
+    public int getLine(){ return 0; }
+    public void checkArgs(ArrayList<Integer> p0, Token p1, String p2){}
+    public void init(RuntimeServices p0, InternalContextAdapter p1, Node p2){}
+    public void setLocation(int p0, int p1){}
+    public void setLocation(int p0, int p1, Template p2){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/DirectiveConstants.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/DirectiveConstants.java
new file mode 100644
index 00000000000..4a87866e1cb
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/DirectiveConstants.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.apache.velocity.runtime.directive.DirectiveConstants for testing purposes
+
+package org.apache.velocity.runtime.directive;
+
+
+public interface DirectiveConstants
+{
+    static int BLOCK = 0;
+    static int LINE = 0;
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/Macro.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/Macro.java
new file mode 100644
index 00000000000..4cfbd60617b
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/Macro.java
@@ -0,0 +1,30 @@
+// Generated automatically from org.apache.velocity.runtime.directive.Macro for testing purposes
+
+package org.apache.velocity.runtime.directive;
+
+import java.io.Writer;
+import java.util.ArrayList;
+import java.util.List;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.RuntimeServices;
+import org.apache.velocity.runtime.directive.Directive;
+import org.apache.velocity.runtime.parser.Token;
+import org.apache.velocity.runtime.parser.node.Node;
+
+public class Macro extends Directive
+{
+    public Macro(){}
+    public String getName(){ return null; }
+    public boolean isScopeProvided(){ return false; }
+    public boolean render(InternalContextAdapter p0, Writer p1, Node p2){ return false; }
+    public int getType(){ return 0; }
+    public static StringBuilder macroToString(StringBuilder p0, List<Macro.MacroArg> p1, RuntimeServices p2){ return null; }
+    public void checkArgs(ArrayList<Integer> p0, Token p1, String p2){}
+    public void init(RuntimeServices p0, InternalContextAdapter p1, Node p2){}
+    static public class MacroArg
+    {
+        public MacroArg(){}
+        public Node defaultVal = null;
+        public String name = null;
+    }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/Scope.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/Scope.java
new file mode 100644
index 00000000000..984ff3e0e13
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/directive/Scope.java
@@ -0,0 +1,36 @@
+// Generated automatically from org.apache.velocity.runtime.directive.Scope for testing purposes
+
+package org.apache.velocity.runtime.directive;
+
+import java.util.AbstractMap;
+import java.util.Map;
+import java.util.Set;
+
+public class Scope extends AbstractMap<Object, Object>
+{
+    protected Scope() {}
+    protected final Object owner = null;
+    protected int getDepth(){ return 0; }
+    protected void stop(){}
+    public Object get(Object p0){ return null; }
+    public Object getReplaced(){ return null; }
+    public Object put(Object p0, Object p1){ return null; }
+    public Scope getParent(){ return null; }
+    public Scope getTopmost(){ return null; }
+    public Scope(Object p0, Object p1){}
+    public Scope.Info getInfo(){ return null; }
+    public Set<Map.Entry<Object, Object>> entrySet(){ return null; }
+    public String set(Object p0, Object p1){ return null; }
+    static public class Info
+    {
+        protected Info() {}
+        public Info(Scope p0, Object p1){}
+        public String getName(){ return null; }
+        public String getTemplate(){ return null; }
+        public String getType(){ return null; }
+        public String toString(){ return null; }
+        public int getColumn(){ return 0; }
+        public int getDepth(){ return 0; }
+        public int getLine(){ return 0; }
+    }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/CharStream.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/CharStream.java
new file mode 100644
index 00000000000..1967bf41121
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/CharStream.java
@@ -0,0 +1,18 @@
+// Generated automatically from org.apache.velocity.runtime.parser.CharStream for testing purposes
+
+package org.apache.velocity.runtime.parser;
+
+
+public interface CharStream
+{
+    String GetImage();
+    char BeginToken();
+    char readChar();
+    char[] GetSuffix(int p0);
+    int getBeginColumn();
+    int getBeginLine();
+    int getEndColumn();
+    int getEndLine();
+    void Done();
+    void backup(int p0);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/LogContext.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/LogContext.java
new file mode 100644
index 00000000000..93d81c67c0f
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/LogContext.java
@@ -0,0 +1,20 @@
+// Generated automatically from org.apache.velocity.runtime.parser.LogContext for testing purposes
+
+package org.apache.velocity.runtime.parser;
+
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+import org.apache.velocity.util.introspection.Info;
+import org.slf4j.Logger;
+
+public class LogContext
+{
+    protected LogContext() {}
+    protected static Logger logger = null;
+    public LogContext(boolean p0){}
+    public String[] getStackTrace(){ return null; }
+    public static String MDC_COLUMN = null;
+    public static String MDC_FILE = null;
+    public static String MDC_LINE = null;
+    public void popLogContext(){}
+    public void pushLogContext(SimpleNode p0, Info p1){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/Parser.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/Parser.java
new file mode 100644
index 00000000000..b2000f639d9
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/Parser.java
@@ -0,0 +1,29 @@
+// Generated automatically from org.apache.velocity.runtime.parser.Parser for testing purposes
+
+package org.apache.velocity.runtime.parser;
+
+import java.io.Reader;
+import org.apache.velocity.Template;
+import org.apache.velocity.runtime.RuntimeServices;
+import org.apache.velocity.runtime.directive.Directive;
+import org.apache.velocity.runtime.parser.CharStream;
+import org.apache.velocity.runtime.parser.Token;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public interface Parser
+{
+    Directive getDirective(String p0);
+    RuntimeServices getRuntimeServices();
+    SimpleNode parse(Reader p0, Template p1);
+    Template getCurrentTemplate();
+    Token getToken(int p0);
+    boolean isDirective(String p0);
+    char asterisk();
+    char at();
+    char dollar();
+    char hash();
+    default String blockComment(){ return null; }
+    default String lineComment(){ return null; }
+    void ReInit(CharStream p0);
+    void resetCurrentTemplate();
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/Token.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/Token.java
new file mode 100644
index 00000000000..43b3aa839fc
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/Token.java
@@ -0,0 +1,24 @@
+// Generated automatically from org.apache.velocity.runtime.parser.Token for testing purposes
+
+package org.apache.velocity.runtime.parser;
+
+import java.io.Serializable;
+
+public class Token implements Serializable
+{
+    public Object getValue(){ return null; }
+    public String image = null;
+    public String toString(){ return null; }
+    public Token next = null;
+    public Token specialToken = null;
+    public Token(){}
+    public Token(int p0){}
+    public Token(int p0, String p1){}
+    public int beginColumn = 0;
+    public int beginLine = 0;
+    public int endColumn = 0;
+    public int endLine = 0;
+    public int kind = 0;
+    public static Token newToken(int p0){ return null; }
+    public static Token newToken(int p0, String p1){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTAddNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTAddNode.java
new file mode 100644
index 00000000000..8f52a48e38b
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTAddNode.java
@@ -0,0 +1,17 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTAddNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTMathNode;
+
+public class ASTAddNode extends ASTMathNode
+{
+    protected ASTAddNode() {}
+    protected Object handleSpecial(Object p0, Object p1, InternalContextAdapter p2){ return null; }
+    public ASTAddNode(Parser p0, int p1){}
+    public ASTAddNode(int p0){}
+    public Number perform(Number p0, Number p1, InternalContextAdapter p2){ return null; }
+    public String getLiteralOperator(){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTAndNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTAndNode.java
new file mode 100644
index 00000000000..592b698aa13
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTAndNode.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTAndNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTLogicalOperator;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+
+public class ASTAndNode extends ASTLogicalOperator
+{
+    protected ASTAndNode() {}
+    public ASTAndNode(Parser p0, int p1){}
+    public ASTAndNode(int p0){}
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public String getLiteralOperator(){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTAssignment.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTAssignment.java
new file mode 100644
index 00000000000..939dcb12a85
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTAssignment.java
@@ -0,0 +1,17 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTAssignment for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTAssignment extends SimpleNode
+{
+    protected ASTAssignment() {}
+    public ASTAssignment(Parser p0, int p1){}
+    public ASTAssignment(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTBinaryOperator.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTBinaryOperator.java
new file mode 100644
index 00000000000..562653b7973
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTBinaryOperator.java
@@ -0,0 +1,17 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTBinaryOperator for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+abstract public class ASTBinaryOperator extends SimpleNode
+{
+    protected ASTBinaryOperator() {}
+    public ASTBinaryOperator(Parser p0, int p1){}
+    public ASTBinaryOperator(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public String literal(){ return null; }
+    public abstract String getLiteralOperator();
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTBlock.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTBlock.java
new file mode 100644
index 00000000000..0a6bdb2defd
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTBlock.java
@@ -0,0 +1,25 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTBlock for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTBlock extends SimpleNode
+{
+    protected ASTBlock() {}
+    public ASTBlock(Parser p0, int p1){}
+    public ASTBlock(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public String getPostfix(){ return null; }
+    public String getPrefix(){ return null; }
+    public boolean endsWithNewline = false;
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+    public void setMorePostfix(String p0){}
+    public void setPostfix(String p0){}
+    public void setPrefix(String p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTComment.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTComment.java
new file mode 100644
index 00000000000..64e939be79a
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTComment.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTComment for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTComment extends SimpleNode
+{
+    protected ASTComment() {}
+    public ASTComment(Parser p0, int p1){}
+    public ASTComment(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTComparisonNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTComparisonNode.java
new file mode 100644
index 00000000000..e6b79c30aeb
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTComparisonNode.java
@@ -0,0 +1,23 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTComparisonNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTBinaryOperator;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+
+abstract public class ASTComparisonNode extends ASTBinaryOperator
+{
+    protected ASTComparisonNode() {}
+    public ASTComparisonNode(Parser p0, int p1){}
+    public ASTComparisonNode(int p0){}
+    public Boolean compareNumbers(Object p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public abstract String getLiteralOperator();
+    public abstract boolean numberTest(int p0);
+    public boolean compareNonNumber(Object p0, Object p1){ return false; }
+    public boolean compareNull(Object p0, Object p1){ return false; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTDirective.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTDirective.java
new file mode 100644
index 00000000000..a858fa889ac
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTDirective.java
@@ -0,0 +1,29 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTDirective for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTDirective extends SimpleNode
+{
+    protected ASTDirective() {}
+    public ASTDirective(Parser p0, int p1){}
+    public ASTDirective(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public String getDirectiveName(){ return null; }
+    public String getMorePrefix(){ return null; }
+    public String getPostfix(){ return null; }
+    public String getPrefix(){ return null; }
+    public String literal(){ return null; }
+    public String toString(){ return null; }
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+    public int getDirectiveType(){ return 0; }
+    public void setDirectiveName(String p0){}
+    public void setPostfix(String p0){}
+    public void setPrefix(String p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTDirectiveAssign.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTDirectiveAssign.java
new file mode 100644
index 00000000000..4f53e3dc0e1
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTDirectiveAssign.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTDirectiveAssign for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTDirectiveAssign extends SimpleNode
+{
+    protected ASTDirectiveAssign() {}
+    public ASTDirectiveAssign(Parser p0, int p1){}
+    public ASTDirectiveAssign(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTDivNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTDivNode.java
new file mode 100644
index 00000000000..e70c2e9c527
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTDivNode.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTDivNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTMathNode;
+
+public class ASTDivNode extends ASTMathNode
+{
+    protected ASTDivNode() {}
+    public ASTDivNode(Parser p0, int p1){}
+    public ASTDivNode(int p0){}
+    public Number perform(Number p0, Number p1, InternalContextAdapter p2){ return null; }
+    public String getLiteralOperator(){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTEQNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTEQNode.java
new file mode 100644
index 00000000000..02ac260c7e1
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTEQNode.java
@@ -0,0 +1,17 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTEQNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTComparisonNode;
+
+public class ASTEQNode extends ASTComparisonNode
+{
+    protected ASTEQNode() {}
+    public ASTEQNode(Parser p0, int p1){}
+    public ASTEQNode(int p0){}
+    public String getLiteralOperator(){ return null; }
+    public boolean compareNonNumber(Object p0, Object p1){ return false; }
+    public boolean compareNull(Object p0, Object p1){ return false; }
+    public boolean numberTest(int p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTElseIfStatement.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTElseIfStatement.java
new file mode 100644
index 00000000000..e96fbf638e1
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTElseIfStatement.java
@@ -0,0 +1,20 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTElseIfStatement for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTElseIfStatement extends SimpleNode
+{
+    protected ASTElseIfStatement() {}
+    public ASTElseIfStatement(Parser p0, int p1){}
+    public ASTElseIfStatement(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTElseStatement.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTElseStatement.java
new file mode 100644
index 00000000000..e7c114b9d25
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTElseStatement.java
@@ -0,0 +1,18 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTElseStatement for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTElseStatement extends SimpleNode
+{
+    protected ASTElseStatement() {}
+    public ASTElseStatement(Parser p0, int p1){}
+    public ASTElseStatement(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTEscape.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTEscape.java
new file mode 100644
index 00000000000..32dc06a188c
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTEscape.java
@@ -0,0 +1,20 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTEscape for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTEscape extends SimpleNode
+{
+    protected ASTEscape() {}
+    public ASTEscape(Parser p0, int p1){}
+    public ASTEscape(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public String val = null;
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTEscapedDirective.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTEscapedDirective.java
new file mode 100644
index 00000000000..10eb77a1315
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTEscapedDirective.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTEscapedDirective for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTEscapedDirective extends SimpleNode
+{
+    protected ASTEscapedDirective() {}
+    public ASTEscapedDirective(Parser p0, int p1){}
+    public ASTEscapedDirective(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTExpression.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTExpression.java
new file mode 100644
index 00000000000..65ccd478b09
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTExpression.java
@@ -0,0 +1,20 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTExpression for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTExpression extends SimpleNode
+{
+    protected ASTExpression() {}
+    public ASTExpression(Parser p0, int p1){}
+    public ASTExpression(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public String literal(){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTFalse.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTFalse.java
new file mode 100644
index 00000000000..d796d315a71
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTFalse.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTFalse for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTFalse extends SimpleNode
+{
+    protected ASTFalse() {}
+    public ASTFalse(Parser p0, int p1){}
+    public ASTFalse(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTFloatingPointLiteral.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTFloatingPointLiteral.java
new file mode 100644
index 00000000000..fd00f3a975b
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTFloatingPointLiteral.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTFloatingPointLiteral for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTFloatingPointLiteral extends SimpleNode
+{
+    protected ASTFloatingPointLiteral() {}
+    public ASTFloatingPointLiteral(Parser p0, int p1){}
+    public ASTFloatingPointLiteral(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTGENode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTGENode.java
new file mode 100644
index 00000000000..6a1264422b4
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTGENode.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTGENode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTComparisonNode;
+
+public class ASTGENode extends ASTComparisonNode
+{
+    protected ASTGENode() {}
+    public ASTGENode(Parser p0, int p1){}
+    public ASTGENode(int p0){}
+    public String getLiteralOperator(){ return null; }
+    public boolean numberTest(int p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTGTNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTGTNode.java
new file mode 100644
index 00000000000..048363b3bad
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTGTNode.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTGTNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTComparisonNode;
+
+public class ASTGTNode extends ASTComparisonNode
+{
+    protected ASTGTNode() {}
+    public ASTGTNode(Parser p0, int p1){}
+    public ASTGTNode(int p0){}
+    public String getLiteralOperator(){ return null; }
+    public boolean numberTest(int p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIdentifier.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIdentifier.java
new file mode 100644
index 00000000000..dd4dc5efc3e
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIdentifier.java
@@ -0,0 +1,23 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTIdentifier for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+import org.apache.velocity.util.introspection.Info;
+
+public class ASTIdentifier extends SimpleNode
+{
+    protected ASTIdentifier() {}
+    protected Info uberInfo = null;
+    protected boolean strictRef = false;
+    public ASTIdentifier(Parser p0, int p1){}
+    public ASTIdentifier(int p0){}
+    public Object execute(Object p0, InternalContextAdapter p1){ return null; }
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public String getIdentifier(){ return null; }
+    public String literal(){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIfStatement.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIfStatement.java
new file mode 100644
index 00000000000..3a8d07a469c
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIfStatement.java
@@ -0,0 +1,24 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTIfStatement for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTIfStatement extends SimpleNode
+{
+    protected ASTIfStatement() {}
+    public ASTIfStatement(Parser p0, int p1){}
+    public ASTIfStatement(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public String getPostfix(){ return null; }
+    public String getPrefix(){ return null; }
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+    public void process(InternalContextAdapter p0, ParserVisitor p1){}
+    public void setPostfix(String p0){}
+    public void setPrefix(String p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIndex.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIndex.java
new file mode 100644
index 00000000000..5315b176214
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIndex.java
@@ -0,0 +1,18 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTIndex for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTIndex extends SimpleNode
+{
+    protected ASTIndex() {}
+    protected boolean strictRef = false;
+    public ASTIndex(Parser p0, int p1){}
+    public ASTIndex(int p0){}
+    public Object execute(Object p0, InternalContextAdapter p1){ return null; }
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public static Object adjMinusIndexArg(Object p0, Object p1, InternalContextAdapter p2, SimpleNode p3){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIntegerLiteral.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIntegerLiteral.java
new file mode 100644
index 00000000000..94a2b36f24d
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIntegerLiteral.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTIntegerLiteral for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTIntegerLiteral extends SimpleNode
+{
+    protected ASTIntegerLiteral() {}
+    public ASTIntegerLiteral(Parser p0, int p1){}
+    public ASTIntegerLiteral(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIntegerRange.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIntegerRange.java
new file mode 100644
index 00000000000..3fa3aead0c0
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTIntegerRange.java
@@ -0,0 +1,18 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTIntegerRange for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTIntegerRange extends SimpleNode
+{
+    protected ASTIntegerRange() {}
+    public ASTIntegerRange(Parser p0, int p1){}
+    public ASTIntegerRange(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTLENode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTLENode.java
new file mode 100644
index 00000000000..0997267789e
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTLENode.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTLENode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTComparisonNode;
+
+public class ASTLENode extends ASTComparisonNode
+{
+    protected ASTLENode() {}
+    public ASTLENode(Parser p0, int p1){}
+    public ASTLENode(int p0){}
+    public String getLiteralOperator(){ return null; }
+    public boolean numberTest(int p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTLTNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTLTNode.java
new file mode 100644
index 00000000000..df7065beca8
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTLTNode.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTLTNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTComparisonNode;
+
+public class ASTLTNode extends ASTComparisonNode
+{
+    protected ASTLTNode() {}
+    public ASTLTNode(Parser p0, int p1){}
+    public ASTLTNode(int p0){}
+    public String getLiteralOperator(){ return null; }
+    public boolean numberTest(int p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTLogicalOperator.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTLogicalOperator.java
new file mode 100644
index 00000000000..66f3a8378ce
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTLogicalOperator.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTLogicalOperator for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTBinaryOperator;
+
+abstract public class ASTLogicalOperator extends ASTBinaryOperator
+{
+    protected ASTLogicalOperator() {}
+    public ASTLogicalOperator(Parser p0, int p1){}
+    public ASTLogicalOperator(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMap.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMap.java
new file mode 100644
index 00000000000..86c4ed8d11c
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMap.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTMap for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTMap extends SimpleNode
+{
+    protected ASTMap() {}
+    public ASTMap(Parser p0, int p1){}
+    public ASTMap(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMathNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMathNode.java
new file mode 100644
index 00000000000..f2eb33fbb5b
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMathNode.java
@@ -0,0 +1,21 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTMathNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTBinaryOperator;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+
+abstract public class ASTMathNode extends ASTBinaryOperator
+{
+    protected ASTMathNode() {}
+    protected Object handleSpecial(Object p0, Object p1, InternalContextAdapter p2){ return null; }
+    protected boolean strictMode = false;
+    public ASTMathNode(Parser p0, int p1){}
+    public ASTMathNode(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public abstract Number perform(Number p0, Number p1, InternalContextAdapter p2);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMethod.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMethod.java
new file mode 100644
index 00000000000..8cf9d8afd47
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMethod.java
@@ -0,0 +1,23 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTMethod for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+import org.apache.velocity.util.introspection.Info;
+
+public class ASTMethod extends SimpleNode
+{
+    protected ASTMethod() {}
+    protected Info uberInfo = null;
+    protected boolean strictRef = false;
+    public ASTMethod(Parser p0, int p1){}
+    public ASTMethod(int p0){}
+    public Object execute(Object p0, InternalContextAdapter p1){ return null; }
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public String getMethodName(){ return null; }
+    public String literal(){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTModNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTModNode.java
new file mode 100644
index 00000000000..dfc4ac2a6dd
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTModNode.java
@@ -0,0 +1,17 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTModNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTMathNode;
+
+public class ASTModNode extends ASTMathNode
+{
+    protected ASTModNode() {}
+    public ASTModNode(Parser p0, int p1){}
+    public ASTModNode(int p0){}
+    public Number perform(Number p0, Number p1, InternalContextAdapter p2){ return null; }
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public String getLiteralOperator(){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMulNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMulNode.java
new file mode 100644
index 00000000000..0bd624c2d40
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTMulNode.java
@@ -0,0 +1,17 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTMulNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTMathNode;
+
+public class ASTMulNode extends ASTMathNode
+{
+    protected ASTMulNode() {}
+    public ASTMulNode(Parser p0, int p1){}
+    public ASTMulNode(int p0){}
+    public Number perform(Number p0, Number p1, InternalContextAdapter p2){ return null; }
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public String getLiteralOperator(){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTNENode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTNENode.java
new file mode 100644
index 00000000000..29e0daa46ad
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTNENode.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTNENode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTEQNode;
+
+public class ASTNENode extends ASTEQNode
+{
+    protected ASTNENode() {}
+    public ASTNENode(Parser p0, int p1){}
+    public ASTNENode(int p0){}
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTNotNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTNotNode.java
new file mode 100644
index 00000000000..7e345c9eb90
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTNotNode.java
@@ -0,0 +1,20 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTNotNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTNotNode extends SimpleNode
+{
+    protected ASTNotNode() {}
+    public ASTNotNode(Parser p0, int p1){}
+    public ASTNotNode(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public String literal(){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTObjectArray.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTObjectArray.java
new file mode 100644
index 00000000000..1067fe2b7af
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTObjectArray.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTObjectArray for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTObjectArray extends SimpleNode
+{
+    protected ASTObjectArray() {}
+    public ASTObjectArray(Parser p0, int p1){}
+    public ASTObjectArray(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTOrNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTOrNode.java
new file mode 100644
index 00000000000..f671efdb590
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTOrNode.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTOrNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTLogicalOperator;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+
+public class ASTOrNode extends ASTLogicalOperator
+{
+    protected ASTOrNode() {}
+    public ASTOrNode(Parser p0, int p1){}
+    public ASTOrNode(int p0){}
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public String getLiteralOperator(){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTReference.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTReference.java
new file mode 100644
index 00000000000..9edfb7f99b2
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTReference.java
@@ -0,0 +1,30 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTReference for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+import org.apache.velocity.util.introspection.Info;
+
+public class ASTReference extends SimpleNode
+{
+    protected ASTReference() {}
+    protected Info uberInfo = null;
+    public ASTReference(Parser p0, int p1){}
+    public ASTReference(int p0){}
+    public Object execute(Object p0, InternalContextAdapter p1){ return null; }
+    public Object getRootVariableValue(InternalContextAdapter p0){ return null; }
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public String getRootString(){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+    public boolean setValue(InternalContextAdapter p0, Object p1){ return false; }
+    public boolean strictEscape = false;
+    public boolean strictRef = false;
+    public static String printClass(Class<? extends Object> p0){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTSetDirective.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTSetDirective.java
new file mode 100644
index 00000000000..b39477ef292
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTSetDirective.java
@@ -0,0 +1,27 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTSetDirective for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+import org.apache.velocity.util.introspection.Info;
+
+public class ASTSetDirective extends SimpleNode
+{
+    protected ASTSetDirective() {}
+    protected Info uberInfo = null;
+    protected boolean strictRef = false;
+    public ASTSetDirective(Parser p0, int p1){}
+    public ASTSetDirective(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public String getPostfix(){ return null; }
+    public String getPrefix(){ return null; }
+    public String literal(){ return null; }
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+    public void setPostfix(String p0){}
+    public void setPrefix(String p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTStringLiteral.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTStringLiteral.java
new file mode 100644
index 00000000000..cca4d6bc12e
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTStringLiteral.java
@@ -0,0 +1,23 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTStringLiteral for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.Node;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTStringLiteral extends SimpleNode
+{
+    protected ASTStringLiteral() {}
+    public ASTStringLiteral(Parser p0, int p1){}
+    public ASTStringLiteral(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+    public boolean isConstant(){ return false; }
+    public static String unescape(String p0){ return null; }
+    public void adjTokenLineNums(Node p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTSubtractNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTSubtractNode.java
new file mode 100644
index 00000000000..13e2bb9fd94
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTSubtractNode.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTSubtractNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ASTMathNode;
+
+public class ASTSubtractNode extends ASTMathNode
+{
+    protected ASTSubtractNode() {}
+    public ASTSubtractNode(Parser p0, int p1){}
+    public ASTSubtractNode(int p0){}
+    public Number perform(Number p0, Number p1, InternalContextAdapter p2){ return null; }
+    public String getLiteralOperator(){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTText.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTText.java
new file mode 100644
index 00000000000..5d0b329aaec
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTText.java
@@ -0,0 +1,22 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTText for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTText extends SimpleNode
+{
+    protected ASTText() {}
+    public ASTText(Parser p0, int p1){}
+    public ASTText(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public String getCtext(){ return null; }
+    public String literal(){ return null; }
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+    public void setCtext(String p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTTextblock.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTTextblock.java
new file mode 100644
index 00000000000..437e500a2cf
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTTextblock.java
@@ -0,0 +1,20 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTTextblock for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTTextblock extends SimpleNode
+{
+    protected ASTTextblock() {}
+    public ASTTextblock(Parser p0, int p1){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+    public final String END = null;
+    public final String START = null;
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTTrue.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTTrue.java
new file mode 100644
index 00000000000..671cbbbfdc0
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTTrue.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTTrue for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTTrue extends SimpleNode
+{
+    protected ASTTrue() {}
+    public ASTTrue(Parser p0, int p1){}
+    public ASTTrue(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTWord.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTWord.java
new file mode 100644
index 00000000000..b5aced346ef
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTWord.java
@@ -0,0 +1,17 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTWord for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTWord extends SimpleNode
+{
+    protected ASTWord() {}
+    public ASTWord(Parser p0, int p1){}
+    public ASTWord(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTprocess.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTprocess.java
new file mode 100644
index 00000000000..4ac70bd3729
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ASTprocess.java
@@ -0,0 +1,17 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ASTprocess for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public class ASTprocess extends SimpleNode
+{
+    protected ASTprocess() {}
+    public ASTprocess(Parser p0, int p1){}
+    public ASTprocess(int p0){}
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/Node.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/Node.java
new file mode 100644
index 00000000000..a39423c1ff0
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/Node.java
@@ -0,0 +1,44 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.Node for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.Writer;
+import org.apache.velocity.Template;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.Renderable;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.Token;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+
+public interface Node extends Renderable
+{
+    Node jjtGetChild(int p0);
+    Node jjtGetParent();
+    Object childrenAccept(ParserVisitor p0, Object p1);
+    Object execute(Object p0, InternalContextAdapter p1);
+    Object init(InternalContextAdapter p0, Object p1);
+    Object jjtAccept(ParserVisitor p0, Object p1);
+    Object value(InternalContextAdapter p0);
+    Parser getParser();
+    String getFirstTokenImage();
+    String getLastTokenImage();
+    String getTemplateName();
+    String literal();
+    Template getTemplate();
+    Token getFirstToken();
+    Token getLastToken();
+    boolean evaluate(InternalContextAdapter p0);
+    boolean isInvalid();
+    boolean render(InternalContextAdapter p0, Writer p1);
+    int getColumn();
+    int getInfo();
+    int getLine();
+    int getType();
+    int jjtGetNumChildren();
+    void jjtAddChild(Node p0, int p1);
+    void jjtClose();
+    void jjtOpen();
+    void jjtSetParent(Node p0);
+    void setInfo(int p0);
+    void setInvalid();
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ParserVisitor.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ParserVisitor.java
new file mode 100644
index 00000000000..68e2b4fc74a
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/ParserVisitor.java
@@ -0,0 +1,94 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.ParserVisitor for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import org.apache.velocity.runtime.parser.node.ASTAddNode;
+import org.apache.velocity.runtime.parser.node.ASTAndNode;
+import org.apache.velocity.runtime.parser.node.ASTAssignment;
+import org.apache.velocity.runtime.parser.node.ASTBlock;
+import org.apache.velocity.runtime.parser.node.ASTComment;
+import org.apache.velocity.runtime.parser.node.ASTDirective;
+import org.apache.velocity.runtime.parser.node.ASTDirectiveAssign;
+import org.apache.velocity.runtime.parser.node.ASTDivNode;
+import org.apache.velocity.runtime.parser.node.ASTEQNode;
+import org.apache.velocity.runtime.parser.node.ASTElseIfStatement;
+import org.apache.velocity.runtime.parser.node.ASTElseStatement;
+import org.apache.velocity.runtime.parser.node.ASTEscape;
+import org.apache.velocity.runtime.parser.node.ASTEscapedDirective;
+import org.apache.velocity.runtime.parser.node.ASTExpression;
+import org.apache.velocity.runtime.parser.node.ASTFalse;
+import org.apache.velocity.runtime.parser.node.ASTFloatingPointLiteral;
+import org.apache.velocity.runtime.parser.node.ASTGENode;
+import org.apache.velocity.runtime.parser.node.ASTGTNode;
+import org.apache.velocity.runtime.parser.node.ASTIdentifier;
+import org.apache.velocity.runtime.parser.node.ASTIfStatement;
+import org.apache.velocity.runtime.parser.node.ASTIndex;
+import org.apache.velocity.runtime.parser.node.ASTIntegerLiteral;
+import org.apache.velocity.runtime.parser.node.ASTIntegerRange;
+import org.apache.velocity.runtime.parser.node.ASTLENode;
+import org.apache.velocity.runtime.parser.node.ASTLTNode;
+import org.apache.velocity.runtime.parser.node.ASTMap;
+import org.apache.velocity.runtime.parser.node.ASTMethod;
+import org.apache.velocity.runtime.parser.node.ASTModNode;
+import org.apache.velocity.runtime.parser.node.ASTMulNode;
+import org.apache.velocity.runtime.parser.node.ASTNENode;
+import org.apache.velocity.runtime.parser.node.ASTNotNode;
+import org.apache.velocity.runtime.parser.node.ASTObjectArray;
+import org.apache.velocity.runtime.parser.node.ASTOrNode;
+import org.apache.velocity.runtime.parser.node.ASTReference;
+import org.apache.velocity.runtime.parser.node.ASTSetDirective;
+import org.apache.velocity.runtime.parser.node.ASTStringLiteral;
+import org.apache.velocity.runtime.parser.node.ASTSubtractNode;
+import org.apache.velocity.runtime.parser.node.ASTText;
+import org.apache.velocity.runtime.parser.node.ASTTextblock;
+import org.apache.velocity.runtime.parser.node.ASTTrue;
+import org.apache.velocity.runtime.parser.node.ASTWord;
+import org.apache.velocity.runtime.parser.node.ASTprocess;
+import org.apache.velocity.runtime.parser.node.SimpleNode;
+
+public interface ParserVisitor
+{
+    Object visit(ASTAddNode p0, Object p1);
+    Object visit(ASTAndNode p0, Object p1);
+    Object visit(ASTAssignment p0, Object p1);
+    Object visit(ASTBlock p0, Object p1);
+    Object visit(ASTComment p0, Object p1);
+    Object visit(ASTDirective p0, Object p1);
+    Object visit(ASTDirectiveAssign p0, Object p1);
+    Object visit(ASTDivNode p0, Object p1);
+    Object visit(ASTEQNode p0, Object p1);
+    Object visit(ASTElseIfStatement p0, Object p1);
+    Object visit(ASTElseStatement p0, Object p1);
+    Object visit(ASTEscape p0, Object p1);
+    Object visit(ASTEscapedDirective p0, Object p1);
+    Object visit(ASTExpression p0, Object p1);
+    Object visit(ASTFalse p0, Object p1);
+    Object visit(ASTFloatingPointLiteral p0, Object p1);
+    Object visit(ASTGENode p0, Object p1);
+    Object visit(ASTGTNode p0, Object p1);
+    Object visit(ASTIdentifier p0, Object p1);
+    Object visit(ASTIfStatement p0, Object p1);
+    Object visit(ASTIndex p0, Object p1);
+    Object visit(ASTIntegerLiteral p0, Object p1);
+    Object visit(ASTIntegerRange p0, Object p1);
+    Object visit(ASTLENode p0, Object p1);
+    Object visit(ASTLTNode p0, Object p1);
+    Object visit(ASTMap p0, Object p1);
+    Object visit(ASTMethod p0, Object p1);
+    Object visit(ASTModNode p0, Object p1);
+    Object visit(ASTMulNode p0, Object p1);
+    Object visit(ASTNENode p0, Object p1);
+    Object visit(ASTNotNode p0, Object p1);
+    Object visit(ASTObjectArray p0, Object p1);
+    Object visit(ASTOrNode p0, Object p1);
+    Object visit(ASTReference p0, Object p1);
+    Object visit(ASTSetDirective p0, Object p1);
+    Object visit(ASTStringLiteral p0, Object p1);
+    Object visit(ASTSubtractNode p0, Object p1);
+    Object visit(ASTText p0, Object p1);
+    Object visit(ASTTextblock p0, Object p1);
+    Object visit(ASTTrue p0, Object p1);
+    Object visit(ASTWord p0, Object p1);
+    Object visit(ASTprocess p0, Object p1);
+    Object visit(SimpleNode p0, Object p1);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/SimpleNode.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/SimpleNode.java
new file mode 100644
index 00000000000..a89a965554d
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/parser/node/SimpleNode.java
@@ -0,0 +1,78 @@
+// Generated automatically from org.apache.velocity.runtime.parser.node.SimpleNode for testing purposes
+
+package org.apache.velocity.runtime.parser.node;
+
+import java.io.PrintStream;
+import java.io.PrintWriter;
+import java.io.Writer;
+import org.apache.velocity.Template;
+import org.apache.velocity.context.InternalContextAdapter;
+import org.apache.velocity.runtime.RuntimeServices;
+import org.apache.velocity.runtime.parser.Parser;
+import org.apache.velocity.runtime.parser.Token;
+import org.apache.velocity.runtime.parser.node.Node;
+import org.apache.velocity.runtime.parser.node.ParserVisitor;
+import org.slf4j.Logger;
+
+public class SimpleNode implements Node
+{
+    protected SimpleNode() {}
+    protected Logger log = null;
+    protected Node parent = null;
+    protected Node[] children = null;
+    protected Parser parser = null;
+    protected RuntimeServices rsvc = null;
+    protected String firstImage = null;
+    protected String getLocation(InternalContextAdapter p0){ return null; }
+    protected String lastImage = null;
+    protected String literal = null;
+    protected Template template = null;
+    protected Token first = null;
+    protected Token last = null;
+    protected boolean invalid = false;
+    protected int column = 0;
+    protected int id = 0;
+    protected int info = 0;
+    protected int line = 0;
+    public Node jjtGetChild(int p0){ return null; }
+    public Node jjtGetParent(){ return null; }
+    public Object childrenAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object execute(Object p0, InternalContextAdapter p1){ return null; }
+    public Object init(InternalContextAdapter p0, Object p1){ return null; }
+    public Object jjtAccept(ParserVisitor p0, Object p1){ return null; }
+    public Object value(InternalContextAdapter p0){ return null; }
+    public Parser getParser(){ return null; }
+    public RuntimeServices getRuntimeServices(){ return null; }
+    public SimpleNode(Parser p0, int p1){}
+    public SimpleNode(int p0){}
+    public String getFirstTokenImage(){ return null; }
+    public String getLastTokenImage(){ return null; }
+    public String getTemplateName(){ return null; }
+    public String literal(){ return null; }
+    public String toString(){ return null; }
+    public String toString(String p0){ return null; }
+    public Template getTemplate(){ return null; }
+    public Token getFirstToken(){ return null; }
+    public Token getLastToken(){ return null; }
+    public boolean evaluate(InternalContextAdapter p0){ return false; }
+    public boolean isInvalid(){ return false; }
+    public boolean render(InternalContextAdapter p0, Writer p1){ return false; }
+    public boolean state = false;
+    public final void dump(String p0){}
+    public final void dump(String p0, PrintStream p1){}
+    public int getColumn(){ return 0; }
+    public int getInfo(){ return 0; }
+    public int getLine(){ return 0; }
+    public int getType(){ return 0; }
+    public int jjtGetNumChildren(){ return 0; }
+    public void cleanupParserAndTokens(){}
+    public void dump(String p0, PrintWriter p1){}
+    public void jjtAddChild(Node p0, int p1){}
+    public void jjtClose(){}
+    public void jjtOpen(){}
+    public void jjtSetParent(Node p0){}
+    public void saveTokenImages(){}
+    public void setFirstToken(Token p0){}
+    public void setInfo(int p0){}
+    public void setInvalid(){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/ContentResource.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/ContentResource.java
new file mode 100644
index 00000000000..2e33109b267
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/ContentResource.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.apache.velocity.runtime.resource.ContentResource for testing purposes
+
+package org.apache.velocity.runtime.resource;
+
+import org.apache.velocity.runtime.resource.Resource;
+
+public class ContentResource extends Resource
+{
+    public ContentResource(){}
+    public boolean process(){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/Resource.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/Resource.java
new file mode 100644
index 00000000000..9e7bae44b01
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/Resource.java
@@ -0,0 +1,41 @@
+// Generated automatically from org.apache.velocity.runtime.resource.Resource for testing purposes
+
+package org.apache.velocity.runtime.resource;
+
+import org.apache.velocity.runtime.RuntimeServices;
+import org.apache.velocity.runtime.resource.loader.ResourceLoader;
+import org.slf4j.Logger;
+
+abstract public class Resource
+{
+    protected Logger log = null;
+    protected Object data = null;
+    protected ResourceLoader resourceLoader = null;
+    protected RuntimeServices rsvc = null;
+    protected String encoding = null;
+    protected String name = null;
+    protected int type = 0;
+    protected long lastModified = 0;
+    protected long modificationCheckInterval = 0;
+    protected long nextCheck = 0;
+    protected static long MILLIS_PER_SECOND = 0;
+    public Object getData(){ return null; }
+    public Resource(){}
+    public ResourceLoader getResourceLoader(){ return null; }
+    public String getEncoding(){ return null; }
+    public String getName(){ return null; }
+    public abstract boolean process();
+    public boolean isSourceModified(){ return false; }
+    public boolean requiresChecking(){ return false; }
+    public int getType(){ return 0; }
+    public long getLastModified(){ return 0; }
+    public void setData(Object p0){}
+    public void setEncoding(String p0){}
+    public void setLastModified(long p0){}
+    public void setModificationCheckInterval(long p0){}
+    public void setName(String p0){}
+    public void setResourceLoader(ResourceLoader p0){}
+    public void setRuntimeServices(RuntimeServices p0){}
+    public void setType(int p0){}
+    public void touch(){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/loader/ResourceLoader.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/loader/ResourceLoader.java
new file mode 100644
index 00000000000..cee6d9a6b64
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/loader/ResourceLoader.java
@@ -0,0 +1,32 @@
+// Generated automatically from org.apache.velocity.runtime.resource.loader.ResourceLoader for testing purposes
+
+package org.apache.velocity.runtime.resource.loader;
+
+import java.io.InputStream;
+import java.io.Reader;
+import org.apache.velocity.runtime.RuntimeServices;
+import org.apache.velocity.runtime.resource.Resource;
+import org.apache.velocity.util.ExtProperties;
+import org.slf4j.Logger;
+
+abstract public class ResourceLoader
+{
+    protected Logger log = null;
+    protected Reader buildReader(InputStream p0, String p1){ return null; }
+    protected RuntimeServices rsvc = null;
+    protected String className = null;
+    protected boolean isCachingOn = false;
+    protected long modificationCheckInterval = 0;
+    public ResourceLoader(){}
+    public String getClassName(){ return null; }
+    public abstract Reader getResourceReader(String p0, String p1);
+    public abstract boolean isSourceModified(Resource p0);
+    public abstract long getLastModified(Resource p0);
+    public abstract void init(ExtProperties p0);
+    public boolean isCachingOn(){ return false; }
+    public boolean resourceExists(String p0){ return false; }
+    public long getModificationCheckInterval(){ return 0; }
+    public void commonInit(RuntimeServices p0, ExtProperties p1){}
+    public void setCachingOn(boolean p0){}
+    public void setModificationCheckInterval(long p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/util/StringResource.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/util/StringResource.java
new file mode 100644
index 00000000000..fb017e02dc7
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/util/StringResource.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.apache.velocity.runtime.resource.util.StringResource for testing purposes
+
+package org.apache.velocity.runtime.resource.util;
+
+
+public class StringResource
+{
+    protected StringResource() {}
+    public String getBody(){ return null; }
+    public String getEncoding(){ return null; }
+    public StringResource(String p0, String p1){}
+    public long getLastModified(){ return 0; }
+    public void setBody(String p0){}
+    public void setEncoding(String p0){}
+    public void setLastModified(long p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/util/StringResourceRepository.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/util/StringResourceRepository.java
new file mode 100644
index 00000000000..1b7125e939d
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/util/StringResourceRepository.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.apache.velocity.runtime.resource.util.StringResourceRepository for testing purposes
+
+package org.apache.velocity.runtime.resource.util;
+
+import org.apache.velocity.runtime.resource.util.StringResource;
+
+public interface StringResourceRepository
+{
+    String getEncoding();
+    StringResource getStringResource(String p0);
+    void putStringResource(String p0, String p1);
+    void putStringResource(String p0, String p1, String p2);
+    void removeStringResource(String p0);
+    void setEncoding(String p0);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/util/StringResourceRepositoryImpl.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/util/StringResourceRepositoryImpl.java
new file mode 100644
index 00000000000..2ae0ed35a29
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/runtime/resource/util/StringResourceRepositoryImpl.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.apache.velocity.runtime.resource.util.StringResourceRepositoryImpl for testing purposes
+
+package org.apache.velocity.runtime.resource.util;
+
+import java.util.Map;
+import org.apache.velocity.runtime.resource.util.StringResource;
+import org.apache.velocity.runtime.resource.util.StringResourceRepository;
+
+public class StringResourceRepositoryImpl implements StringResourceRepository
+{
+    protected Map<String, StringResource> resources = null;
+    public String getEncoding(){ return null; }
+    public StringResource getStringResource(String p0){ return null; }
+    public StringResourceRepositoryImpl(){}
+    public void putStringResource(String p0, String p1){}
+    public void putStringResource(String p0, String p1, String p2){}
+    public void removeStringResource(String p0){}
+    public void setEncoding(String p0){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/DeprecationAwareExtProperties.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/DeprecationAwareExtProperties.java
new file mode 100644
index 00000000000..eb550aa13a2
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/DeprecationAwareExtProperties.java
@@ -0,0 +1,17 @@
+// Generated automatically from org.apache.velocity.util.DeprecationAwareExtProperties for testing purposes
+
+package org.apache.velocity.util;
+
+import java.util.Hashtable;
+import org.slf4j.Logger;
+
+public class DeprecationAwareExtProperties extends Hashtable<String, Object>
+{
+    protected String translateKey(String p0){ return null; }
+    protected static Logger logger = null;
+    protected void warnDeprecated(String p0, String p1){}
+    public DeprecationAwareExtProperties(){}
+    public Object get(String p0){ return null; }
+    public Object put(String p0, Object p1){ return null; }
+    public boolean containsKey(String p0){ return false; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/ExtProperties.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/ExtProperties.java
new file mode 100644
index 00000000000..608e08bffd3
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/ExtProperties.java
@@ -0,0 +1,80 @@
+// Generated automatically from org.apache.velocity.util.ExtProperties for testing purposes
+
+package org.apache.velocity.util;
+
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.util.ArrayList;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.Vector;
+import org.apache.velocity.util.DeprecationAwareExtProperties;
+
+public class ExtProperties extends DeprecationAwareExtProperties
+{
+    protected ArrayList<String> keysAsListed = null;
+    protected String basePath = null;
+    protected String file = null;
+    protected String fileSeparator = null;
+    protected String interpolate(String p0){ return null; }
+    protected String interpolateHelper(String p0, List<String> p1){ return null; }
+    protected boolean isInitialized = false;
+    protected static String END_TOKEN = null;
+    protected static String START_TOKEN = null;
+    protected static String include = null;
+    public Boolean getBoolean(String p0, Boolean p1){ return null; }
+    public Byte getByte(String p0, Byte p1){ return null; }
+    public Double getDouble(String p0, Double p1){ return null; }
+    public ExtProperties subset(String p0){ return null; }
+    public ExtProperties(){}
+    public ExtProperties(String p0){}
+    public ExtProperties(String p0, String p1){}
+    public Float getFloat(String p0, Float p1){ return null; }
+    public Integer getInteger(String p0, Integer p1){ return null; }
+    public Iterator<String> getKeys(){ return null; }
+    public Iterator<String> getKeys(String p0){ return null; }
+    public List getList(String p0){ return null; }
+    public List getList(String p0, List p1){ return null; }
+    public Long getLong(String p0, Long p1){ return null; }
+    public Object getProperty(String p0){ return null; }
+    public Properties getProperties(String p0){ return null; }
+    public Properties getProperties(String p0, Properties p1){ return null; }
+    public Short getShort(String p0, Short p1){ return null; }
+    public String getInclude(){ return null; }
+    public String getString(String p0){ return null; }
+    public String getString(String p0, String p1){ return null; }
+    public String testBoolean(String p0){ return null; }
+    public String[] getStringArray(String p0){ return null; }
+    public Vector getVector(String p0){ return null; }
+    public Vector getVector(String p0, Vector p1){ return null; }
+    public boolean getBoolean(String p0){ return false; }
+    public boolean getBoolean(String p0, boolean p1){ return false; }
+    public boolean isInitialized(){ return false; }
+    public byte getByte(String p0){ return 0; }
+    public byte getByte(String p0, byte p1){ return 0; }
+    public double getDouble(String p0){ return 0; }
+    public double getDouble(String p0, double p1){ return 0; }
+    public float getFloat(String p0){ return 0; }
+    public float getFloat(String p0, float p1){ return 0; }
+    public int getInt(String p0){ return 0; }
+    public int getInt(String p0, int p1){ return 0; }
+    public int getInteger(String p0){ return 0; }
+    public int getInteger(String p0, int p1){ return 0; }
+    public long getLong(String p0){ return 0; }
+    public long getLong(String p0, long p1){ return 0; }
+    public short getShort(String p0){ return 0; }
+    public short getShort(String p0, short p1){ return 0; }
+    public static ExtProperties convertProperties(Map p0){ return null; }
+    public static ExtProperties convertProperties(Properties p0){ return null; }
+    public void addProperty(String p0, Object p1){}
+    public void clearProperty(String p0){}
+    public void combine(ExtProperties p0){}
+    public void display(){}
+    public void load(InputStream p0){}
+    public void load(InputStream p0, String p1){}
+    public void save(OutputStream p0, String p1){}
+    public void setInclude(String p0){}
+    public void setProperty(String p0, Object p1){}
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/Info.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/Info.java
new file mode 100644
index 00000000000..ce935405364
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/Info.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.apache.velocity.util.introspection.Info for testing purposes
+
+package org.apache.velocity.util.introspection;
+
+import org.apache.velocity.runtime.parser.node.Node;
+
+public class Info
+{
+    protected Info() {}
+    public Info(Node p0){}
+    public Info(String p0, int p1, int p2){}
+    public String getTemplateName(){ return null; }
+    public String toString(){ return null; }
+    public int getColumn(){ return 0; }
+    public int getLine(){ return 0; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/IntrospectionCacheData.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/IntrospectionCacheData.java
new file mode 100644
index 00000000000..7ef73f30c88
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/IntrospectionCacheData.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.apache.velocity.util.introspection.IntrospectionCacheData for testing purposes
+
+package org.apache.velocity.util.introspection;
+
+
+public class IntrospectionCacheData
+{
+    public Class<? extends Object> contextData = null;
+    public IntrospectionCacheData(){}
+    public Object thingy = null;
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/Uberspect.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/Uberspect.java
new file mode 100644
index 00000000000..b5ab1ea26da
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/Uberspect.java
@@ -0,0 +1,18 @@
+// Generated automatically from org.apache.velocity.util.introspection.Uberspect for testing purposes
+
+package org.apache.velocity.util.introspection;
+
+import java.util.Iterator;
+import org.apache.velocity.util.introspection.Info;
+import org.apache.velocity.util.introspection.VelMethod;
+import org.apache.velocity.util.introspection.VelPropertyGet;
+import org.apache.velocity.util.introspection.VelPropertySet;
+
+public interface Uberspect
+{
+    Iterator getIterator(Object p0, Info p1);
+    VelMethod getMethod(Object p0, String p1, Object[] p2, Info p3);
+    VelPropertyGet getPropertyGet(Object p0, String p1, Info p2);
+    VelPropertySet getPropertySet(Object p0, String p1, Object p2, Info p3);
+    void init();
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/VelMethod.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/VelMethod.java
new file mode 100644
index 00000000000..50466d19554
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/VelMethod.java
@@ -0,0 +1,14 @@
+// Generated automatically from org.apache.velocity.util.introspection.VelMethod for testing purposes
+
+package org.apache.velocity.util.introspection;
+
+import java.lang.reflect.Method;
+
+public interface VelMethod
+{
+    Class<? extends Object> getReturnType();
+    Method getMethod();
+    Object invoke(Object p0, Object[] p1);
+    String getMethodName();
+    boolean isCacheable();
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/VelPropertyGet.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/VelPropertyGet.java
new file mode 100644
index 00000000000..7923de341f7
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/VelPropertyGet.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.apache.velocity.util.introspection.VelPropertyGet for testing purposes
+
+package org.apache.velocity.util.introspection;
+
+
+public interface VelPropertyGet
+{
+    Object invoke(Object p0);
+    String getMethodName();
+    boolean isCacheable();
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/VelPropertySet.java b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/VelPropertySet.java
new file mode 100644
index 00000000000..c3c75d2564b
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/apache/velocity/util/introspection/VelPropertySet.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.apache.velocity.util.introspection.VelPropertySet for testing purposes
+
+package org.apache.velocity.util.introspection;
+
+
+public interface VelPropertySet
+{
+    Object invoke(Object p0, Object p1);
+    String getMethodName();
+    boolean isCacheable();
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/Logger.java b/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/Logger.java
new file mode 100644
index 00000000000..667b304e7fe
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/Logger.java
@@ -0,0 +1,80 @@
+// Generated automatically from org.slf4j.Logger for testing purposes
+
+package org.slf4j;
+
+import org.slf4j.Marker;
+import org.slf4j.event.Level;
+import org.slf4j.spi.LoggingEventBuilder;
+
+public interface Logger
+{
+    String getName();
+    boolean isDebugEnabled();
+    boolean isDebugEnabled(Marker p0);
+    boolean isErrorEnabled();
+    boolean isErrorEnabled(Marker p0);
+    boolean isInfoEnabled();
+    boolean isInfoEnabled(Marker p0);
+    boolean isTraceEnabled();
+    boolean isTraceEnabled(Marker p0);
+    boolean isWarnEnabled();
+    boolean isWarnEnabled(Marker p0);
+    default LoggingEventBuilder atDebug(){ return null; }
+    default LoggingEventBuilder atError(){ return null; }
+    default LoggingEventBuilder atInfo(){ return null; }
+    default LoggingEventBuilder atTrace(){ return null; }
+    default LoggingEventBuilder atWarn(){ return null; }
+    default LoggingEventBuilder makeLoggingEventBuilder(Level p0){ return null; }
+    default boolean isEnabledForLevel(Level p0){ return false; }
+    static String ROOT_LOGGER_NAME = null;
+    void debug(Marker p0, String p1);
+    void debug(Marker p0, String p1, Object p2);
+    void debug(Marker p0, String p1, Object p2, Object p3);
+    void debug(Marker p0, String p1, Object... p2);
+    void debug(Marker p0, String p1, Throwable p2);
+    void debug(String p0);
+    void debug(String p0, Object p1);
+    void debug(String p0, Object p1, Object p2);
+    void debug(String p0, Object... p1);
+    void debug(String p0, Throwable p1);
+    void error(Marker p0, String p1);
+    void error(Marker p0, String p1, Object p2);
+    void error(Marker p0, String p1, Object p2, Object p3);
+    void error(Marker p0, String p1, Object... p2);
+    void error(Marker p0, String p1, Throwable p2);
+    void error(String p0);
+    void error(String p0, Object p1);
+    void error(String p0, Object p1, Object p2);
+    void error(String p0, Object... p1);
+    void error(String p0, Throwable p1);
+    void info(Marker p0, String p1);
+    void info(Marker p0, String p1, Object p2);
+    void info(Marker p0, String p1, Object p2, Object p3);
+    void info(Marker p0, String p1, Object... p2);
+    void info(Marker p0, String p1, Throwable p2);
+    void info(String p0);
+    void info(String p0, Object p1);
+    void info(String p0, Object p1, Object p2);
+    void info(String p0, Object... p1);
+    void info(String p0, Throwable p1);
+    void trace(Marker p0, String p1);
+    void trace(Marker p0, String p1, Object p2);
+    void trace(Marker p0, String p1, Object p2, Object p3);
+    void trace(Marker p0, String p1, Object... p2);
+    void trace(Marker p0, String p1, Throwable p2);
+    void trace(String p0);
+    void trace(String p0, Object p1);
+    void trace(String p0, Object p1, Object p2);
+    void trace(String p0, Object... p1);
+    void trace(String p0, Throwable p1);
+    void warn(Marker p0, String p1);
+    void warn(Marker p0, String p1, Object p2);
+    void warn(Marker p0, String p1, Object p2, Object p3);
+    void warn(Marker p0, String p1, Object... p2);
+    void warn(Marker p0, String p1, Throwable p2);
+    void warn(String p0);
+    void warn(String p0, Object p1);
+    void warn(String p0, Object p1, Object p2);
+    void warn(String p0, Object... p1);
+    void warn(String p0, Throwable p1);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/Marker.java b/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/Marker.java
new file mode 100644
index 00000000000..bf8ac78dc7f
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/Marker.java
@@ -0,0 +1,22 @@
+// Generated automatically from org.slf4j.Marker for testing purposes
+
+package org.slf4j;
+
+import java.io.Serializable;
+import java.util.Iterator;
+
+public interface Marker extends Serializable
+{
+    Iterator<Marker> iterator();
+    String getName();
+    boolean contains(Marker p0);
+    boolean contains(String p0);
+    boolean equals(Object p0);
+    boolean hasChildren();
+    boolean hasReferences();
+    boolean remove(Marker p0);
+    int hashCode();
+    static String ANY_MARKER = null;
+    static String ANY_NON_NULL_MARKER = null;
+    void add(Marker p0);
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/event/Level.java b/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/event/Level.java
new file mode 100644
index 00000000000..1e2d5e005c1
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/event/Level.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.slf4j.event.Level for testing purposes
+
+package org.slf4j.event;
+
+
+public enum Level
+{
+    DEBUG, ERROR, INFO, TRACE, WARN;
+    private Level() {}
+    public String toString(){ return null; }
+    public int toInt(){ return 0; }
+    public static Level intToLevel(int p0){ return null; }
+}
diff --git a/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/spi/LoggingEventBuilder.java b/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/spi/LoggingEventBuilder.java
new file mode 100644
index 00000000000..cff6b5d178e
--- /dev/null
+++ b/java/ql/test/stubs/apache-velocity-2.3/org/slf4j/spi/LoggingEventBuilder.java
@@ -0,0 +1,21 @@
+// Generated automatically from org.slf4j.spi.LoggingEventBuilder for testing purposes
+
+package org.slf4j.spi;
+
+import java.util.function.Supplier;
+import org.slf4j.Marker;
+
+public interface LoggingEventBuilder
+{
+    LoggingEventBuilder addArgument(Object p0);
+    LoggingEventBuilder addArgument(Supplier<? extends Object> p0);
+    LoggingEventBuilder addKeyValue(String p0, Object p1);
+    LoggingEventBuilder addKeyValue(String p0, Supplier<Object> p1);
+    LoggingEventBuilder addMarker(Marker p0);
+    LoggingEventBuilder setCause(Throwable p0);
+    void log(String p0);
+    void log(String p0, Object p1);
+    void log(String p0, Object p1, Object p2);
+    void log(String p0, Object... p1);
+    void log(Supplier<String> p0);
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/app/AlarmManager.java b/java/ql/test/stubs/google-android-9.0.0/android/app/AlarmManager.java
new file mode 100644
index 00000000000..4aff1376c4b
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/android/app/AlarmManager.java
@@ -0,0 +1,54 @@
+// Generated automatically from android.app.AlarmManager for testing purposes
+
+package android.app;
+
+import android.app.PendingIntent;
+import android.os.Handler;
+import android.os.Parcel;
+import android.os.Parcelable;
+
+public class AlarmManager
+{
+    public AlarmManager.AlarmClockInfo getNextAlarmClock(){ return null; }
+    public boolean canScheduleExactAlarms(){ return false; }
+    public static String ACTION_NEXT_ALARM_CLOCK_CHANGED = null;
+    public static String ACTION_SCHEDULE_EXACT_ALARM_PERMISSION_STATE_CHANGED = null;
+    public static int ELAPSED_REALTIME = 0;
+    public static int ELAPSED_REALTIME_WAKEUP = 0;
+    public static int RTC = 0;
+    public static int RTC_WAKEUP = 0;
+    public static long INTERVAL_DAY = 0;
+    public static long INTERVAL_FIFTEEN_MINUTES = 0;
+    public static long INTERVAL_HALF_DAY = 0;
+    public static long INTERVAL_HALF_HOUR = 0;
+    public static long INTERVAL_HOUR = 0;
+    public void cancel(AlarmManager.OnAlarmListener p0){}
+    public void cancel(PendingIntent p0){}
+    public void set(int p0, long p1, PendingIntent p2){}
+    public void set(int p0, long p1, String p2, AlarmManager.OnAlarmListener p3, Handler p4){}
+    public void setAlarmClock(AlarmManager.AlarmClockInfo p0, PendingIntent p1){}
+    public void setAndAllowWhileIdle(int p0, long p1, PendingIntent p2){}
+    public void setExact(int p0, long p1, PendingIntent p2){}
+    public void setExact(int p0, long p1, String p2, AlarmManager.OnAlarmListener p3, Handler p4){}
+    public void setExactAndAllowWhileIdle(int p0, long p1, PendingIntent p2){}
+    public void setInexactRepeating(int p0, long p1, long p2, PendingIntent p3){}
+    public void setRepeating(int p0, long p1, long p2, PendingIntent p3){}
+    public void setTime(long p0){}
+    public void setTimeZone(String p0){}
+    public void setWindow(int p0, long p1, long p2, PendingIntent p3){}
+    public void setWindow(int p0, long p1, long p2, String p3, AlarmManager.OnAlarmListener p4, Handler p5){}
+    static public class AlarmClockInfo implements Parcelable
+    {
+        protected AlarmClockInfo() {}
+        public AlarmClockInfo(long p0, PendingIntent p1){}
+        public PendingIntent getShowIntent(){ return null; }
+        public int describeContents(){ return 0; }
+        public long getTriggerTime(){ return 0; }
+        public static Parcelable.Creator<AlarmManager.AlarmClockInfo> CREATOR = null;
+        public void writeToParcel(Parcel p0, int p1){}
+    }
+    static public interface OnAlarmListener
+    {
+        void onAlarm();
+    }
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/app/AppComponentFactory.java b/java/ql/test/stubs/google-android-9.0.0/android/app/AppComponentFactory.java
new file mode 100644
index 00000000000..284510fc655
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/android/app/AppComponentFactory.java
@@ -0,0 +1,22 @@
+// Generated automatically from android.app.AppComponentFactory for testing purposes
+
+package android.app;
+
+import android.app.Activity;
+import android.app.Application;
+import android.app.Service;
+import android.content.BroadcastReceiver;
+import android.content.ContentProvider;
+import android.content.Intent;
+import android.content.pm.ApplicationInfo;
+
+public class AppComponentFactory
+{
+    public Activity instantiateActivity(ClassLoader p0, String p1, Intent p2){ return null; }
+    public AppComponentFactory(){}
+    public Application instantiateApplication(ClassLoader p0, String p1){ return null; }
+    public BroadcastReceiver instantiateReceiver(ClassLoader p0, String p1, Intent p2){ return null; }
+    public ClassLoader instantiateClassLoader(ClassLoader p0, ApplicationInfo p1){ return null; }
+    public ContentProvider instantiateProvider(ClassLoader p0, String p1){ return null; }
+    public Service instantiateService(ClassLoader p0, String p1, Intent p2){ return null; }
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/app/AutomaticZenRule.java b/java/ql/test/stubs/google-android-9.0.0/android/app/AutomaticZenRule.java
new file mode 100644
index 00000000000..3b97a1eca2d
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/android/app/AutomaticZenRule.java
@@ -0,0 +1,37 @@
+// Generated automatically from android.app.AutomaticZenRule for testing purposes
+
+package android.app;
+
+import android.content.ComponentName;
+import android.net.Uri;
+import android.os.Parcel;
+import android.os.Parcelable;
+import android.service.notification.ZenPolicy;
+
+public class AutomaticZenRule implements Parcelable
+{
+    protected AutomaticZenRule() {}
+    public AutomaticZenRule(Parcel p0){}
+    public AutomaticZenRule(String p0, ComponentName p1, ComponentName p2, Uri p3, ZenPolicy p4, int p5, boolean p6){}
+    public AutomaticZenRule(String p0, ComponentName p1, Uri p2, int p3, boolean p4){}
+    public ComponentName getConfigurationActivity(){ return null; }
+    public ComponentName getOwner(){ return null; }
+    public String getName(){ return null; }
+    public String toString(){ return null; }
+    public Uri getConditionId(){ return null; }
+    public ZenPolicy getZenPolicy(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isEnabled(){ return false; }
+    public int describeContents(){ return 0; }
+    public int getInterruptionFilter(){ return 0; }
+    public int hashCode(){ return 0; }
+    public long getCreationTime(){ return 0; }
+    public static Parcelable.Creator<AutomaticZenRule> CREATOR = null;
+    public void setConditionId(Uri p0){}
+    public void setConfigurationActivity(ComponentName p0){}
+    public void setEnabled(boolean p0){}
+    public void setInterruptionFilter(int p0){}
+    public void setName(String p0){}
+    public void setZenPolicy(ZenPolicy p0){}
+    public void writeToParcel(Parcel p0, int p1){}
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/service/notification/Condition.java b/java/ql/test/stubs/google-android-9.0.0/android/service/notification/Condition.java
new file mode 100644
index 00000000000..a7f94f23c42
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/android/service/notification/Condition.java
@@ -0,0 +1,41 @@
+// Generated automatically from android.service.notification.Condition for testing purposes
+
+package android.service.notification;
+
+import android.content.Context;
+import android.net.Uri;
+import android.os.Parcel;
+import android.os.Parcelable;
+
+public class Condition implements Parcelable
+{
+    protected Condition() {}
+    public Condition copy(){ return null; }
+    public Condition(Parcel p0){}
+    public Condition(Uri p0, String p1, String p2, String p3, int p4, int p5, int p6){}
+    public Condition(Uri p0, String p1, int p2){}
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public final String line1 = null;
+    public final String line2 = null;
+    public final String summary = null;
+    public final Uri id = null;
+    public final int flags = 0;
+    public final int icon = 0;
+    public final int state = 0;
+    public int describeContents(){ return 0; }
+    public int hashCode(){ return 0; }
+    public static Parcelable.Creator<Condition> CREATOR = null;
+    public static String SCHEME = null;
+    public static String relevanceToString(int p0){ return null; }
+    public static String stateToString(int p0){ return null; }
+    public static Uri.Builder newId(Context p0){ return null; }
+    public static boolean isValidId(Uri p0, String p1){ return false; }
+    public static int FLAG_RELEVANT_ALWAYS = 0;
+    public static int FLAG_RELEVANT_NOW = 0;
+    public static int STATE_ERROR = 0;
+    public static int STATE_FALSE = 0;
+    public static int STATE_TRUE = 0;
+    public static int STATE_UNKNOWN = 0;
+    public void writeToParcel(Parcel p0, int p1){}
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/service/notification/StatusBarNotification.java b/java/ql/test/stubs/google-android-9.0.0/android/service/notification/StatusBarNotification.java
new file mode 100644
index 00000000000..e360a5ad3f1
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/android/service/notification/StatusBarNotification.java
@@ -0,0 +1,37 @@
+// Generated automatically from android.service.notification.StatusBarNotification for testing purposes
+
+package android.service.notification;
+
+import android.app.Notification;
+import android.os.Parcel;
+import android.os.Parcelable;
+import android.os.UserHandle;
+
+public class StatusBarNotification implements Parcelable
+{
+    protected StatusBarNotification() {}
+    public Notification getNotification(){ return null; }
+    public StatusBarNotification clone(){ return null; }
+    public StatusBarNotification(Parcel p0){}
+    public StatusBarNotification(String p0, String p1, int p2, String p3, int p4, int p5, int p6, Notification p7, UserHandle p8, long p9){}
+    public String getGroupKey(){ return null; }
+    public String getKey(){ return null; }
+    public String getOpPkg(){ return null; }
+    public String getOverrideGroupKey(){ return null; }
+    public String getPackageName(){ return null; }
+    public String getTag(){ return null; }
+    public String toString(){ return null; }
+    public UserHandle getUser(){ return null; }
+    public boolean isAppGroup(){ return false; }
+    public boolean isClearable(){ return false; }
+    public boolean isGroup(){ return false; }
+    public boolean isOngoing(){ return false; }
+    public int describeContents(){ return 0; }
+    public int getId(){ return 0; }
+    public int getUid(){ return 0; }
+    public int getUserId(){ return 0; }
+    public long getPostTime(){ return 0; }
+    public static Parcelable.Creator<StatusBarNotification> CREATOR = null;
+    public void setOverrideGroupKey(String p0){}
+    public void writeToParcel(Parcel p0, int p1){}
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/service/notification/ZenPolicy.java b/java/ql/test/stubs/google-android-9.0.0/android/service/notification/ZenPolicy.java
new file mode 100644
index 00000000000..81c52b0c18a
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/android/service/notification/ZenPolicy.java
@@ -0,0 +1,47 @@
+// Generated automatically from android.service.notification.ZenPolicy for testing purposes
+
+package android.service.notification;
+
+import android.os.Parcel;
+import android.os.Parcelable;
+
+public class ZenPolicy implements Parcelable
+{
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int describeContents(){ return 0; }
+    public int getPriorityCallSenders(){ return 0; }
+    public int getPriorityCategoryAlarms(){ return 0; }
+    public int getPriorityCategoryCalls(){ return 0; }
+    public int getPriorityCategoryConversations(){ return 0; }
+    public int getPriorityCategoryEvents(){ return 0; }
+    public int getPriorityCategoryMedia(){ return 0; }
+    public int getPriorityCategoryMessages(){ return 0; }
+    public int getPriorityCategoryReminders(){ return 0; }
+    public int getPriorityCategoryRepeatCallers(){ return 0; }
+    public int getPriorityCategorySystem(){ return 0; }
+    public int getPriorityConversationSenders(){ return 0; }
+    public int getPriorityMessageSenders(){ return 0; }
+    public int getVisualEffectAmbient(){ return 0; }
+    public int getVisualEffectBadge(){ return 0; }
+    public int getVisualEffectFullScreenIntent(){ return 0; }
+    public int getVisualEffectLights(){ return 0; }
+    public int getVisualEffectNotificationList(){ return 0; }
+    public int getVisualEffectPeek(){ return 0; }
+    public int getVisualEffectStatusBar(){ return 0; }
+    public int hashCode(){ return 0; }
+    public static Parcelable.Creator<ZenPolicy> CREATOR = null;
+    public static int CONVERSATION_SENDERS_ANYONE = 0;
+    public static int CONVERSATION_SENDERS_IMPORTANT = 0;
+    public static int CONVERSATION_SENDERS_NONE = 0;
+    public static int CONVERSATION_SENDERS_UNSET = 0;
+    public static int PEOPLE_TYPE_ANYONE = 0;
+    public static int PEOPLE_TYPE_CONTACTS = 0;
+    public static int PEOPLE_TYPE_NONE = 0;
+    public static int PEOPLE_TYPE_STARRED = 0;
+    public static int PEOPLE_TYPE_UNSET = 0;
+    public static int STATE_ALLOW = 0;
+    public static int STATE_DISALLOW = 0;
+    public static int STATE_UNSET = 0;
+    public void writeToParcel(Parcel p0, int p1){}
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/AlarmManagerCompat.java b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/AlarmManagerCompat.java
new file mode 100644
index 00000000000..adaf14a156b
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/AlarmManagerCompat.java
@@ -0,0 +1,15 @@
+// Generated automatically from androidx.core.app.AlarmManagerCompat for testing purposes
+
+package androidx.core.app;
+
+import android.app.AlarmManager;
+import android.app.PendingIntent;
+
+public class AlarmManagerCompat
+{
+    protected AlarmManagerCompat() {}
+    public static void setAlarmClock(AlarmManager p0, long p1, PendingIntent p2, PendingIntent p3){}
+    public static void setAndAllowWhileIdle(AlarmManager p0, int p1, long p2, PendingIntent p3){}
+    public static void setExact(AlarmManager p0, int p1, long p2, PendingIntent p3){}
+    public static void setExactAndAllowWhileIdle(AlarmManager p0, int p1, long p2, PendingIntent p3){}
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/CoreComponentFactory.java b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/CoreComponentFactory.java
new file mode 100644
index 00000000000..699156f3441
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/CoreComponentFactory.java
@@ -0,0 +1,25 @@
+// Generated automatically from androidx.core.app.CoreComponentFactory for testing purposes
+
+package androidx.core.app;
+
+import android.app.Activity;
+import android.app.AppComponentFactory;
+import android.app.Application;
+import android.app.Service;
+import android.content.BroadcastReceiver;
+import android.content.ContentProvider;
+import android.content.Intent;
+
+public class CoreComponentFactory extends AppComponentFactory
+{
+    public Activity instantiateActivity(ClassLoader p0, String p1, Intent p2){ return null; }
+    public Application instantiateApplication(ClassLoader p0, String p1){ return null; }
+    public BroadcastReceiver instantiateReceiver(ClassLoader p0, String p1, Intent p2){ return null; }
+    public ContentProvider instantiateProvider(ClassLoader p0, String p1){ return null; }
+    public CoreComponentFactory(){}
+    public Service instantiateService(ClassLoader p0, String p1, Intent p2){ return null; }
+    static public interface CompatWrapped
+    {
+        Object getWrapper();
+    }
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/NotificationBuilderWithBuilderAccessor.java b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/NotificationBuilderWithBuilderAccessor.java
new file mode 100644
index 00000000000..028807b3000
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/NotificationBuilderWithBuilderAccessor.java
@@ -0,0 +1,10 @@
+// Generated automatically from androidx.core.app.NotificationBuilderWithBuilderAccessor for testing
+// purposes
+
+package androidx.core.app;
+
+import android.app.Notification;
+
+public interface NotificationBuilderWithBuilderAccessor {
+    Notification.Builder getBuilder();
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/NotificationCompat.java b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/NotificationCompat.java
new file mode 100644
index 00000000000..58beaab5b9c
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/NotificationCompat.java
@@ -0,0 +1,720 @@
+// Generated automatically from androidx.core.app.NotificationCompat for testing purposes
+
+package androidx.core.app;
+
+import android.app.Notification;
+import android.app.PendingIntent;
+import android.content.Context;
+import android.graphics.Bitmap;
+import android.net.Uri;
+import android.os.Bundle;
+import android.widget.RemoteViews;
+import androidx.core.app.NotificationBuilderWithBuilderAccessor;
+import androidx.core.app.RemoteInput;
+import androidx.core.graphics.drawable.IconCompat;
+import java.util.ArrayList;
+import java.util.List;
+
+public class NotificationCompat {
+    abstract static public class Style {
+        protected NotificationCompat.Builder mBuilder = null;
+
+        protected void restoreFromCompatExtras(Bundle p0) {}
+
+        public Bitmap createColoredBitmap(int p0, int p1) {
+            return null;
+        }
+
+        public Notification build() {
+            return null;
+        }
+
+        public RemoteViews applyStandardTemplate(boolean p0, int p1, boolean p2) {
+            return null;
+        }
+
+        public RemoteViews makeBigContentView(NotificationBuilderWithBuilderAccessor p0) {
+            return null;
+        }
+
+        public RemoteViews makeContentView(NotificationBuilderWithBuilderAccessor p0) {
+            return null;
+        }
+
+        public RemoteViews makeHeadsUpContentView(NotificationBuilderWithBuilderAccessor p0) {
+            return null;
+        }
+
+        public Style() {}
+
+        public void addCompatExtras(Bundle p0) {}
+
+        public void apply(NotificationBuilderWithBuilderAccessor p0) {}
+
+        public void buildIntoRemoteViews(RemoteViews p0, RemoteViews p1) {}
+
+        public void setBuilder(NotificationCompat.Builder p0) {}
+    }
+
+    public NotificationCompat() {}
+
+    public static Bundle getExtras(Notification p0) {
+        return null;
+    }
+
+    public static CharSequence getContentTitle(Notification p0) {
+        return null;
+    }
+
+    public static List<NotificationCompat.Action> getInvisibleActions(Notification p0) {
+        return null;
+    }
+
+    public static NotificationCompat.Action getAction(Notification p0, int p1) {
+        return null;
+    }
+
+    public static NotificationCompat.BubbleMetadata getBubbleMetadata(Notification p0) {
+        return null;
+    }
+
+    public static String CATEGORY_ALARM = null;
+    public static String CATEGORY_CALL = null;
+    public static String CATEGORY_EMAIL = null;
+    public static String CATEGORY_ERROR = null;
+    public static String CATEGORY_EVENT = null;
+    public static String CATEGORY_MESSAGE = null;
+    public static String CATEGORY_NAVIGATION = null;
+    public static String CATEGORY_PROGRESS = null;
+    public static String CATEGORY_PROMO = null;
+    public static String CATEGORY_RECOMMENDATION = null;
+    public static String CATEGORY_REMINDER = null;
+    public static String CATEGORY_SERVICE = null;
+    public static String CATEGORY_SOCIAL = null;
+    public static String CATEGORY_STATUS = null;
+    public static String CATEGORY_SYSTEM = null;
+    public static String CATEGORY_TRANSPORT = null;
+    public static String EXTRA_AUDIO_CONTENTS_URI = null;
+    public static String EXTRA_BACKGROUND_IMAGE_URI = null;
+    public static String EXTRA_BIG_TEXT = null;
+    public static String EXTRA_CHRONOMETER_COUNT_DOWN = null;
+    public static String EXTRA_COMPACT_ACTIONS = null;
+    public static String EXTRA_CONVERSATION_TITLE = null;
+    public static String EXTRA_HIDDEN_CONVERSATION_TITLE = null;
+    public static String EXTRA_INFO_TEXT = null;
+    public static String EXTRA_IS_GROUP_CONVERSATION = null;
+    public static String EXTRA_LARGE_ICON = null;
+    public static String EXTRA_LARGE_ICON_BIG = null;
+    public static String EXTRA_MEDIA_SESSION = null;
+    public static String EXTRA_MESSAGES = null;
+    public static String EXTRA_MESSAGING_STYLE_USER = null;
+    public static String EXTRA_PEOPLE = null;
+    public static String EXTRA_PICTURE = null;
+    public static String EXTRA_PROGRESS = null;
+    public static String EXTRA_PROGRESS_INDETERMINATE = null;
+    public static String EXTRA_PROGRESS_MAX = null;
+    public static String EXTRA_REMOTE_INPUT_HISTORY = null;
+    public static String EXTRA_SELF_DISPLAY_NAME = null;
+    public static String EXTRA_SHOW_CHRONOMETER = null;
+    public static String EXTRA_SHOW_WHEN = null;
+    public static String EXTRA_SMALL_ICON = null;
+    public static String EXTRA_SUB_TEXT = null;
+    public static String EXTRA_SUMMARY_TEXT = null;
+    public static String EXTRA_TEMPLATE = null;
+    public static String EXTRA_TEXT = null;
+    public static String EXTRA_TEXT_LINES = null;
+    public static String EXTRA_TITLE = null;
+    public static String EXTRA_TITLE_BIG = null;
+    public static String GROUP_KEY_SILENT = null;
+
+    public static String getCategory(Notification p0) {
+        return null;
+    }
+
+    public static String getChannelId(Notification p0) {
+        return null;
+    }
+
+    public static String getGroup(Notification p0) {
+        return null;
+    }
+
+    public static String getShortcutId(Notification p0) {
+        return null;
+    }
+
+    public static String getSortKey(Notification p0) {
+        return null;
+    }
+
+    public static boolean getAllowSystemGeneratedContextualActions(Notification p0) {
+        return false;
+    }
+
+    public static boolean getLocalOnly(Notification p0) {
+        return false;
+    }
+
+    public static boolean isGroupSummary(Notification p0) {
+        return false;
+    }
+
+    public static int BADGE_ICON_LARGE = 0;
+    public static int BADGE_ICON_NONE = 0;
+    public static int BADGE_ICON_SMALL = 0;
+    public static int COLOR_DEFAULT = 0;
+    public static int DEFAULT_ALL = 0;
+    public static int DEFAULT_LIGHTS = 0;
+    public static int DEFAULT_SOUND = 0;
+    public static int DEFAULT_VIBRATE = 0;
+    public static int FLAG_AUTO_CANCEL = 0;
+    public static int FLAG_BUBBLE = 0;
+    public static int FLAG_FOREGROUND_SERVICE = 0;
+    public static int FLAG_GROUP_SUMMARY = 0;
+    public static int FLAG_HIGH_PRIORITY = 0;
+    public static int FLAG_INSISTENT = 0;
+    public static int FLAG_LOCAL_ONLY = 0;
+    public static int FLAG_NO_CLEAR = 0;
+    public static int FLAG_ONGOING_EVENT = 0;
+    public static int FLAG_ONLY_ALERT_ONCE = 0;
+    public static int FLAG_SHOW_LIGHTS = 0;
+    public static int GROUP_ALERT_ALL = 0;
+    public static int GROUP_ALERT_CHILDREN = 0;
+    public static int GROUP_ALERT_SUMMARY = 0;
+    public static int PRIORITY_DEFAULT = 0;
+    public static int PRIORITY_HIGH = 0;
+    public static int PRIORITY_LOW = 0;
+    public static int PRIORITY_MAX = 0;
+    public static int PRIORITY_MIN = 0;
+    public static int STREAM_DEFAULT = 0;
+    public static int VISIBILITY_PRIVATE = 0;
+    public static int VISIBILITY_PUBLIC = 0;
+    public static int VISIBILITY_SECRET = 0;
+
+    public static int getActionCount(Notification p0) {
+        return 0;
+    }
+
+    public static int getBadgeIconType(Notification p0) {
+        return 0;
+    }
+
+    public static int getGroupAlertBehavior(Notification p0) {
+        return 0;
+    }
+
+    public static long getTimeoutAfter(Notification p0) {
+        return 0;
+    }
+
+    static public class Action {
+        protected Action() {}
+
+        public Action(IconCompat p0, CharSequence p1, PendingIntent p2) {}
+
+        public Action(int p0, CharSequence p1, PendingIntent p2) {}
+
+        public Bundle getExtras() {
+            return null;
+        }
+
+        public CharSequence getTitle() {
+            return null;
+        }
+
+        public CharSequence title = null;
+
+        public IconCompat getIconCompat() {
+            return null;
+        }
+
+        public PendingIntent actionIntent = null;
+
+        public PendingIntent getActionIntent() {
+            return null;
+        }
+
+        public RemoteInput[] getDataOnlyRemoteInputs() {
+            return null;
+        }
+
+        public RemoteInput[] getRemoteInputs() {
+            return null;
+        }
+
+        public boolean getAllowGeneratedReplies() {
+            return false;
+        }
+
+        public boolean getShowsUserInterface() {
+            return false;
+        }
+
+        public boolean isContextual() {
+            return false;
+        }
+
+        public int getIcon() {
+            return 0;
+        }
+
+        public int getSemanticAction() {
+            return 0;
+        }
+
+        public int icon = 0;
+        public static int SEMANTIC_ACTION_ARCHIVE = 0;
+        public static int SEMANTIC_ACTION_CALL = 0;
+        public static int SEMANTIC_ACTION_DELETE = 0;
+        public static int SEMANTIC_ACTION_MARK_AS_READ = 0;
+        public static int SEMANTIC_ACTION_MARK_AS_UNREAD = 0;
+        public static int SEMANTIC_ACTION_MUTE = 0;
+        public static int SEMANTIC_ACTION_NONE = 0;
+        public static int SEMANTIC_ACTION_REPLY = 0;
+        public static int SEMANTIC_ACTION_THUMBS_DOWN = 0;
+        public static int SEMANTIC_ACTION_THUMBS_UP = 0;
+        public static int SEMANTIC_ACTION_UNMUTE = 0;
+
+        static public class Builder {
+            protected Builder() {}
+
+            public Builder(IconCompat p0, CharSequence p1, PendingIntent p2) {}
+
+            public Builder(NotificationCompat.Action p0) {}
+
+            public Builder(int p0, CharSequence p1, PendingIntent p2) {}
+
+            public Bundle getExtras() {
+                return null;
+            }
+
+            public NotificationCompat.Action build() {
+                return null;
+            }
+
+            public NotificationCompat.Action.Builder addExtras(Bundle p0) {
+                return null;
+            }
+
+            public NotificationCompat.Action.Builder addRemoteInput(RemoteInput p0) {
+                return null;
+            }
+
+            public NotificationCompat.Action.Builder extend(NotificationCompat.Action.Extender p0) {
+                return null;
+            }
+
+            public NotificationCompat.Action.Builder setAllowGeneratedReplies(boolean p0) {
+                return null;
+            }
+
+            public NotificationCompat.Action.Builder setContextual(boolean p0) {
+                return null;
+            }
+
+            public NotificationCompat.Action.Builder setSemanticAction(int p0) {
+                return null;
+            }
+
+            public NotificationCompat.Action.Builder setShowsUserInterface(boolean p0) {
+                return null;
+            }
+        }
+        static public interface Extender {
+            NotificationCompat.Action.Builder extend(NotificationCompat.Action.Builder p0);
+        }
+    }
+    static public class BigPictureStyle extends NotificationCompat.Style {
+        public BigPictureStyle() {}
+
+        public BigPictureStyle(NotificationCompat.Builder p0) {}
+
+        public NotificationCompat.BigPictureStyle bigLargeIcon(Bitmap p0) {
+            return null;
+        }
+
+        public NotificationCompat.BigPictureStyle bigPicture(Bitmap p0) {
+            return null;
+        }
+
+        public NotificationCompat.BigPictureStyle setBigContentTitle(CharSequence p0) {
+            return null;
+        }
+
+        public NotificationCompat.BigPictureStyle setSummaryText(CharSequence p0) {
+            return null;
+        }
+
+        public void apply(NotificationBuilderWithBuilderAccessor p0) {}
+    }
+    static public class BigTextStyle extends NotificationCompat.Style {
+        public BigTextStyle() {}
+
+        public BigTextStyle(NotificationCompat.Builder p0) {}
+
+        public NotificationCompat.BigTextStyle bigText(CharSequence p0) {
+            return null;
+        }
+
+        public NotificationCompat.BigTextStyle setBigContentTitle(CharSequence p0) {
+            return null;
+        }
+
+        public NotificationCompat.BigTextStyle setSummaryText(CharSequence p0) {
+            return null;
+        }
+
+        public void apply(NotificationBuilderWithBuilderAccessor p0) {}
+    }
+    static public class BubbleMetadata {
+        protected BubbleMetadata() {}
+
+        public IconCompat getIcon() {
+            return null;
+        }
+
+        public PendingIntent getDeleteIntent() {
+            return null;
+        }
+
+        public PendingIntent getIntent() {
+            return null;
+        }
+
+        public boolean getAutoExpandBubble() {
+            return false;
+        }
+
+        public boolean isNotificationSuppressed() {
+            return false;
+        }
+
+        public int getDesiredHeight() {
+            return 0;
+        }
+
+        public int getDesiredHeightResId() {
+            return 0;
+        }
+
+        public static Notification.BubbleMetadata toPlatform(NotificationCompat.BubbleMetadata p0) {
+            return null;
+        }
+
+        public static NotificationCompat.BubbleMetadata fromPlatform(
+                Notification.BubbleMetadata p0) {
+            return null;
+        }
+    }
+    static public class Builder {
+        protected Builder() {}
+
+        protected static CharSequence limitCharSequenceLength(CharSequence p0) {
+            return null;
+        }
+
+        public ArrayList<NotificationCompat.Action> mActions = null;
+        public ArrayList<String> mPeople = null;
+
+        public Builder(Context p0) {}
+
+        public Builder(Context p0, String p1) {}
+
+        public Bundle getExtras() {
+            return null;
+        }
+
+        public Context mContext = null;
+
+        public Notification build() {
+            return null;
+        }
+
+        public Notification getNotification() {
+            return null;
+        }
+
+        public NotificationCompat.BubbleMetadata getBubbleMetadata() {
+            return null;
+        }
+
+        public NotificationCompat.Builder addAction(NotificationCompat.Action p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder addAction(int p0, CharSequence p1, PendingIntent p2) {
+            return null;
+        }
+
+        public NotificationCompat.Builder addExtras(Bundle p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder addInvisibleAction(NotificationCompat.Action p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder addInvisibleAction(int p0, CharSequence p1,
+                PendingIntent p2) {
+            return null;
+        }
+
+        public NotificationCompat.Builder addPerson(String p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder extend(NotificationCompat.Extender p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setAllowSystemGeneratedContextualActions(boolean p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setAutoCancel(boolean p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setBadgeIconType(int p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setBubbleMetadata(NotificationCompat.BubbleMetadata p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setCategory(String p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setChannelId(String p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setChronometerCountDown(boolean p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setColor(int p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setColorized(boolean p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setContent(RemoteViews p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setContentInfo(CharSequence p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setContentIntent(PendingIntent p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setContentText(CharSequence p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setContentTitle(CharSequence p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setCustomBigContentView(RemoteViews p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setCustomContentView(RemoteViews p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setCustomHeadsUpContentView(RemoteViews p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setDefaults(int p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setDeleteIntent(PendingIntent p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setExtras(Bundle p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setFullScreenIntent(PendingIntent p0, boolean p1) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setGroup(String p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setGroupAlertBehavior(int p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setGroupSummary(boolean p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setLargeIcon(Bitmap p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setLights(int p0, int p1, int p2) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setLocalOnly(boolean p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setNotificationSilent() {
+            return null;
+        }
+
+        public NotificationCompat.Builder setNumber(int p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setOngoing(boolean p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setOnlyAlertOnce(boolean p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setPriority(int p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setProgress(int p0, int p1, boolean p2) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setPublicVersion(Notification p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setRemoteInputHistory(CharSequence[] p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setShortcutId(String p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setShowWhen(boolean p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setSmallIcon(int p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setSmallIcon(int p0, int p1) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setSortKey(String p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setSound(Uri p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setSound(Uri p0, int p1) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setStyle(NotificationCompat.Style p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setSubText(CharSequence p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setTicker(CharSequence p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setTicker(CharSequence p0, RemoteViews p1) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setTimeoutAfter(long p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setUsesChronometer(boolean p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setVibrate(long[] p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setVisibility(int p0) {
+            return null;
+        }
+
+        public NotificationCompat.Builder setWhen(long p0) {
+            return null;
+        }
+
+        public RemoteViews getBigContentView() {
+            return null;
+        }
+
+        public RemoteViews getContentView() {
+            return null;
+        }
+
+        public RemoteViews getHeadsUpContentView() {
+            return null;
+        }
+
+        public int getColor() {
+            return 0;
+        }
+
+        public int getPriority() {
+            return 0;
+        }
+
+        public long getWhenIfShowing() {
+            return 0;
+        }
+    }
+    static public class InboxStyle extends NotificationCompat.Style {
+        public InboxStyle() {}
+
+        public InboxStyle(NotificationCompat.Builder p0) {}
+
+        public NotificationCompat.InboxStyle addLine(CharSequence p0) {
+            return null;
+        }
+
+        public NotificationCompat.InboxStyle setBigContentTitle(CharSequence p0) {
+            return null;
+        }
+
+        public NotificationCompat.InboxStyle setSummaryText(CharSequence p0) {
+            return null;
+        }
+
+        public void apply(NotificationBuilderWithBuilderAccessor p0) {}
+    }
+    static public interface Extender {
+        NotificationCompat.Builder extend(NotificationCompat.Builder p0);
+    }
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/NotificationManagerCompat.java b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/NotificationManagerCompat.java
new file mode 100644
index 00000000000..184c3cd25c7
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/NotificationManagerCompat.java
@@ -0,0 +1,43 @@
+// Generated automatically from androidx.core.app.NotificationManagerCompat for testing purposes
+
+package androidx.core.app;
+
+import android.app.Notification;
+import android.app.NotificationChannel;
+import android.app.NotificationChannelGroup;
+import android.content.Context;
+import java.util.List;
+import java.util.Set;
+
+public class NotificationManagerCompat
+{
+    protected NotificationManagerCompat() {}
+    public List<NotificationChannel> getNotificationChannels(){ return null; }
+    public List<NotificationChannelGroup> getNotificationChannelGroups(){ return null; }
+    public NotificationChannel getNotificationChannel(String p0){ return null; }
+    public NotificationChannelGroup getNotificationChannelGroup(String p0){ return null; }
+    public boolean areNotificationsEnabled(){ return false; }
+    public int getImportance(){ return 0; }
+    public static NotificationManagerCompat from(Context p0){ return null; }
+    public static Set<String> getEnabledListenerPackages(Context p0){ return null; }
+    public static String ACTION_BIND_SIDE_CHANNEL = null;
+    public static String EXTRA_USE_SIDE_CHANNEL = null;
+    public static int IMPORTANCE_DEFAULT = 0;
+    public static int IMPORTANCE_HIGH = 0;
+    public static int IMPORTANCE_LOW = 0;
+    public static int IMPORTANCE_MAX = 0;
+    public static int IMPORTANCE_MIN = 0;
+    public static int IMPORTANCE_NONE = 0;
+    public static int IMPORTANCE_UNSPECIFIED = 0;
+    public void cancel(String p0, int p1){}
+    public void cancel(int p0){}
+    public void cancelAll(){}
+    public void createNotificationChannel(NotificationChannel p0){}
+    public void createNotificationChannelGroup(NotificationChannelGroup p0){}
+    public void createNotificationChannelGroups(List<NotificationChannelGroup> p0){}
+    public void createNotificationChannels(List<NotificationChannel> p0){}
+    public void deleteNotificationChannel(String p0){}
+    public void deleteNotificationChannelGroup(String p0){}
+    public void notify(String p0, int p1, Notification p2){}
+    public void notify(int p0, Notification p1){}
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/RemoteInput.java b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/RemoteInput.java
new file mode 100644
index 00000000000..8f684095110
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/core/app/RemoteInput.java
@@ -0,0 +1,71 @@
+// Generated automatically from androidx.core.app.RemoteInput for testing purposes
+
+package androidx.core.app;
+
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Bundle;
+import java.util.Map;
+import java.util.Set;
+
+public class RemoteInput {
+    protected RemoteInput() {}
+
+    public Bundle getExtras() {
+        return null;
+    }
+
+    public CharSequence getLabel() {
+        return null;
+    }
+
+    public CharSequence[] getChoices() {
+        return null;
+    }
+
+    public Set<String> getAllowedDataTypes() {
+        return null;
+    }
+
+    public String getResultKey() {
+        return null;
+    }
+
+    public boolean getAllowFreeFormInput() {
+        return false;
+    }
+
+    public boolean isDataOnly() {
+        return false;
+    }
+
+    public int getEditChoicesBeforeSending() {
+        return 0;
+    }
+
+    public static Bundle getResultsFromIntent(Intent p0) {
+        return null;
+    }
+
+    public static Map<String, Uri> getDataResultsFromIntent(Intent p0, String p1) {
+        return null;
+    }
+
+    public static String EXTRA_RESULTS_DATA = null;
+    public static String RESULTS_CLIP_LABEL = null;
+    public static int EDIT_CHOICES_BEFORE_SENDING_AUTO = 0;
+    public static int EDIT_CHOICES_BEFORE_SENDING_DISABLED = 0;
+    public static int EDIT_CHOICES_BEFORE_SENDING_ENABLED = 0;
+    public static int SOURCE_CHOICE = 0;
+    public static int SOURCE_FREE_FORM_INPUT = 0;
+
+    public static int getResultsSource(Intent p0) {
+        return 0;
+    }
+
+    public static void addDataResultToIntent(RemoteInput p0, Intent p1, Map<String, Uri> p2) {}
+
+    public static void addResultsToIntent(RemoteInput[] p0, Intent p1, Bundle p2) {}
+
+    public static void setResultsSource(Intent p0, int p1) {}
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/remotecallback/CallbackReceiver.java b/java/ql/test/stubs/google-android-9.0.0/androidx/remotecallback/CallbackReceiver.java
new file mode 100644
index 00000000000..3215fe270d8
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/remotecallback/CallbackReceiver.java
@@ -0,0 +1,10 @@
+// Generated automatically from androidx.remotecallback.CallbackReceiver for testing purposes
+
+package androidx.remotecallback;
+
+import android.content.Context;
+
+public interface CallbackReceiver<T>
+{
+    T createRemoteCallback(Context p0);
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/slice/Clock.java b/java/ql/test/stubs/google-android-9.0.0/androidx/slice/Clock.java
new file mode 100644
index 00000000000..4aed87209c6
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/slice/Clock.java
@@ -0,0 +1,9 @@
+// Generated automatically from androidx.slice.Clock for testing purposes
+
+package androidx.slice;
+
+
+public interface Clock
+{
+    long currentTimeMillis();
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/slice/builders/impl/TemplateBuilderImpl.java b/java/ql/test/stubs/google-android-9.0.0/androidx/slice/builders/impl/TemplateBuilderImpl.java
new file mode 100644
index 00000000000..073ce2604c9
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/slice/builders/impl/TemplateBuilderImpl.java
@@ -0,0 +1,23 @@
+// Generated automatically from androidx.slice.builders.impl.TemplateBuilderImpl for testing purposes
+
+package androidx.slice.builders.impl;
+
+import androidx.slice.Clock;
+import androidx.slice.Slice;
+import androidx.slice.SliceSpec;
+import java.util.ArrayList;
+
+abstract public class TemplateBuilderImpl
+{
+    protected TemplateBuilderImpl() {}
+    protected ArrayList<String> parseImageMode(int p0, boolean p1){ return null; }
+    protected TemplateBuilderImpl(Slice.Builder p0, SliceSpec p1){}
+    protected TemplateBuilderImpl(Slice.Builder p0, SliceSpec p1, Clock p2){}
+    protected void setBuilder(Slice.Builder p0){}
+    public Clock getClock(){ return null; }
+    public Slice build(){ return null; }
+    public Slice.Builder createChildBuilder(){ return null; }
+    public Slice.Builder getBuilder(){ return null; }
+    public SliceSpec getSpec(){ return null; }
+    public abstract void apply(Slice.Builder p0);
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/slice/compat/CompatPermissionManager.java b/java/ql/test/stubs/google-android-9.0.0/androidx/slice/compat/CompatPermissionManager.java
new file mode 100644
index 00000000000..a04e2c809cd
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/slice/compat/CompatPermissionManager.java
@@ -0,0 +1,16 @@
+// Generated automatically from androidx.slice.compat.CompatPermissionManager for testing purposes
+
+package androidx.slice.compat;
+
+import android.content.Context;
+import android.net.Uri;
+
+public class CompatPermissionManager
+{
+    protected CompatPermissionManager() {}
+    public CompatPermissionManager(Context p0, String p1, int p2, String[] p3){}
+    public int checkSlicePermission(Uri p0, int p1, int p2){ return 0; }
+    public static String ALL_SUFFIX = null;
+    public void grantSlicePermission(Uri p0, String p1){}
+    public void revokeSlicePermission(Uri p0, String p1){}
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/versionedparcelable/CustomVersionedParcelable.java b/java/ql/test/stubs/google-android-9.0.0/androidx/versionedparcelable/CustomVersionedParcelable.java
new file mode 100644
index 00000000000..8ffcfef8989
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/versionedparcelable/CustomVersionedParcelable.java
@@ -0,0 +1,14 @@
+// Generated automatically from androidx.versionedparcelable.CustomVersionedParcelable for testing
+// purposes
+
+package androidx.versionedparcelable;
+
+import androidx.versionedparcelable.VersionedParcelable;
+
+abstract public class CustomVersionedParcelable implements VersionedParcelable {
+    public CustomVersionedParcelable() {}
+
+    public void onPostParceling() {}
+
+    public void onPreParceling(boolean p0) {}
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/versionedparcelable/VersionedParcelable.java b/java/ql/test/stubs/google-android-9.0.0/androidx/versionedparcelable/VersionedParcelable.java
new file mode 100644
index 00000000000..866f2e392ab
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/versionedparcelable/VersionedParcelable.java
@@ -0,0 +1,8 @@
+// Generated automatically from androidx.versionedparcelable.VersionedParcelable for testing
+// purposes
+
+package androidx.versionedparcelable;
+
+
+public interface VersionedParcelable {
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JacksonAnnotationValue.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JacksonAnnotationValue.java
new file mode 100644
index 00000000000..e161dbc27db
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JacksonAnnotationValue.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.fasterxml.jackson.annotation.JacksonAnnotationValue for testing purposes
+
+package com.fasterxml.jackson.annotation;
+
+import java.lang.annotation.Annotation;
+
+public interface JacksonAnnotationValue<A extends Annotation>
+{
+    Class<A> valueFor();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonAutoDetect.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonAutoDetect.java
new file mode 100644
index 00000000000..af74d6eabdf
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonAutoDetect.java
@@ -0,0 +1,21 @@
+// Generated automatically from com.fasterxml.jackson.annotation.JsonAutoDetect for testing purposes
+
+package com.fasterxml.jackson.annotation;
+
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Member;
+
+public interface JsonAutoDetect extends Annotation
+{
+    JsonAutoDetect.Visibility creatorVisibility();
+    JsonAutoDetect.Visibility fieldVisibility();
+    JsonAutoDetect.Visibility getterVisibility();
+    JsonAutoDetect.Visibility isGetterVisibility();
+    JsonAutoDetect.Visibility setterVisibility();
+    static public enum Visibility
+    {
+        ANY, DEFAULT, NONE, NON_PRIVATE, PROTECTED_AND_PUBLIC, PUBLIC_ONLY;
+        private Visibility() {}
+        public boolean isVisible(Member p0){ return false; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonCreator.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonCreator.java
new file mode 100644
index 00000000000..197fc7b49e7
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonCreator.java
@@ -0,0 +1,15 @@
+// Generated automatically from com.fasterxml.jackson.annotation.JsonCreator for testing purposes
+
+package com.fasterxml.jackson.annotation;
+
+import java.lang.annotation.Annotation;
+
+public interface JsonCreator extends Annotation
+{
+    JsonCreator.Mode mode();
+    static public enum Mode
+    {
+        DEFAULT, DELEGATING, DISABLED, PROPERTIES;
+        private Mode() {}
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonFormat.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonFormat.java
new file mode 100644
index 00000000000..ce55732ae95
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonFormat.java
@@ -0,0 +1,82 @@
+// Generated automatically from com.fasterxml.jackson.annotation.JsonFormat for testing purposes
+
+package com.fasterxml.jackson.annotation;
+
+import com.fasterxml.jackson.annotation.JacksonAnnotationValue;
+import java.io.Serializable;
+import java.lang.annotation.Annotation;
+import java.util.Locale;
+import java.util.TimeZone;
+
+public interface JsonFormat extends Annotation
+{
+    JsonFormat.Feature[] with();
+    JsonFormat.Feature[] without();
+    JsonFormat.Shape shape();
+    String locale();
+    String pattern();
+    String timezone();
+    static String DEFAULT_LOCALE = null;
+    static String DEFAULT_TIMEZONE = null;
+    static public class Features
+    {
+        protected Features() {}
+        public Boolean get(JsonFormat.Feature p0){ return null; }
+        public JsonFormat.Features with(JsonFormat.Feature... p0){ return null; }
+        public JsonFormat.Features withOverrides(JsonFormat.Features p0){ return null; }
+        public JsonFormat.Features without(JsonFormat.Feature... p0){ return null; }
+        public boolean equals(Object p0){ return false; }
+        public int hashCode(){ return 0; }
+        public static JsonFormat.Features construct(JsonFormat p0){ return null; }
+        public static JsonFormat.Features construct(JsonFormat.Feature[] p0, JsonFormat.Feature[] p1){ return null; }
+        public static JsonFormat.Features empty(){ return null; }
+    }
+    static public class Value implements JacksonAnnotationValue<JsonFormat>, Serializable
+    {
+        public Boolean getFeature(JsonFormat.Feature p0){ return null; }
+        public Class<JsonFormat> valueFor(){ return null; }
+        public JsonFormat.Shape getShape(){ return null; }
+        public JsonFormat.Value withFeature(JsonFormat.Feature p0){ return null; }
+        public JsonFormat.Value withLocale(Locale p0){ return null; }
+        public JsonFormat.Value withPattern(String p0){ return null; }
+        public JsonFormat.Value withShape(JsonFormat.Shape p0){ return null; }
+        public JsonFormat.Value withTimeZone(TimeZone p0){ return null; }
+        public JsonFormat.Value withoutFeature(JsonFormat.Feature p0){ return null; }
+        public Locale getLocale(){ return null; }
+        public String getPattern(){ return null; }
+        public String timeZoneAsString(){ return null; }
+        public String toString(){ return null; }
+        public TimeZone getTimeZone(){ return null; }
+        public Value(){}
+        public Value(JsonFormat p0){}
+        public Value(String p0, JsonFormat.Shape p1, Locale p2, String p3, TimeZone p4){}
+        public Value(String p0, JsonFormat.Shape p1, Locale p2, String p3, TimeZone p4, JsonFormat.Features p5){}
+        public Value(String p0, JsonFormat.Shape p1, Locale p2, TimeZone p3){}
+        public Value(String p0, JsonFormat.Shape p1, Locale p2, TimeZone p3, JsonFormat.Features p4){}
+        public Value(String p0, JsonFormat.Shape p1, String p2, String p3){}
+        public Value(String p0, JsonFormat.Shape p1, String p2, String p3, JsonFormat.Features p4){}
+        public boolean equals(Object p0){ return false; }
+        public boolean hasLocale(){ return false; }
+        public boolean hasPattern(){ return false; }
+        public boolean hasShape(){ return false; }
+        public boolean hasTimeZone(){ return false; }
+        public final JsonFormat.Value withOverrides(JsonFormat.Value p0){ return null; }
+        public int hashCode(){ return 0; }
+        public static JsonFormat.Value empty(){ return null; }
+        public static JsonFormat.Value forPattern(String p0){ return null; }
+        public static JsonFormat.Value forShape(JsonFormat.Shape p0){ return null; }
+        public static JsonFormat.Value from(JsonFormat p0){ return null; }
+    }
+    static public enum Feature
+    {
+        ACCEPT_SINGLE_VALUE_AS_ARRAY, WRITE_DATES_WITH_ZONE_ID, WRITE_DATE_TIMESTAMPS_AS_NANOSECONDS, WRITE_SINGLE_ELEM_ARRAYS_UNWRAPPED, WRITE_SORTED_MAP_ENTRIES;
+        private Feature() {}
+    }
+    static public enum Shape
+    {
+        ANY, ARRAY, BOOLEAN, NUMBER, NUMBER_FLOAT, NUMBER_INT, OBJECT, SCALAR, STRING;
+        private Shape() {}
+        public boolean isNumeric(){ return false; }
+        public boolean isStructured(){ return false; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonInclude.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonInclude.java
new file mode 100644
index 00000000000..9a3e6f50582
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonInclude.java
@@ -0,0 +1,40 @@
+// Generated automatically from com.fasterxml.jackson.annotation.JsonInclude for testing purposes
+
+package com.fasterxml.jackson.annotation;
+
+import com.fasterxml.jackson.annotation.JacksonAnnotationValue;
+import java.io.Serializable;
+import java.lang.annotation.Annotation;
+
+public interface JsonInclude extends Annotation
+{
+    JsonInclude.Include content();
+    JsonInclude.Include value();
+    static public class Value implements JacksonAnnotationValue<JsonInclude>, Serializable
+    {
+        protected Value() {}
+        protected Object readResolve(){ return null; }
+        protected Value(JsonInclude.Include p0, JsonInclude.Include p1){}
+        protected final JsonInclude.Include _contentInclusion = null;
+        protected final JsonInclude.Include _valueInclusion = null;
+        protected static JsonInclude.Value EMPTY = null;
+        public Class<JsonInclude> valueFor(){ return null; }
+        public JsonInclude.Include getContentInclusion(){ return null; }
+        public JsonInclude.Include getValueInclusion(){ return null; }
+        public JsonInclude.Value withContentInclusion(JsonInclude.Include p0){ return null; }
+        public JsonInclude.Value withOverrides(JsonInclude.Value p0){ return null; }
+        public JsonInclude.Value withValueInclusion(JsonInclude.Include p0){ return null; }
+        public String toString(){ return null; }
+        public Value(JsonInclude p0){}
+        public boolean equals(Object p0){ return false; }
+        public int hashCode(){ return 0; }
+        public static JsonInclude.Value construct(JsonInclude.Include p0, JsonInclude.Include p1){ return null; }
+        public static JsonInclude.Value empty(){ return null; }
+        public static JsonInclude.Value from(JsonInclude p0){ return null; }
+    }
+    static public enum Include
+    {
+        ALWAYS, NON_ABSENT, NON_DEFAULT, NON_EMPTY, NON_NULL, USE_DEFAULTS;
+        private Include() {}
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonProperty.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonProperty.java
new file mode 100644
index 00000000000..3aa2f5e6c6c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonProperty.java
@@ -0,0 +1,21 @@
+// Generated automatically from com.fasterxml.jackson.annotation.JsonProperty for testing purposes
+
+package com.fasterxml.jackson.annotation;
+
+import java.lang.annotation.Annotation;
+
+public interface JsonProperty extends Annotation
+{
+    JsonProperty.Access access();
+    String defaultValue();
+    String value();
+    boolean required();
+    int index();
+    static String USE_DEFAULT_NAME = null;
+    static int INDEX_UNKNOWN = 0;
+    static public enum Access
+    {
+        AUTO, READ_ONLY, READ_WRITE, WRITE_ONLY;
+        private Access() {}
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonTypeInfo.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonTypeInfo.java
new file mode 100644
index 00000000000..9cb8f81cc02
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/JsonTypeInfo.java
@@ -0,0 +1,25 @@
+// Generated automatically from com.fasterxml.jackson.annotation.JsonTypeInfo for testing purposes
+
+package com.fasterxml.jackson.annotation;
+
+import java.lang.annotation.Annotation;
+
+public interface JsonTypeInfo extends Annotation
+{
+    Class<? extends Object> defaultImpl();
+    JsonTypeInfo.As include();
+    JsonTypeInfo.Id use();
+    String property();
+    boolean visible();
+    static public enum As
+    {
+        EXISTING_PROPERTY, EXTERNAL_PROPERTY, PROPERTY, WRAPPER_ARRAY, WRAPPER_OBJECT;
+        private As() {}
+    }
+    static public enum Id
+    {
+        CLASS, CUSTOM, MINIMAL_CLASS, NAME, NONE;
+        private Id() {}
+        public String getDefaultPropertyName(){ return null; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/ObjectIdGenerator.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/ObjectIdGenerator.java
new file mode 100644
index 00000000000..d26901a762f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/ObjectIdGenerator.java
@@ -0,0 +1,29 @@
+// Generated automatically from com.fasterxml.jackson.annotation.ObjectIdGenerator for testing purposes
+
+package com.fasterxml.jackson.annotation;
+
+import java.io.Serializable;
+
+abstract public class ObjectIdGenerator<T> implements Serializable
+{
+    public ObjectIdGenerator(){}
+    public abstract Class<? extends Object> getScope();
+    public abstract ObjectIdGenerator.IdKey key(Object p0);
+    public abstract ObjectIdGenerator<T> forScope(Class<? extends Object> p0);
+    public abstract ObjectIdGenerator<T> newForSerialization(Object p0);
+    public abstract T generateId(Object p0);
+    public abstract boolean canUseFor(ObjectIdGenerator<? extends Object> p0);
+    public boolean isValidReferencePropertyName(String p0, Object p1){ return false; }
+    public boolean maySerializeAsObject(){ return false; }
+    static public class IdKey implements Serializable
+    {
+        protected IdKey() {}
+        public IdKey(Class<? extends Object> p0, Class<? extends Object> p1, Object p2){}
+        public String toString(){ return null; }
+        public boolean equals(Object p0){ return false; }
+        public final Class<? extends Object> scope = null;
+        public final Class<? extends Object> type = null;
+        public final Object key = null;
+        public int hashCode(){ return 0; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/ObjectIdResolver.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/ObjectIdResolver.java
new file mode 100644
index 00000000000..2311d229ff6
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/ObjectIdResolver.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.annotation.ObjectIdResolver for testing purposes
+
+package com.fasterxml.jackson.annotation;
+
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+
+public interface ObjectIdResolver
+{
+    Object resolveId(ObjectIdGenerator.IdKey p0);
+    ObjectIdResolver newForDeserialization(Object p0);
+    boolean canUseFor(ObjectIdResolver p0);
+    void bindItem(ObjectIdGenerator.IdKey p0, Object p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/PropertyAccessor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/PropertyAccessor.java
new file mode 100644
index 00000000000..fb02398b4bf
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/annotation/PropertyAccessor.java
@@ -0,0 +1,15 @@
+// Generated automatically from com.fasterxml.jackson.annotation.PropertyAccessor for testing purposes
+
+package com.fasterxml.jackson.annotation;
+
+
+public enum PropertyAccessor
+{
+    ALL, CREATOR, FIELD, GETTER, IS_GETTER, NONE, SETTER;
+    private PropertyAccessor() {}
+    public boolean creatorEnabled(){ return false; }
+    public boolean fieldEnabled(){ return false; }
+    public boolean getterEnabled(){ return false; }
+    public boolean isGetterEnabled(){ return false; }
+    public boolean setterEnabled(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/Base64Variant.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/Base64Variant.java
new file mode 100644
index 00000000000..d915fffd3e6
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/Base64Variant.java
@@ -0,0 +1,44 @@
+// Generated automatically from com.fasterxml.jackson.core.Base64Variant for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.util.ByteArrayBuilder;
+import java.io.Serializable;
+
+public class Base64Variant implements Serializable
+{
+    protected Base64Variant() {}
+    protected Object readResolve(){ return null; }
+    protected void _reportBase64EOF(){}
+    protected void _reportInvalidBase64(char p0, int p1, String p2){}
+    public Base64Variant(Base64Variant p0, String p1, boolean p2, char p3, int p4){}
+    public Base64Variant(Base64Variant p0, String p1, int p2){}
+    public Base64Variant(String p0, String p1, boolean p2, char p3, int p4){}
+    public String encode(byte[] p0){ return null; }
+    public String encode(byte[] p0, boolean p1){ return null; }
+    public String getName(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean usesPadding(){ return false; }
+    public boolean usesPaddingChar(char p0){ return false; }
+    public boolean usesPaddingChar(int p0){ return false; }
+    public byte encodeBase64BitsAsByte(int p0){ return 0; }
+    public byte getPaddingByte(){ return 0; }
+    public byte[] decode(String p0){ return null; }
+    public char encodeBase64BitsAsChar(int p0){ return '0'; }
+    public char getPaddingChar(){ return '0'; }
+    public int decodeBase64Byte(byte p0){ return 0; }
+    public int decodeBase64Char(char p0){ return 0; }
+    public int decodeBase64Char(int p0){ return 0; }
+    public int encodeBase64Chunk(int p0, byte[] p1, int p2){ return 0; }
+    public int encodeBase64Chunk(int p0, char[] p1, int p2){ return 0; }
+    public int encodeBase64Partial(int p0, int p1, byte[] p2, int p3){ return 0; }
+    public int encodeBase64Partial(int p0, int p1, char[] p2, int p3){ return 0; }
+    public int getMaxLineLength(){ return 0; }
+    public int hashCode(){ return 0; }
+    public static int BASE64_VALUE_INVALID = 0;
+    public static int BASE64_VALUE_PADDING = 0;
+    public void decode(String p0, ByteArrayBuilder p1){}
+    public void encodeBase64Chunk(StringBuilder p0, int p1){}
+    public void encodeBase64Partial(StringBuilder p0, int p1, int p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/FormatFeature.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/FormatFeature.java
new file mode 100644
index 00000000000..ce203f2e529
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/FormatFeature.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.core.FormatFeature for testing purposes
+
+package com.fasterxml.jackson.core;
+
+
+public interface FormatFeature
+{
+    boolean enabledByDefault();
+    boolean enabledIn(int p0);
+    int getMask();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/FormatSchema.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/FormatSchema.java
new file mode 100644
index 00000000000..bec0cc33756
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/FormatSchema.java
@@ -0,0 +1,9 @@
+// Generated automatically from com.fasterxml.jackson.core.FormatSchema for testing purposes
+
+package com.fasterxml.jackson.core;
+
+
+public interface FormatSchema
+{
+    String getSchemaType();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonEncoding.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonEncoding.java
new file mode 100644
index 00000000000..99a64d613b6
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonEncoding.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.core.JsonEncoding for testing purposes
+
+package com.fasterxml.jackson.core;
+
+
+public enum JsonEncoding
+{
+    UTF16_BE, UTF16_LE, UTF32_BE, UTF32_LE, UTF8;
+    private JsonEncoding() {}
+    public String getJavaName(){ return null; }
+    public boolean isBigEndian(){ return false; }
+    public int bits(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonFactory.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonFactory.java
new file mode 100644
index 00000000000..e95401584b1
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonFactory.java
@@ -0,0 +1,134 @@
+// Generated automatically from com.fasterxml.jackson.core.JsonFactory for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.FormatFeature;
+import com.fasterxml.jackson.core.FormatSchema;
+import com.fasterxml.jackson.core.JsonEncoding;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.ObjectCodec;
+import com.fasterxml.jackson.core.SerializableString;
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.core.Versioned;
+import com.fasterxml.jackson.core.format.InputAccessor;
+import com.fasterxml.jackson.core.format.MatchStrength;
+import com.fasterxml.jackson.core.io.CharacterEscapes;
+import com.fasterxml.jackson.core.io.IOContext;
+import com.fasterxml.jackson.core.io.InputDecorator;
+import com.fasterxml.jackson.core.io.OutputDecorator;
+import com.fasterxml.jackson.core.sym.ByteQuadsCanonicalizer;
+import com.fasterxml.jackson.core.sym.CharsToNameCanonicalizer;
+import com.fasterxml.jackson.core.util.BufferRecycler;
+import java.io.File;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.Reader;
+import java.io.Serializable;
+import java.io.Writer;
+import java.lang.ref.SoftReference;
+import java.net.URL;
+
+public class JsonFactory implements Serializable, Versioned
+{
+    protected CharacterEscapes _characterEscapes = null;
+    protected IOContext _createContext(Object p0, boolean p1){ return null; }
+    protected InputDecorator _inputDecorator = null;
+    protected InputStream _optimizedStreamFromURL(URL p0){ return null; }
+    protected JsonFactory(JsonFactory p0, ObjectCodec p1){}
+    protected JsonGenerator _createGenerator(Writer p0, IOContext p1){ return null; }
+    protected JsonGenerator _createUTF8Generator(OutputStream p0, IOContext p1){ return null; }
+    protected JsonParser _createParser(InputStream p0, IOContext p1){ return null; }
+    protected JsonParser _createParser(Reader p0, IOContext p1){ return null; }
+    protected JsonParser _createParser(byte[] p0, int p1, int p2, IOContext p3){ return null; }
+    protected JsonParser _createParser(char[] p0, int p1, int p2, IOContext p3, boolean p4){ return null; }
+    protected MatchStrength hasJSONFormat(InputAccessor p0){ return null; }
+    protected Object readResolve(){ return null; }
+    protected ObjectCodec _objectCodec = null;
+    protected OutputDecorator _outputDecorator = null;
+    protected SerializableString _rootValueSeparator = null;
+    protected Writer _createWriter(OutputStream p0, JsonEncoding p1, IOContext p2){ return null; }
+    protected final ByteQuadsCanonicalizer _byteSymbolCanonicalizer = null;
+    protected final CharsToNameCanonicalizer _rootCharSymbols = null;
+    protected final InputStream _decorate(InputStream p0, IOContext p1){ return null; }
+    protected final OutputStream _decorate(OutputStream p0, IOContext p1){ return null; }
+    protected final Reader _decorate(Reader p0, IOContext p1){ return null; }
+    protected final Writer _decorate(Writer p0, IOContext p1){ return null; }
+    protected int _factoryFeatures = 0;
+    protected int _generatorFeatures = 0;
+    protected int _parserFeatures = 0;
+    protected static ThreadLocal<SoftReference<BufferRecycler>> _recyclerRef = null;
+    protected static int DEFAULT_FACTORY_FEATURE_FLAGS = 0;
+    protected static int DEFAULT_GENERATOR_FEATURE_FLAGS = 0;
+    protected static int DEFAULT_PARSER_FEATURE_FLAGS = 0;
+    protected void _checkInvalidCopy(Class<? extends Object> p0){}
+    public BufferRecycler _getBufferRecycler(){ return null; }
+    public CharacterEscapes getCharacterEscapes(){ return null; }
+    public Class<? extends FormatFeature> getFormatReadFeatureType(){ return null; }
+    public Class<? extends FormatFeature> getFormatWriteFeatureType(){ return null; }
+    public InputDecorator getInputDecorator(){ return null; }
+    public JsonFactory copy(){ return null; }
+    public JsonFactory disable(JsonFactory.Feature p0){ return null; }
+    public JsonFactory disable(JsonGenerator.Feature p0){ return null; }
+    public JsonFactory disable(JsonParser.Feature p0){ return null; }
+    public JsonFactory enable(JsonFactory.Feature p0){ return null; }
+    public JsonFactory enable(JsonGenerator.Feature p0){ return null; }
+    public JsonFactory enable(JsonParser.Feature p0){ return null; }
+    public JsonFactory setCharacterEscapes(CharacterEscapes p0){ return null; }
+    public JsonFactory setCodec(ObjectCodec p0){ return null; }
+    public JsonFactory setInputDecorator(InputDecorator p0){ return null; }
+    public JsonFactory setOutputDecorator(OutputDecorator p0){ return null; }
+    public JsonFactory setRootValueSeparator(String p0){ return null; }
+    public JsonFactory(){}
+    public JsonFactory(ObjectCodec p0){}
+    public JsonGenerator createGenerator(File p0, JsonEncoding p1){ return null; }
+    public JsonGenerator createGenerator(OutputStream p0){ return null; }
+    public JsonGenerator createGenerator(OutputStream p0, JsonEncoding p1){ return null; }
+    public JsonGenerator createGenerator(Writer p0){ return null; }
+    public JsonGenerator createJsonGenerator(OutputStream p0){ return null; }
+    public JsonGenerator createJsonGenerator(OutputStream p0, JsonEncoding p1){ return null; }
+    public JsonGenerator createJsonGenerator(Writer p0){ return null; }
+    public JsonParser createJsonParser(File p0){ return null; }
+    public JsonParser createJsonParser(InputStream p0){ return null; }
+    public JsonParser createJsonParser(Reader p0){ return null; }
+    public JsonParser createJsonParser(String p0){ return null; }
+    public JsonParser createJsonParser(URL p0){ return null; }
+    public JsonParser createJsonParser(byte[] p0){ return null; }
+    public JsonParser createJsonParser(byte[] p0, int p1, int p2){ return null; }
+    public JsonParser createParser(File p0){ return null; }
+    public JsonParser createParser(InputStream p0){ return null; }
+    public JsonParser createParser(Reader p0){ return null; }
+    public JsonParser createParser(String p0){ return null; }
+    public JsonParser createParser(URL p0){ return null; }
+    public JsonParser createParser(byte[] p0){ return null; }
+    public JsonParser createParser(byte[] p0, int p1, int p2){ return null; }
+    public JsonParser createParser(char[] p0){ return null; }
+    public JsonParser createParser(char[] p0, int p1, int p2){ return null; }
+    public MatchStrength hasFormat(InputAccessor p0){ return null; }
+    public ObjectCodec getCodec(){ return null; }
+    public OutputDecorator getOutputDecorator(){ return null; }
+    public String getFormatName(){ return null; }
+    public String getRootValueSeparator(){ return null; }
+    public Version version(){ return null; }
+    public boolean canHandleBinaryNatively(){ return false; }
+    public boolean canUseCharArrays(){ return false; }
+    public boolean canUseSchema(FormatSchema p0){ return false; }
+    public boolean requiresCustomCodec(){ return false; }
+    public boolean requiresPropertyOrdering(){ return false; }
+    public final JsonFactory configure(JsonFactory.Feature p0, boolean p1){ return null; }
+    public final JsonFactory configure(JsonGenerator.Feature p0, boolean p1){ return null; }
+    public final JsonFactory configure(JsonParser.Feature p0, boolean p1){ return null; }
+    public final boolean isEnabled(JsonFactory.Feature p0){ return false; }
+    public final boolean isEnabled(JsonGenerator.Feature p0){ return false; }
+    public final boolean isEnabled(JsonParser.Feature p0){ return false; }
+    public static String FORMAT_NAME_JSON = null;
+    static public enum Feature
+    {
+        CANONICALIZE_FIELD_NAMES, FAIL_ON_SYMBOL_HASH_OVERFLOW, INTERN_FIELD_NAMES, USE_THREAD_LOCAL_FOR_BUFFER_RECYCLING;
+        private Feature() {}
+        public boolean enabledByDefault(){ return false; }
+        public boolean enabledIn(int p0){ return false; }
+        public int getMask(){ return 0; }
+        public static int collectDefaults(){ return 0; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonGenerator.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonGenerator.java
new file mode 100644
index 00000000000..5be02d7f390
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonGenerator.java
@@ -0,0 +1,135 @@
+// Generated automatically from com.fasterxml.jackson.core.JsonGenerator for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.core.FormatSchema;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonStreamContext;
+import com.fasterxml.jackson.core.ObjectCodec;
+import com.fasterxml.jackson.core.PrettyPrinter;
+import com.fasterxml.jackson.core.SerializableString;
+import com.fasterxml.jackson.core.TreeNode;
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.core.Versioned;
+import com.fasterxml.jackson.core.io.CharacterEscapes;
+import java.io.Closeable;
+import java.io.Flushable;
+import java.io.InputStream;
+import java.math.BigDecimal;
+import java.math.BigInteger;
+
+abstract public class JsonGenerator implements Closeable, Flushable, Versioned
+{
+    protected JsonGenerator(){}
+    protected PrettyPrinter _cfgPrettyPrinter = null;
+    protected final void _throwInternal(){}
+    protected void _reportError(String p0){}
+    protected void _reportUnsupportedOperation(){}
+    protected void _writeSimpleObject(Object p0){}
+    public CharacterEscapes getCharacterEscapes(){ return null; }
+    public FormatSchema getSchema(){ return null; }
+    public JsonGenerator overrideFormatFeatures(int p0, int p1){ return null; }
+    public JsonGenerator overrideStdFeatures(int p0, int p1){ return null; }
+    public JsonGenerator setCharacterEscapes(CharacterEscapes p0){ return null; }
+    public JsonGenerator setHighestNonEscapedChar(int p0){ return null; }
+    public JsonGenerator setPrettyPrinter(PrettyPrinter p0){ return null; }
+    public JsonGenerator setRootValueSeparator(SerializableString p0){ return null; }
+    public Object getCurrentValue(){ return null; }
+    public Object getOutputTarget(){ return null; }
+    public PrettyPrinter getPrettyPrinter(){ return null; }
+    public abstract JsonGenerator disable(JsonGenerator.Feature p0);
+    public abstract JsonGenerator enable(JsonGenerator.Feature p0);
+    public abstract JsonGenerator setCodec(ObjectCodec p0);
+    public abstract JsonGenerator setFeatureMask(int p0);
+    public abstract JsonGenerator useDefaultPrettyPrinter();
+    public abstract JsonStreamContext getOutputContext();
+    public abstract ObjectCodec getCodec();
+    public abstract Version version();
+    public abstract boolean isClosed();
+    public abstract boolean isEnabled(JsonGenerator.Feature p0);
+    public abstract int getFeatureMask();
+    public abstract int writeBinary(Base64Variant p0, InputStream p1, int p2);
+    public abstract void close();
+    public abstract void flush();
+    public abstract void writeBinary(Base64Variant p0, byte[] p1, int p2, int p3);
+    public abstract void writeBoolean(boolean p0);
+    public abstract void writeEndArray();
+    public abstract void writeEndObject();
+    public abstract void writeFieldName(SerializableString p0);
+    public abstract void writeFieldName(String p0);
+    public abstract void writeNull();
+    public abstract void writeNumber(BigDecimal p0);
+    public abstract void writeNumber(BigInteger p0);
+    public abstract void writeNumber(String p0);
+    public abstract void writeNumber(double p0);
+    public abstract void writeNumber(float p0);
+    public abstract void writeNumber(int p0);
+    public abstract void writeNumber(long p0);
+    public abstract void writeObject(Object p0);
+    public abstract void writeRaw(String p0);
+    public abstract void writeRaw(String p0, int p1, int p2);
+    public abstract void writeRaw(char p0);
+    public abstract void writeRaw(char[] p0, int p1, int p2);
+    public abstract void writeRawUTF8String(byte[] p0, int p1, int p2);
+    public abstract void writeRawValue(String p0);
+    public abstract void writeRawValue(String p0, int p1, int p2);
+    public abstract void writeRawValue(char[] p0, int p1, int p2);
+    public abstract void writeStartArray();
+    public abstract void writeStartObject();
+    public abstract void writeString(SerializableString p0);
+    public abstract void writeString(String p0);
+    public abstract void writeString(char[] p0, int p1, int p2);
+    public abstract void writeTree(TreeNode p0);
+    public abstract void writeUTF8String(byte[] p0, int p1, int p2);
+    public boolean canOmitFields(){ return false; }
+    public boolean canUseSchema(FormatSchema p0){ return false; }
+    public boolean canWriteBinaryNatively(){ return false; }
+    public boolean canWriteFormattedNumbers(){ return false; }
+    public boolean canWriteObjectId(){ return false; }
+    public boolean canWriteTypeId(){ return false; }
+    public final JsonGenerator configure(JsonGenerator.Feature p0, boolean p1){ return null; }
+    public final void writeArrayFieldStart(String p0){}
+    public final void writeBinaryField(String p0, byte[] p1){}
+    public final void writeBooleanField(String p0, boolean p1){}
+    public final void writeNullField(String p0){}
+    public final void writeNumberField(String p0, BigDecimal p1){}
+    public final void writeNumberField(String p0, double p1){}
+    public final void writeNumberField(String p0, float p1){}
+    public final void writeNumberField(String p0, int p1){}
+    public final void writeNumberField(String p0, long p1){}
+    public final void writeObjectField(String p0, Object p1){}
+    public final void writeObjectFieldStart(String p0){}
+    public int getFormatFeatures(){ return 0; }
+    public int getHighestEscapedChar(){ return 0; }
+    public int getOutputBuffered(){ return 0; }
+    public int writeBinary(InputStream p0, int p1){ return 0; }
+    public void copyCurrentEvent(JsonParser p0){}
+    public void copyCurrentStructure(JsonParser p0){}
+    public void setCurrentValue(Object p0){}
+    public void setSchema(FormatSchema p0){}
+    public void writeArray(double[] p0, int p1, int p2){}
+    public void writeArray(int[] p0, int p1, int p2){}
+    public void writeArray(long[] p0, int p1, int p2){}
+    public void writeBinary(byte[] p0){}
+    public void writeBinary(byte[] p0, int p1, int p2){}
+    public void writeNumber(short p0){}
+    public void writeObjectId(Object p0){}
+    public void writeObjectRef(Object p0){}
+    public void writeOmittedField(String p0){}
+    public void writeRaw(SerializableString p0){}
+    public void writeRawValue(SerializableString p0){}
+    public void writeStartArray(int p0){}
+    public void writeStartObject(Object p0){}
+    public void writeStringField(String p0, String p1){}
+    public void writeTypeId(Object p0){}
+    static public enum Feature
+    {
+        AUTO_CLOSE_JSON_CONTENT, AUTO_CLOSE_TARGET, ESCAPE_NON_ASCII, FLUSH_PASSED_TO_STREAM, IGNORE_UNKNOWN, QUOTE_FIELD_NAMES, QUOTE_NON_NUMERIC_NUMBERS, STRICT_DUPLICATE_DETECTION, WRITE_BIGDECIMAL_AS_PLAIN, WRITE_NUMBERS_AS_STRINGS;
+        private Feature() {}
+        public boolean enabledByDefault(){ return false; }
+        public boolean enabledIn(int p0){ return false; }
+        public int getMask(){ return 0; }
+        public static int collectDefaults(){ return 0; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonLocation.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonLocation.java
new file mode 100644
index 00000000000..f6d9ceeff38
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonLocation.java
@@ -0,0 +1,21 @@
+// Generated automatically from com.fasterxml.jackson.core.JsonLocation for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import java.io.Serializable;
+
+public class JsonLocation implements Serializable
+{
+    protected JsonLocation() {}
+    public JsonLocation(Object p0, long p1, int p2, int p3){}
+    public JsonLocation(Object p0, long p1, long p2, int p3, int p4){}
+    public Object getSourceRef(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int getColumnNr(){ return 0; }
+    public int getLineNr(){ return 0; }
+    public int hashCode(){ return 0; }
+    public long getByteOffset(){ return 0; }
+    public long getCharOffset(){ return 0; }
+    public static JsonLocation NA = null;
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonParseException.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonParseException.java
new file mode 100644
index 00000000000..e7573cdc5eb
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonParseException.java
@@ -0,0 +1,21 @@
+// Generated automatically from com.fasterxml.jackson.core.JsonParseException for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.JsonLocation;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonProcessingException;
+
+public class JsonParseException extends JsonProcessingException
+{
+    protected JsonParseException() {}
+    protected JsonParser _processor = null;
+    public JsonParseException withParser(JsonParser p0){ return null; }
+    public JsonParseException(JsonParser p0, String p1){}
+    public JsonParseException(JsonParser p0, String p1, JsonLocation p2){}
+    public JsonParseException(JsonParser p0, String p1, JsonLocation p2, Throwable p3){}
+    public JsonParseException(JsonParser p0, String p1, Throwable p2){}
+    public JsonParseException(String p0, JsonLocation p1){}
+    public JsonParseException(String p0, JsonLocation p1, Throwable p2){}
+    public JsonParser getProcessor(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonParser.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonParser.java
new file mode 100644
index 00000000000..7e0e91d2efe
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonParser.java
@@ -0,0 +1,132 @@
+// Generated automatically from com.fasterxml.jackson.core.JsonParser for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.core.FormatSchema;
+import com.fasterxml.jackson.core.JsonLocation;
+import com.fasterxml.jackson.core.JsonParseException;
+import com.fasterxml.jackson.core.JsonStreamContext;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.core.ObjectCodec;
+import com.fasterxml.jackson.core.SerializableString;
+import com.fasterxml.jackson.core.TreeNode;
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.core.Versioned;
+import com.fasterxml.jackson.core.type.TypeReference;
+import java.io.Closeable;
+import java.io.OutputStream;
+import java.io.Writer;
+import java.math.BigDecimal;
+import java.math.BigInteger;
+import java.util.Iterator;
+
+abstract public class JsonParser implements Closeable, Versioned
+{
+    protected JsonParseException _constructError(String p0){ return null; }
+    protected JsonParser(){}
+    protected JsonParser(int p0){}
+    protected ObjectCodec _codec(){ return null; }
+    protected int _features = 0;
+    protected void _reportUnsupportedOperation(){}
+    public <T extends TreeNode> T readValueAsTree(){ return null; }
+    public <T> Iterator<T> readValuesAs(Class<T> p0){ return null; }
+    public <T> Iterator<T> readValuesAs(TypeReference<? extends Object> p0){ return null; }
+    public <T> T readValueAs(Class<T> p0){ return null; }
+    public <T> T readValueAs(TypeReference<? extends Object> p0){ return null; }
+    public Boolean nextBooleanValue(){ return null; }
+    public FormatSchema getSchema(){ return null; }
+    public JsonParser configure(JsonParser.Feature p0, boolean p1){ return null; }
+    public JsonParser disable(JsonParser.Feature p0){ return null; }
+    public JsonParser enable(JsonParser.Feature p0){ return null; }
+    public JsonParser overrideFormatFeatures(int p0, int p1){ return null; }
+    public JsonParser overrideStdFeatures(int p0, int p1){ return null; }
+    public JsonParser setFeatureMask(int p0){ return null; }
+    public Object getCurrentValue(){ return null; }
+    public Object getInputSource(){ return null; }
+    public Object getObjectId(){ return null; }
+    public Object getTypeId(){ return null; }
+    public String getValueAsString(){ return null; }
+    public String nextFieldName(){ return null; }
+    public String nextTextValue(){ return null; }
+    public abstract BigDecimal getDecimalValue();
+    public abstract BigInteger getBigIntegerValue();
+    public abstract JsonLocation getCurrentLocation();
+    public abstract JsonLocation getTokenLocation();
+    public abstract JsonParser skipChildren();
+    public abstract JsonParser.NumberType getNumberType();
+    public abstract JsonStreamContext getParsingContext();
+    public abstract JsonToken getCurrentToken();
+    public abstract JsonToken getLastClearedToken();
+    public abstract JsonToken nextToken();
+    public abstract JsonToken nextValue();
+    public abstract Number getNumberValue();
+    public abstract Object getEmbeddedObject();
+    public abstract ObjectCodec getCodec();
+    public abstract String getCurrentName();
+    public abstract String getText();
+    public abstract String getValueAsString(String p0);
+    public abstract Version version();
+    public abstract boolean hasCurrentToken();
+    public abstract boolean hasTextCharacters();
+    public abstract boolean hasToken(JsonToken p0);
+    public abstract boolean hasTokenId(int p0);
+    public abstract boolean isClosed();
+    public abstract byte[] getBinaryValue(Base64Variant p0);
+    public abstract char[] getTextCharacters();
+    public abstract double getDoubleValue();
+    public abstract float getFloatValue();
+    public abstract int getCurrentTokenId();
+    public abstract int getIntValue();
+    public abstract int getTextLength();
+    public abstract int getTextOffset();
+    public abstract long getLongValue();
+    public abstract void clearCurrentToken();
+    public abstract void close();
+    public abstract void overrideCurrentName(String p0);
+    public abstract void setCodec(ObjectCodec p0);
+    public boolean canReadObjectId(){ return false; }
+    public boolean canReadTypeId(){ return false; }
+    public boolean canUseSchema(FormatSchema p0){ return false; }
+    public boolean getBooleanValue(){ return false; }
+    public boolean getValueAsBoolean(){ return false; }
+    public boolean getValueAsBoolean(boolean p0){ return false; }
+    public boolean isEnabled(JsonParser.Feature p0){ return false; }
+    public boolean isExpectedStartArrayToken(){ return false; }
+    public boolean isExpectedStartObjectToken(){ return false; }
+    public boolean nextFieldName(SerializableString p0){ return false; }
+    public boolean requiresCustomCodec(){ return false; }
+    public byte getByteValue(){ return 0; }
+    public byte[] getBinaryValue(){ return null; }
+    public double getValueAsDouble(){ return 0; }
+    public double getValueAsDouble(double p0){ return 0; }
+    public int getFeatureMask(){ return 0; }
+    public int getFormatFeatures(){ return 0; }
+    public int getValueAsInt(){ return 0; }
+    public int getValueAsInt(int p0){ return 0; }
+    public int nextIntValue(int p0){ return 0; }
+    public int readBinaryValue(Base64Variant p0, OutputStream p1){ return 0; }
+    public int readBinaryValue(OutputStream p0){ return 0; }
+    public int releaseBuffered(OutputStream p0){ return 0; }
+    public int releaseBuffered(Writer p0){ return 0; }
+    public long getValueAsLong(){ return 0; }
+    public long getValueAsLong(long p0){ return 0; }
+    public long nextLongValue(long p0){ return 0; }
+    public short getShortValue(){ return 0; }
+    public void setCurrentValue(Object p0){}
+    public void setSchema(FormatSchema p0){}
+    static public enum Feature
+    {
+        ALLOW_BACKSLASH_ESCAPING_ANY_CHARACTER, ALLOW_COMMENTS, ALLOW_NON_NUMERIC_NUMBERS, ALLOW_NUMERIC_LEADING_ZEROS, ALLOW_SINGLE_QUOTES, ALLOW_UNQUOTED_CONTROL_CHARS, ALLOW_UNQUOTED_FIELD_NAMES, ALLOW_YAML_COMMENTS, AUTO_CLOSE_SOURCE, IGNORE_UNDEFINED, STRICT_DUPLICATE_DETECTION;
+        private Feature() {}
+        public boolean enabledByDefault(){ return false; }
+        public boolean enabledIn(int p0){ return false; }
+        public int getMask(){ return 0; }
+        public static int collectDefaults(){ return 0; }
+    }
+    static public enum NumberType
+    {
+        BIG_DECIMAL, BIG_INTEGER, DOUBLE, FLOAT, INT, LONG;
+        private NumberType() {}
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonPointer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonPointer.java
new file mode 100644
index 00000000000..0514789a7fb
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonPointer.java
@@ -0,0 +1,39 @@
+// Generated automatically from com.fasterxml.jackson.core.JsonPointer for testing purposes
+
+package com.fasterxml.jackson.core;
+
+
+public class JsonPointer
+{
+    protected JsonPointer _constructHead(){ return null; }
+    protected JsonPointer _constructHead(int p0, JsonPointer p1){ return null; }
+    protected JsonPointer _head = null;
+    protected JsonPointer(){}
+    protected JsonPointer(String p0, String p1, JsonPointer p2){}
+    protected JsonPointer(String p0, String p1, int p2, JsonPointer p3){}
+    protected final JsonPointer _nextSegment = null;
+    protected final String _asString = null;
+    protected final String _matchingPropertyName = null;
+    protected final int _matchingElementIndex = 0;
+    protected static JsonPointer EMPTY = null;
+    protected static JsonPointer _parseQuotedTail(String p0, int p1){ return null; }
+    protected static JsonPointer _parseTail(String p0){ return null; }
+    public JsonPointer append(JsonPointer p0){ return null; }
+    public JsonPointer head(){ return null; }
+    public JsonPointer last(){ return null; }
+    public JsonPointer matchElement(int p0){ return null; }
+    public JsonPointer matchProperty(String p0){ return null; }
+    public JsonPointer tail(){ return null; }
+    public String getMatchingProperty(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean matches(){ return false; }
+    public boolean matchesElement(int p0){ return false; }
+    public boolean matchesProperty(String p0){ return false; }
+    public boolean mayMatchElement(){ return false; }
+    public boolean mayMatchProperty(){ return false; }
+    public int getMatchingIndex(){ return 0; }
+    public int hashCode(){ return 0; }
+    public static JsonPointer compile(String p0){ return null; }
+    public static JsonPointer valueOf(String p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonProcessingException.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonProcessingException.java
new file mode 100644
index 00000000000..443801c4b25
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonProcessingException.java
@@ -0,0 +1,23 @@
+// Generated automatically from com.fasterxml.jackson.core.JsonProcessingException for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.JsonLocation;
+import java.io.IOException;
+
+public class JsonProcessingException extends IOException
+{
+    protected JsonProcessingException() {}
+    protected JsonLocation _location = null;
+    protected JsonProcessingException(String p0){}
+    protected JsonProcessingException(String p0, JsonLocation p1){}
+    protected JsonProcessingException(String p0, JsonLocation p1, Throwable p2){}
+    protected JsonProcessingException(String p0, Throwable p1){}
+    protected JsonProcessingException(Throwable p0){}
+    protected String getMessageSuffix(){ return null; }
+    public JsonLocation getLocation(){ return null; }
+    public Object getProcessor(){ return null; }
+    public String getMessage(){ return null; }
+    public String getOriginalMessage(){ return null; }
+    public String toString(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonStreamContext.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonStreamContext.java
new file mode 100644
index 00000000000..ac8e077b995
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonStreamContext.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.fasterxml.jackson.core.JsonStreamContext for testing purposes
+
+package com.fasterxml.jackson.core;
+
+
+abstract public class JsonStreamContext
+{
+    protected JsonStreamContext(){}
+    protected int _index = 0;
+    protected int _type = 0;
+    protected static int TYPE_ARRAY = 0;
+    protected static int TYPE_OBJECT = 0;
+    protected static int TYPE_ROOT = 0;
+    public Object getCurrentValue(){ return null; }
+    public abstract JsonStreamContext getParent();
+    public abstract String getCurrentName();
+    public final String getTypeDesc(){ return null; }
+    public final boolean inArray(){ return false; }
+    public final boolean inObject(){ return false; }
+    public final boolean inRoot(){ return false; }
+    public final int getCurrentIndex(){ return 0; }
+    public final int getEntryCount(){ return 0; }
+    public void setCurrentValue(Object p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonToken.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonToken.java
new file mode 100644
index 00000000000..6c3d7a04ba9
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/JsonToken.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.fasterxml.jackson.core.JsonToken for testing purposes
+
+package com.fasterxml.jackson.core;
+
+
+public enum JsonToken
+{
+    END_ARRAY, END_OBJECT, FIELD_NAME, NOT_AVAILABLE, START_ARRAY, START_OBJECT, VALUE_EMBEDDED_OBJECT, VALUE_FALSE, VALUE_NULL, VALUE_NUMBER_FLOAT, VALUE_NUMBER_INT, VALUE_STRING, VALUE_TRUE;
+    private JsonToken() {}
+    public final String asString(){ return null; }
+    public final boolean isBoolean(){ return false; }
+    public final boolean isNumeric(){ return false; }
+    public final boolean isScalarValue(){ return false; }
+    public final boolean isStructEnd(){ return false; }
+    public final boolean isStructStart(){ return false; }
+    public final byte[] asByteArray(){ return null; }
+    public final char[] asCharArray(){ return null; }
+    public final int id(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/ObjectCodec.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/ObjectCodec.java
new file mode 100644
index 00000000000..e88572a8847
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/ObjectCodec.java
@@ -0,0 +1,35 @@
+// Generated automatically from com.fasterxml.jackson.core.ObjectCodec for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.JsonFactory;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.TreeCodec;
+import com.fasterxml.jackson.core.TreeNode;
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.core.Versioned;
+import com.fasterxml.jackson.core.type.ResolvedType;
+import com.fasterxml.jackson.core.type.TypeReference;
+import java.util.Iterator;
+
+abstract public class ObjectCodec extends TreeCodec implements Versioned
+{
+    protected ObjectCodec(){}
+    public JsonFactory getFactory(){ return null; }
+    public JsonFactory getJsonFactory(){ return null; }
+    public Version version(){ return null; }
+    public abstract <T extends TreeNode> T readTree(JsonParser p0);
+    public abstract <T> Iterator<T> readValues(JsonParser p0, Class<T> p1);
+    public abstract <T> Iterator<T> readValues(JsonParser p0, ResolvedType p1);
+    public abstract <T> Iterator<T> readValues(JsonParser p0, TypeReference<? extends Object> p1);
+    public abstract <T> T readValue(JsonParser p0, Class<T> p1);
+    public abstract <T> T readValue(JsonParser p0, ResolvedType p1);
+    public abstract <T> T readValue(JsonParser p0, TypeReference<? extends Object> p1);
+    public abstract <T> T treeToValue(TreeNode p0, Class<T> p1);
+    public abstract JsonParser treeAsTokens(TreeNode p0);
+    public abstract TreeNode createArrayNode();
+    public abstract TreeNode createObjectNode();
+    public abstract void writeTree(JsonGenerator p0, TreeNode p1);
+    public abstract void writeValue(JsonGenerator p0, Object p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/PrettyPrinter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/PrettyPrinter.java
new file mode 100644
index 00000000000..dd32ce45303
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/PrettyPrinter.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.fasterxml.jackson.core.PrettyPrinter for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+
+public interface PrettyPrinter
+{
+    void beforeArrayValues(JsonGenerator p0);
+    void beforeObjectEntries(JsonGenerator p0);
+    void writeArrayValueSeparator(JsonGenerator p0);
+    void writeEndArray(JsonGenerator p0, int p1);
+    void writeEndObject(JsonGenerator p0, int p1);
+    void writeObjectEntrySeparator(JsonGenerator p0);
+    void writeObjectFieldValueSeparator(JsonGenerator p0);
+    void writeRootValueSeparator(JsonGenerator p0);
+    void writeStartArray(JsonGenerator p0);
+    void writeStartObject(JsonGenerator p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/SerializableString.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/SerializableString.java
new file mode 100644
index 00000000000..590c77237cf
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/SerializableString.java
@@ -0,0 +1,23 @@
+// Generated automatically from com.fasterxml.jackson.core.SerializableString for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import java.io.OutputStream;
+import java.nio.ByteBuffer;
+
+public interface SerializableString
+{
+    String getValue();
+    byte[] asQuotedUTF8();
+    byte[] asUnquotedUTF8();
+    char[] asQuotedChars();
+    int appendQuoted(char[] p0, int p1);
+    int appendQuotedUTF8(byte[] p0, int p1);
+    int appendUnquoted(char[] p0, int p1);
+    int appendUnquotedUTF8(byte[] p0, int p1);
+    int charLength();
+    int putQuotedUTF8(ByteBuffer p0);
+    int putUnquotedUTF8(ByteBuffer p0);
+    int writeQuotedUTF8(OutputStream p0);
+    int writeUnquotedUTF8(OutputStream p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/TreeCodec.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/TreeCodec.java
new file mode 100644
index 00000000000..3923f609874
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/TreeCodec.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.fasterxml.jackson.core.TreeCodec for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.TreeNode;
+
+abstract public class TreeCodec
+{
+    public TreeCodec(){}
+    public abstract <T extends TreeNode> T readTree(JsonParser p0);
+    public abstract JsonParser treeAsTokens(TreeNode p0);
+    public abstract TreeNode createArrayNode();
+    public abstract TreeNode createObjectNode();
+    public abstract void writeTree(JsonGenerator p0, TreeNode p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/TreeNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/TreeNode.java
new file mode 100644
index 00000000000..2b53de0c03b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/TreeNode.java
@@ -0,0 +1,30 @@
+// Generated automatically from com.fasterxml.jackson.core.TreeNode for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonPointer;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.core.ObjectCodec;
+import java.util.Iterator;
+
+public interface TreeNode
+{
+    Iterator<String> fieldNames();
+    JsonParser traverse();
+    JsonParser traverse(ObjectCodec p0);
+    JsonParser.NumberType numberType();
+    JsonToken asToken();
+    TreeNode at(JsonPointer p0);
+    TreeNode at(String p0);
+    TreeNode get(String p0);
+    TreeNode get(int p0);
+    TreeNode path(String p0);
+    TreeNode path(int p0);
+    boolean isArray();
+    boolean isContainerNode();
+    boolean isMissingNode();
+    boolean isObject();
+    boolean isValueNode();
+    int size();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/Version.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/Version.java
new file mode 100644
index 00000000000..84eb36c9e76
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/Version.java
@@ -0,0 +1,32 @@
+// Generated automatically from com.fasterxml.jackson.core.Version for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import java.io.Serializable;
+
+public class Version implements Comparable<Version>, Serializable
+{
+    protected Version() {}
+    protected final String _artifactId = null;
+    protected final String _groupId = null;
+    protected final String _snapshotInfo = null;
+    protected final int _majorVersion = 0;
+    protected final int _minorVersion = 0;
+    protected final int _patchLevel = 0;
+    public String getArtifactId(){ return null; }
+    public String getGroupId(){ return null; }
+    public String toFullString(){ return null; }
+    public String toString(){ return null; }
+    public Version(int p0, int p1, int p2, String p3){}
+    public Version(int p0, int p1, int p2, String p3, String p4, String p5){}
+    public boolean equals(Object p0){ return false; }
+    public boolean isSnapshot(){ return false; }
+    public boolean isUknownVersion(){ return false; }
+    public boolean isUnknownVersion(){ return false; }
+    public int compareTo(Version p0){ return 0; }
+    public int getMajorVersion(){ return 0; }
+    public int getMinorVersion(){ return 0; }
+    public int getPatchLevel(){ return 0; }
+    public int hashCode(){ return 0; }
+    public static Version unknownVersion(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/Versioned.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/Versioned.java
new file mode 100644
index 00000000000..7def0be7bbb
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/Versioned.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.fasterxml.jackson.core.Versioned for testing purposes
+
+package com.fasterxml.jackson.core;
+
+import com.fasterxml.jackson.core.Version;
+
+public interface Versioned
+{
+    Version version();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/filter/TokenFilter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/filter/TokenFilter.java
new file mode 100644
index 00000000000..fb5453b2b3b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/filter/TokenFilter.java
@@ -0,0 +1,35 @@
+// Generated automatically from com.fasterxml.jackson.core.filter.TokenFilter for testing purposes
+
+package com.fasterxml.jackson.core.filter;
+
+import com.fasterxml.jackson.core.JsonParser;
+import java.math.BigDecimal;
+import java.math.BigInteger;
+
+public class TokenFilter
+{
+    protected TokenFilter(){}
+    protected boolean _includeScalar(){ return false; }
+    public String toString(){ return null; }
+    public TokenFilter filterStartArray(){ return null; }
+    public TokenFilter filterStartObject(){ return null; }
+    public TokenFilter includeElement(int p0){ return null; }
+    public TokenFilter includeProperty(String p0){ return null; }
+    public TokenFilter includeRootValue(int p0){ return null; }
+    public boolean includeBinary(){ return false; }
+    public boolean includeBoolean(boolean p0){ return false; }
+    public boolean includeEmbeddedValue(Object p0){ return false; }
+    public boolean includeNull(){ return false; }
+    public boolean includeNumber(BigDecimal p0){ return false; }
+    public boolean includeNumber(BigInteger p0){ return false; }
+    public boolean includeNumber(double p0){ return false; }
+    public boolean includeNumber(float p0){ return false; }
+    public boolean includeNumber(int p0){ return false; }
+    public boolean includeNumber(long p0){ return false; }
+    public boolean includeRawValue(){ return false; }
+    public boolean includeString(String p0){ return false; }
+    public boolean includeValue(JsonParser p0){ return false; }
+    public static TokenFilter INCLUDE_ALL = null;
+    public void filterFinishArray(){}
+    public void filterFinishObject(){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/format/InputAccessor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/format/InputAccessor.java
new file mode 100644
index 00000000000..000e88839aa
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/format/InputAccessor.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.core.format.InputAccessor for testing purposes
+
+package com.fasterxml.jackson.core.format;
+
+
+public interface InputAccessor
+{
+    boolean hasMoreBytes();
+    byte nextByte();
+    void reset();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/format/MatchStrength.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/format/MatchStrength.java
new file mode 100644
index 00000000000..a3f3a0f7a0f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/format/MatchStrength.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.fasterxml.jackson.core.format.MatchStrength for testing purposes
+
+package com.fasterxml.jackson.core.format;
+
+
+public enum MatchStrength
+{
+    FULL_MATCH, INCONCLUSIVE, NO_MATCH, SOLID_MATCH, WEAK_MATCH;
+    private MatchStrength() {}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/CharacterEscapes.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/CharacterEscapes.java
new file mode 100644
index 00000000000..296647febb1
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/CharacterEscapes.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.fasterxml.jackson.core.io.CharacterEscapes for testing purposes
+
+package com.fasterxml.jackson.core.io;
+
+import com.fasterxml.jackson.core.SerializableString;
+import java.io.Serializable;
+
+abstract public class CharacterEscapes implements Serializable
+{
+    public CharacterEscapes(){}
+    public abstract SerializableString getEscapeSequence(int p0);
+    public abstract int[] getEscapeCodesForAscii();
+    public static int ESCAPE_CUSTOM = 0;
+    public static int ESCAPE_NONE = 0;
+    public static int ESCAPE_STANDARD = 0;
+    public static int[] standardAsciiEscapesForJSON(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/IOContext.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/IOContext.java
new file mode 100644
index 00000000000..22e83e3cfd9
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/IOContext.java
@@ -0,0 +1,47 @@
+// Generated automatically from com.fasterxml.jackson.core.io.IOContext for testing purposes
+
+package com.fasterxml.jackson.core.io;
+
+import com.fasterxml.jackson.core.JsonEncoding;
+import com.fasterxml.jackson.core.util.BufferRecycler;
+import com.fasterxml.jackson.core.util.TextBuffer;
+
+public class IOContext
+{
+    protected IOContext() {}
+    protected JsonEncoding _encoding = null;
+    protected byte[] _base64Buffer = null;
+    protected byte[] _readIOBuffer = null;
+    protected byte[] _writeEncodingBuffer = null;
+    protected char[] _concatCBuffer = null;
+    protected char[] _nameCopyBuffer = null;
+    protected char[] _tokenCBuffer = null;
+    protected final BufferRecycler _bufferRecycler = null;
+    protected final Object _sourceRef = null;
+    protected final boolean _managedResource = false;
+    protected final void _verifyAlloc(Object p0){}
+    protected final void _verifyRelease(byte[] p0, byte[] p1){}
+    protected final void _verifyRelease(char[] p0, char[] p1){}
+    public IOContext withEncoding(JsonEncoding p0){ return null; }
+    public IOContext(BufferRecycler p0, Object p1, boolean p2){}
+    public JsonEncoding getEncoding(){ return null; }
+    public Object getSourceReference(){ return null; }
+    public TextBuffer constructTextBuffer(){ return null; }
+    public boolean isResourceManaged(){ return false; }
+    public byte[] allocBase64Buffer(){ return null; }
+    public byte[] allocReadIOBuffer(){ return null; }
+    public byte[] allocReadIOBuffer(int p0){ return null; }
+    public byte[] allocWriteEncodingBuffer(){ return null; }
+    public byte[] allocWriteEncodingBuffer(int p0){ return null; }
+    public char[] allocConcatBuffer(){ return null; }
+    public char[] allocNameCopyBuffer(int p0){ return null; }
+    public char[] allocTokenBuffer(){ return null; }
+    public char[] allocTokenBuffer(int p0){ return null; }
+    public void releaseBase64Buffer(byte[] p0){}
+    public void releaseConcatBuffer(char[] p0){}
+    public void releaseNameCopyBuffer(char[] p0){}
+    public void releaseReadIOBuffer(byte[] p0){}
+    public void releaseTokenBuffer(char[] p0){}
+    public void releaseWriteEncodingBuffer(byte[] p0){}
+    public void setEncoding(JsonEncoding p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/InputDecorator.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/InputDecorator.java
new file mode 100644
index 00000000000..e7c8c97ba67
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/InputDecorator.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.fasterxml.jackson.core.io.InputDecorator for testing purposes
+
+package com.fasterxml.jackson.core.io;
+
+import com.fasterxml.jackson.core.io.IOContext;
+import java.io.InputStream;
+import java.io.Reader;
+import java.io.Serializable;
+
+abstract public class InputDecorator implements Serializable
+{
+    public InputDecorator(){}
+    public abstract InputStream decorate(IOContext p0, InputStream p1);
+    public abstract InputStream decorate(IOContext p0, byte[] p1, int p2, int p3);
+    public abstract Reader decorate(IOContext p0, Reader p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/OutputDecorator.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/OutputDecorator.java
new file mode 100644
index 00000000000..16d4ab26715
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/OutputDecorator.java
@@ -0,0 +1,15 @@
+// Generated automatically from com.fasterxml.jackson.core.io.OutputDecorator for testing purposes
+
+package com.fasterxml.jackson.core.io;
+
+import com.fasterxml.jackson.core.io.IOContext;
+import java.io.OutputStream;
+import java.io.Serializable;
+import java.io.Writer;
+
+abstract public class OutputDecorator implements Serializable
+{
+    public OutputDecorator(){}
+    public abstract OutputStream decorate(IOContext p0, OutputStream p1);
+    public abstract Writer decorate(IOContext p0, Writer p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/SerializedString.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/SerializedString.java
new file mode 100644
index 00000000000..9090f5b1703
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/io/SerializedString.java
@@ -0,0 +1,36 @@
+// Generated automatically from com.fasterxml.jackson.core.io.SerializedString for testing purposes
+
+package com.fasterxml.jackson.core.io;
+
+import com.fasterxml.jackson.core.SerializableString;
+import java.io.OutputStream;
+import java.io.Serializable;
+import java.nio.ByteBuffer;
+
+public class SerializedString implements Serializable, SerializableString
+{
+    protected SerializedString() {}
+    protected Object readResolve(){ return null; }
+    protected String _jdkSerializeValue = null;
+    protected byte[] _quotedUTF8Ref = null;
+    protected byte[] _unquotedUTF8Ref = null;
+    protected char[] _quotedChars = null;
+    protected final String _value = null;
+    public SerializedString(String p0){}
+    public final String getValue(){ return null; }
+    public final String toString(){ return null; }
+    public final boolean equals(Object p0){ return false; }
+    public final byte[] asQuotedUTF8(){ return null; }
+    public final byte[] asUnquotedUTF8(){ return null; }
+    public final char[] asQuotedChars(){ return null; }
+    public final int charLength(){ return 0; }
+    public final int hashCode(){ return 0; }
+    public int appendQuoted(char[] p0, int p1){ return 0; }
+    public int appendQuotedUTF8(byte[] p0, int p1){ return 0; }
+    public int appendUnquoted(char[] p0, int p1){ return 0; }
+    public int appendUnquotedUTF8(byte[] p0, int p1){ return 0; }
+    public int putQuotedUTF8(ByteBuffer p0){ return 0; }
+    public int putUnquotedUTF8(ByteBuffer p0){ return 0; }
+    public int writeQuotedUTF8(OutputStream p0){ return 0; }
+    public int writeUnquotedUTF8(OutputStream p0){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/sym/ByteQuadsCanonicalizer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/sym/ByteQuadsCanonicalizer.java
new file mode 100644
index 00000000000..83f0332a5e7
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/sym/ByteQuadsCanonicalizer.java
@@ -0,0 +1,131 @@
+// Generated automatically from com.fasterxml.jackson.core.sym.ByteQuadsCanonicalizer for testing
+// purposes
+
+package com.fasterxml.jackson.core.sym;
+
+import java.util.concurrent.atomic.AtomicReference;
+
+public class ByteQuadsCanonicalizer {
+    protected ByteQuadsCanonicalizer() {}
+
+    protected String[] _names = null;
+    protected boolean _intern = false;
+    protected final AtomicReference<ByteQuadsCanonicalizer.TableInfo> _tableInfo = null;
+    protected final ByteQuadsCanonicalizer _parent = null;
+    protected final boolean _failOnDoS = false;
+    protected int _count = 0;
+    protected int _hashSize = 0;
+    protected int _longNameOffset = 0;
+    protected int _secondaryStart = 0;
+    protected int _spilloverEnd = 0;
+    protected int _tertiaryShift = 0;
+    protected int _tertiaryStart = 0;
+    protected int[] _hashArea = null;
+
+    protected static ByteQuadsCanonicalizer createRoot(int p0) {
+        return null;
+    }
+
+    protected void _reportTooManyCollisions() {}
+
+    public ByteQuadsCanonicalizer makeChild(int p0) {
+        return null;
+    }
+
+    public String addName(String p0, int p1) {
+        return null;
+    }
+
+    public String addName(String p0, int p1, int p2) {
+        return null;
+    }
+
+    public String addName(String p0, int p1, int p2, int p3) {
+        return null;
+    }
+
+    public String addName(String p0, int[] p1, int p2) {
+        return null;
+    }
+
+    public String findName(int p0) {
+        return null;
+    }
+
+    public String findName(int p0, int p1) {
+        return null;
+    }
+
+    public String findName(int p0, int p1, int p2) {
+        return null;
+    }
+
+    public String findName(int[] p0, int p1) {
+        return null;
+    }
+
+    public String toString() {
+        return null;
+    }
+
+    public boolean maybeDirty() {
+        return false;
+    }
+
+    public int bucketCount() {
+        return 0;
+    }
+
+    public int calcHash(int p0) {
+        return 0;
+    }
+
+    public int calcHash(int p0, int p1) {
+        return 0;
+    }
+
+    public int calcHash(int p0, int p1, int p2) {
+        return 0;
+    }
+
+    public int calcHash(int[] p0, int p1) {
+        return 0;
+    }
+
+    public int hashSeed() {
+        return 0;
+    }
+
+    public int primaryCount() {
+        return 0;
+    }
+
+    public int secondaryCount() {
+        return 0;
+    }
+
+    public int size() {
+        return 0;
+    }
+
+    public int spilloverCount() {
+        return 0;
+    }
+
+    public int tertiaryCount() {
+        return 0;
+    }
+
+    public int totalCount() {
+        return 0;
+    }
+
+    public static ByteQuadsCanonicalizer createRoot() {
+        return null;
+    }
+
+    public void release() {}
+
+    class TableInfo {
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/sym/CharsToNameCanonicalizer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/sym/CharsToNameCanonicalizer.java
new file mode 100644
index 00000000000..cab7d2ce099
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/sym/CharsToNameCanonicalizer.java
@@ -0,0 +1,86 @@
+// Generated automatically from com.fasterxml.jackson.core.sym.CharsToNameCanonicalizer for testing
+// purposes
+
+package com.fasterxml.jackson.core.sym;
+
+import java.util.BitSet;
+
+public class CharsToNameCanonicalizer {
+    protected CharsToNameCanonicalizer() {}
+
+    protected BitSet _overflows = null;
+    protected CharsToNameCanonicalizer _parent = null;
+    protected CharsToNameCanonicalizer.Bucket[] _buckets = null;
+    protected String[] _symbols = null;
+    protected boolean _canonicalize = false;
+    protected boolean _dirty = false;
+    protected final int _flags = 0;
+    protected int _indexMask = 0;
+    protected int _longestCollisionList = 0;
+    protected int _size = 0;
+    protected int _sizeThreshold = 0;
+
+    protected static CharsToNameCanonicalizer createRoot(int p0) {
+        return null;
+    }
+
+    protected static int DEFAULT_T_SIZE = 0;
+    protected static int MAX_T_SIZE = 0;
+
+    protected void reportTooManyCollisions(int p0) {}
+
+    public CharsToNameCanonicalizer makeChild(int p0) {
+        return null;
+    }
+
+    public String findSymbol(char[] p0, int p1, int p2, int p3) {
+        return null;
+    }
+
+    public boolean maybeDirty() {
+        return false;
+    }
+
+    public int _hashToIndex(int p0) {
+        return 0;
+    }
+
+    public int bucketCount() {
+        return 0;
+    }
+
+    public int calcHash(String p0) {
+        return 0;
+    }
+
+    public int calcHash(char[] p0, int p1, int p2) {
+        return 0;
+    }
+
+    public int collisionCount() {
+        return 0;
+    }
+
+    public int hashSeed() {
+        return 0;
+    }
+
+    public int maxCollisionLength() {
+        return 0;
+    }
+
+    public int size() {
+        return 0;
+    }
+
+    public static CharsToNameCanonicalizer createRoot() {
+        return null;
+    }
+
+    public static int HASH_MULT = 0;
+
+    public void release() {}
+
+    class Bucket {
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/type/ResolvedType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/type/ResolvedType.java
new file mode 100644
index 00000000000..ea572e69fda
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/type/ResolvedType.java
@@ -0,0 +1,32 @@
+// Generated automatically from com.fasterxml.jackson.core.type.ResolvedType for testing purposes
+
+package com.fasterxml.jackson.core.type;
+
+
+abstract public class ResolvedType
+{
+    public Class<? extends Object> getParameterSource(){ return null; }
+    public ResolvedType(){}
+    public abstract Class<? extends Object> getRawClass();
+    public abstract ResolvedType containedType(int p0);
+    public abstract ResolvedType getContentType();
+    public abstract ResolvedType getKeyType();
+    public abstract ResolvedType getReferencedType();
+    public abstract String containedTypeName(int p0);
+    public abstract String toCanonical();
+    public abstract boolean hasGenericTypes();
+    public abstract boolean hasRawClass(Class<? extends Object> p0);
+    public abstract boolean isAbstract();
+    public abstract boolean isArrayType();
+    public abstract boolean isCollectionLikeType();
+    public abstract boolean isConcrete();
+    public abstract boolean isContainerType();
+    public abstract boolean isEnumType();
+    public abstract boolean isFinal();
+    public abstract boolean isInterface();
+    public abstract boolean isMapLikeType();
+    public abstract boolean isPrimitive();
+    public abstract boolean isThrowable();
+    public abstract int containedTypeCount();
+    public boolean isReferenceType(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/type/TypeReference.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/type/TypeReference.java
new file mode 100644
index 00000000000..c37bc5986f6
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/type/TypeReference.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.core.type.TypeReference for testing purposes
+
+package com.fasterxml.jackson.core.type;
+
+import java.lang.reflect.Type;
+
+abstract public class TypeReference<T> implements Comparable<TypeReference<T>>
+{
+    protected TypeReference(){}
+    protected final Type _type = null;
+    public Type getType(){ return null; }
+    public int compareTo(TypeReference<T> p0){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/util/BufferRecycler.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/util/BufferRecycler.java
new file mode 100644
index 00000000000..28a1ad2ce9c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/util/BufferRecycler.java
@@ -0,0 +1,30 @@
+// Generated automatically from com.fasterxml.jackson.core.util.BufferRecycler for testing purposes
+
+package com.fasterxml.jackson.core.util;
+
+
+public class BufferRecycler
+{
+    protected BufferRecycler(int p0, int p1){}
+    protected byte[] balloc(int p0){ return null; }
+    protected char[] calloc(int p0){ return null; }
+    protected final byte[][] _byteBuffers = null;
+    protected final char[][] _charBuffers = null;
+    protected int byteBufferLength(int p0){ return 0; }
+    protected int charBufferLength(int p0){ return 0; }
+    public BufferRecycler(){}
+    public byte[] allocByteBuffer(int p0, int p1){ return null; }
+    public char[] allocCharBuffer(int p0, int p1){ return null; }
+    public final byte[] allocByteBuffer(int p0){ return null; }
+    public final char[] allocCharBuffer(int p0){ return null; }
+    public final void releaseByteBuffer(int p0, byte[] p1){}
+    public static int BYTE_BASE64_CODEC_BUFFER = 0;
+    public static int BYTE_READ_IO_BUFFER = 0;
+    public static int BYTE_WRITE_CONCAT_BUFFER = 0;
+    public static int BYTE_WRITE_ENCODING_BUFFER = 0;
+    public static int CHAR_CONCAT_BUFFER = 0;
+    public static int CHAR_NAME_COPY_BUFFER = 0;
+    public static int CHAR_TEXT_BUFFER = 0;
+    public static int CHAR_TOKEN_BUFFER = 0;
+    public void releaseCharBuffer(int p0, char[] p1){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/util/ByteArrayBuilder.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/util/ByteArrayBuilder.java
new file mode 100644
index 00000000000..2e0739d6a80
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/util/ByteArrayBuilder.java
@@ -0,0 +1,32 @@
+// Generated automatically from com.fasterxml.jackson.core.util.ByteArrayBuilder for testing purposes
+
+package com.fasterxml.jackson.core.util;
+
+import com.fasterxml.jackson.core.util.BufferRecycler;
+import java.io.OutputStream;
+
+public class ByteArrayBuilder extends OutputStream
+{
+    public ByteArrayBuilder(){}
+    public ByteArrayBuilder(BufferRecycler p0){}
+    public ByteArrayBuilder(BufferRecycler p0, int p1){}
+    public ByteArrayBuilder(int p0){}
+    public byte[] completeAndCoalesce(int p0){ return null; }
+    public byte[] finishCurrentSegment(){ return null; }
+    public byte[] getCurrentSegment(){ return null; }
+    public byte[] resetAndGetFirstSegment(){ return null; }
+    public byte[] toByteArray(){ return null; }
+    public int getCurrentSegmentLength(){ return 0; }
+    public static byte[] NO_BYTES = null;
+    public void append(int p0){}
+    public void appendThreeBytes(int p0){}
+    public void appendTwoBytes(int p0){}
+    public void close(){}
+    public void flush(){}
+    public void release(){}
+    public void reset(){}
+    public void setCurrentSegmentLength(int p0){}
+    public void write(byte[] p0){}
+    public void write(byte[] p0, int p1, int p2){}
+    public void write(int p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/util/TextBuffer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/util/TextBuffer.java
new file mode 100644
index 00000000000..63edd819ac5
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/core/util/TextBuffer.java
@@ -0,0 +1,38 @@
+// Generated automatically from com.fasterxml.jackson.core.util.TextBuffer for testing purposes
+
+package com.fasterxml.jackson.core.util;
+
+import com.fasterxml.jackson.core.util.BufferRecycler;
+import java.math.BigDecimal;
+
+public class TextBuffer
+{
+    protected TextBuffer() {}
+    public BigDecimal contentsAsDecimal(){ return null; }
+    public String contentsAsString(){ return null; }
+    public String setCurrentAndReturn(int p0){ return null; }
+    public String toString(){ return null; }
+    public TextBuffer(BufferRecycler p0){}
+    public boolean hasTextAsCharacters(){ return false; }
+    public char[] contentsAsArray(){ return null; }
+    public char[] emptyAndGetCurrentSegment(){ return null; }
+    public char[] expandCurrentSegment(){ return null; }
+    public char[] expandCurrentSegment(int p0){ return null; }
+    public char[] finishCurrentSegment(){ return null; }
+    public char[] getCurrentSegment(){ return null; }
+    public char[] getTextBuffer(){ return null; }
+    public double contentsAsDouble(){ return 0; }
+    public int getCurrentSegmentSize(){ return 0; }
+    public int getTextOffset(){ return 0; }
+    public int size(){ return 0; }
+    public void append(String p0, int p1, int p2){}
+    public void append(char p0){}
+    public void append(char[] p0, int p1, int p2){}
+    public void ensureNotShared(){}
+    public void releaseBuffers(){}
+    public void resetWithCopy(char[] p0, int p1, int p2){}
+    public void resetWithEmpty(){}
+    public void resetWithShared(char[] p0, int p1, int p2){}
+    public void resetWithString(String p0){}
+    public void setCurrentLength(int p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/AbstractTypeResolver.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/AbstractTypeResolver.java
new file mode 100644
index 00000000000..6356c43b6a9
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/AbstractTypeResolver.java
@@ -0,0 +1,15 @@
+// Generated automatically from com.fasterxml.jackson.databind.AbstractTypeResolver for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.JavaType;
+
+abstract public class AbstractTypeResolver
+{
+    public AbstractTypeResolver(){}
+    public JavaType findTypeMapping(DeserializationConfig p0, JavaType p1){ return null; }
+    public JavaType resolveAbstractType(DeserializationConfig p0, BeanDescription p1){ return null; }
+    public JavaType resolveAbstractType(DeserializationConfig p0, JavaType p1){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/AnnotationIntrospector.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/AnnotationIntrospector.java
new file mode 100644
index 00000000000..44b0bf254f8
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/AnnotationIntrospector.java
@@ -0,0 +1,128 @@
+// Generated automatically from com.fasterxml.jackson.databind.AnnotationIntrospector for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.core.Versioned;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.annotation.JsonPOJOBuilder;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import com.fasterxml.jackson.databind.introspect.AnnotatedClass;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMethod;
+import com.fasterxml.jackson.databind.introspect.ObjectIdInfo;
+import com.fasterxml.jackson.databind.introspect.VisibilityChecker;
+import com.fasterxml.jackson.databind.jsontype.NamedType;
+import com.fasterxml.jackson.databind.jsontype.TypeResolverBuilder;
+import com.fasterxml.jackson.databind.ser.BeanPropertyWriter;
+import com.fasterxml.jackson.databind.util.NameTransformer;
+import java.io.Serializable;
+import java.lang.annotation.Annotation;
+import java.util.Collection;
+import java.util.List;
+
+abstract public class AnnotationIntrospector implements Serializable, Versioned
+{
+    protected <A extends Annotation> A _findAnnotation(Annotated p0, Class<A> p1){ return null; }
+    protected boolean _hasAnnotation(Annotated p0, Class<? extends Annotation> p1){ return false; }
+    protected boolean _hasOneOf(Annotated p0, Class<? extends Annotation>[] p1){ return false; }
+    public AnnotatedMethod resolveSetterConflict(MapperConfig<? extends Object> p0, AnnotatedMethod p1, AnnotatedMethod p2){ return null; }
+    public AnnotationIntrospector(){}
+    public AnnotationIntrospector.ReferenceProperty findReferenceType(AnnotatedMember p0){ return null; }
+    public Boolean findIgnoreUnknownProperties(AnnotatedClass p0){ return null; }
+    public Boolean findSerializationSortAlphabetically(Annotated p0){ return null; }
+    public Boolean hasRequiredMarker(AnnotatedMember p0){ return null; }
+    public Boolean isIgnorableType(AnnotatedClass p0){ return null; }
+    public Boolean isTypeId(AnnotatedMember p0){ return null; }
+    public Class<? extends Object> findDeserializationContentType(Annotated p0, JavaType p1){ return null; }
+    public Class<? extends Object> findDeserializationKeyType(Annotated p0, JavaType p1){ return null; }
+    public Class<? extends Object> findDeserializationType(Annotated p0, JavaType p1){ return null; }
+    public Class<? extends Object> findPOJOBuilder(AnnotatedClass p0){ return null; }
+    public Class<? extends Object> findSerializationContentType(Annotated p0, JavaType p1){ return null; }
+    public Class<? extends Object> findSerializationKeyType(Annotated p0, JavaType p1){ return null; }
+    public Class<? extends Object> findSerializationType(Annotated p0){ return null; }
+    public Class<? extends Object>[] findViews(Annotated p0){ return null; }
+    public Collection<AnnotationIntrospector> allIntrospectors(){ return null; }
+    public Collection<AnnotationIntrospector> allIntrospectors(Collection<AnnotationIntrospector> p0){ return null; }
+    public Integer findPropertyIndex(Annotated p0){ return null; }
+    public JavaType refineDeserializationType(MapperConfig<? extends Object> p0, Annotated p1, JavaType p2){ return null; }
+    public JavaType refineSerializationType(MapperConfig<? extends Object> p0, Annotated p1, JavaType p2){ return null; }
+    public JsonCreator.Mode findCreatorBinding(Annotated p0){ return null; }
+    public JsonFormat.Value findFormat(Annotated p0){ return null; }
+    public JsonInclude.Include findSerializationInclusion(Annotated p0, JsonInclude.Include p1){ return null; }
+    public JsonInclude.Include findSerializationInclusionForContent(Annotated p0, JsonInclude.Include p1){ return null; }
+    public JsonInclude.Value findPropertyInclusion(Annotated p0){ return null; }
+    public JsonPOJOBuilder.Value findPOJOBuilderConfig(AnnotatedClass p0){ return null; }
+    public JsonProperty.Access findPropertyAccess(Annotated p0){ return null; }
+    public JsonSerialize.Typing findSerializationTyping(Annotated p0){ return null; }
+    public List<NamedType> findSubtypes(Annotated p0){ return null; }
+    public NameTransformer findUnwrappingNameTransformer(AnnotatedMember p0){ return null; }
+    public Object findContentDeserializer(Annotated p0){ return null; }
+    public Object findContentSerializer(Annotated p0){ return null; }
+    public Object findDeserializationContentConverter(AnnotatedMember p0){ return null; }
+    public Object findDeserializationConverter(Annotated p0){ return null; }
+    public Object findDeserializer(Annotated p0){ return null; }
+    public Object findFilterId(Annotated p0){ return null; }
+    public Object findInjectableValueId(AnnotatedMember p0){ return null; }
+    public Object findKeyDeserializer(Annotated p0){ return null; }
+    public Object findKeySerializer(Annotated p0){ return null; }
+    public Object findNamingStrategy(AnnotatedClass p0){ return null; }
+    public Object findNullSerializer(Annotated p0){ return null; }
+    public Object findSerializationContentConverter(AnnotatedMember p0){ return null; }
+    public Object findSerializationConverter(Annotated p0){ return null; }
+    public Object findSerializer(Annotated p0){ return null; }
+    public Object findValueInstantiator(AnnotatedClass p0){ return null; }
+    public ObjectIdInfo findObjectIdInfo(Annotated p0){ return null; }
+    public ObjectIdInfo findObjectReferenceInfo(Annotated p0, ObjectIdInfo p1){ return null; }
+    public PropertyName findNameForDeserialization(Annotated p0){ return null; }
+    public PropertyName findNameForSerialization(Annotated p0){ return null; }
+    public PropertyName findRootName(AnnotatedClass p0){ return null; }
+    public PropertyName findWrapperName(Annotated p0){ return null; }
+    public String findClassDescription(AnnotatedClass p0){ return null; }
+    public String findEnumValue(Enum<? extends Object> p0){ return null; }
+    public String findImplicitPropertyName(AnnotatedMember p0){ return null; }
+    public String findPropertyDefaultValue(Annotated p0){ return null; }
+    public String findPropertyDescription(Annotated p0){ return null; }
+    public String findTypeName(AnnotatedClass p0){ return null; }
+    public String[] findEnumValues(Class<? extends Object> p0, Enum<? extends Object>[] p1, String[] p2){ return null; }
+    public String[] findPropertiesToIgnore(Annotated p0){ return null; }
+    public String[] findPropertiesToIgnore(Annotated p0, boolean p1){ return null; }
+    public String[] findSerializationPropertyOrder(AnnotatedClass p0){ return null; }
+    public TypeResolverBuilder<? extends Object> findPropertyContentTypeResolver(MapperConfig<? extends Object> p0, AnnotatedMember p1, JavaType p2){ return null; }
+    public TypeResolverBuilder<? extends Object> findPropertyTypeResolver(MapperConfig<? extends Object> p0, AnnotatedMember p1, JavaType p2){ return null; }
+    public TypeResolverBuilder<? extends Object> findTypeResolver(MapperConfig<? extends Object> p0, AnnotatedClass p1, JavaType p2){ return null; }
+    public VisibilityChecker<? extends Object> findAutoDetectVisibility(AnnotatedClass p0, VisibilityChecker<? extends Object> p1){ return null; }
+    public abstract Version version();
+    public boolean hasAnyGetterAnnotation(AnnotatedMethod p0){ return false; }
+    public boolean hasAnySetterAnnotation(AnnotatedMethod p0){ return false; }
+    public boolean hasAsValueAnnotation(AnnotatedMethod p0){ return false; }
+    public boolean hasCreatorAnnotation(Annotated p0){ return false; }
+    public boolean hasIgnoreMarker(AnnotatedMember p0){ return false; }
+    public boolean isAnnotationBundle(Annotation p0){ return false; }
+    public static AnnotationIntrospector nopInstance(){ return null; }
+    public static AnnotationIntrospector pair(AnnotationIntrospector p0, AnnotationIntrospector p1){ return null; }
+    public void findAndAddVirtualProperties(MapperConfig<? extends Object> p0, AnnotatedClass p1, List<BeanPropertyWriter> p2){}
+    static public class ReferenceProperty
+    {
+        protected ReferenceProperty() {}
+        public AnnotationIntrospector.ReferenceProperty.Type getType(){ return null; }
+        public ReferenceProperty(AnnotationIntrospector.ReferenceProperty.Type p0, String p1){}
+        public String getName(){ return null; }
+        public boolean isBackReference(){ return false; }
+        public boolean isManagedReference(){ return false; }
+        public static AnnotationIntrospector.ReferenceProperty back(String p0){ return null; }
+        public static AnnotationIntrospector.ReferenceProperty managed(String p0){ return null; }
+        static public enum Type
+        {
+            BACK_REFERENCE, MANAGED_REFERENCE;
+            private Type() {}
+        }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/BeanDescription.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/BeanDescription.java
new file mode 100644
index 00000000000..b075e5e7d6f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/BeanDescription.java
@@ -0,0 +1,59 @@
+// Generated automatically from com.fasterxml.jackson.databind.BeanDescription for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.annotation.JsonPOJOBuilder;
+import com.fasterxml.jackson.databind.introspect.AnnotatedClass;
+import com.fasterxml.jackson.databind.introspect.AnnotatedConstructor;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMethod;
+import com.fasterxml.jackson.databind.introspect.BeanPropertyDefinition;
+import com.fasterxml.jackson.databind.introspect.ObjectIdInfo;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+import com.fasterxml.jackson.databind.util.Annotations;
+import com.fasterxml.jackson.databind.util.Converter;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Method;
+import java.lang.reflect.Type;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+abstract public class BeanDescription
+{
+    protected BeanDescription() {}
+    protected BeanDescription(JavaType p0){}
+    protected final JavaType _type = null;
+    public Class<? extends Object> getBeanClass(){ return null; }
+    public JavaType getType(){ return null; }
+    public String findClassDescription(){ return null; }
+    public abstract AnnotatedClass getClassInfo();
+    public abstract AnnotatedConstructor findDefaultConstructor();
+    public abstract AnnotatedMember findAnyGetter();
+    public abstract AnnotatedMethod findAnySetter();
+    public abstract AnnotatedMethod findJsonValueMethod();
+    public abstract AnnotatedMethod findMethod(String p0, Class<? extends Object>[] p1);
+    public abstract Annotations getClassAnnotations();
+    public abstract Class<? extends Object> findPOJOBuilder();
+    public abstract Constructor<? extends Object> findSingleArgConstructor(Class<? extends Object>... p0);
+    public abstract Converter<Object, Object> findDeserializationConverter();
+    public abstract Converter<Object, Object> findSerializationConverter();
+    public abstract JavaType resolveType(Type p0);
+    public abstract JsonFormat.Value findExpectedFormat(JsonFormat.Value p0);
+    public abstract JsonInclude.Value findPropertyInclusion(JsonInclude.Value p0);
+    public abstract JsonPOJOBuilder.Value findPOJOBuilderConfig();
+    public abstract List<AnnotatedConstructor> getConstructors();
+    public abstract List<AnnotatedMethod> getFactoryMethods();
+    public abstract List<BeanPropertyDefinition> findProperties();
+    public abstract Map<Object, AnnotatedMember> findInjectables();
+    public abstract Map<String, AnnotatedMember> findBackReferenceProperties();
+    public abstract Method findFactoryMethod(Class<? extends Object>... p0);
+    public abstract Object instantiateBean(boolean p0);
+    public abstract ObjectIdInfo getObjectIdInfo();
+    public abstract Set<String> getIgnoredPropertyNames();
+    public abstract TypeBindings bindingsForBeanType();
+    public abstract boolean hasKnownClassAnnotations();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/BeanProperty.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/BeanProperty.java
new file mode 100644
index 00000000000..9c3d63f9b20
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/BeanProperty.java
@@ -0,0 +1,65 @@
+// Generated automatically from com.fasterxml.jackson.databind.BeanProperty for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.PropertyMetadata;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonObjectFormatVisitor;
+import com.fasterxml.jackson.databind.util.Annotations;
+import com.fasterxml.jackson.databind.util.Named;
+import java.lang.annotation.Annotation;
+
+public interface BeanProperty extends Named
+{
+    <A extends Annotation> A getAnnotation(Class<A> p0);
+    <A extends Annotation> A getContextAnnotation(Class<A> p0);
+    AnnotatedMember getMember();
+    JavaType getType();
+    JsonFormat.Value findFormatOverrides(AnnotationIntrospector p0);
+    JsonFormat.Value findPropertyFormat(MapperConfig<? extends Object> p0, Class<? extends Object> p1);
+    JsonInclude.Value findPropertyInclusion(MapperConfig<? extends Object> p0, Class<? extends Object> p1);
+    PropertyMetadata getMetadata();
+    PropertyName getFullName();
+    PropertyName getWrapperName();
+    String getName();
+    boolean isRequired();
+    boolean isVirtual();
+    static JsonFormat.Value EMPTY_FORMAT = null;
+    static JsonInclude.Value EMPTY_INCLUDE = null;
+    static public class Std implements BeanProperty
+    {
+        protected Std() {}
+        protected final AnnotatedMember _member = null;
+        protected final Annotations _contextAnnotations = null;
+        protected final JavaType _type = null;
+        protected final PropertyMetadata _metadata = null;
+        protected final PropertyName _name = null;
+        protected final PropertyName _wrapperName = null;
+        public <A extends Annotation> A getAnnotation(Class<A> p0){ return null; }
+        public <A extends Annotation> A getContextAnnotation(Class<A> p0){ return null; }
+        public AnnotatedMember getMember(){ return null; }
+        public BeanProperty.Std withType(JavaType p0){ return null; }
+        public JavaType getType(){ return null; }
+        public JsonFormat.Value findFormatOverrides(AnnotationIntrospector p0){ return null; }
+        public JsonFormat.Value findPropertyFormat(MapperConfig<? extends Object> p0, Class<? extends Object> p1){ return null; }
+        public JsonInclude.Value findPropertyInclusion(MapperConfig<? extends Object> p0, Class<? extends Object> p1){ return null; }
+        public PropertyMetadata getMetadata(){ return null; }
+        public PropertyName getFullName(){ return null; }
+        public PropertyName getWrapperName(){ return null; }
+        public Std(BeanProperty.Std p0, JavaType p1){}
+        public Std(PropertyName p0, JavaType p1, PropertyName p2, Annotations p3, AnnotatedMember p4, PropertyMetadata p5){}
+        public Std(String p0, JavaType p1, PropertyName p2, Annotations p3, AnnotatedMember p4, boolean p5){}
+        public String getName(){ return null; }
+        public boolean isRequired(){ return false; }
+        public boolean isVirtual(){ return false; }
+        public void depositSchemaProperty(JsonObjectFormatVisitor p0, SerializerProvider p1){}
+    }
+    void depositSchemaProperty(JsonObjectFormatVisitor p0, SerializerProvider p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DatabindContext.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DatabindContext.java
new file mode 100644
index 00000000000..471a67d98e0
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DatabindContext.java
@@ -0,0 +1,39 @@
+// Generated automatically from com.fasterxml.jackson.databind.DatabindContext for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.annotation.ObjectIdResolver;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import com.fasterxml.jackson.databind.introspect.ObjectIdInfo;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import com.fasterxml.jackson.databind.util.Converter;
+import java.lang.reflect.Type;
+import java.util.Locale;
+import java.util.TimeZone;
+
+abstract public class DatabindContext
+{
+    public Converter<Object, Object> converterInstance(Annotated p0, Object p1){ return null; }
+    public DatabindContext(){}
+    public JavaType constructSpecializedType(JavaType p0, Class<? extends Object> p1){ return null; }
+    public JavaType constructType(Type p0){ return null; }
+    public ObjectIdGenerator<? extends Object> objectIdGeneratorInstance(Annotated p0, ObjectIdInfo p1){ return null; }
+    public ObjectIdResolver objectIdResolverInstance(Annotated p0, ObjectIdInfo p1){ return null; }
+    public abstract AnnotationIntrospector getAnnotationIntrospector();
+    public abstract Class<? extends Object> getActiveView();
+    public abstract DatabindContext setAttribute(Object p0, Object p1);
+    public abstract JsonFormat.Value getDefaultPropertyFormat(Class<? extends Object> p0);
+    public abstract Locale getLocale();
+    public abstract MapperConfig<? extends Object> getConfig();
+    public abstract Object getAttribute(Object p0);
+    public abstract TimeZone getTimeZone();
+    public abstract TypeFactory getTypeFactory();
+    public abstract boolean canOverrideAccessModifiers();
+    public abstract boolean isEnabled(MapperFeature p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DeserializationConfig.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DeserializationConfig.java
new file mode 100644
index 00000000000..a9ffbc3ff0c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DeserializationConfig.java
@@ -0,0 +1,114 @@
+// Generated automatically from com.fasterxml.jackson.databind.DeserializationConfig for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.PropertyAccessor;
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.core.FormatFeature;
+import com.fasterxml.jackson.core.JsonFactory;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.cfg.BaseSettings;
+import com.fasterxml.jackson.databind.cfg.ConfigFeature;
+import com.fasterxml.jackson.databind.cfg.ContextAttributes;
+import com.fasterxml.jackson.databind.cfg.HandlerInstantiator;
+import com.fasterxml.jackson.databind.cfg.MapperConfigBase;
+import com.fasterxml.jackson.databind.deser.DeserializationProblemHandler;
+import com.fasterxml.jackson.databind.introspect.ClassIntrospector;
+import com.fasterxml.jackson.databind.introspect.SimpleMixInResolver;
+import com.fasterxml.jackson.databind.introspect.VisibilityChecker;
+import com.fasterxml.jackson.databind.jsontype.SubtypeResolver;
+import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
+import com.fasterxml.jackson.databind.jsontype.TypeResolverBuilder;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import com.fasterxml.jackson.databind.util.LinkedNode;
+import com.fasterxml.jackson.databind.util.RootNameLookup;
+import java.io.Serializable;
+import java.text.DateFormat;
+import java.util.Locale;
+import java.util.TimeZone;
+
+public class DeserializationConfig extends MapperConfigBase<DeserializationFeature, DeserializationConfig> implements Serializable
+{
+    protected DeserializationConfig() {}
+    protected BaseSettings getBaseSettings(){ return null; }
+    protected DeserializationConfig(DeserializationConfig p0, ContextAttributes p1){}
+    protected DeserializationConfig(DeserializationConfig p0, SimpleMixInResolver p1){}
+    protected DeserializationConfig(DeserializationConfig p0, SimpleMixInResolver p1, RootNameLookup p2){}
+    protected final JsonNodeFactory _nodeFactory = null;
+    protected final LinkedNode<DeserializationProblemHandler> _problemHandlers = null;
+    protected final int _deserFeatures = 0;
+    protected final int _formatReadFeatures = 0;
+    protected final int _formatReadFeaturesToChange = 0;
+    protected final int _parserFeatures = 0;
+    protected final int _parserFeaturesToChange = 0;
+    public <T extends BeanDescription> T introspect(JavaType p0){ return null; }
+    public <T extends BeanDescription> T introspectForBuilder(JavaType p0){ return null; }
+    public <T extends BeanDescription> T introspectForCreation(JavaType p0){ return null; }
+    public AnnotationIntrospector getAnnotationIntrospector(){ return null; }
+    public BeanDescription introspectClassAnnotations(JavaType p0){ return null; }
+    public BeanDescription introspectDirectClassAnnotations(JavaType p0){ return null; }
+    public DeserializationConfig with(AnnotationIntrospector p0){ return null; }
+    public DeserializationConfig with(Base64Variant p0){ return null; }
+    public DeserializationConfig with(ClassIntrospector p0){ return null; }
+    public DeserializationConfig with(ContextAttributes p0){ return null; }
+    public DeserializationConfig with(DateFormat p0){ return null; }
+    public DeserializationConfig with(DeserializationFeature p0){ return null; }
+    public DeserializationConfig with(DeserializationFeature p0, DeserializationFeature... p1){ return null; }
+    public DeserializationConfig with(FormatFeature p0){ return null; }
+    public DeserializationConfig with(HandlerInstantiator p0){ return null; }
+    public DeserializationConfig with(JsonNodeFactory p0){ return null; }
+    public DeserializationConfig with(JsonParser.Feature p0){ return null; }
+    public DeserializationConfig with(Locale p0){ return null; }
+    public DeserializationConfig with(MapperFeature p0, boolean p1){ return null; }
+    public DeserializationConfig with(MapperFeature... p0){ return null; }
+    public DeserializationConfig with(PropertyNamingStrategy p0){ return null; }
+    public DeserializationConfig with(SubtypeResolver p0){ return null; }
+    public DeserializationConfig with(TimeZone p0){ return null; }
+    public DeserializationConfig with(TypeFactory p0){ return null; }
+    public DeserializationConfig with(TypeResolverBuilder<? extends Object> p0){ return null; }
+    public DeserializationConfig with(VisibilityChecker<? extends Object> p0){ return null; }
+    public DeserializationConfig withAppendedAnnotationIntrospector(AnnotationIntrospector p0){ return null; }
+    public DeserializationConfig withFeatures(DeserializationFeature... p0){ return null; }
+    public DeserializationConfig withFeatures(FormatFeature... p0){ return null; }
+    public DeserializationConfig withFeatures(JsonParser.Feature... p0){ return null; }
+    public DeserializationConfig withHandler(DeserializationProblemHandler p0){ return null; }
+    public DeserializationConfig withInsertedAnnotationIntrospector(AnnotationIntrospector p0){ return null; }
+    public DeserializationConfig withNoProblemHandlers(){ return null; }
+    public DeserializationConfig withRootName(PropertyName p0){ return null; }
+    public DeserializationConfig withView(Class<? extends Object> p0){ return null; }
+    public DeserializationConfig withVisibility(PropertyAccessor p0, JsonAutoDetect.Visibility p1){ return null; }
+    public DeserializationConfig without(DeserializationFeature p0){ return null; }
+    public DeserializationConfig without(DeserializationFeature p0, DeserializationFeature... p1){ return null; }
+    public DeserializationConfig without(FormatFeature p0){ return null; }
+    public DeserializationConfig without(JsonParser.Feature p0){ return null; }
+    public DeserializationConfig without(MapperFeature... p0){ return null; }
+    public DeserializationConfig withoutFeatures(DeserializationFeature... p0){ return null; }
+    public DeserializationConfig withoutFeatures(FormatFeature... p0){ return null; }
+    public DeserializationConfig withoutFeatures(JsonParser.Feature... p0){ return null; }
+    public DeserializationConfig(BaseSettings p0, SubtypeResolver p1, SimpleMixInResolver p2, RootNameLookup p3){}
+    public JsonFormat.Value getDefaultPropertyFormat(Class<? extends Object> p0){ return null; }
+    public JsonInclude.Value getDefaultPropertyInclusion(){ return null; }
+    public JsonInclude.Value getDefaultPropertyInclusion(Class<? extends Object> p0){ return null; }
+    public LinkedNode<DeserializationProblemHandler> getProblemHandlers(){ return null; }
+    public TypeDeserializer findTypeDeserializer(JavaType p0){ return null; }
+    public VisibilityChecker<? extends Object> getDefaultVisibilityChecker(){ return null; }
+    public boolean useRootWrapping(){ return false; }
+    public final JsonNodeFactory getNodeFactory(){ return null; }
+    public final boolean hasDeserializationFeatures(int p0){ return false; }
+    public final boolean hasSomeOfFeatures(int p0){ return false; }
+    public final boolean isEnabled(DeserializationFeature p0){ return false; }
+    public final boolean isEnabled(JsonParser.Feature p0, JsonFactory p1){ return false; }
+    public final int getDeserializationFeatures(){ return 0; }
+    public void initialize(JsonParser p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DeserializationContext.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DeserializationContext.java
new file mode 100644
index 00000000000..4cb4a9a26bf
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DeserializationContext.java
@@ -0,0 +1,137 @@
+// Generated automatically from com.fasterxml.jackson.databind.DeserializationContext for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.annotation.ObjectIdResolver;
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.DatabindContext;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.InjectableValues;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.JsonMappingException;
+import com.fasterxml.jackson.databind.KeyDeserializer;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.cfg.ContextAttributes;
+import com.fasterxml.jackson.databind.deser.DeserializerCache;
+import com.fasterxml.jackson.databind.deser.DeserializerFactory;
+import com.fasterxml.jackson.databind.deser.impl.ReadableObjectId;
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import com.fasterxml.jackson.databind.util.ArrayBuilders;
+import com.fasterxml.jackson.databind.util.LinkedNode;
+import com.fasterxml.jackson.databind.util.ObjectBuffer;
+import java.io.Serializable;
+import java.text.DateFormat;
+import java.util.Calendar;
+import java.util.Date;
+import java.util.Locale;
+import java.util.TimeZone;
+import java.util.concurrent.atomic.AtomicReference;
+
+abstract public class DeserializationContext extends DatabindContext implements Serializable
+{
+    protected DeserializationContext() {}
+    protected ArrayBuilders _arrayBuilders = null;
+    protected ContextAttributes _attributes = null;
+    protected DateFormat _dateFormat = null;
+    protected DateFormat getDateFormat(){ return null; }
+    protected DeserializationContext(DeserializationContext p0){}
+    protected DeserializationContext(DeserializationContext p0, DeserializationConfig p1, JsonParser p2, InjectableValues p3){}
+    protected DeserializationContext(DeserializationContext p0, DeserializerFactory p1){}
+    protected DeserializationContext(DeserializerFactory p0){}
+    protected DeserializationContext(DeserializerFactory p0, DeserializerCache p1){}
+    protected JsonParser _parser = null;
+    protected LinkedNode<JavaType> _currentType = null;
+    protected ObjectBuffer _objectBuffer = null;
+    protected String _calcName(Class<? extends Object> p0){ return null; }
+    protected String _desc(String p0){ return null; }
+    protected String _quotedString(String p0){ return null; }
+    protected String _valueDesc(){ return null; }
+    protected String determineClassName(Object p0){ return null; }
+    protected final Class<? extends Object> _view = null;
+    protected final DeserializationConfig _config = null;
+    protected final DeserializerCache _cache = null;
+    protected final DeserializerFactory _factory = null;
+    protected final InjectableValues _injectableValues = null;
+    protected final int _featureFlags = 0;
+    public <T> T readPropertyValue(JsonParser p0, BeanProperty p1, Class<T> p2){ return null; }
+    public <T> T readPropertyValue(JsonParser p0, BeanProperty p1, JavaType p2){ return null; }
+    public <T> T readValue(JsonParser p0, Class<T> p1){ return null; }
+    public <T> T readValue(JsonParser p0, JavaType p1){ return null; }
+    public <T> T reportEndOfInputException(Class<? extends Object> p0){ return null; }
+    public <T> T reportUnknownTypeException(JavaType p0, String p1, String p2){ return null; }
+    public <T> T reportWeirdKeyException(Class<? extends Object> p0, String p1, String p2, Object... p3){ return null; }
+    public <T> T reportWeirdNumberException(Number p0, Class<? extends Object> p1, String p2, Object... p3){ return null; }
+    public <T> T reportWeirdStringException(String p0, Class<? extends Object> p1, String p2, Object... p3){ return null; }
+    public <T> T reportWrongTokenException(JsonParser p0, JsonToken p1, String p2, Object... p3){ return null; }
+    public Calendar constructCalendar(Date p0){ return null; }
+    public Class<? extends Object> findClass(String p0){ return null; }
+    public Date parseDate(String p0){ return null; }
+    public DeserializationConfig getConfig(){ return null; }
+    public DeserializationContext setAttribute(Object p0, Object p1){ return null; }
+    public DeserializerFactory getFactory(){ return null; }
+    public JavaType getContextualType(){ return null; }
+    public JsonDeserializer<? extends Object> handlePrimaryContextualization(JsonDeserializer<? extends Object> p0, BeanProperty p1){ return null; }
+    public JsonDeserializer<? extends Object> handlePrimaryContextualization(JsonDeserializer<? extends Object> p0, BeanProperty p1, JavaType p2){ return null; }
+    public JsonDeserializer<? extends Object> handleSecondaryContextualization(JsonDeserializer<? extends Object> p0, BeanProperty p1){ return null; }
+    public JsonDeserializer<? extends Object> handleSecondaryContextualization(JsonDeserializer<? extends Object> p0, BeanProperty p1, JavaType p2){ return null; }
+    public JsonMappingException endOfInputException(Class<? extends Object> p0){ return null; }
+    public JsonMappingException instantiationException(Class<? extends Object> p0, String p1){ return null; }
+    public JsonMappingException instantiationException(Class<? extends Object> p0, Throwable p1){ return null; }
+    public JsonMappingException mappingException(Class<? extends Object> p0){ return null; }
+    public JsonMappingException mappingException(Class<? extends Object> p0, JsonToken p1){ return null; }
+    public JsonMappingException mappingException(String p0){ return null; }
+    public JsonMappingException mappingException(String p0, Object... p1){ return null; }
+    public JsonMappingException reportInstantiationException(Class<? extends Object> p0, String p1, Object... p2){ return null; }
+    public JsonMappingException reportInstantiationException(Class<? extends Object> p0, Throwable p1){ return null; }
+    public JsonMappingException reportMappingException(String p0, Object... p1){ return null; }
+    public JsonMappingException unknownTypeException(JavaType p0, String p1){ return null; }
+    public JsonMappingException unknownTypeException(JavaType p0, String p1, String p2){ return null; }
+    public JsonMappingException weirdKeyException(Class<? extends Object> p0, String p1, String p2){ return null; }
+    public JsonMappingException weirdNumberException(Number p0, Class<? extends Object> p1, String p2){ return null; }
+    public JsonMappingException weirdStringException(String p0, Class<? extends Object> p1, String p2){ return null; }
+    public JsonMappingException wrongTokenException(JsonParser p0, JsonToken p1, String p2){ return null; }
+    public Locale getLocale(){ return null; }
+    public Object getAttribute(Object p0){ return null; }
+    public TimeZone getTimeZone(){ return null; }
+    public abstract JsonDeserializer<Object> deserializerInstance(Annotated p0, Object p1);
+    public abstract KeyDeserializer keyDeserializerInstance(Annotated p0, Object p1);
+    public abstract ReadableObjectId findObjectId(Object p0, ObjectIdGenerator<? extends Object> p1);
+    public abstract ReadableObjectId findObjectId(Object p0, ObjectIdGenerator<? extends Object> p1, ObjectIdResolver p2);
+    public abstract void checkUnresolvedObjectId();
+    public boolean handleUnknownProperty(JsonParser p0, JsonDeserializer<? extends Object> p1, Object p2, String p3){ return false; }
+    public boolean hasValueDeserializerFor(JavaType p0){ return false; }
+    public boolean hasValueDeserializerFor(JavaType p0, AtomicReference<Throwable> p1){ return false; }
+    public final AnnotationIntrospector getAnnotationIntrospector(){ return null; }
+    public final ArrayBuilders getArrayBuilders(){ return null; }
+    public final Base64Variant getBase64Variant(){ return null; }
+    public final Class<? extends Object> getActiveView(){ return null; }
+    public final JavaType constructType(Class<? extends Object> p0){ return null; }
+    public final JsonDeserializer<Object> findContextualValueDeserializer(JavaType p0, BeanProperty p1){ return null; }
+    public final JsonDeserializer<Object> findNonContextualValueDeserializer(JavaType p0){ return null; }
+    public final JsonDeserializer<Object> findRootValueDeserializer(JavaType p0){ return null; }
+    public final JsonFormat.Value getDefaultPropertyFormat(Class<? extends Object> p0){ return null; }
+    public final JsonNodeFactory getNodeFactory(){ return null; }
+    public final JsonParser getParser(){ return null; }
+    public final KeyDeserializer findKeyDeserializer(JavaType p0, BeanProperty p1){ return null; }
+    public final Object findInjectableValue(Object p0, BeanProperty p1, Object p2){ return null; }
+    public final ObjectBuffer leaseObjectBuffer(){ return null; }
+    public final TypeFactory getTypeFactory(){ return null; }
+    public final boolean canOverrideAccessModifiers(){ return false; }
+    public final boolean hasDeserializationFeatures(int p0){ return false; }
+    public final boolean hasSomeOfFeatures(int p0){ return false; }
+    public final boolean isEnabled(DeserializationFeature p0){ return false; }
+    public final boolean isEnabled(MapperFeature p0){ return false; }
+    public final int getDeserializationFeatures(){ return 0; }
+    public final void returnObjectBuffer(ObjectBuffer p0){}
+    public void reportUnknownProperty(Object p0, String p1, JsonDeserializer<? extends Object> p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DeserializationFeature.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DeserializationFeature.java
new file mode 100644
index 00000000000..58dbf219959
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/DeserializationFeature.java
@@ -0,0 +1,25 @@
+// Generated automatically from com.fasterxml.jackson.databind.DeserializationFeature for testing
+// purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.databind.cfg.ConfigFeature;
+
+
+public enum DeserializationFeature implements ConfigFeature {
+    ACCEPT_EMPTY_ARRAY_AS_NULL_OBJECT, ACCEPT_EMPTY_STRING_AS_NULL_OBJECT, ACCEPT_FLOAT_AS_INT, ACCEPT_SINGLE_VALUE_AS_ARRAY, ADJUST_DATES_TO_CONTEXT_TIME_ZONE, EAGER_DESERIALIZER_FETCH, FAIL_ON_IGNORED_PROPERTIES, FAIL_ON_INVALID_SUBTYPE, FAIL_ON_MISSING_CREATOR_PROPERTIES, FAIL_ON_NULL_FOR_PRIMITIVES, FAIL_ON_NUMBERS_FOR_ENUMS, FAIL_ON_READING_DUP_TREE_KEY, FAIL_ON_UNKNOWN_PROPERTIES, FAIL_ON_UNRESOLVED_OBJECT_IDS, READ_DATE_TIMESTAMPS_AS_NANOSECONDS, READ_ENUMS_USING_TO_STRING, READ_UNKNOWN_ENUM_VALUES_AS_NULL, UNWRAP_ROOT_VALUE, UNWRAP_SINGLE_VALUE_ARRAYS, USE_BIG_DECIMAL_FOR_FLOATS, USE_BIG_INTEGER_FOR_INTS, USE_JAVA_ARRAY_FOR_JSON_ARRAY, USE_LONG_FOR_INTS, WRAP_EXCEPTIONS;
+
+    private DeserializationFeature() {}
+
+    public boolean enabledByDefault() {
+        return false;
+    }
+
+    public boolean enabledIn(int p0) {
+        return false;
+    }
+
+    public int getMask() {
+        return 0;
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/InjectableValues.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/InjectableValues.java
new file mode 100644
index 00000000000..4cde0036faf
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/InjectableValues.java
@@ -0,0 +1,12 @@
+// Generated automatically from com.fasterxml.jackson.databind.InjectableValues for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.DeserializationContext;
+
+abstract public class InjectableValues
+{
+    public InjectableValues(){}
+    public abstract Object findInjectableValue(Object p0, DeserializationContext p1, BeanProperty p2, Object p3);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JavaType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JavaType.java
new file mode 100644
index 00000000000..5b12e5f0193
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JavaType.java
@@ -0,0 +1,72 @@
+// Generated automatically from com.fasterxml.jackson.databind.JavaType for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.type.ResolvedType;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+import java.io.Serializable;
+import java.lang.reflect.Type;
+import java.util.List;
+
+abstract public class JavaType extends ResolvedType implements Serializable, Type
+{
+    protected JavaType() {}
+    protected JavaType(Class<? extends Object> p0, int p1, Object p2, Object p3, boolean p4){}
+    protected JavaType(JavaType p0){}
+    protected abstract JavaType _narrow(Class<? extends Object> p0);
+    protected final Class<? extends Object> _class = null;
+    protected final Object _typeHandler = null;
+    protected final Object _valueHandler = null;
+    protected final boolean _asStatic = false;
+    protected final int _hash = 0;
+    public <T> T getTypeHandler(){ return null; }
+    public <T> T getValueHandler(){ return null; }
+    public Class<? extends Object> getParameterSource(){ return null; }
+    public JavaType containedTypeOrUnknown(int p0){ return null; }
+    public JavaType forcedNarrowBy(Class<? extends Object> p0){ return null; }
+    public JavaType getContentType(){ return null; }
+    public JavaType getKeyType(){ return null; }
+    public JavaType getReferencedType(){ return null; }
+    public Object getContentTypeHandler(){ return null; }
+    public Object getContentValueHandler(){ return null; }
+    public String getErasedSignature(){ return null; }
+    public String getGenericSignature(){ return null; }
+    public abstract JavaType containedType(int p0);
+    public abstract JavaType findSuperType(Class<? extends Object> p0);
+    public abstract JavaType getSuperClass();
+    public abstract JavaType refine(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3);
+    public abstract JavaType withContentType(JavaType p0);
+    public abstract JavaType withContentTypeHandler(Object p0);
+    public abstract JavaType withContentValueHandler(Object p0);
+    public abstract JavaType withStaticTyping();
+    public abstract JavaType withTypeHandler(Object p0);
+    public abstract JavaType withValueHandler(Object p0);
+    public abstract JavaType[] findTypeParameters(Class<? extends Object> p0);
+    public abstract List<JavaType> getInterfaces();
+    public abstract String containedTypeName(int p0);
+    public abstract String toString();
+    public abstract StringBuilder getErasedSignature(StringBuilder p0);
+    public abstract StringBuilder getGenericSignature(StringBuilder p0);
+    public abstract TypeBindings getBindings();
+    public abstract boolean equals(Object p0);
+    public abstract boolean isContainerType();
+    public abstract int containedTypeCount();
+    public boolean hasGenericTypes(){ return false; }
+    public boolean hasValueHandler(){ return false; }
+    public boolean isAbstract(){ return false; }
+    public boolean isArrayType(){ return false; }
+    public boolean isCollectionLikeType(){ return false; }
+    public boolean isConcrete(){ return false; }
+    public boolean isMapLikeType(){ return false; }
+    public boolean isThrowable(){ return false; }
+    public final Class<? extends Object> getRawClass(){ return null; }
+    public final boolean hasRawClass(Class<? extends Object> p0){ return false; }
+    public final boolean isEnumType(){ return false; }
+    public final boolean isFinal(){ return false; }
+    public final boolean isInterface(){ return false; }
+    public final boolean isJavaLangObject(){ return false; }
+    public final boolean isPrimitive(){ return false; }
+    public final boolean isTypeOrSubTypeOf(Class<? extends Object> p0){ return false; }
+    public final boolean useStaticType(){ return false; }
+    public final int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonDeserializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonDeserializer.java
new file mode 100644
index 00000000000..e4937ffc00d
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonDeserializer.java
@@ -0,0 +1,31 @@
+// Generated automatically from com.fasterxml.jackson.databind.JsonDeserializer for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.deser.SettableBeanProperty;
+import com.fasterxml.jackson.databind.deser.impl.ObjectIdReader;
+import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
+import com.fasterxml.jackson.databind.util.NameTransformer;
+import java.util.Collection;
+
+abstract public class JsonDeserializer<T>
+{
+    public Class<? extends Object> handledType(){ return null; }
+    public Collection<Object> getKnownPropertyNames(){ return null; }
+    public JsonDeserializer(){}
+    public JsonDeserializer<? extends Object> getDelegatee(){ return null; }
+    public JsonDeserializer<? extends Object> replaceDelegatee(JsonDeserializer<? extends Object> p0){ return null; }
+    public JsonDeserializer<T> unwrappingDeserializer(NameTransformer p0){ return null; }
+    public Object deserializeWithType(JsonParser p0, DeserializationContext p1, TypeDeserializer p2){ return null; }
+    public ObjectIdReader getObjectIdReader(){ return null; }
+    public SettableBeanProperty findBackReference(String p0){ return null; }
+    public T deserialize(JsonParser p0, DeserializationContext p1, T p2){ return null; }
+    public T getEmptyValue(){ return null; }
+    public T getEmptyValue(DeserializationContext p0){ return null; }
+    public T getNullValue(){ return null; }
+    public T getNullValue(DeserializationContext p0){ return null; }
+    public abstract T deserialize(JsonParser p0, DeserializationContext p1);
+    public boolean isCachable(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonMappingException.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonMappingException.java
new file mode 100644
index 00000000000..25c25b48c86
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonMappingException.java
@@ -0,0 +1,71 @@
+// Generated automatically from com.fasterxml.jackson.databind.JsonMappingException for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonLocation;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import java.io.Closeable;
+import java.io.IOException;
+import java.io.Serializable;
+import java.util.LinkedList;
+import java.util.List;
+
+public class JsonMappingException extends JsonProcessingException
+{
+    protected JsonMappingException() {}
+    protected Closeable _processor = null;
+    protected LinkedList<JsonMappingException.Reference> _path = null;
+    protected String _buildMessage(){ return null; }
+    protected void _appendPathDesc(StringBuilder p0){}
+    public JsonMappingException(Closeable p0, String p1){}
+    public JsonMappingException(Closeable p0, String p1, JsonLocation p2){}
+    public JsonMappingException(Closeable p0, String p1, Throwable p2){}
+    public JsonMappingException(String p0){}
+    public JsonMappingException(String p0, JsonLocation p1){}
+    public JsonMappingException(String p0, JsonLocation p1, Throwable p2){}
+    public JsonMappingException(String p0, Throwable p1){}
+    public List<JsonMappingException.Reference> getPath(){ return null; }
+    public Object getProcessor(){ return null; }
+    public String getLocalizedMessage(){ return null; }
+    public String getMessage(){ return null; }
+    public String getPathReference(){ return null; }
+    public String toString(){ return null; }
+    public StringBuilder getPathReference(StringBuilder p0){ return null; }
+    public static JsonMappingException from(DeserializationContext p0, String p1){ return null; }
+    public static JsonMappingException from(DeserializationContext p0, String p1, Throwable p2){ return null; }
+    public static JsonMappingException from(JsonGenerator p0, String p1){ return null; }
+    public static JsonMappingException from(JsonGenerator p0, String p1, Throwable p2){ return null; }
+    public static JsonMappingException from(JsonParser p0, String p1){ return null; }
+    public static JsonMappingException from(JsonParser p0, String p1, Throwable p2){ return null; }
+    public static JsonMappingException from(SerializerProvider p0, String p1){ return null; }
+    public static JsonMappingException from(SerializerProvider p0, String p1, Throwable p2){ return null; }
+    public static JsonMappingException fromUnexpectedIOE(IOException p0){ return null; }
+    public static JsonMappingException wrapWithPath(Throwable p0, JsonMappingException.Reference p1){ return null; }
+    public static JsonMappingException wrapWithPath(Throwable p0, Object p1, String p2){ return null; }
+    public static JsonMappingException wrapWithPath(Throwable p0, Object p1, int p2){ return null; }
+    public void prependPath(JsonMappingException.Reference p0){}
+    public void prependPath(Object p0, String p1){}
+    public void prependPath(Object p0, int p1){}
+    static public class Reference implements Serializable
+    {
+        protected Object _from = null;
+        protected Reference(){}
+        protected String _asString = null;
+        protected String _fieldName = null;
+        protected int _index = 0;
+        public Object getFrom(){ return null; }
+        public Reference(Object p0){}
+        public Reference(Object p0, String p1){}
+        public Reference(Object p0, int p1){}
+        public String getFieldName(){ return null; }
+        public String toString(){ return null; }
+        public int getIndex(){ return 0; }
+        public void setFieldName(String p0){}
+        public void setFrom(Object p0){}
+        public void setIndex(int p0){}
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonNode.java
new file mode 100644
index 00000000000..c212d6b52e4
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonNode.java
@@ -0,0 +1,94 @@
+// Generated automatically from com.fasterxml.jackson.databind.JsonNode for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.JsonPointer;
+import com.fasterxml.jackson.core.TreeNode;
+import com.fasterxml.jackson.databind.JsonSerializable;
+import com.fasterxml.jackson.databind.node.JsonNodeType;
+import java.math.BigDecimal;
+import java.math.BigInteger;
+import java.util.Comparator;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+
+abstract public class JsonNode extends JsonSerializable.Base implements Iterable<JsonNode>, TreeNode
+{
+    protected JsonNode(){}
+    protected abstract JsonNode _at(JsonPointer p0);
+    public BigDecimal decimalValue(){ return null; }
+    public BigInteger bigIntegerValue(){ return null; }
+    public Iterator<JsonNode> elements(){ return null; }
+    public Iterator<Map.Entry<String, JsonNode>> fields(){ return null; }
+    public Iterator<String> fieldNames(){ return null; }
+    public JsonNode get(String p0){ return null; }
+    public JsonNode with(String p0){ return null; }
+    public JsonNode withArray(String p0){ return null; }
+    public Number numberValue(){ return null; }
+    public String asText(String p0){ return null; }
+    public String textValue(){ return null; }
+    public abstract <T extends JsonNode> T deepCopy();
+    public abstract JsonNode findParent(String p0);
+    public abstract JsonNode findPath(String p0);
+    public abstract JsonNode findValue(String p0);
+    public abstract JsonNode get(int p0);
+    public abstract JsonNode path(String p0);
+    public abstract JsonNode path(int p0);
+    public abstract JsonNodeType getNodeType();
+    public abstract List<JsonNode> findParents(String p0, List<JsonNode> p1);
+    public abstract List<JsonNode> findValues(String p0, List<JsonNode> p1);
+    public abstract List<String> findValuesAsText(String p0, List<String> p1);
+    public abstract String asText();
+    public abstract String toString();
+    public abstract boolean equals(Object p0);
+    public boolean asBoolean(){ return false; }
+    public boolean asBoolean(boolean p0){ return false; }
+    public boolean booleanValue(){ return false; }
+    public boolean canConvertToInt(){ return false; }
+    public boolean canConvertToLong(){ return false; }
+    public boolean equals(Comparator<JsonNode> p0, JsonNode p1){ return false; }
+    public boolean has(String p0){ return false; }
+    public boolean has(int p0){ return false; }
+    public boolean hasNonNull(String p0){ return false; }
+    public boolean hasNonNull(int p0){ return false; }
+    public boolean isBigDecimal(){ return false; }
+    public boolean isBigInteger(){ return false; }
+    public boolean isDouble(){ return false; }
+    public boolean isFloat(){ return false; }
+    public boolean isFloatingPointNumber(){ return false; }
+    public boolean isInt(){ return false; }
+    public boolean isIntegralNumber(){ return false; }
+    public boolean isLong(){ return false; }
+    public boolean isShort(){ return false; }
+    public byte[] binaryValue(){ return null; }
+    public double asDouble(){ return 0; }
+    public double asDouble(double p0){ return 0; }
+    public double doubleValue(){ return 0; }
+    public final Iterator<JsonNode> iterator(){ return null; }
+    public final JsonNode at(JsonPointer p0){ return null; }
+    public final JsonNode at(String p0){ return null; }
+    public final List<JsonNode> findParents(String p0){ return null; }
+    public final List<JsonNode> findValues(String p0){ return null; }
+    public final List<String> findValuesAsText(String p0){ return null; }
+    public final boolean isArray(){ return false; }
+    public final boolean isBinary(){ return false; }
+    public final boolean isBoolean(){ return false; }
+    public final boolean isContainerNode(){ return false; }
+    public final boolean isMissingNode(){ return false; }
+    public final boolean isNull(){ return false; }
+    public final boolean isNumber(){ return false; }
+    public final boolean isObject(){ return false; }
+    public final boolean isPojo(){ return false; }
+    public final boolean isTextual(){ return false; }
+    public final boolean isValueNode(){ return false; }
+    public float floatValue(){ return 0; }
+    public int asInt(){ return 0; }
+    public int asInt(int p0){ return 0; }
+    public int intValue(){ return 0; }
+    public int size(){ return 0; }
+    public long asLong(){ return 0; }
+    public long asLong(long p0){ return 0; }
+    public long longValue(){ return 0; }
+    public short shortValue(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonSerializable.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonSerializable.java
new file mode 100644
index 00000000000..fd7a7cca10b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonSerializable.java
@@ -0,0 +1,18 @@
+// Generated automatically from com.fasterxml.jackson.databind.JsonSerializable for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+
+public interface JsonSerializable
+{
+    abstract static public class Base implements JsonSerializable
+    {
+        public Base(){}
+        public boolean isEmpty(SerializerProvider p0){ return false; }
+    }
+    void serialize(JsonGenerator p0, SerializerProvider p1);
+    void serializeWithType(JsonGenerator p0, SerializerProvider p1, TypeSerializer p2);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonSerializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonSerializer.java
new file mode 100644
index 00000000000..e1ceee8bd05
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/JsonSerializer.java
@@ -0,0 +1,31 @@
+// Generated automatically from com.fasterxml.jackson.databind.JsonSerializer for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitable;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.ser.PropertyWriter;
+import com.fasterxml.jackson.databind.util.NameTransformer;
+import java.util.Iterator;
+
+abstract public class JsonSerializer<T> implements JsonFormatVisitable
+{
+    public Class<T> handledType(){ return null; }
+    public Iterator<PropertyWriter> properties(){ return null; }
+    public JsonSerializer(){}
+    public JsonSerializer<? extends Object> getDelegatee(){ return null; }
+    public JsonSerializer<? extends Object> withFilterId(Object p0){ return null; }
+    public JsonSerializer<T> replaceDelegatee(JsonSerializer<? extends Object> p0){ return null; }
+    public JsonSerializer<T> unwrappingSerializer(NameTransformer p0){ return null; }
+    public abstract void serialize(T p0, JsonGenerator p1, SerializerProvider p2);
+    public boolean isEmpty(SerializerProvider p0, T p1){ return false; }
+    public boolean isEmpty(T p0){ return false; }
+    public boolean isUnwrappingSerializer(){ return false; }
+    public boolean usesObjectId(){ return false; }
+    public void acceptJsonFormatVisitor(JsonFormatVisitorWrapper p0, JavaType p1){}
+    public void serializeWithType(T p0, JsonGenerator p1, SerializerProvider p2, TypeSerializer p3){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/KeyDeserializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/KeyDeserializer.java
new file mode 100644
index 00000000000..b5d4817fa3e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/KeyDeserializer.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.databind.KeyDeserializer for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.databind.DeserializationContext;
+
+abstract public class KeyDeserializer
+{
+    public KeyDeserializer(){}
+    public abstract Object deserializeKey(String p0, DeserializationContext p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/MapperFeature.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/MapperFeature.java
new file mode 100644
index 00000000000..1dec2a29e3a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/MapperFeature.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.databind.MapperFeature for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+
+public enum MapperFeature
+{
+    ACCEPT_CASE_INSENSITIVE_PROPERTIES, ALLOW_EXPLICIT_PROPERTY_RENAMING, ALLOW_FINAL_FIELDS_AS_MUTATORS, AUTO_DETECT_CREATORS, AUTO_DETECT_FIELDS, AUTO_DETECT_GETTERS, AUTO_DETECT_IS_GETTERS, AUTO_DETECT_SETTERS, CAN_OVERRIDE_ACCESS_MODIFIERS, DEFAULT_VIEW_INCLUSION, IGNORE_DUPLICATE_MODULE_REGISTRATIONS, INFER_PROPERTY_MUTATORS, OVERRIDE_PUBLIC_ACCESS_MODIFIERS, PROPAGATE_TRANSIENT_MARKER, REQUIRE_SETTERS_FOR_GETTERS, SORT_PROPERTIES_ALPHABETICALLY, USE_ANNOTATIONS, USE_GETTERS_AS_SETTERS, USE_STATIC_TYPING, USE_STD_BEAN_NAMING, USE_WRAPPER_NAME_AS_PROPERTY_NAME;
+    private MapperFeature() {}
+    public boolean enabledByDefault(){ return false; }
+    public boolean enabledIn(int p0){ return false; }
+    public int getMask(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/MappingIterator.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/MappingIterator.java
new file mode 100644
index 00000000000..1a974b12999
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/MappingIterator.java
@@ -0,0 +1,53 @@
+// Generated automatically from com.fasterxml.jackson.databind.MappingIterator for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.FormatSchema;
+import com.fasterxml.jackson.core.JsonLocation;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonStreamContext;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.JsonMappingException;
+import java.io.Closeable;
+import java.io.IOException;
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.List;
+
+public class MappingIterator<T> implements Closeable, Iterator<T>
+{
+    protected MappingIterator() {}
+    protected <R> R _handleIOException(IOException p0){ return null; }
+    protected <R> R _handleMappingException(JsonMappingException p0){ return null; }
+    protected <R> R _throwNoSuchElement(){ return null; }
+    protected MappingIterator(JavaType p0, JsonParser p1, DeserializationContext p2, JsonDeserializer<? extends Object> p3, boolean p4, Object p5){}
+    protected final DeserializationContext _context = null;
+    protected final JavaType _type = null;
+    protected final JsonDeserializer<T> _deserializer = null;
+    protected final JsonParser _parser = null;
+    protected final JsonStreamContext _seqContext = null;
+    protected final T _updatedValue = null;
+    protected final boolean _closeParser = false;
+    protected int _state = 0;
+    protected static <T> MappingIterator<T> emptyIterator(){ return null; }
+    protected static MappingIterator<? extends Object> EMPTY_ITERATOR = null;
+    protected static int STATE_CLOSED = 0;
+    protected static int STATE_HAS_VALUE = 0;
+    protected static int STATE_MAY_HAVE_VALUE = 0;
+    protected static int STATE_NEED_RESYNC = 0;
+    protected void _resync(){}
+    public <C extends Collection<? super T>> C readAll(C p0){ return null; }
+    public <L extends List<? super T>> L readAll(L p0){ return null; }
+    public FormatSchema getParserSchema(){ return null; }
+    public JsonLocation getCurrentLocation(){ return null; }
+    public JsonParser getParser(){ return null; }
+    public List<T> readAll(){ return null; }
+    public T next(){ return null; }
+    public T nextValue(){ return null; }
+    public boolean hasNext(){ return false; }
+    public boolean hasNextValue(){ return false; }
+    public void close(){}
+    public void remove(){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/Module.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/Module.java
new file mode 100644
index 00000000000..f08e41a5a73
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/Module.java
@@ -0,0 +1,65 @@
+// Generated automatically from com.fasterxml.jackson.databind.Module for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.JsonFactory;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.ObjectCodec;
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.core.Versioned;
+import com.fasterxml.jackson.databind.AbstractTypeResolver;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.databind.deser.BeanDeserializerModifier;
+import com.fasterxml.jackson.databind.deser.DeserializationProblemHandler;
+import com.fasterxml.jackson.databind.deser.Deserializers;
+import com.fasterxml.jackson.databind.deser.KeyDeserializers;
+import com.fasterxml.jackson.databind.deser.ValueInstantiators;
+import com.fasterxml.jackson.databind.introspect.ClassIntrospector;
+import com.fasterxml.jackson.databind.jsontype.NamedType;
+import com.fasterxml.jackson.databind.ser.BeanSerializerModifier;
+import com.fasterxml.jackson.databind.ser.Serializers;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import com.fasterxml.jackson.databind.type.TypeModifier;
+
+abstract public class Module implements Versioned
+{
+    public Module(){}
+    public Object getTypeId(){ return null; }
+    public abstract String getModuleName();
+    public abstract Version version();
+    public abstract void setupModule(Module.SetupContext p0);
+    static public interface SetupContext
+    {
+        <C extends ObjectCodec> C getOwner();
+        TypeFactory getTypeFactory();
+        Version getMapperVersion();
+        boolean isEnabled(DeserializationFeature p0);
+        boolean isEnabled(JsonFactory.Feature p0);
+        boolean isEnabled(JsonGenerator.Feature p0);
+        boolean isEnabled(JsonParser.Feature p0);
+        boolean isEnabled(MapperFeature p0);
+        boolean isEnabled(SerializationFeature p0);
+        void addAbstractTypeResolver(AbstractTypeResolver p0);
+        void addBeanDeserializerModifier(BeanDeserializerModifier p0);
+        void addBeanSerializerModifier(BeanSerializerModifier p0);
+        void addDeserializationProblemHandler(DeserializationProblemHandler p0);
+        void addDeserializers(Deserializers p0);
+        void addKeyDeserializers(KeyDeserializers p0);
+        void addKeySerializers(Serializers p0);
+        void addSerializers(Serializers p0);
+        void addTypeModifier(TypeModifier p0);
+        void addValueInstantiators(ValueInstantiators p0);
+        void appendAnnotationIntrospector(AnnotationIntrospector p0);
+        void insertAnnotationIntrospector(AnnotationIntrospector p0);
+        void registerSubtypes(Class<? extends Object>... p0);
+        void registerSubtypes(NamedType... p0);
+        void setClassIntrospector(ClassIntrospector p0);
+        void setMixInAnnotations(Class<? extends Object> p0, Class<? extends Object> p1);
+        void setNamingStrategy(PropertyNamingStrategy p0);
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ObjectMapper.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ObjectMapper.java
new file mode 100644
index 00000000000..270d243a74a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ObjectMapper.java
@@ -0,0 +1,306 @@
+// Generated automatically from com.fasterxml.jackson.databind.ObjectMapper for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.PropertyAccessor;
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.core.FormatSchema;
+import com.fasterxml.jackson.core.JsonFactory;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.core.ObjectCodec;
+import com.fasterxml.jackson.core.PrettyPrinter;
+import com.fasterxml.jackson.core.TreeNode;
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.core.Versioned;
+import com.fasterxml.jackson.core.io.CharacterEscapes;
+import com.fasterxml.jackson.core.type.ResolvedType;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.InjectableValues;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.MappingIterator;
+import com.fasterxml.jackson.databind.Module;
+import com.fasterxml.jackson.databind.ObjectReader;
+import com.fasterxml.jackson.databind.ObjectWriter;
+import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.cfg.BaseSettings;
+import com.fasterxml.jackson.databind.cfg.ContextAttributes;
+import com.fasterxml.jackson.databind.cfg.HandlerInstantiator;
+import com.fasterxml.jackson.databind.deser.DefaultDeserializationContext;
+import com.fasterxml.jackson.databind.deser.DeserializationProblemHandler;
+import com.fasterxml.jackson.databind.introspect.ClassIntrospector;
+import com.fasterxml.jackson.databind.introspect.SimpleMixInResolver;
+import com.fasterxml.jackson.databind.introspect.VisibilityChecker;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper;
+import com.fasterxml.jackson.databind.jsonschema.JsonSchema;
+import com.fasterxml.jackson.databind.jsontype.NamedType;
+import com.fasterxml.jackson.databind.jsontype.SubtypeResolver;
+import com.fasterxml.jackson.databind.jsontype.TypeResolverBuilder;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fasterxml.jackson.databind.ser.DefaultSerializerProvider;
+import com.fasterxml.jackson.databind.ser.FilterProvider;
+import com.fasterxml.jackson.databind.ser.SerializerFactory;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import java.io.File;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.Reader;
+import java.io.Serializable;
+import java.io.Writer;
+import java.lang.reflect.Type;
+import java.net.URL;
+import java.text.DateFormat;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.TimeZone;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicReference;
+
+public class ObjectMapper extends ObjectCodec implements Serializable, Versioned
+{
+    protected ClassIntrospector defaultClassIntrospector(){ return null; }
+    protected DefaultDeserializationContext _deserializationContext = null;
+    protected DefaultDeserializationContext createDeserializationContext(JsonParser p0, DeserializationConfig p1){ return null; }
+    protected DefaultSerializerProvider _serializerProvider = null;
+    protected DefaultSerializerProvider _serializerProvider(SerializationConfig p0){ return null; }
+    protected DeserializationConfig _deserializationConfig = null;
+    protected InjectableValues _injectableValues = null;
+    protected JsonDeserializer<Object> _findRootDeserializer(DeserializationContext p0, JavaType p1){ return null; }
+    protected JsonToken _initForReading(JsonParser p0){ return null; }
+    protected Object _convert(Object p0, JavaType p1){ return null; }
+    protected Object _readMapAndClose(JsonParser p0, JavaType p1){ return null; }
+    protected Object _readValue(DeserializationConfig p0, JsonParser p1, JavaType p2){ return null; }
+    protected Object _unwrapAndDeserialize(JsonParser p0, DeserializationContext p1, DeserializationConfig p2, JavaType p3, JsonDeserializer<Object> p4){ return null; }
+    protected ObjectMapper(ObjectMapper p0){}
+    protected ObjectReader _newReader(DeserializationConfig p0){ return null; }
+    protected ObjectReader _newReader(DeserializationConfig p0, JavaType p1, Object p2, FormatSchema p3, InjectableValues p4){ return null; }
+    protected ObjectWriter _newWriter(SerializationConfig p0){ return null; }
+    protected ObjectWriter _newWriter(SerializationConfig p0, FormatSchema p1){ return null; }
+    protected ObjectWriter _newWriter(SerializationConfig p0, JavaType p1, PrettyPrinter p2){ return null; }
+    protected PrettyPrinter _defaultPrettyPrinter(){ return null; }
+    protected SerializationConfig _serializationConfig = null;
+    protected SerializerFactory _serializerFactory = null;
+    protected Set<Object> _registeredModuleTypes = null;
+    protected SimpleMixInResolver _mixIns = null;
+    protected SubtypeResolver _subtypeResolver = null;
+    protected TypeFactory _typeFactory = null;
+    protected final ConcurrentHashMap<JavaType, JsonDeserializer<Object>> _rootDeserializers = null;
+    protected final JsonFactory _jsonFactory = null;
+    protected final void _configAndWriteValue(JsonGenerator p0, Object p1){}
+    protected final void _configAndWriteValue(JsonGenerator p0, Object p1, Class<? extends Object> p2){}
+    protected static AnnotationIntrospector DEFAULT_ANNOTATION_INTROSPECTOR = null;
+    protected static BaseSettings DEFAULT_BASE = null;
+    protected static PrettyPrinter _defaultPrettyPrinter = null;
+    protected static VisibilityChecker<? extends Object> STD_VISIBILITY_CHECKER = null;
+    protected void _checkInvalidCopy(Class<? extends Object> p0){}
+    protected void _verifySchemaType(FormatSchema p0){}
+    public <T extends JsonNode> T valueToTree(Object p0){ return null; }
+    public <T extends TreeNode> T readTree(JsonParser p0){ return null; }
+    public <T> MappingIterator<T> readValues(JsonParser p0, Class<T> p1){ return null; }
+    public <T> MappingIterator<T> readValues(JsonParser p0, JavaType p1){ return null; }
+    public <T> MappingIterator<T> readValues(JsonParser p0, ResolvedType p1){ return null; }
+    public <T> MappingIterator<T> readValues(JsonParser p0, TypeReference<? extends Object> p1){ return null; }
+    public <T> T convertValue(Object p0, Class<T> p1){ return null; }
+    public <T> T convertValue(Object p0, JavaType p1){ return null; }
+    public <T> T convertValue(Object p0, TypeReference<? extends Object> p1){ return null; }
+    public <T> T readValue(File p0, Class<T> p1){ return null; }
+    public <T> T readValue(File p0, JavaType p1){ return null; }
+    public <T> T readValue(File p0, TypeReference p1){ return null; }
+    public <T> T readValue(InputStream p0, Class<T> p1){ return null; }
+    public <T> T readValue(InputStream p0, JavaType p1){ return null; }
+    public <T> T readValue(InputStream p0, TypeReference p1){ return null; }
+    public <T> T readValue(JsonParser p0, Class<T> p1){ return null; }
+    public <T> T readValue(JsonParser p0, JavaType p1){ return null; }
+    public <T> T readValue(JsonParser p0, TypeReference<? extends Object> p1){ return null; }
+    public <T> T readValue(Reader p0, Class<T> p1){ return null; }
+    public <T> T readValue(Reader p0, JavaType p1){ return null; }
+    public <T> T readValue(Reader p0, TypeReference p1){ return null; }
+    public <T> T readValue(String p0, Class<T> p1){ return null; }
+    public <T> T readValue(String p0, JavaType p1){ return null; }
+    public <T> T readValue(String p0, TypeReference p1){ return null; }
+    public <T> T readValue(URL p0, Class<T> p1){ return null; }
+    public <T> T readValue(URL p0, JavaType p1){ return null; }
+    public <T> T readValue(URL p0, TypeReference p1){ return null; }
+    public <T> T readValue(byte[] p0, Class<T> p1){ return null; }
+    public <T> T readValue(byte[] p0, JavaType p1){ return null; }
+    public <T> T readValue(byte[] p0, TypeReference p1){ return null; }
+    public <T> T readValue(byte[] p0, int p1, int p2, Class<T> p3){ return null; }
+    public <T> T readValue(byte[] p0, int p1, int p2, JavaType p3){ return null; }
+    public <T> T readValue(byte[] p0, int p1, int p2, TypeReference p3){ return null; }
+    public <T> T treeToValue(TreeNode p0, Class<T> p1){ return null; }
+    public ArrayNode createArrayNode(){ return null; }
+    public Class<? extends Object> findMixInClassFor(Class<? extends Object> p0){ return null; }
+    public DateFormat getDateFormat(){ return null; }
+    public DeserializationConfig getDeserializationConfig(){ return null; }
+    public DeserializationContext getDeserializationContext(){ return null; }
+    public InjectableValues getInjectableValues(){ return null; }
+    public JavaType constructType(Type p0){ return null; }
+    public JsonFactory getFactory(){ return null; }
+    public JsonFactory getJsonFactory(){ return null; }
+    public JsonNode readTree(File p0){ return null; }
+    public JsonNode readTree(InputStream p0){ return null; }
+    public JsonNode readTree(Reader p0){ return null; }
+    public JsonNode readTree(String p0){ return null; }
+    public JsonNode readTree(URL p0){ return null; }
+    public JsonNode readTree(byte[] p0){ return null; }
+    public JsonNodeFactory getNodeFactory(){ return null; }
+    public JsonParser treeAsTokens(TreeNode p0){ return null; }
+    public JsonSchema generateJsonSchema(Class<? extends Object> p0){ return null; }
+    public Object setHandlerInstantiator(HandlerInstantiator p0){ return null; }
+    public ObjectMapper addHandler(DeserializationProblemHandler p0){ return null; }
+    public ObjectMapper addMixIn(Class<? extends Object> p0, Class<? extends Object> p1){ return null; }
+    public ObjectMapper clearProblemHandlers(){ return null; }
+    public ObjectMapper configure(DeserializationFeature p0, boolean p1){ return null; }
+    public ObjectMapper configure(JsonGenerator.Feature p0, boolean p1){ return null; }
+    public ObjectMapper configure(JsonParser.Feature p0, boolean p1){ return null; }
+    public ObjectMapper configure(MapperFeature p0, boolean p1){ return null; }
+    public ObjectMapper configure(SerializationFeature p0, boolean p1){ return null; }
+    public ObjectMapper copy(){ return null; }
+    public ObjectMapper disable(DeserializationFeature p0){ return null; }
+    public ObjectMapper disable(DeserializationFeature p0, DeserializationFeature... p1){ return null; }
+    public ObjectMapper disable(JsonGenerator.Feature... p0){ return null; }
+    public ObjectMapper disable(JsonParser.Feature... p0){ return null; }
+    public ObjectMapper disable(MapperFeature... p0){ return null; }
+    public ObjectMapper disable(SerializationFeature p0){ return null; }
+    public ObjectMapper disable(SerializationFeature p0, SerializationFeature... p1){ return null; }
+    public ObjectMapper disableDefaultTyping(){ return null; }
+    public ObjectMapper enable(DeserializationFeature p0){ return null; }
+    public ObjectMapper enable(DeserializationFeature p0, DeserializationFeature... p1){ return null; }
+    public ObjectMapper enable(JsonGenerator.Feature... p0){ return null; }
+    public ObjectMapper enable(JsonParser.Feature... p0){ return null; }
+    public ObjectMapper enable(MapperFeature... p0){ return null; }
+    public ObjectMapper enable(SerializationFeature p0){ return null; }
+    public ObjectMapper enable(SerializationFeature p0, SerializationFeature... p1){ return null; }
+    public ObjectMapper enableDefaultTyping(){ return null; }
+    public ObjectMapper enableDefaultTyping(ObjectMapper.DefaultTyping p0){ return null; }
+    public ObjectMapper enableDefaultTyping(ObjectMapper.DefaultTyping p0, JsonTypeInfo.As p1){ return null; }
+    public ObjectMapper enableDefaultTypingAsProperty(ObjectMapper.DefaultTyping p0, String p1){ return null; }
+    public ObjectMapper findAndRegisterModules(){ return null; }
+    public ObjectMapper registerModule(Module p0){ return null; }
+    public ObjectMapper registerModules(Iterable<Module> p0){ return null; }
+    public ObjectMapper registerModules(Module... p0){ return null; }
+    public ObjectMapper setAnnotationIntrospector(AnnotationIntrospector p0){ return null; }
+    public ObjectMapper setAnnotationIntrospectors(AnnotationIntrospector p0, AnnotationIntrospector p1){ return null; }
+    public ObjectMapper setBase64Variant(Base64Variant p0){ return null; }
+    public ObjectMapper setConfig(DeserializationConfig p0){ return null; }
+    public ObjectMapper setConfig(SerializationConfig p0){ return null; }
+    public ObjectMapper setDateFormat(DateFormat p0){ return null; }
+    public ObjectMapper setDefaultPrettyPrinter(PrettyPrinter p0){ return null; }
+    public ObjectMapper setDefaultTyping(TypeResolverBuilder<? extends Object> p0){ return null; }
+    public ObjectMapper setFilterProvider(FilterProvider p0){ return null; }
+    public ObjectMapper setInjectableValues(InjectableValues p0){ return null; }
+    public ObjectMapper setLocale(Locale p0){ return null; }
+    public ObjectMapper setMixInResolver(ClassIntrospector.MixInResolver p0){ return null; }
+    public ObjectMapper setMixIns(Map<Class<? extends Object>, Class<? extends Object>> p0){ return null; }
+    public ObjectMapper setNodeFactory(JsonNodeFactory p0){ return null; }
+    public ObjectMapper setPropertyInclusion(JsonInclude.Value p0){ return null; }
+    public ObjectMapper setPropertyNamingStrategy(PropertyNamingStrategy p0){ return null; }
+    public ObjectMapper setSerializationInclusion(JsonInclude.Include p0){ return null; }
+    public ObjectMapper setSerializerFactory(SerializerFactory p0){ return null; }
+    public ObjectMapper setSerializerProvider(DefaultSerializerProvider p0){ return null; }
+    public ObjectMapper setSubtypeResolver(SubtypeResolver p0){ return null; }
+    public ObjectMapper setTimeZone(TimeZone p0){ return null; }
+    public ObjectMapper setTypeFactory(TypeFactory p0){ return null; }
+    public ObjectMapper setVisibility(PropertyAccessor p0, JsonAutoDetect.Visibility p1){ return null; }
+    public ObjectMapper setVisibility(VisibilityChecker<? extends Object> p0){ return null; }
+    public ObjectMapper(){}
+    public ObjectMapper(JsonFactory p0){}
+    public ObjectMapper(JsonFactory p0, DefaultSerializerProvider p1, DefaultDeserializationContext p2){}
+    public ObjectNode createObjectNode(){ return null; }
+    public ObjectReader reader(){ return null; }
+    public ObjectReader reader(Base64Variant p0){ return null; }
+    public ObjectReader reader(Class<? extends Object> p0){ return null; }
+    public ObjectReader reader(ContextAttributes p0){ return null; }
+    public ObjectReader reader(DeserializationFeature p0){ return null; }
+    public ObjectReader reader(DeserializationFeature p0, DeserializationFeature... p1){ return null; }
+    public ObjectReader reader(FormatSchema p0){ return null; }
+    public ObjectReader reader(InjectableValues p0){ return null; }
+    public ObjectReader reader(JavaType p0){ return null; }
+    public ObjectReader reader(JsonNodeFactory p0){ return null; }
+    public ObjectReader reader(TypeReference<? extends Object> p0){ return null; }
+    public ObjectReader readerFor(Class<? extends Object> p0){ return null; }
+    public ObjectReader readerFor(JavaType p0){ return null; }
+    public ObjectReader readerFor(TypeReference<? extends Object> p0){ return null; }
+    public ObjectReader readerForUpdating(Object p0){ return null; }
+    public ObjectReader readerWithView(Class<? extends Object> p0){ return null; }
+    public ObjectWriter writer(){ return null; }
+    public ObjectWriter writer(Base64Variant p0){ return null; }
+    public ObjectWriter writer(CharacterEscapes p0){ return null; }
+    public ObjectWriter writer(ContextAttributes p0){ return null; }
+    public ObjectWriter writer(DateFormat p0){ return null; }
+    public ObjectWriter writer(FilterProvider p0){ return null; }
+    public ObjectWriter writer(FormatSchema p0){ return null; }
+    public ObjectWriter writer(PrettyPrinter p0){ return null; }
+    public ObjectWriter writer(SerializationFeature p0){ return null; }
+    public ObjectWriter writer(SerializationFeature p0, SerializationFeature... p1){ return null; }
+    public ObjectWriter writerFor(Class<? extends Object> p0){ return null; }
+    public ObjectWriter writerFor(JavaType p0){ return null; }
+    public ObjectWriter writerFor(TypeReference<? extends Object> p0){ return null; }
+    public ObjectWriter writerWithDefaultPrettyPrinter(){ return null; }
+    public ObjectWriter writerWithType(Class<? extends Object> p0){ return null; }
+    public ObjectWriter writerWithType(JavaType p0){ return null; }
+    public ObjectWriter writerWithType(TypeReference<? extends Object> p0){ return null; }
+    public ObjectWriter writerWithView(Class<? extends Object> p0){ return null; }
+    public PropertyNamingStrategy getPropertyNamingStrategy(){ return null; }
+    public SerializationConfig getSerializationConfig(){ return null; }
+    public SerializerFactory getSerializerFactory(){ return null; }
+    public SerializerProvider getSerializerProvider(){ return null; }
+    public SerializerProvider getSerializerProviderInstance(){ return null; }
+    public String writeValueAsString(Object p0){ return null; }
+    public SubtypeResolver getSubtypeResolver(){ return null; }
+    public TypeFactory getTypeFactory(){ return null; }
+    public Version version(){ return null; }
+    public VisibilityChecker<? extends Object> getVisibilityChecker(){ return null; }
+    public boolean canDeserialize(JavaType p0){ return false; }
+    public boolean canDeserialize(JavaType p0, AtomicReference<Throwable> p1){ return false; }
+    public boolean canSerialize(Class<? extends Object> p0){ return false; }
+    public boolean canSerialize(Class<? extends Object> p0, AtomicReference<Throwable> p1){ return false; }
+    public boolean isEnabled(DeserializationFeature p0){ return false; }
+    public boolean isEnabled(JsonFactory.Feature p0){ return false; }
+    public boolean isEnabled(JsonGenerator.Feature p0){ return false; }
+    public boolean isEnabled(JsonParser.Feature p0){ return false; }
+    public boolean isEnabled(MapperFeature p0){ return false; }
+    public boolean isEnabled(SerializationFeature p0){ return false; }
+    public byte[] writeValueAsBytes(Object p0){ return null; }
+    public final <T> T readValue(JsonParser p0, ResolvedType p1){ return null; }
+    public final void addMixInAnnotations(Class<? extends Object> p0, Class<? extends Object> p1){}
+    public int mixInCount(){ return 0; }
+    public static List<Module> findModules(){ return null; }
+    public static List<Module> findModules(ClassLoader p0){ return null; }
+    public void acceptJsonFormatVisitor(Class<? extends Object> p0, JsonFormatVisitorWrapper p1){}
+    public void acceptJsonFormatVisitor(JavaType p0, JsonFormatVisitorWrapper p1){}
+    public void registerSubtypes(Class<? extends Object>... p0){}
+    public void registerSubtypes(NamedType... p0){}
+    public void setFilters(FilterProvider p0){}
+    public void setMixInAnnotations(Map<Class<? extends Object>, Class<? extends Object>> p0){}
+    public void setVisibilityChecker(VisibilityChecker<? extends Object> p0){}
+    public void writeTree(JsonGenerator p0, JsonNode p1){}
+    public void writeTree(JsonGenerator p0, TreeNode p1){}
+    public void writeValue(File p0, Object p1){}
+    public void writeValue(JsonGenerator p0, Object p1){}
+    public void writeValue(OutputStream p0, Object p1){}
+    public void writeValue(Writer p0, Object p1){}
+    static public enum DefaultTyping
+    {
+        JAVA_LANG_OBJECT, NON_CONCRETE_AND_ARRAYS, NON_FINAL, OBJECT_AND_NON_CONCRETE;
+        private DefaultTyping() {}
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ObjectReader.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ObjectReader.java
new file mode 100644
index 00000000000..6b757cf044f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ObjectReader.java
@@ -0,0 +1,183 @@
+// Generated automatically from com.fasterxml.jackson.databind.ObjectReader for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.core.FormatFeature;
+import com.fasterxml.jackson.core.FormatSchema;
+import com.fasterxml.jackson.core.JsonFactory;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonPointer;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.core.ObjectCodec;
+import com.fasterxml.jackson.core.TreeNode;
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.core.Versioned;
+import com.fasterxml.jackson.core.filter.TokenFilter;
+import com.fasterxml.jackson.core.type.ResolvedType;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.InjectableValues;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.MappingIterator;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.cfg.ContextAttributes;
+import com.fasterxml.jackson.databind.deser.DataFormatReaders;
+import com.fasterxml.jackson.databind.deser.DefaultDeserializationContext;
+import com.fasterxml.jackson.databind.deser.DeserializationProblemHandler;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import java.io.File;
+import java.io.InputStream;
+import java.io.Reader;
+import java.io.Serializable;
+import java.lang.reflect.Type;
+import java.net.URL;
+import java.util.Iterator;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TimeZone;
+import java.util.concurrent.ConcurrentHashMap;
+
+public class ObjectReader extends ObjectCodec implements Serializable, Versioned
+{
+    protected ObjectReader() {}
+    protected <T> MappingIterator<T> _bindAndReadValues(JsonParser p0){ return null; }
+    protected <T> MappingIterator<T> _detectBindAndReadValues(DataFormatReaders.Match p0, boolean p1){ return null; }
+    protected <T> MappingIterator<T> _newIterator(JsonParser p0, DeserializationContext p1, JsonDeserializer<? extends Object> p2, boolean p3){ return null; }
+    protected DefaultDeserializationContext createDeserializationContext(JsonParser p0){ return null; }
+    protected InputStream _inputStream(File p0){ return null; }
+    protected InputStream _inputStream(URL p0){ return null; }
+    protected JsonDeserializer<Object> _findRootDeserializer(DeserializationContext p0){ return null; }
+    protected JsonDeserializer<Object> _findTreeDeserializer(DeserializationContext p0){ return null; }
+    protected JsonDeserializer<Object> _prefetchRootDeserializer(JavaType p0){ return null; }
+    protected JsonNode _bindAndCloseAsTree(JsonParser p0){ return null; }
+    protected JsonNode _bindAsTree(JsonParser p0){ return null; }
+    protected JsonNode _detectBindAndCloseAsTree(InputStream p0){ return null; }
+    protected JsonParser _considerFilter(JsonParser p0, boolean p1){ return null; }
+    protected JsonToken _initForReading(JsonParser p0){ return null; }
+    protected Object _bind(JsonParser p0, Object p1){ return null; }
+    protected Object _bindAndClose(JsonParser p0){ return null; }
+    protected Object _detectBindAndClose(DataFormatReaders.Match p0, boolean p1){ return null; }
+    protected Object _detectBindAndClose(byte[] p0, int p1, int p2){ return null; }
+    protected Object _unwrapAndDeserialize(JsonParser p0, DeserializationContext p1, JavaType p2, JsonDeserializer<Object> p3){ return null; }
+    protected ObjectReader _new(ObjectReader p0, DeserializationConfig p1){ return null; }
+    protected ObjectReader _new(ObjectReader p0, DeserializationConfig p1, JavaType p2, JsonDeserializer<Object> p3, Object p4, FormatSchema p5, InjectableValues p6, DataFormatReaders p7){ return null; }
+    protected ObjectReader _new(ObjectReader p0, JsonFactory p1){ return null; }
+    protected ObjectReader _with(DeserializationConfig p0){ return null; }
+    protected ObjectReader(ObjectMapper p0, DeserializationConfig p1){}
+    protected ObjectReader(ObjectMapper p0, DeserializationConfig p1, JavaType p2, Object p3, FormatSchema p4, InjectableValues p5){}
+    protected ObjectReader(ObjectReader p0, DeserializationConfig p1){}
+    protected ObjectReader(ObjectReader p0, DeserializationConfig p1, JavaType p2, JsonDeserializer<Object> p3, Object p4, FormatSchema p5, InjectableValues p6, DataFormatReaders p7){}
+    protected ObjectReader(ObjectReader p0, JsonFactory p1){}
+    protected ObjectReader(ObjectReader p0, TokenFilter p1){}
+    protected final ConcurrentHashMap<JavaType, JsonDeserializer<Object>> _rootDeserializers = null;
+    protected final DataFormatReaders _dataFormatReaders = null;
+    protected final DefaultDeserializationContext _context = null;
+    protected final DeserializationConfig _config = null;
+    protected final FormatSchema _schema = null;
+    protected final InjectableValues _injectableValues = null;
+    protected final JavaType _valueType = null;
+    protected final JsonDeserializer<Object> _rootDeserializer = null;
+    protected final JsonFactory _parserFactory = null;
+    protected final Object _valueToUpdate = null;
+    protected final boolean _unwrapRoot = false;
+    protected void _initForMultiRead(JsonParser p0){}
+    protected void _reportUndetectableSource(Object p0){}
+    protected void _reportUnkownFormat(DataFormatReaders p0, DataFormatReaders.Match p1){}
+    protected void _verifySchemaType(FormatSchema p0){}
+    public <T extends TreeNode> T readTree(JsonParser p0){ return null; }
+    public <T> Iterator<T> readValues(JsonParser p0, Class<T> p1){ return null; }
+    public <T> Iterator<T> readValues(JsonParser p0, JavaType p1){ return null; }
+    public <T> Iterator<T> readValues(JsonParser p0, ResolvedType p1){ return null; }
+    public <T> Iterator<T> readValues(JsonParser p0, TypeReference<? extends Object> p1){ return null; }
+    public <T> MappingIterator<T> readValues(File p0){ return null; }
+    public <T> MappingIterator<T> readValues(InputStream p0){ return null; }
+    public <T> MappingIterator<T> readValues(JsonParser p0){ return null; }
+    public <T> MappingIterator<T> readValues(Reader p0){ return null; }
+    public <T> MappingIterator<T> readValues(String p0){ return null; }
+    public <T> MappingIterator<T> readValues(URL p0){ return null; }
+    public <T> MappingIterator<T> readValues(byte[] p0, int p1, int p2){ return null; }
+    public <T> T readValue(File p0){ return null; }
+    public <T> T readValue(InputStream p0){ return null; }
+    public <T> T readValue(JsonNode p0){ return null; }
+    public <T> T readValue(JsonParser p0){ return null; }
+    public <T> T readValue(JsonParser p0, Class<T> p1){ return null; }
+    public <T> T readValue(JsonParser p0, JavaType p1){ return null; }
+    public <T> T readValue(JsonParser p0, ResolvedType p1){ return null; }
+    public <T> T readValue(JsonParser p0, TypeReference<? extends Object> p1){ return null; }
+    public <T> T readValue(Reader p0){ return null; }
+    public <T> T readValue(String p0){ return null; }
+    public <T> T readValue(URL p0){ return null; }
+    public <T> T readValue(byte[] p0){ return null; }
+    public <T> T readValue(byte[] p0, int p1, int p2){ return null; }
+    public <T> T treeToValue(TreeNode p0, Class<T> p1){ return null; }
+    public ContextAttributes getAttributes(){ return null; }
+    public DeserializationConfig getConfig(){ return null; }
+    public InjectableValues getInjectableValues(){ return null; }
+    public JsonFactory getFactory(){ return null; }
+    public JsonNode createArrayNode(){ return null; }
+    public JsonNode createObjectNode(){ return null; }
+    public JsonNode readTree(InputStream p0){ return null; }
+    public JsonNode readTree(Reader p0){ return null; }
+    public JsonNode readTree(String p0){ return null; }
+    public JsonParser treeAsTokens(TreeNode p0){ return null; }
+    public ObjectReader at(JsonPointer p0){ return null; }
+    public ObjectReader at(String p0){ return null; }
+    public ObjectReader forType(Class<? extends Object> p0){ return null; }
+    public ObjectReader forType(JavaType p0){ return null; }
+    public ObjectReader forType(TypeReference<? extends Object> p0){ return null; }
+    public ObjectReader with(Base64Variant p0){ return null; }
+    public ObjectReader with(ContextAttributes p0){ return null; }
+    public ObjectReader with(DeserializationConfig p0){ return null; }
+    public ObjectReader with(DeserializationFeature p0){ return null; }
+    public ObjectReader with(DeserializationFeature p0, DeserializationFeature... p1){ return null; }
+    public ObjectReader with(FormatFeature p0){ return null; }
+    public ObjectReader with(FormatSchema p0){ return null; }
+    public ObjectReader with(InjectableValues p0){ return null; }
+    public ObjectReader with(JsonFactory p0){ return null; }
+    public ObjectReader with(JsonNodeFactory p0){ return null; }
+    public ObjectReader with(JsonParser.Feature p0){ return null; }
+    public ObjectReader with(Locale p0){ return null; }
+    public ObjectReader with(TimeZone p0){ return null; }
+    public ObjectReader withAttribute(Object p0, Object p1){ return null; }
+    public ObjectReader withAttributes(Map<? extends Object, ? extends Object> p0){ return null; }
+    public ObjectReader withFeatures(DeserializationFeature... p0){ return null; }
+    public ObjectReader withFeatures(FormatFeature... p0){ return null; }
+    public ObjectReader withFeatures(JsonParser.Feature... p0){ return null; }
+    public ObjectReader withFormatDetection(DataFormatReaders p0){ return null; }
+    public ObjectReader withFormatDetection(ObjectReader... p0){ return null; }
+    public ObjectReader withHandler(DeserializationProblemHandler p0){ return null; }
+    public ObjectReader withRootName(PropertyName p0){ return null; }
+    public ObjectReader withRootName(String p0){ return null; }
+    public ObjectReader withType(Class<? extends Object> p0){ return null; }
+    public ObjectReader withType(JavaType p0){ return null; }
+    public ObjectReader withType(Type p0){ return null; }
+    public ObjectReader withType(TypeReference<? extends Object> p0){ return null; }
+    public ObjectReader withValueToUpdate(Object p0){ return null; }
+    public ObjectReader withView(Class<? extends Object> p0){ return null; }
+    public ObjectReader without(DeserializationFeature p0){ return null; }
+    public ObjectReader without(DeserializationFeature p0, DeserializationFeature... p1){ return null; }
+    public ObjectReader without(FormatFeature p0){ return null; }
+    public ObjectReader without(JsonParser.Feature p0){ return null; }
+    public ObjectReader withoutAttribute(Object p0){ return null; }
+    public ObjectReader withoutFeatures(DeserializationFeature... p0){ return null; }
+    public ObjectReader withoutFeatures(FormatFeature... p0){ return null; }
+    public ObjectReader withoutFeatures(JsonParser.Feature... p0){ return null; }
+    public ObjectReader withoutRootName(){ return null; }
+    public TypeFactory getTypeFactory(){ return null; }
+    public Version version(){ return null; }
+    public boolean isEnabled(DeserializationFeature p0){ return false; }
+    public boolean isEnabled(JsonParser.Feature p0){ return false; }
+    public boolean isEnabled(MapperFeature p0){ return false; }
+    public final <T> MappingIterator<T> readValues(byte[] p0){ return null; }
+    public void writeTree(JsonGenerator p0, TreeNode p1){}
+    public void writeValue(JsonGenerator p0, Object p1){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ObjectWriter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ObjectWriter.java
new file mode 100644
index 00000000000..aa7f0c7f9de
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ObjectWriter.java
@@ -0,0 +1,160 @@
+// Generated automatically from com.fasterxml.jackson.databind.ObjectWriter for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.core.FormatFeature;
+import com.fasterxml.jackson.core.FormatSchema;
+import com.fasterxml.jackson.core.JsonFactory;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.PrettyPrinter;
+import com.fasterxml.jackson.core.SerializableString;
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.core.Versioned;
+import com.fasterxml.jackson.core.io.CharacterEscapes;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.SequenceWriter;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.databind.cfg.ContextAttributes;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.ser.DefaultSerializerProvider;
+import com.fasterxml.jackson.databind.ser.FilterProvider;
+import com.fasterxml.jackson.databind.ser.SerializerFactory;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import java.io.File;
+import java.io.OutputStream;
+import java.io.Serializable;
+import java.io.Writer;
+import java.text.DateFormat;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TimeZone;
+import java.util.concurrent.atomic.AtomicReference;
+
+public class ObjectWriter implements Serializable, Versioned
+{
+    protected ObjectWriter() {}
+    protected DefaultSerializerProvider _serializerProvider(){ return null; }
+    protected ObjectWriter _new(ObjectWriter p0, JsonFactory p1){ return null; }
+    protected ObjectWriter _new(ObjectWriter p0, SerializationConfig p1){ return null; }
+    protected ObjectWriter _new(ObjectWriter.GeneratorSettings p0, ObjectWriter.Prefetch p1){ return null; }
+    protected ObjectWriter(ObjectMapper p0, SerializationConfig p1){}
+    protected ObjectWriter(ObjectMapper p0, SerializationConfig p1, FormatSchema p2){}
+    protected ObjectWriter(ObjectMapper p0, SerializationConfig p1, JavaType p2, PrettyPrinter p3){}
+    protected ObjectWriter(ObjectWriter p0, JsonFactory p1){}
+    protected ObjectWriter(ObjectWriter p0, SerializationConfig p1){}
+    protected ObjectWriter(ObjectWriter p0, SerializationConfig p1, ObjectWriter.GeneratorSettings p2, ObjectWriter.Prefetch p3){}
+    protected SequenceWriter _newSequenceWriter(boolean p0, JsonGenerator p1, boolean p2){ return null; }
+    protected final DefaultSerializerProvider _serializerProvider = null;
+    protected final JsonFactory _generatorFactory = null;
+    protected final ObjectWriter.GeneratorSettings _generatorSettings = null;
+    protected final ObjectWriter.Prefetch _prefetch = null;
+    protected final SerializationConfig _config = null;
+    protected final SerializerFactory _serializerFactory = null;
+    protected final void _configAndWriteValue(JsonGenerator p0, Object p1){}
+    protected final void _configureGenerator(JsonGenerator p0){}
+    protected static PrettyPrinter NULL_PRETTY_PRINTER = null;
+    protected void _verifySchemaType(FormatSchema p0){}
+    public ContextAttributes getAttributes(){ return null; }
+    public JsonFactory getFactory(){ return null; }
+    public ObjectWriter forType(Class<? extends Object> p0){ return null; }
+    public ObjectWriter forType(JavaType p0){ return null; }
+    public ObjectWriter forType(TypeReference<? extends Object> p0){ return null; }
+    public ObjectWriter with(Base64Variant p0){ return null; }
+    public ObjectWriter with(CharacterEscapes p0){ return null; }
+    public ObjectWriter with(ContextAttributes p0){ return null; }
+    public ObjectWriter with(DateFormat p0){ return null; }
+    public ObjectWriter with(FilterProvider p0){ return null; }
+    public ObjectWriter with(FormatFeature p0){ return null; }
+    public ObjectWriter with(FormatSchema p0){ return null; }
+    public ObjectWriter with(JsonFactory p0){ return null; }
+    public ObjectWriter with(JsonGenerator.Feature p0){ return null; }
+    public ObjectWriter with(Locale p0){ return null; }
+    public ObjectWriter with(PrettyPrinter p0){ return null; }
+    public ObjectWriter with(SerializationFeature p0){ return null; }
+    public ObjectWriter with(SerializationFeature p0, SerializationFeature... p1){ return null; }
+    public ObjectWriter with(TimeZone p0){ return null; }
+    public ObjectWriter withAttribute(Object p0, Object p1){ return null; }
+    public ObjectWriter withAttributes(Map<? extends Object, ? extends Object> p0){ return null; }
+    public ObjectWriter withDefaultPrettyPrinter(){ return null; }
+    public ObjectWriter withFeatures(FormatFeature... p0){ return null; }
+    public ObjectWriter withFeatures(JsonGenerator.Feature... p0){ return null; }
+    public ObjectWriter withFeatures(SerializationFeature... p0){ return null; }
+    public ObjectWriter withRootName(PropertyName p0){ return null; }
+    public ObjectWriter withRootName(String p0){ return null; }
+    public ObjectWriter withRootValueSeparator(SerializableString p0){ return null; }
+    public ObjectWriter withRootValueSeparator(String p0){ return null; }
+    public ObjectWriter withSchema(FormatSchema p0){ return null; }
+    public ObjectWriter withType(Class<? extends Object> p0){ return null; }
+    public ObjectWriter withType(JavaType p0){ return null; }
+    public ObjectWriter withType(TypeReference<? extends Object> p0){ return null; }
+    public ObjectWriter withView(Class<? extends Object> p0){ return null; }
+    public ObjectWriter without(FormatFeature p0){ return null; }
+    public ObjectWriter without(JsonGenerator.Feature p0){ return null; }
+    public ObjectWriter without(SerializationFeature p0){ return null; }
+    public ObjectWriter without(SerializationFeature p0, SerializationFeature... p1){ return null; }
+    public ObjectWriter withoutAttribute(Object p0){ return null; }
+    public ObjectWriter withoutFeatures(FormatFeature... p0){ return null; }
+    public ObjectWriter withoutFeatures(JsonGenerator.Feature... p0){ return null; }
+    public ObjectWriter withoutFeatures(SerializationFeature... p0){ return null; }
+    public ObjectWriter withoutRootName(){ return null; }
+    public SequenceWriter writeValues(File p0){ return null; }
+    public SequenceWriter writeValues(JsonGenerator p0){ return null; }
+    public SequenceWriter writeValues(OutputStream p0){ return null; }
+    public SequenceWriter writeValues(Writer p0){ return null; }
+    public SequenceWriter writeValuesAsArray(File p0){ return null; }
+    public SequenceWriter writeValuesAsArray(JsonGenerator p0){ return null; }
+    public SequenceWriter writeValuesAsArray(OutputStream p0){ return null; }
+    public SequenceWriter writeValuesAsArray(Writer p0){ return null; }
+    public SerializationConfig getConfig(){ return null; }
+    public String writeValueAsString(Object p0){ return null; }
+    public TypeFactory getTypeFactory(){ return null; }
+    public Version version(){ return null; }
+    public boolean canSerialize(Class<? extends Object> p0){ return false; }
+    public boolean canSerialize(Class<? extends Object> p0, AtomicReference<Throwable> p1){ return false; }
+    public boolean hasPrefetchedSerializer(){ return false; }
+    public boolean isEnabled(JsonParser.Feature p0){ return false; }
+    public boolean isEnabled(MapperFeature p0){ return false; }
+    public boolean isEnabled(SerializationFeature p0){ return false; }
+    public byte[] writeValueAsBytes(Object p0){ return null; }
+    public void acceptJsonFormatVisitor(Class<? extends Object> p0, JsonFormatVisitorWrapper p1){}
+    public void acceptJsonFormatVisitor(JavaType p0, JsonFormatVisitorWrapper p1){}
+    public void writeValue(File p0, Object p1){}
+    public void writeValue(JsonGenerator p0, Object p1){}
+    public void writeValue(OutputStream p0, Object p1){}
+    public void writeValue(Writer p0, Object p1){}
+    static public class GeneratorSettings implements Serializable
+    {
+        protected GeneratorSettings() {}
+        public GeneratorSettings(PrettyPrinter p0, FormatSchema p1, CharacterEscapes p2, SerializableString p3){}
+        public ObjectWriter.GeneratorSettings with(CharacterEscapes p0){ return null; }
+        public ObjectWriter.GeneratorSettings with(FormatSchema p0){ return null; }
+        public ObjectWriter.GeneratorSettings with(PrettyPrinter p0){ return null; }
+        public ObjectWriter.GeneratorSettings withRootValueSeparator(SerializableString p0){ return null; }
+        public ObjectWriter.GeneratorSettings withRootValueSeparator(String p0){ return null; }
+        public final CharacterEscapes characterEscapes = null;
+        public final FormatSchema schema = null;
+        public final PrettyPrinter prettyPrinter = null;
+        public final SerializableString rootValueSeparator = null;
+        public static ObjectWriter.GeneratorSettings empty = null;
+        public void initialize(JsonGenerator p0){}
+    }
+    static public class Prefetch implements Serializable
+    {
+        protected Prefetch() {}
+        public ObjectWriter.Prefetch forRootType(ObjectWriter p0, JavaType p1){ return null; }
+        public boolean hasSerializer(){ return false; }
+        public final JsonSerializer<Object> getValueSerializer(){ return null; }
+        public final TypeSerializer getTypeSerializer(){ return null; }
+        public static ObjectWriter.Prefetch empty = null;
+        public void serialize(JsonGenerator p0, Object p1, DefaultSerializerProvider p2){}
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/PropertyMetadata.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/PropertyMetadata.java
new file mode 100644
index 00000000000..3bb9ffb4fb9
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/PropertyMetadata.java
@@ -0,0 +1,34 @@
+// Generated automatically from com.fasterxml.jackson.databind.PropertyMetadata for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import java.io.Serializable;
+
+public class PropertyMetadata implements Serializable
+{
+    protected PropertyMetadata() {}
+    protected Object readResolve(){ return null; }
+    protected PropertyMetadata(Boolean p0, String p1){}
+    protected PropertyMetadata(Boolean p0, String p1, Integer p2, String p3){}
+    protected final Boolean _required = null;
+    protected final Integer _index = null;
+    protected final String _defaultValue = null;
+    protected final String _description = null;
+    public Boolean getRequired(){ return null; }
+    public Integer getIndex(){ return null; }
+    public PropertyMetadata withDefaultValue(String p0){ return null; }
+    public PropertyMetadata withDescription(String p0){ return null; }
+    public PropertyMetadata withIndex(Integer p0){ return null; }
+    public PropertyMetadata withRequired(Boolean p0){ return null; }
+    public String getDefaultValue(){ return null; }
+    public String getDescription(){ return null; }
+    public boolean hasDefaultValue(){ return false; }
+    public boolean hasDefuaultValue(){ return false; }
+    public boolean hasIndex(){ return false; }
+    public boolean isRequired(){ return false; }
+    public static PropertyMetadata STD_OPTIONAL = null;
+    public static PropertyMetadata STD_REQUIRED = null;
+    public static PropertyMetadata STD_REQUIRED_OR_OPTIONAL = null;
+    public static PropertyMetadata construct(boolean p0, String p1){ return null; }
+    public static PropertyMetadata construct(boolean p0, String p1, Integer p2, String p3){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/PropertyName.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/PropertyName.java
new file mode 100644
index 00000000000..29acfdf291a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/PropertyName.java
@@ -0,0 +1,35 @@
+// Generated automatically from com.fasterxml.jackson.databind.PropertyName for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.SerializableString;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import java.io.Serializable;
+
+public class PropertyName implements Serializable
+{
+    protected PropertyName() {}
+    protected Object readResolve(){ return null; }
+    protected SerializableString _encodedSimple = null;
+    protected final String _namespace = null;
+    protected final String _simpleName = null;
+    public PropertyName internSimpleName(){ return null; }
+    public PropertyName withNamespace(String p0){ return null; }
+    public PropertyName withSimpleName(String p0){ return null; }
+    public PropertyName(String p0){}
+    public PropertyName(String p0, String p1){}
+    public SerializableString simpleAsEncoded(MapperConfig<? extends Object> p0){ return null; }
+    public String getNamespace(){ return null; }
+    public String getSimpleName(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean hasNamespace(){ return false; }
+    public boolean hasSimpleName(){ return false; }
+    public boolean hasSimpleName(String p0){ return false; }
+    public boolean isEmpty(){ return false; }
+    public int hashCode(){ return 0; }
+    public static PropertyName NO_NAME = null;
+    public static PropertyName USE_DEFAULT = null;
+    public static PropertyName construct(String p0){ return null; }
+    public static PropertyName construct(String p0, String p1){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/PropertyNamingStrategy.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/PropertyNamingStrategy.java
new file mode 100644
index 00000000000..29640d6dc0c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/PropertyNamingStrategy.java
@@ -0,0 +1,25 @@
+// Generated automatically from com.fasterxml.jackson.databind.PropertyNamingStrategy for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.introspect.AnnotatedField;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMethod;
+import com.fasterxml.jackson.databind.introspect.AnnotatedParameter;
+import java.io.Serializable;
+
+public class PropertyNamingStrategy implements Serializable
+{
+    public PropertyNamingStrategy(){}
+    public String nameForConstructorParameter(MapperConfig<? extends Object> p0, AnnotatedParameter p1, String p2){ return null; }
+    public String nameForField(MapperConfig<? extends Object> p0, AnnotatedField p1, String p2){ return null; }
+    public String nameForGetterMethod(MapperConfig<? extends Object> p0, AnnotatedMethod p1, String p2){ return null; }
+    public String nameForSetterMethod(MapperConfig<? extends Object> p0, AnnotatedMethod p1, String p2){ return null; }
+    public static PropertyNamingStrategy CAMEL_CASE_TO_LOWER_CASE_WITH_UNDERSCORES = null;
+    public static PropertyNamingStrategy KEBAB_CASE = null;
+    public static PropertyNamingStrategy LOWER_CAMEL_CASE = null;
+    public static PropertyNamingStrategy LOWER_CASE = null;
+    public static PropertyNamingStrategy PASCAL_CASE_TO_CAMEL_CASE = null;
+    public static PropertyNamingStrategy SNAKE_CASE = null;
+    public static PropertyNamingStrategy UPPER_CAMEL_CASE = null;
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SequenceWriter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SequenceWriter.java
new file mode 100644
index 00000000000..0bc78b311e8
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SequenceWriter.java
@@ -0,0 +1,45 @@
+// Generated automatically from com.fasterxml.jackson.databind.SequenceWriter for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.Version;
+import com.fasterxml.jackson.core.Versioned;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.ObjectWriter;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.ser.DefaultSerializerProvider;
+import com.fasterxml.jackson.databind.ser.impl.PropertySerializerMap;
+import java.io.Closeable;
+import java.io.Flushable;
+import java.util.Collection;
+
+public class SequenceWriter implements Closeable, Flushable, Versioned
+{
+    protected SequenceWriter() {}
+    protected PropertySerializerMap _dynamicSerializers = null;
+    protected SequenceWriter _writeCloseableValue(Object p0){ return null; }
+    protected SequenceWriter _writeCloseableValue(Object p0, JavaType p1){ return null; }
+    protected boolean _closed = false;
+    protected boolean _openArray = false;
+    protected final DefaultSerializerProvider _provider = null;
+    protected final JsonGenerator _generator = null;
+    protected final JsonSerializer<Object> _rootSerializer = null;
+    protected final SerializationConfig _config = null;
+    protected final TypeSerializer _typeSerializer = null;
+    protected final boolean _cfgCloseCloseable = false;
+    protected final boolean _cfgFlush = false;
+    protected final boolean _closeGenerator = false;
+    public <C extends Collection<? extends Object>> SequenceWriter writeAll(C p0){ return null; }
+    public SequenceWriter init(boolean p0){ return null; }
+    public SequenceWriter write(Object p0){ return null; }
+    public SequenceWriter write(Object p0, JavaType p1){ return null; }
+    public SequenceWriter writeAll(Iterable<? extends Object> p0){ return null; }
+    public SequenceWriter writeAll(Object[] p0){ return null; }
+    public SequenceWriter(DefaultSerializerProvider p0, JsonGenerator p1, boolean p2, ObjectWriter.Prefetch p3){}
+    public Version version(){ return null; }
+    public void close(){}
+    public void flush(){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SerializationConfig.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SerializationConfig.java
new file mode 100644
index 00000000000..3d415c25265
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SerializationConfig.java
@@ -0,0 +1,115 @@
+// Generated automatically from com.fasterxml.jackson.databind.SerializationConfig for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.PropertyAccessor;
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.core.FormatFeature;
+import com.fasterxml.jackson.core.JsonFactory;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.PrettyPrinter;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.databind.cfg.BaseSettings;
+import com.fasterxml.jackson.databind.cfg.ConfigFeature;
+import com.fasterxml.jackson.databind.cfg.ContextAttributes;
+import com.fasterxml.jackson.databind.cfg.HandlerInstantiator;
+import com.fasterxml.jackson.databind.cfg.MapperConfigBase;
+import com.fasterxml.jackson.databind.introspect.ClassIntrospector;
+import com.fasterxml.jackson.databind.introspect.SimpleMixInResolver;
+import com.fasterxml.jackson.databind.introspect.VisibilityChecker;
+import com.fasterxml.jackson.databind.jsontype.SubtypeResolver;
+import com.fasterxml.jackson.databind.jsontype.TypeResolverBuilder;
+import com.fasterxml.jackson.databind.ser.FilterProvider;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import com.fasterxml.jackson.databind.util.RootNameLookup;
+import java.io.Serializable;
+import java.text.DateFormat;
+import java.util.Locale;
+import java.util.TimeZone;
+
+public class SerializationConfig extends MapperConfigBase<SerializationFeature, SerializationConfig> implements Serializable
+{
+    protected SerializationConfig() {}
+    protected SerializationConfig(SerializationConfig p0, ContextAttributes p1){}
+    protected SerializationConfig(SerializationConfig p0, PrettyPrinter p1){}
+    protected SerializationConfig(SerializationConfig p0, SimpleMixInResolver p1){}
+    protected SerializationConfig(SerializationConfig p0, SimpleMixInResolver p1, RootNameLookup p2){}
+    protected final FilterProvider _filterProvider = null;
+    protected final JsonInclude.Value _serializationInclusion = null;
+    protected final PrettyPrinter _defaultPrettyPrinter = null;
+    protected final int _formatWriteFeatures = 0;
+    protected final int _formatWriteFeaturesToChange = 0;
+    protected final int _generatorFeatures = 0;
+    protected final int _generatorFeaturesToChange = 0;
+    protected final int _serFeatures = 0;
+    protected static JsonInclude.Value DEFAULT_INCLUSION = null;
+    protected static PrettyPrinter DEFAULT_PRETTY_PRINTER = null;
+    public <T extends BeanDescription> T introspect(JavaType p0){ return null; }
+    public AnnotationIntrospector getAnnotationIntrospector(){ return null; }
+    public BeanDescription introspectClassAnnotations(JavaType p0){ return null; }
+    public BeanDescription introspectDirectClassAnnotations(JavaType p0){ return null; }
+    public FilterProvider getFilterProvider(){ return null; }
+    public JsonFormat.Value getDefaultPropertyFormat(Class<? extends Object> p0){ return null; }
+    public JsonInclude.Include getSerializationInclusion(){ return null; }
+    public JsonInclude.Value getDefaultPropertyInclusion(){ return null; }
+    public JsonInclude.Value getDefaultPropertyInclusion(Class<? extends Object> p0){ return null; }
+    public PrettyPrinter constructDefaultPrettyPrinter(){ return null; }
+    public PrettyPrinter getDefaultPrettyPrinter(){ return null; }
+    public SerializationConfig with(AnnotationIntrospector p0){ return null; }
+    public SerializationConfig with(Base64Variant p0){ return null; }
+    public SerializationConfig with(ClassIntrospector p0){ return null; }
+    public SerializationConfig with(ContextAttributes p0){ return null; }
+    public SerializationConfig with(DateFormat p0){ return null; }
+    public SerializationConfig with(FormatFeature p0){ return null; }
+    public SerializationConfig with(HandlerInstantiator p0){ return null; }
+    public SerializationConfig with(JsonGenerator.Feature p0){ return null; }
+    public SerializationConfig with(Locale p0){ return null; }
+    public SerializationConfig with(MapperFeature p0, boolean p1){ return null; }
+    public SerializationConfig with(MapperFeature... p0){ return null; }
+    public SerializationConfig with(PropertyNamingStrategy p0){ return null; }
+    public SerializationConfig with(SerializationFeature p0){ return null; }
+    public SerializationConfig with(SerializationFeature p0, SerializationFeature... p1){ return null; }
+    public SerializationConfig with(SubtypeResolver p0){ return null; }
+    public SerializationConfig with(TimeZone p0){ return null; }
+    public SerializationConfig with(TypeFactory p0){ return null; }
+    public SerializationConfig with(TypeResolverBuilder<? extends Object> p0){ return null; }
+    public SerializationConfig with(VisibilityChecker<? extends Object> p0){ return null; }
+    public SerializationConfig withAppendedAnnotationIntrospector(AnnotationIntrospector p0){ return null; }
+    public SerializationConfig withDefaultPrettyPrinter(PrettyPrinter p0){ return null; }
+    public SerializationConfig withFeatures(FormatFeature... p0){ return null; }
+    public SerializationConfig withFeatures(JsonGenerator.Feature... p0){ return null; }
+    public SerializationConfig withFeatures(SerializationFeature... p0){ return null; }
+    public SerializationConfig withFilters(FilterProvider p0){ return null; }
+    public SerializationConfig withInsertedAnnotationIntrospector(AnnotationIntrospector p0){ return null; }
+    public SerializationConfig withPropertyInclusion(JsonInclude.Value p0){ return null; }
+    public SerializationConfig withRootName(PropertyName p0){ return null; }
+    public SerializationConfig withSerializationInclusion(JsonInclude.Include p0){ return null; }
+    public SerializationConfig withView(Class<? extends Object> p0){ return null; }
+    public SerializationConfig withVisibility(PropertyAccessor p0, JsonAutoDetect.Visibility p1){ return null; }
+    public SerializationConfig without(FormatFeature p0){ return null; }
+    public SerializationConfig without(JsonGenerator.Feature p0){ return null; }
+    public SerializationConfig without(MapperFeature... p0){ return null; }
+    public SerializationConfig without(SerializationFeature p0){ return null; }
+    public SerializationConfig without(SerializationFeature p0, SerializationFeature... p1){ return null; }
+    public SerializationConfig withoutFeatures(FormatFeature... p0){ return null; }
+    public SerializationConfig withoutFeatures(JsonGenerator.Feature... p0){ return null; }
+    public SerializationConfig withoutFeatures(SerializationFeature... p0){ return null; }
+    public SerializationConfig(BaseSettings p0, SubtypeResolver p1, SimpleMixInResolver p2, RootNameLookup p3){}
+    public String toString(){ return null; }
+    public VisibilityChecker<? extends Object> getDefaultVisibilityChecker(){ return null; }
+    public boolean useRootWrapping(){ return false; }
+    public final boolean hasSerializationFeatures(int p0){ return false; }
+    public final boolean isEnabled(JsonGenerator.Feature p0, JsonFactory p1){ return false; }
+    public final boolean isEnabled(SerializationFeature p0){ return false; }
+    public final int getSerializationFeatures(){ return 0; }
+    public void initialize(JsonGenerator p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SerializationFeature.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SerializationFeature.java
new file mode 100644
index 00000000000..019ff42f205
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SerializationFeature.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.fasterxml.jackson.databind.SerializationFeature for testing
+// purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.databind.cfg.ConfigFeature;
+
+public enum SerializationFeature implements ConfigFeature {
+    CLOSE_CLOSEABLE, EAGER_SERIALIZER_FETCH, FAIL_ON_EMPTY_BEANS, FAIL_ON_SELF_REFERENCES, FAIL_ON_UNWRAPPED_TYPE_IDENTIFIERS, FLUSH_AFTER_WRITE_VALUE, INDENT_OUTPUT, ORDER_MAP_ENTRIES_BY_KEYS, USE_EQUALITY_FOR_OBJECT_ID, WRAP_EXCEPTIONS, WRAP_ROOT_VALUE, WRITE_BIGDECIMAL_AS_PLAIN, WRITE_CHAR_ARRAYS_AS_JSON_ARRAYS, WRITE_DATES_AS_TIMESTAMPS, WRITE_DATES_WITH_ZONE_ID, WRITE_DATE_KEYS_AS_TIMESTAMPS, WRITE_DATE_TIMESTAMPS_AS_NANOSECONDS, WRITE_DURATIONS_AS_TIMESTAMPS, WRITE_EMPTY_JSON_ARRAYS, WRITE_ENUMS_USING_INDEX, WRITE_ENUMS_USING_TO_STRING, WRITE_NULL_MAP_VALUES, WRITE_SINGLE_ELEM_ARRAYS_UNWRAPPED;
+
+    private SerializationFeature() {}
+
+    public boolean enabledByDefault() {
+        return false;
+    }
+
+    public boolean enabledIn(int p0) {
+        return false;
+    }
+
+    public int getMask() {
+        return 0;
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SerializerProvider.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SerializerProvider.java
new file mode 100644
index 00000000000..09e0aa71c2b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/SerializerProvider.java
@@ -0,0 +1,106 @@
+// Generated automatically from com.fasterxml.jackson.databind.SerializerProvider for testing purposes
+
+package com.fasterxml.jackson.databind;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.DatabindContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonMappingException;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.databind.cfg.ContextAttributes;
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.ser.FilterProvider;
+import com.fasterxml.jackson.databind.ser.SerializerCache;
+import com.fasterxml.jackson.databind.ser.SerializerFactory;
+import com.fasterxml.jackson.databind.ser.impl.ReadOnlyClassToSerializerMap;
+import com.fasterxml.jackson.databind.ser.impl.WritableObjectId;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import java.text.DateFormat;
+import java.util.Date;
+import java.util.Locale;
+import java.util.TimeZone;
+
+abstract public class SerializerProvider extends DatabindContext
+{
+    protected ContextAttributes _attributes = null;
+    protected DateFormat _dateFormat = null;
+    protected JsonSerializer<Object> _createAndCacheUntypedSerializer(Class<? extends Object> p0){ return null; }
+    protected JsonSerializer<Object> _createAndCacheUntypedSerializer(JavaType p0){ return null; }
+    protected JsonSerializer<Object> _createUntypedSerializer(JavaType p0){ return null; }
+    protected JsonSerializer<Object> _findExplicitUntypedSerializer(Class<? extends Object> p0){ return null; }
+    protected JsonSerializer<Object> _handleContextualResolvable(JsonSerializer<? extends Object> p0, BeanProperty p1){ return null; }
+    protected JsonSerializer<Object> _handleResolvable(JsonSerializer<? extends Object> p0){ return null; }
+    protected JsonSerializer<Object> _keySerializer = null;
+    protected JsonSerializer<Object> _nullKeySerializer = null;
+    protected JsonSerializer<Object> _nullValueSerializer = null;
+    protected JsonSerializer<Object> _unknownTypeSerializer = null;
+    protected SerializerProvider(SerializerProvider p0){}
+    protected SerializerProvider(SerializerProvider p0, SerializationConfig p1, SerializerFactory p2){}
+    protected final Class<? extends Object> _serializationView = null;
+    protected final DateFormat _dateFormat(){ return null; }
+    protected final ReadOnlyClassToSerializerMap _knownSerializers = null;
+    protected final SerializationConfig _config = null;
+    protected final SerializerCache _serializerCache = null;
+    protected final SerializerFactory _serializerFactory = null;
+    protected final boolean _stdNullValueSerializer = false;
+    protected static JsonSerializer<Object> DEFAULT_UNKNOWN_SERIALIZER = null;
+    protected static boolean CACHE_UNKNOWN_MAPPINGS = false;
+    protected void _reportIncompatibleRootType(Object p0, JavaType p1){}
+    public JsonMappingException mappingException(String p0, Object... p1){ return null; }
+    public JsonSerializer<? extends Object> handlePrimaryContextualization(JsonSerializer<? extends Object> p0, BeanProperty p1){ return null; }
+    public JsonSerializer<? extends Object> handleSecondaryContextualization(JsonSerializer<? extends Object> p0, BeanProperty p1){ return null; }
+    public JsonSerializer<Object> findKeySerializer(Class<? extends Object> p0, BeanProperty p1){ return null; }
+    public JsonSerializer<Object> findKeySerializer(JavaType p0, BeanProperty p1){ return null; }
+    public JsonSerializer<Object> findNullKeySerializer(JavaType p0, BeanProperty p1){ return null; }
+    public JsonSerializer<Object> findNullValueSerializer(BeanProperty p0){ return null; }
+    public JsonSerializer<Object> findPrimaryPropertySerializer(Class<? extends Object> p0, BeanProperty p1){ return null; }
+    public JsonSerializer<Object> findPrimaryPropertySerializer(JavaType p0, BeanProperty p1){ return null; }
+    public JsonSerializer<Object> findTypedValueSerializer(Class<? extends Object> p0, boolean p1, BeanProperty p2){ return null; }
+    public JsonSerializer<Object> findTypedValueSerializer(JavaType p0, boolean p1, BeanProperty p2){ return null; }
+    public JsonSerializer<Object> findValueSerializer(Class<? extends Object> p0){ return null; }
+    public JsonSerializer<Object> findValueSerializer(Class<? extends Object> p0, BeanProperty p1){ return null; }
+    public JsonSerializer<Object> findValueSerializer(JavaType p0){ return null; }
+    public JsonSerializer<Object> findValueSerializer(JavaType p0, BeanProperty p1){ return null; }
+    public JsonSerializer<Object> getDefaultNullKeySerializer(){ return null; }
+    public JsonSerializer<Object> getDefaultNullValueSerializer(){ return null; }
+    public JsonSerializer<Object> getUnknownTypeSerializer(Class<? extends Object> p0){ return null; }
+    public Locale getLocale(){ return null; }
+    public Object getAttribute(Object p0){ return null; }
+    public SerializerProvider setAttribute(Object p0, Object p1){ return null; }
+    public SerializerProvider(){}
+    public TimeZone getTimeZone(){ return null; }
+    public TypeSerializer findTypeSerializer(JavaType p0){ return null; }
+    public abstract JsonSerializer<Object> serializerInstance(Annotated p0, Object p1);
+    public abstract WritableObjectId findObjectId(Object p0, ObjectIdGenerator<? extends Object> p1);
+    public boolean isUnknownTypeSerializer(JsonSerializer<? extends Object> p0){ return false; }
+    public final AnnotationIntrospector getAnnotationIntrospector(){ return null; }
+    public final Class<? extends Object> getActiveView(){ return null; }
+    public final Class<? extends Object> getSerializationView(){ return null; }
+    public final FilterProvider getFilterProvider(){ return null; }
+    public final JsonFormat.Value getDefaultPropertyFormat(Class<? extends Object> p0){ return null; }
+    public final SerializationConfig getConfig(){ return null; }
+    public final TypeFactory getTypeFactory(){ return null; }
+    public final boolean canOverrideAccessModifiers(){ return false; }
+    public final boolean hasSerializationFeatures(int p0){ return false; }
+    public final boolean isEnabled(MapperFeature p0){ return false; }
+    public final boolean isEnabled(SerializationFeature p0){ return false; }
+    public final void defaultSerializeDateValue(Date p0, JsonGenerator p1){}
+    public final void defaultSerializeDateValue(long p0, JsonGenerator p1){}
+    public final void defaultSerializeField(String p0, Object p1, JsonGenerator p2){}
+    public final void defaultSerializeNull(JsonGenerator p0){}
+    public final void defaultSerializeValue(Object p0, JsonGenerator p1){}
+    public static JsonSerializer<Object> DEFAULT_NULL_KEY_SERIALIZER = null;
+    public void defaultSerializeDateKey(Date p0, JsonGenerator p1){}
+    public void defaultSerializeDateKey(long p0, JsonGenerator p1){}
+    public void setDefaultKeySerializer(JsonSerializer<Object> p0){}
+    public void setNullKeySerializer(JsonSerializer<Object> p0){}
+    public void setNullValueSerializer(JsonSerializer<Object> p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/annotation/JsonPOJOBuilder.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/annotation/JsonPOJOBuilder.java
new file mode 100644
index 00000000000..b6118770a70
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/annotation/JsonPOJOBuilder.java
@@ -0,0 +1,18 @@
+// Generated automatically from com.fasterxml.jackson.databind.annotation.JsonPOJOBuilder for testing purposes
+
+package com.fasterxml.jackson.databind.annotation;
+
+import java.lang.annotation.Annotation;
+
+public interface JsonPOJOBuilder extends Annotation
+{
+    String buildMethodName();
+    String withPrefix();
+    static public class Value
+    {
+        protected Value() {}
+        public Value(JsonPOJOBuilder p0){}
+        public final String buildMethodName = null;
+        public final String withPrefix = null;
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/annotation/JsonSerialize.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/annotation/JsonSerialize.java
new file mode 100644
index 00000000000..0c4d945a32c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/annotation/JsonSerialize.java
@@ -0,0 +1,32 @@
+// Generated automatically from com.fasterxml.jackson.databind.annotation.JsonSerialize for testing purposes
+
+package com.fasterxml.jackson.databind.annotation;
+
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.util.Converter;
+import java.lang.annotation.Annotation;
+
+public interface JsonSerialize extends Annotation
+{
+    Class<? extends Converter> contentConverter();
+    Class<? extends Converter> converter();
+    Class<? extends JsonSerializer> contentUsing();
+    Class<? extends JsonSerializer> keyUsing();
+    Class<? extends JsonSerializer> nullsUsing();
+    Class<? extends JsonSerializer> using();
+    Class<? extends Object> as();
+    Class<? extends Object> contentAs();
+    Class<? extends Object> keyAs();
+    JsonSerialize.Inclusion include();
+    JsonSerialize.Typing typing();
+    static public enum Inclusion
+    {
+        ALWAYS, DEFAULT_INCLUSION, NON_DEFAULT, NON_EMPTY, NON_NULL;
+        private Inclusion() {}
+    }
+    static public enum Typing
+    {
+        DEFAULT_TYPING, DYNAMIC, STATIC;
+        private Typing() {}
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/BaseSettings.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/BaseSettings.java
new file mode 100644
index 00000000000..74a96691e47
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/BaseSettings.java
@@ -0,0 +1,61 @@
+// Generated automatically from com.fasterxml.jackson.databind.cfg.BaseSettings for testing purposes
+
+package com.fasterxml.jackson.databind.cfg;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.PropertyAccessor;
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.cfg.HandlerInstantiator;
+import com.fasterxml.jackson.databind.introspect.ClassIntrospector;
+import com.fasterxml.jackson.databind.introspect.VisibilityChecker;
+import com.fasterxml.jackson.databind.jsontype.TypeResolverBuilder;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import java.io.Serializable;
+import java.text.DateFormat;
+import java.util.Locale;
+import java.util.TimeZone;
+
+public class BaseSettings implements Serializable
+{
+    protected BaseSettings() {}
+    protected final AnnotationIntrospector _annotationIntrospector = null;
+    protected final Base64Variant _defaultBase64 = null;
+    protected final ClassIntrospector _classIntrospector = null;
+    protected final DateFormat _dateFormat = null;
+    protected final HandlerInstantiator _handlerInstantiator = null;
+    protected final Locale _locale = null;
+    protected final PropertyNamingStrategy _propertyNamingStrategy = null;
+    protected final TimeZone _timeZone = null;
+    protected final TypeFactory _typeFactory = null;
+    protected final TypeResolverBuilder<? extends Object> _typeResolverBuilder = null;
+    protected final VisibilityChecker<? extends Object> _visibilityChecker = null;
+    public AnnotationIntrospector getAnnotationIntrospector(){ return null; }
+    public Base64Variant getBase64Variant(){ return null; }
+    public BaseSettings with(Base64Variant p0){ return null; }
+    public BaseSettings with(Locale p0){ return null; }
+    public BaseSettings with(TimeZone p0){ return null; }
+    public BaseSettings withAnnotationIntrospector(AnnotationIntrospector p0){ return null; }
+    public BaseSettings withAppendedAnnotationIntrospector(AnnotationIntrospector p0){ return null; }
+    public BaseSettings withClassIntrospector(ClassIntrospector p0){ return null; }
+    public BaseSettings withDateFormat(DateFormat p0){ return null; }
+    public BaseSettings withHandlerInstantiator(HandlerInstantiator p0){ return null; }
+    public BaseSettings withInsertedAnnotationIntrospector(AnnotationIntrospector p0){ return null; }
+    public BaseSettings withPropertyNamingStrategy(PropertyNamingStrategy p0){ return null; }
+    public BaseSettings withTypeFactory(TypeFactory p0){ return null; }
+    public BaseSettings withTypeResolverBuilder(TypeResolverBuilder<? extends Object> p0){ return null; }
+    public BaseSettings withVisibility(PropertyAccessor p0, JsonAutoDetect.Visibility p1){ return null; }
+    public BaseSettings withVisibilityChecker(VisibilityChecker<? extends Object> p0){ return null; }
+    public BaseSettings(ClassIntrospector p0, AnnotationIntrospector p1, VisibilityChecker<? extends Object> p2, PropertyNamingStrategy p3, TypeFactory p4, TypeResolverBuilder<? extends Object> p5, DateFormat p6, HandlerInstantiator p7, Locale p8, TimeZone p9, Base64Variant p10){}
+    public ClassIntrospector getClassIntrospector(){ return null; }
+    public DateFormat getDateFormat(){ return null; }
+    public HandlerInstantiator getHandlerInstantiator(){ return null; }
+    public Locale getLocale(){ return null; }
+    public PropertyNamingStrategy getPropertyNamingStrategy(){ return null; }
+    public TimeZone getTimeZone(){ return null; }
+    public TypeFactory getTypeFactory(){ return null; }
+    public TypeResolverBuilder<? extends Object> getTypeResolverBuilder(){ return null; }
+    public VisibilityChecker<? extends Object> getVisibilityChecker(){ return null; }
+    public boolean hasExplicitTimeZone(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/ConfigFeature.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/ConfigFeature.java
new file mode 100644
index 00000000000..d3fb671f73c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/ConfigFeature.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.databind.cfg.ConfigFeature for testing purposes
+
+package com.fasterxml.jackson.databind.cfg;
+
+
+public interface ConfigFeature
+{
+    boolean enabledByDefault();
+    boolean enabledIn(int p0);
+    int getMask();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/ContextAttributes.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/ContextAttributes.java
new file mode 100644
index 00000000000..72815b4ea1c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/ContextAttributes.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.fasterxml.jackson.databind.cfg.ContextAttributes for testing purposes
+
+package com.fasterxml.jackson.databind.cfg;
+
+import java.util.Map;
+
+abstract public class ContextAttributes
+{
+    public ContextAttributes(){}
+    public abstract ContextAttributes withPerCallAttribute(Object p0, Object p1);
+    public abstract ContextAttributes withSharedAttribute(Object p0, Object p1);
+    public abstract ContextAttributes withSharedAttributes(Map<? extends Object, ? extends Object> p0);
+    public abstract ContextAttributes withoutSharedAttribute(Object p0);
+    public abstract Object getAttribute(Object p0);
+    public static ContextAttributes getEmpty(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/HandlerInstantiator.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/HandlerInstantiator.java
new file mode 100644
index 00000000000..ccde28ee55e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/HandlerInstantiator.java
@@ -0,0 +1,35 @@
+// Generated automatically from com.fasterxml.jackson.databind.cfg.HandlerInstantiator for testing purposes
+
+package com.fasterxml.jackson.databind.cfg;
+
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.annotation.ObjectIdResolver;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.KeyDeserializer;
+import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.deser.ValueInstantiator;
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import com.fasterxml.jackson.databind.jsontype.TypeIdResolver;
+import com.fasterxml.jackson.databind.jsontype.TypeResolverBuilder;
+import com.fasterxml.jackson.databind.ser.VirtualBeanPropertyWriter;
+import com.fasterxml.jackson.databind.util.Converter;
+
+abstract public class HandlerInstantiator
+{
+    public Converter<? extends Object, ? extends Object> converterInstance(MapperConfig<? extends Object> p0, Annotated p1, Class<? extends Object> p2){ return null; }
+    public HandlerInstantiator(){}
+    public ObjectIdGenerator<? extends Object> objectIdGeneratorInstance(MapperConfig<? extends Object> p0, Annotated p1, Class<? extends Object> p2){ return null; }
+    public ObjectIdResolver resolverIdGeneratorInstance(MapperConfig<? extends Object> p0, Annotated p1, Class<? extends Object> p2){ return null; }
+    public PropertyNamingStrategy namingStrategyInstance(MapperConfig<? extends Object> p0, Annotated p1, Class<? extends Object> p2){ return null; }
+    public ValueInstantiator valueInstantiatorInstance(MapperConfig<? extends Object> p0, Annotated p1, Class<? extends Object> p2){ return null; }
+    public VirtualBeanPropertyWriter virtualPropertyWriterInstance(MapperConfig<? extends Object> p0, Class<? extends Object> p1){ return null; }
+    public abstract JsonDeserializer<? extends Object> deserializerInstance(DeserializationConfig p0, Annotated p1, Class<? extends Object> p2);
+    public abstract JsonSerializer<? extends Object> serializerInstance(SerializationConfig p0, Annotated p1, Class<? extends Object> p2);
+    public abstract KeyDeserializer keyDeserializerInstance(DeserializationConfig p0, Annotated p1, Class<? extends Object> p2);
+    public abstract TypeIdResolver typeIdResolverInstance(MapperConfig<? extends Object> p0, Annotated p1, Class<? extends Object> p2);
+    public abstract TypeResolverBuilder<? extends Object> typeResolverBuilderInstance(MapperConfig<? extends Object> p0, Annotated p1, Class<? extends Object> p2);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/MapperConfig.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/MapperConfig.java
new file mode 100644
index 00000000000..3c069e52e95
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/MapperConfig.java
@@ -0,0 +1,82 @@
+// Generated automatically from com.fasterxml.jackson.databind.cfg.MapperConfig for testing purposes
+
+package com.fasterxml.jackson.databind.cfg;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.core.SerializableString;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.MapperFeature;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.cfg.BaseSettings;
+import com.fasterxml.jackson.databind.cfg.ConfigFeature;
+import com.fasterxml.jackson.databind.cfg.ContextAttributes;
+import com.fasterxml.jackson.databind.cfg.HandlerInstantiator;
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import com.fasterxml.jackson.databind.introspect.ClassIntrospector;
+import com.fasterxml.jackson.databind.introspect.VisibilityChecker;
+import com.fasterxml.jackson.databind.jsontype.SubtypeResolver;
+import com.fasterxml.jackson.databind.jsontype.TypeIdResolver;
+import com.fasterxml.jackson.databind.jsontype.TypeResolverBuilder;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import java.io.Serializable;
+import java.text.DateFormat;
+import java.util.Locale;
+import java.util.TimeZone;
+
+abstract public class MapperConfig<T extends MapperConfig<T>> implements ClassIntrospector.MixInResolver, Serializable
+{
+    protected MapperConfig() {}
+    protected MapperConfig(BaseSettings p0, int p1){}
+    protected MapperConfig(MapperConfig<T> p0){}
+    protected MapperConfig(MapperConfig<T> p0, BaseSettings p1){}
+    protected MapperConfig(MapperConfig<T> p0, int p1){}
+    protected final BaseSettings _base = null;
+    protected final int _mapperFeatures = 0;
+    protected static JsonFormat.Value EMPTY_FORMAT = null;
+    protected static JsonInclude.Value EMPTY_INCLUDE = null;
+    public AnnotationIntrospector getAnnotationIntrospector(){ return null; }
+    public Base64Variant getBase64Variant(){ return null; }
+    public BeanDescription introspectClassAnnotations(Class<? extends Object> p0){ return null; }
+    public BeanDescription introspectDirectClassAnnotations(Class<? extends Object> p0){ return null; }
+    public ClassIntrospector getClassIntrospector(){ return null; }
+    public JavaType constructSpecializedType(JavaType p0, Class<? extends Object> p1){ return null; }
+    public SerializableString compileString(String p0){ return null; }
+    public TypeIdResolver typeIdResolverInstance(Annotated p0, Class<? extends TypeIdResolver> p1){ return null; }
+    public TypeResolverBuilder<? extends Object> typeResolverBuilderInstance(Annotated p0, Class<? extends TypeResolverBuilder<? extends Object>> p1){ return null; }
+    public VisibilityChecker<? extends Object> getDefaultVisibilityChecker(){ return null; }
+    public abstract BeanDescription introspectClassAnnotations(JavaType p0);
+    public abstract BeanDescription introspectDirectClassAnnotations(JavaType p0);
+    public abstract Class<? extends Object> getActiveView();
+    public abstract ContextAttributes getAttributes();
+    public abstract JsonFormat.Value getDefaultPropertyFormat(Class<? extends Object> p0);
+    public abstract JsonInclude.Value getDefaultPropertyInclusion();
+    public abstract JsonInclude.Value getDefaultPropertyInclusion(Class<? extends Object> p0);
+    public abstract PropertyName findRootName(Class<? extends Object> p0);
+    public abstract PropertyName findRootName(JavaType p0);
+    public abstract SubtypeResolver getSubtypeResolver();
+    public abstract T with(MapperFeature p0, boolean p1);
+    public abstract T with(MapperFeature... p0);
+    public abstract T without(MapperFeature... p0);
+    public abstract boolean useRootWrapping();
+    public final DateFormat getDateFormat(){ return null; }
+    public final HandlerInstantiator getHandlerInstantiator(){ return null; }
+    public final JavaType constructType(Class<? extends Object> p0){ return null; }
+    public final JavaType constructType(TypeReference<? extends Object> p0){ return null; }
+    public final Locale getLocale(){ return null; }
+    public final PropertyNamingStrategy getPropertyNamingStrategy(){ return null; }
+    public final TimeZone getTimeZone(){ return null; }
+    public final TypeFactory getTypeFactory(){ return null; }
+    public final TypeResolverBuilder<? extends Object> getDefaultTyper(JavaType p0){ return null; }
+    public final boolean canOverrideAccessModifiers(){ return false; }
+    public final boolean hasMapperFeatures(int p0){ return false; }
+    public final boolean isAnnotationProcessingEnabled(){ return false; }
+    public final boolean isEnabled(MapperFeature p0){ return false; }
+    public final boolean shouldSortPropertiesAlphabetically(){ return false; }
+    public static <F extends Enum<F> & ConfigFeature> int collectFeatureDefaults(Class<F> p0){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/MapperConfigBase.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/MapperConfigBase.java
new file mode 100644
index 00000000000..8530f0775b1
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/cfg/MapperConfigBase.java
@@ -0,0 +1,81 @@
+// Generated automatically from com.fasterxml.jackson.databind.cfg.MapperConfigBase for testing purposes
+
+package com.fasterxml.jackson.databind.cfg;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.PropertyAccessor;
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.PropertyNamingStrategy;
+import com.fasterxml.jackson.databind.cfg.BaseSettings;
+import com.fasterxml.jackson.databind.cfg.ConfigFeature;
+import com.fasterxml.jackson.databind.cfg.ContextAttributes;
+import com.fasterxml.jackson.databind.cfg.HandlerInstantiator;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.introspect.ClassIntrospector;
+import com.fasterxml.jackson.databind.introspect.SimpleMixInResolver;
+import com.fasterxml.jackson.databind.introspect.VisibilityChecker;
+import com.fasterxml.jackson.databind.jsontype.SubtypeResolver;
+import com.fasterxml.jackson.databind.jsontype.TypeResolverBuilder;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import com.fasterxml.jackson.databind.util.RootNameLookup;
+import java.io.Serializable;
+import java.text.DateFormat;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TimeZone;
+
+abstract public class MapperConfigBase<CFG extends ConfigFeature, T extends MapperConfigBase<CFG, T>> extends MapperConfig<T> implements Serializable
+{
+    protected MapperConfigBase() {}
+    protected MapperConfigBase(BaseSettings p0, SubtypeResolver p1, SimpleMixInResolver p2, RootNameLookup p3){}
+    protected MapperConfigBase(MapperConfigBase<CFG, T> p0){}
+    protected MapperConfigBase(MapperConfigBase<CFG, T> p0, BaseSettings p1){}
+    protected MapperConfigBase(MapperConfigBase<CFG, T> p0, Class<? extends Object> p1){}
+    protected MapperConfigBase(MapperConfigBase<CFG, T> p0, ContextAttributes p1){}
+    protected MapperConfigBase(MapperConfigBase<CFG, T> p0, PropertyName p1){}
+    protected MapperConfigBase(MapperConfigBase<CFG, T> p0, SimpleMixInResolver p1){}
+    protected MapperConfigBase(MapperConfigBase<CFG, T> p0, SimpleMixInResolver p1, RootNameLookup p2){}
+    protected MapperConfigBase(MapperConfigBase<CFG, T> p0, SubtypeResolver p1){}
+    protected MapperConfigBase(MapperConfigBase<CFG, T> p0, int p1){}
+    protected final Class<? extends Object> _view = null;
+    protected final ContextAttributes _attributes = null;
+    protected final PropertyName _rootName = null;
+    protected final RootNameLookup _rootNames = null;
+    protected final SimpleMixInResolver _mixIns = null;
+    protected final SubtypeResolver _subtypeResolver = null;
+    public ClassIntrospector.MixInResolver copy(){ return null; }
+    public PropertyName findRootName(Class<? extends Object> p0){ return null; }
+    public PropertyName findRootName(JavaType p0){ return null; }
+    public T withAttribute(Object p0, Object p1){ return null; }
+    public T withAttributes(Map<? extends Object, ? extends Object> p0){ return null; }
+    public T withRootName(String p0){ return null; }
+    public T withoutAttribute(Object p0){ return null; }
+    public abstract T with(AnnotationIntrospector p0);
+    public abstract T with(Base64Variant p0);
+    public abstract T with(ClassIntrospector p0);
+    public abstract T with(ContextAttributes p0);
+    public abstract T with(DateFormat p0);
+    public abstract T with(HandlerInstantiator p0);
+    public abstract T with(Locale p0);
+    public abstract T with(PropertyNamingStrategy p0);
+    public abstract T with(SubtypeResolver p0);
+    public abstract T with(TimeZone p0);
+    public abstract T with(TypeFactory p0);
+    public abstract T with(TypeResolverBuilder<? extends Object> p0);
+    public abstract T with(VisibilityChecker<? extends Object> p0);
+    public abstract T withAppendedAnnotationIntrospector(AnnotationIntrospector p0);
+    public abstract T withInsertedAnnotationIntrospector(AnnotationIntrospector p0);
+    public abstract T withRootName(PropertyName p0);
+    public abstract T withView(Class<? extends Object> p0);
+    public abstract T withVisibility(PropertyAccessor p0, JsonAutoDetect.Visibility p1);
+    public final Class<? extends Object> findMixInClassFor(Class<? extends Object> p0){ return null; }
+    public final Class<? extends Object> getActiveView(){ return null; }
+    public final ContextAttributes getAttributes(){ return null; }
+    public final PropertyName getFullRootName(){ return null; }
+    public final String getRootName(){ return null; }
+    public final SubtypeResolver getSubtypeResolver(){ return null; }
+    public final int mixInCount(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/AbstractDeserializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/AbstractDeserializer.java
new file mode 100644
index 00000000000..efa306aef2f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/AbstractDeserializer.java
@@ -0,0 +1,38 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.AbstractDeserializer for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.deser.BeanDeserializerBuilder;
+import com.fasterxml.jackson.databind.deser.SettableBeanProperty;
+import com.fasterxml.jackson.databind.deser.impl.ObjectIdReader;
+import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
+import java.io.Serializable;
+import java.util.Map;
+
+public class AbstractDeserializer extends JsonDeserializer<Object> implements Serializable
+{
+    protected AbstractDeserializer() {}
+    protected AbstractDeserializer(BeanDescription p0){}
+    protected Object _deserializeFromObjectId(JsonParser p0, DeserializationContext p1){ return null; }
+    protected Object _deserializeIfNatural(JsonParser p0, DeserializationContext p1){ return null; }
+    protected final JavaType _baseType = null;
+    protected final Map<String, SettableBeanProperty> _backRefProperties = null;
+    protected final ObjectIdReader _objectIdReader = null;
+    protected final boolean _acceptBoolean = false;
+    protected final boolean _acceptDouble = false;
+    protected final boolean _acceptInt = false;
+    protected final boolean _acceptString = false;
+    public AbstractDeserializer(BeanDeserializerBuilder p0, BeanDescription p1, Map<String, SettableBeanProperty> p2){}
+    public Class<? extends Object> handledType(){ return null; }
+    public Object deserialize(JsonParser p0, DeserializationContext p1){ return null; }
+    public Object deserializeWithType(JsonParser p0, DeserializationContext p1, TypeDeserializer p2){ return null; }
+    public ObjectIdReader getObjectIdReader(){ return null; }
+    public SettableBeanProperty findBackReference(String p0){ return null; }
+    public boolean isCachable(){ return false; }
+    public static AbstractDeserializer constructForNonPOJO(BeanDescription p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/BeanDeserializerBuilder.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/BeanDeserializerBuilder.java
new file mode 100644
index 00000000000..5f24ac7f775
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/BeanDeserializerBuilder.java
@@ -0,0 +1,68 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.BeanDeserializerBuilder for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.annotation.JsonPOJOBuilder;
+import com.fasterxml.jackson.databind.deser.AbstractDeserializer;
+import com.fasterxml.jackson.databind.deser.SettableAnyProperty;
+import com.fasterxml.jackson.databind.deser.SettableBeanProperty;
+import com.fasterxml.jackson.databind.deser.ValueInstantiator;
+import com.fasterxml.jackson.databind.deser.impl.ObjectIdReader;
+import com.fasterxml.jackson.databind.deser.impl.ValueInjector;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMethod;
+import com.fasterxml.jackson.databind.util.Annotations;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+
+public class BeanDeserializerBuilder
+{
+    protected BeanDeserializerBuilder() {}
+    protected AnnotatedMethod _buildMethod = null;
+    protected BeanDeserializerBuilder(BeanDeserializerBuilder p0){}
+    protected HashMap<String, SettableBeanProperty> _backRefProperties = null;
+    protected HashSet<String> _ignorableProps = null;
+    protected JsonPOJOBuilder.Value _builderConfig = null;
+    protected List<ValueInjector> _injectables = null;
+    protected ObjectIdReader _objectIdReader = null;
+    protected SettableAnyProperty _anySetter = null;
+    protected ValueInstantiator _valueInstantiator = null;
+    protected boolean _ignoreAllUnknown = false;
+    protected final BeanDescription _beanDesc = null;
+    protected final Map<String, SettableBeanProperty> _properties = null;
+    protected final boolean _caseInsensitivePropertyComparison = false;
+    protected final boolean _defaultViewInclusion = false;
+    public AbstractDeserializer buildAbstract(){ return null; }
+    public AnnotatedMethod getBuildMethod(){ return null; }
+    public BeanDeserializerBuilder(BeanDescription p0, DeserializationConfig p1){}
+    public Iterator<SettableBeanProperty> getProperties(){ return null; }
+    public JsonDeserializer<? extends Object> build(){ return null; }
+    public JsonDeserializer<? extends Object> buildBuilderBased(JavaType p0, String p1){ return null; }
+    public JsonPOJOBuilder.Value getBuilderConfig(){ return null; }
+    public List<ValueInjector> getInjectables(){ return null; }
+    public ObjectIdReader getObjectIdReader(){ return null; }
+    public SettableAnyProperty getAnySetter(){ return null; }
+    public SettableBeanProperty findProperty(PropertyName p0){ return null; }
+    public SettableBeanProperty removeProperty(PropertyName p0){ return null; }
+    public ValueInstantiator getValueInstantiator(){ return null; }
+    public boolean hasProperty(PropertyName p0){ return false; }
+    public void addBackReferenceProperty(String p0, SettableBeanProperty p1){}
+    public void addCreatorProperty(SettableBeanProperty p0){}
+    public void addIgnorable(String p0){}
+    public void addInjectable(PropertyName p0, JavaType p1, Annotations p2, AnnotatedMember p3, Object p4){}
+    public void addOrReplaceProperty(SettableBeanProperty p0, boolean p1){}
+    public void addProperty(SettableBeanProperty p0){}
+    public void setAnySetter(SettableAnyProperty p0){}
+    public void setIgnoreUnknownProperties(boolean p0){}
+    public void setObjectIdReader(ObjectIdReader p0){}
+    public void setPOJOBuilder(AnnotatedMethod p0, JsonPOJOBuilder.Value p1){}
+    public void setValueInstantiator(ValueInstantiator p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/BeanDeserializerModifier.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/BeanDeserializerModifier.java
new file mode 100644
index 00000000000..a30fea7ea29
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/BeanDeserializerModifier.java
@@ -0,0 +1,34 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.BeanDeserializerModifier for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.KeyDeserializer;
+import com.fasterxml.jackson.databind.deser.BeanDeserializerBuilder;
+import com.fasterxml.jackson.databind.introspect.BeanPropertyDefinition;
+import com.fasterxml.jackson.databind.type.ArrayType;
+import com.fasterxml.jackson.databind.type.CollectionLikeType;
+import com.fasterxml.jackson.databind.type.CollectionType;
+import com.fasterxml.jackson.databind.type.MapLikeType;
+import com.fasterxml.jackson.databind.type.MapType;
+import com.fasterxml.jackson.databind.type.ReferenceType;
+import java.util.List;
+
+abstract public class BeanDeserializerModifier
+{
+    public BeanDeserializerBuilder updateBuilder(DeserializationConfig p0, BeanDescription p1, BeanDeserializerBuilder p2){ return null; }
+    public BeanDeserializerModifier(){}
+    public JsonDeserializer<? extends Object> modifyArrayDeserializer(DeserializationConfig p0, ArrayType p1, BeanDescription p2, JsonDeserializer<? extends Object> p3){ return null; }
+    public JsonDeserializer<? extends Object> modifyCollectionDeserializer(DeserializationConfig p0, CollectionType p1, BeanDescription p2, JsonDeserializer<? extends Object> p3){ return null; }
+    public JsonDeserializer<? extends Object> modifyCollectionLikeDeserializer(DeserializationConfig p0, CollectionLikeType p1, BeanDescription p2, JsonDeserializer<? extends Object> p3){ return null; }
+    public JsonDeserializer<? extends Object> modifyDeserializer(DeserializationConfig p0, BeanDescription p1, JsonDeserializer<? extends Object> p2){ return null; }
+    public JsonDeserializer<? extends Object> modifyEnumDeserializer(DeserializationConfig p0, JavaType p1, BeanDescription p2, JsonDeserializer<? extends Object> p3){ return null; }
+    public JsonDeserializer<? extends Object> modifyMapDeserializer(DeserializationConfig p0, MapType p1, BeanDescription p2, JsonDeserializer<? extends Object> p3){ return null; }
+    public JsonDeserializer<? extends Object> modifyMapLikeDeserializer(DeserializationConfig p0, MapLikeType p1, BeanDescription p2, JsonDeserializer<? extends Object> p3){ return null; }
+    public JsonDeserializer<? extends Object> modifyReferenceDeserializer(DeserializationConfig p0, ReferenceType p1, BeanDescription p2, JsonDeserializer<? extends Object> p3){ return null; }
+    public KeyDeserializer modifyKeyDeserializer(DeserializationConfig p0, JavaType p1, KeyDeserializer p2){ return null; }
+    public List<BeanPropertyDefinition> updateProperties(DeserializationConfig p0, BeanDescription p1, List<BeanPropertyDefinition> p2){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DataFormatReaders.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DataFormatReaders.java
new file mode 100644
index 00000000000..d0ebd6bb9ce
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DataFormatReaders.java
@@ -0,0 +1,50 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.DataFormatReaders for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.format.MatchStrength;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.ObjectReader;
+import java.io.InputStream;
+import java.util.Collection;
+
+public class DataFormatReaders
+{
+    protected DataFormatReaders() {}
+    protected final MatchStrength _minimalMatch = null;
+    protected final MatchStrength _optimalMatch = null;
+    protected final ObjectReader[] _readers = null;
+    protected final int _maxInputLookahead = 0;
+    public DataFormatReaders with(DeserializationConfig p0){ return null; }
+    public DataFormatReaders with(ObjectReader[] p0){ return null; }
+    public DataFormatReaders withMaxInputLookahead(int p0){ return null; }
+    public DataFormatReaders withMinimalMatch(MatchStrength p0){ return null; }
+    public DataFormatReaders withOptimalMatch(MatchStrength p0){ return null; }
+    public DataFormatReaders withType(JavaType p0){ return null; }
+    public DataFormatReaders(Collection<ObjectReader> p0){}
+    public DataFormatReaders(ObjectReader... p0){}
+    public DataFormatReaders.Match findFormat(InputStream p0){ return null; }
+    public DataFormatReaders.Match findFormat(byte[] p0){ return null; }
+    public DataFormatReaders.Match findFormat(byte[] p0, int p1, int p2){ return null; }
+    public String toString(){ return null; }
+    public static int DEFAULT_MAX_INPUT_LOOKAHEAD = 0;
+    static public class Match
+    {
+        protected Match() {}
+        protected Match(InputStream p0, byte[] p1, int p2, int p3, ObjectReader p4, MatchStrength p5){}
+        protected final InputStream _originalStream = null;
+        protected final MatchStrength _matchStrength = null;
+        protected final ObjectReader _match = null;
+        protected final byte[] _bufferedData = null;
+        protected final int _bufferedLength = 0;
+        protected final int _bufferedStart = 0;
+        public InputStream getDataStream(){ return null; }
+        public JsonParser createParserWithMatch(){ return null; }
+        public MatchStrength getMatchStrength(){ return null; }
+        public ObjectReader getReader(){ return null; }
+        public String getMatchedFormatName(){ return null; }
+        public boolean hasMatch(){ return false; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DefaultDeserializationContext.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DefaultDeserializationContext.java
new file mode 100644
index 00000000000..46d4bbef67b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DefaultDeserializationContext.java
@@ -0,0 +1,38 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.DefaultDeserializationContext for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.annotation.ObjectIdResolver;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.InjectableValues;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.KeyDeserializer;
+import com.fasterxml.jackson.databind.deser.DeserializerCache;
+import com.fasterxml.jackson.databind.deser.DeserializerFactory;
+import com.fasterxml.jackson.databind.deser.impl.ReadableObjectId;
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import java.io.Serializable;
+import java.util.LinkedHashMap;
+
+abstract public class DefaultDeserializationContext extends DeserializationContext implements Serializable
+{
+    protected DefaultDeserializationContext() {}
+    protected DefaultDeserializationContext(DefaultDeserializationContext p0){}
+    protected DefaultDeserializationContext(DefaultDeserializationContext p0, DeserializationConfig p1, JsonParser p2, InjectableValues p3){}
+    protected DefaultDeserializationContext(DefaultDeserializationContext p0, DeserializerFactory p1){}
+    protected DefaultDeserializationContext(DeserializerFactory p0, DeserializerCache p1){}
+    protected LinkedHashMap<ObjectIdGenerator.IdKey, ReadableObjectId> _objectIds = null;
+    protected ReadableObjectId createReadableObjectId(ObjectIdGenerator.IdKey p0){ return null; }
+    protected boolean tryToResolveUnresolvedObjectId(ReadableObjectId p0){ return false; }
+    public DefaultDeserializationContext copy(){ return null; }
+    public JsonDeserializer<Object> deserializerInstance(Annotated p0, Object p1){ return null; }
+    public ReadableObjectId findObjectId(Object p0, ObjectIdGenerator<? extends Object> p1){ return null; }
+    public ReadableObjectId findObjectId(Object p0, ObjectIdGenerator<? extends Object> p1, ObjectIdResolver p2){ return null; }
+    public abstract DefaultDeserializationContext createInstance(DeserializationConfig p0, JsonParser p1, InjectableValues p2);
+    public abstract DefaultDeserializationContext with(DeserializerFactory p0);
+    public final KeyDeserializer keyDeserializerInstance(Annotated p0, Object p1){ return null; }
+    public void checkUnresolvedObjectId(){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DeserializationProblemHandler.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DeserializationProblemHandler.java
new file mode 100644
index 00000000000..26dbe3f2660
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DeserializationProblemHandler.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.DeserializationProblemHandler for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+
+abstract public class DeserializationProblemHandler
+{
+    public DeserializationProblemHandler(){}
+    public boolean handleUnknownProperty(DeserializationContext p0, JsonParser p1, JsonDeserializer<? extends Object> p2, Object p3, String p4){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DeserializerCache.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DeserializerCache.java
new file mode 100644
index 00000000000..dc8fe04904c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DeserializerCache.java
@@ -0,0 +1,37 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.DeserializerCache for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.KeyDeserializer;
+import com.fasterxml.jackson.databind.deser.DeserializerFactory;
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import com.fasterxml.jackson.databind.util.Converter;
+import java.io.Serializable;
+import java.util.HashMap;
+import java.util.concurrent.ConcurrentHashMap;
+
+public class DeserializerCache implements Serializable
+{
+    protected Converter<Object, Object> findConverter(DeserializationContext p0, Annotated p1){ return null; }
+    protected JsonDeserializer<? extends Object> _createDeserializer2(DeserializationContext p0, DeserializerFactory p1, JavaType p2, BeanDescription p3){ return null; }
+    protected JsonDeserializer<Object> _createAndCache2(DeserializationContext p0, DeserializerFactory p1, JavaType p2){ return null; }
+    protected JsonDeserializer<Object> _createAndCacheValueDeserializer(DeserializationContext p0, DeserializerFactory p1, JavaType p2){ return null; }
+    protected JsonDeserializer<Object> _createDeserializer(DeserializationContext p0, DeserializerFactory p1, JavaType p2){ return null; }
+    protected JsonDeserializer<Object> _findCachedDeserializer(JavaType p0){ return null; }
+    protected JsonDeserializer<Object> _handleUnknownValueDeserializer(DeserializationContext p0, JavaType p1){ return null; }
+    protected JsonDeserializer<Object> findConvertingDeserializer(DeserializationContext p0, Annotated p1, JsonDeserializer<Object> p2){ return null; }
+    protected JsonDeserializer<Object> findDeserializerFromAnnotation(DeserializationContext p0, Annotated p1){ return null; }
+    protected KeyDeserializer _handleUnknownKeyDeserializer(DeserializationContext p0, JavaType p1){ return null; }
+    protected final ConcurrentHashMap<JavaType, JsonDeserializer<Object>> _cachedDeserializers = null;
+    protected final HashMap<JavaType, JsonDeserializer<Object>> _incompleteDeserializers = null;
+    public DeserializerCache(){}
+    public JsonDeserializer<Object> findValueDeserializer(DeserializationContext p0, DeserializerFactory p1, JavaType p2){ return null; }
+    public KeyDeserializer findKeyDeserializer(DeserializationContext p0, DeserializerFactory p1, JavaType p2){ return null; }
+    public boolean hasValueDeserializerFor(DeserializationContext p0, DeserializerFactory p1, JavaType p2){ return false; }
+    public int cachedDeserializersCount(){ return 0; }
+    public void flushCachedDeserializers(){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DeserializerFactory.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DeserializerFactory.java
new file mode 100644
index 00000000000..b2726ffd0b9
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/DeserializerFactory.java
@@ -0,0 +1,48 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.DeserializerFactory for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.databind.AbstractTypeResolver;
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.KeyDeserializer;
+import com.fasterxml.jackson.databind.deser.BeanDeserializerModifier;
+import com.fasterxml.jackson.databind.deser.Deserializers;
+import com.fasterxml.jackson.databind.deser.KeyDeserializers;
+import com.fasterxml.jackson.databind.deser.ValueInstantiator;
+import com.fasterxml.jackson.databind.deser.ValueInstantiators;
+import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
+import com.fasterxml.jackson.databind.type.ArrayType;
+import com.fasterxml.jackson.databind.type.CollectionLikeType;
+import com.fasterxml.jackson.databind.type.CollectionType;
+import com.fasterxml.jackson.databind.type.MapLikeType;
+import com.fasterxml.jackson.databind.type.MapType;
+import com.fasterxml.jackson.databind.type.ReferenceType;
+
+abstract public class DeserializerFactory
+{
+    protected static Deserializers[] NO_DESERIALIZERS = null;
+    public DeserializerFactory(){}
+    public abstract DeserializerFactory withAbstractTypeResolver(AbstractTypeResolver p0);
+    public abstract DeserializerFactory withAdditionalDeserializers(Deserializers p0);
+    public abstract DeserializerFactory withAdditionalKeyDeserializers(KeyDeserializers p0);
+    public abstract DeserializerFactory withDeserializerModifier(BeanDeserializerModifier p0);
+    public abstract DeserializerFactory withValueInstantiators(ValueInstantiators p0);
+    public abstract JavaType mapAbstractType(DeserializationConfig p0, JavaType p1);
+    public abstract JsonDeserializer<? extends Object> createArrayDeserializer(DeserializationContext p0, ArrayType p1, BeanDescription p2);
+    public abstract JsonDeserializer<? extends Object> createCollectionDeserializer(DeserializationContext p0, CollectionType p1, BeanDescription p2);
+    public abstract JsonDeserializer<? extends Object> createCollectionLikeDeserializer(DeserializationContext p0, CollectionLikeType p1, BeanDescription p2);
+    public abstract JsonDeserializer<? extends Object> createEnumDeserializer(DeserializationContext p0, JavaType p1, BeanDescription p2);
+    public abstract JsonDeserializer<? extends Object> createMapDeserializer(DeserializationContext p0, MapType p1, BeanDescription p2);
+    public abstract JsonDeserializer<? extends Object> createMapLikeDeserializer(DeserializationContext p0, MapLikeType p1, BeanDescription p2);
+    public abstract JsonDeserializer<? extends Object> createReferenceDeserializer(DeserializationContext p0, ReferenceType p1, BeanDescription p2);
+    public abstract JsonDeserializer<? extends Object> createTreeDeserializer(DeserializationConfig p0, JavaType p1, BeanDescription p2);
+    public abstract JsonDeserializer<Object> createBeanDeserializer(DeserializationContext p0, JavaType p1, BeanDescription p2);
+    public abstract JsonDeserializer<Object> createBuilderBasedDeserializer(DeserializationContext p0, JavaType p1, BeanDescription p2, Class<? extends Object> p3);
+    public abstract KeyDeserializer createKeyDeserializer(DeserializationContext p0, JavaType p1);
+    public abstract TypeDeserializer findTypeDeserializer(DeserializationConfig p0, JavaType p1);
+    public abstract ValueInstantiator findValueInstantiator(DeserializationContext p0, BeanDescription p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/Deserializers.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/Deserializers.java
new file mode 100644
index 00000000000..c22020603db
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/Deserializers.java
@@ -0,0 +1,30 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.Deserializers for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.KeyDeserializer;
+import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
+import com.fasterxml.jackson.databind.type.ArrayType;
+import com.fasterxml.jackson.databind.type.CollectionLikeType;
+import com.fasterxml.jackson.databind.type.CollectionType;
+import com.fasterxml.jackson.databind.type.MapLikeType;
+import com.fasterxml.jackson.databind.type.MapType;
+import com.fasterxml.jackson.databind.type.ReferenceType;
+
+public interface Deserializers
+{
+    JsonDeserializer<? extends Object> findArrayDeserializer(ArrayType p0, DeserializationConfig p1, BeanDescription p2, TypeDeserializer p3, JsonDeserializer<? extends Object> p4);
+    JsonDeserializer<? extends Object> findBeanDeserializer(JavaType p0, DeserializationConfig p1, BeanDescription p2);
+    JsonDeserializer<? extends Object> findCollectionDeserializer(CollectionType p0, DeserializationConfig p1, BeanDescription p2, TypeDeserializer p3, JsonDeserializer<? extends Object> p4);
+    JsonDeserializer<? extends Object> findCollectionLikeDeserializer(CollectionLikeType p0, DeserializationConfig p1, BeanDescription p2, TypeDeserializer p3, JsonDeserializer<? extends Object> p4);
+    JsonDeserializer<? extends Object> findEnumDeserializer(Class<? extends Object> p0, DeserializationConfig p1, BeanDescription p2);
+    JsonDeserializer<? extends Object> findMapDeserializer(MapType p0, DeserializationConfig p1, BeanDescription p2, KeyDeserializer p3, TypeDeserializer p4, JsonDeserializer<? extends Object> p5);
+    JsonDeserializer<? extends Object> findMapLikeDeserializer(MapLikeType p0, DeserializationConfig p1, BeanDescription p2, KeyDeserializer p3, TypeDeserializer p4, JsonDeserializer<? extends Object> p5);
+    JsonDeserializer<? extends Object> findReferenceDeserializer(ReferenceType p0, DeserializationConfig p1, BeanDescription p2, TypeDeserializer p3, JsonDeserializer<? extends Object> p4);
+    JsonDeserializer<? extends Object> findTreeNodeDeserializer(Class<? extends JsonNode> p0, DeserializationConfig p1, BeanDescription p2);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/KeyDeserializers.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/KeyDeserializers.java
new file mode 100644
index 00000000000..90b6c17549b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/KeyDeserializers.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.KeyDeserializers for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.KeyDeserializer;
+
+public interface KeyDeserializers
+{
+    KeyDeserializer findKeyDeserializer(JavaType p0, DeserializationConfig p1, BeanDescription p2);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/SettableAnyProperty.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/SettableAnyProperty.java
new file mode 100644
index 00000000000..01dcf895d50
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/SettableAnyProperty.java
@@ -0,0 +1,33 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.SettableAnyProperty for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMethod;
+import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
+import java.io.Serializable;
+
+public class SettableAnyProperty implements Serializable
+{
+    protected SettableAnyProperty() {}
+    protected JsonDeserializer<Object> _valueDeserializer = null;
+    protected SettableAnyProperty(SettableAnyProperty p0){}
+    protected final AnnotatedMethod _setter = null;
+    protected final BeanProperty _property = null;
+    protected final JavaType _type = null;
+    protected final TypeDeserializer _valueTypeDeserializer = null;
+    protected void _throwAsIOE(Exception p0, String p1, Object p2){}
+    public BeanProperty getProperty(){ return null; }
+    public JavaType getType(){ return null; }
+    public Object deserialize(JsonParser p0, DeserializationContext p1){ return null; }
+    public SettableAnyProperty withValueDeserializer(JsonDeserializer<Object> p0){ return null; }
+    public SettableAnyProperty(BeanProperty p0, AnnotatedMethod p1, JavaType p2, JsonDeserializer<Object> p3, TypeDeserializer p4){}
+    public String toString(){ return null; }
+    public boolean hasValueDeserializer(){ return false; }
+    public final void deserializeAndSet(JsonParser p0, DeserializationContext p1, Object p2, String p3){}
+    public void set(Object p0, String p1, Object p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/SettableBeanProperty.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/SettableBeanProperty.java
new file mode 100644
index 00000000000..333dcca8964
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/SettableBeanProperty.java
@@ -0,0 +1,83 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.SettableBeanProperty for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.PropertyMetadata;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.introspect.BeanPropertyDefinition;
+import com.fasterxml.jackson.databind.introspect.ConcreteBeanPropertyBase;
+import com.fasterxml.jackson.databind.introspect.ObjectIdInfo;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonObjectFormatVisitor;
+import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
+import com.fasterxml.jackson.databind.util.Annotations;
+import com.fasterxml.jackson.databind.util.ViewMatcher;
+import java.io.IOException;
+import java.io.Serializable;
+import java.lang.annotation.Annotation;
+
+abstract public class SettableBeanProperty extends ConcreteBeanPropertyBase implements Serializable
+{
+    protected SettableBeanProperty() {}
+    protected IOException _throwAsIOE(Exception p0){ return null; }
+    protected IOException _throwAsIOE(JsonParser p0, Exception p1){ return null; }
+    protected ObjectIdInfo _objectIdInfo = null;
+    protected SettableBeanProperty(BeanPropertyDefinition p0, JavaType p1, TypeDeserializer p2, Annotations p3){}
+    protected SettableBeanProperty(PropertyName p0, JavaType p1, PropertyMetadata p2, JsonDeserializer<Object> p3){}
+    protected SettableBeanProperty(PropertyName p0, JavaType p1, PropertyName p2, TypeDeserializer p3, Annotations p4, PropertyMetadata p5){}
+    protected SettableBeanProperty(SettableBeanProperty p0){}
+    protected SettableBeanProperty(SettableBeanProperty p0, JsonDeserializer<? extends Object> p1){}
+    protected SettableBeanProperty(SettableBeanProperty p0, PropertyName p1){}
+    protected SettableBeanProperty(String p0, JavaType p1, PropertyName p2, TypeDeserializer p3, Annotations p4, boolean p5){}
+    protected String _managedReferenceName = null;
+    protected ViewMatcher _viewMatcher = null;
+    protected final Annotations _contextAnnotations = null;
+    protected final Class<? extends Object> getDeclaringClass(){ return null; }
+    protected final JavaType _type = null;
+    protected final JsonDeserializer<Object> _valueDeserializer = null;
+    protected final PropertyName _propName = null;
+    protected final PropertyName _wrapperName = null;
+    protected final TypeDeserializer _valueTypeDeserializer = null;
+    protected int _propertyIndex = 0;
+    protected static JsonDeserializer<Object> MISSING_VALUE_DESERIALIZER = null;
+    protected void _throwAsIOE(Exception p0, Object p1){}
+    protected void _throwAsIOE(JsonParser p0, Exception p1, Object p2){}
+    public <A extends Annotation> A getContextAnnotation(Class<A> p0){ return null; }
+    public JavaType getType(){ return null; }
+    public JsonDeserializer<Object> getValueDeserializer(){ return null; }
+    public Object getInjectableValueId(){ return null; }
+    public ObjectIdInfo getObjectIdInfo(){ return null; }
+    public PropertyName getFullName(){ return null; }
+    public PropertyName getWrapperName(){ return null; }
+    public SettableBeanProperty withName(String p0){ return null; }
+    public SettableBeanProperty withSimpleName(String p0){ return null; }
+    public String getManagedReferenceName(){ return null; }
+    public String toString(){ return null; }
+    public TypeDeserializer getValueTypeDeserializer(){ return null; }
+    public abstract <A extends Annotation> A getAnnotation(Class<A> p0);
+    public abstract AnnotatedMember getMember();
+    public abstract Object deserializeSetAndReturn(JsonParser p0, DeserializationContext p1, Object p2);
+    public abstract Object setAndReturn(Object p0, Object p1);
+    public abstract SettableBeanProperty withName(PropertyName p0);
+    public abstract SettableBeanProperty withValueDeserializer(JsonDeserializer<? extends Object> p0);
+    public abstract void deserializeAndSet(JsonParser p0, DeserializationContext p1, Object p2);
+    public abstract void set(Object p0, Object p1);
+    public boolean hasValueDeserializer(){ return false; }
+    public boolean hasValueTypeDeserializer(){ return false; }
+    public boolean hasViews(){ return false; }
+    public boolean visibleInView(Class<? extends Object> p0){ return false; }
+    public final Object deserialize(JsonParser p0, DeserializationContext p1){ return null; }
+    public final String getName(){ return null; }
+    public int getCreatorIndex(){ return 0; }
+    public int getPropertyIndex(){ return 0; }
+    public void assignIndex(int p0){}
+    public void depositSchemaProperty(JsonObjectFormatVisitor p0, SerializerProvider p1){}
+    public void setManagedReferenceName(String p0){}
+    public void setObjectIdInfo(ObjectIdInfo p0){}
+    public void setViews(Class<? extends Object>[] p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/UnresolvedForwardReference.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/UnresolvedForwardReference.java
new file mode 100644
index 00000000000..8f4895dc47b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/UnresolvedForwardReference.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.UnresolvedForwardReference for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.core.JsonLocation;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.JsonMappingException;
+import com.fasterxml.jackson.databind.deser.UnresolvedId;
+import com.fasterxml.jackson.databind.deser.impl.ReadableObjectId;
+import java.util.List;
+
+public class UnresolvedForwardReference extends JsonMappingException
+{
+    protected UnresolvedForwardReference() {}
+    public List<UnresolvedId> getUnresolvedIds(){ return null; }
+    public Object getUnresolvedId(){ return null; }
+    public ReadableObjectId getRoid(){ return null; }
+    public String getMessage(){ return null; }
+    public UnresolvedForwardReference(JsonParser p0, String p1){}
+    public UnresolvedForwardReference(JsonParser p0, String p1, JsonLocation p2, ReadableObjectId p3){}
+    public UnresolvedForwardReference(String p0){}
+    public UnresolvedForwardReference(String p0, JsonLocation p1, ReadableObjectId p2){}
+    public void addUnresolvedId(Object p0, Class<? extends Object> p1, JsonLocation p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/UnresolvedId.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/UnresolvedId.java
new file mode 100644
index 00000000000..f1895e44186
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/UnresolvedId.java
@@ -0,0 +1,15 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.UnresolvedId for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.core.JsonLocation;
+
+public class UnresolvedId
+{
+    protected UnresolvedId() {}
+    public Class<? extends Object> getType(){ return null; }
+    public JsonLocation getLocation(){ return null; }
+    public Object getId(){ return null; }
+    public String toString(){ return null; }
+    public UnresolvedId(Object p0, Class<? extends Object> p1, JsonLocation p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/ValueInstantiator.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/ValueInstantiator.java
new file mode 100644
index 00000000000..cf1d1f5b1d6
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/ValueInstantiator.java
@@ -0,0 +1,44 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.ValueInstantiator for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.deser.SettableBeanProperty;
+import com.fasterxml.jackson.databind.introspect.AnnotatedParameter;
+import com.fasterxml.jackson.databind.introspect.AnnotatedWithParams;
+
+abstract public class ValueInstantiator
+{
+    protected Object _createFromStringFallbacks(DeserializationContext p0, String p1){ return null; }
+    public AnnotatedParameter getIncompleteParameter(){ return null; }
+    public AnnotatedWithParams getArrayDelegateCreator(){ return null; }
+    public AnnotatedWithParams getDefaultCreator(){ return null; }
+    public AnnotatedWithParams getDelegateCreator(){ return null; }
+    public AnnotatedWithParams getWithArgsCreator(){ return null; }
+    public JavaType getArrayDelegateType(DeserializationConfig p0){ return null; }
+    public JavaType getDelegateType(DeserializationConfig p0){ return null; }
+    public Object createFromBoolean(DeserializationContext p0, boolean p1){ return null; }
+    public Object createFromDouble(DeserializationContext p0, double p1){ return null; }
+    public Object createFromInt(DeserializationContext p0, int p1){ return null; }
+    public Object createFromLong(DeserializationContext p0, long p1){ return null; }
+    public Object createFromObjectWith(DeserializationContext p0, Object[] p1){ return null; }
+    public Object createFromString(DeserializationContext p0, String p1){ return null; }
+    public Object createUsingArrayDelegate(DeserializationContext p0, Object p1){ return null; }
+    public Object createUsingDefault(DeserializationContext p0){ return null; }
+    public Object createUsingDelegate(DeserializationContext p0, Object p1){ return null; }
+    public SettableBeanProperty[] getFromObjectArguments(DeserializationConfig p0){ return null; }
+    public ValueInstantiator(){}
+    public abstract String getValueTypeDesc();
+    public boolean canCreateFromBoolean(){ return false; }
+    public boolean canCreateFromDouble(){ return false; }
+    public boolean canCreateFromInt(){ return false; }
+    public boolean canCreateFromLong(){ return false; }
+    public boolean canCreateFromObjectWith(){ return false; }
+    public boolean canCreateFromString(){ return false; }
+    public boolean canCreateUsingArrayDelegate(){ return false; }
+    public boolean canCreateUsingDefault(){ return false; }
+    public boolean canCreateUsingDelegate(){ return false; }
+    public boolean canInstantiate(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/ValueInstantiators.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/ValueInstantiators.java
new file mode 100644
index 00000000000..31124f2a86e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/ValueInstantiators.java
@@ -0,0 +1,12 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.ValueInstantiators for testing purposes
+
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.deser.ValueInstantiator;
+
+public interface ValueInstantiators
+{
+    ValueInstantiator findValueInstantiator(DeserializationConfig p0, BeanDescription p1, ValueInstantiator p2);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/impl/ObjectIdReader.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/impl/ObjectIdReader.java
new file mode 100644
index 00000000000..b1f90ddbb9f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/impl/ObjectIdReader.java
@@ -0,0 +1,33 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.impl.ObjectIdReader for testing purposes
+
+package com.fasterxml.jackson.databind.deser.impl;
+
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.annotation.ObjectIdResolver;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.deser.SettableBeanProperty;
+import java.io.Serializable;
+
+public class ObjectIdReader implements Serializable
+{
+    protected ObjectIdReader() {}
+    protected ObjectIdReader(JavaType p0, PropertyName p1, ObjectIdGenerator<? extends Object> p2, JsonDeserializer<? extends Object> p3, SettableBeanProperty p4){}
+    protected ObjectIdReader(JavaType p0, PropertyName p1, ObjectIdGenerator<? extends Object> p2, JsonDeserializer<? extends Object> p3, SettableBeanProperty p4, ObjectIdResolver p5){}
+    protected final JavaType _idType = null;
+    protected final JsonDeserializer<Object> _deserializer = null;
+    public JavaType getIdType(){ return null; }
+    public JsonDeserializer<Object> getDeserializer(){ return null; }
+    public Object readObjectReference(JsonParser p0, DeserializationContext p1){ return null; }
+    public boolean isValidReferencePropertyName(String p0, JsonParser p1){ return false; }
+    public boolean maySerializeAsObject(){ return false; }
+    public final ObjectIdGenerator<? extends Object> generator = null;
+    public final ObjectIdResolver resolver = null;
+    public final PropertyName propertyName = null;
+    public final SettableBeanProperty idProperty = null;
+    public static ObjectIdReader construct(JavaType p0, PropertyName p1, ObjectIdGenerator<? extends Object> p2, JsonDeserializer<? extends Object> p3, SettableBeanProperty p4){ return null; }
+    public static ObjectIdReader construct(JavaType p0, PropertyName p1, ObjectIdGenerator<? extends Object> p2, JsonDeserializer<? extends Object> p3, SettableBeanProperty p4, ObjectIdResolver p5){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/impl/ReadableObjectId.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/impl/ReadableObjectId.java
new file mode 100644
index 00000000000..b276e5cbb3e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/impl/ReadableObjectId.java
@@ -0,0 +1,42 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.impl.ReadableObjectId for testing purposes
+
+package com.fasterxml.jackson.databind.deser.impl;
+
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.annotation.ObjectIdResolver;
+import com.fasterxml.jackson.core.JsonLocation;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.deser.UnresolvedForwardReference;
+import java.util.Iterator;
+import java.util.LinkedList;
+
+public class ReadableObjectId
+{
+    protected ReadableObjectId() {}
+    abstract static public class Referring
+    {
+        protected Referring() {}
+        public Class<? extends Object> getBeanType(){ return null; }
+        public JsonLocation getLocation(){ return null; }
+        public Referring(UnresolvedForwardReference p0, Class<? extends Object> p1){}
+        public abstract void handleResolvedForwardReference(Object p0, Object p1);
+        public boolean hasId(Object p0){ return false; }
+    }
+    protected LinkedList<ReadableObjectId.Referring> _referringProperties = null;
+    protected ObjectIdResolver _resolver = null;
+    protected final ObjectIdGenerator.IdKey _key = null;
+    public Iterator<ReadableObjectId.Referring> referringProperties(){ return null; }
+    public Object item = null;
+    public Object resolve(){ return null; }
+    public ObjectIdGenerator.IdKey getKey(){ return null; }
+    public ObjectIdResolver getResolver(){ return null; }
+    public ReadableObjectId(Object p0){}
+    public ReadableObjectId(ObjectIdGenerator.IdKey p0){}
+    public String toString(){ return null; }
+    public boolean hasReferringProperties(){ return false; }
+    public boolean tryToResolveUnresolved(DeserializationContext p0){ return false; }
+    public final Object id = null;
+    public void appendReferring(ReadableObjectId.Referring p0){}
+    public void bindItem(Object p0){}
+    public void setResolver(ObjectIdResolver p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/impl/ValueInjector.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/impl/ValueInjector.java
new file mode 100644
index 00000000000..a14ad550d49
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/deser/impl/ValueInjector.java
@@ -0,0 +1,20 @@
+// Generated automatically from com.fasterxml.jackson.databind.deser.impl.ValueInjector for testing purposes
+
+package com.fasterxml.jackson.databind.deser.impl;
+
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.util.Annotations;
+
+public class ValueInjector extends BeanProperty.Std
+{
+    protected ValueInjector() {}
+    protected final Object _valueId = null;
+    public Object findValue(DeserializationContext p0, Object p1){ return null; }
+    public ValueInjector(PropertyName p0, JavaType p1, Annotations p2, AnnotatedMember p3, Object p4){}
+    public ValueInjector(String p0, JavaType p1, Annotations p2, AnnotatedMember p3, Object p4){}
+    public void inject(DeserializationContext p0, Object p1){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/Annotated.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/Annotated.java
new file mode 100644
index 00000000000..e18ed3c97a7
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/Annotated.java
@@ -0,0 +1,33 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.Annotated for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.introspect.AnnotationMap;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+import java.lang.annotation.Annotation;
+import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Type;
+
+abstract public class Annotated
+{
+    protected Annotated(){}
+    protected abstract AnnotationMap getAllAnnotations();
+    protected abstract int getModifiers();
+    public Type getGenericType(){ return null; }
+    public abstract <A extends Annotation> A getAnnotation(Class<A> p0);
+    public abstract Annotated withAnnotations(AnnotationMap p0);
+    public abstract AnnotatedElement getAnnotated();
+    public abstract Class<? extends Object> getRawType();
+    public abstract Iterable<Annotation> annotations();
+    public abstract JavaType getType();
+    public abstract String getName();
+    public abstract String toString();
+    public abstract boolean equals(Object p0);
+    public abstract boolean hasAnnotation(Class<? extends Object> p0);
+    public abstract boolean hasOneOf(Class<? extends Annotation>[] p0);
+    public abstract int hashCode();
+    public final Annotated withFallBackAnnotationsFrom(Annotated p0){ return null; }
+    public final JavaType getType(TypeBindings p0){ return null; }
+    public final boolean isPublic(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedClass.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedClass.java
new file mode 100644
index 00000000000..fa585c363cb
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedClass.java
@@ -0,0 +1,96 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.AnnotatedClass for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import com.fasterxml.jackson.databind.introspect.AnnotatedConstructor;
+import com.fasterxml.jackson.databind.introspect.AnnotatedField;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMethod;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMethodMap;
+import com.fasterxml.jackson.databind.introspect.AnnotationMap;
+import com.fasterxml.jackson.databind.introspect.ClassIntrospector;
+import com.fasterxml.jackson.databind.introspect.TypeResolutionContext;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import com.fasterxml.jackson.databind.util.Annotations;
+import com.fasterxml.jackson.databind.util.ClassUtil;
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.lang.reflect.Type;
+import java.util.List;
+import java.util.Map;
+
+public class AnnotatedClass extends Annotated implements TypeResolutionContext
+{
+    protected AnnotatedClass() {}
+    protected AnnotatedConstructor _constructDefaultConstructor(ClassUtil.Ctor p0, TypeResolutionContext p1){ return null; }
+    protected AnnotatedConstructor _constructNonDefaultConstructor(ClassUtil.Ctor p0, TypeResolutionContext p1){ return null; }
+    protected AnnotatedConstructor _defaultConstructor = null;
+    protected AnnotatedField _constructField(Field p0, TypeResolutionContext p1){ return null; }
+    protected AnnotatedMethod _constructCreatorMethod(Method p0, TypeResolutionContext p1){ return null; }
+    protected AnnotatedMethod _constructMethod(Method p0, TypeResolutionContext p1){ return null; }
+    protected AnnotatedMethodMap _memberMethods = null;
+    protected AnnotationMap _classAnnotations = null;
+    protected AnnotationMap _collectRelevantAnnotations(Annotation[] p0){ return null; }
+    protected AnnotationMap getAllAnnotations(){ return null; }
+    protected AnnotationMap[] _collectRelevantAnnotations(Annotation[][] p0){ return null; }
+    protected List<AnnotatedConstructor> _constructors = null;
+    protected List<AnnotatedField> _fields = null;
+    protected List<AnnotatedMethod> _creatorMethods = null;
+    protected Map<String, AnnotatedField> _findFields(JavaType p0, TypeResolutionContext p1, Map<String, AnnotatedField> p2){ return null; }
+    protected Method[] _findClassMethods(Class<? extends Object> p0){ return null; }
+    protected boolean _creatorsResolved = false;
+    protected boolean _isIncludableMemberMethod(Method p0){ return false; }
+    protected final AnnotationIntrospector _annotationIntrospector = null;
+    protected final Class<? extends Object> _class = null;
+    protected final Class<? extends Object> _primaryMixIn = null;
+    protected final ClassIntrospector.MixInResolver _mixInResolver = null;
+    protected final JavaType _type = null;
+    protected final List<JavaType> _superTypes = null;
+    protected final TypeBindings _bindings = null;
+    protected final TypeFactory _typeFactory = null;
+    protected void _addClassMixIns(AnnotationMap p0, Class<? extends Object> p1){}
+    protected void _addClassMixIns(AnnotationMap p0, Class<? extends Object> p1, Class<? extends Object> p2){}
+    protected void _addClassMixIns(AnnotationMap p0, JavaType p1){}
+    protected void _addConstructorMixIns(Class<? extends Object> p0){}
+    protected void _addFactoryMixIns(Class<? extends Object> p0){}
+    protected void _addFieldMixIns(Class<? extends Object> p0, Class<? extends Object> p1, Map<String, AnnotatedField> p2){}
+    protected void _addMemberMethods(Class<? extends Object> p0, TypeResolutionContext p1, AnnotatedMethodMap p2, Class<? extends Object> p3, AnnotatedMethodMap p4){}
+    protected void _addMethodMixIns(Class<? extends Object> p0, AnnotatedMethodMap p1, Class<? extends Object> p2, AnnotatedMethodMap p3){}
+    protected void _addMixOvers(Constructor<? extends Object> p0, AnnotatedConstructor p1, boolean p2){}
+    protected void _addMixOvers(Method p0, AnnotatedMethod p1, boolean p2){}
+    protected void _addMixUnders(Method p0, AnnotatedMethod p1){}
+    public <A extends Annotation> A getAnnotation(Class<A> p0){ return null; }
+    public AnnotatedClass withAnnotations(AnnotationMap p0){ return null; }
+    public AnnotatedConstructor getDefaultConstructor(){ return null; }
+    public AnnotatedMethod findMethod(String p0, Class<? extends Object>[] p1){ return null; }
+    public Annotations getAnnotations(){ return null; }
+    public Class<? extends Object> getAnnotated(){ return null; }
+    public Class<? extends Object> getRawType(){ return null; }
+    public Iterable<AnnotatedField> fields(){ return null; }
+    public Iterable<AnnotatedMethod> memberMethods(){ return null; }
+    public Iterable<Annotation> annotations(){ return null; }
+    public JavaType getType(){ return null; }
+    public JavaType resolveType(Type p0){ return null; }
+    public List<AnnotatedConstructor> getConstructors(){ return null; }
+    public List<AnnotatedMethod> getStaticMethods(){ return null; }
+    public String getName(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean hasAnnotation(Class<? extends Object> p0){ return false; }
+    public boolean hasAnnotations(){ return false; }
+    public boolean hasOneOf(Class<? extends Annotation>[] p0){ return false; }
+    public int getFieldCount(){ return 0; }
+    public int getMemberMethodCount(){ return 0; }
+    public int getModifiers(){ return 0; }
+    public int hashCode(){ return 0; }
+    public static AnnotatedClass construct(JavaType p0, MapperConfig<? extends Object> p1){ return null; }
+    public static AnnotatedClass construct(JavaType p0, MapperConfig<? extends Object> p1, ClassIntrospector.MixInResolver p2){ return null; }
+    public static AnnotatedClass constructWithoutSuperTypes(Class<? extends Object> p0, MapperConfig<? extends Object> p1){ return null; }
+    public static AnnotatedClass constructWithoutSuperTypes(Class<? extends Object> p0, MapperConfig<? extends Object> p1, ClassIntrospector.MixInResolver p2){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedConstructor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedConstructor.java
new file mode 100644
index 00000000000..892ed1a55cf
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedConstructor.java
@@ -0,0 +1,106 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.AnnotatedConstructor for
+// testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.introspect.AnnotatedWithParams;
+import com.fasterxml.jackson.databind.introspect.AnnotationMap;
+import com.fasterxml.jackson.databind.introspect.TypeResolutionContext;
+import java.io.Serializable;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Member;
+import java.lang.reflect.Type;
+
+public class AnnotatedConstructor extends AnnotatedWithParams {
+    protected AnnotatedConstructor() {}
+
+    protected AnnotatedConstructor(AnnotatedConstructor.Serialization p0) {}
+
+    protected AnnotatedConstructor.Serialization _serialization = null;
+    protected final Constructor<? extends Object> _constructor = null;
+
+    public AnnotatedConstructor withAnnotations(AnnotationMap p0) {
+        return null;
+    }
+
+    public AnnotatedConstructor(TypeResolutionContext p0, Constructor<? extends Object> p1,
+            AnnotationMap p2, AnnotationMap[] p3) {}
+
+    public Class<? extends Object> getDeclaringClass() {
+        return null;
+    }
+
+    public Class<? extends Object> getRawParameterType(int p0) {
+        return null;
+    }
+
+    public Class<? extends Object> getRawType() {
+        return null;
+    }
+
+    public Constructor<? extends Object> getAnnotated() {
+        return null;
+    }
+
+    public JavaType getParameterType(int p0) {
+        return null;
+    }
+
+    public JavaType getType() {
+        return null;
+    }
+
+    public Member getMember() {
+        return null;
+    }
+
+    public Object getValue(Object p0) {
+        return null;
+    }
+
+    public String getName() {
+        return null;
+    }
+
+    public String toString() {
+        return null;
+    }
+
+    public Type getGenericParameterType(int p0) {
+        return null;
+    }
+
+    public boolean equals(Object p0) {
+        return false;
+    }
+
+    public final Object call() {
+        return null;
+    }
+
+    public final Object call(Object[] p0) {
+        return null;
+    }
+
+    public final Object call1(Object p0) {
+        return null;
+    }
+
+    public int getModifiers() {
+        return 0;
+    }
+
+    public int getParameterCount() {
+        return 0;
+    }
+
+    public int hashCode() {
+        return 0;
+    }
+
+    public void setValue(Object p0, Object p1) {}
+
+    class Serialization {
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedField.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedField.java
new file mode 100644
index 00000000000..df1f86bc202
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedField.java
@@ -0,0 +1,93 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.AnnotatedField for testing
+// purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.introspect.AnnotationMap;
+import com.fasterxml.jackson.databind.introspect.TypeResolutionContext;
+import java.io.Serializable;
+import java.lang.reflect.Field;
+import java.lang.reflect.Member;
+import java.lang.reflect.Type;
+
+public class AnnotatedField extends AnnotatedMember implements Serializable {
+    protected AnnotatedField() {}
+
+    protected AnnotatedField(AnnotatedField.Serialization p0) {}
+
+    protected AnnotatedField.Serialization _serialization = null;
+    protected final Field _field = null;
+
+    public AnnotatedField withAnnotations(AnnotationMap p0) {
+        return null;
+    }
+
+    public AnnotatedField(TypeResolutionContext p0, Field p1, AnnotationMap p2) {}
+
+    public Class<? extends Object> getDeclaringClass() {
+        return null;
+    }
+
+    public Class<? extends Object> getRawType() {
+        return null;
+    }
+
+    public Field getAnnotated() {
+        return null;
+    }
+
+    public JavaType getType() {
+        return null;
+    }
+
+    public Member getMember() {
+        return null;
+    }
+
+    public Object getValue(Object p0) {
+        return null;
+    }
+
+    public String getFullName() {
+        return null;
+    }
+
+    public String getName() {
+        return null;
+    }
+
+    public String toString() {
+        return null;
+    }
+
+    public Type getGenericType() {
+        return null;
+    }
+
+    public boolean equals(Object p0) {
+        return false;
+    }
+
+    public boolean isTransient() {
+        return false;
+    }
+
+    public int getAnnotationCount() {
+        return 0;
+    }
+
+    public int getModifiers() {
+        return 0;
+    }
+
+    public int hashCode() {
+        return 0;
+    }
+
+    public void setValue(Object p0, Object p1) {}
+
+    class Serialization {
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedMember.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedMember.java
new file mode 100644
index 00000000000..011f95572ae
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedMember.java
@@ -0,0 +1,33 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.AnnotatedMember for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import com.fasterxml.jackson.databind.introspect.AnnotationMap;
+import com.fasterxml.jackson.databind.introspect.TypeResolutionContext;
+import java.io.Serializable;
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Member;
+
+abstract public class AnnotatedMember extends Annotated implements Serializable
+{
+    protected AnnotatedMember() {}
+    protected AnnotatedMember(AnnotatedMember p0){}
+    protected AnnotatedMember(TypeResolutionContext p0, AnnotationMap p1){}
+    protected AnnotationMap getAllAnnotations(){ return null; }
+    protected final AnnotationMap _annotations = null;
+    protected final TypeResolutionContext _typeContext = null;
+    public Iterable<Annotation> annotations(){ return null; }
+    public TypeResolutionContext getTypeContext(){ return null; }
+    public abstract Class<? extends Object> getDeclaringClass();
+    public abstract Member getMember();
+    public abstract Object getValue(Object p0);
+    public abstract void setValue(Object p0, Object p1);
+    public boolean hasOneOf(Class<? extends Annotation>[] p0){ return false; }
+    public final <A extends Annotation> A getAnnotation(Class<A> p0){ return null; }
+    public final boolean addIfNotPresent(Annotation p0){ return false; }
+    public final boolean addOrOverride(Annotation p0){ return false; }
+    public final boolean hasAnnotation(Class<? extends Object> p0){ return false; }
+    public final void fixAccess(){}
+    public final void fixAccess(boolean p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedMethod.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedMethod.java
new file mode 100644
index 00000000000..1088121d27d
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedMethod.java
@@ -0,0 +1,134 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.AnnotatedMethod for
+// testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.introspect.AnnotatedWithParams;
+import com.fasterxml.jackson.databind.introspect.AnnotationMap;
+import com.fasterxml.jackson.databind.introspect.TypeResolutionContext;
+import java.io.Serializable;
+import java.lang.reflect.Method;
+import java.lang.reflect.Type;
+
+public class AnnotatedMethod extends AnnotatedWithParams implements Serializable {
+    protected AnnotatedMethod() {}
+
+    protected AnnotatedMethod(AnnotatedMethod.Serialization p0) {}
+
+    protected AnnotatedMethod.Serialization _serialization = null;
+    protected Class<? extends Object>[] _paramClasses = null;
+    protected final Method _method = null;
+
+    public AnnotatedMethod withAnnotations(AnnotationMap p0) {
+        return null;
+    }
+
+    public AnnotatedMethod withMethod(Method p0) {
+        return null;
+    }
+
+    public AnnotatedMethod(TypeResolutionContext p0, Method p1, AnnotationMap p2,
+            AnnotationMap[] p3) {}
+
+    public Class<? extends Object> getDeclaringClass() {
+        return null;
+    }
+
+    public Class<? extends Object> getRawParameterType(int p0) {
+        return null;
+    }
+
+    public Class<? extends Object> getRawReturnType() {
+        return null;
+    }
+
+    public Class<? extends Object> getRawType() {
+        return null;
+    }
+
+    public Class<? extends Object>[] getRawParameterTypes() {
+        return null;
+    }
+
+    public JavaType getParameterType(int p0) {
+        return null;
+    }
+
+    public JavaType getType() {
+        return null;
+    }
+
+    public Method getAnnotated() {
+        return null;
+    }
+
+    public Method getMember() {
+        return null;
+    }
+
+    public Object getValue(Object p0) {
+        return null;
+    }
+
+    public String getFullName() {
+        return null;
+    }
+
+    public String getName() {
+        return null;
+    }
+
+    public String toString() {
+        return null;
+    }
+
+    public Type getGenericParameterType(int p0) {
+        return null;
+    }
+
+    public Type getGenericType() {
+        return null;
+    }
+
+    public Type[] getGenericParameterTypes() {
+        return null;
+    }
+
+    public boolean equals(Object p0) {
+        return false;
+    }
+
+    public boolean hasReturnType() {
+        return false;
+    }
+
+    public final Object call() {
+        return null;
+    }
+
+    public final Object call(Object[] p0) {
+        return null;
+    }
+
+    public final Object call1(Object p0) {
+        return null;
+    }
+
+    public int getModifiers() {
+        return 0;
+    }
+
+    public int getParameterCount() {
+        return 0;
+    }
+
+    public int hashCode() {
+        return 0;
+    }
+
+    public void setValue(Object p0, Object p1) {}
+
+    class Serialization {
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedMethodMap.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedMethodMap.java
new file mode 100644
index 00000000000..f0a3c727703
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedMethodMap.java
@@ -0,0 +1,23 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.AnnotatedMethodMap for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.introspect.AnnotatedMethod;
+import com.fasterxml.jackson.databind.introspect.MemberKey;
+import java.lang.reflect.Method;
+import java.util.Iterator;
+import java.util.LinkedHashMap;
+
+public class AnnotatedMethodMap implements Iterable<AnnotatedMethod>
+{
+    protected LinkedHashMap<MemberKey, AnnotatedMethod> _methods = null;
+    public AnnotatedMethod find(Method p0){ return null; }
+    public AnnotatedMethod find(String p0, Class<? extends Object>[] p1){ return null; }
+    public AnnotatedMethod remove(AnnotatedMethod p0){ return null; }
+    public AnnotatedMethod remove(Method p0){ return null; }
+    public AnnotatedMethodMap(){}
+    public Iterator<AnnotatedMethod> iterator(){ return null; }
+    public boolean isEmpty(){ return false; }
+    public int size(){ return 0; }
+    public void add(AnnotatedMethod p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedParameter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedParameter.java
new file mode 100644
index 00000000000..ef3e28c0df3
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedParameter.java
@@ -0,0 +1,37 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.AnnotatedParameter for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.introspect.AnnotatedWithParams;
+import com.fasterxml.jackson.databind.introspect.AnnotationMap;
+import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Member;
+import java.lang.reflect.Type;
+
+public class AnnotatedParameter extends AnnotatedMember
+{
+    protected AnnotatedParameter() {}
+    protected final AnnotatedWithParams _owner = null;
+    protected final JavaType _type = null;
+    protected final int _index = 0;
+    public AnnotatedElement getAnnotated(){ return null; }
+    public AnnotatedParameter withAnnotations(AnnotationMap p0){ return null; }
+    public AnnotatedParameter(AnnotatedWithParams p0, JavaType p1, AnnotationMap p2, int p3){}
+    public AnnotatedWithParams getOwner(){ return null; }
+    public Class<? extends Object> getDeclaringClass(){ return null; }
+    public Class<? extends Object> getRawType(){ return null; }
+    public JavaType getType(){ return null; }
+    public Member getMember(){ return null; }
+    public Object getValue(Object p0){ return null; }
+    public String getName(){ return null; }
+    public String toString(){ return null; }
+    public Type getGenericType(){ return null; }
+    public Type getParameterType(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int getIndex(){ return 0; }
+    public int getModifiers(){ return 0; }
+    public int hashCode(){ return 0; }
+    public void setValue(Object p0, Object p1){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedWithParams.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedWithParams.java
new file mode 100644
index 00000000000..62e19ecfb65
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotatedWithParams.java
@@ -0,0 +1,30 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.AnnotatedWithParams for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.introspect.AnnotatedParameter;
+import com.fasterxml.jackson.databind.introspect.AnnotationMap;
+import com.fasterxml.jackson.databind.introspect.TypeResolutionContext;
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Type;
+
+abstract public class AnnotatedWithParams extends AnnotatedMember
+{
+    protected AnnotatedWithParams() {}
+    protected AnnotatedParameter replaceParameterAnnotations(int p0, AnnotationMap p1){ return null; }
+    protected AnnotatedWithParams(TypeResolutionContext p0, AnnotationMap p1, AnnotationMap[] p2){}
+    protected final AnnotationMap[] _paramAnnotations = null;
+    public abstract Class<? extends Object> getRawParameterType(int p0);
+    public abstract JavaType getParameterType(int p0);
+    public abstract Object call();
+    public abstract Object call(Object[] p0);
+    public abstract Object call1(Object p0);
+    public abstract Type getGenericParameterType(int p0);
+    public abstract int getParameterCount();
+    public final AnnotatedParameter getParameter(int p0){ return null; }
+    public final AnnotationMap getParameterAnnotations(int p0){ return null; }
+    public final int getAnnotationCount(){ return 0; }
+    public final void addOrOverrideParam(int p0, Annotation p1){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotationMap.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotationMap.java
new file mode 100644
index 00000000000..c3248668f24
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/AnnotationMap.java
@@ -0,0 +1,23 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.AnnotationMap for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.util.Annotations;
+import java.lang.annotation.Annotation;
+import java.util.HashMap;
+
+public class AnnotationMap implements Annotations
+{
+    protected HashMap<Class<? extends Object>, Annotation> _annotations = null;
+    protected final boolean _add(Annotation p0){ return false; }
+    public <A extends Annotation> A get(Class<A> p0){ return null; }
+    public AnnotationMap(){}
+    public Iterable<Annotation> annotations(){ return null; }
+    public String toString(){ return null; }
+    public boolean add(Annotation p0){ return false; }
+    public boolean addIfNotPresent(Annotation p0){ return false; }
+    public boolean has(Class<? extends Object> p0){ return false; }
+    public boolean hasOneOf(Class<? extends Annotation>[] p0){ return false; }
+    public int size(){ return 0; }
+    public static AnnotationMap merge(AnnotationMap p0, AnnotationMap p1){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/BeanPropertyDefinition.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/BeanPropertyDefinition.java
new file mode 100644
index 00000000000..3bc6beeaaa8
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/BeanPropertyDefinition.java
@@ -0,0 +1,52 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.BeanPropertyDefinition for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.PropertyMetadata;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.introspect.AnnotatedField;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMethod;
+import com.fasterxml.jackson.databind.introspect.AnnotatedParameter;
+import com.fasterxml.jackson.databind.introspect.ObjectIdInfo;
+import com.fasterxml.jackson.databind.util.Named;
+import java.util.Iterator;
+
+abstract public class BeanPropertyDefinition implements Named
+{
+    protected static JsonInclude.Value EMPTY_INCLUDE = null;
+    public AnnotationIntrospector.ReferenceProperty findReferenceType(){ return null; }
+    public BeanPropertyDefinition(){}
+    public Class<? extends Object>[] findViews(){ return null; }
+    public Iterator<AnnotatedParameter> getConstructorParameters(){ return null; }
+    public JsonInclude.Value findInclusion(){ return null; }
+    public ObjectIdInfo findObjectIdInfo(){ return null; }
+    public abstract AnnotatedField getField();
+    public abstract AnnotatedMember getAccessor();
+    public abstract AnnotatedMember getMutator();
+    public abstract AnnotatedMember getNonConstructorMutator();
+    public abstract AnnotatedMember getPrimaryMember();
+    public abstract AnnotatedMethod getGetter();
+    public abstract AnnotatedMethod getSetter();
+    public abstract AnnotatedParameter getConstructorParameter();
+    public abstract BeanPropertyDefinition withName(PropertyName p0);
+    public abstract BeanPropertyDefinition withSimpleName(String p0);
+    public abstract PropertyMetadata getMetadata();
+    public abstract PropertyName getFullName();
+    public abstract PropertyName getWrapperName();
+    public abstract String getInternalName();
+    public abstract String getName();
+    public abstract boolean hasConstructorParameter();
+    public abstract boolean hasField();
+    public abstract boolean hasGetter();
+    public abstract boolean hasSetter();
+    public abstract boolean isExplicitlyIncluded();
+    public boolean couldDeserialize(){ return false; }
+    public boolean couldSerialize(){ return false; }
+    public boolean hasName(PropertyName p0){ return false; }
+    public boolean isExplicitlyNamed(){ return false; }
+    public boolean isRequired(){ return false; }
+    public boolean isTypeId(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/ClassIntrospector.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/ClassIntrospector.java
new file mode 100644
index 00000000000..88749923326
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/ClassIntrospector.java
@@ -0,0 +1,25 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.ClassIntrospector for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+
+abstract public class ClassIntrospector
+{
+    protected ClassIntrospector(){}
+    public abstract BeanDescription forClassAnnotations(MapperConfig<? extends Object> p0, JavaType p1, ClassIntrospector.MixInResolver p2);
+    public abstract BeanDescription forCreation(DeserializationConfig p0, JavaType p1, ClassIntrospector.MixInResolver p2);
+    public abstract BeanDescription forDeserialization(DeserializationConfig p0, JavaType p1, ClassIntrospector.MixInResolver p2);
+    public abstract BeanDescription forDeserializationWithBuilder(DeserializationConfig p0, JavaType p1, ClassIntrospector.MixInResolver p2);
+    public abstract BeanDescription forDirectClassAnnotations(MapperConfig<? extends Object> p0, JavaType p1, ClassIntrospector.MixInResolver p2);
+    public abstract BeanDescription forSerialization(SerializationConfig p0, JavaType p1, ClassIntrospector.MixInResolver p2);
+    static public interface MixInResolver
+    {
+        Class<? extends Object> findMixInClassFor(Class<? extends Object> p0);
+        ClassIntrospector.MixInResolver copy();
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/ConcreteBeanPropertyBase.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/ConcreteBeanPropertyBase.java
new file mode 100644
index 00000000000..d832ef33917
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/ConcreteBeanPropertyBase.java
@@ -0,0 +1,26 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.ConcreteBeanPropertyBase for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.PropertyMetadata;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import java.io.Serializable;
+
+abstract public class ConcreteBeanPropertyBase implements BeanProperty, Serializable
+{
+    protected ConcreteBeanPropertyBase() {}
+    protected ConcreteBeanPropertyBase(ConcreteBeanPropertyBase p0){}
+    protected ConcreteBeanPropertyBase(PropertyMetadata p0){}
+    protected JsonFormat.Value _format = null;
+    protected final PropertyMetadata _metadata = null;
+    public JsonFormat.Value findPropertyFormat(MapperConfig<? extends Object> p0, Class<? extends Object> p1){ return null; }
+    public JsonInclude.Value findPropertyInclusion(MapperConfig<? extends Object> p0, Class<? extends Object> p1){ return null; }
+    public PropertyMetadata getMetadata(){ return null; }
+    public boolean isRequired(){ return false; }
+    public boolean isVirtual(){ return false; }
+    public final JsonFormat.Value findFormatOverrides(AnnotationIntrospector p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/MemberKey.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/MemberKey.java
new file mode 100644
index 00000000000..9b14e4b27da
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/MemberKey.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.MemberKey for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Method;
+
+public class MemberKey
+{
+    protected MemberKey() {}
+    public MemberKey(Constructor<? extends Object> p0){}
+    public MemberKey(Method p0){}
+    public MemberKey(String p0, Class<? extends Object>[] p1){}
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/ObjectIdInfo.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/ObjectIdInfo.java
new file mode 100644
index 00000000000..0941b7af730
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/ObjectIdInfo.java
@@ -0,0 +1,30 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.ObjectIdInfo for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.annotation.ObjectIdResolver;
+import com.fasterxml.jackson.databind.PropertyName;
+
+public class ObjectIdInfo
+{
+    protected ObjectIdInfo() {}
+    protected ObjectIdInfo(PropertyName p0, Class<? extends Object> p1, Class<? extends ObjectIdGenerator<? extends Object>> p2, boolean p3){}
+    protected ObjectIdInfo(PropertyName p0, Class<? extends Object> p1, Class<? extends ObjectIdGenerator<? extends Object>> p2, boolean p3, Class<? extends ObjectIdResolver> p4){}
+    protected final Class<? extends Object> _scope = null;
+    protected final Class<? extends ObjectIdGenerator<? extends Object>> _generator = null;
+    protected final Class<? extends ObjectIdResolver> _resolver = null;
+    protected final PropertyName _propertyName = null;
+    protected final boolean _alwaysAsId = false;
+    public Class<? extends Object> getScope(){ return null; }
+    public Class<? extends ObjectIdGenerator<? extends Object>> getGeneratorType(){ return null; }
+    public Class<? extends ObjectIdResolver> getResolverType(){ return null; }
+    public ObjectIdInfo withAlwaysAsId(boolean p0){ return null; }
+    public ObjectIdInfo(PropertyName p0, Class<? extends Object> p1, Class<? extends ObjectIdGenerator<? extends Object>> p2){}
+    public ObjectIdInfo(PropertyName p0, Class<? extends Object> p1, Class<? extends ObjectIdGenerator<? extends Object>> p2, Class<? extends ObjectIdResolver> p3){}
+    public ObjectIdInfo(String p0, Class<? extends Object> p1, Class<? extends ObjectIdGenerator<? extends Object>> p2){}
+    public PropertyName getPropertyName(){ return null; }
+    public String toString(){ return null; }
+    public boolean getAlwaysAsId(){ return false; }
+    public static ObjectIdInfo empty(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/SimpleMixInResolver.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/SimpleMixInResolver.java
new file mode 100644
index 00000000000..3dd599ee4b3
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/SimpleMixInResolver.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.SimpleMixInResolver for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.introspect.ClassIntrospector;
+import com.fasterxml.jackson.databind.type.ClassKey;
+import java.io.Serializable;
+import java.util.Map;
+
+public class SimpleMixInResolver implements ClassIntrospector.MixInResolver, Serializable
+{
+    protected SimpleMixInResolver() {}
+    protected Map<ClassKey, Class<? extends Object>> _localMixIns = null;
+    protected SimpleMixInResolver(ClassIntrospector.MixInResolver p0, Map<ClassKey, Class<? extends Object>> p1){}
+    protected final ClassIntrospector.MixInResolver _overrides = null;
+    public Class<? extends Object> findMixInClassFor(Class<? extends Object> p0){ return null; }
+    public SimpleMixInResolver copy(){ return null; }
+    public SimpleMixInResolver withOverrides(ClassIntrospector.MixInResolver p0){ return null; }
+    public SimpleMixInResolver withoutLocalDefinitions(){ return null; }
+    public SimpleMixInResolver(ClassIntrospector.MixInResolver p0){}
+    public int localSize(){ return 0; }
+    public void addLocalDefinition(Class<? extends Object> p0, Class<? extends Object> p1){}
+    public void setLocalDefinitions(Map<Class<? extends Object>, Class<? extends Object>> p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/TypeResolutionContext.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/TypeResolutionContext.java
new file mode 100644
index 00000000000..f0f5ee3f3d0
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/TypeResolutionContext.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.TypeResolutionContext for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.databind.JavaType;
+import java.lang.reflect.Type;
+
+public interface TypeResolutionContext
+{
+    JavaType resolveType(Type p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/VisibilityChecker.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/VisibilityChecker.java
new file mode 100644
index 00000000000..9244c258a4f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/introspect/VisibilityChecker.java
@@ -0,0 +1,34 @@
+// Generated automatically from com.fasterxml.jackson.databind.introspect.VisibilityChecker for testing purposes
+
+package com.fasterxml.jackson.databind.introspect;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.PropertyAccessor;
+import com.fasterxml.jackson.databind.introspect.AnnotatedField;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMethod;
+import java.lang.reflect.Field;
+import java.lang.reflect.Member;
+import java.lang.reflect.Method;
+
+public interface VisibilityChecker<T extends VisibilityChecker<T>>
+{
+    T with(JsonAutoDetect p0);
+    T with(JsonAutoDetect.Visibility p0);
+    T withCreatorVisibility(JsonAutoDetect.Visibility p0);
+    T withFieldVisibility(JsonAutoDetect.Visibility p0);
+    T withGetterVisibility(JsonAutoDetect.Visibility p0);
+    T withIsGetterVisibility(JsonAutoDetect.Visibility p0);
+    T withSetterVisibility(JsonAutoDetect.Visibility p0);
+    T withVisibility(PropertyAccessor p0, JsonAutoDetect.Visibility p1);
+    boolean isCreatorVisible(AnnotatedMember p0);
+    boolean isCreatorVisible(Member p0);
+    boolean isFieldVisible(AnnotatedField p0);
+    boolean isFieldVisible(Field p0);
+    boolean isGetterVisible(AnnotatedMethod p0);
+    boolean isGetterVisible(Method p0);
+    boolean isIsGetterVisible(AnnotatedMethod p0);
+    boolean isIsGetterVisible(Method p0);
+    boolean isSetterVisible(AnnotatedMethod p0);
+    boolean isSetterVisible(Method p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonAnyFormatVisitor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonAnyFormatVisitor.java
new file mode 100644
index 00000000000..da3b7f2f22d
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonAnyFormatVisitor.java
@@ -0,0 +1,8 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonAnyFormatVisitor for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+
+public interface JsonAnyFormatVisitor
+{
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonArrayFormatVisitor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonArrayFormatVisitor.java
new file mode 100644
index 00000000000..e791667914e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonArrayFormatVisitor.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonArrayFormatVisitor for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatTypes;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitable;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWithSerializerProvider;
+
+public interface JsonArrayFormatVisitor extends JsonFormatVisitorWithSerializerProvider
+{
+    void itemsFormat(JsonFormatTypes p0);
+    void itemsFormat(JsonFormatVisitable p0, JavaType p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonBooleanFormatVisitor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonBooleanFormatVisitor.java
new file mode 100644
index 00000000000..38854cb135d
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonBooleanFormatVisitor.java
@@ -0,0 +1,9 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonBooleanFormatVisitor for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonValueFormatVisitor;
+
+public interface JsonBooleanFormatVisitor extends JsonValueFormatVisitor
+{
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatTypes.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatTypes.java
new file mode 100644
index 00000000000..6591d808006
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatTypes.java
@@ -0,0 +1,12 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatTypes for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+
+public enum JsonFormatTypes
+{
+    ANY, ARRAY, BOOLEAN, INTEGER, NULL, NUMBER, OBJECT, STRING;
+    private JsonFormatTypes() {}
+    public String value(){ return null; }
+    public static JsonFormatTypes forValue(String p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatVisitable.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatVisitable.java
new file mode 100644
index 00000000000..ac87e40983e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatVisitable.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitable for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper;
+
+public interface JsonFormatVisitable
+{
+    void acceptJsonFormatVisitor(JsonFormatVisitorWrapper p0, JavaType p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatVisitorWithSerializerProvider.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatVisitorWithSerializerProvider.java
new file mode 100644
index 00000000000..67497732cec
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatVisitorWithSerializerProvider.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWithSerializerProvider for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.databind.SerializerProvider;
+
+public interface JsonFormatVisitorWithSerializerProvider
+{
+    SerializerProvider getProvider();
+    void setProvider(SerializerProvider p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatVisitorWrapper.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatVisitorWrapper.java
new file mode 100644
index 00000000000..8f98974070c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonFormatVisitorWrapper.java
@@ -0,0 +1,28 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonAnyFormatVisitor;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonArrayFormatVisitor;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonBooleanFormatVisitor;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWithSerializerProvider;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonIntegerFormatVisitor;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonMapFormatVisitor;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonNullFormatVisitor;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonNumberFormatVisitor;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonObjectFormatVisitor;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonStringFormatVisitor;
+
+public interface JsonFormatVisitorWrapper extends JsonFormatVisitorWithSerializerProvider
+{
+    JsonAnyFormatVisitor expectAnyFormat(JavaType p0);
+    JsonArrayFormatVisitor expectArrayFormat(JavaType p0);
+    JsonBooleanFormatVisitor expectBooleanFormat(JavaType p0);
+    JsonIntegerFormatVisitor expectIntegerFormat(JavaType p0);
+    JsonMapFormatVisitor expectMapFormat(JavaType p0);
+    JsonNullFormatVisitor expectNullFormat(JavaType p0);
+    JsonNumberFormatVisitor expectNumberFormat(JavaType p0);
+    JsonObjectFormatVisitor expectObjectFormat(JavaType p0);
+    JsonStringFormatVisitor expectStringFormat(JavaType p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonIntegerFormatVisitor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonIntegerFormatVisitor.java
new file mode 100644
index 00000000000..bc8406c652d
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonIntegerFormatVisitor.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonIntegerFormatVisitor for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonValueFormatVisitor;
+
+public interface JsonIntegerFormatVisitor extends JsonValueFormatVisitor
+{
+    void numberType(JsonParser.NumberType p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonMapFormatVisitor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonMapFormatVisitor.java
new file mode 100644
index 00000000000..758c5f9dd5c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonMapFormatVisitor.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonMapFormatVisitor for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitable;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWithSerializerProvider;
+
+public interface JsonMapFormatVisitor extends JsonFormatVisitorWithSerializerProvider
+{
+    void keyFormat(JsonFormatVisitable p0, JavaType p1);
+    void valueFormat(JsonFormatVisitable p0, JavaType p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonNullFormatVisitor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonNullFormatVisitor.java
new file mode 100644
index 00000000000..3c991efc44e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonNullFormatVisitor.java
@@ -0,0 +1,8 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonNullFormatVisitor for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+
+public interface JsonNullFormatVisitor
+{
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonNumberFormatVisitor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonNumberFormatVisitor.java
new file mode 100644
index 00000000000..be649ff7ef4
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonNumberFormatVisitor.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonNumberFormatVisitor for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonValueFormatVisitor;
+
+public interface JsonNumberFormatVisitor extends JsonValueFormatVisitor
+{
+    void numberType(JsonParser.NumberType p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonObjectFormatVisitor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonObjectFormatVisitor.java
new file mode 100644
index 00000000000..e3f43497249
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonObjectFormatVisitor.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonObjectFormatVisitor for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitable;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWithSerializerProvider;
+
+public interface JsonObjectFormatVisitor extends JsonFormatVisitorWithSerializerProvider
+{
+    void optionalProperty(BeanProperty p0);
+    void optionalProperty(String p0, JsonFormatVisitable p1, JavaType p2);
+    void property(BeanProperty p0);
+    void property(String p0, JsonFormatVisitable p1, JavaType p2);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonStringFormatVisitor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonStringFormatVisitor.java
new file mode 100644
index 00000000000..bd74135e0e7
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonStringFormatVisitor.java
@@ -0,0 +1,9 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonStringFormatVisitor for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonValueFormatVisitor;
+
+public interface JsonStringFormatVisitor extends JsonValueFormatVisitor
+{
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonValueFormat.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonValueFormat.java
new file mode 100644
index 00000000000..594b2d7c643
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonValueFormat.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonValueFormat for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+
+public enum JsonValueFormat
+{
+    COLOR, DATE, DATE_TIME, EMAIL, HOST_NAME, IPV6, IP_ADDRESS, PHONE, REGEX, STYLE, TIME, URI, UTC_MILLISEC;
+    private JsonValueFormat() {}
+    public String toString(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonValueFormatVisitor.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonValueFormatVisitor.java
new file mode 100644
index 00000000000..229c1442f92
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonFormatVisitors/JsonValueFormatVisitor.java
@@ -0,0 +1,12 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonFormatVisitors.JsonValueFormatVisitor for testing purposes
+
+package com.fasterxml.jackson.databind.jsonFormatVisitors;
+
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonValueFormat;
+import java.util.Set;
+
+public interface JsonValueFormatVisitor
+{
+    void enumTypes(Set<String> p0);
+    void format(JsonValueFormat p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonschema/JsonSchema.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonschema/JsonSchema.java
new file mode 100644
index 00000000000..17286f65bfe
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonschema/JsonSchema.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonschema.JsonSchema for testing purposes
+
+package com.fasterxml.jackson.databind.jsonschema;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+
+public class JsonSchema
+{
+    protected JsonSchema() {}
+    public JsonSchema(ObjectNode p0){}
+    public ObjectNode getSchemaNode(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int hashCode(){ return 0; }
+    public static JsonNode getDefaultSchemaNode(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonschema/SchemaAware.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonschema/SchemaAware.java
new file mode 100644
index 00000000000..8d058229ac2
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsonschema/SchemaAware.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsonschema.SchemaAware for testing purposes
+
+package com.fasterxml.jackson.databind.jsonschema;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import java.lang.reflect.Type;
+
+public interface SchemaAware
+{
+    JsonNode getSchema(SerializerProvider p0, Type p1);
+    JsonNode getSchema(SerializerProvider p0, Type p1, boolean p2);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/NamedType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/NamedType.java
new file mode 100644
index 00000000000..8ea36af94c1
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/NamedType.java
@@ -0,0 +1,22 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsontype.NamedType for testing purposes
+
+package com.fasterxml.jackson.databind.jsontype;
+
+import java.io.Serializable;
+
+public class NamedType implements Serializable
+{
+    protected NamedType() {}
+    protected String _name = null;
+    protected final Class<? extends Object> _class = null;
+    protected final int _hashCode = 0;
+    public Class<? extends Object> getType(){ return null; }
+    public NamedType(Class<? extends Object> p0){}
+    public NamedType(Class<? extends Object> p0, String p1){}
+    public String getName(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean hasName(){ return false; }
+    public int hashCode(){ return 0; }
+    public void setName(String p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/SubtypeResolver.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/SubtypeResolver.java
new file mode 100644
index 00000000000..8305b93683f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/SubtypeResolver.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsontype.SubtypeResolver for testing purposes
+
+package com.fasterxml.jackson.databind.jsontype;
+
+import com.fasterxml.jackson.databind.AnnotationIntrospector;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.introspect.AnnotatedClass;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.jsontype.NamedType;
+import java.util.Collection;
+
+abstract public class SubtypeResolver
+{
+    public Collection<NamedType> collectAndResolveSubtypesByClass(MapperConfig<? extends Object> p0, AnnotatedClass p1){ return null; }
+    public Collection<NamedType> collectAndResolveSubtypesByClass(MapperConfig<? extends Object> p0, AnnotatedMember p1, JavaType p2){ return null; }
+    public Collection<NamedType> collectAndResolveSubtypesByTypeId(MapperConfig<? extends Object> p0, AnnotatedClass p1){ return null; }
+    public Collection<NamedType> collectAndResolveSubtypesByTypeId(MapperConfig<? extends Object> p0, AnnotatedMember p1, JavaType p2){ return null; }
+    public SubtypeResolver(){}
+    public abstract Collection<NamedType> collectAndResolveSubtypes(AnnotatedClass p0, MapperConfig<? extends Object> p1, AnnotationIntrospector p2);
+    public abstract Collection<NamedType> collectAndResolveSubtypes(AnnotatedMember p0, MapperConfig<? extends Object> p1, AnnotationIntrospector p2, JavaType p3);
+    public abstract void registerSubtypes(Class<? extends Object>... p0);
+    public abstract void registerSubtypes(NamedType... p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeDeserializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeDeserializer.java
new file mode 100644
index 00000000000..25d053eb48e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeDeserializer.java
@@ -0,0 +1,26 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsontype.TypeDeserializer for testing purposes
+
+package com.fasterxml.jackson.databind.jsontype;
+
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.jsontype.TypeIdResolver;
+
+abstract public class TypeDeserializer
+{
+    public TypeDeserializer(){}
+    public abstract Class<? extends Object> getDefaultImpl();
+    public abstract JsonTypeInfo.As getTypeInclusion();
+    public abstract Object deserializeTypedFromAny(JsonParser p0, DeserializationContext p1);
+    public abstract Object deserializeTypedFromArray(JsonParser p0, DeserializationContext p1);
+    public abstract Object deserializeTypedFromObject(JsonParser p0, DeserializationContext p1);
+    public abstract Object deserializeTypedFromScalar(JsonParser p0, DeserializationContext p1);
+    public abstract String getPropertyName();
+    public abstract TypeDeserializer forProperty(BeanProperty p0);
+    public abstract TypeIdResolver getTypeIdResolver();
+    public static Object deserializeIfNatural(JsonParser p0, DeserializationContext p1, Class<? extends Object> p2){ return null; }
+    public static Object deserializeIfNatural(JsonParser p0, DeserializationContext p1, JavaType p2){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeIdResolver.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeIdResolver.java
new file mode 100644
index 00000000000..d3f4bea8c0a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeIdResolver.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsontype.TypeIdResolver for testing purposes
+
+package com.fasterxml.jackson.databind.jsontype;
+
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.databind.DatabindContext;
+import com.fasterxml.jackson.databind.JavaType;
+
+public interface TypeIdResolver
+{
+    JavaType typeFromId(DatabindContext p0, String p1);
+    JavaType typeFromId(String p0);
+    JsonTypeInfo.Id getMechanism();
+    String getDescForKnownTypeIds();
+    String idFromBaseType();
+    String idFromValue(Object p0);
+    String idFromValueAndType(Object p0, Class<? extends Object> p1);
+    void init(JavaType p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeResolverBuilder.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeResolverBuilder.java
new file mode 100644
index 00000000000..dbca4800d37
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeResolverBuilder.java
@@ -0,0 +1,25 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsontype.TypeResolverBuilder for testing purposes
+
+package com.fasterxml.jackson.databind.jsontype;
+
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.databind.DeserializationConfig;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.jsontype.NamedType;
+import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
+import com.fasterxml.jackson.databind.jsontype.TypeIdResolver;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import java.util.Collection;
+
+public interface TypeResolverBuilder<T extends TypeResolverBuilder<T>>
+{
+    Class<? extends Object> getDefaultImpl();
+    T defaultImpl(Class<? extends Object> p0);
+    T inclusion(JsonTypeInfo.As p0);
+    T init(JsonTypeInfo.Id p0, TypeIdResolver p1);
+    T typeIdVisibility(boolean p0);
+    T typeProperty(String p0);
+    TypeDeserializer buildTypeDeserializer(DeserializationConfig p0, JavaType p1, Collection<NamedType> p2);
+    TypeSerializer buildTypeSerializer(SerializationConfig p0, JavaType p1, Collection<NamedType> p2);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeSerializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeSerializer.java
new file mode 100644
index 00000000000..4a08820d601
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/jsontype/TypeSerializer.java
@@ -0,0 +1,32 @@
+// Generated automatically from com.fasterxml.jackson.databind.jsontype.TypeSerializer for testing purposes
+
+package com.fasterxml.jackson.databind.jsontype;
+
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.jsontype.TypeIdResolver;
+
+abstract public class TypeSerializer
+{
+    public TypeSerializer(){}
+    public abstract JsonTypeInfo.As getTypeInclusion();
+    public abstract String getPropertyName();
+    public abstract TypeIdResolver getTypeIdResolver();
+    public abstract TypeSerializer forProperty(BeanProperty p0);
+    public abstract void writeCustomTypePrefixForArray(Object p0, JsonGenerator p1, String p2);
+    public abstract void writeCustomTypePrefixForObject(Object p0, JsonGenerator p1, String p2);
+    public abstract void writeCustomTypePrefixForScalar(Object p0, JsonGenerator p1, String p2);
+    public abstract void writeCustomTypeSuffixForArray(Object p0, JsonGenerator p1, String p2);
+    public abstract void writeCustomTypeSuffixForObject(Object p0, JsonGenerator p1, String p2);
+    public abstract void writeCustomTypeSuffixForScalar(Object p0, JsonGenerator p1, String p2);
+    public abstract void writeTypePrefixForArray(Object p0, JsonGenerator p1);
+    public abstract void writeTypePrefixForObject(Object p0, JsonGenerator p1);
+    public abstract void writeTypePrefixForScalar(Object p0, JsonGenerator p1);
+    public abstract void writeTypeSuffixForArray(Object p0, JsonGenerator p1);
+    public abstract void writeTypeSuffixForObject(Object p0, JsonGenerator p1);
+    public abstract void writeTypeSuffixForScalar(Object p0, JsonGenerator p1);
+    public void writeTypePrefixForArray(Object p0, JsonGenerator p1, Class<? extends Object> p2){}
+    public void writeTypePrefixForObject(Object p0, JsonGenerator p1, Class<? extends Object> p2){}
+    public void writeTypePrefixForScalar(Object p0, JsonGenerator p1, Class<? extends Object> p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ArrayNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ArrayNode.java
new file mode 100644
index 00000000000..918f86d24e4
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ArrayNode.java
@@ -0,0 +1,94 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.ArrayNode for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonPointer;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.node.ContainerNode;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import com.fasterxml.jackson.databind.node.JsonNodeType;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fasterxml.jackson.databind.util.RawValue;
+import java.math.BigDecimal;
+import java.util.Collection;
+import java.util.Comparator;
+import java.util.Iterator;
+import java.util.List;
+
+public class ArrayNode extends ContainerNode<ArrayNode>
+{
+    protected ArrayNode() {}
+    protected ArrayNode _add(JsonNode p0){ return null; }
+    protected ArrayNode _insert(int p0, JsonNode p1){ return null; }
+    protected JsonNode _at(JsonPointer p0){ return null; }
+    protected boolean _childrenEqual(ArrayNode p0){ return false; }
+    public ArrayNode add(BigDecimal p0){ return null; }
+    public ArrayNode add(Boolean p0){ return null; }
+    public ArrayNode add(Double p0){ return null; }
+    public ArrayNode add(Float p0){ return null; }
+    public ArrayNode add(Integer p0){ return null; }
+    public ArrayNode add(JsonNode p0){ return null; }
+    public ArrayNode add(Long p0){ return null; }
+    public ArrayNode add(String p0){ return null; }
+    public ArrayNode add(boolean p0){ return null; }
+    public ArrayNode add(byte[] p0){ return null; }
+    public ArrayNode add(double p0){ return null; }
+    public ArrayNode add(float p0){ return null; }
+    public ArrayNode add(int p0){ return null; }
+    public ArrayNode add(long p0){ return null; }
+    public ArrayNode addAll(ArrayNode p0){ return null; }
+    public ArrayNode addAll(Collection<? extends JsonNode> p0){ return null; }
+    public ArrayNode addArray(){ return null; }
+    public ArrayNode addNull(){ return null; }
+    public ArrayNode addPOJO(Object p0){ return null; }
+    public ArrayNode addRawValue(RawValue p0){ return null; }
+    public ArrayNode deepCopy(){ return null; }
+    public ArrayNode insert(int p0, BigDecimal p1){ return null; }
+    public ArrayNode insert(int p0, Boolean p1){ return null; }
+    public ArrayNode insert(int p0, Double p1){ return null; }
+    public ArrayNode insert(int p0, Float p1){ return null; }
+    public ArrayNode insert(int p0, Integer p1){ return null; }
+    public ArrayNode insert(int p0, JsonNode p1){ return null; }
+    public ArrayNode insert(int p0, Long p1){ return null; }
+    public ArrayNode insert(int p0, String p1){ return null; }
+    public ArrayNode insert(int p0, boolean p1){ return null; }
+    public ArrayNode insert(int p0, byte[] p1){ return null; }
+    public ArrayNode insert(int p0, double p1){ return null; }
+    public ArrayNode insert(int p0, float p1){ return null; }
+    public ArrayNode insert(int p0, int p1){ return null; }
+    public ArrayNode insert(int p0, long p1){ return null; }
+    public ArrayNode insertArray(int p0){ return null; }
+    public ArrayNode insertNull(int p0){ return null; }
+    public ArrayNode insertPOJO(int p0, Object p1){ return null; }
+    public ArrayNode removeAll(){ return null; }
+    public ArrayNode(JsonNodeFactory p0){}
+    public ArrayNode(JsonNodeFactory p0, List<JsonNode> p1){}
+    public Iterator<JsonNode> elements(){ return null; }
+    public JsonNode findValue(String p0){ return null; }
+    public JsonNode get(String p0){ return null; }
+    public JsonNode get(int p0){ return null; }
+    public JsonNode path(String p0){ return null; }
+    public JsonNode path(int p0){ return null; }
+    public JsonNode remove(int p0){ return null; }
+    public JsonNode set(int p0, JsonNode p1){ return null; }
+    public JsonNodeType getNodeType(){ return null; }
+    public JsonToken asToken(){ return null; }
+    public List<JsonNode> findParents(String p0, List<JsonNode> p1){ return null; }
+    public List<JsonNode> findValues(String p0, List<JsonNode> p1){ return null; }
+    public List<String> findValuesAsText(String p0, List<String> p1){ return null; }
+    public ObjectNode addObject(){ return null; }
+    public ObjectNode findParent(String p0){ return null; }
+    public ObjectNode insertObject(int p0){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Comparator<JsonNode> p0, JsonNode p1){ return false; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isEmpty(SerializerProvider p0){ return false; }
+    public int hashCode(){ return 0; }
+    public int size(){ return 0; }
+    public void serialize(JsonGenerator p0, SerializerProvider p1){}
+    public void serializeWithType(JsonGenerator p0, SerializerProvider p1, TypeSerializer p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/BaseJsonNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/BaseJsonNode.java
new file mode 100644
index 00000000000..9951f96870d
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/BaseJsonNode.java
@@ -0,0 +1,25 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.BaseJsonNode for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.core.ObjectCodec;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.JsonSerializable;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+
+abstract public class BaseJsonNode extends JsonNode implements JsonSerializable
+{
+    protected BaseJsonNode(){}
+    public JsonParser traverse(){ return null; }
+    public JsonParser traverse(ObjectCodec p0){ return null; }
+    public JsonParser.NumberType numberType(){ return null; }
+    public abstract JsonToken asToken();
+    public abstract int hashCode();
+    public abstract void serialize(JsonGenerator p0, SerializerProvider p1);
+    public abstract void serializeWithType(JsonGenerator p0, SerializerProvider p1, TypeSerializer p2);
+    public final JsonNode findPath(String p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/BinaryNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/BinaryNode.java
new file mode 100644
index 00000000000..e0226079e8b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/BinaryNode.java
@@ -0,0 +1,27 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.BinaryNode for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.node.JsonNodeType;
+import com.fasterxml.jackson.databind.node.ValueNode;
+
+public class BinaryNode extends ValueNode
+{
+    protected BinaryNode() {}
+    protected final byte[] _data = null;
+    public BinaryNode(byte[] p0){}
+    public BinaryNode(byte[] p0, int p1, int p2){}
+    public JsonNodeType getNodeType(){ return null; }
+    public JsonToken asToken(){ return null; }
+    public String asText(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public byte[] binaryValue(){ return null; }
+    public final void serialize(JsonGenerator p0, SerializerProvider p1){}
+    public int hashCode(){ return 0; }
+    public static BinaryNode valueOf(byte[] p0){ return null; }
+    public static BinaryNode valueOf(byte[] p0, int p1, int p2){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/BooleanNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/BooleanNode.java
new file mode 100644
index 00000000000..d9450f154ae
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/BooleanNode.java
@@ -0,0 +1,31 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.BooleanNode for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.node.JsonNodeType;
+import com.fasterxml.jackson.databind.node.ValueNode;
+
+public class BooleanNode extends ValueNode
+{
+    protected BooleanNode() {}
+    public JsonNodeType getNodeType(){ return null; }
+    public JsonToken asToken(){ return null; }
+    public String asText(){ return null; }
+    public boolean asBoolean(){ return false; }
+    public boolean asBoolean(boolean p0){ return false; }
+    public boolean booleanValue(){ return false; }
+    public boolean equals(Object p0){ return false; }
+    public double asDouble(double p0){ return 0; }
+    public final void serialize(JsonGenerator p0, SerializerProvider p1){}
+    public int asInt(int p0){ return 0; }
+    public int hashCode(){ return 0; }
+    public long asLong(long p0){ return 0; }
+    public static BooleanNode FALSE = null;
+    public static BooleanNode TRUE = null;
+    public static BooleanNode getFalse(){ return null; }
+    public static BooleanNode getTrue(){ return null; }
+    public static BooleanNode valueOf(boolean p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ContainerNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ContainerNode.java
new file mode 100644
index 00000000000..17c051b484f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ContainerNode.java
@@ -0,0 +1,56 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.ContainerNode for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.BaseJsonNode;
+import com.fasterxml.jackson.databind.node.BinaryNode;
+import com.fasterxml.jackson.databind.node.BooleanNode;
+import com.fasterxml.jackson.databind.node.JsonNodeCreator;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import com.fasterxml.jackson.databind.node.NullNode;
+import com.fasterxml.jackson.databind.node.NumericNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fasterxml.jackson.databind.node.TextNode;
+import com.fasterxml.jackson.databind.node.ValueNode;
+import com.fasterxml.jackson.databind.util.RawValue;
+import java.math.BigDecimal;
+import java.math.BigInteger;
+
+abstract public class ContainerNode<T extends ContainerNode<T>> extends BaseJsonNode implements JsonNodeCreator
+{
+    protected ContainerNode() {}
+    protected ContainerNode(JsonNodeFactory p0){}
+    protected final JsonNodeFactory _nodeFactory = null;
+    public String asText(){ return null; }
+    public abstract JsonNode get(String p0);
+    public abstract JsonNode get(int p0);
+    public abstract JsonToken asToken();
+    public abstract T removeAll();
+    public abstract int size();
+    public final ArrayNode arrayNode(){ return null; }
+    public final BinaryNode binaryNode(byte[] p0){ return null; }
+    public final BinaryNode binaryNode(byte[] p0, int p1, int p2){ return null; }
+    public final BooleanNode booleanNode(boolean p0){ return null; }
+    public final NullNode nullNode(){ return null; }
+    public final NumericNode numberNode(BigDecimal p0){ return null; }
+    public final NumericNode numberNode(BigInteger p0){ return null; }
+    public final NumericNode numberNode(byte p0){ return null; }
+    public final NumericNode numberNode(double p0){ return null; }
+    public final NumericNode numberNode(float p0){ return null; }
+    public final NumericNode numberNode(int p0){ return null; }
+    public final NumericNode numberNode(long p0){ return null; }
+    public final NumericNode numberNode(short p0){ return null; }
+    public final ObjectNode objectNode(){ return null; }
+    public final TextNode textNode(String p0){ return null; }
+    public final ValueNode numberNode(Byte p0){ return null; }
+    public final ValueNode numberNode(Double p0){ return null; }
+    public final ValueNode numberNode(Float p0){ return null; }
+    public final ValueNode numberNode(Integer p0){ return null; }
+    public final ValueNode numberNode(Long p0){ return null; }
+    public final ValueNode numberNode(Short p0){ return null; }
+    public final ValueNode pojoNode(Object p0){ return null; }
+    public final ValueNode rawValueNode(RawValue p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/JsonNodeCreator.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/JsonNodeCreator.java
new file mode 100644
index 00000000000..e4e7d963f85
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/JsonNodeCreator.java
@@ -0,0 +1,37 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.JsonNodeCreator for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fasterxml.jackson.databind.node.ValueNode;
+import com.fasterxml.jackson.databind.util.RawValue;
+import java.math.BigDecimal;
+import java.math.BigInteger;
+
+public interface JsonNodeCreator
+{
+    ArrayNode arrayNode();
+    ObjectNode objectNode();
+    ValueNode binaryNode(byte[] p0);
+    ValueNode binaryNode(byte[] p0, int p1, int p2);
+    ValueNode booleanNode(boolean p0);
+    ValueNode nullNode();
+    ValueNode numberNode(BigDecimal p0);
+    ValueNode numberNode(BigInteger p0);
+    ValueNode numberNode(Byte p0);
+    ValueNode numberNode(Double p0);
+    ValueNode numberNode(Float p0);
+    ValueNode numberNode(Integer p0);
+    ValueNode numberNode(Long p0);
+    ValueNode numberNode(Short p0);
+    ValueNode numberNode(byte p0);
+    ValueNode numberNode(double p0);
+    ValueNode numberNode(float p0);
+    ValueNode numberNode(int p0);
+    ValueNode numberNode(long p0);
+    ValueNode numberNode(short p0);
+    ValueNode pojoNode(Object p0);
+    ValueNode rawValueNode(RawValue p0);
+    ValueNode textNode(String p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/JsonNodeFactory.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/JsonNodeFactory.java
new file mode 100644
index 00000000000..fff72b53107
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/JsonNodeFactory.java
@@ -0,0 +1,49 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.JsonNodeFactory for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.BinaryNode;
+import com.fasterxml.jackson.databind.node.BooleanNode;
+import com.fasterxml.jackson.databind.node.JsonNodeCreator;
+import com.fasterxml.jackson.databind.node.NullNode;
+import com.fasterxml.jackson.databind.node.NumericNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fasterxml.jackson.databind.node.TextNode;
+import com.fasterxml.jackson.databind.node.ValueNode;
+import com.fasterxml.jackson.databind.util.RawValue;
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.math.BigInteger;
+
+public class JsonNodeFactory implements JsonNodeCreator, Serializable
+{
+    protected JsonNodeFactory(){}
+    protected boolean _inIntRange(long p0){ return false; }
+    public ArrayNode arrayNode(){ return null; }
+    public BinaryNode binaryNode(byte[] p0){ return null; }
+    public BinaryNode binaryNode(byte[] p0, int p1, int p2){ return null; }
+    public BooleanNode booleanNode(boolean p0){ return null; }
+    public JsonNodeFactory(boolean p0){}
+    public NullNode nullNode(){ return null; }
+    public NumericNode numberNode(BigDecimal p0){ return null; }
+    public NumericNode numberNode(BigInteger p0){ return null; }
+    public NumericNode numberNode(byte p0){ return null; }
+    public NumericNode numberNode(double p0){ return null; }
+    public NumericNode numberNode(float p0){ return null; }
+    public NumericNode numberNode(int p0){ return null; }
+    public NumericNode numberNode(long p0){ return null; }
+    public NumericNode numberNode(short p0){ return null; }
+    public ObjectNode objectNode(){ return null; }
+    public TextNode textNode(String p0){ return null; }
+    public ValueNode numberNode(Byte p0){ return null; }
+    public ValueNode numberNode(Double p0){ return null; }
+    public ValueNode numberNode(Float p0){ return null; }
+    public ValueNode numberNode(Integer p0){ return null; }
+    public ValueNode numberNode(Long p0){ return null; }
+    public ValueNode numberNode(Short p0){ return null; }
+    public ValueNode pojoNode(Object p0){ return null; }
+    public ValueNode rawValueNode(RawValue p0){ return null; }
+    public static JsonNodeFactory instance = null;
+    public static JsonNodeFactory withExactBigDecimals(boolean p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/JsonNodeType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/JsonNodeType.java
new file mode 100644
index 00000000000..8f7bd54f9ad
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/JsonNodeType.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.JsonNodeType for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+
+public enum JsonNodeType
+{
+    ARRAY, BINARY, BOOLEAN, MISSING, NULL, NUMBER, OBJECT, POJO, STRING;
+    private JsonNodeType() {}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/NullNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/NullNode.java
new file mode 100644
index 00000000000..eff6bcf53c3
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/NullNode.java
@@ -0,0 +1,23 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.NullNode for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.node.JsonNodeType;
+import com.fasterxml.jackson.databind.node.ValueNode;
+
+public class NullNode extends ValueNode
+{
+    protected NullNode() {}
+    public JsonNodeType getNodeType(){ return null; }
+    public JsonToken asToken(){ return null; }
+    public String asText(){ return null; }
+    public String asText(String p0){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public final void serialize(JsonGenerator p0, SerializerProvider p1){}
+    public int hashCode(){ return 0; }
+    public static NullNode getInstance(){ return null; }
+    public static NullNode instance = null;
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/NumericNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/NumericNode.java
new file mode 100644
index 00000000000..dda8f943843
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/NumericNode.java
@@ -0,0 +1,31 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.NumericNode for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.node.JsonNodeType;
+import com.fasterxml.jackson.databind.node.ValueNode;
+import java.math.BigDecimal;
+import java.math.BigInteger;
+
+abstract public class NumericNode extends ValueNode
+{
+    protected NumericNode(){}
+    public abstract BigDecimal decimalValue();
+    public abstract BigInteger bigIntegerValue();
+    public abstract JsonParser.NumberType numberType();
+    public abstract Number numberValue();
+    public abstract String asText();
+    public abstract boolean canConvertToInt();
+    public abstract boolean canConvertToLong();
+    public abstract double doubleValue();
+    public abstract int intValue();
+    public abstract long longValue();
+    public final JsonNodeType getNodeType(){ return null; }
+    public final double asDouble(){ return 0; }
+    public final double asDouble(double p0){ return 0; }
+    public final int asInt(){ return 0; }
+    public final int asInt(int p0){ return 0; }
+    public final long asLong(){ return 0; }
+    public final long asLong(long p0){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ObjectNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ObjectNode.java
new file mode 100644
index 00000000000..7bf1cc888ea
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ObjectNode.java
@@ -0,0 +1,91 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.ObjectNode for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonPointer;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.ContainerNode;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import com.fasterxml.jackson.databind.node.JsonNodeType;
+import com.fasterxml.jackson.databind.util.RawValue;
+import java.math.BigDecimal;
+import java.util.Collection;
+import java.util.Comparator;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+
+public class ObjectNode extends ContainerNode<ObjectNode>
+{
+    protected ObjectNode() {}
+    protected JsonNode _at(JsonPointer p0){ return null; }
+    protected ObjectNode _put(String p0, JsonNode p1){ return null; }
+    protected boolean _childrenEqual(ObjectNode p0){ return false; }
+    protected final Map<String, JsonNode> _children = null;
+    public ArrayNode putArray(String p0){ return null; }
+    public ArrayNode withArray(String p0){ return null; }
+    public Iterator<JsonNode> elements(){ return null; }
+    public Iterator<Map.Entry<String, JsonNode>> fields(){ return null; }
+    public Iterator<String> fieldNames(){ return null; }
+    public JsonNode findValue(String p0){ return null; }
+    public JsonNode get(String p0){ return null; }
+    public JsonNode get(int p0){ return null; }
+    public JsonNode path(String p0){ return null; }
+    public JsonNode path(int p0){ return null; }
+    public JsonNode put(String p0, JsonNode p1){ return null; }
+    public JsonNode putAll(Map<String, ? extends JsonNode> p0){ return null; }
+    public JsonNode putAll(ObjectNode p0){ return null; }
+    public JsonNode remove(String p0){ return null; }
+    public JsonNode replace(String p0, JsonNode p1){ return null; }
+    public JsonNode set(String p0, JsonNode p1){ return null; }
+    public JsonNode setAll(Map<String, ? extends JsonNode> p0){ return null; }
+    public JsonNode setAll(ObjectNode p0){ return null; }
+    public JsonNode without(String p0){ return null; }
+    public JsonNodeType getNodeType(){ return null; }
+    public JsonToken asToken(){ return null; }
+    public List<JsonNode> findParents(String p0, List<JsonNode> p1){ return null; }
+    public List<JsonNode> findValues(String p0, List<JsonNode> p1){ return null; }
+    public List<String> findValuesAsText(String p0, List<String> p1){ return null; }
+    public ObjectNode deepCopy(){ return null; }
+    public ObjectNode findParent(String p0){ return null; }
+    public ObjectNode put(String p0, BigDecimal p1){ return null; }
+    public ObjectNode put(String p0, Boolean p1){ return null; }
+    public ObjectNode put(String p0, Double p1){ return null; }
+    public ObjectNode put(String p0, Float p1){ return null; }
+    public ObjectNode put(String p0, Integer p1){ return null; }
+    public ObjectNode put(String p0, Long p1){ return null; }
+    public ObjectNode put(String p0, Short p1){ return null; }
+    public ObjectNode put(String p0, String p1){ return null; }
+    public ObjectNode put(String p0, boolean p1){ return null; }
+    public ObjectNode put(String p0, byte[] p1){ return null; }
+    public ObjectNode put(String p0, double p1){ return null; }
+    public ObjectNode put(String p0, float p1){ return null; }
+    public ObjectNode put(String p0, int p1){ return null; }
+    public ObjectNode put(String p0, long p1){ return null; }
+    public ObjectNode put(String p0, short p1){ return null; }
+    public ObjectNode putNull(String p0){ return null; }
+    public ObjectNode putObject(String p0){ return null; }
+    public ObjectNode putPOJO(String p0, Object p1){ return null; }
+    public ObjectNode putRawValue(String p0, RawValue p1){ return null; }
+    public ObjectNode remove(Collection<String> p0){ return null; }
+    public ObjectNode removeAll(){ return null; }
+    public ObjectNode retain(Collection<String> p0){ return null; }
+    public ObjectNode retain(String... p0){ return null; }
+    public ObjectNode with(String p0){ return null; }
+    public ObjectNode without(Collection<String> p0){ return null; }
+    public ObjectNode(JsonNodeFactory p0){}
+    public ObjectNode(JsonNodeFactory p0, Map<String, JsonNode> p1){}
+    public String toString(){ return null; }
+    public boolean equals(Comparator<JsonNode> p0, JsonNode p1){ return false; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isEmpty(SerializerProvider p0){ return false; }
+    public int hashCode(){ return 0; }
+    public int size(){ return 0; }
+    public void serialize(JsonGenerator p0, SerializerProvider p1){}
+    public void serializeWithType(JsonGenerator p0, SerializerProvider p1, TypeSerializer p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/TextNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/TextNode.java
new file mode 100644
index 00000000000..6bb27420728
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/TextNode.java
@@ -0,0 +1,37 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.TextNode for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.core.Base64Variant;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.node.JsonNodeType;
+import com.fasterxml.jackson.databind.node.ValueNode;
+
+public class TextNode extends ValueNode
+{
+    protected TextNode() {}
+    protected final String _value = null;
+    protected static void appendQuoted(StringBuilder p0, String p1){}
+    protected void _reportBase64EOF(){}
+    protected void _reportInvalidBase64(Base64Variant p0, char p1, int p2){}
+    protected void _reportInvalidBase64(Base64Variant p0, char p1, int p2, String p3){}
+    public JsonNodeType getNodeType(){ return null; }
+    public JsonToken asToken(){ return null; }
+    public String asText(){ return null; }
+    public String asText(String p0){ return null; }
+    public String textValue(){ return null; }
+    public String toString(){ return null; }
+    public TextNode(String p0){}
+    public boolean asBoolean(boolean p0){ return false; }
+    public boolean equals(Object p0){ return false; }
+    public byte[] binaryValue(){ return null; }
+    public byte[] getBinaryValue(Base64Variant p0){ return null; }
+    public double asDouble(double p0){ return 0; }
+    public final void serialize(JsonGenerator p0, SerializerProvider p1){}
+    public int asInt(int p0){ return 0; }
+    public int hashCode(){ return 0; }
+    public long asLong(long p0){ return 0; }
+    public static TextNode valueOf(String p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ValueNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ValueNode.java
new file mode 100644
index 00000000000..488888f33be
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/node/ValueNode.java
@@ -0,0 +1,36 @@
+// Generated automatically from com.fasterxml.jackson.databind.node.ValueNode for testing purposes
+
+package com.fasterxml.jackson.databind.node;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonPointer;
+import com.fasterxml.jackson.core.JsonToken;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.node.BaseJsonNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import java.util.List;
+
+abstract public class ValueNode extends BaseJsonNode
+{
+    protected JsonNode _at(JsonPointer p0){ return null; }
+    protected ValueNode(){}
+    public <T extends JsonNode> T deepCopy(){ return null; }
+    public String toString(){ return null; }
+    public abstract JsonToken asToken();
+    public final JsonNode findValue(String p0){ return null; }
+    public final JsonNode get(String p0){ return null; }
+    public final JsonNode get(int p0){ return null; }
+    public final JsonNode path(String p0){ return null; }
+    public final JsonNode path(int p0){ return null; }
+    public final List<JsonNode> findParents(String p0, List<JsonNode> p1){ return null; }
+    public final List<JsonNode> findValues(String p0, List<JsonNode> p1){ return null; }
+    public final List<String> findValuesAsText(String p0, List<String> p1){ return null; }
+    public final ObjectNode findParent(String p0){ return null; }
+    public final boolean has(String p0){ return false; }
+    public final boolean has(int p0){ return false; }
+    public final boolean hasNonNull(String p0){ return false; }
+    public final boolean hasNonNull(int p0){ return false; }
+    public void serializeWithType(JsonGenerator p0, SerializerProvider p1, TypeSerializer p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/AnyGetterWriter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/AnyGetterWriter.java
new file mode 100644
index 00000000000..7a671487b9e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/AnyGetterWriter.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.AnyGetterWriter for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.ser.PropertyFilter;
+import com.fasterxml.jackson.databind.ser.std.MapSerializer;
+
+public class AnyGetterWriter
+{
+    protected AnyGetterWriter() {}
+    protected JsonSerializer<Object> _serializer = null;
+    protected MapSerializer _mapSerializer = null;
+    protected final AnnotatedMember _accessor = null;
+    protected final BeanProperty _property = null;
+    public AnyGetterWriter(BeanProperty p0, AnnotatedMember p1, JsonSerializer<? extends Object> p2){}
+    public void getAndFilter(Object p0, JsonGenerator p1, SerializerProvider p2, PropertyFilter p3){}
+    public void getAndSerialize(Object p0, JsonGenerator p1, SerializerProvider p2){}
+    public void resolve(SerializerProvider p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanPropertyFilter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanPropertyFilter.java
new file mode 100644
index 00000000000..c00efcff14e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanPropertyFilter.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.BeanPropertyFilter for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonObjectFormatVisitor;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fasterxml.jackson.databind.ser.BeanPropertyWriter;
+
+public interface BeanPropertyFilter
+{
+    void depositSchemaProperty(BeanPropertyWriter p0, JsonObjectFormatVisitor p1, SerializerProvider p2);
+    void depositSchemaProperty(BeanPropertyWriter p0, ObjectNode p1, SerializerProvider p2);
+    void serializeAsField(Object p0, JsonGenerator p1, SerializerProvider p2, BeanPropertyWriter p3);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanPropertyWriter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanPropertyWriter.java
new file mode 100644
index 00000000000..2c0be23cf62
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanPropertyWriter.java
@@ -0,0 +1,95 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.BeanPropertyWriter for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.SerializableString;
+import com.fasterxml.jackson.core.io.SerializedString;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.introspect.BeanPropertyDefinition;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonObjectFormatVisitor;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fasterxml.jackson.databind.ser.PropertyWriter;
+import com.fasterxml.jackson.databind.ser.impl.PropertySerializerMap;
+import com.fasterxml.jackson.databind.util.Annotations;
+import com.fasterxml.jackson.databind.util.NameTransformer;
+import java.io.Serializable;
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.lang.reflect.Type;
+import java.util.HashMap;
+
+public class BeanPropertyWriter extends PropertyWriter implements Serializable
+{
+    protected BeanPropertyWriter _new(PropertyName p0){ return null; }
+    protected BeanPropertyWriter(){}
+    protected BeanPropertyWriter(BeanPropertyWriter p0){}
+    protected BeanPropertyWriter(BeanPropertyWriter p0, PropertyName p1){}
+    protected BeanPropertyWriter(BeanPropertyWriter p0, SerializedString p1){}
+    protected Field _field = null;
+    protected HashMap<Object, Object> _internalSettings = null;
+    protected JavaType _nonTrivialBaseType = null;
+    protected JsonSerializer<Object> _findAndAddDynamic(PropertySerializerMap p0, Class<? extends Object> p1, SerializerProvider p2){ return null; }
+    protected JsonSerializer<Object> _nullSerializer = null;
+    protected JsonSerializer<Object> _serializer = null;
+    protected Method _accessorMethod = null;
+    protected PropertySerializerMap _dynamicSerializers = null;
+    protected TypeSerializer _typeSerializer = null;
+    protected boolean _handleSelfReference(Object p0, JsonGenerator p1, SerializerProvider p2, JsonSerializer<? extends Object> p3){ return false; }
+    protected final AnnotatedMember _member = null;
+    protected final Annotations _contextAnnotations = null;
+    protected final Class<? extends Object>[] _includeInViews = null;
+    protected final JavaType _cfgSerializationType = null;
+    protected final JavaType _declaredType = null;
+    protected final Object _suppressableValue = null;
+    protected final PropertyName _wrapperName = null;
+    protected final SerializedString _name = null;
+    protected final boolean _suppressNulls = false;
+    protected void _depositSchemaProperty(ObjectNode p0, JsonNode p1){}
+    public <A extends Annotation> A getAnnotation(Class<A> p0){ return null; }
+    public <A extends Annotation> A getContextAnnotation(Class<A> p0){ return null; }
+    public AnnotatedMember getMember(){ return null; }
+    public BeanPropertyWriter rename(NameTransformer p0){ return null; }
+    public BeanPropertyWriter unwrappingWriter(NameTransformer p0){ return null; }
+    public BeanPropertyWriter(BeanPropertyDefinition p0, AnnotatedMember p1, Annotations p2, JavaType p3, JsonSerializer<? extends Object> p4, TypeSerializer p5, JavaType p6, boolean p7, Object p8){}
+    public Class<? extends Object> getPropertyType(){ return null; }
+    public Class<? extends Object> getRawSerializationType(){ return null; }
+    public Class<? extends Object>[] getViews(){ return null; }
+    public JavaType getSerializationType(){ return null; }
+    public JavaType getType(){ return null; }
+    public JsonSerializer<Object> getSerializer(){ return null; }
+    public Object getInternalSetting(Object p0){ return null; }
+    public Object removeInternalSetting(Object p0){ return null; }
+    public Object setInternalSetting(Object p0, Object p1){ return null; }
+    public PropertyName getFullName(){ return null; }
+    public PropertyName getWrapperName(){ return null; }
+    public SerializableString getSerializedName(){ return null; }
+    public String getName(){ return null; }
+    public String toString(){ return null; }
+    public Type getGenericPropertyType(){ return null; }
+    public TypeSerializer getTypeSerializer(){ return null; }
+    public boolean hasNullSerializer(){ return false; }
+    public boolean hasSerializer(){ return false; }
+    public boolean isUnwrapping(){ return false; }
+    public boolean willSuppressNulls(){ return false; }
+    public boolean wouldConflictWithName(PropertyName p0){ return false; }
+    public final Object get(Object p0){ return null; }
+    public static Object MARKER_FOR_EMPTY = null;
+    public void assignNullSerializer(JsonSerializer<Object> p0){}
+    public void assignSerializer(JsonSerializer<Object> p0){}
+    public void assignTypeSerializer(TypeSerializer p0){}
+    public void depositSchemaProperty(JsonObjectFormatVisitor p0, SerializerProvider p1){}
+    public void depositSchemaProperty(ObjectNode p0, SerializerProvider p1){}
+    public void serializeAsElement(Object p0, JsonGenerator p1, SerializerProvider p2){}
+    public void serializeAsField(Object p0, JsonGenerator p1, SerializerProvider p2){}
+    public void serializeAsOmittedField(Object p0, JsonGenerator p1, SerializerProvider p2){}
+    public void serializeAsPlaceholder(Object p0, JsonGenerator p1, SerializerProvider p2){}
+    public void setNonTrivialBaseType(JavaType p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanSerializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanSerializer.java
new file mode 100644
index 00000000000..5002ab54377
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanSerializer.java
@@ -0,0 +1,31 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.BeanSerializer for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.ser.BeanPropertyWriter;
+import com.fasterxml.jackson.databind.ser.BeanSerializerBuilder;
+import com.fasterxml.jackson.databind.ser.impl.ObjectIdWriter;
+import com.fasterxml.jackson.databind.ser.std.BeanSerializerBase;
+import com.fasterxml.jackson.databind.util.NameTransformer;
+
+public class BeanSerializer extends BeanSerializerBase
+{
+    protected BeanSerializer() {}
+    protected BeanSerializer(BeanSerializerBase p0){}
+    protected BeanSerializer(BeanSerializerBase p0, ObjectIdWriter p1){}
+    protected BeanSerializer(BeanSerializerBase p0, ObjectIdWriter p1, Object p2){}
+    protected BeanSerializer(BeanSerializerBase p0, String[] p1){}
+    protected BeanSerializerBase asArraySerializer(){ return null; }
+    protected BeanSerializerBase withIgnorals(String[] p0){ return null; }
+    public BeanSerializer(JavaType p0, BeanSerializerBuilder p1, BeanPropertyWriter[] p2, BeanPropertyWriter[] p3){}
+    public BeanSerializerBase withFilterId(Object p0){ return null; }
+    public BeanSerializerBase withObjectIdWriter(ObjectIdWriter p0){ return null; }
+    public JsonSerializer<Object> unwrappingSerializer(NameTransformer p0){ return null; }
+    public String toString(){ return null; }
+    public final void serialize(Object p0, JsonGenerator p1, SerializerProvider p2){}
+    public static BeanSerializer createDummy(JavaType p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanSerializerBuilder.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanSerializerBuilder.java
new file mode 100644
index 00000000000..badae846dca
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanSerializerBuilder.java
@@ -0,0 +1,47 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.BeanSerializerBuilder for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.introspect.AnnotatedClass;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.ser.AnyGetterWriter;
+import com.fasterxml.jackson.databind.ser.BeanPropertyWriter;
+import com.fasterxml.jackson.databind.ser.BeanSerializer;
+import com.fasterxml.jackson.databind.ser.impl.ObjectIdWriter;
+import java.util.List;
+
+public class BeanSerializerBuilder
+{
+    protected BeanSerializerBuilder() {}
+    protected AnnotatedMember _typeId = null;
+    protected AnyGetterWriter _anyGetter = null;
+    protected BeanPropertyWriter[] _filteredProperties = null;
+    protected BeanSerializerBuilder(BeanSerializerBuilder p0){}
+    protected List<BeanPropertyWriter> _properties = null;
+    protected Object _filterId = null;
+    protected ObjectIdWriter _objectIdWriter = null;
+    protected SerializationConfig _config = null;
+    protected final BeanDescription _beanDesc = null;
+    protected void setConfig(SerializationConfig p0){}
+    public AnnotatedClass getClassInfo(){ return null; }
+    public AnnotatedMember getTypeId(){ return null; }
+    public AnyGetterWriter getAnyGetter(){ return null; }
+    public BeanDescription getBeanDescription(){ return null; }
+    public BeanPropertyWriter[] getFilteredProperties(){ return null; }
+    public BeanSerializer createDummy(){ return null; }
+    public BeanSerializerBuilder(BeanDescription p0){}
+    public JsonSerializer<? extends Object> build(){ return null; }
+    public List<BeanPropertyWriter> getProperties(){ return null; }
+    public Object getFilterId(){ return null; }
+    public ObjectIdWriter getObjectIdWriter(){ return null; }
+    public boolean hasProperties(){ return false; }
+    public void setAnyGetter(AnyGetterWriter p0){}
+    public void setFilterId(Object p0){}
+    public void setFilteredProperties(BeanPropertyWriter[] p0){}
+    public void setObjectIdWriter(ObjectIdWriter p0){}
+    public void setProperties(List<BeanPropertyWriter> p0){}
+    public void setTypeId(AnnotatedMember p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanSerializerModifier.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanSerializerModifier.java
new file mode 100644
index 00000000000..ebd7633769a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/BeanSerializerModifier.java
@@ -0,0 +1,32 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.BeanSerializerModifier for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.ser.BeanPropertyWriter;
+import com.fasterxml.jackson.databind.ser.BeanSerializerBuilder;
+import com.fasterxml.jackson.databind.type.ArrayType;
+import com.fasterxml.jackson.databind.type.CollectionLikeType;
+import com.fasterxml.jackson.databind.type.CollectionType;
+import com.fasterxml.jackson.databind.type.MapLikeType;
+import com.fasterxml.jackson.databind.type.MapType;
+import java.util.List;
+
+abstract public class BeanSerializerModifier
+{
+    public BeanSerializerBuilder updateBuilder(SerializationConfig p0, BeanDescription p1, BeanSerializerBuilder p2){ return null; }
+    public BeanSerializerModifier(){}
+    public JsonSerializer<? extends Object> modifyArraySerializer(SerializationConfig p0, ArrayType p1, BeanDescription p2, JsonSerializer<? extends Object> p3){ return null; }
+    public JsonSerializer<? extends Object> modifyCollectionLikeSerializer(SerializationConfig p0, CollectionLikeType p1, BeanDescription p2, JsonSerializer<? extends Object> p3){ return null; }
+    public JsonSerializer<? extends Object> modifyCollectionSerializer(SerializationConfig p0, CollectionType p1, BeanDescription p2, JsonSerializer<? extends Object> p3){ return null; }
+    public JsonSerializer<? extends Object> modifyEnumSerializer(SerializationConfig p0, JavaType p1, BeanDescription p2, JsonSerializer<? extends Object> p3){ return null; }
+    public JsonSerializer<? extends Object> modifyKeySerializer(SerializationConfig p0, JavaType p1, BeanDescription p2, JsonSerializer<? extends Object> p3){ return null; }
+    public JsonSerializer<? extends Object> modifyMapLikeSerializer(SerializationConfig p0, MapLikeType p1, BeanDescription p2, JsonSerializer<? extends Object> p3){ return null; }
+    public JsonSerializer<? extends Object> modifyMapSerializer(SerializationConfig p0, MapType p1, BeanDescription p2, JsonSerializer<? extends Object> p3){ return null; }
+    public JsonSerializer<? extends Object> modifySerializer(SerializationConfig p0, BeanDescription p1, JsonSerializer<? extends Object> p2){ return null; }
+    public List<BeanPropertyWriter> changeProperties(SerializationConfig p0, BeanDescription p1, List<BeanPropertyWriter> p2){ return null; }
+    public List<BeanPropertyWriter> orderProperties(SerializationConfig p0, BeanDescription p1, List<BeanPropertyWriter> p2){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/ContainerSerializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/ContainerSerializer.java
new file mode 100644
index 00000000000..b7e52662fff
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/ContainerSerializer.java
@@ -0,0 +1,26 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.ContainerSerializer for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.ser.std.StdSerializer;
+
+abstract public class ContainerSerializer<T> extends StdSerializer<T>
+{
+    protected ContainerSerializer() {}
+    protected ContainerSerializer(Class<? extends Object> p0, boolean p1){}
+    protected ContainerSerializer(Class<T> p0){}
+    protected ContainerSerializer(ContainerSerializer<? extends Object> p0){}
+    protected ContainerSerializer(JavaType p0){}
+    protected abstract ContainerSerializer<? extends Object> _withValueTypeSerializer(TypeSerializer p0);
+    protected boolean hasContentTypeAnnotation(SerializerProvider p0, BeanProperty p1){ return false; }
+    public ContainerSerializer<? extends Object> withValueTypeSerializer(TypeSerializer p0){ return null; }
+    public abstract JavaType getContentType();
+    public abstract JsonSerializer<? extends Object> getContentSerializer();
+    public abstract boolean hasSingleElement(T p0);
+    public boolean isEmpty(T p0){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/ContextualSerializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/ContextualSerializer.java
new file mode 100644
index 00000000000..7479e6f3a95
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/ContextualSerializer.java
@@ -0,0 +1,12 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.ContextualSerializer for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+
+public interface ContextualSerializer
+{
+    JsonSerializer<? extends Object> createContextual(SerializerProvider p0, BeanProperty p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/DefaultSerializerProvider.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/DefaultSerializerProvider.java
new file mode 100644
index 00000000000..8afb68a9c46
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/DefaultSerializerProvider.java
@@ -0,0 +1,45 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.DefaultSerializerProvider for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.introspect.Annotated;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper;
+import com.fasterxml.jackson.databind.jsonschema.JsonSchema;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.ser.SerializerFactory;
+import com.fasterxml.jackson.databind.ser.impl.WritableObjectId;
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
+
+abstract public class DefaultSerializerProvider extends SerializerProvider implements Serializable
+{
+    protected ArrayList<ObjectIdGenerator<? extends Object>> _objectIdGenerators = null;
+    protected DefaultSerializerProvider(){}
+    protected DefaultSerializerProvider(DefaultSerializerProvider p0){}
+    protected DefaultSerializerProvider(SerializerProvider p0, SerializationConfig p1, SerializerFactory p2){}
+    protected Map<Object, WritableObjectId> _createObjectIdMap(){ return null; }
+    protected Map<Object, WritableObjectId> _seenObjectIds = null;
+    protected void _serializeNull(JsonGenerator p0){}
+    public DefaultSerializerProvider copy(){ return null; }
+    public JsonSchema generateJsonSchema(Class<? extends Object> p0){ return null; }
+    public JsonSerializer<Object> serializerInstance(Annotated p0, Object p1){ return null; }
+    public WritableObjectId findObjectId(Object p0, ObjectIdGenerator<? extends Object> p1){ return null; }
+    public abstract DefaultSerializerProvider createInstance(SerializationConfig p0, SerializerFactory p1);
+    public boolean hasSerializerFor(Class<? extends Object> p0, AtomicReference<Throwable> p1){ return false; }
+    public int cachedSerializersCount(){ return 0; }
+    public void acceptJsonFormatVisitor(JavaType p0, JsonFormatVisitorWrapper p1){}
+    public void flushCachedSerializers(){}
+    public void serializePolymorphic(JsonGenerator p0, Object p1, JavaType p2, JsonSerializer<Object> p3, TypeSerializer p4){}
+    public void serializePolymorphic(JsonGenerator p0, Object p1, TypeSerializer p2){}
+    public void serializeValue(JsonGenerator p0, Object p1){}
+    public void serializeValue(JsonGenerator p0, Object p1, JavaType p2){}
+    public void serializeValue(JsonGenerator p0, Object p1, JavaType p2, JsonSerializer<Object> p3){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/FilterProvider.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/FilterProvider.java
new file mode 100644
index 00000000000..de4317045db
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/FilterProvider.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.FilterProvider for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.databind.ser.BeanPropertyFilter;
+import com.fasterxml.jackson.databind.ser.PropertyFilter;
+
+abstract public class FilterProvider
+{
+    public FilterProvider(){}
+    public PropertyFilter findPropertyFilter(Object p0, Object p1){ return null; }
+    public abstract BeanPropertyFilter findFilter(Object p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/PropertyFilter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/PropertyFilter.java
new file mode 100644
index 00000000000..23fc37e7bb7
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/PropertyFilter.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.PropertyFilter for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonObjectFormatVisitor;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fasterxml.jackson.databind.ser.PropertyWriter;
+
+public interface PropertyFilter
+{
+    void depositSchemaProperty(PropertyWriter p0, JsonObjectFormatVisitor p1, SerializerProvider p2);
+    void depositSchemaProperty(PropertyWriter p0, ObjectNode p1, SerializerProvider p2);
+    void serializeAsElement(Object p0, JsonGenerator p1, SerializerProvider p2, PropertyWriter p3);
+    void serializeAsField(Object p0, JsonGenerator p1, SerializerProvider p2, PropertyWriter p3);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/PropertyWriter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/PropertyWriter.java
new file mode 100644
index 00000000000..7b40f6efd47
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/PropertyWriter.java
@@ -0,0 +1,33 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.PropertyWriter for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.PropertyMetadata;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.introspect.BeanPropertyDefinition;
+import com.fasterxml.jackson.databind.introspect.ConcreteBeanPropertyBase;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonObjectFormatVisitor;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import java.io.Serializable;
+import java.lang.annotation.Annotation;
+
+abstract public class PropertyWriter extends ConcreteBeanPropertyBase implements Serializable
+{
+    protected PropertyWriter() {}
+    protected PropertyWriter(BeanPropertyDefinition p0){}
+    protected PropertyWriter(PropertyMetadata p0){}
+    protected PropertyWriter(PropertyWriter p0){}
+    public <A extends Annotation> A findAnnotation(Class<A> p0){ return null; }
+    public abstract <A extends Annotation> A getAnnotation(Class<A> p0);
+    public abstract <A extends Annotation> A getContextAnnotation(Class<A> p0);
+    public abstract PropertyName getFullName();
+    public abstract String getName();
+    public abstract void depositSchemaProperty(JsonObjectFormatVisitor p0, SerializerProvider p1);
+    public abstract void depositSchemaProperty(ObjectNode p0, SerializerProvider p1);
+    public abstract void serializeAsElement(Object p0, JsonGenerator p1, SerializerProvider p2);
+    public abstract void serializeAsField(Object p0, JsonGenerator p1, SerializerProvider p2);
+    public abstract void serializeAsOmittedField(Object p0, JsonGenerator p1, SerializerProvider p2);
+    public abstract void serializeAsPlaceholder(Object p0, JsonGenerator p1, SerializerProvider p2);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/ResolvableSerializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/ResolvableSerializer.java
new file mode 100644
index 00000000000..c9edd624e33
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/ResolvableSerializer.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.ResolvableSerializer for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.databind.SerializerProvider;
+
+public interface ResolvableSerializer
+{
+    void resolve(SerializerProvider p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/SerializerCache.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/SerializerCache.java
new file mode 100644
index 00000000000..75103d06998
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/SerializerCache.java
@@ -0,0 +1,25 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.SerializerCache for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.ser.impl.ReadOnlyClassToSerializerMap;
+
+public class SerializerCache
+{
+    public JsonSerializer<Object> typedValueSerializer(Class<? extends Object> p0){ return null; }
+    public JsonSerializer<Object> typedValueSerializer(JavaType p0){ return null; }
+    public JsonSerializer<Object> untypedValueSerializer(Class<? extends Object> p0){ return null; }
+    public JsonSerializer<Object> untypedValueSerializer(JavaType p0){ return null; }
+    public ReadOnlyClassToSerializerMap getReadOnlyLookupMap(){ return null; }
+    public SerializerCache(){}
+    public int size(){ return 0; }
+    public void addAndResolveNonTypedSerializer(Class<? extends Object> p0, JavaType p1, JsonSerializer<Object> p2, SerializerProvider p3){}
+    public void addAndResolveNonTypedSerializer(Class<? extends Object> p0, JsonSerializer<Object> p1, SerializerProvider p2){}
+    public void addAndResolveNonTypedSerializer(JavaType p0, JsonSerializer<Object> p1, SerializerProvider p2){}
+    public void addTypedSerializer(Class<? extends Object> p0, JsonSerializer<Object> p1){}
+    public void addTypedSerializer(JavaType p0, JsonSerializer<Object> p1){}
+    public void flush(){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/SerializerFactory.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/SerializerFactory.java
new file mode 100644
index 00000000000..0b996ab16df
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/SerializerFactory.java
@@ -0,0 +1,22 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.SerializerFactory for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.ser.BeanSerializerModifier;
+import com.fasterxml.jackson.databind.ser.Serializers;
+
+abstract public class SerializerFactory
+{
+    public SerializerFactory(){}
+    public abstract JsonSerializer<Object> createKeySerializer(SerializationConfig p0, JavaType p1, JsonSerializer<Object> p2);
+    public abstract JsonSerializer<Object> createSerializer(SerializerProvider p0, JavaType p1);
+    public abstract SerializerFactory withAdditionalKeySerializers(Serializers p0);
+    public abstract SerializerFactory withAdditionalSerializers(Serializers p0);
+    public abstract SerializerFactory withSerializerModifier(BeanSerializerModifier p0);
+    public abstract TypeSerializer createTypeSerializer(SerializationConfig p0, JavaType p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/Serializers.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/Serializers.java
new file mode 100644
index 00000000000..ac091d239fe
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/Serializers.java
@@ -0,0 +1,26 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.Serializers for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.type.ArrayType;
+import com.fasterxml.jackson.databind.type.CollectionLikeType;
+import com.fasterxml.jackson.databind.type.CollectionType;
+import com.fasterxml.jackson.databind.type.MapLikeType;
+import com.fasterxml.jackson.databind.type.MapType;
+import com.fasterxml.jackson.databind.type.ReferenceType;
+
+public interface Serializers
+{
+    JsonSerializer<? extends Object> findArraySerializer(SerializationConfig p0, ArrayType p1, BeanDescription p2, TypeSerializer p3, JsonSerializer<Object> p4);
+    JsonSerializer<? extends Object> findCollectionLikeSerializer(SerializationConfig p0, CollectionLikeType p1, BeanDescription p2, TypeSerializer p3, JsonSerializer<Object> p4);
+    JsonSerializer<? extends Object> findCollectionSerializer(SerializationConfig p0, CollectionType p1, BeanDescription p2, TypeSerializer p3, JsonSerializer<Object> p4);
+    JsonSerializer<? extends Object> findMapLikeSerializer(SerializationConfig p0, MapLikeType p1, BeanDescription p2, JsonSerializer<Object> p3, TypeSerializer p4, JsonSerializer<Object> p5);
+    JsonSerializer<? extends Object> findMapSerializer(SerializationConfig p0, MapType p1, BeanDescription p2, JsonSerializer<Object> p3, TypeSerializer p4, JsonSerializer<Object> p5);
+    JsonSerializer<? extends Object> findReferenceSerializer(SerializationConfig p0, ReferenceType p1, BeanDescription p2, TypeSerializer p3, JsonSerializer<Object> p4);
+    JsonSerializer<? extends Object> findSerializer(SerializationConfig p0, JavaType p1, BeanDescription p2);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/VirtualBeanPropertyWriter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/VirtualBeanPropertyWriter.java
new file mode 100644
index 00000000000..d79a9406da0
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/VirtualBeanPropertyWriter.java
@@ -0,0 +1,33 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.VirtualBeanPropertyWriter for testing purposes
+
+package com.fasterxml.jackson.databind.ser;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.introspect.AnnotatedClass;
+import com.fasterxml.jackson.databind.introspect.BeanPropertyDefinition;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.ser.BeanPropertyWriter;
+import com.fasterxml.jackson.databind.util.Annotations;
+import java.io.Serializable;
+
+abstract public class VirtualBeanPropertyWriter extends BeanPropertyWriter implements Serializable
+{
+    protected VirtualBeanPropertyWriter(){}
+    protected VirtualBeanPropertyWriter(BeanPropertyDefinition p0, Annotations p1, JavaType p2){}
+    protected VirtualBeanPropertyWriter(BeanPropertyDefinition p0, Annotations p1, JavaType p2, JsonSerializer<? extends Object> p3, TypeSerializer p4, JavaType p5, JsonInclude.Value p6){}
+    protected VirtualBeanPropertyWriter(VirtualBeanPropertyWriter p0){}
+    protected VirtualBeanPropertyWriter(VirtualBeanPropertyWriter p0, PropertyName p1){}
+    protected abstract Object value(Object p0, JsonGenerator p1, SerializerProvider p2);
+    protected static Object _suppressableValue(JsonInclude.Value p0){ return null; }
+    protected static boolean _suppressNulls(JsonInclude.Value p0){ return false; }
+    public abstract VirtualBeanPropertyWriter withConfig(MapperConfig<? extends Object> p0, AnnotatedClass p1, BeanPropertyDefinition p2, JavaType p3);
+    public boolean isVirtual(){ return false; }
+    public void serializeAsElement(Object p0, JsonGenerator p1, SerializerProvider p2){}
+    public void serializeAsField(Object p0, JsonGenerator p1, SerializerProvider p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/ObjectIdWriter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/ObjectIdWriter.java
new file mode 100644
index 00000000000..77c0c830fb7
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/ObjectIdWriter.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.impl.ObjectIdWriter for testing purposes
+
+package com.fasterxml.jackson.databind.ser.impl;
+
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.core.SerializableString;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.PropertyName;
+
+public class ObjectIdWriter
+{
+    protected ObjectIdWriter() {}
+    protected ObjectIdWriter(JavaType p0, SerializableString p1, ObjectIdGenerator<? extends Object> p2, JsonSerializer<? extends Object> p3, boolean p4){}
+    public ObjectIdWriter withAlwaysAsId(boolean p0){ return null; }
+    public ObjectIdWriter withSerializer(JsonSerializer<? extends Object> p0){ return null; }
+    public final JavaType idType = null;
+    public final JsonSerializer<Object> serializer = null;
+    public final ObjectIdGenerator<? extends Object> generator = null;
+    public final SerializableString propertyName = null;
+    public final boolean alwaysAsId = false;
+    public static ObjectIdWriter construct(JavaType p0, PropertyName p1, ObjectIdGenerator<? extends Object> p2, boolean p3){ return null; }
+    public static ObjectIdWriter construct(JavaType p0, String p1, ObjectIdGenerator<? extends Object> p2, boolean p3){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/PropertySerializerMap.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/PropertySerializerMap.java
new file mode 100644
index 00000000000..6dd7d9ec713
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/PropertySerializerMap.java
@@ -0,0 +1,37 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.impl.PropertySerializerMap for testing purposes
+
+package com.fasterxml.jackson.databind.ser.impl;
+
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+
+abstract public class PropertySerializerMap
+{
+    protected PropertySerializerMap() {}
+    protected PropertySerializerMap(PropertySerializerMap p0){}
+    protected PropertySerializerMap(boolean p0){}
+    protected final boolean _resetWhenFull = false;
+    public abstract JsonSerializer<Object> serializerFor(Class<? extends Object> p0);
+    public abstract PropertySerializerMap newWith(Class<? extends Object> p0, JsonSerializer<Object> p1);
+    public final PropertySerializerMap.SerializerAndMapResult addSerializer(Class<? extends Object> p0, JsonSerializer<Object> p1){ return null; }
+    public final PropertySerializerMap.SerializerAndMapResult addSerializer(JavaType p0, JsonSerializer<Object> p1){ return null; }
+    public final PropertySerializerMap.SerializerAndMapResult findAndAddKeySerializer(Class<? extends Object> p0, SerializerProvider p1, BeanProperty p2){ return null; }
+    public final PropertySerializerMap.SerializerAndMapResult findAndAddPrimarySerializer(Class<? extends Object> p0, SerializerProvider p1, BeanProperty p2){ return null; }
+    public final PropertySerializerMap.SerializerAndMapResult findAndAddPrimarySerializer(JavaType p0, SerializerProvider p1, BeanProperty p2){ return null; }
+    public final PropertySerializerMap.SerializerAndMapResult findAndAddRootValueSerializer(Class<? extends Object> p0, SerializerProvider p1){ return null; }
+    public final PropertySerializerMap.SerializerAndMapResult findAndAddRootValueSerializer(JavaType p0, SerializerProvider p1){ return null; }
+    public final PropertySerializerMap.SerializerAndMapResult findAndAddSecondarySerializer(Class<? extends Object> p0, SerializerProvider p1, BeanProperty p2){ return null; }
+    public final PropertySerializerMap.SerializerAndMapResult findAndAddSecondarySerializer(JavaType p0, SerializerProvider p1, BeanProperty p2){ return null; }
+    public static PropertySerializerMap emptyForProperties(){ return null; }
+    public static PropertySerializerMap emptyForRootValues(){ return null; }
+    public static PropertySerializerMap emptyMap(){ return null; }
+    static public class SerializerAndMapResult
+    {
+        protected SerializerAndMapResult() {}
+        public SerializerAndMapResult(JsonSerializer<Object> p0, PropertySerializerMap p1){}
+        public final JsonSerializer<Object> serializer = null;
+        public final PropertySerializerMap map = null;
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/ReadOnlyClassToSerializerMap.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/ReadOnlyClassToSerializerMap.java
new file mode 100644
index 00000000000..a004d6c33e7
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/ReadOnlyClassToSerializerMap.java
@@ -0,0 +1,21 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.impl.ReadOnlyClassToSerializerMap for testing purposes
+
+package com.fasterxml.jackson.databind.ser.impl;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.util.TypeKey;
+import java.util.HashMap;
+import java.util.Map;
+
+public class ReadOnlyClassToSerializerMap
+{
+    protected ReadOnlyClassToSerializerMap() {}
+    public JsonSerializer<Object> typedValueSerializer(Class<? extends Object> p0){ return null; }
+    public JsonSerializer<Object> typedValueSerializer(JavaType p0){ return null; }
+    public JsonSerializer<Object> untypedValueSerializer(Class<? extends Object> p0){ return null; }
+    public JsonSerializer<Object> untypedValueSerializer(JavaType p0){ return null; }
+    public ReadOnlyClassToSerializerMap(Map<TypeKey, JsonSerializer<Object>> p0){}
+    public int size(){ return 0; }
+    public static ReadOnlyClassToSerializerMap from(HashMap<TypeKey, JsonSerializer<Object>> p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/WritableObjectId.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/WritableObjectId.java
new file mode 100644
index 00000000000..12600d25662
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/impl/WritableObjectId.java
@@ -0,0 +1,20 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.impl.WritableObjectId for testing purposes
+
+package com.fasterxml.jackson.databind.ser.impl;
+
+import com.fasterxml.jackson.annotation.ObjectIdGenerator;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.ser.impl.ObjectIdWriter;
+
+public class WritableObjectId
+{
+    protected WritableObjectId() {}
+    protected boolean idWritten = false;
+    public Object generateId(Object p0){ return null; }
+    public Object id = null;
+    public WritableObjectId(ObjectIdGenerator<? extends Object> p0){}
+    public boolean writeAsId(JsonGenerator p0, SerializerProvider p1, ObjectIdWriter p2){ return false; }
+    public final ObjectIdGenerator<? extends Object> generator = null;
+    public void writeAsField(JsonGenerator p0, SerializerProvider p1, ObjectIdWriter p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/std/BeanSerializerBase.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/std/BeanSerializerBase.java
new file mode 100644
index 00000000000..176aa39299e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/std/BeanSerializerBase.java
@@ -0,0 +1,69 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.std.BeanSerializerBase for testing purposes
+
+package com.fasterxml.jackson.databind.ser.std;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitable;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper;
+import com.fasterxml.jackson.databind.jsonschema.SchemaAware;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.ser.AnyGetterWriter;
+import com.fasterxml.jackson.databind.ser.BeanPropertyWriter;
+import com.fasterxml.jackson.databind.ser.BeanSerializerBuilder;
+import com.fasterxml.jackson.databind.ser.ContextualSerializer;
+import com.fasterxml.jackson.databind.ser.PropertyWriter;
+import com.fasterxml.jackson.databind.ser.ResolvableSerializer;
+import com.fasterxml.jackson.databind.ser.impl.ObjectIdWriter;
+import com.fasterxml.jackson.databind.ser.impl.WritableObjectId;
+import com.fasterxml.jackson.databind.ser.std.StdSerializer;
+import com.fasterxml.jackson.databind.util.NameTransformer;
+import java.lang.reflect.Type;
+import java.util.Iterator;
+
+abstract public class BeanSerializerBase extends StdSerializer<Object> implements ContextualSerializer, JsonFormatVisitable, ResolvableSerializer, SchemaAware
+{
+    protected BeanSerializerBase() {}
+    protected BeanSerializerBase(BeanSerializerBase p0){}
+    protected BeanSerializerBase(BeanSerializerBase p0, NameTransformer p1){}
+    protected BeanSerializerBase(BeanSerializerBase p0, ObjectIdWriter p1){}
+    protected BeanSerializerBase(BeanSerializerBase p0, ObjectIdWriter p1, Object p2){}
+    protected BeanSerializerBase(BeanSerializerBase p0, String[] p1){}
+    protected BeanSerializerBase(JavaType p0, BeanSerializerBuilder p1, BeanPropertyWriter[] p2, BeanPropertyWriter[] p3){}
+    protected JsonSerializer<Object> findConvertingSerializer(SerializerProvider p0, BeanPropertyWriter p1){ return null; }
+    protected abstract BeanSerializerBase asArraySerializer();
+    protected abstract BeanSerializerBase withIgnorals(String[] p0);
+    protected final AnnotatedMember _typeId = null;
+    protected final AnyGetterWriter _anyGetterWriter = null;
+    protected final BeanPropertyWriter[] _filteredProps = null;
+    protected final BeanPropertyWriter[] _props = null;
+    protected final JsonFormat.Shape _serializationShape = null;
+    protected final Object _propertyFilterId = null;
+    protected final ObjectIdWriter _objectIdWriter = null;
+    protected final String _customTypeId(Object p0){ return null; }
+    protected final void _serializeWithObjectId(Object p0, JsonGenerator p1, SerializerProvider p2, TypeSerializer p3){}
+    protected final void _serializeWithObjectId(Object p0, JsonGenerator p1, SerializerProvider p2, boolean p3){}
+    protected static BeanPropertyWriter[] NO_PROPS = null;
+    protected static PropertyName NAME_FOR_OBJECT_REF = null;
+    protected void _serializeObjectId(Object p0, JsonGenerator p1, SerializerProvider p2, TypeSerializer p3, WritableObjectId p4){}
+    protected void serializeFields(Object p0, JsonGenerator p1, SerializerProvider p2){}
+    protected void serializeFieldsFiltered(Object p0, JsonGenerator p1, SerializerProvider p2){}
+    public BeanSerializerBase(BeanSerializerBase p0, BeanPropertyWriter[] p1, BeanPropertyWriter[] p2){}
+    public Iterator<PropertyWriter> properties(){ return null; }
+    public JsonNode getSchema(SerializerProvider p0, Type p1){ return null; }
+    public JsonSerializer<? extends Object> createContextual(SerializerProvider p0, BeanProperty p1){ return null; }
+    public abstract BeanSerializerBase withFilterId(Object p0);
+    public abstract BeanSerializerBase withObjectIdWriter(ObjectIdWriter p0);
+    public abstract void serialize(Object p0, JsonGenerator p1, SerializerProvider p2);
+    public boolean usesObjectId(){ return false; }
+    public void acceptJsonFormatVisitor(JsonFormatVisitorWrapper p0, JavaType p1){}
+    public void resolve(SerializerProvider p0){}
+    public void serializeWithType(Object p0, JsonGenerator p1, SerializerProvider p2, TypeSerializer p3){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/std/MapSerializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/std/MapSerializer.java
new file mode 100644
index 00000000000..f63f49a780f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/std/MapSerializer.java
@@ -0,0 +1,68 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.std.MapSerializer for testing purposes
+
+package com.fasterxml.jackson.databind.ser.std;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.ser.ContainerSerializer;
+import com.fasterxml.jackson.databind.ser.ContextualSerializer;
+import com.fasterxml.jackson.databind.ser.PropertyFilter;
+import com.fasterxml.jackson.databind.ser.impl.PropertySerializerMap;
+import java.lang.reflect.Type;
+import java.util.HashSet;
+import java.util.Map;
+
+public class MapSerializer extends ContainerSerializer<Map<? extends Object, ? extends Object>> implements ContextualSerializer
+{
+    protected MapSerializer() {}
+    protected JsonSerializer<Object> _keySerializer = null;
+    protected JsonSerializer<Object> _valueSerializer = null;
+    protected Map<? extends Object, ? extends Object> _orderEntries(Map<? extends Object, ? extends Object> p0){ return null; }
+    protected MapSerializer(HashSet<String> p0, JavaType p1, JavaType p2, boolean p3, TypeSerializer p4, JsonSerializer<? extends Object> p5, JsonSerializer<? extends Object> p6){}
+    protected MapSerializer(MapSerializer p0, BeanProperty p1, JsonSerializer<? extends Object> p2, JsonSerializer<? extends Object> p3, HashSet<String> p4){}
+    protected MapSerializer(MapSerializer p0, Object p1, boolean p2){}
+    protected MapSerializer(MapSerializer p0, TypeSerializer p1){}
+    protected MapSerializer(MapSerializer p0, TypeSerializer p1, Object p2){}
+    protected PropertySerializerMap _dynamicValueSerializers = null;
+    protected final BeanProperty _property = null;
+    protected final HashSet<String> _ignoredEntries = null;
+    protected final JavaType _keyType = null;
+    protected final JavaType _valueType = null;
+    protected final JsonSerializer<Object> _findAndAddDynamic(PropertySerializerMap p0, Class<? extends Object> p1, SerializerProvider p2){ return null; }
+    protected final JsonSerializer<Object> _findAndAddDynamic(PropertySerializerMap p0, JavaType p1, SerializerProvider p2){ return null; }
+    protected final Object _filterId = null;
+    protected final Object _suppressableValue = null;
+    protected final TypeSerializer _valueTypeSerializer = null;
+    protected final boolean _sortKeys = false;
+    protected final boolean _valueTypeIsStatic = false;
+    protected static JavaType UNSPECIFIED_TYPE = null;
+    protected void _ensureOverride(){}
+    protected void serializeTypedFields(Map<? extends Object, ? extends Object> p0, JsonGenerator p1, SerializerProvider p2){}
+    public JavaType getContentType(){ return null; }
+    public JsonNode getSchema(SerializerProvider p0, Type p1){ return null; }
+    public JsonSerializer<? extends Object> createContextual(SerializerProvider p0, BeanProperty p1){ return null; }
+    public JsonSerializer<? extends Object> getContentSerializer(){ return null; }
+    public JsonSerializer<? extends Object> getKeySerializer(){ return null; }
+    public MapSerializer _withValueTypeSerializer(TypeSerializer p0){ return null; }
+    public MapSerializer withContentInclusion(Object p0){ return null; }
+    public MapSerializer withFilterId(Object p0){ return null; }
+    public MapSerializer withResolved(BeanProperty p0, JsonSerializer<? extends Object> p1, JsonSerializer<? extends Object> p2, HashSet<String> p3, boolean p4){ return null; }
+    public boolean hasSingleElement(Map<? extends Object, ? extends Object> p0){ return false; }
+    public boolean isEmpty(SerializerProvider p0, Map<? extends Object, ? extends Object> p1){ return false; }
+    public static MapSerializer construct(String[] p0, JavaType p1, boolean p2, TypeSerializer p3, JsonSerializer<Object> p4, JsonSerializer<Object> p5, Object p6){ return null; }
+    public void acceptJsonFormatVisitor(JsonFormatVisitorWrapper p0, JavaType p1){}
+    public void serialize(Map<? extends Object, ? extends Object> p0, JsonGenerator p1, SerializerProvider p2){}
+    public void serializeFields(Map<? extends Object, ? extends Object> p0, JsonGenerator p1, SerializerProvider p2){}
+    public void serializeFieldsUsing(Map<? extends Object, ? extends Object> p0, JsonGenerator p1, SerializerProvider p2, JsonSerializer<Object> p3){}
+    public void serializeFilteredFields(Map<? extends Object, ? extends Object> p0, JsonGenerator p1, SerializerProvider p2, PropertyFilter p3){}
+    public void serializeFilteredFields(Map<? extends Object, ? extends Object> p0, JsonGenerator p1, SerializerProvider p2, PropertyFilter p3, Object p4){}
+    public void serializeOptionalFields(Map<? extends Object, ? extends Object> p0, JsonGenerator p1, SerializerProvider p2, Object p3){}
+    public void serializeTypedFields(Map<? extends Object, ? extends Object> p0, JsonGenerator p1, SerializerProvider p2, Object p3){}
+    public void serializeWithType(Map<? extends Object, ? extends Object> p0, JsonGenerator p1, SerializerProvider p2, TypeSerializer p3){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/std/StdSerializer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/std/StdSerializer.java
new file mode 100644
index 00000000000..4b38c3212dc
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/ser/std/StdSerializer.java
@@ -0,0 +1,54 @@
+// Generated automatically from com.fasterxml.jackson.databind.ser.std.StdSerializer for testing purposes
+
+package com.fasterxml.jackson.databind.ser.std;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.BeanProperty;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatTypes;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitable;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper;
+import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonValueFormat;
+import com.fasterxml.jackson.databind.jsonschema.SchemaAware;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.fasterxml.jackson.databind.ser.PropertyFilter;
+import java.io.Serializable;
+import java.lang.reflect.Type;
+
+abstract public class StdSerializer<T> extends JsonSerializer<T> implements JsonFormatVisitable, SchemaAware, Serializable
+{
+    protected StdSerializer() {}
+    protected Boolean findFormatFeature(SerializerProvider p0, BeanProperty p1, Class<? extends Object> p2, JsonFormat.Feature p3){ return null; }
+    protected JsonFormat.Value findFormatOverrides(SerializerProvider p0, BeanProperty p1, Class<? extends Object> p2){ return null; }
+    protected JsonSerializer<? extends Object> findAnnotatedContentSerializer(SerializerProvider p0, BeanProperty p1){ return null; }
+    protected JsonSerializer<? extends Object> findConvertingContentSerializer(SerializerProvider p0, BeanProperty p1, JsonSerializer<? extends Object> p2){ return null; }
+    protected ObjectNode createObjectNode(){ return null; }
+    protected ObjectNode createSchemaNode(String p0){ return null; }
+    protected ObjectNode createSchemaNode(String p0, boolean p1){ return null; }
+    protected PropertyFilter findPropertyFilter(SerializerProvider p0, Object p1, Object p2){ return null; }
+    protected StdSerializer(Class<? extends Object> p0, boolean p1){}
+    protected StdSerializer(Class<T> p0){}
+    protected StdSerializer(JavaType p0){}
+    protected StdSerializer(StdSerializer<? extends Object> p0){}
+    protected boolean isDefaultSerializer(JsonSerializer<? extends Object> p0){ return false; }
+    protected final Class<T> _handledType = null;
+    protected void visitArrayFormat(JsonFormatVisitorWrapper p0, JavaType p1, JsonFormatTypes p2){}
+    protected void visitArrayFormat(JsonFormatVisitorWrapper p0, JavaType p1, JsonSerializer<? extends Object> p2, JavaType p3){}
+    protected void visitFloatFormat(JsonFormatVisitorWrapper p0, JavaType p1, JsonParser.NumberType p2){}
+    protected void visitIntFormat(JsonFormatVisitorWrapper p0, JavaType p1, JsonParser.NumberType p2){}
+    protected void visitIntFormat(JsonFormatVisitorWrapper p0, JavaType p1, JsonParser.NumberType p2, JsonValueFormat p3){}
+    protected void visitStringFormat(JsonFormatVisitorWrapper p0, JavaType p1){}
+    protected void visitStringFormat(JsonFormatVisitorWrapper p0, JavaType p1, JsonValueFormat p2){}
+    public Class<T> handledType(){ return null; }
+    public JsonNode getSchema(SerializerProvider p0, Type p1){ return null; }
+    public JsonNode getSchema(SerializerProvider p0, Type p1, boolean p2){ return null; }
+    public abstract void serialize(T p0, JsonGenerator p1, SerializerProvider p2);
+    public void acceptJsonFormatVisitor(JsonFormatVisitorWrapper p0, JavaType p1){}
+    public void wrapAndThrow(SerializerProvider p0, Throwable p1, Object p2, String p3){}
+    public void wrapAndThrow(SerializerProvider p0, Throwable p1, Object p2, int p3){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ArrayType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ArrayType.java
new file mode 100644
index 00000000000..5834a528111
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ArrayType.java
@@ -0,0 +1,37 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.ArrayType for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.TypeBase;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+
+public class ArrayType extends TypeBase
+{
+    protected ArrayType() {}
+    protected ArrayType(JavaType p0, TypeBindings p1, Object p2, Object p3, Object p4, boolean p5){}
+    protected JavaType _narrow(Class<? extends Object> p0){ return null; }
+    protected final JavaType _componentType = null;
+    protected final Object _emptyArray = null;
+    public ArrayType withContentTypeHandler(Object p0){ return null; }
+    public ArrayType withContentValueHandler(Object p0){ return null; }
+    public ArrayType withStaticTyping(){ return null; }
+    public ArrayType withTypeHandler(Object p0){ return null; }
+    public ArrayType withValueHandler(Object p0){ return null; }
+    public JavaType getContentType(){ return null; }
+    public JavaType refine(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){ return null; }
+    public JavaType withContentType(JavaType p0){ return null; }
+    public Object getContentTypeHandler(){ return null; }
+    public Object getContentValueHandler(){ return null; }
+    public String toString(){ return null; }
+    public StringBuilder getErasedSignature(StringBuilder p0){ return null; }
+    public StringBuilder getGenericSignature(StringBuilder p0){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean hasGenericTypes(){ return false; }
+    public boolean isAbstract(){ return false; }
+    public boolean isArrayType(){ return false; }
+    public boolean isConcrete(){ return false; }
+    public boolean isContainerType(){ return false; }
+    public static ArrayType construct(JavaType p0, TypeBindings p1){ return null; }
+    public static ArrayType construct(JavaType p0, TypeBindings p1, Object p2, Object p3){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ClassKey.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ClassKey.java
new file mode 100644
index 00000000000..bda8741908f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ClassKey.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.ClassKey for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import java.io.Serializable;
+
+public class ClassKey implements Comparable<ClassKey>, Serializable
+{
+    public ClassKey(){}
+    public ClassKey(Class<? extends Object> p0){}
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int compareTo(ClassKey p0){ return 0; }
+    public int hashCode(){ return 0; }
+    public void reset(Class<? extends Object> p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ClassStack.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ClassStack.java
new file mode 100644
index 00000000000..4107bbc142f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ClassStack.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.ClassStack for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.ResolvedRecursiveType;
+
+public class ClassStack
+{
+    protected ClassStack() {}
+    protected final Class<? extends Object> _current = null;
+    protected final ClassStack _parent = null;
+    public ClassStack child(Class<? extends Object> p0){ return null; }
+    public ClassStack find(Class<? extends Object> p0){ return null; }
+    public ClassStack(Class<? extends Object> p0){}
+    public String toString(){ return null; }
+    public void addSelfReference(ResolvedRecursiveType p0){}
+    public void resolveSelfReferences(JavaType p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/CollectionLikeType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/CollectionLikeType.java
new file mode 100644
index 00000000000..c43af707c00
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/CollectionLikeType.java
@@ -0,0 +1,37 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.CollectionLikeType for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.TypeBase;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+
+public class CollectionLikeType extends TypeBase
+{
+    protected CollectionLikeType() {}
+    protected CollectionLikeType(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3, JavaType p4, Object p5, Object p6, boolean p7){}
+    protected CollectionLikeType(TypeBase p0, JavaType p1){}
+    protected JavaType _narrow(Class<? extends Object> p0){ return null; }
+    protected String buildCanonicalName(){ return null; }
+    protected final JavaType _elementType = null;
+    public CollectionLikeType withContentTypeHandler(Object p0){ return null; }
+    public CollectionLikeType withContentValueHandler(Object p0){ return null; }
+    public CollectionLikeType withStaticTyping(){ return null; }
+    public CollectionLikeType withTypeHandler(Object p0){ return null; }
+    public CollectionLikeType withValueHandler(Object p0){ return null; }
+    public JavaType getContentType(){ return null; }
+    public JavaType refine(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){ return null; }
+    public JavaType withContentType(JavaType p0){ return null; }
+    public Object getContentTypeHandler(){ return null; }
+    public Object getContentValueHandler(){ return null; }
+    public String toString(){ return null; }
+    public StringBuilder getErasedSignature(StringBuilder p0){ return null; }
+    public StringBuilder getGenericSignature(StringBuilder p0){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isCollectionLikeType(){ return false; }
+    public boolean isContainerType(){ return false; }
+    public boolean isTrueCollectionType(){ return false; }
+    public static CollectionLikeType construct(Class<? extends Object> p0, JavaType p1){ return null; }
+    public static CollectionLikeType construct(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3, JavaType p4){ return null; }
+    public static CollectionLikeType upgradeFrom(JavaType p0, JavaType p1){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/CollectionType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/CollectionType.java
new file mode 100644
index 00000000000..3144fd68cc3
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/CollectionType.java
@@ -0,0 +1,25 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.CollectionType for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.CollectionLikeType;
+import com.fasterxml.jackson.databind.type.TypeBase;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+
+public class CollectionType extends CollectionLikeType
+{
+    protected CollectionType() {}
+    protected CollectionType(TypeBase p0, JavaType p1){}
+    protected JavaType _narrow(Class<? extends Object> p0){ return null; }
+    public CollectionType withContentTypeHandler(Object p0){ return null; }
+    public CollectionType withContentValueHandler(Object p0){ return null; }
+    public CollectionType withStaticTyping(){ return null; }
+    public CollectionType withTypeHandler(Object p0){ return null; }
+    public CollectionType withValueHandler(Object p0){ return null; }
+    public JavaType refine(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){ return null; }
+    public JavaType withContentType(JavaType p0){ return null; }
+    public String toString(){ return null; }
+    public static CollectionType construct(Class<? extends Object> p0, JavaType p1){ return null; }
+    public static CollectionType construct(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3, JavaType p4){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/MapLikeType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/MapLikeType.java
new file mode 100644
index 00000000000..411c3247fc9
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/MapLikeType.java
@@ -0,0 +1,41 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.MapLikeType for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.TypeBase;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+
+public class MapLikeType extends TypeBase
+{
+    protected MapLikeType() {}
+    protected JavaType _narrow(Class<? extends Object> p0){ return null; }
+    protected MapLikeType(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3, JavaType p4, JavaType p5, Object p6, Object p7, boolean p8){}
+    protected MapLikeType(TypeBase p0, JavaType p1, JavaType p2){}
+    protected String buildCanonicalName(){ return null; }
+    protected final JavaType _keyType = null;
+    protected final JavaType _valueType = null;
+    public JavaType getContentType(){ return null; }
+    public JavaType getKeyType(){ return null; }
+    public JavaType refine(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){ return null; }
+    public JavaType withContentType(JavaType p0){ return null; }
+    public MapLikeType withContentTypeHandler(Object p0){ return null; }
+    public MapLikeType withContentValueHandler(Object p0){ return null; }
+    public MapLikeType withKeyType(JavaType p0){ return null; }
+    public MapLikeType withKeyTypeHandler(Object p0){ return null; }
+    public MapLikeType withKeyValueHandler(Object p0){ return null; }
+    public MapLikeType withStaticTyping(){ return null; }
+    public MapLikeType withTypeHandler(Object p0){ return null; }
+    public MapLikeType withValueHandler(Object p0){ return null; }
+    public Object getContentTypeHandler(){ return null; }
+    public Object getContentValueHandler(){ return null; }
+    public String toString(){ return null; }
+    public StringBuilder getErasedSignature(StringBuilder p0){ return null; }
+    public StringBuilder getGenericSignature(StringBuilder p0){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isContainerType(){ return false; }
+    public boolean isMapLikeType(){ return false; }
+    public boolean isTrueMapType(){ return false; }
+    public static MapLikeType construct(Class<? extends Object> p0, JavaType p1, JavaType p2){ return null; }
+    public static MapLikeType upgradeFrom(JavaType p0, JavaType p1, JavaType p2){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/MapType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/MapType.java
new file mode 100644
index 00000000000..c1bc8d9a6c1
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/MapType.java
@@ -0,0 +1,28 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.MapType for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.MapLikeType;
+import com.fasterxml.jackson.databind.type.TypeBase;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+
+public class MapType extends MapLikeType
+{
+    protected MapType() {}
+    protected JavaType _narrow(Class<? extends Object> p0){ return null; }
+    protected MapType(TypeBase p0, JavaType p1, JavaType p2){}
+    public JavaType refine(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){ return null; }
+    public JavaType withContentType(JavaType p0){ return null; }
+    public MapType withContentTypeHandler(Object p0){ return null; }
+    public MapType withContentValueHandler(Object p0){ return null; }
+    public MapType withKeyType(JavaType p0){ return null; }
+    public MapType withKeyTypeHandler(Object p0){ return null; }
+    public MapType withKeyValueHandler(Object p0){ return null; }
+    public MapType withStaticTyping(){ return null; }
+    public MapType withTypeHandler(Object p0){ return null; }
+    public MapType withValueHandler(Object p0){ return null; }
+    public String toString(){ return null; }
+    public static MapType construct(Class<? extends Object> p0, JavaType p1, JavaType p2){ return null; }
+    public static MapType construct(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3, JavaType p4, JavaType p5){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ReferenceType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ReferenceType.java
new file mode 100644
index 00000000000..aa8c6250c3c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ReferenceType.java
@@ -0,0 +1,35 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.ReferenceType for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.SimpleType;
+import com.fasterxml.jackson.databind.type.TypeBase;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+
+public class ReferenceType extends SimpleType
+{
+    protected ReferenceType() {}
+    protected JavaType _narrow(Class<? extends Object> p0){ return null; }
+    protected ReferenceType(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3, JavaType p4, Object p5, Object p6, boolean p7){}
+    protected ReferenceType(TypeBase p0, JavaType p1){}
+    protected String buildCanonicalName(){ return null; }
+    protected final JavaType _referencedType = null;
+    public JavaType getContentType(){ return null; }
+    public JavaType getReferencedType(){ return null; }
+    public JavaType refine(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){ return null; }
+    public JavaType withContentType(JavaType p0){ return null; }
+    public ReferenceType withContentTypeHandler(Object p0){ return null; }
+    public ReferenceType withContentValueHandler(Object p0){ return null; }
+    public ReferenceType withStaticTyping(){ return null; }
+    public ReferenceType withTypeHandler(Object p0){ return null; }
+    public ReferenceType withValueHandler(Object p0){ return null; }
+    public String toString(){ return null; }
+    public StringBuilder getErasedSignature(StringBuilder p0){ return null; }
+    public StringBuilder getGenericSignature(StringBuilder p0){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isReferenceType(){ return false; }
+    public static ReferenceType construct(Class<? extends Object> p0, JavaType p1){ return null; }
+    public static ReferenceType construct(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3, JavaType p4){ return null; }
+    public static ReferenceType upgradeFrom(JavaType p0, JavaType p1){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ResolvedRecursiveType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ResolvedRecursiveType.java
new file mode 100644
index 00000000000..93a568968cf
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/ResolvedRecursiveType.java
@@ -0,0 +1,29 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.ResolvedRecursiveType for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.TypeBase;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+
+public class ResolvedRecursiveType extends TypeBase
+{
+    protected ResolvedRecursiveType() {}
+    protected JavaType _narrow(Class<? extends Object> p0){ return null; }
+    protected JavaType _referencedType = null;
+    public JavaType getSelfReferencedType(){ return null; }
+    public JavaType refine(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){ return null; }
+    public JavaType withContentType(JavaType p0){ return null; }
+    public JavaType withContentTypeHandler(Object p0){ return null; }
+    public JavaType withContentValueHandler(Object p0){ return null; }
+    public JavaType withStaticTyping(){ return null; }
+    public JavaType withTypeHandler(Object p0){ return null; }
+    public JavaType withValueHandler(Object p0){ return null; }
+    public ResolvedRecursiveType(Class<? extends Object> p0, TypeBindings p1){}
+    public String toString(){ return null; }
+    public StringBuilder getErasedSignature(StringBuilder p0){ return null; }
+    public StringBuilder getGenericSignature(StringBuilder p0){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isContainerType(){ return false; }
+    public void setReference(JavaType p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/SimpleType.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/SimpleType.java
new file mode 100644
index 00000000000..01dfc2e4c51
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/SimpleType.java
@@ -0,0 +1,33 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.SimpleType for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.TypeBase;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+
+public class SimpleType extends TypeBase
+{
+    protected SimpleType() {}
+    protected JavaType _narrow(Class<? extends Object> p0){ return null; }
+    protected SimpleType(Class<? extends Object> p0){}
+    protected SimpleType(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){}
+    protected SimpleType(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3, Object p4, Object p5, boolean p6){}
+    protected SimpleType(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3, int p4, Object p5, Object p6, boolean p7){}
+    protected SimpleType(TypeBase p0){}
+    protected String buildCanonicalName(){ return null; }
+    public JavaType refine(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){ return null; }
+    public JavaType withContentType(JavaType p0){ return null; }
+    public JavaType withContentTypeHandler(Object p0){ return null; }
+    public SimpleType withContentValueHandler(Object p0){ return null; }
+    public SimpleType withStaticTyping(){ return null; }
+    public SimpleType withTypeHandler(Object p0){ return null; }
+    public SimpleType withValueHandler(Object p0){ return null; }
+    public String toString(){ return null; }
+    public StringBuilder getErasedSignature(StringBuilder p0){ return null; }
+    public StringBuilder getGenericSignature(StringBuilder p0){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isContainerType(){ return false; }
+    public static SimpleType construct(Class<? extends Object> p0){ return null; }
+    public static SimpleType constructUnsafe(Class<? extends Object> p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeBase.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeBase.java
new file mode 100644
index 00000000000..6a3094fcfe1
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeBase.java
@@ -0,0 +1,39 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.TypeBase for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.JsonSerializable;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+import java.util.List;
+
+abstract public class TypeBase extends JavaType implements JsonSerializable
+{
+    protected TypeBase() {}
+    protected String buildCanonicalName(){ return null; }
+    protected TypeBase(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3, int p4, Object p5, Object p6, boolean p7){}
+    protected TypeBase(TypeBase p0){}
+    protected final JavaType _superClass = null;
+    protected final JavaType[] _superInterfaces = null;
+    protected final TypeBindings _bindings = null;
+    protected static JavaType _bogusSuperClass(Class<? extends Object> p0){ return null; }
+    protected static StringBuilder _classSignature(Class<? extends Object> p0, StringBuilder p1, boolean p2){ return null; }
+    public <T> T getTypeHandler(){ return null; }
+    public <T> T getValueHandler(){ return null; }
+    public JavaType containedType(int p0){ return null; }
+    public JavaType getSuperClass(){ return null; }
+    public JavaType[] findTypeParameters(Class<? extends Object> p0){ return null; }
+    public List<JavaType> getInterfaces(){ return null; }
+    public String containedTypeName(int p0){ return null; }
+    public String toCanonical(){ return null; }
+    public TypeBindings getBindings(){ return null; }
+    public abstract StringBuilder getErasedSignature(StringBuilder p0);
+    public abstract StringBuilder getGenericSignature(StringBuilder p0);
+    public final JavaType findSuperType(Class<? extends Object> p0){ return null; }
+    public int containedTypeCount(){ return 0; }
+    public void serialize(JsonGenerator p0, SerializerProvider p1){}
+    public void serializeWithType(JsonGenerator p0, SerializerProvider p1, TypeSerializer p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeBindings.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeBindings.java
new file mode 100644
index 00000000000..3efa0822c87
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeBindings.java
@@ -0,0 +1,33 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.TypeBindings for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import java.io.Serializable;
+import java.util.List;
+
+public class TypeBindings implements Serializable
+{
+    protected TypeBindings() {}
+    protected JavaType[] typeParameterArray(){ return null; }
+    protected Object readResolve(){ return null; }
+    public JavaType findBoundType(String p0){ return null; }
+    public JavaType getBoundType(int p0){ return null; }
+    public List<JavaType> getTypeParameters(){ return null; }
+    public Object asKey(Class<? extends Object> p0){ return null; }
+    public String getBoundName(int p0){ return null; }
+    public String toString(){ return null; }
+    public TypeBindings withUnboundVariable(String p0){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean hasUnbound(String p0){ return false; }
+    public boolean isEmpty(){ return false; }
+    public int hashCode(){ return 0; }
+    public int size(){ return 0; }
+    public static TypeBindings create(Class<? extends Object> p0, JavaType p1){ return null; }
+    public static TypeBindings create(Class<? extends Object> p0, JavaType p1, JavaType p2){ return null; }
+    public static TypeBindings create(Class<? extends Object> p0, JavaType[] p1){ return null; }
+    public static TypeBindings create(Class<? extends Object> p0, List<JavaType> p1){ return null; }
+    public static TypeBindings createIfNeeded(Class<? extends Object> p0, JavaType p1){ return null; }
+    public static TypeBindings createIfNeeded(Class<? extends Object> p0, JavaType[] p1){ return null; }
+    public static TypeBindings emptyBindings(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeFactory.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeFactory.java
new file mode 100644
index 00000000000..4bd01f7904a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeFactory.java
@@ -0,0 +1,106 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.TypeFactory for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.ArrayType;
+import com.fasterxml.jackson.databind.type.ClassStack;
+import com.fasterxml.jackson.databind.type.CollectionLikeType;
+import com.fasterxml.jackson.databind.type.CollectionType;
+import com.fasterxml.jackson.databind.type.MapLikeType;
+import com.fasterxml.jackson.databind.type.MapType;
+import com.fasterxml.jackson.databind.type.SimpleType;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+import com.fasterxml.jackson.databind.type.TypeModifier;
+import com.fasterxml.jackson.databind.type.TypeParser;
+import com.fasterxml.jackson.databind.util.LRUMap;
+import java.io.Serializable;
+import java.lang.reflect.GenericArrayType;
+import java.lang.reflect.GenericDeclaration;
+import java.lang.reflect.ParameterizedType;
+import java.lang.reflect.Type;
+import java.lang.reflect.TypeVariable;
+import java.lang.reflect.WildcardType;
+import java.util.Collection;
+import java.util.Map;
+
+public class TypeFactory implements Serializable
+{
+    protected TypeFactory() {}
+    protected Class<? extends Object> _findPrimitive(String p0){ return null; }
+    protected Class<? extends Object> classForName(String p0){ return null; }
+    protected Class<? extends Object> classForName(String p0, boolean p1, ClassLoader p2){ return null; }
+    protected JavaType _constructSimple(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){ return null; }
+    protected JavaType _findWellKnownSimple(Class<? extends Object> p0){ return null; }
+    protected JavaType _fromAny(ClassStack p0, Type p1, TypeBindings p2){ return null; }
+    protected JavaType _fromArrayType(ClassStack p0, GenericArrayType p1, TypeBindings p2){ return null; }
+    protected JavaType _fromClass(ClassStack p0, Class<? extends Object> p1, TypeBindings p2){ return null; }
+    protected JavaType _fromParamType(ClassStack p0, ParameterizedType p1, TypeBindings p2){ return null; }
+    protected JavaType _fromVariable(ClassStack p0, TypeVariable<? extends Object> p1, TypeBindings p2){ return null; }
+    protected JavaType _fromWellKnownClass(ClassStack p0, Class<? extends Object> p1, TypeBindings p2, JavaType p3, JavaType[] p4){ return null; }
+    protected JavaType _fromWellKnownInterface(ClassStack p0, Class<? extends Object> p1, TypeBindings p2, JavaType p3, JavaType[] p4){ return null; }
+    protected JavaType _fromWildcard(ClassStack p0, WildcardType p1, TypeBindings p2){ return null; }
+    protected JavaType _newSimpleType(Class<? extends Object> p0, TypeBindings p1, JavaType p2, JavaType[] p3){ return null; }
+    protected JavaType _resolveSuperClass(ClassStack p0, Class<? extends Object> p1, TypeBindings p2){ return null; }
+    protected JavaType _unknownType(){ return null; }
+    protected JavaType[] _resolveSuperInterfaces(ClassStack p0, Class<? extends Object> p1, TypeBindings p2){ return null; }
+    protected TypeFactory(TypeParser p0, TypeModifier[] p1){}
+    protected TypeFactory(TypeParser p0, TypeModifier[] p1, ClassLoader p2){}
+    protected final ClassLoader _classLoader = null;
+    protected final LRUMap<Object, JavaType> _typeCache = null;
+    protected final TypeModifier[] _modifiers = null;
+    protected final TypeParser _parser = null;
+    protected static SimpleType CORE_TYPE_BOOL = null;
+    protected static SimpleType CORE_TYPE_CLASS = null;
+    protected static SimpleType CORE_TYPE_COMPARABLE = null;
+    protected static SimpleType CORE_TYPE_ENUM = null;
+    protected static SimpleType CORE_TYPE_INT = null;
+    protected static SimpleType CORE_TYPE_LONG = null;
+    protected static SimpleType CORE_TYPE_OBJECT = null;
+    protected static SimpleType CORE_TYPE_STRING = null;
+    protected static TypeBindings EMPTY_BINDINGS = null;
+    protected static TypeFactory instance = null;
+    public ArrayType constructArrayType(Class<? extends Object> p0){ return null; }
+    public ArrayType constructArrayType(JavaType p0){ return null; }
+    public Class<? extends Object> findClass(String p0){ return null; }
+    public ClassLoader getClassLoader(){ return null; }
+    public CollectionLikeType constructCollectionLikeType(Class<? extends Object> p0, Class<? extends Object> p1){ return null; }
+    public CollectionLikeType constructCollectionLikeType(Class<? extends Object> p0, JavaType p1){ return null; }
+    public CollectionLikeType constructRawCollectionLikeType(Class<? extends Object> p0){ return null; }
+    public CollectionType constructCollectionType(Class<? extends Collection> p0, Class<? extends Object> p1){ return null; }
+    public CollectionType constructCollectionType(Class<? extends Collection> p0, JavaType p1){ return null; }
+    public CollectionType constructRawCollectionType(Class<? extends Collection> p0){ return null; }
+    public JavaType constructFromCanonical(String p0){ return null; }
+    public JavaType constructGeneralizedType(JavaType p0, Class<? extends Object> p1){ return null; }
+    public JavaType constructParametricType(Class<? extends Object> p0, Class<? extends Object>... p1){ return null; }
+    public JavaType constructParametricType(Class<? extends Object> p0, JavaType... p1){ return null; }
+    public JavaType constructParametrizedType(Class<? extends Object> p0, Class<? extends Object> p1, Class<? extends Object>... p2){ return null; }
+    public JavaType constructParametrizedType(Class<? extends Object> p0, Class<? extends Object> p1, JavaType... p2){ return null; }
+    public JavaType constructReferenceType(Class<? extends Object> p0, JavaType p1){ return null; }
+    public JavaType constructSimpleType(Class<? extends Object> p0, Class<? extends Object> p1, JavaType[] p2){ return null; }
+    public JavaType constructSimpleType(Class<? extends Object> p0, JavaType[] p1){ return null; }
+    public JavaType constructSpecializedType(JavaType p0, Class<? extends Object> p1){ return null; }
+    public JavaType constructType(Type p0){ return null; }
+    public JavaType constructType(Type p0, Class<? extends Object> p1){ return null; }
+    public JavaType constructType(Type p0, JavaType p1){ return null; }
+    public JavaType constructType(Type p0, TypeBindings p1){ return null; }
+    public JavaType constructType(TypeReference<? extends Object> p0){ return null; }
+    public JavaType moreSpecificType(JavaType p0, JavaType p1){ return null; }
+    public JavaType uncheckedSimpleType(Class<? extends Object> p0){ return null; }
+    public JavaType[] findTypeParameters(Class<? extends Object> p0, Class<? extends Object> p1){ return null; }
+    public JavaType[] findTypeParameters(Class<? extends Object> p0, Class<? extends Object> p1, TypeBindings p2){ return null; }
+    public JavaType[] findTypeParameters(JavaType p0, Class<? extends Object> p1){ return null; }
+    public MapLikeType constructMapLikeType(Class<? extends Object> p0, Class<? extends Object> p1, Class<? extends Object> p2){ return null; }
+    public MapLikeType constructMapLikeType(Class<? extends Object> p0, JavaType p1, JavaType p2){ return null; }
+    public MapLikeType constructRawMapLikeType(Class<? extends Object> p0){ return null; }
+    public MapType constructMapType(Class<? extends Map> p0, Class<? extends Object> p1, Class<? extends Object> p2){ return null; }
+    public MapType constructMapType(Class<? extends Map> p0, JavaType p1, JavaType p2){ return null; }
+    public MapType constructRawMapType(Class<? extends Map> p0){ return null; }
+    public TypeFactory withClassLoader(ClassLoader p0){ return null; }
+    public TypeFactory withModifier(TypeModifier p0){ return null; }
+    public static Class<? extends Object> rawClass(Type p0){ return null; }
+    public static JavaType unknownType(){ return null; }
+    public static TypeFactory defaultInstance(){ return null; }
+    public void clearCache(){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeModifier.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeModifier.java
new file mode 100644
index 00000000000..72221c829f0
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeModifier.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.TypeModifier for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.TypeBindings;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import java.lang.reflect.Type;
+
+abstract public class TypeModifier
+{
+    public TypeModifier(){}
+    public abstract JavaType modifyType(JavaType p0, Type p1, TypeBindings p2, TypeFactory p3);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeParser.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeParser.java
new file mode 100644
index 00000000000..651fa7c0d88
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/type/TypeParser.java
@@ -0,0 +1,44 @@
+// Generated automatically from com.fasterxml.jackson.databind.type.TypeParser for testing purposes
+
+package com.fasterxml.jackson.databind.type;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+import java.io.Serializable;
+import java.util.List;
+import java.util.StringTokenizer;
+
+public class TypeParser implements Serializable {
+    protected TypeParser() {}
+
+    protected Class<? extends Object> findClass(String p0, TypeParser.MyTokenizer p1) {
+        return null;
+    }
+
+    protected IllegalArgumentException _problem(TypeParser.MyTokenizer p0, String p1) {
+        return null;
+    }
+
+    protected JavaType parseType(TypeParser.MyTokenizer p0) {
+        return null;
+    }
+
+    protected List<JavaType> parseTypes(TypeParser.MyTokenizer p0) {
+        return null;
+    }
+
+    protected final TypeFactory _factory = null;
+
+    public JavaType parse(String p0) {
+        return null;
+    }
+
+    public TypeParser withFactory(TypeFactory p0) {
+        return null;
+    }
+
+    public TypeParser(TypeFactory p0) {}
+
+    class MyTokenizer {
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/Annotations.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/Annotations.java
new file mode 100644
index 00000000000..3ef83182037
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/Annotations.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.Annotations for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+import java.lang.annotation.Annotation;
+
+public interface Annotations
+{
+    <A extends Annotation> A get(Class<A> p0);
+    int size();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ArrayBuilders.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ArrayBuilders.java
new file mode 100644
index 00000000000..f0ac6bdcba4
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ArrayBuilders.java
@@ -0,0 +1,63 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.ArrayBuilders for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+import com.fasterxml.jackson.databind.util.PrimitiveArrayBuilder;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+public class ArrayBuilders
+{
+    public ArrayBuilders(){}
+    public ArrayBuilders.BooleanBuilder getBooleanBuilder(){ return null; }
+    public ArrayBuilders.ByteBuilder getByteBuilder(){ return null; }
+    public ArrayBuilders.DoubleBuilder getDoubleBuilder(){ return null; }
+    public ArrayBuilders.FloatBuilder getFloatBuilder(){ return null; }
+    public ArrayBuilders.IntBuilder getIntBuilder(){ return null; }
+    public ArrayBuilders.LongBuilder getLongBuilder(){ return null; }
+    public ArrayBuilders.ShortBuilder getShortBuilder(){ return null; }
+    public static <T> ArrayList<T> arrayToList(T[] p0){ return null; }
+    public static <T> HashSet<T> arrayToSet(T[] p0){ return null; }
+    public static <T> HashSet<T> setAndArray(Set<T> p0, T[] p1){ return null; }
+    public static <T> List<T> addToList(List<T> p0, T p1){ return null; }
+    public static <T> T[] insertInList(T[] p0, T p1){ return null; }
+    public static <T> T[] insertInListNoDup(T[] p0, T p1){ return null; }
+    public static Object getArrayComparator(Object p0){ return null; }
+    static public class BooleanBuilder extends PrimitiveArrayBuilder<boolean[]>
+    {
+        public BooleanBuilder(){}
+        public final boolean[] _constructArray(int p0){ return null; }
+    }
+    static public class ByteBuilder extends PrimitiveArrayBuilder<byte[]>
+    {
+        public ByteBuilder(){}
+        public final byte[] _constructArray(int p0){ return null; }
+    }
+    static public class DoubleBuilder extends PrimitiveArrayBuilder<double[]>
+    {
+        public DoubleBuilder(){}
+        public final double[] _constructArray(int p0){ return null; }
+    }
+    static public class FloatBuilder extends PrimitiveArrayBuilder<float[]>
+    {
+        public FloatBuilder(){}
+        public final float[] _constructArray(int p0){ return null; }
+    }
+    static public class IntBuilder extends PrimitiveArrayBuilder<int[]>
+    {
+        public IntBuilder(){}
+        public final int[] _constructArray(int p0){ return null; }
+    }
+    static public class LongBuilder extends PrimitiveArrayBuilder<long[]>
+    {
+        public LongBuilder(){}
+        public final long[] _constructArray(int p0){ return null; }
+    }
+    static public class ShortBuilder extends PrimitiveArrayBuilder<short[]>
+    {
+        public ShortBuilder(){}
+        public final short[] _constructArray(int p0){ return null; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ClassUtil.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ClassUtil.java
new file mode 100644
index 00000000000..57abe866049
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ClassUtil.java
@@ -0,0 +1,79 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.ClassUtil for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+import com.fasterxml.jackson.databind.JavaType;
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Member;
+import java.lang.reflect.Method;
+import java.lang.reflect.Type;
+import java.util.EnumMap;
+import java.util.EnumSet;
+import java.util.Iterator;
+import java.util.List;
+
+public class ClassUtil
+{
+    public ClassUtil(){}
+    public static <T> Constructor<T> findConstructor(Class<T> p0, boolean p1){ return null; }
+    public static <T> Iterator<T> emptyIterator(){ return null; }
+    public static <T> T createInstance(Class<T> p0, boolean p1){ return null; }
+    public static Annotation[] findClassAnnotations(Class<? extends Object> p0){ return null; }
+    public static Class<? extends Enum<? extends Object>> findEnumType(Class<? extends Object> p0){ return null; }
+    public static Class<? extends Enum<? extends Object>> findEnumType(Enum<? extends Object> p0){ return null; }
+    public static Class<? extends Enum<? extends Object>> findEnumType(EnumMap<? extends Object, ? extends Object> p0){ return null; }
+    public static Class<? extends Enum<? extends Object>> findEnumType(EnumSet<? extends Object> p0){ return null; }
+    public static Class<? extends Object> findClass(String p0){ return null; }
+    public static Class<? extends Object> getDeclaringClass(Class<? extends Object> p0){ return null; }
+    public static Class<? extends Object> getEnclosingClass(Class<? extends Object> p0){ return null; }
+    public static Class<? extends Object> getOuterClass(Class<? extends Object> p0){ return null; }
+    public static Class<? extends Object> primitiveType(Class<? extends Object> p0){ return null; }
+    public static Class<? extends Object> wrapperType(Class<? extends Object> p0){ return null; }
+    public static ClassUtil.Ctor[] getConstructors(Class<? extends Object> p0){ return null; }
+    public static Field[] getDeclaredFields(Class<? extends Object> p0){ return null; }
+    public static List<Class<? extends Object>> findRawSuperTypes(Class<? extends Object> p0, Class<? extends Object> p1, boolean p2){ return null; }
+    public static List<Class<? extends Object>> findSuperClasses(Class<? extends Object> p0, Class<? extends Object> p1, boolean p2){ return null; }
+    public static List<Class<? extends Object>> findSuperTypes(Class<? extends Object> p0, Class<? extends Object> p1){ return null; }
+    public static List<Class<? extends Object>> findSuperTypes(Class<? extends Object> p0, Class<? extends Object> p1, List<Class<? extends Object>> p2){ return null; }
+    public static List<JavaType> findSuperTypes(JavaType p0, Class<? extends Object> p1, boolean p2){ return null; }
+    public static Method[] getDeclaredMethods(Class<? extends Object> p0){ return null; }
+    public static Object defaultValue(Class<? extends Object> p0){ return null; }
+    public static String canBeABeanType(Class<? extends Object> p0){ return null; }
+    public static String getClassDescription(Object p0){ return null; }
+    public static String getPackageName(Class<? extends Object> p0){ return null; }
+    public static String isLocalType(Class<? extends Object> p0, boolean p1){ return null; }
+    public static Throwable getRootCause(Throwable p0){ return null; }
+    public static Type getGenericSuperclass(Class<? extends Object> p0){ return null; }
+    public static Type[] getGenericInterfaces(Class<? extends Object> p0){ return null; }
+    public static boolean hasEnclosingMethod(Class<? extends Object> p0){ return false; }
+    public static boolean hasGetterSignature(Method p0){ return false; }
+    public static boolean isBogusClass(Class<? extends Object> p0){ return false; }
+    public static boolean isCollectionMapOrArray(Class<? extends Object> p0){ return false; }
+    public static boolean isConcrete(Class<? extends Object> p0){ return false; }
+    public static boolean isConcrete(Member p0){ return false; }
+    public static boolean isJacksonStdImpl(Class<? extends Object> p0){ return false; }
+    public static boolean isJacksonStdImpl(Object p0){ return false; }
+    public static boolean isNonStaticInnerClass(Class<? extends Object> p0){ return false; }
+    public static boolean isObjectOrPrimitive(Class<? extends Object> p0){ return false; }
+    public static boolean isProxyType(Class<? extends Object> p0){ return false; }
+    public static void checkAndFixAccess(Member p0){}
+    public static void checkAndFixAccess(Member p0, boolean p1){}
+    public static void throwAsIAE(Throwable p0){}
+    public static void throwAsIAE(Throwable p0, String p1){}
+    public static void throwRootCause(Throwable p0){}
+    public static void unwrapAndThrowAsIAE(Throwable p0){}
+    public static void unwrapAndThrowAsIAE(Throwable p0, String p1){}
+    static public class Ctor
+    {
+        protected Ctor() {}
+        public Annotation[] getDeclaredAnnotations(){ return null; }
+        public Annotation[][] getParameterAnnotations(){ return null; }
+        public Class<? extends Object> getDeclaringClass(){ return null; }
+        public Constructor<? extends Object> getConstructor(){ return null; }
+        public Ctor(Constructor<? extends Object> p0){}
+        public final Constructor<? extends Object> _ctor = null;
+        public int getParamCount(){ return 0; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/Converter.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/Converter.java
new file mode 100644
index 00000000000..5bf5119293a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/Converter.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.Converter for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.type.TypeFactory;
+
+public interface Converter<IN, OUT>
+{
+    JavaType getInputType(TypeFactory p0);
+    JavaType getOutputType(TypeFactory p0);
+    OUT convert(IN p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/LRUMap.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/LRUMap.java
new file mode 100644
index 00000000000..75b5209641e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/LRUMap.java
@@ -0,0 +1,21 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.LRUMap for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+import java.io.Serializable;
+import java.util.concurrent.ConcurrentHashMap;
+
+public class LRUMap<K, V> implements Serializable
+{
+    protected LRUMap() {}
+    protected Object readResolve(){ return null; }
+    protected final ConcurrentHashMap<K, V> _map = null;
+    protected final int _maxEntries = 0;
+    protected int _jdkSerializeMaxEntries = 0;
+    public LRUMap(int p0, int p1){}
+    public V get(Object p0){ return null; }
+    public V put(K p0, V p1){ return null; }
+    public V putIfAbsent(K p0, V p1){ return null; }
+    public int size(){ return 0; }
+    public void clear(){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/LinkedNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/LinkedNode.java
new file mode 100644
index 00000000000..1f85c6e3b84
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/LinkedNode.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.LinkedNode for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+
+public class LinkedNode<T>
+{
+    protected LinkedNode() {}
+    public LinkedNode(T p0, LinkedNode<T> p1){}
+    public LinkedNode<T> next(){ return null; }
+    public T value(){ return null; }
+    public static <ST> boolean contains(LinkedNode<ST> p0, ST p1){ return false; }
+    public void linkNext(LinkedNode<T> p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/NameTransformer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/NameTransformer.java
new file mode 100644
index 00000000000..77cd9c13dda
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/NameTransformer.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.NameTransformer for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+
+abstract public class NameTransformer
+{
+    protected NameTransformer(){}
+    public abstract String reverse(String p0);
+    public abstract String transform(String p0);
+    public static NameTransformer NOP = null;
+    public static NameTransformer chainedTransformer(NameTransformer p0, NameTransformer p1){ return null; }
+    public static NameTransformer simpleTransformer(String p0, String p1){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/Named.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/Named.java
new file mode 100644
index 00000000000..fd619b549f7
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/Named.java
@@ -0,0 +1,9 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.Named for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+
+public interface Named
+{
+    String getName();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ObjectBuffer.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ObjectBuffer.java
new file mode 100644
index 00000000000..bbc42376970
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ObjectBuffer.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.ObjectBuffer for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+import java.util.List;
+
+public class ObjectBuffer
+{
+    protected final void _copyTo(Object p0, int p1, Object[] p2, int p3){}
+    protected void _reset(){}
+    public <T> T[] completeAndClearBuffer(Object[] p0, int p1, Class<T> p2){ return null; }
+    public ObjectBuffer(){}
+    public Object[] appendCompletedChunk(Object[] p0){ return null; }
+    public Object[] completeAndClearBuffer(Object[] p0, int p1){ return null; }
+    public Object[] resetAndStart(){ return null; }
+    public int bufferedSize(){ return 0; }
+    public int initialCapacity(){ return 0; }
+    public void completeAndClearBuffer(Object[] p0, int p1, List<Object> p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/PrimitiveArrayBuilder.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/PrimitiveArrayBuilder.java
new file mode 100644
index 00000000000..abfcb34b2f9
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/PrimitiveArrayBuilder.java
@@ -0,0 +1,38 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.PrimitiveArrayBuilder for
+// testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+
+abstract public class PrimitiveArrayBuilder<T> {
+    protected PrimitiveArrayBuilder() {}
+
+    protected PrimitiveArrayBuilder.Node<T> _bufferHead = null;
+    protected PrimitiveArrayBuilder.Node<T> _bufferTail = null;
+    protected T _freeBuffer = null;
+
+    protected abstract T _constructArray(int p0);
+
+    protected int _bufferedEntryCount = 0;
+
+    protected void _reset() {}
+
+    public T completeAndClearBuffer(T p0, int p1) {
+        return null;
+    }
+
+    public T resetAndStart() {
+        return null;
+    }
+
+    public final T appendCompletedChunk(T p0, int p1) {
+        return null;
+    }
+
+    public int bufferedSize() {
+        return 0;
+    }
+
+    static class Node<T> {
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/RawValue.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/RawValue.java
new file mode 100644
index 00000000000..0d21cde6a1c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/RawValue.java
@@ -0,0 +1,27 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.RawValue for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.SerializableString;
+import com.fasterxml.jackson.databind.JsonSerializable;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+
+public class RawValue implements JsonSerializable
+{
+    protected RawValue() {}
+    protected Object _value = null;
+    protected RawValue(Object p0, boolean p1){}
+    protected void _serialize(JsonGenerator p0){}
+    public Object rawValue(){ return null; }
+    public RawValue(JsonSerializable p0){}
+    public RawValue(SerializableString p0){}
+    public RawValue(String p0){}
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int hashCode(){ return 0; }
+    public void serialize(JsonGenerator p0){}
+    public void serialize(JsonGenerator p0, SerializerProvider p1){}
+    public void serializeWithType(JsonGenerator p0, SerializerProvider p1, TypeSerializer p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/RootNameLookup.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/RootNameLookup.java
new file mode 100644
index 00000000000..e48dd8641d1
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/RootNameLookup.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.RootNameLookup for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.PropertyName;
+import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.type.ClassKey;
+import com.fasterxml.jackson.databind.util.LRUMap;
+import java.io.Serializable;
+
+public class RootNameLookup implements Serializable
+{
+    protected LRUMap<ClassKey, PropertyName> _rootNames = null;
+    protected Object readResolve(){ return null; }
+    public PropertyName findRootName(Class<? extends Object> p0, MapperConfig<? extends Object> p1){ return null; }
+    public PropertyName findRootName(JavaType p0, MapperConfig<? extends Object> p1){ return null; }
+    public RootNameLookup(){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/TypeKey.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/TypeKey.java
new file mode 100644
index 00000000000..9cc83194612
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/TypeKey.java
@@ -0,0 +1,31 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.TypeKey for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+import com.fasterxml.jackson.databind.JavaType;
+
+public class TypeKey
+{
+    protected Class<? extends Object> _class = null;
+    protected JavaType _type = null;
+    protected boolean _isTyped = false;
+    protected int _hashCode = 0;
+    public Class<? extends Object> getRawType(){ return null; }
+    public JavaType getType(){ return null; }
+    public TypeKey(){}
+    public TypeKey(Class<? extends Object> p0, boolean p1){}
+    public TypeKey(JavaType p0, boolean p1){}
+    public TypeKey(TypeKey p0){}
+    public boolean isTyped(){ return false; }
+    public final String toString(){ return null; }
+    public final boolean equals(Object p0){ return false; }
+    public final int hashCode(){ return 0; }
+    public final void resetTyped(Class<? extends Object> p0){}
+    public final void resetTyped(JavaType p0){}
+    public final void resetUntyped(Class<? extends Object> p0){}
+    public final void resetUntyped(JavaType p0){}
+    public static int typedHash(Class<? extends Object> p0){ return 0; }
+    public static int typedHash(JavaType p0){ return 0; }
+    public static int untypedHash(Class<? extends Object> p0){ return 0; }
+    public static int untypedHash(JavaType p0){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ViewMatcher.java b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ViewMatcher.java
new file mode 100644
index 00000000000..7f5e8e134eb
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/fasterxml/jackson/databind/util/ViewMatcher.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.fasterxml.jackson.databind.util.ViewMatcher for testing purposes
+
+package com.fasterxml.jackson.databind.util;
+
+import java.io.Serializable;
+
+public class ViewMatcher implements Serializable
+{
+    protected static ViewMatcher EMPTY = null;
+    public ViewMatcher(){}
+    public boolean isVisibleForView(Class<? extends Object> p0){ return false; }
+    public static ViewMatcher construct(Class<? extends Object>[] p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/google/common/collect/Multimap.java b/java/ql/test/stubs/jinjava-2.6.0/com/google/common/collect/Multimap.java
new file mode 100644
index 00000000000..9cdec55e59c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/google/common/collect/Multimap.java
@@ -0,0 +1,34 @@
+// Generated automatically from com.google.common.collect.Multimap for testing purposes
+
+package com.google.common.collect;
+
+import com.google.common.collect.Multiset;
+import java.util.Collection;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.BiConsumer;
+
+public interface Multimap<K, V>
+{
+    Collection<Map.Entry<K, V>> entries();
+    Collection<V> get(K p0);
+    Collection<V> removeAll(Object p0);
+    Collection<V> replaceValues(K p0, Iterable<? extends V> p1);
+    Collection<V> values();
+    Map<K, Collection<V>> asMap();
+    Multiset<K> keys();
+    Set<K> keySet();
+    boolean containsEntry(Object p0, Object p1);
+    boolean containsKey(Object p0);
+    boolean containsValue(Object p0);
+    boolean equals(Object p0);
+    boolean isEmpty();
+    boolean put(K p0, V p1);
+    boolean putAll(K p0, Iterable<? extends V> p1);
+    boolean putAll(Multimap<? extends K, ? extends V> p0);
+    boolean remove(Object p0, Object p1);
+    default void forEach(BiConsumer<? super K, ? super V> p0){}
+    int hashCode();
+    int size();
+    void clear();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/google/common/collect/Multiset.java b/java/ql/test/stubs/jinjava-2.6.0/com/google/common/collect/Multiset.java
new file mode 100644
index 00000000000..9c6f000078c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/google/common/collect/Multiset.java
@@ -0,0 +1,43 @@
+// Generated automatically from com.google.common.collect.Multiset for testing purposes
+
+package com.google.common.collect;
+
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.Set;
+import java.util.Spliterator;
+import java.util.function.Consumer;
+import java.util.function.ObjIntConsumer;
+
+public interface Multiset<E> extends Collection<E>
+{
+    Iterator<E> iterator();
+    Set<E> elementSet();
+    Set<Multiset.Entry<E>> entrySet();
+    String toString();
+    boolean add(E p0);
+    boolean contains(Object p0);
+    boolean containsAll(Collection<? extends Object> p0);
+    boolean equals(Object p0);
+    boolean remove(Object p0);
+    boolean removeAll(Collection<? extends Object> p0);
+    boolean retainAll(Collection<? extends Object> p0);
+    boolean setCount(E p0, int p1, int p2);
+    default Spliterator<E> spliterator(){ return null; }
+    default void forEach(Consumer<? super E> p0){}
+    default void forEachEntry(ObjIntConsumer<? super E> p0){}
+    int add(E p0, int p1);
+    int count(Object p0);
+    int hashCode();
+    int remove(Object p0, int p1);
+    int setCount(E p0, int p1);
+    int size();
+    static public interface Entry<E>
+    {
+        E getElement();
+        String toString();
+        boolean equals(Object p0);
+        int getCount();
+        int hashCode();
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/google/common/collect/SetMultimap.java b/java/ql/test/stubs/jinjava-2.6.0/com/google/common/collect/SetMultimap.java
new file mode 100644
index 00000000000..07dd464de7b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/google/common/collect/SetMultimap.java
@@ -0,0 +1,18 @@
+// Generated automatically from com.google.common.collect.SetMultimap for testing purposes
+
+package com.google.common.collect;
+
+import com.google.common.collect.Multimap;
+import java.util.Collection;
+import java.util.Map;
+import java.util.Set;
+
+public interface SetMultimap<K, V> extends Multimap<K, V>
+{
+    Map<K, Collection<V>> asMap();
+    Set<Map.Entry<K, V>> entries();
+    Set<V> get(K p0);
+    Set<V> removeAll(Object p0);
+    Set<V> replaceValues(K p0, Iterable<? extends V> p1);
+    boolean equals(Object p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/Jinjava.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/Jinjava.java
new file mode 100644
index 00000000000..9d2e0956161
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/Jinjava.java
@@ -0,0 +1,81 @@
+// Generated automatically from com.hubspot.jinjava.Jinjava for testing purposes
+
+package com.hubspot.jinjava;
+
+import com.hubspot.jinjava.JinjavaConfig;
+import com.hubspot.jinjava.doc.JinjavaDoc;
+import com.hubspot.jinjava.interpret.Context;
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.interpret.RenderResult;
+import com.hubspot.jinjava.lib.exptest.ExpTest;
+import com.hubspot.jinjava.lib.filter.Filter;
+import com.hubspot.jinjava.lib.fn.ELFunctionDefinition;
+import com.hubspot.jinjava.lib.tag.Tag;
+import com.hubspot.jinjava.loader.ResourceLocator;
+import java.util.Map;
+import jinjava.javax.el.ExpressionFactory;
+
+public class Jinjava {
+    public Context getGlobalContext() {
+        return null;
+    }
+
+    public Context getGlobalContextCopy() {
+        return null;
+    }
+
+    public ExpressionFactory getEagerExpressionFactory() {
+        return null;
+    }
+
+    public ExpressionFactory getExpressionFactory() {
+        return null;
+    }
+
+    public Jinjava() {}
+
+    public Jinjava(JinjavaConfig p0) {}
+
+    public JinjavaConfig getGlobalConfig() {
+        return null;
+    }
+
+    public JinjavaDoc getJinjavaDoc() {
+        return null;
+    }
+
+    public JinjavaInterpreter newInterpreter() {
+        return null;
+    }
+
+    public RenderResult renderForResult(String p0, Map<String, ? extends Object> p1) {
+        return null;
+    }
+
+    public RenderResult renderForResult(String p0, Map<String, ? extends Object> p1,
+            JinjavaConfig p2) {
+        return null;
+    }
+
+    public ResourceLocator getResourceLocator() {
+        return null;
+    }
+
+    public String getJinjavaSnippetDoc() {
+        return null;
+    }
+
+    public String render(String p0, Map<String, ? extends Object> p1) {
+        return null;
+    }
+
+    public void registerExpTest(ExpTest p0) {}
+
+    public void registerFilter(Filter p0) {}
+
+    public void registerFunction(ELFunctionDefinition p0) {}
+
+    public void registerTag(Tag p0) {}
+
+    public void setResourceLocator(ResourceLocator p0) {}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/JinjavaConfig.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/JinjavaConfig.java
new file mode 100644
index 00000000000..d2e4d38190c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/JinjavaConfig.java
@@ -0,0 +1,81 @@
+// Generated automatically from com.hubspot.jinjava.JinjavaConfig for testing purposes
+
+package com.hubspot.jinjava;
+
+import com.hubspot.jinjava.LegacyOverrides;
+import com.hubspot.jinjava.interpret.Context;
+import com.hubspot.jinjava.interpret.InterpreterFactory;
+import com.hubspot.jinjava.mode.ExecutionMode;
+import com.hubspot.jinjava.random.RandomNumberGeneratorStrategy;
+import com.hubspot.jinjava.tree.parse.TokenScannerSymbols;
+import java.nio.charset.Charset;
+import java.time.ZoneId;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import jinjava.javax.el.ELResolver;
+
+public class JinjavaConfig
+{
+    public Charset getCharset(){ return null; }
+    public ELResolver getElResolver(){ return null; }
+    public ExecutionMode getExecutionMode(){ return null; }
+    public InterpreterFactory getInterpreterFactory(){ return null; }
+    public JinjavaConfig(){}
+    public JinjavaConfig(Charset p0, Locale p1, ZoneId p2, int p3){}
+    public JinjavaConfig(InterpreterFactory p0){}
+    public LegacyOverrides getLegacyOverrides(){ return null; }
+    public Locale getLocale(){ return null; }
+    public Map<Context.Library, Set<String>> getDisabled(){ return null; }
+    public RandomNumberGeneratorStrategy getRandomNumberGeneratorStrategy(){ return null; }
+    public TokenScannerSymbols getTokenScannerSymbols(){ return null; }
+    public ZoneId getTimeZone(){ return null; }
+    public boolean isEnableRecursiveMacroCalls(){ return false; }
+    public boolean isFailOnUnknownTokens(){ return false; }
+    public boolean isIterateOverMapKeys(){ return false; }
+    public boolean isLstripBlocks(){ return false; }
+    public boolean isNestedInterpretationEnabled(){ return false; }
+    public boolean isTrimBlocks(){ return false; }
+    public boolean isValidationMode(){ return false; }
+    public int getMaxListSize(){ return 0; }
+    public int getMaxMacroRecursionDepth(){ return 0; }
+    public int getMaxMapSize(){ return 0; }
+    public int getMaxNumEagerTokens(){ return 0; }
+    public int getMaxRenderDepth(){ return 0; }
+    public int getRangeLimit(){ return 0; }
+    public long getMaxOutputSize(){ return 0; }
+    public long getMaxStringLength(){ return 0; }
+    public static JinjavaConfig.Builder newBuilder(){ return null; }
+    public void setTokenScannerSymbols(TokenScannerSymbols p0){}
+    static public class Builder
+    {
+        protected Builder() {}
+        public JinjavaConfig build(){ return null; }
+        public JinjavaConfig.Builder withCharset(Charset p0){ return null; }
+        public JinjavaConfig.Builder withDisabled(Map<Context.Library, Set<String>> p0){ return null; }
+        public JinjavaConfig.Builder withElResolver(ELResolver p0){ return null; }
+        public JinjavaConfig.Builder withEnableRecursiveMacroCalls(boolean p0){ return null; }
+        public JinjavaConfig.Builder withExecutionMode(ExecutionMode p0){ return null; }
+        public JinjavaConfig.Builder withFailOnUnknownTokens(boolean p0){ return null; }
+        public JinjavaConfig.Builder withInterperterFactory(InterpreterFactory p0){ return null; }
+        public JinjavaConfig.Builder withIterateOverMapKeys(boolean p0){ return null; }
+        public JinjavaConfig.Builder withLegacyOverrides(LegacyOverrides p0){ return null; }
+        public JinjavaConfig.Builder withLocale(Locale p0){ return null; }
+        public JinjavaConfig.Builder withLstripBlocks(boolean p0){ return null; }
+        public JinjavaConfig.Builder withMaxListSize(int p0){ return null; }
+        public JinjavaConfig.Builder withMaxMacroRecursionDepth(int p0){ return null; }
+        public JinjavaConfig.Builder withMaxMapSize(int p0){ return null; }
+        public JinjavaConfig.Builder withMaxNumEagerTokens(int p0){ return null; }
+        public JinjavaConfig.Builder withMaxOutputSize(long p0){ return null; }
+        public JinjavaConfig.Builder withMaxRenderDepth(int p0){ return null; }
+        public JinjavaConfig.Builder withMaxStringLength(long p0){ return null; }
+        public JinjavaConfig.Builder withNestedInterpretationEnabled(boolean p0){ return null; }
+        public JinjavaConfig.Builder withRandomNumberGeneratorStrategy(RandomNumberGeneratorStrategy p0){ return null; }
+        public JinjavaConfig.Builder withRangeLimit(int p0){ return null; }
+        public JinjavaConfig.Builder withReadOnlyResolver(boolean p0){ return null; }
+        public JinjavaConfig.Builder withTimeZone(ZoneId p0){ return null; }
+        public JinjavaConfig.Builder withTokenScannerSymbols(TokenScannerSymbols p0){ return null; }
+        public JinjavaConfig.Builder withTrimBlocks(boolean p0){ return null; }
+        public JinjavaConfig.Builder withValidationMode(boolean p0){ return null; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/LegacyOverrides.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/LegacyOverrides.java
new file mode 100644
index 00000000000..8fd14533d51
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/LegacyOverrides.java
@@ -0,0 +1,23 @@
+// Generated automatically from com.hubspot.jinjava.LegacyOverrides for testing purposes
+
+package com.hubspot.jinjava;
+
+
+public class LegacyOverrides
+{
+    protected LegacyOverrides() {}
+    public boolean isEvaluateMapKeys(){ return false; }
+    public boolean isIterateOverMapKeys(){ return false; }
+    public boolean isUsePyishObjectMapper(){ return false; }
+    public static LegacyOverrides NONE = null;
+    public static LegacyOverrides.Builder newBuilder(){ return null; }
+    static public class Builder
+    {
+        protected Builder() {}
+        public LegacyOverrides build(){ return null; }
+        public LegacyOverrides.Builder withEvaluateMapKeys(boolean p0){ return null; }
+        public LegacyOverrides.Builder withIterateOverMapKeys(boolean p0){ return null; }
+        public LegacyOverrides.Builder withUsePyishObjectMapper(boolean p0){ return null; }
+        public static LegacyOverrides.Builder from(LegacyOverrides p0){ return null; }
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDoc.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDoc.java
new file mode 100644
index 00000000000..19bae11a2be
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDoc.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.hubspot.jinjava.doc.JinjavaDoc for testing purposes
+
+package com.hubspot.jinjava.doc;
+
+import com.hubspot.jinjava.doc.JinjavaDocExpTest;
+import com.hubspot.jinjava.doc.JinjavaDocFilter;
+import com.hubspot.jinjava.doc.JinjavaDocFunction;
+import com.hubspot.jinjava.doc.JinjavaDocTag;
+import java.util.Map;
+
+public class JinjavaDoc
+{
+    public JinjavaDoc(){}
+    public Map<String, JinjavaDocExpTest> getExpTests(){ return null; }
+    public Map<String, JinjavaDocFilter> getFilters(){ return null; }
+    public Map<String, JinjavaDocFunction> getFunctions(){ return null; }
+    public Map<String, JinjavaDocTag> getTags(){ return null; }
+    public Map<String, String> getCodeSnippets(){ return null; }
+    public void addCodeSnippet(String p0, String p1){}
+    public void addExpTest(JinjavaDocExpTest p0){}
+    public void addFilter(JinjavaDocFilter p0){}
+    public void addFunction(JinjavaDocFunction p0){}
+    public void addTag(JinjavaDocTag p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocExpTest.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocExpTest.java
new file mode 100644
index 00000000000..b5156e762ec
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocExpTest.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.hubspot.jinjava.doc.JinjavaDocExpTest for testing purposes
+
+package com.hubspot.jinjava.doc;
+
+import com.hubspot.jinjava.doc.JinjavaDocItem;
+import com.hubspot.jinjava.doc.JinjavaDocParam;
+import com.hubspot.jinjava.doc.JinjavaDocSnippet;
+import java.util.Map;
+
+public class JinjavaDocExpTest extends JinjavaDocItem
+{
+    protected JinjavaDocExpTest() {}
+    public JinjavaDocExpTest(String p0, String p1, String p2, boolean p3, JinjavaDocParam[] p4, JinjavaDocParam[] p5, JinjavaDocSnippet[] p6, Map<String, String> p7){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocFilter.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocFilter.java
new file mode 100644
index 00000000000..26ef0cde8c6
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocFilter.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.hubspot.jinjava.doc.JinjavaDocFilter for testing purposes
+
+package com.hubspot.jinjava.doc;
+
+import com.hubspot.jinjava.doc.JinjavaDocItem;
+import com.hubspot.jinjava.doc.JinjavaDocParam;
+import com.hubspot.jinjava.doc.JinjavaDocSnippet;
+import java.util.Map;
+
+public class JinjavaDocFilter extends JinjavaDocItem
+{
+    protected JinjavaDocFilter() {}
+    public JinjavaDocFilter(String p0, String p1, String p2, boolean p3, JinjavaDocParam[] p4, JinjavaDocParam[] p5, JinjavaDocSnippet[] p6, Map<String, String> p7){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocFunction.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocFunction.java
new file mode 100644
index 00000000000..1a07e1d9542
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocFunction.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.hubspot.jinjava.doc.JinjavaDocFunction for testing purposes
+
+package com.hubspot.jinjava.doc;
+
+import com.hubspot.jinjava.doc.JinjavaDocItem;
+import com.hubspot.jinjava.doc.JinjavaDocParam;
+import com.hubspot.jinjava.doc.JinjavaDocSnippet;
+import java.util.Map;
+
+public class JinjavaDocFunction extends JinjavaDocItem
+{
+    protected JinjavaDocFunction() {}
+    public JinjavaDocFunction(String p0, String p1, String p2, boolean p3, JinjavaDocParam[] p4, JinjavaDocParam[] p5, JinjavaDocSnippet[] p6, Map<String, String> p7){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocItem.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocItem.java
new file mode 100644
index 00000000000..f4230713a3b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocItem.java
@@ -0,0 +1,21 @@
+// Generated automatically from com.hubspot.jinjava.doc.JinjavaDocItem for testing purposes
+
+package com.hubspot.jinjava.doc;
+
+import com.hubspot.jinjava.doc.JinjavaDocParam;
+import com.hubspot.jinjava.doc.JinjavaDocSnippet;
+import java.util.Map;
+
+abstract public class JinjavaDocItem
+{
+    protected JinjavaDocItem() {}
+    public JinjavaDocItem(String p0, String p1, String p2, boolean p3, JinjavaDocParam[] p4, JinjavaDocParam[] p5, JinjavaDocSnippet[] p6, Map<String, String> p7){}
+    public JinjavaDocParam[] getInputs(){ return null; }
+    public JinjavaDocParam[] getParams(){ return null; }
+    public JinjavaDocSnippet[] getSnippets(){ return null; }
+    public Map<String, String> getMeta(){ return null; }
+    public String getAliasOf(){ return null; }
+    public String getDesc(){ return null; }
+    public String getName(){ return null; }
+    public boolean isDeprecated(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocParam.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocParam.java
new file mode 100644
index 00000000000..3779f09d8f8
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocParam.java
@@ -0,0 +1,15 @@
+// Generated automatically from com.hubspot.jinjava.doc.JinjavaDocParam for testing purposes
+
+package com.hubspot.jinjava.doc;
+
+
+public class JinjavaDocParam
+{
+    protected JinjavaDocParam() {}
+    public JinjavaDocParam(String p0, String p1, String p2, String p3, boolean p4){}
+    public String getDefaultValue(){ return null; }
+    public String getDesc(){ return null; }
+    public String getName(){ return null; }
+    public String getType(){ return null; }
+    public boolean getRequired(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocSnippet.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocSnippet.java
new file mode 100644
index 00000000000..22612f48f3e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocSnippet.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.hubspot.jinjava.doc.JinjavaDocSnippet for testing purposes
+
+package com.hubspot.jinjava.doc;
+
+
+public class JinjavaDocSnippet
+{
+    protected JinjavaDocSnippet() {}
+    public JinjavaDocSnippet(String p0, String p1, String p2){}
+    public String getCode(){ return null; }
+    public String getDesc(){ return null; }
+    public String getOutput(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocTag.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocTag.java
new file mode 100644
index 00000000000..7b6e42cbb4a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/doc/JinjavaDocTag.java
@@ -0,0 +1,15 @@
+// Generated automatically from com.hubspot.jinjava.doc.JinjavaDocTag for testing purposes
+
+package com.hubspot.jinjava.doc;
+
+import com.hubspot.jinjava.doc.JinjavaDocItem;
+import com.hubspot.jinjava.doc.JinjavaDocParam;
+import com.hubspot.jinjava.doc.JinjavaDocSnippet;
+import java.util.Map;
+
+public class JinjavaDocTag extends JinjavaDocItem
+{
+    protected JinjavaDocTag() {}
+    public JinjavaDocTag(String p0, boolean p1, String p2, String p3, boolean p4, JinjavaDocParam[] p5, JinjavaDocParam[] p6, JinjavaDocSnippet[] p7, Map<String, String> p8){}
+    public boolean isEmpty(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/el/ext/AbstractCallableMethod.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/el/ext/AbstractCallableMethod.java
new file mode 100644
index 00000000000..8331fb407c9
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/el/ext/AbstractCallableMethod.java
@@ -0,0 +1,20 @@
+// Generated automatically from com.hubspot.jinjava.el.ext.AbstractCallableMethod for testing purposes
+
+package com.hubspot.jinjava.el.ext;
+
+import java.lang.reflect.Method;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+abstract public class AbstractCallableMethod
+{
+    protected AbstractCallableMethod() {}
+    public AbstractCallableMethod(String p0, LinkedHashMap<String, Object> p1){}
+    public List<String> getArguments(){ return null; }
+    public Map<String, Object> getDefaults(){ return null; }
+    public Object evaluate(Object... p0){ return null; }
+    public String getName(){ return null; }
+    public abstract Object doEvaluate(Map<String, Object> p0, Map<String, Object> p1, List<Object> p2);
+    public static Method EVAL_METHOD = null;
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/CallStack.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/CallStack.java
new file mode 100644
index 00000000000..8f45cf5c709
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/CallStack.java
@@ -0,0 +1,21 @@
+// Generated automatically from com.hubspot.jinjava.interpret.CallStack for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.hubspot.jinjava.interpret.TagCycleException;
+import java.util.Optional;
+
+public class CallStack
+{
+    protected CallStack() {}
+    public CallStack(CallStack p0, Class<? extends TagCycleException> p1){}
+    public Optional<String> peek(){ return null; }
+    public Optional<String> pop(){ return null; }
+    public boolean contains(String p0){ return false; }
+    public boolean isEmpty(){ return false; }
+    public int getTopLineNumber(){ return 0; }
+    public int getTopStartPosition(){ return 0; }
+    public void push(String p0, int p1, int p2){}
+    public void pushWithMaxDepth(String p0, int p1, int p2, int p3){}
+    public void pushWithoutCycleCheck(String p0, int p1, int p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/Context.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/Context.java
new file mode 100644
index 00000000000..31421c1fc58
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/Context.java
@@ -0,0 +1,121 @@
+// Generated automatically from com.hubspot.jinjava.interpret.Context for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.google.common.collect.SetMultimap;
+import com.hubspot.jinjava.interpret.CallStack;
+import com.hubspot.jinjava.interpret.DynamicVariableResolver;
+import com.hubspot.jinjava.lib.Importable;
+import com.hubspot.jinjava.lib.expression.ExpressionStrategy;
+import com.hubspot.jinjava.lib.exptest.ExpTest;
+import com.hubspot.jinjava.lib.filter.Filter;
+import com.hubspot.jinjava.lib.fn.ELFunctionDefinition;
+import com.hubspot.jinjava.lib.fn.MacroFunction;
+import com.hubspot.jinjava.lib.tag.Tag;
+import com.hubspot.jinjava.lib.tag.eager.EagerToken;
+import com.hubspot.jinjava.tree.Node;
+import com.hubspot.jinjava.util.ScopeMap;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+
+public class Context extends ScopeMap<String, Object>
+{
+    public CallStack getCurrentPathStack(){ return null; }
+    public CallStack getExtendPathStack(){ return null; }
+    public CallStack getImportPathStack(){ return null; }
+    public CallStack getIncludePathStack(){ return null; }
+    public CallStack getMacroStack(){ return null; }
+    public Collection<ELFunctionDefinition> getAllFunctions(){ return null; }
+    public Collection<ExpTest> getAllExpTests(){ return null; }
+    public Collection<Filter> getAllFilters(){ return null; }
+    public Collection<Tag> getAllTags(){ return null; }
+    public Context getParent(){ return null; }
+    public Context setDeferredExecutionMode(boolean p0){ return null; }
+    public Context setValidationMode(boolean p0){ return null; }
+    public Context(){}
+    public Context(Context p0){}
+    public Context(Context p0, Map<String, ? extends Object> p1){}
+    public Context(Context p0, Map<String, ? extends Object> p1, Map<Context.Library, Set<String>> p2){}
+    public Context(Context p0, Map<String, ? extends Object> p1, Map<Context.Library, Set<String>> p2, boolean p3){}
+    public Context.TemporaryValueClosable<Boolean> withPartialMacroEvaluation(){ return null; }
+    public Context.TemporaryValueClosable<Boolean> withUnwrapRawOverride(){ return null; }
+    public DynamicVariableResolver getDynamicVariableResolver(){ return null; }
+    public ELFunctionDefinition getFunction(String p0){ return null; }
+    public ExpTest getExpTest(String p0){ return null; }
+    public ExpressionStrategy getExpressionStrategy(){ return null; }
+    public Filter getFilter(String p0){ return null; }
+    public List<? extends Node> getSuperBlock(){ return null; }
+    public MacroFunction getGlobalMacro(String p0){ return null; }
+    public Map<String, MacroFunction> getGlobalMacros(){ return null; }
+    public Map<String, Object> getSessionBindings(){ return null; }
+    public Node getCurrentNode(){ return null; }
+    public Optional<MacroFunction> getLocalMacro(String p0){ return null; }
+    public Optional<String> getImportResourceAlias(){ return null; }
+    public Set<EagerToken> getEagerTokens(){ return null; }
+    public Set<Node> getDeferredNodes(){ return null; }
+    public Set<String> getMetaContextVariables(){ return null; }
+    public Set<String> getResolvedExpressions(){ return null; }
+    public Set<String> getResolvedFunctions(){ return null; }
+    public Set<String> getResolvedValues(){ return null; }
+    public SetMultimap<String, String> getDependencies(){ return null; }
+    public String popRenderStack(){ return null; }
+    public Tag getTag(String p0){ return null; }
+    public boolean doesRenderStackContain(String p0){ return false; }
+    public boolean getThrowInterpreterErrors(){ return false; }
+    public boolean isAutoEscape(){ return false; }
+    public boolean isDeferredExecutionMode(){ return false; }
+    public boolean isFunctionDisabled(String p0){ return false; }
+    public boolean isGlobalMacro(String p0){ return false; }
+    public boolean isPartialMacroEvaluation(){ return false; }
+    public boolean isUnwrapRawOverride(){ return false; }
+    public boolean isValidationMode(){ return false; }
+    public boolean wasExpressionResolved(String p0){ return false; }
+    public boolean wasValueResolved(String p0){ return false; }
+    public final void registerClasses(Class<? extends Importable>... p0){}
+    public int getRenderDepth(){ return 0; }
+    public static String DEFERRED_IMPORT_RESOURCE_PATH_KEY = null;
+    public static String GLOBAL_MACROS_SCOPE_KEY = null;
+    public static String IMPORT_RESOURCE_ALIAS_KEY = null;
+    public static String IMPORT_RESOURCE_PATH_KEY = null;
+    public void addDependencies(SetMultimap<String, String> p0){}
+    public void addDependency(String p0, String p1){}
+    public void addGlobalMacro(MacroFunction p0){}
+    public void addResolvedExpression(String p0){}
+    public void addResolvedFrom(Context p0){}
+    public void addResolvedFunction(String p0){}
+    public void addResolvedValue(String p0){}
+    public void checkNumberOfDeferredTokens(){}
+    public void handleDeferredNode(Node p0){}
+    public void handleEagerToken(EagerToken p0){}
+    public void popFromStack(){}
+    public void pushFromStack(String p0, int p1, int p2){}
+    public void pushRenderStack(String p0){}
+    public void registerExpTest(ExpTest p0){}
+    public void registerFilter(Filter p0){}
+    public void registerFunction(ELFunctionDefinition p0){}
+    public void registerTag(Tag p0){}
+    public void removeSuperBlock(){}
+    public void reset(){}
+    public void setAutoEscape(Boolean p0){}
+    public void setCurrentNode(Node p0){}
+    public void setDynamicVariableResolver(DynamicVariableResolver p0){}
+    public void setExpressionStrategy(ExpressionStrategy p0){}
+    public void setPartialMacroEvaluation(boolean p0){}
+    public void setRenderDepth(int p0){}
+    public void setSuperBlock(List<? extends Node> p0){}
+    public void setThrowInterpreterErrors(boolean p0){}
+    public void setUnwrapRawOverride(boolean p0){}
+    static public class TemporaryValueClosable<T> implements AutoCloseable
+    {
+        protected TemporaryValueClosable() {}
+        public void close(){}
+    }
+    static public enum Library
+    {
+        EXP_TEST, FILTER, FUNCTION, TAG;
+        private Library() {}
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/DynamicVariableResolver.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/DynamicVariableResolver.java
new file mode 100644
index 00000000000..9b25ef83d67
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/DynamicVariableResolver.java
@@ -0,0 +1,9 @@
+// Generated automatically from com.hubspot.jinjava.interpret.DynamicVariableResolver for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import java.util.function.Function;
+
+public interface DynamicVariableResolver extends Function<String, Object>
+{
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InterpretException.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InterpretException.java
new file mode 100644
index 00000000000..439943735f6
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InterpretException.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.hubspot.jinjava.interpret.InterpretException for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+
+public class InterpretException extends RuntimeException
+{
+    protected InterpretException() {}
+    public InterpretException(String p0){}
+    public InterpretException(String p0, Throwable p1){}
+    public InterpretException(String p0, Throwable p1, int p2){}
+    public InterpretException(String p0, Throwable p1, int p2, int p3){}
+    public InterpretException(String p0, int p1){}
+    public InterpretException(String p0, int p1, int p2){}
+    public int getLineNumber(){ return 0; }
+    public int getStartPosition(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InterpreterFactory.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InterpreterFactory.java
new file mode 100644
index 00000000000..9c164f51e2c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InterpreterFactory.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.hubspot.jinjava.interpret.InterpreterFactory for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.hubspot.jinjava.Jinjava;
+import com.hubspot.jinjava.JinjavaConfig;
+import com.hubspot.jinjava.interpret.Context;
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+
+public interface InterpreterFactory
+{
+    JinjavaInterpreter newInstance(Jinjava p0, Context p1, JinjavaConfig p2);
+    JinjavaInterpreter newInstance(JinjavaInterpreter p0);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InvalidArgumentException.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InvalidArgumentException.java
new file mode 100644
index 00000000000..df2fe8cf788
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InvalidArgumentException.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.hubspot.jinjava.interpret.InvalidArgumentException for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.hubspot.jinjava.interpret.InvalidReason;
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.lib.Importable;
+
+public class InvalidArgumentException extends RuntimeException
+{
+    protected InvalidArgumentException() {}
+    public InvalidArgumentException(JinjavaInterpreter p0, Importable p1, InvalidReason p2, String p3, Object... p4){}
+    public InvalidArgumentException(JinjavaInterpreter p0, Importable p1, InvalidReason p2, int p3, Object... p4){}
+    public InvalidArgumentException(JinjavaInterpreter p0, String p1, String p2){}
+    public String getMessage(){ return null; }
+    public String getName(){ return null; }
+    public int getLineNumber(){ return 0; }
+    public int getStartPosition(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InvalidInputException.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InvalidInputException.java
new file mode 100644
index 00000000000..02091ccce32
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InvalidInputException.java
@@ -0,0 +1,18 @@
+// Generated automatically from com.hubspot.jinjava.interpret.InvalidInputException for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.hubspot.jinjava.interpret.InvalidReason;
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.lib.Importable;
+
+public class InvalidInputException extends RuntimeException
+{
+    protected InvalidInputException() {}
+    public InvalidInputException(JinjavaInterpreter p0, Importable p1, InvalidReason p2, Object... p3){}
+    public InvalidInputException(JinjavaInterpreter p0, String p1, String p2){}
+    public String getMessage(){ return null; }
+    public String getName(){ return null; }
+    public int getLineNumber(){ return 0; }
+    public int getStartPosition(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InvalidReason.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InvalidReason.java
new file mode 100644
index 00000000000..c8de4cf2b08
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/InvalidReason.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.hubspot.jinjava.interpret.InvalidReason for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+
+public enum InvalidReason
+{
+    CIDR, ENUM, EXPRESSION_TEST, JSON_READ, JSON_WRITE, NON_ZERO_NUMBER, NOT_ITERABLE, NULL, NULL_ATTRIBUTE_IN_LIST, NULL_IN_LIST, NUMBER_FORMAT, POSITIVE_NUMBER, REGEX, STRING, TEMPORAL_UNIT;
+    private InvalidReason() {}
+    public String getErrorMessage(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/JinjavaInterpreter.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/JinjavaInterpreter.java
new file mode 100644
index 00000000000..8dbb1253655
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/JinjavaInterpreter.java
@@ -0,0 +1,79 @@
+// Generated automatically from com.hubspot.jinjava.interpret.JinjavaInterpreter for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.hubspot.jinjava.Jinjava;
+import com.hubspot.jinjava.JinjavaConfig;
+import com.hubspot.jinjava.interpret.Context;
+import com.hubspot.jinjava.interpret.TemplateError;
+import com.hubspot.jinjava.objects.serialization.PyishSerializable;
+import com.hubspot.jinjava.tree.Node;
+import com.hubspot.jinjava.tree.output.BlockInfo;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Random;
+import java.util.Set;
+
+public class JinjavaInterpreter implements PyishSerializable
+{
+    protected JinjavaInterpreter() {}
+    public Context getContext(){ return null; }
+    public JinjavaConfig getConfig(){ return null; }
+    public JinjavaConfig getConfiguration(){ return null; }
+    public JinjavaInterpreter(Jinjava p0, Context p1, JinjavaConfig p2){}
+    public JinjavaInterpreter(JinjavaInterpreter p0){}
+    public JinjavaInterpreter.InterpreterScopeClosable enterNonStackingScope(){ return null; }
+    public JinjavaInterpreter.InterpreterScopeClosable enterScope(){ return null; }
+    public JinjavaInterpreter.InterpreterScopeClosable enterScope(Map<Context.Library, Set<String>> p0){ return null; }
+    public List<TemplateError> getErrors(){ return null; }
+    public List<TemplateError> getErrorsCopy(){ return null; }
+    public Node parse(String p0){ return null; }
+    public Object resolveELExpression(String p0, int p1){ return null; }
+    public Object resolveELExpression(String p0, int p1, int p2){ return null; }
+    public Object resolveObject(String p0, int p1){ return null; }
+    public Object resolveObject(String p0, int p1, int p2){ return null; }
+    public Object resolveProperty(Object p0, List<String> p1){ return null; }
+    public Object resolveProperty(Object p0, String p1){ return null; }
+    public Object retraceVariable(String p0, int p1){ return null; }
+    public Object retraceVariable(String p0, int p1, int p2){ return null; }
+    public Object wrap(Object p0){ return null; }
+    public Optional<TemplateError> getLastError(){ return null; }
+    public Random getRandom(){ return null; }
+    public String getAsString(Object p0){ return null; }
+    public String getResource(String p0){ return null; }
+    public String render(Node p0){ return null; }
+    public String render(Node p0, boolean p1){ return null; }
+    public String render(String p0){ return null; }
+    public String renderFlat(String p0){ return null; }
+    public String resolveResourceLocation(String p0){ return null; }
+    public String resolveString(String p0, int p1){ return null; }
+    public String resolveString(String p0, int p1, int p2){ return null; }
+    public String toPyishString(){ return null; }
+    public boolean isValidationMode(){ return false; }
+    public class InterpreterScopeClosable implements AutoCloseable
+    {
+        public InterpreterScopeClosable(){}
+        public void close(){}
+    }
+    public int getLineNumber(){ return 0; }
+    public int getPosition(){ return 0; }
+    public int getScopeDepth(){ return 0; }
+    public static JinjavaInterpreter getCurrent(){ return null; }
+    public static Optional<JinjavaInterpreter> getCurrentMaybe(){ return null; }
+    public static void popCurrent(){}
+    public static void pushCurrent(JinjavaInterpreter p0){}
+    public void addAllChildErrors(String p0, Collection<TemplateError> p1){}
+    public void addAllErrors(Collection<TemplateError> p0){}
+    public void addBlock(String p0, BlockInfo p1){}
+    public void addError(TemplateError p0){}
+    public void addExtendParentRoot(Node p0){}
+    public void endRender(String p0){}
+    public void endRender(String p0, Map<String, Object> p1){}
+    public void leaveScope(){}
+    public void removeLastError(){}
+    public void setLineNumber(int p0){}
+    public void setPosition(int p0){}
+    public void startRender(String p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/RenderResult.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/RenderResult.java
new file mode 100644
index 00000000000..d8fade0bc2f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/RenderResult.java
@@ -0,0 +1,20 @@
+// Generated automatically from com.hubspot.jinjava.interpret.RenderResult for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.hubspot.jinjava.interpret.Context;
+import com.hubspot.jinjava.interpret.TemplateError;
+import java.util.List;
+
+public class RenderResult
+{
+    protected RenderResult() {}
+    public Context getContext(){ return null; }
+    public List<TemplateError> getErrors(){ return null; }
+    public RenderResult withOutput(String p0){ return null; }
+    public RenderResult(String p0){}
+    public RenderResult(String p0, Context p1, List<TemplateError> p2){}
+    public RenderResult(TemplateError p0, Context p1, List<TemplateError> p2){}
+    public String getOutput(){ return null; }
+    public boolean hasErrors(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TagCycleException.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TagCycleException.java
new file mode 100644
index 00000000000..5e8cf317247
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TagCycleException.java
@@ -0,0 +1,15 @@
+// Generated automatically from com.hubspot.jinjava.interpret.TagCycleException for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.hubspot.jinjava.interpret.TemplateStateException;
+import java.util.Optional;
+
+public class TagCycleException extends TemplateStateException
+{
+    protected TagCycleException() {}
+    public String getPath(){ return null; }
+    public String getTagName(){ return null; }
+    public TagCycleException(String p0, String p1, int p2, int p3){}
+    public static TagCycleException create(Class<? extends TagCycleException> p0, String p1, Optional<Integer> p2, Optional<Integer> p3){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TemplateError.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TemplateError.java
new file mode 100644
index 00000000000..5aa5b97b997
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TemplateError.java
@@ -0,0 +1,68 @@
+// Generated automatically from com.hubspot.jinjava.interpret.TemplateError for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.hubspot.jinjava.interpret.InterpretException;
+import com.hubspot.jinjava.interpret.InvalidArgumentException;
+import com.hubspot.jinjava.interpret.InvalidInputException;
+import com.hubspot.jinjava.interpret.TemplateSyntaxException;
+import com.hubspot.jinjava.interpret.errorcategory.TemplateErrorCategory;
+import java.util.Map;
+import java.util.Optional;
+
+public class TemplateError
+{
+    protected TemplateError() {}
+    public Exception getException(){ return null; }
+    public Map<String, String> getCategoryErrors(){ return null; }
+    public Optional<String> getSourceTemplate(){ return null; }
+    public String getFieldName(){ return null; }
+    public String getMessage(){ return null; }
+    public String toString(){ return null; }
+    public TemplateError serializable(){ return null; }
+    public TemplateError withScopeDepth(int p0){ return null; }
+    public TemplateError(TemplateError.ErrorType p0, TemplateError.ErrorReason p1, String p2, String p3, int p4, int p5, Exception p6){}
+    public TemplateError(TemplateError.ErrorType p0, TemplateError.ErrorReason p1, TemplateError.ErrorItem p2, String p3, String p4, int p5, Exception p6){}
+    public TemplateError(TemplateError.ErrorType p0, TemplateError.ErrorReason p1, TemplateError.ErrorItem p2, String p3, String p4, int p5, Exception p6, TemplateErrorCategory p7, Map<String, String> p8){}
+    public TemplateError(TemplateError.ErrorType p0, TemplateError.ErrorReason p1, TemplateError.ErrorItem p2, String p3, String p4, int p5, int p6, Exception p7){}
+    public TemplateError(TemplateError.ErrorType p0, TemplateError.ErrorReason p1, TemplateError.ErrorItem p2, String p3, String p4, int p5, int p6, Exception p7, TemplateErrorCategory p8, Map<String, String> p9){}
+    public TemplateError(TemplateError.ErrorType p0, TemplateError.ErrorReason p1, TemplateError.ErrorItem p2, String p3, String p4, int p5, int p6, Exception p7, TemplateErrorCategory p8, Map<String, String> p9, int p10){}
+    public TemplateError.ErrorItem getItem(){ return null; }
+    public TemplateError.ErrorReason getReason(){ return null; }
+    public TemplateError.ErrorType getSeverity(){ return null; }
+    public TemplateErrorCategory getCategory(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int getLineno(){ return 0; }
+    public int getScopeDepth(){ return 0; }
+    public int getStartPosition(){ return 0; }
+    public int hashCode(){ return 0; }
+    public static TemplateError fromException(Exception p0){ return null; }
+    public static TemplateError fromException(Exception p0, int p1){ return null; }
+    public static TemplateError fromException(Exception p0, int p1, int p2){ return null; }
+    public static TemplateError fromException(TemplateSyntaxException p0){ return null; }
+    public static TemplateError fromInvalidArgumentException(InvalidArgumentException p0){ return null; }
+    public static TemplateError fromInvalidInputException(InvalidInputException p0){ return null; }
+    public static TemplateError fromOutputTooBigException(Exception p0){ return null; }
+    public static TemplateError fromSyntaxError(InterpretException p0){ return null; }
+    public static TemplateError fromUnknownProperty(Object p0, String p1, int p2){ return null; }
+    public static TemplateError fromUnknownProperty(Object p0, String p1, int p2, int p3){ return null; }
+    public void setLineno(int p0){}
+    public void setMessage(String p0){}
+    public void setSourceTemplate(String p0){}
+    public void setStartPosition(int p0){}
+    static public enum ErrorItem
+    {
+        EXPRESSION_TEST, FILTER, FUNCTION, OTHER, PROPERTY, TAG, TEMPLATE, TOKEN;
+        private ErrorItem() {}
+    }
+    static public enum ErrorReason
+    {
+        BAD_URL, COLLECTION_TOO_BIG, DISABLED, EXCEPTION, INVALID_ARGUMENT, INVALID_INPUT, MISSING, OTHER, OUTPUT_TOO_BIG, OVER_LIMIT, SYNTAX_ERROR, UNKNOWN;
+        private ErrorReason() {}
+    }
+    static public enum ErrorType
+    {
+        FATAL, WARNING;
+        private ErrorType() {}
+    }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TemplateStateException.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TemplateStateException.java
new file mode 100644
index 00000000000..69aaa37f95c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TemplateStateException.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.hubspot.jinjava.interpret.TemplateStateException for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.hubspot.jinjava.interpret.InterpretException;
+
+public class TemplateStateException extends InterpretException
+{
+    protected TemplateStateException() {}
+    public TemplateStateException(String p0){}
+    public TemplateStateException(String p0, Throwable p1){}
+    public TemplateStateException(String p0, Throwable p1, int p2){}
+    public TemplateStateException(String p0, Throwable p1, int p2, int p3){}
+    public TemplateStateException(String p0, int p1){}
+    public TemplateStateException(String p0, int p1, int p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TemplateSyntaxException.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TemplateSyntaxException.java
new file mode 100644
index 00000000000..f1314bed67f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/TemplateSyntaxException.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.hubspot.jinjava.interpret.TemplateSyntaxException for testing purposes
+
+package com.hubspot.jinjava.interpret;
+
+import com.hubspot.jinjava.interpret.InterpretException;
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+
+public class TemplateSyntaxException extends InterpretException
+{
+    protected TemplateSyntaxException() {}
+    public String getCode(){ return null; }
+    public TemplateSyntaxException(JinjavaInterpreter p0, String p1, String p2){}
+    public TemplateSyntaxException(String p0, String p1, int p2){}
+    public TemplateSyntaxException(String p0, String p1, int p2, Throwable p3){}
+    public TemplateSyntaxException(String p0, String p1, int p2, int p3){}
+    public TemplateSyntaxException(String p0, String p1, int p2, int p3, Throwable p4){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/errorcategory/TemplateErrorCategory.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/errorcategory/TemplateErrorCategory.java
new file mode 100644
index 00000000000..15278a1aab5
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/interpret/errorcategory/TemplateErrorCategory.java
@@ -0,0 +1,8 @@
+// Generated automatically from com.hubspot.jinjava.interpret.errorcategory.TemplateErrorCategory for testing purposes
+
+package com.hubspot.jinjava.interpret.errorcategory;
+
+
+public interface TemplateErrorCategory
+{
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/Importable.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/Importable.java
new file mode 100644
index 00000000000..75b6e702d0b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/Importable.java
@@ -0,0 +1,9 @@
+// Generated automatically from com.hubspot.jinjava.lib.Importable for testing purposes
+
+package com.hubspot.jinjava.lib;
+
+
+public interface Importable
+{
+    String getName();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/expression/ExpressionStrategy.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/expression/ExpressionStrategy.java
new file mode 100644
index 00000000000..eb8373d518d
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/expression/ExpressionStrategy.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.hubspot.jinjava.lib.expression.ExpressionStrategy for testing purposes
+
+package com.hubspot.jinjava.lib.expression;
+
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.tree.output.RenderedOutputNode;
+import com.hubspot.jinjava.tree.parse.ExpressionToken;
+import java.io.Serializable;
+
+public interface ExpressionStrategy extends Serializable
+{
+    RenderedOutputNode interpretOutput(ExpressionToken p0, JinjavaInterpreter p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/exptest/ExpTest.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/exptest/ExpTest.java
new file mode 100644
index 00000000000..63a86e16e4a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/exptest/ExpTest.java
@@ -0,0 +1,12 @@
+// Generated automatically from com.hubspot.jinjava.lib.exptest.ExpTest for testing purposes
+
+package com.hubspot.jinjava.lib.exptest;
+
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.lib.Importable;
+
+public interface ExpTest extends Importable
+{
+    boolean evaluate(Object p0, JinjavaInterpreter p1, Object... p2);
+    default boolean evaluateNegated(Object p0, JinjavaInterpreter p1, Object... p2){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/filter/Filter.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/filter/Filter.java
new file mode 100644
index 00000000000..4a55a69bfd0
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/filter/Filter.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.hubspot.jinjava.lib.filter.Filter for testing purposes
+
+package com.hubspot.jinjava.lib.filter;
+
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.lib.Importable;
+import com.hubspot.jinjava.objects.SafeString;
+import java.util.Map;
+
+public interface Filter extends Importable
+{
+    Object filter(Object p0, JinjavaInterpreter p1, String... p2);
+    default Object filter(Object p0, JinjavaInterpreter p1, Object[] p2, Map<String, Object> p3){ return null; }
+    default Object filter(SafeString p0, JinjavaInterpreter p1, String... p2){ return null; }
+    default boolean preserveSafeString(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/fn/ELFunctionDefinition.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/fn/ELFunctionDefinition.java
new file mode 100644
index 00000000000..c7f763e1158
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/fn/ELFunctionDefinition.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.hubspot.jinjava.lib.fn.ELFunctionDefinition for testing purposes
+
+package com.hubspot.jinjava.lib.fn;
+
+import com.hubspot.jinjava.lib.Importable;
+import java.lang.reflect.Method;
+
+public class ELFunctionDefinition implements Importable
+{
+    protected ELFunctionDefinition() {}
+    public ELFunctionDefinition(String p0, String p1, Class<? extends Object> p2, String p3, Class<? extends Object>... p4){}
+    public ELFunctionDefinition(String p0, String p1, Method p2){}
+    public Method getMethod(){ return null; }
+    public String getLocalName(){ return null; }
+    public String getName(){ return null; }
+    public String getNamespace(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/fn/MacroFunction.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/fn/MacroFunction.java
new file mode 100644
index 00000000000..e450722095c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/fn/MacroFunction.java
@@ -0,0 +1,28 @@
+// Generated automatically from com.hubspot.jinjava.lib.fn.MacroFunction for testing purposes
+
+package com.hubspot.jinjava.lib.fn;
+
+import com.hubspot.jinjava.el.ext.AbstractCallableMethod;
+import com.hubspot.jinjava.interpret.Context;
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.tree.Node;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+public class MacroFunction extends AbstractCallableMethod
+{
+    protected MacroFunction() {}
+    public MacroFunction(List<Node> p0, String p1, LinkedHashMap<String, Object> p2, boolean p3, Context p4, int p5, int p6){}
+    public MacroFunction(MacroFunction p0, String p1){}
+    public Object doEvaluate(Map<String, Object> p0, Map<String, Object> p1, List<Object> p2){ return null; }
+    public Optional<String> getImportFile(JinjavaInterpreter p0){ return null; }
+    public String getEvaluationResult(Map<String, Object> p0, Map<String, Object> p1, List<Object> p2, JinjavaInterpreter p3){ return null; }
+    public String reconstructImage(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isCaller(){ return false; }
+    public boolean isDeferred(){ return false; }
+    public int hashCode(){ return 0; }
+    public void setDeferred(boolean p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/tag/Tag.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/tag/Tag.java
new file mode 100644
index 00000000000..90dff51c9af
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/tag/Tag.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.hubspot.jinjava.lib.tag.Tag for testing purposes
+
+package com.hubspot.jinjava.lib.tag;
+
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.lib.Importable;
+import com.hubspot.jinjava.tree.TagNode;
+import com.hubspot.jinjava.tree.output.OutputNode;
+import java.io.Serializable;
+
+public interface Tag extends Importable, Serializable
+{
+    String interpret(TagNode p0, JinjavaInterpreter p1);
+    default OutputNode interpretOutput(TagNode p0, JinjavaInterpreter p1){ return null; }
+    default String getEndTagName(){ return null; }
+    default boolean isRenderedInValidationMode(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/tag/eager/EagerToken.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/tag/eager/EagerToken.java
new file mode 100644
index 00000000000..43d61873c85
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/lib/tag/eager/EagerToken.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.hubspot.jinjava.lib.tag.eager.EagerToken for testing purposes
+
+package com.hubspot.jinjava.lib.tag.eager;
+
+import com.hubspot.jinjava.tree.parse.Token;
+import java.util.Set;
+
+public class EagerToken
+{
+    protected EagerToken() {}
+    public EagerToken(Token p0, Set<String> p1){}
+    public EagerToken(Token p0, Set<String> p1, Set<String> p2){}
+    public Set<String> getSetDeferredWords(){ return null; }
+    public Set<String> getUsedDeferredWords(){ return null; }
+    public String getImportResourcePath(){ return null; }
+    public Token getToken(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/loader/LocationResolver.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/loader/LocationResolver.java
new file mode 100644
index 00000000000..6ebc3368541
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/loader/LocationResolver.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.hubspot.jinjava.loader.LocationResolver for testing purposes
+
+package com.hubspot.jinjava.loader;
+
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+
+public interface LocationResolver
+{
+    String resolve(String p0, JinjavaInterpreter p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/loader/ResourceLocator.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/loader/ResourceLocator.java
new file mode 100644
index 00000000000..b92df3fe0c8
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/loader/ResourceLocator.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.hubspot.jinjava.loader.ResourceLocator for testing purposes
+
+package com.hubspot.jinjava.loader;
+
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.loader.LocationResolver;
+import java.nio.charset.Charset;
+import java.util.Optional;
+
+public interface ResourceLocator
+{
+    String getString(String p0, Charset p1, JinjavaInterpreter p2);
+    default Optional<LocationResolver> getLocationResolver(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/mode/ExecutionMode.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/mode/ExecutionMode.java
new file mode 100644
index 00000000000..5edad697f10
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/mode/ExecutionMode.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.hubspot.jinjava.mode.ExecutionMode for testing purposes
+
+package com.hubspot.jinjava.mode;
+
+import com.hubspot.jinjava.interpret.Context;
+
+public interface ExecutionMode
+{
+    default boolean isPreserveRawTags(){ return false; }
+    default boolean useEagerContextReverting(){ return false; }
+    default boolean useEagerParser(){ return false; }
+    default void prepareContext(Context p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/objects/PyWrapper.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/objects/PyWrapper.java
new file mode 100644
index 00000000000..58ae8d4711a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/objects/PyWrapper.java
@@ -0,0 +1,8 @@
+// Generated automatically from com.hubspot.jinjava.objects.PyWrapper for testing purposes
+
+package com.hubspot.jinjava.objects;
+
+
+public interface PyWrapper
+{
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/objects/SafeString.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/objects/SafeString.java
new file mode 100644
index 00000000000..0b8a20630fd
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/objects/SafeString.java
@@ -0,0 +1,12 @@
+// Generated automatically from com.hubspot.jinjava.objects.SafeString for testing purposes
+
+package com.hubspot.jinjava.objects;
+
+
+public class SafeString
+{
+    protected SafeString() {}
+    public SafeString(String p0){}
+    public String getValue(){ return null; }
+    public String toString(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/objects/serialization/PyishSerializable.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/objects/serialization/PyishSerializable.java
new file mode 100644
index 00000000000..0d5939fd171
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/objects/serialization/PyishSerializable.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.hubspot.jinjava.objects.serialization.PyishSerializable for testing purposes
+
+package com.hubspot.jinjava.objects.serialization;
+
+import com.fasterxml.jackson.databind.ObjectWriter;
+import com.hubspot.jinjava.objects.PyWrapper;
+
+public interface PyishSerializable extends PyWrapper
+{
+    default String toPyishString(){ return null; }
+    static ObjectWriter SELF_WRITER = null;
+    static String writeValueAsString(Object p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/random/RandomNumberGeneratorStrategy.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/random/RandomNumberGeneratorStrategy.java
new file mode 100644
index 00000000000..3b7b13bffb7
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/random/RandomNumberGeneratorStrategy.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.hubspot.jinjava.random.RandomNumberGeneratorStrategy for testing purposes
+
+package com.hubspot.jinjava.random;
+
+
+public enum RandomNumberGeneratorStrategy
+{
+    CONSTANT_ZERO, DEFERRED, THREAD_LOCAL;
+    private RandomNumberGeneratorStrategy() {}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/Node.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/Node.java
new file mode 100644
index 00000000000..d0705d3b8bd
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/Node.java
@@ -0,0 +1,29 @@
+// Generated automatically from com.hubspot.jinjava.tree.Node for testing purposes
+
+package com.hubspot.jinjava.tree;
+
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.tree.output.OutputNode;
+import com.hubspot.jinjava.tree.parse.Token;
+import com.hubspot.jinjava.tree.parse.TokenScannerSymbols;
+import java.io.Serializable;
+import java.util.LinkedList;
+
+abstract public class Node implements Serializable
+{
+    protected Node() {}
+    public LinkedList<Node> getChildren(){ return null; }
+    public Node getParent(){ return null; }
+    public Node(Token p0, int p1, int p2){}
+    public String reconstructImage(){ return null; }
+    public String toTreeString(){ return null; }
+    public String toTreeString(int p0){ return null; }
+    public Token getMaster(){ return null; }
+    public TokenScannerSymbols getSymbols(){ return null; }
+    public abstract OutputNode render(JinjavaInterpreter p0);
+    public abstract String getName();
+    public int getLineNumber(){ return 0; }
+    public int getStartPosition(){ return 0; }
+    public void setChildren(LinkedList<Node> p0){}
+    public void setParent(Node p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/TagNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/TagNode.java
new file mode 100644
index 00000000000..0d747aaabd9
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/TagNode.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.hubspot.jinjava.tree.TagNode for testing purposes
+
+package com.hubspot.jinjava.tree;
+
+import com.hubspot.jinjava.interpret.JinjavaInterpreter;
+import com.hubspot.jinjava.lib.tag.Tag;
+import com.hubspot.jinjava.tree.Node;
+import com.hubspot.jinjava.tree.output.OutputNode;
+import com.hubspot.jinjava.tree.parse.TagToken;
+import com.hubspot.jinjava.tree.parse.TokenScannerSymbols;
+
+public class TagNode extends Node
+{
+    protected TagNode() {}
+    public OutputNode render(JinjavaInterpreter p0){ return null; }
+    public String getEndName(){ return null; }
+    public String getHelpers(){ return null; }
+    public String getName(){ return null; }
+    public String reconstructEnd(){ return null; }
+    public String reconstructImage(){ return null; }
+    public String toString(){ return null; }
+    public Tag getTag(){ return null; }
+    public TagNode(Tag p0, TagToken p1, TokenScannerSymbols p2){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/output/BlockInfo.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/output/BlockInfo.java
new file mode 100644
index 00000000000..efa3dbd60dd
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/output/BlockInfo.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.hubspot.jinjava.tree.output.BlockInfo for testing purposes
+
+package com.hubspot.jinjava.tree.output;
+
+import com.hubspot.jinjava.tree.Node;
+import java.util.List;
+import java.util.Optional;
+
+public class BlockInfo
+{
+    protected BlockInfo() {}
+    public BlockInfo(List<? extends Node> p0, Optional<String> p1, int p2, int p3){}
+    public List<? extends Node> getNodes(){ return null; }
+    public Optional<String> getParentPath(){ return null; }
+    public int getParentLineNo(){ return 0; }
+    public int getParentPosition(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/output/OutputNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/output/OutputNode.java
new file mode 100644
index 00000000000..75c98a3e25c
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/output/OutputNode.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.hubspot.jinjava.tree.output.OutputNode for testing purposes
+
+package com.hubspot.jinjava.tree.output;
+
+
+public interface OutputNode
+{
+    String getValue();
+    long getSize();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/output/RenderedOutputNode.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/output/RenderedOutputNode.java
new file mode 100644
index 00000000000..8a8b0710f7b
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/output/RenderedOutputNode.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.hubspot.jinjava.tree.output.RenderedOutputNode for testing purposes
+
+package com.hubspot.jinjava.tree.output;
+
+import com.hubspot.jinjava.tree.output.OutputNode;
+
+public class RenderedOutputNode implements OutputNode
+{
+    protected RenderedOutputNode() {}
+    public RenderedOutputNode(String p0){}
+    public String getValue(){ return null; }
+    public String toString(){ return null; }
+    public long getSize(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/ExpressionToken.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/ExpressionToken.java
new file mode 100644
index 00000000000..b29e7d420bd
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/ExpressionToken.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.hubspot.jinjava.tree.parse.ExpressionToken for testing purposes
+
+package com.hubspot.jinjava.tree.parse;
+
+import com.hubspot.jinjava.tree.parse.Token;
+import com.hubspot.jinjava.tree.parse.TokenScannerSymbols;
+
+public class ExpressionToken extends Token
+{
+    protected ExpressionToken() {}
+    protected void parse(){}
+    public ExpressionToken(String p0, int p1, int p2, TokenScannerSymbols p3){}
+    public String getExpr(){ return null; }
+    public String toString(){ return null; }
+    public int getType(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/TagToken.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/TagToken.java
new file mode 100644
index 00000000000..188e444e18e
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/TagToken.java
@@ -0,0 +1,18 @@
+// Generated automatically from com.hubspot.jinjava.tree.parse.TagToken for testing purposes
+
+package com.hubspot.jinjava.tree.parse;
+
+import com.hubspot.jinjava.tree.parse.Token;
+import com.hubspot.jinjava.tree.parse.TokenScannerSymbols;
+
+public class TagToken extends Token
+{
+    protected TagToken() {}
+    protected void parse(){}
+    public String getHelpers(){ return null; }
+    public String getRawTagName(){ return null; }
+    public String getTagName(){ return null; }
+    public String toString(){ return null; }
+    public TagToken(String p0, int p1, int p2, TokenScannerSymbols p3){}
+    public int getType(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/Token.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/Token.java
new file mode 100644
index 00000000000..596c939cbe3
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/Token.java
@@ -0,0 +1,30 @@
+// Generated automatically from com.hubspot.jinjava.tree.parse.Token for testing purposes
+
+package com.hubspot.jinjava.tree.parse;
+
+import com.hubspot.jinjava.tree.parse.TokenScannerSymbols;
+import java.io.Serializable;
+
+abstract public class Token implements Serializable
+{
+    protected Token() {}
+    protected String content = null;
+    protected String image = null;
+    protected abstract void parse();
+    protected final int lineNumber = 0;
+    protected final int startPosition = 0;
+    public String getImage(){ return null; }
+    public String toString(){ return null; }
+    public Token(String p0, int p1, int p2, TokenScannerSymbols p3){}
+    public TokenScannerSymbols getSymbols(){ return null; }
+    public abstract int getType();
+    public boolean isLeftTrim(){ return false; }
+    public boolean isRightTrim(){ return false; }
+    public boolean isRightTrimAfterEnd(){ return false; }
+    public int getLineNumber(){ return 0; }
+    public int getStartPosition(){ return 0; }
+    public void mergeImageAndContent(Token p0){}
+    public void setLeftTrim(boolean p0){}
+    public void setRightTrim(boolean p0){}
+    public void setRightTrimAfterEnd(boolean p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/TokenScannerSymbols.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/TokenScannerSymbols.java
new file mode 100644
index 00000000000..5f9662f234d
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/tree/parse/TokenScannerSymbols.java
@@ -0,0 +1,33 @@
+// Generated automatically from com.hubspot.jinjava.tree.parse.TokenScannerSymbols for testing purposes
+
+package com.hubspot.jinjava.tree.parse;
+
+import java.io.Serializable;
+
+abstract public class TokenScannerSymbols implements Serializable
+{
+    public String getClosingComment(){ return null; }
+    public String getExpressionEnd(){ return null; }
+    public String getExpressionEndWithTag(){ return null; }
+    public String getExpressionStart(){ return null; }
+    public String getExpressionStartWithTag(){ return null; }
+    public TokenScannerSymbols(){}
+    public abstract char getExprEndChar();
+    public abstract char getExprStartChar();
+    public abstract char getFixedChar();
+    public abstract char getNewlineChar();
+    public abstract char getNoteChar();
+    public abstract char getPostfixChar();
+    public abstract char getPrefixChar();
+    public abstract char getTagChar();
+    public abstract char getTrimChar();
+    public int getExprEnd(){ return 0; }
+    public int getExprStart(){ return 0; }
+    public int getFixed(){ return 0; }
+    public int getNewline(){ return 0; }
+    public int getNote(){ return 0; }
+    public int getPostfix(){ return 0; }
+    public int getPrefix(){ return 0; }
+    public int getTag(){ return 0; }
+    public int getTrim(){ return 0; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/util/ScopeMap.java b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/util/ScopeMap.java
new file mode 100644
index 00000000000..27c95a62faa
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/com/hubspot/jinjava/util/ScopeMap.java
@@ -0,0 +1,29 @@
+// Generated automatically from com.hubspot.jinjava.util.ScopeMap for testing purposes
+
+package com.hubspot.jinjava.util;
+
+import java.util.Collection;
+import java.util.Map;
+import java.util.Set;
+
+public class ScopeMap<K, V> implements Map<K, V>
+{
+    public Collection<V> values(){ return null; }
+    public Map<K, V> getScope(){ return null; }
+    public ScopeMap(){}
+    public ScopeMap(ScopeMap<K, V> p0){}
+    public ScopeMap(ScopeMap<K, V> p0, Map<K, V> p1){}
+    public ScopeMap<K, V> getParent(){ return null; }
+    public Set<K> keySet(){ return null; }
+    public Set<Map.Entry<K, V>> entrySet(){ return null; }
+    public V get(Object p0){ return null; }
+    public V get(Object p0, V p1){ return null; }
+    public V put(K p0, V p1){ return null; }
+    public V remove(Object p0){ return null; }
+    public boolean containsKey(Object p0){ return false; }
+    public boolean containsValue(Object p0){ return false; }
+    public boolean isEmpty(){ return false; }
+    public int size(){ return 0; }
+    public void clear(){}
+    public void putAll(Map<? extends K, ? extends V> p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ELContext.java b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ELContext.java
new file mode 100644
index 00000000000..2f101609df1
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ELContext.java
@@ -0,0 +1,22 @@
+// Generated automatically from jinjava.javax.el.ELContext for testing purposes
+
+package jinjava.javax.el;
+
+import java.util.Locale;
+import jinjava.javax.el.ELResolver;
+import jinjava.javax.el.FunctionMapper;
+import jinjava.javax.el.VariableMapper;
+
+abstract public class ELContext
+{
+    public ELContext(){}
+    public Locale getLocale(){ return null; }
+    public Object getContext(Class<? extends Object> p0){ return null; }
+    public abstract ELResolver getELResolver();
+    public abstract FunctionMapper getFunctionMapper();
+    public abstract VariableMapper getVariableMapper();
+    public boolean isPropertyResolved(){ return false; }
+    public void putContext(Class<? extends Object> p0, Object p1){}
+    public void setLocale(Locale p0){}
+    public void setPropertyResolved(boolean p0){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ELResolver.java b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ELResolver.java
new file mode 100644
index 00000000000..920da009593
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ELResolver.java
@@ -0,0 +1,21 @@
+// Generated automatically from jinjava.javax.el.ELResolver for testing purposes
+
+package jinjava.javax.el;
+
+import java.beans.FeatureDescriptor;
+import java.util.Iterator;
+import jinjava.javax.el.ELContext;
+
+abstract public class ELResolver
+{
+    public ELResolver(){}
+    public Object invoke(ELContext p0, Object p1, Object p2, Class<? extends Object>[] p3, Object[] p4){ return null; }
+    public abstract Class<? extends Object> getCommonPropertyType(ELContext p0, Object p1);
+    public abstract Class<? extends Object> getType(ELContext p0, Object p1, Object p2);
+    public abstract Iterator<FeatureDescriptor> getFeatureDescriptors(ELContext p0, Object p1);
+    public abstract Object getValue(ELContext p0, Object p1, Object p2);
+    public abstract boolean isReadOnly(ELContext p0, Object p1, Object p2);
+    public abstract void setValue(ELContext p0, Object p1, Object p2, Object p3);
+    public static String RESOLVABLE_AT_DESIGN_TIME = null;
+    public static String TYPE = null;
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/Expression.java b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/Expression.java
new file mode 100644
index 00000000000..457c7d0997f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/Expression.java
@@ -0,0 +1,14 @@
+// Generated automatically from jinjava.javax.el.Expression for testing purposes
+
+package jinjava.javax.el;
+
+import java.io.Serializable;
+
+abstract public class Expression implements Serializable
+{
+    public Expression(){}
+    public abstract String getExpressionString();
+    public abstract boolean equals(Object p0);
+    public abstract boolean isLiteralText();
+    public abstract int hashCode();
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ExpressionFactory.java b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ExpressionFactory.java
new file mode 100644
index 00000000000..088c46147f8
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ExpressionFactory.java
@@ -0,0 +1,19 @@
+// Generated automatically from jinjava.javax.el.ExpressionFactory for testing purposes
+
+package jinjava.javax.el;
+
+import java.util.Properties;
+import jinjava.javax.el.ELContext;
+import jinjava.javax.el.MethodExpression;
+import jinjava.javax.el.ValueExpression;
+
+abstract public class ExpressionFactory
+{
+    public ExpressionFactory(){}
+    public abstract MethodExpression createMethodExpression(ELContext p0, String p1, Class<? extends Object> p2, Class<? extends Object>[] p3);
+    public abstract Object coerceToType(Object p0, Class<? extends Object> p1);
+    public abstract ValueExpression createValueExpression(ELContext p0, String p1, Class<? extends Object> p2);
+    public abstract ValueExpression createValueExpression(Object p0, Class<? extends Object> p1);
+    public static ExpressionFactory newInstance(){ return null; }
+    public static ExpressionFactory newInstance(Properties p0){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/FunctionMapper.java b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/FunctionMapper.java
new file mode 100644
index 00000000000..10f8b6c304a
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/FunctionMapper.java
@@ -0,0 +1,11 @@
+// Generated automatically from jinjava.javax.el.FunctionMapper for testing purposes
+
+package jinjava.javax.el;
+
+import java.lang.reflect.Method;
+
+abstract public class FunctionMapper
+{
+    public FunctionMapper(){}
+    public abstract Method resolveFunction(String p0, String p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/MethodExpression.java b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/MethodExpression.java
new file mode 100644
index 00000000000..31f9a360671
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/MethodExpression.java
@@ -0,0 +1,15 @@
+// Generated automatically from jinjava.javax.el.MethodExpression for testing purposes
+
+package jinjava.javax.el;
+
+import jinjava.javax.el.ELContext;
+import jinjava.javax.el.Expression;
+import jinjava.javax.el.MethodInfo;
+
+abstract public class MethodExpression extends Expression
+{
+    public MethodExpression(){}
+    public abstract MethodInfo getMethodInfo(ELContext p0);
+    public abstract Object invoke(ELContext p0, Object[] p1);
+    public boolean isParmetersProvided(){ return false; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/MethodInfo.java b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/MethodInfo.java
new file mode 100644
index 00000000000..470662dfd4f
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/MethodInfo.java
@@ -0,0 +1,13 @@
+// Generated automatically from jinjava.javax.el.MethodInfo for testing purposes
+
+package jinjava.javax.el;
+
+
+public class MethodInfo
+{
+    protected MethodInfo() {}
+    public Class<? extends Object> getReturnType(){ return null; }
+    public Class<? extends Object>[] getParamTypes(){ return null; }
+    public MethodInfo(String p0, Class<? extends Object> p1, Class<? extends Object>[] p2){}
+    public String getName(){ return null; }
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ValueExpression.java b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ValueExpression.java
new file mode 100644
index 00000000000..71e4eadc431
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ValueExpression.java
@@ -0,0 +1,18 @@
+// Generated automatically from jinjava.javax.el.ValueExpression for testing purposes
+
+package jinjava.javax.el;
+
+import jinjava.javax.el.ELContext;
+import jinjava.javax.el.Expression;
+import jinjava.javax.el.ValueReference;
+
+abstract public class ValueExpression extends Expression
+{
+    public ValueExpression(){}
+    public ValueReference getValueReference(ELContext p0){ return null; }
+    public abstract Class<? extends Object> getExpectedType();
+    public abstract Class<? extends Object> getType(ELContext p0);
+    public abstract Object getValue(ELContext p0);
+    public abstract boolean isReadOnly(ELContext p0);
+    public abstract void setValue(ELContext p0, Object p1);
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ValueReference.java b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ValueReference.java
new file mode 100644
index 00000000000..49bb7539561
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/ValueReference.java
@@ -0,0 +1,13 @@
+// Generated automatically from jinjava.javax.el.ValueReference for testing purposes
+
+package jinjava.javax.el;
+
+import java.io.Serializable;
+
+public class ValueReference implements Serializable
+{
+    protected ValueReference() {}
+    public Object getBase(){ return null; }
+    public Object getProperty(){ return null; }
+    public ValueReference(Object p0, Object p1){}
+}
diff --git a/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/VariableMapper.java b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/VariableMapper.java
new file mode 100644
index 00000000000..b6009a3c2db
--- /dev/null
+++ b/java/ql/test/stubs/jinjava-2.6.0/jinjava/javax/el/VariableMapper.java
@@ -0,0 +1,12 @@
+// Generated automatically from jinjava.javax.el.VariableMapper for testing purposes
+
+package jinjava.javax.el;
+
+import jinjava.javax.el.ValueExpression;
+
+abstract public class VariableMapper
+{
+    public VariableMapper(){}
+    public abstract ValueExpression resolveVariable(String p0);
+    public abstract ValueExpression setVariable(String p0, ValueExpression p1);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/PebbleEngine.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/PebbleEngine.java
new file mode 100644
index 00000000000..60506ce81d4
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/PebbleEngine.java
@@ -0,0 +1,27 @@
+package com.mitchellbosecke.pebble;
+
+import com.mitchellbosecke.pebble.template.*;
+
+public class PebbleEngine {
+    public static class Builder {
+        public Builder() {
+        };
+
+        public PebbleEngine build() {
+            return new PebbleEngine();
+        }
+    };
+
+    PebbleEngine() {
+    }
+
+    public PebbleTemplate getLiteralTemplate(String templateName) {
+        return new PebbleTemplate() {
+        };
+    }
+
+    public PebbleTemplate getTemplate(String templateName) {
+        return new PebbleTemplate() {
+        };
+    }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/PebbleEngine.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/PebbleEngine.java
new file mode 100644
index 00000000000..56cf8ce454c
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/PebbleEngine.java
@@ -0,0 +1,60 @@
+// Generated automatically from com.mitchellbosecke.pebble.PebbleEngine for testing purposes
+
+package com.mitchellbosecke.pebble;
+
+import com.mitchellbosecke.pebble.attributes.methodaccess.MethodAccessValidator;
+import com.mitchellbosecke.pebble.cache.CacheKey;
+import com.mitchellbosecke.pebble.cache.PebbleCache;
+import com.mitchellbosecke.pebble.extension.Extension;
+import com.mitchellbosecke.pebble.extension.ExtensionCustomizer;
+import com.mitchellbosecke.pebble.extension.ExtensionRegistry;
+import com.mitchellbosecke.pebble.extension.escaper.EscapingStrategy;
+import com.mitchellbosecke.pebble.lexer.Syntax;
+import com.mitchellbosecke.pebble.loader.Loader;
+import com.mitchellbosecke.pebble.template.EvaluationOptions;
+import com.mitchellbosecke.pebble.template.PebbleTemplate;
+import java.util.Locale;
+import java.util.concurrent.ExecutorService;
+import java.util.function.Function;
+
+public class PebbleEngine
+{
+    protected PebbleEngine() {}
+    public EvaluationOptions getEvaluationOptions(){ return null; }
+    public ExecutorService getExecutorService(){ return null; }
+    public ExtensionRegistry getExtensionRegistry(){ return null; }
+    public Loader<? extends Object> getLoader(){ return null; }
+    public Locale getDefaultLocale(){ return null; }
+    public PebbleCache<CacheKey, Object> getTagCache(){ return null; }
+    public PebbleCache<Object, PebbleTemplate> getTemplateCache(){ return null; }
+    public PebbleTemplate getLiteralTemplate(String p0){ return null; }
+    public PebbleTemplate getTemplate(String p0){ return null; }
+    public Syntax getSyntax(){ return null; }
+    public boolean isStrictVariables(){ return false; }
+    public int getMaxRenderedSize(){ return 0; }
+    static public class Builder
+    {
+        public Builder(){}
+        public PebbleEngine build(){ return null; }
+        public PebbleEngine.Builder addEscapingStrategy(String p0, EscapingStrategy p1){ return null; }
+        public PebbleEngine.Builder allowOverrideCoreOperators(boolean p0){ return null; }
+        public PebbleEngine.Builder autoEscaping(boolean p0){ return null; }
+        public PebbleEngine.Builder cacheActive(boolean p0){ return null; }
+        public PebbleEngine.Builder defaultEscapingStrategy(String p0){ return null; }
+        public PebbleEngine.Builder defaultLocale(Locale p0){ return null; }
+        public PebbleEngine.Builder executorService(ExecutorService p0){ return null; }
+        public PebbleEngine.Builder extension(Extension... p0){ return null; }
+        public PebbleEngine.Builder greedyMatchMethod(boolean p0){ return null; }
+        public PebbleEngine.Builder literalDecimalTreatedAsInteger(boolean p0){ return null; }
+        public PebbleEngine.Builder literalNumbersAsBigDecimals(boolean p0){ return null; }
+        public PebbleEngine.Builder loader(Loader<? extends Object> p0){ return null; }
+        public PebbleEngine.Builder maxRenderedSize(int p0){ return null; }
+        public PebbleEngine.Builder methodAccessValidator(MethodAccessValidator p0){ return null; }
+        public PebbleEngine.Builder newLineTrimming(boolean p0){ return null; }
+        public PebbleEngine.Builder registerExtensionCustomizer(Function<Extension, ExtensionCustomizer> p0){ return null; }
+        public PebbleEngine.Builder strictVariables(boolean p0){ return null; }
+        public PebbleEngine.Builder syntax(Syntax p0){ return null; }
+        public PebbleEngine.Builder tagCache(PebbleCache<CacheKey, Object> p0){ return null; }
+        public PebbleEngine.Builder templateCache(PebbleCache<Object, PebbleTemplate> p0){ return null; }
+    }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/attributes/AttributeResolver.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/attributes/AttributeResolver.java
new file mode 100644
index 00000000000..718d9514cd7
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/attributes/AttributeResolver.java
@@ -0,0 +1,12 @@
+// Generated automatically from com.mitchellbosecke.pebble.attributes.AttributeResolver for testing purposes
+
+package com.mitchellbosecke.pebble.attributes;
+
+import com.mitchellbosecke.pebble.attributes.ResolvedAttribute;
+import com.mitchellbosecke.pebble.node.ArgumentsNode;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+
+public interface AttributeResolver
+{
+    ResolvedAttribute resolve(Object p0, Object p1, Object[] p2, ArgumentsNode p3, EvaluationContextImpl p4, String p5, int p6);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/attributes/ResolvedAttribute.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/attributes/ResolvedAttribute.java
new file mode 100644
index 00000000000..96eeeb9f049
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/attributes/ResolvedAttribute.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.mitchellbosecke.pebble.attributes.ResolvedAttribute for testing purposes
+
+package com.mitchellbosecke.pebble.attributes;
+
+
+public class ResolvedAttribute
+{
+    protected ResolvedAttribute() {}
+    public ResolvedAttribute(Object p0){}
+    public final Object evaluatedValue = null;
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/attributes/methodaccess/MethodAccessValidator.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/attributes/methodaccess/MethodAccessValidator.java
new file mode 100644
index 00000000000..de3f0199069
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/attributes/methodaccess/MethodAccessValidator.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.mitchellbosecke.pebble.attributes.methodaccess.MethodAccessValidator for testing purposes
+
+package com.mitchellbosecke.pebble.attributes.methodaccess;
+
+import java.lang.reflect.Method;
+
+public interface MethodAccessValidator
+{
+    boolean isMethodAccessAllowed(Object p0, Method p1);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/cache/CacheKey.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/cache/CacheKey.java
new file mode 100644
index 00000000000..9ca2ee21be4
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/cache/CacheKey.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.mitchellbosecke.pebble.cache.CacheKey for testing purposes
+
+package com.mitchellbosecke.pebble.cache;
+
+import com.mitchellbosecke.pebble.node.CacheNode;
+import java.util.Locale;
+
+public class CacheKey
+{
+    protected CacheKey() {}
+    public CacheKey(CacheNode p0, String p1, Locale p2){}
+    public boolean equals(Object p0){ return false; }
+    public int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/cache/PebbleCache.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/cache/PebbleCache.java
new file mode 100644
index 00000000000..4aa03637ca9
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/cache/PebbleCache.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.mitchellbosecke.pebble.cache.PebbleCache for testing purposes
+
+package com.mitchellbosecke.pebble.cache;
+
+import java.util.function.Function;
+
+public interface PebbleCache<K, V>
+{
+    V computeIfAbsent(K p0, Function<? super K, ? extends V> p1);
+    void invalidateAll();
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Extension.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Extension.java
new file mode 100644
index 00000000000..9ac4cf8ca7a
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Extension.java
@@ -0,0 +1,27 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.Extension for testing purposes
+
+package com.mitchellbosecke.pebble.extension;
+
+import com.mitchellbosecke.pebble.attributes.AttributeResolver;
+import com.mitchellbosecke.pebble.extension.Filter;
+import com.mitchellbosecke.pebble.extension.Function;
+import com.mitchellbosecke.pebble.extension.NodeVisitorFactory;
+import com.mitchellbosecke.pebble.extension.Test;
+import com.mitchellbosecke.pebble.operator.BinaryOperator;
+import com.mitchellbosecke.pebble.operator.UnaryOperator;
+import com.mitchellbosecke.pebble.tokenParser.TokenParser;
+import java.util.List;
+import java.util.Map;
+
+public interface Extension
+{
+    List<AttributeResolver> getAttributeResolver();
+    List<BinaryOperator> getBinaryOperators();
+    List<NodeVisitorFactory> getNodeVisitors();
+    List<TokenParser> getTokenParsers();
+    List<UnaryOperator> getUnaryOperators();
+    Map<String, Filter> getFilters();
+    Map<String, Function> getFunctions();
+    Map<String, Object> getGlobalVariables();
+    Map<String, Test> getTests();
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/ExtensionCustomizer.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/ExtensionCustomizer.java
new file mode 100644
index 00000000000..2658a04cef3
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/ExtensionCustomizer.java
@@ -0,0 +1,30 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.ExtensionCustomizer for testing purposes
+
+package com.mitchellbosecke.pebble.extension;
+
+import com.mitchellbosecke.pebble.attributes.AttributeResolver;
+import com.mitchellbosecke.pebble.extension.Extension;
+import com.mitchellbosecke.pebble.extension.Filter;
+import com.mitchellbosecke.pebble.extension.Function;
+import com.mitchellbosecke.pebble.extension.NodeVisitorFactory;
+import com.mitchellbosecke.pebble.extension.Test;
+import com.mitchellbosecke.pebble.operator.BinaryOperator;
+import com.mitchellbosecke.pebble.operator.UnaryOperator;
+import com.mitchellbosecke.pebble.tokenParser.TokenParser;
+import java.util.List;
+import java.util.Map;
+
+abstract public class ExtensionCustomizer implements Extension
+{
+    protected ExtensionCustomizer() {}
+    public ExtensionCustomizer(Extension p0){}
+    public List<AttributeResolver> getAttributeResolver(){ return null; }
+    public List<BinaryOperator> getBinaryOperators(){ return null; }
+    public List<NodeVisitorFactory> getNodeVisitors(){ return null; }
+    public List<TokenParser> getTokenParsers(){ return null; }
+    public List<UnaryOperator> getUnaryOperators(){ return null; }
+    public Map<String, Filter> getFilters(){ return null; }
+    public Map<String, Function> getFunctions(){ return null; }
+    public Map<String, Object> getGlobalVariables(){ return null; }
+    public Map<String, Test> getTests(){ return null; }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/ExtensionRegistry.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/ExtensionRegistry.java
new file mode 100644
index 00000000000..58a9e8bbad5
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/ExtensionRegistry.java
@@ -0,0 +1,33 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.ExtensionRegistry for testing purposes
+
+package com.mitchellbosecke.pebble.extension;
+
+import com.mitchellbosecke.pebble.attributes.AttributeResolver;
+import com.mitchellbosecke.pebble.extension.Extension;
+import com.mitchellbosecke.pebble.extension.Filter;
+import com.mitchellbosecke.pebble.extension.Function;
+import com.mitchellbosecke.pebble.extension.NodeVisitorFactory;
+import com.mitchellbosecke.pebble.extension.Test;
+import com.mitchellbosecke.pebble.operator.BinaryOperator;
+import com.mitchellbosecke.pebble.operator.UnaryOperator;
+import com.mitchellbosecke.pebble.tokenParser.TokenParser;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+
+public class ExtensionRegistry
+{
+    public ExtensionRegistry(){}
+    public ExtensionRegistry(Collection<? extends Extension> p0){}
+    public Filter getFilter(String p0){ return null; }
+    public Function getFunction(String p0){ return null; }
+    public List<AttributeResolver> getAttributeResolver(){ return null; }
+    public List<NodeVisitorFactory> getNodeVisitors(){ return null; }
+    public Map<String, BinaryOperator> getBinaryOperators(){ return null; }
+    public Map<String, Object> getGlobalVariables(){ return null; }
+    public Map<String, TokenParser> getTokenParsers(){ return null; }
+    public Map<String, UnaryOperator> getUnaryOperators(){ return null; }
+    public Test getTest(String p0){ return null; }
+    public void addExtension(Extension p0){}
+    public void addOperatorOverridingExtension(Extension p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Filter.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Filter.java
new file mode 100644
index 00000000000..44607c35755
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Filter.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.Filter for testing purposes
+
+package com.mitchellbosecke.pebble.extension;
+
+import com.mitchellbosecke.pebble.extension.NamedArguments;
+import com.mitchellbosecke.pebble.template.EvaluationContext;
+import com.mitchellbosecke.pebble.template.PebbleTemplate;
+import java.util.Map;
+
+public interface Filter extends NamedArguments
+{
+    Object apply(Object p0, Map<String, Object> p1, PebbleTemplate p2, EvaluationContext p3, int p4);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Function.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Function.java
new file mode 100644
index 00000000000..f637b1d027d
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Function.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.Function for testing purposes
+
+package com.mitchellbosecke.pebble.extension;
+
+import com.mitchellbosecke.pebble.extension.NamedArguments;
+import com.mitchellbosecke.pebble.template.EvaluationContext;
+import com.mitchellbosecke.pebble.template.PebbleTemplate;
+import java.util.Map;
+
+public interface Function extends NamedArguments
+{
+    Object execute(Map<String, Object> p0, PebbleTemplate p1, EvaluationContext p2, int p3);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/NamedArguments.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/NamedArguments.java
new file mode 100644
index 00000000000..db71ab2f63e
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/NamedArguments.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.NamedArguments for testing purposes
+
+package com.mitchellbosecke.pebble.extension;
+
+import java.util.List;
+
+public interface NamedArguments
+{
+    List<String> getArgumentNames();
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/NodeVisitor.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/NodeVisitor.java
new file mode 100644
index 00000000000..16073524bda
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/NodeVisitor.java
@@ -0,0 +1,46 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.NodeVisitor for testing purposes
+
+package com.mitchellbosecke.pebble.extension;
+
+import com.mitchellbosecke.pebble.node.ArgumentsNode;
+import com.mitchellbosecke.pebble.node.AutoEscapeNode;
+import com.mitchellbosecke.pebble.node.BlockNode;
+import com.mitchellbosecke.pebble.node.BodyNode;
+import com.mitchellbosecke.pebble.node.ExtendsNode;
+import com.mitchellbosecke.pebble.node.FlushNode;
+import com.mitchellbosecke.pebble.node.ForNode;
+import com.mitchellbosecke.pebble.node.IfNode;
+import com.mitchellbosecke.pebble.node.ImportNode;
+import com.mitchellbosecke.pebble.node.IncludeNode;
+import com.mitchellbosecke.pebble.node.MacroNode;
+import com.mitchellbosecke.pebble.node.NamedArgumentNode;
+import com.mitchellbosecke.pebble.node.Node;
+import com.mitchellbosecke.pebble.node.ParallelNode;
+import com.mitchellbosecke.pebble.node.PositionalArgumentNode;
+import com.mitchellbosecke.pebble.node.PrintNode;
+import com.mitchellbosecke.pebble.node.RootNode;
+import com.mitchellbosecke.pebble.node.SetNode;
+import com.mitchellbosecke.pebble.node.TextNode;
+
+public interface NodeVisitor
+{
+    void visit(ArgumentsNode p0);
+    void visit(AutoEscapeNode p0);
+    void visit(BlockNode p0);
+    void visit(BodyNode p0);
+    void visit(ExtendsNode p0);
+    void visit(FlushNode p0);
+    void visit(ForNode p0);
+    void visit(IfNode p0);
+    void visit(ImportNode p0);
+    void visit(IncludeNode p0);
+    void visit(MacroNode p0);
+    void visit(NamedArgumentNode p0);
+    void visit(Node p0);
+    void visit(ParallelNode p0);
+    void visit(PositionalArgumentNode p0);
+    void visit(PrintNode p0);
+    void visit(RootNode p0);
+    void visit(SetNode p0);
+    void visit(TextNode p0);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/NodeVisitorFactory.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/NodeVisitorFactory.java
new file mode 100644
index 00000000000..d4f04d6d23b
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/NodeVisitorFactory.java
@@ -0,0 +1,11 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.NodeVisitorFactory for testing purposes
+
+package com.mitchellbosecke.pebble.extension;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.template.PebbleTemplate;
+
+public interface NodeVisitorFactory
+{
+    NodeVisitor createVisitor(PebbleTemplate p0);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Test.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Test.java
new file mode 100644
index 00000000000..ddcf7e17597
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/Test.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.Test for testing purposes
+
+package com.mitchellbosecke.pebble.extension;
+
+import com.mitchellbosecke.pebble.extension.NamedArguments;
+import com.mitchellbosecke.pebble.template.EvaluationContext;
+import com.mitchellbosecke.pebble.template.PebbleTemplate;
+import java.util.Map;
+
+public interface Test extends NamedArguments
+{
+    boolean apply(Object p0, Map<String, Object> p1, PebbleTemplate p2, EvaluationContext p3, int p4);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/escaper/EscapingStrategy.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/escaper/EscapingStrategy.java
new file mode 100644
index 00000000000..8a844aeefbf
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/escaper/EscapingStrategy.java
@@ -0,0 +1,9 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.escaper.EscapingStrategy for testing purposes
+
+package com.mitchellbosecke.pebble.extension.escaper;
+
+
+public interface EscapingStrategy
+{
+    String escape(String p0);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/escaper/SafeString.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/escaper/SafeString.java
new file mode 100644
index 00000000000..3c83117e3b7
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/extension/escaper/SafeString.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.extension.escaper.SafeString for testing purposes
+
+package com.mitchellbosecke.pebble.extension.escaper;
+
+
+public class SafeString
+{
+    protected SafeString() {}
+    public SafeString(String p0){}
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/lexer/Syntax.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/lexer/Syntax.java
new file mode 100644
index 00000000000..cc05826c284
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/lexer/Syntax.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.mitchellbosecke.pebble.lexer.Syntax for testing purposes
+
+package com.mitchellbosecke.pebble.lexer;
+
+
+public class Syntax
+{
+    protected Syntax() {}
+    public String getCommentCloseDelimiter(){ return null; }
+    public String getCommentOpenDelimiter(){ return null; }
+    public String getExecuteCloseDelimiter(){ return null; }
+    public String getExecuteOpenDelimiter(){ return null; }
+    public String getInterpolationCloseDelimiter(){ return null; }
+    public String getInterpolationOpenDelimiter(){ return null; }
+    public String getPrintCloseDelimiter(){ return null; }
+    public String getPrintOpenDelimiter(){ return null; }
+    public String getWhitespaceTrim(){ return null; }
+    public Syntax(String p0, String p1, String p2, String p3, String p4, String p5, String p6, String p7, String p8, boolean p9){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/lexer/Token.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/lexer/Token.java
new file mode 100644
index 00000000000..b47763e38bc
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/lexer/Token.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.mitchellbosecke.pebble.lexer.Token for testing purposes
+
+package com.mitchellbosecke.pebble.lexer;
+
+
+public class Token
+{
+    protected Token() {}
+    public String getValue(){ return null; }
+    public String toString(){ return null; }
+    public Token(Token.Type p0, String p1, int p2){}
+    public Token.Type getType(){ return null; }
+    public boolean test(Token.Type p0){ return false; }
+    public boolean test(Token.Type p0, String... p1){ return false; }
+    public int getLineNumber(){ return 0; }
+    public void setLineNumber(int p0){}
+    public void setType(Token.Type p0){}
+    public void setValue(String p0){}
+    static public enum Type
+    {
+        EOF, EXECUTE_END, EXECUTE_START, LONG, NAME, NUMBER, OPERATOR, PRINT_END, PRINT_START, PUNCTUATION, STRING, STRING_INTERPOLATION_END, STRING_INTERPOLATION_START, TEXT;
+        private Type() {}
+    }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/lexer/TokenStream.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/lexer/TokenStream.java
new file mode 100644
index 00000000000..dc85efa48ea
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/lexer/TokenStream.java
@@ -0,0 +1,23 @@
+// Generated automatically from com.mitchellbosecke.pebble.lexer.TokenStream for testing purposes
+
+package com.mitchellbosecke.pebble.lexer;
+
+import com.mitchellbosecke.pebble.lexer.Token;
+import java.util.ArrayList;
+import java.util.Collection;
+
+public class TokenStream
+{
+    protected TokenStream() {}
+    public ArrayList<Token> getTokens(){ return null; }
+    public String getFilename(){ return null; }
+    public String toString(){ return null; }
+    public Token current(){ return null; }
+    public Token expect(Token.Type p0){ return null; }
+    public Token expect(Token.Type p0, String p1){ return null; }
+    public Token next(){ return null; }
+    public Token peek(){ return null; }
+    public Token peek(int p0){ return null; }
+    public TokenStream(Collection<Token> p0, String p1){}
+    public boolean isEOF(){ return false; }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/loader/Loader.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/loader/Loader.java
new file mode 100644
index 00000000000..48f20a1756a
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/loader/Loader.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.mitchellbosecke.pebble.loader.Loader for testing purposes
+
+package com.mitchellbosecke.pebble.loader;
+
+import java.io.Reader;
+
+public interface Loader<T>
+{
+    Reader getReader(T p0);
+    String resolveRelativePath(String p0, String p1);
+    T createCacheKey(String p0);
+    boolean resourceExists(String p0);
+    void setCharset(String p0);
+    void setPrefix(String p0);
+    void setSuffix(String p0);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/AbstractRenderableNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/AbstractRenderableNode.java
new file mode 100644
index 00000000000..371268d1456
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/AbstractRenderableNode.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.AbstractRenderableNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.RenderableNode;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+abstract public class AbstractRenderableNode implements RenderableNode
+{
+    public AbstractRenderableNode(){}
+    public AbstractRenderableNode(int p0){}
+    public abstract void accept(NodeVisitor p0);
+    public abstract void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2);
+    public int getLineNumber(){ return 0; }
+    public void setLineNumber(int p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ArgumentsNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ArgumentsNode.java
new file mode 100644
index 00000000000..1b5a7727823
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ArgumentsNode.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.ArgumentsNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NamedArguments;
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.NamedArgumentNode;
+import com.mitchellbosecke.pebble.node.Node;
+import com.mitchellbosecke.pebble.node.PositionalArgumentNode;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.util.List;
+import java.util.Map;
+
+public class ArgumentsNode implements Node
+{
+    protected ArgumentsNode() {}
+    public ArgumentsNode(List<PositionalArgumentNode> p0, List<NamedArgumentNode> p1, int p2){}
+    public List<NamedArgumentNode> getNamedArgs(){ return null; }
+    public List<PositionalArgumentNode> getPositionalArgs(){ return null; }
+    public Map<String, Object> getArgumentMap(PebbleTemplateImpl p0, EvaluationContextImpl p1, NamedArguments p2){ return null; }
+    public String toString(){ return null; }
+    public void accept(NodeVisitor p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/AutoEscapeNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/AutoEscapeNode.java
new file mode 100644
index 00000000000..1a34db674cf
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/AutoEscapeNode.java
@@ -0,0 +1,21 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.AutoEscapeNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.BodyNode;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class AutoEscapeNode extends AbstractRenderableNode
+{
+    protected AutoEscapeNode() {}
+    public AutoEscapeNode(int p0, BodyNode p1, boolean p2, String p3){}
+    public BodyNode getBody(){ return null; }
+    public String getStrategy(){ return null; }
+    public boolean isActive(){ return false; }
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/BlockNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/BlockNode.java
new file mode 100644
index 00000000000..7a17260f634
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/BlockNode.java
@@ -0,0 +1,23 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.BlockNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.BodyNode;
+import com.mitchellbosecke.pebble.template.Block;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class BlockNode extends AbstractRenderableNode
+{
+    protected BlockNode() {}
+    public Block getBlock(){ return null; }
+    public BlockNode(int p0, String p1){}
+    public BlockNode(int p0, String p1, BodyNode p2){}
+    public BodyNode getBody(){ return null; }
+    public String getName(){ return null; }
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/BodyNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/BodyNode.java
new file mode 100644
index 00000000000..6c0247221c1
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/BodyNode.java
@@ -0,0 +1,22 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.BodyNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.RenderableNode;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+import java.util.List;
+
+public class BodyNode extends AbstractRenderableNode
+{
+    protected BodyNode() {}
+    public BodyNode(int p0, List<RenderableNode> p1){}
+    public List<RenderableNode> getChildren(){ return null; }
+    public boolean isOnlyRenderInheritanceSafeNodes(){ return false; }
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+    public void setOnlyRenderInheritanceSafeNodes(boolean p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/CacheNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/CacheNode.java
new file mode 100644
index 00000000000..22d7afa9746
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/CacheNode.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.CacheNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.BodyNode;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class CacheNode extends AbstractRenderableNode
+{
+    protected CacheNode() {}
+    public CacheNode(int p0, Expression<? extends Object> p1, BodyNode p2){}
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ExtendsNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ExtendsNode.java
new file mode 100644
index 00000000000..32f5b7663f0
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ExtendsNode.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.ExtendsNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class ExtendsNode extends AbstractRenderableNode
+{
+    protected ExtendsNode() {}
+    public Expression<? extends Object> getParentExpression(){ return null; }
+    public ExtendsNode(int p0, Expression<? extends Object> p1){}
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/FlushNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/FlushNode.java
new file mode 100644
index 00000000000..90ca7c5eb57
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/FlushNode.java
@@ -0,0 +1,17 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.FlushNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class FlushNode extends AbstractRenderableNode
+{
+    protected FlushNode() {}
+    public FlushNode(int p0){}
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ForNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ForNode.java
new file mode 100644
index 00000000000..f9862be4e40
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ForNode.java
@@ -0,0 +1,23 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.ForNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.BodyNode;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class ForNode extends AbstractRenderableNode
+{
+    protected ForNode() {}
+    public BodyNode getBody(){ return null; }
+    public BodyNode getElseBody(){ return null; }
+    public Expression<? extends Object> getIterable(){ return null; }
+    public ForNode(int p0, String p1, Expression<? extends Object> p2, BodyNode p3, BodyNode p4){}
+    public String getIterationVariable(){ return null; }
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/IfNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/IfNode.java
new file mode 100644
index 00000000000..0f9d5ca6dab
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/IfNode.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.IfNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.BodyNode;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import com.mitchellbosecke.pebble.utils.Pair;
+import java.io.Writer;
+import java.util.List;
+
+public class IfNode extends AbstractRenderableNode
+{
+    protected IfNode() {}
+    public BodyNode getElseBody(){ return null; }
+    public IfNode(int p0, List<Pair<Expression<? extends Object>, BodyNode>> p1){}
+    public IfNode(int p0, List<Pair<Expression<? extends Object>, BodyNode>> p1, BodyNode p2){}
+    public List<Pair<Expression<? extends Object>, BodyNode>> getConditionsWithBodies(){ return null; }
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ImportNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ImportNode.java
new file mode 100644
index 00000000000..b67bed68d29
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ImportNode.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.ImportNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class ImportNode extends AbstractRenderableNode
+{
+    protected ImportNode() {}
+    public Expression<? extends Object> getImportExpression(){ return null; }
+    public ImportNode(int p0, Expression<? extends Object> p1, String p2){}
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/IncludeNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/IncludeNode.java
new file mode 100644
index 00000000000..ce3300bd9f6
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/IncludeNode.java
@@ -0,0 +1,20 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.IncludeNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.node.expression.MapExpression;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class IncludeNode extends AbstractRenderableNode
+{
+    protected IncludeNode() {}
+    public Expression<? extends Object> getIncludeExpression(){ return null; }
+    public IncludeNode(int p0, Expression<? extends Object> p1, MapExpression p2){}
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/MacroNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/MacroNode.java
new file mode 100644
index 00000000000..2fe3b40b885
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/MacroNode.java
@@ -0,0 +1,24 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.MacroNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.ArgumentsNode;
+import com.mitchellbosecke.pebble.node.BodyNode;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.Macro;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class MacroNode extends AbstractRenderableNode
+{
+    protected MacroNode() {}
+    public ArgumentsNode getArgs(){ return null; }
+    public BodyNode getBody(){ return null; }
+    public Macro getMacro(){ return null; }
+    public MacroNode(String p0, ArgumentsNode p1, BodyNode p2){}
+    public String getName(){ return null; }
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/NamedArgumentNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/NamedArgumentNode.java
new file mode 100644
index 00000000000..55289d4e22d
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/NamedArgumentNode.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.NamedArgumentNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.Node;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+
+public class NamedArgumentNode implements Node
+{
+    protected NamedArgumentNode() {}
+    public Expression<? extends Object> getValueExpression(){ return null; }
+    public NamedArgumentNode(String p0, Expression<? extends Object> p1){}
+    public String getName(){ return null; }
+    public void accept(NodeVisitor p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/Node.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/Node.java
new file mode 100644
index 00000000000..e7fdceaffb5
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/Node.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.Node for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+
+public interface Node
+{
+    void accept(NodeVisitor p0);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ParallelNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ParallelNode.java
new file mode 100644
index 00000000000..95f55df23d7
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/ParallelNode.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.ParallelNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.BodyNode;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class ParallelNode extends AbstractRenderableNode
+{
+    protected ParallelNode() {}
+    public BodyNode getBody(){ return null; }
+    public ParallelNode(int p0, BodyNode p1){}
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/PositionalArgumentNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/PositionalArgumentNode.java
new file mode 100644
index 00000000000..3947096868a
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/PositionalArgumentNode.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.PositionalArgumentNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.Node;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+
+public class PositionalArgumentNode implements Node
+{
+    protected PositionalArgumentNode() {}
+    public Expression<? extends Object> getValueExpression(){ return null; }
+    public PositionalArgumentNode(Expression<? extends Object> p0){}
+    public String toString(){ return null; }
+    public void accept(NodeVisitor p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/PrintNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/PrintNode.java
new file mode 100644
index 00000000000..3166821471c
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/PrintNode.java
@@ -0,0 +1,20 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.PrintNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class PrintNode extends AbstractRenderableNode
+{
+    protected PrintNode() {}
+    public Expression<? extends Object> getExpression(){ return null; }
+    public PrintNode(Expression<? extends Object> p0, int p1){}
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+    public void setExpression(Expression<? extends Object> p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/RenderableNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/RenderableNode.java
new file mode 100644
index 00000000000..09f2baee292
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/RenderableNode.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.RenderableNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.node.Node;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public interface RenderableNode extends Node
+{
+    void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/RootNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/RootNode.java
new file mode 100644
index 00000000000..74bf4dfdcda
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/RootNode.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.RootNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.BodyNode;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class RootNode extends AbstractRenderableNode
+{
+    protected RootNode() {}
+    public BodyNode getBody(){ return null; }
+    public RootNode(BodyNode p0){}
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/SetNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/SetNode.java
new file mode 100644
index 00000000000..7ff8bd1353f
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/SetNode.java
@@ -0,0 +1,20 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.SetNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class SetNode extends AbstractRenderableNode
+{
+    protected SetNode() {}
+    public Expression<? extends Object> getValue(){ return null; }
+    public SetNode(int p0, String p1, Expression<? extends Object> p2){}
+    public String getName(){ return null; }
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/TextNode.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/TextNode.java
new file mode 100644
index 00000000000..ef8470cf6ad
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/TextNode.java
@@ -0,0 +1,18 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.TextNode for testing purposes
+
+package com.mitchellbosecke.pebble.node;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.AbstractRenderableNode;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public class TextNode extends AbstractRenderableNode
+{
+    protected TextNode() {}
+    public TextNode(String p0, int p1){}
+    public char[] getData(){ return null; }
+    public void accept(NodeVisitor p0){}
+    public void render(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/BinaryExpression.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/BinaryExpression.java
new file mode 100644
index 00000000000..44388aa3c85
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/BinaryExpression.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.expression.BinaryExpression for testing purposes
+
+package com.mitchellbosecke.pebble.node.expression;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+
+abstract public class BinaryExpression<T> implements Expression<T>
+{
+    public BinaryExpression(){}
+    public BinaryExpression(Expression<? extends Object> p0, Expression<? extends Object> p1){}
+    public Expression<? extends Object> getLeftExpression(){ return null; }
+    public Expression<? extends Object> getRightExpression(){ return null; }
+    public int getLineNumber(){ return 0; }
+    public void accept(NodeVisitor p0){}
+    public void setLeft(Expression<? extends Object> p0){}
+    public void setLineNumber(int p0){}
+    public void setRight(Expression<? extends Object> p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/Expression.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/Expression.java
new file mode 100644
index 00000000000..478243e481d
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/Expression.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.expression.Expression for testing purposes
+
+package com.mitchellbosecke.pebble.node.expression;
+
+import com.mitchellbosecke.pebble.node.Node;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+
+public interface Expression<T> extends Node
+{
+    T evaluate(PebbleTemplateImpl p0, EvaluationContextImpl p1);
+    int getLineNumber();
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/FilterInvocationExpression.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/FilterInvocationExpression.java
new file mode 100644
index 00000000000..7381b09c26a
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/FilterInvocationExpression.java
@@ -0,0 +1,20 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.expression.FilterInvocationExpression for testing purposes
+
+package com.mitchellbosecke.pebble.node.expression;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.ArgumentsNode;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+
+public class FilterInvocationExpression implements Expression<Object>
+{
+    protected FilterInvocationExpression() {}
+    public ArgumentsNode getArgs(){ return null; }
+    public FilterInvocationExpression(String p0, ArgumentsNode p1, int p2){}
+    public Object evaluate(PebbleTemplateImpl p0, EvaluationContextImpl p1){ return null; }
+    public String getFilterName(){ return null; }
+    public int getLineNumber(){ return 0; }
+    public void accept(NodeVisitor p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/MapExpression.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/MapExpression.java
new file mode 100644
index 00000000000..835bf4dc0eb
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/MapExpression.java
@@ -0,0 +1,19 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.expression.MapExpression for testing purposes
+
+package com.mitchellbosecke.pebble.node.expression;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.util.Map;
+
+public class MapExpression implements Expression<Map<? extends Object, ? extends Object>>
+{
+    protected MapExpression() {}
+    public Map<? extends Object, ? extends Object> evaluate(PebbleTemplateImpl p0, EvaluationContextImpl p1){ return null; }
+    public MapExpression(Map<Expression<? extends Object>, Expression<? extends Object>> p0, int p1){}
+    public MapExpression(int p0){}
+    public int getLineNumber(){ return 0; }
+    public void accept(NodeVisitor p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/UnaryExpression.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/UnaryExpression.java
new file mode 100644
index 00000000000..b9e35df55fa
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/node/expression/UnaryExpression.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.mitchellbosecke.pebble.node.expression.UnaryExpression for testing purposes
+
+package com.mitchellbosecke.pebble.node.expression;
+
+import com.mitchellbosecke.pebble.extension.NodeVisitor;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+
+abstract public class UnaryExpression implements Expression<Object>
+{
+    public Expression<? extends Object> getChildExpression(){ return null; }
+    public UnaryExpression(){}
+    public int getLineNumber(){ return 0; }
+    public void accept(NodeVisitor p0){}
+    public void setChildExpression(Expression<? extends Object> p0){}
+    public void setLineNumber(int p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/Associativity.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/Associativity.java
new file mode 100644
index 00000000000..37da265b2e2
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/Associativity.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.mitchellbosecke.pebble.operator.Associativity for testing purposes
+
+package com.mitchellbosecke.pebble.operator;
+
+
+public enum Associativity
+{
+    LEFT, RIGHT;
+    private Associativity() {}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/BinaryOperator.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/BinaryOperator.java
new file mode 100644
index 00000000000..54ca71cd85a
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/BinaryOperator.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.mitchellbosecke.pebble.operator.BinaryOperator for testing purposes
+
+package com.mitchellbosecke.pebble.operator;
+
+import com.mitchellbosecke.pebble.node.expression.BinaryExpression;
+import com.mitchellbosecke.pebble.operator.Associativity;
+import com.mitchellbosecke.pebble.operator.BinaryOperatorType;
+
+public interface BinaryOperator
+{
+    Associativity getAssociativity();
+    BinaryExpression<? extends Object> getInstance();
+    BinaryOperatorType getType();
+    String getSymbol();
+    int getPrecedence();
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/BinaryOperatorType.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/BinaryOperatorType.java
new file mode 100644
index 00000000000..c639ac2134c
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/BinaryOperatorType.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.mitchellbosecke.pebble.operator.BinaryOperatorType for testing purposes
+
+package com.mitchellbosecke.pebble.operator;
+
+
+public enum BinaryOperatorType
+{
+    FILTER, NORMAL, TEST;
+    private BinaryOperatorType() {}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/UnaryOperator.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/UnaryOperator.java
new file mode 100644
index 00000000000..6cf0e80cd1e
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/operator/UnaryOperator.java
@@ -0,0 +1,12 @@
+// Generated automatically from com.mitchellbosecke.pebble.operator.UnaryOperator for testing purposes
+
+package com.mitchellbosecke.pebble.operator;
+
+import com.mitchellbosecke.pebble.node.expression.UnaryExpression;
+
+public interface UnaryOperator
+{
+    Class<? extends UnaryExpression> getNodeClass();
+    String getSymbol();
+    int getPrecedence();
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/ExpressionParser.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/ExpressionParser.java
new file mode 100644
index 00000000000..2f0028f9631
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/ExpressionParser.java
@@ -0,0 +1,22 @@
+// Generated automatically from com.mitchellbosecke.pebble.parser.ExpressionParser for testing purposes
+
+package com.mitchellbosecke.pebble.parser;
+
+import com.mitchellbosecke.pebble.node.ArgumentsNode;
+import com.mitchellbosecke.pebble.node.expression.Expression;
+import com.mitchellbosecke.pebble.node.expression.FilterInvocationExpression;
+import com.mitchellbosecke.pebble.operator.BinaryOperator;
+import com.mitchellbosecke.pebble.operator.UnaryOperator;
+import com.mitchellbosecke.pebble.parser.Parser;
+import com.mitchellbosecke.pebble.parser.ParserOptions;
+import java.util.Map;
+
+public class ExpressionParser
+{
+    protected ExpressionParser() {}
+    public ArgumentsNode parseArguments(boolean p0){ return null; }
+    public Expression<? extends Object> parseExpression(){ return null; }
+    public ExpressionParser(Parser p0, Map<String, BinaryOperator> p1, Map<String, UnaryOperator> p2, ParserOptions p3){}
+    public FilterInvocationExpression parseFilterInvocationExpression(){ return null; }
+    public String parseNewVariableName(){ return null; }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/Parser.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/Parser.java
new file mode 100644
index 00000000000..bde8406d45c
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/Parser.java
@@ -0,0 +1,21 @@
+// Generated automatically from com.mitchellbosecke.pebble.parser.Parser for testing purposes
+
+package com.mitchellbosecke.pebble.parser;
+
+import com.mitchellbosecke.pebble.lexer.TokenStream;
+import com.mitchellbosecke.pebble.node.BodyNode;
+import com.mitchellbosecke.pebble.node.RootNode;
+import com.mitchellbosecke.pebble.parser.ExpressionParser;
+import com.mitchellbosecke.pebble.parser.StoppingCondition;
+
+public interface Parser
+{
+    BodyNode subparse();
+    BodyNode subparse(StoppingCondition p0);
+    ExpressionParser getExpressionParser();
+    RootNode parse(TokenStream p0);
+    String peekBlockStack();
+    String popBlockStack();
+    TokenStream getStream();
+    void pushBlockStack(String p0);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/ParserOptions.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/ParserOptions.java
new file mode 100644
index 00000000000..02daef21413
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/ParserOptions.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.parser.ParserOptions for testing purposes
+
+package com.mitchellbosecke.pebble.parser;
+
+
+public class ParserOptions
+{
+    public ParserOptions setLiteralDecimalTreatedAsInteger(boolean p0){ return null; }
+    public ParserOptions setLiteralNumbersAsBigDecimals(boolean p0){ return null; }
+    public ParserOptions(){}
+    public boolean isLiteralDecimalTreatedAsInteger(){ return false; }
+    public boolean isLiteralNumbersAsBigDecimals(){ return false; }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/StoppingCondition.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/StoppingCondition.java
new file mode 100644
index 00000000000..af302d53be9
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/parser/StoppingCondition.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.mitchellbosecke.pebble.parser.StoppingCondition for testing purposes
+
+package com.mitchellbosecke.pebble.parser;
+
+import com.mitchellbosecke.pebble.lexer.Token;
+
+public interface StoppingCondition
+{
+    boolean evaluate(Token p0);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Block.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Block.java
new file mode 100644
index 00000000000..153a1283f5a
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Block.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.Block for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.io.Writer;
+
+public interface Block
+{
+    String getName();
+    void evaluate(PebbleTemplateImpl p0, Writer p1, EvaluationContextImpl p2);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/EvaluationContext.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/EvaluationContext.java
new file mode 100644
index 00000000000..10d81057381
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/EvaluationContext.java
@@ -0,0 +1,12 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.EvaluationContext for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+import java.util.Locale;
+
+public interface EvaluationContext
+{
+    Locale getLocale();
+    Object getVariable(String p0);
+    boolean isStrictVariables();
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/EvaluationContextImpl.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/EvaluationContextImpl.java
new file mode 100644
index 00000000000..692ca8c3944
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/EvaluationContextImpl.java
@@ -0,0 +1,41 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.EvaluationContextImpl for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+import com.mitchellbosecke.pebble.cache.CacheKey;
+import com.mitchellbosecke.pebble.cache.PebbleCache;
+import com.mitchellbosecke.pebble.extension.ExtensionRegistry;
+import com.mitchellbosecke.pebble.template.EvaluationContext;
+import com.mitchellbosecke.pebble.template.EvaluationOptions;
+import com.mitchellbosecke.pebble.template.Hierarchy;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import com.mitchellbosecke.pebble.template.RenderedSizeContext;
+import com.mitchellbosecke.pebble.template.ScopeChain;
+import com.mitchellbosecke.pebble.utils.Callbacks;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.concurrent.ExecutorService;
+
+public class EvaluationContextImpl implements EvaluationContext, RenderedSizeContext
+{
+    protected EvaluationContextImpl() {}
+    public EvaluationContextImpl shallowCopyWithoutInheritanceChain(PebbleTemplateImpl p0){ return null; }
+    public EvaluationContextImpl threadSafeCopy(PebbleTemplateImpl p0){ return null; }
+    public EvaluationContextImpl(PebbleTemplateImpl p0, boolean p1, Locale p2, int p3, ExtensionRegistry p4, PebbleCache<CacheKey, Object> p5, ExecutorService p6, List<PebbleTemplateImpl> p7, Map<String, PebbleTemplateImpl> p8, ScopeChain p9, Hierarchy p10, EvaluationOptions p11){}
+    public EvaluationOptions getEvaluationOptions(){ return null; }
+    public ExecutorService getExecutorService(){ return null; }
+    public ExtensionRegistry getExtensionRegistry(){ return null; }
+    public Hierarchy getHierarchy(){ return null; }
+    public List<PebbleTemplateImpl> getImportedTemplates(){ return null; }
+    public Locale getLocale(){ return null; }
+    public Object getVariable(String p0){ return null; }
+    public PebbleCache<CacheKey, Object> getTagCache(){ return null; }
+    public PebbleTemplateImpl getNamedImportedTemplate(String p0){ return null; }
+    public ScopeChain getScopeChain(){ return null; }
+    public boolean isStrictVariables(){ return false; }
+    public int addAndGet(int p0){ return 0; }
+    public int getMaxRenderedSize(){ return 0; }
+    public void addNamedImportedTemplates(String p0, PebbleTemplateImpl p1){}
+    public void scopedShallowWithoutInheritanceChain(PebbleTemplateImpl p0, Map<? extends Object, ? extends Object> p1, Callbacks.PebbleConsumer<EvaluationContextImpl> p2){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/EvaluationOptions.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/EvaluationOptions.java
new file mode 100644
index 00000000000..aedd552efe8
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/EvaluationOptions.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.EvaluationOptions for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+import com.mitchellbosecke.pebble.attributes.methodaccess.MethodAccessValidator;
+
+public class EvaluationOptions
+{
+    protected EvaluationOptions() {}
+    public EvaluationOptions(boolean p0, MethodAccessValidator p1){}
+    public MethodAccessValidator getMethodAccessValidator(){ return null; }
+    public boolean isGreedyMatchMethod(){ return false; }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Hierarchy.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Hierarchy.java
new file mode 100644
index 00000000000..c87c3d5856a
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Hierarchy.java
@@ -0,0 +1,16 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.Hierarchy for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+
+public class Hierarchy
+{
+    protected Hierarchy() {}
+    public Hierarchy(PebbleTemplateImpl p0){}
+    public PebbleTemplateImpl getChild(){ return null; }
+    public PebbleTemplateImpl getParent(){ return null; }
+    public void ascend(){}
+    public void descend(){}
+    public void pushAncestor(PebbleTemplateImpl p0){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Macro.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Macro.java
new file mode 100644
index 00000000000..f6f868ed57c
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Macro.java
@@ -0,0 +1,14 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.Macro for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+import com.mitchellbosecke.pebble.extension.NamedArguments;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.PebbleTemplateImpl;
+import java.util.Map;
+
+public interface Macro extends NamedArguments
+{
+    String call(PebbleTemplateImpl p0, EvaluationContextImpl p1, Map<String, Object> p2);
+    String getName();
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/PebbleTemplate.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/PebbleTemplate.java
new file mode 100644
index 00000000000..ad643446db2
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/PebbleTemplate.java
@@ -0,0 +1,20 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.PebbleTemplate for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+import java.io.Writer;
+import java.util.Locale;
+import java.util.Map;
+
+public interface PebbleTemplate
+{
+    String getName();
+    void evaluate(Writer p0);
+    void evaluate(Writer p0, Locale p1);
+    void evaluate(Writer p0, Map<String, Object> p1);
+    void evaluate(Writer p0, Map<String, Object> p1, Locale p2);
+    void evaluateBlock(String p0, Writer p1);
+    void evaluateBlock(String p0, Writer p1, Locale p2);
+    void evaluateBlock(String p0, Writer p1, Map<String, Object> p2);
+    void evaluateBlock(String p0, Writer p1, Map<String, Object> p2, Locale p3);
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/PebbleTemplateImpl.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/PebbleTemplateImpl.java
new file mode 100644
index 00000000000..facde872587
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/PebbleTemplateImpl.java
@@ -0,0 +1,48 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.PebbleTemplateImpl for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+import com.mitchellbosecke.pebble.PebbleEngine;
+import com.mitchellbosecke.pebble.extension.escaper.SafeString;
+import com.mitchellbosecke.pebble.node.ArgumentsNode;
+import com.mitchellbosecke.pebble.node.BlockNode;
+import com.mitchellbosecke.pebble.node.RenderableNode;
+import com.mitchellbosecke.pebble.template.Block;
+import com.mitchellbosecke.pebble.template.EvaluationContextImpl;
+import com.mitchellbosecke.pebble.template.Macro;
+import com.mitchellbosecke.pebble.template.PebbleTemplate;
+import com.mitchellbosecke.pebble.utils.Pair;
+import java.io.Writer;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+
+public class PebbleTemplateImpl implements PebbleTemplate
+{
+    protected PebbleTemplateImpl() {}
+    public PebbleTemplateImpl getNamedImportedTemplate(EvaluationContextImpl p0, String p1){ return null; }
+    public PebbleTemplateImpl(PebbleEngine p0, RenderableNode p1, String p2){}
+    public SafeString macro(EvaluationContextImpl p0, String p1, ArgumentsNode p2, boolean p3, int p4){ return null; }
+    public String getName(){ return null; }
+    public String resolveRelativePath(String p0){ return null; }
+    public boolean hasBlock(String p0){ return false; }
+    public boolean hasMacro(String p0){ return false; }
+    public void block(Writer p0, EvaluationContextImpl p1, String p2, boolean p3){}
+    public void embedTemplate(int p0, Writer p1, EvaluationContextImpl p2, String p3, Map<? extends Object, ? extends Object> p4, List<BlockNode> p5){}
+    public void evaluate(Writer p0){}
+    public void evaluate(Writer p0, Locale p1){}
+    public void evaluate(Writer p0, Map<String, Object> p1){}
+    public void evaluate(Writer p0, Map<String, Object> p1, Locale p2){}
+    public void evaluateBlock(String p0, Writer p1){}
+    public void evaluateBlock(String p0, Writer p1, Locale p2){}
+    public void evaluateBlock(String p0, Writer p1, Map<String, Object> p2){}
+    public void evaluateBlock(String p0, Writer p1, Map<String, Object> p2, Locale p3){}
+    public void importNamedMacrosFromTemplate(String p0, List<Pair<String, String>> p1){}
+    public void importNamedTemplate(EvaluationContextImpl p0, String p1, String p2){}
+    public void importTemplate(EvaluationContextImpl p0, String p1){}
+    public void includeTemplate(Writer p0, EvaluationContextImpl p1, String p2, Map<? extends Object, ? extends Object> p3){}
+    public void registerBlock(Block p0){}
+    public void registerMacro(Macro p0){}
+    public void registerMacro(String p0, Macro p1){}
+    public void setParent(EvaluationContextImpl p0, String p1){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/RenderedSizeContext.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/RenderedSizeContext.java
new file mode 100644
index 00000000000..00006b3cdc5
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/RenderedSizeContext.java
@@ -0,0 +1,10 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.RenderedSizeContext for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+
+public interface RenderedSizeContext
+{
+    int addAndGet(int p0);
+    int getMaxRenderedSize();
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Scope.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Scope.java
new file mode 100644
index 00000000000..41b3f847bd1
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/Scope.java
@@ -0,0 +1,18 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.Scope for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+import java.util.Map;
+import java.util.Set;
+
+public class Scope
+{
+    protected Scope() {}
+    public Object get(String p0){ return null; }
+    public Scope shallowCopy(){ return null; }
+    public Scope(Map<String, Object> p0, boolean p1){}
+    public Set<String> getKeys(){ return null; }
+    public boolean containsKey(String p0){ return false; }
+    public boolean isLocal(){ return false; }
+    public void put(String p0, Object p1){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/ScopeChain.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/ScopeChain.java
new file mode 100644
index 00000000000..4576738e78f
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/template/ScopeChain.java
@@ -0,0 +1,23 @@
+// Generated automatically from com.mitchellbosecke.pebble.template.ScopeChain for testing purposes
+
+package com.mitchellbosecke.pebble.template;
+
+import com.mitchellbosecke.pebble.template.Scope;
+import java.util.List;
+import java.util.Map;
+
+public class ScopeChain
+{
+    public List<Scope> getGlobalScopes(){ return null; }
+    public Object get(String p0){ return null; }
+    public ScopeChain deepCopy(){ return null; }
+    public ScopeChain(){}
+    public boolean containsKey(String p0){ return false; }
+    public boolean currentScopeContainsVariable(String p0){ return false; }
+    public void popScope(){}
+    public void pushLocalScope(){}
+    public void pushScope(){}
+    public void pushScope(Map<String, Object> p0){}
+    public void put(String p0, Object p1){}
+    public void set(String p0, Object p1){}
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/tokenParser/TokenParser.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/tokenParser/TokenParser.java
new file mode 100644
index 00000000000..125b1ae2f54
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/tokenParser/TokenParser.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.tokenParser.TokenParser for testing purposes
+
+package com.mitchellbosecke.pebble.tokenParser;
+
+import com.mitchellbosecke.pebble.lexer.Token;
+import com.mitchellbosecke.pebble.node.RenderableNode;
+import com.mitchellbosecke.pebble.parser.Parser;
+
+public interface TokenParser
+{
+    RenderableNode parse(Token p0, Parser p1);
+    String getTag();
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/utils/Callbacks.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/utils/Callbacks.java
new file mode 100644
index 00000000000..c2c177e4ee5
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/utils/Callbacks.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.utils.Callbacks for testing purposes
+
+package com.mitchellbosecke.pebble.utils;
+
+
+public class Callbacks
+{
+    public Callbacks(){}
+    static public interface PebbleConsumer<T>
+    {
+        void accept(T p0);
+    }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/utils/Pair.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/utils/Pair.java
new file mode 100644
index 00000000000..1226fa2f2bd
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/mitchellbosecke/pebble/utils/Pair.java
@@ -0,0 +1,13 @@
+// Generated automatically from com.mitchellbosecke.pebble.utils.Pair for testing purposes
+
+package com.mitchellbosecke.pebble.utils;
+
+
+public class Pair<L, R>
+{
+    protected Pair() {}
+    public L getLeft(){ return null; }
+    public Pair(L p0, R p1){}
+    public R getRight(){ return null; }
+    public String toString(){ return null; }
+}
diff --git a/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/template/PebbleTemplate.java b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/template/PebbleTemplate.java
new file mode 100644
index 00000000000..3f7ff70aec9
--- /dev/null
+++ b/java/ql/test/stubs/pebble-3.1.5/com/mitchellbosecke/pebble/template/PebbleTemplate.java
@@ -0,0 +1,3 @@
+package com.mitchellbosecke.pebble.template;
+
+public interface PebbleTemplate {}
\ No newline at end of file
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/DialectConfiguration.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/DialectConfiguration.java
new file mode 100644
index 00000000000..21c34e8cffd
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/DialectConfiguration.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.thymeleaf.DialectConfiguration for testing purposes
+
+package org.thymeleaf;
+
+import org.thymeleaf.dialect.IDialect;
+
+public class DialectConfiguration
+{
+    protected DialectConfiguration() {}
+    public DialectConfiguration(IDialect p0){}
+    public DialectConfiguration(String p0, IDialect p1){}
+    public IDialect getDialect(){ return null; }
+    public String getPrefix(){ return null; }
+    public boolean isPrefixSpecified(){ return false; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/IEngineConfiguration.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/IEngineConfiguration.java
new file mode 100644
index 00000000000..e8cfa7a03e1
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/IEngineConfiguration.java
@@ -0,0 +1,60 @@
+// Generated automatically from org.thymeleaf.IEngineConfiguration for testing purposes
+
+package org.thymeleaf;
+
+import java.util.Map;
+import java.util.Set;
+import org.thymeleaf.DialectConfiguration;
+import org.thymeleaf.cache.ICacheManager;
+import org.thymeleaf.context.IEngineContextFactory;
+import org.thymeleaf.dialect.IDialect;
+import org.thymeleaf.engine.AttributeDefinitions;
+import org.thymeleaf.engine.ElementDefinitions;
+import org.thymeleaf.engine.TemplateManager;
+import org.thymeleaf.expression.IExpressionObjectFactory;
+import org.thymeleaf.linkbuilder.ILinkBuilder;
+import org.thymeleaf.messageresolver.IMessageResolver;
+import org.thymeleaf.model.IModelFactory;
+import org.thymeleaf.postprocessor.IPostProcessor;
+import org.thymeleaf.preprocessor.IPreProcessor;
+import org.thymeleaf.processor.cdatasection.ICDATASectionProcessor;
+import org.thymeleaf.processor.comment.ICommentProcessor;
+import org.thymeleaf.processor.doctype.IDocTypeProcessor;
+import org.thymeleaf.processor.element.IElementProcessor;
+import org.thymeleaf.processor.processinginstruction.IProcessingInstructionProcessor;
+import org.thymeleaf.processor.templateboundaries.ITemplateBoundariesProcessor;
+import org.thymeleaf.processor.text.ITextProcessor;
+import org.thymeleaf.processor.xmldeclaration.IXMLDeclarationProcessor;
+import org.thymeleaf.templatemode.TemplateMode;
+import org.thymeleaf.templateparser.markup.decoupled.IDecoupledTemplateLogicResolver;
+import org.thymeleaf.templateresolver.ITemplateResolver;
+
+public interface IEngineConfiguration
+{
+    AttributeDefinitions getAttributeDefinitions();
+    ElementDefinitions getElementDefinitions();
+    ICacheManager getCacheManager();
+    IDecoupledTemplateLogicResolver getDecoupledTemplateLogicResolver();
+    IEngineContextFactory getEngineContextFactory();
+    IExpressionObjectFactory getExpressionObjectFactory();
+    IModelFactory getModelFactory(TemplateMode p0);
+    Map<String, Object> getExecutionAttributes();
+    Set<DialectConfiguration> getDialectConfigurations();
+    Set<ICDATASectionProcessor> getCDATASectionProcessors(TemplateMode p0);
+    Set<ICommentProcessor> getCommentProcessors(TemplateMode p0);
+    Set<IDialect> getDialects();
+    Set<IDocTypeProcessor> getDocTypeProcessors(TemplateMode p0);
+    Set<IElementProcessor> getElementProcessors(TemplateMode p0);
+    Set<ILinkBuilder> getLinkBuilders();
+    Set<IMessageResolver> getMessageResolvers();
+    Set<IPostProcessor> getPostProcessors(TemplateMode p0);
+    Set<IPreProcessor> getPreProcessors(TemplateMode p0);
+    Set<IProcessingInstructionProcessor> getProcessingInstructionProcessors(TemplateMode p0);
+    Set<ITemplateBoundariesProcessor> getTemplateBoundariesProcessors(TemplateMode p0);
+    Set<ITemplateResolver> getTemplateResolvers();
+    Set<ITextProcessor> getTextProcessors(TemplateMode p0);
+    Set<IXMLDeclarationProcessor> getXMLDeclarationProcessors(TemplateMode p0);
+    String getStandardDialectPrefix();
+    TemplateManager getTemplateManager();
+    boolean isStandardDialectPresent();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/ITemplateEngine.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/ITemplateEngine.java
new file mode 100644
index 00000000000..b0cec7fb139
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/ITemplateEngine.java
@@ -0,0 +1,24 @@
+// Generated automatically from org.thymeleaf.ITemplateEngine for testing purposes
+
+package org.thymeleaf;
+
+import java.io.Writer;
+import java.util.Set;
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.IThrottledTemplateProcessor;
+import org.thymeleaf.TemplateSpec;
+import org.thymeleaf.context.IContext;
+
+public interface ITemplateEngine
+{
+    IEngineConfiguration getConfiguration();
+    IThrottledTemplateProcessor processThrottled(String p0, IContext p1);
+    IThrottledTemplateProcessor processThrottled(String p0, Set<String> p1, IContext p2);
+    IThrottledTemplateProcessor processThrottled(TemplateSpec p0, IContext p1);
+    String process(String p0, IContext p1);
+    String process(String p0, Set<String> p1, IContext p2);
+    String process(TemplateSpec p0, IContext p1);
+    void process(String p0, IContext p1, Writer p2);
+    void process(String p0, Set<String> p1, IContext p2, Writer p3);
+    void process(TemplateSpec p0, IContext p1, Writer p2);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/IThrottledTemplateProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/IThrottledTemplateProcessor.java
new file mode 100644
index 00000000000..e8cdeefdf18
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/IThrottledTemplateProcessor.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.thymeleaf.IThrottledTemplateProcessor for testing purposes
+
+package org.thymeleaf;
+
+import java.io.OutputStream;
+import java.io.Writer;
+import java.nio.charset.Charset;
+import org.thymeleaf.TemplateSpec;
+
+public interface IThrottledTemplateProcessor
+{
+    String getProcessorIdentifier();
+    TemplateSpec getTemplateSpec();
+    boolean isFinished();
+    int process(int p0, OutputStream p1, Charset p2);
+    int process(int p0, Writer p1);
+    int processAll(OutputStream p0, Charset p1);
+    int processAll(Writer p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/TemplateEngine.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/TemplateEngine.java
new file mode 100644
index 00000000000..deaaf159e19
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/TemplateEngine.java
@@ -0,0 +1,67 @@
+// Generated automatically from org.thymeleaf.TemplateEngine for testing purposes
+
+package org.thymeleaf;
+
+import java.io.Writer;
+import java.util.Map;
+import java.util.Set;
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.ITemplateEngine;
+import org.thymeleaf.IThrottledTemplateProcessor;
+import org.thymeleaf.TemplateSpec;
+import org.thymeleaf.cache.ICacheManager;
+import org.thymeleaf.context.IContext;
+import org.thymeleaf.context.IEngineContextFactory;
+import org.thymeleaf.dialect.IDialect;
+import org.thymeleaf.linkbuilder.ILinkBuilder;
+import org.thymeleaf.messageresolver.IMessageResolver;
+import org.thymeleaf.templateparser.markup.decoupled.IDecoupledTemplateLogicResolver;
+import org.thymeleaf.templateresolver.ITemplateResolver;
+
+public class TemplateEngine implements ITemplateEngine
+{
+    protected void initializeSpecific(){}
+    public IEngineConfiguration getConfiguration(){ return null; }
+    public TemplateEngine(){}
+    public final ICacheManager getCacheManager(){ return null; }
+    public final IDecoupledTemplateLogicResolver getDecoupledTemplateLogicResolver(){ return null; }
+    public final IEngineContextFactory getEngineContextFactory(){ return null; }
+    public final IThrottledTemplateProcessor processThrottled(String p0, IContext p1){ return null; }
+    public final IThrottledTemplateProcessor processThrottled(String p0, Set<String> p1, IContext p2){ return null; }
+    public final IThrottledTemplateProcessor processThrottled(TemplateSpec p0, IContext p1){ return null; }
+    public final Map<String, Set<IDialect>> getDialectsByPrefix(){ return null; }
+    public final Set<IDialect> getDialects(){ return null; }
+    public final Set<ILinkBuilder> getLinkBuilders(){ return null; }
+    public final Set<IMessageResolver> getMessageResolvers(){ return null; }
+    public final Set<ITemplateResolver> getTemplateResolvers(){ return null; }
+    public final String process(String p0, IContext p1){ return null; }
+    public final String process(String p0, Set<String> p1, IContext p2){ return null; }
+    public final String process(TemplateSpec p0, IContext p1){ return null; }
+    public final boolean isInitialized(){ return false; }
+    public final void process(String p0, IContext p1, Writer p2){}
+    public final void process(String p0, Set<String> p1, IContext p2, Writer p3){}
+    public final void process(TemplateSpec p0, IContext p1, Writer p2){}
+    public static String TIMER_LOGGER_NAME = null;
+    public static String threadIndex(){ return null; }
+    public void addDialect(IDialect p0){}
+    public void addDialect(String p0, IDialect p1){}
+    public void addLinkBuilder(ILinkBuilder p0){}
+    public void addMessageResolver(IMessageResolver p0){}
+    public void addTemplateResolver(ITemplateResolver p0){}
+    public void clearDialects(){}
+    public void clearTemplateCache(){}
+    public void clearTemplateCacheFor(String p0){}
+    public void setAdditionalDialects(Set<IDialect> p0){}
+    public void setCacheManager(ICacheManager p0){}
+    public void setDecoupledTemplateLogicResolver(IDecoupledTemplateLogicResolver p0){}
+    public void setDialect(IDialect p0){}
+    public void setDialects(Set<IDialect> p0){}
+    public void setDialectsByPrefix(Map<String, IDialect> p0){}
+    public void setEngineContextFactory(IEngineContextFactory p0){}
+    public void setLinkBuilder(ILinkBuilder p0){}
+    public void setLinkBuilders(Set<ILinkBuilder> p0){}
+    public void setMessageResolver(IMessageResolver p0){}
+    public void setMessageResolvers(Set<IMessageResolver> p0){}
+    public void setTemplateResolver(ITemplateResolver p0){}
+    public void setTemplateResolvers(Set<ITemplateResolver> p0){}
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/TemplateSpec.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/TemplateSpec.java
new file mode 100644
index 00000000000..d06d8bd4300
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/TemplateSpec.java
@@ -0,0 +1,30 @@
+// Generated automatically from org.thymeleaf.TemplateSpec for testing purposes
+
+package org.thymeleaf;
+
+import java.io.Serializable;
+import java.util.Map;
+import java.util.Set;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public class TemplateSpec implements Serializable
+{
+    protected TemplateSpec() {}
+    public Map<String, Object> getTemplateResolutionAttributes(){ return null; }
+    public Set<String> getTemplateSelectors(){ return null; }
+    public String getOutputContentType(){ return null; }
+    public String getTemplate(){ return null; }
+    public String toString(){ return null; }
+    public TemplateMode getTemplateMode(){ return null; }
+    public TemplateSpec(String p0, Map<String, Object> p1){}
+    public TemplateSpec(String p0, Set<String> p1, String p2, Map<String, Object> p3){}
+    public TemplateSpec(String p0, Set<String> p1, TemplateMode p2, Map<String, Object> p3){}
+    public TemplateSpec(String p0, String p1){}
+    public TemplateSpec(String p0, TemplateMode p1){}
+    public boolean equals(Object p0){ return false; }
+    public boolean hasTemplateMode(){ return false; }
+    public boolean hasTemplateResolutionAttributes(){ return false; }
+    public boolean hasTemplateSelectors(){ return false; }
+    public boolean isOutputSSE(){ return false; }
+    public int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ExpressionCacheKey.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ExpressionCacheKey.java
new file mode 100644
index 00000000000..528c58cff3a
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ExpressionCacheKey.java
@@ -0,0 +1,18 @@
+// Generated automatically from org.thymeleaf.cache.ExpressionCacheKey for testing purposes
+
+package org.thymeleaf.cache;
+
+import java.io.Serializable;
+
+public class ExpressionCacheKey implements Serializable
+{
+    protected ExpressionCacheKey() {}
+    public ExpressionCacheKey(String p0, String p1){}
+    public ExpressionCacheKey(String p0, String p1, String p2){}
+    public String getExpression0(){ return null; }
+    public String getExpression1(){ return null; }
+    public String getType(){ return null; }
+    public String toString(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICache.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICache.java
new file mode 100644
index 00000000000..92b3f1d05d4
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICache.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.thymeleaf.cache.ICache for testing purposes
+
+package org.thymeleaf.cache;
+
+import java.util.Set;
+import org.thymeleaf.cache.ICacheEntryValidityChecker;
+
+public interface ICache<K, V>
+{
+    Set<K> keySet();
+    V get(K p0);
+    V get(K p0, ICacheEntryValidityChecker<? super K, ? super V> p1);
+    void clear();
+    void clearKey(K p0);
+    void put(K p0, V p1);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICacheEntryValidity.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICacheEntryValidity.java
new file mode 100644
index 00000000000..a5b4c76391d
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICacheEntryValidity.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.thymeleaf.cache.ICacheEntryValidity for testing purposes
+
+package org.thymeleaf.cache;
+
+
+public interface ICacheEntryValidity
+{
+    boolean isCacheStillValid();
+    boolean isCacheable();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICacheEntryValidityChecker.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICacheEntryValidityChecker.java
new file mode 100644
index 00000000000..1a8f1bf3c92
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICacheEntryValidityChecker.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.thymeleaf.cache.ICacheEntryValidityChecker for testing purposes
+
+package org.thymeleaf.cache;
+
+import java.io.Serializable;
+
+public interface ICacheEntryValidityChecker<K, V> extends Serializable
+{
+    boolean checkIsValueStillValid(K p0, V p1, long p2);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICacheManager.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICacheManager.java
new file mode 100644
index 00000000000..48358f1d070
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/ICacheManager.java
@@ -0,0 +1,18 @@
+// Generated automatically from org.thymeleaf.cache.ICacheManager for testing purposes
+
+package org.thymeleaf.cache;
+
+import java.util.List;
+import org.thymeleaf.cache.ExpressionCacheKey;
+import org.thymeleaf.cache.ICache;
+import org.thymeleaf.cache.TemplateCacheKey;
+import org.thymeleaf.engine.TemplateModel;
+
+public interface ICacheManager
+{
+    <K, V> ICache<K, V> getSpecificCache(String p0);
+    ICache<ExpressionCacheKey, Object> getExpressionCache();
+    ICache<TemplateCacheKey, TemplateModel> getTemplateCache();
+    List<String> getAllSpecificCacheNames();
+    void clearAllCaches();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/TemplateCacheKey.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/TemplateCacheKey.java
new file mode 100644
index 00000000000..e05adee3b1a
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/cache/TemplateCacheKey.java
@@ -0,0 +1,24 @@
+// Generated automatically from org.thymeleaf.cache.TemplateCacheKey for testing purposes
+
+package org.thymeleaf.cache;
+
+import java.io.Serializable;
+import java.util.Map;
+import java.util.Set;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public class TemplateCacheKey implements Serializable
+{
+    protected TemplateCacheKey() {}
+    public Map<String, Object> getTemplateResolutionAttributes(){ return null; }
+    public Set<String> getTemplateSelectors(){ return null; }
+    public String getOwnerTemplate(){ return null; }
+    public String getTemplate(){ return null; }
+    public String toString(){ return null; }
+    public TemplateCacheKey(String p0, String p1, Set<String> p2, int p3, int p4, TemplateMode p5, Map<String, Object> p6){}
+    public TemplateMode getTemplateMode(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public int getColOffset(){ return 0; }
+    public int getLineOffset(){ return 0; }
+    public int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/AbstractContext.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/AbstractContext.java
new file mode 100644
index 00000000000..3d4987a44a2
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/AbstractContext.java
@@ -0,0 +1,24 @@
+// Generated automatically from org.thymeleaf.context.AbstractContext for testing purposes
+
+package org.thymeleaf.context;
+
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import org.thymeleaf.context.IContext;
+
+abstract public class AbstractContext implements IContext
+{
+    protected AbstractContext(){}
+    protected AbstractContext(Locale p0){}
+    protected AbstractContext(Locale p0, Map<String, Object> p1){}
+    public final Locale getLocale(){ return null; }
+    public final Object getVariable(String p0){ return null; }
+    public final Set<String> getVariableNames(){ return null; }
+    public final boolean containsVariable(String p0){ return false; }
+    public void clearVariables(){}
+    public void removeVariable(String p0){}
+    public void setLocale(Locale p0){}
+    public void setVariable(String p0, Object p1){}
+    public void setVariables(Map<String, Object> p0){}
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/Context.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/Context.java
new file mode 100644
index 00000000000..901e86f242c
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/Context.java
@@ -0,0 +1,14 @@
+// Generated automatically from org.thymeleaf.context.Context for testing purposes
+
+package org.thymeleaf.context;
+
+import java.util.Locale;
+import java.util.Map;
+import org.thymeleaf.context.AbstractContext;
+
+public class Context extends AbstractContext
+{
+    public Context(){}
+    public Context(Locale p0){}
+    public Context(Locale p0, Map<String, Object> p1){}
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IContext.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IContext.java
new file mode 100644
index 00000000000..6bce2b7ee46
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IContext.java
@@ -0,0 +1,14 @@
+// Generated automatically from org.thymeleaf.context.IContext for testing purposes
+
+package org.thymeleaf.context;
+
+import java.util.Locale;
+import java.util.Set;
+
+public interface IContext
+{
+    Locale getLocale();
+    Object getVariable(String p0);
+    Set<String> getVariableNames();
+    boolean containsVariable(String p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IEngineContext.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IEngineContext.java
new file mode 100644
index 00000000000..a59c0d6e569
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IEngineContext.java
@@ -0,0 +1,26 @@
+// Generated automatically from org.thymeleaf.context.IEngineContext for testing purposes
+
+package org.thymeleaf.context;
+
+import java.util.List;
+import java.util.Map;
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.engine.TemplateData;
+import org.thymeleaf.inline.IInliner;
+import org.thymeleaf.model.IProcessableElementTag;
+
+public interface IEngineContext extends ITemplateContext
+{
+    List<IProcessableElementTag> getElementStackAbove(int p0);
+    boolean isVariableLocal(String p0);
+    int level();
+    void decreaseLevel();
+    void increaseLevel();
+    void removeVariable(String p0);
+    void setElementTag(IProcessableElementTag p0);
+    void setInliner(IInliner p0);
+    void setSelectionTarget(Object p0);
+    void setTemplateData(TemplateData p0);
+    void setVariable(String p0, Object p1);
+    void setVariables(Map<String, Object> p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IEngineContextFactory.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IEngineContextFactory.java
new file mode 100644
index 00000000000..17b32e837b1
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IEngineContextFactory.java
@@ -0,0 +1,14 @@
+// Generated automatically from org.thymeleaf.context.IEngineContextFactory for testing purposes
+
+package org.thymeleaf.context;
+
+import java.util.Map;
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.context.IContext;
+import org.thymeleaf.context.IEngineContext;
+import org.thymeleaf.engine.TemplateData;
+
+public interface IEngineContextFactory
+{
+    IEngineContext createEngineContext(IEngineConfiguration p0, TemplateData p1, Map<String, Object> p2, IContext p3);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IExpressionContext.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IExpressionContext.java
new file mode 100644
index 00000000000..ade330f7131
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IExpressionContext.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.context.IExpressionContext for testing purposes
+
+package org.thymeleaf.context;
+
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.context.IContext;
+import org.thymeleaf.expression.IExpressionObjects;
+
+public interface IExpressionContext extends IContext
+{
+    IEngineConfiguration getConfiguration();
+    IExpressionObjects getExpressionObjects();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/ITemplateContext.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/ITemplateContext.java
new file mode 100644
index 00000000000..72698ba15af
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/ITemplateContext.java
@@ -0,0 +1,29 @@
+// Generated automatically from org.thymeleaf.context.ITemplateContext for testing purposes
+
+package org.thymeleaf.context;
+
+import java.util.List;
+import java.util.Map;
+import org.thymeleaf.context.IExpressionContext;
+import org.thymeleaf.context.IdentifierSequences;
+import org.thymeleaf.engine.TemplateData;
+import org.thymeleaf.inline.IInliner;
+import org.thymeleaf.model.IModelFactory;
+import org.thymeleaf.model.IProcessableElementTag;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public interface ITemplateContext extends IExpressionContext
+{
+    IInliner getInliner();
+    IModelFactory getModelFactory();
+    IdentifierSequences getIdentifierSequences();
+    List<IProcessableElementTag> getElementStack();
+    List<TemplateData> getTemplateStack();
+    Map<String, Object> getTemplateResolutionAttributes();
+    Object getSelectionTarget();
+    String buildLink(String p0, Map<String, Object> p1);
+    String getMessage(Class<? extends Object> p0, String p1, Object[] p2, boolean p3);
+    TemplateData getTemplateData();
+    TemplateMode getTemplateMode();
+    boolean hasSelectionTarget();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IdentifierSequences.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IdentifierSequences.java
new file mode 100644
index 00000000000..209a533d362
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/context/IdentifierSequences.java
@@ -0,0 +1,12 @@
+// Generated automatically from org.thymeleaf.context.IdentifierSequences for testing purposes
+
+package org.thymeleaf.context;
+
+
+public class IdentifierSequences
+{
+    public IdentifierSequences(){}
+    public Integer getAndIncrementIDSeq(String p0){ return null; }
+    public Integer getNextIDSeq(String p0){ return null; }
+    public Integer getPreviousIDSeq(String p0){ return null; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/dialect/IDialect.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/dialect/IDialect.java
new file mode 100644
index 00000000000..cf37c3a8be4
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/dialect/IDialect.java
@@ -0,0 +1,9 @@
+// Generated automatically from org.thymeleaf.dialect.IDialect for testing purposes
+
+package org.thymeleaf.dialect;
+
+
+public interface IDialect
+{
+    String getName();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/AttributeDefinition.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/AttributeDefinition.java
new file mode 100644
index 00000000000..1b7a9be6c80
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/AttributeDefinition.java
@@ -0,0 +1,18 @@
+// Generated automatically from org.thymeleaf.engine.AttributeDefinition for testing purposes
+
+package org.thymeleaf.engine;
+
+import java.util.Set;
+import org.thymeleaf.engine.AttributeName;
+import org.thymeleaf.processor.element.IElementProcessor;
+
+abstract public class AttributeDefinition
+{
+    protected AttributeDefinition() {}
+    public Set<IElementProcessor> getAssociatedProcessors(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean hasAssociatedProcessors(){ return false; }
+    public final AttributeName getAttributeName(){ return null; }
+    public final String toString(){ return null; }
+    public int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/AttributeDefinitions.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/AttributeDefinitions.java
new file mode 100644
index 00000000000..4329d7df95b
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/AttributeDefinitions.java
@@ -0,0 +1,37 @@
+// Generated automatically from org.thymeleaf.engine.AttributeDefinitions for testing purposes
+
+package org.thymeleaf.engine;
+
+import java.util.Map;
+import java.util.Set;
+import org.thymeleaf.engine.AttributeDefinition;
+import org.thymeleaf.engine.HTMLAttributeDefinition;
+import org.thymeleaf.engine.TextAttributeDefinition;
+import org.thymeleaf.engine.XMLAttributeDefinition;
+import org.thymeleaf.processor.element.IElementProcessor;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public class AttributeDefinitions
+{
+    protected AttributeDefinitions() {}
+    public AttributeDefinition forName(TemplateMode p0, String p1){ return null; }
+    public AttributeDefinition forName(TemplateMode p0, String p1, String p2){ return null; }
+    public AttributeDefinition forName(TemplateMode p0, char[] p1, int p2, int p3){ return null; }
+    public AttributeDefinitions(Map<TemplateMode, Set<IElementProcessor>> p0){}
+    public HTMLAttributeDefinition forHTMLName(String p0){ return null; }
+    public HTMLAttributeDefinition forHTMLName(String p0, String p1){ return null; }
+    public HTMLAttributeDefinition forHTMLName(char[] p0, int p1, int p2){ return null; }
+    public TextAttributeDefinition forCSSName(String p0){ return null; }
+    public TextAttributeDefinition forCSSName(String p0, String p1){ return null; }
+    public TextAttributeDefinition forCSSName(char[] p0, int p1, int p2){ return null; }
+    public TextAttributeDefinition forJavaScriptName(String p0){ return null; }
+    public TextAttributeDefinition forJavaScriptName(String p0, String p1){ return null; }
+    public TextAttributeDefinition forJavaScriptName(char[] p0, int p1, int p2){ return null; }
+    public TextAttributeDefinition forTextName(String p0){ return null; }
+    public TextAttributeDefinition forTextName(String p0, String p1){ return null; }
+    public TextAttributeDefinition forTextName(char[] p0, int p1, int p2){ return null; }
+    public XMLAttributeDefinition forXMLName(String p0){ return null; }
+    public XMLAttributeDefinition forXMLName(String p0, String p1){ return null; }
+    public XMLAttributeDefinition forXMLName(char[] p0, int p1, int p2){ return null; }
+    public static Set<String> ALL_STANDARD_HTML_ATTRIBUTE_NAMES = null;
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/AttributeName.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/AttributeName.java
new file mode 100644
index 00000000000..825ba185707
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/AttributeName.java
@@ -0,0 +1,20 @@
+// Generated automatically from org.thymeleaf.engine.AttributeName for testing purposes
+
+package org.thymeleaf.engine;
+
+
+abstract public class AttributeName
+{
+    protected AttributeName() {}
+    protected AttributeName(String p0, String p1, String[] p2){}
+    protected final String attributeName = null;
+    protected final String prefix = null;
+    protected final String[] completeAttributeNames = null;
+    public String getAttributeName(){ return null; }
+    public String getPrefix(){ return null; }
+    public String toString(){ return null; }
+    public String[] getCompleteAttributeNames(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isPrefixed(){ return false; }
+    public int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ElementDefinition.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ElementDefinition.java
new file mode 100644
index 00000000000..29e270476bb
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ElementDefinition.java
@@ -0,0 +1,18 @@
+// Generated automatically from org.thymeleaf.engine.ElementDefinition for testing purposes
+
+package org.thymeleaf.engine;
+
+import java.util.Set;
+import org.thymeleaf.engine.ElementName;
+import org.thymeleaf.processor.element.IElementProcessor;
+
+abstract public class ElementDefinition
+{
+    protected ElementDefinition() {}
+    public Set<IElementProcessor> getAssociatedProcessors(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean hasAssociatedProcessors(){ return false; }
+    public final ElementName getElementName(){ return null; }
+    public final String toString(){ return null; }
+    public int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ElementDefinitions.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ElementDefinitions.java
new file mode 100644
index 00000000000..d16bafb5bdd
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ElementDefinitions.java
@@ -0,0 +1,37 @@
+// Generated automatically from org.thymeleaf.engine.ElementDefinitions for testing purposes
+
+package org.thymeleaf.engine;
+
+import java.util.Map;
+import java.util.Set;
+import org.thymeleaf.engine.ElementDefinition;
+import org.thymeleaf.engine.HTMLElementDefinition;
+import org.thymeleaf.engine.TextElementDefinition;
+import org.thymeleaf.engine.XMLElementDefinition;
+import org.thymeleaf.processor.element.IElementProcessor;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public class ElementDefinitions
+{
+    protected ElementDefinitions() {}
+    public ElementDefinition forName(TemplateMode p0, String p1){ return null; }
+    public ElementDefinition forName(TemplateMode p0, String p1, String p2){ return null; }
+    public ElementDefinition forName(TemplateMode p0, char[] p1, int p2, int p3){ return null; }
+    public ElementDefinitions(Map<TemplateMode, Set<IElementProcessor>> p0){}
+    public HTMLElementDefinition forHTMLName(String p0){ return null; }
+    public HTMLElementDefinition forHTMLName(String p0, String p1){ return null; }
+    public HTMLElementDefinition forHTMLName(char[] p0, int p1, int p2){ return null; }
+    public TextElementDefinition forCSSName(String p0){ return null; }
+    public TextElementDefinition forCSSName(String p0, String p1){ return null; }
+    public TextElementDefinition forCSSName(char[] p0, int p1, int p2){ return null; }
+    public TextElementDefinition forJavaScriptName(String p0){ return null; }
+    public TextElementDefinition forJavaScriptName(String p0, String p1){ return null; }
+    public TextElementDefinition forJavaScriptName(char[] p0, int p1, int p2){ return null; }
+    public TextElementDefinition forTextName(String p0){ return null; }
+    public TextElementDefinition forTextName(String p0, String p1){ return null; }
+    public TextElementDefinition forTextName(char[] p0, int p1, int p2){ return null; }
+    public XMLElementDefinition forXMLName(String p0){ return null; }
+    public XMLElementDefinition forXMLName(String p0, String p1){ return null; }
+    public XMLElementDefinition forXMLName(char[] p0, int p1, int p2){ return null; }
+    public static Set<String> ALL_STANDARD_HTML_ELEMENT_NAMES = null;
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ElementName.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ElementName.java
new file mode 100644
index 00000000000..26c93d958dc
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ElementName.java
@@ -0,0 +1,20 @@
+// Generated automatically from org.thymeleaf.engine.ElementName for testing purposes
+
+package org.thymeleaf.engine;
+
+
+abstract public class ElementName
+{
+    protected ElementName() {}
+    protected ElementName(String p0, String p1, String[] p2){}
+    protected final String elementName = null;
+    protected final String prefix = null;
+    protected final String[] completeElementNames = null;
+    public String getElementName(){ return null; }
+    public String getPrefix(){ return null; }
+    public String toString(){ return null; }
+    public String[] getCompleteElementNames(){ return null; }
+    public boolean equals(Object p0){ return false; }
+    public boolean isPrefixed(){ return false; }
+    public int hashCode(){ return 0; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/HTMLAttributeDefinition.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/HTMLAttributeDefinition.java
new file mode 100644
index 00000000000..b4b5ac18f67
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/HTMLAttributeDefinition.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.thymeleaf.engine.HTMLAttributeDefinition for testing purposes
+
+package org.thymeleaf.engine;
+
+import org.thymeleaf.engine.AttributeDefinition;
+
+public class HTMLAttributeDefinition extends AttributeDefinition
+{
+    protected HTMLAttributeDefinition() {}
+    public boolean isBooleanAttribute(){ return false; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/HTMLElementDefinition.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/HTMLElementDefinition.java
new file mode 100644
index 00000000000..a82ccf5dab5
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/HTMLElementDefinition.java
@@ -0,0 +1,12 @@
+// Generated automatically from org.thymeleaf.engine.HTMLElementDefinition for testing purposes
+
+package org.thymeleaf.engine;
+
+import org.thymeleaf.engine.ElementDefinition;
+import org.thymeleaf.engine.HTMLElementType;
+
+public class HTMLElementDefinition extends ElementDefinition
+{
+    protected HTMLElementDefinition() {}
+    public HTMLElementType getType(){ return null; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/HTMLElementType.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/HTMLElementType.java
new file mode 100644
index 00000000000..adb2351a49a
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/HTMLElementType.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.thymeleaf.engine.HTMLElementType for testing purposes
+
+package org.thymeleaf.engine;
+
+
+public enum HTMLElementType
+{
+    ESCAPABLE_RAW_TEXT, FOREIGN, NORMAL, RAW_TEXT, VOID;
+    private HTMLElementType() {}
+    public boolean isVoid(){ return false; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ITemplateHandler.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ITemplateHandler.java
new file mode 100644
index 00000000000..2e4c5efd1d7
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ITemplateHandler.java
@@ -0,0 +1,33 @@
+// Generated automatically from org.thymeleaf.engine.ITemplateHandler for testing purposes
+
+package org.thymeleaf.engine;
+
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.ICDATASection;
+import org.thymeleaf.model.ICloseElementTag;
+import org.thymeleaf.model.IComment;
+import org.thymeleaf.model.IDocType;
+import org.thymeleaf.model.IOpenElementTag;
+import org.thymeleaf.model.IProcessingInstruction;
+import org.thymeleaf.model.IStandaloneElementTag;
+import org.thymeleaf.model.ITemplateEnd;
+import org.thymeleaf.model.ITemplateStart;
+import org.thymeleaf.model.IText;
+import org.thymeleaf.model.IXMLDeclaration;
+
+public interface ITemplateHandler
+{
+    void handleCDATASection(ICDATASection p0);
+    void handleCloseElement(ICloseElementTag p0);
+    void handleComment(IComment p0);
+    void handleDocType(IDocType p0);
+    void handleOpenElement(IOpenElementTag p0);
+    void handleProcessingInstruction(IProcessingInstruction p0);
+    void handleStandaloneElement(IStandaloneElementTag p0);
+    void handleTemplateEnd(ITemplateEnd p0);
+    void handleTemplateStart(ITemplateStart p0);
+    void handleText(IText p0);
+    void handleXMLDeclaration(IXMLDeclaration p0);
+    void setContext(ITemplateContext p0);
+    void setNext(ITemplateHandler p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/IThrottledTemplateWriterControl.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/IThrottledTemplateWriterControl.java
new file mode 100644
index 00000000000..c7876f8f2f8
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/IThrottledTemplateWriterControl.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.engine.IThrottledTemplateWriterControl for testing purposes
+
+package org.thymeleaf.engine;
+
+
+public interface IThrottledTemplateWriterControl
+{
+    boolean isOverflown();
+    boolean isStopped();
+    int getMaxOverflowSize();
+    int getOverflowGrowCount();
+    int getWrittenCount();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TemplateData.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TemplateData.java
new file mode 100644
index 00000000000..b7fc3f29548
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TemplateData.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.thymeleaf.engine.TemplateData for testing purposes
+
+package org.thymeleaf.engine;
+
+import java.util.Set;
+import org.thymeleaf.cache.ICacheEntryValidity;
+import org.thymeleaf.templatemode.TemplateMode;
+import org.thymeleaf.templateresource.ITemplateResource;
+
+public class TemplateData
+{
+    protected TemplateData() {}
+    public ICacheEntryValidity getValidity(){ return null; }
+    public ITemplateResource getTemplateResource(){ return null; }
+    public Set<String> getTemplateSelectors(){ return null; }
+    public String getTemplate(){ return null; }
+    public TemplateMode getTemplateMode(){ return null; }
+    public boolean hasTemplateSelectors(){ return false; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TemplateManager.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TemplateManager.java
new file mode 100644
index 00000000000..6cca1dc2ae0
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TemplateManager.java
@@ -0,0 +1,27 @@
+// Generated automatically from org.thymeleaf.engine.TemplateManager for testing purposes
+
+package org.thymeleaf.engine;
+
+import java.io.Writer;
+import java.util.Set;
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.TemplateSpec;
+import org.thymeleaf.context.IContext;
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.engine.TemplateData;
+import org.thymeleaf.engine.TemplateModel;
+import org.thymeleaf.engine.ThrottledTemplateProcessor;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public class TemplateManager
+{
+    protected TemplateManager() {}
+    public TemplateManager(IEngineConfiguration p0){}
+    public TemplateModel parseStandalone(ITemplateContext p0, String p1, Set<String> p2, TemplateMode p3, boolean p4, boolean p5){ return null; }
+    public TemplateModel parseString(TemplateData p0, String p1, int p2, int p3, TemplateMode p4, boolean p5){ return null; }
+    public ThrottledTemplateProcessor parseAndProcessThrottled(TemplateSpec p0, IContext p1){ return null; }
+    public void clearCaches(){}
+    public void clearCachesFor(String p0){}
+    public void parseAndProcess(TemplateSpec p0, IContext p1, Writer p2){}
+    public void process(TemplateModel p0, ITemplateContext p1, Writer p2){}
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TemplateModel.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TemplateModel.java
new file mode 100644
index 00000000000..483007df0d8
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TemplateModel.java
@@ -0,0 +1,32 @@
+// Generated automatically from org.thymeleaf.engine.TemplateModel for testing purposes
+
+package org.thymeleaf.engine;
+
+import java.io.Writer;
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.engine.TemplateData;
+import org.thymeleaf.model.IModel;
+import org.thymeleaf.model.IModelVisitor;
+import org.thymeleaf.model.ITemplateEvent;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public class TemplateModel implements IModel
+{
+    protected TemplateModel() {}
+    public final IEngineConfiguration getConfiguration(){ return null; }
+    public final IModel cloneModel(){ return null; }
+    public final ITemplateEvent get(int p0){ return null; }
+    public final String toString(){ return null; }
+    public final TemplateData getTemplateData(){ return null; }
+    public final TemplateMode getTemplateMode(){ return null; }
+    public final int size(){ return 0; }
+    public final void add(ITemplateEvent p0){}
+    public final void addModel(IModel p0){}
+    public final void insert(int p0, ITemplateEvent p1){}
+    public final void insertModel(int p0, IModel p1){}
+    public final void remove(int p0){}
+    public final void replace(int p0, ITemplateEvent p1){}
+    public final void reset(){}
+    public final void write(Writer p0){}
+    public void accept(IModelVisitor p0){}
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TextAttributeDefinition.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TextAttributeDefinition.java
new file mode 100644
index 00000000000..850adc12beb
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TextAttributeDefinition.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.thymeleaf.engine.TextAttributeDefinition for testing purposes
+
+package org.thymeleaf.engine;
+
+import org.thymeleaf.engine.AttributeDefinition;
+
+public class TextAttributeDefinition extends AttributeDefinition
+{
+    protected TextAttributeDefinition() {}
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TextElementDefinition.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TextElementDefinition.java
new file mode 100644
index 00000000000..13ae198008e
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/TextElementDefinition.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.thymeleaf.engine.TextElementDefinition for testing purposes
+
+package org.thymeleaf.engine;
+
+import org.thymeleaf.engine.ElementDefinition;
+
+public class TextElementDefinition extends ElementDefinition
+{
+    protected TextElementDefinition() {}
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ThrottledTemplateProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ThrottledTemplateProcessor.java
new file mode 100644
index 00000000000..b007c8fe525
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/ThrottledTemplateProcessor.java
@@ -0,0 +1,23 @@
+// Generated automatically from org.thymeleaf.engine.ThrottledTemplateProcessor for testing purposes
+
+package org.thymeleaf.engine;
+
+import java.io.OutputStream;
+import java.io.Writer;
+import java.nio.charset.Charset;
+import org.thymeleaf.IThrottledTemplateProcessor;
+import org.thymeleaf.TemplateSpec;
+import org.thymeleaf.engine.IThrottledTemplateWriterControl;
+
+public class ThrottledTemplateProcessor implements IThrottledTemplateProcessor
+{
+    protected ThrottledTemplateProcessor() {}
+    public IThrottledTemplateWriterControl getThrottledTemplateWriterControl(){ return null; }
+    public String getProcessorIdentifier(){ return null; }
+    public TemplateSpec getTemplateSpec(){ return null; }
+    public boolean isFinished(){ return false; }
+    public int process(int p0, OutputStream p1, Charset p2){ return 0; }
+    public int process(int p0, Writer p1){ return 0; }
+    public int processAll(OutputStream p0, Charset p1){ return 0; }
+    public int processAll(Writer p0){ return 0; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/XMLAttributeDefinition.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/XMLAttributeDefinition.java
new file mode 100644
index 00000000000..9f9f34d862d
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/XMLAttributeDefinition.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.thymeleaf.engine.XMLAttributeDefinition for testing purposes
+
+package org.thymeleaf.engine;
+
+import org.thymeleaf.engine.AttributeDefinition;
+
+public class XMLAttributeDefinition extends AttributeDefinition
+{
+    protected XMLAttributeDefinition() {}
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/XMLElementDefinition.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/XMLElementDefinition.java
new file mode 100644
index 00000000000..8a568988172
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/engine/XMLElementDefinition.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.thymeleaf.engine.XMLElementDefinition for testing purposes
+
+package org.thymeleaf.engine;
+
+import org.thymeleaf.engine.ElementDefinition;
+
+public class XMLElementDefinition extends ElementDefinition
+{
+    protected XMLElementDefinition() {}
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/expression/IExpressionObjectFactory.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/expression/IExpressionObjectFactory.java
new file mode 100644
index 00000000000..84733bc0c93
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/expression/IExpressionObjectFactory.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.expression.IExpressionObjectFactory for testing purposes
+
+package org.thymeleaf.expression;
+
+import java.util.Set;
+import org.thymeleaf.context.IExpressionContext;
+
+public interface IExpressionObjectFactory
+{
+    Object buildObject(IExpressionContext p0, String p1);
+    Set<String> getAllExpressionObjectNames();
+    boolean isCacheable(String p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/expression/IExpressionObjects.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/expression/IExpressionObjects.java
new file mode 100644
index 00000000000..c402ddf4dbc
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/expression/IExpressionObjects.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.expression.IExpressionObjects for testing purposes
+
+package org.thymeleaf.expression;
+
+import java.util.Set;
+
+public interface IExpressionObjects
+{
+    Object getObject(String p0);
+    Set<String> getObjectNames();
+    boolean containsObject(String p0);
+    int size();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/inline/IInliner.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/inline/IInliner.java
new file mode 100644
index 00000000000..c0b9c22943d
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/inline/IInliner.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.thymeleaf.inline.IInliner for testing purposes
+
+package org.thymeleaf.inline;
+
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.ICDATASection;
+import org.thymeleaf.model.IComment;
+import org.thymeleaf.model.IText;
+
+public interface IInliner
+{
+    CharSequence inline(ITemplateContext p0, ICDATASection p1);
+    CharSequence inline(ITemplateContext p0, IComment p1);
+    CharSequence inline(ITemplateContext p0, IText p1);
+    String getName();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/linkbuilder/ILinkBuilder.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/linkbuilder/ILinkBuilder.java
new file mode 100644
index 00000000000..d3d06ddb9b8
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/linkbuilder/ILinkBuilder.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.linkbuilder.ILinkBuilder for testing purposes
+
+package org.thymeleaf.linkbuilder;
+
+import java.util.Map;
+import org.thymeleaf.context.IExpressionContext;
+
+public interface ILinkBuilder
+{
+    Integer getOrder();
+    String buildLink(IExpressionContext p0, String p1, Map<String, Object> p2);
+    String getName();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/messageresolver/IMessageResolver.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/messageresolver/IMessageResolver.java
new file mode 100644
index 00000000000..44e9a165f22
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/messageresolver/IMessageResolver.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.messageresolver.IMessageResolver for testing purposes
+
+package org.thymeleaf.messageresolver;
+
+import org.thymeleaf.context.ITemplateContext;
+
+public interface IMessageResolver
+{
+    Integer getOrder();
+    String createAbsentMessageRepresentation(ITemplateContext p0, Class<? extends Object> p1, String p2, Object[] p3);
+    String getName();
+    String resolveMessage(ITemplateContext p0, Class<? extends Object> p1, String p2, Object[] p3);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/AttributeValueQuotes.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/AttributeValueQuotes.java
new file mode 100644
index 00000000000..93c49c96ad5
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/AttributeValueQuotes.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.thymeleaf.model.AttributeValueQuotes for testing purposes
+
+package org.thymeleaf.model;
+
+
+public enum AttributeValueQuotes
+{
+    DOUBLE, NONE, SINGLE;
+    private AttributeValueQuotes() {}
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IAttribute.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IAttribute.java
new file mode 100644
index 00000000000..3d5a2501bcc
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IAttribute.java
@@ -0,0 +1,21 @@
+// Generated automatically from org.thymeleaf.model.IAttribute for testing purposes
+
+package org.thymeleaf.model;
+
+import java.io.Writer;
+import org.thymeleaf.engine.AttributeDefinition;
+import org.thymeleaf.model.AttributeValueQuotes;
+
+public interface IAttribute
+{
+    AttributeDefinition getAttributeDefinition();
+    AttributeValueQuotes getValueQuotes();
+    String getAttributeCompleteName();
+    String getOperator();
+    String getTemplateName();
+    String getValue();
+    boolean hasLocation();
+    int getCol();
+    int getLine();
+    void write(Writer p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ICDATASection.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ICDATASection.java
new file mode 100644
index 00000000000..a5fc095dfa1
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ICDATASection.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.thymeleaf.model.ICDATASection for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.ITemplateEvent;
+
+public interface ICDATASection extends CharSequence, ITemplateEvent
+{
+    String getCDATASection();
+    String getContent();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ICloseElementTag.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ICloseElementTag.java
new file mode 100644
index 00000000000..6626d35c7b3
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ICloseElementTag.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.thymeleaf.model.ICloseElementTag for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.IElementTag;
+
+public interface ICloseElementTag extends IElementTag
+{
+    boolean isUnmatched();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IComment.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IComment.java
new file mode 100644
index 00000000000..6496dba245d
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IComment.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.thymeleaf.model.IComment for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.ITemplateEvent;
+
+public interface IComment extends CharSequence, ITemplateEvent
+{
+    String getComment();
+    String getContent();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IDocType.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IDocType.java
new file mode 100644
index 00000000000..16d58f7ed15
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IDocType.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.thymeleaf.model.IDocType for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.ITemplateEvent;
+
+public interface IDocType extends ITemplateEvent
+{
+    String getDocType();
+    String getElementName();
+    String getInternalSubset();
+    String getKeyword();
+    String getPublicId();
+    String getSystemId();
+    String getType();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IElementTag.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IElementTag.java
new file mode 100644
index 00000000000..7de654ac619
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IElementTag.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.thymeleaf.model.IElementTag for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.engine.ElementDefinition;
+import org.thymeleaf.model.ITemplateEvent;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public interface IElementTag extends ITemplateEvent
+{
+    ElementDefinition getElementDefinition();
+    String getElementCompleteName();
+    TemplateMode getTemplateMode();
+    boolean isSynthetic();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IModel.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IModel.java
new file mode 100644
index 00000000000..0acf1b203ce
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IModel.java
@@ -0,0 +1,27 @@
+// Generated automatically from org.thymeleaf.model.IModel for testing purposes
+
+package org.thymeleaf.model;
+
+import java.io.Writer;
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.model.IModelVisitor;
+import org.thymeleaf.model.ITemplateEvent;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public interface IModel
+{
+    IEngineConfiguration getConfiguration();
+    IModel cloneModel();
+    ITemplateEvent get(int p0);
+    TemplateMode getTemplateMode();
+    int size();
+    void accept(IModelVisitor p0);
+    void add(ITemplateEvent p0);
+    void addModel(IModel p0);
+    void insert(int p0, ITemplateEvent p1);
+    void insertModel(int p0, IModel p1);
+    void remove(int p0);
+    void replace(int p0, ITemplateEvent p1);
+    void reset();
+    void write(Writer p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IModelFactory.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IModelFactory.java
new file mode 100644
index 00000000000..b7a26269b83
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IModelFactory.java
@@ -0,0 +1,54 @@
+// Generated automatically from org.thymeleaf.model.IModelFactory for testing purposes
+
+package org.thymeleaf.model;
+
+import java.util.Map;
+import org.thymeleaf.engine.AttributeName;
+import org.thymeleaf.engine.TemplateData;
+import org.thymeleaf.model.AttributeValueQuotes;
+import org.thymeleaf.model.ICDATASection;
+import org.thymeleaf.model.ICloseElementTag;
+import org.thymeleaf.model.IComment;
+import org.thymeleaf.model.IDocType;
+import org.thymeleaf.model.IModel;
+import org.thymeleaf.model.IOpenElementTag;
+import org.thymeleaf.model.IProcessableElementTag;
+import org.thymeleaf.model.IProcessingInstruction;
+import org.thymeleaf.model.IStandaloneElementTag;
+import org.thymeleaf.model.ITemplateEvent;
+import org.thymeleaf.model.IText;
+import org.thymeleaf.model.IXMLDeclaration;
+
+public interface IModelFactory
+{
+    <T extends IProcessableElementTag> T removeAttribute(T p0, AttributeName p1);
+    <T extends IProcessableElementTag> T removeAttribute(T p0, String p1);
+    <T extends IProcessableElementTag> T removeAttribute(T p0, String p1, String p2);
+    <T extends IProcessableElementTag> T replaceAttribute(T p0, AttributeName p1, String p2, String p3);
+    <T extends IProcessableElementTag> T replaceAttribute(T p0, AttributeName p1, String p2, String p3, AttributeValueQuotes p4);
+    <T extends IProcessableElementTag> T setAttribute(T p0, String p1, String p2);
+    <T extends IProcessableElementTag> T setAttribute(T p0, String p1, String p2, AttributeValueQuotes p3);
+    ICDATASection createCDATASection(CharSequence p0);
+    ICloseElementTag createCloseElementTag(String p0);
+    ICloseElementTag createCloseElementTag(String p0, boolean p1, boolean p2);
+    IComment createComment(CharSequence p0);
+    IDocType createDocType(String p0, String p1);
+    IDocType createDocType(String p0, String p1, String p2, String p3, String p4);
+    IDocType createHTML5DocType();
+    IModel createModel();
+    IModel createModel(ITemplateEvent p0);
+    IModel parse(TemplateData p0, String p1);
+    IOpenElementTag createOpenElementTag(String p0);
+    IOpenElementTag createOpenElementTag(String p0, Map<String, String> p1, AttributeValueQuotes p2, boolean p3);
+    IOpenElementTag createOpenElementTag(String p0, String p1, String p2);
+    IOpenElementTag createOpenElementTag(String p0, String p1, String p2, boolean p3);
+    IOpenElementTag createOpenElementTag(String p0, boolean p1);
+    IProcessingInstruction createProcessingInstruction(String p0, String p1);
+    IStandaloneElementTag createStandaloneElementTag(String p0);
+    IStandaloneElementTag createStandaloneElementTag(String p0, Map<String, String> p1, AttributeValueQuotes p2, boolean p3, boolean p4);
+    IStandaloneElementTag createStandaloneElementTag(String p0, String p1, String p2);
+    IStandaloneElementTag createStandaloneElementTag(String p0, String p1, String p2, boolean p3, boolean p4);
+    IStandaloneElementTag createStandaloneElementTag(String p0, boolean p1, boolean p2);
+    IText createText(CharSequence p0);
+    IXMLDeclaration createXMLDeclaration(String p0, String p1, String p2);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IModelVisitor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IModelVisitor.java
new file mode 100644
index 00000000000..2c88c808e90
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IModelVisitor.java
@@ -0,0 +1,30 @@
+// Generated automatically from org.thymeleaf.model.IModelVisitor for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.ICDATASection;
+import org.thymeleaf.model.ICloseElementTag;
+import org.thymeleaf.model.IComment;
+import org.thymeleaf.model.IDocType;
+import org.thymeleaf.model.IOpenElementTag;
+import org.thymeleaf.model.IProcessingInstruction;
+import org.thymeleaf.model.IStandaloneElementTag;
+import org.thymeleaf.model.ITemplateEnd;
+import org.thymeleaf.model.ITemplateStart;
+import org.thymeleaf.model.IText;
+import org.thymeleaf.model.IXMLDeclaration;
+
+public interface IModelVisitor
+{
+    void visit(ICDATASection p0);
+    void visit(ICloseElementTag p0);
+    void visit(IComment p0);
+    void visit(IDocType p0);
+    void visit(IOpenElementTag p0);
+    void visit(IProcessingInstruction p0);
+    void visit(IStandaloneElementTag p0);
+    void visit(ITemplateEnd p0);
+    void visit(ITemplateStart p0);
+    void visit(IText p0);
+    void visit(IXMLDeclaration p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IOpenElementTag.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IOpenElementTag.java
new file mode 100644
index 00000000000..7c16b377c68
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IOpenElementTag.java
@@ -0,0 +1,9 @@
+// Generated automatically from org.thymeleaf.model.IOpenElementTag for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.IProcessableElementTag;
+
+public interface IOpenElementTag extends IProcessableElementTag
+{
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IProcessableElementTag.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IProcessableElementTag.java
new file mode 100644
index 00000000000..360c1ed4293
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IProcessableElementTag.java
@@ -0,0 +1,23 @@
+// Generated automatically from org.thymeleaf.model.IProcessableElementTag for testing purposes
+
+package org.thymeleaf.model;
+
+import java.util.Map;
+import org.thymeleaf.engine.AttributeName;
+import org.thymeleaf.model.IAttribute;
+import org.thymeleaf.model.IElementTag;
+
+public interface IProcessableElementTag extends IElementTag
+{
+    IAttribute getAttribute(AttributeName p0);
+    IAttribute getAttribute(String p0);
+    IAttribute getAttribute(String p0, String p1);
+    IAttribute[] getAllAttributes();
+    Map<String, String> getAttributeMap();
+    String getAttributeValue(AttributeName p0);
+    String getAttributeValue(String p0);
+    String getAttributeValue(String p0, String p1);
+    boolean hasAttribute(AttributeName p0);
+    boolean hasAttribute(String p0);
+    boolean hasAttribute(String p0, String p1);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IProcessingInstruction.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IProcessingInstruction.java
new file mode 100644
index 00000000000..9c987c7aecf
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IProcessingInstruction.java
@@ -0,0 +1,12 @@
+// Generated automatically from org.thymeleaf.model.IProcessingInstruction for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.ITemplateEvent;
+
+public interface IProcessingInstruction extends ITemplateEvent
+{
+    String getContent();
+    String getProcessingInstruction();
+    String getTarget();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IStandaloneElementTag.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IStandaloneElementTag.java
new file mode 100644
index 00000000000..149c1bf4f2b
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IStandaloneElementTag.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.thymeleaf.model.IStandaloneElementTag for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.IProcessableElementTag;
+
+public interface IStandaloneElementTag extends IProcessableElementTag
+{
+    boolean isMinimized();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ITemplateEnd.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ITemplateEnd.java
new file mode 100644
index 00000000000..e171bf43b44
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ITemplateEnd.java
@@ -0,0 +1,9 @@
+// Generated automatically from org.thymeleaf.model.ITemplateEnd for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.ITemplateEvent;
+
+public interface ITemplateEnd extends ITemplateEvent
+{
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ITemplateEvent.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ITemplateEvent.java
new file mode 100644
index 00000000000..304e991c7a4
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ITemplateEvent.java
@@ -0,0 +1,16 @@
+// Generated automatically from org.thymeleaf.model.ITemplateEvent for testing purposes
+
+package org.thymeleaf.model;
+
+import java.io.Writer;
+import org.thymeleaf.model.IModelVisitor;
+
+public interface ITemplateEvent
+{
+    String getTemplateName();
+    boolean hasLocation();
+    int getCol();
+    int getLine();
+    void accept(IModelVisitor p0);
+    void write(Writer p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ITemplateStart.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ITemplateStart.java
new file mode 100644
index 00000000000..9df574390ae
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/ITemplateStart.java
@@ -0,0 +1,9 @@
+// Generated automatically from org.thymeleaf.model.ITemplateStart for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.ITemplateEvent;
+
+public interface ITemplateStart extends ITemplateEvent
+{
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IText.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IText.java
new file mode 100644
index 00000000000..b7007ea89db
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IText.java
@@ -0,0 +1,10 @@
+// Generated automatically from org.thymeleaf.model.IText for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.ITemplateEvent;
+
+public interface IText extends CharSequence, ITemplateEvent
+{
+    String getText();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IXMLDeclaration.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IXMLDeclaration.java
new file mode 100644
index 00000000000..e436ef31ab8
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/model/IXMLDeclaration.java
@@ -0,0 +1,14 @@
+// Generated automatically from org.thymeleaf.model.IXMLDeclaration for testing purposes
+
+package org.thymeleaf.model;
+
+import org.thymeleaf.model.ITemplateEvent;
+
+public interface IXMLDeclaration extends ITemplateEvent
+{
+    String getEncoding();
+    String getKeyword();
+    String getStandalone();
+    String getVersion();
+    String getXmlDeclaration();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/postprocessor/IPostProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/postprocessor/IPostProcessor.java
new file mode 100644
index 00000000000..0733031a17c
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/postprocessor/IPostProcessor.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.postprocessor.IPostProcessor for testing purposes
+
+package org.thymeleaf.postprocessor;
+
+import org.thymeleaf.engine.ITemplateHandler;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public interface IPostProcessor
+{
+    Class<? extends ITemplateHandler> getHandlerClass();
+    TemplateMode getTemplateMode();
+    int getPrecedence();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/preprocessor/IPreProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/preprocessor/IPreProcessor.java
new file mode 100644
index 00000000000..eb73e08cda3
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/preprocessor/IPreProcessor.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.preprocessor.IPreProcessor for testing purposes
+
+package org.thymeleaf.preprocessor;
+
+import org.thymeleaf.engine.ITemplateHandler;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public interface IPreProcessor
+{
+    Class<? extends ITemplateHandler> getHandlerClass();
+    TemplateMode getTemplateMode();
+    int getPrecedence();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/IProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/IProcessor.java
new file mode 100644
index 00000000000..3188670bcd2
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/IProcessor.java
@@ -0,0 +1,11 @@
+// Generated automatically from org.thymeleaf.processor.IProcessor for testing purposes
+
+package org.thymeleaf.processor;
+
+import org.thymeleaf.templatemode.TemplateMode;
+
+public interface IProcessor
+{
+    TemplateMode getTemplateMode();
+    int getPrecedence();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/cdatasection/ICDATASectionProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/cdatasection/ICDATASectionProcessor.java
new file mode 100644
index 00000000000..95572352c05
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/cdatasection/ICDATASectionProcessor.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.cdatasection.ICDATASectionProcessor for testing purposes
+
+package org.thymeleaf.processor.cdatasection;
+
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.ICDATASection;
+import org.thymeleaf.processor.IProcessor;
+import org.thymeleaf.processor.cdatasection.ICDATASectionStructureHandler;
+
+public interface ICDATASectionProcessor extends IProcessor
+{
+    void process(ITemplateContext p0, ICDATASection p1, ICDATASectionStructureHandler p2);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/cdatasection/ICDATASectionStructureHandler.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/cdatasection/ICDATASectionStructureHandler.java
new file mode 100644
index 00000000000..f809d3cb2fc
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/cdatasection/ICDATASectionStructureHandler.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.cdatasection.ICDATASectionStructureHandler for testing purposes
+
+package org.thymeleaf.processor.cdatasection;
+
+import org.thymeleaf.model.IModel;
+
+public interface ICDATASectionStructureHandler
+{
+    void removeCDATASection();
+    void replaceWith(IModel p0, boolean p1);
+    void reset();
+    void setContent(CharSequence p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/comment/ICommentProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/comment/ICommentProcessor.java
new file mode 100644
index 00000000000..0d9d0ead04b
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/comment/ICommentProcessor.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.comment.ICommentProcessor for testing purposes
+
+package org.thymeleaf.processor.comment;
+
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.IComment;
+import org.thymeleaf.processor.IProcessor;
+import org.thymeleaf.processor.comment.ICommentStructureHandler;
+
+public interface ICommentProcessor extends IProcessor
+{
+    void process(ITemplateContext p0, IComment p1, ICommentStructureHandler p2);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/comment/ICommentStructureHandler.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/comment/ICommentStructureHandler.java
new file mode 100644
index 00000000000..659c275c843
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/comment/ICommentStructureHandler.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.comment.ICommentStructureHandler for testing purposes
+
+package org.thymeleaf.processor.comment;
+
+import org.thymeleaf.model.IModel;
+
+public interface ICommentStructureHandler
+{
+    void removeComment();
+    void replaceWith(IModel p0, boolean p1);
+    void reset();
+    void setContent(CharSequence p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/doctype/IDocTypeProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/doctype/IDocTypeProcessor.java
new file mode 100644
index 00000000000..82c743847ea
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/doctype/IDocTypeProcessor.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.doctype.IDocTypeProcessor for testing purposes
+
+package org.thymeleaf.processor.doctype;
+
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.IDocType;
+import org.thymeleaf.processor.IProcessor;
+import org.thymeleaf.processor.doctype.IDocTypeStructureHandler;
+
+public interface IDocTypeProcessor extends IProcessor
+{
+    void process(ITemplateContext p0, IDocType p1, IDocTypeStructureHandler p2);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/doctype/IDocTypeStructureHandler.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/doctype/IDocTypeStructureHandler.java
new file mode 100644
index 00000000000..d10f208f679
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/doctype/IDocTypeStructureHandler.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.doctype.IDocTypeStructureHandler for testing purposes
+
+package org.thymeleaf.processor.doctype;
+
+import org.thymeleaf.model.IModel;
+
+public interface IDocTypeStructureHandler
+{
+    void removeDocType();
+    void replaceWith(IModel p0, boolean p1);
+    void reset();
+    void setDocType(String p0, String p1, String p2, String p3, String p4);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/element/IElementProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/element/IElementProcessor.java
new file mode 100644
index 00000000000..863c925f7f2
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/element/IElementProcessor.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.element.IElementProcessor for testing purposes
+
+package org.thymeleaf.processor.element;
+
+import org.thymeleaf.processor.IProcessor;
+import org.thymeleaf.processor.element.MatchingAttributeName;
+import org.thymeleaf.processor.element.MatchingElementName;
+
+public interface IElementProcessor extends IProcessor
+{
+    MatchingAttributeName getMatchingAttributeName();
+    MatchingElementName getMatchingElementName();
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/element/MatchingAttributeName.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/element/MatchingAttributeName.java
new file mode 100644
index 00000000000..a41c7bb3755
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/element/MatchingAttributeName.java
@@ -0,0 +1,20 @@
+// Generated automatically from org.thymeleaf.processor.element.MatchingAttributeName for testing purposes
+
+package org.thymeleaf.processor.element;
+
+import org.thymeleaf.engine.AttributeName;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public class MatchingAttributeName
+{
+    protected MatchingAttributeName() {}
+    public AttributeName getMatchingAttributeName(){ return null; }
+    public String getMatchingAllAttributesWithPrefix(){ return null; }
+    public String toString(){ return null; }
+    public TemplateMode getTemplateMode(){ return null; }
+    public boolean isMatchingAllAttributes(){ return false; }
+    public boolean matches(AttributeName p0){ return false; }
+    public static MatchingAttributeName forAllAttributes(TemplateMode p0){ return null; }
+    public static MatchingAttributeName forAllAttributesWithPrefix(TemplateMode p0, String p1){ return null; }
+    public static MatchingAttributeName forAttributeName(TemplateMode p0, AttributeName p1){ return null; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/element/MatchingElementName.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/element/MatchingElementName.java
new file mode 100644
index 00000000000..bf1c096b68e
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/element/MatchingElementName.java
@@ -0,0 +1,20 @@
+// Generated automatically from org.thymeleaf.processor.element.MatchingElementName for testing purposes
+
+package org.thymeleaf.processor.element;
+
+import org.thymeleaf.engine.ElementName;
+import org.thymeleaf.templatemode.TemplateMode;
+
+public class MatchingElementName
+{
+    protected MatchingElementName() {}
+    public ElementName getMatchingElementName(){ return null; }
+    public String getMatchingAllElementsWithPrefix(){ return null; }
+    public String toString(){ return null; }
+    public TemplateMode getTemplateMode(){ return null; }
+    public boolean isMatchingAllElements(){ return false; }
+    public boolean matches(ElementName p0){ return false; }
+    public static MatchingElementName forAllElements(TemplateMode p0){ return null; }
+    public static MatchingElementName forAllElementsWithPrefix(TemplateMode p0, String p1){ return null; }
+    public static MatchingElementName forElementName(TemplateMode p0, ElementName p1){ return null; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/processinginstruction/IProcessingInstructionProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/processinginstruction/IProcessingInstructionProcessor.java
new file mode 100644
index 00000000000..859fa0fb539
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/processinginstruction/IProcessingInstructionProcessor.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.processinginstruction.IProcessingInstructionProcessor for testing purposes
+
+package org.thymeleaf.processor.processinginstruction;
+
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.IProcessingInstruction;
+import org.thymeleaf.processor.IProcessor;
+import org.thymeleaf.processor.processinginstruction.IProcessingInstructionStructureHandler;
+
+public interface IProcessingInstructionProcessor extends IProcessor
+{
+    void process(ITemplateContext p0, IProcessingInstruction p1, IProcessingInstructionStructureHandler p2);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/processinginstruction/IProcessingInstructionStructureHandler.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/processinginstruction/IProcessingInstructionStructureHandler.java
new file mode 100644
index 00000000000..3701674a05f
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/processinginstruction/IProcessingInstructionStructureHandler.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.processinginstruction.IProcessingInstructionStructureHandler for testing purposes
+
+package org.thymeleaf.processor.processinginstruction;
+
+import org.thymeleaf.model.IModel;
+
+public interface IProcessingInstructionStructureHandler
+{
+    void removeProcessingInstruction();
+    void replaceWith(IModel p0, boolean p1);
+    void reset();
+    void setProcessingInstruction(String p0, String p1);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/templateboundaries/ITemplateBoundariesProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/templateboundaries/ITemplateBoundariesProcessor.java
new file mode 100644
index 00000000000..6e02158cc0b
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/templateboundaries/ITemplateBoundariesProcessor.java
@@ -0,0 +1,15 @@
+// Generated automatically from org.thymeleaf.processor.templateboundaries.ITemplateBoundariesProcessor for testing purposes
+
+package org.thymeleaf.processor.templateboundaries;
+
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.ITemplateEnd;
+import org.thymeleaf.model.ITemplateStart;
+import org.thymeleaf.processor.IProcessor;
+import org.thymeleaf.processor.templateboundaries.ITemplateBoundariesStructureHandler;
+
+public interface ITemplateBoundariesProcessor extends IProcessor
+{
+    void processTemplateEnd(ITemplateContext p0, ITemplateEnd p1, ITemplateBoundariesStructureHandler p2);
+    void processTemplateStart(ITemplateContext p0, ITemplateStart p1, ITemplateBoundariesStructureHandler p2);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/templateboundaries/ITemplateBoundariesStructureHandler.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/templateboundaries/ITemplateBoundariesStructureHandler.java
new file mode 100644
index 00000000000..146e0949b97
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/templateboundaries/ITemplateBoundariesStructureHandler.java
@@ -0,0 +1,17 @@
+// Generated automatically from org.thymeleaf.processor.templateboundaries.ITemplateBoundariesStructureHandler for testing purposes
+
+package org.thymeleaf.processor.templateboundaries;
+
+import org.thymeleaf.inline.IInliner;
+import org.thymeleaf.model.IModel;
+
+public interface ITemplateBoundariesStructureHandler
+{
+    void insert(IModel p0, boolean p1);
+    void insert(String p0, boolean p1);
+    void removeLocalVariable(String p0);
+    void reset();
+    void setInliner(IInliner p0);
+    void setLocalVariable(String p0, Object p1);
+    void setSelectionTarget(Object p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/text/ITextProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/text/ITextProcessor.java
new file mode 100644
index 00000000000..7ba2f796468
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/text/ITextProcessor.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.text.ITextProcessor for testing purposes
+
+package org.thymeleaf.processor.text;
+
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.IText;
+import org.thymeleaf.processor.IProcessor;
+import org.thymeleaf.processor.text.ITextStructureHandler;
+
+public interface ITextProcessor extends IProcessor
+{
+    void process(ITemplateContext p0, IText p1, ITextStructureHandler p2);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/text/ITextStructureHandler.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/text/ITextStructureHandler.java
new file mode 100644
index 00000000000..a70bd560424
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/text/ITextStructureHandler.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.text.ITextStructureHandler for testing purposes
+
+package org.thymeleaf.processor.text;
+
+import org.thymeleaf.model.IModel;
+
+public interface ITextStructureHandler
+{
+    void removeText();
+    void replaceWith(IModel p0, boolean p1);
+    void reset();
+    void setText(CharSequence p0);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/xmldeclaration/IXMLDeclarationProcessor.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/xmldeclaration/IXMLDeclarationProcessor.java
new file mode 100644
index 00000000000..da7abd0b178
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/xmldeclaration/IXMLDeclarationProcessor.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.xmldeclaration.IXMLDeclarationProcessor for testing purposes
+
+package org.thymeleaf.processor.xmldeclaration;
+
+import org.thymeleaf.context.ITemplateContext;
+import org.thymeleaf.model.IXMLDeclaration;
+import org.thymeleaf.processor.IProcessor;
+import org.thymeleaf.processor.xmldeclaration.IXMLDeclarationStructureHandler;
+
+public interface IXMLDeclarationProcessor extends IProcessor
+{
+    void process(ITemplateContext p0, IXMLDeclaration p1, IXMLDeclarationStructureHandler p2);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/xmldeclaration/IXMLDeclarationStructureHandler.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/xmldeclaration/IXMLDeclarationStructureHandler.java
new file mode 100644
index 00000000000..971cef5a8d3
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/processor/xmldeclaration/IXMLDeclarationStructureHandler.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.processor.xmldeclaration.IXMLDeclarationStructureHandler for testing purposes
+
+package org.thymeleaf.processor.xmldeclaration;
+
+import org.thymeleaf.model.IModel;
+
+public interface IXMLDeclarationStructureHandler
+{
+    void removeXMLDeclaration();
+    void replaceWith(IModel p0, boolean p1);
+    void reset();
+    void setXMLDeclaration(String p0, String p1, String p2, String p3);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templatemode/TemplateMode.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templatemode/TemplateMode.java
new file mode 100644
index 00000000000..074b4ce19dc
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templatemode/TemplateMode.java
@@ -0,0 +1,14 @@
+// Generated automatically from org.thymeleaf.templatemode.TemplateMode for testing purposes
+
+package org.thymeleaf.templatemode;
+
+
+public enum TemplateMode
+{
+    CSS, HTML, HTML5, JAVASCRIPT, LEGACYHTML5, RAW, TEXT, VALIDXHTML, VALIDXML, XHTML, XML;
+    private TemplateMode() {}
+    public boolean isCaseSensitive(){ return false; }
+    public boolean isMarkup(){ return false; }
+    public boolean isText(){ return false; }
+    public static TemplateMode parse(String p0){ return null; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateparser/markup/decoupled/IDecoupledTemplateLogicResolver.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateparser/markup/decoupled/IDecoupledTemplateLogicResolver.java
new file mode 100644
index 00000000000..97ddd58f6ad
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateparser/markup/decoupled/IDecoupledTemplateLogicResolver.java
@@ -0,0 +1,13 @@
+// Generated automatically from org.thymeleaf.templateparser.markup.decoupled.IDecoupledTemplateLogicResolver for testing purposes
+
+package org.thymeleaf.templateparser.markup.decoupled;
+
+import java.util.Set;
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.templatemode.TemplateMode;
+import org.thymeleaf.templateresource.ITemplateResource;
+
+public interface IDecoupledTemplateLogicResolver
+{
+    ITemplateResource resolveDecoupledTemplateLogic(IEngineConfiguration p0, String p1, String p2, Set<String> p3, ITemplateResource p4, TemplateMode p5);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateresolver/ITemplateResolver.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateresolver/ITemplateResolver.java
new file mode 100644
index 00000000000..733098c0205
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateresolver/ITemplateResolver.java
@@ -0,0 +1,14 @@
+// Generated automatically from org.thymeleaf.templateresolver.ITemplateResolver for testing purposes
+
+package org.thymeleaf.templateresolver;
+
+import java.util.Map;
+import org.thymeleaf.IEngineConfiguration;
+import org.thymeleaf.templateresolver.TemplateResolution;
+
+public interface ITemplateResolver
+{
+    Integer getOrder();
+    String getName();
+    TemplateResolution resolveTemplate(IEngineConfiguration p0, String p1, String p2, Map<String, Object> p3);
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateresolver/TemplateResolution.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateresolver/TemplateResolution.java
new file mode 100644
index 00000000000..b905ea2f51e
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateresolver/TemplateResolution.java
@@ -0,0 +1,19 @@
+// Generated automatically from org.thymeleaf.templateresolver.TemplateResolution for testing purposes
+
+package org.thymeleaf.templateresolver;
+
+import org.thymeleaf.cache.ICacheEntryValidity;
+import org.thymeleaf.templatemode.TemplateMode;
+import org.thymeleaf.templateresource.ITemplateResource;
+
+public class TemplateResolution
+{
+    protected TemplateResolution() {}
+    public ICacheEntryValidity getValidity(){ return null; }
+    public ITemplateResource getTemplateResource(){ return null; }
+    public TemplateMode getTemplateMode(){ return null; }
+    public TemplateResolution(ITemplateResource p0, TemplateMode p1, ICacheEntryValidity p2){}
+    public TemplateResolution(ITemplateResource p0, boolean p1, TemplateMode p2, boolean p3, ICacheEntryValidity p4){}
+    public boolean getUseDecoupledLogic(){ return false; }
+    public boolean isTemplateResourceExistenceVerified(){ return false; }
+}
diff --git a/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateresource/ITemplateResource.java b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateresource/ITemplateResource.java
new file mode 100644
index 00000000000..dd3a5e3ea64
--- /dev/null
+++ b/java/ql/test/stubs/thymeleaf-3.0.14/org/thymeleaf/templateresource/ITemplateResource.java
@@ -0,0 +1,14 @@
+// Generated automatically from org.thymeleaf.templateresource.ITemplateResource for testing purposes
+
+package org.thymeleaf.templateresource;
+
+import java.io.Reader;
+
+public interface ITemplateResource
+{
+    ITemplateResource relative(String p0);
+    Reader reader();
+    String getBaseName();
+    String getDescription();
+    boolean exists();
+}
diff --git a/javascript/extractor/lib/typescript/package.json b/javascript/extractor/lib/typescript/package.json
index 6898986e749..2fbc09e8d9e 100644
--- a/javascript/extractor/lib/typescript/package.json
+++ b/javascript/extractor/lib/typescript/package.json
@@ -2,7 +2,7 @@
     "name": "typescript-parser-wrapper",
     "private": true,
     "dependencies": {
-        "typescript": "4.7.2"
+        "typescript": "4.8.2"
     },
     "scripts": {
         "build": "tsc --project tsconfig.json",
diff --git a/javascript/extractor/lib/typescript/src/ast_extractor.ts b/javascript/extractor/lib/typescript/src/ast_extractor.ts
index c1415dbd294..b935294feb6 100644
--- a/javascript/extractor/lib/typescript/src/ast_extractor.ts
+++ b/javascript/extractor/lib/typescript/src/ast_extractor.ts
@@ -168,20 +168,9 @@ export function augmentAst(ast: AugmentedSourceFile, code: string, project: Proj
         }
     }
 
-    // Number of conditional type expressions the visitor is currently inside.
-    // We disable type extraction inside such type expressions, to avoid complications
-    // with `infer` types.
-    let insideConditionalTypes = 0;
-
     visitAstNode(ast);
     function visitAstNode(node: AugmentedNode) {
-        if (node.kind === ts.SyntaxKind.ConditionalType) {
-            ++insideConditionalTypes;
-        }
         ts.forEachChild(node, visitAstNode);
-        if (node.kind === ts.SyntaxKind.ConditionalType) {
-            --insideConditionalTypes;
-        }
 
         // fill in line/column info
         if ("pos" in node) {
@@ -202,7 +191,7 @@ export function augmentAst(ast: AugmentedSourceFile, code: string, project: Proj
             }
         }
 
-        if (typeChecker != null && insideConditionalTypes === 0) {
+        if (typeChecker != null) {
             if (isTypedNode(node)) {
                 let contextualType = isContextuallyTypedNode(node)
                     ? typeChecker.getContextualType(node)
diff --git a/javascript/extractor/lib/typescript/src/main.ts b/javascript/extractor/lib/typescript/src/main.ts
index 626c8a593b0..440e621efd2 100644
--- a/javascript/extractor/lib/typescript/src/main.ts
+++ b/javascript/extractor/lib/typescript/src/main.ts
@@ -241,7 +241,7 @@ const astProperties: string[] = [
     "constructor",
     "declarationList",
     "declarations",
-    "decorators",
+    "illegalDecorators",
     "default",
     "delete",
     "dotDotDotToken",
diff --git a/javascript/extractor/lib/typescript/src/type_table.ts b/javascript/extractor/lib/typescript/src/type_table.ts
index 1479d84e5da..9a14db84019 100644
--- a/javascript/extractor/lib/typescript/src/type_table.ts
+++ b/javascript/extractor/lib/typescript/src/type_table.ts
@@ -947,7 +947,7 @@ export class TypeTable {
    * Returns a unique string for the given call/constructor signature.
    */
   private getSignatureString(kind: ts.SignatureKind, signature: AugmentedSignature): string {
-    let modifiers : ts.ModifiersArray = signature.getDeclaration()?.modifiers;
+    let modifiers  = signature.getDeclaration()?.modifiers;
     let isAbstract = modifiers && modifiers.filter(modifier => modifier.kind == ts.SyntaxKind.AbstractKeyword).length > 0
 
     let parameters = signature.getParameters();
diff --git a/javascript/extractor/lib/typescript/yarn.lock b/javascript/extractor/lib/typescript/yarn.lock
index 3a10c8452f0..05fb731c9e4 100644
--- a/javascript/extractor/lib/typescript/yarn.lock
+++ b/javascript/extractor/lib/typescript/yarn.lock
@@ -6,7 +6,7 @@
   version "12.7.11"
   resolved node-12.7.11.tgz#be879b52031cfb5d295b047f5462d8ef1a716446
 
-typescript@4.7.2:
-  version "4.7.2"
-  resolved "https://registry.yarnpkg.com/typescript/-/typescript-4.7.2.tgz#1f9aa2ceb9af87cca227813b4310fff0b51593c4"
-  integrity sha512-Mamb1iX2FDUpcTRzltPxgWMKy3fhg0TN378ylbktPGPK/99KbDtMQ4W1hwgsbPAsG3a0xKa1vmw4VKZQbkvz5A==
+typescript@4.8.2:
+  version "4.8.2"
+  resolved "https://registry.yarnpkg.com/typescript/-/typescript-4.8.2.tgz#e3b33d5ccfb5914e4eeab6699cf208adee3fd790"
+  integrity sha512-C0I1UsrrDHo2fYI5oaCGbSejwX4ch+9Y5jTQELvovfmFkK3HHSZJB8MSJcWLmCUBzQBchCrZ9rMRV6GuNrvGtw==
diff --git a/javascript/extractor/src/com/semmle/js/extractor/Main.java b/javascript/extractor/src/com/semmle/js/extractor/Main.java
index 6ae1e79dc33..50ee6835aeb 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/Main.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/Main.java
@@ -41,7 +41,7 @@ public class Main {
    * A version identifier that should be updated every time the extractor changes in such a way that
    * it may produce different tuples for the same file under the same {@link ExtractorConfig}.
    */
-  public static final String EXTRACTOR_VERSION = "2022-07-11";
+  public static final String EXTRACTOR_VERSION = "2022-08-25";
 
   public static final Pattern NEWLINE = Pattern.compile("\n");
 
diff --git a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
index 9ac0915fc90..1cb1913ee75 100644
--- a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
+++ b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
@@ -976,8 +976,9 @@ public class TypeScriptASTConverter {
             hasDeclareKeyword,
             hasAbstractKeyword);
     attachSymbolInformation(classDecl.getClassDef(), node);
-    if (node.has("decorators")) {
-      classDecl.addDecorators(convertChildren(node, "decorators"));
+    List<Decorator> decorators = getDecorators(node);
+    if (!decorators.isEmpty()) {
+      classDecl.addDecorators(decorators);
       advanceUntilAfter(loc, classDecl.getDecorators());
     }
     Node exportedDecl = fixExports(loc, classDecl);
@@ -989,6 +990,17 @@ public class TypeScriptASTConverter {
     return exportedDecl;
   }
 
+  List<Decorator> getDecorators(JsonObject node) throws ParseError {
+    List<Decorator> result = new ArrayList<>();
+    for (JsonElement elt : getChildIterable(node, "modifiers")) {
+      JsonObject modifier = elt.getAsJsonObject();
+      if (hasKind(modifier, "Decorator")) {
+        result.add((Decorator) convertNode(modifier));
+      }
+    }
+    return result;
+  }
+
   private Node convertCommaListExpression(JsonObject node, SourceLocation loc) throws ParseError {
     return new SequenceExpression(loc, convertChildren(node, "elements"));
   }
@@ -1041,7 +1053,7 @@ public class TypeScriptASTConverter {
   private List<DecoratorList> convertParameterDecorators(JsonObject function) throws ParseError {
     List<DecoratorList> decoratorLists = new ArrayList<>();
     for (JsonElement parameter : getProperParameters(function)) {
-      decoratorLists.add(makeDecoratorList(parameter.getAsJsonObject().get("decorators")));
+      decoratorLists.add(makeDecoratorList(parameter.getAsJsonObject().get("modifiers")));
     }
     return decoratorLists;
   }
@@ -1139,7 +1151,7 @@ public class TypeScriptASTConverter {
             loc,
             hasModifier(node, "ConstKeyword"),
             hasModifier(node, "DeclareKeyword"),
-            convertChildrenNotNull(node, "decorators"),
+            convertChildrenNotNull(node, "illegalDecorators"), // as of https://github.com/microsoft/TypeScript/pull/50343/ the property is called `illegalDecorators` instead of `decorators`
             convertChild(node, "name"),
             convertChildren(node, "members"));
     attachSymbolInformation(enumDeclaration, node);
@@ -1664,8 +1676,9 @@ public class TypeScriptASTConverter {
     FunctionExpression method = convertImplicitFunction(node, loc);
     MethodDefinition methodDefinition =
         new MethodDefinition(loc, flags, methodKind, convertChild(node, "name"), method);
-    if (node.has("decorators")) {
-      methodDefinition.addDecorators(convertChildren(node, "decorators"));
+    List<Decorator> decorators = getDecorators(node);
+    if (!decorators.isEmpty()) {
+      methodDefinition.addDecorators(decorators);
       advanceUntilAfter(loc, methodDefinition.getDecorators());
     }
     return methodDefinition;
@@ -2079,8 +2092,9 @@ public class TypeScriptASTConverter {
             convertChild(node, "name"),
             convertChild(node, "initializer"),
             convertChildAsType(node, "type"));
-    if (node.has("decorators")) {
-      fieldDefinition.addDecorators(convertChildren(node, "decorators"));
+    List<Decorator> decorators = getDecorators(node);
+    if (!decorators.isEmpty()) {
+      fieldDefinition.addDecorators(decorators);
       advanceUntilAfter(loc, fieldDefinition.getDecorators());
     }
     return fieldDefinition;
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/CoreKnowledge.qll b/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/CoreKnowledge.qll
index cba8fc8fab7..e569fb3dc96 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/CoreKnowledge.qll
+++ b/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/CoreKnowledge.qll
@@ -175,7 +175,7 @@ predicate isOtherModeledArgument(DataFlow::Node n, FilteringReason reason) {
   or
   n instanceof CryptographicKey and reason instanceof CryptographicKeyReason
   or
-  any(CryptographicOperation op).getInput().flow() = n and
+  any(CryptographicOperation op).getInput() = n and
   reason instanceof CryptographicOperationFlowReason
   or
   exists(DataFlow::CallNode call | n = call.getAnArgument() |
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll b/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll
index f146f569684..f0ec79df0cf 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll
+++ b/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll
@@ -144,7 +144,7 @@ private module AccessPaths {
       not param = base.getReceiver()
     |
       result = param and
-      name = param.asSource().asExpr().(Parameter).getName()
+      name = param.asSource().(DataFlow::ParameterNode).getName()
       or
       param.asSource().asExpr() instanceof DestructuringPattern and
       result = param.getMember(name)
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/NosqlInjectionATM.qll b/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/NosqlInjectionATM.qll
index 2f84c558f3a..ed1da2dc38b 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/NosqlInjectionATM.qll
+++ b/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/NosqlInjectionATM.qll
@@ -42,10 +42,10 @@ module SinkEndpointFilter {
       result = "modeled database access"
       or
       // Remove calls to APIs that aren't relevant to NoSQL injection
-      call.getReceiver().asExpr() instanceof HTTP::RequestExpr and
+      call.getReceiver() instanceof Http::RequestNode and
       result = "receiver is a HTTP request expression"
       or
-      call.getReceiver().asExpr() instanceof HTTP::ResponseExpr and
+      call.getReceiver() instanceof Http::ResponseNode and
       result = "receiver is a HTTP response expression"
     )
     or
@@ -115,7 +115,7 @@ predicate isBaseAdditionalFlowStep(
   inlbl = TaintedObject::label() and
   outlbl = TaintedObject::label() and
   exists(NoSql::Query query, DataFlow::SourceNode queryObj |
-    queryObj.flowsToExpr(query) and
+    queryObj.flowsTo(query) and
     queryObj.flowsTo(trg) and
     src = queryObj.getAPropertyWrite().getRhs()
   )
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml b/javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml
index 99c1030e053..b437e4de0ba 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml
+++ b/javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/javascript-experimental-atm-lib
-version: 0.3.2
+version: 0.3.4
 extractor: javascript
 library: true
 groups:
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/DebugResultInclusion.ql b/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/DebugResultInclusion.ql
index 215103358ea..28a95268a57 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/DebugResultInclusion.ql
+++ b/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/DebugResultInclusion.ql
@@ -15,16 +15,16 @@ import extraction.ExtractEndpointData
 
 string getAReasonSinkExcluded(DataFlow::Node sinkCandidate, Query query) {
   query instanceof NosqlInjectionQuery and
-  result = NosqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(sinkCandidate)
+  result = NosqlInjectionAtm::SinkEndpointFilter::getAReasonSinkExcluded(sinkCandidate)
   or
   query instanceof SqlInjectionQuery and
-  result = SqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(sinkCandidate)
+  result = SqlInjectionAtm::SinkEndpointFilter::getAReasonSinkExcluded(sinkCandidate)
   or
   query instanceof TaintedPathQuery and
-  result = TaintedPathATM::SinkEndpointFilter::getAReasonSinkExcluded(sinkCandidate)
+  result = TaintedPathAtm::SinkEndpointFilter::getAReasonSinkExcluded(sinkCandidate)
   or
   query instanceof XssQuery and
-  result = XssATM::SinkEndpointFilter::getAReasonSinkExcluded(sinkCandidate)
+  result = XssAtm::SinkEndpointFilter::getAReasonSinkExcluded(sinkCandidate)
 }
 
 pragma[inline]
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointData.qll b/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointData.qll
index 53d559d2568..af91933b7a4 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointData.qll
+++ b/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointData.qll
@@ -14,10 +14,26 @@ import experimental.adaptivethreatmodeling.EndpointFeatures as EndpointFeatures
 import experimental.adaptivethreatmodeling.EndpointScoring as EndpointScoring
 import experimental.adaptivethreatmodeling.EndpointTypes
 import experimental.adaptivethreatmodeling.FilteringReasons
-import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionATM
-import experimental.adaptivethreatmodeling.SqlInjectionATM as SqlInjectionATM
-import experimental.adaptivethreatmodeling.TaintedPathATM as TaintedPathATM
-import experimental.adaptivethreatmodeling.XssATM as XssATM
+import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionAtm
+
+/** DEPRECATED: Alias for NosqlInjectionAtm */
+deprecated module NosqlInjectionATM = NosqlInjectionAtm;
+
+import experimental.adaptivethreatmodeling.SqlInjectionATM as SqlInjectionAtm
+
+/** DEPRECATED: Alias for SqlInjectionAtm */
+deprecated module SqlInjectionATM = SqlInjectionAtm;
+
+import experimental.adaptivethreatmodeling.TaintedPathATM as TaintedPathAtm
+
+/** DEPRECATED: Alias for TaintedPathAtm */
+deprecated module TaintedPathATM = TaintedPathAtm;
+
+import experimental.adaptivethreatmodeling.XssATM as XssAtm
+
+/** DEPRECATED: Alias for XssAtm */
+deprecated module XssATM = XssAtm;
+
 import Labels
 import NoFeaturizationRestrictionsConfig
 import Queries
@@ -25,13 +41,13 @@ import Queries
 /** Gets the ATM configuration object for the specified query. */
 AtmConfig getAtmCfg(Query query) {
   query instanceof NosqlInjectionQuery and
-  result instanceof NosqlInjectionATM::NosqlInjectionAtmConfig
+  result instanceof NosqlInjectionAtm::NosqlInjectionAtmConfig
   or
-  query instanceof SqlInjectionQuery and result instanceof SqlInjectionATM::SqlInjectionAtmConfig
+  query instanceof SqlInjectionQuery and result instanceof SqlInjectionAtm::SqlInjectionAtmConfig
   or
-  query instanceof TaintedPathQuery and result instanceof TaintedPathATM::TaintedPathAtmConfig
+  query instanceof TaintedPathQuery and result instanceof TaintedPathAtm::TaintedPathAtmConfig
   or
-  query instanceof XssQuery and result instanceof XssATM::DomBasedXssAtmConfig
+  query instanceof XssQuery and result instanceof XssAtm::DomBasedXssAtmConfig
 }
 
 /** DEPRECATED: Alias for getAtmCfg */
@@ -39,13 +55,13 @@ deprecated ATMConfig getATMCfg(Query query) { result = getAtmCfg(query) }
 
 /** Gets the ATM data flow configuration for the specified query. */
 DataFlow::Configuration getDataFlowCfg(Query query) {
-  query instanceof NosqlInjectionQuery and result instanceof NosqlInjectionATM::Configuration
+  query instanceof NosqlInjectionQuery and result instanceof NosqlInjectionAtm::Configuration
   or
-  query instanceof SqlInjectionQuery and result instanceof SqlInjectionATM::Configuration
+  query instanceof SqlInjectionQuery and result instanceof SqlInjectionAtm::Configuration
   or
-  query instanceof TaintedPathQuery and result instanceof TaintedPathATM::Configuration
+  query instanceof TaintedPathQuery and result instanceof TaintedPathAtm::Configuration
   or
-  query instanceof XssQuery and result instanceof XssATM::Configuration
+  query instanceof XssQuery and result instanceof XssAtm::Configuration
 }
 
 /** Gets a known sink for the specified query. */
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointMapping.ql b/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointMapping.ql
index 11986562085..697928d74b0 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointMapping.ql
+++ b/javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/extraction/ExtractEndpointMapping.ql
@@ -4,25 +4,25 @@
  * Maps ML-powered queries to their `EndpointType` for clearer labelling while evaluating ML model during training.
  */
 
-import experimental.adaptivethreatmodeling.SqlInjectionATM as SqlInjectionATM
-import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionATM
-import experimental.adaptivethreatmodeling.TaintedPathATM as TaintedPathATM
-import experimental.adaptivethreatmodeling.XssATM as XssATM
+import experimental.adaptivethreatmodeling.SqlInjectionATM as SqlInjectionAtm
+import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionAtm
+import experimental.adaptivethreatmodeling.TaintedPathATM as TaintedPathAtm
+import experimental.adaptivethreatmodeling.XssATM as XssAtm
 import experimental.adaptivethreatmodeling.AdaptiveThreatModeling
 
 from string queryName, AtmConfig c, EndpointType e
 where
   (
     queryName = "SqlInjection" and
-    c instanceof SqlInjectionATM::SqlInjectionAtmConfig
+    c instanceof SqlInjectionAtm::SqlInjectionAtmConfig
     or
     queryName = "NosqlInjection" and
-    c instanceof NosqlInjectionATM::NosqlInjectionAtmConfig
+    c instanceof NosqlInjectionAtm::NosqlInjectionAtmConfig
     or
     queryName = "TaintedPath" and
-    c instanceof TaintedPathATM::TaintedPathAtmConfig
+    c instanceof TaintedPathAtm::TaintedPathAtmConfig
     or
-    queryName = "Xss" and c instanceof XssATM::DomBasedXssAtmConfig
+    queryName = "Xss" and c instanceof XssAtm::DomBasedXssAtmConfig
   ) and
   e = c.getASinkEndpointType()
 select queryName, e.getEncoding() as label
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml b/javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml
index a034ce1aa7f..0942785b20a 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml
+++ b/javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml
@@ -1,6 +1,6 @@
 name: codeql/javascript-experimental-atm-queries
 language: javascript
-version: 0.3.2
+version: 0.3.4
 suites: codeql-suites
 defaultSuiteFile: codeql-suites/javascript-atm-code-scanning.qls
 groups:
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/EndpointFeatures.ql b/javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/EndpointFeatures.ql
index ab0191c5129..9985625d85c 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/EndpointFeatures.ql
+++ b/javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/EndpointFeatures.ql
@@ -7,20 +7,20 @@
  */
 
 import javascript
-import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionATM
-import experimental.adaptivethreatmodeling.SqlInjectionATM as SqlInjectionATM
-import experimental.adaptivethreatmodeling.TaintedPathATM as TaintedPathATM
-import experimental.adaptivethreatmodeling.XssATM as XssATM
+import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionAtm
+import experimental.adaptivethreatmodeling.SqlInjectionATM as SqlInjectionAtm
+import experimental.adaptivethreatmodeling.TaintedPathATM as TaintedPathAtm
+import experimental.adaptivethreatmodeling.XssATM as XssAtm
 import experimental.adaptivethreatmodeling.EndpointFeatures as EndpointFeatures
 import experimental.adaptivethreatmodeling.StandardEndpointFilters as StandardEndpointFilters
 import extraction.NoFeaturizationRestrictionsConfig
 
 query predicate tokenFeatures(DataFlow::Node endpoint, string featureName, string featureValue) {
   (
-    not exists(NosqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
-    not exists(SqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
-    not exists(TaintedPathATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
-    not exists(XssATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
+    not exists(NosqlInjectionAtm::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
+    not exists(SqlInjectionAtm::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
+    not exists(TaintedPathAtm::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
+    not exists(XssAtm::SinkEndpointFilter::getAReasonSinkExcluded(endpoint)) or
     StandardEndpointFilters::isArgumentToModeledFunction(endpoint)
   ) and
   EndpointFeatures::tokenFeatures(endpoint, featureName, featureValue)
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/FilteredTruePositives.ql b/javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/FilteredTruePositives.ql
index 9edae6cec5e..8ae82446403 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/FilteredTruePositives.ql
+++ b/javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/FilteredTruePositives.ql
@@ -17,31 +17,31 @@ import semmle.javascript.security.dataflow.SqlInjectionCustomizations
 import semmle.javascript.security.dataflow.TaintedPathCustomizations
 import semmle.javascript.security.dataflow.DomBasedXssCustomizations
 import experimental.adaptivethreatmodeling.StandardEndpointFilters as StandardEndpointFilters
-import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionATM
-import experimental.adaptivethreatmodeling.SqlInjectionATM as SqlInjectionATM
-import experimental.adaptivethreatmodeling.TaintedPathATM as TaintedPathATM
-import experimental.adaptivethreatmodeling.XssATM as XssATM
+import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionAtm
+import experimental.adaptivethreatmodeling.SqlInjectionATM as SqlInjectionAtm
+import experimental.adaptivethreatmodeling.TaintedPathATM as TaintedPathAtm
+import experimental.adaptivethreatmodeling.XssATM as XssAtm
 
 query predicate nosqlFilteredTruePositives(DataFlow::Node endpoint, string reason) {
   endpoint instanceof NosqlInjection::Sink and
-  reason = NosqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
+  reason = NosqlInjectionAtm::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
   not reason = ["argument to modeled function", "modeled sink", "modeled database access"]
 }
 
 query predicate sqlFilteredTruePositives(DataFlow::Node endpoint, string reason) {
   endpoint instanceof SqlInjection::Sink and
-  reason = SqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
+  reason = SqlInjectionAtm::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
   reason != "argument to modeled function"
 }
 
 query predicate taintedPathFilteredTruePositives(DataFlow::Node endpoint, string reason) {
   endpoint instanceof TaintedPath::Sink and
-  reason = TaintedPathATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
+  reason = TaintedPathAtm::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
   reason != "argument to modeled function"
 }
 
 query predicate xssFilteredTruePositives(DataFlow::Node endpoint, string reason) {
   endpoint instanceof DomBasedXss::Sink and
-  reason = XssATM::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
+  reason = XssAtm::SinkEndpointFilter::getAReasonSinkExcluded(endpoint) and
   reason != "argument to modeled function"
 }
diff --git a/javascript/ql/experimental/adaptivethreatmodeling/test/modeled_apis/nosql_endpoint_filter_ignores_modeled_apis.ql b/javascript/ql/experimental/adaptivethreatmodeling/test/modeled_apis/nosql_endpoint_filter_ignores_modeled_apis.ql
index 566a2bb98b8..9a81ce73d91 100644
--- a/javascript/ql/experimental/adaptivethreatmodeling/test/modeled_apis/nosql_endpoint_filter_ignores_modeled_apis.ql
+++ b/javascript/ql/experimental/adaptivethreatmodeling/test/modeled_apis/nosql_endpoint_filter_ignores_modeled_apis.ql
@@ -1,6 +1,6 @@
 import javascript
-import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionATM
+import experimental.adaptivethreatmodeling.NosqlInjectionATM as NosqlInjectionAtm
 
 query predicate effectiveSinks(DataFlow::Node node) {
-  not exists(NosqlInjectionATM::SinkEndpointFilter::getAReasonSinkExcluded(node))
+  not exists(NosqlInjectionAtm::SinkEndpointFilter::getAReasonSinkExcluded(node))
 }
diff --git a/javascript/ql/lib/change-notes/2022-04-04-dataflow-models.md b/javascript/ql/lib/change-notes/2022-04-04-dataflow-models.md
new file mode 100644
index 00000000000..4a454f51b20
--- /dev/null
+++ b/javascript/ql/lib/change-notes/2022-04-04-dataflow-models.md
@@ -0,0 +1,57 @@
+---
+category: breaking
+---
+* Many library models have been rewritten to use dataflow nodes instead of the AST.
+  The types of some classes have been changed, and these changes may break existing code.
+  Other classes and predicates have been renamed, in these cases the old name is still available as a deprecated feature.
+
+* The basetype of the following list of classes has changed from an expression to a dataflow node, and thus code using these classes might break. 
+  The fix to these breakages is usually to use `asExpr()` to get an expression from a dataflow node, or to use `.flow()` to get a dataflow node from an expression.  
+   - DOM.qll#WebStorageWrite
+   - CryptoLibraries.qll#CryptographicOperation
+   - Express.qll#Express::RequestBodyAccess
+   - HTTP.qll#HTTP::ResponseBody
+   - HTTP.qll#HTTP::CookieDefinition
+   - HTTP.qll#HTTP::ServerDefinition
+   - HTTP.qll#HTTP::RouteSetup
+   - NoSQL.qll#NoSql::Query
+   - SQL.qll#SQL::SqlString
+   - SQL.qll#SQL::SqlSanitizer
+   - HTTP.qll#ResponseBody
+   - HTTP.qll#CookieDefinition
+   - HTTP.qll#ServerDefinition
+   - HTTP.qll#RouteSetup
+   - HTTP.qll#HTTP::RedirectInvocation
+   - HTTP.qll#RedirectInvocation
+   - Express.qll#Express::RouterDefinition
+   - AngularJSCore.qll#LinkFunction
+   - Connect.qll#Connect::StandardRouteHandler
+   - CryptoLibraries.qll#CryptographicKeyCredentialsExpr
+   - AWS.qll#AWS::Credentials
+   - Azure.qll#Azure::Credentials
+   - Connect.qll#Connect::Credentials
+   - DigitalOcean.qll#DigitalOcean::Credentials
+   - Express.qll#Express::Credentials
+   - NodeJSLib.qll#NodeJSLib::Credentials
+   - PkgCloud.qll#PkgCloud::Credentials
+   - Request.qll#Request::Credentials
+   - ServiceDefinitions.qll#InjectableFunctionServiceRequest
+   - SensitiveActions.qll#SensitiveVariableAccess
+   - SensitiveActions.qll#CleartextPasswordExpr
+   - Connect.qll#Connect::ServerDefinition
+   - Restify.qll#Restify::ServerDefinition
+   - Connect.qll#Connect::RouteSetup
+   - Express.qll#Express::RouteSetup
+   - Fastify.qll#Fastify::RouteSetup
+   - Hapi.qll#Hapi::RouteSetup
+   - Koa.qll#Koa::RouteSetup
+   - Restify.qll#Restify::RouteSetup
+   - NodeJSLib.qll#NodeJSLib::RouteSetup
+   - Express.qll#Express::StandardRouteHandler
+   - Express.qll#Express::SetCookie
+   - Hapi.qll#Hapi::RouteHandler
+   - HTTP.qll#HTTP::Servers::StandardHeaderDefinition
+   - HTTP.qll#Servers::StandardHeaderDefinition
+   - Hapi.qll#Hapi::ServerDefinition
+   - Koa.qll#Koa::AppDefinition
+   - SensitiveActions.qll#SensitiveCall
\ No newline at end of file
diff --git a/javascript/ql/lib/change-notes/2022-05-24-typescript-4-8.md b/javascript/ql/lib/change-notes/2022-05-24-typescript-4-8.md
new file mode 100644
index 00000000000..28b73b84d1b
--- /dev/null
+++ b/javascript/ql/lib/change-notes/2022-05-24-typescript-4-8.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Added support for TypeScript 4.8.
\ No newline at end of file
diff --git a/javascript/ql/lib/change-notes/2022-08-09-mermaid.md b/javascript/ql/lib/change-notes/2022-08-09-mermaid.md
new file mode 100644
index 00000000000..4e8d9f6677b
--- /dev/null
+++ b/javascript/ql/lib/change-notes/2022-08-09-mermaid.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* A model for the `mermaid` library has been added. XSS queries can now detect flow through the `render` method of the `mermaid` library. 
\ No newline at end of file
diff --git a/javascript/ql/lib/change-notes/2022-09-12-uppercase.md b/javascript/ql/lib/change-notes/2022-09-12-uppercase.md
new file mode 100644
index 00000000000..996861f1c2c
--- /dev/null
+++ b/javascript/ql/lib/change-notes/2022-09-12-uppercase.md
@@ -0,0 +1,5 @@
+---
+category: deprecated
+---
+* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
+  The old name still exists as a deprecated alias.
\ No newline at end of file
diff --git a/javascript/ql/lib/semmle/javascript/Actions.qll b/javascript/ql/lib/semmle/javascript/Actions.qll
index 8ea789c96e0..d79bb6eff4a 100644
--- a/javascript/ql/lib/semmle/javascript/Actions.qll
+++ b/javascript/ql/lib/semmle/javascript/Actions.qll
@@ -11,7 +11,7 @@ import javascript
  */
 module Actions {
   /** A YAML node in a GitHub Actions workflow file. */
-  private class Node extends YAMLNode {
+  private class Node extends YamlNode {
     Node() {
       this.getLocation()
           .getFile()
@@ -24,12 +24,12 @@ module Actions {
    * An Actions workflow. This is a mapping at the top level of an Actions YAML workflow file.
    * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
    */
-  class Workflow extends Node, YAMLDocument, YAMLMapping {
+  class Workflow extends Node, YamlDocument, YamlMapping {
     /** Gets the `jobs` mapping from job IDs to job definitions in this workflow. */
-    YAMLMapping getJobs() { result = this.lookup("jobs") }
+    YamlMapping getJobs() { result = this.lookup("jobs") }
 
     /** Gets the name of the workflow. */
-    string getName() { result = this.lookup("name").(YAMLString).getValue() }
+    string getName() { result = this.lookup("name").(YamlString).getValue() }
 
     /** Gets the name of the workflow file. */
     string getFileName() { result = this.getFile().getBaseName() }
@@ -45,7 +45,7 @@ module Actions {
    * An Actions On trigger within a workflow.
    * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#on.
    */
-  class On extends YAMLNode, YAMLMappingLikeNode {
+  class On extends YamlNode, YamlMappingLikeNode {
     Workflow workflow;
 
     On() { workflow.lookup("on") = this }
@@ -58,7 +58,7 @@ module Actions {
    * An Actions job within a workflow.
    * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobs.
    */
-  class Job extends YAMLNode, YAMLMapping {
+  class Job extends YamlNode, YamlMapping {
     string jobId;
     Workflow workflow;
 
@@ -74,19 +74,19 @@ module Actions {
      * Gets the ID of this job, as a YAML scalar node.
      * This is the job's key within the `jobs` mapping.
      */
-    YAMLString getIdNode() { workflow.getJobs().maps(result, this) }
+    YamlString getIdNode() { workflow.getJobs().maps(result, this) }
 
     /** Gets the human-readable name of this job, if any, as a string. */
     string getName() { result = this.getNameNode().getValue() }
 
     /** Gets the human-readable name of this job, if any, as a YAML scalar node. */
-    YAMLString getNameNode() { result = this.lookup("name") }
+    YamlString getNameNode() { result = this.lookup("name") }
 
     /** Gets the step at the given index within this job. */
     Step getStep(int index) { result.getJob() = this and result.getIndex() = index }
 
     /** Gets the sequence of `steps` within this job. */
-    YAMLSequence getSteps() { result = this.lookup("steps") }
+    YamlSequence getSteps() { result = this.lookup("steps") }
 
     /** Gets the workflow this job belongs to. */
     Workflow getWorkflow() { result = workflow }
@@ -99,7 +99,7 @@ module Actions {
    * An `if` within a job.
    * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idif.
    */
-  class JobIf extends YAMLNode, YAMLScalar {
+  class JobIf extends YamlNode, YamlScalar {
     Job job;
 
     JobIf() { job.lookup("if") = this }
@@ -112,7 +112,7 @@ module Actions {
    * A step within an Actions job.
    * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsteps.
    */
-  class Step extends YAMLNode, YAMLMapping {
+  class Step extends YamlNode, YamlMapping {
     int index;
     Job job;
 
@@ -134,14 +134,14 @@ module Actions {
     StepIf getIf() { result.getStep() = this }
 
     /** Gets the ID of this step, if any. */
-    string getId() { result = this.lookup("id").(YAMLString).getValue() }
+    string getId() { result = this.lookup("id").(YamlString).getValue() }
   }
 
   /**
    * An `if` within a step.
    * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsif.
    */
-  class StepIf extends YAMLNode, YAMLScalar {
+  class StepIf extends YamlNode, YamlScalar {
     Step step;
 
     StepIf() { step.lookup("if") = this }
@@ -170,7 +170,7 @@ module Actions {
    *
    * Does not handle local repository references, e.g. `.github/actions/action-name`.
    */
-  class Uses extends YAMLNode, YAMLScalar {
+  class Uses extends YamlNode, YamlScalar {
     Step step;
 
     Uses() { step.lookup("uses") = this }
@@ -200,7 +200,7 @@ module Actions {
    *   arg2: abc
    * ```
    */
-  class With extends YAMLNode, YAMLMapping {
+  class With extends YamlNode, YamlMapping {
     Step step;
 
     With() { step.lookup("with") = this }
@@ -219,7 +219,7 @@ module Actions {
    *   ref: ${{ github.event.pull_request.head.sha }}
    * ```
    */
-  class Ref extends YAMLNode, YAMLString {
+  class Ref extends YamlNode, YamlString {
     With with;
 
     Ref() { with.lookup("ref") = this }
@@ -232,7 +232,7 @@ module Actions {
    * A `run` field within an Actions job step, which runs command-line programs using an operating system shell.
    * See https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun.
    */
-  class Run extends YAMLNode, YAMLString {
+  class Run extends YamlNode, YamlString {
     Step step;
 
     Run() { step.lookup("run") = this }
diff --git a/javascript/ql/lib/semmle/javascript/ApiGraphs.qll b/javascript/ql/lib/semmle/javascript/ApiGraphs.qll
index 205ff21d1fd..72d5a50cebe 100644
--- a/javascript/ql/lib/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/lib/semmle/javascript/ApiGraphs.qll
@@ -533,8 +533,9 @@ module API {
 
   /** Gets a node corresponding to an import of module `m`. */
   Node moduleImport(string m) {
-    result = Impl::MkModuleImport(m) or
-    result = Impl::MkModuleImport(m).(Node).getMember("default")
+    result = Internal::getAModuleImportRaw(m)
+    or
+    result = ModelOutput::getATypeNode(m, "")
   }
 
   /** Gets a node corresponding to an export of module `m`. */
@@ -544,6 +545,22 @@ module API {
   module Node {
     /** Gets a node whose type has the given qualified name. */
     Node ofType(string moduleName, string exportedName) {
+      result = Internal::getANodeOfTypeRaw(moduleName, exportedName)
+      or
+      result = ModelOutput::getATypeNode(moduleName, exportedName)
+    }
+  }
+
+  /** Provides access to API graph nodes without taking into account types from models. */
+  module Internal {
+    /** Gets a node corresponding to an import of module `m` without taking into account types from models. */
+    Node getAModuleImportRaw(string m) {
+      result = Impl::MkModuleImport(m) or
+      result = Impl::MkModuleImport(m).(Node).getMember("default")
+    }
+
+    /** Gets a node whose type has the given qualified name, not including types from models. */
+    Node getANodeOfTypeRaw(string moduleName, string exportedName) {
       result = Impl::MkTypeUse(moduleName, exportedName).(Node).getInstance()
     }
   }
@@ -635,7 +652,7 @@ module API {
           exports(m, _, _)
           or
           exists(NodeModule nm | nm = mod |
-            exists(SSA::implicitInit([nm.getModuleVariable(), nm.getExportsVariable()]))
+            exists(Ssa::implicitInit([nm.getModuleVariable(), nm.getExportsVariable()]))
           )
         )
       } or
@@ -646,7 +663,14 @@ module API {
         or
         any(Type t).hasUnderlyingType(m, _)
       } or
-      MkClassInstance(DataFlow::ClassNode cls) { cls = trackDefNode(_) and hasSemantics(cls) } or
+      MkClassInstance(DataFlow::ClassNode cls) {
+        hasSemantics(cls) and
+        (
+          cls = trackDefNode(_)
+          or
+          cls.getAnInstanceReference() = trackDefNode(_)
+        )
+      } or
       MkAsyncFuncResult(DataFlow::FunctionNode f) {
         f = trackDefNode(_) and f.getFunction().isAsync() and hasSemantics(f)
       } or
@@ -738,16 +762,6 @@ module API {
                   .getStaticMember(name, DataFlow::MemberKind::getter())
                   .getAReturn()
           )
-          or
-          // If `new C()` escapes, generate edges to its instance members
-          exists(DataFlow::ClassNode cls, string name |
-            pred = cls.getAClassReference().getAnInstantiation() and
-            lbl = Label::member(name)
-          |
-            rhs = cls.getInstanceMethod(name)
-            or
-            rhs = cls.getInstanceMember(name, DataFlow::MemberKind::getter()).getAReturn()
-          )
         )
         or
         exists(DataFlow::ClassNode cls, string name |
@@ -1236,9 +1250,13 @@ module API {
         succ = MkUse(ref)
       )
       or
-      exists(DataFlow::Node rhs |
-        rhs(pred, lbl, rhs) and
+      exists(DataFlow::Node rhs | rhs(pred, lbl, rhs) |
         succ = MkDef(rhs)
+        or
+        exists(DataFlow::ClassNode cls |
+          cls.getAnInstanceReference() = rhs and
+          succ = MkClassInstance(cls)
+        )
       )
       or
       exists(DataFlow::Node def |
@@ -1477,7 +1495,7 @@ module API {
         /** Gets the EntryPoint associated with this label. */
         API::EntryPoint getEntryPoint() { result = e }
 
-        override string toString() { result = "getASuccessor(Label::entryPoint(\"" + e + "\"))" }
+        override string toString() { result = "entryPoint(\"" + e + "\")" }
       }
 
       /** A label that gets a promised value. */
diff --git a/javascript/ql/lib/semmle/javascript/Classes.qll b/javascript/ql/lib/semmle/javascript/Classes.qll
index 23dc738345d..c7ad74561bb 100644
--- a/javascript/ql/lib/semmle/javascript/Classes.qll
+++ b/javascript/ql/lib/semmle/javascript/Classes.qll
@@ -493,6 +493,9 @@ class MemberDeclaration extends @property, Documentable {
    */
   predicate isStatic() { is_static(this) }
 
+  /** Gets a boolean indicating if this member is static. */
+  boolean getStaticAsBool() { if this.isStatic() then result = true else result = false }
+
   /**
    * Holds if this member is abstract.
    *
@@ -694,10 +697,10 @@ class MethodDeclaration extends MemberDeclaration {
    * the overload index is defined as if only one of them was concrete.
    */
   int getOverloadIndex() {
-    exists(ClassOrInterface type, string name |
+    exists(ClassOrInterface type, string name, boolean static |
       this =
         rank[result + 1](MethodDeclaration method, int i |
-          methodDeclaredInType(type, name, i, method)
+          methodDeclaredInType(type, name, static, i, method)
         |
           method order by i
         )
@@ -718,10 +721,11 @@ class MethodDeclaration extends MemberDeclaration {
  * Holds if the `index`th member of `type` is `method`, which has the given `name`.
  */
 private predicate methodDeclaredInType(
-  ClassOrInterface type, string name, int index, MethodDeclaration method
+  ClassOrInterface type, string name, boolean static, int index, MethodDeclaration method
 ) {
   not method instanceof ConstructorDeclaration and // distinguish methods named "constructor" from the constructor
   type.getMemberByIndex(index) = method and
+  static = method.getStaticAsBool() and
   method.getName() = name
 }
 
diff --git a/javascript/ql/lib/semmle/javascript/Expr.qll b/javascript/ql/lib/semmle/javascript/Expr.qll
index 7db74458bdf..3676077e024 100644
--- a/javascript/ql/lib/semmle/javascript/Expr.qll
+++ b/javascript/ql/lib/semmle/javascript/Expr.qll
@@ -167,7 +167,7 @@ class Expr extends @expr, ExprOrStmt, ExprOrType, AST::ValueNode {
   /**
    * Holds if this expression may refer to the initial value of parameter `p`.
    */
-  predicate mayReferToParameter(Parameter p) { this.flow().mayReferToParameter(p) }
+  predicate mayReferToParameter(Parameter p) { DataFlow::parameterNode(p).flowsToExpr(this) }
 
   /**
    * Gets the static type of this expression, as determined by the TypeScript type system.
diff --git a/javascript/ql/lib/semmle/javascript/GeneratedCode.qll b/javascript/ql/lib/semmle/javascript/GeneratedCode.qll
index 016875ff8d4..8dd53402205 100644
--- a/javascript/ql/lib/semmle/javascript/GeneratedCode.qll
+++ b/javascript/ql/lib/semmle/javascript/GeneratedCode.qll
@@ -178,7 +178,7 @@ predicate isGeneratedFileName(File f) {
 predicate isGenerated(TopLevel tl) {
   tl.isMinified() or
   isBundle(tl) or
-  tl instanceof GWTGeneratedTopLevel or
+  tl instanceof GwtGeneratedTopLevel or
   tl instanceof DartGeneratedTopLevel or
   exists(GeneratedCodeMarkerComment gcmc | tl = gcmc.getTopLevel()) or
   hasManyInvocations(tl) or
diff --git a/javascript/ql/lib/semmle/javascript/JsonStringifiers.qll b/javascript/ql/lib/semmle/javascript/JsonStringifiers.qll
index f4cdda89e31..f4c2a846ed8 100644
--- a/javascript/ql/lib/semmle/javascript/JsonStringifiers.qll
+++ b/javascript/ql/lib/semmle/javascript/JsonStringifiers.qll
@@ -43,7 +43,7 @@ class JsonStringifyCall extends DataFlow::CallNode {
 /**
  * A taint step through the [`json2csv`](https://www.npmjs.com/package/json2csv) library.
  */
-class JSON2CSVTaintStep extends TaintTracking::SharedTaintStep {
+class Json2CsvTaintStep extends TaintTracking::SharedTaintStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
     exists(API::CallNode call |
       call =
@@ -59,6 +59,9 @@ class JSON2CSVTaintStep extends TaintTracking::SharedTaintStep {
   }
 }
 
+/** DEPRECATED: Alias for Json2CsvTaintStep */
+deprecated class JSON2CSVTaintStep = Json2CsvTaintStep;
+
 /**
  * A step through the [`prettyjson`](https://www.npmjs.com/package/prettyjson) library.
  * This is not quite a `JSON.stringify` call, as it e.g. does not wrap keys in double quotes.
diff --git a/javascript/ql/lib/semmle/javascript/NPM.qll b/javascript/ql/lib/semmle/javascript/NPM.qll
index 21d7fa4007f..515e900f277 100644
--- a/javascript/ql/lib/semmle/javascript/NPM.qll
+++ b/javascript/ql/lib/semmle/javascript/NPM.qll
@@ -168,18 +168,24 @@ class PackageJson extends JsonObject {
   JsonArray getCPUs() { result = this.getPropValue("cpu") }
 
   /** Gets a platform supported by this package. */
-  string getWhitelistedCPU() {
+  string getWhitelistedCpu() {
     result = this.getCPUs().getElementStringValue(_) and
     not result.matches("!%")
   }
 
+  /** DEPRECATED: Alias for getWhitelistedCpu */
+  deprecated string getWhitelistedCPU() { result = this.getWhitelistedCpu() }
+
   /** Gets a platform not supported by this package. */
-  string getBlacklistedCPU() {
+  string getBlacklistedCpu() {
     exists(string str | str = this.getCPUs().getElementStringValue(_) |
       result = str.regexpCapture("!(.*)", 1)
     )
   }
 
+  /** DEPRECATED: Alias for getBlacklistedCpu */
+  deprecated string getBlacklistedCPU() { result = this.getBlacklistedCpu() }
+
   /** Holds if this package prefers to be installed globally. */
   predicate isPreferGlobal() { this.getPropValue("preferGlobal").(JsonBoolean).getValue() = "true" }
 
diff --git a/javascript/ql/lib/semmle/javascript/NodeModuleResolutionImpl.qll b/javascript/ql/lib/semmle/javascript/NodeModuleResolutionImpl.qll
index 7660d374216..32c1e453444 100644
--- a/javascript/ql/lib/semmle/javascript/NodeModuleResolutionImpl.qll
+++ b/javascript/ql/lib/semmle/javascript/NodeModuleResolutionImpl.qll
@@ -90,10 +90,11 @@ bindingset[name]
 private string getStem(string name) { result = name.regexpCapture("(.+?)(?:\\.([^.]+))?", 1) }
 
 /**
- * Gets the main module described by `pkg` with the given `priority`.
+ * Gets a file that a main module from `pkg` exported as `mainPath` with the given `priority`.
+ * `mainPath` is "." if it's the main module of the package.
  */
-File resolveMainModule(PackageJson pkg, int priority) {
-  exists(PathExpr main | main = MainModulePath::of(pkg, ".") |
+private File resolveMainPath(PackageJson pkg, string mainPath, int priority) {
+  exists(PathExpr main | main = MainModulePath::of(pkg, mainPath) |
     result = main.resolve() and priority = 0
     or
     result = tryExtensions(main.resolve(), "index", priority)
@@ -102,6 +103,26 @@ File resolveMainModule(PackageJson pkg, int priority) {
     exists(int n | n = main.getNumComponent() |
       result = tryExtensions(main.resolveUpTo(n - 1), getStem(main.getComponent(n - 1)), priority)
     )
+    or
+    // assuming the files get moved from one dir to another during compilation:
+    not exists(main.resolve()) and // didn't resolve
+    count(int i, string comp | comp = main.getComponent(i) and not comp = "." | i) = 2 and // is down one folder
+    exists(Folder subFolder | subFolder = pkg.getFile().getParentContainer().getAFolder() |
+      // is in one folder below the package.json, and has the right basename
+      result =
+        tryExtensions(subFolder, getStem(main.getComponent(main.getNumComponent() - 1)),
+          priority - 999) // very high priority, to make sure everything else is tried first
+    )
+  )
+}
+
+/**
+ * Gets the main module described by `pkg` with the given `priority`.
+ */
+File resolveMainModule(PackageJson pkg, int priority) {
+  exists(int subPriority, string mainPath |
+    result = resolveMainPath(pkg, mainPath, subPriority) and
+    if mainPath = "." then subPriority = priority else priority = subPriority + 1000
   )
   or
   exists(Folder folder, Folder child |
diff --git a/javascript/ql/lib/semmle/javascript/PackageExports.qll b/javascript/ql/lib/semmle/javascript/PackageExports.qll
index 01cd134ff0c..909564f740b 100644
--- a/javascript/ql/lib/semmle/javascript/PackageExports.qll
+++ b/javascript/ql/lib/semmle/javascript/PackageExports.qll
@@ -52,6 +52,16 @@ private DataFlow::Node getAValueExportedByPackage() {
     not isPrivateMethodDeclaration(result)
   )
   or
+  // module.exports.foo = function () {
+  //   return new Foo(); // <- result
+  // };
+  exists(DataFlow::FunctionNode func, DataFlow::NewNode inst, DataFlow::ClassNode clz |
+    func = getAValueExportedByPackage().getALocalSource() and inst = unique( | | func.getAReturn())
+  |
+    clz.getAnInstanceReference() = inst and
+    result = clz.getAnInstanceMember(_)
+  )
+  or
   result = getAValueExportedByPackage().getALocalSource()
   or
   // Nested property reads.
diff --git a/javascript/ql/lib/semmle/javascript/PrintAst.qll b/javascript/ql/lib/semmle/javascript/PrintAst.qll
index 95c722f5402..29b1d619016 100644
--- a/javascript/ql/lib/semmle/javascript/PrintAst.qll
+++ b/javascript/ql/lib/semmle/javascript/PrintAst.qll
@@ -64,8 +64,8 @@ private newtype TPrintAstNode =
   // JSON
   TJsonNode(JsonValue value) { shouldPrint(value, _) and not isNotNeeded(value) } or
   // YAML
-  TYamlNode(YAMLNode n) { shouldPrint(n, _) and not isNotNeeded(n) } or
-  TYamlMappingNode(YAMLMapping mapping, int i) {
+  TYamlNode(YamlNode n) { shouldPrint(n, _) and not isNotNeeded(n) } or
+  TYamlMappingNode(YamlMapping mapping, int i) {
     shouldPrint(mapping, _) and not isNotNeeded(mapping) and exists(mapping.getKeyNode(i))
   } or
   // HTML
@@ -628,7 +628,7 @@ module PrintYaml {
    * A print node representing a YAML value in a .yml file.
    */
   class YamlNodeNode extends PrintAstNode, TYamlNode {
-    YAMLNode node;
+    YamlNode node;
 
     YamlNodeNode() { this = TYamlNode(node) }
 
@@ -639,10 +639,10 @@ module PrintYaml {
     /**
      * Gets the `YAMLNode` represented by this node.
      */
-    final YAMLNode getValue() { result = node }
+    final YamlNode getValue() { result = node }
 
     override PrintAstNode getChild(int childIndex) {
-      exists(YAMLNode child | result.(YamlNodeNode).getValue() = child |
+      exists(YamlNode child | result.(YamlNodeNode).getValue() = child |
         child = node.getChildNode(childIndex)
       )
     }
@@ -657,7 +657,7 @@ module PrintYaml {
    * Each child of this node aggregates the key and value of a mapping.
    */
   class YamlMappingNode extends YamlNodeNode {
-    override YAMLMapping node;
+    override YamlMapping node;
 
     override PrintAstNode getChild(int childIndex) {
       exists(YamlMappingMapNode map | map = result | map.maps(node, childIndex))
@@ -671,21 +671,21 @@ module PrintYaml {
    * A print node representing the `i`th mapping in `mapping`.
    */
   class YamlMappingMapNode extends PrintAstNode, TYamlMappingNode {
-    YAMLMapping mapping;
+    YamlMapping mapping;
     int i;
 
     YamlMappingMapNode() { this = TYamlMappingNode(mapping, i) }
 
     override string toString() {
-      result = "(Mapping " + i + ")" and not exists(mapping.getKeyNode(i).(YAMLScalar).getValue())
+      result = "(Mapping " + i + ")" and not exists(mapping.getKeyNode(i).(YamlScalar).getValue())
       or
-      result = "(Mapping " + i + ") " + mapping.getKeyNode(i).(YAMLScalar).getValue() + ":"
+      result = "(Mapping " + i + ") " + mapping.getKeyNode(i).(YamlScalar).getValue() + ":"
     }
 
     /**
      * Holds if this print node represents the `index`th mapping of `m`.
      */
-    predicate maps(YAMLMapping m, int index) {
+    predicate maps(YamlMapping m, int index) {
       m = mapping and
       index = i
     }
diff --git a/javascript/ql/lib/semmle/javascript/RangeAnalysis.qll b/javascript/ql/lib/semmle/javascript/RangeAnalysis.qll
index 9d8b3967b1c..a385df662ce 100644
--- a/javascript/ql/lib/semmle/javascript/RangeAnalysis.qll
+++ b/javascript/ql/lib/semmle/javascript/RangeAnalysis.qll
@@ -103,7 +103,7 @@ module RangeAnalysis {
    * the given increment/decrement expression.
    */
   private DataFlow::Node updateExprResult(UpdateExpr expr) {
-    result = DataFlow::ssaDefinitionNode(SSA::definition(expr))
+    result = DataFlow::ssaDefinitionNode(Ssa::definition(expr))
     or
     expr.isPrefix() and
     result = expr.flow()
@@ -113,7 +113,7 @@ module RangeAnalysis {
    * Gets a data flow node holding the result of the given componund assignment.
    */
   private DataFlow::Node compoundAssignResult(CompoundAssignExpr expr) {
-    result = DataFlow::ssaDefinitionNode(SSA::definition(expr))
+    result = DataFlow::ssaDefinitionNode(Ssa::definition(expr))
     or
     result = expr.flow()
   }
diff --git a/javascript/ql/lib/semmle/javascript/Regexp.qll b/javascript/ql/lib/semmle/javascript/Regexp.qll
index e683fb0db2a..e443ede5104 100644
--- a/javascript/ql/lib/semmle/javascript/Regexp.qll
+++ b/javascript/ql/lib/semmle/javascript/Regexp.qll
@@ -1005,7 +1005,10 @@ module RegExpPatterns {
    * Gets a pattern that matches common top-level domain names in lower case.
    * DEPRECATED: use `getACommonTld` instead
    */
-  deprecated predicate commonTLD = getACommonTld/0;
+  deprecated predicate commonTld = getACommonTld/0;
+
+  /** DEPRECATED: Alias for commonTld */
+  deprecated predicate commonTLD = commonTld/0;
 }
 
 /**
diff --git a/javascript/ql/lib/semmle/javascript/Routing.qll b/javascript/ql/lib/semmle/javascript/Routing.qll
index 96d3e0a7f51..a7e37c10743 100644
--- a/javascript/ql/lib/semmle/javascript/Routing.qll
+++ b/javascript/ql/lib/semmle/javascript/Routing.qll
@@ -282,7 +282,7 @@ module Routing {
      * Gets an HTTP method name which this node will accept, or nothing if the node accepts all HTTP methods, not
      * taking into account the context from ancestors or children nodes.
      */
-    HTTP::RequestMethodName getOwnHttpMethod() { none() } // Overridden in subclass
+    Http::RequestMethodName getOwnHttpMethod() { none() } // Overridden in subclass
 
     private Node getAUseSiteInRouteSetup() {
       if this.getParent() instanceof RouteSetup
@@ -383,7 +383,7 @@ module Routing {
        * Gets an HTTP request method name (in upper case) matched by this node, or nothing
        * if all HTTP request method names are accepted.
        */
-      HTTP::RequestMethodName getHttpMethod() { none() }
+      Http::RequestMethodName getHttpMethod() { none() }
     }
 
     private class ValueNodeImpl extends Node, MkValueNode {
@@ -407,7 +407,7 @@ module Routing {
 
       override string getRelativePath() { result = range.getRelativePath() }
 
-      override HTTP::RequestMethodName getOwnHttpMethod() { result = range.getHttpMethod() }
+      override Http::RequestMethodName getOwnHttpMethod() { result = range.getHttpMethod() }
     }
 
     private StepSummary routeStepSummary() {
@@ -434,7 +434,7 @@ module Routing {
         or
         StepSummary::smallstep(result, this, routeStepSummary())
         or
-        HTTP::routeHandlerStep(result, this)
+        Http::routeHandlerStep(result, this)
         or
         RouteHandlerTrackingStep::step(result, this)
         or
@@ -599,7 +599,7 @@ module Routing {
        * Gets an HTTP request method name (in upper case) matched by this node, or nothing
        * if all HTTP request method names are accepted.
        */
-      HTTP::RequestMethodName getHttpMethod() { none() }
+      Http::RequestMethodName getHttpMethod() { none() }
 
       /**
        * Holds if this route setup targets `router` and occurs at the given `cfgNode`.
@@ -635,7 +635,7 @@ module Routing {
 
       override string getRelativePath() { result = range.getRelativePath() }
 
-      override HTTP::RequestMethodName getOwnHttpMethod() { result = range.getHttpMethod() }
+      override Http::RequestMethodName getOwnHttpMethod() { result = range.getHttpMethod() }
     }
 
     /**
diff --git a/javascript/ql/lib/semmle/javascript/SSA.qll b/javascript/ql/lib/semmle/javascript/SSA.qll
index 8e60fb0c3e4..3ba64d0200d 100644
--- a/javascript/ql/lib/semmle/javascript/SSA.qll
+++ b/javascript/ql/lib/semmle/javascript/SSA.qll
@@ -737,7 +737,7 @@ class SsaRefinementNode extends SsaPseudoDefinition, TRefinement {
   }
 }
 
-module SSA {
+module Ssa {
   /** Gets the SSA definition corresponding to the implicit initialization of `v`. */
   SsaImplicitInit implicitInit(SsaSourceVariable v) { result.getSourceVariable() = v }
 
@@ -747,3 +747,6 @@ module SSA {
   /** Gets the SSA variable corresponding to `d`. */
   SsaVariable variable(VarDef d) { result.getDefinition() = definition(d) }
 }
+
+/** DEPRECATED: Alias for Ssa */
+deprecated module SSA = Ssa;
diff --git a/javascript/ql/lib/semmle/javascript/Stmt.qll b/javascript/ql/lib/semmle/javascript/Stmt.qll
index edf8296585a..24a901a0dcc 100644
--- a/javascript/ql/lib/semmle/javascript/Stmt.qll
+++ b/javascript/ql/lib/semmle/javascript/Stmt.qll
@@ -291,10 +291,13 @@ class StrictModeDecl extends KnownDirective {
  * "use asm";
  * ```
  */
-class ASMJSDirective extends KnownDirective {
-  ASMJSDirective() { this.getDirectiveText() = "use asm" }
+class AsmJSDirective extends KnownDirective {
+  AsmJSDirective() { this.getDirectiveText() = "use asm" }
 }
 
+/** DEPRECATED: Alias for AsmJSDirective */
+deprecated class ASMJSDirective = AsmJSDirective;
+
 /**
  * A Babel directive.
  *
diff --git a/javascript/ql/lib/semmle/javascript/YAML.qll b/javascript/ql/lib/semmle/javascript/YAML.qll
index 49e0d28ae28..e7b49165499 100644
--- a/javascript/ql/lib/semmle/javascript/YAML.qll
+++ b/javascript/ql/lib/semmle/javascript/YAML.qll
@@ -20,13 +20,13 @@ import javascript
  * << : *DEFAULTS  # an alias node referring to anchor `DEFAULTS`
  * ```
  */
-class YAMLNode extends @yaml_node, Locatable {
+class YamlNode extends @yaml_node, Locatable {
   override Location getLocation() { yaml_locations(this, result) }
 
   /**
    * Gets the parent node of this node, which is always a collection.
    */
-  YAMLCollection getParentNode() { yaml(this, _, result, _, _, _) }
+  YamlCollection getParentNode() { yaml(this, _, result, _, _, _) }
 
   /**
    * Gets the `i`th child node of this node.
@@ -34,12 +34,12 @@ class YAMLNode extends @yaml_node, Locatable {
    * _Note_: The index of a child node relative to its parent is considered
    * an implementation detail and may change between versions of the extractor.
    */
-  YAMLNode getChildNode(int i) { yaml(result, _, this, i, _, _) }
+  YamlNode getChildNode(int i) { yaml(result, _, this, i, _, _) }
 
   /**
    * Gets a child node of this node.
    */
-  YAMLNode getAChildNode() { result = this.getChildNode(_) }
+  YamlNode getAChildNode() { result = this.getChildNode(_) }
 
   /**
    * Gets the number of child nodes of this node.
@@ -49,12 +49,12 @@ class YAMLNode extends @yaml_node, Locatable {
   /**
    * Gets the `i`th child of this node, as a YAML value.
    */
-  YAMLValue getChild(int i) { result = this.getChildNode(i).eval() }
+  YamlValue getChild(int i) { result = this.getChildNode(i).eval() }
 
   /**
    * Gets a child of this node, as a YAML value.
    */
-  YAMLValue getAChild() { result = this.getChild(_) }
+  YamlValue getAChild() { result = this.getChild(_) }
 
   /**
    * Gets the tag of this node.
@@ -79,16 +79,19 @@ class YAMLNode extends @yaml_node, Locatable {
   /**
    * Gets the toplevel document to which this node belongs.
    */
-  YAMLDocument getDocument() { result = this.getParentNode*() }
+  YamlDocument getDocument() { result = this.getParentNode*() }
 
   /**
    * Gets the YAML value this node corresponds to after resolving aliases and includes.
    */
-  YAMLValue eval() { result = this }
+  YamlValue eval() { result = this }
 
-  override string getAPrimaryQlClass() { result = "YAMLNode" }
+  override string getAPrimaryQlClass() { result = "YamlNode" }
 }
 
+/** DEPRECATED: Alias for YamlNode */
+deprecated class YAMLNode = YamlNode;
+
 /**
  * A YAML value; that is, either a scalar or a collection.
  *
@@ -102,7 +105,10 @@ class YAMLNode extends @yaml_node, Locatable {
  * - sequence
  * ```
  */
-abstract class YAMLValue extends YAMLNode { }
+abstract class YamlValue extends YamlNode { }
+
+/** DEPRECATED: Alias for YamlValue */
+deprecated class YAMLValue = YamlValue;
 
 /**
  * A YAML scalar.
@@ -118,7 +124,7 @@ abstract class YAMLValue extends YAMLNode { }
  * "hello"
  * ```
  */
-class YAMLScalar extends YAMLValue, @yaml_scalar_node {
+class YamlScalar extends YamlValue, @yaml_scalar_node {
   /**
    * Gets the style of this scalar, which is one of the following:
    *
@@ -147,9 +153,12 @@ class YAMLScalar extends YAMLValue, @yaml_scalar_node {
    */
   string getValue() { yaml_scalars(this, _, result) }
 
-  override string getAPrimaryQlClass() { result = "YAMLScalar" }
+  override string getAPrimaryQlClass() { result = "YamlScalar" }
 }
 
+/** DEPRECATED: Alias for YamlScalar */
+deprecated class YAMLScalar = YamlScalar;
+
 /**
  * A YAML scalar representing an integer value.
  *
@@ -160,8 +169,8 @@ class YAMLScalar extends YAMLValue, @yaml_scalar_node {
  * 0xffff
  * ```
  */
-class YAMLInteger extends YAMLScalar {
-  YAMLInteger() { this.hasStandardTypeTag("int") }
+class YamlInteger extends YamlScalar {
+  YamlInteger() { this.hasStandardTypeTag("int") }
 
   /**
    * Gets the value of this scalar, as an integer.
@@ -169,6 +178,9 @@ class YAMLInteger extends YAMLScalar {
   int getIntValue() { result = this.getValue().toInt() }
 }
 
+/** DEPRECATED: Alias for YamlInteger */
+deprecated class YAMLInteger = YamlInteger;
+
 /**
  * A YAML scalar representing a floating point value.
  *
@@ -179,8 +191,8 @@ class YAMLInteger extends YAMLScalar {
  * 6.626e-34
  * ```
  */
-class YAMLFloat extends YAMLScalar {
-  YAMLFloat() { this.hasStandardTypeTag("float") }
+class YamlFloat extends YamlScalar {
+  YamlFloat() { this.hasStandardTypeTag("float") }
 
   /**
    * Gets the value of this scalar, as a floating point number.
@@ -188,6 +200,9 @@ class YAMLFloat extends YAMLScalar {
   float getFloatValue() { result = this.getValue().toFloat() }
 }
 
+/** DEPRECATED: Alias for YamlFloat */
+deprecated class YAMLFloat = YamlFloat;
+
 /**
  * A YAML scalar representing a time stamp.
  *
@@ -197,8 +212,8 @@ class YAMLFloat extends YAMLScalar {
  * 2001-12-15T02:59:43.1Z
  * ```
  */
-class YAMLTimestamp extends YAMLScalar {
-  YAMLTimestamp() { this.hasStandardTypeTag("timestamp") }
+class YamlTimestamp extends YamlScalar {
+  YamlTimestamp() { this.hasStandardTypeTag("timestamp") }
 
   /**
    * Gets the value of this scalar, as a date.
@@ -206,6 +221,9 @@ class YAMLTimestamp extends YAMLScalar {
   date getDateValue() { result = this.getValue().toDate() }
 }
 
+/** DEPRECATED: Alias for YamlTimestamp */
+deprecated class YAMLTimestamp = YamlTimestamp;
+
 /**
  * A YAML scalar representing a Boolean value.
  *
@@ -215,8 +233,8 @@ class YAMLTimestamp extends YAMLScalar {
  * true
  * ```
  */
-class YAMLBool extends YAMLScalar {
-  YAMLBool() { this.hasStandardTypeTag("bool") }
+class YamlBool extends YamlScalar {
+  YamlBool() { this.hasStandardTypeTag("bool") }
 
   /**
    * Gets the value of this scalar, as a Boolean.
@@ -224,6 +242,9 @@ class YAMLBool extends YAMLScalar {
   boolean getBoolValue() { if this.getValue() = "true" then result = true else result = false }
 }
 
+/** DEPRECATED: Alias for YamlBool */
+deprecated class YAMLBool = YamlBool;
+
 /**
  * A YAML scalar representing the null value.
  *
@@ -233,10 +254,13 @@ class YAMLBool extends YAMLScalar {
  * null
  * ```
  */
-class YAMLNull extends YAMLScalar {
-  YAMLNull() { this.hasStandardTypeTag("null") }
+class YamlNull extends YamlScalar {
+  YamlNull() { this.hasStandardTypeTag("null") }
 }
 
+/** DEPRECATED: Alias for YamlNull */
+deprecated class YAMLNull = YamlNull;
+
 /**
  * A YAML scalar representing a string value.
  *
@@ -246,10 +270,13 @@ class YAMLNull extends YAMLScalar {
  * "hello"
  * ```
  */
-class YAMLString extends YAMLScalar {
-  YAMLString() { this.hasStandardTypeTag("str") }
+class YamlString extends YamlScalar {
+  YamlString() { this.hasStandardTypeTag("str") }
 }
 
+/** DEPRECATED: Alias for YamlString */
+deprecated class YAMLString = YamlString;
+
 /**
  * A YAML scalar representing a merge key.
  *
@@ -260,10 +287,13 @@ class YAMLString extends YAMLScalar {
  * << : *DEFAULTS  # merge key
  * ```
  */
-class YAMLMergeKey extends YAMLScalar {
-  YAMLMergeKey() { this.hasStandardTypeTag("merge") }
+class YamlMergeKey extends YamlScalar {
+  YamlMergeKey() { this.hasStandardTypeTag("merge") }
 }
 
+/** DEPRECATED: Alias for YamlMergeKey */
+deprecated class YAMLMergeKey = YamlMergeKey;
+
 /**
  * A YAML scalar representing an `!include` directive.
  *
@@ -271,11 +301,11 @@ class YAMLMergeKey extends YAMLScalar {
  * !include common.yaml
  * ```
  */
-class YAMLInclude extends YAMLScalar {
-  YAMLInclude() { this.getTag() = "!include" }
+class YamlInclude extends YamlScalar {
+  YamlInclude() { this.getTag() = "!include" }
 
-  override YAMLValue eval() {
-    exists(YAMLDocument targetDoc |
+  override YamlValue eval() {
+    exists(YamlDocument targetDoc |
       targetDoc.getFile().getAbsolutePath() = this.getTargetPath() and
       result = targetDoc.eval()
     )
@@ -293,6 +323,9 @@ class YAMLInclude extends YAMLScalar {
   }
 }
 
+/** DEPRECATED: Alias for YamlInclude */
+deprecated class YAMLInclude = YamlInclude;
+
 /**
  * A YAML collection, that is, either a mapping or a sequence.
  *
@@ -310,10 +343,13 @@ class YAMLInclude extends YAMLScalar {
  * - -blue
  * ```
  */
-class YAMLCollection extends YAMLValue, @yaml_collection_node {
-  override string getAPrimaryQlClass() { result = "YAMLCollection" }
+class YamlCollection extends YamlValue, @yaml_collection_node {
+  override string getAPrimaryQlClass() { result = "YamlCollection" }
 }
 
+/** DEPRECATED: Alias for YamlCollection */
+deprecated class YAMLCollection = YamlCollection;
+
 /**
  * A YAML mapping.
  *
@@ -324,11 +360,11 @@ class YAMLCollection extends YAMLValue, @yaml_collection_node {
  * y: 1
  * ```
  */
-class YAMLMapping extends YAMLCollection, @yaml_mapping_node {
+class YamlMapping extends YamlCollection, @yaml_mapping_node {
   /**
    * Gets the `i`th key of this mapping.
    */
-  YAMLNode getKeyNode(int i) {
+  YamlNode getKeyNode(int i) {
     i >= 0 and
     exists(int j | i = j - 1 and result = this.getChildNode(j))
   }
@@ -336,7 +372,7 @@ class YAMLMapping extends YAMLCollection, @yaml_mapping_node {
   /**
    * Gets the `i`th value of this mapping.
    */
-  YAMLNode getValueNode(int i) {
+  YamlNode getValueNode(int i) {
     i >= 0 and
     exists(int j | i = -j - 1 and result = this.getChildNode(j))
   }
@@ -344,30 +380,33 @@ class YAMLMapping extends YAMLCollection, @yaml_mapping_node {
   /**
    * Gets the `i`th key of this mapping, as a YAML value.
    */
-  YAMLValue getKey(int i) { result = this.getKeyNode(i).eval() }
+  YamlValue getKey(int i) { result = this.getKeyNode(i).eval() }
 
   /**
    * Gets the `i`th value of this mapping, as a YAML value.
    */
-  YAMLValue getValue(int i) { result = this.getValueNode(i).eval() }
+  YamlValue getValue(int i) { result = this.getValueNode(i).eval() }
 
   /**
    * Holds if this mapping maps `key` to `value`.
    */
-  predicate maps(YAMLValue key, YAMLValue value) {
+  predicate maps(YamlValue key, YamlValue value) {
     exists(int i | key = this.getKey(i) and value = this.getValue(i))
     or
-    exists(YAMLMergeKey merge, YAMLMapping that | this.maps(merge, that) | that.maps(key, value))
+    exists(YamlMergeKey merge, YamlMapping that | this.maps(merge, that) | that.maps(key, value))
   }
 
   /**
    * Gets the value that this mapping maps `key` to.
    */
-  YAMLValue lookup(string key) { exists(YAMLScalar s | s.getValue() = key | this.maps(s, result)) }
+  YamlValue lookup(string key) { exists(YamlScalar s | s.getValue() = key | this.maps(s, result)) }
 
-  override string getAPrimaryQlClass() { result = "YAMLMapping" }
+  override string getAPrimaryQlClass() { result = "YamlMapping" }
 }
 
+/** DEPRECATED: Alias for YamlMapping */
+deprecated class YAMLMapping = YamlMapping;
+
 /**
  * A YAML sequence.
  *
@@ -379,20 +418,23 @@ class YAMLMapping extends YAMLCollection, @yaml_mapping_node {
  * - blue
  * ```
  */
-class YAMLSequence extends YAMLCollection, @yaml_sequence_node {
+class YamlSequence extends YamlCollection, @yaml_sequence_node {
   /**
    * Gets the `i`th element in this sequence.
    */
-  YAMLNode getElementNode(int i) { result = this.getChildNode(i) }
+  YamlNode getElementNode(int i) { result = this.getChildNode(i) }
 
   /**
    * Gets the `i`th element in this sequence, as a YAML value.
    */
-  YAMLValue getElement(int i) { result = this.getElementNode(i).eval() }
+  YamlValue getElement(int i) { result = this.getElementNode(i).eval() }
 
-  override string getAPrimaryQlClass() { result = "YAMLSequence" }
+  override string getAPrimaryQlClass() { result = "YamlSequence" }
 }
 
+/** DEPRECATED: Alias for YamlSequence */
+deprecated class YAMLSequence = YamlSequence;
+
 /**
  * A YAML alias node referring to a target anchor.
  *
@@ -402,8 +444,8 @@ class YAMLSequence extends YAMLCollection, @yaml_sequence_node {
  * *DEFAULTS
  * ```
  */
-class YAMLAliasNode extends YAMLNode, @yaml_alias_node {
-  override YAMLValue eval() {
+class YamlAliasNode extends YamlNode, @yaml_alias_node {
+  override YamlValue eval() {
     result.getAnchor() = this.getTarget() and
     result.getDocument() = this.getDocument()
   }
@@ -413,9 +455,12 @@ class YAMLAliasNode extends YAMLNode, @yaml_alias_node {
    */
   string getTarget() { yaml_aliases(this, result) }
 
-  override string getAPrimaryQlClass() { result = "YAMLAliasNode" }
+  override string getAPrimaryQlClass() { result = "YamlAliasNode" }
 }
 
+/** DEPRECATED: Alias for YamlAliasNode */
+deprecated class YAMLAliasNode = YamlAliasNode;
+
 /**
  * A YAML document.
  *
@@ -427,14 +472,17 @@ class YAMLAliasNode extends YAMLNode, @yaml_alias_node {
  * y: 1
  * ```
  */
-class YAMLDocument extends YAMLNode {
-  YAMLDocument() { not exists(this.getParentNode()) }
+class YamlDocument extends YamlNode {
+  YamlDocument() { not exists(this.getParentNode()) }
 }
 
+/** DEPRECATED: Alias for YamlDocument */
+deprecated class YAMLDocument = YamlDocument;
+
 /**
  * An error message produced by the YAML parser while processing a YAML file.
  */
-class YAMLParseError extends @yaml_error, Error {
+class YamlParseError extends @yaml_error, Error {
   override Location getLocation() { yaml_locations(this, result) }
 
   override string getMessage() { yaml_errors(this, result) }
@@ -442,6 +490,9 @@ class YAMLParseError extends @yaml_error, Error {
   override string toString() { result = this.getMessage() }
 }
 
+/** DEPRECATED: Alias for YamlParseError */
+deprecated class YAMLParseError = YamlParseError;
+
 /**
  * A YAML node that may contain sub-nodes that can be identified by a name.
  * I.e. a mapping, sequence, or scalar.
@@ -464,30 +515,30 @@ class YAMLParseError extends @yaml_error, Error {
  *
  * are equivalent.
  */
-class YAMLMappingLikeNode extends YAMLNode {
-  YAMLMappingLikeNode() {
-    this instanceof YAMLMapping
+class YamlMappingLikeNode extends YamlNode {
+  YamlMappingLikeNode() {
+    this instanceof YamlMapping
     or
-    this instanceof YAMLSequence
+    this instanceof YamlSequence
     or
-    this instanceof YAMLScalar
+    this instanceof YamlScalar
   }
 
   /** Gets sub-name identified by `name`. */
-  YAMLNode getNode(string name) {
-    exists(YAMLMapping mapping |
+  YamlNode getNode(string name) {
+    exists(YamlMapping mapping |
       mapping = this and
       result = mapping.lookup(name)
     )
     or
-    exists(YAMLSequence sequence, YAMLNode node |
+    exists(YamlSequence sequence, YamlNode node |
       sequence = this and
       sequence.getAChildNode() = node and
       node.eval().toString() = name and
       result = node
     )
     or
-    exists(YAMLScalar scalar |
+    exists(YamlScalar scalar |
       scalar = this and
       scalar.getValue() = name and
       result = scalar
@@ -496,19 +547,22 @@ class YAMLMappingLikeNode extends YAMLNode {
 
   /** Gets the number of elements in this mapping or sequence. */
   int getElementCount() {
-    exists(YAMLMapping mapping |
+    exists(YamlMapping mapping |
       mapping = this and
       result = mapping.getNumChild() / 2
     )
     or
-    exists(YAMLSequence sequence |
+    exists(YamlSequence sequence |
       sequence = this and
       result = sequence.getNumChild()
     )
     or
-    exists(YAMLScalar scalar |
+    exists(YamlScalar scalar |
       scalar = this and
       result = 1
     )
   }
 }
+
+/** DEPRECATED: Alias for YamlMappingLikeNode */
+deprecated class YAMLMappingLikeNode = YamlMappingLikeNode;
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/Configuration.qll b/javascript/ql/lib/semmle/javascript/dataflow/Configuration.qll
index 9dcf6bb1913..2449f8a8eb8 100644
--- a/javascript/ql/lib/semmle/javascript/dataflow/Configuration.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/Configuration.qll
@@ -770,7 +770,7 @@ private class FlowStepThroughImport extends SharedFlowStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
     exists(ImportSpecifier specifier |
       pred = DataFlow::valueNode(specifier) and
-      succ = DataFlow::ssaDefinitionNode(SSA::definition(specifier))
+      succ = DataFlow::ssaDefinitionNode(Ssa::definition(specifier))
     )
   }
 }
@@ -1777,7 +1777,7 @@ class MidPathNode extends PathNode, MkMidNode {
       SsaImplicitDefinition
     or
     // Skip SSA definition of parameter as its location coincides with the parameter node
-    nd = DataFlow::ssaDefinitionNode(SSA::definition(any(SimpleParameter p)))
+    nd = DataFlow::ssaDefinitionNode(Ssa::definition(any(SimpleParameter p)))
     or
     // Skip to the top of big left-leaning string concatenation trees.
     nd = any(AddExpr add).flow() and
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/lib/semmle/javascript/dataflow/DataFlow.qll
index 7a2640b6f60..20366a8f2b5 100644
--- a/javascript/ql/lib/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/DataFlow.qll
@@ -139,9 +139,12 @@ module DataFlow {
     }
 
     /**
+     * DEPRECATED: Use `DataFlow::ParameterNode::flowsTo()` instead.
      * Holds if this expression may refer to the initial value of parameter `p`.
      */
-    predicate mayReferToParameter(Parameter p) { parameterNode(p).(SourceNode).flowsTo(this) }
+    deprecated predicate mayReferToParameter(Parameter p) {
+      parameterNode(p).(SourceNode).flowsTo(this)
+    }
 
     /**
      * Holds if this element is at the specified location.
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/Nodes.qll b/javascript/ql/lib/semmle/javascript/dataflow/Nodes.qll
index 826e5280ace..1c9a9f66100 100644
--- a/javascript/ql/lib/semmle/javascript/dataflow/Nodes.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/Nodes.qll
@@ -472,6 +472,12 @@ class FunctionNode extends DataFlow::ValueNode, DataFlow::SourceNode {
   /** Gets a parameter of this function. */
   ParameterNode getAParameter() { result = this.getParameter(_) }
 
+  /** Gets the parameter named `name` of this function, if any. */
+  DataFlow::ParameterNode getParameterByName(string name) {
+    result = this.getAParameter() and
+    result.getName() = name
+  }
+
   /** Gets the number of parameters declared on this function. */
   int getNumParameter() { result = count(astNode.getAParameter()) }
 
@@ -556,6 +562,14 @@ class ObjectLiteralNode extends DataFlow::ValueNode, DataFlow::SourceNode {
   DataFlow::FunctionNode getPropertySetter(string name) {
     result = astNode.getPropertyByName(name).(PropertySetter).getInit().flow()
   }
+
+  /** Gets the value of a computed property name of this object literal, such as `x` in `{[x]: 1}` */
+  DataFlow::Node getAComputedPropertyName() {
+    exists(Property prop | prop = astNode.getAProperty() |
+      prop.isComputed() and
+      result = prop.getNameExpr().flow()
+    )
+  }
 }
 
 /**
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/Sources.qll b/javascript/ql/lib/semmle/javascript/dataflow/Sources.qll
index 170b1f6896f..6e7f8bc3461 100644
--- a/javascript/ql/lib/semmle/javascript/dataflow/Sources.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/Sources.qll
@@ -10,6 +10,11 @@ private import javascript
 private import semmle.javascript.dataflow.TypeTracking
 private import semmle.javascript.internal.CachedStages
 
+/**
+ * An alias for `SourceNode`.
+ */
+class LocalSourceNode = SourceNode;
+
 /**
  * A source node for local data flow, that is, a node from which local data flow is tracked.
  *
@@ -343,7 +348,7 @@ private class NodeModuleSourcesNodes extends SourceNode::Range {
 
   NodeModuleSourcesNodes() {
     exists(NodeModule m |
-      this = DataFlow::ssaDefinitionNode(SSA::implicitInit(v)) and
+      this = DataFlow::ssaDefinitionNode(Ssa::implicitInit(v)) and
       v = [m.getModuleVariable(), m.getExportsVariable()]
     )
   }
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll
index ec38e760916..5147bcf7f2a 100644
--- a/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll
@@ -482,17 +482,13 @@ module TaintTracking {
    */
   private class HeapTaintStep extends SharedTaintStep {
     override predicate heapStep(DataFlow::Node pred, DataFlow::Node succ) {
-      exists(Expr e, Expr f | e = succ.asExpr() and f = pred.asExpr() |
-        exists(Property prop | e.(ObjectExpr).getAProperty() = prop |
-          prop.isComputed() and f = prop.getNameExpr()
-        )
-        or
-        // spreading a tainted object into an object literal gives a tainted object
-        e.(ObjectExpr).getAProperty().(SpreadProperty).getInit().(SpreadElement).getOperand() = f
-        or
-        // spreading a tainted value into an array literal gives a tainted array
-        e.(ArrayExpr).getAnElement().(SpreadElement).getOperand() = f
-      )
+      succ.(DataFlow::ObjectLiteralNode).getAComputedPropertyName() = pred
+      or
+      // spreading a tainted object into an object literal gives a tainted object
+      succ.(DataFlow::ObjectLiteralNode).getASpreadProperty() = pred
+      or
+      // spreading a tainted value into an array literal gives a tainted array
+      succ.(DataFlow::ArrayCreationNode).getASpreadArgument() = pred
       or
       // arrays with tainted elements and objects with tainted property names are tainted
       succ.(DataFlow::ArrayCreationNode).getAnElement() = pred and
@@ -546,16 +542,16 @@ module TaintTracking {
    */
   private class ComputedPropWriteTaintStep extends SharedTaintStep {
     override predicate heapStep(DataFlow::Node pred, DataFlow::Node succ) {
-      exists(AssignExpr assgn, IndexExpr idx, DataFlow::SourceNode obj |
-        assgn.getTarget() = idx and
-        obj.flowsToExpr(idx.getBase()) and
-        not exists(idx.getPropertyName()) and
-        pred = DataFlow::valueNode(assgn.getRhs()) and
+      exists(DataFlow::PropWrite assgn, DataFlow::SourceNode obj |
+        not exists(assgn.getPropertyName()) and
+        not assgn.getWriteNode() instanceof Property and // not a write inside an object literal
+        pred = assgn.getRhs() and
+        assgn = obj.getAPropertyWrite() and
         succ = obj
       |
         obj instanceof DataFlow::ObjectLiteralNode
         or
-        obj.getAPropertyRead("length").flowsToExpr(idx.getPropertyNameExpr())
+        obj.getAPropertyRead("length").flowsToExpr(assgn.getPropertyNameExpr())
       )
     }
   }
@@ -580,8 +576,8 @@ module TaintTracking {
     override predicate stringManipulationStep(DataFlow::Node pred, DataFlow::Node target) {
       exists(DataFlow::ValueNode succ | target = succ |
         // string operations that propagate taint
-        exists(string name | name = succ.getAstNode().(MethodCallExpr).getMethodName() |
-          pred.asExpr() = succ.getAstNode().(MethodCallExpr).getReceiver() and
+        exists(string name | name = succ.(DataFlow::MethodCallNode).getMethodName() |
+          pred = succ.(DataFlow::MethodCallNode).getReceiver() and
           (
             // sorted, interesting, properties of String.prototype
             name =
@@ -600,7 +596,7 @@ module TaintTracking {
             name = "join"
           )
           or
-          exists(int i | pred.asExpr() = succ.getAstNode().(MethodCallExpr).getArgument(i) |
+          exists(int i | pred = succ.(DataFlow::MethodCallNode).getArgument(i) |
             name = "concat"
             or
             name = ["replace", "replaceAll"] and i = 1
@@ -615,10 +611,10 @@ module TaintTracking {
         )
         or
         // String.fromCharCode and String.fromCodePoint
-        exists(int i, MethodCallExpr mce |
-          mce = succ.getAstNode() and
-          pred.asExpr() = mce.getArgument(i) and
-          (mce.getMethodName() = "fromCharCode" or mce.getMethodName() = "fromCodePoint")
+        exists(int i, DataFlow::MethodCallNode mcn |
+          mcn = succ and
+          pred = mcn.getArgument(i) and
+          mcn.getMethodName() = ["fromCharCode", "fromCodePoint"]
         )
         or
         // `(encode|decode)URI(Component)?` propagate taint
@@ -744,11 +740,11 @@ module TaintTracking {
    * the parameters in `input`.
    */
   predicate isUrlSearchParams(DataFlow::SourceNode params, DataFlow::Node input) {
-    exists(DataFlow::GlobalVarRefNode urlSearchParams, NewExpr newUrlSearchParams |
+    exists(DataFlow::GlobalVarRefNode urlSearchParams, DataFlow::NewNode newUrlSearchParams |
       urlSearchParams.getName() = "URLSearchParams" and
-      newUrlSearchParams = urlSearchParams.getAnInstantiation().asExpr() and
-      params.asExpr() = newUrlSearchParams and
-      input.asExpr() = newUrlSearchParams.getArgument(0)
+      newUrlSearchParams = urlSearchParams.getAnInstantiation() and
+      params = newUrlSearchParams and
+      input = newUrlSearchParams.getArgument(0)
     )
   }
 
@@ -988,7 +984,7 @@ module TaintTracking {
    *
    * `<contains>` is one of: `contains`, `has`, `hasOwnProperty`
    *
-   * Note that the `includes` method is covered by `StringInclusionSanitizer`.
+   * Note that the `includes` method is covered by `MembershipTestSanitizer`.
    */
   class WhitelistContainmentCallSanitizer extends AdditionalSanitizerGuardNode,
     DataFlow::MethodCallNode {
@@ -1175,7 +1171,7 @@ module TaintTracking {
   /**
    * A check of form `x.indexOf(y) > 0` or similar, which sanitizes `y` in the "then" branch.
    *
-   * The more typical case of `x.indexOf(y) >= 0` is covered by `StringInclusionSanitizer`.
+   * The more typical case of `x.indexOf(y) >= 0` is covered by `MembershipTestSanitizer`.
    */
   class PositiveIndexOfSanitizer extends AdditionalSanitizerGuardNode, DataFlow::ValueNode {
     MethodCallExpr indexOf;
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/internal/CallGraphs.qll b/javascript/ql/lib/semmle/javascript/dataflow/internal/CallGraphs.qll
index 94a6532b107..e616772e789 100644
--- a/javascript/ql/lib/semmle/javascript/dataflow/internal/CallGraphs.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/internal/CallGraphs.qll
@@ -89,6 +89,18 @@ module CallGraph {
       result = getAFunctionReference(outer, 0, t.continue()).getAnInvocation() and
       locallyReturnedFunction(outer, function)
     )
+    or
+    // dynamic dispatch to unknown property of an object
+    exists(DataFlow::ObjectLiteralNode obj, DataFlow::PropRead read |
+      getAFunctionReference(function, 0, t.continue()) = obj.getAPropertySource() and
+      obj.getAPropertyRead() = read and
+      not exists(read.getPropertyName()) and
+      result = read and
+      // there exists only local reads of the object, nothing else.
+      forex(DataFlow::Node ref | ref = obj.getALocalUse() and exists(ref.asExpr()) |
+        ref = [obj, any(DataFlow::PropRead r).getBase()]
+      )
+    )
   }
 
   private predicate locallyReturnedFunction(
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/internal/InterProceduralTypeInference.qll b/javascript/ql/lib/semmle/javascript/dataflow/internal/InterProceduralTypeInference.qll
index 6105b1b8115..2ac0c0bbad6 100644
--- a/javascript/ql/lib/semmle/javascript/dataflow/internal/InterProceduralTypeInference.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/internal/InterProceduralTypeInference.qll
@@ -171,10 +171,10 @@ abstract class CallWithNonLocalAnalyzedReturnFlow extends DataFlow::AnalyzedValu
 /**
  * Flow analysis for the return value of IIFEs.
  */
-private class IIFEWithAnalyzedReturnFlow extends CallWithAnalyzedReturnFlow {
+private class IifeWithAnalyzedReturnFlow extends CallWithAnalyzedReturnFlow {
   ImmediatelyInvokedFunctionExpr iife;
 
-  IIFEWithAnalyzedReturnFlow() { astNode = iife.getInvocation() }
+  IifeWithAnalyzedReturnFlow() { astNode = iife.getInvocation() }
 
   override AnalyzedFunction getACallee() { result = iife.analyze() }
 }
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/internal/VariableTypeInference.qll b/javascript/ql/lib/semmle/javascript/dataflow/internal/VariableTypeInference.qll
index f2b905086c5..b55c0ddc302 100644
--- a/javascript/ql/lib/semmle/javascript/dataflow/internal/VariableTypeInference.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/internal/VariableTypeInference.qll
@@ -692,10 +692,10 @@ abstract private class CallWithAnalyzedParameters extends FunctionWithAnalyzedPa
 /**
  * Flow analysis for simple parameters of IIFEs.
  */
-private class IIFEWithAnalyzedParameters extends CallWithAnalyzedParameters {
+private class IifeWithAnalyzedParameters extends CallWithAnalyzedParameters {
   ImmediatelyInvokedFunctionExpr iife;
 
-  IIFEWithAnalyzedParameters() {
+  IifeWithAnalyzedParameters() {
     this = iife and
     iife.getInvocationKind() = "direct"
   }
diff --git a/javascript/ql/lib/semmle/javascript/dependencies/Dependencies.qll b/javascript/ql/lib/semmle/javascript/dependencies/Dependencies.qll
index 1f47bd3e350..024a966bf21 100644
--- a/javascript/ql/lib/semmle/javascript/dependencies/Dependencies.qll
+++ b/javascript/ql/lib/semmle/javascript/dependencies/Dependencies.qll
@@ -276,15 +276,15 @@ class ExternalScriptDependency extends ScriptDependency, @xmlattribute {
 /**
  * A dependency on GWT indicated by a GWT header script.
  */
-private class GWTDependency extends ScriptDependency {
-  GWTDependency() { this instanceof GWTHeader }
+private class GwtDependency extends ScriptDependency {
+  GwtDependency() { this instanceof GwtHeader }
 
   override predicate info(string id, string v) {
     id = "gwt" and
-    exists(GWTHeader h | h = this |
-      v = h.getGWTVersion()
+    exists(GwtHeader h | h = this |
+      v = h.getGwtVersion()
       or
-      not exists(h.getGWTVersion()) and v = "unknown"
+      not exists(h.getGwtVersion()) and v = "unknown"
     )
   }
 
diff --git a/javascript/ql/lib/semmle/javascript/dependencies/FrameworkLibraries.qll b/javascript/ql/lib/semmle/javascript/dependencies/FrameworkLibraries.qll
index 0d4664a79f4..1b0c00f6b7b 100644
--- a/javascript/ql/lib/semmle/javascript/dependencies/FrameworkLibraries.qll
+++ b/javascript/ql/lib/semmle/javascript/dependencies/FrameworkLibraries.qll
@@ -904,8 +904,8 @@ private class SinonJS extends FrameworkLibraryWithGenericUrl, FrameworkLibraryWi
 /**
  * The TinyMCE framework.
  */
-private class TinyMCE extends FrameworkLibraryWithGenericUrl {
-  TinyMCE() { this = "tinymce" }
+private class TinyMce extends FrameworkLibraryWithGenericUrl {
+  TinyMce() { this = "tinymce" }
 
   override string getAnAlias() { result = "jquery.tinymce" or result = "tinymce.jquery" }
 }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/AWS.qll b/javascript/ql/lib/semmle/javascript/frameworks/AWS.qll
index 120f47bb952..1eac5888b95 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/AWS.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/AWS.qll
@@ -8,19 +8,19 @@ module AWS {
   /**
    * Holds if the `i`th argument of `invk` is an object hash for `AWS.Config`.
    */
-  private predicate takesConfigurationObject(InvokeExpr invk, int i) {
+  private predicate takesConfigurationObject(DataFlow::InvokeNode invk, int i) {
     exists(DataFlow::ModuleImportNode mod | mod.getPath() = "aws-sdk" |
       // `AWS.config.update(nd)`
-      invk = mod.getAPropertyRead("config").getAMemberCall("update").asExpr() and
+      invk = mod.getAPropertyRead("config").getAMemberCall("update") and
       i = 0
       or
       exists(DataFlow::SourceNode cfg | cfg = mod.getAConstructorInvocation("Config") |
         // `new AWS.Config(nd)`
-        invk = cfg.asExpr() and
+        invk = cfg and
         i = 0
         or
         // `var config = new AWS.Config(...); config.update(nd);`
-        invk = cfg.getAMemberCall("update").asExpr() and
+        invk = cfg.getAMemberCall("update") and
         i = 0
       )
     )
@@ -29,13 +29,13 @@ module AWS {
   /**
    * An expression that is used as an AWS config value: `{ accessKeyId: <user>, secretAccessKey: <password>}`.
    */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
-      exists(string prop, InvokeExpr invk, int i |
+      exists(string prop, DataFlow::InvokeNode invk, int i |
         takesConfigurationObject(invk, i) and
-        invk.hasOptionArgument(i, prop, this)
+        this = invk.getOptionArgument(i, prop)
       |
         prop = "accessKeyId" and kind = "user name"
         or
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll b/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll
index f7975a8c198..e26a71bcdd4 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll
@@ -68,7 +68,7 @@ private class TrackStringsInAngularCode extends DataFlow::SourceNode::Range, Dat
  */
 private DataFlow::CallNode angularModuleCall(string name) {
   result = angular().getAMemberCall("module") and
-  result.getArgument(0).asExpr().mayHaveStringValue(name)
+  result.getArgument(0).mayHaveStringValue(name)
 }
 
 /**
@@ -105,8 +105,8 @@ class AngularModule extends TAngularModule {
   /**
    * Get the array of dependencies from this module's definition.
    */
-  ArrayExpr getDependencyArray() {
-    this.getADefinition().getArgument(1).getALocalSource().asExpr() = result
+  DataFlow::ArrayCreationNode getDependencyArray() {
+    this.getADefinition().getArgument(1).getALocalSource() = result
   }
 
   /**
@@ -160,14 +160,10 @@ class ModuleApiCall extends DataFlow::CallNode {
   string getMethodName() { result = methodName }
 }
 
-class ModuleApiCallDependencyInjection extends DependencyInjection {
-  ModuleApiCall call;
+class ModuleApiCallDependencyInjection extends DependencyInjection instanceof ModuleApiCall {
   string methodName;
 
-  ModuleApiCallDependencyInjection() {
-    this = call and
-    methodName = call.getMethodName()
-  }
+  ModuleApiCallDependencyInjection() { methodName = super.getMethodName() }
 
   /**
    * Gets the argument position for this method call that expects an injectable function.
@@ -183,7 +179,7 @@ class ModuleApiCallDependencyInjection extends DependencyInjection {
   }
 
   override DataFlow::Node getAnInjectableFunction() {
-    result = call.getArgument(this.injectableArgPos())
+    result = super.getArgument(this.injectableArgPos())
   }
 }
 
@@ -266,10 +262,10 @@ abstract class CustomDirective extends DirectiveInstance {
   DataFlow::SourceNode getMember(string name) { result.flowsTo(this.getMemberInit(name)) }
 
   /** Gets the method `name` of this directive. */
-  Function getMethod(string name) { DataFlow::valueNode(result) = this.getMember(name) }
+  DataFlow::FunctionNode getMethod(string name) { result = this.getMember(name) }
 
   /** Gets a link function of this directive. */
-  abstract Function getALinkFunction();
+  abstract DataFlow::FunctionNode getALinkFunction();
 
   /** Holds if this directive's properties are bound to the controller. */
   abstract predicate bindsToController();
@@ -284,7 +280,7 @@ abstract class CustomDirective extends DirectiveInstance {
   InjectableFunction getController() { result = this.getMember("controller") }
 
   /** Gets the template URL of this directive, if any. */
-  string getTemplateUrl() { this.getMember("templateUrl").asExpr().mayHaveStringValue(result) }
+  string getTemplateUrl() { this.getMember("templateUrl").mayHaveStringValue(result) }
 
   /**
    * Gets a template file for this directive, if any.
@@ -302,9 +298,7 @@ abstract class CustomDirective extends DirectiveInstance {
     else result = DirectiveInstance.super.getAScope()
   }
 
-  private string getRestrictionString() {
-    this.getMember("restrict").asExpr().mayHaveStringValue(result)
-  }
+  private string getRestrictionString() { this.getMember("restrict").mayHaveStringValue(result) }
 
   private predicate hasTargetType(DirectiveTargetType type) {
     not exists(this.getRestrictionString()) or
@@ -332,10 +326,10 @@ class GeneralDirective extends CustomDirective, MkCustomDirective {
 
   /** Gets a node that contributes to the return value of the factory function. */
   override DataFlow::SourceNode getAnInstantiation() {
-    exists(Function factory, InjectableFunction f |
+    exists(DataFlow::FunctionNode factory, InjectableFunction f |
       f = definition.getAFactoryFunction() and
       factory = f.asFunction() and
-      result.flowsToExpr(factory.getAReturnedExpr())
+      result.flowsTo(factory.getAReturn())
     )
   }
 
@@ -344,7 +338,7 @@ class GeneralDirective extends CustomDirective, MkCustomDirective {
   }
 
   /** Gets the compile function of this directive, if any. */
-  Function getCompileFunction() { result = this.getMethod("compile") }
+  DataFlow::FunctionNode getCompileFunction() { result = this.getMethod("compile") }
 
   /**
    * Gets a pre/post link function of this directive defined on its definition object.
@@ -365,9 +359,8 @@ class GeneralDirective extends CustomDirective, MkCustomDirective {
     result = this.getMember("link").getAPropertySource(kind)
     or
     // { compile: function() { ... return link; } }
-    exists(Expr compileReturn, DataFlow::SourceNode compileReturnSrc |
-      compileReturn = this.getCompileFunction().getAReturnedExpr() and
-      compileReturnSrc.flowsToExpr(compileReturn)
+    exists(DataFlow::SourceNode compileReturnSrc |
+      compileReturnSrc.flowsTo(this.getCompileFunction().getAReturn())
     |
       // link = function postLink() { ... }
       kind = "post" and
@@ -380,18 +373,20 @@ class GeneralDirective extends CustomDirective, MkCustomDirective {
   }
 
   /** Gets the pre-link function of this directive. */
-  Function getPreLinkFunction() { result = this.getLinkFunction("pre").getAstNode() }
+  DataFlow::FunctionNode getPreLinkFunction() { result = this.getLinkFunction("pre") }
 
   /** Gets the post-link function of this directive. */
-  Function getPostLinkFunction() { result = this.getLinkFunction("post").getAstNode() }
+  DataFlow::FunctionNode getPostLinkFunction() { result = this.getLinkFunction("post") }
 
-  override Function getALinkFunction() { result = this.getLinkFunction(_).getAstNode() }
+  override DataFlow::FunctionNode getALinkFunction() { result = this.getLinkFunction(_) }
 
   override predicate bindsToController() {
-    this.getMemberInit("bindToController").asExpr().mayHaveBooleanValue(true)
+    this.getMemberInit("bindToController").mayHaveBooleanValue(true)
   }
 
-  override predicate hasIsolateScope() { this.getMember("scope").asExpr() instanceof ObjectExpr }
+  override predicate hasIsolateScope() {
+    this.getMember("scope") instanceof DataFlow::ObjectLiteralNode
+  }
 }
 
 /**
@@ -412,7 +407,7 @@ class ComponentDirective extends CustomDirective, MkCustomComponent {
     comp.getConfig().hasPropertyWrite(name, result)
   }
 
-  override Function getALinkFunction() { none() }
+  override DataFlow::FunctionNode getALinkFunction() { none() }
 
   override predicate bindsToController() { none() }
 
@@ -561,13 +556,12 @@ class DirectiveTargetName extends string {
  *
  * See https://docs.angularjs.org/api/ng/service/$location for details.
  */
-private class LocationFlowSource extends RemoteFlowSource {
+private class LocationFlowSource extends RemoteFlowSource instanceof DataFlow::MethodCallNode {
   LocationFlowSource() {
-    exists(ServiceReference service, MethodCallExpr mce, string m, int n |
+    exists(ServiceReference service, string m, int n |
       service.getName() = "$location" and
-      this.asExpr() = mce and
-      mce = service.getAMethodCall(m) and
-      n = mce.getNumArgument()
+      this = service.getAMethodCall(m) and
+      n = super.getNumArgument()
     |
       m = "search" and n < 2
       or
@@ -605,7 +599,7 @@ private class JQLiteObject extends JQuery::ObjectSource::Range {
   JQLiteObject() {
     this = angular().getAMemberCall("element")
     or
-    exists(Parameter param | this = DataFlow::parameterNode(param) |
+    exists(DataFlow::ParameterNode param | this = param |
       // element parameters to user-functions invoked by AngularJS
       param = any(LinkFunction link).getElementParameter()
       or
@@ -613,13 +607,13 @@ private class JQLiteObject extends JQuery::ObjectSource::Range {
         param = d.getCompileFunction().getParameter(0)
         or
         exists(DataFlow::FunctionNode f, int i |
-          f.flowsToExpr(d.getCompileFunction().getAReturnedExpr()) and i = 1
+          f.flowsTo(d.getCompileFunction().getAReturn()) and i = 1
           or
           f = d.getMember("template") and i = 0
           or
           f = d.getMember("templateUrl") and i = 0
         |
-          param = f.getAstNode().(Function).getParameter(i)
+          param = f.getParameter(i)
         )
       )
     )
@@ -631,99 +625,111 @@ private class JQLiteObject extends JQuery::ObjectSource::Range {
 }
 
 /**
+ * DEPRECATED: Use `AngularJSCallNode` instead.
  * A call to an AngularJS function.
  *
  * Used for exposing behavior that is similar to the behavior of other libraries.
  */
-abstract class AngularJSCall extends CallExpr {
+deprecated class AngularJSCall extends CallExpr {
+  AngularJSCallNode node;
+
+  AngularJSCall() { this.flow() = node }
+
+  /** Holds if `e` is an argument that this call interprets as HTML. */
+  deprecated predicate interpretsArgumentAsHtml(Expr e) { node.interpretsArgumentAsHtml(e.flow()) }
+
+  /** Holds if `e` is an argument that this call stores globally, e.g. in a cookie. */
+  deprecated predicate storesArgumentGlobally(Expr e) { node.storesArgumentGlobally(e.flow()) }
+
+  /** Holds if `e` is an argument that this call interprets as code. */
+  deprecated predicate interpretsArgumentAsCode(Expr e) { node.interpretsArgumentAsCode(e.flow()) }
+}
+
+/**
+ * A call to an AngularJS function.
+ *
+ * Used for exposing behavior that is similar to the behavior of other libraries.
+ */
+abstract class AngularJSCallNode extends DataFlow::CallNode {
   /**
    * Holds if `e` is an argument that this call interprets as HTML.
    */
-  abstract predicate interpretsArgumentAsHtml(Expr e);
+  abstract predicate interpretsArgumentAsHtml(DataFlow::Node e);
 
   /**
    * Holds if `e` is an argument that this call stores globally, e.g. in a cookie.
    */
-  abstract predicate storesArgumentGlobally(Expr e);
+  abstract predicate storesArgumentGlobally(DataFlow::Node e);
 
   /**
    * Holds if `e` is an argument that this call interprets as code.
    */
-  abstract predicate interpretsArgumentAsCode(Expr e);
+  abstract predicate interpretsArgumentAsCode(DataFlow::Node e);
 }
 
 /**
  * A call to a method on the AngularJS object itself.
  */
-private class AngularMethodCall extends AngularJSCall {
-  MethodCallExpr mce;
+private class AngularMethodCall extends AngularJSCallNode {
+  AngularMethodCall() { this = angular().getAMemberCall(_) }
 
-  AngularMethodCall() {
-    mce = angular().getAMemberCall(_).asExpr() and
-    mce = this
+  override predicate interpretsArgumentAsHtml(DataFlow::Node e) {
+    super.getCalleeName() = "element" and
+    e = super.getArgument(0)
   }
 
-  override predicate interpretsArgumentAsHtml(Expr e) {
-    mce.getMethodName() = "element" and
-    e = mce.getArgument(0)
-  }
+  override predicate storesArgumentGlobally(DataFlow::Node e) { none() }
 
-  override predicate storesArgumentGlobally(Expr e) { none() }
-
-  override predicate interpretsArgumentAsCode(Expr e) { none() }
+  override predicate interpretsArgumentAsCode(DataFlow::Node e) { none() }
 }
 
 /**
  * A call to a builtin service or one of its methods.
  */
-private class BuiltinServiceCall extends AngularJSCall {
-  CallExpr call;
-
+private class BuiltinServiceCall extends AngularJSCallNode {
   BuiltinServiceCall() {
     exists(BuiltinServiceReference service |
       service.getAMethodCall(_) = this or
       service.getACall() = this
-    |
-      call = this
     )
   }
 
-  override predicate interpretsArgumentAsHtml(Expr e) {
+  override predicate interpretsArgumentAsHtml(DataFlow::Node e) {
     exists(ServiceReference service, string methodName |
       service.getName() = "$sce" and
-      call = service.getAMethodCall(methodName)
+      this = service.getAMethodCall(methodName)
     |
       // specialized call
       (methodName = "trustAsHtml" or methodName = "trustAsCss") and
-      e = call.getArgument(0)
+      e = this.getArgument(0)
       or
       // generic call with enum argument
       methodName = "trustAs" and
       exists(DataFlow::PropRead prn |
-        prn.asExpr() = call.getArgument(0) and
+        prn = this.getArgument(0) and
         (prn = service.getAPropertyAccess("HTML") or prn = service.getAPropertyAccess("CSS")) and
-        e = call.getArgument(1)
+        e = this.getArgument(1)
       )
     )
   }
 
-  override predicate storesArgumentGlobally(Expr e) {
+  override predicate storesArgumentGlobally(DataFlow::Node e) {
     exists(ServiceReference service, string serviceName, string methodName |
       service.getName() = serviceName and
-      call = service.getAMethodCall(methodName)
+      this = service.getAMethodCall(methodName)
     |
       // AngularJS caches (only available during runtime, so similar to sessionStorage)
       (serviceName = "$cacheFactory" or serviceName = "$templateCache") and
       methodName = "put" and
-      e = call.getArgument(1)
+      e = this.getArgument(1)
       or
       serviceName = "$cookies" and
       (methodName = "put" or methodName = "putObject") and
-      e = call.getArgument(1)
+      e = this.getArgument(1)
     )
   }
 
-  override predicate interpretsArgumentAsCode(Expr e) {
+  override predicate interpretsArgumentAsCode(DataFlow::Node e) {
     exists(ScopeServiceReference scope, string methodName |
       methodName =
         [
@@ -731,22 +737,21 @@ private class BuiltinServiceCall extends AngularJSCall {
           "$watchGroup"
         ]
     |
-      call = scope.getAMethodCall(methodName) and
-      e = call.getArgument(0)
+      this = scope.getAMethodCall(methodName) and
+      e = this.getArgument(0)
     )
     or
     exists(ServiceReference service | service.getName() = ["$compile", "$parse", "$interpolate"] |
-      call = service.getACall() and
-      e = call.getArgument(0)
+      this = service.getACall() and
+      e = this.getArgument(0)
     )
     or
-    exists(ServiceReference service, CallExpr filterInvocation |
+    exists(ServiceReference service |
       // `$filter('orderBy')(collection, expression)`
       service.getName() = "$filter" and
-      call = service.getACall() and
-      call.getArgument(0).mayHaveStringValue("orderBy") and
-      filterInvocation.getCallee() = call and
-      e = filterInvocation.getArgument(1)
+      this = service.getACall() and
+      this.getArgument(0).mayHaveStringValue("orderBy") and
+      e = this.getACall().getArgument(1)
     )
   }
 }
@@ -754,33 +759,33 @@ private class BuiltinServiceCall extends AngularJSCall {
 /**
  * A link-function used in a custom AngularJS directive.
  */
-class LinkFunction extends Function {
+class LinkFunction extends DataFlow::FunctionNode {
   LinkFunction() { this = any(GeneralDirective d).getALinkFunction() }
 
   /**
    * Gets the scope parameter of this function.
    */
-  Parameter getScopeParameter() { result = this.getParameter(0) }
+  DataFlow::ParameterNode getScopeParameter() { result = this.getParameter(0) }
 
   /**
    * Gets the element parameter of this function (contains a jqLite-wrapped DOM element).
    */
-  Parameter getElementParameter() { result = this.getParameter(1) }
+  DataFlow::ParameterNode getElementParameter() { result = this.getParameter(1) }
 
   /**
    * Gets the attributes parameter of this function.
    */
-  Parameter getAttributesParameter() { result = this.getParameter(2) }
+  DataFlow::ParameterNode getAttributesParameter() { result = this.getParameter(2) }
 
   /**
    * Gets the controller parameter of this function.
    */
-  Parameter getControllerParameter() { result = this.getParameter(3) }
+  DataFlow::ParameterNode getControllerParameter() { result = this.getParameter(3) }
 
   /**
    * Gets the transclude-function parameter of this function.
    */
-  Parameter getTranscludeFnParameter() { result = this.getParameter(4) }
+  DataFlow::ParameterNode getTranscludeFnParameter() { result = this.getParameter(4) }
 }
 
 /**
@@ -807,29 +812,29 @@ class AngularScope extends TAngularScope {
   /**
    * Gets an access to this scope object.
    */
-  Expr getAnAccess() {
+  DataFlow::Node getAnAccess() {
     exists(CustomDirective d | this = d.getAScope() |
-      exists(Parameter p |
+      exists(DataFlow::ParameterNode p |
         p = d.getController().getDependencyParameter("$scope") or
         p = d.getALinkFunction().getParameter(0)
       |
-        result.mayReferToParameter(p)
+        p.flowsTo(result)
       )
       or
       exists(DataFlow::ThisNode dis |
-        dis.flowsToExpr(result) and
-        dis.getBinder().getAstNode() = d.getController().asFunction() and
+        dis.flowsTo(result) and
+        dis.getBinder() = d.getController().asFunction() and
         d.bindsToController()
       )
       or
-      d.hasIsolateScope() and result = d.getMember("scope").asExpr()
+      d.hasIsolateScope() and result = d.getMember("scope")
     )
     or
-    exists(DirectiveController c, DOM::ElementDefinition elem, Parameter p |
+    exists(DirectiveController c, DOM::ElementDefinition elem, DataFlow::ParameterNode p |
       c.boundTo(elem) and
       this.mayApplyTo(elem) and
       p = c.getFactoryFunction().getDependencyParameter("$scope") and
-      result.mayReferToParameter(p)
+      p.flowsTo(result)
     )
   }
 
@@ -925,9 +930,7 @@ class RouteSetup extends DataFlow::CallNode, DependencyInjection {
     |
       result = controllerProperty
       or
-      exists(ControllerDefinition def |
-        controllerProperty.asExpr().mayHaveStringValue(def.getName())
-      |
+      exists(ControllerDefinition def | controllerProperty.mayHaveStringValue(def.getName()) |
         result = def.getAService()
       )
     )
@@ -1007,7 +1010,7 @@ private class RouteInstantiatedController extends Controller {
 
   override predicate boundTo(DOM::ElementDefinition elem) {
     exists(string url, HTML::HtmlFile template |
-      setup.getRouteParam("templateUrl").asExpr().mayHaveStringValue(url) and
+      setup.getRouteParam("templateUrl").mayHaveStringValue(url) and
       template.getAbsolutePath().regexpMatch(".*\\Q" + url + "\\E") and
       elem.getFile() = template
     )
@@ -1015,22 +1018,19 @@ private class RouteInstantiatedController extends Controller {
 
   override predicate boundToAs(DOM::ElementDefinition elem, string name) {
     this.boundTo(elem) and
-    setup.getRouteParam("controllerAs").asExpr().mayHaveStringValue(name)
+    setup.getRouteParam("controllerAs").mayHaveStringValue(name)
   }
 }
 
 /**
  * Dataflow for the arguments of AngularJS dependency-injected functions.
  */
-private class DependencyInjectedArgumentInitializer extends DataFlow::AnalyzedNode {
+private class DependencyInjectedArgumentInitializer extends DataFlow::AnalyzedNode instanceof DataFlow::ParameterNode {
   DataFlow::AnalyzedNode service;
 
   DependencyInjectedArgumentInitializer() {
-    exists(
-      AngularJS::InjectableFunction f, Parameter param, AngularJS::CustomServiceDefinition def
-    |
-      this = DataFlow::parameterNode(param) and
-      def.getServiceReference() = f.getAResolvedDependency(param) and
+    exists(AngularJS::InjectableFunction f, AngularJS::CustomServiceDefinition def |
+      def.getServiceReference() = f.getAResolvedDependency(this) and
       service = def.getAService()
     )
   }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/DependencyInjections.qll b/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/DependencyInjections.qll
index 6f5aaf7d38f..0db43d3d97a 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/DependencyInjections.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/DependencyInjections.qll
@@ -41,33 +41,35 @@ abstract class DependencyInjection extends DataFlow::ValueNode {
  */
 abstract class InjectableFunction extends DataFlow::ValueNode {
   /** Gets the parameter corresponding to dependency `name`. */
-  abstract Parameter getDependencyParameter(string name);
+  abstract DataFlow::ParameterNode getDependencyParameter(string name);
 
   /**
    * Gets the `i`th dependency declaration, which is also named `name`.
    */
-  abstract AstNode getDependencyDeclaration(int i, string name);
+  abstract DataFlow::Node getDependencyDeclaration(int i, string name);
 
   /**
-   * Gets an ASTNode for the `name` dependency declaration.
+   * Gets a node for the `name` dependency declaration.
    */
-  AstNode getADependencyDeclaration(string name) { result = getDependencyDeclaration(_, name) }
+  DataFlow::Node getADependencyDeclaration(string name) {
+    result = getDependencyDeclaration(_, name)
+  }
 
   /**
-   * Gets the ASTNode for the `i`th dependency declaration.
+   * Gets the dataflow node for the `i`th dependency declaration.
    */
-  AstNode getDependencyDeclaration(int i) { result = getDependencyDeclaration(i, _) }
+  DataFlow::Node getDependencyDeclaration(int i) { result = getDependencyDeclaration(i, _) }
 
   /** Gets the function underlying this injectable function. */
-  abstract Function asFunction();
+  abstract DataFlow::FunctionNode asFunction();
 
-  /** Gets a location where this function is explicitly dependency injected. */
-  abstract AstNode getAnExplicitDependencyInjection();
+  /** Gets a node where this function is explicitly dependency injected. */
+  abstract DataFlow::Node getAnExplicitDependencyInjection();
 
   /**
    * Gets a service corresponding to the dependency-injected `parameter`.
    */
-  ServiceReference getAResolvedDependency(Parameter parameter) {
+  ServiceReference getAResolvedDependency(DataFlow::ParameterNode parameter) {
     exists(string name, InjectableFunctionServiceRequest request |
       this = request.getAnInjectedFunction() and
       parameter = getDependencyParameter(name) and
@@ -79,7 +81,7 @@ abstract class InjectableFunction extends DataFlow::ValueNode {
    * Gets a Custom service corresponding to the dependency-injected `parameter`.
    * (this is a convenience variant of `getAResolvedDependency`)
    */
-  DataFlow::Node getCustomServiceDependency(Parameter parameter) {
+  DataFlow::Node getCustomServiceDependency(DataFlow::ParameterNode parameter) {
     exists(CustomServiceDefinition custom |
       custom.getServiceReference() = getAResolvedDependency(parameter) and
       result = custom.getAService()
@@ -91,100 +93,88 @@ abstract class InjectableFunction extends DataFlow::ValueNode {
  * An injectable function that does not explicitly list its dependencies,
  * instead relying on implicit matching by parameter names.
  */
-private class FunctionWithImplicitDependencyAnnotation extends InjectableFunction {
-  override Function astNode;
-
+private class FunctionWithImplicitDependencyAnnotation extends InjectableFunction instanceof DataFlow::FunctionNode {
   FunctionWithImplicitDependencyAnnotation() {
     this.(DataFlow::FunctionNode).flowsTo(any(DependencyInjection d).getAnInjectableFunction()) and
-    not exists(getAPropertyDependencyInjection(astNode))
+    not exists(getAPropertyDependencyInjection(this))
   }
 
-  override Parameter getDependencyParameter(string name) {
-    result = astNode.getParameterByName(name)
+  override DataFlow::ParameterNode getDependencyParameter(string name) {
+    result = super.getParameterByName(name)
   }
 
-  override Parameter getDependencyDeclaration(int i, string name) {
+  override DataFlow::ParameterNode getDependencyDeclaration(int i, string name) {
     result.getName() = name and
-    result = astNode.getParameter(i)
+    result = super.getParameter(i)
   }
 
-  override Function asFunction() { result = astNode }
+  override DataFlow::FunctionNode asFunction() { result = this }
 
-  override AstNode getAnExplicitDependencyInjection() { none() }
+  override DataFlow::Node getAnExplicitDependencyInjection() { none() }
 }
 
-private DataFlow::PropWrite getAPropertyDependencyInjection(Function function) {
-  exists(DataFlow::FunctionNode ltf |
-    ltf.getAstNode() = function and
-    result = ltf.getAPropertyWrite("$inject")
-  )
+private DataFlow::PropWrite getAPropertyDependencyInjection(DataFlow::FunctionNode function) {
+  result = function.getAPropertyWrite("$inject")
 }
 
 /**
  * An injectable function with an `$inject` property that lists its
  * dependencies.
  */
-private class FunctionWithInjectProperty extends InjectableFunction {
-  override Function astNode;
+private class FunctionWithInjectProperty extends InjectableFunction instanceof DataFlow::FunctionNode {
   DataFlow::ArrayCreationNode dependencies;
 
   FunctionWithInjectProperty() {
     (
       this.(DataFlow::FunctionNode).flowsTo(any(DependencyInjection d).getAnInjectableFunction()) or
-      exists(FunctionWithExplicitDependencyAnnotation f | f.asFunction() = astNode)
+      exists(FunctionWithExplicitDependencyAnnotation f | f.asFunction() = this)
     ) and
     exists(DataFlow::PropWrite pwn |
-      pwn = getAPropertyDependencyInjection(astNode) and
+      pwn = getAPropertyDependencyInjection(this) and
       pwn.getRhs().getALocalSource() = dependencies
     )
   }
 
-  override Parameter getDependencyParameter(string name) {
-    exists(int i | exists(getDependencyDeclaration(i, name)) | result = astNode.getParameter(i))
+  override DataFlow::ParameterNode getDependencyParameter(string name) {
+    exists(int i | exists(getDependencyDeclaration(i, name)) | result = super.getParameter(i))
   }
 
-  override AstNode getDependencyDeclaration(int i, string name) {
-    exists(DataFlow::ValueNode decl |
-      decl = dependencies.getElement(i) and
-      decl.mayHaveStringValue(name) and
-      result = decl.getAstNode()
-    )
+  override DataFlow::Node getDependencyDeclaration(int i, string name) {
+    result = dependencies.getElement(i) and
+    result.mayHaveStringValue(name)
   }
 
-  override Function asFunction() { result = astNode }
+  override DataFlow::FunctionNode asFunction() { result = this }
 
-  override AstNode getAnExplicitDependencyInjection() {
-    result = getAPropertyDependencyInjection(astNode).getAstNode()
+  override DataFlow::Node getAnExplicitDependencyInjection() {
+    result = getAPropertyDependencyInjection(this)
   }
 }
 
 /**
  * An injectable function embedded in an array of dependencies.
  */
-private class FunctionWithExplicitDependencyAnnotation extends InjectableFunction {
+private class FunctionWithExplicitDependencyAnnotation extends InjectableFunction instanceof DataFlow::ArrayCreationNode {
   DataFlow::FunctionNode function;
-  override ArrayExpr astNode;
 
   FunctionWithExplicitDependencyAnnotation() {
     this.(DataFlow::SourceNode).flowsTo(any(DependencyInjection d).getAnInjectableFunction()) and
-    function.flowsToExpr(astNode.getElement(astNode.getSize() - 1))
+    function.flowsTo(super.getElement(super.getSize() - 1))
   }
 
-  override Parameter getDependencyParameter(string name) {
-    exists(int i | astNode.getElement(i).mayHaveStringValue(name) |
-      result = asFunction().getParameter(i)
-    )
+  override DataFlow::ParameterNode getDependencyParameter(string name) {
+    exists(int i | super.getElement(i).mayHaveStringValue(name) | result = function.getParameter(i))
   }
 
-  override AstNode getDependencyDeclaration(int i, string name) {
-    result = astNode.getElement(i) and
-    result.(Expr).mayHaveStringValue(name)
+  override DataFlow::Node getDependencyDeclaration(int i, string name) {
+    result = super.getElement(i) and
+    result.mayHaveStringValue(name)
   }
 
-  override Function asFunction() { result = function.getAstNode() }
+  override DataFlow::FunctionNode asFunction() { result = function }
 
-  override AstNode getAnExplicitDependencyInjection() {
-    result = astNode or
+  override DataFlow::Node getAnExplicitDependencyInjection() {
+    result = this or
     result = function.(InjectableFunction).getAnExplicitDependencyInjection()
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/ServiceDefinitions.qll b/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/ServiceDefinitions.qll
index 6d421de851c..a9941c6492d 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/ServiceDefinitions.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/AngularJS/ServiceDefinitions.qll
@@ -27,7 +27,7 @@ private newtype TServiceReference =
  */
 abstract class ServiceReference extends TServiceReference {
   /** Gets a textual representation of this element. */
-  string toString() { result = getName() }
+  string toString() { result = this.getName() }
 
   /**
    * Gets the name of this reference.
@@ -38,26 +38,26 @@ abstract class ServiceReference extends TServiceReference {
    * Gets a data flow node that may refer to this service.
    */
   DataFlow::SourceNode getAReference() {
-    result = DataFlow::parameterNode(any(ServiceRequest request).getDependencyParameter(this))
+    result = any(ServiceRequestNode request).getDependencyParameter(this)
   }
 
   /**
    * Gets an access to the referenced service.
    */
-  Expr getAnAccess() {
-    result.mayReferToParameter(any(ServiceRequest request).getDependencyParameter(this))
+  DataFlow::Node getAnAccess() {
+    any(ServiceRequestNode request).getDependencyParameter(this).flowsTo(result)
   }
 
   /**
    * Gets a call that invokes the referenced service.
    */
-  CallExpr getACall() { result.getCallee() = getAnAccess() }
+  DataFlow::CallNode getACall() { result.getCalleeNode() = this.getAnAccess() }
 
   /**
    * Gets a method call that invokes method `methodName` on the referenced service.
    */
-  MethodCallExpr getAMethodCall(string methodName) {
-    result.getReceiver() = getAnAccess() and
+  DataFlow::MethodCallNode getAMethodCall(string methodName) {
+    result.getReceiver() = this.getAnAccess() and
     result.getMethodName() = methodName
   }
 
@@ -65,7 +65,7 @@ abstract class ServiceReference extends TServiceReference {
    * Gets an access to property `propertyName` on the referenced service.
    */
   DataFlow::PropRef getAPropertyAccess(string propertyName) {
-    result.getBase().asExpr() = getAnAccess() and
+    result.getBase() = this.getAnAccess() and
     result.getPropertyName() = propertyName
   }
 
@@ -93,7 +93,7 @@ class BuiltinServiceReference extends ServiceReference, MkBuiltinServiceReferenc
 DataFlow::ParameterNode builtinServiceRef(string serviceName) {
   exists(InjectableFunction f, BuiltinServiceReference service |
     service.getName() = serviceName and
-    result = DataFlow::parameterNode(f.getDependencyParameter(serviceName))
+    result = f.getDependencyParameter(serviceName)
   )
 }
 
@@ -244,17 +244,17 @@ abstract class RecipeDefinition extends DataFlow::CallNode, CustomServiceDefinit
       this = moduleRef(_).getAMethodCall(methodName) or
       this = builtinServiceRef("$provide").getAMethodCall(methodName)
     ) and
-    getArgument(0).asExpr().mayHaveStringValue(name)
+    this.getArgument(0).mayHaveStringValue(name)
   }
 
   override string getName() { result = name }
 
-  override DataFlow::SourceNode getAFactoryFunction() { result.flowsTo(getArgument(1)) }
+  override DataFlow::SourceNode getAFactoryFunction() { result.flowsTo(this.getArgument(1)) }
 
   override DataFlow::Node getAnInjectableFunction() {
     methodName != "value" and
     methodName != "constant" and
-    result = getAFactoryFunction()
+    result = this.getAFactoryFunction()
   }
 }
 
@@ -269,7 +269,7 @@ abstract class RecipeDefinition extends DataFlow::CallNode, CustomServiceDefinit
  */
 abstract private class CustomSpecialServiceDefinition extends CustomServiceDefinition,
   DependencyInjection {
-  override DataFlow::Node getAnInjectableFunction() { result = getAFactoryFunction() }
+  override DataFlow::Node getAnInjectableFunction() { result = this.getAFactoryFunction() }
 }
 
 /**
@@ -281,7 +281,7 @@ private predicate isCustomServiceDefinitionOnModule(
   DataFlow::Node factoryFunction
 ) {
   mce = moduleRef(_).getAMethodCall(moduleMethodName) and
-  mce.getArgument(0).asExpr().mayHaveStringValue(serviceName) and
+  mce.getArgument(0).mayHaveStringValue(serviceName) and
   factoryFunction = mce.getArgument(1)
 }
 
@@ -296,7 +296,7 @@ private predicate isCustomServiceDefinitionOnProvider(
     factoryArgument = mce.getOptionArgument(0, serviceName)
     or
     mce.getNumArgument() = 2 and
-    mce.getArgument(0).asExpr().mayHaveStringValue(serviceName) and
+    mce.getArgument(0).mayHaveStringValue(serviceName) and
     factoryArgument = mce.getArgument(1)
   )
 }
@@ -338,7 +338,7 @@ class FilterDefinition extends CustomSpecialServiceDefinition {
   override DataFlow::SourceNode getAService() {
     exists(InjectableFunction f |
       f = factoryFunction.getALocalSource() and
-      result.flowsToExpr(f.asFunction().getAReturnedExpr())
+      result.flowsTo(f.asFunction().getAReturn())
     )
   }
 
@@ -428,7 +428,7 @@ class AnimationDefinition extends CustomSpecialServiceDefinition {
   override DataFlow::SourceNode getAService() {
     exists(InjectableFunction f |
       f = factoryFunction.getALocalSource() and
-      result.flowsToExpr(f.asFunction().getAReturnedExpr())
+      result.flowsTo(f.asFunction().getAReturn())
     )
   }
 
@@ -446,22 +446,37 @@ BuiltinServiceReference getBuiltinServiceOfKind(string kind) {
 }
 
 /**
+ * DEPRECATED: Use `ServiceRequestNode` instead.
  * A request for one or more AngularJS services.
  */
-abstract class ServiceRequest extends Expr {
+deprecated class ServiceRequest extends Expr {
+  ServiceRequestNode node;
+
+  ServiceRequest() { this.flow() = node }
+
+  /** Gets the parameter of this request into which `service` is injected. */
+  deprecated Parameter getDependencyParameter(ServiceReference service) {
+    result.flow() = node.getDependencyParameter(service)
+  }
+}
+
+/**
+ * A request for one or more AngularJS services.
+ */
+abstract class ServiceRequestNode extends DataFlow::Node {
   /**
    * Gets the parameter of this request into which `service` is injected.
    */
-  abstract Parameter getDependencyParameter(ServiceReference service);
+  abstract DataFlow::ParameterNode getDependencyParameter(ServiceReference service);
 }
 
 /**
  * The request for a scope service in the form of the link-function of a directive.
  */
-private class LinkFunctionWithScopeInjection extends ServiceRequest {
+private class LinkFunctionWithScopeInjection extends ServiceRequestNode {
   LinkFunctionWithScopeInjection() { this instanceof LinkFunction }
 
-  override Parameter getDependencyParameter(ServiceReference service) {
+  override DataFlow::ParameterNode getDependencyParameter(ServiceReference service) {
     service instanceof ScopeServiceReference and
     result = this.(LinkFunction).getScopeParameter()
   }
@@ -470,10 +485,10 @@ private class LinkFunctionWithScopeInjection extends ServiceRequest {
 /**
  * A request for a service, in the form of a dependency-injected function.
  */
-class InjectableFunctionServiceRequest extends ServiceRequest {
+class InjectableFunctionServiceRequest extends ServiceRequestNode {
   InjectableFunction injectedFunction;
 
-  InjectableFunctionServiceRequest() { injectedFunction.getAstNode() = this }
+  InjectableFunctionServiceRequest() { injectedFunction = this }
 
   /**
    * Gets the function of this request.
@@ -483,7 +498,9 @@ class InjectableFunctionServiceRequest extends ServiceRequest {
   /**
    * Gets a name of a requested service.
    */
-  string getAServiceName() { exists(getAnInjectedFunction().getADependencyDeclaration(result)) }
+  string getAServiceName() {
+    exists(this.getAnInjectedFunction().getADependencyDeclaration(result))
+  }
 
   /**
    * Gets a service with the specified name, relative to this request.
@@ -494,16 +511,16 @@ class InjectableFunctionServiceRequest extends ServiceRequest {
     result.isInjectable()
   }
 
-  override Parameter getDependencyParameter(ServiceReference service) {
+  override DataFlow::ParameterNode getDependencyParameter(ServiceReference service) {
     service = injectedFunction.getAResolvedDependency(result)
   }
 }
 
 private DataFlow::SourceNode getFactoryFunctionResult(RecipeDefinition def) {
-  exists(Function factoryFunction, InjectableFunction f |
+  exists(DataFlow::FunctionNode factoryFunction, InjectableFunction f |
     f = def.getAFactoryFunction() and
     factoryFunction = f.asFunction() and
-    result.flowsToExpr(factoryFunction.getAReturnedExpr())
+    result.flowsTo(factoryFunction.getAReturn())
   )
 }
 
@@ -561,8 +578,8 @@ class ServiceRecipeDefinition extends RecipeDefinition {
      */
 
     exists(InjectableFunction f |
-      f = getAFactoryFunction() and
-      result.getAstNode() = f.asFunction()
+      f = this.getAFactoryFunction() and
+      result = f.asFunction()
     )
   }
 }
@@ -574,7 +591,7 @@ class ServiceRecipeDefinition extends RecipeDefinition {
 class ValueRecipeDefinition extends RecipeDefinition {
   ValueRecipeDefinition() { methodName = "value" }
 
-  override DataFlow::SourceNode getAService() { result = getAFactoryFunction() }
+  override DataFlow::SourceNode getAService() { result = this.getAFactoryFunction() }
 }
 
 /**
@@ -584,7 +601,7 @@ class ValueRecipeDefinition extends RecipeDefinition {
 class ConstantRecipeDefinition extends RecipeDefinition {
   ConstantRecipeDefinition() { methodName = "constant" }
 
-  override DataFlow::SourceNode getAService() { result = getAFactoryFunction() }
+  override DataFlow::SourceNode getAService() { result = this.getAFactoryFunction() }
 }
 
 /**
@@ -607,8 +624,8 @@ class ProviderRecipeDefinition extends RecipeDefinition {
      */
 
     exists(DataFlow::ThisNode thiz, InjectableFunction f |
-      f = getAFactoryFunction() and
-      thiz.getBinder().getFunction() = f.asFunction() and
+      f = this.getAFactoryFunction() and
+      thiz.getBinder() = f.asFunction() and
       result = thiz.getAPropertySource("$get")
     )
   }
@@ -632,7 +649,9 @@ class ConfigMethodDefinition extends ModuleApiCall {
   /**
    * Gets a provided configuration method.
    */
-  InjectableFunction getConfigMethod() { result.(DataFlow::SourceNode).flowsTo(getArgument(0)) }
+  InjectableFunction getConfigMethod() {
+    result.(DataFlow::SourceNode).flowsTo(this.getArgument(0))
+  }
 }
 
 /**
@@ -645,12 +664,12 @@ class RunMethodDefinition extends ModuleApiCall {
   /**
    * Gets a provided run method.
    */
-  InjectableFunction getRunMethod() { result.(DataFlow::SourceNode).flowsTo(getArgument(0)) }
+  InjectableFunction getRunMethod() { result.(DataFlow::SourceNode).flowsTo(this.getArgument(0)) }
 }
 
 /**
  * The `$scope` or `$rootScope` service.
  */
 class ScopeServiceReference extends BuiltinServiceReference {
-  ScopeServiceReference() { getName() = "$scope" or getName() = "$rootScope" }
+  ScopeServiceReference() { this.getName() = "$scope" or this.getName() = "$rootScope" }
 }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Azure.qll b/javascript/ql/lib/semmle/javascript/frameworks/Azure.qll
index 5cfd2c8326d..1527b655edd 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Azure.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Azure.qll
@@ -8,13 +8,14 @@ module Azure {
   /**
    * An expression that is used for authentication at Azure`.
    */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
-      exists(CallExpr mce, string methodName |
-        (methodName = "loginWithUsernamePassword" or methodName = "loginWithServicePrincipalSecret") and
-        mce = DataFlow::moduleMember("ms-rest-azure", methodName).getACall().asExpr()
+      exists(DataFlow::CallNode mce |
+        mce =
+          DataFlow::moduleMember("ms-rest-azure",
+            ["loginWithUsernamePassword", "loginWithServicePrincipalSecret"]).getACall()
       |
         this = mce.getArgument(0) and kind = "user name"
         or
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll b/javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll
index 8e56a36b9bf..f570c9d3a38 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll
@@ -112,7 +112,7 @@ module ClientRequest {
   /**
    * Gets the name of an HTTP request method, in all-lowercase.
    */
-  private string httpMethodName() { result = any(HTTP::RequestMethodName m).toLowerCase() }
+  private string httpMethodName() { result = any(Http::RequestMethodName m).toLowerCase() }
 
   /**
    * Gets a model of an instance of the `request` library, or one of
@@ -270,16 +270,16 @@ module ClientRequest {
   }
 
   /** An expression that is used as a credential in a request. */
-  private class AuthorizationHeader extends CredentialsExpr {
+  private class AuthorizationHeader extends CredentialsNode {
     AuthorizationHeader() {
       exists(DataFlow::PropWrite write | write.getPropertyName().regexpMatch("(?i)authorization") |
-        this = write.getRhs().asExpr()
+        this = write.getRhs()
       )
       or
       exists(DataFlow::MethodCallNode call | call.getMethodName() = ["append", "set"] |
         call.getNumArgument() = 2 and
         call.getArgument(0).getStringValue().regexpMatch("(?i)authorization") and
-        this = call.getArgument(1).asExpr()
+        this = call.getArgument(1)
       )
     }
 
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Connect.qll b/javascript/ql/lib/semmle/javascript/frameworks/Connect.qll
index 06138746fa6..59518a2f4f3 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Connect.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Connect.qll
@@ -10,10 +10,10 @@ module Connect {
   /**
    * An expression that creates a new Connect server.
    */
-  class ServerDefinition extends HTTP::Servers::StandardServerDefinition, CallExpr {
+  class ServerDefinition extends Http::Servers::StandardServerDefinition, DataFlow::CallNode {
     ServerDefinition() {
       // `app = connect()`
-      this = DataFlow::moduleImport("connect").getAnInvocation().asExpr()
+      this = DataFlow::moduleImport("connect").getAnInvocation()
     }
   }
 
@@ -30,43 +30,45 @@ module Connect {
      *
      * `kind` is one of: "error", "request", "response", "next".
      */
-    abstract Parameter getRouteHandlerParameter(string kind);
+    abstract DataFlow::ParameterNode getRouteHandlerParameter(string kind);
 
     /**
      * Gets the parameter of the route handler that contains the request object.
      */
-    override Parameter getRequestParameter() { result = getRouteHandlerParameter("request") }
+    override DataFlow::ParameterNode getRequestParameter() {
+      result = getRouteHandlerParameter("request")
+    }
 
     /**
      * Gets the parameter of the route handler that contains the response object.
      */
-    override Parameter getResponseParameter() { result = getRouteHandlerParameter("response") }
+    override DataFlow::ParameterNode getResponseParameter() {
+      result = getRouteHandlerParameter("response")
+    }
   }
 
   /**
    * A Connect route handler installed by a route setup.
    */
-  class StandardRouteHandler extends RouteHandler {
-    override Function astNode;
-
+  class StandardRouteHandler extends RouteHandler, DataFlow::FunctionNode {
     StandardRouteHandler() { this = any(RouteSetup setup).getARouteHandler() }
 
-    override Parameter getRouteHandlerParameter(string kind) {
-      result = getRouteHandlerParameter(astNode, kind)
+    override DataFlow::ParameterNode getRouteHandlerParameter(string kind) {
+      result = getRouteHandlerParameter(this, kind)
     }
   }
 
   /**
    * A call to a Connect method that sets up a route.
    */
-  class RouteSetup extends MethodCallExpr, HTTP::Servers::StandardRouteSetup {
+  class RouteSetup extends DataFlow::MethodCallNode, Http::Servers::StandardRouteSetup {
     ServerDefinition server;
 
     RouteSetup() {
       getMethodName() = "use" and
       (
         // app.use(fun)
-        server.flowsTo(getReceiver())
+        server.ref().getAMethodCall() = this
         or
         // app.use(...).use(fun)
         this.getReceiver().(RouteSetup).getServer() = server
@@ -79,24 +81,32 @@ module Connect {
 
     private DataFlow::SourceNode getARouteHandler(DataFlow::TypeBackTracker t) {
       t.start() and
-      result = getARouteHandlerExpr().flow().getALocalSource()
+      result = getARouteHandlerNode().getALocalSource()
       or
       exists(DataFlow::TypeBackTracker t2 | result = getARouteHandler(t2).backtrack(t2, t))
     }
 
-    override Expr getServer() { result = server }
+    override DataFlow::Node getServer() { result = server }
 
-    /** Gets an argument that represents a route handler being registered. */
-    Expr getARouteHandlerExpr() { result = getAnArgument() }
+    /**
+     * DEPRECATED: Use `getARouteHandlerNode` instead.
+     * Gets an argument that represents a route handler being registered.
+     */
+    deprecated Expr getARouteHandlerExpr() { result = getARouteHandlerNode().asExpr() }
+
+    /**
+     * Gets an argument that represents a route handler being registered.
+     */
+    DataFlow::Node getARouteHandlerNode() { result = getAnArgument() }
   }
 
   /** An expression that is passed as `basicAuthConnect(<user>, <password>)`. */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
-      exists(CallExpr call |
-        call = DataFlow::moduleImport("basic-auth-connect").getAnInvocation().asExpr() and
+      exists(DataFlow::CallNode call |
+        call = DataFlow::moduleImport("basic-auth-connect").getAnInvocation() and
         call.getNumArgument() = 2
       |
         this = call.getArgument(0) and kind = "user name"
@@ -108,22 +118,24 @@ module Connect {
     override string getCredentialsKind() { result = kind }
   }
 
-  class RequestExpr = NodeJSLib::RequestExpr;
+  deprecated class RequestExpr = NodeJSLib::RequestExpr;
+
+  class RequestNode = NodeJSLib::RequestNode;
 
   /**
    * An access to a user-controlled Connect request input.
    */
-  private class RequestInputAccess extends HTTP::RequestInputAccess {
-    RequestExpr request;
+  private class RequestInputAccess extends Http::RequestInputAccess instanceof DataFlow::MethodCallNode {
+    RequestNode request;
     string kind;
 
     RequestInputAccess() {
       request.getRouteHandler() instanceof StandardRouteHandler and
-      exists(PropAccess cookies |
+      exists(DataFlow::PropRead cookies |
         // `req.cookies.get(<name>)`
         kind = "cookie" and
         cookies.accesses(request, "cookies") and
-        this.asExpr().(MethodCallExpr).calls(cookies, "get")
+        super.calls(cookies, "get")
       )
     }
 
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/ConnectExpressShared.qll b/javascript/ql/lib/semmle/javascript/frameworks/ConnectExpressShared.qll
index 489fcf550c4..87956ef38c8 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/ConnectExpressShared.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/ConnectExpressShared.qll
@@ -52,7 +52,7 @@ module ConnectExpressShared {
   /**
    * Holds if `function` appears to match the given signature based on parameter naming.
    */
-  private predicate matchesSignature(Function function, RouteHandlerSignature sig) {
+  private predicate matchesSignature(DataFlow::FunctionNode function, RouteHandlerSignature sig) {
     function.getNumParameter() = sig.getArity() and
     function.getParameter(sig.getParameterIndex("request")).getName() = ["req", "request"] and
     function.getParameter(sig.getParameterIndex("response")).getName() = ["res", "response"] and
@@ -71,8 +71,8 @@ module ConnectExpressShared {
    * so the caller should restrict the function accordingly.
    */
   pragma[inline]
-  private Parameter getRouteHandlerParameter(
-    Function routeHandler, RouteHandlerSignature sig, string kind
+  private DataFlow::ParameterNode getRouteHandlerParameter(
+    DataFlow::FunctionNode routeHandler, RouteHandlerSignature sig, string kind
   ) {
     result = routeHandler.getParameter(sig.getParameterIndex(kind))
   }
@@ -83,7 +83,9 @@ module ConnectExpressShared {
    * `kind` is one of: "error", "request", "response", "next".
    */
   pragma[inline]
-  Parameter getRouteParameterHandlerParameter(Function routeHandler, string kind) {
+  DataFlow::ParameterNode getRouteParameterHandlerParameter(
+    DataFlow::FunctionNode routeHandler, string kind
+  ) {
     result =
       getRouteHandlerParameter(routeHandler, RouteHandlerSignature::requestResponseNextParameter(),
         kind)
@@ -95,7 +97,7 @@ module ConnectExpressShared {
    * `kind` is one of: "error", "request", "response", "next".
    */
   pragma[inline]
-  Parameter getRouteHandlerParameter(Function routeHandler, string kind) {
+  DataFlow::ParameterNode getRouteHandlerParameter(DataFlow::FunctionNode routeHandler, string kind) {
     if routeHandler.getNumParameter() = 4
     then
       // For arity 4 there is ambiguity between (err, req, res, next) and (req, res, next, param)
@@ -113,9 +115,9 @@ module ConnectExpressShared {
    *
    * For example, this could be the function `function(req, res, next){...}`.
    */
-  class RouteHandlerCandidate extends HTTP::RouteHandlerCandidate {
+  class RouteHandlerCandidate extends Http::RouteHandlerCandidate {
     RouteHandlerCandidate() {
-      matchesSignature(astNode, _) and
+      matchesSignature(this, _) and
       not (
         // heuristic: not a class method (the server invokes this with a function call)
         astNode = any(MethodDefinition def).getBody()
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/CookieLibraries.qll b/javascript/ql/lib/semmle/javascript/frameworks/CookieLibraries.qll
index 77bfff9f388..b78fd0834db 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/CookieLibraries.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/CookieLibraries.qll
@@ -76,7 +76,7 @@ private predicate canHaveSensitiveCookie(DataFlow::Node node) {
     HeuristicNames::nameIndicatesSensitiveData([s, getCookieName(s)], _)
   )
   or
-  node.asExpr() instanceof SensitiveExpr
+  node instanceof SensitiveNode
 }
 
 /**
@@ -271,30 +271,27 @@ private module ExpressCookies {
   /**
    * A cookie set using `response.cookie` from `express` module (https://expressjs.com/en/api.html#res.cookie).
    */
-  private class InsecureExpressCookieResponse extends CookieWrites::CookieWrite,
-    DataFlow::MethodCallNode {
-    InsecureExpressCookieResponse() { this.asExpr() instanceof Express::SetCookie }
-
+  private class InsecureExpressCookieResponse extends CookieWrites::CookieWrite instanceof Express::SetCookie {
     override predicate isSecure() {
       // A cookie is secure if there are cookie options with the `secure` flag set to `true`.
       // The default is `false`.
-      exists(DataFlow::Node value | value = this.getOptionArgument(2, CookieWrites::secure()) |
+      exists(DataFlow::Node value | value = super.getOptionArgument(2, CookieWrites::secure()) |
         not value.mayHaveBooleanValue(false) // anything but `false` is accepted as being maybe true
       )
     }
 
-    override predicate isSensitive() { canHaveSensitiveCookie(this.getArgument(0)) }
+    override predicate isSensitive() { canHaveSensitiveCookie(super.getArgument(0)) }
 
     override predicate isHttpOnly() {
       // A cookie is httpOnly if there are cookie options with the `httpOnly` flag set to `true`.
       // The default is `false`.
-      exists(DataFlow::Node value | value = this.getOptionArgument(2, CookieWrites::httpOnly()) |
+      exists(DataFlow::Node value | value = super.getOptionArgument(2, CookieWrites::httpOnly()) |
         not value.mayHaveBooleanValue(false) // anything but `false` is accepted as being maybe true
       )
     }
 
     override string getSameSite() {
-      result = getSameSiteValue(this.getOptionArgument(2, "sameSite"))
+      result = getSameSiteValue(super.getOptionArgument(2, "sameSite"))
     }
   }
 
@@ -371,11 +368,11 @@ private class HttpCookieWrite extends CookieWrites::CookieWrite {
   string header;
 
   HttpCookieWrite() {
-    exists(HTTP::CookieDefinition setCookie |
-      this.asExpr() = setCookie.getHeaderArgument() and
+    exists(Http::CookieDefinition setCookie |
+      this = setCookie.getHeaderArgument() and
       not this instanceof DataFlow::ArrayCreationNode
       or
-      this = setCookie.getHeaderArgument().flow().(DataFlow::ArrayCreationNode).getAnElement()
+      this = setCookie.getHeaderArgument().(DataFlow::ArrayCreationNode).getAnElement()
     ) and
     header =
       [
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Credentials.qll b/javascript/ql/lib/semmle/javascript/frameworks/Credentials.qll
index 164bc6e8f88..ad27a0fe828 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Credentials.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Credentials.qll
@@ -6,10 +6,27 @@
 import javascript
 
 /**
+ * DEPRECATED: Use `CredentialsNode` instead.
  * An expression whose value is used to supply credentials such
  * as a user name, a password, or a key.
  */
-abstract class CredentialsExpr extends Expr {
+deprecated class CredentialsExpr extends Expr {
+  CredentialsNode node;
+
+  CredentialsExpr() { node.asExpr() = this }
+
+  /**
+   * Gets a description of the kind of credential this expression is used as,
+   * such as `"user name"`, `"password"`, `"key"`.
+   */
+  deprecated string getCredentialsKind() { result = node.getCredentialsKind() }
+}
+
+/**
+ * An expression whose value is used to supply credentials such
+ * as a user name, a password, or a key.
+ */
+abstract class CredentialsNode extends DataFlow::Node {
   /**
    * Gets a description of the kind of credential this expression is used as,
    * such as `"user name"`, `"password"`, `"key"`.
@@ -17,12 +34,10 @@ abstract class CredentialsExpr extends Expr {
   abstract string getCredentialsKind();
 }
 
-private class CredentialsFromModel extends CredentialsExpr {
+private class CredentialsFromModel extends CredentialsNode {
   string kind;
 
-  CredentialsFromModel() {
-    this = ModelOutput::getASinkNode("credentials[" + kind + "]").asSink().asExpr()
-  }
+  CredentialsFromModel() { this = ModelOutput::getASinkNode("credentials[" + kind + "]").asSink() }
 
   override string getCredentialsKind() { result = kind }
 }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/CryptoLibraries.qll b/javascript/ql/lib/semmle/javascript/frameworks/CryptoLibraries.qll
index 9dcd4d9fbb9..9cf4dcfaace 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/CryptoLibraries.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/CryptoLibraries.qll
@@ -8,11 +8,11 @@ import semmle.javascript.security.CryptoAlgorithms
 /**
  * An application of a cryptographic algorithm.
  */
-abstract class CryptographicOperation extends Expr {
+abstract class CryptographicOperation extends DataFlow::Node {
   /**
    * Gets the input the algorithm is used on, e.g. the plain text input to be encrypted.
    */
-  abstract Expr getInput();
+  abstract DataFlow::Node getInput();
 
   /**
    * Gets the applied algorithm.
@@ -46,11 +46,9 @@ abstract class CryptographicKeyCreation extends DataFlow::Node {
 }
 
 /**
- * A key used in a cryptographic algorithm, viewed as a `CredentialsExpr`.
+ * A key used in a cryptographic algorithm, viewed as a `CredentialsNode`.
  */
-class CryptographicKeyCredentialsExpr extends CredentialsExpr {
-  CryptographicKeyCredentialsExpr() { this = any(CryptographicKey k).asExpr() }
-
+class CryptographicKeyCredentialsExpr extends CredentialsNode instanceof CryptographicKey {
   override string getCredentialsKind() { result = "key" }
 }
 
@@ -58,8 +56,8 @@ class CryptographicKeyCredentialsExpr extends CredentialsExpr {
  * A model of the asmCrypto library.
  */
 private module AsmCrypto {
-  private class Apply extends CryptographicOperation {
-    Expr input;
+  private class Apply extends CryptographicOperation instanceof DataFlow::CallNode {
+    DataFlow::Node input;
     CryptographicAlgorithm algorithm; // non-functional
 
     Apply() {
@@ -73,17 +71,15 @@ private module AsmCrypto {
        *      ```
        */
 
-      exists(DataFlow::CallNode mce | this = mce.asExpr() |
-        exists(DataFlow::SourceNode asmCrypto, string algorithmName |
-          asmCrypto = DataFlow::globalVarRef("asmCrypto") and
-          algorithm.matchesName(algorithmName) and
-          mce = asmCrypto.getAPropertyRead(algorithmName).getAMemberCall(_) and
-          input = mce.getAnArgument().asExpr()
-        )
+      exists(DataFlow::SourceNode asmCrypto, string algorithmName |
+        asmCrypto = DataFlow::globalVarRef("asmCrypto") and
+        algorithm.matchesName(algorithmName) and
+        this = asmCrypto.getAPropertyRead(algorithmName).getAMemberCall(_) and
+        input = this.getAnArgument()
       )
     }
 
-    override Expr getInput() { result = input }
+    override DataFlow::Node getInput() { result = input }
 
     override CryptographicAlgorithm getAlgorithm() { result = algorithm }
   }
@@ -97,9 +93,8 @@ private module BrowserIdCrypto {
     Key() { this = any(Apply apply).getKey() }
   }
 
-  private class Apply extends CryptographicOperation {
+  private class Apply extends CryptographicOperation instanceof DataFlow::MethodCallNode {
     CryptographicAlgorithm algorithm; // non-functional
-    MethodCallExpr mce;
 
     Apply() {
       /*
@@ -118,7 +113,6 @@ private module BrowserIdCrypto {
        *      ```
        */
 
-      this = mce and
       exists(
         DataFlow::SourceNode mod, DataFlow::Node algorithmNameNode, DataFlow::CallNode keygen,
         DataFlow::FunctionNode callback
@@ -128,15 +122,15 @@ private module BrowserIdCrypto {
         algorithmNameNode = keygen.getOptionArgument(0, "algorithm") and
         algorithm.matchesName(algorithmNameNode.getStringValue()) and
         callback = keygen.getCallback(1) and
-        this = mod.getAMemberCall("sign").asExpr()
+        this = mod.getAMemberCall("sign")
       )
     }
 
-    override Expr getInput() { result = mce.getArgument(0) }
+    override DataFlow::Node getInput() { result = super.getArgument(0) }
 
     override CryptographicAlgorithm getAlgorithm() { result = algorithm }
 
-    DataFlow::Node getKey() { result.asExpr() = mce.getArgument(1) }
+    DataFlow::Node getKey() { result = super.getArgument(1) }
   }
 }
 
@@ -217,14 +211,12 @@ private module NodeJSCrypto {
     override predicate isSymmetricKey() { none() }
   }
 
-  private class Apply extends CryptographicOperation, MethodCallExpr {
+  private class Apply extends CryptographicOperation instanceof DataFlow::MethodCallNode {
     InstantiatedAlgorithm instantiation;
 
-    Apply() {
-      this = instantiation.getAMethodCall(any(string m | m = "update" or m = "write")).asExpr()
-    }
+    Apply() { this = instantiation.getAMethodCall(any(string m | m = "update" or m = "write")) }
 
-    override Expr getInput() { result = this.getArgument(0) }
+    override DataFlow::Node getInput() { result = super.getArgument(0) }
 
     override CryptographicAlgorithm getAlgorithm() { result = instantiation.getAlgorithm() }
   }
@@ -260,7 +252,7 @@ private module CryptoJS {
   /**
    *  Matches `CryptoJS.<algorithmName>` and `require("crypto-js/<algorithmName>")`
    */
-  private DataFlow::SourceNode getAlgorithmExpr(CryptographicAlgorithm algorithm) {
+  private DataFlow::SourceNode getAlgorithmNode(CryptographicAlgorithm algorithm) {
     exists(string algorithmName | algorithm.matchesName(algorithmName) |
       exists(DataFlow::SourceNode mod | mod = DataFlow::moduleImport("crypto-js") |
         result = mod.getAPropertyRead(algorithmName) or
@@ -274,7 +266,9 @@ private module CryptoJS {
     )
   }
 
-  private DataFlow::CallNode getEncryptionApplication(Expr input, CryptographicAlgorithm algorithm) {
+  private DataFlow::CallNode getEncryptionApplication(
+    DataFlow::Node input, CryptographicAlgorithm algorithm
+  ) {
     /*
      *    ```
      *    var CryptoJS = require("crypto-js");
@@ -288,11 +282,13 @@ private module CryptoJS {
      *    Also matches where `CryptoJS.<algorithmName>` has been replaced by `require("crypto-js/<algorithmName>")`
      */
 
-    result = getAlgorithmExpr(algorithm).getAMemberCall("encrypt") and
-    input = result.getArgument(0).asExpr()
+    result = getAlgorithmNode(algorithm).getAMemberCall("encrypt") and
+    input = result.getArgument(0)
   }
 
-  private DataFlow::CallNode getDirectApplication(Expr input, CryptographicAlgorithm algorithm) {
+  private DataFlow::CallNode getDirectApplication(
+    DataFlow::Node input, CryptographicAlgorithm algorithm
+  ) {
     /*
      *    ```
      *    var CryptoJS = require("crypto-js");
@@ -307,20 +303,20 @@ private module CryptoJS {
      *    Also matches where `CryptoJS.<algorithmName>` has been replaced by `require("crypto-js/<algorithmName>")`
      */
 
-    result = getAlgorithmExpr(algorithm).getACall() and
-    input = result.getArgument(0).asExpr()
+    result = getAlgorithmNode(algorithm).getACall() and
+    input = result.getArgument(0)
   }
 
   private class Apply extends CryptographicOperation {
-    Expr input;
+    DataFlow::Node input;
     CryptographicAlgorithm algorithm; // non-functional
 
     Apply() {
-      this = getEncryptionApplication(input, algorithm).asExpr() or
-      this = getDirectApplication(input, algorithm).asExpr()
+      this = getEncryptionApplication(input, algorithm) or
+      this = getDirectApplication(input, algorithm)
     }
 
-    override Expr getInput() { result = input }
+    override DataFlow::Node getInput() { result = input }
 
     override CryptographicAlgorithm getAlgorithm() { result = algorithm }
   }
@@ -328,7 +324,7 @@ private module CryptoJS {
   private class Key extends CryptographicKey {
     Key() {
       exists(DataFlow::SourceNode e, CryptographicAlgorithm algorithm |
-        e = getAlgorithmExpr(algorithm)
+        e = getAlgorithmNode(algorithm)
       |
         exists(string name |
           name = "encrypt" or
@@ -351,7 +347,7 @@ private module CryptoJS {
     CreateKey() {
       // var key = CryptoJS.PBKDF2(password, salt, { keySize: 8 });
       this =
-        getAlgorithmExpr(any(CryptographicAlgorithm algo | algo.getName() = algorithm)).getACall() and
+        getAlgorithmNode(any(CryptographicAlgorithm algo | algo.getName() = algorithm)).getACall() and
       optionArg = 2
       or
       // var key = CryptoJS.algo.PBKDF2.create({ keySize: 8 });
@@ -378,8 +374,8 @@ private module CryptoJS {
  * A model of the TweetNaCl library.
  */
 private module TweetNaCl {
-  private class Apply extends CryptographicOperation instanceof MethodCallExpr {
-    Expr input;
+  private class Apply extends CryptographicOperation instanceof DataFlow::CallNode {
+    DataFlow::Node input;
     CryptographicAlgorithm algorithm;
 
     Apply() {
@@ -400,12 +396,12 @@ private module TweetNaCl {
         name = "sign" and algorithm.matchesName("ed25519")
       |
         (mod = DataFlow::moduleImport("nacl") or mod = DataFlow::moduleImport("nacl-fast")) and
-        this = mod.getAMemberCall(name).asExpr() and
+        this = mod.getAMemberCall(name) and
         super.getArgument(0) = input
       )
     }
 
-    override Expr getInput() { result = input }
+    override DataFlow::Node getInput() { result = input }
 
     override CryptographicAlgorithm getAlgorithm() { result = algorithm }
   }
@@ -421,7 +417,7 @@ private module HashJs {
    * - `require("hash.js/lib/hash/<algorithmName>")`()
    * - `require("hash.js/lib/hash/sha/<sha-algorithm-suffix>")`()
    */
-  private DataFlow::CallNode getAlgorithmExpr(CryptographicAlgorithm algorithm) {
+  private DataFlow::CallNode getAlgorithmNode(CryptographicAlgorithm algorithm) {
     exists(string algorithmName | algorithm.matchesName(algorithmName) |
       result = DataFlow::moduleMember("hash.js", algorithmName).getACall()
       or
@@ -438,8 +434,8 @@ private module HashJs {
     )
   }
 
-  private class Apply extends CryptographicOperation instanceof MethodCallExpr {
-    Expr input;
+  private class Apply extends CryptographicOperation instanceof DataFlow::CallNode {
+    DataFlow::Node input;
     CryptographicAlgorithm algorithm; // non-functional
 
     Apply() {
@@ -456,11 +452,11 @@ private module HashJs {
        *      Also matches where `hash.<algorithmName>()` has been replaced by a more specific require a la `require("hash.js/lib/hash/sha/512")`
        */
 
-      this = getAlgorithmExpr(algorithm).getAMemberCall("update").asExpr() and
+      this = getAlgorithmNode(algorithm).getAMemberCall("update") and
       input = super.getArgument(0)
     }
 
-    override Expr getInput() { result = input }
+    override DataFlow::Node getInput() { result = input }
 
     override CryptographicAlgorithm getAlgorithm() { result = algorithm }
   }
@@ -492,7 +488,7 @@ private module Forge {
           // `require('forge').cipher.createCipher("3DES-CBC").update("secret", "key");`
           (createName = "createCipher" or createName = "createDecipher") and
           this = mod.getAPropertyRead("cipher").getAMemberCall(createName) and
-          this.getArgument(0).asExpr().mayHaveStringValue(cipherName) and
+          this.getArgument(0).mayHaveStringValue(cipherName) and
           cipherName = cipherPrefix + "-" + cipherSuffix and
           cipherSuffix = ["CBC", "CFB", "CTR", "ECB", "GCM", "OFB"] and
           algorithmName = cipherPrefix and
@@ -531,19 +527,19 @@ private module Forge {
     override CryptographicAlgorithm getAlgorithm() { result = algorithm }
   }
 
-  private class Apply extends CryptographicOperation instanceof MethodCallExpr {
-    Expr input;
+  private class Apply extends CryptographicOperation instanceof DataFlow::CallNode {
+    DataFlow::Node input;
     CryptographicAlgorithm algorithm; // non-functional
 
     Apply() {
       exists(Cipher cipher |
-        this = cipher.getAMemberCall("update").asExpr() and
+        this = cipher.getAMemberCall("update") and
         super.getArgument(0) = input and
         algorithm = cipher.getAlgorithm()
       )
     }
 
-    override Expr getInput() { result = input }
+    override DataFlow::Node getInput() { result = input }
 
     override CryptographicAlgorithm getAlgorithm() { result = algorithm }
   }
@@ -590,8 +586,8 @@ private module Forge {
  * A model of the md5 library.
  */
 private module Md5 {
-  private class Apply extends CryptographicOperation instanceof CallExpr {
-    Expr input;
+  private class Apply extends CryptographicOperation instanceof DataFlow::CallNode {
+    DataFlow::Node input;
     CryptographicAlgorithm algorithm;
 
     Apply() {
@@ -599,12 +595,12 @@ private module Md5 {
       exists(DataFlow::SourceNode mod |
         mod = DataFlow::moduleImport("md5") and
         algorithm.matchesName("MD5") and
-        this = mod.getACall().asExpr() and
+        this = mod.getACall() and
         super.getArgument(0) = input
       )
     }
 
-    override Expr getInput() { result = input }
+    override DataFlow::Node getInput() { result = input }
 
     override CryptographicAlgorithm getAlgorithm() { result = algorithm }
   }
@@ -614,8 +610,8 @@ private module Md5 {
  * A model of the bcrypt, bcryptjs, bcrypt-nodejs libraries.
  */
 private module Bcrypt {
-  private class Apply extends CryptographicOperation instanceof MethodCallExpr {
-    Expr input;
+  private class Apply extends CryptographicOperation instanceof DataFlow::CallNode {
+    DataFlow::Node input;
     CryptographicAlgorithm algorithm;
 
     Apply() {
@@ -632,12 +628,12 @@ private module Bcrypt {
           methodName = "hashSync"
         ) and
         mod = DataFlow::moduleImport(moduleName) and
-        this = mod.getAMemberCall(methodName).asExpr() and
+        this = mod.getAMemberCall(methodName) and
         super.getArgument(0) = input
       )
     }
 
-    override Expr getInput() { result = input }
+    override DataFlow::Node getInput() { result = input }
 
     override CryptographicAlgorithm getAlgorithm() { result = algorithm }
   }
@@ -647,23 +643,23 @@ private module Bcrypt {
  * A model of the hasha library.
  */
 private module Hasha {
-  private class Apply extends CryptographicOperation instanceof CallExpr {
-    Expr input;
+  private class Apply extends CryptographicOperation instanceof DataFlow::CallNode {
+    DataFlow::Node input;
     CryptographicAlgorithm algorithm;
 
     Apply() {
       // `require('hasha')('unicorn', { algorithm: "md5" });`
-      exists(DataFlow::SourceNode mod, string algorithmName, Expr algorithmNameNode |
+      exists(DataFlow::SourceNode mod, string algorithmName, DataFlow::Node algorithmNameNode |
         mod = DataFlow::moduleImport("hasha") and
-        this = mod.getACall().asExpr() and
+        this = mod.getACall() and
         super.getArgument(0) = input and
         algorithm.matchesName(algorithmName) and
-        super.hasOptionArgument(1, "algorithm", algorithmNameNode) and
+        super.getOptionArgument(1, "algorithm") = algorithmNameNode and
         algorithmNameNode.mayHaveStringValue(algorithmName)
       )
     }
 
-    override Expr getInput() { result = input }
+    override DataFlow::Node getInput() { result = input }
 
     override CryptographicAlgorithm getAlgorithm() { result = algorithm }
   }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/DigitalOcean.qll b/javascript/ql/lib/semmle/javascript/frameworks/DigitalOcean.qll
index 76077c93023..60d96a937c9 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/DigitalOcean.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/DigitalOcean.qll
@@ -8,12 +8,12 @@ module DigitalOcean {
   /**
    * An expression that is used for authentication at DigitalOcean: `digitalocean.client(<token>)`.
    */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
-      exists(CallExpr mce |
-        mce = DataFlow::moduleMember("digitalocean", "client").getACall().asExpr()
+      exists(DataFlow::CallNode mce |
+        mce = DataFlow::moduleMember("digitalocean", "client").getACall()
       |
         this = mce.getArgument(0) and kind = "token"
       )
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Electron.qll b/javascript/ql/lib/semmle/javascript/frameworks/Electron.qll
index 038f4b8afb3..5ec9c8edcf9 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Electron.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Electron.qll
@@ -112,7 +112,7 @@ module Electron {
      */
     class ProcessSender extends Process {
       ProcessSender() {
-        exists(IPCSendRegistration reg | reg.getEmitter() instanceof MainProcess |
+        exists(IpcSendRegistration reg | reg.getEmitter() instanceof MainProcess |
           this = reg.getABoundCallbackParameter(1, 0).getAPropertyRead("sender")
         )
       }
@@ -123,28 +123,31 @@ module Electron {
      * Does mostly the same as an EventEmitter event handler,
      * except that values can be returned through the `event.returnValue` property.
      */
-    class IPCSendRegistration extends EventRegistration::DefaultEventRegistration,
+    class IpcSendRegistration extends EventRegistration::DefaultEventRegistration,
       DataFlow::MethodCallNode {
       override Process emitter;
 
-      IPCSendRegistration() { this = emitter.ref().getAMethodCall(EventEmitter::on()) }
+      IpcSendRegistration() { this = emitter.ref().getAMethodCall(EventEmitter::on()) }
 
       override DataFlow::Node getAReturnedValue() {
         result = this.getABoundCallbackParameter(1, 0).getAPropertyWrite("returnValue").getRhs()
       }
 
-      override IPCDispatch getAReturnDispatch() { result.getCalleeName() = "sendSync" }
+      override IpcDispatch getAReturnDispatch() { result.getCalleeName() = "sendSync" }
     }
 
+    /** DEPRECATED: Alias for IpcSendRegistration */
+    deprecated class IPCSendRegistration = IpcSendRegistration;
+
     /**
      * A dispatch of an IPC event.
      * An IPC event is sent from the renderer to the main process.
      * And a value can be returned through the `returnValue` property of the event (first parameter in the callback).
      */
-    class IPCDispatch extends EventDispatch::DefaultEventDispatch, DataFlow::InvokeNode {
+    class IpcDispatch extends EventDispatch::DefaultEventDispatch, DataFlow::InvokeNode {
       override Process emitter;
 
-      IPCDispatch() {
+      IpcDispatch() {
         exists(string methodName | methodName = "sendSync" or methodName = "send" |
           this = emitter.ref().getAMemberCall(methodName)
         )
@@ -163,7 +166,7 @@ module Electron {
       /**
        * Gets a registration that this dispatch can send an event to.
        */
-      override IPCSendRegistration getAReceiver() {
+      override IpcSendRegistration getAReceiver() {
         this.getEmitter() instanceof RendererProcess and
         result.getEmitter() instanceof MainProcess
         or
@@ -171,6 +174,9 @@ module Electron {
         result.getEmitter() instanceof RendererProcess
       }
     }
+
+    /** DEPRECATED: Alias for IpcDispatch */
+    deprecated class IPCDispatch = IpcDispatch;
   }
 
   /**
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Emscripten.qll b/javascript/ql/lib/semmle/javascript/frameworks/Emscripten.qll
index 0e5575226f7..5c0128a57c6 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Emscripten.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Emscripten.qll
@@ -13,10 +13,13 @@ abstract class EmscriptenMarkerComment extends GeneratedCodeMarkerComment { }
 /**
  * An `EMSCRIPTEN_START_ASM` marker comment.
  */
-class EmscriptenStartASMComment extends EmscriptenMarkerComment {
-  EmscriptenStartASMComment() { getText().trim() = "EMSCRIPTEN_START_ASM" }
+class EmscriptenStartAsmComment extends EmscriptenMarkerComment {
+  EmscriptenStartAsmComment() { getText().trim() = "EMSCRIPTEN_START_ASM" }
 }
 
+/** DEPRECATED: Alias for EmscriptenStartAsmComment */
+deprecated class EmscriptenStartASMComment = EmscriptenStartAsmComment;
+
 /**
  * An `EMSCRIPTEN_START_FUNCS` marker comment.
  */
@@ -27,10 +30,13 @@ class EmscriptenStartFuncsComment extends EmscriptenMarkerComment {
 /**
  * An `EMSCRIPTEN_END_ASM` marker comment.
  */
-class EmscriptenEndASMComment extends EmscriptenMarkerComment {
-  EmscriptenEndASMComment() { getText().trim() = "EMSCRIPTEN_END_ASM" }
+class EmscriptenEndAsmComment extends EmscriptenMarkerComment {
+  EmscriptenEndAsmComment() { getText().trim() = "EMSCRIPTEN_END_ASM" }
 }
 
+/** DEPRECATED: Alias for EmscriptenEndAsmComment */
+deprecated class EmscriptenEndASMComment = EmscriptenEndAsmComment;
+
 /**
  * An `EMSCRIPTEN_END_FUNCS` marker comment.
  */
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Express.qll b/javascript/ql/lib/semmle/javascript/frameworks/Express.qll
index 19616530763..a48b7d1719a 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Express.qll
@@ -40,31 +40,27 @@ module Express {
     )
   }
 
-  /**
-   * Holds if `e` may refer to the given `router` object.
-   */
-  private predicate isRouter(Expr e, RouterDefinition router) { router.flowsTo(e) }
+  /** Holds if `e` may refer to the given `router` object. */
+  private predicate isRouter(DataFlow::Node e, RouterDefinition router) { router.ref().flowsTo(e) }
 
   /**
    * Holds if `e` may refer to a router object.
    */
-  private predicate isRouter(Expr e) {
+  private predicate isRouter(DataFlow::Node e) {
     isRouter(e, _)
     or
-    e.getType().hasUnderlyingType("express", "Router")
+    e.asExpr().getType().hasUnderlyingType("express", "Router")
     or
     // created by `webpack-dev-server`
-    WebpackDevServer::webpackDevServerApp().flowsToExpr(e)
+    WebpackDevServer::webpackDevServerApp().flowsTo(e)
   }
 
   /**
+   * DEPRECATED: Use `RouterDefinition.ref()` or `RouteSetup` instead.
    * An expression that refers to a route.
    */
-  class RouteExpr extends MethodCallExpr {
-    RouteExpr() { isRouter(this) }
-
-    /** Gets the router from which this route was created, if it is known. */
-    RouterDefinition getRouter() { isRouter(this, result) }
+  deprecated class RouteExpr extends MethodCallExpr {
+    RouteExpr() { isRouter(this.flow()) }
   }
 
   /**
@@ -74,7 +70,7 @@ module Express {
     result = "param" or
     result = "all" or
     result = "use" or
-    result = any(HTTP::RequestMethodName m).toLowerCase() or
+    result = any(Http::RequestMethodName m).toLowerCase() or
     // deprecated methods
     result = "error" or
     result = "del"
@@ -83,20 +79,20 @@ module Express {
   private class RouterRange extends Routing::Router::Range {
     RouterDefinition def;
 
-    RouterRange() { this = def.flow() }
+    RouterRange() { this = def }
 
     override DataFlow::SourceNode getAReference() { result = def.ref() }
   }
 
   private class RoutingTreeSetup extends Routing::RouteSetup::MethodCall {
-    RoutingTreeSetup() { this.asExpr() instanceof RouteSetup }
+    RoutingTreeSetup() { this instanceof RouteSetup }
 
     override string getRelativePath() {
       not this.getMethodName() = "param" and // do not treat parameter name as a path
       result = this.getArgument(0).getStringValue()
     }
 
-    override HTTP::RequestMethodName getHttpMethod() { result.toLowerCase() = this.getMethodName() }
+    override Http::RequestMethodName getHttpMethod() { result.toLowerCase() = this.getMethodName() }
   }
 
   /**
@@ -140,7 +136,7 @@ module Express {
   /**
    * A call to an Express router method that sets up a route.
    */
-  class RouteSetup extends HTTP::Servers::StandardRouteSetup, MethodCallExpr {
+  class RouteSetup extends Http::Servers::StandardRouteSetup, DataFlow::MethodCallNode {
     RouteSetup() {
       isRouter(this.getReceiver()) and
       this.getMethodName() = routeSetupMethodName()
@@ -156,12 +152,23 @@ module Express {
     predicate isUseCall() { this.getMethodName() = "use" }
 
     /**
+     * DEPRECATED: Use `getRouteHandlerNode` instead.
      * Gets the `n`th handler registered by this setup, with 0 being the first.
      *
      * This differs from `getARouteHandler` in that the argument expression is
      * returned, not its dataflow source.
      */
-    Expr getRouteHandlerExpr(int index) {
+    deprecated Expr getRouteHandlerExpr(int index) {
+      result = this.getRouteHandlerNode(index).asExpr()
+    }
+
+    /**
+     * Gets the `n`th handler registered by this setup, with 0 being the first.
+     *
+     * This differs from `getARouteHandler` in that the argument expression is
+     * returned, not its dataflow source.
+     */
+    DataFlow::Node getRouteHandlerNode(int index) {
       // The first argument is a URI pattern if it is a string. If it could possibly be
       // a function, we consider it to be a route handler, otherwise a URI pattern.
       exists(AnalyzedNode firstArg | firstArg = this.getArgument(0).analyze() |
@@ -173,40 +180,60 @@ module Express {
       )
     }
 
-    /** Gets an argument that represents a route handler being registered. */
-    Expr getARouteHandlerExpr() { result = this.getRouteHandlerExpr(_) }
+    /**
+     * DEPRECATED: Use `getARouteHandlerNode` instead.
+     * Gets an argument that represents a route handler being registered.
+     */
+    deprecated Expr getARouteHandlerExpr() { result = this.getRouteHandlerExpr(_) }
 
-    /** Gets the last argument representing a route handler being registered. */
-    Expr getLastRouteHandlerExpr() {
+    /**
+     * Gets an argument that represents a route handler being registered.
+     */
+    DataFlow::Node getARouteHandlerNode() { result = this.getRouteHandlerNode(_) }
+
+    /**
+     * DEPRECATED: Use `getLastRouteHandlerExpr` instead.
+     * Gets the last argument representing a route handler being registered.
+     */
+    deprecated Expr getLastRouteHandlerExpr() {
       result = max(int i | | this.getRouteHandlerExpr(i) order by i)
     }
 
+    /**
+     * Gets the last argument representing a route handler being registered.
+     */
+    DataFlow::Node getLastRouteHandlerNode() {
+      result = max(int i | | this.getRouteHandlerNode(i) order by i)
+    }
+
     override DataFlow::SourceNode getARouteHandler() {
       result = this.getARouteHandler(DataFlow::TypeBackTracker::end())
     }
 
     private DataFlow::SourceNode getARouteHandler(DataFlow::TypeBackTracker t) {
       t.start() and
-      result = this.getARouteHandlerExpr().flow().getALocalSource()
+      result = this.getARouteHandlerNode().getALocalSource()
       or
       exists(DataFlow::TypeBackTracker t2, DataFlow::SourceNode succ |
         succ = this.getARouteHandler(t2)
       |
         result = succ.backtrack(t2, t)
         or
-        HTTP::routeHandlerStep(result, succ) and
+        Http::routeHandlerStep(result, succ) and
         t = t2
       )
     }
 
-    override Expr getServer() { result.(Application).getARouteHandler() = this.getARouteHandler() }
+    override DataFlow::Node getServer() {
+      result.(Application).getARouteHandler() = this.getARouteHandler()
+    }
 
     /**
      * Gets the HTTP request type this is registered for, if any.
      *
      * Has no result for `use`, `all`, or `param` calls.
      */
-    HTTP::RequestMethodName getRequestMethod() { result.toLowerCase() = this.getMethodName() }
+    Http::RequestMethodName getRequestMethod() { result.toLowerCase() = this.getMethodName() }
 
     /**
      * Holds if this registers a route for all request methods.
@@ -233,16 +260,16 @@ module Express {
   /**
    * A call that sets up a Passport router that includes the request object.
    */
-  private class PassportRouteSetup extends HTTP::Servers::StandardRouteSetup, CallExpr {
+  private class PassportRouteSetup extends Http::Servers::StandardRouteSetup, DataFlow::CallNode {
     DataFlow::ModuleImportNode importNode;
     DataFlow::FunctionNode callback;
 
     // looks for this pattern: passport.use(new Strategy({passReqToCallback: true}, callback))
     PassportRouteSetup() {
       importNode = DataFlow::moduleImport("passport") and
-      this = importNode.getAMemberCall("use").asExpr() and
+      this = importNode.getAMemberCall("use") and
       exists(DataFlow::NewNode strategy |
-        strategy.flowsToExpr(this.getArgument(0)) and
+        strategy.flowsTo(this.getArgument(0)) and
         strategy.getNumArgument() = 2 and
         // new Strategy({passReqToCallback: true}, ...)
         strategy.getOptionArgument(0, "passReqToCallback").mayHaveBooleanValue(true) and
@@ -250,7 +277,7 @@ module Express {
       )
     }
 
-    override Expr getServer() { result = importNode.asExpr() }
+    override DataFlow::Node getServer() { result = importNode }
 
     override DataFlow::SourceNode getARouteHandler() { result = callback }
   }
@@ -258,18 +285,62 @@ module Express {
   /**
    * The callback given to passport in PassportRouteSetup.
    */
-  private class PassportRouteHandler extends RouteHandler, HTTP::Servers::StandardRouteHandler,
-    DataFlow::ValueNode {
-    override Function astNode;
-
+  private class PassportRouteHandler extends RouteHandler, Http::Servers::StandardRouteHandler,
+    DataFlow::FunctionNode {
     PassportRouteHandler() { this = any(PassportRouteSetup setup).getARouteHandler() }
 
-    override Parameter getRouteHandlerParameter(string kind) {
+    override DataFlow::ParameterNode getRouteHandlerParameter(string kind) {
       kind = "request" and
-      result = astNode.getParameter(0)
+      result = this.getParameter(0)
     }
   }
 
+  /**
+   * DEPRECATED: Use `RouteHandlerNode` instead.
+   * An expression used as an Express route handler, such as `submitHandler` below:
+   * ```
+   * app.post('/submit', submitHandler)
+   * ```
+   *
+   * Unlike `RouterHandler`, this is the argument passed to a setup, as opposed to
+   * a function that flows into such an argument.
+   */
+  deprecated class RouteHandlerExpr extends Expr {
+    RouteHandlerNode node;
+
+    RouteHandlerExpr() { this.flow() = node }
+
+    /** Gets the setup call that registers this route handler. */
+    deprecated RouteSetup getSetup() { result = node.getSetup() }
+
+    /** Gets the function body of this handler, if it is defined locally. */
+    deprecated RouteHandler getBody() { result = node.getBody() }
+
+    /** Holds if this is not followed by more handlers. */
+    deprecated predicate isLastHandler() { node.isLastHandler() }
+
+    /** Gets a route handler that immediately precedes this in the route stack. */
+    deprecated Express::RouteHandlerExpr getPreviousMiddleware() {
+      result = node.getPreviousMiddleware().asExpr()
+    }
+
+    /** Gets a route handler that may follow immediately after this one in its route stack. */
+    deprecated Express::RouteHandlerExpr getNextMiddleware() {
+      result = node.getNextMiddleware().asExpr()
+    }
+
+    /**
+     * Gets a route handler that precedes this one (not necessarily immediately), may handle
+     * same request method, and matches on the same path or a prefix.
+     */
+    deprecated Express::RouteHandlerExpr getAMatchingAncestor() {
+      result = node.getAMatchingAncestor().asExpr()
+    }
+
+    /** Gets the router being registered as a sub-router here, if any. */
+    deprecated RouterDefinition getAsSubRouter() { result = node.getAsSubRouter() }
+  }
+
   /**
    * An expression used as an Express route handler, such as `submitHandler` below:
    * ```
@@ -279,11 +350,11 @@ module Express {
    * Unlike `RouterHandler`, this is the argument passed to a setup, as opposed to
    * a function that flows into such an argument.
    */
-  class RouteHandlerExpr extends Expr {
+  class RouteHandlerNode extends DataFlow::Node {
     RouteSetup setup;
     int index;
 
-    RouteHandlerExpr() { this = setup.getRouteHandlerExpr(index) }
+    RouteHandlerNode() { this = setup.getRouteHandlerNode(index) }
 
     /**
      * Gets the setup call that registers this route handler.
@@ -294,7 +365,7 @@ module Express {
      * Gets the function body of this handler, if it is defined locally.
      */
     RouteHandler getBody() {
-      exists(DataFlow::SourceNode source | source = this.flow().getALocalSource() |
+      exists(DataFlow::SourceNode source | source = this.getALocalSource() |
         result = source
         or
         DataFlow::functionOneWayForwardingStep(result.(DataFlow::SourceNode).getALocalUse(), source)
@@ -306,7 +377,7 @@ module Express {
      */
     predicate isLastHandler() {
       not setup.isUseCall() and
-      not exists(setup.getRouteHandlerExpr(index + 1))
+      not exists(setup.getRouteHandlerNode(index + 1))
     }
 
     /**
@@ -331,10 +402,11 @@ module Express {
      * In this case, the previous from `foo` is `auth` although they do not act on the
      * same requests.
      */
-    Express::RouteHandlerExpr getPreviousMiddleware() {
-      index = 0 and result = setup.getRouter().getMiddlewareStackAt(setup.getAPredecessor())
+    Express::RouteHandlerNode getPreviousMiddleware() {
+      index = 0 and
+      result = setup.getRouter().getMiddlewareStackAt(setup.asExpr().getAPredecessor())
       or
-      index > 0 and result = setup.getRouteHandlerExpr(index - 1)
+      index > 0 and result = setup.getRouteHandlerNode(index - 1)
       or
       // Outside the router's original container, use the flow-insensitive model of its middleware stack.
       // Its state is not tracked to CFG nodes outside its original container.
@@ -348,7 +420,7 @@ module Express {
     /**
      * Gets a route handler that may follow immediately after this one in its route stack.
      */
-    Express::RouteHandlerExpr getNextMiddleware() { result.getPreviousMiddleware() = this }
+    Express::RouteHandlerNode getNextMiddleware() { result.getPreviousMiddleware() = this }
 
     /**
      * Gets a route handler that precedes this one (not necessarily immediately), may handle
@@ -361,7 +433,7 @@ module Express {
      * router installs a route handler `r1` on a path that matches the path of a route handler
      * `r2` installed on a subrouter, `r1` will not be recognized as an ancestor of `r2`.
      */
-    Express::RouteHandlerExpr getAMatchingAncestor() {
+    Express::RouteHandlerNode getAMatchingAncestor() {
       result = this.getPreviousMiddleware+() and
       exists(RouteSetup resSetup | resSetup = result.getSetup() |
         // check whether request methods are compatible
@@ -378,7 +450,7 @@ module Express {
       or
       // if this is a sub-router, any previously installed middleware for the same
       // request method will necessarily match
-      exists(RouteHandlerExpr outer |
+      exists(RouteHandlerNode outer |
         setup.getRouter() = outer.getAsSubRouter() and
         outer.getSetup().handlesSameRequestMethodAs(setup) and
         result = outer.getAMatchingAncestor()
@@ -398,52 +470,57 @@ module Express {
    * but support for other kinds of route handlers can be added by implementing
    * additional subclasses of this class.
    */
-  abstract class RouteHandler extends HTTP::RouteHandler {
+  abstract class RouteHandler extends Http::RouteHandler {
     /**
      * Gets the parameter of kind `kind` of this route handler.
      *
      * `kind` is one of: "error", "request", "response", "next", or "parameter".
      */
-    abstract Parameter getRouteHandlerParameter(string kind);
+    abstract DataFlow::ParameterNode getRouteHandlerParameter(string kind);
 
     /**
      * Gets the parameter of the route handler that contains the request object.
      */
-    Parameter getRequestParameter() { result = this.getRouteHandlerParameter("request") }
+    DataFlow::ParameterNode getRequestParameter() {
+      result = this.getRouteHandlerParameter("request")
+    }
 
     /**
      * Gets the parameter of the route handler that contains the response object.
      */
-    Parameter getResponseParameter() { result = this.getRouteHandlerParameter("response") }
+    DataFlow::ParameterNode getResponseParameter() {
+      result = this.getRouteHandlerParameter("response")
+    }
 
     /**
      * Gets a request body access of this handler.
      */
-    Expr getARequestBodyAccess() { result.(PropAccess).accesses(this.getARequestExpr(), "body") }
+    DataFlow::PropRead getARequestBodyAccess() { result.accesses(this.getARequestNode(), "body") }
   }
 
   /**
    * An Express route handler installed by a route setup.
    */
-  class StandardRouteHandler extends RouteHandler, HTTP::Servers::StandardRouteHandler,
-    DataFlow::ValueNode {
-    override Function astNode;
+  class StandardRouteHandler extends RouteHandler, Http::Servers::StandardRouteHandler,
+    DataFlow::FunctionNode {
     RouteSetup routeSetup;
 
     StandardRouteHandler() { this = routeSetup.getARouteHandler() }
 
-    override Parameter getRouteHandlerParameter(string kind) {
+    override DataFlow::ParameterNode getRouteHandlerParameter(string kind) {
       if routeSetup.isParameterHandler()
-      then result = getRouteParameterHandlerParameter(astNode, kind)
-      else result = getRouteHandlerParameter(astNode, kind)
+      then result = getRouteParameterHandlerParameter(this, kind)
+      else result = getRouteHandlerParameter(this, kind)
     }
   }
 
   /**
    * Holds if `call` is a chainable method call on the response object of `handler`.
    */
-  private predicate isChainableResponseMethodCall(RouteHandler handler, MethodCallExpr call) {
-    exists(string name | call.calls(handler.getAResponseExpr(), name) |
+  private predicate isChainableResponseMethodCall(
+    RouteHandler handler, DataFlow::MethodCallNode call
+  ) {
+    exists(string name | call.calls(handler.getAResponseNode(), name) |
       name =
         [
           "append", "attachment", "location", "send", "sendStatus", "set", "status", "type", "vary",
@@ -453,7 +530,7 @@ module Express {
   }
 
   /** An Express response source. */
-  abstract class ResponseSource extends HTTP::Servers::ResponseSource { }
+  abstract class ResponseSource extends Http::Servers::ResponseSource { }
 
   /**
    * An Express response source, that is, the response parameter of a
@@ -463,9 +540,9 @@ module Express {
     RouteHandler rh;
 
     ExplicitResponseSource() {
-      this = DataFlow::parameterNode(rh.getResponseParameter())
+      this = rh.getResponseParameter()
       or
-      isChainableResponseMethodCall(rh, this.asExpr())
+      isChainableResponseMethodCall(rh, this)
     }
 
     /**
@@ -484,7 +561,7 @@ module Express {
   }
 
   /** An Express request source. */
-  abstract class RequestSource extends HTTP::Servers::RequestSource { }
+  abstract class RequestSource extends Http::Servers::RequestSource { }
 
   /**
    * An Express request source, that is, the request parameter of a
@@ -493,7 +570,7 @@ module Express {
   private class ExplicitRequestSource extends RequestSource {
     RouteHandler rh;
 
-    ExplicitRequestSource() { this = DataFlow::parameterNode(rh.getRequestParameter()) }
+    ExplicitRequestSource() { this = rh.getRequestParameter() }
 
     /**
      * Gets the route handler that handles this request.
@@ -511,16 +588,32 @@ module Express {
   }
 
   /**
+   * DEPRECATED: Use `ResponseNode` instead.
    * An Express response expression.
    */
-  class ResponseExpr extends NodeJSLib::ResponseExpr {
+  deprecated class ResponseExpr extends NodeJSLib::ResponseExpr {
+    ResponseExpr() { this.flow() instanceof ResponseNode }
+  }
+
+  /**
+   * An Express response expression.
+   */
+  class ResponseNode extends NodeJSLib::ResponseNode {
     override ResponseSource src;
   }
 
+  /**
+   * DEPRECATED: Use `RequestNode` instead.
+   * An Express request expression.
+   */
+  deprecated class RequestExpr extends NodeJSLib::RequestExpr {
+    RequestExpr() { this.flow() instanceof RequestNode }
+  }
+
   /**
    * An Express request expression.
    */
-  class RequestExpr extends NodeJSLib::RequestExpr {
+  class RequestNode extends NodeJSLib::RequestNode {
     override RequestSource src;
   }
 
@@ -539,16 +632,16 @@ module Express {
   }
 
   /** The input parameter to an `app.param()` route handler. */
-  private class ParamHandlerInputAccess extends HTTP::RequestInputAccess {
+  private class ParamHandlerInputAccess extends Http::RequestInputAccess {
     RouteHandler rh;
 
     ParamHandlerInputAccess() {
       exists(RouteSetup setup | rh = setup.getARouteHandler() |
-        this = DataFlow::parameterNode(rh.getRouteHandlerParameter("parameter"))
+        this = rh.getRouteHandlerParameter("parameter")
       )
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = rh }
+    override Http::RouteHandler getRouteHandler() { result = rh }
 
     override string getKind() { result = "parameter" }
   }
@@ -582,7 +675,7 @@ module Express {
   /**
    * An access to a user-controlled Express request input.
    */
-  class RequestInputAccess extends HTTP::RequestInputAccess {
+  class RequestInputAccess extends Http::RequestInputAccess {
     RequestSource request;
     string kind;
 
@@ -640,7 +733,7 @@ module Express {
   /**
    * An access to a header on an Express request.
    */
-  private class RequestHeaderAccess extends HTTP::RequestHeaderAccess {
+  private class RequestHeaderAccess extends Http::RequestHeaderAccess {
     RequestSource request;
 
     RequestHeaderAccess() {
@@ -669,40 +762,40 @@ module Express {
   /**
    * HTTP headers created by Express calls
    */
-  abstract private class ExplicitHeader extends HTTP::ExplicitHeaderDefinition { }
+  abstract private class ExplicitHeader extends Http::ExplicitHeaderDefinition { }
 
   /**
    * Holds if `e` is an HTTP request object.
    */
-  predicate isRequest(Expr e) { any(RouteHandler rh).getARequestExpr() = e }
+  predicate isRequest(DataFlow::Node e) { any(RouteHandler rh).getARequestNode() = e }
 
   /**
    * Holds if `e` is an HTTP response object.
    */
-  predicate isResponse(Expr e) { any(RouteHandler rh).getAResponseExpr() = e }
+  predicate isResponse(DataFlow::Node e) { any(RouteHandler rh).getAResponseNode() = e }
 
   /**
    * An access to the HTTP request body.
    */
-  class RequestBodyAccess extends Expr {
+  class RequestBodyAccess extends DataFlow::Node {
     RequestBodyAccess() { any(RouteHandler h).getARequestBodyAccess() = this }
   }
 
-  abstract private class HeaderDefinition extends HTTP::Servers::StandardHeaderDefinition {
-    HeaderDefinition() { isResponse(astNode.getReceiver()) }
+  abstract private class HeaderDefinition extends Http::Servers::StandardHeaderDefinition {
+    HeaderDefinition() { isResponse(this.getReceiver()) }
 
-    override RouteHandler getRouteHandler() { astNode.getReceiver() = result.getAResponseExpr() }
+    override RouteHandler getRouteHandler() { this.getReceiver() = result.getAResponseNode() }
   }
 
   /**
    * An invocation of the `redirect` method of an HTTP response object.
    */
-  private class RedirectInvocation extends HTTP::RedirectInvocation, MethodCallExpr {
+  private class RedirectInvocation extends Http::RedirectInvocation, DataFlow::MethodCallNode {
     ResponseSource response;
 
-    RedirectInvocation() { this = response.ref().getAMethodCall("redirect").asExpr() }
+    RedirectInvocation() { this = response.ref().getAMethodCall("redirect") }
 
-    override Expr getUrlArgument() { result = this.getLastArgument() }
+    override DataFlow::Node getUrlArgument() { result = this.getLastArgument() }
 
     override RouteHandler getRouteHandler() { result = response.getRouteHandler() }
   }
@@ -713,8 +806,8 @@ module Express {
    */
   private class SetOneHeader extends HeaderDefinition {
     SetOneHeader() {
-      astNode.getMethodName() = any(string n | n = "set" or n = "header") and
-      astNode.getNumArgument() = 2
+      this.getMethodName() = any(string n | n = "set" or n = "header") and
+      this.getNumArgument() = 2
     }
   }
 
@@ -735,18 +828,18 @@ module Express {
      */
     private DataFlow::SourceNode getAHeaderSource() { result.flowsTo(this.getArgument(0)) }
 
-    override predicate definesExplicitly(string headerName, Expr headerValue) {
+    override predicate definesHeaderValue(string headerName, DataFlow::Node headerValue) {
       exists(string header |
-        this.getAHeaderSource().hasPropertyWrite(header, DataFlow::valueNode(headerValue)) and
+        this.getAHeaderSource().hasPropertyWrite(header, headerValue) and
         headerName = header.toLowerCase()
       )
     }
 
     override RouteHandler getRouteHandler() { result = response.getRouteHandler() }
 
-    override Expr getNameExpr() {
+    override DataFlow::Node getNameNode() {
       exists(DataFlow::PropWrite write | this.getAHeaderSource().getAPropertyWrite() = write |
-        result = write.getPropertyNameExpr()
+        result = write.getPropertyNameExpr().flow()
       )
     }
   }
@@ -755,16 +848,16 @@ module Express {
    * An invocation of the `append` method on an HTTP response object.
    */
   private class AppendHeader extends HeaderDefinition {
-    AppendHeader() { astNode.getMethodName() = "append" }
+    AppendHeader() { this.getMethodName() = "append" }
   }
 
   /**
    * An argument passed to the `send` or `end` method of an HTTP response object.
    */
-  private class ResponseSendArgument extends HTTP::ResponseSendArgument {
+  private class ResponseSendArgument extends Http::ResponseSendArgument {
     ResponseSource response;
 
-    ResponseSendArgument() { this = response.ref().getAMethodCall("send").getArgument(0).asExpr() }
+    ResponseSendArgument() { this = response.ref().getAMethodCall("send").getArgument(0) }
 
     override RouteHandler getRouteHandler() { result = response.getRouteHandler() }
   }
@@ -772,14 +865,14 @@ module Express {
   /**
    * An invocation of the `cookie` method on an HTTP response object.
    */
-  class SetCookie extends HTTP::CookieDefinition, MethodCallExpr {
+  class SetCookie extends Http::CookieDefinition, DataFlow::MethodCallNode {
     ResponseSource response;
 
-    SetCookie() { this = response.ref().getAMethodCall("cookie").asExpr() }
+    SetCookie() { this = response.ref().getAMethodCall("cookie") }
 
-    override Expr getNameArgument() { result = this.getArgument(0) }
+    override DataFlow::Node getNameArgument() { result = this.getArgument(0) }
 
-    override Expr getValueArgument() { result = this.getArgument(1) }
+    override DataFlow::Node getValueArgument() { result = this.getArgument(1) }
 
     override RouteHandler getRouteHandler() { result = response.getRouteHandler() }
   }
@@ -788,11 +881,11 @@ module Express {
    * An expression passed to the `render` method of an HTTP response object
    * as the value of a template variable.
    */
-  private class TemplateInput extends HTTP::ResponseBody {
+  private class TemplateInput extends Http::ResponseBody {
     TemplateObjectInput obj;
 
     TemplateInput() {
-      obj.getALocalSource().(DataFlow::ObjectLiteralNode).hasPropertyWrite(_, this.flow())
+      obj.getALocalSource().(DataFlow::ObjectLiteralNode).hasPropertyWrite(_, this)
     }
 
     override RouteHandler getRouteHandler() { result = obj.getRouteHandler() }
@@ -820,26 +913,24 @@ module Express {
   /**
    * An Express server application.
    */
-  private class Application extends HTTP::ServerDefinition {
-    Application() { this = appCreation().asExpr() }
+  private class Application extends Http::ServerDefinition {
+    Application() { this = appCreation() }
 
     /**
      * Gets a route handler of the application, regardless of nesting.
      */
-    override HTTP::RouteHandler getARouteHandler() {
+    override Http::RouteHandler getARouteHandler() {
       result = this.(RouterDefinition).getASubRouter*().getARouteHandler()
     }
   }
 
-  /**
-   * An Express router.
-   */
-  class RouterDefinition extends InvokeExpr {
-    RouterDefinition() { this = routerCreation().asExpr() }
+  /** An Express router. */
+  class RouterDefinition extends DataFlow::Node instanceof DataFlow::InvokeNode {
+    RouterDefinition() { this = routerCreation() }
 
     private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
       t.start() and
-      result = DataFlow::exprNode(this)
+      result = this
       or
       exists(string name | result = this.ref(t.continue()).getAMethodCall(name) |
         name = "route" or
@@ -852,30 +943,25 @@ module Express {
     /** Gets a data flow node referring to this router. */
     DataFlow::SourceNode ref() { result = this.ref(DataFlow::TypeTracker::end()) }
 
-    /**
-     * Holds if `sink` may refer to this router.
-     */
-    predicate flowsTo(Expr sink) { this.ref().flowsToExpr(sink) }
-
     /**
      * Gets a `RouteSetup` that was used for setting up a route on this router.
      */
-    private RouteSetup getARouteSetup() { this.flowsTo(result.getReceiver()) }
+    private RouteSetup getARouteSetup() { this.ref().flowsTo(result.getReceiver()) }
 
     /**
      * Gets a sub-router registered on this router.
      *
      * Example: `router2` for `router1.use(router2)` or `router1.use("/route2", router2)`
      */
-    RouterDefinition getASubRouter() { result.flowsTo(this.getARouteSetup().getAnArgument()) }
+    RouterDefinition getASubRouter() { result.ref().flowsTo(this.getARouteSetup().getAnArgument()) }
 
     /**
      * Gets a route handler registered on this router.
      *
      * Example: `fun` for `router1.use(fun)` or `router.use("/route", fun)`
      */
-    HTTP::RouteHandler getARouteHandler() {
-      result.(DataFlow::SourceNode).flowsToExpr(this.getARouteSetup().getAnArgument())
+    Http::RouteHandler getARouteHandler() {
+      result.(DataFlow::SourceNode).flowsTo(this.getARouteSetup().getAnArgument())
     }
 
     /**
@@ -893,25 +979,25 @@ module Express {
      *
      * If `node` is not in the same container where `router` was defined, the predicate has no result.
      */
-    Express::RouteHandlerExpr getMiddlewareStackAt(ControlFlowNode node) {
+    Express::RouteHandlerNode getMiddlewareStackAt(ControlFlowNode node) {
       if
-        exists(Express::RouteSetup setup | node = setup and setup.getRouter() = this |
+        exists(Express::RouteSetup setup | node = setup.asExpr() and setup.getRouter() = this |
           setup.isUseCall()
         )
-      then result = node.(Express::RouteSetup).getLastRouteHandlerExpr()
+      then result = node.(AST::ValueNode).flow().(Express::RouteSetup).getLastRouteHandlerNode()
       else result = this.getMiddlewareStackAt(node.getAPredecessor())
     }
 
     /**
      * Gets the final middleware registered on this router.
      */
-    Express::RouteHandlerExpr getMiddlewareStack() {
+    Express::RouteHandlerNode getMiddlewareStack() {
       result = this.getMiddlewareStackAt(this.getContainer().getExit())
     }
   }
 
   /** An expression that is passed as `expressBasicAuth({ users: { <user>: <password> }})`. */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
@@ -922,9 +1008,9 @@ module Express {
           usersSrc.flowsTo(call.getOptionArgument(0, "users")) and
           usersSrc.flowsTo(pwn.getBase())
         |
-          this = pwn.getPropertyNameExpr() and kind = "user name"
+          this = pwn.getPropertyNameExpr().flow() and kind = "user name"
           or
-          this = pwn.getRhs().asExpr() and kind = "password"
+          this = pwn.getRhs() and kind = "password"
         )
       )
     }
@@ -937,7 +1023,7 @@ module Express {
     DataFlow::MethodCallNode {
     ResponseSendFileAsFileSystemAccess() {
       exists(string name | name = "sendFile" or name = "sendfile" |
-        this.calls(any(ResponseExpr res).flow(), name)
+        this.calls(any(ResponseNode res), name)
       )
     }
 
@@ -958,15 +1044,15 @@ module Express {
    * A function that flows to a route setup.
    */
   private class TrackedRouteHandlerCandidateWithSetup extends RouteHandler,
-    HTTP::Servers::StandardRouteHandler, DataFlow::FunctionNode {
+    Http::Servers::StandardRouteHandler, DataFlow::FunctionNode {
     RouteSetup routeSetup;
 
     TrackedRouteHandlerCandidateWithSetup() { this = routeSetup.getARouteHandler() }
 
-    override Parameter getRouteHandlerParameter(string kind) {
+    override DataFlow::ParameterNode getRouteHandlerParameter(string kind) {
       if routeSetup.isParameterHandler()
-      then result = getRouteParameterHandlerParameter(astNode, kind)
-      else result = getRouteHandlerParameter(astNode, kind)
+      then result = getRouteParameterHandlerParameter(this, kind)
+      else result = getRouteHandlerParameter(this, kind)
     }
   }
 
@@ -977,14 +1063,14 @@ module Express {
    * `router.post(handler)` where it is unknown if `router` is an
    * Express router.
    */
-  class RouteSetupCandidate extends HTTP::RouteSetupCandidate, DataFlow::MethodCallNode {
+  class RouteSetupCandidate extends Http::RouteSetupCandidate, DataFlow::MethodCallNode {
     DataFlow::ValueNode routeHandlerArg;
 
     RouteSetupCandidate() {
       exists(string methodName |
         methodName = "all" or
         methodName = "use" or
-        methodName = any(HTTP::RequestMethodName m).toLowerCase()
+        methodName = any(Http::RequestMethodName m).toLowerCase()
       |
         this.getMethodName() = methodName and
         exists(DataFlow::ValueNode arg | arg = this.getAnArgument() |
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/ExpressModules.qll b/javascript/ql/lib/semmle/javascript/frameworks/ExpressModules.qll
index 64b4122fb46..6052d97cef8 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/ExpressModules.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/ExpressModules.qll
@@ -18,25 +18,25 @@ module ExpressLibraries {
   /**
    * A header produced by a route handler of the "x-frame-options" module.
    */
-  class XFrameOptionsRouteHandlerHeader extends HTTP::ImplicitHeaderDefinition {
+  class XFrameOptionsRouteHandlerHeader extends Http::ImplicitHeaderDefinition {
     XFrameOptionsRouteHandlerHeader() { this instanceof XFrameOptionsRouteHandler }
 
     override predicate defines(string headerName, string headerValue) {
       xFrameOptionsDefaultImplicitHeaderDefinition(headerName, headerValue)
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = this }
+    override Http::RouteHandler getRouteHandler() { result = this }
   }
 
   /**
    * A route handler from the "x-frame-options" module.
    */
-  class XFrameOptionsRouteHandler extends HTTP::RouteHandler {
+  class XFrameOptionsRouteHandler extends Http::RouteHandler {
     XFrameOptionsRouteHandler() {
       this = DataFlow::moduleImport("x-frame-options").getAnInvocation()
     }
 
-    override HTTP::HeaderDefinition getAResponseHeader(string name) {
+    override Http::HeaderDefinition getAResponseHeader(string name) {
       name = this.(XFrameOptionsRouteHandlerHeader).getAHeaderName() and
       result = this
     }
@@ -45,23 +45,23 @@ module ExpressLibraries {
   /**
    * A header produced by a route handler of the "frameguard" module.
    */
-  class FrameGuardRouteHandlerHeader extends HTTP::ImplicitHeaderDefinition {
+  class FrameGuardRouteHandlerHeader extends Http::ImplicitHeaderDefinition {
     FrameGuardRouteHandlerHeader() { this instanceof FrameGuardRouteHandler }
 
     override predicate defines(string headerName, string headerValue) {
       xFrameOptionsDefaultImplicitHeaderDefinition(headerName, headerValue)
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = this }
+    override Http::RouteHandler getRouteHandler() { result = this }
   }
 
   /**
    * A route handler from the "frameguard" module.
    */
-  class FrameGuardRouteHandler extends HTTP::RouteHandler {
+  class FrameGuardRouteHandler extends Http::RouteHandler {
     FrameGuardRouteHandler() { this = DataFlow::moduleImport("frameguard").getAnInvocation() }
 
-    override HTTP::HeaderDefinition getAResponseHeader(string name) {
+    override Http::HeaderDefinition getAResponseHeader(string name) {
       name = this.(FrameGuardRouteHandlerHeader).getAHeaderName() and
       result = this
     }
@@ -70,20 +70,20 @@ module ExpressLibraries {
   /**
    * A header produced by a route handler of the "helmet" module.
    */
-  class HelmetRouteHandlerHeader extends HTTP::ImplicitHeaderDefinition {
+  class HelmetRouteHandlerHeader extends Http::ImplicitHeaderDefinition {
     HelmetRouteHandlerHeader() { this instanceof HelmetRouteHandler }
 
     override predicate defines(string headerName, string headerValue) {
       xFrameOptionsDefaultImplicitHeaderDefinition(headerName, headerValue)
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = this }
+    override Http::RouteHandler getRouteHandler() { result = this }
   }
 
   /**
    * A route handler from the "helmet" module.
    */
-  class HelmetRouteHandler extends HTTP::RouteHandler {
+  class HelmetRouteHandler extends Http::RouteHandler {
     HelmetRouteHandler() {
       exists(DataFlow::ModuleImportNode m | "helmet" = m.getPath() |
         this = m.getAnInvocation() or
@@ -91,7 +91,7 @@ module ExpressLibraries {
       )
     }
 
-    override HTTP::HeaderDefinition getAResponseHeader(string name) {
+    override Http::HeaderDefinition getAResponseHeader(string name) {
       name = this.(HelmetRouteHandlerHeader).getAHeaderName() and
       result = this
     }
@@ -108,7 +108,7 @@ module ExpressLibraries {
     /**
      * A call that creates an `express-session` middleware instance.
      */
-    class MiddlewareInstance extends DataFlow::InvokeNode, HTTP::CookieMiddlewareInstance {
+    class MiddlewareInstance extends DataFlow::InvokeNode, Http::CookieMiddlewareInstance {
       MiddlewareInstance() { this = expressSession().getACall() }
 
       /**
@@ -135,7 +135,7 @@ module ExpressLibraries {
     /**
      * A call that creates a `cookie-parser` middleware instance.
      */
-    class MiddlewareInstance extends DataFlow::InvokeNode, HTTP::CookieMiddlewareInstance {
+    class MiddlewareInstance extends DataFlow::InvokeNode, Http::CookieMiddlewareInstance {
       MiddlewareInstance() { this = cookieParser().getACall() }
 
       /**
@@ -164,7 +164,7 @@ module ExpressLibraries {
     /**
      * A call that creates a `cookie-session` middleware instance.
      */
-    class MiddlewareInstance extends DataFlow::InvokeNode, HTTP::CookieMiddlewareInstance {
+    class MiddlewareInstance extends DataFlow::InvokeNode, Http::CookieMiddlewareInstance {
       MiddlewareInstance() { this = cookieSession().getACall() }
 
       /**
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Fastify.qll b/javascript/ql/lib/semmle/javascript/frameworks/Fastify.qll
index 000015191f8..d12c4278601 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Fastify.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Fastify.qll
@@ -12,15 +12,13 @@ module Fastify {
   /**
    * An expression that creates a new Fastify server.
    */
-  abstract class ServerDefinition extends HTTP::Servers::StandardServerDefinition { }
+  abstract class ServerDefinition extends Http::Servers::StandardServerDefinition { }
 
   /**
    * A standard way to create a Fastify server.
    */
   class StandardServerDefinition extends ServerDefinition {
-    StandardServerDefinition() {
-      this = DataFlow::moduleImport("fastify").getAnInvocation().asExpr()
-    }
+    StandardServerDefinition() { this = DataFlow::moduleImport("fastify").getAnInvocation() }
   }
 
   /** Gets a data flow node referring to a fastify server. */
@@ -78,7 +76,7 @@ module Fastify {
    * but support for other kinds of route handlers can be added by implementing
    * additional subclasses of this class.
    */
-  abstract class RouteHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::ValueNode {
+  abstract class RouteHandler extends Http::Servers::StandardRouteHandler, DataFlow::ValueNode {
     /**
      * Gets the parameter of the route handler that contains the request object.
      */
@@ -105,7 +103,7 @@ module Fastify {
    * A Fastify reply source, that is, the `reply` parameter of a
    * route handler.
    */
-  private class ReplySource extends HTTP::Servers::ResponseSource {
+  private class ReplySource extends Http::Servers::ResponseSource {
     RouteHandler rh;
 
     ReplySource() { this = rh.getReplyParameter() }
@@ -120,7 +118,7 @@ module Fastify {
    * A Fastify request source, that is, the request parameter of a
    * route handler.
    */
-  private class RequestSource extends HTTP::Servers::RequestSource {
+  private class RequestSource extends Http::Servers::RequestSource {
     RouteHandler rh;
 
     RequestSource() { this = rh.getRequestParameter() }
@@ -134,12 +132,12 @@ module Fastify {
   /**
    * A call to a Fastify method that sets up a route.
    */
-  class RouteSetup extends MethodCallExpr, HTTP::Servers::StandardRouteSetup {
+  class RouteSetup extends DataFlow::MethodCallNode, Http::Servers::StandardRouteSetup {
     ServerDefinition server;
     string methodName;
 
     RouteSetup() {
-      this = server(server.flow()).getAMethodCall(methodName).asExpr() and
+      this = server(server).getAMethodCall(methodName) and
       methodName = ["route", "get", "head", "post", "put", "delete", "options", "patch"]
     }
 
@@ -149,31 +147,36 @@ module Fastify {
 
     private DataFlow::SourceNode getARouteHandler(DataFlow::TypeBackTracker t) {
       t.start() and
-      result = this.getARouteHandlerExpr().getALocalSource()
+      result = this.getARouteHandlerNode().getALocalSource()
       or
       exists(DataFlow::TypeBackTracker t2 | result = this.getARouteHandler(t2).backtrack(t2, t))
     }
 
-    override Expr getServer() { result = server }
+    override DataFlow::SourceNode getServer() { result = server }
 
-    /** Gets an argument that represents a route handler being registered. */
-    DataFlow::Node getARouteHandlerExpr() {
+    /**
+     * DEPRECATED: Use `getARouteHandlerNode` instead.
+     * Gets an argument that represents a route handler being registered.
+     */
+    deprecated DataFlow::Node getARouteHandlerExpr() { result = this.getARouteHandlerNode() }
+
+    /**  Gets an argument that represents a route handler being registered. */
+    DataFlow::Node getARouteHandlerNode() {
       if methodName = "route"
-      then
-        result = this.flow().(DataFlow::MethodCallNode).getOptionArgument(0, getNthHandlerName(_))
-      else result = this.getLastArgument().flow()
+      then result = this.getOptionArgument(0, getNthHandlerName(_))
+      else result = this.getLastArgument()
     }
   }
 
   private class ShorthandRoutingTreeSetup extends Routing::RouteSetup::MethodCall {
     ShorthandRoutingTreeSetup() {
-      this.asExpr() instanceof RouteSetup and
+      this instanceof RouteSetup and
       not this.getMethodName() = "route"
     }
 
     override string getRelativePath() { result = this.getArgument(0).getStringValue() }
 
-    override HTTP::RequestMethodName getHttpMethod() { result = this.getMethodName().toUpperCase() }
+    override Http::RequestMethodName getHttpMethod() { result = this.getMethodName().toUpperCase() }
   }
 
   /** Gets the name of the `n`th handler function that can be installed a route setup, in order of execution. */
@@ -185,13 +188,13 @@ module Fastify {
 
   private class FullRoutingTreeSetup extends Routing::RouteSetup::MethodCall {
     FullRoutingTreeSetup() {
-      this.asExpr() instanceof RouteSetup and
+      this instanceof RouteSetup and
       this.getMethodName() = "route"
     }
 
     override string getRelativePath() { result = this.getOptionArgument(0, "url").getStringValue() }
 
-    override HTTP::RequestMethodName getHttpMethod() {
+    override Http::RequestMethodName getHttpMethod() {
       result = this.getOptionArgument(0, "method").getStringValue().toUpperCase()
     }
 
@@ -223,7 +226,7 @@ module Fastify {
       result = this.pluginBody(DataFlow::TypeBackTracker::end())
     }
 
-    override HTTP::RequestMethodName getHttpMethod() {
+    override Http::RequestMethodName getHttpMethod() {
       result = this.getOptionArgument(1, "method").getStringValue().toUpperCase()
     }
 
@@ -249,7 +252,7 @@ module Fastify {
   /**
    * An access to a user-controlled Fastify request input.
    */
-  private class RequestInputAccess extends HTTP::RequestInputAccess {
+  private class RequestInputAccess extends Http::RequestInputAccess {
     RouteHandler rh;
     string kind;
 
@@ -287,13 +290,7 @@ module Fastify {
    */
   private predicate usesFastifyPlugin(RouteHandler rh, DataFlow::SourceNode plugin) {
     exists(RouteSetup setup |
-      plugin
-          .flowsTo(setup
-                .getServer()
-                .flow()
-                .(DataFlow::SourceNode)
-                .getAMethodCall("register")
-                .getArgument(0)) and // only matches the plugins that apply to all routes
+      plugin.flowsTo(setup.getServer().getAMethodCall("register").getArgument(0)) and // only matches the plugins that apply to all routes
       rh = setup.getARouteHandler()
     )
   }
@@ -303,13 +300,7 @@ module Fastify {
    */
   private predicate usesMiddleware(RouteHandler rh, DataFlow::SourceNode middleware) {
     exists(RouteSetup setup |
-      middleware
-          .flowsTo(setup
-                .getServer()
-                .flow()
-                .(DataFlow::SourceNode)
-                .getAMethodCall("use")
-                .getArgument(0)) and // only matches the middlewares that apply to all routes
+      middleware.flowsTo(setup.getServer().getAMethodCall("use").getArgument(0)) and // only matches the middlewares that apply to all routes
       rh = setup.getARouteHandler()
     )
   }
@@ -317,7 +308,7 @@ module Fastify {
   /**
    * An access to a header on a Fastify request.
    */
-  private class RequestHeaderAccess extends HTTP::RequestHeaderAccess {
+  private class RequestHeaderAccess extends Http::RequestHeaderAccess {
     RouteHandler rh;
 
     RequestHeaderAccess() {
@@ -336,13 +327,13 @@ module Fastify {
   /**
    * An argument passed to the `send` or `end` method of an HTTP response object.
    */
-  private class ResponseSendArgument extends HTTP::ResponseSendArgument {
+  private class ResponseSendArgument extends Http::ResponseSendArgument {
     RouteHandler rh;
 
     ResponseSendArgument() {
-      this = rh.getAResponseSource().ref().getAMethodCall("send").getArgument(0).asExpr()
+      this = rh.getAResponseSource().ref().getAMethodCall("send").getArgument(0)
       or
-      this = rh.(DataFlow::FunctionNode).getAReturn().asExpr()
+      this = rh.(DataFlow::FunctionNode).getAReturn()
     }
 
     override RouteHandler getRouteHandler() { result = rh }
@@ -351,14 +342,12 @@ module Fastify {
   /**
    * An invocation of the `redirect` method of an HTTP response object.
    */
-  private class RedirectInvocation extends HTTP::RedirectInvocation, MethodCallExpr {
+  private class RedirectInvocation extends Http::RedirectInvocation, DataFlow::MethodCallNode {
     RouteHandler rh;
 
-    RedirectInvocation() {
-      this = rh.getAResponseSource().ref().getAMethodCall("redirect").asExpr()
-    }
+    RedirectInvocation() { this = rh.getAResponseSource().ref().getAMethodCall("redirect") }
 
-    override Expr getUrlArgument() { result = this.getLastArgument() }
+    override DataFlow::Node getUrlArgument() { result = this.getLastArgument() }
 
     override RouteHandler getRouteHandler() { result = rh }
   }
@@ -366,7 +355,7 @@ module Fastify {
   /**
    * An invocation that sets a single header of the HTTP response.
    */
-  private class SetOneHeader extends HTTP::Servers::StandardHeaderDefinition,
+  private class SetOneHeader extends Http::Servers::StandardHeaderDefinition,
     DataFlow::MethodCallNode {
     RouteHandler rh;
 
@@ -381,7 +370,7 @@ module Fastify {
   /**
    * An invocation that sets any number of headers of the HTTP response.
    */
-  class SetMultipleHeaders extends HTTP::ExplicitHeaderDefinition, DataFlow::MethodCallNode {
+  class SetMultipleHeaders extends Http::ExplicitHeaderDefinition, DataFlow::MethodCallNode {
     RouteHandler rh;
 
     SetMultipleHeaders() {
@@ -394,18 +383,18 @@ module Fastify {
      */
     private DataFlow::SourceNode getAHeaderSource() { result.flowsTo(this.getArgument(0)) }
 
-    override predicate definesExplicitly(string headerName, Expr headerValue) {
+    override predicate definesHeaderValue(string headerName, DataFlow::Node headerValue) {
       exists(string header |
-        this.getAHeaderSource().hasPropertyWrite(header, headerValue.flow()) and
+        this.getAHeaderSource().hasPropertyWrite(header, headerValue) and
         headerName = header.toLowerCase()
       )
     }
 
     override RouteHandler getRouteHandler() { result = rh }
 
-    override Expr getNameExpr() {
+    override DataFlow::Node getNameNode() {
       exists(DataFlow::PropWrite write | this.getAHeaderSource().getAPropertyWrite() = write |
-        result = write.getPropertyNameExpr()
+        result = write.getPropertyNameExpr().flow()
       )
     }
   }
@@ -425,7 +414,7 @@ module Fastify {
     override DataFlow::Node getTemplateParamsNode() { result = this.getArgument(1) }
   }
 
-  private class FastifyCookieMiddleware extends HTTP::CookieMiddlewareInstance {
+  private class FastifyCookieMiddleware extends Http::CookieMiddlewareInstance {
     FastifyCookieMiddleware() {
       this = DataFlow::moduleImport(["fastify-cookie", "fastify-session", "fastify-secure-session"])
     }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Firebase.qll b/javascript/ql/lib/semmle/javascript/frameworks/Firebase.qll
index 3678d5fde57..35a8d329643 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Firebase.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Firebase.qll
@@ -114,13 +114,13 @@ module Firebase {
     class QueryListenCall extends DataFlow::MethodCallNode {
       QueryListenCall() {
         this = query().getAMethodCall() and
-        (getMethodName() = "on" or getMethodName() = "once")
+        (this.getMethodName() = "on" or this.getMethodName() = "once")
       }
 
       /**
        * Gets the argument in which the callback is passed.
        */
-      DataFlow::Node getCallbackNode() { result = getArgument(1) }
+      DataFlow::Node getCallbackNode() { result = this.getArgument(1) }
     }
 
     /**
@@ -183,50 +183,46 @@ module Firebase {
     class RefBuilderListenCall extends DataFlow::MethodCallNode {
       RefBuilderListenCall() {
         this = ref().getAMethodCall() and
-        getMethodName() = "on" + any(string s)
+        this.getMethodName() = "on" + any(string s)
       }
 
       /**
        * Gets the data flow node holding the listener callback.
        */
-      DataFlow::Node getCallbackNode() { result = getArgument(0) }
+      DataFlow::Node getCallbackNode() { result = this.getArgument(0) }
     }
 
     /**
      * A call to a Firebase method that sets up a route.
      */
-    private class RouteSetup extends HTTP::Servers::StandardRouteSetup, CallExpr {
-      RouteSetup() {
-        this = namespace().getAPropertyRead("https").getAMemberCall("onRequest").asExpr()
-      }
+    private class RouteSetup extends Http::Servers::StandardRouteSetup, DataFlow::CallNode {
+      RouteSetup() { this = namespace().getAPropertyRead("https").getAMemberCall("onRequest") }
 
       override DataFlow::SourceNode getARouteHandler() {
-        result = getARouteHandler(DataFlow::TypeBackTracker::end())
+        result = this.getARouteHandler(DataFlow::TypeBackTracker::end())
       }
 
       private DataFlow::SourceNode getARouteHandler(DataFlow::TypeBackTracker t) {
         t.start() and
-        result = getArgument(0).flow().getALocalSource()
+        result = this.getArgument(0).getALocalSource()
         or
-        exists(DataFlow::TypeBackTracker t2 | result = getARouteHandler(t2).backtrack(t2, t))
+        exists(DataFlow::TypeBackTracker t2 | result = this.getARouteHandler(t2).backtrack(t2, t))
       }
 
-      override Expr getServer() { none() }
+      override DataFlow::Node getServer() { none() }
     }
 
     /**
      * A function used as a route handler.
      */
-    private class RouteHandler extends Express::RouteHandler, HTTP::Servers::StandardRouteHandler,
-      DataFlow::ValueNode {
-      override Function astNode;
-
+    private class RouteHandler extends Express::RouteHandler, Http::Servers::StandardRouteHandler,
+      DataFlow::FunctionNode {
       RouteHandler() { this = any(RouteSetup setup).getARouteHandler() }
 
-      override Parameter getRouteHandlerParameter(string kind) {
-        kind = "request" and result = astNode.getParameter(0)
+      override DataFlow::ParameterNode getRouteHandlerParameter(string kind) {
+        kind = "request" and result = this.getParameter(0)
         or
-        kind = "response" and result = astNode.getParameter(1)
+        kind = "response" and result = this.getParameter(1)
       }
     }
   }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/GWT.qll b/javascript/ql/lib/semmle/javascript/frameworks/GWT.qll
index 608f3d8b1fd..7450c48378b 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/GWT.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/GWT.qll
@@ -7,32 +7,44 @@ import javascript
 /**
  * A `$gwt_version` variable.
  */
-class GWTVersionVariable extends GlobalVariable {
-  GWTVersionVariable() { getName() = "$gwt_version" }
+class GwtVersionVariable extends GlobalVariable {
+  GwtVersionVariable() { getName() = "$gwt_version" }
 }
 
+/** DEPRECATED: Alias for GwtVersionVariable */
+deprecated class GWTVersionVariable = GwtVersionVariable;
+
 /**
  * A GWT header script that defines the `$gwt_version` variable.
  */
-class GWTHeader extends InlineScript {
-  GWTHeader() {
-    exists(GWTVersionVariable gwtVersion | gwtVersion.getADeclaration().getTopLevel() = this)
+class GwtHeader extends InlineScript {
+  GwtHeader() {
+    exists(GwtVersionVariable gwtVersion | gwtVersion.getADeclaration().getTopLevel() = this)
   }
 
   /**
    * Gets the GWT version this script was generated with, if it can be determined.
    */
-  string getGWTVersion() {
+  string getGwtVersion() {
     exists(Expr e | e.getTopLevel() = this |
-      e = any(GWTVersionVariable v).getAnAssignedExpr() and
+      e = any(GwtVersionVariable v).getAnAssignedExpr() and
       result = e.getStringValue()
     )
   }
+
+  /** DEPRECATED: Alias for getGwtVersion */
+  deprecated string getGWTVersion() { result = getGwtVersion() }
 }
 
+/** DEPRECATED: Alias for GwtHeader */
+deprecated class GWTHeader = GwtHeader;
+
 /**
  * A toplevel in a file that appears to be GWT-generated.
  */
-class GWTGeneratedTopLevel extends TopLevel {
-  GWTGeneratedTopLevel() { exists(GWTHeader h | getFile() = h.getFile()) }
+class GwtGeneratedTopLevel extends TopLevel {
+  GwtGeneratedTopLevel() { exists(GwtHeader h | getFile() = h.getFile()) }
 }
+
+/** DEPRECATED: Alias for GwtGeneratedTopLevel */
+deprecated class GWTGeneratedTopLevel = GwtGeneratedTopLevel;
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/HTTP.qll b/javascript/ql/lib/semmle/javascript/frameworks/HTTP.qll
index f82b4650668..62788b2a3d7 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/HTTP.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/HTTP.qll
@@ -8,13 +8,13 @@ private import semmle.javascript.dataflow.internal.StepSummary
 private import semmle.javascript.dataflow.internal.CallGraphs
 private import DataFlow::PseudoProperties as PseudoProperties
 
-module HTTP {
+module Http {
   /**
    * A function invocation that causes a redirect response to be sent.
    */
-  abstract class RedirectInvocation extends InvokeExpr {
+  abstract class RedirectInvocation extends DataFlow::CallNode {
     /** Gets the argument specifying the URL to redirect to. */
-    abstract Expr getUrlArgument();
+    abstract DataFlow::Node getUrlArgument();
 
     /** Gets the route handler this redirect occurs in. */
     abstract RouteHandler getRouteHandler();
@@ -56,24 +56,34 @@ module HTTP {
    * An expression that sets HTTP response headers explicitly.
    */
   abstract class ExplicitHeaderDefinition extends HeaderDefinition {
-    override string getAHeaderName() { this.definesExplicitly(result, _) }
+    override string getAHeaderName() { this.definesHeaderValue(result, _) }
 
     override predicate defines(string headerName, string headerValue) {
-      exists(Expr e |
-        this.definesExplicitly(headerName, e) and
+      exists(DataFlow::Node e |
+        this.definesHeaderValue(headerName, e) and
         headerValue = e.getStringValue()
       )
     }
 
     /**
+     * DEPRECATED: use `definesHeaderValue` instead.
      * Holds if the header with (lower-case) name `headerName` is set to the value of `headerValue`.
      */
-    abstract predicate definesExplicitly(string headerName, Expr headerValue);
+    deprecated predicate definesExplicitly(string headerName, Expr headerValue) {
+      this.definesHeaderValue(headerName, headerValue.flow())
+    }
+
+    /** Holds if the header with (lower-case) name `headerName` is set to the value of `headerValue`. */
+    abstract predicate definesHeaderValue(string headerName, DataFlow::Node headerValue);
 
     /**
+     * DEPRECATED: Use `getNameNode()` instead.
      * Returns the expression used to compute the header name.
      */
-    abstract Expr getNameExpr();
+    deprecated Expr getNameExpr() { result = this.getNameNode().asExpr() }
+
+    /** Returns the expression used to compute the header name. */
+    abstract DataFlow::Node getNameNode();
   }
 
   /**
@@ -107,7 +117,7 @@ module HTTP {
   /**
    * An expression whose value is sent as (part of) the body of an HTTP response.
    */
-  abstract class ResponseBody extends Expr {
+  abstract class ResponseBody extends DataFlow::Node {
     /**
      * Gets the route handler that sends this expression.
      */
@@ -123,21 +133,21 @@ module HTTP {
   /**
    * An expression that sets a cookie in an HTTP response.
    */
-  abstract class CookieDefinition extends Expr {
+  abstract class CookieDefinition extends DataFlow::Node {
     /**
      * Gets the argument, if any, specifying the raw cookie header.
      */
-    Expr getHeaderArgument() { none() }
+    DataFlow::Node getHeaderArgument() { none() }
 
     /**
      * Gets the argument, if any, specifying the cookie name.
      */
-    Expr getNameArgument() { none() }
+    DataFlow::Node getNameArgument() { none() }
 
     /**
      * Gets the argument, if any, specifying the cookie value.
      */
-    Expr getValueArgument() { none() }
+    DataFlow::Node getValueArgument() { none() }
 
     /** Gets the route handler that sets this cookie. */
     abstract RouteHandler getRouteHandler();
@@ -150,12 +160,12 @@ module HTTP {
     HeaderDefinition header;
 
     SetCookieHeader() {
-      this = header.asExpr() and
+      this = header and
       header.getAHeaderName() = "set-cookie"
     }
 
-    override Expr getHeaderArgument() {
-      header.(ExplicitHeaderDefinition).definesExplicitly("set-cookie", result)
+    override DataFlow::Node getHeaderArgument() {
+      header.(ExplicitHeaderDefinition).definesHeaderValue("set-cookie", result)
     }
 
     override RouteHandler getRouteHandler() { result = header.getRouteHandler() }
@@ -164,7 +174,7 @@ module HTTP {
   /**
    * An expression that creates a new server.
    */
-  abstract class ServerDefinition extends Expr {
+  abstract class ServerDefinition extends DataFlow::Node {
     /**
      * Gets a route handler of the server.
      */
@@ -198,16 +208,30 @@ module HTTP {
     final Servers::ResponseSource getAResponseSource() { result.getRouteHandler() = this }
 
     /**
+     * DEPRECATED: Use `getARequestNode()` instead.
      * Gets an expression that contains a request object handled
      * by this handler.
      */
-    RequestExpr getARequestExpr() { result.getRouteHandler() = this }
+    deprecated RequestExpr getARequestExpr() { result.flow() = this.getARequestNode() }
+
+    /**
+     * Gets an expression that contains a request object handled
+     * by this handler.
+     */
+    RequestNode getARequestNode() { result.getRouteHandler() = this }
+
+    /**
+     * DEPRECATED: Use `getAResponseNode()` instead.
+     * Gets an expression that contains a response object provided
+     * by this handler.
+     */
+    deprecated ResponseExpr getAResponseExpr() { result.flow() = this.getAResponseNode() }
 
     /**
      * Gets an expression that contains a response object provided
      * by this handler.
      */
-    ResponseExpr getAResponseExpr() { result.getRouteHandler() = this }
+    ResponseNode getAResponseNode() { result.getRouteHandler() = this }
   }
 
   /**
@@ -218,7 +242,7 @@ module HTTP {
     DataFlow::functionOneWayForwardingStep(pred.getALocalUse(), succ)
     or
     // a container containing route-handlers.
-    exists(HTTP::RouteHandlerCandidateContainer container | pred = container.getRouteHandler(succ))
+    exists(Http::RouteHandlerCandidateContainer container | pred = container.getRouteHandler(succ))
     or
     // (function (req, res) {}).bind(this);
     exists(DataFlow::PartialInvokeNode call |
@@ -232,26 +256,42 @@ module HTTP {
   /**
    * An expression that sets up a route on a server.
    */
-  abstract class RouteSetup extends Expr { }
+  abstract class RouteSetup extends DataFlow::Node { }
 
-  /**
-   * An expression that may contain a request object.
-   */
-  abstract class RequestExpr extends Expr {
-    /**
-     * Gets the route handler that handles this request.
-     */
+  /** A dataflow node that may contain a request object. */
+  abstract class RequestNode extends DataFlow::Node {
+    /** Gets the route handler that handles this request. */
+    abstract RouteHandler getRouteHandler();
+  }
+
+  /** An dataflow node that may contain a response object. */
+  abstract class ResponseNode extends DataFlow::Node {
+    /** Gets the route handler that handles this request. */
     abstract RouteHandler getRouteHandler();
   }
 
   /**
-   * An expression that may contain a response object.
+   * DEPRECATED: Use `RequestNode` instead.
+   * An expression that may contain a request object.
    */
-  abstract class ResponseExpr extends Expr {
+  deprecated class RequestExpr extends Expr {
+    RequestExpr() { this.flow() instanceof ResponseNode }
+
     /**
      * Gets the route handler that handles this request.
      */
-    abstract RouteHandler getRouteHandler();
+    RouteHandler getRouteHandler() { result = this.flow().(ResponseNode).getRouteHandler() }
+  }
+
+  /**
+   * DEPRECATED: Use `ResponseNode` instead.
+   * An expression that may contain a response object.
+   */
+  deprecated class ResponseExpr extends Expr {
+    /**
+     * Gets the route handler that handles this request.
+     */
+    RouteHandler getRouteHandler() { result = this.flow().(ResponseNode).getRouteHandler() }
   }
 
   /**
@@ -267,15 +307,19 @@ module HTTP {
 
       private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
         t.start() and
-        result = DataFlow::exprNode(this)
+        result = this.getALocalSource()
         or
         exists(DataFlow::TypeTracker t2 | result = this.ref(t2).track(t2, t))
       }
 
+      /** Gets a data flow node referring to this server. */
+      DataFlow::SourceNode ref() { result = this.ref(DataFlow::TypeTracker::end()) }
+
       /**
+       * DEPRECATED: Use `ref().flowsToExpr()` instead.
        * Holds if `sink` may refer to this server definition.
        */
-      predicate flowsTo(Expr sink) { this.ref(DataFlow::TypeTracker::end()).flowsToExpr(sink) }
+      deprecated predicate flowsTo(Expr sink) { this.ref().flowsToExpr(sink) }
     }
 
     /**
@@ -290,7 +334,7 @@ module HTTP {
       /**
        * Gets the server this route handler is registered on.
        */
-      Expr getServer() {
+      DataFlow::Node getServer() {
         exists(StandardRouteSetup setup | setup.getARouteHandler() = this |
           result = setup.getServer()
         )
@@ -350,10 +394,10 @@ module HTTP {
     /**
      * A request expression arising from a request source.
      */
-    class StandardRequestExpr extends RequestExpr {
+    class StandardRequestNode extends RequestNode {
       RequestSource src;
 
-      StandardRequestExpr() { src.ref().flowsTo(DataFlow::valueNode(this)) }
+      StandardRequestNode() { src.ref().flowsTo(this) }
 
       override RouteHandler getRouteHandler() { result = src.getRouteHandler() }
     }
@@ -361,26 +405,49 @@ module HTTP {
     /**
      * A response expression arising from a response source.
      */
-    class StandardResponseExpr extends ResponseExpr {
+    class StandardResponseNode extends ResponseNode {
       ResponseSource src;
 
-      StandardResponseExpr() { src.ref().flowsTo(DataFlow::valueNode(this)) }
+      StandardResponseNode() { src.ref().flowsTo(this) }
 
       override RouteHandler getRouteHandler() { result = src.getRouteHandler() }
     }
 
+    /**
+     * A request expression arising from a request source.
+     */
+    deprecated class StandardRequestExpr extends RequestExpr {
+      RequestSource src;
+
+      StandardRequestExpr() { src.ref().flowsToExpr(this) }
+
+      override RouteHandler getRouteHandler() { result = src.getRouteHandler() }
+    }
+
+    /**
+     * A response expression arising from a response source.
+     */
+    deprecated class StandardResponseExpr extends ResponseExpr {
+      ResponseSource src;
+
+      StandardResponseExpr() { src.ref().flowsToExpr(this) }
+
+      override RouteHandler getRouteHandler() {
+        result = this.flow().(StandardResponseNode).getRouteHandler()
+      }
+    }
+
     /**
      * A standard header definition.
      */
-    abstract class StandardHeaderDefinition extends ExplicitHeaderDefinition, DataFlow::ValueNode {
-      override MethodCallExpr astNode;
-
-      override predicate definesExplicitly(string headerName, Expr headerValue) {
-        headerName = this.getNameExpr().getStringValue().toLowerCase() and
-        headerValue = astNode.getArgument(1)
+    abstract class StandardHeaderDefinition extends ExplicitHeaderDefinition,
+      DataFlow::MethodCallNode {
+      override predicate definesHeaderValue(string headerName, DataFlow::Node headerValue) {
+        headerName = this.getNameNode().getStringValue().toLowerCase() and
+        headerValue = this.getArgument(1)
       }
 
-      override Expr getNameExpr() { result = astNode.getArgument(0) }
+      override DataFlow::Node getNameNode() { result = this.getArgument(0) }
     }
 
     /**
@@ -396,7 +463,7 @@ module HTTP {
       /**
        * Gets the server on which this route setup sets up routes.
        */
-      abstract Expr getServer();
+      abstract DataFlow::Node getServer();
     }
 
     /**
@@ -610,7 +677,7 @@ module HTTP {
     /**
      * A collection that contains one or more route potential handlers.
      */
-    private class ContainerCollection extends HTTP::RouteHandlerCandidateContainer::Range,
+    private class ContainerCollection extends Http::RouteHandlerCandidateContainer::Range,
       DataFlow::NewNode {
       ContainerCollection() {
         this = DataFlow::globalVarRef("Map").getAnInstantiation() and // restrict to Map for now
@@ -632,3 +699,6 @@ module HTTP {
     }
   }
 }
+
+/** DEPRECATED: Alias for Http */
+deprecated module HTTP = Http;
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll b/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll
index b83b85831c7..e4bc922951c 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll
@@ -9,49 +9,44 @@ module Hapi {
   /**
    * An expression that creates a new Hapi server.
    */
-  class ServerDefinition extends HTTP::Servers::StandardServerDefinition, NewExpr {
+  class ServerDefinition extends Http::Servers::StandardServerDefinition, DataFlow::NewNode {
     ServerDefinition() {
       // `server = new Hapi.Server()`
-      this = DataFlow::moduleMember("hapi", "Server").getAnInstantiation().asExpr()
+      this = DataFlow::moduleMember("hapi", "Server").getAnInstantiation()
     }
   }
 
   /**
    * A Hapi route handler.
    */
-  class RouteHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::ValueNode {
-    Function function;
-
-    RouteHandler() {
-      function = astNode and
-      exists(RouteSetup setup | this = setup.getARouteHandler())
-    }
+  class RouteHandler extends Http::Servers::StandardRouteHandler, DataFlow::FunctionNode {
+    RouteHandler() { exists(RouteSetup setup | this = setup.getARouteHandler()) }
 
     /**
      * Gets the parameter of the route handler that contains the request object.
      */
-    Parameter getRequestParameter() { result = function.getParameter(0) }
+    DataFlow::ParameterNode getRequestParameter() { result = this.getParameter(0) }
 
     /**
      * Gets the parameter of the route handler that contains the "request toolkit",
      * usually named `h`.
      */
-    Parameter getRequestToolkitParameter() { result = function.getParameter(1) }
+    DataFlow::ParameterNode getRequestToolkitParameter() { result = this.getParameter(1) }
 
     /**
      * Gets a source node referring to the request toolkit parameter, usually named `h`.
      */
-    DataFlow::SourceNode getRequestToolkit() { result = getRequestToolkitParameter().flow() }
+    DataFlow::SourceNode getRequestToolkit() { result = this.getRequestToolkitParameter() }
   }
 
   /**
    * A Hapi response source, that is, an access to the `response` property
    * of a request object.
    */
-  private class ResponseSource extends HTTP::Servers::ResponseSource {
-    RequestExpr req;
+  private class ResponseSource extends Http::Servers::ResponseSource {
+    RequestNode req;
 
-    ResponseSource() { asExpr().(PropAccess).accesses(req, "response") }
+    ResponseSource() { this.(DataFlow::PropRead).accesses(req, "response") }
 
     /**
      * Gets the route handler that provides this response.
@@ -63,10 +58,10 @@ module Hapi {
    * A Hapi request source, that is, the request parameter of a
    * route handler.
    */
-  private class RequestSource extends HTTP::Servers::RequestSource {
+  private class RequestSource extends Http::Servers::RequestSource {
     RouteHandler rh;
 
-    RequestSource() { this = DataFlow::parameterNode(rh.getRequestParameter()) }
+    RequestSource() { this = rh.getRequestParameter() }
 
     /**
      * Gets the route handler that handles this request.
@@ -75,59 +70,75 @@ module Hapi {
   }
 
   /**
+   * DEPRECATED: Use `ResponseNode` instead.
    * A Hapi response expression.
    */
-  class ResponseExpr extends HTTP::Servers::StandardResponseExpr {
+  deprecated class ResponseExpr extends HTTP::Servers::StandardResponseExpr {
+    ResponseExpr() { this.flow() instanceof ResponseNode }
+  }
+
+  /**
+   * A Hapi response node.
+   */
+  class ResponseNode extends Http::Servers::StandardResponseNode {
     override ResponseSource src;
   }
 
   /**
+   * DEPRECATED: Use `RequestNode` instead.
    * An Hapi request expression.
    */
-  class RequestExpr extends HTTP::Servers::StandardRequestExpr {
+  deprecated class RequestExpr extends HTTP::Servers::StandardRequestExpr {
+    RequestExpr() { this.flow() instanceof RequestNode }
+  }
+
+  /**
+   * A Hapi request node.
+   */
+  class RequestNode extends Http::Servers::StandardRequestNode {
     override RequestSource src;
   }
 
   /**
    * An access to a user-controlled Hapi request input.
    */
-  private class RequestInputAccess extends HTTP::RequestInputAccess {
+  private class RequestInputAccess extends Http::RequestInputAccess {
     RouteHandler rh;
     string kind;
 
     RequestInputAccess() {
-      exists(Expr request | request = rh.getARequestExpr() |
+      exists(DataFlow::Node request | request = rh.getARequestNode() |
         kind = "body" and
         (
           // `request.rawPayload`
-          this.asExpr().(PropAccess).accesses(request, "rawPayload")
+          this.(DataFlow::PropRead).accesses(request, "rawPayload")
           or
-          exists(PropAccess payload |
+          exists(DataFlow::PropRead payload |
             // `request.payload.name`
             payload.accesses(request, "payload") and
-            this.asExpr().(PropAccess).accesses(payload, _)
+            this.(DataFlow::PropRead).accesses(payload, _)
           )
         )
         or
         kind = "parameter" and
-        exists(PropAccess query |
+        exists(DataFlow::PropRead query |
           // `request.query.name`
           query.accesses(request, "query") and
-          this.asExpr().(PropAccess).accesses(query, _)
+          this.(DataFlow::PropRead).accesses(query, _)
         )
         or
-        exists(PropAccess url |
+        exists(DataFlow::PropRead url |
           // `request.url.path`
           kind = "url" and
           url.accesses(request, "url") and
-          this.asExpr().(PropAccess).accesses(url, "path")
+          this.(DataFlow::PropRead).accesses(url, "path")
         )
         or
-        exists(PropAccess state |
+        exists(DataFlow::PropRead state |
           // `request.state.<name>`
           kind = "cookie" and
           state.accesses(request, "state") and
-          this.asExpr().(PropAccess).accesses(state, _)
+          this.(DataFlow::PropRead).accesses(state, _)
         )
       )
       or
@@ -145,15 +156,15 @@ module Hapi {
   /**
    * An access to an HTTP header on a Hapi request.
    */
-  private class RequestHeaderAccess extends HTTP::RequestHeaderAccess {
+  private class RequestHeaderAccess extends Http::RequestHeaderAccess {
     RouteHandler rh;
 
     RequestHeaderAccess() {
-      exists(Expr request | request = rh.getARequestExpr() |
-        exists(PropAccess headers |
+      exists(DataFlow::Node request | request = rh.getARequestNode() |
+        exists(DataFlow::PropRead headers |
           // `request.headers.<name>`
           headers.accesses(request, "headers") and
-          this.asExpr().(PropAccess).accesses(headers, _)
+          this.(DataFlow::PropRead).accesses(headers, _)
         )
       )
     }
@@ -170,12 +181,12 @@ module Hapi {
   /**
    * An HTTP header defined in a Hapi server.
    */
-  private class HeaderDefinition extends HTTP::Servers::StandardHeaderDefinition {
-    ResponseExpr res;
+  private class HeaderDefinition extends Http::Servers::StandardHeaderDefinition {
+    ResponseNode res;
 
     HeaderDefinition() {
       // request.response.header('Cache-Control', 'no-cache')
-      astNode.calls(res, "header")
+      this.calls(res, "header")
     }
 
     override RouteHandler getRouteHandler() { result = res.getRouteHandler() }
@@ -184,40 +195,40 @@ module Hapi {
   /**
    * A call to a Hapi method that sets up a route.
    */
-  class RouteSetup extends MethodCallExpr, HTTP::Servers::StandardRouteSetup {
+  class RouteSetup extends DataFlow::MethodCallNode, Http::Servers::StandardRouteSetup {
     ServerDefinition server;
-    Expr handler;
+    DataFlow::Node handler;
 
     RouteSetup() {
-      server.flowsTo(getReceiver()) and
+      server.ref().getAMethodCall() = this and
       (
         // server.route({ handler: fun })
-        getMethodName() = "route" and
-        hasOptionArgument(0, "handler", handler)
+        this.getMethodName() = "route" and
+        this.getOptionArgument(0, "handler") = handler
         or
         // server.ext('/', fun)
-        getMethodName() = "ext" and
-        handler = getArgument(1)
+        this.getMethodName() = "ext" and
+        handler = this.getArgument(1)
       )
     }
 
     override DataFlow::SourceNode getARouteHandler() {
-      result = getARouteHandler(DataFlow::TypeBackTracker::end())
+      result = this.getARouteHandler(DataFlow::TypeBackTracker::end())
     }
 
     private DataFlow::SourceNode getARouteHandler(DataFlow::TypeBackTracker t) {
       t.start() and
-      result = getRouteHandler().getALocalSource()
+      result = this.getRouteHandler().getALocalSource()
       or
-      exists(DataFlow::TypeBackTracker t2 | result = getARouteHandler(t2).backtrack(t2, t))
+      exists(DataFlow::TypeBackTracker t2 | result = this.getARouteHandler(t2).backtrack(t2, t))
     }
 
     pragma[noinline]
-    private DataFlow::Node getRouteHandler() { result = handler.flow() }
+    private DataFlow::Node getRouteHandler() { result = handler }
 
-    Expr getRouteHandlerExpr() { result = handler }
+    deprecated Expr getRouteHandlerExpr() { result = handler.asExpr() }
 
-    override Expr getServer() { result = server }
+    override DataFlow::Node getServer() { result = server }
   }
 
   /**
@@ -225,7 +236,7 @@ module Hapi {
    *
    * For example, this could be the function `function(request, h){...}`.
    */
-  class RouteHandlerCandidate extends HTTP::RouteHandlerCandidate {
+  class RouteHandlerCandidate extends Http::RouteHandlerCandidate {
     RouteHandlerCandidate() {
       exists(string request, string responseToolkit |
         (request = "request" or request = "req") and
@@ -245,7 +256,7 @@ module Hapi {
    * A function that looks like a Hapi route handler and flows to a route setup.
    */
   private class TrackedRouteHandlerCandidateWithSetup extends RouteHandler,
-    HTTP::Servers::StandardRouteHandler, DataFlow::FunctionNode {
+    Http::Servers::StandardRouteHandler, DataFlow::FunctionNode {
     TrackedRouteHandlerCandidateWithSetup() { this = any(RouteSetup s).getARouteHandler() }
   }
 
@@ -257,18 +268,18 @@ module Hapi {
 
     override DataFlow::SourceNode getOutput() { none() }
 
-    override DataFlow::Node getTemplateFileNode() { result = getArgument(0) }
+    override DataFlow::Node getTemplateFileNode() { result = this.getArgument(0) }
 
-    override DataFlow::Node getTemplateParamsNode() { result = getArgument(1) }
+    override DataFlow::Node getTemplateParamsNode() { result = this.getArgument(1) }
   }
 
   /**
    * A return from a route handler.
    */
-  private class HandlerReturn extends HTTP::ResponseSendArgument {
+  private class HandlerReturn extends Http::ResponseSendArgument {
     RouteHandler handler;
 
-    HandlerReturn() { this = handler.(DataFlow::FunctionNode).getAReturn().asExpr() }
+    HandlerReturn() { this = handler.(DataFlow::FunctionNode).getAReturn() }
 
     override RouteHandler getRouteHandler() { result = handler }
   }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/HttpProxy.qll b/javascript/ql/lib/semmle/javascript/frameworks/HttpProxy.qll
index 24e694ca8d9..b471dd34431 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/HttpProxy.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/HttpProxy.qll
@@ -83,16 +83,12 @@ private module HttpProxy {
       )
     }
 
-    override Parameter getRequestParameter() {
-      exists(int req | routeHandlingEventHandler(event, req, _) |
-        result = getFunction().getParameter(req)
-      )
+    override DataFlow::ParameterNode getRequestParameter() {
+      exists(int req | routeHandlingEventHandler(event, req, _) | result = getParameter(req))
     }
 
-    override Parameter getResponseParameter() {
-      exists(int res | routeHandlingEventHandler(event, _, res) |
-        result = getFunction().getParameter(res)
-      )
+    override DataFlow::ParameterNode getResponseParameter() {
+      exists(int res | routeHandlingEventHandler(event, _, res) | result = getParameter(res))
     }
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/JWT.qll b/javascript/ql/lib/semmle/javascript/frameworks/JWT.qll
index 48568450770..aa0b157844c 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/JWT.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/JWT.qll
@@ -40,12 +40,10 @@ private module JsonWebToken {
   }
 
   /**
-   * The private key for a JWT as a `CredentialsExpr`.
+   * The private key for a JWT as a `CredentialsNode`.
    */
-  private class JwtKey extends CredentialsExpr {
-    JwtKey() {
-      this = DataFlow::moduleMember("jsonwebtoken", "sign").getACall().getArgument(1).asExpr()
-    }
+  private class JwtKey extends CredentialsNode {
+    JwtKey() { this = DataFlow::moduleMember("jsonwebtoken", "sign").getACall().getArgument(1) }
 
     override string getCredentialsKind() { result = "key" }
   }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Knex.qll b/javascript/ql/lib/semmle/javascript/frameworks/Knex.qll
index e768a9feaff..923df27bd50 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Knex.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Knex.qll
@@ -43,7 +43,7 @@ module Knex {
 
   /** A SQL string passed to a raw Knex method. */
   private class RawKnexSqlString extends SQL::SqlString {
-    RawKnexSqlString() { this = any(RawKnexCall call).getArgument(0).asExpr() }
+    RawKnexSqlString() { this = any(RawKnexCall call).getArgument(0) }
   }
 
   /** A call that triggers a SQL query submission by calling then/stream/asCallback. */
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Koa.qll b/javascript/ql/lib/semmle/javascript/frameworks/Koa.qll
index f9519736b0e..e8ca5ef2ac1 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Koa.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Koa.qll
@@ -9,25 +9,25 @@ module Koa {
   /**
    * An expression that creates a new Koa application.
    */
-  class AppDefinition extends HTTP::Servers::StandardServerDefinition, InvokeExpr {
+  class AppDefinition extends Http::Servers::StandardServerDefinition, DataFlow::InvokeNode {
     AppDefinition() {
       // `app = new Koa()` / `app = Koa()`
-      this = DataFlow::moduleImport("koa").getAnInvocation().asExpr()
+      this = DataFlow::moduleImport("koa").getAnInvocation()
     }
   }
 
   /**
    * An HTTP header defined in a Koa application.
    */
-  private class HeaderDefinition extends HTTP::Servers::StandardHeaderDefinition {
+  private class HeaderDefinition extends Http::Servers::StandardHeaderDefinition {
     RouteHandler rh;
 
     HeaderDefinition() {
       // ctx.set('Cache-Control', 'no-cache');
-      astNode.calls(rh.getAResponseOrContextExpr(), "set")
+      this.calls(rh.getAResponseOrContextNode(), "set")
       or
       // ctx.response.header('Cache-Control', 'no-cache')
-      astNode.calls(rh.getAResponseExpr(), "header")
+      this.calls(rh.getAResponseNode(), "header")
     }
 
     override RouteHandler getRouteHandler() { result = rh }
@@ -36,14 +36,21 @@ module Koa {
   /**
    * A Koa route handler.
    */
-  abstract class RouteHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::SourceNode {
+  abstract class RouteHandler extends Http::Servers::StandardRouteHandler, DataFlow::SourceNode {
     /**
      * Gets the parameter of the route handler that contains the context object.
      */
-    Parameter getContextParameter() {
-      result = this.getAFunctionValue().getFunction().getParameter(0)
+    DataFlow::ParameterNode getContextParameter() {
+      result = this.getAFunctionValue().getParameter(0)
     }
 
+    /**
+     * DEPRECATED: Use `getAContextNode` instead.
+     * Gets an expression that contains the "context" object of
+     * a route handler invocation.
+     */
+    deprecated Expr getAContextExpr() { result = this.getAContextNode().asExpr() }
+
     /**
      * Gets an expression that contains the "context" object of
      * a route handler invocation.
@@ -52,22 +59,38 @@ module Koa {
      * `this` or `ctx`, given as the first and only argument to the
      * route handler.
      */
-    Expr getAContextExpr() { result.(ContextExpr).getRouteHandler() = this }
+    DataFlow::Node getAContextNode() { result.(ContextNode).getRouteHandler() = this }
+
+    /**
+     * DEPRECATED: Use `getAResponseOrContextNode` instead.
+     * Gets an expression that contains the context or response
+     * object of a route handler invocation.
+     */
+    deprecated Expr getAResponseOrContextExpr() {
+      result = this.getAResponseOrContextNode().asExpr()
+    }
 
     /**
      * Gets an expression that contains the context or response
      * object of a route handler invocation.
      */
-    Expr getAResponseOrContextExpr() {
-      result = this.getAResponseExpr() or result = this.getAContextExpr()
+    DataFlow::Node getAResponseOrContextNode() {
+      result = this.getAResponseNode() or result = this.getAContextNode()
     }
 
+    /**
+     * DEPRECATED: Use `getARequestOrContextNode` instead.
+     * Gets an expression that contains the context or request
+     * object of a route handler invocation.
+     */
+    deprecated Expr getARequestOrContextExpr() { result = this.getARequestOrContextNode().asExpr() }
+
     /**
      * Gets an expression that contains the context or request
      * object of a route handler invocation.
      */
-    Expr getARequestOrContextExpr() {
-      result = this.getARequestExpr() or result = this.getAContextExpr()
+    DataFlow::Node getARequestOrContextNode() {
+      result = this.getARequestNode() or result = this.getAContextNode()
     }
 
     /**
@@ -108,7 +131,7 @@ module Koa {
     RouteHandler rh;
 
     ContextSource() {
-      this = DataFlow::parameterNode(rh.getContextParameter())
+      this = rh.getContextParameter()
       or
       this.(DataFlow::ThisNode).getBinder() = rh
     }
@@ -118,8 +141,6 @@ module Koa {
      */
     RouteHandler getRouteHandler() { result = rh }
 
-    predicate flowsTo(DataFlow::Node nd) { this.ref().flowsTo(nd) }
-
     private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
       t.start() and
       result = this
@@ -206,10 +227,10 @@ module Koa {
    * A Koa request source, that is, an access to the `request` property
    * of a context object.
    */
-  private class RequestSource extends HTTP::Servers::RequestSource {
-    ContextExpr ctx;
+  private class RequestSource extends Http::Servers::RequestSource instanceof DataFlow::PropRead {
+    ContextNode ctx;
 
-    RequestSource() { this.asExpr().(PropAccess).accesses(ctx, "request") }
+    RequestSource() { super.accesses(ctx, "request") }
 
     /**
      * Gets the route handler that provides this response.
@@ -221,7 +242,7 @@ module Koa {
    * A Koa request source, accessed through the a request property of a
    * generator route handler (deprecated in Koa 3).
    */
-  private class GeneratorRequestSource extends HTTP::Servers::RequestSource {
+  private class GeneratorRequestSource extends Http::Servers::RequestSource {
     RouteHandler rh;
 
     GeneratorRequestSource() {
@@ -241,10 +262,10 @@ module Koa {
    * A Koa response source, that is, an access to the `response` property
    * of a context object.
    */
-  private class ResponseSource extends HTTP::Servers::ResponseSource {
-    ContextExpr ctx;
+  private class ResponseSource extends Http::Servers::ResponseSource instanceof DataFlow::PropRead {
+    ContextNode ctx;
 
-    ResponseSource() { this.asExpr().(PropAccess).accesses(ctx, "response") }
+    ResponseSource() { super.accesses(ctx, "response") }
 
     /**
      * Gets the route handler that provides this response.
@@ -253,12 +274,25 @@ module Koa {
   }
 
   /**
+   * DEPRECATED: Use `ContextNode` instead.
    * An expression that may hold a Koa context object.
    */
-  class ContextExpr extends Expr {
+  deprecated class ContextExpr extends Expr {
+    ContextNode node;
+
+    ContextExpr() { node.asExpr() = this }
+
+    /** Gets the route handler that provides this response. */
+    deprecated RouteHandler getRouteHandler() { result = node.getRouteHandler() }
+  }
+
+  /**
+   * An expression that may hold a Koa context object.
+   */
+  class ContextNode extends DataFlow::Node {
     ContextSource src;
 
-    ContextExpr() { src.flowsTo(DataFlow::valueNode(this)) }
+    ContextNode() { src.ref().flowsTo(this) }
 
     /**
      * Gets the route handler that provides this response.
@@ -267,23 +301,39 @@ module Koa {
   }
 
   /**
+   * DEPRECATED: Use `RequestNode` instead.
    * An expression that may hold a Koa request object.
    */
-  class RequestExpr extends HTTP::Servers::StandardRequestExpr {
+  deprecated class RequestExpr extends HTTP::Servers::StandardRequestExpr {
+    RequestExpr() { this.flow() instanceof RequestNode }
+  }
+
+  /**
+   * An expression that may hold a Koa request object.
+   */
+  class RequestNode extends Http::Servers::StandardRequestNode {
     override RequestSource src;
   }
 
+  /**
+   * DEPRECATED: Use `ResponseNode` instead.
+   * An expression that may hold a Koa response object.
+   */
+  deprecated class ResponseExpr extends HTTP::Servers::StandardResponseExpr {
+    ResponseExpr() { this.flow() instanceof ResponseNode }
+  }
+
   /**
    * An expression that may hold a Koa response object.
    */
-  class ResponseExpr extends HTTP::Servers::StandardResponseExpr {
+  class ResponseNode extends Http::Servers::StandardResponseNode {
     override ResponseSource src;
   }
 
   /**
    * An access to a user-controlled Koa request input.
    */
-  private class RequestInputAccess extends HTTP::RequestInputAccess {
+  private class RequestInputAccess extends Http::RequestInputAccess {
     RouteHandler rh;
     string kind;
 
@@ -294,11 +344,11 @@ module Koa {
       kind = "parameter" and
       this = rh.getARequestParameterAccess()
       or
-      exists(Expr e | rh.getARequestOrContextExpr() = e |
+      exists(DataFlow::Node e | rh.getARequestOrContextNode() = e |
         // `ctx.request.url`, `ctx.request.originalUrl`, or `ctx.request.href`
         exists(string propName |
           kind = "url" and
-          this.asExpr().(PropAccess).accesses(e, propName)
+          this.(DataFlow::PropRead).accesses(e, propName)
         |
           propName = "url"
           or
@@ -309,19 +359,19 @@ module Koa {
         or
         // params, when handler is registered by `koa-router` or similar.
         kind = "parameter" and
-        this.asExpr().(PropAccess).accesses(e, "params")
+        this.(DataFlow::PropRead).accesses(e, "params")
         or
         // `ctx.request.body`
-        e instanceof RequestExpr and
+        e instanceof RequestNode and
         kind = "body" and
-        this.asExpr().(PropAccess).accesses(e, "body")
+        this.(DataFlow::PropRead).accesses(e, "body")
         or
         // `ctx.cookies.get(<name>)`
-        exists(PropAccess cookies |
-          e instanceof ContextExpr and
+        exists(DataFlow::PropRead cookies |
+          e instanceof ContextNode and
           kind = "cookie" and
           cookies.accesses(e, "cookies") and
-          this = cookies.flow().(DataFlow::SourceNode).getAMethodCall("get")
+          this = cookies.getAMethodCall("get")
         )
         or
         exists(RequestHeaderAccess access | access = this |
@@ -340,31 +390,31 @@ module Koa {
 
   private DataFlow::Node getAQueryParameterAccess(RouteHandler rh) {
     // `ctx.query.name` or `ctx.request.query.name`
-    exists(PropAccess q |
-      q.accesses(rh.getARequestOrContextExpr(), "query") and
-      result = q.flow().(DataFlow::SourceNode).getAPropertyRead()
+    exists(DataFlow::PropRead q |
+      q.accesses(rh.getARequestOrContextNode(), "query") and
+      result = q.getAPropertyRead()
     )
   }
 
   /**
    * An access to an HTTP header on a Koa request.
    */
-  private class RequestHeaderAccess extends HTTP::RequestHeaderAccess {
+  private class RequestHeaderAccess extends Http::RequestHeaderAccess {
     RouteHandler rh;
 
     RequestHeaderAccess() {
-      exists(Expr e | e = rh.getARequestOrContextExpr() |
-        exists(string propName, PropAccess headers |
+      exists(DataFlow::Node e | e = rh.getARequestOrContextNode() |
+        exists(string propName, DataFlow::PropRead headers |
           // `ctx.request.header.<name>`, `ctx.request.headers.<name>`
           headers.accesses(e, propName) and
-          this = headers.flow().(DataFlow::SourceNode).getAPropertyRead()
+          this = headers.getAPropertyRead()
         |
           propName = "header" or
           propName = "headers"
         )
         or
         // `ctx.request.get(<name>)`
-        this.asExpr().(MethodCallExpr).calls(e, "get")
+        this.(DataFlow::MethodCallNode).calls(e, "get")
       )
     }
 
@@ -385,37 +435,33 @@ module Koa {
   /**
    * A call to a Koa method that sets up a route.
    */
-  class RouteSetup extends HTTP::Servers::StandardRouteSetup, MethodCallExpr {
+  class RouteSetup extends Http::Servers::StandardRouteSetup, DataFlow::MethodCallNode {
     AppDefinition server;
 
     RouteSetup() {
       // app.use(fun)
-      server.flowsTo(this.getReceiver()) and
-      this.getMethodName() = "use"
+      server.ref().getAMethodCall("use") = this
     }
 
     override DataFlow::SourceNode getARouteHandler() {
       // `StandardRouteHandler` uses this predicate in it's charpred, so making this predicate return a `RouteHandler` would give an empty recursion.
-      result.flowsToExpr(this.getArgument(0))
+      result.flowsTo(this.getArgument(0))
       or
       // For the route-handlers that does not depend on this predicate in their charpred.
-      result.(RouteHandler).getARouteHandlerRegistrationObject().flowsToExpr(this.getArgument(0))
+      result.(RouteHandler).getARouteHandlerRegistrationObject().flowsTo(this.getArgument(0))
     }
 
-    override Expr getServer() { result = server }
+    override DataFlow::Node getServer() { result = server }
   }
 
   /**
    * A value assigned to the body of an HTTP response object.
    */
-  private class ResponseSendArgument extends HTTP::ResponseSendArgument {
+  private class ResponseSendArgument extends Http::ResponseSendArgument {
     RouteHandler rh;
 
     ResponseSendArgument() {
-      exists(DataFlow::PropWrite pwn |
-        pwn.writes(DataFlow::valueNode(rh.getAResponseOrContextExpr()), "body",
-          DataFlow::valueNode(this))
-      )
+      exists(DataFlow::PropWrite pwn | pwn.writes(rh.getAResponseOrContextNode(), "body", this))
     }
 
     override RouteHandler getRouteHandler() { result = rh }
@@ -424,12 +470,12 @@ module Koa {
   /**
    * An invocation of the `redirect` method of an HTTP response object.
    */
-  private class RedirectInvocation extends HTTP::RedirectInvocation, MethodCallExpr {
+  private class RedirectInvocation extends Http::RedirectInvocation instanceof DataFlow::MethodCallNode {
     RouteHandler rh;
 
-    RedirectInvocation() { this.(MethodCallExpr).calls(rh.getAResponseOrContextExpr(), "redirect") }
+    RedirectInvocation() { super.calls(rh.getAResponseOrContextNode(), "redirect") }
 
-    override Expr getUrlArgument() { result = this.getArgument(0) }
+    override DataFlow::Node getUrlArgument() { result = this.getArgument(0) }
 
     override RouteHandler getRouteHandler() { result = rh }
   }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/LiveServer.qll b/javascript/ql/lib/semmle/javascript/frameworks/LiveServer.qll
index 1d7604e0b0c..5a8075ed366 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/LiveServer.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/LiveServer.qll
@@ -9,10 +9,10 @@ private module LiveServer {
   /**
    * An expression that imports the live-server package, seen as a server-definition.
    */
-  class ServerDefinition extends HTTP::Servers::StandardServerDefinition {
-    ServerDefinition() { this = DataFlow::moduleImport("live-server").asExpr() }
+  class ServerDefinition extends Http::Servers::StandardServerDefinition {
+    ServerDefinition() { this = DataFlow::moduleImport("live-server") }
 
-    API::Node getImportNode() { result.asSource().asExpr() = this }
+    API::Node getImportNode() { result.asSource() = this }
   }
 
   /**
@@ -22,26 +22,22 @@ private module LiveServer {
   class RouteHandler extends Connect::RouteHandler, DataFlow::FunctionNode {
     RouteHandler() { this = any(RouteSetup setup).getARouteHandler() }
 
-    override Parameter getRouteHandlerParameter(string kind) {
-      result = ConnectExpressShared::getRouteHandlerParameter(astNode, kind)
+    override DataFlow::ParameterNode getRouteHandlerParameter(string kind) {
+      result = ConnectExpressShared::getRouteHandlerParameter(this, kind)
     }
   }
 
   /**
    * The call to `require("live-server").start()`, seen as a route setup.
    */
-  class RouteSetup extends MethodCallExpr, HTTP::Servers::StandardRouteSetup {
+  class RouteSetup extends Http::Servers::StandardRouteSetup instanceof API::CallNode {
     ServerDefinition server;
-    API::CallNode call;
 
-    RouteSetup() {
-      call = server.getImportNode().getMember("start").getACall() and
-      this = call.asExpr()
-    }
+    RouteSetup() { this = server.getImportNode().getMember("start").getACall() }
 
     override DataFlow::SourceNode getARouteHandler() {
       exists(DataFlow::SourceNode middleware |
-        middleware = call.getParameter(0).getMember("middleware").getAValueReachingSink()
+        middleware = super.getParameter(0).getMember("middleware").getAValueReachingSink()
       |
         result = middleware.getAMemberCall(["push", "unshift"]).getArgument(0).getAFunctionValue()
         or
@@ -49,6 +45,6 @@ private module LiveServer {
       )
     }
 
-    override Expr getServer() { result = server }
+    override DataFlow::Node getServer() { result = server }
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Logging.qll b/javascript/ql/lib/semmle/javascript/frameworks/Logging.qll
index 8f5938f4865..a5599e4ee79 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Logging.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Logging.qll
@@ -349,8 +349,8 @@ private module Pino {
     or
     // `pino` is installed as the "log" property on the request object in `Express` and similar libraries.
     // in `Hapi` the property is "logger".
-    exists(HTTP::RequestExpr req, API::Node reqNode |
-      reqNode.asSource() = req.flow().getALocalSource() and
+    exists(Http::RequestNode req, API::Node reqNode |
+      reqNode.asSource() = req.getALocalSource() and
       result = reqNode.getMember(["log", "logger"])
     )
   }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Markdown.qll b/javascript/ql/lib/semmle/javascript/frameworks/Markdown.qll
index 492ab0cbcec..5a60a8ac84d 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Markdown.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Markdown.qll
@@ -78,6 +78,32 @@ module Markdown {
     }
   }
 
+  /** A taint step for the `mermaid` library. */
+  private class MermaidStep extends MarkdownStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(API::CallNode call |
+        call =
+          [API::moduleImport("mermaid"), API::moduleImport("mermaid").getMember("mermaidAPI")]
+              .getMember("render")
+              .getACall()
+      |
+        succ = [call, call.getParameter(2).getParameter(0).asSource()] and
+        pred = call.getArgument(1)
+      )
+      or
+      exists(DataFlow::CallNode call |
+        call =
+          [
+            DataFlow::globalVarRef("mermaid"),
+            DataFlow::globalVarRef("mermaid").getAPropertyRead("mermaidAPI")
+          ].getAMemberCall("render")
+      |
+        succ = [call.(DataFlow::Node), call.getABoundCallbackParameter(2, 0)] and
+        pred = call.getArgument(1)
+      )
+    }
+  }
+
   /**
    * Classes and predicates for modeling taint steps in `unified` and `remark`.
    */
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Micro.qll b/javascript/ql/lib/semmle/javascript/frameworks/Micro.qll
index bc0cd9a31bd..abdc97fe0b7 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Micro.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Micro.qll
@@ -42,47 +42,55 @@ private module Micro {
   /**
    * A function passed to `micro` or `micro.run`.
    */
-  class MicroRouteHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::FunctionNode {
+  class MicroRouteHandler extends Http::Servers::StandardRouteHandler, DataFlow::FunctionNode {
     MicroRouteHandler() { this = microRouteHandler().getAFunctionValue() }
   }
 
-  class MicroRequestSource extends HTTP::Servers::RequestSource {
+  class MicroRequestSource extends Http::Servers::RequestSource {
     MicroRouteHandler h;
 
     MicroRequestSource() { this = h.getParameter(0) }
 
-    override HTTP::RouteHandler getRouteHandler() { result = h }
+    override Http::RouteHandler getRouteHandler() { result = h }
   }
 
-  class MicroResponseSource extends HTTP::Servers::ResponseSource {
+  class MicroResponseSource extends Http::Servers::ResponseSource {
     MicroRouteHandler h;
 
     MicroResponseSource() { this = h.getParameter(1) }
 
-    override HTTP::RouteHandler getRouteHandler() { result = h }
+    override Http::RouteHandler getRouteHandler() { result = h }
   }
 
-  class MicroRequestExpr extends NodeJSLib::RequestExpr {
+  deprecated class MicroRequestExpr extends NodeJSLib::RequestExpr {
     override MicroRequestSource src;
   }
 
-  class MicroReseponseExpr extends NodeJSLib::ResponseExpr {
+  class MicroRequestNode extends NodeJSLib::RequestNode {
+    override MicroRequestSource src;
+  }
+
+  deprecated class MicroReseponseExpr extends NodeJSLib::ResponseExpr {
     override MicroResponseSource src;
   }
 
-  private HTTP::RouteHandler getRouteHandlerFromReqRes(DataFlow::Node node) {
-    exists(HTTP::Servers::RequestSource src |
+  class MicroResponseNode extends NodeJSLib::ResponseNode {
+    override MicroResponseSource src;
+  }
+
+  private Http::RouteHandler getRouteHandlerFromReqRes(DataFlow::Node node) {
+    exists(Http::Servers::RequestSource src |
       src.ref().flowsTo(node) and
       result = src.getRouteHandler()
     )
     or
-    exists(HTTP::Servers::ResponseSource src |
+    exists(Http::Servers::ResponseSource src |
       src.ref().flowsTo(node) and
       result = src.getRouteHandler()
     )
   }
 
-  class MicroBodyParserCall extends HTTP::RequestInputAccess, DataFlow::CallNode {
+  class MicroBodyParserCall extends Http::RequestInputAccess, DataFlow::CallNode {
     string name;
 
     MicroBodyParserCall() {
@@ -92,22 +100,22 @@ private module Micro {
 
     override string getKind() { result = "body" }
 
-    override HTTP::RouteHandler getRouteHandler() {
+    override Http::RouteHandler getRouteHandler() {
       result = getRouteHandlerFromReqRes(getArgument(0))
     }
 
     override predicate isUserControlledObject() { name = "json" }
   }
 
-  class MicroSendArgument extends HTTP::ResponseSendArgument {
+  class MicroSendArgument extends Http::ResponseSendArgument {
     CallNode send;
 
     MicroSendArgument() {
       send = moduleMember("micro", ["send", "sendError"]).getACall() and
-      this = send.getLastArgument().asExpr()
+      this = send.getLastArgument()
     }
 
-    override HTTP::RouteHandler getRouteHandler() {
+    override Http::RouteHandler getRouteHandler() {
       result = getRouteHandlerFromReqRes(send.getArgument([0, 1]))
     }
   }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Nest.qll b/javascript/ql/lib/semmle/javascript/frameworks/Nest.qll
index 1799f35beb8..16a57eb1b98 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Nest.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Nest.qll
@@ -34,7 +34,7 @@ module NestJS {
    * }
    * ```
    */
-  private class NestJSRouteHandler extends HTTP::RouteHandler, DataFlow::FunctionNode {
+  private class NestJSRouteHandler extends Http::RouteHandler, DataFlow::FunctionNode {
     NestJSRouteHandler() {
       getAFunctionDecorator(this) =
         nestjs()
@@ -42,7 +42,7 @@ module NestJS {
             .getACall()
     }
 
-    override HTTP::HeaderDefinition getAResponseHeader(string name) { none() }
+    override Http::HeaderDefinition getAResponseHeader(string name) { none() }
 
     /**
      * Holds if this has the `@Redirect()` decorator.
@@ -56,7 +56,7 @@ module NestJS {
      */
     predicate isReturnValueReflected() {
       getAFunctionDecorator(this) = nestjs().getMember(["Get", "Post"]).getACall() and
-      not hasRedirectDecorator() and
+      not this.hasRedirectDecorator() and
       not getAFunctionDecorator(this) = nestjs().getMember("Render").getACall()
     }
 
@@ -93,7 +93,7 @@ module NestJS {
     NestJSRequestInput() {
       decoratorName =
         ["Query", "Param", "Headers", "Body", "HostParam", "UploadedFile", "UploadedFiles"] and
-      decorator = getADecorator() and
+      decorator = this.getADecorator() and
       decorator = nestjs().getMember(decoratorName).getACall()
     }
 
@@ -105,7 +105,7 @@ module NestJS {
 
     /** Gets a pipe applied to this parameter, not including global pipes. */
     DataFlow::Node getAPipe() {
-      result = getNestRouteHandler().getAPipe()
+      result = this.getNestRouteHandler().getAPipe()
       or
       result = decorator.getArgument(1)
       or
@@ -132,7 +132,7 @@ module NestJS {
       hasSanitizingPipe(this, false)
       or
       hasSanitizingPipe(this, true) and
-      isSanitizingType(getParameter().getType().unfold())
+      isSanitizingType(this.getParameter().getType().unfold())
     }
   }
 
@@ -240,14 +240,14 @@ module NestJS {
       )
     }
 
-    DataFlow::FunctionNode getTransformFunction() { result = getInstanceMethod("transform") }
+    DataFlow::FunctionNode getTransformFunction() { result = this.getInstanceMethod("transform") }
 
-    DataFlow::ParameterNode getInputData() { result = getTransformFunction().getParameter(0) }
+    DataFlow::ParameterNode getInputData() { result = this.getTransformFunction().getParameter(0) }
 
-    DataFlow::Node getOutputData() { result = getTransformFunction().getReturnNode() }
+    DataFlow::Node getOutputData() { result = this.getTransformFunction().getReturnNode() }
 
     NestJSRequestInput getAnAffectedParameter() {
-      [getAnInstanceReference(), getAClassReference()].flowsTo(result.getAPipe())
+      [this.getAnInstanceReference(), this.getAClassReference()].flowsTo(result.getAPipe())
     }
   }
 
@@ -257,7 +257,7 @@ module NestJS {
    * The type of remote flow depends on which decorator is applied at the parameter, so
    * we just classify it as a `RemoteFlowSource`.
    */
-  private class NestJSCustomPipeInput extends HTTP::RequestInputAccess {
+  private class NestJSCustomPipeInput extends Http::RequestInputAccess {
     CustomPipeClass pipe;
 
     NestJSCustomPipeInput() {
@@ -273,7 +273,7 @@ module NestJS {
       result = pipe.getAnAffectedParameter().getInputKind()
     }
 
-    override HTTP::RouteHandler getRouteHandler() {
+    override Http::RouteHandler getRouteHandler() {
       result = pipe.getAnAffectedParameter().getNestRouteHandler()
     }
   }
@@ -295,18 +295,18 @@ module NestJS {
    * as a source of untrusted data.
    */
   private class NestJSRequestInputAsRequestInputAccess extends NestJSRequestInput,
-    HTTP::RequestInputAccess {
+    Http::RequestInputAccess {
     NestJSRequestInputAsRequestInputAccess() {
-      not isSanitizedByPipe() and
+      not this.isSanitizedByPipe() and
       not this = any(CustomPipeClass cls).getAnAffectedParameter()
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = getNestRouteHandler() }
+    override Http::RouteHandler getRouteHandler() { result = this.getNestRouteHandler() }
 
-    override string getKind() { result = getInputKind() }
+    override string getKind() { result = this.getInputKind() }
 
     override predicate isUserControlledObject() {
-      not exists(getAPipe()) and // value is not transformed by a pipe
+      not exists(this.getAPipe()) and // value is not transformed by a pipe
       (
         decorator.getNumArgument() = 0
         or
@@ -316,7 +316,7 @@ module NestJS {
   }
 
   private class NestJSHeaderAccess extends NestJSRequestInputAsRequestInputAccess,
-    HTTP::RequestHeaderAccess {
+    Http::RequestHeaderAccess {
     NestJSHeaderAccess() { decoratorName = "Headers" and decorator.getNumArgument() > 0 }
 
     override string getAHeaderName() {
@@ -344,20 +344,20 @@ module NestJS {
    * ```
    * writes `<b>Hello</b>` to the response.
    */
-  private class ReturnValueAsResponseSend extends HTTP::ResponseSendArgument {
+  private class ReturnValueAsResponseSend extends Http::ResponseSendArgument {
     NestJSRouteHandler handler;
 
     ReturnValueAsResponseSend() {
       handler.isReturnValueReflected() and
-      this = handler.getAReturn().asExpr() and
+      this = handler.getAReturn() and
       // Only returned strings are sinks
       not exists(Type type |
-        type = getType() and
+        type = this.asExpr().getType() and
         not isStringType(type.unfold())
       )
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = handler }
+    override Http::RouteHandler getRouteHandler() { result = handler }
   }
 
   /**
@@ -389,15 +389,15 @@ module NestJS {
     CustomParameterDecorator() { this = nestjs().getMember("createParamDecorator").getACall() }
 
     /** Gets the `context` parameter. */
-    API::Node getExecutionContext() { result = getParameter(0).getParameter(1) }
+    API::Node getExecutionContext() { result = this.getParameter(0).getParameter(1) }
 
     /** Gets a parameter with this decorator applied. */
     DataFlow::ParameterNode getADecoratedParameter() {
-      result.getADecorator() = getReturn().getReturn().getAValueReachableFromSource()
+      result.getADecorator() = this.getReturn().getReturn().getAValueReachableFromSource()
     }
 
     /** Gets a value returned by the decorator's callback, which becomes the value of the decorated parameter. */
-    DataFlow::Node getResult() { result = getParameter(0).getReturn().asSink() }
+    DataFlow::Node getResult() { result = this.getParameter(0).getReturn().asSink() }
   }
 
   /**
@@ -439,7 +439,7 @@ module NestJS {
     /**
      * Gets the route handler that handles this request.
      */
-    override HTTP::RouteHandler getRouteHandler() {
+    override Http::RouteHandler getRouteHandler() {
       result.(DataFlow::FunctionNode).getAParameter() = this
     }
   }
@@ -456,7 +456,7 @@ module NestJS {
     /**
      * Gets the route handler that handles this request.
      */
-    override HTTP::RouteHandler getRouteHandler() {
+    override Http::RouteHandler getRouteHandler() {
       result.(DataFlow::FunctionNode).getAParameter() = this
     }
   }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Next.qll b/javascript/ql/lib/semmle/javascript/frameworks/Next.qll
index 091aa8ba1af..50671e37796 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Next.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Next.qll
@@ -35,11 +35,10 @@ module NextJS {
    */
   Module getAModuleWithFallbackPaths() {
     result = getAPagesModule() and
-    exists(DataFlow::FunctionNode staticPaths, Expr fallback |
+    exists(DataFlow::FunctionNode staticPaths, DataFlow::Node fallback |
       staticPaths = result.getAnExportedValue("getStaticPaths").getAFunctionValue() and
-      fallback =
-        staticPaths.getAReturn().getALocalSource().getAPropertyWrite("fallback").getRhs().asExpr() and
-      not fallback.(BooleanLiteral).getValue() = "false"
+      fallback = staticPaths.getAReturn().getALocalSource().getAPropertyWrite("fallback").getRhs() and
+      not fallback.mayHaveBooleanValue(false)
     )
   }
 
@@ -154,14 +153,14 @@ module NextJS {
   /**
    * A Next.js function that is exected on the server for every request, seen as a routehandler.
    */
-  class NextHttpRouteHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::FunctionNode {
+  class NextHttpRouteHandler extends Http::Servers::StandardRouteHandler, DataFlow::FunctionNode {
     NextHttpRouteHandler() { this = getServerSidePropsFunction(_) or this = getInitialProps(_) }
   }
 
   /**
    * A function that handles both a request and response from Next.js, seen as a routehandler.
    */
-  class NextReqResHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::FunctionNode {
+  class NextReqResHandler extends Http::Servers::StandardRouteHandler, DataFlow::FunctionNode {
     DataFlow::ParameterNode req;
     DataFlow::ParameterNode res;
 
@@ -183,28 +182,28 @@ module NextJS {
    * A NodeJS HTTP request object in a Next.js page.
    */
   class NextHttpRequestSource extends NodeJSLib::RequestSource {
-    HTTP::RouteHandler rh;
+    Http::RouteHandler rh;
 
     NextHttpRequestSource() {
       this = rh.(NextHttpRouteHandler).getParameter(0).getAPropertyRead("req") or
       this = rh.(NextReqResHandler).getRequest()
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = rh }
+    override Http::RouteHandler getRouteHandler() { result = rh }
   }
 
   /**
    * A NodeJS HTTP response object in a Next.js page.
    */
   class NextHttpResponseSource extends NodeJSLib::ResponseSource {
-    HTTP::RouteHandler rh;
+    Http::RouteHandler rh;
 
     NextHttpResponseSource() {
       this = rh.(NextHttpRouteHandler).getParameter(0).getAPropertyRead("res") or
       this = rh.(NextReqResHandler).getResponse()
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = rh }
+    override Http::RouteHandler getRouteHandler() { result = rh }
   }
 
   /**
@@ -223,17 +222,17 @@ module NextJS {
    * and we therefore model the routehandler as an Express.js routehandler.
    */
   class NextApiRouteHandler extends DataFlow::FunctionNode, Express::RouteHandler,
-    HTTP::Servers::StandardRouteHandler {
+    Http::Servers::StandardRouteHandler {
     NextApiRouteHandler() {
       exists(Module mod | mod.getFile().getParentContainer() = apiFolder() |
         this = mod.getAnExportedValue("default").getAFunctionValue()
       )
     }
 
-    override Parameter getRouteHandlerParameter(string kind) {
-      kind = "request" and result = this.getFunction().getParameter(0)
+    override DataFlow::ParameterNode getRouteHandlerParameter(string kind) {
+      kind = "request" and result = this.getParameter(0)
       or
-      kind = "response" and result = this.getFunction().getParameter(1)
+      kind = "response" and result = this.getParameter(1)
     }
   }
 
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/NoSQL.qll b/javascript/ql/lib/semmle/javascript/frameworks/NoSQL.qll
index 5985735a106..7f49e0cd229 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/NoSQL.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/NoSQL.qll
@@ -6,8 +6,8 @@ import javascript
 
 /** Provides classes for modeling NoSql query sinks. */
 module NoSql {
-  /** An expression that is interpreted as a NoSql query. */
-  abstract class Query extends Expr {
+  /** An expression that is interpreted as a NoSQL query. */
+  abstract class Query extends DataFlow::Node {
     /** Gets an expression that is interpreted as a code operator in this query. */
     DataFlow::Node getACodeOperator() { none() }
   }
@@ -84,7 +84,7 @@ private module MongoDB {
   class Query extends NoSql::Query {
     QueryCall qc;
 
-    Query() { this = qc.getAQueryArgument().asExpr() }
+    Query() { this = qc.getAQueryArgument() }
 
     override DataFlow::Node getACodeOperator() { result = qc.getACodeOperator() }
   }
@@ -496,13 +496,11 @@ private module Mongoose {
   /**
    * An expression passed to `mongoose.createConnection` to supply credentials.
    */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
-      exists(string prop |
-        this = createConnection().getParameter(3).getMember(prop).asSink().asExpr()
-      |
+      exists(string prop | this = createConnection().getParameter(3).getMember(prop).asSink() |
         prop = "user" and kind = "user name"
         or
         prop = "pass" and kind = "password"
@@ -518,7 +516,7 @@ private module Mongoose {
   class MongoDBQueryPart extends NoSql::Query {
     MongooseFunction f;
 
-    MongoDBQueryPart() { this = f.getQueryArgument().asSink().asExpr() }
+    MongoDBQueryPart() { this = f.getQueryArgument().asSink() }
 
     override DataFlow::Node getACodeOperator() {
       result = getADollarWhereProperty(f.getQueryArgument())
@@ -625,7 +623,7 @@ private module Minimongo {
   class Query extends NoSql::Query {
     QueryCall qc;
 
-    Query() { this = qc.getAQueryArgument().asExpr() }
+    Query() { this = qc.getAQueryArgument() }
 
     override DataFlow::Node getACodeOperator() { result = qc.getACodeOperator() }
   }
@@ -685,7 +683,7 @@ private module MarsDB {
   class Query extends NoSql::Query {
     QueryCall qc;
 
-    Query() { this = qc.getAQueryArgument().asExpr() }
+    Query() { this = qc.getAQueryArgument() }
 
     override DataFlow::Node getACodeOperator() { result = qc.getACodeOperator() }
   }
@@ -770,7 +768,7 @@ private module Redis {
     RedisKeyArgument() {
       exists(string method, int argIndex |
         QuerySignatures::argumentIsAmbiguousKey(method, argIndex) and
-        this = redis().getMember(method).getParameter(argIndex).asSink().asExpr()
+        this = redis().getMember(method).getParameter(argIndex).asSink()
       )
     }
   }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll b/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
index 5bd92e3ec5c..36c3cb78cb9 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
@@ -49,7 +49,7 @@ module NodeJSLib {
   /**
    * Holds if `call` is an invocation of `http.createServer` or `https.createServer`.
    */
-  predicate isCreateServer(CallExpr call) {
+  predicate isCreateServer(DataFlow::CallNode call) {
     exists(string pkg, string fn |
       pkg = "http" and fn = "createServer"
       or
@@ -60,17 +60,39 @@ module NodeJSLib {
       or
       pkg = "http2" and fn = "createSecureServer"
     |
-      call = DataFlow::moduleMember(pkg, fn).getAnInvocation().asExpr()
+      call = DataFlow::moduleMember(pkg, fn).getAnInvocation()
     )
   }
 
+  /**
+   * DEPRECATED: Use `ResponseNode` instead.
+   * A Node.js HTTP response.
+   *
+   * A server library that provides an (enhanced) NodesJS HTTP response
+   * object should implement a library specific subclass of this class.
+   */
+  deprecated class ResponseExpr extends HTTP::Servers::StandardResponseExpr {
+    ResponseExpr() { this.flow() instanceof ResponseNode }
+  }
+
   /**
    * A Node.js HTTP response.
    *
    * A server library that provides an (enhanced) NodesJS HTTP response
    * object should implement a library specific subclass of this class.
    */
-  abstract class ResponseExpr extends HTTP::Servers::StandardResponseExpr { }
+  abstract class ResponseNode extends Http::Servers::StandardResponseNode { }
+
+  /**
+   * DEPRECATED: Use `RequestNode` instead.
+   * A Node.js HTTP request.
+   *
+   * A server library that provides an (enhanced) NodesJS HTTP request
+   * object should implement a library specific subclass of this class.
+   */
+  deprecated class RequestExpr extends HTTP::Servers::StandardRequestExpr {
+    RequestExpr() { this.flow() instanceof RequestNode }
+  }
 
   /**
    * A Node.js HTTP request.
@@ -78,7 +100,7 @@ module NodeJSLib {
    * A server library that provides an (enhanced) NodesJS HTTP request
    * object should implement a library specific subclass of this class.
    */
-  abstract class RequestExpr extends HTTP::Servers::StandardRequestExpr { }
+  abstract class RequestNode extends Http::Servers::StandardRequestNode { }
 
   /**
    * A function used as an Node.js server route handler.
@@ -87,16 +109,16 @@ module NodeJSLib {
    * but support for other kinds of route handlers can be added by implementing
    * additional subclasses of this class.
    */
-  abstract class RouteHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::FunctionNode {
+  abstract class RouteHandler extends Http::Servers::StandardRouteHandler, DataFlow::FunctionNode {
     /**
      * Gets the parameter of the route handler that contains the request object.
      */
-    Parameter getRequestParameter() { result = this.getFunction().getParameter(0) }
+    DataFlow::ParameterNode getRequestParameter() { result = this.getParameter(0) }
 
     /**
      * Gets the parameter of the route handler that contains the response object.
      */
-    Parameter getResponseParameter() { result = this.getFunction().getParameter(1) }
+    DataFlow::ParameterNode getResponseParameter() { result = this.getParameter(1) }
   }
 
   /**
@@ -109,7 +131,7 @@ module NodeJSLib {
   /**
    * A Node.js response source.
    */
-  abstract class ResponseSource extends HTTP::Servers::ResponseSource { }
+  abstract class ResponseSource extends Http::Servers::ResponseSource { }
 
   /**
    * A standard Node.js response source, that is, the response parameter of a
@@ -118,7 +140,7 @@ module NodeJSLib {
   private class StandardResponseSource extends ResponseSource {
     RouteHandler rh;
 
-    StandardResponseSource() { this = DataFlow::parameterNode(rh.getResponseParameter()) }
+    StandardResponseSource() { this = rh.getResponseParameter() }
 
     /**
      * Gets the route handler that provides this response.
@@ -129,7 +151,7 @@ module NodeJSLib {
   /**
    * A Node.js request source.
    */
-  abstract class RequestSource extends HTTP::Servers::RequestSource { }
+  abstract class RequestSource extends Http::Servers::RequestSource { }
 
   /**
    * A standard Node.js request source, that is, the request parameter of a
@@ -138,7 +160,7 @@ module NodeJSLib {
   private class StandardRequestSource extends RequestSource {
     RouteHandler rh;
 
-    StandardRequestSource() { this = DataFlow::parameterNode(rh.getRequestParameter()) }
+    StandardRequestSource() { this = rh.getRequestParameter() }
 
     /**
      * Gets the route handler that handles this request.
@@ -147,36 +169,52 @@ module NodeJSLib {
   }
 
   /**
+   * DEPRECATED: Use `BuiltinRouteHandlerResponseNode` instead.
    * A builtin Node.js HTTP response.
    */
-  private class BuiltinRouteHandlerResponseExpr extends ResponseExpr {
+  deprecated private class BuiltinRouteHandlerResponseExpr extends ResponseExpr {
     BuiltinRouteHandlerResponseExpr() { src instanceof ResponseSource }
   }
 
+  /**
+   * A builtin Node.js HTTP response.
+   */
+  private class BuiltinRouteHandlerResponseNode extends ResponseNode {
+    BuiltinRouteHandlerResponseNode() { src instanceof ResponseSource }
+  }
+
+  /**
+   * DEPRECATED: Use `BuiltinRouteHandlerRequestNode` instead.
+   * A builtin Node.js HTTP request.
+   */
+  deprecated private class BuiltinRouteHandlerRequestExpr extends RequestExpr {
+    BuiltinRouteHandlerRequestExpr() { src instanceof RequestSource }
+  }
+
   /**
    * A builtin Node.js HTTP request.
    */
-  private class BuiltinRouteHandlerRequestExpr extends RequestExpr {
-    BuiltinRouteHandlerRequestExpr() { src instanceof RequestSource }
+  private class BuiltinRouteHandlerRequestNode extends RequestNode {
+    BuiltinRouteHandlerRequestNode() { src instanceof RequestSource }
   }
 
   /**
    * An access to a user-controlled Node.js request input.
    */
-  private class RequestInputAccess extends HTTP::RequestInputAccess {
-    RequestExpr request;
+  private class RequestInputAccess extends Http::RequestInputAccess {
+    RequestNode request;
     string kind;
 
     RequestInputAccess() {
       // `req.url` / `req.body`
       kind = ["url", "body"] and
-      this.asExpr().(PropAccess).accesses(request, kind)
+      this.(DataFlow::PropRead).accesses(request, kind)
       or
-      exists(PropAccess headers |
+      exists(DataFlow::PropRead headers |
         // `req.headers.cookie`
         kind = "cookie" and
         headers.accesses(request, "headers") and
-        this.asExpr().(PropAccess).accesses(headers, "cookie")
+        this.(DataFlow::PropRead).accesses(headers, "cookie")
       )
       or
       exists(RequestHeaderAccess access | this = access |
@@ -185,7 +223,7 @@ module NodeJSLib {
       )
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = request.getRouteHandler() }
+    override Http::RouteHandler getRouteHandler() { result = request.getRouteHandler() }
 
     override string getKind() { result = kind }
   }
@@ -193,15 +231,15 @@ module NodeJSLib {
   /**
    * An access to an HTTP header (other than "Cookie") on an incoming Node.js request object.
    */
-  private class RequestHeaderAccess extends HTTP::RequestHeaderAccess {
-    RequestExpr request;
+  private class RequestHeaderAccess extends Http::RequestHeaderAccess {
+    RequestNode request;
 
     RequestHeaderAccess() {
-      exists(PropAccess headers, string name |
+      exists(DataFlow::PropRead headers, string name |
         // `req.headers.<name>`
         name != "cookie" and
         headers.accesses(request, "headers") and
-        this.asExpr().(PropAccess).accesses(headers, name)
+        this.(DataFlow::PropRead).accesses(headers, name)
       )
     }
 
@@ -209,23 +247,23 @@ module NodeJSLib {
       result = this.(DataFlow::PropRead).getPropertyName().toLowerCase()
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = request.getRouteHandler() }
+    override Http::RouteHandler getRouteHandler() { result = request.getRouteHandler() }
 
     override string getKind() { result = "header" }
 
-    RequestExpr getRequest() { result = request }
+    RequestNode getRequest() { result = request }
   }
 
-  class RouteSetup extends CallExpr, HTTP::Servers::StandardRouteSetup {
+  class RouteSetup extends DataFlow::CallNode, Http::Servers::StandardRouteSetup {
     ServerDefinition server;
-    Expr handler;
+    DataFlow::Node handler;
 
     RouteSetup() {
-      server.flowsTo(this) and
+      server.ref() = this and
       handler = this.getLastArgument()
       or
-      server.flowsTo(this.getReceiver()) and
-      this.(MethodCallExpr).getMethodName().regexpMatch("on(ce)?") and
+      server.ref().getAMethodCall() = this and
+      this.getCalleeName().regexpMatch("on(ce)?") and
       this.getArgument(0).getStringValue() = "request" and
       handler = this.getArgument(1)
     }
@@ -236,7 +274,7 @@ module NodeJSLib {
 
     private DataFlow::SourceNode getARouteHandler(DataFlow::TypeBackTracker t) {
       t.start() and
-      result = handler.flow().getALocalSource()
+      result = handler.getALocalSource()
       or
       exists(DataFlow::TypeBackTracker t2, DataFlow::SourceNode succ |
         succ = this.getARouteHandler(t2)
@@ -244,31 +282,37 @@ module NodeJSLib {
         result = succ.backtrack(t2, t)
         or
         t = t2 and
-        HTTP::routeHandlerStep(result, succ)
+        Http::routeHandlerStep(result, succ)
       )
     }
 
-    override Expr getServer() { result = server }
+    override DataFlow::Node getServer() { result = server }
+
+    /**
+     * DEPRECATED: Use `getRouteHandlerNode` instead.
+     * Gets the expression for the handler registered by this setup.
+     */
+    deprecated Expr getRouteHandlerExpr() { result = handler.asExpr() }
 
     /**
      * Gets the expression for the handler registered by this setup.
      */
-    Expr getRouteHandlerExpr() { result = handler }
+    DataFlow::Node getRouteHandlerNode() { result = handler }
   }
 
-  abstract private class HeaderDefinition extends HTTP::Servers::StandardHeaderDefinition {
-    ResponseExpr r;
+  abstract private class HeaderDefinition extends Http::Servers::StandardHeaderDefinition {
+    ResponseNode r;
 
-    HeaderDefinition() { astNode.getReceiver() = r }
+    HeaderDefinition() { this.getReceiver() = r }
 
-    override HTTP::RouteHandler getRouteHandler() { result = r.getRouteHandler() }
+    override Http::RouteHandler getRouteHandler() { result = r.getRouteHandler() }
   }
 
   /**
    * A call to the `setHeader` method of an HTTP response.
    */
   private class SetHeader extends HeaderDefinition {
-    SetHeader() { astNode.getMethodName() = "setHeader" }
+    SetHeader() { this.getMethodName() = "setHeader" }
   }
 
   /**
@@ -276,15 +320,15 @@ module NodeJSLib {
    */
   private class WriteHead extends HeaderDefinition {
     WriteHead() {
-      astNode.getMethodName() = "writeHead" and
-      astNode.getNumArgument() >= 1
+      this.getMethodName() = "writeHead" and
+      this.getNumArgument() >= 1
     }
 
-    override predicate definesExplicitly(string headerName, Expr headerValue) {
-      astNode.getNumArgument() > 1 and
+    override predicate definesHeaderValue(string headerName, DataFlow::Node headerValue) {
+      this.getNumArgument() > 1 and
       exists(DataFlow::SourceNode headers, string header |
-        headers.flowsToExpr(astNode.getLastArgument()) and
-        headers.hasPropertyWrite(header, DataFlow::valueNode(headerValue)) and
+        headers.flowsTo(this.getLastArgument()) and
+        headers.hasPropertyWrite(header, headerValue) and
         headerName = header.toLowerCase()
       )
     }
@@ -359,34 +403,33 @@ module NodeJSLib {
    * An expression passed as the first argument to the `write` or `end` method
    * of an HTTP response.
    */
-  private class ResponseSendArgument extends HTTP::ResponseSendArgument {
-    HTTP::RouteHandler rh;
+  private class ResponseSendArgument extends Http::ResponseSendArgument {
+    Http::RouteHandler rh;
 
     ResponseSendArgument() {
-      exists(MethodCallExpr mce, string m | m = "write" or m = "end" |
-        mce.calls(any(ResponseExpr e | e.getRouteHandler() = rh), m) and
-        this = mce.getArgument(0) and
+      exists(DataFlow::MethodCallNode mcn, string m | m = "write" or m = "end" |
+        mcn.calls(any(ResponseNode e | e.getRouteHandler() = rh), m) and
+        this = mcn.getArgument(0) and
         // don't mistake callback functions as data
         not this.analyze().getAValue() instanceof AbstractFunction
       )
     }
 
-    override HTTP::RouteHandler getRouteHandler() { result = rh }
+    override Http::RouteHandler getRouteHandler() { result = rh }
   }
 
   /**
    * An expression that creates a new Node.js server.
    */
-  class ServerDefinition extends HTTP::Servers::StandardServerDefinition {
+  class ServerDefinition extends Http::Servers::StandardServerDefinition {
     ServerDefinition() { isCreateServer(this) }
   }
 
   /** An expression that is passed as `http.request({ auth: <expr> }, ...)`. */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     Credentials() {
       exists(string http | http = "http" or http = "https" |
-        this =
-          DataFlow::moduleMember(http, "request").getACall().getOptionArgument(0, "auth").asExpr()
+        this = DataFlow::moduleMember(http, "request").getACall().getOptionArgument(0, "auth")
       )
     }
 
@@ -777,7 +820,7 @@ module NodeJSLib {
    *
    * For example, this could be the function `function(req, res){...}`.
    */
-  class RouteHandlerCandidate extends HTTP::RouteHandlerCandidate {
+  class RouteHandlerCandidate extends Http::RouteHandlerCandidate {
     RouteHandlerCandidate() {
       exists(string request, string response |
         (request = "request" or request = "req") and
@@ -797,7 +840,7 @@ module NodeJSLib {
    * A function that flows to a route setup.
    */
   private class TrackedRouteHandlerCandidateWithSetup extends RouteHandler,
-    HTTP::Servers::StandardRouteHandler, DataFlow::FunctionNode {
+    Http::Servers::StandardRouteHandler, DataFlow::FunctionNode {
     TrackedRouteHandlerCandidateWithSetup() { this = any(RouteSetup s).getARouteHandler() }
   }
 
@@ -828,7 +871,7 @@ module NodeJSLib {
    * For example, this could be the call `server.on("request", handler)`
    * where it is unknown if `server` is a Node.js server.
    */
-  class RouteSetupCandidate extends HTTP::RouteSetupCandidate, DataFlow::MethodCallNode {
+  class RouteSetupCandidate extends Http::RouteSetupCandidate, DataFlow::MethodCallNode {
     DataFlow::ValueNode arg;
 
     RouteSetupCandidate() {
@@ -869,7 +912,7 @@ module NodeJSLib {
       exists(string moduleName, DataFlow::SourceNode callee | this = callee.getACall() |
         (moduleName = "http" or moduleName = "https") and
         (
-          callee = DataFlow::moduleMember(moduleName, any(HTTP::RequestMethodName m).toLowerCase())
+          callee = DataFlow::moduleMember(moduleName, any(Http::RequestMethodName m).toLowerCase())
           or
           callee = DataFlow::moduleMember(moduleName, "request")
         ) and
@@ -994,11 +1037,9 @@ module NodeJSLib {
   /**
    * A data flow node that is the username passed to the login callback provided by an HTTP or HTTPS request made by a Node.js process, for example `username` in `http.request(url).on('login', (res, cb) => {cb(username, password)})`.
    */
-  private class ClientRequestLoginUsername extends CredentialsExpr {
+  private class ClientRequestLoginUsername extends CredentialsNode {
     ClientRequestLoginUsername() {
-      exists(ClientRequestLoginCallback callback |
-        this = callback.getACall().getArgument(0).asExpr()
-      )
+      exists(ClientRequestLoginCallback callback | this = callback.getACall().getArgument(0))
     }
 
     override string getCredentialsKind() { result = "Node.js http(s) client login username" }
@@ -1007,11 +1048,9 @@ module NodeJSLib {
   /**
    * A data flow node that is the password passed to the login callback provided by an HTTP or HTTPS request made by a Node.js process, for example `password` in `http.request(url).on('login', (res, cb) => {cb(username, password)})`.
    */
-  private class ClientRequestLoginPassword extends CredentialsExpr {
+  private class ClientRequestLoginPassword extends CredentialsNode {
     ClientRequestLoginPassword() {
-      exists(ClientRequestLoginCallback callback |
-        this = callback.getACall().getArgument(1).asExpr()
-      )
+      exists(ClientRequestLoginCallback callback | this = callback.getACall().getArgument(1))
     }
 
     override string getCredentialsKind() { result = "Node.js http(s) client login password" }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/PkgCloud.qll b/javascript/ql/lib/semmle/javascript/frameworks/PkgCloud.qll
index ef1e5b9bdbb..9255b31fb65 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/PkgCloud.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/PkgCloud.qll
@@ -31,13 +31,13 @@ module PkgCloud {
   /**
    * An expression that is used for authentication through pkgcloud.
    */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
       exists(string propertyName, DataFlow::InvokeNode invk, int i |
         takesConfigurationObject(invk, i) and
-        this = invk.getOptionArgument(0, propertyName).asExpr()
+        this = invk.getOptionArgument(0, propertyName)
       |
         /*
          * Catch-all support for the following providers:
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Request.qll b/javascript/ql/lib/semmle/javascript/frameworks/Request.qll
index bd9fa71864f..3551da6f0c1 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Request.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Request.qll
@@ -6,7 +6,7 @@ import javascript
 
 module Request {
   /** A credentials expression that is used for authentication. */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
@@ -17,12 +17,12 @@ module Request {
           action = mod.getAnInvocation()
           or
           // specialized form: `request.get(...)`
-          action = mod.getAMemberCall(any(HTTP::RequestMethodName n).toLowerCase())
+          action = mod.getAMemberCall(any(Http::RequestMethodName n).toLowerCase())
         )
       |
-        exists(MethodCallExpr auth, int argIndex |
+        exists(DataFlow::MethodCallNode auth, int argIndex |
           // request.get(url).auth('username', 'password', _, 'token');
-          auth = action.getAMemberCall("auth").asExpr() and
+          auth = action.getAMemberCall("auth") and
           this = auth.getArgument(argIndex)
         |
           argIndex = 0 and kind = "user name"
@@ -35,7 +35,7 @@ module Request {
         exists(DataFlow::ObjectLiteralNode auth, string propertyName |
           // request.get(url, { auth: {user: 'username', pass: 'password', bearer: 'token'}})
           auth.flowsTo(action.getOptionArgument(1, "auth")) and
-          auth.hasPropertyWrite(propertyName, DataFlow::valueNode(this))
+          auth.hasPropertyWrite(propertyName, this)
         |
           (propertyName = "user" or propertyName = "username") and
           kind = "user name"
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Restify.qll b/javascript/ql/lib/semmle/javascript/frameworks/Restify.qll
index f83f2930f51..889369c6ea4 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Restify.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Restify.qll
@@ -9,17 +9,17 @@ module Restify {
   /**
    * An expression that creates a new Restify server.
    */
-  class ServerDefinition extends HTTP::Servers::StandardServerDefinition, CallExpr {
+  class ServerDefinition extends Http::Servers::StandardServerDefinition, DataFlow::CallNode {
     ServerDefinition() {
       // `server = restify.createServer()`
-      this = DataFlow::moduleMember("restify", "createServer").getACall().asExpr()
+      this = DataFlow::moduleMember("restify", "createServer").getACall()
     }
   }
 
   /**
    * A Restify route handler.
    */
-  class RouteHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::ValueNode {
+  class RouteHandler extends Http::Servers::StandardRouteHandler, DataFlow::ValueNode {
     Function function;
 
     RouteHandler() {
@@ -42,7 +42,7 @@ module Restify {
    * A Restify response source, that is, the response parameter of a
    * route handler.
    */
-  private class ResponseSource extends HTTP::Servers::ResponseSource {
+  private class ResponseSource extends Http::Servers::ResponseSource {
     RouteHandler rh;
 
     ResponseSource() { this = DataFlow::parameterNode(rh.getResponseParameter()) }
@@ -57,7 +57,7 @@ module Restify {
    * A Restify request source, that is, the request parameter of a
    * route handler.
    */
-  private class RequestSource extends HTTP::Servers::RequestSource {
+  private class RequestSource extends Http::Servers::RequestSource {
     RouteHandler rh;
 
     RequestSource() { this = DataFlow::parameterNode(rh.getRequestParameter()) }
@@ -69,38 +69,54 @@ module Restify {
   }
 
   /**
+   * DEPRECATED: Use `ResponseNode` instead.
    * A Node.js HTTP response provided by Restify.
    */
-  class ResponseExpr extends NodeJSLib::ResponseExpr {
+  deprecated class ResponseExpr extends NodeJSLib::ResponseExpr {
     ResponseExpr() { src instanceof ResponseSource }
   }
 
+  /**
+   * A Node.js HTTP response provided by Restify.
+   */
+  class ResponseNode extends NodeJSLib::ResponseNode {
+    ResponseNode() { src instanceof ResponseSource }
+  }
+
+  /**
+   * DEPRECATED: Use `RequestNode` instead.
+   * A Node.js HTTP request provided by Restify.
+   */
+  deprecated class RequestExpr extends NodeJSLib::RequestExpr {
+    RequestExpr() { src instanceof RequestSource }
+  }
+
   /**
    * A Node.js HTTP request provided by Restify.
    */
-  class RequestExpr extends NodeJSLib::RequestExpr {
-    RequestExpr() { src instanceof RequestSource }
+  class RequestNode extends NodeJSLib::RequestNode {
+    RequestNode() { src instanceof RequestSource }
   }
 
   /**
    * An access to a user-controlled Restify request input.
    */
-  private class RequestInputAccess extends HTTP::RequestInputAccess {
-    RequestExpr request;
+  private class RequestInputAccess extends Http::RequestInputAccess {
+    RequestNode request;
     string kind;
 
     RequestInputAccess() {
-      exists(MethodCallExpr query |
+      exists(DataFlow::MethodCallNode query |
         // `request.getQuery().<name>`
         kind = "parameter" and
         query.calls(request, "getQuery") and
-        this.asExpr().(PropAccess).accesses(query, _)
+        this.(DataFlow::PropRead).accesses(query, _)
       )
       or
       exists(string methodName |
         // `request.href()` or `request.getPath()`
         kind = "url" and
-        this.asExpr().(MethodCallExpr).calls(request, methodName)
+        this.(DataFlow::MethodCallNode).calls(request, methodName)
       |
         methodName = "href" or
         methodName = "getPath"
@@ -108,13 +124,12 @@ module Restify {
       or
       // `request.getContentType()`, `request.userAgent()`, `request.trailer(...)`, `request.header(...)`
       kind = "header" and
-      this.asExpr()
-          .(MethodCallExpr)
+      this.(DataFlow::MethodCallNode)
           .calls(request, ["getContentType", "userAgent", "trailer", "header"])
       or
       // `req.cookies
       kind = "cookie" and
-      this.asExpr().(PropAccess).accesses(request, "cookies")
+      this.(DataFlow::PropRead).accesses(request, "cookies")
     }
 
     override RouteHandler getRouteHandler() { result = request.getRouteHandler() }
@@ -125,31 +140,30 @@ module Restify {
   /**
    * An HTTP header defined in a Restify server.
    */
-  private class HeaderDefinition extends HTTP::Servers::StandardHeaderDefinition {
+  private class HeaderDefinition extends Http::Servers::StandardHeaderDefinition {
     HeaderDefinition() {
       // response.header('Cache-Control', 'no-cache')
-      astNode.getReceiver() instanceof ResponseExpr and
-      astNode.getMethodName() = "header"
+      this.getReceiver() instanceof ResponseNode and
+      this.getMethodName() = "header"
     }
 
-    override RouteHandler getRouteHandler() { astNode.getReceiver() = result.getAResponseExpr() }
+    override RouteHandler getRouteHandler() { this.getReceiver() = result.getAResponseNode() }
   }
 
   /**
    * A call to a Restify method that sets up a route.
    */
-  class RouteSetup extends MethodCallExpr, HTTP::Servers::StandardRouteSetup {
+  class RouteSetup extends DataFlow::MethodCallNode, Http::Servers::StandardRouteSetup {
     ServerDefinition server;
 
     RouteSetup() {
       // server.get('/', fun)
       // server.head('/', fun)
-      server.flowsTo(getReceiver()) and
-      getMethodName() = any(HTTP::RequestMethodName m).toLowerCase()
+      server.ref().getAMethodCall(any(Http::RequestMethodName m).toLowerCase()) = this
     }
 
-    override DataFlow::SourceNode getARouteHandler() { result.flowsToExpr(getArgument(1)) }
+    override DataFlow::SourceNode getARouteHandler() { result.flowsTo(this.getArgument(1)) }
 
-    override Expr getServer() { result = server }
+    override DataFlow::Node getServer() { result = server }
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/SQL.qll b/javascript/ql/lib/semmle/javascript/frameworks/SQL.qll
index edd92614a2c..a1499d09ea2 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/SQL.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/SQL.qll
@@ -5,26 +5,26 @@
 import javascript
 
 module SQL {
-  /** A string-valued expression that is interpreted as a SQL command. */
-  abstract class SqlString extends Expr { }
+  /** A string-valued dataflow node that is interpreted as a SQL command. */
+  abstract class SqlString extends DataFlow::Node { }
 
   private class SqlStringFromModel extends SqlString {
-    SqlStringFromModel() { this = ModelOutput::getASinkNode("sql-injection").asSink().asExpr() }
+    SqlStringFromModel() { this = ModelOutput::getASinkNode("sql-injection").asSink() }
   }
 
   /**
-   * An expression that sanitizes a string to make it safe to embed into
+   * An dataflow node that sanitizes a string to make it safe to embed into
    * a SQL command.
    */
-  abstract class SqlSanitizer extends Expr {
-    Expr input;
-    Expr output;
+  abstract class SqlSanitizer extends DataFlow::Node {
+    DataFlow::Node input;
+    DataFlow::Node output;
 
     /** Gets the input expression being sanitized. */
-    Expr getInput() { result = input }
+    DataFlow::Node getInput() { result = input }
 
     /** Gets the output expression containing the sanitized value. */
-    Expr getOutput() { result = output }
+    DataFlow::Node getOutput() { result = output }
   }
 }
 
@@ -90,26 +90,26 @@ private module MySql {
 
   /** An expression that is passed to the `query` method and hence interpreted as SQL. */
   class QueryString extends SQL::SqlString {
-    QueryString() { this = any(QueryCall qc).getAQueryArgument().asExpr() }
+    QueryString() { this = any(QueryCall qc).getAQueryArgument() }
   }
 
   /** A call to the `escape` or `escapeId` method that performs SQL sanitization. */
-  class EscapingSanitizer extends SQL::SqlSanitizer, MethodCallExpr {
+  class EscapingSanitizer extends SQL::SqlSanitizer instanceof API::CallNode {
     EscapingSanitizer() {
-      this = [mysql(), pool(), connection()].getMember(["escape", "escapeId"]).getACall().asExpr() and
+      this = [mysql(), pool(), connection()].getMember(["escape", "escapeId"]).getACall() and
       input = this.getArgument(0) and
       output = this
     }
   }
 
   /** An expression that is passed as user name or password to `mysql.createConnection`. */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
       exists(API::Node callee, string prop |
         callee in [createConnection(), createPool()] and
-        this = callee.getParameter(0).getMember(prop).asSink().asExpr() and
+        this = callee.getParameter(0).getMember(prop).asSink() and
         (
           prop = "user" and kind = "user name"
           or
@@ -198,21 +198,21 @@ private module Postgres {
   /** An expression that is passed to the `query` method and hence interpreted as SQL. */
   class QueryString extends SQL::SqlString {
     QueryString() {
-      this = any(QueryCall qc).getAQueryArgument().asExpr()
+      this = any(QueryCall qc).getAQueryArgument()
       or
-      this = API::moduleImport("pg-cursor").getParameter(0).asSink().asExpr()
+      this = API::moduleImport("pg-cursor").getParameter(0).asSink()
     }
   }
 
   /** An expression that is passed as user name or password when creating a client or a pool. */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
       exists(string prop |
-        this = [newClient(), newPool()].getParameter(0).getMember(prop).asSink().asExpr()
+        this = [newClient(), newPool()].getParameter(0).getMember(prop).asSink()
         or
-        this = pgPromise().getParameter(0).getMember(prop).asSink().asExpr()
+        this = pgPromise().getParameter(0).getMember(prop).asSink()
       |
         prop = "user" and kind = "user name"
         or
@@ -349,7 +349,7 @@ private module Postgres {
 
   /** An expression that is interpreted as SQL by `pg-promise`. */
   class PgPromiseQueryString extends SQL::SqlString {
-    PgPromiseQueryString() { this = any(PgPromiseQueryCall qc).getAQueryArgument().asExpr() }
+    PgPromiseQueryString() { this = any(PgPromiseQueryCall qc).getAQueryArgument() }
   }
 }
 
@@ -398,7 +398,7 @@ private module Sqlite {
 
   /** An expression that is passed to the `query` method and hence interpreted as SQL. */
   class QueryString extends SQL::SqlString {
-    QueryString() { this = any(QueryCall qc).getAQueryArgument().asExpr() }
+    QueryString() { this = any(QueryCall qc).getAQueryArgument() }
   }
 }
 
@@ -470,7 +470,7 @@ private module MsSql {
   class QueryString extends SQL::SqlString {
     QueryString() {
       exists(DatabaseAccess dba | dba instanceof QueryTemplateExpr or dba instanceof QueryCall |
-        this = dba.getAQueryArgument().asExpr()
+        this = dba.getAQueryArgument()
       )
     }
   }
@@ -478,14 +478,14 @@ private module MsSql {
   /** An element of a query template, which is automatically sanitized. */
   class QueryTemplateSanitizer extends SQL::SqlSanitizer {
     QueryTemplateSanitizer() {
-      this = any(QueryTemplateExpr qte).getAQueryArgument().asExpr() and
+      this = any(QueryTemplateExpr qte).getAQueryArgument() and
       input = this and
       output = this
     }
   }
 
   /** An expression that is passed as user name or password when creating a client or a pool. */
-  class Credentials extends CredentialsExpr {
+  class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
@@ -495,7 +495,7 @@ private module MsSql {
           or
           callee = mssql().getMember("ConnectionPool")
         ) and
-        this = callee.getParameter(0).getMember(prop).asSink().asExpr() and
+        this = callee.getParameter(0).getMember(prop).asSink() and
         (
           prop = "user" and kind = "user name"
           or
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/ServerLess.qll b/javascript/ql/lib/semmle/javascript/frameworks/ServerLess.qll
index 0eccacac0b7..6eace6700ae 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/ServerLess.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/ServerLess.qll
@@ -15,21 +15,21 @@ private module ServerLess {
    * `codeURI` defaults to the empty string if no explicit value is set in the configuration.
    */
   private predicate hasServerlessHandler(File ymlFile, string handler, string codeUri) {
-    exists(YAMLMapping resource | ymlFile = resource.getFile() |
+    exists(YamlMapping resource | ymlFile = resource.getFile() |
       // There exists at least "AWS::Serverless::Function" and "Aliyun::Serverless::Function"
-      resource.lookup("Type").(YAMLScalar).getValue().regexpMatch(".*::Serverless::Function") and
-      exists(YAMLMapping properties | properties = resource.lookup("Properties") |
-        handler = properties.lookup("Handler").(YAMLScalar).getValue() and
+      resource.lookup("Type").(YamlScalar).getValue().regexpMatch(".*::Serverless::Function") and
+      exists(YamlMapping properties | properties = resource.lookup("Properties") |
+        handler = properties.lookup("Handler").(YamlScalar).getValue() and
         if exists(properties.lookup("CodeUri"))
-        then codeUri = properties.lookup("CodeUri").(YAMLScalar).getValue()
+        then codeUri = properties.lookup("CodeUri").(YamlScalar).getValue()
         else codeUri = ""
       )
       or
       // The `serverless` library, which specifies a top-level `functions` property
-      exists(YAMLMapping functions |
+      exists(YamlMapping functions |
         functions = resource.lookup("functions") and
         not exists(resource.getParentNode()) and
-        handler = functions.getValue(_).(YAMLMapping).lookup("handler").(YAMLScalar).getValue() and
+        handler = functions.getValue(_).(YamlMapping).lookup("handler").(YamlScalar).getValue() and
         codeUri = ""
       )
     )
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Templating.qll b/javascript/ql/lib/semmle/javascript/frameworks/Templating.qll
index 90adf7d7de6..d66ca3baab2 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Templating.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Templating.qll
@@ -151,7 +151,7 @@ module Templating {
 
     /** Gets the data flow node representing the initialization of the given variable in this scope. */
     DataFlow::Node getVariableInit(string name) {
-      result = DataFlow::ssaDefinitionNode(SSA::implicitInit(this.getScope().getVariable(name)))
+      result = DataFlow::ssaDefinitionNode(Ssa::implicitInit(this.getScope().getVariable(name)))
     }
 
     /** Gets a data flow node corresponding to a use of the given template variable within this top-level. */
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Testing.qll b/javascript/ql/lib/semmle/javascript/frameworks/Testing.qll
index 6923d59124f..f8f0c2126f0 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Testing.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Testing.qll
@@ -27,8 +27,8 @@ class QUnitTest extends Test, @call_expr {
  * that is, an invocation of a function named `it` where the first argument
  * is a string and the second argument is a function.
  */
-class BDDTest extends Test, @call_expr {
-  BDDTest() {
+class BddTest extends Test, @call_expr {
+  BddTest() {
     exists(CallExpr call | call = this |
       call.getCallee().(VarAccess).getName() = "it" and
       exists(call.getArgument(0).getStringValue()) and
@@ -37,6 +37,9 @@ class BDDTest extends Test, @call_expr {
   }
 }
 
+/** DEPRECATED: Alias for BddTest */
+deprecated class BDDTest = BddTest;
+
 /**
  * Gets the test file for `f` with stem extension `stemExt`, where `stemExt` is "test" or "spec".
  * That is, a file named `<base>.<stemExt>.<ext>` in the
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/WebSocket.qll b/javascript/ql/lib/semmle/javascript/frameworks/WebSocket.qll
index 16e5187081e..a02da6c9f86 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/WebSocket.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/WebSocket.qll
@@ -226,21 +226,21 @@ module ServerWebSocket {
    * A `socket.on("connection", (msg, req) => {})` call seen as a HTTP route handler.
    * `req` is a `HTTP::IncomingMessage` instance.
    */
-  class ConnectionCallAsRouteHandler extends HTTP::RouteHandler, DataFlow::CallNode {
+  class ConnectionCallAsRouteHandler extends Http::RouteHandler, DataFlow::CallNode {
     ConnectionCallAsRouteHandler() { this = getAConnectionCall(_) }
 
-    override HTTP::HeaderDefinition getAResponseHeader(string name) { none() }
+    override Http::HeaderDefinition getAResponseHeader(string name) { none() }
   }
 
   /**
    * The `req` parameter of a `socket.on("connection", (msg, req) => {})` call.
    */
-  class ServerHttpRequest extends HTTP::Servers::RequestSource {
+  class ServerHttpRequest extends Http::Servers::RequestSource {
     ConnectionCallAsRouteHandler handler;
 
     ServerHttpRequest() { this = handler.getCallback(1).getParameter(1) }
 
-    override HTTP::RouteHandler getRouteHandler() { result = handler }
+    override Http::RouteHandler getRouteHandler() { result = handler }
   }
 
   /** DEPRECATED: Alias for ServerHttpRequest */
@@ -249,7 +249,7 @@ module ServerWebSocket {
   /**
    * An access user-controlled HTTP request input in a request to a WebSocket server.
    */
-  class WebSocketRequestInput extends HTTP::RequestInputAccess {
+  class WebSocketRequestInput extends Http::RequestInputAccess {
     ServerHttpRequest request;
     string kind;
 
@@ -267,7 +267,7 @@ module ServerWebSocket {
 
     override string getKind() { result = kind }
 
-    override HTTP::RouteHandler getRouteHandler() { result = request.getRouteHandler() }
+    override Http::RouteHandler getRouteHandler() { result = request.getRouteHandler() }
   }
 
   /**
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
index 69563a3eab4..fb5ac61cc91 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
@@ -72,6 +72,8 @@ private class Unit = Specific::Unit;
 
 private module API = Specific::API;
 
+private module DataFlow = Specific::DataFlow;
+
 private import Specific::AccessPathSyntax
 
 /** Module containing hooks for providing input data to be interpreted as a model. */
@@ -155,6 +157,38 @@ module ModelInput {
      */
     abstract predicate row(string row);
   }
+
+  /**
+   * A unit class for adding additional type model rows from CodeQL models.
+   */
+  class TypeModel extends Unit {
+    /**
+     * Gets a data-flow node that is a source of the type `package;type`.
+     */
+    DataFlow::Node getASource(string package, string type) { none() }
+
+    /**
+     * Gets a data flow node that is a sink of the type `package;type`,
+     * usually because it is an argument passed to a parameter of that type.
+     */
+    DataFlow::Node getASink(string package, string type) { none() }
+  }
+
+  /**
+   * A unit class for adding additional type variable model rows.
+   */
+  class TypeVariableModelCsv extends Unit {
+    /**
+     * Holds if `row` specifies a path through a type variable.
+     *
+     * A row of form,
+     * ```
+     * name;path
+     * ```
+     * means `path` can be substituted for a token `TypeVar[name]`.
+     */
+    abstract predicate row(string row);
+  }
 }
 
 private import ModelInput
@@ -182,6 +216,8 @@ private predicate summaryModel(string row) { any(SummaryModelCsv s).row(inverseP
 
 private predicate typeModel(string row) { any(TypeModelCsv s).row(inversePad(row)) }
 
+private predicate typeVariableModel(string row) { any(TypeVariableModelCsv s).row(inversePad(row)) }
+
 /** Holds if a source model exists for the given parameters. */
 predicate sourceModel(string package, string type, string path, string kind) {
   exists(string row |
@@ -219,7 +255,7 @@ private predicate summaryModel(
   )
 }
 
-/** Holds if an type model exists for the given parameters. */
+/** Holds if a type model exists for the given parameters. */
 private predicate typeModel(
   string package1, string type1, string package2, string type2, string path
 ) {
@@ -233,6 +269,15 @@ private predicate typeModel(
   )
 }
 
+/** Holds if a type variable model exists for the given parameters. */
+private predicate typeVariableModel(string name, string path) {
+  exists(string row |
+    typeVariableModel(row) and
+    row.splitAt(";", 0) = name and
+    row.splitAt(";", 1) = path
+  )
+}
+
 /**
  * Gets a package that should be seen as an alias for the given other `package`,
  * or the `package` itself.
@@ -253,7 +298,7 @@ private predicate isRelevantPackage(string package) {
     sourceModel(package, _, _, _) or
     sinkModel(package, _, _, _) or
     summaryModel(package, _, _, _, _, _) or
-    typeModel(package, _, _, _, _)
+    typeModel(_, _, package, _, _)
   ) and
   (
     Specific::isPackageUsed(package)
@@ -290,6 +335,8 @@ private class AccessPathRange extends AccessPath::Range {
       summaryModel(package, _, _, this, _, _) or
       summaryModel(package, _, _, _, this, _)
     )
+    or
+    typeVariableModel(_, this)
   }
 }
 
@@ -339,6 +386,57 @@ private predicate invocationMatchesCallSiteFilter(Specific::InvokeNode invoke, A
   Specific::invocationMatchesExtraCallSiteFilter(invoke, token)
 }
 
+private class TypeModelUseEntry extends API::EntryPoint {
+  private string package;
+  private string type;
+
+  TypeModelUseEntry() {
+    exists(any(TypeModel tm).getASource(package, type)) and
+    this = "TypeModelUseEntry;" + package + ";" + type
+  }
+
+  override DataFlow::LocalSourceNode getASource() {
+    result = any(TypeModel tm).getASource(package, type)
+  }
+
+  API::Node getNodeForType(string package_, string type_) {
+    package = package_ and type = type_ and result = this.getANode()
+  }
+}
+
+private class TypeModelDefEntry extends API::EntryPoint {
+  private string package;
+  private string type;
+
+  TypeModelDefEntry() {
+    exists(any(TypeModel tm).getASink(package, type)) and
+    this = "TypeModelDefEntry;" + package + ";" + type
+  }
+
+  override DataFlow::Node getASink() { result = any(TypeModel tm).getASink(package, type) }
+
+  API::Node getNodeForType(string package_, string type_) {
+    package = package_ and type = type_ and result = this.getANode()
+  }
+}
+
+/**
+ * Gets an API node identified by the given `(package,type)` pair.
+ */
+pragma[nomagic]
+private API::Node getNodeFromType(string package, string type) {
+  exists(string package2, string type2, AccessPath path2 |
+    typeModel(package, type, package2, type2, path2) and
+    result = getNodeFromPath(package2, type2, path2)
+  )
+  or
+  result = any(TypeModelUseEntry e).getNodeForType(package, type)
+  or
+  result = any(TypeModelDefEntry e).getNodeForType(package, type)
+  or
+  result = Specific::getExtraNodeFromType(package, type)
+}
+
 /**
  * Gets the API node identified by the first `n` tokens of `path` in the given `(package, type, path)` tuple.
  */
@@ -347,12 +445,8 @@ private API::Node getNodeFromPath(string package, string type, AccessPath path,
   isRelevantFullPath(package, type, path) and
   (
     n = 0 and
-    exists(string package2, string type2, AccessPath path2 |
-      typeModel(package, type, package2, type2, path2) and
-      result = getNodeFromPath(package2, type2, path2, path2.getNumToken())
-    )
+    result = getNodeFromType(package, type)
     or
-    // Language-specific cases, such as handling of global variables
     result = Specific::getExtraNodeFromPath(package, type, path, n)
   )
   or
@@ -361,6 +455,72 @@ private API::Node getNodeFromPath(string package, string type, AccessPath path,
   // Similar to the other recursive case, but where the path may have stepped through one or more call-site filters
   result =
     getSuccessorFromInvoke(getInvocationFromPath(package, type, path, n - 1), path.getToken(n - 1))
+  or
+  // Apply a subpath
+  result =
+    getNodeFromSubPath(getNodeFromPath(package, type, path, n - 1), getSubPathAt(path, n - 1))
+  or
+  // Apply a type step
+  typeStep(getNodeFromPath(package, type, path, n), result)
+}
+
+/**
+ * Gets a subpath for the `TypeVar` token found at the `n`th token of `path`.
+ */
+pragma[nomagic]
+private AccessPath getSubPathAt(AccessPath path, int n) {
+  exists(string typeVarName |
+    path.getToken(n).getAnArgument("TypeVar") = typeVarName and
+    typeVariableModel(typeVarName, result)
+  )
+}
+
+/**
+ * Gets a node that is found by evaluating the first `n` tokens of `subPath` starting at `base`.
+ */
+pragma[nomagic]
+private API::Node getNodeFromSubPath(API::Node base, AccessPath subPath, int n) {
+  exists(AccessPath path, int k |
+    base = [getNodeFromPath(_, _, path, k), getNodeFromSubPath(_, path, k)] and
+    subPath = getSubPathAt(path, k) and
+    result = base and
+    n = 0
+  )
+  or
+  exists(string package, string type, AccessPath basePath |
+    typeStepModel(package, type, basePath, subPath) and
+    base = getNodeFromPath(package, type, basePath) and
+    result = base and
+    n = 0
+  )
+  or
+  result = getSuccessorFromNode(getNodeFromSubPath(base, subPath, n - 1), subPath.getToken(n - 1))
+  or
+  result =
+    getSuccessorFromInvoke(getInvocationFromSubPath(base, subPath, n - 1), subPath.getToken(n - 1))
+  or
+  result =
+    getNodeFromSubPath(getNodeFromSubPath(base, subPath, n - 1), getSubPathAt(subPath, n - 1))
+  or
+  typeStep(getNodeFromSubPath(base, subPath, n), result)
+}
+
+/**
+ * Gets a call site that is found by evaluating the first `n` tokens of `subPath` starting at `base`.
+ */
+private Specific::InvokeNode getInvocationFromSubPath(API::Node base, AccessPath subPath, int n) {
+  result = Specific::getAnInvocationOf(getNodeFromSubPath(base, subPath, n))
+  or
+  result = getInvocationFromSubPath(base, subPath, n - 1) and
+  invocationMatchesCallSiteFilter(result, subPath.getToken(n - 1))
+}
+
+/**
+ * Gets a node that is found by evaluating `subPath` starting at `base`.
+ */
+pragma[nomagic]
+private API::Node getNodeFromSubPath(API::Node base, AccessPath subPath) {
+  result = getNodeFromSubPath(base, subPath, subPath.getNumToken())
 }
 
 /** Gets the node identified by the given `(package, type, path)` tuple. */
@@ -368,6 +528,20 @@ API::Node getNodeFromPath(string package, string type, AccessPath path) {
   result = getNodeFromPath(package, type, path, path.getNumToken())
 }
 
+pragma[nomagic]
+private predicate typeStepModel(string package, string type, AccessPath basePath, AccessPath output) {
+  summaryModel(package, type, basePath, "", output, "type")
+}
+
+pragma[nomagic]
+private predicate typeStep(API::Node pred, API::Node succ) {
+  exists(string package, string type, AccessPath basePath, AccessPath output |
+    typeStepModel(package, type, basePath, output) and
+    pred = getNodeFromPath(package, type, basePath) and
+    succ = getNodeFromSubPath(pred, output)
+  )
+}
+
 /**
  * Gets an invocation identified by the given `(package, type, path)` tuple.
  *
@@ -390,7 +564,7 @@ Specific::InvokeNode getInvocationFromPath(string package, string type, AccessPa
  */
 bindingset[name]
 predicate isValidTokenNameInIdentifyingAccessPath(string name) {
-  name = ["Argument", "Parameter", "ReturnValue", "WithArity"]
+  name = ["Argument", "Parameter", "ReturnValue", "WithArity", "TypeVar"]
   or
   Specific::isExtraValidTokenNameInIdentifyingAccessPath(name)
 }
@@ -418,6 +592,9 @@ predicate isValidTokenArgumentInIdentifyingAccessPath(string name, string argume
   name = "WithArity" and
   argument.regexpMatch("\\d+(\\.\\.(\\d+)?)?")
   or
+  name = "TypeVar" and
+  exists(argument)
+  or
   Specific::isExtraValidTokenArgumentInIdentifyingAccessPath(name, argument)
 }
 
@@ -469,12 +646,7 @@ module ModelOutput {
    * Holds if `node` is seen as an instance of `(package,type)` due to a type definition
    * contributed by a CSV model.
    */
-  API::Node getATypeNode(string package, string type) {
-    exists(string package2, string type2, AccessPath path |
-      typeModel(package, type, package2, type2, path) and
-      result = getNodeFromPath(package2, type2, path)
-    )
-  }
+  API::Node getATypeNode(string package, string type) { result = getNodeFromType(package, type) }
 
   /**
    * Gets an error message relating to an invalid CSV row in a model.
@@ -489,6 +661,8 @@ module ModelOutput {
       any(SummaryModelCsv csv).row(row) and kind = "summary" and expectedArity = 6
       or
       any(TypeModelCsv csv).row(row) and kind = "type" and expectedArity = 5
+      or
+      any(TypeVariableModelCsv csv).row(row) and kind = "type-variable" and expectedArity = 2
     |
       actualArity = count(row.indexOf(";")) + 1 and
       actualArity != expectedArity and
@@ -499,7 +673,7 @@ module ModelOutput {
     or
     // Check names and arguments of access path tokens
     exists(AccessPath path, AccessPathToken token |
-      isRelevantFullPath(_, _, path) and
+      (isRelevantFullPath(_, _, path) or typeVariableModel(_, path)) and
       token = path.getToken(_)
     |
       not isValidTokenNameInIdentifyingAccessPath(token.getName()) and
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsSpecific.qll b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsSpecific.qll
index 861a44a2cfc..097a46fd11a 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsSpecific.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsSpecific.qll
@@ -20,7 +20,6 @@
  */
 
 private import javascript as JS
-private import JS::DataFlow as DataFlow
 private import ApiGraphModels
 
 class Unit = JS::Unit;
@@ -29,6 +28,7 @@ class Unit = JS::Unit;
 module API = JS::API;
 
 import semmle.javascript.frameworks.data.internal.AccessPathSyntax as AccessPathSyntax
+import JS::DataFlow as DataFlow
 private import AccessPathSyntax
 
 /**
@@ -77,10 +77,6 @@ private API::Node getGlobalNode(string globalName) {
 /** Gets a JavaScript-specific interpretation of the `(package, type, path)` tuple after resolving the first `n` access path tokens. */
 bindingset[package, type, path]
 API::Node getExtraNodeFromPath(string package, string type, AccessPath path, int n) {
-  type = "" and
-  n = 0 and
-  result = API::moduleImport(package)
-  or
   // Global variable accesses is via the 'global' package
   exists(AccessPathToken token |
     package = getAPackageAlias("global") and
@@ -90,10 +86,15 @@ API::Node getExtraNodeFromPath(string package, string type, AccessPath path, int
     result = getGlobalNode(token.getAnArgument()) and
     n = 1
   )
+}
+
+/** Gets a JavaScript-specific interpretation of the `(package, type)` tuple. */
+API::Node getExtraNodeFromType(string package, string type) {
+  type = "" and
+  result = API::moduleImport(package)
   or
   // Access instance of a type based on type annotations
-  n = 0 and
-  result = API::Node::ofType(getAPackageAlias(package), type)
+  result = API::Internal::getANodeOfTypeRaw(getAPackageAlias(package), type)
 }
 
 /**
@@ -104,6 +105,9 @@ API::Node getExtraSuccessorFromNode(API::Node node, AccessPathToken token) {
   token.getName() = "Member" and
   result = node.getMember(token.getAnArgument())
   or
+  token.getName() = "AnyMember" and
+  result = node.getAMember()
+  or
   token.getName() = "Instance" and
   result = node.getInstance()
   or
@@ -163,6 +167,16 @@ predicate invocationMatchesExtraCallSiteFilter(API::InvokeNode invoke, AccessPat
   token.getName() = "Call" and
   invoke instanceof API::CallNode and
   invoke instanceof DataFlow::CallNode // Workaround compiler bug
+  or
+  token.getName() = "WithStringArgument" and
+  exists(string operand, string argIndex, string stringValue |
+    operand = token.getAnArgument() and
+    argIndex = operand.splitAt("=", 0) and
+    stringValue = operand.splitAt("=", 1) and
+    invoke
+        .getArgument(AccessPath::parseIntWithArity(argIndex, invoke.getNumArgument()))
+        .getStringValue() = stringValue
+  )
 }
 
 /**
@@ -225,8 +239,9 @@ bindingset[name]
 predicate isExtraValidTokenNameInIdentifyingAccessPath(string name) {
   name =
     [
-      "Member", "Instance", "Awaited", "ArrayElement", "Element", "MapValue", "NewCall", "Call",
-      "DecoratedClass", "DecoratedMember", "DecoratedParameter"
+      "Member", "AnyMember", "Instance", "Awaited", "ArrayElement", "Element", "MapValue",
+      "NewCall", "Call", "DecoratedClass", "DecoratedMember", "DecoratedParameter",
+      "WithStringArgument"
     ]
 }
 
@@ -237,7 +252,7 @@ predicate isExtraValidTokenNameInIdentifyingAccessPath(string name) {
 predicate isExtraValidNoArgumentTokenInIdentifyingAccessPath(string name) {
   name =
     [
-      "Instance", "Awaited", "ArrayElement", "Element", "MapValue", "NewCall", "Call",
+      "AnyMember", "Instance", "Awaited", "ArrayElement", "Element", "MapValue", "NewCall", "Call",
       "DecoratedClass", "DecoratedMember", "DecoratedParameter"
     ]
 }
@@ -250,4 +265,8 @@ bindingset[name, argument]
 predicate isExtraValidTokenArgumentInIdentifyingAccessPath(string name, string argument) {
   name = ["Member"] and
   exists(argument)
+  or
+  name = "WithStringArgument" and
+  exists(argument.indexOf("=")) and
+  exists(AccessPath::parseIntWithArity(argument.splitAt("=", 0), 10))
 }
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/jQuery.qll b/javascript/ql/lib/semmle/javascript/frameworks/jQuery.qll
index 0f2b36216c9..d40a356f3bc 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/jQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/jQuery.qll
@@ -281,7 +281,7 @@ private module JQueryClientRequest {
               .getParameter(0)
         or
         result =
-          getAResponseNodeFromAnXHRObject(this.getOptionArgument([0 .. 1],
+          getAResponseNodeFromAnXhrObject(this.getOptionArgument([0 .. 1],
               any(string method | method = "error" or method = "complete"))
                 .getALocalSource()
                 .(DataFlow::FunctionNode)
@@ -303,15 +303,15 @@ private module JQueryClientRequest {
           .getParameter(0)
     or
     result =
-      getAResponseNodeFromAnXHRObject(request.getAMemberCall("fail").getCallback(0).getParameter(0))
+      getAResponseNodeFromAnXhrObject(request.getAMemberCall("fail").getCallback(0).getParameter(0))
   }
 
   /**
    * Gets a node referring to the response contained in an `jqXHR` object.
    */
-  private DataFlow::SourceNode getAResponseNodeFromAnXHRObject(DataFlow::SourceNode jqXHR) {
+  private DataFlow::SourceNode getAResponseNodeFromAnXhrObject(DataFlow::SourceNode jqXhr) {
     result =
-      jqXHR
+      jqXhr
           .getAPropertyRead(any(string s |
               s = "responseText" or
               s = "responseXML"
diff --git a/javascript/ql/lib/semmle/javascript/heuristics/AdditionalRouteHandlers.qll b/javascript/ql/lib/semmle/javascript/heuristics/AdditionalRouteHandlers.qll
index 3b9c3b1bb79..76a8aff557b 100644
--- a/javascript/ql/lib/semmle/javascript/heuristics/AdditionalRouteHandlers.qll
+++ b/javascript/ql/lib/semmle/javascript/heuristics/AdditionalRouteHandlers.qll
@@ -11,14 +11,14 @@ private import semmle.javascript.frameworks.ConnectExpressShared
  * Add `NodeJSLib::RouteHandlerCandidate` to the extent of `NodeJSLib::RouteHandler`.
  */
 private class PromotedNodeJSLibCandidate extends NodeJSLib::RouteHandler,
-  HTTP::Servers::StandardRouteHandler {
+  Http::Servers::StandardRouteHandler {
   PromotedNodeJSLibCandidate() { this instanceof NodeJSLib::RouteHandlerCandidate }
 }
 
 /**
  * Add `Hapi::RouteHandlerCandidate` to the extent of `Hapi::RouteHandler`.
  */
-private class PromotedHapiCandidate extends Hapi::RouteHandler, HTTP::Servers::StandardRouteHandler {
+private class PromotedHapiCandidate extends Hapi::RouteHandler, Http::Servers::StandardRouteHandler {
   PromotedHapiCandidate() { this instanceof Hapi::RouteHandlerCandidate }
 }
 
@@ -26,11 +26,11 @@ private class PromotedHapiCandidate extends Hapi::RouteHandler, HTTP::Servers::S
  * Add `ConnectExpressShared::RouteHandlerCandidate` to the extent of `Express::RouteHandler`.
  */
 private class PromotedExpressCandidate extends Express::RouteHandler,
-  HTTP::Servers::StandardRouteHandler {
+  Http::Servers::StandardRouteHandler {
   PromotedExpressCandidate() { this instanceof ConnectExpressShared::RouteHandlerCandidate }
 
-  override Parameter getRouteHandlerParameter(string kind) {
-    result = ConnectExpressShared::getRouteHandlerParameter(getAstNode(), kind)
+  override DataFlow::ParameterNode getRouteHandlerParameter(string kind) {
+    result = ConnectExpressShared::getRouteHandlerParameter(this, kind)
   }
 }
 
@@ -38,10 +38,10 @@ private class PromotedExpressCandidate extends Express::RouteHandler,
  * Add `ConnectExpressShared::RouteHandlerCandidate` to the extent of `Connect::RouteHandler`.
  */
 private class PromotedConnectCandidate extends Connect::RouteHandler,
-  HTTP::Servers::StandardRouteHandler {
+  Http::Servers::StandardRouteHandler {
   PromotedConnectCandidate() { this instanceof ConnectExpressShared::RouteHandlerCandidate }
 
-  override Parameter getRouteHandlerParameter(string kind) {
-    result = ConnectExpressShared::getRouteHandlerParameter(getAstNode(), kind)
+  override DataFlow::ParameterNode getRouteHandlerParameter(string kind) {
+    result = ConnectExpressShared::getRouteHandlerParameter(this, kind)
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/internal/ConceptsShared.qll b/javascript/ql/lib/semmle/javascript/internal/ConceptsShared.qll
index 027e587d9d3..2f6c8bb8b29 100644
--- a/javascript/ql/lib/semmle/javascript/internal/ConceptsShared.qll
+++ b/javascript/ql/lib/semmle/javascript/internal/ConceptsShared.qll
@@ -87,3 +87,70 @@ module Cryptography {
     predicate isWeak() { this = "ECB" }
   }
 }
+
+/** Provides classes for modeling HTTP-related APIs. */
+module Http {
+  /** Provides classes for modeling HTTP clients. */
+  module Client {
+    /**
+     * A data-flow node that makes an outgoing HTTP request.
+     *
+     * Extend this class to refine existing API models. If you want to model new APIs,
+     * extend `Http::Client::Request::Range` instead.
+     */
+    class Request extends DataFlow::Node instanceof Request::Range {
+      /**
+       * Gets a data-flow node that contributes to the URL of the request.
+       * Depending on the framework, a request may have multiple nodes which contribute to the URL.
+       */
+      DataFlow::Node getAUrlPart() { result = super.getAUrlPart() }
+
+      /** Gets a string that identifies the framework used for this request. */
+      string getFramework() { result = super.getFramework() }
+
+      /**
+       * Holds if this request is made using a mode that disables SSL/TLS
+       * certificate validation, where `disablingNode` represents the point at
+       * which the validation was disabled, and `argumentOrigin` represents the origin
+       * of the argument that disabled the validation (which could be the same node as
+       * `disablingNode`).
+       */
+      predicate disablesCertificateValidation(
+        DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+      ) {
+        super.disablesCertificateValidation(disablingNode, argumentOrigin)
+      }
+    }
+
+    /** Provides a class for modeling new HTTP requests. */
+    module Request {
+      /**
+       * A data-flow node that makes an outgoing HTTP request.
+       *
+       * Extend this class to model new APIs. If you want to refine existing API models,
+       * extend `Http::Client::Request` instead.
+       */
+      abstract class Range extends DataFlow::Node {
+        /**
+         * Gets a data-flow node that contributes to the URL of the request.
+         * Depending on the framework, a request may have multiple nodes which contribute to the URL.
+         */
+        abstract DataFlow::Node getAUrlPart();
+
+        /** Gets a string that identifies the framework used for this request. */
+        abstract string getFramework();
+
+        /**
+         * Holds if this request is made using a mode that disables SSL/TLS
+         * certificate validation, where `disablingNode` represents the point at
+         * which the validation was disabled, and `argumentOrigin` represents the origin
+         * of the argument that disabled the validation (which could be the same node as
+         * `disablingNode`).
+         */
+        abstract predicate disablesCertificateValidation(
+          DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+        );
+      }
+    }
+  }
+}
diff --git a/javascript/ql/lib/semmle/javascript/linters/ESLint.qll b/javascript/ql/lib/semmle/javascript/linters/ESLint.qll
index 32b9f217a27..76164f25f18 100644
--- a/javascript/ql/lib/semmle/javascript/linters/ESLint.qll
+++ b/javascript/ql/lib/semmle/javascript/linters/ESLint.qll
@@ -60,7 +60,7 @@ module ESLint {
   }
 
   /** An `.eslintrc.yaml` file. */
-  private class EslintrcYaml extends Configuration, YAMLDocument, YAMLMapping {
+  private class EslintrcYaml extends Configuration, YamlDocument, YamlMapping {
     EslintrcYaml() {
       exists(string n | n = getFile().getBaseName() |
         n = ".eslintrc.yaml" or n = ".eslintrc.yml" or n = ".eslintrc"
@@ -71,11 +71,11 @@ module ESLint {
   }
 
   /** An ESLint configuration object in YAML format. */
-  private class YamlConfigurationObject extends ConfigurationObject, YAMLMapping {
+  private class YamlConfigurationObject extends ConfigurationObject, YamlMapping {
     override Configuration getConfiguration() { this = result.(EslintrcYaml).getValue(_) }
 
     override boolean getBooleanProperty(string p) {
-      exists(string v | v = lookup(p).(YAMLBool).getValue() |
+      exists(string v | v = lookup(p).(YamlBool).getValue() |
         v = "true" and result = true
         or
         v = "false" and result = false
diff --git a/javascript/ql/lib/semmle/javascript/security/OverlyLargeRangeQuery.qll b/javascript/ql/lib/semmle/javascript/security/OverlyLargeRangeQuery.qll
index f83a6411618..65e662f0bc5 100644
--- a/javascript/ql/lib/semmle/javascript/security/OverlyLargeRangeQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/OverlyLargeRangeQuery.qll
@@ -96,7 +96,10 @@ class OverlyWideRange extends RegExpCharacterRange {
       toCodePoint("A") <= high
       or
       // a non-alphanumeric char as part of the range boundaries
-      exists(int bound | bound = [low, high] | not isAlphanumeric(bound.toUnicode()))
+      exists(int bound | bound = [low, high] | not isAlphanumeric(bound.toUnicode())) and
+      // while still being ascii
+      low < 128 and
+      high < 128
     ) and
     // allowlist for known ranges
     not this = allowedWideRanges()
@@ -173,7 +176,7 @@ module RangePrinter {
   }
 
   /** Gets the number of parts we should print for a given `range`. */
-  private int parts(OverlyWideRange range) { result = 1 + strictcount(cutoff(range, _)) }
+  private int parts(OverlyWideRange range) { result = 1 + count(cutoff(range, _)) }
 
   /** Holds if the given part of a range should span from `low` to `high`. */
   private predicate part(OverlyWideRange range, int part, string low, string high) {
diff --git a/javascript/ql/lib/semmle/javascript/security/PasswordInConfigurationFileQuery.qll b/javascript/ql/lib/semmle/javascript/security/PasswordInConfigurationFileQuery.qll
index e31b482c25f..183fca296c7 100644
--- a/javascript/ql/lib/semmle/javascript/security/PasswordInConfigurationFileQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/PasswordInConfigurationFileQuery.qll
@@ -21,11 +21,11 @@ predicate config(string key, string val, Locatable valElement) {
       val = valElement.(JsonString).getValue()
     )
     or
-    exists(YAMLMapping m, YAMLString keyElement |
+    exists(YamlMapping m, YamlString keyElement |
       m.maps(keyElement, valElement) and
       key = keyElement.getValue() and
       (
-        val = valElement.(YAMLString).getValue()
+        val = valElement.(YamlString).getValue()
         or
         valElement.toString() = "" and
         val = ""
diff --git a/javascript/ql/lib/semmle/javascript/security/SensitiveActions.qll b/javascript/ql/lib/semmle/javascript/security/SensitiveActions.qll
index dfa1ef10a80..aad1e3fddd6 100644
--- a/javascript/ql/lib/semmle/javascript/security/SensitiveActions.qll
+++ b/javascript/ql/lib/semmle/javascript/security/SensitiveActions.qll
@@ -13,9 +13,25 @@ import javascript
 import semmle.javascript.security.internal.SensitiveDataHeuristics
 private import HeuristicNames
 
+/**
+ * DEPRECATED: Use `SensitiveNode` instead.
+ * An expression that might contain sensitive data.
+ */
+deprecated class SensitiveExpr extends Expr {
+  SensitiveNode node;
+
+  SensitiveExpr() { node.asExpr() = this }
+
+  /** Gets a human-readable description of this expression for use in alert messages. */
+  deprecated string describe() { result = node.describe() }
+
+  /** Gets a classification of the kind of sensitive data this expression might contain. */
+  deprecated SensitiveDataClassification getClassification() { result = node.getClassification() }
+}
+
 /** An expression that might contain sensitive data. */
 cached
-abstract class SensitiveExpr extends Expr {
+abstract class SensitiveNode extends DataFlow::Node {
   /** Gets a human-readable description of this expression for use in alert messages. */
   cached
   abstract string describe();
@@ -26,33 +42,33 @@ abstract class SensitiveExpr extends Expr {
 }
 
 /** A function call that might produce sensitive data. */
-class SensitiveCall extends SensitiveExpr, InvokeExpr {
+class SensitiveCall extends SensitiveNode instanceof DataFlow::InvokeNode {
   SensitiveDataClassification classification;
 
   SensitiveCall() {
-    classification = this.getCalleeName().(SensitiveDataFunctionName).getClassification()
+    classification = super.getCalleeName().(SensitiveDataFunctionName).getClassification()
     or
     // This is particularly to pick up methods with an argument like "password", which
     // may indicate a lookup.
-    exists(string s | this.getAnArgument().mayHaveStringValue(s) |
+    exists(string s | super.getAnArgument().mayHaveStringValue(s) |
       nameIndicatesSensitiveData(s, classification)
     )
   }
 
-  override string describe() { result = "a call to " + this.getCalleeName() }
+  override string describe() { result = "a call to " + super.getCalleeName() }
 
   override SensitiveDataClassification getClassification() { result = classification }
 }
 
 /** An access to a variable or property that might contain sensitive data. */
-abstract class SensitiveVariableAccess extends SensitiveExpr {
+abstract class SensitiveVariableAccess extends SensitiveNode {
   string name;
 
   SensitiveVariableAccess() {
-    this.(VarAccess).getName() = name
+    this.asExpr().(VarAccess).getName() = name
     or
     exists(DataFlow::PropRead pr |
-      this = pr.asExpr() and
+      this = pr and
       pr.getPropertyName() = name
     )
   }
@@ -80,7 +96,7 @@ private predicate writesProperty(DataFlow::Node node, string name) {
   exists(VarDef v | v.getAVariable().getName() = name |
     if exists(v.getSource())
     then v.getSource() = node.asExpr()
-    else node = DataFlow::ssaDefinitionNode(SSA::definition(v))
+    else node = DataFlow::ssaDefinitionNode(Ssa::definition(v))
   )
 }
 
@@ -173,10 +189,8 @@ class ProtectCall extends DataFlow::CallNode {
 }
 
 /** An expression that might contain a clear-text password. */
-class CleartextPasswordExpr extends SensitiveExpr {
-  CleartextPasswordExpr() {
-    this.(SensitiveExpr).getClassification() = SensitiveDataClassification::password()
-  }
+class CleartextPasswordExpr extends SensitiveNode {
+  CleartextPasswordExpr() { this.getClassification() = SensitiveDataClassification::password() }
 
   override string describe() { none() }
 
diff --git a/javascript/ql/lib/semmle/javascript/security/TaintedObject.qll b/javascript/ql/lib/semmle/javascript/security/TaintedObject.qll
index 6c5c0f21057..eac7dd4e762 100644
--- a/javascript/ql/lib/semmle/javascript/security/TaintedObject.qll
+++ b/javascript/ql/lib/semmle/javascript/security/TaintedObject.qll
@@ -75,7 +75,7 @@ module TaintedObject {
 
   /** Request input accesses as a JSON source. */
   private class RequestInputAsSource extends Source {
-    RequestInputAsSource() { this.(HTTP::RequestInputAccess).isUserControlledObject() }
+    RequestInputAsSource() { this.(Http::RequestInputAccess).isUserControlledObject() }
   }
 
   /**
diff --git a/javascript/ql/lib/semmle/javascript/security/UselessUseOfCat.qll b/javascript/ql/lib/semmle/javascript/security/UselessUseOfCat.qll
index c2244de9d7e..5428e14abee 100644
--- a/javascript/ql/lib/semmle/javascript/security/UselessUseOfCat.qll
+++ b/javascript/ql/lib/semmle/javascript/security/UselessUseOfCat.qll
@@ -127,7 +127,7 @@ class UselessCat extends CommandCall {
         or
         // `exec` can use 3 parameters, `readFile` can only use two, so it is OK to have a third parameter if it is unused,
         func.getNumParameter() = 3 and
-        not exists(SSA::definition(func.getParameter(2).getParameter()))
+        not exists(Ssa::definition(func.getParameter(2).getParameter()))
       )
     ) and
     // The process returned by an async call is unused.
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/BrokenCryptoAlgorithmCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/BrokenCryptoAlgorithmCustomizations.qll
index 58858d79886..832f811f67b 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/BrokenCryptoAlgorithmCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/BrokenCryptoAlgorithmCustomizations.qll
@@ -30,10 +30,8 @@ module BrokenCryptoAlgorithm {
    * A sensitive expression, viewed as a data flow source for sensitive information
    * in broken or weak cryptographic algorithms.
    */
-  class SensitiveExprSource extends Source, DataFlow::ValueNode {
-    override SensitiveExpr astNode;
-
-    override string describe() { result = astNode.describe() }
+  class SensitiveExprSource extends Source instanceof SensitiveNode {
+    override string describe() { result = SensitiveNode.super.describe() }
   }
 
   /**
@@ -43,7 +41,7 @@ module BrokenCryptoAlgorithm {
     WeakCryptographicOperationSink() {
       exists(CryptographicOperation application |
         application.getAlgorithm().isWeak() and
-        this.asExpr() = application.getInput()
+        this = application.getInput()
       )
     }
   }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/CleartextStorageCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/CleartextStorageCustomizations.qll
index e719d02d100..d158e4b0cac 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/CleartextStorageCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/CleartextStorageCustomizations.qll
@@ -30,15 +30,13 @@ module CleartextStorage {
    * A sensitive expression, viewed as a data flow source for cleartext storage
    * of sensitive information.
    */
-  class SensitiveExprSource extends Source, DataFlow::ValueNode {
-    override SensitiveExpr astNode;
-
+  class SensitiveExprSource extends Source instanceof SensitiveNode {
     SensitiveExprSource() {
       // storing user names or account names in plaintext isn't usually a problem
-      astNode.getClassification() != SensitiveDataClassification::id()
+      super.getClassification() != SensitiveDataClassification::id()
     }
 
-    override string describe() { result = astNode.describe() }
+    override string describe() { result = SensitiveNode.super.describe() }
   }
 
   /** A call to any function whose name suggests that it encodes or encrypts its arguments. */
@@ -51,9 +49,9 @@ module CleartextStorage {
    */
   class CookieStorageSink extends Sink {
     CookieStorageSink() {
-      exists(HTTP::CookieDefinition cookieDef |
-        this.asExpr() = cookieDef.getValueArgument() or
-        this.asExpr() = cookieDef.getHeaderArgument()
+      exists(Http::CookieDefinition cookieDef |
+        this = cookieDef.getValueArgument() or
+        this = cookieDef.getHeaderArgument()
       )
     }
   }
@@ -61,16 +59,12 @@ module CleartextStorage {
   /**
    * An expression set as a value of localStorage or sessionStorage.
    */
-  class WebStorageSink extends Sink {
-    WebStorageSink() { this.asExpr() instanceof WebStorageWrite }
-  }
+  class WebStorageSink extends Sink instanceof WebStorageWrite { }
 
   /**
    * An expression stored by AngularJS.
    */
   class AngularJSStorageSink extends Sink {
-    AngularJSStorageSink() {
-      any(AngularJS::AngularJSCall call).storesArgumentGlobally(this.asExpr())
-    }
+    AngularJSStorageSink() { any(AngularJS::AngularJSCallNode call).storesArgumentGlobally(this) }
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll
index 6549f40ebdd..4c6ad8b0ee9 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll
@@ -57,23 +57,23 @@ module ClientSideUrlRedirect {
    * when `base` is the current URL.
    */
   predicate untrustedUrlSubstring(DataFlow::Node base, DataFlow::Node substring) {
-    exists(MethodCallExpr mce, string methodName |
-      mce = substring.asExpr() and mce.calls(base.asExpr(), methodName)
+    exists(DataFlow::MethodCallNode mcn, string methodName |
+      mcn = substring and mcn.calls(base, methodName)
     |
       methodName = "split" and
       // exclude all splits where only the prefix is accessed, which is safe for url-redirects.
-      not exists(PropAccess pacc | mce = pacc.getBase() | pacc.getPropertyName() = "0")
+      not exists(DataFlow::PropRead pacc | mcn = pacc.getBase() | pacc.getPropertyName() = "0")
       or
       methodName = StringOps::substringMethodName() and
       // exclude `location.href.substring(0, ...)` and similar, which can
       // never refer to the query string
-      not mce.getArgument(0).(NumberLiteral).getIntValue() = 0
+      not mcn.getArgument(0).getIntValue() = 0
     )
     or
-    exists(MethodCallExpr mce |
-      substring.asExpr() = mce and
-      mce = any(DataFlow::RegExpCreationNode re).getAMethodCall("exec").asExpr() and
-      base.asExpr() = mce.getArgument(0)
+    exists(DataFlow::MethodCallNode mcn |
+      substring = mcn and
+      mcn = any(DataFlow::RegExpCreationNode re).getAMethodCall("exec") and
+      base = mcn.getArgument(0)
     )
   }
 
@@ -104,7 +104,9 @@ module ClientSideUrlRedirect {
       xss = true
       or
       // An assignment to `location`
-      exists(Assignment assgn | isLocation(assgn.getTarget()) and astNode = assgn.getRhs()) and
+      exists(Assignment assgn |
+        isLocationNode(assgn.getTarget().flow()) and astNode = assgn.getRhs()
+      ) and
       xss = true
       or
       // An assignment to `location.href`, `location.protocol` or `location.hostname`
@@ -119,7 +121,7 @@ module ClientSideUrlRedirect {
       // A redirection using the AngularJS `$location` service
       exists(AngularJS::ServiceReference service |
         service.getName() = "$location" and
-        this.asExpr() = service.getAMethodCall("url").getArgument(0)
+        this = service.getAMethodCall("url").getArgument(0)
       ) and
       xss = false
     }
@@ -177,7 +179,7 @@ module ClientSideUrlRedirect {
       )
       or
       // e.g. node.setAttribute("href", sink)
-      any(DomMethodCallExpr call).interpretsArgumentsAsUrl(this.asExpr())
+      any(DomMethodCallNode call).interpretsArgumentsAsUrl(this)
     }
 
     override predicate isXssSink() { any() }
@@ -189,9 +191,9 @@ module ClientSideUrlRedirect {
    */
   class AttributeWriteUrlSink extends ScriptUrlSink, DataFlow::ValueNode {
     AttributeWriteUrlSink() {
-      exists(DomPropWriteNode pw |
+      exists(DomPropertyWrite pw |
         pw.interpretsValueAsJavaScriptUrl() and
-        this = DataFlow::valueNode(pw.getRhs())
+        this = pw.getRhs()
       )
     }
 
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll
index 9e72cc9ee82..ee358c1b4c8 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll
@@ -19,7 +19,7 @@ module CodeInjection {
     /**
      * Gets the substitute for `X` in the message `User-provided value flows to X`.
      */
-    string getMessageSuffix() { result = "here and is interpreted as code" }
+    string getMessageSuffix() { result = "this location and is interpreted as code" }
   }
 
   /**
@@ -37,7 +37,7 @@ module CodeInjection {
    */
   class AngularJSExpressionSink extends Sink, DataFlow::ValueNode {
     AngularJSExpressionSink() {
-      any(AngularJS::AngularJSCall call).interpretsArgumentAsCode(this.asExpr())
+      any(AngularJS::AngularJSCallNode call).interpretsArgumentAsCode(this)
     }
   }
 
@@ -126,7 +126,8 @@ module CodeInjection {
     }
 
     override string getMessageSuffix() {
-      result = "here and is interpreted by " + templateType + ", which may evaluate it as code"
+      result =
+        "this location and is interpreted by " + templateType + ", which may evaluate it as code"
     }
   }
 
@@ -170,7 +171,7 @@ module CodeInjection {
         exists(string callName | c = DataFlow::globalVarRef(callName).getAnInvocation() |
           callName = "eval" and index = 0
           or
-          callName = "Function"
+          callName = "Function" and index = -1
           or
           callName = "execScript" and index = 0
           or
@@ -185,14 +186,13 @@ module CodeInjection {
           callName = "setImmediate" and index = 0
         )
         or
-        exists(DataFlow::GlobalVarRefNode wasm, string methodName |
-          wasm.getName() = "WebAssembly" and c = wasm.getAMemberCall(methodName)
-        |
-          methodName = "compile" or
-          methodName = "compileStreaming"
-        )
+        c = DataFlow::globalVarRef("WebAssembly").getAMemberCall(["compile", "compileStreaming"]) and
+        index = -1
       |
         this = c.getArgument(index)
+        or
+        index = -1 and
+        this = c.getAnArgument()
       )
       or
       // node-serialize is not intended to be safe for untrusted inputs
@@ -289,7 +289,7 @@ module CodeInjection {
   /** A sink for code injection via template injection. */
   abstract private class TemplateSink extends Sink {
     override string getMessageSuffix() {
-      result = "here and is interpreted as a template, which may contain code"
+      result = "this location and is interpreted as a template, which may contain code"
     }
   }
 
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/CorsMisconfigurationForCredentialsCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/CorsMisconfigurationForCredentialsCustomizations.qll
index 867494fc0a3..79868ea9989 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/CorsMisconfigurationForCredentialsCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/CorsMisconfigurationForCredentialsCustomizations.qll
@@ -19,7 +19,7 @@ module CorsMisconfigurationForCredentials {
     /**
      * Gets the "Access-Control-Allow-Credentials" header definition.
      */
-    abstract HTTP::HeaderDefinition getCredentialsHeader();
+    abstract Http::HeaderDefinition getCredentialsHeader();
   }
 
   /**
@@ -41,24 +41,24 @@ module CorsMisconfigurationForCredentials {
    * HTTP header with a truthy value.
    */
   class CorsOriginHeaderWithAssociatedCredentialHeader extends Sink, DataFlow::ValueNode {
-    HTTP::ExplicitHeaderDefinition credentials;
+    Http::ExplicitHeaderDefinition credentials;
 
     CorsOriginHeaderWithAssociatedCredentialHeader() {
       exists(
-        HTTP::RouteHandler routeHandler, HTTP::ExplicitHeaderDefinition origin,
-        Expr credentialsValue
+        Http::RouteHandler routeHandler, Http::ExplicitHeaderDefinition origin,
+        DataFlow::Node credentialsValue
       |
         routeHandler.getAResponseHeader(_) = origin and
         routeHandler.getAResponseHeader(_) = credentials and
-        origin.definesExplicitly("access-control-allow-origin", this.asExpr()) and
-        credentials.definesExplicitly("access-control-allow-credentials", credentialsValue)
+        origin.definesHeaderValue("access-control-allow-origin", this) and
+        credentials.definesHeaderValue("access-control-allow-credentials", credentialsValue)
       |
         credentialsValue.mayHaveBooleanValue(true) or
         credentialsValue.mayHaveStringValue("true")
       )
     }
 
-    override HTTP::HeaderDefinition getCredentialsHeader() { result = credentials }
+    override Http::HeaderDefinition getCredentialsHeader() { result = credentials }
   }
 
   /**
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/DOM.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/DOM.qll
index 3b370bb6938..21fb6f785af 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/DOM.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/DOM.qll
@@ -21,14 +21,28 @@ class DomGlobalVariable extends GlobalVariable {
 /** DEPRECATED: Alias for DomGlobalVariable */
 deprecated class DOMGlobalVariable = DomGlobalVariable;
 
-/** Holds if `e` could hold a value that comes from the DOM. */
-predicate isDomValue(Expr e) { DOM::domValueRef().flowsToExpr(e) }
+/**
+ * DEPRECATED: Use `isDomNode` instead.
+ * Holds if `e` could hold a value that comes from the DOM.
+ */
+deprecated predicate isDomValue(Expr e) { isDomNode(e.flow()) }
+
+/**
+ * Holds if `e` could hold a value that comes from the DOM.
+ */
+predicate isDomNode(DataFlow::Node e) { DOM::domValueRef().flowsTo(e) }
+
+/**
+ * DEPRECATED: Use `isLocationNode` instead.
+ * Holds if `e` could refer to the `location` property of a DOM node.
+ */
+deprecated predicate isLocation(Expr e) { isLocationNode(e.flow()) }
 
 /** Holds if `e` could refer to the `location` property of a DOM node. */
-predicate isLocation(Expr e) {
-  e = DOM::domValueRef().getAPropertyReference("location").asExpr()
+predicate isLocationNode(DataFlow::Node e) {
+  e = DOM::domValueRef().getAPropertyReference("location")
   or
-  e.accessesGlobal("location")
+  e = DataFlow::globalVarRef("location")
 }
 
 /**
@@ -53,15 +67,52 @@ deprecated predicate isDocumentUrl(Expr e) { e.flow() = DOM::locationSource() }
 deprecated predicate isDocumentURL = isDocumentUrl/1;
 
 /**
+ * DEPRECATED. In most cases, a sanitizer based on this predicate can be removed, as
+ * taint tracking no longer step through the properties of the location object by default.
+ *
+ * Holds if `pacc` accesses a part of `document.location` that is
+ * not considered user-controlled, that is, anything except
+ * `href`, `hash` and `search`.
+ */
+deprecated predicate isSafeLocationProperty(PropAccess pacc) {
+  exists(string prop | pacc = DOM::locationRef().getAPropertyRead(prop).asExpr() |
+    prop != "href" and prop != "hash" and prop != "search"
+  )
+}
+
+/**
+ * DEPRECATED: Use `DomMethodCallNode` instead.
  * A call to a DOM method.
  */
-class DomMethodCallExpr extends MethodCallExpr {
-  DomMethodCallExpr() { isDomValue(this.getReceiver()) }
+deprecated class DomMethodCallExpr extends MethodCallExpr {
+  DomMethodCallNode node;
+
+  DomMethodCallExpr() { this.flow() = node }
+
+  /** Holds if `arg` is an argument that is interpreted as HTML. */
+  deprecated predicate interpretsArgumentsAsHtml(Expr arg) {
+    node.interpretsArgumentsAsHtml(arg.flow())
+  }
+
+  /** Holds if `arg` is an argument that is used as an URL. */
+  deprecated predicate interpretsArgumentsAsURL(Expr arg) {
+    node.interpretsArgumentsAsURL(arg.flow())
+  }
+
+  /** DEPRECATED: Alias for interpretsArgumentsAsHtml */
+  deprecated predicate interpretsArgumentsAsHTML(Expr arg) { this.interpretsArgumentsAsHtml(arg) }
+}
+
+/**
+ * A call to a DOM method.
+ */
+class DomMethodCallNode extends DataFlow::MethodCallNode {
+  DomMethodCallNode() { isDomNode(this.getReceiver()) }
 
   /**
    * Holds if `arg` is an argument that is interpreted as HTML.
    */
-  predicate interpretsArgumentsAsHtml(Expr arg) {
+  predicate interpretsArgumentsAsHtml(DataFlow::Node arg) {
     exists(int argPos, string name |
       arg = this.getArgument(argPos) and
       name = this.getMethodName()
@@ -86,7 +137,7 @@ class DomMethodCallExpr extends MethodCallExpr {
   /**
    * Holds if `arg` is an argument that is used as an URL.
    */
-  predicate interpretsArgumentsAsUrl(Expr arg) {
+  predicate interpretsArgumentsAsUrl(DataFlow::Node arg) {
     exists(int argPos, string name |
       arg = this.getArgument(argPos) and
       name = this.getMethodName()
@@ -104,56 +155,84 @@ class DomMethodCallExpr extends MethodCallExpr {
   }
 
   /** DEPRECATED: Alias for interpretsArgumentsAsUrl */
-  deprecated predicate interpretsArgumentsAsURL(Expr arg) { this.interpretsArgumentsAsUrl(arg) }
+  deprecated predicate interpretsArgumentsAsURL(DataFlow::Node arg) {
+    this.interpretsArgumentsAsUrl(arg)
+  }
 
   /** DEPRECATED: Alias for interpretsArgumentsAsHtml */
-  deprecated predicate interpretsArgumentsAsHTML(Expr arg) { this.interpretsArgumentsAsHtml(arg) }
+  deprecated predicate interpretsArgumentsAsHTML(DataFlow::Node arg) {
+    this.interpretsArgumentsAsHtml(arg)
+  }
 }
 
 /**
+ * DEPRECATED: Use `DomPropertyWrite` instead.
  * An assignment to a property of a DOM object.
  */
-class DomPropWriteNode extends Assignment {
-  PropAccess lhs;
+deprecated class DomPropWriteNode extends Assignment {
+  DomPropertyWrite node;
 
-  DomPropWriteNode() {
-    lhs = this.getLhs() and
-    isDomValue(lhs.getBase())
-  }
+  DomPropWriteNode() { this.flow() = node }
 
   /**
    * Holds if the assigned value is interpreted as HTML.
    */
-  predicate interpretsValueAsHtml() {
-    lhs.getPropertyName() = "innerHTML" or
-    lhs.getPropertyName() = "outerHTML"
-  }
+  predicate interpretsValueAsHtml() { node.interpretsValueAsHtml() }
 
   /** DEPRECATED: Alias for interpretsValueAsHtml */
   deprecated predicate interpretsValueAsHTML() { this.interpretsValueAsHtml() }
 
+  /**
+   * Holds if the assigned value is interpreted as JavaScript via javascript: protocol.
+   */
+  predicate interpretsValueAsJavaScriptUrl() { node.interpretsValueAsJavaScriptUrl() }
+}
+
+/**
+ * An assignment to a property of a DOM object.
+ */
+class DomPropertyWrite extends DataFlow::Node instanceof DataFlow::PropWrite {
+  DomPropertyWrite() { isDomNode(super.getBase()) }
+
+  /**
+   * Holds if the assigned value is interpreted as HTML.
+   */
+  predicate interpretsValueAsHtml() {
+    super.getPropertyName() = "innerHTML" or
+    super.getPropertyName() = "outerHTML"
+  }
+
   /**
    * Holds if the assigned value is interpreted as JavaScript via javascript: protocol.
    */
   predicate interpretsValueAsJavaScriptUrl() {
-    lhs.getPropertyName() = DOM::getAPropertyNameInterpretedAsJavaScriptUrl()
+    super.getPropertyName() = DOM::getAPropertyNameInterpretedAsJavaScriptUrl()
+  }
+
+  /**
+   * Gets the data flow node corresponding to the value being written.
+   */
+  DataFlow::Node getRhs() {
+    result = super.getRhs()
+    or
+    result = super.getWriteNode().(AssignAddExpr).getRhs().flow()
   }
 }
 
 /**
  * A value written to web storage, like `localStorage` or `sessionStorage`.
  */
-class WebStorageWrite extends Expr {
+class WebStorageWrite extends DataFlow::Node {
   WebStorageWrite() {
     exists(DataFlow::SourceNode webStorage |
       webStorage = DataFlow::globalVarRef("localStorage") or
       webStorage = DataFlow::globalVarRef("sessionStorage")
     |
       // an assignment to `window.localStorage[someProp]`
-      this = webStorage.getAPropertyWrite().getRhs().asExpr()
+      this = webStorage.getAPropertyWrite().getRhs()
       or
       // an invocation of `window.localStorage.setItem`
-      this = webStorage.getAMethodCall("setItem").getArgument(1).asExpr()
+      this = webStorage.getAMethodCall("setItem").getArgument(1)
     )
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/DifferentKindsComparisonBypassCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/DifferentKindsComparisonBypassCustomizations.qll
index bfb30cc2c99..956fe352854 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/DifferentKindsComparisonBypassCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/DifferentKindsComparisonBypassCustomizations.qll
@@ -31,7 +31,7 @@ module DifferentKindsComparisonBypass {
    * A HTTP request input that is suspicious to compare with another HTTP request input of a different kind.
    */
   class RequestInputComparisonSource extends Source {
-    HTTP::RequestInputAccess input;
+    Http::RequestInputAccess input;
 
     RequestInputComparisonSource() { input = this }
 
@@ -42,7 +42,7 @@ module DifferentKindsComparisonBypass {
     /**
      * Gets the HTTP request input of this source.
      */
-    private HTTP::RequestInputAccess getInput() { result = input }
+    private Http::RequestInputAccess getInput() { result = input }
   }
 
   /**
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssCustomizations.qll
index b23f52d7c22..18230c92037 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssCustomizations.qll
@@ -31,7 +31,7 @@ module DomBasedXss {
       )
       or
       // call to an Angular method that interprets its argument as HTML
-      any(AngularJS::AngularJSCall call).interpretsArgumentAsHtml(this.asExpr())
+      any(AngularJS::AngularJSCallNode call).interpretsArgumentAsHtml(this)
       or
       // call to a WinJS function that interprets its argument as HTML
       exists(DataFlow::MethodCallNode mcn, string m |
@@ -130,12 +130,12 @@ module DomBasedXss {
   class DomSink extends Sink {
     DomSink() {
       // Call to a DOM function that inserts its argument into the DOM
-      any(DomMethodCallExpr call).interpretsArgumentsAsHtml(this.asExpr())
+      any(DomMethodCallNode call).interpretsArgumentsAsHtml(this)
       or
       // Assignment to a dangerous DOM property
-      exists(DomPropWriteNode pw |
+      exists(DomPropertyWrite pw |
         pw.interpretsValueAsHtml() and
-        this = DataFlow::valueNode(pw.getRhs())
+        this = pw.getRhs()
       )
       or
       // `html` or `source.html` properties of React Native `WebView`
@@ -159,7 +159,7 @@ module DomBasedXss {
       )
       or
       exists(DataFlow::MethodCallNode ccf |
-        isDomValue(ccf.getReceiver().asExpr()) and
+        isDomNode(ccf.getReceiver()) and
         ccf.getMethodName() = "createContextualFragment" and
         this = ccf.getArgument(0)
       )
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssQuery.qll
index 72c4020526b..e8c1a144920 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssQuery.qll
@@ -75,7 +75,7 @@ class Configuration extends TaintTracking::Configuration {
   }
 
   override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
-    guard instanceof PrefixStringSanitizer or
+    guard instanceof PrefixStringSanitizerActivated or
     guard instanceof QuoteGuard or
     guard instanceof ContainsHtmlGuard
   }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataCustomizations.qll
index fb663a755ed..785677488e4 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataCustomizations.qll
@@ -165,7 +165,7 @@ module ExternalApiUsedWithUntrustedData {
       not param = base.getReceiver()
     |
       result = param and
-      name = param.asSource().asExpr().(Parameter).getName()
+      name = param.asSource().(DataFlow::ParameterNode).getName()
       or
       param.asSource().asExpr() instanceof DestructuringPattern and
       result = param.getMember(name)
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedCredentialsCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedCredentialsCustomizations.qll
index 6ad3b1a8853..5e43e34aa8a 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedCredentialsCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedCredentialsCustomizations.qll
@@ -33,12 +33,10 @@ module HardcodedCredentials {
   }
 
   /**
-   * A subclass of `Sink` that includes every `CredentialsExpr`
+   * A subclass of `Sink` that includes every `CredentialsNode`
    * as a credentials sink.
    */
-  class DefaultCredentialsSink extends Sink, DataFlow::ValueNode {
-    override CredentialsExpr astNode;
-
-    override string getKind() { result = astNode.getCredentialsKind() }
+  class DefaultCredentialsSink extends Sink instanceof CredentialsNode {
+    override string getKind() { result = super.getCredentialsKind() }
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedDataInterpretedAsCodeCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedDataInterpretedAsCodeCustomizations.qll
index e07658d7830..2d12f60552e 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedDataInterpretedAsCodeCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/HardcodedDataInterpretedAsCodeCustomizations.qll
@@ -54,7 +54,7 @@ module HardcodedDataInterpretedAsCode {
 
     override DataFlow::FlowLabel getLabel() { result.isTaint() }
 
-    override string getKind() { result = "code" }
+    override string getKind() { result = "Code" }
   }
 
   /**
@@ -65,6 +65,6 @@ module HardcodedDataInterpretedAsCode {
 
     override DataFlow::FlowLabel getLabel() { result.isDataOrTaint() }
 
-    override string getKind() { result = "an import path" }
+    override string getKind() { result = "An import path" }
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/HostHeaderPoisoningInEmailGenerationQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/HostHeaderPoisoningInEmailGenerationQuery.qll
index 2a41b76dc80..f87938dfb71 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/HostHeaderPoisoningInEmailGenerationQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/HostHeaderPoisoningInEmailGenerationQuery.qll
@@ -12,7 +12,7 @@ class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "TaintedHostHeader" }
 
   override predicate isSource(DataFlow::Node node) {
-    exists(HTTP::RequestHeaderAccess input | node = input |
+    exists(Http::RequestHeaderAccess input | node = input |
       input.getKind() = "header" and
       input.getAHeaderName() = "host"
     )
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessSpecific.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessSpecific.qll
index a7b6cca1360..7ed38fdf3f2 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessSpecific.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessSpecific.qll
@@ -9,7 +9,7 @@ private import HttpToFileAccessCustomizations::HttpToFileAccess
  * An access to a user-controlled HTTP request input, considered as a flow source for writing user-controlled data to files
  */
 private class RequestInputAccessAsSource extends Source {
-  RequestInputAccessAsSource() { this instanceof HTTP::RequestInputAccess }
+  RequestInputAccessAsSource() { this instanceof Http::RequestInputAccess }
 }
 
 /** A response from a server, considered as a flow source for writing user-controlled data to files. */
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/InsecureRandomnessCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/InsecureRandomnessCustomizations.qll
index dfb270cfd9f..37c5998df5f 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/InsecureRandomnessCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/InsecureRandomnessCustomizations.qll
@@ -104,6 +104,12 @@ module InsecureRandomness {
       pred = mc.getAnArgument() and
       succ = mc
     )
+    or
+    // selecting a random element.
+    exists(DataFlow::PropRead read | read = succ |
+      read.getPropertyNameExpr() = pred.asExpr() and
+      not exists(read.getPropertyName())
+    )
   }
 
   /**
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/InsufficientPasswordHashCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/InsufficientPasswordHashCustomizations.qll
index 6ffcb7fa527..1697d55fe0b 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/InsufficientPasswordHashCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/InsufficientPasswordHashCustomizations.qll
@@ -30,14 +30,12 @@ module InsufficientPasswordHash {
    * A potential clear-text password, considered as a source for password hashing
    * with insufficient computational effort.
    */
-  class CleartextPasswordSource extends Source, DataFlow::ValueNode {
-    override SensitiveExpr astNode;
-
+  class CleartextPasswordSource extends Source instanceof SensitiveNode {
     CleartextPasswordSource() {
-      astNode.getClassification() = SensitiveDataClassification::password()
+      super.getClassification() = SensitiveDataClassification::password()
     }
 
-    override string describe() { result = astNode.describe() }
+    override string describe() { result = SensitiveNode.super.describe() }
   }
 
   /**
@@ -49,7 +47,7 @@ module InsufficientPasswordHash {
         application.getAlgorithm().isWeak() or
         not application.getAlgorithm() instanceof PasswordHashingAlgorithm
       |
-        this.asExpr() = application.getInput()
+        this = application.getInput()
       )
     }
   }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll
index b4acd922498..7d3958d83d8 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll
@@ -199,7 +199,7 @@ class RateLimiterFlexibleRateLimiter extends DataFlow::FunctionNode {
       rateLimiterClassName.matches("RateLimiter%") and
       rateLimiterClass = API::moduleImport("rate-limiter-flexible").getMember(rateLimiterClassName) and
       rateLimiterConsume = rateLimiterClass.getInstance().getMember("consume") and
-      request.getParameter() = getRouteHandlerParameter(this.getFunction(), "request") and
+      request = getRouteHandlerParameter(this, "request") and
       request.getAPropertyRead().flowsTo(rateLimiterConsume.getAParameter().asSink())
     )
   }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionCustomizations.qll
index 7d4c5939440..50dd7fc0053 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionCustomizations.qll
@@ -36,7 +36,5 @@ module NosqlInjection {
   }
 
   /** An expression interpreted as a NoSql query, viewed as a sink. */
-  class NosqlQuerySink extends Sink, DataFlow::ValueNode {
-    override NoSql::Query astNode;
-  }
+  class NosqlQuerySink extends Sink instanceof NoSql::Query { }
 }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionQuery.qll
index ada9c57ad64..be9b3bdee0a 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/NosqlInjectionQuery.qll
@@ -45,7 +45,7 @@ class Configuration extends TaintTracking::Configuration {
     inlbl = TaintedObject::label() and
     outlbl = TaintedObject::label() and
     exists(NoSql::Query query, DataFlow::SourceNode queryObj |
-      queryObj.flowsToExpr(query) and
+      queryObj.flowsTo(query) and
       queryObj.flowsTo(trg) and
       src = queryObj.getAPropertyWrite().getRhs()
     )
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/PostMessageStarCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/PostMessageStarCustomizations.qll
index 3f8b7c7f846..b35d564bcaf 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/PostMessageStarCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/PostMessageStarCustomizations.qll
@@ -41,9 +41,7 @@ module PostMessageStar {
    * A sensitive expression, viewed as a data flow source for cross-window communication
    * with unrestricted origin.
    */
-  class SensitiveExprSource extends Source, DataFlow::ValueNode {
-    override SensitiveExpr astNode;
-  }
+  class SensitiveExprSource extends Source instanceof SensitiveNode { }
 
   /** A call to any function whose name suggests that it encodes or encrypts its arguments. */
   class ProtectSanitizer extends Sanitizer {
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/PrototypePollutingAssignmentQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/PrototypePollutingAssignmentQuery.qll
index 23abee9db2d..536c5ebf971 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/PrototypePollutingAssignmentQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/PrototypePollutingAssignmentQuery.qll
@@ -124,7 +124,8 @@ class Configuration extends TaintTracking::Configuration {
     guard instanceof TypeofCheck or
     guard instanceof NumberGuard or
     guard instanceof EqualityCheck or
-    guard instanceof IncludesCheck
+    guard instanceof IncludesCheck or
+    guard instanceof DenyListInclusionGuard
   }
 }
 
@@ -275,3 +276,21 @@ private class IncludesCheck extends TaintTracking::LabeledSanitizerGuardNode, In
     outcome = this.getPolarity().booleanNot()
   }
 }
+
+/**
+ * A sanitizer guard that checks tests whether `x` is included in a list like `["__proto__"].includes(x)`.
+ */
+private class DenyListInclusionGuard extends TaintTracking::SanitizerGuardNode, InclusionTest {
+  DenyListInclusionGuard() {
+    this.getContainerNode()
+        .getALocalSource()
+        .(DataFlow::ArrayCreationNode)
+        .getAnElement()
+        .mayHaveStringValue("__proto__")
+  }
+
+  override predicate sanitizes(boolean outcome, Expr e) {
+    e = this.getContainedNode().asExpr() and
+    outcome = super.getPolarity().booleanNot()
+  }
+}
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/ReflectedXssCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/ReflectedXssCustomizations.qll
index 73188869256..2b8f9112dd2 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/ReflectedXssCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/ReflectedXssCustomizations.qll
@@ -24,17 +24,15 @@ module ReflectedXss {
    * a content type that does not (case-insensitively) contain the string "html". This
    * is to prevent us from flagging plain-text or JSON responses as vulnerable.
    */
-  class HttpResponseSink extends Sink, DataFlow::ValueNode {
-    override HTTP::ResponseSendArgument astNode;
-
-    HttpResponseSink() { not exists(getANonHtmlHeaderDefinition(astNode)) }
+  class HttpResponseSink extends Sink instanceof Http::ResponseSendArgument {
+    HttpResponseSink() { not exists(getANonHtmlHeaderDefinition(this)) }
   }
 
   /**
    * Gets a HeaderDefinition that defines a non-html content-type for `send`.
    */
-  HTTP::HeaderDefinition getANonHtmlHeaderDefinition(HTTP::ResponseSendArgument send) {
-    exists(HTTP::RouteHandler h |
+  Http::HeaderDefinition getANonHtmlHeaderDefinition(Http::ResponseSendArgument send) {
+    exists(Http::RouteHandler h |
       send.getRouteHandler() = h and
       result = nonHtmlContentTypeHeader(h)
     |
@@ -46,7 +44,7 @@ module ReflectedXss {
   /**
    * Holds if `h` may send a response with a content type other than HTML.
    */
-  HTTP::HeaderDefinition nonHtmlContentTypeHeader(HTTP::RouteHandler h) {
+  Http::HeaderDefinition nonHtmlContentTypeHeader(Http::RouteHandler h) {
     result = h.getAResponseHeader("content-type") and
     not exists(string tp | result.defines("content-type", tp) | tp.regexpMatch("(?i).*html.*"))
   }
@@ -54,7 +52,7 @@ module ReflectedXss {
   /**
    * Holds if a header set in `header` is likely to affect a response sent at `sender`.
    */
-  predicate headerAffects(HTTP::HeaderDefinition header, HTTP::ResponseSendArgument sender) {
+  predicate headerAffects(Http::HeaderDefinition header, Http::ResponseSendArgument sender) {
     sender.getRouteHandler() = header.getRouteHandler() and
     (
       // `sender` is affected by a dominating `header`.
@@ -62,7 +60,7 @@ module ReflectedXss {
       or
       // There is no dominating header, and `header` is non-local.
       not isLocalHeaderDefinition(header) and
-      not exists(HTTP::HeaderDefinition dominatingHeader |
+      not exists(Http::HeaderDefinition dominatingHeader |
         dominatingHeader.getBasicBlock().(ReachableBasicBlock).dominates(sender.getBasicBlock())
       )
     )
@@ -79,10 +77,10 @@ module ReflectedXss {
    * return;
    * ```
    */
-  predicate isLocalHeaderDefinition(HTTP::HeaderDefinition header) {
+  predicate isLocalHeaderDefinition(Http::HeaderDefinition header) {
     exists(ReachableBasicBlock headerBlock | headerBlock = header.getBasicBlock() |
       1 =
-        strictcount(HTTP::ResponseSendArgument sender |
+        strictcount(Http::ResponseSendArgument sender |
           sender.getRouteHandler() = header.getRouteHandler() and
           header.getBasicBlock().(ReachableBasicBlock).dominates(sender.getBasicBlock())
         ) and
@@ -110,9 +108,9 @@ module ReflectedXss {
   /** A third-party controllable request input, considered as a flow source for reflected XSS. */
   class ThirdPartyRequestInputAccessAsSource extends Source {
     ThirdPartyRequestInputAccessAsSource() {
-      this.(HTTP::RequestInputAccess).isThirdPartyControllable()
+      this.(Http::RequestInputAccess).isThirdPartyControllable()
       or
-      this.(HTTP::RequestHeaderAccess).getAHeaderName() = "referer"
+      this.(Http::RequestHeaderAccess).getAHeaderName() = "referer"
     }
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/RemotePropertyInjectionCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/RemotePropertyInjectionCustomizations.qll
index 8281a958142..8af60e6e529 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/RemotePropertyInjectionCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/RemotePropertyInjectionCustomizations.qll
@@ -47,7 +47,7 @@ module RemotePropertyInjection {
       exists(DeleteExpr expr | expr.getOperand().(PropAccess).getPropertyNameExpr() = astNode)
     }
 
-    override string getMessage() { result = " a property name to write to." }
+    override string getMessage() { result = "A property name to write to" }
   }
 
   /**
@@ -57,14 +57,14 @@ module RemotePropertyInjection {
    * header names as properties. This case is already handled by
    * `PropertyWriteSink`.
    */
-  class HeaderNameSink extends Sink, DataFlow::ValueNode {
+  class HeaderNameSink extends Sink {
     HeaderNameSink() {
-      exists(HTTP::ExplicitHeaderDefinition hd |
+      exists(Http::ExplicitHeaderDefinition hd |
         not hd instanceof Express::SetMultipleHeaders and
-        astNode = hd.getNameExpr()
+        this = hd.getNameNode()
       )
     }
 
-    override string getMessage() { result = " a header name." }
+    override string getMessage() { result = "A header name" }
   }
 }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectCustomizations.qll
index e8511ee1f5a..c15dbc2ecf8 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectCustomizations.qll
@@ -26,24 +26,24 @@ module ServerSideUrlRedirect {
   /** A source of third-party user input, considered as a flow source for URL redirects. */
   class ThirdPartyRequestInputAccessAsSource extends Source {
     ThirdPartyRequestInputAccessAsSource() {
-      this.(HTTP::RequestInputAccess).isThirdPartyControllable()
+      this.(Http::RequestInputAccess).isThirdPartyControllable()
     }
   }
 
   /**
    * An HTTP redirect, considered as a sink for `Configuration`.
    */
-  class RedirectSink extends Sink, DataFlow::ValueNode {
-    RedirectSink() { astNode = any(HTTP::RedirectInvocation redir).getUrlArgument() }
+  class RedirectSink extends Sink {
+    RedirectSink() { this = any(Http::RedirectInvocation redir).getUrlArgument() }
   }
 
   /**
    * A definition of the HTTP "Location" header, considered as a sink for
    * `Configuration`.
    */
-  class LocationHeaderSink extends Sink, DataFlow::ValueNode {
+  class LocationHeaderSink extends Sink {
     LocationHeaderSink() {
-      any(HTTP::ExplicitHeaderDefinition def).definesExplicitly("location", astNode)
+      any(Http::ExplicitHeaderDefinition def).definesHeaderValue("location", this)
     }
   }
 
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/SqlInjectionCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/SqlInjectionCustomizations.qll
index 42ffe2ea3c3..dd6f5d79ac8 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/SqlInjectionCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/SqlInjectionCustomizations.qll
@@ -28,13 +28,11 @@ module SqlInjection {
   }
 
   /** An SQL expression passed to an API call that executes SQL. */
-  class SqlInjectionExprSink extends Sink, DataFlow::ValueNode {
-    override SQL::SqlString astNode;
-  }
+  class SqlInjectionExprSink extends Sink instanceof SQL::SqlString { }
 
   /** An expression that sanitizes a value for the purposes of string based query injection. */
-  class SanitizerExpr extends Sanitizer, DataFlow::ValueNode {
-    SanitizerExpr() { astNode = any(SQL::SqlSanitizer ss).getOutput() }
+  class SanitizerExpr extends Sanitizer {
+    SanitizerExpr() { this = any(SQL::SqlSanitizer ss).getOutput() }
   }
 
   /** An GraphQL expression passed to an API call that executes GraphQL. */
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/StackTraceExposureCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/StackTraceExposureCustomizations.qll
index 235926795ba..205c00f8f79 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/StackTraceExposureCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/StackTraceExposureCustomizations.qll
@@ -32,7 +32,5 @@ module StackTraceExposure {
    * An expression that can become part of an HTTP response body, viewed
    * as a data flow sink for stack trace exposure vulnerabilities.
    */
-  class DefaultSink extends Sink, DataFlow::ValueNode {
-    override HTTP::ResponseBody astNode;
-  }
+  class DefaultSink extends Sink instanceof Http::ResponseBody { }
 }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
index 03b1211326a..c463b1d3ecb 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
@@ -647,12 +647,12 @@ module TaintedPath {
   /**
    * A path argument to the Express `res.render` method.
    */
-  class ExpressRenderSink extends Sink, DataFlow::ValueNode {
+  class ExpressRenderSink extends Sink {
     ExpressRenderSink() {
-      exists(MethodCallExpr mce |
+      exists(DataFlow::MethodCallNode mce |
         Express::isResponse(mce.getReceiver()) and
         mce.getMethodName() = "render" and
-        astNode = mce.getArgument(0)
+        this = mce.getArgument(0)
       )
     }
   }
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/TemplateObjectInjectionCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/TemplateObjectInjectionCustomizations.qll
index 06008a0266d..6191c389873 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/TemplateObjectInjectionCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/TemplateObjectInjectionCustomizations.qll
@@ -76,8 +76,8 @@ module TemplateObjectInjection {
   predicate usesVulnerableTemplateEngine(Express::RouterDefinition router) {
     // option 1: `app.set("view engine", "theEngine")`.
     // Express will load the engine automatically.
-    exists(MethodCallExpr call |
-      router.flowsTo(call.getReceiver()) and
+    exists(DataFlow::MethodCallNode call |
+      router.ref().getAMethodCall() = call and
       call.getMethodName() = "set" and
       call.getArgument(0).getStringValue() = "view engine" and
       call.getArgument(1).getStringValue() = getAVulnerableTemplateEngine()
@@ -91,11 +91,11 @@ module TemplateObjectInjection {
       DataFlow::MethodCallNode viewEngineCall
     |
       // `app.engine("name", engine)
-      router.flowsTo(registerCall.getReceiver().asExpr()) and
+      router.ref().getAMethodCall() = registerCall and
       registerCall.getMethodName() = ["engine", "register"] and
       engine = registerCall.getArgument(1).getALocalSource() and
       // app.set("view engine", "name")
-      router.flowsTo(viewEngineCall.getReceiver().asExpr()) and
+      router.ref().getAMethodCall() = viewEngineCall and
       viewEngineCall.getMethodName() = "set" and
       viewEngineCall.getArgument(0).getStringValue() = "view engine" and
       // The name set by the `app.engine("name")` call matches `app.set("view engine", "name")`.
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingCustomizations.qll
index 3cdc81c66ee..ad608017115 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingCustomizations.qll
@@ -29,7 +29,7 @@ module TypeConfusionThroughParameterTampering {
    * Node.js-based HTTP servers turn request parameters into arrays if their names are repeated.
    */
   private class TypeTamperableRequestParameter extends Source {
-    TypeTamperableRequestParameter() { this.(HTTP::RequestInputAccess).isUserControlledObject() }
+    TypeTamperableRequestParameter() { this.(Http::RequestInputAccess).isUserControlledObject() }
   }
 
   /**
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingQuery.qll
index 1615a69eda7..cd4c31146a8 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingQuery.qll
@@ -26,7 +26,11 @@ class Configuration extends DataFlow::Configuration {
     sink.analyze().getAType() = TTObject()
   }
 
-  override predicate isBarrier(DataFlow::Node node) { node instanceof Barrier }
+  override predicate isBarrier(DataFlow::Node node) {
+    super.isBarrier(node)
+    or
+    node instanceof Barrier
+  }
 
   override predicate isBarrierGuard(DataFlow::BarrierGuardNode guard) {
     guard instanceof TypeOfTestBarrier or
@@ -50,7 +54,7 @@ private class TypeOfTestBarrier extends DataFlow::BarrierGuardNode, DataFlow::Va
 }
 
 private class IsArrayBarrier extends DataFlow::BarrierGuardNode, DataFlow::CallNode {
-  IsArrayBarrier() { this = DataFlow::globalVarRef("Array").getAMemberCall("isArray").getACall() }
+  IsArrayBarrier() { this = DataFlow::globalVarRef("Array").getAMemberCall("isArray") }
 
   override predicate blocks(boolean outcome, Expr e) {
     e = getArgument(0).asExpr() and
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionQuery.qll
index bf8468572b4..8e5060036af 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionQuery.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeHtmlConstructionQuery.qll
@@ -43,7 +43,8 @@ class Configration extends TaintTracking::Configuration {
   override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
     guard instanceof PrefixStringSanitizer or
     guard instanceof QuoteGuard or
-    guard instanceof ContainsHtmlGuard
+    guard instanceof ContainsHtmlGuard or
+    guard instanceof TypeTestGuard
   }
 }
 
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/XmlBombCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/XmlBombCustomizations.qll
index 1d159b057ad..7d9755ca7a5 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/XmlBombCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/XmlBombCustomizations.qll
@@ -31,8 +31,8 @@ module XmlBomb {
   /**
    * An access to `document.location`, considered as a flow source for XML bomb vulnerabilities.
    */
-  class LocationAsSource extends Source, DataFlow::ValueNode {
-    LocationAsSource() { isLocation(astNode) }
+  class LocationAsSource extends Source {
+    LocationAsSource() { isLocationNode(this) }
   }
 
   /**
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll
index 3f0f569eff6..bd3aa65aa4d 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll
@@ -67,10 +67,10 @@ module XssThroughDom {
   /**
    * A source for text from a DOM property read by jQuery.
    */
-  class JQueryDOMPropertySource extends DomPropertySource instanceof JQuery::MethodCall {
+  class JQueryDomPropertySource extends DomPropertySource instanceof JQuery::MethodCall {
     string prop;
 
-    JQueryDOMPropertySource() {
+    JQueryDomPropertySource() {
       exists(string methodName |
         this.getMethodName() = methodName and
         this.getNumArgument() = 1 and
@@ -87,6 +87,9 @@ module XssThroughDom {
     override string getPropertyName() { result = prop }
   }
 
+  /** DEPRECATED: Alias for JQueryDomPropertySource */
+  deprecated class JQueryDOMPropertySource = JQueryDomPropertySource;
+
   /**
    * A source for text from the DOM from a `d3` method call.
    */
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/XxeCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/XxeCustomizations.qll
index 4e7bb5e730c..0b54c3bf301 100644
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/XxeCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/XxeCustomizations.qll
@@ -31,8 +31,8 @@ module Xxe {
   /**
    * An access to `document.location`, considered as a flow source for XXE vulnerabilities.
    */
-  class LocationAsSource extends Source, DataFlow::ValueNode {
-    LocationAsSource() { isLocation(astNode) }
+  class LocationAsSource extends Source {
+    LocationAsSource() { isLocationNode(this) }
   }
 
   /**
diff --git a/javascript/ql/lib/semmle/javascript/security/regexp/ExponentialBackTracking.qll b/javascript/ql/lib/semmle/javascript/security/regexp/ExponentialBackTracking.qll
index 000c247fc71..d006837466b 100644
--- a/javascript/ql/lib/semmle/javascript/security/regexp/ExponentialBackTracking.qll
+++ b/javascript/ql/lib/semmle/javascript/security/regexp/ExponentialBackTracking.qll
@@ -115,6 +115,7 @@ private newtype TStatePair =
 private int rankState(State state) {
   state =
     rank[result](State s, Location l |
+      stateInsideBacktracking(s) and
       l = s.getRepr().getLocation()
     |
       s order by l.getStartLine(), l.getStartColumn(), s.toString()
diff --git a/javascript/ql/lib/semmle/javascript/security/regexp/NfaUtils.qll b/javascript/ql/lib/semmle/javascript/security/regexp/NfaUtils.qll
index fdcb10c2f85..5112bdad11e 100644
--- a/javascript/ql/lib/semmle/javascript/security/regexp/NfaUtils.qll
+++ b/javascript/ql/lib/semmle/javascript/security/regexp/NfaUtils.qll
@@ -93,8 +93,6 @@ class RegExpRoot extends RegExpTerm {
    * Holds if this root term is relevant to the ReDoS analysis.
    */
   predicate isRelevant() {
-    // there is at least one repetition
-    getRoot(any(InfiniteRepetitionQuantifier q)) = this and
     // is actually used as a RegExp
     this.isUsedAsRegExp() and
     // not excluded for library specific reasons
@@ -877,6 +875,107 @@ predicate isStartState(State state) {
  */
 signature predicate isCandidateSig(State state, string pump);
 
+/**
+ * Holds if `state` is a candidate for ReDoS.
+ */
+signature predicate isCandidateSig(State state);
+
+/**
+ * Predicates for constructing a prefix string that leads to a given state.
+ */
+module PrefixConstruction<isCandidateSig/1 isCandidate> {
+  /**
+   * Holds if `state` is the textually last start state for the regular expression.
+   */
+  private predicate lastStartState(RelevantState state) {
+    exists(RegExpRoot root |
+      state =
+        max(RelevantState s, Location l |
+          isStartState(s) and
+          getRoot(s.getRepr()) = root and
+          l = s.getRepr().getLocation()
+        |
+          s
+          order by
+            l.getStartLine(), l.getStartColumn(), s.getRepr().toString(), l.getEndColumn(),
+            l.getEndLine()
+        )
+    )
+  }
+
+  /**
+   * Holds if there exists any transition (Epsilon() or other) from `a` to `b`.
+   */
+  private predicate existsTransition(State a, State b) { delta(a, _, b) }
+
+  /**
+   * Gets the minimum number of transitions it takes to reach `state` from the `start` state.
+   */
+  int prefixLength(State start, State state) =
+    shortestDistances(lastStartState/1, existsTransition/2)(start, state, result)
+
+  /**
+   * Gets the minimum number of transitions it takes to reach `state` from the start state.
+   */
+  private int lengthFromStart(State state) { result = prefixLength(_, state) }
+
+  /**
+   * Gets a string for which the regular expression will reach `state`.
+   *
+   * Has at most one result for any given `state`.
+   * This predicate will not always have a result even if there is a ReDoS issue in
+   * the regular expression.
+   */
+  string prefix(State state) {
+    lastStartState(state) and
+    result = ""
+    or
+    // the search stops past the last redos candidate state.
+    lengthFromStart(state) <= max(lengthFromStart(any(State s | isCandidate(s)))) and
+    exists(State prev |
+      // select a unique predecessor (by an arbitrary measure)
+      prev =
+        min(State s, Location loc |
+          lengthFromStart(s) = lengthFromStart(state) - 1 and
+          loc = s.getRepr().getLocation() and
+          delta(s, _, state)
+        |
+          s
+          order by
+            loc.getStartLine(), loc.getStartColumn(), loc.getEndLine(), loc.getEndColumn(),
+            s.getRepr().toString()
+        )
+    |
+      // greedy search for the shortest prefix
+      result = prefix(prev) and delta(prev, Epsilon(), state)
+      or
+      not delta(prev, Epsilon(), state) and
+      result = prefix(prev) + getCanonicalEdgeChar(prev, state)
+    )
+  }
+
+  /**
+   * Gets a canonical char for which there exists a transition from `prev` to `next` in the NFA.
+   */
+  private string getCanonicalEdgeChar(State prev, State next) {
+    result =
+      min(string c | delta(prev, any(InputSymbol symbol | c = intersect(Any(), symbol)), next))
+  }
+
+  /** A state within a regular expression that contains a candidate state. */
+  class RelevantState instanceof State {
+    RelevantState() {
+      exists(State s | isCandidate(s) | getRoot(s.getRepr()) = getRoot(this.getRepr()))
+    }
+
+    /** Gets a string representation for this state in a regular expression. */
+    string toString() { result = State.super.toString() }
+
+    /** Gets the term represented by this state. */
+    RegExpTerm getRepr() { result = State.super.getRepr() }
+  }
+}
+
 /**
  * A module for pruning candidate ReDoS states.
  * The candidates are specified by the `isCandidate` signature predicate.
@@ -910,95 +1009,11 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
   /** Gets a state that can reach the `accept-any` state using only epsilon steps. */
   private State acceptsAnySuffix() { epsilonSucc*(result) = AcceptAnySuffix(_) }
 
-  /**
-   * Predicates for constructing a prefix string that leads to a given state.
-   */
-  private module PrefixConstruction {
-    /**
-     * Holds if `state` is the textually last start state for the regular expression.
-     */
-    private predicate lastStartState(State state) {
-      exists(RegExpRoot root |
-        state =
-          max(State s, Location l |
-            s = stateInPumpableRegexp() and
-            isStartState(s) and
-            getRoot(s.getRepr()) = root and
-            l = s.getRepr().getLocation()
-          |
-            s
-            order by
-              l.getStartLine(), l.getStartColumn(), s.getRepr().toString(), l.getEndColumn(),
-              l.getEndLine()
-          )
-      )
-    }
+  predicate isCandidateState(State s) { isReDoSCandidate(s, _) }
 
-    /**
-     * Holds if there exists any transition (Epsilon() or other) from `a` to `b`.
-     */
-    private predicate existsTransition(State a, State b) { delta(a, _, b) }
+  import PrefixConstruction<isCandidateState/1> as Prefix
 
-    /**
-     * Gets the minimum number of transitions it takes to reach `state` from the `start` state.
-     */
-    int prefixLength(State start, State state) =
-      shortestDistances(lastStartState/1, existsTransition/2)(start, state, result)
-
-    /**
-     * Gets the minimum number of transitions it takes to reach `state` from the start state.
-     */
-    private int lengthFromStart(State state) { result = prefixLength(_, state) }
-
-    /**
-     * Gets a string for which the regular expression will reach `state`.
-     *
-     * Has at most one result for any given `state`.
-     * This predicate will not always have a result even if there is a ReDoS issue in
-     * the regular expression.
-     */
-    string prefix(State state) {
-      lastStartState(state) and
-      result = ""
-      or
-      // the search stops past the last redos candidate state.
-      lengthFromStart(state) <= max(lengthFromStart(any(State s | isReDoSCandidate(s, _)))) and
-      exists(State prev |
-        // select a unique predecessor (by an arbitrary measure)
-        prev =
-          min(State s, Location loc |
-            lengthFromStart(s) = lengthFromStart(state) - 1 and
-            loc = s.getRepr().getLocation() and
-            delta(s, _, state)
-          |
-            s
-            order by
-              loc.getStartLine(), loc.getStartColumn(), loc.getEndLine(), loc.getEndColumn(),
-              s.getRepr().toString()
-          )
-      |
-        // greedy search for the shortest prefix
-        result = prefix(prev) and delta(prev, Epsilon(), state)
-        or
-        not delta(prev, Epsilon(), state) and
-        result = prefix(prev) + getCanonicalEdgeChar(prev, state)
-      )
-    }
-
-    /**
-     * Gets a canonical char for which there exists a transition from `prev` to `next` in the NFA.
-     */
-    private string getCanonicalEdgeChar(State prev, State next) {
-      result =
-        min(string c | delta(prev, any(InputSymbol symbol | c = intersect(Any(), symbol)), next))
-    }
-
-    /** Gets a state within a regular expression that has a pumpable state. */
-    pragma[noinline]
-    State stateInPumpableRegexp() {
-      exists(State s | isReDoSCandidate(s, _) | getRoot(s.getRepr()) = getRoot(result.getRepr()))
-    }
-  }
+  class RelevantState = Prefix::RelevantState;
 
   /**
    * Predicates for testing the presence of a rejecting suffix.
@@ -1018,8 +1033,6 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
    * using epsilon transitions. But any attempt at repeating `w` will end in a state that accepts all suffixes.
    */
   private module SuffixConstruction {
-    import PrefixConstruction
-
     /**
      * Holds if all states reachable from `fork` by repeating `w`
      * are likely rejectable by appending some suffix.
@@ -1035,32 +1048,26 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * This predicate might find impossible suffixes when searching for suffixes of length > 1, which can cause FPs.
      */
     pragma[noinline]
-    private predicate isLikelyRejectable(State s) {
-      s = stateInPumpableRegexp() and
-      (
-        // exists a reject edge with some char.
-        hasRejectEdge(s)
-        or
-        hasEdgeToLikelyRejectable(s)
-        or
-        // stopping here is rejection
-        isRejectState(s)
-      )
+    private predicate isLikelyRejectable(RelevantState s) {
+      // exists a reject edge with some char.
+      hasRejectEdge(s)
+      or
+      hasEdgeToLikelyRejectable(s)
+      or
+      // stopping here is rejection
+      isRejectState(s)
     }
 
     /**
      * Holds if `s` is not an accept state, and there is no epsilon transition to an accept state.
      */
-    predicate isRejectState(State s) {
-      s = stateInPumpableRegexp() and not epsilonSucc*(s) = Accept(_)
-    }
+    predicate isRejectState(RelevantState s) { not epsilonSucc*(s) = Accept(_) }
 
     /**
      * Holds if there is likely a non-empty suffix leading to rejection starting in `s`.
      */
     pragma[noopt]
-    predicate hasEdgeToLikelyRejectable(State s) {
-      s = stateInPumpableRegexp() and
+    predicate hasEdgeToLikelyRejectable(RelevantState s) {
       // all edges (at least one) with some char leads to another state that is rejectable.
       // the `next` states might not share a common suffix, which can cause FPs.
       exists(string char | char = hasEdgeToLikelyRejectableHelper(s) |
@@ -1075,8 +1082,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * and `s` has not been found to be rejectable by `hasRejectEdge` or `isRejectState`.
      */
     pragma[noinline]
-    private string hasEdgeToLikelyRejectableHelper(State s) {
-      s = stateInPumpableRegexp() and
+    private string hasEdgeToLikelyRejectableHelper(RelevantState s) {
       not hasRejectEdge(s) and
       not isRejectState(s) and
       deltaClosedChar(s, result, _)
@@ -1087,9 +1093,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * along epsilon edges, such that there is a transition from
      * `prev` to `next` that the character symbol `char`.
      */
-    predicate deltaClosedChar(State prev, string char, State next) {
-      prev = stateInPumpableRegexp() and
-      next = stateInPumpableRegexp() and
+    predicate deltaClosedChar(RelevantState prev, string char, RelevantState next) {
       deltaClosed(prev, getAnInputSymbolMatchingRelevant(char), next)
     }
 
@@ -1099,18 +1103,28 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
       result = getAnInputSymbolMatching(char)
     }
 
+    pragma[noinline]
+    RegExpRoot relevantRoot() {
+      exists(RegExpTerm term, State s |
+        s.getRepr() = term and isCandidateState(s) and result = term.getRootTerm()
+      )
+    }
+
     /**
      * Gets a char used for finding possible suffixes inside `root`.
      */
     pragma[noinline]
     private string relevant(RegExpRoot root) {
-      exists(ascii(result)) and exists(root)
-      or
-      exists(InputSymbol s | belongsTo(s, root) | result = intersect(s, _))
-      or
-      // The characters from `hasSimpleRejectEdge`. Only `\n` is really needed (as `\n` is not in the `ascii` relation).
-      // The three chars must be kept in sync with `hasSimpleRejectEdge`.
-      result = ["|", "\n", "Z"] and exists(root)
+      root = relevantRoot() and
+      (
+        exists(ascii(result)) and exists(root)
+        or
+        exists(InputSymbol s | belongsTo(s, root) | result = intersect(s, _))
+        or
+        // The characters from `hasSimpleRejectEdge`. Only `\n` is really needed (as `\n` is not in the `ascii` relation).
+        // The three chars must be kept in sync with `hasSimpleRejectEdge`.
+        result = ["|", "\n", "Z"] and exists(root)
+      )
     }
 
     /**
@@ -1208,12 +1222,12 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
   predicate hasReDoSResult(RegExpTerm t, string pump, State s, string prefixMsg) {
     isReDoSAttackable(t, pump, s) and
     (
-      prefixMsg = "starting with '" + escape(PrefixConstruction::prefix(s)) + "' and " and
-      not PrefixConstruction::prefix(s) = ""
+      prefixMsg = "starting with '" + escape(Prefix::prefix(s)) + "' and " and
+      not Prefix::prefix(s) = ""
       or
-      PrefixConstruction::prefix(s) = "" and prefixMsg = ""
+      Prefix::prefix(s) = "" and prefixMsg = ""
       or
-      not exists(PrefixConstruction::prefix(s)) and prefixMsg = ""
+      not exists(Prefix::prefix(s)) and prefixMsg = ""
     )
   }
 
diff --git a/javascript/ql/lib/semmle/javascript/security/regexp/PolynomialReDoSCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/regexp/PolynomialReDoSCustomizations.qll
index ad464f8f24c..87f9437196f 100644
--- a/javascript/ql/lib/semmle/javascript/security/regexp/PolynomialReDoSCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/regexp/PolynomialReDoSCustomizations.qll
@@ -48,8 +48,8 @@ module PolynomialReDoS {
    * A remote input to a server, seen as a source for polynomial
    * regular expression denial-of-service vulnerabilities.
    */
-  class RequestInputAccessAsSource extends Source instanceof HTTP::RequestInputAccess {
-    override string getKind() { result = HTTP::RequestInputAccess.super.getKind() }
+  class RequestInputAccessAsSource extends Source instanceof Http::RequestInputAccess {
+    override string getKind() { result = Http::RequestInputAccess.super.getKind() }
   }
 
   /**
diff --git a/javascript/ql/src/AngularJS/DeadAngularJSEventListener.ql b/javascript/ql/src/AngularJS/DeadAngularJSEventListener.ql
index 36a90784275..d1d411ad447 100644
--- a/javascript/ql/src/AngularJS/DeadAngularJSEventListener.ql
+++ b/javascript/ql/src/AngularJS/DeadAngularJSEventListener.ql
@@ -42,17 +42,19 @@ predicate isABuiltinEventName(string name) {
  * Holds if user code emits or broadcasts an event named `name`.
  */
 predicate isAUserDefinedEventName(string name) {
-  exists(string methodName, MethodCallExpr mce | methodName = "$emit" or methodName = "$broadcast" |
-    mce.getArgument(0).mayHaveStringValue(name) and
+  exists(string methodName, DataFlow::MethodCallNode mcn |
+    methodName = "$emit" or methodName = "$broadcast"
+  |
+    mcn.getArgument(0).mayHaveStringValue(name) and
     (
       // dataflow based scope resolution
-      mce = any(AngularJS::ScopeServiceReference scope).getAMethodCall(methodName)
+      mcn = any(AngularJS::ScopeServiceReference scope).getAMethodCall(methodName)
       or
       // heuristic scope resolution: assume parameters like `$scope` or `$rootScope` are AngularJS scope objects
-      exists(SimpleParameter param |
+      exists(DataFlow::ParameterNode param |
         param.getName() = any(AngularJS::ScopeServiceReference scope).getName() and
-        mce.getReceiver().mayReferToParameter(param) and
-        mce.getMethodName() = methodName
+        param.getAMethodCall() = mcn and
+        mcn.getMethodName() = methodName
       )
       or
       // a call in an AngularJS expression
@@ -64,7 +66,7 @@ predicate isAUserDefinedEventName(string name) {
   )
 }
 
-from AngularJS::ScopeServiceReference scope, MethodCallExpr mce, string eventName
+from AngularJS::ScopeServiceReference scope, DataFlow::MethodCallNode mce, string eventName
 where
   mce = scope.getAMethodCall("$on") and
   mce.getArgument(0).mayHaveStringValue(eventName) and
diff --git a/javascript/ql/src/AngularJS/DependencyMismatch.ql b/javascript/ql/src/AngularJS/DependencyMismatch.ql
index bbdb042bf19..83f9b1cb73a 100644
--- a/javascript/ql/src/AngularJS/DependencyMismatch.ql
+++ b/javascript/ql/src/AngularJS/DependencyMismatch.ql
@@ -14,7 +14,7 @@
 
 import javascript
 
-from AngularJS::InjectableFunction f, SimpleParameter p, string msg
+from AngularJS::InjectableFunction f, DataFlow::ParameterNode p, string msg
 where
   p = f.asFunction().getAParameter() and
   (
diff --git a/javascript/ql/src/AngularJS/DisablingSce.ql b/javascript/ql/src/AngularJS/DisablingSce.ql
index 7ec1b5405b2..4f164d9c55b 100644
--- a/javascript/ql/src/AngularJS/DisablingSce.ql
+++ b/javascript/ql/src/AngularJS/DisablingSce.ql
@@ -14,7 +14,7 @@
 
 import javascript
 
-from MethodCallExpr mce, AngularJS::BuiltinServiceReference service
+from DataFlow::MethodCallNode mce, AngularJS::BuiltinServiceReference service
 where
   service.getName() = "$sceProvider" and
   mce = service.getAMethodCall("enabled") and
diff --git a/javascript/ql/src/AngularJS/DoubleCompilation.ql b/javascript/ql/src/AngularJS/DoubleCompilation.ql
index 95f088d20ce..968e493c45d 100644
--- a/javascript/ql/src/AngularJS/DoubleCompilation.ql
+++ b/javascript/ql/src/AngularJS/DoubleCompilation.ql
@@ -15,7 +15,7 @@
 
 import javascript
 
-from AngularJS::ServiceReference compile, SimpleParameter elem, CallExpr c
+from AngularJS::ServiceReference compile, DataFlow::ParameterNode elem, DataFlow::CallNode c
 where
   compile.getName() = "$compile" and
   elem =
@@ -24,7 +24,7 @@ where
         .(AngularJS::LinkFunction)
         .getElementParameter() and
   c = compile.getACall() and
-  c.getArgument(0).mayReferToParameter(elem) and
+  elem.flowsTo(c.getArgument(0)) and
   // don't flag $compile calls that specify a `maxPriority`
   c.getNumArgument() < 3
 select c, "This call to $compile may cause double compilation of '" + elem + "'."
diff --git a/javascript/ql/src/AngularJS/DuplicateDependency.ql b/javascript/ql/src/AngularJS/DuplicateDependency.ql
index e0f0c4954cb..53ed240aa54 100644
--- a/javascript/ql/src/AngularJS/DuplicateDependency.ql
+++ b/javascript/ql/src/AngularJS/DuplicateDependency.ql
@@ -12,16 +12,17 @@
 import javascript
 import semmle.javascript.RestrictedLocations
 
-predicate isRepeatedDependency(AngularJS::InjectableFunction f, string name, AstNode location) {
+predicate isRepeatedDependency(AngularJS::InjectableFunction f, string name, DataFlow::Node node) {
   exists(int i, int j |
     i < j and
     exists(f.getDependencyDeclaration(i, name)) and
-    location = f.getDependencyDeclaration(j, name)
+    node = f.getDependencyDeclaration(j, name)
   )
 }
 
-from AngularJS::InjectableFunction f, AstNode node, string name
+from AngularJS::InjectableFunction f, DataFlow::Node node, string name
 where
   isRepeatedDependency(f, name, node) and
   not count(f.asFunction().getParameterByName(name)) > 1 // avoid duplicating reports from js/duplicate-parameter-name
-select f.asFunction().(FirstLineOf), "This function has a duplicate dependency '$@'.", node, name
+select f.asFunction().getFunction().(FirstLineOf), "This function has a duplicate dependency '$@'.",
+  node, name
diff --git a/javascript/ql/src/AngularJS/InsecureUrlWhitelist.ql b/javascript/ql/src/AngularJS/InsecureUrlWhitelist.ql
index ac4c4772f11..54f900a1b36 100644
--- a/javascript/ql/src/AngularJS/InsecureUrlWhitelist.ql
+++ b/javascript/ql/src/AngularJS/InsecureUrlWhitelist.ql
@@ -23,7 +23,7 @@ predicate isResourceUrlWhitelist(
 ) {
   exists(AngularJS::ServiceReference service |
     service.getName() = "$sceDelegateProvider" and
-    setupCall.asExpr() = service.getAMethodCall("resourceUrlWhitelist") and
+    setupCall = service.getAMethodCall("resourceUrlWhitelist") and
     list.flowsTo(setupCall.getArgument(0))
   )
 }
diff --git a/javascript/ql/src/AngularJS/RepeatedInjection.ql b/javascript/ql/src/AngularJS/RepeatedInjection.ql
index 3f2e535fdd0..27fb0dc2f62 100644
--- a/javascript/ql/src/AngularJS/RepeatedInjection.ql
+++ b/javascript/ql/src/AngularJS/RepeatedInjection.ql
@@ -12,9 +12,9 @@
 import javascript
 import semmle.javascript.RestrictedLocations
 
-from AngularJS::InjectableFunction f, AstNode explicitInjection
+from AngularJS::InjectableFunction f, DataFlow::Node explicitInjection
 where
   count(f.getAnExplicitDependencyInjection()) > 1 and
   explicitInjection = f.getAnExplicitDependencyInjection()
-select f.asFunction().(FirstLineOf), "This function has $@ defined in multiple places.",
-  explicitInjection, "dependency injections"
+select f.asFunction().getFunction().(FirstLineOf),
+  "This function has $@ defined in multiple places.", explicitInjection, "dependency injections"
diff --git a/javascript/ql/src/AngularJS/UnusedAngularDependency.ql b/javascript/ql/src/AngularJS/UnusedAngularDependency.ql
index 4eb22c33695..4c5530d1a68 100644
--- a/javascript/ql/src/AngularJS/UnusedAngularDependency.ql
+++ b/javascript/ql/src/AngularJS/UnusedAngularDependency.ql
@@ -13,9 +13,9 @@ import javascript
 import Declarations.UnusedParameter
 import semmle.javascript.RestrictedLocations
 
-predicate isUnusedParameter(Function f, string msg, Parameter parameter) {
+predicate isUnusedParameter(DataFlow::FunctionNode f, string msg, Parameter parameter) {
   exists(Variable pv |
-    isUnused(f, parameter, pv, _) and
+    isUnused(f.getFunction(), parameter, pv, _) and
     not isAnAccidentallyUnusedParameter(parameter) and // avoid double alerts
     msg = "Unused dependency " + pv.getName() + "."
   )
diff --git a/javascript/ql/src/Declarations/UnusedParameter.ql b/javascript/ql/src/Declarations/UnusedParameter.ql
index 464c6762e06..d48dc11ed2a 100644
--- a/javascript/ql/src/Declarations/UnusedParameter.ql
+++ b/javascript/ql/src/Declarations/UnusedParameter.ql
@@ -13,4 +13,4 @@ import UnusedParameter
 
 from Parameter p
 where isAnAccidentallyUnusedParameter(p)
-select p, "Unused parameter " + p.getAVariable().getName() + "."
+select p, "The parameter '" + p.getVariable().getName() + "' is never used."
diff --git a/javascript/ql/src/Expressions/BitwiseSignCheck.ql b/javascript/ql/src/Expressions/BitwiseSignCheck.ql
index 658960e39af..a26e846ee7b 100644
--- a/javascript/ql/src/Expressions/BitwiseSignCheck.ql
+++ b/javascript/ql/src/Expressions/BitwiseSignCheck.ql
@@ -53,4 +53,4 @@ where
   not e instanceof EqualityTest and
   e.getRightOperand().getIntValue() = 0 and
   not acceptableSignCheck(b)
-select e, "Sign check of a bitwise operation"
+select e, "Potentially unsafe sign check of a bitwise operation."
diff --git a/javascript/ql/src/Expressions/Misspelling.qll b/javascript/ql/src/Expressions/Misspelling.qll
index e7c35260edb..966e3d5e996 100644
--- a/javascript/ql/src/Expressions/Misspelling.qll
+++ b/javascript/ql/src/Expressions/Misspelling.qll
@@ -4,7 +4,7 @@
 
 import javascript
 // import typo database (generated from Wikipedia, licensed under CC BY-SA 3.0)
-import TypoDatabase
+import codeql.typos.TypoDatabase
 
 /**
  * Holds if `wrong` is a misspelling of `right` that might be intentional or
diff --git a/javascript/ql/src/Expressions/TypoDatabase.qll b/javascript/ql/src/Expressions/TypoDatabase.qll
index a41f003a8c0..f480b9ebc8b 100644
--- a/javascript/ql/src/Expressions/TypoDatabase.qll
+++ b/javascript/ql/src/Expressions/TypoDatabase.qll
@@ -1,9035 +1,4 @@
-/**
- * Holds if `wrong` is a common misspelling of `right`.
- *
- * This predicate was automatically generated by
- *     python buildutils-internal/scripts/generate-typos.py
- * which uses http://en.wikipedia.org/wiki/Wikipedia:Lists_of_common_misspellings/For_machines (with custom additions) on 2018-01-19.
- *
- * This file is available under the Creative Commons Attribution-ShareAlike License
- * (https://en.wikipedia.org/wiki/Wikipedia:Text_of_Creative_Commons_Attribution-ShareAlike_3.0_Unported_License).
- */
-predicate typos(string wrong, string right) {
-  wrong = "abandonned" and right = "abandoned"
-  or
-  wrong = "abbout" and right = "about"
-  or
-  wrong = "aberation" and right = "aberration"
-  or
-  wrong = "abilityes" and right = "abilities"
-  or
-  wrong = "abilties" and right = "abilities"
-  or
-  wrong = "abilty" and right = "ability"
-  or
-  wrong = "abondon" and right = "abandon"
-  or
-  wrong = "abondoned" and right = "abandoned"
-  or
-  wrong = "abondoning" and right = "abandoning"
-  or
-  wrong = "abondons" and right = "abandons"
-  or
-  wrong = "aborigene" and right = "aborigine"
-  or
-  wrong = "abortificant" and right = "abortifacient"
-  or
-  wrong = "abotu" and right = "about"
-  or
-  wrong = "abreviate" and right = "abbreviate"
-  or
-  wrong = "abreviated" and right = "abbreviated"
-  or
-  wrong = "abreviation" and right = "abbreviation"
-  or
-  wrong = "abritrary" and right = "arbitrary"
-  or
-  wrong = "absail" and right = "abseil"
-  or
-  wrong = "absailing" and right = "abseiling"
-  or
-  wrong = "abscence" and right = "absence"
-  or
-  wrong = "absense" and right = "absence"
-  or
-  wrong = "absolutly" and right = "absolutely"
-  or
-  wrong = "absorbsion" and right = "absorption"
-  or
-  wrong = "absorbtion" and right = "absorption"
-  or
-  wrong = "abudance" and right = "abundance"
-  or
-  wrong = "abundacies" and right = "abundances"
-  or
-  wrong = "abundancies" and right = "abundances"
-  or
-  wrong = "abundunt" and right = "abundant"
-  or
-  wrong = "abutts" and right = "abuts"
-  or
-  wrong = "acadamy" and right = "academy"
-  or
-  wrong = "acadmic" and right = "academic"
-  or
-  wrong = "accademic" and right = "academic"
-  or
-  wrong = "accademy" and right = "academy"
-  or
-  wrong = "acccess" and right = "access"
-  or
-  wrong = "acccused" and right = "accused"
-  or
-  wrong = "accelleration" and right = "acceleration"
-  or
-  wrong = "accension" and right = "accession"
-  or
-  wrong = "accension" and right = "ascension"
-  or
-  wrong = "acceptence" and right = "acceptance"
-  or
-  wrong = "acceptible" and right = "acceptable"
-  or
-  wrong = "accesories" and right = "accessories"
-  or
-  wrong = "accessable" and right = "accessible"
-  or
-  wrong = "accidant" and right = "accident"
-  or
-  wrong = "accidentaly" and right = "accidentally"
-  or
-  wrong = "accidently" and right = "accidentally"
-  or
-  wrong = "acclimitization" and right = "acclimatization"
-  or
-  wrong = "accomadate" and right = "accommodate"
-  or
-  wrong = "accomadated" and right = "accommodated"
-  or
-  wrong = "accomadates" and right = "accommodates"
-  or
-  wrong = "accomadating" and right = "accommodating"
-  or
-  wrong = "accomadation" and right = "accommodation"
-  or
-  wrong = "accomadations" and right = "accommodations"
-  or
-  wrong = "accomdate" and right = "accommodate"
-  or
-  wrong = "accomodate" and right = "accommodate"
-  or
-  wrong = "accomodated" and right = "accommodated"
-  or
-  wrong = "accomodates" and right = "accommodates"
-  or
-  wrong = "accomodating" and right = "accommodating"
-  or
-  wrong = "accomodation" and right = "accommodation"
-  or
-  wrong = "accomodations" and right = "accommodations"
-  or
-  wrong = "accompanyed" and right = "accompanied"
-  or
-  wrong = "accordeon" and right = "accordion"
-  or
-  wrong = "accordian" and right = "accordion"
-  or
-  wrong = "accoring" and right = "according"
-  or
-  wrong = "accoustic" and right = "acoustic"
-  or
-  wrong = "accquainted" and right = "acquainted"
-  or
-  wrong = "accrediation" and right = "accreditation"
-  or
-  wrong = "accredidation" and right = "accreditation"
-  or
-  wrong = "accross" and right = "across"
-  or
-  wrong = "accussed" and right = "accused"
-  or
-  wrong = "acedemic" and right = "academic"
-  or
-  wrong = "acheive" and right = "achieve"
-  or
-  wrong = "acheived" and right = "achieved"
-  or
-  wrong = "acheivement" and right = "achievement"
-  or
-  wrong = "acheivements" and right = "achievements"
-  or
-  wrong = "acheives" and right = "achieves"
-  or
-  wrong = "acheiving" and right = "achieving"
-  or
-  wrong = "acheivment" and right = "achievement"
-  or
-  wrong = "acheivments" and right = "achievements"
-  or
-  wrong = "achievment" and right = "achievement"
-  or
-  wrong = "achievments" and right = "achievements"
-  or
-  wrong = "achive" and right = "achieve"
-  or
-  wrong = "achive" and right = "archive"
-  or
-  wrong = "achived" and right = "achieved"
-  or
-  wrong = "achived" and right = "archived"
-  or
-  wrong = "achivement" and right = "achievement"
-  or
-  wrong = "achivements" and right = "achievements"
-  or
-  wrong = "acident" and right = "accident"
-  or
-  wrong = "acknowldeged" and right = "acknowledged"
-  or
-  wrong = "acknowledgeing" and right = "acknowledging"
-  or
-  wrong = "ackward" and right = "awkward"
-  or
-  wrong = "ackward" and right = "backward"
-  or
-  wrong = "acommodate" and right = "accommodate"
-  or
-  wrong = "acomplish" and right = "accomplish"
-  or
-  wrong = "acomplished" and right = "accomplished"
-  or
-  wrong = "acomplishment" and right = "accomplishment"
-  or
-  wrong = "acomplishments" and right = "accomplishments"
-  or
-  wrong = "acording" and right = "according"
-  or
-  wrong = "acordingly" and right = "accordingly"
-  or
-  wrong = "acquaintence" and right = "acquaintance"
-  or
-  wrong = "acquaintences" and right = "acquaintances"
-  or
-  wrong = "acquiantence" and right = "acquaintance"
-  or
-  wrong = "acquiantences" and right = "acquaintances"
-  or
-  wrong = "acquited" and right = "acquitted"
-  or
-  wrong = "activites" and right = "activities"
-  or
-  wrong = "activly" and right = "actively"
-  or
-  wrong = "actualy" and right = "actually"
-  or
-  wrong = "acuracy" and right = "accuracy"
-  or
-  wrong = "acused" and right = "accused"
-  or
-  wrong = "acustom" and right = "accustom"
-  or
-  wrong = "acustommed" and right = "accustomed"
-  or
-  wrong = "adapater" and right = "adapter"
-  or
-  wrong = "adavanced" and right = "advanced"
-  or
-  wrong = "adbandon" and right = "abandon"
-  or
-  wrong = "addional" and right = "additional"
-  or
-  wrong = "addionally" and right = "additionally"
-  or
-  wrong = "additinally" and right = "additionally"
-  or
-  wrong = "additionaly" and right = "additionally"
-  or
-  wrong = "additonal" and right = "additional"
-  or
-  wrong = "additonally" and right = "additionally"
-  or
-  wrong = "addmission" and right = "admission"
-  or
-  wrong = "addopt" and right = "adopt"
-  or
-  wrong = "addopted" and right = "adopted"
-  or
-  wrong = "addoptive" and right = "adoptive"
-  or
-  wrong = "addres" and right = "adders"
-  or
-  wrong = "addres" and right = "address"
-  or
-  wrong = "addresable" and right = "addressable"
-  or
-  wrong = "addresed" and right = "addressed"
-  or
-  wrong = "addresing" and right = "addressing"
-  or
-  wrong = "addressess" and right = "addresses"
-  or
-  wrong = "addtion" and right = "addition"
-  or
-  wrong = "addtional" and right = "additional"
-  or
-  wrong = "adecuate" and right = "adequate"
-  or
-  wrong = "adequit" and right = "adequate"
-  or
-  wrong = "adhearing" and right = "adhering"
-  or
-  wrong = "adherance" and right = "adherence"
-  or
-  wrong = "admendment" and right = "amendment"
-  or
-  wrong = "admininistrative" and right = "administrative"
-  or
-  wrong = "adminstered" and right = "administered"
-  or
-  wrong = "adminstrate" and right = "administrate"
-  or
-  wrong = "adminstration" and right = "administration"
-  or
-  wrong = "adminstrative" and right = "administrative"
-  or
-  wrong = "adminstrator" and right = "administrator"
-  or
-  wrong = "admissability" and right = "admissibility"
-  or
-  wrong = "admissable" and right = "admissible"
-  or
-  wrong = "admited" and right = "admitted"
-  or
-  wrong = "admitedly" and right = "admittedly"
-  or
-  wrong = "adn" and right = "and"
-  or
-  wrong = "adolecent" and right = "adolescent"
-  or
-  wrong = "adquire" and right = "acquire"
-  or
-  wrong = "adquired" and right = "acquired"
-  or
-  wrong = "adquires" and right = "acquires"
-  or
-  wrong = "adquiring" and right = "acquiring"
-  or
-  wrong = "adres" and right = "address"
-  or
-  wrong = "adresable" and right = "addressable"
-  or
-  wrong = "adresing" and right = "addressing"
-  or
-  wrong = "adress" and right = "address"
-  or
-  wrong = "adressable" and right = "addressable"
-  or
-  wrong = "adressed" and right = "addressed"
-  or
-  wrong = "adressing" and right = "addressing"
-  or
-  wrong = "adressing" and right = "dressing"
-  or
-  wrong = "adventrous" and right = "adventurous"
-  or
-  wrong = "advertisment" and right = "advertisement"
-  or
-  wrong = "advertisments" and right = "advertisements"
-  or
-  wrong = "advesary" and right = "adversary"
-  or
-  wrong = "adviced" and right = "advised"
-  or
-  wrong = "aeriel" and right = "aerial"
-  or
-  wrong = "aeriels" and right = "aerials"
-  or
-  wrong = "afair" and right = "affair"
-  or
-  wrong = "afficianados" and right = "aficionados"
-  or
-  wrong = "afficionado" and right = "aficionado"
-  or
-  wrong = "afficionados" and right = "aficionados"
-  or
-  wrong = "affilate" and right = "affiliate"
-  or
-  wrong = "affilliate" and right = "affiliate"
-  or
-  wrong = "affort" and right = "afford"
-  or
-  wrong = "affort" and right = "effort"
-  or
-  wrong = "aforememtioned" and right = "aforementioned"
-  or
-  wrong = "againnst" and right = "against"
-  or
-  wrong = "agains" and right = "against"
-  or
-  wrong = "agaisnt" and right = "against"
-  or
-  wrong = "aganist" and right = "against"
-  or
-  wrong = "aggaravates" and right = "aggravates"
-  or
-  wrong = "aggreed" and right = "agreed"
-  or
-  wrong = "aggreement" and right = "agreement"
-  or
-  wrong = "aggregious" and right = "egregious"
-  or
-  wrong = "aggresive" and right = "aggressive"
-  or
-  wrong = "agian" and right = "again"
-  or
-  wrong = "agianst" and right = "against"
-  or
-  wrong = "agin" and right = "again"
-  or
-  wrong = "agina" and right = "again"
-  or
-  wrong = "agina" and right = "angina"
-  or
-  wrong = "aginst" and right = "against"
-  or
-  wrong = "agravate" and right = "aggravate"
-  or
-  wrong = "agre" and right = "agree"
-  or
-  wrong = "agred" and right = "agreed"
-  or
-  wrong = "agreeement" and right = "agreement"
-  or
-  wrong = "agreemnt" and right = "agreement"
-  or
-  wrong = "agregate" and right = "aggregate"
-  or
-  wrong = "agregates" and right = "aggregates"
-  or
-  wrong = "agreing" and right = "agreeing"
-  or
-  wrong = "agression" and right = "aggression"
-  or
-  wrong = "agressive" and right = "aggressive"
-  or
-  wrong = "agressively" and right = "aggressively"
-  or
-  wrong = "agressor" and right = "aggressor"
-  or
-  wrong = "agricultue" and right = "agriculture"
-  or
-  wrong = "agriculure" and right = "agriculture"
-  or
-  wrong = "agricuture" and right = "agriculture"
-  or
-  wrong = "agrieved" and right = "aggrieved"
-  or
-  wrong = "agrument" and right = "argument"
-  or
-  wrong = "agruments" and right = "arguments"
-  or
-  wrong = "ahev" and right = "have"
-  or
-  wrong = "ahppen" and right = "happen"
-  or
-  wrong = "ahve" and right = "have"
-  or
-  wrong = "aicraft" and right = "aircraft"
-  or
-  wrong = "aiport" and right = "airport"
-  or
-  wrong = "airbourne" and right = "airborne"
-  or
-  wrong = "aircaft" and right = "aircraft"
-  or
-  wrong = "aircrafts" and right = "aircraft"
-  or
-  wrong = "airporta" and right = "airports"
-  or
-  wrong = "airrcraft" and right = "aircraft"
-  or
-  wrong = "aisian" and right = "asian"
-  or
-  wrong = "albiet" and right = "albeit"
-  or
-  wrong = "alchohol" and right = "alcohol"
-  or
-  wrong = "alchoholic" and right = "alcoholic"
-  or
-  wrong = "alchol" and right = "alcohol"
-  or
-  wrong = "alcholic" and right = "alcoholic"
-  or
-  wrong = "alcohal" and right = "alcohol"
-  or
-  wrong = "alcoholical" and right = "alcoholic"
-  or
-  wrong = "aledge" and right = "allege"
-  or
-  wrong = "aledged" and right = "alleged"
-  or
-  wrong = "aledges" and right = "alleges"
-  or
-  wrong = "alege" and right = "allege"
-  or
-  wrong = "aleged" and right = "alleged"
-  or
-  wrong = "alegience" and right = "allegiance"
-  or
-  wrong = "algebraical" and right = "algebraic"
-  or
-  wrong = "algorhitms" and right = "algorithms"
-  or
-  wrong = "algoritm" and right = "algorithm"
-  or
-  wrong = "algoritms" and right = "algorithms"
-  or
-  wrong = "alientating" and right = "alienating"
-  or
-  wrong = "alledge" and right = "allege"
-  or
-  wrong = "alledged" and right = "alleged"
-  or
-  wrong = "alledgedly" and right = "allegedly"
-  or
-  wrong = "alledges" and right = "alleges"
-  or
-  wrong = "allegedely" and right = "allegedly"
-  or
-  wrong = "allegedy" and right = "allegedly"
-  or
-  wrong = "allegely" and right = "allegedly"
-  or
-  wrong = "allegence" and right = "allegiance"
-  or
-  wrong = "allegience" and right = "allegiance"
-  or
-  wrong = "allign" and right = "align"
-  or
-  wrong = "alligned" and right = "aligned"
-  or
-  wrong = "alliviate" and right = "alleviate"
-  or
-  wrong = "allopone" and right = "allophone"
-  or
-  wrong = "allopones" and right = "allophones"
-  or
-  wrong = "allready" and right = "already"
-  or
-  wrong = "allthough" and right = "although"
-  or
-  wrong = "alltogether" and right = "altogether"
-  or
-  wrong = "almsot" and right = "almost"
-  or
-  wrong = "alochol" and right = "alcohol"
-  or
-  wrong = "alomst" and right = "almost"
-  or
-  wrong = "alot" and right = "allot"
-  or
-  wrong = "alotted" and right = "allotted"
-  or
-  wrong = "alowed" and right = "allowed"
-  or
-  wrong = "alowing" and right = "allowing"
-  or
-  wrong = "alreayd" and right = "already"
-  or
-  wrong = "alse" and right = "else"
-  or
-  wrong = "alsot" and right = "also"
-  or
-  wrong = "alternitives" and right = "alternatives"
-  or
-  wrong = "altho" and right = "although"
-  or
-  wrong = "althought" and right = "although"
-  or
-  wrong = "altough" and right = "although"
-  or
-  wrong = "alusion" and right = "allusion"
-  or
-  wrong = "alusion" and right = "illusion"
-  or
-  wrong = "alwasy" and right = "always"
-  or
-  wrong = "alwyas" and right = "always"
-  or
-  wrong = "amalgomated" and right = "amalgamated"
-  or
-  wrong = "amatuer" and right = "amateur"
-  or
-  wrong = "amature" and right = "amateur"
-  or
-  wrong = "amature" and right = "armature"
-  or
-  wrong = "amendmant" and right = "amendment"
-  or
-  wrong = "amercia" and right = "america"
-  or
-  wrong = "amerliorate" and right = "ameliorate"
-  or
-  wrong = "amke" and right = "make"
-  or
-  wrong = "amking" and right = "making"
-  or
-  wrong = "ammend" and right = "amend"
-  or
-  wrong = "ammended" and right = "amended"
-  or
-  wrong = "ammendment" and right = "amendment"
-  or
-  wrong = "ammendments" and right = "amendments"
-  or
-  wrong = "ammount" and right = "amount"
-  or
-  wrong = "ammused" and right = "amused"
-  or
-  wrong = "amoung" and right = "among"
-  or
-  wrong = "amoungst" and right = "amongst"
-  or
-  wrong = "amung" and right = "among"
-  or
-  wrong = "amunition" and right = "ammunition"
-  or
-  wrong = "analagous" and right = "analogous"
-  or
-  wrong = "analitic" and right = "analytic"
-  or
-  wrong = "analogeous" and right = "analogous"
-  or
-  wrong = "anarchim" and right = "anarchism"
-  or
-  wrong = "anarchistm" and right = "anarchism"
-  or
-  wrong = "anbd" and right = "and"
-  or
-  wrong = "ancestory" and right = "ancestry"
-  or
-  wrong = "ancilliary" and right = "ancillary"
-  or
-  wrong = "andd" and right = "and"
-  or
-  wrong = "androgenous" and right = "androgynous"
-  or
-  wrong = "androgeny" and right = "androgyny"
-  or
-  wrong = "anihilation" and right = "annihilation"
-  or
-  wrong = "aniversary" and right = "anniversary"
-  or
-  wrong = "annoint" and right = "anoint"
-  or
-  wrong = "annointed" and right = "anointed"
-  or
-  wrong = "annointing" and right = "anointing"
-  or
-  wrong = "annoints" and right = "anoints"
-  or
-  wrong = "annouced" and right = "announced"
-  or
-  wrong = "annualy" and right = "annually"
-  or
-  wrong = "annuled" and right = "annulled"
-  or
-  wrong = "anohter" and right = "another"
-  or
-  wrong = "anomolies" and right = "anomalies"
-  or
-  wrong = "anomolous" and right = "anomalous"
-  or
-  wrong = "anomoly" and right = "anomaly"
-  or
-  wrong = "anonimity" and right = "anonymity"
-  or
-  wrong = "anounced" and right = "announced"
-  or
-  wrong = "anouncement" and right = "announcement"
-  or
-  wrong = "ansalisation" and right = "nasalisation"
-  or
-  wrong = "ansalization" and right = "nasalization"
-  or
-  wrong = "ansestors" and right = "ancestors"
-  or
-  wrong = "antartic" and right = "antarctic"
-  or
-  wrong = "anthromorphization" and right = "anthropomorphization"
-  or
-  wrong = "anthropolgist" and right = "anthropologist"
-  or
-  wrong = "anthropolgy" and right = "anthropology"
-  or
-  wrong = "anual" and right = "annual"
-  or
-  wrong = "anulled" and right = "annulled"
-  or
-  wrong = "anwsered" and right = "answered"
-  or
-  wrong = "anyhwere" and right = "anywhere"
-  or
-  wrong = "anytying" and right = "anything"
-  or
-  wrong = "aparent" and right = "apparent"
-  or
-  wrong = "aparment" and right = "apartment"
-  or
-  wrong = "apenines" and right = "apennines"
-  or
-  wrong = "aplication" and right = "application"
-  or
-  wrong = "aplied" and right = "applied"
-  or
-  wrong = "apolegetics" and right = "apologetics"
-  or
-  wrong = "apon" and right = "apron"
-  or
-  wrong = "apon" and right = "upon"
-  or
-  wrong = "apparant" and right = "apparent"
-  or
-  wrong = "apparantly" and right = "apparently"
-  or
-  wrong = "appart" and right = "apart"
-  or
-  wrong = "appartment" and right = "apartment"
-  or
-  wrong = "appartments" and right = "apartments"
-  or
-  wrong = "appealling" and right = "appalling"
-  or
-  wrong = "appealling" and right = "appealing"
-  or
-  wrong = "appeareance" and right = "appearance"
-  or
-  wrong = "appearence" and right = "appearance"
-  or
-  wrong = "appearences" and right = "appearances"
-  or
-  wrong = "appenines" and right = "apennines"
-  or
-  wrong = "apperance" and right = "appearance"
-  or
-  wrong = "apperances" and right = "appearances"
-  or
-  wrong = "appereance" and right = "appearance"
-  or
-  wrong = "appereances" and right = "appearances"
-  or
-  wrong = "applicaiton" and right = "application"
-  or
-  wrong = "applicaitons" and right = "applications"
-  or
-  wrong = "appologies" and right = "apologies"
-  or
-  wrong = "appology" and right = "apology"
-  or
-  wrong = "apprearance" and right = "appearance"
-  or
-  wrong = "apprieciate" and right = "appreciate"
-  or
-  wrong = "approachs" and right = "approaches"
-  or
-  wrong = "appropiate" and right = "appropriate"
-  or
-  wrong = "appropraite" and right = "appropriate"
-  or
-  wrong = "appropropiate" and right = "appropriate"
-  or
-  wrong = "approproximate" and right = "approximate"
-  or
-  wrong = "approxamately" and right = "approximately"
-  or
-  wrong = "approxiately" and right = "approximately"
-  or
-  wrong = "approximitely" and right = "approximately"
-  or
-  wrong = "aprehensive" and right = "apprehensive"
-  or
-  wrong = "apropriate" and right = "appropriate"
-  or
-  wrong = "aproval" and right = "approval"
-  or
-  wrong = "aproximate" and right = "approximate"
-  or
-  wrong = "aproximately" and right = "approximately"
-  or
-  wrong = "aquaduct" and right = "aqueduct"
-  or
-  wrong = "aquaintance" and right = "acquaintance"
-  or
-  wrong = "aquainted" and right = "acquainted"
-  or
-  wrong = "aquiantance" and right = "acquaintance"
-  or
-  wrong = "aquire" and right = "acquire"
-  or
-  wrong = "aquired" and right = "acquired"
-  or
-  wrong = "aquiring" and right = "acquiring"
-  or
-  wrong = "aquisition" and right = "acquisition"
-  or
-  wrong = "aquitted" and right = "acquitted"
-  or
-  wrong = "aranged" and right = "arranged"
-  or
-  wrong = "arangement" and right = "arrangement"
-  or
-  wrong = "arbitarily" and right = "arbitrarily"
-  or
-  wrong = "arbitary" and right = "arbitrary"
-  or
-  wrong = "archaelogical" and right = "archaeological"
-  or
-  wrong = "archaelogists" and right = "archaeologists"
-  or
-  wrong = "archaelogy" and right = "archaeology"
-  or
-  wrong = "archaoelogy" and right = "archaeology"
-  or
-  wrong = "archaoelogy" and right = "archeology"
-  or
-  wrong = "archaology" and right = "archaeology"
-  or
-  wrong = "archaology" and right = "archeology"
-  or
-  wrong = "archeaologist" and right = "archaeologist"
-  or
-  wrong = "archeaologist" and right = "archeologist"
-  or
-  wrong = "archeaologists" and right = "archaeologists"
-  or
-  wrong = "archeaologists" and right = "archeologists"
-  or
-  wrong = "archetect" and right = "architect"
-  or
-  wrong = "archetects" and right = "architects"
-  or
-  wrong = "archetectural" and right = "architectural"
-  or
-  wrong = "archetecturally" and right = "architecturally"
-  or
-  wrong = "archetecture" and right = "architecture"
-  or
-  wrong = "archiac" and right = "archaic"
-  or
-  wrong = "archictect" and right = "architect"
-  or
-  wrong = "archimedian" and right = "archimedean"
-  or
-  wrong = "architecht" and right = "architect"
-  or
-  wrong = "architechturally" and right = "architecturally"
-  or
-  wrong = "architechture" and right = "architecture"
-  or
-  wrong = "architechtures" and right = "architectures"
-  or
-  wrong = "architectual" and right = "architectural"
-  or
-  wrong = "archtype" and right = "archetype"
-  or
-  wrong = "archtypes" and right = "archetypes"
-  or
-  wrong = "aready" and right = "already"
-  or
-  wrong = "areodynamics" and right = "aerodynamics"
-  or
-  wrong = "argubly" and right = "arguably"
-  or
-  wrong = "arguement" and right = "argument"
-  or
-  wrong = "arguements" and right = "arguments"
-  or
-  wrong = "arised" and right = "arose"
-  or
-  wrong = "arival" and right = "arrival"
-  or
-  wrong = "armamant" and right = "armament"
-  or
-  wrong = "armistace" and right = "armistice"
-  or
-  wrong = "arogant" and right = "arrogant"
-  or
-  wrong = "arogent" and right = "arrogant"
-  or
-  wrong = "aroud" and right = "around"
-  or
-  wrong = "arrangment" and right = "arrangement"
-  or
-  wrong = "arrangments" and right = "arrangements"
-  or
-  wrong = "arrengement" and right = "arrangement"
-  or
-  wrong = "arrengements" and right = "arrangements"
-  or
-  wrong = "arround" and right = "around"
-  or
-  wrong = "artcile" and right = "article"
-  or
-  wrong = "artical" and right = "article"
-  or
-  wrong = "artice" and right = "article"
-  or
-  wrong = "articel" and right = "article"
-  or
-  wrong = "artifical" and right = "artificial"
-  or
-  wrong = "artifically" and right = "artificially"
-  or
-  wrong = "artillary" and right = "artillery"
-  or
-  wrong = "arund" and right = "around"
-  or
-  wrong = "asetic" and right = "ascetic"
-  or
-  wrong = "asign" and right = "assign"
-  or
-  wrong = "aslo" and right = "also"
-  or
-  wrong = "asnyc" and right = "async"
-  or
-  wrong = "asociated" and right = "associated"
-  or
-  wrong = "asorbed" and right = "absorbed"
-  or
-  wrong = "asphyxation" and right = "asphyxiation"
-  or
-  wrong = "assasin" and right = "assassin"
-  or
-  wrong = "assasinate" and right = "assassinate"
-  or
-  wrong = "assasinated" and right = "assassinated"
-  or
-  wrong = "assasinates" and right = "assassinates"
-  or
-  wrong = "assasination" and right = "assassination"
-  or
-  wrong = "assasinations" and right = "assassinations"
-  or
-  wrong = "assasined" and right = "assassinated"
-  or
-  wrong = "assasins" and right = "assassins"
-  or
-  wrong = "assassintation" and right = "assassination"
-  or
-  wrong = "assemple" and right = "assemble"
-  or
-  wrong = "assertation" and right = "assertion"
-  or
-  wrong = "asside" and right = "aside"
-  or
-  wrong = "assisnate" and right = "assassinate"
-  or
-  wrong = "assit" and right = "assist"
-  or
-  wrong = "assitant" and right = "assistant"
-  or
-  wrong = "assocation" and right = "association"
-  or
-  wrong = "assoicate" and right = "associate"
-  or
-  wrong = "assoicated" and right = "associated"
-  or
-  wrong = "assoicates" and right = "associates"
-  or
-  wrong = "assosication" and right = "assassination"
-  or
-  wrong = "asssassans" and right = "assassins"
-  or
-  wrong = "assualt" and right = "assault"
-  or
-  wrong = "assualted" and right = "assaulted"
-  or
-  wrong = "assymetric" and right = "asymmetric"
-  or
-  wrong = "assymetrical" and right = "asymmetrical"
-  or
-  wrong = "asteriod" and right = "asteroid"
-  or
-  wrong = "asthetic" and right = "aesthetic"
-  or
-  wrong = "asthetical" and right = "aesthetical"
-  or
-  wrong = "asthetically" and right = "aesthetically"
-  or
-  wrong = "asume" and right = "assume"
-  or
-  wrong = "atain" and right = "attain"
-  or
-  wrong = "atempting" and right = "attempting"
-  or
-  wrong = "atheistical" and right = "atheistic"
-  or
-  wrong = "athenean" and right = "athenian"
-  or
-  wrong = "atheneans" and right = "athenians"
-  or
-  wrong = "athiesm" and right = "atheism"
-  or
-  wrong = "athiest" and right = "atheist"
-  or
-  wrong = "atorney" and right = "attorney"
-  or
-  wrong = "atribute" and right = "attribute"
-  or
-  wrong = "atributed" and right = "attributed"
-  or
-  wrong = "atributes" and right = "attributes"
-  or
-  wrong = "attaindre" and right = "attainder"
-  or
-  wrong = "attaindre" and right = "attained"
-  or
-  wrong = "attemp" and right = "attempt"
-  or
-  wrong = "attemped" and right = "attempted"
-  or
-  wrong = "attemt" and right = "attempt"
-  or
-  wrong = "attemted" and right = "attempted"
-  or
-  wrong = "attemting" and right = "attempting"
-  or
-  wrong = "attemts" and right = "attempts"
-  or
-  wrong = "attendence" and right = "attendance"
-  or
-  wrong = "attendent" and right = "attendant"
-  or
-  wrong = "attendents" and right = "attendants"
-  or
-  wrong = "attened" and right = "attended"
-  or
-  wrong = "attension" and right = "attention"
-  or
-  wrong = "attitide" and right = "attitude"
-  or
-  wrong = "attributred" and right = "attributed"
-  or
-  wrong = "attrocities" and right = "atrocities"
-  or
-  wrong = "audeince" and right = "audience"
-  or
-  wrong = "auromated" and right = "automated"
-  or
-  wrong = "austrailia" and right = "australia"
-  or
-  wrong = "austrailian" and right = "australian"
-  or
-  wrong = "auther" and right = "author"
-  or
-  wrong = "authobiographic" and right = "autobiographic"
-  or
-  wrong = "authobiography" and right = "autobiography"
-  or
-  wrong = "authorative" and right = "authoritative"
-  or
-  wrong = "authorites" and right = "authorities"
-  or
-  wrong = "authorithy" and right = "authority"
-  or
-  wrong = "authoritiers" and right = "authorities"
-  or
-  wrong = "authoritive" and right = "authoritative"
-  or
-  wrong = "authrorities" and right = "authorities"
-  or
-  wrong = "autochtonous" and right = "autochthonous"
-  or
-  wrong = "autoctonous" and right = "autochthonous"
-  or
-  wrong = "automaticly" and right = "automatically"
-  or
-  wrong = "automibile" and right = "automobile"
-  or
-  wrong = "automonomous" and right = "autonomous"
-  or
-  wrong = "autor" and right = "author"
-  or
-  wrong = "autority" and right = "authority"
-  or
-  wrong = "auxilary" and right = "auxiliary"
-  or
-  wrong = "auxillaries" and right = "auxiliaries"
-  or
-  wrong = "auxillary" and right = "auxiliary"
-  or
-  wrong = "auxilliaries" and right = "auxiliaries"
-  or
-  wrong = "auxilliary" and right = "auxiliary"
-  or
-  wrong = "availabe" and right = "available"
-  or
-  wrong = "availablity" and right = "availability"
-  or
-  wrong = "availaible" and right = "available"
-  or
-  wrong = "availble" and right = "available"
-  or
-  wrong = "availiable" and right = "available"
-  or
-  wrong = "availible" and right = "available"
-  or
-  wrong = "avalable" and right = "available"
-  or
-  wrong = "avalance" and right = "avalanche"
-  or
-  wrong = "avaliable" and right = "available"
-  or
-  wrong = "avation" and right = "aviation"
-  or
-  wrong = "averageed" and right = "averaged"
-  or
-  wrong = "avilable" and right = "available"
-  or
-  wrong = "awared" and right = "awarded"
-  or
-  wrong = "awya" and right = "away"
-  or
-  wrong = "baceause" and right = "because"
-  or
-  wrong = "backgorund" and right = "background"
-  or
-  wrong = "backrounds" and right = "backgrounds"
-  or
-  wrong = "bakc" and right = "back"
-  or
-  wrong = "banannas" and right = "bananas"
-  or
-  wrong = "bandwith" and right = "bandwidth"
-  or
-  wrong = "bankrupcy" and right = "bankruptcy"
-  or
-  wrong = "banruptcy" and right = "bankruptcy"
-  or
-  wrong = "baout" and right = "about"
-  or
-  wrong = "baout" and right = "bout"
-  or
-  wrong = "basicaly" and right = "basically"
-  or
-  wrong = "basicly" and right = "basically"
-  or
-  wrong = "bcak" and right = "back"
-  or
-  wrong = "beachead" and right = "beachhead"
-  or
-  wrong = "beacuse" and right = "because"
-  or
-  wrong = "beastiality" and right = "bestiality"
-  or
-  wrong = "beatiful" and right = "beautiful"
-  or
-  wrong = "beaurocracy" and right = "bureaucracy"
-  or
-  wrong = "beaurocratic" and right = "bureaucratic"
-  or
-  wrong = "beautyfull" and right = "beautiful"
-  or
-  wrong = "becamae" and right = "became"
-  or
-  wrong = "becames" and right = "became"
-  or
-  wrong = "becames" and right = "becomes"
-  or
-  wrong = "becasue" and right = "because"
-  or
-  wrong = "beccause" and right = "because"
-  or
-  wrong = "becomeing" and right = "becoming"
-  or
-  wrong = "becomming" and right = "becoming"
-  or
-  wrong = "becouse" and right = "because"
-  or
-  wrong = "becuase" and right = "because"
-  or
-  wrong = "bedore" and right = "before"
-  or
-  wrong = "beeing" and right = "being"
-  or
-  wrong = "befoer" and right = "before"
-  or
-  wrong = "beggin" and right = "begging"
-  or
-  wrong = "beggin" and right = "begin"
-  or
-  wrong = "begginer" and right = "beginner"
-  or
-  wrong = "begginers" and right = "beginners"
-  or
-  wrong = "beggining" and right = "beginning"
-  or
-  wrong = "begginings" and right = "beginnings"
-  or
-  wrong = "beggins" and right = "begins"
-  or
-  wrong = "begining" and right = "beginning"
-  or
-  wrong = "beginnig" and right = "beginning"
-  or
-  wrong = "behavour" and right = "behavior"
-  or
-  wrong = "behavour" and right = "behaviour"
-  or
-  wrong = "beleagured" and right = "beleaguered"
-  or
-  wrong = "beleif" and right = "belief"
-  or
-  wrong = "beleive" and right = "believe"
-  or
-  wrong = "beleived" and right = "believed"
-  or
-  wrong = "beleives" and right = "believes"
-  or
-  wrong = "beleiving" and right = "believing"
-  or
-  wrong = "beligum" and right = "belgium"
-  or
-  wrong = "belive" and right = "believe"
-  or
-  wrong = "belived" and right = "believed"
-  or
-  wrong = "belived" and right = "beloved"
-  or
-  wrong = "belives" and right = "beliefs"
-  or
-  wrong = "belives" and right = "believes"
-  or
-  wrong = "belligerant" and right = "belligerent"
-  or
-  wrong = "bellweather" and right = "bellwether"
-  or
-  wrong = "bemusemnt" and right = "bemusement"
-  or
-  wrong = "beneficary" and right = "beneficiary"
-  or
-  wrong = "beng" and right = "being"
-  or
-  wrong = "benificial" and right = "beneficial"
-  or
-  wrong = "benifit" and right = "benefit"
-  or
-  wrong = "benifits" and right = "benefits"
-  or
-  wrong = "bergamont" and right = "bergamot"
-  or
-  wrong = "bernouilli" and right = "bernoulli"
-  or
-  wrong = "beseige" and right = "besiege"
-  or
-  wrong = "beseiged" and right = "besieged"
-  or
-  wrong = "beseiging" and right = "besieging"
-  or
-  wrong = "beteen" and right = "between"
-  or
-  wrong = "betwen" and right = "between"
-  or
-  wrong = "beween" and right = "between"
-  or
-  wrong = "bewteen" and right = "between"
-  or
-  wrong = "bigining" and right = "beginning"
-  or
-  wrong = "biginning" and right = "beginning"
-  or
-  wrong = "bilateraly" and right = "bilaterally"
-  or
-  wrong = "billingualism" and right = "bilingualism"
-  or
-  wrong = "binominal" and right = "binomial"
-  or
-  wrong = "bizzare" and right = "bizarre"
-  or
-  wrong = "blaim" and right = "blame"
-  or
-  wrong = "blaimed" and right = "blamed"
-  or
-  wrong = "blessure" and right = "blessing"
-  or
-  wrong = "blitzkreig" and right = "blitzkrieg"
-  or
-  wrong = "boaut" and right = "about"
-  or
-  wrong = "boaut" and right = "boat"
-  or
-  wrong = "boaut" and right = "bout"
-  or
-  wrong = "bodydbuilder" and right = "bodybuilder"
-  or
-  wrong = "bolean" and right = "boolean"
-  or
-  wrong = "bombardement" and right = "bombardment"
-  or
-  wrong = "bombarment" and right = "bombardment"
-  or
-  wrong = "bondary" and right = "boundary"
-  or
-  wrong = "bonnano" and right = "bonanno"
-  or
-  wrong = "boook" and right = "book"
-  or
-  wrong = "borke" and right = "broke"
-  or
-  wrong = "boundry" and right = "boundary"
-  or
-  wrong = "bouyancy" and right = "buoyancy"
-  or
-  wrong = "bouyant" and right = "buoyant"
-  or
-  wrong = "boyant" and right = "buoyant"
-  or
-  wrong = "bradcast" and right = "broadcast"
-  or
-  wrong = "brasillian" and right = "brazilian"
-  or
-  wrong = "breakthough" and right = "breakthrough"
-  or
-  wrong = "breakthroughts" and right = "breakthroughs"
-  or
-  wrong = "breif" and right = "brief"
-  or
-  wrong = "breifly" and right = "briefly"
-  or
-  wrong = "brethen" and right = "brethren"
-  or
-  wrong = "bretheren" and right = "brethren"
-  or
-  wrong = "briliant" and right = "brilliant"
-  or
-  wrong = "brillant" and right = "brilliant"
-  or
-  wrong = "brimestone" and right = "brimstone"
-  or
-  wrong = "britian" and right = "britain"
-  or
-  wrong = "brittish" and right = "british"
-  or
-  wrong = "broacasted" and right = "broadcast"
-  or
-  wrong = "broadacasting" and right = "broadcasting"
-  or
-  wrong = "broady" and right = "broadly"
-  or
-  wrong = "buddah" and right = "buddha"
-  or
-  wrong = "buddist" and right = "buddhist"
-  or
-  wrong = "buisness" and right = "business"
-  or
-  wrong = "buisnessman" and right = "businessman"
-  or
-  wrong = "buoancy" and right = "buoyancy"
-  or
-  wrong = "buring" and right = "burin"
-  or
-  wrong = "buring" and right = "burning"
-  or
-  wrong = "buring" and right = "burying"
-  or
-  wrong = "buring" and right = "during"
-  or
-  wrong = "burried" and right = "buried"
-  or
-  wrong = "busines" and right = "business"
-  or
-  wrong = "busineses" and right = "business"
-  or
-  wrong = "busineses" and right = "businesses"
-  or
-  wrong = "busness" and right = "business"
-  or
-  wrong = "bussiness" and right = "business"
-  or
-  wrong = "caculater" and right = "calculator"
-  or
-  wrong = "cacuses" and right = "caucuses"
-  or
-  wrong = "cahracters" and right = "characters"
-  or
-  wrong = "calaber" and right = "caliber"
-  or
-  wrong = "calander" and right = "calendar"
-  or
-  wrong = "calander" and right = "calender"
-  or
-  wrong = "calander" and right = "colander"
-  or
-  wrong = "calculater" and right = "calculator"
-  or
-  wrong = "calculs" and right = "calculus"
-  or
-  wrong = "calender" and right = "calendar"
-  or
-  wrong = "calenders" and right = "calendars"
-  or
-  wrong = "caligraphy" and right = "calligraphy"
-  or
-  wrong = "caluclate" and right = "calculate"
-  or
-  wrong = "caluclated" and right = "calculated"
-  or
-  wrong = "caluculate" and right = "calculate"
-  or
-  wrong = "caluculated" and right = "calculated"
-  or
-  wrong = "calulate" and right = "calculate"
-  or
-  wrong = "calulated" and right = "calculated"
-  or
-  wrong = "calulater" and right = "calculator"
-  or
-  wrong = "cambrige" and right = "cambridge"
-  or
-  wrong = "camoflage" and right = "camouflage"
-  or
-  wrong = "campagin" and right = "campaign"
-  or
-  wrong = "campain" and right = "campaign"
-  or
-  wrong = "campains" and right = "campaigns"
-  or
-  wrong = "candadate" and right = "candidate"
-  or
-  wrong = "candiate" and right = "candidate"
-  or
-  wrong = "candidiate" and right = "candidate"
-  or
-  wrong = "cannister" and right = "canister"
-  or
-  wrong = "cannisters" and right = "canisters"
-  or
-  wrong = "cannnot" and right = "cannot"
-  or
-  wrong = "cannonical" and right = "canonical"
-  or
-  wrong = "cannotation" and right = "connotation"
-  or
-  wrong = "cannotations" and right = "connotations"
-  or
-  wrong = "caost" and right = "coast"
-  or
-  wrong = "caperbility" and right = "capability"
-  or
-  wrong = "capible" and right = "capable"
-  or
-  wrong = "captial" and right = "capital"
-  or
-  wrong = "captued" and right = "captured"
-  or
-  wrong = "capturd" and right = "captured"
-  or
-  wrong = "carachter" and right = "character"
-  or
-  wrong = "caracterized" and right = "characterized"
-  or
-  wrong = "carcas" and right = "caracas"
-  or
-  wrong = "carcas" and right = "carcass"
-  or
-  wrong = "carefull" and right = "careful"
-  or
-  wrong = "careing" and right = "caring"
-  or
-  wrong = "carismatic" and right = "charismatic"
-  or
-  wrong = "carmalite" and right = "carmelite"
-  or
-  wrong = "carnagie" and right = "carnegie"
-  or
-  wrong = "carnege" and right = "carnage"
-  or
-  wrong = "carnege" and right = "carnegie"
-  or
-  wrong = "carnige" and right = "carnage"
-  or
-  wrong = "carnige" and right = "carnegie"
-  or
-  wrong = "carnigie" and right = "carnegie"
-  or
-  wrong = "carreer" and right = "career"
-  or
-  wrong = "carrers" and right = "careers"
-  or
-  wrong = "carribbean" and right = "caribbean"
-  or
-  wrong = "carribean" and right = "caribbean"
-  or
-  wrong = "carryng" and right = "carrying"
-  or
-  wrong = "cartdridge" and right = "cartridge"
-  or
-  wrong = "carthagian" and right = "carthaginian"
-  or
-  wrong = "carthographer" and right = "cartographer"
-  or
-  wrong = "cartilege" and right = "cartilage"
-  or
-  wrong = "cartilidge" and right = "cartilage"
-  or
-  wrong = "cartrige" and right = "cartridge"
-  or
-  wrong = "casette" and right = "cassette"
-  or
-  wrong = "casion" and right = "caisson"
-  or
-  wrong = "cassawory" and right = "cassowary"
-  or
-  wrong = "cassowarry" and right = "cassowary"
-  or
-  wrong = "casue" and right = "cause"
-  or
-  wrong = "casued" and right = "caused"
-  or
-  wrong = "casues" and right = "causes"
-  or
-  wrong = "casuing" and right = "causing"
-  or
-  wrong = "casulaties" and right = "casualties"
-  or
-  wrong = "casulaty" and right = "casualty"
-  or
-  wrong = "catagories" and right = "categories"
-  or
-  wrong = "catagorized" and right = "categorized"
-  or
-  wrong = "catagory" and right = "category"
-  or
-  wrong = "cataline" and right = "catalina"
-  or
-  wrong = "cataline" and right = "catiline"
-  or
-  wrong = "catapillar" and right = "caterpillar"
-  or
-  wrong = "catapillars" and right = "caterpillars"
-  or
-  wrong = "catapiller" and right = "caterpillar"
-  or
-  wrong = "catapillers" and right = "caterpillars"
-  or
-  wrong = "catepillar" and right = "caterpillar"
-  or
-  wrong = "catepillars" and right = "caterpillars"
-  or
-  wrong = "catergorize" and right = "categorize"
-  or
-  wrong = "catergorized" and right = "categorized"
-  or
-  wrong = "caterpilar" and right = "caterpillar"
-  or
-  wrong = "caterpilars" and right = "caterpillars"
-  or
-  wrong = "caterpiller" and right = "caterpillar"
-  or
-  wrong = "caterpillers" and right = "caterpillars"
-  or
-  wrong = "cathlic" and right = "catholic"
-  or
-  wrong = "catholocism" and right = "catholicism"
-  or
-  wrong = "catterpilar" and right = "caterpillar"
-  or
-  wrong = "catterpilars" and right = "caterpillars"
-  or
-  wrong = "catterpillar" and right = "caterpillar"
-  or
-  wrong = "catterpillars" and right = "caterpillars"
-  or
-  wrong = "cattleship" and right = "battleship"
-  or
-  wrong = "causalities" and right = "casualties"
-  or
-  wrong = "ceasar" and right = "caesar"
-  or
-  wrong = "celcius" and right = "celsius"
-  or
-  wrong = "cellpading" and right = "cellpadding"
-  or
-  wrong = "cementary" and right = "cemetery"
-  or
-  wrong = "cemetarey" and right = "cemetery"
-  or
-  wrong = "cemetaries" and right = "cemeteries"
-  or
-  wrong = "cemetary" and right = "cemetery"
-  or
-  wrong = "cencus" and right = "census"
-  or
-  wrong = "censur" and right = "censor"
-  or
-  wrong = "censur" and right = "censure"
-  or
-  wrong = "cententenial" and right = "centennial"
-  or
-  wrong = "centruies" and right = "centuries"
-  or
-  wrong = "centruy" and right = "century"
-  or
-  wrong = "centuties" and right = "centuries"
-  or
-  wrong = "centuty" and right = "century"
-  or
-  wrong = "ceratin" and right = "certain"
-  or
-  wrong = "ceratin" and right = "keratin"
-  or
-  wrong = "cerimonial" and right = "ceremonial"
-  or
-  wrong = "cerimonies" and right = "ceremonies"
-  or
-  wrong = "cerimonious" and right = "ceremonious"
-  or
-  wrong = "cerimony" and right = "ceremony"
-  or
-  wrong = "ceromony" and right = "ceremony"
-  or
-  wrong = "certainity" and right = "certainty"
-  or
-  wrong = "certian" and right = "certain"
-  or
-  wrong = "cervial" and right = "cervical"
-  or
-  wrong = "cervial" and right = "serval"
-  or
-  wrong = "cervial" and right = "servile"
-  or
-  wrong = "chalenging" and right = "challenging"
-  or
-  wrong = "challange" and right = "challenge"
-  or
-  wrong = "challanged" and right = "challenged"
-  or
-  wrong = "challege" and right = "challenge"
-  or
-  wrong = "champange" and right = "champagne"
-  or
-  wrong = "changable" and right = "changeable"
-  or
-  wrong = "charachter" and right = "character"
-  or
-  wrong = "charachters" and right = "characters"
-  or
-  wrong = "charactersistic" and right = "characteristic"
-  or
-  wrong = "charactor" and right = "character"
-  or
-  wrong = "charactors" and right = "characters"
-  or
-  wrong = "charasmatic" and right = "charismatic"
-  or
-  wrong = "charaterized" and right = "characterized"
-  or
-  wrong = "chariman" and right = "chairman"
-  or
-  wrong = "charistics" and right = "characteristics"
-  or
-  wrong = "chasr" and right = "chase"
-  or
-  wrong = "chasr" and right = "chaser"
-  or
-  wrong = "cheif" and right = "chief"
-  or
-  wrong = "cheifs" and right = "chiefs"
-  or
-  wrong = "chemcial" and right = "chemical"
-  or
-  wrong = "chemcially" and right = "chemically"
-  or
-  wrong = "chemestry" and right = "chemistry"
-  or
-  wrong = "chemicaly" and right = "chemically"
-  or
-  wrong = "childbird" and right = "childbirth"
-  or
-  wrong = "childen" and right = "children"
-  or
-  wrong = "choclate" and right = "chocolate"
-  or
-  wrong = "choosen" and right = "chosen"
-  or
-  wrong = "chracter" and right = "character"
-  or
-  wrong = "chuch" and right = "church"
-  or
-  wrong = "churchs" and right = "churches"
-  or
-  wrong = "cincinatti" and right = "cincinnati"
-  or
-  wrong = "cincinnatti" and right = "cincinnati"
-  or
-  wrong = "circulaton" and right = "circulation"
-  or
-  wrong = "circumsicion" and right = "circumcision"
-  or
-  wrong = "circut" and right = "circuit"
-  or
-  wrong = "ciricuit" and right = "circuit"
-  or
-  wrong = "ciriculum" and right = "curriculum"
-  or
-  wrong = "civillian" and right = "civilian"
-  or
-  wrong = "claer" and right = "clear"
-  or
-  wrong = "claerer" and right = "clearer"
-  or
-  wrong = "claerly" and right = "clearly"
-  or
-  wrong = "claimes" and right = "claims"
-  or
-  wrong = "clas" and right = "class"
-  or
-  wrong = "clasic" and right = "classic"
-  or
-  wrong = "clasical" and right = "classical"
-  or
-  wrong = "clasically" and right = "classically"
-  or
-  wrong = "cleareance" and right = "clearance"
-  or
-  wrong = "clera" and right = "clear"
-  or
-  wrong = "clera" and right = "sclera"
-  or
-  wrong = "clincial" and right = "clinical"
-  or
-  wrong = "clinicaly" and right = "clinically"
-  or
-  wrong = "cmo" and right = "com"
-  or
-  wrong = "cmoputer" and right = "computer"
-  or
-  wrong = "coctail" and right = "cocktail"
-  or
-  wrong = "coform" and right = "conform"
-  or
-  wrong = "cognizent" and right = "cognizant"
-  or
-  wrong = "coincedentally" and right = "coincidentally"
-  or
-  wrong = "colaborations" and right = "collaborations"
-  or
-  wrong = "colateral" and right = "collateral"
-  or
-  wrong = "colelctive" and right = "collective"
-  or
-  wrong = "collaberative" and right = "collaborative"
-  or
-  wrong = "collecton" and right = "collection"
-  or
-  wrong = "collegue" and right = "colleague"
-  or
-  wrong = "collegues" and right = "colleagues"
-  or
-  wrong = "collonade" and right = "colonnade"
-  or
-  wrong = "collonies" and right = "colonies"
-  or
-  wrong = "collony" and right = "colony"
-  or
-  wrong = "collosal" and right = "colossal"
-  or
-  wrong = "colonizators" and right = "colonizers"
-  or
-  wrong = "comander" and right = "commandeer"
-  or
-  wrong = "comander" and right = "commander"
-  or
-  wrong = "comando" and right = "commando"
-  or
-  wrong = "comandos" and right = "commandos"
-  or
-  wrong = "comany" and right = "company"
-  or
-  wrong = "comapany" and right = "company"
-  or
-  wrong = "comback" and right = "comeback"
-  or
-  wrong = "combanations" and right = "combinations"
-  or
-  wrong = "combinatins" and right = "combinations"
-  or
-  wrong = "combusion" and right = "combustion"
-  or
-  wrong = "comdemnation" and right = "condemnation"
-  or
-  wrong = "comemmorates" and right = "commemorates"
-  or
-  wrong = "comemoretion" and right = "commemoration"
-  or
-  wrong = "comision" and right = "commission"
-  or
-  wrong = "comisioned" and right = "commissioned"
-  or
-  wrong = "comisioner" and right = "commissioner"
-  or
-  wrong = "comisioning" and right = "commissioning"
-  or
-  wrong = "comisions" and right = "commissions"
-  or
-  wrong = "comission" and right = "commission"
-  or
-  wrong = "comissioned" and right = "commissioned"
-  or
-  wrong = "comissioner" and right = "commissioner"
-  or
-  wrong = "comissioning" and right = "commissioning"
-  or
-  wrong = "comissions" and right = "commissions"
-  or
-  wrong = "comited" and right = "committed"
-  or
-  wrong = "comiting" and right = "committing"
-  or
-  wrong = "comitted" and right = "committed"
-  or
-  wrong = "comittee" and right = "committee"
-  or
-  wrong = "comitting" and right = "committing"
-  or
-  wrong = "commandoes" and right = "commandos"
-  or
-  wrong = "commedic" and right = "comedic"
-  or
-  wrong = "commemerative" and right = "commemorative"
-  or
-  wrong = "commemmorate" and right = "commemorate"
-  or
-  wrong = "commemmorating" and right = "commemorating"
-  or
-  wrong = "commerical" and right = "commercial"
-  or
-  wrong = "commerically" and right = "commercially"
-  or
-  wrong = "commericial" and right = "commercial"
-  or
-  wrong = "commericially" and right = "commercially"
-  or
-  wrong = "commerorative" and right = "commemorative"
-  or
-  wrong = "comming" and right = "coming"
-  or
-  wrong = "comminication" and right = "communication"
-  or
-  wrong = "commision" and right = "commission"
-  or
-  wrong = "commisioned" and right = "commissioned"
-  or
-  wrong = "commisioner" and right = "commissioner"
-  or
-  wrong = "commisioning" and right = "commissioning"
-  or
-  wrong = "commisions" and right = "commissions"
-  or
-  wrong = "commited" and right = "committed"
-  or
-  wrong = "commitee" and right = "committee"
-  or
-  wrong = "commiting" and right = "committing"
-  or
-  wrong = "committe" and right = "committee"
-  or
-  wrong = "committment" and right = "commitment"
-  or
-  wrong = "committments" and right = "commitments"
-  or
-  wrong = "commmemorated" and right = "commemorated"
-  or
-  wrong = "commongly" and right = "commonly"
-  or
-  wrong = "commonweath" and right = "commonwealth"
-  or
-  wrong = "commuications" and right = "communications"
-  or
-  wrong = "commuinications" and right = "communications"
-  or
-  wrong = "communciation" and right = "communication"
-  or
-  wrong = "communiation" and right = "communication"
-  or
-  wrong = "communites" and right = "communities"
-  or
-  wrong = "compability" and right = "compatibility"
-  or
-  wrong = "comparision" and right = "comparison"
-  or
-  wrong = "comparisions" and right = "comparisons"
-  or
-  wrong = "comparitive" and right = "comparative"
-  or
-  wrong = "comparitively" and right = "comparatively"
-  or
-  wrong = "compatabilities" and right = "compatibilities"
-  or
-  wrong = "compatability" and right = "compatibility"
-  or
-  wrong = "compatable" and right = "compatible"
-  or
-  wrong = "compatablities" and right = "compatibilities"
-  or
-  wrong = "compatablity" and right = "compatibility"
-  or
-  wrong = "compatiable" and right = "compatible"
-  or
-  wrong = "compatiblities" and right = "compatibilities"
-  or
-  wrong = "compatiblity" and right = "compatibility"
-  or
-  wrong = "compeitions" and right = "competitions"
-  or
-  wrong = "compensantion" and right = "compensation"
-  or
-  wrong = "competance" and right = "competence"
-  or
-  wrong = "competant" and right = "competent"
-  or
-  wrong = "competative" and right = "competitive"
-  or
-  wrong = "competion" and right = "competition"
-  or
-  wrong = "competion" and right = "completion"
-  or
-  wrong = "competitiion" and right = "competition"
-  or
-  wrong = "competive" and right = "competitive"
-  or
-  wrong = "competiveness" and right = "competitiveness"
-  or
-  wrong = "comphrehensive" and right = "comprehensive"
-  or
-  wrong = "compitent" and right = "competent"
-  or
-  wrong = "completelyl" and right = "completely"
-  or
-  wrong = "completetion" and right = "completion"
-  or
-  wrong = "complier" and right = "compiler"
-  or
-  wrong = "componant" and right = "component"
-  or
-  wrong = "comprable" and right = "comparable"
-  or
-  wrong = "comprimise" and right = "compromise"
-  or
-  wrong = "compulsary" and right = "compulsory"
-  or
-  wrong = "compulsery" and right = "compulsory"
-  or
-  wrong = "computarized" and right = "computerized"
-  or
-  wrong = "concensus" and right = "consensus"
-  or
-  wrong = "concider" and right = "consider"
-  or
-  wrong = "concidered" and right = "considered"
-  or
-  wrong = "concidering" and right = "considering"
-  or
-  wrong = "conciders" and right = "considers"
-  or
-  wrong = "concieted" and right = "conceited"
-  or
-  wrong = "concieved" and right = "conceived"
-  or
-  wrong = "concious" and right = "conscious"
-  or
-  wrong = "conciously" and right = "consciously"
-  or
-  wrong = "conciousness" and right = "consciousness"
-  or
-  wrong = "condamned" and right = "condemned"
-  or
-  wrong = "condemmed" and right = "condemned"
-  or
-  wrong = "condidtion" and right = "condition"
-  or
-  wrong = "condidtions" and right = "conditions"
-  or
-  wrong = "conected" and right = "connected"
-  or
-  wrong = "conection" and right = "connection"
-  or
-  wrong = "conesencus" and right = "consensus"
-  or
-  wrong = "confidental" and right = "confidential"
-  or
-  wrong = "confidentally" and right = "confidentially"
-  or
-  wrong = "confids" and right = "confides"
-  or
-  wrong = "configureable" and right = "configurable"
-  or
-  wrong = "confortable" and right = "comfortable"
-  or
-  wrong = "congradulations" and right = "congratulations"
-  or
-  wrong = "congresional" and right = "congressional"
-  or
-  wrong = "conived" and right = "connived"
-  or
-  wrong = "conjecutre" and right = "conjecture"
-  or
-  wrong = "conjuction" and right = "conjunction"
-  or
-  wrong = "connectinos" and right = "connections"
-  or
-  wrong = "conneticut" and right = "connecticut"
-  or
-  wrong = "conotations" and right = "connotations"
-  or
-  wrong = "conquerd" and right = "conquered"
-  or
-  wrong = "conquerer" and right = "conqueror"
-  or
-  wrong = "conquerers" and right = "conquerors"
-  or
-  wrong = "conqured" and right = "conquered"
-  or
-  wrong = "conscent" and right = "consent"
-  or
-  wrong = "consciouness" and right = "consciousness"
-  or
-  wrong = "consdider" and right = "consider"
-  or
-  wrong = "consdidered" and right = "considered"
-  or
-  wrong = "consdiered" and right = "considered"
-  or
-  wrong = "consectutive" and right = "consecutive"
-  or
-  wrong = "consenquently" and right = "consequently"
-  or
-  wrong = "consentrate" and right = "concentrate"
-  or
-  wrong = "consentrated" and right = "concentrated"
-  or
-  wrong = "consentrates" and right = "concentrates"
-  or
-  wrong = "consept" and right = "concept"
-  or
-  wrong = "consequentually" and right = "consequently"
-  or
-  wrong = "consequeseces" and right = "consequences"
-  or
-  wrong = "consern" and right = "concern"
-  or
-  wrong = "conserned" and right = "concerned"
-  or
-  wrong = "conserning" and right = "concerning"
-  or
-  wrong = "conservitive" and right = "conservative"
-  or
-  wrong = "consiciousness" and right = "consciousness"
-  or
-  wrong = "consicousness" and right = "consciousness"
-  or
-  wrong = "considerd" and right = "considered"
-  or
-  wrong = "consideres" and right = "considered"
-  or
-  wrong = "consious" and right = "conscious"
-  or
-  wrong = "consistant" and right = "consistent"
-  or
-  wrong = "consistantly" and right = "consistently"
-  or
-  wrong = "consituencies" and right = "constituencies"
-  or
-  wrong = "consituency" and right = "constituency"
-  or
-  wrong = "consituted" and right = "constituted"
-  or
-  wrong = "consitution" and right = "constitution"
-  or
-  wrong = "consitutional" and right = "constitutional"
-  or
-  wrong = "consolodate" and right = "consolidate"
-  or
-  wrong = "consolodated" and right = "consolidated"
-  or
-  wrong = "consonent" and right = "consonant"
-  or
-  wrong = "consonents" and right = "consonants"
-  or
-  wrong = "consorcium" and right = "consortium"
-  or
-  wrong = "conspiracys" and right = "conspiracies"
-  or
-  wrong = "conspiriator" and right = "conspirator"
-  or
-  wrong = "consructor" and right = "constructor"
-  or
-  wrong = "constaints" and right = "constraints"
-  or
-  wrong = "constanly" and right = "constantly"
-  or
-  wrong = "constarnation" and right = "consternation"
-  or
-  wrong = "constatn" and right = "constant"
-  or
-  wrong = "constinually" and right = "continually"
-  or
-  wrong = "constituant" and right = "constituent"
-  or
-  wrong = "constituants" and right = "constituents"
-  or
-  wrong = "constituion" and right = "constitution"
-  or
-  wrong = "constituional" and right = "constitutional"
-  or
-  wrong = "consttruction" and right = "construction"
-  or
-  wrong = "constuction" and right = "construction"
-  or
-  wrong = "consulant" and right = "consultant"
-  or
-  wrong = "consumate" and right = "consummate"
-  or
-  wrong = "consumated" and right = "consummated"
-  or
-  wrong = "contaiminate" and right = "contaminate"
-  or
-  wrong = "containes" and right = "contains"
-  or
-  wrong = "contamporaries" and right = "contemporaries"
-  or
-  wrong = "contamporary" and right = "contemporary"
-  or
-  wrong = "contempoary" and right = "contemporary"
-  or
-  wrong = "contemporaneus" and right = "contemporaneous"
-  or
-  wrong = "contempory" and right = "contemporary"
-  or
-  wrong = "contendor" and right = "contender"
-  or
-  wrong = "contian" and right = "contain"
-  or
-  wrong = "contians" and right = "contains"
-  or
-  wrong = "contibute" and right = "contribute"
-  or
-  wrong = "contibuted" and right = "contributed"
-  or
-  wrong = "contibutes" and right = "contributes"
-  or
-  wrong = "contigent" and right = "contingent"
-  or
-  wrong = "contined" and right = "continued"
-  or
-  wrong = "continential" and right = "continental"
-  or
-  wrong = "continous" and right = "continuous"
-  or
-  wrong = "continously" and right = "continuously"
-  or
-  wrong = "continueing" and right = "continuing"
-  or
-  wrong = "contravercial" and right = "controversial"
-  or
-  wrong = "contraversy" and right = "controversy"
-  or
-  wrong = "contributer" and right = "contributor"
-  or
-  wrong = "contributers" and right = "contributors"
-  or
-  wrong = "contritutions" and right = "contributions"
-  or
-  wrong = "controled" and right = "controlled"
-  or
-  wrong = "controling" and right = "controlling"
-  or
-  wrong = "controll" and right = "control"
-  or
-  wrong = "controlls" and right = "controls"
-  or
-  wrong = "controvercial" and right = "controversial"
-  or
-  wrong = "controvercy" and right = "controversy"
-  or
-  wrong = "controveries" and right = "controversies"
-  or
-  wrong = "controversal" and right = "controversial"
-  or
-  wrong = "controversey" and right = "controversy"
-  or
-  wrong = "controvertial" and right = "controversial"
-  or
-  wrong = "controvery" and right = "controversy"
-  or
-  wrong = "contruction" and right = "construction"
-  or
-  wrong = "contructor" and right = "constructor"
-  or
-  wrong = "contstruction" and right = "construction"
-  or
-  wrong = "conveinent" and right = "convenient"
-  or
-  wrong = "convenant" and right = "covenant"
-  or
-  wrong = "convential" and right = "conventional"
-  or
-  wrong = "convertables" and right = "convertibles"
-  or
-  wrong = "convertion" and right = "conversion"
-  or
-  wrong = "conviced" and right = "convinced"
-  or
-  wrong = "convienient" and right = "convenient"
-  or
-  wrong = "coordiantion" and right = "coordination"
-  or
-  wrong = "coorperation" and right = "cooperation"
-  or
-  wrong = "coorperation" and right = "corporation"
-  or
-  wrong = "coorperations" and right = "corporations"
-  or
-  wrong = "copmetitors" and right = "competitors"
-  or
-  wrong = "coputer" and right = "computer"
-  or
-  wrong = "copywrite" and right = "copyright"
-  or
-  wrong = "coridal" and right = "cordial"
-  or
-  wrong = "cornmitted" and right = "committed"
-  or
-  wrong = "corosion" and right = "corrosion"
-  or
-  wrong = "corparate" and right = "corporate"
-  or
-  wrong = "corperations" and right = "corporations"
-  or
-  wrong = "correcters" and right = "correctors"
-  or
-  wrong = "correponding" and right = "corresponding"
-  or
-  wrong = "correposding" and right = "corresponding"
-  or
-  wrong = "correspondant" and right = "correspondent"
-  or
-  wrong = "correspondants" and right = "correspondents"
-  or
-  wrong = "corridoors" and right = "corridors"
-  or
-  wrong = "corrispond" and right = "correspond"
-  or
-  wrong = "corrispondant" and right = "correspondent"
-  or
-  wrong = "corrispondants" and right = "correspondents"
-  or
-  wrong = "corrisponded" and right = "corresponded"
-  or
-  wrong = "corrisponding" and right = "corresponding"
-  or
-  wrong = "corrisponds" and right = "corresponds"
-  or
-  wrong = "costitution" and right = "constitution"
-  or
-  wrong = "coucil" and right = "council"
-  or
-  wrong = "coudl" and right = "cloud"
-  or
-  wrong = "coudl" and right = "could"
-  or
-  wrong = "councellor" and right = "councillor"
-  or
-  wrong = "councellor" and right = "councilor"
-  or
-  wrong = "councellor" and right = "counselor"
-  or
-  wrong = "councellors" and right = "councillors"
-  or
-  wrong = "councellors" and right = "councilors"
-  or
-  wrong = "councellors" and right = "counselors"
-  or
-  wrong = "counries" and right = "countries"
-  or
-  wrong = "countains" and right = "contains"
-  or
-  wrong = "countires" and right = "countries"
-  or
-  wrong = "coururier" and right = "courier"
-  or
-  wrong = "coururier" and right = "couturier"
-  or
-  wrong = "coverted" and right = "converted"
-  or
-  wrong = "coverted" and right = "covered"
-  or
-  wrong = "coverted" and right = "coveted"
-  or
-  wrong = "cpoy" and right = "copy"
-  or
-  wrong = "cpoy" and right = "coy"
-  or
-  wrong = "creaeted" and right = "created"
-  or
-  wrong = "creedence" and right = "credence"
-  or
-  wrong = "critereon" and right = "criterion"
-  or
-  wrong = "criterias" and right = "criteria"
-  or
-  wrong = "criticists" and right = "critics"
-  or
-  wrong = "critising" and right = "criticising"
-  or
-  wrong = "critising" and right = "criticizing"
-  or
-  wrong = "critisising" and right = "criticising"
-  or
-  wrong = "critisism" and right = "criticism"
-  or
-  wrong = "critisisms" and right = "criticisms"
-  or
-  wrong = "critisize" and right = "criticise"
-  or
-  wrong = "critisize" and right = "criticize"
-  or
-  wrong = "critisized" and right = "criticised"
-  or
-  wrong = "critisized" and right = "criticized"
-  or
-  wrong = "critisizes" and right = "criticises"
-  or
-  wrong = "critisizes" and right = "criticizes"
-  or
-  wrong = "critisizing" and right = "criticising"
-  or
-  wrong = "critisizing" and right = "criticizing"
-  or
-  wrong = "critized" and right = "criticized"
-  or
-  wrong = "critizing" and right = "criticizing"
-  or
-  wrong = "crockodiles" and right = "crocodiles"
-  or
-  wrong = "crowm" and right = "crown"
-  or
-  wrong = "crtical" and right = "critical"
-  or
-  wrong = "crticised" and right = "criticised"
-  or
-  wrong = "crucifiction" and right = "crucifixion"
-  or
-  wrong = "crusies" and right = "cruises"
-  or
-  wrong = "crutial" and right = "crucial"
-  or
-  wrong = "crystalisation" and right = "crystallisation"
-  or
-  wrong = "culiminating" and right = "culminating"
-  or
-  wrong = "cumulatative" and right = "cumulative"
-  or
-  wrong = "curch" and right = "church"
-  or
-  wrong = "curcuit" and right = "circuit"
-  or
-  wrong = "currenly" and right = "currently"
-  or
-  wrong = "curriculem" and right = "curriculum"
-  or
-  wrong = "cxan" and right = "cyan"
-  or
-  wrong = "cyclinder" and right = "cylinder"
-  or
-  wrong = "dacquiri" and right = "daiquiri"
-  or
-  wrong = "daed" and right = "dead"
-  or
-  wrong = "dael" and right = "dahl"
-  or
-  wrong = "dael" and right = "deal"
-  or
-  wrong = "dael" and right = "dial"
-  or
-  wrong = "dalmation" and right = "dalmatian"
-  or
-  wrong = "damenor" and right = "demeanor"
-  or
-  wrong = "dammage" and right = "damage"
-  or
-  wrong = "dardenelles" and right = "dardanelles"
-  or
-  wrong = "daugher" and right = "daughter"
-  or
-  wrong = "deafult" and right = "default"
-  or
-  wrong = "debateable" and right = "debatable"
-  or
-  wrong = "decendant" and right = "descendant"
-  or
-  wrong = "decendants" and right = "descendants"
-  or
-  wrong = "decendent" and right = "descendant"
-  or
-  wrong = "decendents" and right = "descendants"
-  or
-  wrong = "decideable" and right = "decidable"
-  or
-  wrong = "decidely" and right = "decidedly"
-  or
-  wrong = "decieved" and right = "deceived"
-  or
-  wrong = "decison" and right = "decision"
-  or
-  wrong = "decomissioned" and right = "decommissioned"
-  or
-  wrong = "decomposit" and right = "decompose"
-  or
-  wrong = "decomposited" and right = "decomposed"
-  or
-  wrong = "decompositing" and right = "decomposing"
-  or
-  wrong = "decomposits" and right = "decomposes"
-  or
-  wrong = "decress" and right = "decrees"
-  or
-  wrong = "decribe" and right = "describe"
-  or
-  wrong = "decribed" and right = "described"
-  or
-  wrong = "decribes" and right = "describes"
-  or
-  wrong = "decribing" and right = "describing"
-  or
-  wrong = "dectect" and right = "detect"
-  or
-  wrong = "defendent" and right = "defendant"
-  or
-  wrong = "defendents" and right = "defendants"
-  or
-  wrong = "deffensively" and right = "defensively"
-  or
-  wrong = "deffine" and right = "define"
-  or
-  wrong = "deffined" and right = "defined"
-  or
-  wrong = "definance" and right = "defiance"
-  or
-  wrong = "definate" and right = "definite"
-  or
-  wrong = "definately" and right = "definitely"
-  or
-  wrong = "definatly" and right = "definitely"
-  or
-  wrong = "definetly" and right = "definitely"
-  or
-  wrong = "definining" and right = "defining"
-  or
-  wrong = "definit" and right = "definite"
-  or
-  wrong = "definitly" and right = "definitely"
-  or
-  wrong = "definiton" and right = "definition"
-  or
-  wrong = "defintion" and right = "definition"
-  or
-  wrong = "defualt" and right = "default"
-  or
-  wrong = "defult" and right = "default"
-  or
-  wrong = "degrate" and right = "degrade"
-  or
-  wrong = "delagates" and right = "delegates"
-  or
-  wrong = "delapidated" and right = "dilapidated"
-  or
-  wrong = "delerious" and right = "delirious"
-  or
-  wrong = "delevopment" and right = "development"
-  or
-  wrong = "deliberatly" and right = "deliberately"
-  or
-  wrong = "delusionally" and right = "delusively"
-  or
-  wrong = "demenor" and right = "demeanor"
-  or
-  wrong = "demographical" and right = "demographic"
-  or
-  wrong = "demolision" and right = "demolition"
-  or
-  wrong = "demorcracy" and right = "democracy"
-  or
-  wrong = "demostration" and right = "demonstration"
-  or
-  wrong = "denegrating" and right = "denigrating"
-  or
-  wrong = "densly" and right = "densely"
-  or
-  wrong = "deparment" and right = "department"
-  or
-  wrong = "deparmental" and right = "departmental"
-  or
-  wrong = "deparments" and right = "departments"
-  or
-  wrong = "dependance" and right = "dependence"
-  or
-  wrong = "dependancy" and right = "dependency"
-  or
-  wrong = "deram" and right = "dram"
-  or
-  wrong = "deram" and right = "dream"
-  or
-  wrong = "deriviated" and right = "derived"
-  or
-  wrong = "derivitive" and right = "derivative"
-  or
-  wrong = "derogitory" and right = "derogatory"
-  or
-  wrong = "descendands" and right = "descendants"
-  or
-  wrong = "descibed" and right = "described"
-  or
-  wrong = "desciptors" and right = "descriptors"
-  or
-  wrong = "descision" and right = "decision"
-  or
-  wrong = "descisions" and right = "decisions"
-  or
-  wrong = "descriibes" and right = "describes"
-  or
-  wrong = "descripters" and right = "descriptors"
-  or
-  wrong = "descripton" and right = "description"
-  or
-  wrong = "desctruction" and right = "destruction"
-  or
-  wrong = "descuss" and right = "discuss"
-  or
-  wrong = "desgined" and right = "designed"
-  or
-  wrong = "deside" and right = "decide"
-  or
-  wrong = "desigining" and right = "designing"
-  or
-  wrong = "desinations" and right = "destinations"
-  or
-  wrong = "desintegrated" and right = "disintegrated"
-  or
-  wrong = "desintegration" and right = "disintegration"
-  or
-  wrong = "desireable" and right = "desirable"
-  or
-  wrong = "desitned" and right = "destined"
-  or
-  wrong = "desktiop" and right = "desktop"
-  or
-  wrong = "desorder" and right = "disorder"
-  or
-  wrong = "desoriented" and right = "disoriented"
-  or
-  wrong = "desparate" and right = "desperate"
-  or
-  wrong = "desparate" and right = "disparate"
-  or
-  wrong = "despict" and right = "depict"
-  or
-  wrong = "despiration" and right = "desperation"
-  or
-  wrong = "dessicated" and right = "desiccated"
-  or
-  wrong = "dessigned" and right = "designed"
-  or
-  wrong = "destablized" and right = "destabilized"
-  or
-  wrong = "destory" and right = "destroy"
-  or
-  wrong = "desugered" and right = "desugared"
-  or
-  wrong = "detailled" and right = "detailed"
-  or
-  wrong = "detatched" and right = "detached"
-  or
-  wrong = "deteoriated" and right = "deteriorated"
-  or
-  wrong = "deteriate" and right = "deteriorate"
-  or
-  wrong = "deterioriating" and right = "deteriorating"
-  or
-  wrong = "determinining" and right = "determining"
-  or
-  wrong = "detremental" and right = "detrimental"
-  or
-  wrong = "devasted" and right = "devastated"
-  or
-  wrong = "develope" and right = "develop"
-  or
-  wrong = "developement" and right = "development"
-  or
-  wrong = "developped" and right = "developed"
-  or
-  wrong = "develpment" and right = "development"
-  or
-  wrong = "devels" and right = "delves"
-  or
-  wrong = "devestated" and right = "devastated"
-  or
-  wrong = "devestating" and right = "devastating"
-  or
-  wrong = "devide" and right = "divide"
-  or
-  wrong = "devided" and right = "divided"
-  or
-  wrong = "devistating" and right = "devastating"
-  or
-  wrong = "devolopement" and right = "development"
-  or
-  wrong = "diablical" and right = "diabolical"
-  or
-  wrong = "diamons" and right = "diamonds"
-  or
-  wrong = "diaster" and right = "disaster"
-  or
-  wrong = "dichtomy" and right = "dichotomy"
-  or
-  wrong = "diconnects" and right = "disconnects"
-  or
-  wrong = "dicover" and right = "discover"
-  or
-  wrong = "dicovered" and right = "discovered"
-  or
-  wrong = "dicovering" and right = "discovering"
-  or
-  wrong = "dicovers" and right = "discovers"
-  or
-  wrong = "dicovery" and right = "discovery"
-  or
-  wrong = "dictionarys" and right = "dictionaries"
-  or
-  wrong = "dicussed" and right = "discussed"
-  or
-  wrong = "diea" and right = "die"
-  or
-  wrong = "diea" and right = "idea"
-  or
-  wrong = "dieing" and right = "dyeing"
-  or
-  wrong = "dieing" and right = "dying"
-  or
-  wrong = "dieties" and right = "deities"
-  or
-  wrong = "diety" and right = "deity"
-  or
-  wrong = "diferent" and right = "different"
-  or
-  wrong = "diferrent" and right = "different"
-  or
-  wrong = "differentiatiations" and right = "differentiations"
-  or
-  wrong = "differnt" and right = "different"
-  or
-  wrong = "difficulity" and right = "difficulty"
-  or
-  wrong = "diffrent" and right = "different"
-  or
-  wrong = "dificulties" and right = "difficulties"
-  or
-  wrong = "dificulty" and right = "difficulty"
-  or
-  wrong = "dimenions" and right = "dimensions"
-  or
-  wrong = "dimention" and right = "dimension"
-  or
-  wrong = "dimentional" and right = "dimensional"
-  or
-  wrong = "dimentions" and right = "dimensions"
-  or
-  wrong = "dimesnional" and right = "dimensional"
-  or
-  wrong = "diminuitive" and right = "diminutive"
-  or
-  wrong = "dimunitive" and right = "diminutive"
-  or
-  wrong = "diosese" and right = "diocese"
-  or
-  wrong = "diphtong" and right = "diphthong"
-  or
-  wrong = "diphtongs" and right = "diphthongs"
-  or
-  wrong = "diplomancy" and right = "diplomacy"
-  or
-  wrong = "dipthong" and right = "diphthong"
-  or
-  wrong = "dipthongs" and right = "diphthongs"
-  or
-  wrong = "directoty" and right = "directory"
-  or
-  wrong = "dirived" and right = "derived"
-  or
-  wrong = "disagreeed" and right = "disagreed"
-  or
-  wrong = "disapeared" and right = "disappeared"
-  or
-  wrong = "disapointing" and right = "disappointing"
-  or
-  wrong = "disappearred" and right = "disappeared"
-  or
-  wrong = "disaproval" and right = "disapproval"
-  or
-  wrong = "disasterous" and right = "disastrous"
-  or
-  wrong = "disatisfaction" and right = "dissatisfaction"
-  or
-  wrong = "disatisfied" and right = "dissatisfied"
-  or
-  wrong = "disatrous" and right = "disastrous"
-  or
-  wrong = "discontentment" and right = "discontent"
-  or
-  wrong = "discribe" and right = "describe"
-  or
-  wrong = "discribed" and right = "described"
-  or
-  wrong = "discribes" and right = "describes"
-  or
-  wrong = "discribing" and right = "describing"
-  or
-  wrong = "disctinction" and right = "distinction"
-  or
-  wrong = "disctinctive" and right = "distinctive"
-  or
-  wrong = "disemination" and right = "dissemination"
-  or
-  wrong = "disenchanged" and right = "disenchanted"
-  or
-  wrong = "disiplined" and right = "disciplined"
-  or
-  wrong = "disobediance" and right = "disobedience"
-  or
-  wrong = "disobediant" and right = "disobedient"
-  or
-  wrong = "disolved" and right = "dissolved"
-  or
-  wrong = "disover" and right = "discover"
-  or
-  wrong = "dispair" and right = "despair"
-  or
-  wrong = "disparingly" and right = "disparagingly"
-  or
-  wrong = "dispence" and right = "dispense"
-  or
-  wrong = "dispenced" and right = "dispensed"
-  or
-  wrong = "dispencing" and right = "dispensing"
-  or
-  wrong = "dispicable" and right = "despicable"
-  or
-  wrong = "dispite" and right = "despite"
-  or
-  wrong = "dispostion" and right = "disposition"
-  or
-  wrong = "disproportiate" and right = "disproportionate"
-  or
-  wrong = "disputandem" and right = "disputandum"
-  or
-  wrong = "disricts" and right = "districts"
-  or
-  wrong = "dissagreement" and right = "disagreement"
-  or
-  wrong = "dissapear" and right = "disappear"
-  or
-  wrong = "dissapearance" and right = "disappearance"
-  or
-  wrong = "dissapeared" and right = "disappeared"
-  or
-  wrong = "dissapearing" and right = "disappearing"
-  or
-  wrong = "dissapears" and right = "disappears"
-  or
-  wrong = "dissappear" and right = "disappear"
-  or
-  wrong = "dissappears" and right = "disappears"
-  or
-  wrong = "dissappointed" and right = "disappointed"
-  or
-  wrong = "dissarray" and right = "disarray"
-  or
-  wrong = "dissobediance" and right = "disobedience"
-  or
-  wrong = "dissobediant" and right = "disobedient"
-  or
-  wrong = "dissobedience" and right = "disobedience"
-  or
-  wrong = "dissobedient" and right = "disobedient"
-  or
-  wrong = "distiction" and right = "distinction"
-  or
-  wrong = "distingish" and right = "distinguish"
-  or
-  wrong = "distingished" and right = "distinguished"
-  or
-  wrong = "distingishes" and right = "distinguishes"
-  or
-  wrong = "distingishing" and right = "distinguishing"
-  or
-  wrong = "distingquished" and right = "distinguished"
-  or
-  wrong = "distrubution" and right = "distribution"
-  or
-  wrong = "distruction" and right = "destruction"
-  or
-  wrong = "distructive" and right = "destructive"
-  or
-  wrong = "ditributed" and right = "distributed"
-  or
-  wrong = "diversed" and right = "diverged"
-  or
-  wrong = "diversed" and right = "diverse"
-  or
-  wrong = "divice" and right = "device"
-  or
-  wrong = "divinition" and right = "divination"
-  or
-  wrong = "divison" and right = "division"
-  or
-  wrong = "divisons" and right = "divisions"
-  or
-  wrong = "doccument" and right = "document"
-  or
-  wrong = "doccumented" and right = "documented"
-  or
-  wrong = "doccuments" and right = "documents"
-  or
-  wrong = "docrines" and right = "doctrines"
-  or
-  wrong = "doctines" and right = "doctrines"
-  or
-  wrong = "documenatry" and right = "documentary"
-  or
-  wrong = "doens" and right = "does"
-  or
-  wrong = "doign" and right = "doing"
-  or
-  wrong = "dominaton" and right = "domination"
-  or
-  wrong = "dominent" and right = "dominant"
-  or
-  wrong = "dominiant" and right = "dominant"
-  or
-  wrong = "donig" and right = "doing"
-  or
-  wrong = "doub" and right = "daub"
-  or
-  wrong = "doub" and right = "doubt"
-  or
-  wrong = "doulbe" and right = "double"
-  or
-  wrong = "dowloads" and right = "downloads"
-  or
-  wrong = "dramtic" and right = "dramatic"
-  or
-  wrong = "draughtman" and right = "draughtsman"
-  or
-  wrong = "dravadian" and right = "dravidian"
-  or
-  wrong = "dreasm" and right = "dreams"
-  or
-  wrong = "driectly" and right = "directly"
-  or
-  wrong = "drnik" and right = "drink"
-  or
-  wrong = "druming" and right = "drumming"
-  or
-  wrong = "drummless" and right = "drumless"
-  or
-  wrong = "dum" and right = "dumb"
-  or
-  wrong = "dupicate" and right = "duplicate"
-  or
-  wrong = "durig" and right = "during"
-  or
-  wrong = "durring" and right = "during"
-  or
-  wrong = "duting" and right = "during"
-  or
-  wrong = "dyas" and right = "dryas"
-  or
-  wrong = "eahc" and right = "each"
-  or
-  wrong = "ealier" and right = "earlier"
-  or
-  wrong = "earlies" and right = "earliest"
-  or
-  wrong = "earnt" and right = "earned"
-  or
-  wrong = "ecclectic" and right = "eclectic"
-  or
-  wrong = "eceonomy" and right = "economy"
-  or
-  wrong = "ecidious" and right = "deciduous"
-  or
-  wrong = "eclispe" and right = "eclipse"
-  or
-  wrong = "ecomonic" and right = "economic"
-  or
-  wrong = "ect" and right = "etc"
-  or
-  wrong = "editting" and right = "editing"
-  or
-  wrong = "eearly" and right = "early"
-  or
-  wrong = "efel" and right = "evil"
-  or
-  wrong = "effeciency" and right = "efficiency"
-  or
-  wrong = "effecient" and right = "efficient"
-  or
-  wrong = "effeciently" and right = "efficiently"
-  or
-  wrong = "efficency" and right = "efficiency"
-  or
-  wrong = "efficent" and right = "efficient"
-  or
-  wrong = "efficently" and right = "efficiently"
-  or
-  wrong = "efford" and right = "afford"
-  or
-  wrong = "efford" and right = "effort"
-  or
-  wrong = "effords" and right = "affords"
-  or
-  wrong = "effords" and right = "efforts"
-  or
-  wrong = "effulence" and right = "effluence"
-  or
-  wrong = "eigth" and right = "eight"
-  or
-  wrong = "eigth" and right = "eighth"
-  or
-  wrong = "eiter" and right = "either"
-  or
-  wrong = "elction" and right = "election"
-  or
-  wrong = "electic" and right = "eclectic"
-  or
-  wrong = "electic" and right = "electric"
-  or
-  wrong = "electon" and right = "election"
-  or
-  wrong = "electon" and right = "electron"
-  or
-  wrong = "electrial" and right = "electrical"
-  or
-  wrong = "electricly" and right = "electrically"
-  or
-  wrong = "electricty" and right = "electricity"
-  or
-  wrong = "elementay" and right = "elementary"
-  or
-  wrong = "eleminated" and right = "eliminated"
-  or
-  wrong = "eleminating" and right = "eliminating"
-  or
-  wrong = "eles" and right = "eels"
-  or
-  wrong = "eletricity" and right = "electricity"
-  or
-  wrong = "elicided" and right = "elicited"
-  or
-  wrong = "eligable" and right = "eligible"
-  or
-  wrong = "elimentary" and right = "elementary"
-  or
-  wrong = "ellected" and right = "elected"
-  or
-  wrong = "elphant" and right = "elephant"
-  or
-  wrong = "embarass" and right = "embarrass"
-  or
-  wrong = "embarassed" and right = "embarrassed"
-  or
-  wrong = "embarassing" and right = "embarrassing"
-  or
-  wrong = "embarassment" and right = "embarrassment"
-  or
-  wrong = "embargos" and right = "embargoes"
-  or
-  wrong = "embarras" and right = "embarrass"
-  or
-  wrong = "embarrased" and right = "embarrassed"
-  or
-  wrong = "embarrasing" and right = "embarrassing"
-  or
-  wrong = "embarrasment" and right = "embarrassment"
-  or
-  wrong = "embezelled" and right = "embezzled"
-  or
-  wrong = "emblamatic" and right = "emblematic"
-  or
-  wrong = "eminate" and right = "emanate"
-  or
-  wrong = "eminated" and right = "emanated"
-  or
-  wrong = "emision" and right = "emission"
-  or
-  wrong = "emited" and right = "emitted"
-  or
-  wrong = "emiting" and right = "emitting"
-  or
-  wrong = "emition" and right = "emission"
-  or
-  wrong = "emition" and right = "emotion"
-  or
-  wrong = "emmediately" and right = "immediately"
-  or
-  wrong = "emmigrated" and right = "emigrated"
-  or
-  wrong = "emmigrated" and right = "immigrated"
-  or
-  wrong = "emminent" and right = "eminent"
-  or
-  wrong = "emminent" and right = "imminent"
-  or
-  wrong = "emminently" and right = "eminently"
-  or
-  wrong = "emmisaries" and right = "emissaries"
-  or
-  wrong = "emmisarries" and right = "emissaries"
-  or
-  wrong = "emmisarry" and right = "emissary"
-  or
-  wrong = "emmisary" and right = "emissary"
-  or
-  wrong = "emmision" and right = "emission"
-  or
-  wrong = "emmisions" and right = "emissions"
-  or
-  wrong = "emmited" and right = "emitted"
-  or
-  wrong = "emmiting" and right = "emitting"
-  or
-  wrong = "emmitted" and right = "emitted"
-  or
-  wrong = "emmitting" and right = "emitting"
-  or
-  wrong = "emnity" and right = "enmity"
-  or
-  wrong = "emperical" and right = "empirical"
-  or
-  wrong = "emphaised" and right = "emphasised"
-  or
-  wrong = "emphsis" and right = "emphasis"
-  or
-  wrong = "emphysyma" and right = "emphysema"
-  or
-  wrong = "empirial" and right = "empirical"
-  or
-  wrong = "empirial" and right = "imperial"
-  or
-  wrong = "emporer" and right = "emperor"
-  or
-  wrong = "emprisoned" and right = "imprisoned"
-  or
-  wrong = "enameld" and right = "enameled"
-  or
-  wrong = "enchancement" and right = "enhancement"
-  or
-  wrong = "encouraing" and right = "encouraging"
-  or
-  wrong = "encryptiion" and right = "encryption"
-  or
-  wrong = "encylopedia" and right = "encyclopedia"
-  or
-  wrong = "endevors" and right = "endeavors"
-  or
-  wrong = "endevour" and right = "endeavour"
-  or
-  wrong = "endig" and right = "ending"
-  or
-  wrong = "endolithes" and right = "endoliths"
-  or
-  wrong = "enduce" and right = "induce"
-  or
-  wrong = "ened" and right = "need"
-  or
-  wrong = "enforceing" and right = "enforcing"
-  or
-  wrong = "engagment" and right = "engagement"
-  or
-  wrong = "engeneer" and right = "engineer"
-  or
-  wrong = "engeneering" and right = "engineering"
-  or
-  wrong = "engieneer" and right = "engineer"
-  or
-  wrong = "engieneers" and right = "engineers"
-  or
-  wrong = "enlargment" and right = "enlargement"
-  or
-  wrong = "enlargments" and right = "enlargements"
-  or
-  wrong = "enlish" and right = "english"
-  or
-  wrong = "enlish" and right = "enlist"
-  or
-  wrong = "enourmous" and right = "enormous"
-  or
-  wrong = "enourmously" and right = "enormously"
-  or
-  wrong = "ensconsed" and right = "ensconced"
-  or
-  wrong = "entaglements" and right = "entanglements"
-  or
-  wrong = "enteratinment" and right = "entertainment"
-  or
-  wrong = "enthusiatic" and right = "enthusiastic"
-  or
-  wrong = "entitity" and right = "entity"
-  or
-  wrong = "entitlied" and right = "entitled"
-  or
-  wrong = "entrepeneur" and right = "entrepreneur"
-  or
-  wrong = "entrepeneurs" and right = "entrepreneurs"
-  or
-  wrong = "enviorment" and right = "environment"
-  or
-  wrong = "enviormental" and right = "environmental"
-  or
-  wrong = "enviormentally" and right = "environmentally"
-  or
-  wrong = "enviorments" and right = "environments"
-  or
-  wrong = "enviornment" and right = "environment"
-  or
-  wrong = "enviornmental" and right = "environmental"
-  or
-  wrong = "enviornmentalist" and right = "environmentalist"
-  or
-  wrong = "enviornmentally" and right = "environmentally"
-  or
-  wrong = "enviornments" and right = "environments"
-  or
-  wrong = "enviroment" and right = "environment"
-  or
-  wrong = "enviromental" and right = "environmental"
-  or
-  wrong = "enviromentalist" and right = "environmentalist"
-  or
-  wrong = "enviromentally" and right = "environmentally"
-  or
-  wrong = "enviroments" and right = "environments"
-  or
-  wrong = "environemnt" and right = "environment"
-  or
-  wrong = "envolutionary" and right = "evolutionary"
-  or
-  wrong = "envrionments" and right = "environments"
-  or
-  wrong = "enxt" and right = "next"
-  or
-  wrong = "epidsodes" and right = "episodes"
-  or
-  wrong = "epsiode" and right = "episode"
-  or
-  wrong = "equialent" and right = "equivalent"
-  or
-  wrong = "equilibium" and right = "equilibrium"
-  or
-  wrong = "equilibrum" and right = "equilibrium"
-  or
-  wrong = "equiped" and right = "equipped"
-  or
-  wrong = "equippment" and right = "equipment"
-  or
-  wrong = "equitorial" and right = "equatorial"
-  or
-  wrong = "equivelant" and right = "equivalent"
-  or
-  wrong = "equivelent" and right = "equivalent"
-  or
-  wrong = "equivilant" and right = "equivalent"
-  or
-  wrong = "equivilent" and right = "equivalent"
-  or
-  wrong = "equivlalent" and right = "equivalent"
-  or
-  wrong = "erally" and right = "orally"
-  or
-  wrong = "erally" and right = "really"
-  or
-  wrong = "eratic" and right = "erratic"
-  or
-  wrong = "eratically" and right = "erratically"
-  or
-  wrong = "eraticly" and right = "erratically"
-  or
-  wrong = "erested" and right = "arrested"
-  or
-  wrong = "erested" and right = "erected"
-  or
-  wrong = "errupted" and right = "erupted"
-  or
-  wrong = "esential" and right = "essential"
-  or
-  wrong = "esitmated" and right = "estimated"
-  or
-  wrong = "esle" and right = "else"
-  or
-  wrong = "especialy" and right = "especially"
-  or
-  wrong = "essencial" and right = "essential"
-  or
-  wrong = "essense" and right = "essence"
-  or
-  wrong = "essentail" and right = "essential"
-  or
-  wrong = "essentialy" and right = "essentially"
-  or
-  wrong = "essentual" and right = "essential"
-  or
-  wrong = "essesital" and right = "essential"
-  or
-  wrong = "estabishes" and right = "establishes"
-  or
-  wrong = "establising" and right = "establishing"
-  or
-  wrong = "ethnocentricm" and right = "ethnocentrism"
-  or
-  wrong = "ethose" and right = "ethos"
-  or
-  wrong = "ethose" and right = "those"
-  or
-  wrong = "europian" and right = "european"
-  or
-  wrong = "europians" and right = "europeans"
-  or
-  wrong = "eurpean" and right = "european"
-  or
-  wrong = "eurpoean" and right = "european"
-  or
-  wrong = "evenhtually" and right = "eventually"
-  or
-  wrong = "eventally" and right = "eventually"
-  or
-  wrong = "eventially" and right = "eventually"
-  or
-  wrong = "eventualy" and right = "eventually"
-  or
-  wrong = "everthing" and right = "everything"
-  or
-  wrong = "everyting" and right = "everything"
-  or
-  wrong = "eveyr" and right = "every"
-  or
-  wrong = "evidentally" and right = "evidently"
-  or
-  wrong = "exagerate" and right = "exaggerate"
-  or
-  wrong = "exagerated" and right = "exaggerated"
-  or
-  wrong = "exagerates" and right = "exaggerates"
-  or
-  wrong = "exagerating" and right = "exaggerating"
-  or
-  wrong = "exagerrate" and right = "exaggerate"
-  or
-  wrong = "exagerrated" and right = "exaggerated"
-  or
-  wrong = "exagerrates" and right = "exaggerates"
-  or
-  wrong = "exagerrating" and right = "exaggerating"
-  or
-  wrong = "examinated" and right = "examined"
-  or
-  wrong = "exampt" and right = "exempt"
-  or
-  wrong = "exapansion" and right = "expansion"
-  or
-  wrong = "excact" and right = "exact"
-  or
-  wrong = "excange" and right = "exchange"
-  or
-  wrong = "excecute" and right = "execute"
-  or
-  wrong = "excecuted" and right = "executed"
-  or
-  wrong = "excecutes" and right = "executes"
-  or
-  wrong = "excecuting" and right = "executing"
-  or
-  wrong = "excecution" and right = "execution"
-  or
-  wrong = "excedded" and right = "exceeded"
-  or
-  wrong = "excelent" and right = "excellent"
-  or
-  wrong = "excell" and right = "excel"
-  or
-  wrong = "excellance" and right = "excellence"
-  or
-  wrong = "excellant" and right = "excellent"
-  or
-  wrong = "excells" and right = "excels"
-  or
-  wrong = "excercise" and right = "exercise"
-  or
-  wrong = "exchanching" and right = "exchanging"
-  or
-  wrong = "excisted" and right = "existed"
-  or
-  wrong = "exculsivly" and right = "exclusively"
-  or
-  wrong = "execising" and right = "exercising"
-  or
-  wrong = "exection" and right = "execution"
-  or
-  wrong = "exectued" and right = "executed"
-  or
-  wrong = "exeedingly" and right = "exceedingly"
-  or
-  wrong = "exelent" and right = "excellent"
-  or
-  wrong = "exellent" and right = "excellent"
-  or
-  wrong = "exemple" and right = "example"
-  or
-  wrong = "exept" and right = "except"
-  or
-  wrong = "exeptional" and right = "exceptional"
-  or
-  wrong = "exerbate" and right = "exacerbate"
-  or
-  wrong = "exerbated" and right = "exacerbated"
-  or
-  wrong = "exerciese" and right = "exercises"
-  or
-  wrong = "exerpt" and right = "excerpt"
-  or
-  wrong = "exerpts" and right = "excerpts"
-  or
-  wrong = "exersize" and right = "exercise"
-  or
-  wrong = "exerternal" and right = "external"
-  or
-  wrong = "exhalted" and right = "exalted"
-  or
-  wrong = "exhibtion" and right = "exhibition"
-  or
-  wrong = "exibition" and right = "exhibition"
-  or
-  wrong = "exibitions" and right = "exhibitions"
-  or
-  wrong = "exicting" and right = "exciting"
-  or
-  wrong = "exinct" and right = "extinct"
-  or
-  wrong = "existance" and right = "existence"
-  or
-  wrong = "existant" and right = "existent"
-  or
-  wrong = "existince" and right = "existence"
-  or
-  wrong = "exliled" and right = "exiled"
-  or
-  wrong = "exludes" and right = "excludes"
-  or
-  wrong = "exmaple" and right = "example"
-  or
-  wrong = "exonorate" and right = "exonerate"
-  or
-  wrong = "exoskelaton" and right = "exoskeleton"
-  or
-  wrong = "expalin" and right = "explain"
-  or
-  wrong = "expatriot" and right = "expatriate"
-  or
-  wrong = "expeced" and right = "expected"
-  or
-  wrong = "expecially" and right = "especially"
-  or
-  wrong = "expeditonary" and right = "expeditionary"
-  or
-  wrong = "expeiments" and right = "experiments"
-  or
-  wrong = "expell" and right = "expel"
-  or
-  wrong = "expells" and right = "expels"
-  or
-  wrong = "experiance" and right = "experience"
-  or
-  wrong = "experianced" and right = "experienced"
-  or
-  wrong = "expession" and right = "expression"
-  or
-  wrong = "expessions" and right = "expressions"
-  or
-  wrong = "expiditions" and right = "expeditions"
-  or
-  wrong = "expierence" and right = "experience"
-  or
-  wrong = "explaination" and right = "explanation"
-  or
-  wrong = "explaning" and right = "explaining"
-  or
-  wrong = "explictly" and right = "explicitly"
-  or
-  wrong = "exploititive" and right = "exploitative"
-  or
-  wrong = "explotation" and right = "exploitation"
-  or
-  wrong = "expropiated" and right = "expropriated"
-  or
-  wrong = "expropiation" and right = "expropriation"
-  or
-  wrong = "exressed" and right = "expressed"
-  or
-  wrong = "extemely" and right = "extremely"
-  or
-  wrong = "extened" and right = "extended"
-  or
-  wrong = "extention" and right = "extension"
-  or
-  wrong = "extentions" and right = "extensions"
-  or
-  wrong = "extered" and right = "exerted"
-  or
-  wrong = "extermist" and right = "extremist"
-  or
-  wrong = "extint" and right = "extant"
-  or
-  wrong = "extint" and right = "extinct"
-  or
-  wrong = "extracter" and right = "extractor"
-  or
-  wrong = "extradiction" and right = "extradition"
-  or
-  wrong = "extraterrestial" and right = "extraterrestrial"
-  or
-  wrong = "extraterrestials" and right = "extraterrestrials"
-  or
-  wrong = "extravagent" and right = "extravagant"
-  or
-  wrong = "extrememly" and right = "extremely"
-  or
-  wrong = "extremeophile" and right = "extremophile"
-  or
-  wrong = "extremly" and right = "extremely"
-  or
-  wrong = "extrordinarily" and right = "extraordinarily"
-  or
-  wrong = "extrordinary" and right = "extraordinary"
-  or
-  wrong = "eyar" and right = "eyas"
-  or
-  wrong = "eyar" and right = "year"
-  or
-  wrong = "eyars" and right = "eyas"
-  or
-  wrong = "eyars" and right = "years"
-  or
-  wrong = "eyasr" and right = "eyas"
-  or
-  wrong = "eyasr" and right = "years"
-  or
-  wrong = "faciliate" and right = "facilitate"
-  or
-  wrong = "faciliated" and right = "facilitated"
-  or
-  wrong = "faciliates" and right = "facilitates"
-  or
-  wrong = "facilites" and right = "facilities"
-  or
-  wrong = "facillitate" and right = "facilitate"
-  or
-  wrong = "facinated" and right = "fascinated"
-  or
-  wrong = "facist" and right = "fascist"
-  or
-  wrong = "familes" and right = "families"
-  or
-  wrong = "familliar" and right = "familiar"
-  or
-  wrong = "famoust" and right = "famous"
-  or
-  wrong = "fanatism" and right = "fanaticism"
-  or
-  wrong = "farenheit" and right = "fahrenheit"
-  or
-  wrong = "fatc" and right = "fact"
-  or
-  wrong = "faught" and right = "fought"
-  or
-  wrong = "favoutrable" and right = "favourable"
-  or
-  wrong = "feasable" and right = "feasible"
-  or
-  wrong = "febuary" and right = "february"
-  or
-  wrong = "feburary" and right = "february"
-  or
-  wrong = "fedreally" and right = "federally"
-  or
-  wrong = "femminist" and right = "feminist"
-  or
-  wrong = "feromone" and right = "pheromone"
-  or
-  wrong = "fertily" and right = "fertility"
-  or
-  wrong = "fianite" and right = "finite"
-  or
-  wrong = "fianlly" and right = "finally"
-  or
-  wrong = "ficticious" and right = "fictitious"
-  or
-  wrong = "fictious" and right = "fictitious"
-  or
-  wrong = "fidn" and right = "find"
-  or
-  wrong = "fiel" and right = "feel"
-  or
-  wrong = "fiel" and right = "field"
-  or
-  wrong = "fiel" and right = "file"
-  or
-  wrong = "fiel" and right = "phial"
-  or
-  wrong = "fiels" and right = "feels"
-  or
-  wrong = "fiels" and right = "fields"
-  or
-  wrong = "fiels" and right = "files"
-  or
-  wrong = "fiels" and right = "phials"
-  or
-  wrong = "fiercly" and right = "fiercely"
-  or
-  wrong = "fightings" and right = "fighting"
-  or
-  wrong = "filiament" and right = "filament"
-  or
-  wrong = "fimilies" and right = "families"
-  or
-  wrong = "finacial" and right = "financial"
-  or
-  wrong = "finaly" and right = "finally"
-  or
-  wrong = "financialy" and right = "financially"
-  or
-  wrong = "firends" and right = "friends"
-  or
-  wrong = "firts" and right = "first"
-  or
-  wrong = "firts" and right = "flirts"
-  or
-  wrong = "fisionable" and right = "fissionable"
-  or
-  wrong = "flamable" and right = "flammable"
-  or
-  wrong = "flawess" and right = "flawless"
-  or
-  wrong = "fleed" and right = "fled"
-  or
-  wrong = "fleed" and right = "freed"
-  or
-  wrong = "flemmish" and right = "flemish"
-  or
-  wrong = "florescent" and right = "fluorescent"
-  or
-  wrong = "flourescent" and right = "fluorescent"
-  or
-  wrong = "flourine" and right = "fluorine"
-  or
-  wrong = "flourishment" and right = "flourishing"
-  or
-  wrong = "fluorish" and right = "flourish"
-  or
-  wrong = "follwoing" and right = "following"
-  or
-  wrong = "folowing" and right = "following"
-  or
-  wrong = "fomed" and right = "formed"
-  or
-  wrong = "fomr" and right = "form"
-  or
-  wrong = "fomr" and right = "from"
-  or
-  wrong = "fonetic" and right = "phonetic"
-  or
-  wrong = "fontrier" and right = "fontier"
-  or
-  wrong = "foootball" and right = "football"
-  or
-  wrong = "forbad" and right = "forbade"
-  or
-  wrong = "forbiden" and right = "forbidden"
-  or
-  wrong = "foreward" and right = "foreword"
-  or
-  wrong = "forfiet" and right = "forfeit"
-  or
-  wrong = "forhead" and right = "forehead"
-  or
-  wrong = "foriegn" and right = "foreign"
-  or
-  wrong = "formalhaut" and right = "fomalhaut"
-  or
-  wrong = "formallize" and right = "formalize"
-  or
-  wrong = "formallized" and right = "formalized"
-  or
-  wrong = "formaly" and right = "formally"
-  or
-  wrong = "formaly" and right = "formerly"
-  or
-  wrong = "formelly" and right = "formerly"
-  or
-  wrong = "formidible" and right = "formidable"
-  or
-  wrong = "formost" and right = "foremost"
-  or
-  wrong = "forsaw" and right = "foresaw"
-  or
-  wrong = "forseeable" and right = "foreseeable"
-  or
-  wrong = "fortelling" and right = "foretelling"
-  or
-  wrong = "forunner" and right = "forerunner"
-  or
-  wrong = "foucs" and right = "focus"
-  or
-  wrong = "foudn" and right = "found"
-  or
-  wrong = "fougth" and right = "fought"
-  or
-  wrong = "foundaries" and right = "foundries"
-  or
-  wrong = "foundary" and right = "foundry"
-  or
-  wrong = "foundland" and right = "newfoundland"
-  or
-  wrong = "fourties" and right = "forties"
-  or
-  wrong = "fourty" and right = "forty"
-  or
-  wrong = "fouth" and right = "fourth"
-  or
-  wrong = "foward" and right = "forward"
-  or
-  wrong = "framwork" and right = "framework"
-  or
-  wrong = "fransiscan" and right = "franciscan"
-  or
-  wrong = "fransiscans" and right = "franciscans"
-  or
-  wrong = "freind" and right = "friend"
-  or
-  wrong = "freindly" and right = "friendly"
-  or
-  wrong = "frequentily" and right = "frequently"
-  or
-  wrong = "frome" and right = "from"
-  or
-  wrong = "fromed" and right = "formed"
-  or
-  wrong = "froniter" and right = "frontier"
-  or
-  wrong = "fucntion" and right = "function"
-  or
-  wrong = "fucntioning" and right = "functioning"
-  or
-  wrong = "fufill" and right = "fulfill"
-  or
-  wrong = "fufilled" and right = "fulfilled"
-  or
-  wrong = "fulfiled" and right = "fulfilled"
-  or
-  wrong = "fullfill" and right = "fulfill"
-  or
-  wrong = "fullfilled" and right = "fulfilled"
-  or
-  wrong = "funcion" and right = "function"
-  or
-  wrong = "fundametal" and right = "fundamental"
-  or
-  wrong = "fundametals" and right = "fundamentals"
-  or
-  wrong = "funguses" and right = "fungi"
-  or
-  wrong = "funtion" and right = "function"
-  or
-  wrong = "funtions" and right = "functions"
-  or
-  wrong = "furuther" and right = "further"
-  or
-  wrong = "futher" and right = "further"
-  or
-  wrong = "futhermore" and right = "furthermore"
-  or
-  wrong = "futhroc" and right = "futhark"
-  or
-  wrong = "futhroc" and right = "futhorc"
-  or
-  wrong = "gae" and right = "gael"
-  or
-  wrong = "gae" and right = "gale"
-  or
-  wrong = "gae" and right = "game"
-  or
-  wrong = "galatic" and right = "galactic"
-  or
-  wrong = "galations" and right = "galatians"
-  or
-  wrong = "gallaxies" and right = "galaxies"
-  or
-  wrong = "galvinized" and right = "galvanized"
-  or
-  wrong = "ganerate" and right = "generate"
-  or
-  wrong = "ganes" and right = "games"
-  or
-  wrong = "ganster" and right = "gangster"
-  or
-  wrong = "garantee" and right = "guarantee"
-  or
-  wrong = "garanteed" and right = "guaranteed"
-  or
-  wrong = "garantees" and right = "guarantees"
-  or
-  wrong = "garnison" and right = "garrison"
-  or
-  wrong = "gaurantee" and right = "guarantee"
-  or
-  wrong = "gauranteed" and right = "guaranteed"
-  or
-  wrong = "gaurantees" and right = "guarantees"
-  or
-  wrong = "gaurd" and right = "gourd"
-  or
-  wrong = "gaurd" and right = "guard"
-  or
-  wrong = "gaurentee" and right = "guarantee"
-  or
-  wrong = "gaurenteed" and right = "guaranteed"
-  or
-  wrong = "gaurentees" and right = "guarantees"
-  or
-  wrong = "geneological" and right = "genealogical"
-  or
-  wrong = "geneologies" and right = "genealogies"
-  or
-  wrong = "geneology" and right = "genealogy"
-  or
-  wrong = "generaly" and right = "generally"
-  or
-  wrong = "generatting" and right = "generating"
-  or
-  wrong = "genialia" and right = "genitalia"
-  or
-  wrong = "geographicial" and right = "geographical"
-  or
-  wrong = "geometrician" and right = "geometer"
-  or
-  wrong = "geometricians" and right = "geometers"
-  or
-  wrong = "gerat" and right = "great"
-  or
-  wrong = "ghandi" and right = "gandhi"
-  or
-  wrong = "glamourous" and right = "glamorous"
-  or
-  wrong = "glight" and right = "flight"
-  or
-  wrong = "gnawwed" and right = "gnawed"
-  or
-  wrong = "godess" and right = "goddess"
-  or
-  wrong = "godesses" and right = "goddesses"
-  or
-  wrong = "godounov" and right = "godunov"
-  or
-  wrong = "gogin" and right = "gauguin"
-  or
-  wrong = "gogin" and right = "going"
-  or
-  wrong = "goign" and right = "going"
-  or
-  wrong = "gonig" and right = "going"
-  or
-  wrong = "gothenberg" and right = "gothenburg"
-  or
-  wrong = "gottleib" and right = "gottlieb"
-  or
-  wrong = "gouvener" and right = "governor"
-  or
-  wrong = "govement" and right = "government"
-  or
-  wrong = "govenment" and right = "government"
-  or
-  wrong = "govenrment" and right = "government"
-  or
-  wrong = "goverance" and right = "governance"
-  or
-  wrong = "goverment" and right = "government"
-  or
-  wrong = "govermental" and right = "governmental"
-  or
-  wrong = "governer" and right = "governor"
-  or
-  wrong = "governmnet" and right = "government"
-  or
-  wrong = "govorment" and right = "government"
-  or
-  wrong = "govormental" and right = "governmental"
-  or
-  wrong = "govornment" and right = "government"
-  or
-  wrong = "gracefull" and right = "graceful"
-  or
-  wrong = "graet" and right = "great"
-  or
-  wrong = "grafitti" and right = "graffiti"
-  or
-  wrong = "gramatically" and right = "grammatically"
-  or
-  wrong = "grammaticaly" and right = "grammatically"
-  or
-  wrong = "grammer" and right = "grammar"
-  or
-  wrong = "grat" and right = "great"
-  or
-  wrong = "gratuitious" and right = "gratuitous"
-  or
-  wrong = "greatful" and right = "grateful"
-  or
-  wrong = "greatfully" and right = "gratefully"
-  or
-  wrong = "greif" and right = "grief"
-  or
-  wrong = "gridles" and right = "griddles"
-  or
-  wrong = "gropu" and right = "group"
-  or
-  wrong = "grwo" and right = "grow"
-  or
-  wrong = "guaduloupe" and right = "guadalupe"
-  or
-  wrong = "guaduloupe" and right = "guadeloupe"
-  or
-  wrong = "guadulupe" and right = "guadalupe"
-  or
-  wrong = "guadulupe" and right = "guadeloupe"
-  or
-  wrong = "guage" and right = "gauge"
-  or
-  wrong = "guarentee" and right = "guarantee"
-  or
-  wrong = "guarenteed" and right = "guaranteed"
-  or
-  wrong = "guarentees" and right = "guarantees"
-  or
-  wrong = "guatamala" and right = "guatemala"
-  or
-  wrong = "guatamalan" and right = "guatemalan"
-  or
-  wrong = "guerrila" and right = "guerrilla"
-  or
-  wrong = "guerrilas" and right = "guerrillas"
-  or
-  wrong = "guidence" and right = "guidance"
-  or
-  wrong = "guilia" and right = "giulia"
-  or
-  wrong = "guilio" and right = "giulio"
-  or
-  wrong = "guiness" and right = "guinness"
-  or
-  wrong = "guiseppe" and right = "giuseppe"
-  or
-  wrong = "gunanine" and right = "guanine"
-  or
-  wrong = "gurantee" and right = "guarantee"
-  or
-  wrong = "guranteed" and right = "guaranteed"
-  or
-  wrong = "gurantees" and right = "guarantees"
-  or
-  wrong = "guttaral" and right = "guttural"
-  or
-  wrong = "gutteral" and right = "guttural"
-  or
-  wrong = "habaeus" and right = "habeas"
-  or
-  wrong = "habeus" and right = "habeas"
-  or
-  wrong = "habsbourg" and right = "habsburg"
-  or
-  wrong = "haemorrage" and right = "haemorrhage"
-  or
-  wrong = "haev" and right = "have"
-  or
-  wrong = "haev" and right = "heave"
-  or
-  wrong = "halarious" and right = "hilarious"
-  or
-  wrong = "hallowean" and right = "halloween"
-  or
-  wrong = "halp" and right = "help"
-  or
-  wrong = "hander" and right = "handler"
-  or
-  wrong = "hapen" and right = "happen"
-  or
-  wrong = "hapened" and right = "happened"
-  or
-  wrong = "hapening" and right = "happening"
-  or
-  wrong = "happend" and right = "happened"
-  or
-  wrong = "happended" and right = "happened"
-  or
-  wrong = "happenned" and right = "happened"
-  or
-  wrong = "harased" and right = "harassed"
-  or
-  wrong = "harases" and right = "harasses"
-  or
-  wrong = "harasment" and right = "harassment"
-  or
-  wrong = "harasments" and right = "harassments"
-  or
-  wrong = "harassement" and right = "harassment"
-  or
-  wrong = "harras" and right = "harass"
-  or
-  wrong = "harrased" and right = "harassed"
-  or
-  wrong = "harrases" and right = "harasses"
-  or
-  wrong = "harrasing" and right = "harassing"
-  or
-  wrong = "harrasment" and right = "harassment"
-  or
-  wrong = "harrasments" and right = "harassments"
-  or
-  wrong = "harrassed" and right = "harassed"
-  or
-  wrong = "harrasses" and right = "harassed"
-  or
-  wrong = "harrassing" and right = "harassing"
-  or
-  wrong = "harrassment" and right = "harassment"
-  or
-  wrong = "harrassments" and right = "harassments"
-  or
-  wrong = "hatian" and right = "haitian"
-  or
-  wrong = "haviest" and right = "heaviest"
-  or
-  wrong = "headquarer" and right = "headquarter"
-  or
-  wrong = "headquater" and right = "headquarter"
-  or
-  wrong = "headquatered" and right = "headquartered"
-  or
-  wrong = "headquaters" and right = "headquarters"
-  or
-  wrong = "healthercare" and right = "healthcare"
-  or
-  wrong = "heared" and right = "heard"
-  or
-  wrong = "heathy" and right = "healthy"
-  or
-  wrong = "heidelburg" and right = "heidelberg"
-  or
-  wrong = "heigher" and right = "higher"
-  or
-  wrong = "heirarchy" and right = "hierarchy"
-  or
-  wrong = "heiroglyphics" and right = "hieroglyphics"
-  or
-  wrong = "helment" and right = "helmet"
-  or
-  wrong = "helpfull" and right = "helpful"
-  or
-  wrong = "helpped" and right = "helped"
-  or
-  wrong = "hemmorhage" and right = "hemorrhage"
-  or
-  wrong = "herad" and right = "heard"
-  or
-  wrong = "herad" and right = "hera"
-  or
-  wrong = "heridity" and right = "heredity"
-  or
-  wrong = "heroe" and right = "hero"
-  or
-  wrong = "heros" and right = "heroes"
-  or
-  wrong = "hertiage" and right = "heritage"
-  or
-  wrong = "hertzs" and right = "hertz"
-  or
-  wrong = "hesistant" and right = "hesitant"
-  or
-  wrong = "heterogenous" and right = "heterogeneous"
-  or
-  wrong = "hieght" and right = "height"
-  or
-  wrong = "hierachical" and right = "hierarchical"
-  or
-  wrong = "hierachies" and right = "hierarchies"
-  or
-  wrong = "hierachy" and right = "hierarchy"
-  or
-  wrong = "hierarcical" and right = "hierarchical"
-  or
-  wrong = "hierarcy" and right = "hierarchy"
-  or
-  wrong = "hieroglph" and right = "hieroglyph"
-  or
-  wrong = "hieroglphs" and right = "hieroglyphs"
-  or
-  wrong = "higer" and right = "higher"
-  or
-  wrong = "higest" and right = "highest"
-  or
-  wrong = "higway" and right = "highway"
-  or
-  wrong = "hillarious" and right = "hilarious"
-  or
-  wrong = "himselv" and right = "himself"
-  or
-  wrong = "hinderance" and right = "hindrance"
-  or
-  wrong = "hinderence" and right = "hindrance"
-  or
-  wrong = "hindrence" and right = "hindrance"
-  or
-  wrong = "hipopotamus" and right = "hippopotamus"
-  or
-  wrong = "hismelf" and right = "himself"
-  or
-  wrong = "histocompatability" and right = "histocompatibility"
-  or
-  wrong = "historicians" and right = "historians"
-  or
-  wrong = "holf" and right = "hold"
-  or
-  wrong = "holliday" and right = "holiday"
-  or
-  wrong = "homogeneize" and right = "homogenize"
-  or
-  wrong = "homogeneized" and right = "homogenized"
-  or
-  wrong = "honory" and right = "honorary"
-  or
-  wrong = "horrifing" and right = "horrifying"
-  or
-  wrong = "hosited" and right = "hoisted"
-  or
-  wrong = "hospitible" and right = "hospitable"
-  or
-  wrong = "hounour" and right = "honour"
-  or
-  wrong = "housr" and right = "hours"
-  or
-  wrong = "housr" and right = "house"
-  or
-  wrong = "howver" and right = "however"
-  or
-  wrong = "hsitorians" and right = "historians"
-  or
-  wrong = "hstory" and right = "history"
-  or
-  wrong = "hten" and right = "hen"
-  or
-  wrong = "hten" and right = "the"
-  or
-  wrong = "hten" and right = "then"
-  or
-  wrong = "htere" and right = "here"
-  or
-  wrong = "htere" and right = "there"
-  or
-  wrong = "htey" and right = "they"
-  or
-  wrong = "htikn" and right = "think"
-  or
-  wrong = "hting" and right = "thing"
-  or
-  wrong = "htink" and right = "think"
-  or
-  wrong = "htis" and right = "this"
-  or
-  wrong = "humer" and right = "humor"
-  or
-  wrong = "humer" and right = "humour"
-  or
-  wrong = "humerous" and right = "humerus"
-  or
-  wrong = "humerous" and right = "humorous"
-  or
-  wrong = "huminoid" and right = "humanoid"
-  or
-  wrong = "humoural" and right = "humoral"
-  or
-  wrong = "humurous" and right = "humorous"
-  or
-  wrong = "husban" and right = "husband"
-  or
-  wrong = "hvae" and right = "have"
-  or
-  wrong = "hvaing" and right = "having"
-  or
-  wrong = "hvea" and right = "have"
-  or
-  wrong = "hvea" and right = "heave"
-  or
-  wrong = "hwihc" and right = "which"
-  or
-  wrong = "hwile" and right = "while"
-  or
-  wrong = "hwole" and right = "whole"
-  or
-  wrong = "hydogen" and right = "hydrogen"
-  or
-  wrong = "hydropile" and right = "hydrophile"
-  or
-  wrong = "hydropilic" and right = "hydrophilic"
-  or
-  wrong = "hydropobe" and right = "hydrophobe"
-  or
-  wrong = "hydropobic" and right = "hydrophobic"
-  or
-  wrong = "hygeine" and right = "hygiene"
-  or
-  wrong = "hyjack" and right = "hijack"
-  or
-  wrong = "hyjacking" and right = "hijacking"
-  or
-  wrong = "hypocracy" and right = "hypocrisy"
-  or
-  wrong = "hypocrasy" and right = "hypocrisy"
-  or
-  wrong = "hypocricy" and right = "hypocrisy"
-  or
-  wrong = "hypocrit" and right = "hypocrite"
-  or
-  wrong = "hypocrits" and right = "hypocrites"
-  or
-  wrong = "iconclastic" and right = "iconoclastic"
-  or
-  wrong = "idaeidae" and right = "idea"
-  or
-  wrong = "idaes" and right = "ideas"
-  or
-  wrong = "idealogies" and right = "ideologies"
-  or
-  wrong = "idealogy" and right = "ideology"
-  or
-  wrong = "identicial" and right = "identical"
-  or
-  wrong = "identifers" and right = "identifiers"
-  or
-  wrong = "ideosyncratic" and right = "idiosyncratic"
-  or
-  wrong = "idesa" and right = "ideas"
-  or
-  wrong = "idesa" and right = "ides"
-  or
-  wrong = "idiosyncracy" and right = "idiosyncrasy"
-  or
-  wrong = "ihaca" and right = "ithaca"
-  or
-  wrong = "illegimacy" and right = "illegitimacy"
-  or
-  wrong = "illegitmate" and right = "illegitimate"
-  or
-  wrong = "illess" and right = "illness"
-  or
-  wrong = "illiegal" and right = "illegal"
-  or
-  wrong = "illution" and right = "illusion"
-  or
-  wrong = "ilness" and right = "illness"
-  or
-  wrong = "ilogical" and right = "illogical"
-  or
-  wrong = "imagenary" and right = "imaginary"
-  or
-  wrong = "imagin" and right = "imagine"
-  or
-  wrong = "imaginery" and right = "imagery"
-  or
-  wrong = "imaginery" and right = "imaginary"
-  or
-  wrong = "imanent" and right = "eminent"
-  or
-  wrong = "imanent" and right = "imminent"
-  or
-  wrong = "imcomplete" and right = "incomplete"
-  or
-  wrong = "imediately" and right = "immediately"
-  or
-  wrong = "imense" and right = "immense"
-  or
-  wrong = "imigrant" and right = "emigrant"
-  or
-  wrong = "imigrant" and right = "immigrant"
-  or
-  wrong = "imigrated" and right = "emigrated"
-  or
-  wrong = "imigrated" and right = "immigrated"
-  or
-  wrong = "imigration" and right = "emigration"
-  or
-  wrong = "imigration" and right = "immigration"
-  or
-  wrong = "iminent" and right = "eminent"
-  or
-  wrong = "iminent" and right = "immanent"
-  or
-  wrong = "iminent" and right = "imminent"
-  or
-  wrong = "immediatley" and right = "immediately"
-  or
-  wrong = "immediatly" and right = "immediately"
-  or
-  wrong = "immidately" and right = "immediately"
-  or
-  wrong = "immidiately" and right = "immediately"
-  or
-  wrong = "immitate" and right = "imitate"
-  or
-  wrong = "immitated" and right = "imitated"
-  or
-  wrong = "immitating" and right = "imitating"
-  or
-  wrong = "immitator" and right = "imitator"
-  or
-  wrong = "immunosupressant" and right = "immunosuppressant"
-  or
-  wrong = "impecabbly" and right = "impeccably"
-  or
-  wrong = "impedence" and right = "impedance"
-  or
-  wrong = "implamenting" and right = "implementing"
-  or
-  wrong = "impliment" and right = "implement"
-  or
-  wrong = "implimented" and right = "implemented"
-  or
-  wrong = "imploys" and right = "employs"
-  or
-  wrong = "importamt" and right = "important"
-  or
-  wrong = "impressario" and right = "impresario"
-  or
-  wrong = "imprioned" and right = "imprisoned"
-  or
-  wrong = "imprisonned" and right = "imprisoned"
-  or
-  wrong = "improvision" and right = "improvisation"
-  or
-  wrong = "improvments" and right = "improvements"
-  or
-  wrong = "inablility" and right = "inability"
-  or
-  wrong = "inaccessable" and right = "inaccessible"
-  or
-  wrong = "inadiquate" and right = "inadequate"
-  or
-  wrong = "inadquate" and right = "inadequate"
-  or
-  wrong = "inadvertant" and right = "inadvertent"
-  or
-  wrong = "inadvertantly" and right = "inadvertently"
-  or
-  wrong = "inagurated" and right = "inaugurated"
-  or
-  wrong = "inaguration" and right = "inauguration"
-  or
-  wrong = "inappropiate" and right = "inappropriate"
-  or
-  wrong = "inaugures" and right = "inaugurates"
-  or
-  wrong = "inbalance" and right = "imbalance"
-  or
-  wrong = "inbalanced" and right = "imbalanced"
-  or
-  wrong = "inbetween" and right = "between"
-  or
-  wrong = "incarcirated" and right = "incarcerated"
-  or
-  wrong = "incidentially" and right = "incidentally"
-  or
-  wrong = "incidently" and right = "incidentally"
-  or
-  wrong = "inclreased" and right = "increased"
-  or
-  wrong = "includ" and right = "include"
-  or
-  wrong = "includng" and right = "including"
-  or
-  wrong = "incompatabilities" and right = "incompatibilities"
-  or
-  wrong = "incompatability" and right = "incompatibility"
-  or
-  wrong = "incompatable" and right = "incompatible"
-  or
-  wrong = "incompatablities" and right = "incompatibilities"
-  or
-  wrong = "incompatablity" and right = "incompatibility"
-  or
-  wrong = "incompatiblities" and right = "incompatibilities"
-  or
-  wrong = "incompatiblity" and right = "incompatibility"
-  or
-  wrong = "incompetance" and right = "incompetence"
-  or
-  wrong = "incompetant" and right = "incompetent"
-  or
-  wrong = "incomptable" and right = "incompatible"
-  or
-  wrong = "incomptetent" and right = "incompetent"
-  or
-  wrong = "inconsistant" and right = "inconsistent"
-  or
-  wrong = "incoroporated" and right = "incorporated"
-  or
-  wrong = "incorperation" and right = "incorporation"
-  or
-  wrong = "incorportaed" and right = "incorporated"
-  or
-  wrong = "incorprates" and right = "incorporates"
-  or
-  wrong = "incorruptable" and right = "incorruptible"
-  or
-  wrong = "incramentally" and right = "incrementally"
-  or
-  wrong = "increadible" and right = "incredible"
-  or
-  wrong = "incredable" and right = "incredible"
-  or
-  wrong = "inctroduce" and right = "introduce"
-  or
-  wrong = "inctroduced" and right = "introduced"
-  or
-  wrong = "incuding" and right = "including"
-  or
-  wrong = "incunabla" and right = "incunabula"
-  or
-  wrong = "indefinately" and right = "indefinitely"
-  or
-  wrong = "indefineable" and right = "undefinable"
-  or
-  wrong = "indefinitly" and right = "indefinitely"
-  or
-  wrong = "indentical" and right = "identical"
-  or
-  wrong = "indepedantly" and right = "independently"
-  or
-  wrong = "indepedence" and right = "independence"
-  or
-  wrong = "independance" and right = "independence"
-  or
-  wrong = "independant" and right = "independent"
-  or
-  wrong = "independantly" and right = "independently"
-  or
-  wrong = "independece" and right = "independence"
-  or
-  wrong = "independendet" and right = "independent"
-  or
-  wrong = "indespensable" and right = "indispensable"
-  or
-  wrong = "indespensible" and right = "indispensable"
-  or
-  wrong = "indictement" and right = "indictment"
-  or
-  wrong = "indigineous" and right = "indigenous"
-  or
-  wrong = "indipendence" and right = "independence"
-  or
-  wrong = "indipendent" and right = "independent"
-  or
-  wrong = "indipendently" and right = "independently"
-  or
-  wrong = "indispensible" and right = "indispensable"
-  or
-  wrong = "indisputible" and right = "indisputable"
-  or
-  wrong = "indisputibly" and right = "indisputably"
-  or
-  wrong = "indite" and right = "indict"
-  or
-  wrong = "individualy" and right = "individually"
-  or
-  wrong = "indpendent" and right = "independent"
-  or
-  wrong = "indpendently" and right = "independently"
-  or
-  wrong = "indulgue" and right = "indulge"
-  or
-  wrong = "indutrial" and right = "industrial"
-  or
-  wrong = "indviduals" and right = "individuals"
-  or
-  wrong = "inefficienty" and right = "inefficiently"
-  or
-  wrong = "inevatible" and right = "inevitable"
-  or
-  wrong = "inevitible" and right = "inevitable"
-  or
-  wrong = "inevititably" and right = "inevitably"
-  or
-  wrong = "infalability" and right = "infallibility"
-  or
-  wrong = "infallable" and right = "infallible"
-  or
-  wrong = "infectuous" and right = "infectious"
-  or
-  wrong = "infered" and right = "inferred"
-  or
-  wrong = "infilitrate" and right = "infiltrate"
-  or
-  wrong = "infilitrated" and right = "infiltrated"
-  or
-  wrong = "infilitration" and right = "infiltration"
-  or
-  wrong = "infinit" and right = "infinite"
-  or
-  wrong = "inflamation" and right = "inflammation"
-  or
-  wrong = "influencial" and right = "influential"
-  or
-  wrong = "influented" and right = "influenced"
-  or
-  wrong = "infomation" and right = "information"
-  or
-  wrong = "informtion" and right = "information"
-  or
-  wrong = "infrantryman" and right = "infantryman"
-  or
-  wrong = "infrigement" and right = "infringement"
-  or
-  wrong = "ingenius" and right = "ingenious"
-  or
-  wrong = "ingreediants" and right = "ingredients"
-  or
-  wrong = "inhabitans" and right = "inhabitants"
-  or
-  wrong = "inherantly" and right = "inherently"
-  or
-  wrong = "inheritage" and right = "heritage"
-  or
-  wrong = "inheritage" and right = "inheritance"
-  or
-  wrong = "inheritence" and right = "inheritance"
-  or
-  wrong = "inital" and right = "initial"
-  or
-  wrong = "initalize" and right = "initialize"
-  or
-  wrong = "initally" and right = "initially"
-  or
-  wrong = "initation" and right = "initiation"
-  or
-  wrong = "initiaitive" and right = "initiative"
-  or
-  wrong = "inlcuding" and right = "including"
-  or
-  wrong = "inmigrant" and right = "immigrant"
-  or
-  wrong = "inmigrants" and right = "immigrants"
-  or
-  wrong = "innoculated" and right = "inoculated"
-  or
-  wrong = "inocence" and right = "innocence"
-  or
-  wrong = "inofficial" and right = "unofficial"
-  or
-  wrong = "inot" and right = "into"
-  or
-  wrong = "inpeach" and right = "impeach"
-  or
-  wrong = "inpending" and right = "impending"
-  or
-  wrong = "inpenetrable" and right = "impenetrable"
-  or
-  wrong = "inpolite" and right = "impolite"
-  or
-  wrong = "inprisonment" and right = "imprisonment"
-  or
-  wrong = "inproving" and right = "improving"
-  or
-  wrong = "insectiverous" and right = "insectivorous"
-  or
-  wrong = "insensative" and right = "insensitive"
-  or
-  wrong = "inseperable" and right = "inseparable"
-  or
-  wrong = "insistance" and right = "insistence"
-  or
-  wrong = "insitution" and right = "institution"
-  or
-  wrong = "insitutions" and right = "institutions"
-  or
-  wrong = "inspite" and right = "inspire"
-  or
-  wrong = "instade" and right = "instead"
-  or
-  wrong = "instatance" and right = "instance"
-  or
-  wrong = "institue" and right = "institute"
-  or
-  wrong = "instuction" and right = "instruction"
-  or
-  wrong = "instuments" and right = "instruments"
-  or
-  wrong = "instutionalized" and right = "institutionalized"
-  or
-  wrong = "instutions" and right = "intuitions"
-  or
-  wrong = "insurence" and right = "insurance"
-  or
-  wrong = "intelectual" and right = "intellectual"
-  or
-  wrong = "inteligence" and right = "intelligence"
-  or
-  wrong = "inteligent" and right = "intelligent"
-  or
-  wrong = "intenational" and right = "international"
-  or
-  wrong = "intented" and right = "indented"
-  or
-  wrong = "intented" and right = "intended"
-  or
-  wrong = "intepretation" and right = "interpretation"
-  or
-  wrong = "intepretator" and right = "interpretor"
-  or
-  wrong = "interational" and right = "international"
-  or
-  wrong = "interbread" and right = "interbred"
-  or
-  wrong = "interbread" and right = "interbreed"
-  or
-  wrong = "interchangable" and right = "interchangeable"
-  or
-  wrong = "interchangably" and right = "interchangeably"
-  or
-  wrong = "intercontinential" and right = "intercontinental"
-  or
-  wrong = "intercontinetal" and right = "intercontinental"
-  or
-  wrong = "intered" and right = "interned"
-  or
-  wrong = "intered" and right = "interred"
-  or
-  wrong = "interelated" and right = "interrelated"
-  or
-  wrong = "interferance" and right = "interference"
-  or
-  wrong = "interfereing" and right = "interfering"
-  or
-  wrong = "intergrated" and right = "integrated"
-  or
-  wrong = "intergration" and right = "integration"
-  or
-  wrong = "interm" and right = "interim"
-  or
-  wrong = "internation" and right = "international"
-  or
-  wrong = "interpet" and right = "interpret"
-  or
-  wrong = "interrim" and right = "interim"
-  or
-  wrong = "interrugum" and right = "interregnum"
-  or
-  wrong = "intertaining" and right = "entertaining"
-  or
-  wrong = "interupt" and right = "interrupt"
-  or
-  wrong = "intervines" and right = "intervenes"
-  or
-  wrong = "intevene" and right = "intervene"
-  or
-  wrong = "intial" and right = "initial"
-  or
-  wrong = "intialize" and right = "initialize"
-  or
-  wrong = "intialized" and right = "initialized"
-  or
-  wrong = "intially" and right = "initially"
-  or
-  wrong = "intrduced" and right = "introduced"
-  or
-  wrong = "intrest" and right = "interest"
-  or
-  wrong = "introdued" and right = "introduced"
-  or
-  wrong = "intruduced" and right = "introduced"
-  or
-  wrong = "intrument" and right = "instrument"
-  or
-  wrong = "intrumental" and right = "instrumental"
-  or
-  wrong = "intruments" and right = "instruments"
-  or
-  wrong = "intrusted" and right = "entrusted"
-  or
-  wrong = "intutive" and right = "intuitive"
-  or
-  wrong = "intutively" and right = "intuitively"
-  or
-  wrong = "inudstry" and right = "industry"
-  or
-  wrong = "inumerable" and right = "enumerable"
-  or
-  wrong = "inumerable" and right = "innumerable"
-  or
-  wrong = "inventer" and right = "inventor"
-  or
-  wrong = "invertibrates" and right = "invertebrates"
-  or
-  wrong = "investingate" and right = "investigate"
-  or
-  wrong = "involvment" and right = "involvement"
-  or
-  wrong = "irelevent" and right = "irrelevant"
-  or
-  wrong = "iresistable" and right = "irresistible"
-  or
-  wrong = "iresistably" and right = "irresistibly"
-  or
-  wrong = "iresistible" and right = "irresistible"
-  or
-  wrong = "iresistibly" and right = "irresistibly"
-  or
-  wrong = "iritable" and right = "irritable"
-  or
-  wrong = "iritated" and right = "irritated"
-  or
-  wrong = "ironicly" and right = "ironically"
-  or
-  wrong = "irregardless" and right = "regardless"
-  or
-  wrong = "irrelevent" and right = "irrelevant"
-  or
-  wrong = "irreplacable" and right = "irreplaceable"
-  or
-  wrong = "irresistable" and right = "irresistible"
-  or
-  wrong = "irresistably" and right = "irresistibly"
-  or
-  wrong = "israelies" and right = "israelis"
-  or
-  wrong = "issueing" and right = "issuing"
-  or
-  wrong = "itnroduced" and right = "introduced"
-  or
-  wrong = "iunior" and right = "junior"
-  or
-  wrong = "iwll" and right = "will"
-  or
-  wrong = "iwth" and right = "with"
-  or
-  wrong = "janurary" and right = "january"
-  or
-  wrong = "januray" and right = "january"
-  or
-  wrong = "japanes" and right = "japanese"
-  or
-  wrong = "jaques" and right = "jacques"
-  or
-  wrong = "jeapardy" and right = "jeopardy"
-  or
-  wrong = "jewllery" and right = "jewellery"
-  or
-  wrong = "johanine" and right = "johannine"
-  or
-  wrong = "jorunal" and right = "journal"
-  or
-  wrong = "jospeh" and right = "joseph"
-  or
-  wrong = "jouney" and right = "journey"
-  or
-  wrong = "journied" and right = "journeyed"
-  or
-  wrong = "journies" and right = "journeys"
-  or
-  wrong = "jstu" and right = "just"
-  or
-  wrong = "jsut" and right = "just"
-  or
-  wrong = "juadaism" and right = "judaism"
-  or
-  wrong = "juadism" and right = "judaism"
-  or
-  wrong = "judical" and right = "judicial"
-  or
-  wrong = "judisuary" and right = "judiciary"
-  or
-  wrong = "juducial" and right = "judicial"
-  or
-  wrong = "juristiction" and right = "jurisdiction"
-  or
-  wrong = "juristictions" and right = "jurisdictions"
-  or
-  wrong = "kindergarden" and right = "kindergarten"
-  or
-  wrong = "klenex" and right = "kleenex"
-  or
-  wrong = "knifes" and right = "knives"
-  or
-  wrong = "knive" and right = "knife"
-  or
-  wrong = "knowlege" and right = "knowledge"
-  or
-  wrong = "knowlegeable" and right = "knowledgeable"
-  or
-  wrong = "knwo" and right = "know"
-  or
-  wrong = "knwos" and right = "knows"
-  or
-  wrong = "konw" and right = "know"
-  or
-  wrong = "konws" and right = "knows"
-  or
-  wrong = "kwno" and right = "know"
-  or
-  wrong = "labatory" and right = "laboratory"
-  or
-  wrong = "labatory" and right = "lavatory"
-  or
-  wrong = "labled" and right = "labeled"
-  or
-  wrong = "labled" and right = "labelled"
-  or
-  wrong = "labratory" and right = "laboratory"
-  or
-  wrong = "laguage" and right = "language"
-  or
-  wrong = "laguages" and right = "languages"
-  or
-  wrong = "langage" and right = "language"
-  or
-  wrong = "langauge" and right = "language"
-  or
-  wrong = "larg" and right = "large"
-  or
-  wrong = "largst" and right = "largest"
-  or
-  wrong = "larrry" and right = "larry"
-  or
-  wrong = "lastr" and right = "last"
-  or
-  wrong = "lattitude" and right = "latitude"
-  or
-  wrong = "launchs" and right = "launch"
-  or
-  wrong = "launchs" and right = "launches"
-  or
-  wrong = "launhed" and right = "launched"
-  or
-  wrong = "lavae" and right = "larvae"
-  or
-  wrong = "layed" and right = "laid"
-  or
-  wrong = "lazyness" and right = "laziness"
-  or
-  wrong = "leage" and right = "league"
-  or
-  wrong = "leanr" and right = "lean"
-  or
-  wrong = "leanr" and right = "leaner"
-  or
-  wrong = "leanr" and right = "learn"
-  or
-  wrong = "leathal" and right = "lethal"
-  or
-  wrong = "lefted" and right = "left"
-  or
-  wrong = "legitamate" and right = "legitimate"
-  or
-  wrong = "legitmate" and right = "legitimate"
-  or
-  wrong = "leibnitz" and right = "leibniz"
-  or
-  wrong = "lengh" and right = "length"
-  or
-  wrong = "lenght" and right = "length"
-  or
-  wrong = "lengt" and right = "length"
-  or
-  wrong = "lenth" and right = "length"
-  or
-  wrong = "leran" and right = "learn"
-  or
-  wrong = "lerans" and right = "learns"
-  or
-  wrong = "leutenant" and right = "lieutenant"
-  or
-  wrong = "levetate" and right = "levitate"
-  or
-  wrong = "levetated" and right = "levitated"
-  or
-  wrong = "levetates" and right = "levitates"
-  or
-  wrong = "levetating" and right = "levitating"
-  or
-  wrong = "levle" and right = "level"
-  or
-  wrong = "liasion" and right = "liaison"
-  or
-  wrong = "liason" and right = "liaison"
-  or
-  wrong = "liasons" and right = "liaisons"
-  or
-  wrong = "libaries" and right = "libraries"
-  or
-  wrong = "libary" and right = "library"
-  or
-  wrong = "libell" and right = "libel"
-  or
-  wrong = "libguistic" and right = "linguistic"
-  or
-  wrong = "libguistics" and right = "linguistics"
-  or
-  wrong = "libitarianisn" and right = "libertarianism"
-  or
-  wrong = "lible" and right = "liable"
-  or
-  wrong = "lible" and right = "libel"
-  or
-  wrong = "lieing" and right = "lying"
-  or
-  wrong = "liek" and right = "like"
-  or
-  wrong = "liekd" and right = "liked"
-  or
-  wrong = "liesure" and right = "leisure"
-  or
-  wrong = "lieuenant" and right = "lieutenant"
-  or
-  wrong = "lieved" and right = "lived"
-  or
-  wrong = "liftime" and right = "lifetime"
-  or
-  wrong = "likelyhood" and right = "likelihood"
-  or
-  wrong = "linnaena" and right = "linnaean"
-  or
-  wrong = "lippizaner" and right = "lipizzaner"
-  or
-  wrong = "liquify" and right = "liquefy"
-  or
-  wrong = "liscense" and right = "licence"
-  or
-  wrong = "liscense" and right = "license"
-  or
-  wrong = "lisence" and right = "licence"
-  or
-  wrong = "lisence" and right = "license"
-  or
-  wrong = "lisense" and right = "licence"
-  or
-  wrong = "lisense" and right = "license"
-  or
-  wrong = "listners" and right = "listeners"
-  or
-  wrong = "litature" and right = "literature"
-  or
-  wrong = "literaly" and right = "literally"
-  or
-  wrong = "literture" and right = "literature"
-  or
-  wrong = "littel" and right = "little"
-  or
-  wrong = "litterally" and right = "literally"
-  or
-  wrong = "liuke" and right = "like"
-  or
-  wrong = "livley" and right = "lively"
-  or
-  wrong = "lmits" and right = "limits"
-  or
-  wrong = "loev" and right = "love"
-  or
-  wrong = "lonelyness" and right = "loneliness"
-  or
-  wrong = "longitudonal" and right = "longitudinal"
-  or
-  wrong = "lonley" and right = "lonely"
-  or
-  wrong = "lonly" and right = "lonely"
-  or
-  wrong = "lonly" and right = "only"
-  or
-  wrong = "loosing" and right = "losing"
-  or
-  wrong = "lotharingen" and right = "lothringen"
-  or
-  wrong = "lsat" and right = "last"
-  or
-  wrong = "lukid" and right = "likud"
-  or
-  wrong = "lveo" and right = "love"
-  or
-  wrong = "lvoe" and right = "love"
-  or
-  wrong = "lybia" and right = "libya"
-  or
-  wrong = "maching" and right = "machine"
-  or
-  wrong = "maching" and right = "marching"
-  or
-  wrong = "maching" and right = "matching"
-  or
-  wrong = "mackeral" and right = "mackerel"
-  or
-  wrong = "magasine" and right = "magazine"
-  or
-  wrong = "magincian" and right = "magician"
-  or
-  wrong = "magisine" and right = "magazine"
-  or
-  wrong = "magizine" and right = "magazine"
-  or
-  wrong = "magnificient" and right = "magnificent"
-  or
-  wrong = "magolia" and right = "magnolia"
-  or
-  wrong = "mailny" and right = "mainly"
-  or
-  wrong = "maintainance" and right = "maintenance"
-  or
-  wrong = "maintainence" and right = "maintenance"
-  or
-  wrong = "maintance" and right = "maintenance"
-  or
-  wrong = "maintenence" and right = "maintenance"
-  or
-  wrong = "maintinaing" and right = "maintaining"
-  or
-  wrong = "maintioned" and right = "mentioned"
-  or
-  wrong = "majoroty" and right = "majority"
-  or
-  wrong = "maked" and right = "made"
-  or
-  wrong = "maked" and right = "marked"
-  or
-  wrong = "makse" and right = "makes"
-  or
-  wrong = "malcom" and right = "malcolm"
-  or
-  wrong = "maltesian" and right = "maltese"
-  or
-  wrong = "mamal" and right = "mammal"
-  or
-  wrong = "mamalian" and right = "mammalian"
-  or
-  wrong = "managable" and right = "manageable"
-  or
-  wrong = "managable" and right = "manageably"
-  or
-  wrong = "managment" and right = "management"
-  or
-  wrong = "maneouvre" and right = "manoeuvre"
-  or
-  wrong = "maneouvred" and right = "manoeuvred"
-  or
-  wrong = "maneouvres" and right = "manoeuvres"
-  or
-  wrong = "maneouvring" and right = "manoeuvring"
-  or
-  wrong = "manisfestations" and right = "manifestations"
-  or
-  wrong = "manoeuverability" and right = "maneuverability"
-  or
-  wrong = "manouver" and right = "maneuver"
-  or
-  wrong = "manouver" and right = "manoeuvre"
-  or
-  wrong = "manouverability" and right = "maneuverability"
-  or
-  wrong = "manouverability" and right = "manoeuverability"
-  or
-  wrong = "manouverability" and right = "manoeuvrability"
-  or
-  wrong = "manouverable" and right = "maneuverable"
-  or
-  wrong = "manouverable" and right = "manoeuvrable"
-  or
-  wrong = "manouvers" and right = "maneuvers"
-  or
-  wrong = "manouvers" and right = "manoeuvres"
-  or
-  wrong = "mantained" and right = "maintained"
-  or
-  wrong = "manuever" and right = "maneuver"
-  or
-  wrong = "manuever" and right = "manoeuvre"
-  or
-  wrong = "manuevers" and right = "maneuvers"
-  or
-  wrong = "manuevers" and right = "manoeuvres"
-  or
-  wrong = "manufacturedd" and right = "manufactured"
-  or
-  wrong = "manufature" and right = "manufacture"
-  or
-  wrong = "manufatured" and right = "manufactured"
-  or
-  wrong = "manufaturing" and right = "manufacturing"
-  or
-  wrong = "manuver" and right = "maneuver"
-  or
-  wrong = "mariage" and right = "marriage"
-  or
-  wrong = "marjority" and right = "majority"
-  or
-  wrong = "markes" and right = "marks"
-  or
-  wrong = "marketting" and right = "marketing"
-  or
-  wrong = "marmelade" and right = "marmalade"
-  or
-  wrong = "marrage" and right = "marriage"
-  or
-  wrong = "marraige" and right = "marriage"
-  or
-  wrong = "marrtyred" and right = "martyred"
-  or
-  wrong = "marryied" and right = "married"
-  or
-  wrong = "massachussets" and right = "massachusetts"
-  or
-  wrong = "massachussetts" and right = "massachusetts"
-  or
-  wrong = "masterbation" and right = "masturbation"
-  or
-  wrong = "mataphysical" and right = "metaphysical"
-  or
-  wrong = "materalists" and right = "materialist"
-  or
-  wrong = "mathamatics" and right = "mathematics"
-  or
-  wrong = "mathematican" and right = "mathematician"
-  or
-  wrong = "mathematicas" and right = "mathematics"
-  or
-  wrong = "matheticians" and right = "mathematicians"
-  or
-  wrong = "mathmatically" and right = "mathematically"
-  or
-  wrong = "mathmatician" and right = "mathematician"
-  or
-  wrong = "mathmaticians" and right = "mathematicians"
-  or
-  wrong = "mccarthyst" and right = "mccarthyist"
-  or
-  wrong = "mchanics" and right = "mechanics"
-  or
-  wrong = "meaninng" and right = "meaning"
-  or
-  wrong = "mear" and right = "mare"
-  or
-  wrong = "mear" and right = "mere"
-  or
-  wrong = "mear" and right = "wear"
-  or
-  wrong = "mechandise" and right = "merchandise"
-  or
-  wrong = "medacine" and right = "medicine"
-  or
-  wrong = "medeival" and right = "medieval"
-  or
-  wrong = "medevial" and right = "medieval"
-  or
-  wrong = "mediciney" and right = "mediciny"
-  or
-  wrong = "medievel" and right = "medieval"
-  or
-  wrong = "mediterainnean" and right = "mediterranean"
-  or
-  wrong = "mediteranean" and right = "mediterranean"
-  or
-  wrong = "meerkrat" and right = "meerkat"
-  or
-  wrong = "melieux" and right = "milieux"
-  or
-  wrong = "membranaphone" and right = "membranophone"
-  or
-  wrong = "memeber" and right = "member"
-  or
-  wrong = "menally" and right = "mentally"
-  or
-  wrong = "meranda" and right = "miranda"
-  or
-  wrong = "meranda" and right = "veranda"
-  or
-  wrong = "mercentile" and right = "mercantile"
-  or
-  wrong = "mesage" and right = "message"
-  or
-  wrong = "messanger" and right = "messenger"
-  or
-  wrong = "messenging" and right = "messaging"
-  or
-  wrong = "messsage" and right = "message"
-  or
-  wrong = "metalic" and right = "metallic"
-  or
-  wrong = "metalurgic" and right = "metallurgic"
-  or
-  wrong = "metalurgical" and right = "metallurgical"
-  or
-  wrong = "metalurgy" and right = "metallurgy"
-  or
-  wrong = "metamorphysis" and right = "metamorphosis"
-  or
-  wrong = "metaphoricial" and right = "metaphorical"
-  or
-  wrong = "meterologist" and right = "meteorologist"
-  or
-  wrong = "meterology" and right = "meteorology"
-  or
-  wrong = "methaphor" and right = "metaphor"
-  or
-  wrong = "methaphors" and right = "metaphors"
-  or
-  wrong = "michagan" and right = "michigan"
-  or
-  wrong = "micoscopy" and right = "microscopy"
-  or
-  wrong = "midwifes" and right = "midwives"
-  or
-  wrong = "mileau" and right = "milieu"
-  or
-  wrong = "milennia" and right = "millennia"
-  or
-  wrong = "milennium" and right = "millennium"
-  or
-  wrong = "mileu" and right = "milieu"
-  or
-  wrong = "miliary" and right = "military"
-  or
-  wrong = "miligram" and right = "milligram"
-  or
-  wrong = "milion" and right = "million"
-  or
-  wrong = "miliraty" and right = "military"
-  or
-  wrong = "millenia" and right = "millennia"
-  or
-  wrong = "millenial" and right = "millennial"
-  or
-  wrong = "millenialism" and right = "millennialism"
-  or
-  wrong = "millenium" and right = "millennium"
-  or
-  wrong = "millepede" and right = "millipede"
-  or
-  wrong = "millioniare" and right = "millionaire"
-  or
-  wrong = "millitant" and right = "militant"
-  or
-  wrong = "millitary" and right = "military"
-  or
-  wrong = "millon" and right = "million"
-  or
-  wrong = "miltary" and right = "military"
-  or
-  wrong = "minature" and right = "miniature"
-  or
-  wrong = "minerial" and right = "mineral"
-  or
-  wrong = "ministery" and right = "ministry"
-  or
-  wrong = "minsitry" and right = "ministry"
-  or
-  wrong = "minstries" and right = "ministries"
-  or
-  wrong = "minstry" and right = "ministry"
-  or
-  wrong = "minumum" and right = "minimum"
-  or
-  wrong = "mirrorred" and right = "mirrored"
-  or
-  wrong = "miscelaneous" and right = "miscellaneous"
-  or
-  wrong = "miscellanious" and right = "miscellaneous"
-  or
-  wrong = "miscellanous" and right = "miscellaneous"
-  or
-  wrong = "mischeivous" and right = "mischievous"
-  or
-  wrong = "mischevious" and right = "mischievous"
-  or
-  wrong = "mischievious" and right = "mischievous"
-  or
-  wrong = "misdameanor" and right = "misdemeanor"
-  or
-  wrong = "misdameanors" and right = "misdemeanors"
-  or
-  wrong = "misdemenor" and right = "misdemeanor"
-  or
-  wrong = "misdemenors" and right = "misdemeanors"
-  or
-  wrong = "misfourtunes" and right = "misfortunes"
-  or
-  wrong = "misile" and right = "missile"
-  or
-  wrong = "misouri" and right = "missouri"
-  or
-  wrong = "mispell" and right = "misspell"
-  or
-  wrong = "mispelled" and right = "misspelled"
-  or
-  wrong = "mispelling" and right = "misspelling"
-  or
-  wrong = "missen" and right = "mizzen"
-  or
-  wrong = "missisipi" and right = "mississippi"
-  or
-  wrong = "missisippi" and right = "mississippi"
-  or
-  wrong = "missle" and right = "missile"
-  or
-  wrong = "missonary" and right = "missionary"
-  or
-  wrong = "misterious" and right = "mysterious"
-  or
-  wrong = "mistery" and right = "mystery"
-  or
-  wrong = "misteryous" and right = "mysterious"
-  or
-  wrong = "mkae" and right = "make"
-  or
-  wrong = "mkaes" and right = "makes"
-  or
-  wrong = "mkaing" and right = "making"
-  or
-  wrong = "mkea" and right = "make"
-  or
-  wrong = "moderm" and right = "modem"
-  or
-  wrong = "modle" and right = "model"
-  or
-  wrong = "moent" and right = "moment"
-  or
-  wrong = "moeny" and right = "money"
-  or
-  wrong = "mohammedans" and right = "muslims"
-  or
-  wrong = "moil" and right = "mohel"
-  or
-  wrong = "moil" and right = "soil"
-  or
-  wrong = "moleclues" and right = "molecules"
-  or
-  wrong = "momento" and right = "memento"
-  or
-  wrong = "monestaries" and right = "monasteries"
-  or
-  wrong = "monestary" and right = "monastery"
-  or
-  wrong = "monestary" and right = "monetary"
-  or
-  wrong = "monickers" and right = "monikers"
-  or
-  wrong = "monolite" and right = "monolithic"
-  or
-  wrong = "monserrat" and right = "montserrat"
-  or
-  wrong = "montains" and right = "mountains"
-  or
-  wrong = "montanous" and right = "mountainous"
-  or
-  wrong = "montnana" and right = "montana"
-  or
-  wrong = "monts" and right = "months"
-  or
-  wrong = "montypic" and right = "monotypic"
-  or
-  wrong = "moreso" and right = "more"
-  or
-  wrong = "morgage" and right = "mortgage"
-  or
-  wrong = "morisette" and right = "morissette"
-  or
-  wrong = "morrisette" and right = "morissette"
-  or
-  wrong = "morroccan" and right = "moroccan"
-  or
-  wrong = "morrocco" and right = "morocco"
-  or
-  wrong = "morroco" and right = "morocco"
-  or
-  wrong = "mortage" and right = "mortgage"
-  or
-  wrong = "mosture" and right = "moisture"
-  or
-  wrong = "motiviated" and right = "motivated"
-  or
-  wrong = "mounth" and right = "month"
-  or
-  wrong = "movei" and right = "movie"
-  or
-  wrong = "movment" and right = "movement"
-  or
-  wrong = "mroe" and right = "more"
-  or
-  wrong = "mucuous" and right = "mucous"
-  or
-  wrong = "muder" and right = "murder"
-  or
-  wrong = "mudering" and right = "murdering"
-  or
-  wrong = "muhammadan" and right = "muslim"
-  or
-  wrong = "multicultralism" and right = "multiculturalism"
-  or
-  wrong = "multipled" and right = "multiplied"
-  or
-  wrong = "multiplers" and right = "multipliers"
-  or
-  wrong = "munbers" and right = "numbers"
-  or
-  wrong = "muncipalities" and right = "municipalities"
-  or
-  wrong = "muncipality" and right = "municipality"
-  or
-  wrong = "munnicipality" and right = "municipality"
-  or
-  wrong = "muscels" and right = "muscles"
-  or
-  wrong = "muscels" and right = "mussels"
-  or
-  wrong = "muscial" and right = "musical"
-  or
-  wrong = "muscician" and right = "musician"
-  or
-  wrong = "muscicians" and right = "musicians"
-  or
-  wrong = "mutiliated" and right = "mutilated"
-  or
-  wrong = "mutiple" and right = "multiple"
-  or
-  wrong = "myraid" and right = "myriad"
-  or
-  wrong = "mysef" and right = "myself"
-  or
-  wrong = "mysogynist" and right = "misogynist"
-  or
-  wrong = "mysogyny" and right = "misogyny"
-  or
-  wrong = "mysterous" and right = "mysterious"
-  or
-  wrong = "mythraic" and right = "mithraic"
-  or
-  wrong = "naieve" and right = "naive"
-  or
-  wrong = "naploeon" and right = "napoleon"
-  or
-  wrong = "napolean" and right = "napoleon"
-  or
-  wrong = "napoleonian" and right = "napoleonic"
-  or
-  wrong = "naturaly" and right = "naturally"
-  or
-  wrong = "naturely" and right = "naturally"
-  or
-  wrong = "naturual" and right = "natural"
-  or
-  wrong = "naturually" and right = "naturally"
-  or
-  wrong = "nazereth" and right = "nazareth"
-  or
-  wrong = "neccesarily" and right = "necessarily"
-  or
-  wrong = "neccesary" and right = "necessary"
-  or
-  wrong = "neccessarily" and right = "necessarily"
-  or
-  wrong = "neccessary" and right = "necessary"
-  or
-  wrong = "neccessities" and right = "necessities"
-  or
-  wrong = "necesarily" and right = "necessarily"
-  or
-  wrong = "necesary" and right = "necessary"
-  or
-  wrong = "necessiate" and right = "necessitate"
-  or
-  wrong = "neglible" and right = "negligible"
-  or
-  wrong = "negligable" and right = "negligible"
-  or
-  wrong = "negociate" and right = "negotiate"
-  or
-  wrong = "negociation" and right = "negotiation"
-  or
-  wrong = "negociations" and right = "negotiations"
-  or
-  wrong = "negotation" and right = "negotiation"
-  or
-  wrong = "neice" and right = "nice"
-  or
-  wrong = "neice" and right = "niece"
-  or
-  wrong = "neigborhood" and right = "neighborhood"
-  or
-  wrong = "neigbour" and right = "neighbor"
-  or
-  wrong = "neigbour" and right = "neighbour"
-  or
-  wrong = "neigbourhood" and right = "neighbourhood"
-  or
-  wrong = "neigbouring" and right = "neighboring"
-  or
-  wrong = "neigbouring" and right = "neighbouring"
-  or
-  wrong = "neigbours" and right = "neighbors"
-  or
-  wrong = "neigbours" and right = "neighbours"
-  or
-  wrong = "neolitic" and right = "neolithic"
-  or
-  wrong = "nessasarily" and right = "necessarily"
-  or
-  wrong = "nessecary" and right = "necessary"
-  or
-  wrong = "nestin" and right = "nesting"
-  or
-  wrong = "neverthless" and right = "nevertheless"
-  or
-  wrong = "newletters" and right = "newsletters"
-  or
-  wrong = "nickle" and right = "nickel"
-  or
-  wrong = "nightime" and right = "nighttime"
-  or
-  wrong = "nineth" and right = "ninth"
-  or
-  wrong = "ninteenth" and right = "nineteenth"
-  or
-  wrong = "ninty" and right = "ninety"
-  or
-  wrong = "nkow" and right = "know"
-  or
-  wrong = "nkwo" and right = "know"
-  or
-  wrong = "nmae" and right = "name"
-  or
-  wrong = "noncombatents" and right = "noncombatants"
-  or
-  wrong = "nonsence" and right = "nonsense"
-  or
-  wrong = "nontheless" and right = "nonetheless"
-  or
-  wrong = "norhern" and right = "northern"
-  or
-  wrong = "northen" and right = "northern"
-  or
-  wrong = "northereastern" and right = "northeastern"
-  or
-  wrong = "notabley" and right = "notably"
-  or
-  wrong = "noteable" and right = "notable"
-  or
-  wrong = "noteably" and right = "notably"
-  or
-  wrong = "noteriety" and right = "notoriety"
-  or
-  wrong = "noth" and right = "north"
-  or
-  wrong = "nothern" and right = "northern"
-  or
-  wrong = "noticable" and right = "noticeable"
-  or
-  wrong = "noticably" and right = "noticeably"
-  or
-  wrong = "notications" and right = "notifications"
-  or
-  wrong = "noticeing" and right = "noticing"
-  or
-  wrong = "noticible" and right = "noticeable"
-  or
-  wrong = "notwhithstanding" and right = "notwithstanding"
-  or
-  wrong = "noveau" and right = "nouveau"
-  or
-  wrong = "novermber" and right = "november"
-  or
-  wrong = "nowdays" and right = "nowadays"
-  or
-  wrong = "nowe" and right = "now"
-  or
-  wrong = "nto" and right = "not"
-  or
-  wrong = "nubmer" and right = "number"
-  or
-  wrong = "nucular" and right = "nuclear"
-  or
-  wrong = "nuculear" and right = "nuclear"
-  or
-  wrong = "nuisanse" and right = "nuisance"
-  or
-  wrong = "nullabour" and right = "nullarbor"
-  or
-  wrong = "numberous" and right = "numerous"
-  or
-  wrong = "nuremburg" and right = "nuremberg"
-  or
-  wrong = "nusance" and right = "nuisance"
-  or
-  wrong = "nutritent" and right = "nutrient"
-  or
-  wrong = "nutritents" and right = "nutrients"
-  or
-  wrong = "nuturing" and right = "nurturing"
-  or
-  wrong = "obect" and right = "object"
-  or
-  wrong = "obediance" and right = "obedience"
-  or
-  wrong = "obediant" and right = "obedient"
-  or
-  wrong = "obejct" and right = "object"
-  or
-  wrong = "obession" and right = "obsession"
-  or
-  wrong = "obssessed" and right = "obsessed"
-  or
-  wrong = "obstacal" and right = "obstacle"
-  or
-  wrong = "obstancles" and right = "obstacles"
-  or
-  wrong = "obstruced" and right = "obstructed"
-  or
-  wrong = "ocasion" and right = "occasion"
-  or
-  wrong = "ocasional" and right = "occasional"
-  or
-  wrong = "ocasionally" and right = "occasionally"
-  or
-  wrong = "ocasionaly" and right = "occasionally"
-  or
-  wrong = "ocasioned" and right = "occasioned"
-  or
-  wrong = "ocasions" and right = "occasions"
-  or
-  wrong = "ocassion" and right = "occasion"
-  or
-  wrong = "ocassional" and right = "occasional"
-  or
-  wrong = "ocassionally" and right = "occasionally"
-  or
-  wrong = "ocassionaly" and right = "occasionally"
-  or
-  wrong = "ocassioned" and right = "occasioned"
-  or
-  wrong = "ocassions" and right = "occasions"
-  or
-  wrong = "occaison" and right = "occasion"
-  or
-  wrong = "occassion" and right = "occasion"
-  or
-  wrong = "occassional" and right = "occasional"
-  or
-  wrong = "occassionally" and right = "occasionally"
-  or
-  wrong = "occassionaly" and right = "occasionally"
-  or
-  wrong = "occassioned" and right = "occasioned"
-  or
-  wrong = "occassions" and right = "occasions"
-  or
-  wrong = "occationally" and right = "occasionally"
-  or
-  wrong = "occour" and right = "occur"
-  or
-  wrong = "occurance" and right = "occurrence"
-  or
-  wrong = "occurances" and right = "occurrences"
-  or
-  wrong = "occured" and right = "occurred"
-  or
-  wrong = "occurence" and right = "occurrence"
-  or
-  wrong = "occurences" and right = "occurrences"
-  or
-  wrong = "occuring" and right = "occurring"
-  or
-  wrong = "occurr" and right = "occur"
-  or
-  wrong = "occurrance" and right = "occurrence"
-  or
-  wrong = "occurrances" and right = "occurrences"
-  or
-  wrong = "octohedra" and right = "octahedra"
-  or
-  wrong = "octohedral" and right = "octahedral"
-  or
-  wrong = "octohedron" and right = "octahedron"
-  or
-  wrong = "ocuntries" and right = "countries"
-  or
-  wrong = "ocuntry" and right = "country"
-  or
-  wrong = "ocurr" and right = "occur"
-  or
-  wrong = "ocurrance" and right = "occurrence"
-  or
-  wrong = "ocurred" and right = "occurred"
-  or
-  wrong = "ocurrence" and right = "occurrence"
-  or
-  wrong = "offcers" and right = "officers"
-  or
-  wrong = "offcially" and right = "officially"
-  or
-  wrong = "offereings" and right = "offerings"
-  or
-  wrong = "offical" and right = "official"
-  or
-  wrong = "offically" and right = "officially"
-  or
-  wrong = "officals" and right = "officials"
-  or
-  wrong = "officaly" and right = "officially"
-  or
-  wrong = "officialy" and right = "officially"
-  or
-  wrong = "offred" and right = "offered"
-  or
-  wrong = "oftenly" and right = "often"
-  or
-  wrong = "oging" and right = "going"
-  or
-  wrong = "oging" and right = "ogling"
-  or
-  wrong = "oject" and right = "object"
-  or
-  wrong = "omision" and right = "omission"
-  or
-  wrong = "omited" and right = "omitted"
-  or
-  wrong = "omiting" and right = "omitting"
-  or
-  wrong = "omlette" and right = "omelette"
-  or
-  wrong = "ommision" and right = "omission"
-  or
-  wrong = "ommited" and right = "omitted"
-  or
-  wrong = "ommiting" and right = "omitting"
-  or
-  wrong = "ommitted" and right = "omitted"
-  or
-  wrong = "ommitting" and right = "omitting"
-  or
-  wrong = "omniverous" and right = "omnivorous"
-  or
-  wrong = "omniverously" and right = "omnivorously"
-  or
-  wrong = "omre" and right = "more"
-  or
-  wrong = "onot" and right = "not"
-  or
-  wrong = "onot" and right = "note"
-  or
-  wrong = "onyl" and right = "only"
-  or
-  wrong = "openess" and right = "openness"
-  or
-  wrong = "oponent" and right = "opponent"
-  or
-  wrong = "oportunity" and right = "opportunity"
-  or
-  wrong = "opose" and right = "oppose"
-  or
-  wrong = "oposite" and right = "opposite"
-  or
-  wrong = "oposition" and right = "opposition"
-  or
-  wrong = "oppenly" and right = "openly"
-  or
-  wrong = "oppinion" and right = "opinion"
-  or
-  wrong = "opponant" and right = "opponent"
-  or
-  wrong = "oppononent" and right = "opponent"
-  or
-  wrong = "oppositition" and right = "opposition"
-  or
-  wrong = "oppossed" and right = "opposed"
-  or
-  wrong = "opprotunity" and right = "opportunity"
-  or
-  wrong = "opression" and right = "oppression"
-  or
-  wrong = "opressive" and right = "oppressive"
-  or
-  wrong = "opthalmic" and right = "ophthalmic"
-  or
-  wrong = "opthalmologist" and right = "ophthalmologist"
-  or
-  wrong = "opthalmology" and right = "ophthalmology"
-  or
-  wrong = "opthamologist" and right = "ophthalmologist"
-  or
-  wrong = "optmizations" and right = "optimizations"
-  or
-  wrong = "optomism" and right = "optimism"
-  or
-  wrong = "orded" and right = "ordered"
-  or
-  wrong = "organim" and right = "organism"
-  or
-  wrong = "organistion" and right = "organisation"
-  or
-  wrong = "organiztion" and right = "organization"
-  or
-  wrong = "orgin" and right = "organ"
-  or
-  wrong = "orgin" and right = "origin"
-  or
-  wrong = "orginal" and right = "original"
-  or
-  wrong = "orginally" and right = "originally"
-  or
-  wrong = "orginize" and right = "organise"
-  or
-  wrong = "oridinarily" and right = "ordinarily"
-  or
-  wrong = "origanaly" and right = "originally"
-  or
-  wrong = "originall" and right = "original"
-  or
-  wrong = "originall" and right = "originally"
-  or
-  wrong = "originaly" and right = "originally"
-  or
-  wrong = "originially" and right = "originally"
-  or
-  wrong = "originnally" and right = "originally"
-  or
-  wrong = "origional" and right = "original"
-  or
-  wrong = "orignally" and right = "originally"
-  or
-  wrong = "orignially" and right = "originally"
-  or
-  wrong = "otehr" and right = "other"
-  or
-  wrong = "oublisher" and right = "publisher"
-  or
-  wrong = "ouevre" and right = "oeuvre"
-  or
-  wrong = "ouput" and right = "output"
-  or
-  wrong = "oustanding" and right = "outstanding"
-  or
-  wrong = "overriden" and right = "overridden"
-  or
-  wrong = "overshaddowed" and right = "overshadowed"
-  or
-  wrong = "overwelming" and right = "overwhelming"
-  or
-  wrong = "overwheliming" and right = "overwhelming"
-  or
-  wrong = "owrk" and right = "work"
-  or
-  wrong = "owudl" and right = "would"
-  or
-  wrong = "oxigen" and right = "oxygen"
-  or
-  wrong = "oximoron" and right = "oxymoron"
-  or
-  wrong = "p0enis" and right = "penis"
-  or
-  wrong = "paide" and right = "paid"
-  or
-  wrong = "paitience" and right = "patience"
-  or
-  wrong = "palce" and right = "palace"
-  or
-  wrong = "palce" and right = "place"
-  or
-  wrong = "paleolitic" and right = "paleolithic"
-  or
-  wrong = "paliamentarian" and right = "parliamentarian"
-  or
-  wrong = "palistian" and right = "palestinian"
-  or
-  wrong = "palistinian" and right = "palestinian"
-  or
-  wrong = "palistinians" and right = "palestinians"
-  or
-  wrong = "pallete" and right = "palette"
-  or
-  wrong = "pamflet" and right = "pamphlet"
-  or
-  wrong = "pamplet" and right = "pamphlet"
-  or
-  wrong = "pantomine" and right = "pantomime"
-  or
-  wrong = "papanicalou" and right = "papanicolaou"
-  or
-  wrong = "paralel" and right = "parallel"
-  or
-  wrong = "paralell" and right = "parallel"
-  or
-  wrong = "paralelly" and right = "parallelly"
-  or
-  wrong = "paralely" and right = "parallelly"
-  or
-  wrong = "parallely" and right = "parallelly"
-  or
-  wrong = "paramater" and right = "parameter"
-  or
-  wrong = "paramters" and right = "parameters"
-  or
-  wrong = "parametarized" and right = "parameterized"
-  or
-  wrong = "paranthesis" and right = "parenthesis"
-  or
-  wrong = "paraphenalia" and right = "paraphernalia"
-  or
-  wrong = "parellels" and right = "parallels"
-  or
-  wrong = "parisitic" and right = "parasitic"
-  or
-  wrong = "parituclar" and right = "particular"
-  or
-  wrong = "parliment" and right = "parliament"
-  or
-  wrong = "parrakeets" and right = "parakeets"
-  or
-  wrong = "parralel" and right = "parallel"
-  or
-  wrong = "parrallel" and right = "parallel"
-  or
-  wrong = "parrallell" and right = "parallel"
-  or
-  wrong = "parrallelly" and right = "parallelly"
-  or
-  wrong = "parrallely" and right = "parallelly"
-  or
-  wrong = "partialy" and right = "partially"
-  or
-  wrong = "particually" and right = "particularly"
-  or
-  wrong = "particualr" and right = "particular"
-  or
-  wrong = "particuarly" and right = "particularly"
-  or
-  wrong = "particularily" and right = "particularly"
-  or
-  wrong = "particulary" and right = "particularly"
-  or
-  wrong = "pary" and right = "party"
-  or
-  wrong = "pased" and right = "passed"
-  or
-  wrong = "pasengers" and right = "passengers"
-  or
-  wrong = "passerbys" and right = "passersby"
-  or
-  wrong = "pasttime" and right = "pastime"
-  or
-  wrong = "pastural" and right = "pastoral"
-  or
-  wrong = "paticular" and right = "particular"
-  or
-  wrong = "pattented" and right = "patented"
-  or
-  wrong = "pavillion" and right = "pavilion"
-  or
-  wrong = "payed" and right = "paid"
-  or
-  wrong = "pblisher" and right = "publisher"
-  or
-  wrong = "pbulisher" and right = "publisher"
-  or
-  wrong = "peageant" and right = "pageant"
-  or
-  wrong = "peaple" and right = "people"
-  or
-  wrong = "peaples" and right = "peoples"
-  or
-  wrong = "peculure" and right = "peculiar"
-  or
-  wrong = "pedestrain" and right = "pedestrian"
-  or
-  wrong = "peformed" and right = "performed"
-  or
-  wrong = "peice" and right = "piece"
-  or
-  wrong = "peloponnes" and right = "peloponnesus"
-  or
-  wrong = "penatly" and right = "penalty"
-  or
-  wrong = "penerator" and right = "penetrator"
-  or
-  wrong = "penisula" and right = "peninsula"
-  or
-  wrong = "penisular" and right = "peninsular"
-  or
-  wrong = "penninsula" and right = "peninsula"
-  or
-  wrong = "penninsular" and right = "peninsular"
-  or
-  wrong = "pennisula" and right = "peninsula"
-  or
-  wrong = "pennyslvania" and right = "pennsylvania"
-  or
-  wrong = "pensinula" and right = "peninsula"
-  or
-  wrong = "pensle" and right = "pencil"
-  or
-  wrong = "peom" and right = "poem"
-  or
-  wrong = "peoms" and right = "poems"
-  or
-  wrong = "peopel" and right = "people"
-  or
-  wrong = "peopels" and right = "peoples"
-  or
-  wrong = "peotry" and right = "poetry"
-  or
-  wrong = "perade" and right = "parade"
-  or
-  wrong = "percepted" and right = "perceived"
-  or
-  wrong = "percieve" and right = "perceive"
-  or
-  wrong = "percieved" and right = "perceived"
-  or
-  wrong = "perenially" and right = "perennially"
-  or
-  wrong = "peretrator" and right = "perpetrator"
-  or
-  wrong = "perfomance" and right = "performance"
-  or
-  wrong = "perfomers" and right = "performers"
-  or
-  wrong = "performence" and right = "performance"
-  or
-  wrong = "performes" and right = "performed"
-  or
-  wrong = "performes" and right = "performs"
-  or
-  wrong = "perhasp" and right = "perhaps"
-  or
-  wrong = "perheaps" and right = "perhaps"
-  or
-  wrong = "perhpas" and right = "perhaps"
-  or
-  wrong = "peripathetic" and right = "peripatetic"
-  or
-  wrong = "peristent" and right = "persistent"
-  or
-  wrong = "perjery" and right = "perjury"
-  or
-  wrong = "perjorative" and right = "pejorative"
-  or
-  wrong = "permanant" and right = "permanent"
-  or
-  wrong = "permenant" and right = "permanent"
-  or
-  wrong = "permenantly" and right = "permanently"
-  or
-  wrong = "permissable" and right = "permissible"
-  or
-  wrong = "perogative" and right = "prerogative"
-  or
-  wrong = "peronal" and right = "personal"
-  or
-  wrong = "perosnality" and right = "personality"
-  or
-  wrong = "perpertrated" and right = "perpetrated"
-  or
-  wrong = "perphas" and right = "perhaps"
-  or
-  wrong = "perpindicular" and right = "perpendicular"
-  or
-  wrong = "persan" and right = "person"
-  or
-  wrong = "perseverence" and right = "perseverance"
-  or
-  wrong = "persistance" and right = "persistence"
-  or
-  wrong = "persistant" and right = "persistent"
-  or
-  wrong = "personel" and right = "personal"
-  or
-  wrong = "personel" and right = "personnel"
-  or
-  wrong = "personell" and right = "personnel"
-  or
-  wrong = "personnell" and right = "personnel"
-  or
-  wrong = "persuded" and right = "persuaded"
-  or
-  wrong = "persue" and right = "pursue"
-  or
-  wrong = "persued" and right = "pursued"
-  or
-  wrong = "persuing" and right = "pursuing"
-  or
-  wrong = "persuit" and right = "pursuit"
-  or
-  wrong = "persuits" and right = "pursuits"
-  or
-  wrong = "pertubation" and right = "perturbation"
-  or
-  wrong = "pertubations" and right = "perturbations"
-  or
-  wrong = "pessiary" and right = "pessary"
-  or
-  wrong = "petetion" and right = "petition"
-  or
-  wrong = "pharoah" and right = "pharaoh"
-  or
-  wrong = "phenomenom" and right = "phenomenon"
-  or
-  wrong = "phenomenonal" and right = "phenomenal"
-  or
-  wrong = "phenomenonly" and right = "phenomenally"
-  or
-  wrong = "phenomonenon" and right = "phenomenon"
-  or
-  wrong = "phenomonon" and right = "phenomenon"
-  or
-  wrong = "phenonmena" and right = "phenomena"
-  or
-  wrong = "philipines" and right = "philippines"
-  or
-  wrong = "philisopher" and right = "philosopher"
-  or
-  wrong = "philisophical" and right = "philosophical"
-  or
-  wrong = "philisophy" and right = "philosophy"
-  or
-  wrong = "phillipine" and right = "philippine"
-  or
-  wrong = "phillipines" and right = "philippines"
-  or
-  wrong = "phillippines" and right = "philippines"
-  or
-  wrong = "phillosophically" and right = "philosophically"
-  or
-  wrong = "philospher" and right = "philosopher"
-  or
-  wrong = "philosphies" and right = "philosophies"
-  or
-  wrong = "philosphy" and right = "philosophy"
-  or
-  wrong = "phonecian" and right = "phoenecian"
-  or
-  wrong = "phongraph" and right = "phonograph"
-  or
-  wrong = "phylosophical" and right = "philosophical"
-  or
-  wrong = "physicaly" and right = "physically"
-  or
-  wrong = "piblisher" and right = "publisher"
-  or
-  wrong = "pich" and right = "pitch"
-  or
-  wrong = "pilgrimmage" and right = "pilgrimage"
-  or
-  wrong = "pilgrimmages" and right = "pilgrimages"
-  or
-  wrong = "pinapple" and right = "pineapple"
-  or
-  wrong = "pinnaple" and right = "pineapple"
-  or
-  wrong = "pinoneered" and right = "pioneered"
-  or
-  wrong = "plagarism" and right = "plagiarism"
-  or
-  wrong = "planation" and right = "plantation"
-  or
-  wrong = "planed" and right = "planned"
-  or
-  wrong = "plantiff" and right = "plaintiff"
-  or
-  wrong = "plateu" and right = "plateau"
-  or
-  wrong = "plausable" and right = "plausible"
-  or
-  wrong = "playright" and right = "playwright"
-  or
-  wrong = "playwrite" and right = "playwright"
-  or
-  wrong = "playwrites" and right = "playwrights"
-  or
-  wrong = "pleasent" and right = "pleasant"
-  or
-  wrong = "plebicite" and right = "plebiscite"
-  or
-  wrong = "plesant" and right = "pleasant"
-  or
-  wrong = "poenis" and right = "penis"
-  or
-  wrong = "poeoples" and right = "peoples"
-  or
-  wrong = "poety" and right = "poetry"
-  or
-  wrong = "poisin" and right = "poison"
-  or
-  wrong = "polical" and right = "political"
-  or
-  wrong = "polinator" and right = "pollinator"
-  or
-  wrong = "polinators" and right = "pollinators"
-  or
-  wrong = "politican" and right = "politician"
-  or
-  wrong = "politicans" and right = "politicians"
-  or
-  wrong = "poltical" and right = "political"
-  or
-  wrong = "polute" and right = "pollute"
-  or
-  wrong = "poluted" and right = "polluted"
-  or
-  wrong = "polutes" and right = "pollutes"
-  or
-  wrong = "poluting" and right = "polluting"
-  or
-  wrong = "polution" and right = "pollution"
-  or
-  wrong = "polyphonyic" and right = "polyphonic"
-  or
-  wrong = "polysaccaride" and right = "polysaccharide"
-  or
-  wrong = "polysaccharid" and right = "polysaccharide"
-  or
-  wrong = "pomegranite" and right = "pomegranate"
-  or
-  wrong = "pomotion" and right = "promotion"
-  or
-  wrong = "poportional" and right = "proportional"
-  or
-  wrong = "popoulation" and right = "population"
-  or
-  wrong = "popularaty" and right = "popularity"
-  or
-  wrong = "populare" and right = "popular"
-  or
-  wrong = "populer" and right = "popular"
-  or
-  wrong = "porshan" and right = "portion"
-  or
-  wrong = "porshon" and right = "portion"
-  or
-  wrong = "portait" and right = "portrait"
-  or
-  wrong = "portayed" and right = "portrayed"
-  or
-  wrong = "portraing" and right = "portraying"
-  or
-  wrong = "portugese" and right = "portuguese"
-  or
-  wrong = "portuguease" and right = "portuguese"
-  or
-  wrong = "portugues" and right = "portuguese"
-  or
-  wrong = "posess" and right = "possess"
-  or
-  wrong = "posessed" and right = "possessed"
-  or
-  wrong = "posesses" and right = "possesses"
-  or
-  wrong = "posessing" and right = "possessing"
-  or
-  wrong = "posession" and right = "possession"
-  or
-  wrong = "posessions" and right = "possessions"
-  or
-  wrong = "posion" and right = "poison"
-  or
-  wrong = "positon" and right = "position"
-  or
-  wrong = "positon" and right = "positron"
-  or
-  wrong = "possable" and right = "possible"
-  or
-  wrong = "possably" and right = "possibly"
-  or
-  wrong = "posseses" and right = "possesses"
-  or
-  wrong = "possesing" and right = "possessing"
-  or
-  wrong = "possesion" and right = "possession"
-  or
-  wrong = "possessess" and right = "possesses"
-  or
-  wrong = "possibile" and right = "possible"
-  or
-  wrong = "possibilty" and right = "possibility"
-  or
-  wrong = "possiblility" and right = "possibility"
-  or
-  wrong = "possiblilty" and right = "possibility"
-  or
-  wrong = "possiblities" and right = "possibilities"
-  or
-  wrong = "possiblity" and right = "possibility"
-  or
-  wrong = "possition" and right = "position"
-  or
-  wrong = "postdam" and right = "potsdam"
-  or
-  wrong = "posthomous" and right = "posthumous"
-  or
-  wrong = "postion" and right = "position"
-  or
-  wrong = "postive" and right = "positive"
-  or
-  wrong = "potatos" and right = "potatoes"
-  or
-  wrong = "potrait" and right = "portrait"
-  or
-  wrong = "potrayed" and right = "portrayed"
-  or
-  wrong = "poulations" and right = "populations"
-  or
-  wrong = "poverful" and right = "powerful"
-  or
-  wrong = "poweful" and right = "powerful"
-  or
-  wrong = "powerfull" and right = "powerful"
-  or
-  wrong = "ppublisher" and right = "publisher"
-  or
-  wrong = "practial" and right = "practical"
-  or
-  wrong = "practially" and right = "practically"
-  or
-  wrong = "practicaly" and right = "practically"
-  or
-  wrong = "practicioner" and right = "practitioner"
-  or
-  wrong = "practicioners" and right = "practitioners"
-  or
-  wrong = "practicly" and right = "practically"
-  or
-  wrong = "practioner" and right = "practitioner"
-  or
-  wrong = "practioners" and right = "practitioners"
-  or
-  wrong = "prairy" and right = "prairie"
-  or
-  wrong = "prarie" and right = "prairie"
-  or
-  wrong = "praries" and right = "prairies"
-  or
-  wrong = "pratice" and right = "practice"
-  or
-  wrong = "preample" and right = "preamble"
-  or
-  wrong = "precedessor" and right = "predecessor"
-  or
-  wrong = "preceed" and right = "precede"
-  or
-  wrong = "preceeded" and right = "preceded"
-  or
-  wrong = "preceeding" and right = "preceding"
-  or
-  wrong = "preceeds" and right = "precedes"
-  or
-  wrong = "precendence" and right = "precedence"
-  or
-  wrong = "precentage" and right = "percentage"
-  or
-  wrong = "precice" and right = "precise"
-  or
-  wrong = "precisly" and right = "precisely"
-  or
-  wrong = "precurser" and right = "precursor"
-  or
-  wrong = "predecesors" and right = "predecessors"
-  or
-  wrong = "predicatble" and right = "predictable"
-  or
-  wrong = "predicitons" and right = "predictions"
-  or
-  wrong = "predomiantly" and right = "predominately"
-  or
-  wrong = "prefered" and right = "preferred"
-  or
-  wrong = "prefering" and right = "preferring"
-  or
-  wrong = "preferrably" and right = "preferably"
-  or
-  wrong = "pregancies" and right = "pregnancies"
-  or
-  wrong = "preiod" and right = "period"
-  or
-  wrong = "preliferation" and right = "proliferation"
-  or
-  wrong = "premeire" and right = "premiere"
-  or
-  wrong = "premeired" and right = "premiered"
-  or
-  wrong = "premillenial" and right = "premillennial"
-  or
-  wrong = "preminence" and right = "preeminence"
-  or
-  wrong = "premission" and right = "permission"
-  or
-  wrong = "premonasterians" and right = "premonstratensians"
-  or
-  wrong = "preocupation" and right = "preoccupation"
-  or
-  wrong = "prepair" and right = "prepare"
-  or
-  wrong = "prepartion" and right = "preparation"
-  or
-  wrong = "prepatory" and right = "preparatory"
-  or
-  wrong = "preperation" and right = "preparation"
-  or
-  wrong = "preperations" and right = "preparations"
-  or
-  wrong = "preriod" and right = "period"
-  or
-  wrong = "presedential" and right = "presidential"
-  or
-  wrong = "presense" and right = "presence"
-  or
-  wrong = "presidenital" and right = "presidential"
-  or
-  wrong = "presidental" and right = "presidential"
-  or
-  wrong = "presitgious" and right = "prestigious"
-  or
-  wrong = "prespective" and right = "perspective"
-  or
-  wrong = "prestigeous" and right = "prestigious"
-  or
-  wrong = "prestigous" and right = "prestigious"
-  or
-  wrong = "presumabely" and right = "presumably"
-  or
-  wrong = "presumibly" and right = "presumably"
-  or
-  wrong = "pretection" and right = "protection"
-  or
-  wrong = "prevelant" and right = "prevalent"
-  or
-  wrong = "preverse" and right = "perverse"
-  or
-  wrong = "previvous" and right = "previous"
-  or
-  wrong = "pricipal" and right = "principal"
-  or
-  wrong = "priciple" and right = "principle"
-  or
-  wrong = "priestood" and right = "priesthood"
-  or
-  wrong = "primarly" and right = "primarily"
-  or
-  wrong = "primative" and right = "primitive"
-  or
-  wrong = "primatively" and right = "primitively"
-  or
-  wrong = "primatives" and right = "primitives"
-  or
-  wrong = "primordal" and right = "primordial"
-  or
-  wrong = "principaly" and right = "principality"
-  or
-  wrong = "principial" and right = "principal"
-  or
-  wrong = "principlaity" and right = "principality"
-  or
-  wrong = "principly" and right = "principally"
-  or
-  wrong = "prinicipal" and right = "principal"
-  or
-  wrong = "privalege" and right = "privilege"
-  or
-  wrong = "privaleges" and right = "privileges"
-  or
-  wrong = "priveledges" and right = "privileges"
-  or
-  wrong = "privelege" and right = "privilege"
-  or
-  wrong = "priveleged" and right = "privileged"
-  or
-  wrong = "priveleges" and right = "privileges"
-  or
-  wrong = "privelige" and right = "privilege"
-  or
-  wrong = "priveliged" and right = "privileged"
-  or
-  wrong = "priveliges" and right = "privileges"
-  or
-  wrong = "privelleges" and right = "privileges"
-  or
-  wrong = "privilage" and right = "privilege"
-  or
-  wrong = "priviledge" and right = "privilege"
-  or
-  wrong = "priviledges" and right = "privileges"
-  or
-  wrong = "privledge" and right = "privilege"
-  or
-  wrong = "privte" and right = "private"
-  or
-  wrong = "probabilaty" and right = "probability"
-  or
-  wrong = "probablistic" and right = "probabilistic"
-  or
-  wrong = "probablly" and right = "probably"
-  or
-  wrong = "probalibity" and right = "probability"
-  or
-  wrong = "probaly" and right = "probably"
-  or
-  wrong = "probelm" and right = "problem"
-  or
-  wrong = "proccess" and right = "process"
-  or
-  wrong = "proccessing" and right = "processing"
-  or
-  wrong = "procede" and right = "precede"
-  or
-  wrong = "procede" and right = "proceed"
-  or
-  wrong = "proceded" and right = "preceded"
-  or
-  wrong = "proceded" and right = "proceeded"
-  or
-  wrong = "procedes" and right = "precedes"
-  or
-  wrong = "procedes" and right = "proceeds"
-  or
-  wrong = "procedger" and right = "procedure"
-  or
-  wrong = "proceding" and right = "preceding"
-  or
-  wrong = "proceding" and right = "proceeding"
-  or
-  wrong = "procedings" and right = "proceedings"
-  or
-  wrong = "proceedure" and right = "procedure"
-  or
-  wrong = "proces" and right = "process"
-  or
-  wrong = "procesed" and right = "processed"
-  or
-  wrong = "processer" and right = "processor"
-  or
-  wrong = "proclaimation" and right = "proclamation"
-  or
-  wrong = "proclamed" and right = "proclaimed"
-  or
-  wrong = "proclaming" and right = "proclaiming"
-  or
-  wrong = "proclomation" and right = "proclamation"
-  or
-  wrong = "profesion" and right = "profession"
-  or
-  wrong = "profesion" and right = "profusion"
-  or
-  wrong = "profesor" and right = "professor"
-  or
-  wrong = "professer" and right = "professor"
-  or
-  wrong = "proffesed" and right = "professed"
-  or
-  wrong = "proffesion" and right = "profession"
-  or
-  wrong = "proffesional" and right = "professional"
-  or
-  wrong = "proffesor" and right = "professor"
-  or
-  wrong = "profilic" and right = "prolific"
-  or
-  wrong = "progessed" and right = "progressed"
-  or
-  wrong = "progidy" and right = "prodigy"
-  or
-  wrong = "programable" and right = "programmable"
-  or
-  wrong = "progrom" and right = "pogrom"
-  or
-  wrong = "progrom" and right = "program"
-  or
-  wrong = "progroms" and right = "pogroms"
-  or
-  wrong = "progroms" and right = "programs"
-  or
-  wrong = "prohabition" and right = "prohibition"
-  or
-  wrong = "prologomena" and right = "prolegomena"
-  or
-  wrong = "prominance" and right = "prominence"
-  or
-  wrong = "prominant" and right = "prominent"
-  or
-  wrong = "prominantly" and right = "prominently"
-  or
-  wrong = "prominately" and right = "predominately"
-  or
-  wrong = "prominately" and right = "prominently"
-  or
-  wrong = "promiscous" and right = "promiscuous"
-  or
-  wrong = "promotted" and right = "promoted"
-  or
-  wrong = "pronomial" and right = "pronominal"
-  or
-  wrong = "pronouced" and right = "pronounced"
-  or
-  wrong = "pronounched" and right = "pronounced"
-  or
-  wrong = "pronounciation" and right = "pronunciation"
-  or
-  wrong = "proove" and right = "prove"
-  or
-  wrong = "prooved" and right = "proved"
-  or
-  wrong = "prophacy" and right = "prophecy"
-  or
-  wrong = "propietary" and right = "proprietary"
-  or
-  wrong = "propmted" and right = "prompted"
-  or
-  wrong = "propoganda" and right = "propaganda"
-  or
-  wrong = "propogate" and right = "propagate"
-  or
-  wrong = "propogates" and right = "propagates"
-  or
-  wrong = "propogation" and right = "propagation"
-  or
-  wrong = "propostion" and right = "proposition"
-  or
-  wrong = "propotions" and right = "proportions"
-  or
-  wrong = "propper" and right = "proper"
-  or
-  wrong = "propperly" and right = "properly"
-  or
-  wrong = "proprietory" and right = "proprietary"
-  or
-  wrong = "proseletyzing" and right = "proselytizing"
-  or
-  wrong = "protaganist" and right = "protagonist"
-  or
-  wrong = "protaganists" and right = "protagonists"
-  or
-  wrong = "protocal" and right = "protocol"
-  or
-  wrong = "protoganist" and right = "protagonist"
-  or
-  wrong = "prototpe" and right = "prototype"
-  or
-  wrong = "protoype" and right = "prototype"
-  or
-  wrong = "protrayed" and right = "portrayed"
-  or
-  wrong = "protruberance" and right = "protuberance"
-  or
-  wrong = "protruberances" and right = "protuberances"
-  or
-  wrong = "prouncements" and right = "pronouncements"
-  or
-  wrong = "provacative" and right = "provocative"
-  or
-  wrong = "provded" and right = "provided"
-  or
-  wrong = "provicial" and right = "provincial"
-  or
-  wrong = "provinicial" and right = "provincial"
-  or
-  wrong = "provisiosn" and right = "provision"
-  or
-  wrong = "provisonal" and right = "provisional"
-  or
-  wrong = "proximty" and right = "proximity"
-  or
-  wrong = "pseudononymous" and right = "pseudonymous"
-  or
-  wrong = "pseudonyn" and right = "pseudonym"
-  or
-  wrong = "psuedo" and right = "pseudo"
-  or
-  wrong = "psycology" and right = "psychology"
-  or
-  wrong = "psyhic" and right = "psychic"
-  or
-  wrong = "pubilsher" and right = "publisher"
-  or
-  wrong = "pubisher" and right = "publisher"
-  or
-  wrong = "publiaher" and right = "publisher"
-  or
-  wrong = "publically" and right = "publicly"
-  or
-  wrong = "publicaly" and right = "publicly"
-  or
-  wrong = "publicher" and right = "publisher"
-  or
-  wrong = "publihser" and right = "publisher"
-  or
-  wrong = "publisehr" and right = "publisher"
-  or
-  wrong = "publiser" and right = "publisher"
-  or
-  wrong = "publisger" and right = "publisher"
-  or
-  wrong = "publisheed" and right = "published"
-  or
-  wrong = "publisherr" and right = "publisher"
-  or
-  wrong = "publishher" and right = "publisher"
-  or
-  wrong = "publishor" and right = "publisher"
-  or
-  wrong = "publishre" and right = "publisher"
-  or
-  wrong = "publissher" and right = "publisher"
-  or
-  wrong = "publlisher" and right = "publisher"
-  or
-  wrong = "publsiher" and right = "publisher"
-  or
-  wrong = "publusher" and right = "publisher"
-  or
-  wrong = "puchasing" and right = "purchasing"
-  or
-  wrong = "pucini" and right = "puccini"
-  or
-  wrong = "pulisher" and right = "publisher"
-  or
-  wrong = "pumkin" and right = "pumpkin"
-  or
-  wrong = "puplisher" and right = "publisher"
-  or
-  wrong = "puritannical" and right = "puritanical"
-  or
-  wrong = "purposedly" and right = "purposely"
-  or
-  wrong = "purpotedly" and right = "purportedly"
-  or
-  wrong = "pursuade" and right = "persuade"
-  or
-  wrong = "pursuaded" and right = "persuaded"
-  or
-  wrong = "pursuades" and right = "persuades"
-  or
-  wrong = "pususading" and right = "persuading"
-  or
-  wrong = "puting" and right = "putting"
-  or
-  wrong = "pwoer" and right = "power"
-  or
-  wrong = "pyscic" and right = "psychic"
-  or
-  wrong = "qtuie" and right = "quiet"
-  or
-  wrong = "qtuie" and right = "quite"
-  or
-  wrong = "quantaty" and right = "quantity"
-  or
-  wrong = "quantitiy" and right = "quantity"
-  or
-  wrong = "quarantaine" and right = "quarantine"
-  or
-  wrong = "queenland" and right = "queensland"
-  or
-  wrong = "questonable" and right = "questionable"
-  or
-  wrong = "quicklyu" and right = "quickly"
-  or
-  wrong = "quinessential" and right = "quintessential"
-  or
-  wrong = "quitted" and right = "quit"
-  or
-  wrong = "quizes" and right = "quizzes"
-  or
-  wrong = "qutie" and right = "quiet"
-  or
-  wrong = "qutie" and right = "quite"
-  or
-  wrong = "rabinnical" and right = "rabbinical"
-  or
-  wrong = "racaus" and right = "raucous"
-  or
-  wrong = "radiactive" and right = "radioactive"
-  or
-  wrong = "radify" and right = "ratify"
-  or
-  wrong = "raelly" and right = "really"
-  or
-  wrong = "rarified" and right = "rarefied"
-  or
-  wrong = "reaccurring" and right = "recurring"
-  or
-  wrong = "reacing" and right = "reaching"
-  or
-  wrong = "reacll" and right = "recall"
-  or
-  wrong = "readmition" and right = "readmission"
-  or
-  wrong = "realitvely" and right = "relatively"
-  or
-  wrong = "realsitic" and right = "realistic"
-  or
-  wrong = "realtions" and right = "relations"
-  or
-  wrong = "realy" and right = "really"
-  or
-  wrong = "realyl" and right = "really"
-  or
-  wrong = "reasearch" and right = "research"
-  or
-  wrong = "rebiulding" and right = "rebuilding"
-  or
-  wrong = "rebllions" and right = "rebellions"
-  or
-  wrong = "rebounce" and right = "rebound"
-  or
-  wrong = "reccomend" and right = "recommend"
-  or
-  wrong = "reccomendations" and right = "recommendations"
-  or
-  wrong = "reccomended" and right = "recommended"
-  or
-  wrong = "reccomending" and right = "recommending"
-  or
-  wrong = "reccommend" and right = "recommend"
-  or
-  wrong = "reccommended" and right = "recommended"
-  or
-  wrong = "reccommending" and right = "recommending"
-  or
-  wrong = "reccuring" and right = "recurring"
-  or
-  wrong = "receeded" and right = "receded"
-  or
-  wrong = "receeding" and right = "receding"
-  or
-  wrong = "recepient" and right = "recipient"
-  or
-  wrong = "recepients" and right = "recipients"
-  or
-  wrong = "receving" and right = "receiving"
-  or
-  wrong = "rechargable" and right = "rechargeable"
-  or
-  wrong = "reched" and right = "reached"
-  or
-  wrong = "recide" and right = "reside"
-  or
-  wrong = "recided" and right = "resided"
-  or
-  wrong = "recident" and right = "resident"
-  or
-  wrong = "recidents" and right = "residents"
-  or
-  wrong = "reciding" and right = "residing"
-  or
-  wrong = "reciepents" and right = "recipients"
-  or
-  wrong = "reciept" and right = "receipt"
-  or
-  wrong = "recieve" and right = "receive"
-  or
-  wrong = "recieved" and right = "received"
-  or
-  wrong = "reciever" and right = "receiver"
-  or
-  wrong = "recievers" and right = "receivers"
-  or
-  wrong = "recieves" and right = "receives"
-  or
-  wrong = "recieving" and right = "receiving"
-  or
-  wrong = "recipiant" and right = "recipient"
-  or
-  wrong = "recipiants" and right = "recipients"
-  or
-  wrong = "recived" and right = "received"
-  or
-  wrong = "recivership" and right = "receivership"
-  or
-  wrong = "recogise" and right = "recognise"
-  or
-  wrong = "recogize" and right = "recognize"
-  or
-  wrong = "recomend" and right = "recommend"
-  or
-  wrong = "recomended" and right = "recommended"
-  or
-  wrong = "recomending" and right = "recommending"
-  or
-  wrong = "recomends" and right = "recommends"
-  or
-  wrong = "recommedations" and right = "recommendations"
-  or
-  wrong = "recompence" and right = "recompense"
-  or
-  wrong = "reconaissance" and right = "reconnaissance"
-  or
-  wrong = "reconcilation" and right = "reconciliation"
-  or
-  wrong = "reconized" and right = "recognized"
-  or
-  wrong = "reconnaisance" and right = "reconnaissance"
-  or
-  wrong = "reconnaissence" and right = "reconnaissance"
-  or
-  wrong = "recontructed" and right = "reconstructed"
-  or
-  wrong = "recquired" and right = "required"
-  or
-  wrong = "recrational" and right = "recreational"
-  or
-  wrong = "recrod" and right = "record"
-  or
-  wrong = "recuiting" and right = "recruiting"
-  or
-  wrong = "recuring" and right = "recurring"
-  or
-  wrong = "recurrance" and right = "recurrence"
-  or
-  wrong = "rediculous" and right = "ridiculous"
-  or
-  wrong = "reedeming" and right = "redeeming"
-  or
-  wrong = "reenforced" and right = "reinforced"
-  or
-  wrong = "refect" and right = "reflect"
-  or
-  wrong = "refedendum" and right = "referendum"
-  or
-  wrong = "referal" and right = "referral"
-  or
-  wrong = "referece" and right = "reference"
-  or
-  wrong = "refereces" and right = "references"
-  or
-  wrong = "refered" and right = "referred"
-  or
-  wrong = "referemce" and right = "reference"
-  or
-  wrong = "referemces" and right = "references"
-  or
-  wrong = "referencs" and right = "references"
-  or
-  wrong = "referenece" and right = "reference"
-  or
-  wrong = "refereneced" and right = "referenced"
-  or
-  wrong = "refereneces" and right = "references"
-  or
-  wrong = "referiang" and right = "referring"
-  or
-  wrong = "refering" and right = "referring"
-  or
-  wrong = "refernce" and right = "reference"
-  or
-  wrong = "refernce" and right = "references"
-  or
-  wrong = "refernces" and right = "references"
-  or
-  wrong = "referrence" and right = "reference"
-  or
-  wrong = "referrences" and right = "references"
-  or
-  wrong = "referrs" and right = "refers"
-  or
-  wrong = "reffered" and right = "referred"
-  or
-  wrong = "refference" and right = "reference"
-  or
-  wrong = "reffering" and right = "referring"
-  or
-  wrong = "refrence" and right = "reference"
-  or
-  wrong = "refrences" and right = "references"
-  or
-  wrong = "refrers" and right = "refers"
-  or
-  wrong = "refridgeration" and right = "refrigeration"
-  or
-  wrong = "refridgerator" and right = "refrigerator"
-  or
-  wrong = "refromist" and right = "reformist"
-  or
-  wrong = "refusla" and right = "refusal"
-  or
-  wrong = "regardes" and right = "regards"
-  or
-  wrong = "regluar" and right = "regular"
-  or
-  wrong = "reguarly" and right = "regularly"
-  or
-  wrong = "regulaion" and right = "regulation"
-  or
-  wrong = "regulaotrs" and right = "regulators"
-  or
-  wrong = "regularily" and right = "regularly"
-  or
-  wrong = "rehersal" and right = "rehearsal"
-  or
-  wrong = "reicarnation" and right = "reincarnation"
-  or
-  wrong = "reigining" and right = "reigning"
-  or
-  wrong = "reknown" and right = "renown"
-  or
-  wrong = "reknowned" and right = "renowned"
-  or
-  wrong = "rela" and right = "real"
-  or
-  wrong = "relaly" and right = "really"
-  or
-  wrong = "relatiopnship" and right = "relationship"
-  or
-  wrong = "relativly" and right = "relatively"
-  or
-  wrong = "relected" and right = "reelected"
-  or
-  wrong = "releive" and right = "relieve"
-  or
-  wrong = "releived" and right = "relieved"
-  or
-  wrong = "releiver" and right = "reliever"
-  or
-  wrong = "releses" and right = "releases"
-  or
-  wrong = "relevence" and right = "relevance"
-  or
-  wrong = "relevent" and right = "relevant"
-  or
-  wrong = "reliablity" and right = "reliability"
-  or
-  wrong = "relient" and right = "reliant"
-  or
-  wrong = "religeous" and right = "religious"
-  or
-  wrong = "religous" and right = "religious"
-  or
-  wrong = "religously" and right = "religiously"
-  or
-  wrong = "relinqushment" and right = "relinquishment"
-  or
-  wrong = "relitavely" and right = "relatively"
-  or
-  wrong = "relized" and right = "realised"
-  or
-  wrong = "relized" and right = "realized"
-  or
-  wrong = "relpacement" and right = "replacement"
-  or
-  wrong = "remaing" and right = "remaining"
-  or
-  wrong = "remeber" and right = "remember"
-  or
-  wrong = "rememberable" and right = "memorable"
-  or
-  wrong = "rememberance" and right = "remembrance"
-  or
-  wrong = "remembrence" and right = "remembrance"
-  or
-  wrong = "remenant" and right = "remnant"
-  or
-  wrong = "remenicent" and right = "reminiscent"
-  or
-  wrong = "reminent" and right = "remnant"
-  or
-  wrong = "reminescent" and right = "reminiscent"
-  or
-  wrong = "reminscent" and right = "reminiscent"
-  or
-  wrong = "reminsicent" and right = "reminiscent"
-  or
-  wrong = "rendevous" and right = "rendezvous"
-  or
-  wrong = "rendezous" and right = "rendezvous"
-  or
-  wrong = "renedered" and right = "rende"
-  or
-  wrong = "renewl" and right = "renewal"
-  or
-  wrong = "rennovate" and right = "renovate"
-  or
-  wrong = "rennovated" and right = "renovated"
-  or
-  wrong = "rennovating" and right = "renovating"
-  or
-  wrong = "rennovation" and right = "renovation"
-  or
-  wrong = "rentors" and right = "renters"
-  or
-  wrong = "reoccurrence" and right = "recurrence"
-  or
-  wrong = "reorganision" and right = "reorganisation"
-  or
-  wrong = "repatition" and right = "repartition"
-  or
-  wrong = "repatition" and right = "repetition"
-  or
-  wrong = "repblic" and right = "republic"
-  or
-  wrong = "repblican" and right = "republican"
-  or
-  wrong = "repblicans" and right = "republicans"
-  or
-  wrong = "repblics" and right = "republics"
-  or
-  wrong = "repectively" and right = "respectively"
-  or
-  wrong = "repeition" and right = "repetition"
-  or
-  wrong = "repentence" and right = "repentance"
-  or
-  wrong = "repentent" and right = "repentant"
-  or
-  wrong = "repeteadly" and right = "repeatedly"
-  or
-  wrong = "repetion" and right = "repetition"
-  or
-  wrong = "repid" and right = "rapid"
-  or
-  wrong = "reponse" and right = "response"
-  or
-  wrong = "reponsible" and right = "responsible"
-  or
-  wrong = "reportadly" and right = "reportedly"
-  or
-  wrong = "represantative" and right = "representative"
-  or
-  wrong = "representive" and right = "representative"
-  or
-  wrong = "representives" and right = "representatives"
-  or
-  wrong = "reproducable" and right = "reproducible"
-  or
-  wrong = "reprtoire" and right = "repertoire"
-  or
-  wrong = "repsectively" and right = "respectively"
-  or
-  wrong = "reptition" and right = "repetition"
-  or
-  wrong = "repubic" and right = "republic"
-  or
-  wrong = "repubican" and right = "republican"
-  or
-  wrong = "repubicans" and right = "republicans"
-  or
-  wrong = "repubics" and right = "republics"
-  or
-  wrong = "republi" and right = "republic"
-  or
-  wrong = "republian" and right = "republican"
-  or
-  wrong = "republians" and right = "republicans"
-  or
-  wrong = "republis" and right = "republics"
-  or
-  wrong = "repulic" and right = "republic"
-  or
-  wrong = "repulican" and right = "republican"
-  or
-  wrong = "repulicans" and right = "republicans"
-  or
-  wrong = "repulics" and right = "republics"
-  or
-  wrong = "requirment" and right = "requirement"
-  or
-  wrong = "requred" and right = "required"
-  or
-  wrong = "resaurant" and right = "restaurant"
-  or
-  wrong = "resembelance" and right = "resemblance"
-  or
-  wrong = "resembes" and right = "resembles"
-  or
-  wrong = "resemblence" and right = "resemblance"
-  or
-  wrong = "resevoir" and right = "reservoir"
-  or
-  wrong = "residental" and right = "residential"
-  or
-  wrong = "resignement" and right = "resignment"
-  or
-  wrong = "resistable" and right = "resistible"
-  or
-  wrong = "resistence" and right = "resistance"
-  or
-  wrong = "resistent" and right = "resistant"
-  or
-  wrong = "respectivly" and right = "respectively"
-  or
-  wrong = "responce" and right = "response"
-  or
-  wrong = "responibilities" and right = "responsibilities"
-  or
-  wrong = "responisble" and right = "responsible"
-  or
-  wrong = "responnsibilty" and right = "responsibility"
-  or
-  wrong = "responsability" and right = "responsibility"
-  or
-  wrong = "responsibile" and right = "responsible"
-  or
-  wrong = "responsibilites" and right = "responsibilities"
-  or
-  wrong = "responsiblities" and right = "responsibilities"
-  or
-  wrong = "responsiblity" and right = "responsibility"
-  or
-  wrong = "ressemblance" and right = "resemblance"
-  or
-  wrong = "ressemble" and right = "resemble"
-  or
-  wrong = "ressembled" and right = "resembled"
-  or
-  wrong = "ressemblence" and right = "resemblance"
-  or
-  wrong = "ressembling" and right = "resembling"
-  or
-  wrong = "resssurecting" and right = "resurrecting"
-  or
-  wrong = "ressurect" and right = "resurrect"
-  or
-  wrong = "ressurected" and right = "resurrected"
-  or
-  wrong = "ressurection" and right = "resurrection"
-  or
-  wrong = "ressurrection" and right = "resurrection"
-  or
-  wrong = "restarant" and right = "restaurant"
-  or
-  wrong = "restarants" and right = "restaurants"
-  or
-  wrong = "restaraunt" and right = "restaurant"
-  or
-  wrong = "restaraunteur" and right = "restaurateur"
-  or
-  wrong = "restaraunteurs" and right = "restaurateurs"
-  or
-  wrong = "restaraunts" and right = "restaurants"
-  or
-  wrong = "restauranteurs" and right = "restaurateurs"
-  or
-  wrong = "restauration" and right = "restoration"
-  or
-  wrong = "restauraunt" and right = "restaurant"
-  or
-  wrong = "resteraunt" and right = "restaurant"
-  or
-  wrong = "resteraunts" and right = "restaurants"
-  or
-  wrong = "resticted" and right = "restricted"
-  or
-  wrong = "restraunt" and right = "restaurant"
-  or
-  wrong = "restraunt" and right = "restraint"
-  or
-  wrong = "resturant" and right = "restaurant"
-  or
-  wrong = "resturants" and right = "restaurants"
-  or
-  wrong = "resturaunt" and right = "restaurant"
-  or
-  wrong = "resturaunts" and right = "restaurants"
-  or
-  wrong = "resurecting" and right = "resurrecting"
-  or
-  wrong = "retalitated" and right = "retaliated"
-  or
-  wrong = "retalitation" and right = "retaliation"
-  or
-  wrong = "retreive" and right = "retrieve"
-  or
-  wrong = "retrive" and right = "retrieve"
-  or
-  wrong = "returnd" and right = "returned"
-  or
-  wrong = "revaluated" and right = "reevaluated"
-  or
-  wrong = "reveiw" and right = "review"
-  or
-  wrong = "reveral" and right = "reversal"
-  or
-  wrong = "reversable" and right = "reversible"
-  or
-  wrong = "revolutionar" and right = "revolutionary"
-  or
-  wrong = "rewitten" and right = "rewritten"
-  or
-  wrong = "rewriet" and right = "rewrite"
-  or
-  wrong = "rference" and right = "reference"
-  or
-  wrong = "rferences" and right = "references"
-  or
-  wrong = "rhymme" and right = "rhyme"
-  or
-  wrong = "rhythem" and right = "rhythm"
-  or
-  wrong = "rhythim" and right = "rhythm"
-  or
-  wrong = "rhytmic" and right = "rhythmic"
-  or
-  wrong = "rigeur" and right = "rigor"
-  or
-  wrong = "rigeur" and right = "rigour"
-  or
-  wrong = "rigeur" and right = "rigueur"
-  or
-  wrong = "rigourous" and right = "rigorous"
-  or
-  wrong = "rininging" and right = "ringing"
-  or
-  wrong = "rised" and right = "raised"
-  or
-  wrong = "rised" and right = "rose"
-  or
-  wrong = "rockerfeller" and right = "rockefeller"
-  or
-  wrong = "rococco" and right = "rococo"
-  or
-  wrong = "rocord" and right = "record"
-  or
-  wrong = "roomate" and right = "roommate"
-  or
-  wrong = "rougly" and right = "roughly"
-  or
-  wrong = "rucuperate" and right = "recuperate"
-  or
-  wrong = "rudimentatry" and right = "rudimentary"
-  or
-  wrong = "rulle" and right = "rule"
-  or
-  wrong = "runing" and right = "running"
-  or
-  wrong = "runnung" and right = "running"
-  or
-  wrong = "russina" and right = "russian"
-  or
-  wrong = "russion" and right = "russian"
-  or
-  wrong = "rwite" and right = "write"
-  or
-  wrong = "rythem" and right = "rhythm"
-  or
-  wrong = "rythim" and right = "rhythm"
-  or
-  wrong = "rythm" and right = "rhythm"
-  or
-  wrong = "rythmic" and right = "rhythmic"
-  or
-  wrong = "rythyms" and right = "rhythms"
-  or
-  wrong = "sacrafice" and right = "sacrifice"
-  or
-  wrong = "sacreligious" and right = "sacrilegious"
-  or
-  wrong = "sacremento" and right = "sacramento"
-  or
-  wrong = "sacrifical" and right = "sacrificial"
-  or
-  wrong = "saftey" and right = "safety"
-  or
-  wrong = "safty" and right = "safety"
-  or
-  wrong = "salery" and right = "salary"
-  or
-  wrong = "sanctionning" and right = "sanctioning"
-  or
-  wrong = "sandwhich" and right = "sandwich"
-  or
-  wrong = "sanhedrim" and right = "sanhedrin"
-  or
-  wrong = "santioned" and right = "sanctioned"
-  or
-  wrong = "sargant" and right = "sergeant"
-  or
-  wrong = "sargeant" and right = "sergeant"
-  or
-  wrong = "sasy" and right = "sassy"
-  or
-  wrong = "sasy" and right = "says"
-  or
-  wrong = "satelite" and right = "satellite"
-  or
-  wrong = "satelites" and right = "satellites"
-  or
-  wrong = "saterday" and right = "saturday"
-  or
-  wrong = "saterdays" and right = "saturdays"
-  or
-  wrong = "satisfactority" and right = "satisfactorily"
-  or
-  wrong = "satric" and right = "satiric"
-  or
-  wrong = "satrical" and right = "satirical"
-  or
-  wrong = "satrically" and right = "satirically"
-  or
-  wrong = "sattelite" and right = "satellite"
-  or
-  wrong = "sattelites" and right = "satellites"
-  or
-  wrong = "saught" and right = "sought"
-  or
-  wrong = "saveing" and right = "saving"
-  or
-  wrong = "saxaphone" and right = "saxophone"
-  or
-  wrong = "scaleable" and right = "scalable"
-  or
-  wrong = "scandanavia" and right = "scandinavia"
-  or
-  wrong = "scaricity" and right = "scarcity"
-  or
-  wrong = "scavanged" and right = "scavenged"
-  or
-  wrong = "schedual" and right = "schedule"
-  or
-  wrong = "scholarhip" and right = "scholarship"
-  or
-  wrong = "scholarstic" and right = "scholarly"
-  or
-  wrong = "scholarstic" and right = "scholastic"
-  or
-  wrong = "scientfic" and right = "scientific"
-  or
-  wrong = "scientifc" and right = "scientific"
-  or
-  wrong = "scientis" and right = "scientist"
-  or
-  wrong = "scince" and right = "science"
-  or
-  wrong = "scinece" and right = "science"
-  or
-  wrong = "scirpt" and right = "script"
-  or
-  wrong = "scoll" and right = "scroll"
-  or
-  wrong = "screenwrighter" and right = "screenwriter"
-  or
-  wrong = "scrutinity" and right = "scrutiny"
-  or
-  wrong = "scuptures" and right = "sculptures"
-  or
-  wrong = "seach" and right = "search"
-  or
-  wrong = "seached" and right = "searched"
-  or
-  wrong = "seaches" and right = "searches"
-  or
-  wrong = "secceeded" and right = "seceded"
-  or
-  wrong = "secceeded" and right = "succeeded"
-  or
-  wrong = "seceed" and right = "secede"
-  or
-  wrong = "seceed" and right = "succeed"
-  or
-  wrong = "seceeded" and right = "seceded"
-  or
-  wrong = "seceeded" and right = "succeeded"
-  or
-  wrong = "secratary" and right = "secretary"
-  or
-  wrong = "secretery" and right = "secretary"
-  or
-  wrong = "sedereal" and right = "sidereal"
-  or
-  wrong = "seeked" and right = "sought"
-  or
-  wrong = "segementation" and right = "segmentation"
-  or
-  wrong = "seguoys" and right = "segues"
-  or
-  wrong = "seige" and right = "siege"
-  or
-  wrong = "seing" and right = "seeing"
-  or
-  wrong = "seinor" and right = "senior"
-  or
-  wrong = "seldomly" and right = "seldom"
-  or
-  wrong = "senarios" and right = "scenarios"
-  or
-  wrong = "sence" and right = "sense"
-  or
-  wrong = "sence" and right = "since"
-  or
-  wrong = "senstive" and right = "sensitive"
-  or
-  wrong = "sensure" and right = "censure"
-  or
-  wrong = "seperate" and right = "separate"
-  or
-  wrong = "seperated" and right = "separated"
-  or
-  wrong = "seperately" and right = "separately"
-  or
-  wrong = "seperates" and right = "separates"
-  or
-  wrong = "seperating" and right = "separating"
-  or
-  wrong = "seperation" and right = "separation"
-  or
-  wrong = "seperatism" and right = "separatism"
-  or
-  wrong = "seperatist" and right = "separatist"
-  or
-  wrong = "seperator" and right = "separator"
-  or
-  wrong = "sepina" and right = "subpoena"
-  or
-  wrong = "sepulchure" and right = "sepulcher"
-  or
-  wrong = "sepulchure" and right = "sepulchre"
-  or
-  wrong = "sepulcre" and right = "sepulcher"
-  or
-  wrong = "sepulcre" and right = "sepulchre"
-  or
-  wrong = "sergent" and right = "sergeant"
-  or
-  wrong = "settelement" and right = "settlement"
-  or
-  wrong = "settlment" and right = "settlement"
-  or
-  wrong = "settting" and right = "setting"
-  or
-  wrong = "severeal" and right = "several"
-  or
-  wrong = "severley" and right = "severely"
-  or
-  wrong = "severly" and right = "severely"
-  or
-  wrong = "sevice" and right = "service"
-  or
-  wrong = "shadasloo" and right = "shadaloo"
-  or
-  wrong = "shaddow" and right = "shadow"
-  or
-  wrong = "shadoloo" and right = "shadaloo"
-  or
-  wrong = "shamen" and right = "shaman"
-  or
-  wrong = "shamen" and right = "shamans"
-  or
-  wrong = "sheat" and right = "cheat"
-  or
-  wrong = "sheat" and right = "sheath"
-  or
-  wrong = "sheat" and right = "sheet"
-  or
-  wrong = "sheild" and right = "shield"
-  or
-  wrong = "sherif" and right = "sheriff"
-  or
-  wrong = "shineing" and right = "shining"
-  or
-  wrong = "shiped" and right = "shipped"
-  or
-  wrong = "shiping" and right = "shipping"
-  or
-  wrong = "shopkeeepers" and right = "shopkeepers"
-  or
-  wrong = "shorly" and right = "shortly"
-  or
-  wrong = "shoudl" and right = "should"
-  or
-  wrong = "shoudln" and right = "should"
-  or
-  wrong = "shreak" and right = "shriek"
-  or
-  wrong = "shrinked" and right = "shrunk"
-  or
-  wrong = "sicne" and right = "since"
-  or
-  wrong = "sideral" and right = "sidereal"
-  or
-  wrong = "sieze" and right = "seize"
-  or
-  wrong = "sieze" and right = "size"
-  or
-  wrong = "siezed" and right = "seized"
-  or
-  wrong = "siezed" and right = "sized"
-  or
-  wrong = "siezing" and right = "seizing"
-  or
-  wrong = "siezing" and right = "sizing"
-  or
-  wrong = "siezure" and right = "seizure"
-  or
-  wrong = "siezures" and right = "seizures"
-  or
-  wrong = "siginificant" and right = "significant"
-  or
-  wrong = "signficant" and right = "significant"
-  or
-  wrong = "signficiant" and right = "significant"
-  or
-  wrong = "signfies" and right = "signifies"
-  or
-  wrong = "signifantly" and right = "significantly"
-  or
-  wrong = "significently" and right = "significantly"
-  or
-  wrong = "signifigant" and right = "significant"
-  or
-  wrong = "signifigantly" and right = "significantly"
-  or
-  wrong = "signitories" and right = "signatories"
-  or
-  wrong = "signitory" and right = "signatory"
-  or
-  wrong = "similarily" and right = "similarly"
-  or
-  wrong = "similiar" and right = "similar"
-  or
-  wrong = "similiarity" and right = "similarity"
-  or
-  wrong = "similiarly" and right = "similarly"
-  or
-  wrong = "simmilar" and right = "similar"
-  or
-  wrong = "simpley" and right = "simply"
-  or
-  wrong = "simplier" and right = "simpler"
-  or
-  wrong = "simultanous" and right = "simultaneous"
-  or
-  wrong = "simultanously" and right = "simultaneously"
-  or
-  wrong = "sincerley" and right = "sincerely"
-  or
-  wrong = "singsog" and right = "singsong"
-  or
-  wrong = "sinse" and right = "since"
-  or
-  wrong = "sinse" and right = "sines"
-  or
-  wrong = "sionist" and right = "zionist"
-  or
-  wrong = "sionists" and right = "zionists"
-  or
-  wrong = "sixtin" and right = "sistine"
-  or
-  wrong = "skagerak" and right = "skagerrak"
-  or
-  wrong = "skateing" and right = "skating"
-  or
-  wrong = "slaugterhouses" and right = "slaughterhouses"
-  or
-  wrong = "slighly" and right = "slightly"
-  or
-  wrong = "slippy" and right = "slippery"
-  or
-  wrong = "slowy" and right = "slowly"
-  or
-  wrong = "smae" and right = "same"
-  or
-  wrong = "smealting" and right = "smelting"
-  or
-  wrong = "smoe" and right = "some"
-  or
-  wrong = "sneeks" and right = "sneaks"
-  or
-  wrong = "snese" and right = "sneeze"
-  or
-  wrong = "socalism" and right = "socialism"
-  or
-  wrong = "socities" and right = "societies"
-  or
-  wrong = "soem" and right = "some"
-  or
-  wrong = "sofware" and right = "software"
-  or
-  wrong = "sohw" and right = "show"
-  or
-  wrong = "soilders" and right = "soldiers"
-  or
-  wrong = "solatary" and right = "solitary"
-  or
-  wrong = "soley" and right = "solely"
-  or
-  wrong = "soliders" and right = "soldiers"
-  or
-  wrong = "soliliquy" and right = "soliloquy"
-  or
-  wrong = "soluable" and right = "soluble"
-  or
-  wrong = "somene" and right = "someone"
-  or
-  wrong = "somtimes" and right = "sometimes"
-  or
-  wrong = "somwhere" and right = "somewhere"
-  or
-  wrong = "sophicated" and right = "sophisticated"
-  or
-  wrong = "sophmore" and right = "sophomore"
-  or
-  wrong = "sorceror" and right = "sorcerer"
-  or
-  wrong = "sorrounding" and right = "surrounding"
-  or
-  wrong = "sotry" and right = "story"
-  or
-  wrong = "sotyr" and right = "satyr"
-  or
-  wrong = "sotyr" and right = "story"
-  or
-  wrong = "soudn" and right = "sound"
-  or
-  wrong = "soudns" and right = "sounds"
-  or
-  wrong = "sould" and right = "could"
-  or
-  wrong = "sould" and right = "should"
-  or
-  wrong = "sould" and right = "sold"
-  or
-  wrong = "sould" and right = "soul"
-  or
-  wrong = "sountrack" and right = "soundtrack"
-  or
-  wrong = "sourth" and right = "south"
-  or
-  wrong = "sourthern" and right = "southern"
-  or
-  wrong = "souvenier" and right = "souvenir"
-  or
-  wrong = "souveniers" and right = "souvenirs"
-  or
-  wrong = "soveits" and right = "soviets"
-  or
-  wrong = "sovereignity" and right = "sovereignty"
-  or
-  wrong = "soverign" and right = "sovereign"
-  or
-  wrong = "soverignity" and right = "sovereignty"
-  or
-  wrong = "soverignty" and right = "sovereignty"
-  or
-  wrong = "spainish" and right = "spanish"
-  or
-  wrong = "speach" and right = "speech"
-  or
-  wrong = "specfic" and right = "specific"
-  or
-  wrong = "speciallized" and right = "specialised"
-  or
-  wrong = "speciallized" and right = "specialized"
-  or
-  wrong = "specif" and right = "specific"
-  or
-  wrong = "specif" and right = "specify"
-  or
-  wrong = "specifiying" and right = "specifying"
-  or
-  wrong = "speciman" and right = "specimen"
-  or
-  wrong = "spectauclar" and right = "spectacular"
-  or
-  wrong = "spectaulars" and right = "spectaculars"
-  or
-  wrong = "spects" and right = "aspects"
-  or
-  wrong = "spects" and right = "expects"
-  or
-  wrong = "spectum" and right = "spectrum"
-  or
-  wrong = "speices" and right = "species"
-  or
-  wrong = "spendour" and right = "splendour"
-  or
-  wrong = "spermatozoan" and right = "spermatozoon"
-  or
-  wrong = "spoace" and right = "space"
-  or
-  wrong = "sponser" and right = "sponsor"
-  or
-  wrong = "sponsered" and right = "sponsored"
-  or
-  wrong = "spontanous" and right = "spontaneous"
-  or
-  wrong = "sponzored" and right = "sponsored"
-  or
-  wrong = "spoonfulls" and right = "spoonfuls"
-  or
-  wrong = "sppeches" and right = "speeches"
-  or
-  wrong = "spreaded" and right = "spread"
-  or
-  wrong = "sprech" and right = "speech"
-  or
-  wrong = "spred" and right = "spread"
-  or
-  wrong = "spriritual" and right = "spiritual"
-  or
-  wrong = "spritual" and right = "spiritual"
-  or
-  wrong = "sqaure" and right = "square"
-  or
-  wrong = "sring" and right = "string"
-  or
-  wrong = "stablility" and right = "stability"
-  or
-  wrong = "stainlees" and right = "stainless"
-  or
-  wrong = "staion" and right = "station"
-  or
-  wrong = "standars" and right = "standards"
-  or
-  wrong = "stange" and right = "strange"
-  or
-  wrong = "startegic" and right = "strategic"
-  or
-  wrong = "startegies" and right = "strategies"
-  or
-  wrong = "startegy" and right = "strategy"
-  or
-  wrong = "stateman" and right = "statesman"
-  or
-  wrong = "statememts" and right = "statements"
-  or
-  wrong = "statment" and right = "statement"
-  or
-  wrong = "steriods" and right = "steroids"
-  or
-  wrong = "sterotypes" and right = "stereotypes"
-  or
-  wrong = "stilus" and right = "stylus"
-  or
-  wrong = "stingent" and right = "stringent"
-  or
-  wrong = "stiring" and right = "stirring"
-  or
-  wrong = "stirrs" and right = "stirs"
-  or
-  wrong = "stlye" and right = "style"
-  or
-  wrong = "stomache" and right = "stomach"
-  or
-  wrong = "stong" and right = "strong"
-  or
-  wrong = "stopry" and right = "story"
-  or
-  wrong = "storeis" and right = "stories"
-  or
-  wrong = "storise" and right = "stories"
-  or
-  wrong = "stornegst" and right = "strongest"
-  or
-  wrong = "stoyr" and right = "story"
-  or
-  wrong = "stpo" and right = "stop"
-  or
-  wrong = "stradegies" and right = "strategies"
-  or
-  wrong = "stradegy" and right = "strategy"
-  or
-  wrong = "strat" and right = "start"
-  or
-  wrong = "strat" and right = "strata"
-  or
-  wrong = "stratagically" and right = "strategically"
-  or
-  wrong = "streemlining" and right = "streamlining"
-  or
-  wrong = "stregth" and right = "strength"
-  or
-  wrong = "strenghen" and right = "strengthen"
-  or
-  wrong = "strenghened" and right = "strengthened"
-  or
-  wrong = "strenghening" and right = "strengthening"
-  or
-  wrong = "strenght" and right = "strength"
-  or
-  wrong = "strenghten" and right = "strengthen"
-  or
-  wrong = "strenghtened" and right = "strengthened"
-  or
-  wrong = "strenghtening" and right = "strengthening"
-  or
-  wrong = "strengtened" and right = "strengthened"
-  or
-  wrong = "strenous" and right = "strenuous"
-  or
-  wrong = "strictist" and right = "strictest"
-  or
-  wrong = "strikely" and right = "strikingly"
-  or
-  wrong = "strnad" and right = "strand"
-  or
-  wrong = "stroy" and right = "destroy"
-  or
-  wrong = "stroy" and right = "story"
-  or
-  wrong = "structual" and right = "structural"
-  or
-  wrong = "stubborness" and right = "stubbornness"
-  or
-  wrong = "stucture" and right = "structure"
-  or
-  wrong = "stuctured" and right = "structured"
-  or
-  wrong = "studdy" and right = "study"
-  or
-  wrong = "studing" and right = "studying"
-  or
-  wrong = "stuggling" and right = "struggling"
-  or
-  wrong = "sturcture" and right = "structure"
-  or
-  wrong = "subcatagories" and right = "subcategories"
-  or
-  wrong = "subcatagory" and right = "subcategory"
-  or
-  wrong = "subconsiously" and right = "subconsciously"
-  or
-  wrong = "subjudgation" and right = "subjugation"
-  or
-  wrong = "submachne" and right = "submachine"
-  or
-  wrong = "subpecies" and right = "subspecies"
-  or
-  wrong = "subsidary" and right = "subsidiary"
-  or
-  wrong = "subsiduary" and right = "subsidiary"
-  or
-  wrong = "subsquent" and right = "subsequent"
-  or
-  wrong = "subsquently" and right = "subsequently"
-  or
-  wrong = "substace" and right = "substance"
-  or
-  wrong = "substancial" and right = "substantial"
-  or
-  wrong = "substatial" and right = "substantial"
-  or
-  wrong = "substituded" and right = "substituted"
-  or
-  wrong = "substract" and right = "subtract"
-  or
-  wrong = "substracted" and right = "subtracted"
-  or
-  wrong = "substracting" and right = "subtracting"
-  or
-  wrong = "substraction" and right = "subtraction"
-  or
-  wrong = "substracts" and right = "subtracts"
-  or
-  wrong = "subtances" and right = "substances"
-  or
-  wrong = "subterranian" and right = "subterranean"
-  or
-  wrong = "suburburban" and right = "suburban"
-  or
-  wrong = "succceeded" and right = "succeeded"
-  or
-  wrong = "succcesses" and right = "successes"
-  or
-  wrong = "succedded" and right = "succeeded"
-  or
-  wrong = "succeded" and right = "succeeded"
-  or
-  wrong = "succeds" and right = "succeeds"
-  or
-  wrong = "succesful" and right = "successful"
-  or
-  wrong = "succesfully" and right = "successfully"
-  or
-  wrong = "succesfuly" and right = "successfully"
-  or
-  wrong = "succesion" and right = "succession"
-  or
-  wrong = "succesive" and right = "successive"
-  or
-  wrong = "successfull" and right = "successful"
-  or
-  wrong = "successully" and right = "successfully"
-  or
-  wrong = "succsess" and right = "success"
-  or
-  wrong = "succsessfull" and right = "successful"
-  or
-  wrong = "suceed" and right = "succeed"
-  or
-  wrong = "suceeded" and right = "succeeded"
-  or
-  wrong = "suceeding" and right = "succeeding"
-  or
-  wrong = "suceeds" and right = "succeeds"
-  or
-  wrong = "sucesful" and right = "successful"
-  or
-  wrong = "sucesfully" and right = "successfully"
-  or
-  wrong = "sucesfuly" and right = "successfully"
-  or
-  wrong = "sucesion" and right = "succession"
-  or
-  wrong = "sucess" and right = "success"
-  or
-  wrong = "sucesses" and right = "successes"
-  or
-  wrong = "sucessful" and right = "successful"
-  or
-  wrong = "sucessfull" and right = "successful"
-  or
-  wrong = "sucessfully" and right = "successfully"
-  or
-  wrong = "sucessfuly" and right = "successfully"
-  or
-  wrong = "sucession" and right = "succession"
-  or
-  wrong = "sucessive" and right = "successive"
-  or
-  wrong = "sucessor" and right = "successor"
-  or
-  wrong = "sucessot" and right = "successor"
-  or
-  wrong = "sucide" and right = "suicide"
-  or
-  wrong = "sucidial" and right = "suicidal"
-  or
-  wrong = "sudent" and right = "student"
-  or
-  wrong = "sudents" and right = "students"
-  or
-  wrong = "sufferage" and right = "suffrage"
-  or
-  wrong = "sufferred" and right = "suffered"
-  or
-  wrong = "sufferring" and right = "suffering"
-  or
-  wrong = "sufficent" and right = "sufficient"
-  or
-  wrong = "sufficently" and right = "sufficiently"
-  or
-  wrong = "sumary" and right = "summary"
-  or
-  wrong = "sunglases" and right = "sunglasses"
-  or
-  wrong = "suop" and right = "soup"
-  or
-  wrong = "superceeded" and right = "superseded"
-  or
-  wrong = "superintendant" and right = "superintendent"
-  or
-  wrong = "suphisticated" and right = "sophisticated"
-  or
-  wrong = "suplimented" and right = "supplemented"
-  or
-  wrong = "suported" and right = "supported"
-  or
-  wrong = "supose" and right = "suppose"
-  or
-  wrong = "suposed" and right = "supposed"
-  or
-  wrong = "suposedly" and right = "supposedly"
-  or
-  wrong = "suposes" and right = "supposes"
-  or
-  wrong = "suposing" and right = "supposing"
-  or
-  wrong = "supplamented" and right = "supplemented"
-  or
-  wrong = "suppliementing" and right = "supplementing"
-  or
-  wrong = "suppoed" and right = "supposed"
-  or
-  wrong = "supposingly" and right = "supposedly"
-  or
-  wrong = "suppy" and right = "supply"
-  or
-  wrong = "suprassing" and right = "surpassing"
-  or
-  wrong = "supress" and right = "suppress"
-  or
-  wrong = "supressed" and right = "suppressed"
-  or
-  wrong = "supresses" and right = "suppresses"
-  or
-  wrong = "supressing" and right = "suppressing"
-  or
-  wrong = "suprise" and right = "surprise"
-  or
-  wrong = "suprised" and right = "surprised"
-  or
-  wrong = "suprising" and right = "surprising"
-  or
-  wrong = "suprisingly" and right = "surprisingly"
-  or
-  wrong = "suprize" and right = "surprise"
-  or
-  wrong = "suprized" and right = "surprised"
-  or
-  wrong = "suprizing" and right = "surprising"
-  or
-  wrong = "suprizingly" and right = "surprisingly"
-  or
-  wrong = "surfce" and right = "surface"
-  or
-  wrong = "surley" and right = "surely"
-  or
-  wrong = "surley" and right = "surly"
-  or
-  wrong = "suround" and right = "surround"
-  or
-  wrong = "surounded" and right = "surrounded"
-  or
-  wrong = "surounding" and right = "surrounding"
-  or
-  wrong = "suroundings" and right = "surroundings"
-  or
-  wrong = "surounds" and right = "surrounds"
-  or
-  wrong = "surplanted" and right = "supplanted"
-  or
-  wrong = "surpress" and right = "suppress"
-  or
-  wrong = "surpressed" and right = "suppressed"
-  or
-  wrong = "surprize" and right = "surprise"
-  or
-  wrong = "surprized" and right = "surprised"
-  or
-  wrong = "surprizing" and right = "surprising"
-  or
-  wrong = "surprizingly" and right = "surprisingly"
-  or
-  wrong = "surrended" and right = "surrendered"
-  or
-  wrong = "surrended" and right = "surrounded"
-  or
-  wrong = "surrepetitious" and right = "surreptitious"
-  or
-  wrong = "surrepetitiously" and right = "surreptitiously"
-  or
-  wrong = "surreptious" and right = "surreptitious"
-  or
-  wrong = "surreptiously" and right = "surreptitiously"
-  or
-  wrong = "surronded" and right = "surrounded"
-  or
-  wrong = "surrouded" and right = "surrounded"
-  or
-  wrong = "surrouding" and right = "surrounding"
-  or
-  wrong = "surrundering" and right = "surrendering"
-  or
-  wrong = "surveilence" and right = "surveillance"
-  or
-  wrong = "surveill" and right = "surveil"
-  or
-  wrong = "surveyer" and right = "surveyor"
-  or
-  wrong = "surviver" and right = "survivor"
-  or
-  wrong = "survivers" and right = "survivors"
-  or
-  wrong = "survivied" and right = "survived"
-  or
-  wrong = "suseptable" and right = "susceptible"
-  or
-  wrong = "suseptible" and right = "susceptible"
-  or
-  wrong = "suspention" and right = "suspension"
-  or
-  wrong = "swaer" and right = "swear"
-  or
-  wrong = "swaers" and right = "swears"
-  or
-  wrong = "swepth" and right = "swept"
-  or
-  wrong = "swiming" and right = "swimming"
-  or
-  wrong = "syas" and right = "says"
-  or
-  wrong = "symetrical" and right = "symmetrical"
-  or
-  wrong = "symetrically" and right = "symmetrically"
-  or
-  wrong = "symetry" and right = "symmetry"
-  or
-  wrong = "symettric" and right = "symmetric"
-  or
-  wrong = "symmetral" and right = "symmetric"
-  or
-  wrong = "symmetricaly" and right = "symmetrically"
-  or
-  wrong = "synagouge" and right = "synagogue"
-  or
-  wrong = "syncronization" and right = "synchronization"
-  or
-  wrong = "synonomous" and right = "synonymous"
-  or
-  wrong = "synonymns" and right = "synonyms"
-  or
-  wrong = "synphony" and right = "symphony"
-  or
-  wrong = "syphyllis" and right = "syphilis"
-  or
-  wrong = "sypmtoms" and right = "symptoms"
-  or
-  wrong = "syrap" and right = "syrup"
-  or
-  wrong = "sysmatically" and right = "systematically"
-  or
-  wrong = "sytem" and right = "system"
-  or
-  wrong = "sytle" and right = "style"
-  or
-  wrong = "tabacco" and right = "tobacco"
-  or
-  wrong = "tahn" and right = "than"
-  or
-  wrong = "taht" and right = "that"
-  or
-  wrong = "talekd" and right = "talked"
-  or
-  wrong = "targetted" and right = "targeted"
-  or
-  wrong = "targetting" and right = "targeting"
-  or
-  wrong = "tast" and right = "taste"
-  or
-  wrong = "tath" and right = "that"
-  or
-  wrong = "tatoo" and right = "tattoo"
-  or
-  wrong = "tattooes" and right = "tattoos"
-  or
-  wrong = "taxanomic" and right = "taxonomic"
-  or
-  wrong = "taxanomy" and right = "taxonomy"
-  or
-  wrong = "teached" and right = "taught"
-  or
-  wrong = "techician" and right = "technician"
-  or
-  wrong = "techicians" and right = "technicians"
-  or
-  wrong = "techiniques" and right = "techniques"
-  or
-  wrong = "technitian" and right = "technician"
-  or
-  wrong = "technnology" and right = "technology"
-  or
-  wrong = "technolgy" and right = "technology"
-  or
-  wrong = "teh" and right = "the"
-  or
-  wrong = "tehy" and right = "they"
-  or
-  wrong = "telelevision" and right = "television"
-  or
-  wrong = "televsion" and right = "television"
-  or
-  wrong = "telphony" and right = "telephony"
-  or
-  wrong = "temerature" and right = "temperature"
-  or
-  wrong = "tempalte" and right = "template"
-  or
-  wrong = "tempaltes" and right = "templates"
-  or
-  wrong = "temparate" and right = "temperate"
-  or
-  wrong = "temperarily" and right = "temporarily"
-  or
-  wrong = "temperment" and right = "temperament"
-  or
-  wrong = "tempertaure" and right = "temperature"
-  or
-  wrong = "temperture" and right = "temperature"
-  or
-  wrong = "temprary" and right = "temporary"
-  or
-  wrong = "tenacle" and right = "tentacle"
-  or
-  wrong = "tenacles" and right = "tentacles"
-  or
-  wrong = "tendacy" and right = "tendency"
-  or
-  wrong = "tendancies" and right = "tendencies"
-  or
-  wrong = "tendancy" and right = "tendency"
-  or
-  wrong = "tepmorarily" and right = "temporarily"
-  or
-  wrong = "terrestial" and right = "terrestrial"
-  or
-  wrong = "terriories" and right = "territories"
-  or
-  wrong = "terriory" and right = "territory"
-  or
-  wrong = "territorist" and right = "terrorist"
-  or
-  wrong = "territoy" and right = "territory"
-  or
-  wrong = "terroist" and right = "terrorist"
-  or
-  wrong = "testiclular" and right = "testicular"
-  or
-  wrong = "testomony" and right = "testimony"
-  or
-  wrong = "tghe" and right = "the"
-  or
-  wrong = "thast" and right = "that"
-  or
-  wrong = "theather" and right = "theater"
-  or
-  wrong = "theese" and right = "these"
-  or
-  wrong = "theif" and right = "thief"
-  or
-  wrong = "theives" and right = "thieves"
-  or
-  wrong = "themselfs" and right = "themselves"
-  or
-  wrong = "themslves" and right = "themselves"
-  or
-  wrong = "ther" and right = "the"
-  or
-  wrong = "ther" and right = "their"
-  or
-  wrong = "ther" and right = "there"
-  or
-  wrong = "therafter" and right = "thereafter"
-  or
-  wrong = "therby" and right = "thereby"
-  or
-  wrong = "theri" and right = "their"
-  or
-  wrong = "thgat" and right = "that"
-  or
-  wrong = "thge" and right = "the"
-  or
-  wrong = "thier" and right = "their"
-  or
-  wrong = "thign" and right = "thing"
-  or
-  wrong = "thigns" and right = "things"
-  or
-  wrong = "thigsn" and right = "things"
-  or
-  wrong = "thikn" and right = "think"
-  or
-  wrong = "thikning" and right = "thickening"
-  or
-  wrong = "thikning" and right = "thinking"
-  or
-  wrong = "thikns" and right = "thinks"
-  or
-  wrong = "thiunk" and right = "think"
-  or
-  wrong = "thn" and right = "then"
-  or
-  wrong = "thna" and right = "than"
-  or
-  wrong = "thne" and right = "then"
-  or
-  wrong = "thnig" and right = "thing"
-  or
-  wrong = "thnigs" and right = "things"
-  or
-  wrong = "thoughout" and right = "throughout"
-  or
-  wrong = "threatend" and right = "threatened"
-  or
-  wrong = "threatning" and right = "threatening"
-  or
-  wrong = "threee" and right = "three"
-  or
-  wrong = "threshhold" and right = "threshold"
-  or
-  wrong = "thrid" and right = "third"
-  or
-  wrong = "throrough" and right = "thorough"
-  or
-  wrong = "throughly" and right = "thoroughly"
-  or
-  wrong = "throught" and right = "thought"
-  or
-  wrong = "throught" and right = "through"
-  or
-  wrong = "throught" and right = "throughout"
-  or
-  wrong = "througout" and right = "throughout"
-  or
-  wrong = "thru" and right = "through"
-  or
-  wrong = "thsi" and right = "this"
-  or
-  wrong = "thsoe" and right = "those"
-  or
-  wrong = "thta" and right = "that"
-  or
-  wrong = "thyat" and right = "that"
-  or
-  wrong = "tiem" and right = "tim"
-  or
-  wrong = "tiem" and right = "time"
-  or
-  wrong = "tihkn" and right = "think"
-  or
-  wrong = "tihs" and right = "this"
-  or
-  wrong = "timne" and right = "time"
-  or
-  wrong = "tiome" and right = "time"
-  or
-  wrong = "tiome" and right = "tome"
-  or
-  wrong = "tje" and right = "the"
-  or
-  wrong = "tjhe" and right = "the"
-  or
-  wrong = "tjpanishad" and right = "upanishad"
-  or
-  wrong = "tkae" and right = "take"
-  or
-  wrong = "tkaes" and right = "takes"
-  or
-  wrong = "tkaing" and right = "taking"
-  or
-  wrong = "tlaking" and right = "talking"
-  or
-  wrong = "tobbaco" and right = "tobacco"
-  or
-  wrong = "todya" and right = "today"
-  or
-  wrong = "toghether" and right = "together"
-  or
-  wrong = "toke" and right = "took"
-  or
-  wrong = "tolerence" and right = "tolerance"
-  or
-  wrong = "tolkein" and right = "tolkien"
-  or
-  wrong = "tomatos" and right = "tomatoes"
-  or
-  wrong = "tommorow" and right = "tomorrow"
-  or
-  wrong = "tommorrow" and right = "tomorrow"
-  or
-  wrong = "tongiht" and right = "tonight"
-  or
-  wrong = "toriodal" and right = "toroidal"
-  or
-  wrong = "tormenters" and right = "tormentors"
-  or
-  wrong = "tornadoe" and right = "tornado"
-  or
-  wrong = "torpeados" and right = "torpedoes"
-  or
-  wrong = "torpedos" and right = "torpedoes"
-  or
-  wrong = "tortise" and right = "tortoise"
-  or
-  wrong = "toubles" and right = "troubles"
-  or
-  wrong = "tounge" and right = "tongue"
-  or
-  wrong = "tourch" and right = "torch"
-  or
-  wrong = "tourch" and right = "touch"
-  or
-  wrong = "towords" and right = "towards"
-  or
-  wrong = "towrad" and right = "toward"
-  or
-  wrong = "tradionally" and right = "traditionally"
-  or
-  wrong = "traditionaly" and right = "traditionally"
-  or
-  wrong = "traditionnal" and right = "traditional"
-  or
-  wrong = "traditition" and right = "tradition"
-  or
-  wrong = "tradtionally" and right = "traditionally"
-  or
-  wrong = "trafficed" and right = "trafficked"
-  or
-  wrong = "trafficing" and right = "trafficking"
-  or
-  wrong = "trafic" and right = "traffic"
-  or
-  wrong = "trancendent" and right = "transcendent"
-  or
-  wrong = "trancending" and right = "transcending"
-  or
-  wrong = "tranform" and right = "transform"
-  or
-  wrong = "tranformed" and right = "transformed"
-  or
-  wrong = "transcendance" and right = "transcendence"
-  or
-  wrong = "transcendant" and right = "transcendent"
-  or
-  wrong = "transcendentational" and right = "transcendental"
-  or
-  wrong = "transcripting" and right = "transcribing"
-  or
-  wrong = "transcripting" and right = "transcription"
-  or
-  wrong = "transending" and right = "transcending"
-  or
-  wrong = "transesxuals" and right = "transsexuals"
-  or
-  wrong = "transfered" and right = "transferred"
-  or
-  wrong = "transfering" and right = "transferring"
-  or
-  wrong = "transformaton" and right = "transformation"
-  or
-  wrong = "transistion" and right = "transition"
-  or
-  wrong = "translater" and right = "translator"
-  or
-  wrong = "translaters" and right = "translators"
-  or
-  wrong = "transmissable" and right = "transmissible"
-  or
-  wrong = "transporation" and right = "transportation"
-  or
-  wrong = "tremelo" and right = "tremolo"
-  or
-  wrong = "tremelos" and right = "tremolos"
-  or
-  wrong = "treshold" and right = "threshold"
-  or
-  wrong = "triguered" and right = "triggered"
-  or
-  wrong = "triology" and right = "trilogy"
-  or
-  wrong = "troling" and right = "trolling"
-  or
-  wrong = "troup" and right = "troupe"
-  or
-  wrong = "troups" and right = "troops"
-  or
-  wrong = "troups" and right = "troupes"
-  or
-  wrong = "truely" and right = "truly"
-  or
-  wrong = "trustworthyness" and right = "trustworthiness"
-  or
-  wrong = "turnk" and right = "trunk"
-  or
-  wrong = "turnk" and right = "turnkey"
-  or
-  wrong = "tuscon" and right = "tucson"
-  or
-  wrong = "tust" and right = "trust"
-  or
-  wrong = "twelth" and right = "twelfth"
-  or
-  wrong = "twon" and right = "town"
-  or
-  wrong = "twpo" and right = "two"
-  or
-  wrong = "tyhat" and right = "that"
-  or
-  wrong = "tyhe" and right = "they"
-  or
-  wrong = "typcial" and right = "typical"
-  or
-  wrong = "typicaly" and right = "typically"
-  or
-  wrong = "tyranies" and right = "tyrannies"
-  or
-  wrong = "tyrany" and right = "tyranny"
-  or
-  wrong = "tyrranies" and right = "tyrannies"
-  or
-  wrong = "tyrrany" and right = "tyranny"
-  or
-  wrong = "ubiquitious" and right = "ubiquitous"
-  or
-  wrong = "ublisher" and right = "publisher"
-  or
-  wrong = "udpate" and right = "update"
-  or
-  wrong = "uise" and right = "use"
-  or
-  wrong = "ukranian" and right = "ukrainian"
-  or
-  wrong = "ultimely" and right = "ultimately"
-  or
-  wrong = "unacompanied" and right = "unaccompanied"
-  or
-  wrong = "unahppy" and right = "unhappy"
-  or
-  wrong = "unanymous" and right = "unanimous"
-  or
-  wrong = "unathorised" and right = "unauthorised"
-  or
-  wrong = "unavailible" and right = "unavailable"
-  or
-  wrong = "unballance" and right = "unbalance"
-  or
-  wrong = "unbeknowst" and right = "unbeknownst"
-  or
-  wrong = "unbeleivable" and right = "unbelievable"
-  or
-  wrong = "uncertainity" and right = "uncertainty"
-  or
-  wrong = "unchallengable" and right = "unchallengeable"
-  or
-  wrong = "unchangable" and right = "unchangeable"
-  or
-  wrong = "uncompetive" and right = "uncompetitive"
-  or
-  wrong = "unconcious" and right = "unconscious"
-  or
-  wrong = "unconciousness" and right = "unconsciousness"
-  or
-  wrong = "unconfortability" and right = "discomfort"
-  or
-  wrong = "uncontitutional" and right = "unconstitutional"
-  or
-  wrong = "unconvential" and right = "unconventional"
-  or
-  wrong = "undecideable" and right = "undecidable"
-  or
-  wrong = "understoon" and right = "understood"
-  or
-  wrong = "undesireable" and right = "undesirable"
-  or
-  wrong = "undetecable" and right = "undetectable"
-  or
-  wrong = "undoubtely" and right = "undoubtedly"
-  or
-  wrong = "undreground" and right = "underground"
-  or
-  wrong = "uneccesary" and right = "unnecessary"
-  or
-  wrong = "unecessary" and right = "unnecessary"
-  or
-  wrong = "unequalities" and right = "inequalities"
-  or
-  wrong = "unforetunately" and right = "unfortunately"
-  or
-  wrong = "unforgetable" and right = "unforgettable"
-  or
-  wrong = "unforgiveable" and right = "unforgivable"
-  or
-  wrong = "unforseen" and right = "unforeseen"
-  or
-  wrong = "unfortunatley" and right = "unfortunately"
-  or
-  wrong = "unfortunatly" and right = "unfortunately"
-  or
-  wrong = "unfourtunately" and right = "unfortunately"
-  or
-  wrong = "unihabited" and right = "uninhabited"
-  or
-  wrong = "unilateraly" and right = "unilaterally"
-  or
-  wrong = "unilatreal" and right = "unilateral"
-  or
-  wrong = "unilatreally" and right = "unilaterally"
-  or
-  wrong = "uninterruped" and right = "uninterrupted"
-  or
-  wrong = "uninterupted" and right = "uninterrupted"
-  or
-  wrong = "unintialized" and right = "uninitialized"
-  or
-  wrong = "unitesstates" and right = "unitedstates"
-  or
-  wrong = "univeral" and right = "universal"
-  or
-  wrong = "univeristies" and right = "universities"
-  or
-  wrong = "univeristy" and right = "university"
-  or
-  wrong = "univerity" and right = "university"
-  or
-  wrong = "universtiy" and right = "university"
-  or
-  wrong = "univesities" and right = "universities"
-  or
-  wrong = "univesity" and right = "university"
-  or
-  wrong = "unkown" and right = "unknown"
-  or
-  wrong = "unlikey" and right = "unlikely"
-  or
-  wrong = "unmanouverable" and right = "unmaneuverable"
-  or
-  wrong = "unmanouverable" and right = "unmanoeuvrable"
-  or
-  wrong = "unmistakeably" and right = "unmistakably"
-  or
-  wrong = "unneccesarily" and right = "unnecessarily"
-  or
-  wrong = "unneccesary" and right = "unnecessary"
-  or
-  wrong = "unneccessarily" and right = "unnecessarily"
-  or
-  wrong = "unneccessary" and right = "unnecessary"
-  or
-  wrong = "unnecesarily" and right = "unnecessarily"
-  or
-  wrong = "unnecesary" and right = "unnecessary"
-  or
-  wrong = "unoffical" and right = "unofficial"
-  or
-  wrong = "unoperational" and right = "nonoperational"
-  or
-  wrong = "unoticeable" and right = "unnoticeable"
-  or
-  wrong = "unplease" and right = "displease"
-  or
-  wrong = "unplesant" and right = "unpleasant"
-  or
-  wrong = "unprecendented" and right = "unprecedented"
-  or
-  wrong = "unprecidented" and right = "unprecedented"
-  or
-  wrong = "unrepentent" and right = "unrepentant"
-  or
-  wrong = "unrepetant" and right = "unrepentant"
-  or
-  wrong = "unrepetent" and right = "unrepentant"
-  or
-  wrong = "unsed" and right = "unsaid"
-  or
-  wrong = "unsed" and right = "unused"
-  or
-  wrong = "unsed" and right = "used"
-  or
-  wrong = "unsubstanciated" and right = "unsubstantiated"
-  or
-  wrong = "unsuccesful" and right = "unsuccessful"
-  or
-  wrong = "unsuccesfully" and right = "unsuccessfully"
-  or
-  wrong = "unsuccessfull" and right = "unsuccessful"
-  or
-  wrong = "unsucesful" and right = "unsuccessful"
-  or
-  wrong = "unsucesfuly" and right = "unsuccessfully"
-  or
-  wrong = "unsucessful" and right = "unsuccessful"
-  or
-  wrong = "unsucessfull" and right = "unsuccessful"
-  or
-  wrong = "unsucessfully" and right = "unsuccessfully"
-  or
-  wrong = "unsuprised" and right = "unsurprised"
-  or
-  wrong = "unsuprising" and right = "unsurprising"
-  or
-  wrong = "unsuprisingly" and right = "unsurprisingly"
-  or
-  wrong = "unsuprized" and right = "unsurprised"
-  or
-  wrong = "unsuprizing" and right = "unsurprising"
-  or
-  wrong = "unsuprizingly" and right = "unsurprisingly"
-  or
-  wrong = "unsurprized" and right = "unsurprised"
-  or
-  wrong = "unsurprizing" and right = "unsurprising"
-  or
-  wrong = "unsurprizingly" and right = "unsurprisingly"
-  or
-  wrong = "untill" and right = "until"
-  or
-  wrong = "untranslateable" and right = "untranslatable"
-  or
-  wrong = "unuseable" and right = "unusable"
-  or
-  wrong = "unusuable" and right = "unusable"
-  or
-  wrong = "unviersity" and right = "university"
-  or
-  wrong = "unwarrented" and right = "unwarranted"
-  or
-  wrong = "unweildly" and right = "unwieldy"
-  or
-  wrong = "unwieldly" and right = "unwieldy"
-  or
-  wrong = "upcomming" and right = "upcoming"
-  or
-  wrong = "upgradded" and right = "upgraded"
-  or
-  wrong = "usally" and right = "usually"
-  or
-  wrong = "useage" and right = "usage"
-  or
-  wrong = "usefull" and right = "useful"
-  or
-  wrong = "usefuly" and right = "usefully"
-  or
-  wrong = "useing" and right = "using"
-  or
-  wrong = "usualy" and right = "usually"
-  or
-  wrong = "ususally" and right = "usually"
-  or
-  wrong = "vaccum" and right = "vacuum"
-  or
-  wrong = "vaccume" and right = "vacuum"
-  or
-  wrong = "vacinity" and right = "vicinity"
-  or
-  wrong = "vaguaries" and right = "vagaries"
-  or
-  wrong = "vaieties" and right = "varieties"
-  or
-  wrong = "vailidty" and right = "validity"
-  or
-  wrong = "valetta" and right = "valletta"
-  or
-  wrong = "valuble" and right = "valuable"
-  or
-  wrong = "valueable" and right = "valuable"
-  or
-  wrong = "varations" and right = "variations"
-  or
-  wrong = "varient" and right = "variant"
-  or
-  wrong = "variey" and right = "variety"
-  or
-  wrong = "varing" and right = "varying"
-  or
-  wrong = "varities" and right = "varieties"
-  or
-  wrong = "varity" and right = "variety"
-  or
-  wrong = "vasall" and right = "vassal"
-  or
-  wrong = "vasalls" and right = "vassals"
-  or
-  wrong = "vaule" and right = "value"
-  or
-  wrong = "vegatarian" and right = "vegetarian"
-  or
-  wrong = "vegitable" and right = "vegetable"
-  or
-  wrong = "vegitables" and right = "vegetables"
-  or
-  wrong = "vegtable" and right = "vegetable"
-  or
-  wrong = "vehicule" and right = "vehicle"
-  or
-  wrong = "vell" and right = "well"
-  or
-  wrong = "venemous" and right = "venomous"
-  or
-  wrong = "vengance" and right = "vengeance"
-  or
-  wrong = "vengence" and right = "vengeance"
-  or
-  wrong = "verfication" and right = "verification"
-  or
-  wrong = "verison" and right = "version"
-  or
-  wrong = "verisons" and right = "versions"
-  or
-  wrong = "vermillion" and right = "vermilion"
-  or
-  wrong = "versitilaty" and right = "versatility"
-  or
-  wrong = "versitlity" and right = "versatility"
-  or
-  wrong = "vetween" and right = "between"
-  or
-  wrong = "veyr" and right = "very"
-  or
-  wrong = "vigeur" and right = "vigor"
-  or
-  wrong = "vigeur" and right = "vigour"
-  or
-  wrong = "vigeur" and right = "vigueur"
-  or
-  wrong = "vigilence" and right = "vigilance"
-  or
-  wrong = "vigourous" and right = "vigorous"
-  or
-  wrong = "villian" and right = "villain"
-  or
-  wrong = "villification" and right = "vilification"
-  or
-  wrong = "villify" and right = "vilify"
-  or
-  wrong = "villin" and right = "villain"
-  or
-  wrong = "villin" and right = "villein"
-  or
-  wrong = "villin" and right = "villi"
-  or
-  wrong = "vincinity" and right = "vicinity"
-  or
-  wrong = "violentce" and right = "violence"
-  or
-  wrong = "virtualy" and right = "virtually"
-  or
-  wrong = "virutal" and right = "virtual"
-  or
-  wrong = "virutally" and right = "virtually"
-  or
-  wrong = "visable" and right = "visible"
-  or
-  wrong = "visably" and right = "visibly"
-  or
-  wrong = "visting" and right = "visiting"
-  or
-  wrong = "vistors" and right = "visitors"
-  or
-  wrong = "vitories" and right = "victories"
-  or
-  wrong = "volcanoe" and right = "volcano"
-  or
-  wrong = "voleyball" and right = "volleyball"
-  or
-  wrong = "volontary" and right = "voluntary"
-  or
-  wrong = "volonteer" and right = "volunteer"
-  or
-  wrong = "volonteered" and right = "volunteered"
-  or
-  wrong = "volonteering" and right = "volunteering"
-  or
-  wrong = "volonteers" and right = "volunteers"
-  or
-  wrong = "volounteer" and right = "volunteer"
-  or
-  wrong = "volounteered" and right = "volunteered"
-  or
-  wrong = "volounteering" and right = "volunteering"
-  or
-  wrong = "volounteers" and right = "volunteers"
-  or
-  wrong = "volumne" and right = "volume"
-  or
-  wrong = "vreity" and right = "variety"
-  or
-  wrong = "vrey" and right = "very"
-  or
-  wrong = "vriety" and right = "variety"
-  or
-  wrong = "vulnerablility" and right = "vulnerability"
-  or
-  wrong = "vyer" and right = "very"
-  or
-  wrong = "vyre" and right = "very"
-  or
-  wrong = "waht" and right = "what"
-  or
-  wrong = "warantee" and right = "warranty"
-  or
-  wrong = "wardobe" and right = "wardrobe"
-  or
-  wrong = "warrent" and right = "warrant"
-  or
-  wrong = "warrriors" and right = "warriors"
-  or
-  wrong = "wass" and right = "was"
-  or
-  wrong = "watn" and right = "want"
-  or
-  wrong = "wayword" and right = "wayward"
-  or
-  wrong = "weaponary" and right = "weaponry"
-  or
-  wrong = "weas" and right = "was"
-  or
-  wrong = "wehn" and right = "when"
-  or
-  wrong = "weild" and right = "wield"
-  or
-  wrong = "weild" and right = "wild"
-  or
-  wrong = "weilded" and right = "wielded"
-  or
-  wrong = "wendsay" and right = "wednesday"
-  or
-  wrong = "wensday" and right = "wednesday"
-  or
-  wrong = "wereabouts" and right = "whereabouts"
-  or
-  wrong = "whant" and right = "want"
-  or
-  wrong = "whants" and right = "wants"
-  or
-  wrong = "whcih" and right = "which"
-  or
-  wrong = "wheras" and right = "whereas"
-  or
-  wrong = "wherease" and right = "whereas"
-  or
-  wrong = "whereever" and right = "wherever"
-  or
-  wrong = "whic" and right = "which"
-  or
-  wrong = "whihc" and right = "which"
-  or
-  wrong = "whith" and right = "with"
-  or
-  wrong = "whlch" and right = "which"
-  or
-  wrong = "whn" and right = "when"
-  or
-  wrong = "wholey" and right = "wholly"
-  or
-  wrong = "wholy" and right = "holy"
-  or
-  wrong = "wholy" and right = "wholly"
-  or
-  wrong = "whta" and right = "what"
-  or
-  wrong = "whther" and right = "whether"
-  or
-  wrong = "wich" and right = "which"
-  or
-  wrong = "wich" and right = "witch"
-  or
-  wrong = "widesread" and right = "widespread"
-  or
-  wrong = "wief" and right = "wife"
-  or
-  wrong = "wierd" and right = "weird"
-  or
-  wrong = "wiew" and right = "view"
-  or
-  wrong = "wih" and right = "with"
-  or
-  wrong = "wiht" and right = "with"
-  or
-  wrong = "wille" and right = "will"
-  or
-  wrong = "willingless" and right = "willingness"
-  or
-  wrong = "willk" and right = "will"
-  or
-  wrong = "wirting" and right = "writing"
-  or
-  wrong = "withdrawl" and right = "withdraw"
-  or
-  wrong = "withdrawl" and right = "withdrawal"
-  or
-  wrong = "witheld" and right = "withheld"
-  or
-  wrong = "withh" and right = "with"
-  or
-  wrong = "withing" and right = "within"
-  or
-  wrong = "withold" and right = "withhold"
-  or
-  wrong = "witht" and right = "with"
-  or
-  wrong = "witn" and right = "with"
-  or
-  wrong = "wiull" and right = "will"
-  or
-  wrong = "wnat" and right = "want"
-  or
-  wrong = "wnated" and right = "wanted"
-  or
-  wrong = "wnats" and right = "wants"
-  or
-  wrong = "wohle" and right = "whole"
-  or
-  wrong = "wokr" and right = "work"
-  or
-  wrong = "wokring" and right = "working"
-  or
-  wrong = "wonderfull" and right = "wonderful"
-  or
-  wrong = "wordlwide" and right = "worldwide"
-  or
-  wrong = "workststion" and right = "workstation"
-  or
-  wrong = "worls" and right = "world"
-  or
-  wrong = "worstened" and right = "worsened"
-  or
-  wrong = "woudl" and right = "would"
-  or
-  wrong = "wresters" and right = "wrestlers"
-  or
-  wrong = "wriet" and right = "write"
-  or
-  wrong = "writen" and right = "written"
-  or
-  wrong = "wroet" and right = "wrote"
-  or
-  wrong = "wrok" and right = "work"
-  or
-  wrong = "wroking" and right = "working"
-  or
-  wrong = "wtih" and right = "with"
-  or
-  wrong = "wupport" and right = "support"
-  or
-  wrong = "xenophoby" and right = "xenophobia"
-  or
-  wrong = "yaching" and right = "yachting"
-  or
-  wrong = "yaer" and right = "year"
-  or
-  wrong = "yaerly" and right = "yearly"
-  or
-  wrong = "yaers" and right = "years"
-  or
-  wrong = "yatch" and right = "yacht"
-  or
-  wrong = "yearm" and right = "year"
-  or
-  wrong = "yeasr" and right = "years"
-  or
-  wrong = "yeild" and right = "yield"
-  or
-  wrong = "yeilding" and right = "yielding"
-  or
-  wrong = "yementite" and right = "yemeni"
-  or
-  wrong = "yementite" and right = "yemenite"
-  or
-  wrong = "yera" and right = "year"
-  or
-  wrong = "yeras" and right = "years"
-  or
-  wrong = "yersa" and right = "years"
-  or
-  wrong = "yotube" and right = "youtube"
-  or
-  wrong = "youseff" and right = "yousef"
-  or
-  wrong = "youself" and right = "yourself"
-  or
-  wrong = "yrea" and right = "year"
-  or
-  wrong = "ytou" and right = "you"
-  or
-  wrong = "yuo" and right = "you"
-  or
-  wrong = "zeebra" and right = "zebra"
-}
+import codeql.typos.TypoDatabase as DB
+
+/** DEPRECATED: Use the `codeql/typos` pack instead. */
+deprecated predicate typos = DB::typos/2;
diff --git a/javascript/ql/src/RegExp/RegExpAlwaysMatches.ql b/javascript/ql/src/RegExp/RegExpAlwaysMatches.ql
index 06e0a8146ef..4ddbe4516cc 100644
--- a/javascript/ql/src/RegExp/RegExpAlwaysMatches.ql
+++ b/javascript/ql/src/RegExp/RegExpAlwaysMatches.ql
@@ -54,6 +54,8 @@ predicate isUniversalRegExp(RegExpTerm term) {
     or
     child.(RegExpCharacterClass).isUniversalClass()
   )
+  or
+  term.(RegExpSequence).getNumChild() = 0
 }
 
 /**
@@ -116,6 +118,6 @@ where
     call instanceof RegExpSearchCall and
     not term.getAChild*() instanceof RegExpDollar and
     message =
-      "This regular expression always the matches at index 0 when used $@, as it matches the empty substring."
+      "This regular expression always matches at index 0 when used $@, as it matches the empty substring."
   )
 select term, message, call, "here"
diff --git a/javascript/ql/src/Security/CWE-022/ZipSlip.ql b/javascript/ql/src/Security/CWE-022/ZipSlip.ql
index 6daa4f01969..13dd6c2ac35 100644
--- a/javascript/ql/src/Security/CWE-022/ZipSlip.ql
+++ b/javascript/ql/src/Security/CWE-022/ZipSlip.ql
@@ -18,6 +18,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink,
-  "Unsanitized zip archive $@, which may contain '..', is used in a file system operation.",
-  source.getNode(), "item path"
+select source.getNode(), source, sink, "$@ depends on $@ which may contain '..'", sink.getNode(),
+  "File system operation", source.getNode(), "unsanitized archive entry"
diff --git a/javascript/ql/src/Security/CWE-073/TemplateObjectInjection.ql b/javascript/ql/src/Security/CWE-073/TemplateObjectInjection.ql
index ea4f0476484..eadf7fed7e9 100644
--- a/javascript/ql/src/Security/CWE-073/TemplateObjectInjection.ql
+++ b/javascript/ql/src/Security/CWE-073/TemplateObjectInjection.ql
@@ -17,5 +17,5 @@ import semmle.javascript.security.dataflow.TemplateObjectInjectionQuery
 
 from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Template object injection due to $@.", source.getNode(),
-  "user-provided value"
+select sink.getNode(), source, sink, "Template object depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-078/CommandInjection.ql b/javascript/ql/src/Security/CWE-078/CommandInjection.ql
index 7bb57bfa6da..051b4d80f12 100644
--- a/javascript/ql/src/Security/CWE-078/CommandInjection.ql
+++ b/javascript/ql/src/Security/CWE-078/CommandInjection.ql
@@ -28,5 +28,5 @@ where
     else highlight = sink.getNode()
   ) and
   sourceNode = source.getNode()
-select highlight, source, sink, "This command depends on $@.", sourceNode,
-  sourceNode.getSourceType()
+select highlight, source, sink, "Command line depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql b/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql
index e29a75c1163..1f5f5c19a69 100644
--- a/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql
+++ b/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql
@@ -19,6 +19,6 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
 where cfg.hasFlowPath(source, sink) and sinkNode = sink.getNode()
-select sinkNode.getAlertLocation(), source, sink, "$@ based on $@ is later used in $@.",
+select sinkNode.getAlertLocation(), source, sink, "$@ which depends on $@ is later used in $@.",
   sinkNode.getAlertLocation(), sinkNode.getSinkType(), source.getNode(), "library input",
-  sinkNode.getCommandExecution(), "shell command"
+  sinkNode.getCommandExecution(), "a shell command"
diff --git a/javascript/ql/src/Security/CWE-079/UnsafeHtmlConstruction.ql b/javascript/ql/src/Security/CWE-079/UnsafeHtmlConstruction.ql
index 32a7dbe38b6..c204b0d106d 100644
--- a/javascript/ql/src/Security/CWE-079/UnsafeHtmlConstruction.ql
+++ b/javascript/ql/src/Security/CWE-079/UnsafeHtmlConstruction.ql
@@ -18,6 +18,6 @@ import semmle.javascript.security.dataflow.UnsafeHtmlConstructionQuery
 
 from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
 where cfg.hasFlowPath(source, sink) and sink.getNode() = sinkNode
-select sinkNode, source, sink, "$@ based on $@ might later cause $@.", sinkNode,
+select sinkNode, source, sink, "$@ which depends on $@ might later allow $@.", sinkNode,
   sinkNode.describe(), source.getNode(), "library input", sinkNode.getSink(),
   sinkNode.getVulnerabilityKind().toLowerCase()
diff --git a/javascript/ql/src/Security/CWE-094/ImproperCodeSanitization.ql b/javascript/ql/src/Security/CWE-094/ImproperCodeSanitization.ql
index 694e827ba41..b0127f15000 100644
--- a/javascript/ql/src/Security/CWE-094/ImproperCodeSanitization.ql
+++ b/javascript/ql/src/Security/CWE-094/ImproperCodeSanitization.ql
@@ -68,5 +68,5 @@ where
     sink.getNode().(StringOps::ConcatenationLeaf).getRoot() = endsInCodeInjectionSink() and
     remoteFlow() = source.getNode().(DataFlow::InvokeNode).getAnArgument()
   )
-select sink.getNode(), source, sink, "$@ flows to here and is used to construct code.",
-  source.getNode(), "Improperly sanitized value"
+select sink.getNode(), source, sink, "Code construction depends on $@.", source.getNode(),
+  "an improperly sanitized value"
diff --git a/javascript/ql/src/Security/CWE-094/UnsafeCodeConstruction.ql b/javascript/ql/src/Security/CWE-094/UnsafeCodeConstruction.ql
index ff9b4fc4dd0..37381ef25c6 100644
--- a/javascript/ql/src/Security/CWE-094/UnsafeCodeConstruction.ql
+++ b/javascript/ql/src/Security/CWE-094/UnsafeCodeConstruction.ql
@@ -19,5 +19,5 @@ import semmle.javascript.security.dataflow.UnsafeCodeConstruction::UnsafeCodeCon
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ flows to here and is later $@.", source.getNode(),
+select sink.getNode(), source, sink, "$@ flows to this location and is later $@.", source.getNode(),
   "Library input", sink.getNode().(Sink).getCodeSink(), "interpreted as code"
diff --git a/javascript/ql/src/Security/CWE-094/UnsafeDynamicMethodAccess.ql b/javascript/ql/src/Security/CWE-094/UnsafeDynamicMethodAccess.ql
index 291fe71da7d..d90055e0bed 100644
--- a/javascript/ql/src/Security/CWE-094/UnsafeDynamicMethodAccess.ql
+++ b/javascript/ql/src/Security/CWE-094/UnsafeDynamicMethodAccess.ql
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink, source, sink,
-  "Invocation of method derived from $@ may lead to remote code execution.", source.getNode(),
-  "user-controlled value"
+  "This method is invoked using $@, which may allow remote code execution.", source.getNode(),
+  "a user-controlled value"
diff --git a/javascript/ql/src/Security/CWE-117/LogInjection.ql b/javascript/ql/src/Security/CWE-117/LogInjection.ql
index 2b9fff12e6f..ad0ad26f9dc 100644
--- a/javascript/ql/src/Security/CWE-117/LogInjection.ql
+++ b/javascript/ql/src/Security/CWE-117/LogInjection.ql
@@ -17,5 +17,5 @@ import semmle.javascript.security.dataflow.LogInjectionQuery
 
 from LogInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ flows to log entry.", source.getNode(),
-  "User-provided value"
+select sink.getNode(), source, sink, "Log entry depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-134/TaintedFormatString.ql b/javascript/ql/src/Security/CWE-134/TaintedFormatString.ql
index 06f44703a5d..b9eb4756554 100644
--- a/javascript/ql/src/Security/CWE-134/TaintedFormatString.ql
+++ b/javascript/ql/src/Security/CWE-134/TaintedFormatString.ql
@@ -16,5 +16,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ flows here and is used in a format string.",
-  source.getNode(), "User-provided value"
+select sink.getNode(), source, sink, "Format string depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql b/javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql
index ccf659bf024..e8835436c72 100644
--- a/javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql
+++ b/javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql
@@ -20,55 +20,29 @@ string toOtherCase(string s) {
   if s.regexpMatch(".*[a-z].*") then result = s.toUpperCase() else result = s.toLowerCase()
 }
 
-RegExpCharacterClass getEnclosingClass(RegExpTerm term) {
-  term = result.getAChild()
-  or
-  term = result.getAChild().(RegExpRange).getAChild()
-}
+import semmle.javascript.security.regexp.NfaUtils as NfaUtils
 
-/**
- * Holds if `term` seems to distinguish between upper and lower case letters, assuming the `i` flag is not present.
- */
-pragma[inline]
-predicate isLikelyCaseSensitiveRegExp(RegExpTerm term) {
-  exists(RegExpConstant const |
-    const = term.getAChild*() and
-    const.getValue().regexpMatch(".*[a-zA-Z].*") and
-    not getEnclosingClass(const).getAChild().(RegExpConstant).getValue() =
-      toOtherCase(const.getValue()) and
-    not const.getParent*() instanceof RegExpNegativeLookahead and
-    not const.getParent*() instanceof RegExpNegativeLookbehind
+/** Holds if `s` is a relevant regexp term were we want to compute a string that matches the term (for `getCaseSensitiveBypassExample`). */
+predicate isCand(NfaUtils::State s) {
+  s.getRepr() instanceof NfaUtils::RegExpRoot and
+  exists(DataFlow::RegExpCreationNode creation |
+    isCaseSensitiveMiddleware(_, creation, _) and
+    s.getRepr().getRootTerm() = creation.getRoot()
   )
 }
 
-/**
- * Gets a string matched by `term`, or part of such a string.
- */
+import NfaUtils::PrefixConstruction<isCand/1> as Prefix
+
+/** Gets a string matched by `term`. */
 string getExampleString(RegExpTerm term) {
-  result = term.getAMatchedString()
-  or
-  // getAMatchedString does not recurse into sequences. Perform one step manually.
-  exists(RegExpSequence seq | seq = term |
-    result =
-      strictconcat(RegExpTerm child, int i, string text |
-        child = seq.getChild(i) and
-        (
-          text = child.getAMatchedString()
-          or
-          not exists(child.getAMatchedString()) and
-          text = ""
-        )
-      |
-        text order by i
-      )
-  )
+  result = Prefix::prefix(any(NfaUtils::State s | s.getRepr() = term))
 }
 
 string getCaseSensitiveBypassExample(RegExpTerm term) {
-  exists(string example |
-    example = getExampleString(term) and
-    result = toOtherCase(example) and
-    result != example // getting an example string is approximate; ensure we got a proper case-change example
+  exists(string byPassExample |
+    byPassExample = getExampleString(term) and
+    result = toOtherCase(byPassExample) and
+    result != byPassExample // getting an byPassExample string is approximate; ensure we got a proper case-change byPassExample
   )
 }
 
@@ -89,7 +63,6 @@ predicate isCaseSensitiveMiddleware(
     ) and
     arg = call.getArgument(0) and
     regexp.getAReference().flowsTo(arg) and
-    isLikelyCaseSensitiveRegExp(regexp.getRoot()) and
     exists(string flags |
       flags = regexp.getFlags() and
       not RegExp::isIgnoreCase(flags)
@@ -108,14 +81,64 @@ predicate isGuardedCaseInsensitiveEndpoint(
   )
 }
 
+/**
+ * Gets an example path that will hit `endpoint`.
+ * Query parameters (e.g. the ":param" in "/foo/:param") have been replaced with example values.
+ */
+string getAnEndpointExample(Routing::RouteSetup endpoint) {
+  exists(string raw |
+    raw = endpoint.getRelativePath() and
+    result = raw.regexpReplaceAll(":\\w+\\b|\\*", ["a", "1"])
+  )
+}
+
+import semmle.javascript.security.regexp.RegexpMatching as RegexpMatching
+
+NfaUtils::RegExpRoot getARoot(DataFlow::RegExpCreationNode creator) {
+  result.getRootTerm() = creator.getRoot()
+}
+
+/**
+ * Holds if the regexp matcher should test whether `root` matches `str`.
+ * The result is used to test whether a case-sensitive bypass exists.
+ */
+predicate isMatchingCandidate(
+  RegexpMatching::RootTerm root, string str, boolean ignorePrefix, boolean testWithGroups
+) {
+  exists(
+    Routing::RouteSetup middleware, Routing::RouteSetup endPoint,
+    DataFlow::RegExpCreationNode regexp
+  |
+    isCaseSensitiveMiddleware(middleware, regexp, _) and
+    isGuardedCaseInsensitiveEndpoint(endPoint, middleware)
+  |
+    root = regexp.getRoot() and
+    exists(getCaseSensitiveBypassExample(getARoot(regexp))) and
+    ignorePrefix = true and
+    testWithGroups = false and
+    str =
+      [
+        getCaseSensitiveBypassExample(getARoot(regexp)), getAnEndpointExample(endPoint),
+        toOtherCase(getAnEndpointExample(endPoint))
+      ]
+  )
+}
+
+import RegexpMatching::RegexpMatching<isMatchingCandidate/4> as Matcher
+
 from
   DataFlow::RegExpCreationNode regexp, Routing::RouteSetup middleware, Routing::RouteSetup endpoint,
-  DataFlow::Node arg, string example
+  DataFlow::Node arg, string byPassExample, string endpointExample, string byPassEndPoint
 where
   isCaseSensitiveMiddleware(middleware, regexp, arg) and
-  example = getCaseSensitiveBypassExample(regexp.getRoot()) and
+  byPassExample = getCaseSensitiveBypassExample(getARoot(regexp)) and
   isGuardedCaseInsensitiveEndpoint(endpoint, middleware) and
-  exists(endpoint.getRelativePath().toLowerCase().indexOf(example.toLowerCase()))
+  // only report one example.
+  endpointExample =
+    min(string ex | ex = getAnEndpointExample(endpoint) and Matcher::matches(regexp.getRoot(), ex)) and
+  not Matcher::matches(regexp.getRoot(), byPassExample) and
+  byPassEndPoint = toOtherCase(endpointExample) and
+  not Matcher::matches(regexp.getRoot(), byPassEndPoint)
 select arg,
   "This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '"
-    + example + "' will bypass the middleware.", regexp, "pattern", endpoint, "here"
+    + byPassEndPoint + "' will bypass the middleware.", regexp, "pattern", endpoint, "here"
diff --git a/javascript/ql/src/Security/CWE-200/FileAccessToHttp.ql b/javascript/ql/src/Security/CWE-200/FileAccessToHttp.ql
index 481e7b4e898..85369b5243d 100644
--- a/javascript/ql/src/Security/CWE-200/FileAccessToHttp.ql
+++ b/javascript/ql/src/Security/CWE-200/FileAccessToHttp.ql
@@ -16,5 +16,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ flows directly to outbound network request",
-  source.getNode(), "File data"
+select sink.getNode(), source, sink, "Outbound network request depends on $@", source.getNode(),
+  "file data"
diff --git a/javascript/ql/src/Security/CWE-200/PrivateFileExposure.ql b/javascript/ql/src/Security/CWE-200/PrivateFileExposure.ql
index 73a20ce2249..fc402857e65 100644
--- a/javascript/ql/src/Security/CWE-200/PrivateFileExposure.ql
+++ b/javascript/ql/src/Security/CWE-200/PrivateFileExposure.ql
@@ -135,7 +135,7 @@ DataFlow::CallNode servesAPrivateFolder(string description) {
  */
 Express::RouteSetup getAnExposingExpressSetup(string path) {
   result.isUseCall() and
-  result.getArgument([0 .. 1]) = servesAPrivateFolder(path).getEnclosingExpr()
+  result.getArgument([0 .. 1]) = servesAPrivateFolder(path)
 }
 
 /**
@@ -149,7 +149,7 @@ DataFlow::CallNode getAnExposingServeSetup(string path) {
 
 from DataFlow::Node node, string path
 where
-  node = getAnExposingExpressSetup(path).flow()
+  node = getAnExposingExpressSetup(path)
   or
   node = getAnExposingServeSetup(path)
 select node, "Serves " + path + ", which can contain private information."
diff --git a/javascript/ql/src/Security/CWE-201/PostMessageStar.ql b/javascript/ql/src/Security/CWE-201/PostMessageStar.ql
index 8884eaebf59..90a3d526db5 100644
--- a/javascript/ql/src/Security/CWE-201/PostMessageStar.ql
+++ b/javascript/ql/src/Security/CWE-201/PostMessageStar.ql
@@ -19,6 +19,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink,
-  "Sensitive data returned from $@ is sent to another window without origin restriction.",
-  source.getNode(), "here"
+select sink.getNode(), source, sink, "$@ is sent to another window without origin restriction.",
+  source.getNode(), "Sensitive data"
diff --git a/javascript/ql/src/Security/CWE-209/StackTraceExposure.ql b/javascript/ql/src/Security/CWE-209/StackTraceExposure.ql
index a7c1d8ca778..b494b0a166a 100644
--- a/javascript/ql/src/Security/CWE-209/StackTraceExposure.ql
+++ b/javascript/ql/src/Security/CWE-209/StackTraceExposure.ql
@@ -20,5 +20,5 @@ import DataFlow::PathGraph
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
-  "Stack trace information from $@ may be exposed to an external user here.", source.getNode(),
-  "here"
+  "$@ flows to this location and may be exposed to an external user.", source.getNode(),
+  "Stack trace information"
diff --git a/javascript/ql/src/Security/CWE-312/BuildArtifactLeak.ql b/javascript/ql/src/Security/CWE-312/BuildArtifactLeak.ql
index 5a0d0bd5d5d..dd04f15f3f2 100644
--- a/javascript/ql/src/Security/CWE-312/BuildArtifactLeak.ql
+++ b/javascript/ql/src/Security/CWE-312/BuildArtifactLeak.ql
@@ -20,5 +20,5 @@ import DataFlow::PathGraph
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
-  "Sensitive data returned by $@ is stored in a build artifact here.", source.getNode(),
-  source.getNode().(CleartextLogging::Source).describe()
+  "Sensitive data returned by $@ flows to this location and is stored in a build artifact.",
+  source.getNode(), source.getNode().(CleartextLogging::Source).describe()
diff --git a/javascript/ql/src/Security/CWE-312/CleartextLogging.ql b/javascript/ql/src/Security/CWE-312/CleartextLogging.ql
index ac89c4b96c9..986eae466f1 100644
--- a/javascript/ql/src/Security/CWE-312/CleartextLogging.ql
+++ b/javascript/ql/src/Security/CWE-312/CleartextLogging.ql
@@ -38,5 +38,5 @@ where
   cfg.hasFlowPath(source, sink) and
   // ignore logging to the browser console (even though it is not a good practice)
   not inBrowserEnvironment(sink.getNode().asExpr().getTopLevel())
-select sink.getNode(), source, sink, "Sensitive data returned by $@ is logged here.",
-  source.getNode(), source.getNode().(Source).describe()
+select sink.getNode(), source, sink, "$@ is logged here.", source.getNode(),
+  "Sensitive data returned by " + source.getNode().(Source).describe()
diff --git a/javascript/ql/src/Security/CWE-312/CleartextStorage.ql b/javascript/ql/src/Security/CWE-312/CleartextStorage.ql
index 39b14ef5aa8..0f4d3069090 100644
--- a/javascript/ql/src/Security/CWE-312/CleartextStorage.ql
+++ b/javascript/ql/src/Security/CWE-312/CleartextStorage.ql
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Sensitive data returned by $@ is stored here.",
-  source.getNode(), source.getNode().(Source).describe()
+select sink.getNode(), source, sink, "$@ is stored here.", source.getNode(),
+  "Sensitive data returned by " + source.getNode().(Source).describe()
diff --git a/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql b/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql
index 99e5f937f5b..0f7e22b7f57 100644
--- a/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql
+++ b/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql
@@ -19,7 +19,6 @@ import DataFlow::PathGraph
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where
   cfg.hasFlowPath(source, sink) and
-  not source.getNode().asExpr() instanceof CleartextPasswordExpr // flagged by js/insufficient-password-hash
-select sink.getNode(), source, sink,
-  "Sensitive data from $@ is used in a broken or weak cryptographic algorithm.", source.getNode(),
-  source.getNode().(Source).describe()
+  not source.getNode() instanceof CleartextPasswordExpr // flagged by js/insufficient-password-hash
+select sink.getNode(), source, sink, "A broken or weak cryptographic algorithm depends on $@.",
+  source.getNode(), "sensitive data from" + source.getNode().(Source).describe()
diff --git a/javascript/ql/src/Security/CWE-338/InsecureRandomness.ql b/javascript/ql/src/Security/CWE-338/InsecureRandomness.ql
index 7de72260d33..bd69ac12531 100644
--- a/javascript/ql/src/Security/CWE-338/InsecureRandomness.ql
+++ b/javascript/ql/src/Security/CWE-338/InsecureRandomness.ql
@@ -18,5 +18,6 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Cryptographically insecure $@ in a security context.",
-  source.getNode(), "random value"
+select sink.getNode(), source, sink,
+  "This security context depends on a cryptographically insecure random number at $@.",
+  source.getNode(), source.getNode().toString()
diff --git a/javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql b/javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql
index 6240615a6e7..508bdad18b2 100644
--- a/javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql
+++ b/javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql
@@ -35,7 +35,7 @@ predicate isRouteHandlerUsingCookies(Routing::RouteHandler handler) {
  * A router handler following after cookie parsing is assumed to depend on
  * cookies, and thus require CSRF protection.
  */
-predicate hasCookieMiddleware(Routing::Node route, HTTP::CookieMiddlewareInstance cookie) {
+predicate hasCookieMiddleware(Routing::Node route, Http::CookieMiddlewareInstance cookie) {
   route.isGuardedBy(cookie)
 }
 
@@ -112,7 +112,7 @@ private DataFlow::SourceNode nodeLeadingToCsrfWriteOrCheck(DataFlow::TypeBackTra
  * Gets a route handler that sets an CSRF related cookie.
  */
 private Routing::RouteHandler getAHandlerSettingCsrfCookie() {
-  exists(HTTP::CookieDefinition setCookie |
+  exists(Http::CookieDefinition setCookie |
     setCookie.getNameArgument().getStringValue().regexpMatch("(?i).*(csrf|xsrf).*") and
     result = Routing::getRouteHandler(setCookie.getRouteHandler())
   )
@@ -180,7 +180,7 @@ predicate hasCsrfMiddleware(Routing::RouteHandler handler) {
 
 from
   Routing::RouteSetup setup, Routing::Node setupArg, Routing::RouteHandler handler,
-  HTTP::CookieMiddlewareInstance cookie
+  Http::CookieMiddlewareInstance cookie
 where
   // Require that the handler uses cookies and has cookie middleware.
   //
diff --git a/javascript/ql/src/Security/CWE-367/FileSystemRace.ql b/javascript/ql/src/Security/CWE-367/FileSystemRace.ql
index be410f92621..b3fb4c04ac1 100644
--- a/javascript/ql/src/Security/CWE-367/FileSystemRace.ql
+++ b/javascript/ql/src/Security/CWE-367/FileSystemRace.ql
@@ -18,32 +18,44 @@ import javascript
  * A call that checks a property of some file.
  */
 class FileCheck extends DataFlow::CallNode {
+  string member;
+
   FileCheck() {
-    this =
-      NodeJSLib::FS::moduleMember([
-          "open", "openSync", "exists", "existsSync", "stat", "statSync", "lstat", "lstatSync",
-          "fstat", "fstatSync", "access", "accessSync"
-        ]).getACall()
+    member =
+      [
+        "open", "openSync", "exists", "existsSync", "stat", "statSync", "lstat", "lstatSync",
+        "fstat", "fstatSync", "access", "accessSync"
+      ] and
+    this = NodeJSLib::FS::moduleMember(member).getACall()
   }
 
   DataFlow::Node getPathArgument() { result = this.getArgument(0) }
+
+  /** Holds if this call is a simple existence check for a file. */
+  predicate isExistsCheck() { member = ["exists", "existsSync"] }
 }
 
 /**
  * A call that modifies or otherwise interacts with a file.
  */
 class FileUse extends DataFlow::CallNode {
+  string member;
+
   FileUse() {
-    this =
-      NodeJSLib::FS::moduleMember([
-          // these are the six methods that accept file paths and file descriptors
-          "readFile", "readFileSync", "writeFile", "writeFileSync", "appendFile", "appendFileSync",
-          // don't use "open" after e.g. "access"
-          "open", "openSync"
-        ]).getACall()
+    member =
+      [
+        // these are the six methods that accept file paths and file descriptors
+        "readFile", "readFileSync", "writeFile", "writeFileSync", "appendFile", "appendFileSync",
+        // don't use "open" after e.g. "access"
+        "open", "openSync"
+      ] and
+    this = NodeJSLib::FS::moduleMember(member).getACall()
   }
 
   DataFlow::Node getPathArgument() { result = this.getArgument(0) }
+
+  /** Holds if this call reads from a file. */
+  predicate isFileRead() { member = ["readFile", "readFileSync"] }
 }
 
 /**
@@ -101,5 +113,6 @@ from FileCheck check, FileUse use
 where
   checkAndUseOnSame(check, use) and
   useAfterCheck(check, use) and
+  not (check.isExistsCheck() and use.isFileRead()) and // a read after an exists check is fine
   not getAFileHandle(DataFlow::TypeTracker::end()).flowsTo(use.getPathArgument())
 select use, "The file may have changed since it $@.", check, "was checked"
diff --git a/javascript/ql/src/Security/CWE-377/InsecureTemporaryFile.ql b/javascript/ql/src/Security/CWE-377/InsecureTemporaryFile.ql
index 8bfce571835..9e9a9f12659 100644
--- a/javascript/ql/src/Security/CWE-377/InsecureTemporaryFile.ql
+++ b/javascript/ql/src/Security/CWE-377/InsecureTemporaryFile.ql
@@ -1,6 +1,7 @@
 /**
  * @name Insecure temporary file
- * @description Creating a temporary file that is accessible by other users TODO:
+ * @description Creating a temporary file that is accessible by other users can
+ * lead to information disclosure and sometimes remote code execution.
  * @kind path-problem
  * @id js/insecure-temporary-file
  * @problem.severity warning
diff --git a/javascript/ql/src/Security/CWE-400/DeepObjectResourceExhaustion.ql b/javascript/ql/src/Security/CWE-400/DeepObjectResourceExhaustion.ql
index 202cf6c591e..a9ea46c4510 100644
--- a/javascript/ql/src/Security/CWE-400/DeepObjectResourceExhaustion.ql
+++ b/javascript/ql/src/Security/CWE-400/DeepObjectResourceExhaustion.ql
@@ -20,5 +20,5 @@ from
 where
   cfg.hasFlowPath(source, sink) and
   sink.getNode().(Sink).hasReason(link, reason)
-select sink, source, sink, "Denial of service caused by processing user input from $@ with $@.",
-  source.getNode(), "here", link, reason
+select sink, source, sink, "Denial of service caused by processing $@ with $@.", source.getNode(),
+  "user input", link, reason
diff --git a/javascript/ql/src/Security/CWE-400/RemotePropertyInjection.ql b/javascript/ql/src/Security/CWE-400/RemotePropertyInjection.ql
index 724ad4104ef..af5c2bccc78 100644
--- a/javascript/ql/src/Security/CWE-400/RemotePropertyInjection.ql
+++ b/javascript/ql/src/Security/CWE-400/RemotePropertyInjection.ql
@@ -18,5 +18,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "A $@ is used as" + sink.getNode().(Sink).getMessage(),
-  source.getNode(), "user-provided value"
+select sink.getNode(), source, sink, sink.getNode().(Sink).getMessage() + " depends on $@.",
+  source.getNode(), "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-451/MissingXFrameOptions.ql b/javascript/ql/src/Security/CWE-451/MissingXFrameOptions.ql
index 316af8d4a36..6228d1539ea 100644
--- a/javascript/ql/src/Security/CWE-451/MissingXFrameOptions.ql
+++ b/javascript/ql/src/Security/CWE-451/MissingXFrameOptions.ql
@@ -15,6 +15,6 @@
 import javascript
 import semmle.javascript.frameworks.HTTP
 
-from HTTP::ServerDefinition server
+from Http::ServerDefinition server
 where not exists(server.getARouteHandler().getAResponseHeader("x-frame-options"))
 select server, "This server never sets the 'X-Frame-Options' HTTP header."
diff --git a/javascript/ql/src/Security/CWE-502/UnsafeDeserialization.ql b/javascript/ql/src/Security/CWE-502/UnsafeDeserialization.ql
index 7423cb2f73d..5f58ebd1030 100644
--- a/javascript/ql/src/Security/CWE-502/UnsafeDeserialization.ql
+++ b/javascript/ql/src/Security/CWE-502/UnsafeDeserialization.ql
@@ -17,4 +17,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Unsafe deserialization of $@.", source.getNode(), "user input"
+select sink.getNode(), source, sink, "Unsafe deserialization that depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-506/HardcodedDataInterpretedAsCode.ql b/javascript/ql/src/Security/CWE-506/HardcodedDataInterpretedAsCode.ql
index 8e5ef152f5f..9fd53ce9916 100644
--- a/javascript/ql/src/Security/CWE-506/HardcodedDataInterpretedAsCode.ql
+++ b/javascript/ql/src/Security/CWE-506/HardcodedDataInterpretedAsCode.ql
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
-  "Hard-coded data from $@ is interpreted as " + sink.getNode().(Sink).getKind() + ".",
-  source.getNode(), "here"
+  "$@ is interpreted as " + sink.getNode().(Sink).getKind() + ".", source.getNode(),
+  "Hard-coded data"
diff --git a/javascript/ql/src/Security/CWE-598/SensitiveGetQuery.ql b/javascript/ql/src/Security/CWE-598/SensitiveGetQuery.ql
index ace28997ccc..1dade2a88ca 100644
--- a/javascript/ql/src/Security/CWE-598/SensitiveGetQuery.ql
+++ b/javascript/ql/src/Security/CWE-598/SensitiveGetQuery.ql
@@ -14,14 +14,14 @@
 import javascript
 
 from
-  Routing::RouteSetup setup, Routing::RouteHandler handler, HTTP::RequestInputAccess input,
-  SensitiveExpr sensitive
+  Routing::RouteSetup setup, Routing::RouteHandler handler, Http::RequestInputAccess input,
+  SensitiveNode sensitive
 where
   setup.getOwnHttpMethod() = "GET" and
   setup.getAChild+() = handler and
   input.getRouteHandler() = handler.getFunction() and
   input.getKind() = "parameter" and
-  input.(DataFlow::SourceNode).flowsToExpr(sensitive) and
+  input.(DataFlow::SourceNode).flowsTo(sensitive) and
   not sensitive.getClassification() = SensitiveDataClassification::id()
 select input, "$@ for GET requests uses query parameter as sensitive data.", handler,
   "Route handler"
diff --git a/javascript/ql/src/Security/CWE-601/ClientSideUrlRedirect.ql b/javascript/ql/src/Security/CWE-601/ClientSideUrlRedirect.ql
index ae779121935..625aa1ae53d 100644
--- a/javascript/ql/src/Security/CWE-601/ClientSideUrlRedirect.ql
+++ b/javascript/ql/src/Security/CWE-601/ClientSideUrlRedirect.ql
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.", source.getNode(),
-  "user-provided value"
+select sink.getNode(), source, sink, "Untrusted URL redirection depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.ql b/javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.ql
index 0f610a2a584..c06537df852 100644
--- a/javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.ql
+++ b/javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.ql
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.", source.getNode(),
-  "user-provided value"
+select sink.getNode(), source, sink, "Untrusted URL redirection depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-611/Xxe.ql b/javascript/ql/src/Security/CWE-611/Xxe.ql
index 01e518b6df7..9aa81aacf0b 100644
--- a/javascript/ql/src/Security/CWE-611/Xxe.ql
+++ b/javascript/ql/src/Security/CWE-611/Xxe.ql
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
-  "A $@ is parsed as XML without guarding against external entity expansion.", source.getNode(),
-  "user-provided value"
+  "XML parsing depends on $@ without guarding against external entity expansion.", source.getNode(),
+  "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.ql b/javascript/ql/src/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.ql
index f4ee0b5239e..9cb88a29b9d 100644
--- a/javascript/ql/src/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.ql
+++ b/javascript/ql/src/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.ql
@@ -17,6 +17,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink,
-  "Links in this email can be hijacked by poisoning the HTTP host header $@.", source.getNode(),
-  "here"
+select sink.getNode(), source, sink, "Links in this email can be hijacked by poisoning the $@.",
+  source.getNode(), "HTTP host header"
diff --git a/javascript/ql/src/Security/CWE-643/XpathInjection.ql b/javascript/ql/src/Security/CWE-643/XpathInjection.ql
index 58e96a6dfc1..a064c25f817 100644
--- a/javascript/ql/src/Security/CWE-643/XpathInjection.ql
+++ b/javascript/ql/src/Security/CWE-643/XpathInjection.ql
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ flows here and is used in an XPath expression.",
-  source.getNode(), "User-provided value"
+select sink.getNode(), source, sink, "XPath expression depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-730/RegExpInjection.ql b/javascript/ql/src/Security/CWE-730/RegExpInjection.ql
index 8da2080d167..85a79cbdc9d 100644
--- a/javascript/ql/src/Security/CWE-730/RegExpInjection.ql
+++ b/javascript/ql/src/Security/CWE-730/RegExpInjection.ql
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "This regular expression is constructed from a $@.",
-  source.getNode(), "user-provided value"
+select sink.getNode(), source, sink, "This regular expression depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-730/ServerCrash.ql b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
index f5de58d4516..c3cd7dcc842 100644
--- a/javascript/ql/src/Security/CWE-730/ServerCrash.ql
+++ b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
@@ -88,7 +88,7 @@ Function reachableFromAsyncCallback() {
  * The main predicate of this query: used for both result display and path computation.
  */
 predicate main(
-  HTTP::RouteHandler rh, AsyncSentinelCall async, AsyncCallback cb, LikelyExceptionThrower thrower
+  Http::RouteHandler rh, AsyncSentinelCall async, AsyncCallback cb, LikelyExceptionThrower thrower
 ) {
   async.getAsyncCallee() = cb and
   rh.getAstNode() = invokesCallbackThatThrowsUncaughtException(async, thrower)
@@ -180,7 +180,7 @@ query predicate nodes(AstNode node) {
 }
 
 from
-  HTTP::RouteHandler rh, AsyncSentinelCall async, DataFlow::Node callbackArg, AsyncCallback cb,
+  Http::RouteHandler rh, AsyncSentinelCall async, DataFlow::Node callbackArg, AsyncCallback cb,
   ExprOrStmt crasher
 where
   main(rh, async, cb, crasher) and
diff --git a/javascript/ql/src/Security/CWE-776/XmlBomb.ql b/javascript/ql/src/Security/CWE-776/XmlBomb.ql
index c340eee68cc..3ab176c2539 100644
--- a/javascript/ql/src/Security/CWE-776/XmlBomb.ql
+++ b/javascript/ql/src/Security/CWE-776/XmlBomb.ql
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
-  "A $@ is parsed as XML without guarding against uncontrolled entity expansion.", source.getNode(),
-  "user-provided value"
+  "XML parsing depends on $@ without guarding against uncontrolled entity expansion.",
+  source.getNode(), "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedSource.ql b/javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedSource.ql
index 98ab953ff61..a801420b44f 100644
--- a/javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedSource.ql
+++ b/javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedSource.ql
@@ -61,8 +61,8 @@ module StaticCreation {
   }
 
   /** A script element that refers to untrusted content. */
-  class CDNScriptElementWithUntrustedContent extends AddsUntrustedUrl, HTML::ScriptElement {
-    CDNScriptElementWithUntrustedContent() {
+  class CdnScriptElementWithUntrustedContent extends AddsUntrustedUrl, HTML::ScriptElement {
+    CdnScriptElementWithUntrustedContent() {
       not exists(string digest | not digest = "" | this.getIntegrityDigest() = digest) and
       isCdnUrlWithCheckingRequired(this.getSourcePath())
     }
diff --git a/javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql b/javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql
index 638829de15e..b248c21da9a 100644
--- a/javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql
+++ b/javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 from Configuration dataflow, DataFlow::PathNode source, DataFlow::PathNode sink
 where dataflow.hasFlowPath(source, sink)
 select sink, source, sink,
-  "Iterating over user-controlled object with a potentially unbounded .length property from $@.",
-  source, "here"
+  "Iteration over a user-controlled object with a potentially unbounded .length property from $@.",
+  source, "a user-provided value"
diff --git a/javascript/ql/src/Security/CWE-912/HttpToFileAccess.ql b/javascript/ql/src/Security/CWE-912/HttpToFileAccess.ql
index 772297dda63..6f12057efd8 100644
--- a/javascript/ql/src/Security/CWE-912/HttpToFileAccess.ql
+++ b/javascript/ql/src/Security/CWE-912/HttpToFileAccess.ql
@@ -17,4 +17,4 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ flows to file system", source.getNode(), "Untrusted data"
+select sink.getNode(), source, sink, "$@ flows to file system.", source.getNode(), "Untrusted data"
diff --git a/javascript/ql/src/Statements/NestedLoopsSameVariable.ql b/javascript/ql/src/Statements/NestedLoopsSameVariable.ql
index f3cbb30644f..f077bd7c09d 100644
--- a/javascript/ql/src/Statements/NestedLoopsSameVariable.ql
+++ b/javascript/ql/src/Statements/NestedLoopsSameVariable.ql
@@ -15,16 +15,17 @@ import javascript
 /**
  * Gets an iteration variable that loop `for` tests and updates.
  */
-Variable getAnIterationVariable(ForStmt for) {
+Variable getAnIterationVariable(ForStmt for, Expr upAccess) {
   result.getAnAccess().getParentExpr*() = for.getTest() and
   exists(UpdateExpr upd | upd.getParentExpr*() = for.getUpdate() |
-    upd.getOperand() = result.getAnAccess()
+    upAccess = upd.getOperand() and upAccess = result.getAnAccess()
   )
 }
 
-from ForStmt outer, ForStmt inner
+from ForStmt outer, ForStmt inner, Variable iteration, Expr upAccess
 where
   inner.nestedIn(outer) and
-  getAnIterationVariable(outer) = getAnIterationVariable(inner)
-select inner.getTest(), "This for statement uses the same loop variable as an enclosing $@.", outer,
-  "for statement"
+  iteration = getAnIterationVariable(outer, _) and
+  iteration = getAnIterationVariable(inner, upAccess)
+select inner.getTest(), "Nested for statement uses loop variable $@ of enclosing $@.", upAccess,
+  iteration.getName(), outer, "for statement"
diff --git a/javascript/ql/src/change-notes/2022-08-23-alert-messages.md b/javascript/ql/src/change-notes/2022-08-23-alert-messages.md
new file mode 100644
index 00000000000..22f4c5c6682
--- /dev/null
+++ b/javascript/ql/src/change-notes/2022-08-23-alert-messages.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The alert message of many queries have been changed to make the message consistent with other languages.
\ No newline at end of file
diff --git a/javascript/ql/src/change-notes/2022-09-07-type-confusion-bugfix.md b/javascript/ql/src/change-notes/2022-09-07-type-confusion-bugfix.md
new file mode 100644
index 00000000000..af351eae597
--- /dev/null
+++ b/javascript/ql/src/change-notes/2022-09-07-type-confusion-bugfix.md
@@ -0,0 +1,6 @@
+---
+category: fix
+---
+
+- Fixed a bug in the `js/type-confusion-through-parameter-tampering` query that would cause it to ignore
+  sanitizers in branching conditions. The query should now report fewer false positives.
diff --git a/javascript/ql/src/change-notes/2022-09-13-regexp-always-matches-fp.md b/javascript/ql/src/change-notes/2022-09-13-regexp-always-matches-fp.md
new file mode 100644
index 00000000000..9e3dc2e980d
--- /dev/null
+++ b/javascript/ql/src/change-notes/2022-09-13-regexp-always-matches-fp.md
@@ -0,0 +1,6 @@
+---
+category: minorAnalysis
+---
+
+- The `js/regexp/always-matches` query will no longer report an empty regular expression as always
+  matching, as this is often the intended behavior.
diff --git a/javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql b/javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql
index ee410fe9245..dc89f8530aa 100644
--- a/javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql
+++ b/javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql
@@ -78,9 +78,9 @@ class ProbableJob extends Actions::Job {
 /**
  * An action step that doesn't contain `actor` or `label` check in `if:` or
  */
-class ProbablePullRequestTarget extends Actions::On, YAMLMappingLikeNode {
+class ProbablePullRequestTarget extends Actions::On, YamlMappingLikeNode {
   ProbablePullRequestTarget() {
-    exists(YAMLNode prtNode |
+    exists(YamlNode prtNode |
       // The `on:` is triggered on `pull_request_target`
       this.getNode("pull_request_target") = prtNode and
       (
@@ -88,7 +88,7 @@ class ProbablePullRequestTarget extends Actions::On, YAMLMappingLikeNode {
         not exists(prtNode.getAChild())
         or
         // or has the filter, that is something else than just [labeled]
-        exists(YAMLMappingLikeNode prt, YAMLMappingLikeNode types |
+        exists(YamlMappingLikeNode prt, YamlMappingLikeNode types |
           types = prt.getNode("types") and
           prtNode = prt and
           (
diff --git a/javascript/ql/src/experimental/poi/PoI.qll b/javascript/ql/src/experimental/poi/PoI.qll
index c51909c5c9e..84134600406 100644
--- a/javascript/ql/src/experimental/poi/PoI.qll
+++ b/javascript/ql/src/experimental/poi/PoI.qll
@@ -77,7 +77,7 @@ private module StandardPoIs {
     UnpromotedRouteSetupPoI() { this = "UnpromotedRouteSetupPoI" }
 
     override predicate is(Node l0) {
-      l0 instanceof HTTP::RouteSetupCandidate and not l0.asExpr() instanceof HTTP::RouteSetup
+      l0 instanceof Http::RouteSetupCandidate and not l0 instanceof Http::RouteSetup
     }
   }
 
@@ -88,7 +88,7 @@ private module StandardPoIs {
     UnpromotedRouteHandlerPoI() { this = "UnpromotedRouteHandlerPoI" }
 
     override predicate is(Node l0) {
-      l0 instanceof HTTP::RouteHandlerCandidate and not l0 instanceof HTTP::RouteHandler
+      l0 instanceof Http::RouteHandlerCandidate and not l0 instanceof Http::RouteHandler
     }
   }
 
@@ -98,7 +98,7 @@ private module StandardPoIs {
   class UnpromotedRouteHandlerWithFlowPoI extends PoI {
     UnpromotedRouteHandlerWithFlowPoI() { this = "UnpromotedRouteHandlerWithFlowPoI" }
 
-    private DataFlow::SourceNode track(HTTP::RouteHandlerCandidate cand, DataFlow::TypeTracker t) {
+    private DataFlow::SourceNode track(Http::RouteHandlerCandidate cand, DataFlow::TypeTracker t) {
       t.start() and
       result = cand
       or
@@ -106,8 +106,8 @@ private module StandardPoIs {
     }
 
     override predicate is(Node l0, Node l1, string t1) {
-      l0 instanceof HTTP::RouteHandlerCandidate and
-      not l0 instanceof HTTP::RouteHandler and
+      l0 instanceof Http::RouteHandlerCandidate and
+      not l0 instanceof Http::RouteHandler and
       l1 = track(l0, TypeTracker::end()) and
       (if l1 = l0 then t1 = "ends here" else t1 = "starts/ends here")
     }
diff --git a/javascript/ql/src/meta/analysis-quality/CandidateTracking.qll b/javascript/ql/src/meta/analysis-quality/CandidateTracking.qll
index 509d5f2a482..72046169219 100644
--- a/javascript/ql/src/meta/analysis-quality/CandidateTracking.qll
+++ b/javascript/ql/src/meta/analysis-quality/CandidateTracking.qll
@@ -8,7 +8,7 @@ import javascript
  * Gets a source node to which `cand` may flow inter-procedurally, with `t` tracking
  * the state of flow.
  */
-DataFlow::SourceNode track(HTTP::RouteHandlerCandidate cand, DataFlow::TypeTracker t) {
+DataFlow::SourceNode track(Http::RouteHandlerCandidate cand, DataFlow::TypeTracker t) {
   t.start() and
   result = cand
   or
diff --git a/javascript/ql/src/meta/analysis-quality/RouteHandlers.ql b/javascript/ql/src/meta/analysis-quality/RouteHandlers.ql
index 5da34036b18..fe09e0ea866 100644
--- a/javascript/ql/src/meta/analysis-quality/RouteHandlers.ql
+++ b/javascript/ql/src/meta/analysis-quality/RouteHandlers.ql
@@ -11,6 +11,6 @@
 import javascript
 import CallGraphQuality
 
-HTTP::RouteHandler relevantRouteHandler() { not result.getFile() instanceof IgnoredFile }
+Http::RouteHandler relevantRouteHandler() { not result.getFile() instanceof IgnoredFile }
 
 select projectRoot(), count(relevantRouteHandler())
diff --git a/javascript/ql/src/meta/analysis-quality/UnpromotedRouteHandlerCandidate.ql b/javascript/ql/src/meta/analysis-quality/UnpromotedRouteHandlerCandidate.ql
index 89b26d734c5..c59d05932af 100644
--- a/javascript/ql/src/meta/analysis-quality/UnpromotedRouteHandlerCandidate.ql
+++ b/javascript/ql/src/meta/analysis-quality/UnpromotedRouteHandlerCandidate.ql
@@ -11,10 +11,10 @@
 import javascript
 import CandidateTracking
 
-from HTTP::RouteHandlerCandidate rh
+from Http::RouteHandlerCandidate rh
 where
-  not rh instanceof HTTP::RouteHandler and
-  not exists(HTTP::RouteSetupCandidate setup |
+  not rh instanceof Http::RouteHandler and
+  not exists(Http::RouteSetupCandidate setup |
     track(rh, DataFlow::TypeTracker::end()).flowsTo(setup.getARouteHandlerArg())
   )
 select rh,
diff --git a/javascript/ql/src/meta/analysis-quality/UnpromotedRouteSetupCandidate.ql b/javascript/ql/src/meta/analysis-quality/UnpromotedRouteSetupCandidate.ql
index 361e2d8a619..1fee417c396 100644
--- a/javascript/ql/src/meta/analysis-quality/UnpromotedRouteSetupCandidate.ql
+++ b/javascript/ql/src/meta/analysis-quality/UnpromotedRouteSetupCandidate.ql
@@ -11,10 +11,10 @@
 import javascript
 import CandidateTracking
 
-from HTTP::RouteSetupCandidate setup
+from Http::RouteSetupCandidate setup
 where
-  not setup.asExpr() instanceof HTTP::RouteSetup and
-  exists(HTTP::RouteHandlerCandidate rh |
+  not setup instanceof Http::RouteSetup and
+  exists(Http::RouteHandlerCandidate rh |
     track(rh, DataFlow::TypeTracker::end()).flowsTo(setup.getARouteHandlerArg())
   )
 select setup,
diff --git a/javascript/ql/src/meta/extraction-metrics/FileData.ql b/javascript/ql/src/meta/extraction-metrics/FileData.ql
index 3d5cbfed59f..bb689cb99cf 100644
--- a/javascript/ql/src/meta/extraction-metrics/FileData.ql
+++ b/javascript/ql/src/meta/extraction-metrics/FileData.ql
@@ -16,10 +16,12 @@ FileWithExtractionMetrics getACacheHit(FileWithExtractionMetrics f) {
   result.isFromCache()
 }
 
-from FileWithExtractionMetrics file, boolean fromCache
-where (if file.isFromCache() then fromCache = true else fromCache = false)
-select file.getAbsolutePath() as FILE, file.getCpuTime() as CPU_NANO,
-  file.getNumberOfLines() as LINES, count(Locatable n | n.getFile() = file) as LOCATABLES,
-  count(TypeAnnotation n | n.getFile() = file) as TYPES, file.getLength() as LENGTH,
-  fromCache as FROM_CACHE, count(getACacheMember(file.getCacheFile())) as CACHE_MEMBERS,
-  count(getACacheHit(file)) as CACHE_HITS, file.getCacheFile() as CACHE_FILE
+from FileWithExtractionMetrics fileWithMetrics, boolean fromCache
+where (if fileWithMetrics.isFromCache() then fromCache = true else fromCache = false)
+select fileWithMetrics.getAbsolutePath() as file, fileWithMetrics.getCpuTime() as cpu_nano,
+  fileWithMetrics.getNumberOfLines() as lines,
+  count(Locatable n | n.getFile() = fileWithMetrics) as locatables,
+  count(TypeAnnotation n | n.getFile() = fileWithMetrics) as types,
+  fileWithMetrics.getLength() as length, fromCache as from_cache,
+  count(getACacheMember(fileWithMetrics.getCacheFile())) as cache_members,
+  count(getACacheHit(fileWithMetrics)) as cache_hits, fileWithMetrics.getCacheFile() as cache_file
diff --git a/javascript/ql/src/meta/extraction-metrics/PhaseTimings.ql b/javascript/ql/src/meta/extraction-metrics/PhaseTimings.ql
index 20e4bab4d35..c67e2caab50 100644
--- a/javascript/ql/src/meta/extraction-metrics/PhaseTimings.ql
+++ b/javascript/ql/src/meta/extraction-metrics/PhaseTimings.ql
@@ -9,5 +9,5 @@
 import semmle.javascript.meta.ExtractionMetrics::ExtractionMetrics
 
 from PhaseName phaseName
-select phaseName, Aggregated::getCpuTime(phaseName) as CPU_NANO,
-  Aggregated::getWallclockTime(phaseName) as WALLCLOCK_NANO
+select phaseName, Aggregated::getCpuTime(phaseName) as cpu_nano,
+  Aggregated::getWallclockTime(phaseName) as wallclock_nano
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index f2f20efe77e..d1a0764deb3 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -9,3 +9,4 @@ defaultSuiteFile: codeql-suites/javascript-code-scanning.qls
 dependencies:
   codeql/javascript-all: "*"
   codeql/suite-helpers: "*"
+  codeql/typos: 0.0.1-dev
diff --git a/javascript/ql/test/ApiGraphs/custom-entry-point/index.js b/javascript/ql/test/ApiGraphs/custom-entry-point/index.js
index 8d993356fe5..03ad4896588 100644
--- a/javascript/ql/test/ApiGraphs/custom-entry-point/index.js
+++ b/javascript/ql/test/ApiGraphs/custom-entry-point/index.js
@@ -1 +1 @@
-module.exports = CustomEntryPoint.foo; /* use=getASuccessor(Label::entryPoint("CustomEntryPoint")) */
+module.exports = CustomEntryPoint.foo; /* use=entryPoint("CustomEntryPoint") */
diff --git a/javascript/ql/test/ApiGraphs/typed/NodeOfType.expected b/javascript/ql/test/ApiGraphs/typed/NodeOfType.expected
index 09fd4b89242..73ac9d71807 100644
--- a/javascript/ql/test/ApiGraphs/typed/NodeOfType.expected
+++ b/javascript/ql/test/ApiGraphs/typed/NodeOfType.expected
@@ -1,4 +1,9 @@
+| body-parser |  | index.ts:4:20:4:41 | require ... arser") |
+| express |  | index.ts:3:17:3:34 | require("express") |
+| mongodb |  | index.ts:1:8:1:19 | * as mongodb |
 | mongodb | Collection | index.ts:14:3:14:17 | getCollection() |
+| mongoose |  | index.ts:17:8:17:20 | * as mongoose |
 | mongoose | Model | index.ts:22:3:22:20 | getMongooseModel() |
 | mongoose | Query | index.ts:23:3:23:20 | getMongooseQuery() |
+| puppeteer |  | index.ts:26:8:26:21 | * as puppeteer |
 | puppeteer | Browser | index.ts:30:22:30:33 | this.browser |
diff --git a/javascript/ql/test/experimental/PoI/TestCustomPoIs.ql b/javascript/ql/test/experimental/PoI/TestCustomPoIs.ql
index 5e73f8a4f87..1a4f9b686f0 100644
--- a/javascript/ql/test/experimental/PoI/TestCustomPoIs.ql
+++ b/javascript/ql/test/experimental/PoI/TestCustomPoIs.ql
@@ -16,7 +16,7 @@ class RouteHandlerAndSetupPoI extends ActivePoI {
   RouteHandlerAndSetupPoI() { this = "RouteHandlerAndSetupPoI" }
 
   override predicate is(Node l0, Node l1, string t1) {
-    l1.asExpr().(Express::RouteSetup).getARouteHandler() = l0 and t1 = "setup"
+    l1.(Express::RouteSetup).getARouteHandler() = l0 and t1 = "setup"
   }
 }
 
@@ -24,9 +24,9 @@ class RouteSetupAndRouterAndRouteHandlerPoI extends ActivePoI {
   RouteSetupAndRouterAndRouteHandlerPoI() { this = "RouteSetupAndRouterAndRouteHandlerPoI" }
 
   override predicate is(Node l0, Node l1, string t1, Node l2, string t2) {
-    l0.asExpr().(Express::RouteSetup).getRouter().flow() = l1 and
+    l0.(Express::RouteSetup).getRouter() = l1 and
     t1 = "router" and
-    l0.asExpr().(Express::RouteSetup).getARouteHandler() = l2 and
+    l0.(Express::RouteSetup).getARouteHandler() = l2 and
     t2 = "routehandler"
   }
 }
diff --git a/javascript/ql/test/library-tests/SensitiveActions/tests.ql b/javascript/ql/test/library-tests/SensitiveActions/tests.ql
index 7adfe2121d3..e1cd2cbd095 100644
--- a/javascript/ql/test/library-tests/SensitiveActions/tests.ql
+++ b/javascript/ql/test/library-tests/SensitiveActions/tests.ql
@@ -20,4 +20,4 @@ query predicate processTermination(NodeJSLib::ProcessTermination term) { any() }
 
 query predicate sensitiveAction(SensitiveAction ac) { any() }
 
-query predicate sensitiveExpr(SensitiveExpr e) { any() }
+query predicate sensitiveExpr(SensitiveNode e) { any() }
diff --git a/javascript/ql/test/library-tests/TypeScript/HasUnderlyingType/HasUnderlyingType.expected b/javascript/ql/test/library-tests/TypeScript/HasUnderlyingType/HasUnderlyingType.expected
index 714ebab353b..247788180eb 100644
--- a/javascript/ql/test/library-tests/TypeScript/HasUnderlyingType/HasUnderlyingType.expected
+++ b/javascript/ql/test/library-tests/TypeScript/HasUnderlyingType/HasUnderlyingType.expected
@@ -1,4 +1,6 @@
 underlyingTypeNode
+| foo |  | file://:0:0:0:0 | use moduleImport("foo").getMember("exports") |
+| foo |  | foo.ts:1:8:1:10 | use moduleImport("foo").getMember("exports").getMember("default") |
 | foo | Bar | foo.ts:3:1:5:1 | use moduleImport("foo").getMember("exports").getMember("Bar").getInstance() |
 | foo | Bar | foo.ts:3:12:3:12 | use moduleImport("foo").getMember("exports").getMember("Bar").getInstance() |
 #select
diff --git a/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected b/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected
index 9f4f6c6aba5..9c271410ecf 100644
--- a/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected
+++ b/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected
@@ -99,6 +99,7 @@ nodes
 | file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
 | file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
 | file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
+| file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
 | file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
 | file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
 | file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
@@ -132,6 +133,9 @@ nodes
 | file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
 | file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
 | file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
+| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
+| file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
+| file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
 | file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
 | file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
 | file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
@@ -1381,8 +1385,47 @@ nodes
 | tst.ts:374:13:374:26 | [DotExpr] B.resolvedFile | semmle.label | [DotExpr] B.resolvedFile |
 | tst.ts:374:13:374:28 | [MethodCallExpr] B.resolvedFile() | semmle.label | [MethodCallExpr] B.resolvedFile() |
 | tst.ts:374:15:374:26 | [Label] resolvedFile | semmle.label | [Label] resolvedFile |
+| tst.ts:379:1:386:1 | [NamespaceDeclaration] module ... ; } | semmle.label | [NamespaceDeclaration] module ... ; } |
+| tst.ts:379:1:386:1 | [NamespaceDeclaration] module ... ; } | semmle.order | 84 |
+| tst.ts:379:8:379:11 | [VarDecl] TS48 | semmle.label | [VarDecl] TS48 |
+| tst.ts:381:5:381:73 | [TypeAliasDeclaration,TypeDefinition] type So ... never; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type So ... never; |
+| tst.ts:381:10:381:16 | [Identifier] SomeNum | semmle.label | [Identifier] SomeNum |
+| tst.ts:381:20:381:24 | [LiteralTypeExpr] "100" | semmle.label | [LiteralTypeExpr] "100" |
+| tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | semmle.label | [ConditionalTypeExpr] "100" e ... : never |
+| tst.ts:381:34:381:60 | [TemplateLiteralTypeExpr] `${infe ... umber}` | semmle.label | [TemplateLiteralTypeExpr] `${infe ... umber}` |
+| tst.ts:381:37:381:58 | [InferTypeExpr] infer U ... number | semmle.label | [InferTypeExpr] infer U ... number |
+| tst.ts:381:43:381:43 | [Identifier] U | semmle.label | [Identifier] U |
+| tst.ts:381:43:381:58 | [TypeParameter] U extends number | semmle.label | [TypeParameter] U extends number |
+| tst.ts:381:53:381:58 | [KeywordTypeExpr] number | semmle.label | [KeywordTypeExpr] number |
+| tst.ts:381:64:381:64 | [LocalTypeAccess] U | semmle.label | [LocalTypeAccess] U |
+| tst.ts:381:68:381:72 | [KeywordTypeExpr] never | semmle.label | [KeywordTypeExpr] never |
+| tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | semmle.label | [FunctionDeclStmt] declare ... T): T; |
+| tst.ts:383:22:383:35 | [VarDecl] chooseRandomly | semmle.label | [VarDecl] chooseRandomly |
+| tst.ts:383:37:383:37 | [Identifier] T | semmle.label | [Identifier] T |
+| tst.ts:383:37:383:37 | [TypeParameter] T | semmle.label | [TypeParameter] T |
+| tst.ts:383:40:383:40 | [SimpleParameter] x | semmle.label | [SimpleParameter] x |
+| tst.ts:383:43:383:43 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
+| tst.ts:383:46:383:46 | [SimpleParameter] y | semmle.label | [SimpleParameter] y |
+| tst.ts:383:49:383:49 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
+| tst.ts:383:53:383:53 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
+| tst.ts:385:5:385:74 | [DeclStmt] let [a, ... ye!"]); | semmle.label | [DeclStmt] let [a, ... ye!"]); |
+| tst.ts:385:9:385:17 | [ArrayPattern] [a, b, c] | semmle.label | [ArrayPattern] [a, b, c] |
+| tst.ts:385:9:385:73 | [VariableDeclarator] [a, b, ... bye!"]) | semmle.label | [VariableDeclarator] [a, b, ... bye!"]) |
+| tst.ts:385:10:385:10 | [VarDecl] a | semmle.label | [VarDecl] a |
+| tst.ts:385:13:385:13 | [VarDecl] b | semmle.label | [VarDecl] b |
+| tst.ts:385:16:385:16 | [VarDecl] c | semmle.label | [VarDecl] c |
+| tst.ts:385:21:385:34 | [VarRef] chooseRandomly | semmle.label | [VarRef] chooseRandomly |
+| tst.ts:385:21:385:73 | [CallExpr] chooseR ... bye!"]) | semmle.label | [CallExpr] chooseR ... bye!"]) |
+| tst.ts:385:36:385:52 | [ArrayExpr] [42, true, "hi!"] | semmle.label | [ArrayExpr] [42, true, "hi!"] |
+| tst.ts:385:37:385:38 | [Literal] 42 | semmle.label | [Literal] 42 |
+| tst.ts:385:41:385:44 | [Literal] true | semmle.label | [Literal] true |
+| tst.ts:385:47:385:51 | [Literal] "hi!" | semmle.label | [Literal] "hi!" |
+| tst.ts:385:55:385:72 | [ArrayExpr] [0, false, "bye!"] | semmle.label | [ArrayExpr] [0, false, "bye!"] |
+| tst.ts:385:56:385:56 | [Literal] 0 | semmle.label | [Literal] 0 |
+| tst.ts:385:59:385:63 | [Literal] false | semmle.label | [Literal] false |
+| tst.ts:385:66:385:71 | [Literal] "bye!" | semmle.label | [Literal] "bye!" |
 | tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.label | [ExportDeclaration] export ... 'b'; } |
-| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 84 |
+| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 85 |
 | tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.label | [FunctionDeclStmt] functio ... 'b'; } |
 | tstModuleCJS.cts:1:17:1:28 | [VarDecl] tstModuleCJS | semmle.label | [VarDecl] tstModuleCJS |
 | tstModuleCJS.cts:1:33:1:35 | [LiteralTypeExpr] 'a' | semmle.label | [LiteralTypeExpr] 'a' |
@@ -1400,7 +1443,7 @@ nodes
 | tstModuleCJS.cts:2:34:2:36 | [Literal] 'a' | semmle.label | [Literal] 'a' |
 | tstModuleCJS.cts:2:40:2:42 | [Literal] 'b' | semmle.label | [Literal] 'b' |
 | tstModuleES.mts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.label | [ExportDeclaration] export ... 'b'; } |
-| tstModuleES.mts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 85 |
+| tstModuleES.mts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 86 |
 | tstModuleES.mts:1:16:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.label | [FunctionDeclStmt] functio ... 'b'; } |
 | tstModuleES.mts:1:25:1:35 | [VarDecl] tstModuleES | semmle.label | [VarDecl] tstModuleES |
 | tstModuleES.mts:1:40:1:42 | [LiteralTypeExpr] 'a' | semmle.label | [LiteralTypeExpr] 'a' |
@@ -1418,7 +1461,7 @@ nodes
 | tstModuleES.mts:2:34:2:36 | [Literal] 'a' | semmle.label | [Literal] 'a' |
 | tstModuleES.mts:2:40:2:42 | [Literal] 'b' | semmle.label | [Literal] 'b' |
 | tstSuffixA.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.label | [ExportDeclaration] export ... .ts'; } |
-| tstSuffixA.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 86 |
+| tstSuffixA.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 87 |
 | tstSuffixA.ts:1:8:3:1 | [FunctionDeclStmt] functio ... .ts'; } | semmle.label | [FunctionDeclStmt] functio ... .ts'; } |
 | tstSuffixA.ts:1:17:1:28 | [VarDecl] resolvedFile | semmle.label | [VarDecl] resolvedFile |
 | tstSuffixA.ts:1:33:1:47 | [LiteralTypeExpr] 'tstSuffixA.ts' | semmle.label | [LiteralTypeExpr] 'tstSuffixA.ts' |
@@ -1426,7 +1469,7 @@ nodes
 | tstSuffixA.ts:2:5:2:27 | [ReturnStmt] return ... xA.ts'; | semmle.label | [ReturnStmt] return ... xA.ts'; |
 | tstSuffixA.ts:2:12:2:26 | [Literal] 'tstSuffixA.ts' | semmle.label | [Literal] 'tstSuffixA.ts' |
 | tstSuffixB.ios.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.label | [ExportDeclaration] export ... .ts'; } |
-| tstSuffixB.ios.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 87 |
+| tstSuffixB.ios.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 88 |
 | tstSuffixB.ios.ts:1:8:3:1 | [FunctionDeclStmt] functio ... .ts'; } | semmle.label | [FunctionDeclStmt] functio ... .ts'; } |
 | tstSuffixB.ios.ts:1:17:1:28 | [VarDecl] resolvedFile | semmle.label | [VarDecl] resolvedFile |
 | tstSuffixB.ios.ts:1:33:1:51 | [LiteralTypeExpr] 'tstSuffixB.ios.ts' | semmle.label | [LiteralTypeExpr] 'tstSuffixB.ios.ts' |
@@ -1434,7 +1477,7 @@ nodes
 | tstSuffixB.ios.ts:2:5:2:31 | [ReturnStmt] return ... os.ts'; | semmle.label | [ReturnStmt] return ... os.ts'; |
 | tstSuffixB.ios.ts:2:12:2:30 | [Literal] 'tstSuffixB.ios.ts' | semmle.label | [Literal] 'tstSuffixB.ios.ts' |
 | tstSuffixB.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.label | [ExportDeclaration] export ... .ts'; } |
-| tstSuffixB.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 88 |
+| tstSuffixB.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 89 |
 | tstSuffixB.ts:1:8:3:1 | [FunctionDeclStmt] functio ... .ts'; } | semmle.label | [FunctionDeclStmt] functio ... .ts'; } |
 | tstSuffixB.ts:1:17:1:28 | [VarDecl] resolvedFile | semmle.label | [VarDecl] resolvedFile |
 | tstSuffixB.ts:1:33:1:47 | [LiteralTypeExpr] 'tstSuffixB.ts' | semmle.label | [LiteralTypeExpr] 'tstSuffixB.ts' |
@@ -1442,16 +1485,16 @@ nodes
 | tstSuffixB.ts:2:5:2:27 | [ReturnStmt] return ... xB.ts'; | semmle.label | [ReturnStmt] return ... xB.ts'; |
 | tstSuffixB.ts:2:12:2:26 | [Literal] 'tstSuffixB.ts' | semmle.label | [Literal] 'tstSuffixB.ts' |
 | type_alias.ts:1:1:1:17 | [TypeAliasDeclaration,TypeDefinition] type B = boolean; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type B = boolean; |
-| type_alias.ts:1:1:1:17 | [TypeAliasDeclaration,TypeDefinition] type B = boolean; | semmle.order | 89 |
+| type_alias.ts:1:1:1:17 | [TypeAliasDeclaration,TypeDefinition] type B = boolean; | semmle.order | 90 |
 | type_alias.ts:1:6:1:6 | [Identifier] B | semmle.label | [Identifier] B |
 | type_alias.ts:1:10:1:16 | [KeywordTypeExpr] boolean | semmle.label | [KeywordTypeExpr] boolean |
 | type_alias.ts:3:1:3:9 | [DeclStmt] var b = ... | semmle.label | [DeclStmt] var b = ... |
-| type_alias.ts:3:1:3:9 | [DeclStmt] var b = ... | semmle.order | 90 |
+| type_alias.ts:3:1:3:9 | [DeclStmt] var b = ... | semmle.order | 91 |
 | type_alias.ts:3:5:3:5 | [VarDecl] b | semmle.label | [VarDecl] b |
 | type_alias.ts:3:5:3:8 | [VariableDeclarator] b: B | semmle.label | [VariableDeclarator] b: B |
 | type_alias.ts:3:8:3:8 | [LocalTypeAccess] B | semmle.label | [LocalTypeAccess] B |
 | type_alias.ts:5:1:5:50 | [TypeAliasDeclaration,TypeDefinition] type Va ... ay<T>>; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Va ... ay<T>>; |
-| type_alias.ts:5:1:5:50 | [TypeAliasDeclaration,TypeDefinition] type Va ... ay<T>>; | semmle.order | 91 |
+| type_alias.ts:5:1:5:50 | [TypeAliasDeclaration,TypeDefinition] type Va ... ay<T>>; | semmle.order | 92 |
 | type_alias.ts:5:6:5:17 | [Identifier] ValueOrArray | semmle.label | [Identifier] ValueOrArray |
 | type_alias.ts:5:19:5:19 | [Identifier] T | semmle.label | [Identifier] T |
 | type_alias.ts:5:19:5:19 | [TypeParameter] T | semmle.label | [TypeParameter] T |
@@ -1463,14 +1506,14 @@ nodes
 | type_alias.ts:5:34:5:48 | [GenericTypeExpr] ValueOrArray<T> | semmle.label | [GenericTypeExpr] ValueOrArray<T> |
 | type_alias.ts:5:47:5:47 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
 | type_alias.ts:7:1:7:28 | [DeclStmt] var c = ... | semmle.label | [DeclStmt] var c = ... |
-| type_alias.ts:7:1:7:28 | [DeclStmt] var c = ... | semmle.order | 92 |
+| type_alias.ts:7:1:7:28 | [DeclStmt] var c = ... | semmle.order | 93 |
 | type_alias.ts:7:5:7:5 | [VarDecl] c | semmle.label | [VarDecl] c |
 | type_alias.ts:7:5:7:27 | [VariableDeclarator] c: Valu ... number> | semmle.label | [VariableDeclarator] c: Valu ... number> |
 | type_alias.ts:7:8:7:19 | [LocalTypeAccess] ValueOrArray | semmle.label | [LocalTypeAccess] ValueOrArray |
 | type_alias.ts:7:8:7:27 | [GenericTypeExpr] ValueOrArray<number> | semmle.label | [GenericTypeExpr] ValueOrArray<number> |
 | type_alias.ts:7:21:7:26 | [KeywordTypeExpr] number | semmle.label | [KeywordTypeExpr] number |
 | type_alias.ts:9:1:15:13 | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; |
-| type_alias.ts:9:1:15:13 | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; | semmle.order | 93 |
+| type_alias.ts:9:1:15:13 | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; | semmle.order | 94 |
 | type_alias.ts:9:6:9:9 | [Identifier] Json | semmle.label | [Identifier] Json |
 | type_alias.ts:10:5:15:12 | [UnionTypeExpr] \| strin ... Json[] | semmle.label | [UnionTypeExpr] \| strin ... Json[] |
 | type_alias.ts:10:7:10:12 | [KeywordTypeExpr] string | semmle.label | [KeywordTypeExpr] string |
@@ -1486,12 +1529,12 @@ nodes
 | type_alias.ts:15:7:15:10 | [LocalTypeAccess] Json | semmle.label | [LocalTypeAccess] Json |
 | type_alias.ts:15:7:15:12 | [ArrayTypeExpr] Json[] | semmle.label | [ArrayTypeExpr] Json[] |
 | type_alias.ts:17:1:17:15 | [DeclStmt] var json = ... | semmle.label | [DeclStmt] var json = ... |
-| type_alias.ts:17:1:17:15 | [DeclStmt] var json = ... | semmle.order | 94 |
+| type_alias.ts:17:1:17:15 | [DeclStmt] var json = ... | semmle.order | 95 |
 | type_alias.ts:17:5:17:8 | [VarDecl] json | semmle.label | [VarDecl] json |
 | type_alias.ts:17:5:17:14 | [VariableDeclarator] json: Json | semmle.label | [VariableDeclarator] json: Json |
 | type_alias.ts:17:11:17:14 | [LocalTypeAccess] Json | semmle.label | [LocalTypeAccess] Json |
 | type_alias.ts:19:1:21:57 | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; |
-| type_alias.ts:19:1:21:57 | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; | semmle.order | 95 |
+| type_alias.ts:19:1:21:57 | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; | semmle.order | 96 |
 | type_alias.ts:19:6:19:16 | [Identifier] VirtualNode | semmle.label | [Identifier] VirtualNode |
 | type_alias.ts:20:5:21:56 | [UnionTypeExpr] \| strin ... Node[]] | semmle.label | [UnionTypeExpr] \| strin ... Node[]] |
 | type_alias.ts:20:7:20:12 | [KeywordTypeExpr] string | semmle.label | [KeywordTypeExpr] string |
@@ -1507,7 +1550,7 @@ nodes
 | type_alias.ts:21:43:21:53 | [LocalTypeAccess] VirtualNode | semmle.label | [LocalTypeAccess] VirtualNode |
 | type_alias.ts:21:43:21:55 | [ArrayTypeExpr] VirtualNode[] | semmle.label | [ArrayTypeExpr] VirtualNode[] |
 | type_alias.ts:23:1:27:6 | [DeclStmt] const myNode = ... | semmle.label | [DeclStmt] const myNode = ... |
-| type_alias.ts:23:1:27:6 | [DeclStmt] const myNode = ... | semmle.order | 96 |
+| type_alias.ts:23:1:27:6 | [DeclStmt] const myNode = ... | semmle.order | 97 |
 | type_alias.ts:23:7:23:12 | [VarDecl] myNode | semmle.label | [VarDecl] myNode |
 | type_alias.ts:23:7:27:5 | [VariableDeclarator] myNode: ... ] ] | semmle.label | [VariableDeclarator] myNode: ... ] ] |
 | type_alias.ts:23:15:23:25 | [LocalTypeAccess] VirtualNode | semmle.label | [LocalTypeAccess] VirtualNode |
@@ -1532,12 +1575,12 @@ nodes
 | type_alias.ts:26:23:26:36 | [Literal] "second-child" | semmle.label | [Literal] "second-child" |
 | type_alias.ts:26:41:26:62 | [Literal] "I'm the second child" | semmle.label | [Literal] "I'm the second child" |
 | type_definition_objects.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.label | [ImportDeclaration] import ... dummy"; |
-| type_definition_objects.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 97 |
+| type_definition_objects.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 98 |
 | type_definition_objects.ts:1:8:1:17 | [ImportSpecifier] * as dummy | semmle.label | [ImportSpecifier] * as dummy |
 | type_definition_objects.ts:1:13:1:17 | [VarDecl] dummy | semmle.label | [VarDecl] dummy |
 | type_definition_objects.ts:1:24:1:32 | [Literal] "./dummy" | semmle.label | [Literal] "./dummy" |
 | type_definition_objects.ts:3:1:3:17 | [ExportDeclaration] export class C {} | semmle.label | [ExportDeclaration] export class C {} |
-| type_definition_objects.ts:3:1:3:17 | [ExportDeclaration] export class C {} | semmle.order | 98 |
+| type_definition_objects.ts:3:1:3:17 | [ExportDeclaration] export class C {} | semmle.order | 99 |
 | type_definition_objects.ts:3:8:3:17 | [ClassDefinition,TypeDefinition] class C {} | semmle.label | [ClassDefinition,TypeDefinition] class C {} |
 | type_definition_objects.ts:3:14:3:14 | [VarDecl] C | semmle.label | [VarDecl] C |
 | type_definition_objects.ts:3:16:3:15 | [BlockStmt] {} | semmle.label | [BlockStmt] {} |
@@ -1545,36 +1588,36 @@ nodes
 | type_definition_objects.ts:3:16:3:15 | [FunctionExpr] () {} | semmle.label | [FunctionExpr] () {} |
 | type_definition_objects.ts:3:16:3:15 | [Label] constructor | semmle.label | [Label] constructor |
 | type_definition_objects.ts:4:1:4:17 | [DeclStmt] let classObj = ... | semmle.label | [DeclStmt] let classObj = ... |
-| type_definition_objects.ts:4:1:4:17 | [DeclStmt] let classObj = ... | semmle.order | 99 |
+| type_definition_objects.ts:4:1:4:17 | [DeclStmt] let classObj = ... | semmle.order | 100 |
 | type_definition_objects.ts:4:5:4:12 | [VarDecl] classObj | semmle.label | [VarDecl] classObj |
 | type_definition_objects.ts:4:5:4:16 | [VariableDeclarator] classObj = C | semmle.label | [VariableDeclarator] classObj = C |
 | type_definition_objects.ts:4:16:4:16 | [VarRef] C | semmle.label | [VarRef] C |
 | type_definition_objects.ts:6:1:6:16 | [ExportDeclaration] export enum E {} | semmle.label | [ExportDeclaration] export enum E {} |
-| type_definition_objects.ts:6:1:6:16 | [ExportDeclaration] export enum E {} | semmle.order | 100 |
+| type_definition_objects.ts:6:1:6:16 | [ExportDeclaration] export enum E {} | semmle.order | 101 |
 | type_definition_objects.ts:6:8:6:16 | [EnumDeclaration,TypeDefinition] enum E {} | semmle.label | [EnumDeclaration,TypeDefinition] enum E {} |
 | type_definition_objects.ts:6:13:6:13 | [VarDecl] E | semmle.label | [VarDecl] E |
 | type_definition_objects.ts:7:1:7:16 | [DeclStmt] let enumObj = ... | semmle.label | [DeclStmt] let enumObj = ... |
-| type_definition_objects.ts:7:1:7:16 | [DeclStmt] let enumObj = ... | semmle.order | 101 |
+| type_definition_objects.ts:7:1:7:16 | [DeclStmt] let enumObj = ... | semmle.order | 102 |
 | type_definition_objects.ts:7:5:7:11 | [VarDecl] enumObj | semmle.label | [VarDecl] enumObj |
 | type_definition_objects.ts:7:5:7:15 | [VariableDeclarator] enumObj = E | semmle.label | [VariableDeclarator] enumObj = E |
 | type_definition_objects.ts:7:15:7:15 | [VarRef] E | semmle.label | [VarRef] E |
 | type_definition_objects.ts:9:1:9:22 | [ExportDeclaration] export ... e N {;} | semmle.label | [ExportDeclaration] export ... e N {;} |
-| type_definition_objects.ts:9:1:9:22 | [ExportDeclaration] export ... e N {;} | semmle.order | 102 |
+| type_definition_objects.ts:9:1:9:22 | [ExportDeclaration] export ... e N {;} | semmle.order | 103 |
 | type_definition_objects.ts:9:8:9:22 | [NamespaceDeclaration] namespace N {;} | semmle.label | [NamespaceDeclaration] namespace N {;} |
 | type_definition_objects.ts:9:18:9:18 | [VarDecl] N | semmle.label | [VarDecl] N |
 | type_definition_objects.ts:9:21:9:21 | [EmptyStmt] ; | semmle.label | [EmptyStmt] ; |
 | type_definition_objects.ts:10:1:10:21 | [DeclStmt] let namespaceObj = ... | semmle.label | [DeclStmt] let namespaceObj = ... |
-| type_definition_objects.ts:10:1:10:21 | [DeclStmt] let namespaceObj = ... | semmle.order | 103 |
+| type_definition_objects.ts:10:1:10:21 | [DeclStmt] let namespaceObj = ... | semmle.order | 104 |
 | type_definition_objects.ts:10:5:10:16 | [VarDecl] namespaceObj | semmle.label | [VarDecl] namespaceObj |
 | type_definition_objects.ts:10:5:10:20 | [VariableDeclarator] namespaceObj = N | semmle.label | [VariableDeclarator] namespaceObj = N |
 | type_definition_objects.ts:10:20:10:20 | [VarRef] N | semmle.label | [VarRef] N |
 | type_definitions.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.label | [ImportDeclaration] import ... dummy"; |
-| type_definitions.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 104 |
+| type_definitions.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 105 |
 | type_definitions.ts:1:8:1:17 | [ImportSpecifier] * as dummy | semmle.label | [ImportSpecifier] * as dummy |
 | type_definitions.ts:1:13:1:17 | [VarDecl] dummy | semmle.label | [VarDecl] dummy |
 | type_definitions.ts:1:24:1:32 | [Literal] "./dummy" | semmle.label | [Literal] "./dummy" |
 | type_definitions.ts:3:1:5:1 | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } | semmle.label | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } |
-| type_definitions.ts:3:1:5:1 | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } | semmle.order | 105 |
+| type_definitions.ts:3:1:5:1 | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } | semmle.order | 106 |
 | type_definitions.ts:3:11:3:11 | [Identifier] I | semmle.label | [Identifier] I |
 | type_definitions.ts:3:13:3:13 | [Identifier] S | semmle.label | [Identifier] S |
 | type_definitions.ts:3:13:3:13 | [TypeParameter] S | semmle.label | [TypeParameter] S |
@@ -1582,14 +1625,14 @@ nodes
 | type_definitions.ts:4:3:4:7 | [FieldDeclaration] x: S; | semmle.label | [FieldDeclaration] x: S; |
 | type_definitions.ts:4:6:4:6 | [LocalTypeAccess] S | semmle.label | [LocalTypeAccess] S |
 | type_definitions.ts:6:1:6:16 | [DeclStmt] let i = ... | semmle.label | [DeclStmt] let i = ... |
-| type_definitions.ts:6:1:6:16 | [DeclStmt] let i = ... | semmle.order | 106 |
+| type_definitions.ts:6:1:6:16 | [DeclStmt] let i = ... | semmle.order | 107 |
 | type_definitions.ts:6:5:6:5 | [VarDecl] i | semmle.label | [VarDecl] i |
 | type_definitions.ts:6:5:6:16 | [VariableDeclarator] i: I<number> | semmle.label | [VariableDeclarator] i: I<number> |
 | type_definitions.ts:6:8:6:8 | [LocalTypeAccess] I | semmle.label | [LocalTypeAccess] I |
 | type_definitions.ts:6:8:6:16 | [GenericTypeExpr] I<number> | semmle.label | [GenericTypeExpr] I<number> |
 | type_definitions.ts:6:10:6:15 | [KeywordTypeExpr] number | semmle.label | [KeywordTypeExpr] number |
 | type_definitions.ts:8:1:10:1 | [ClassDefinition,TypeDefinition] class C ... x: T } | semmle.label | [ClassDefinition,TypeDefinition] class C ... x: T } |
-| type_definitions.ts:8:1:10:1 | [ClassDefinition,TypeDefinition] class C ... x: T } | semmle.order | 107 |
+| type_definitions.ts:8:1:10:1 | [ClassDefinition,TypeDefinition] class C ... x: T } | semmle.order | 108 |
 | type_definitions.ts:8:7:8:7 | [VarDecl] C | semmle.label | [VarDecl] C |
 | type_definitions.ts:8:8:8:7 | [BlockStmt] {} | semmle.label | [BlockStmt] {} |
 | type_definitions.ts:8:8:8:7 | [ClassInitializedMember,ConstructorDefinition] constructor() {} | semmle.label | [ClassInitializedMember,ConstructorDefinition] constructor() {} |
@@ -1601,14 +1644,14 @@ nodes
 | type_definitions.ts:9:3:9:6 | [FieldDeclaration] x: T | semmle.label | [FieldDeclaration] x: T |
 | type_definitions.ts:9:6:9:6 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
 | type_definitions.ts:11:1:11:17 | [DeclStmt] let c = ... | semmle.label | [DeclStmt] let c = ... |
-| type_definitions.ts:11:1:11:17 | [DeclStmt] let c = ... | semmle.order | 108 |
+| type_definitions.ts:11:1:11:17 | [DeclStmt] let c = ... | semmle.order | 109 |
 | type_definitions.ts:11:5:11:5 | [VarDecl] c | semmle.label | [VarDecl] c |
 | type_definitions.ts:11:5:11:16 | [VariableDeclarator] c: C<number> | semmle.label | [VariableDeclarator] c: C<number> |
 | type_definitions.ts:11:8:11:8 | [LocalTypeAccess] C | semmle.label | [LocalTypeAccess] C |
 | type_definitions.ts:11:8:11:16 | [GenericTypeExpr] C<number> | semmle.label | [GenericTypeExpr] C<number> |
 | type_definitions.ts:11:10:11:15 | [KeywordTypeExpr] number | semmle.label | [KeywordTypeExpr] number |
 | type_definitions.ts:13:1:15:1 | [EnumDeclaration,TypeDefinition] enum Co ... blue } | semmle.label | [EnumDeclaration,TypeDefinition] enum Co ... blue } |
-| type_definitions.ts:13:1:15:1 | [EnumDeclaration,TypeDefinition] enum Co ... blue } | semmle.order | 109 |
+| type_definitions.ts:13:1:15:1 | [EnumDeclaration,TypeDefinition] enum Co ... blue } | semmle.order | 110 |
 | type_definitions.ts:13:6:13:10 | [VarDecl] Color | semmle.label | [VarDecl] Color |
 | type_definitions.ts:14:3:14:5 | [EnumMember,TypeDefinition] red | semmle.label | [EnumMember,TypeDefinition] red |
 | type_definitions.ts:14:3:14:5 | [VarDecl] red | semmle.label | [VarDecl] red |
@@ -1617,29 +1660,29 @@ nodes
 | type_definitions.ts:14:15:14:18 | [EnumMember,TypeDefinition] blue | semmle.label | [EnumMember,TypeDefinition] blue |
 | type_definitions.ts:14:15:14:18 | [VarDecl] blue | semmle.label | [VarDecl] blue |
 | type_definitions.ts:16:1:16:17 | [DeclStmt] let color = ... | semmle.label | [DeclStmt] let color = ... |
-| type_definitions.ts:16:1:16:17 | [DeclStmt] let color = ... | semmle.order | 110 |
+| type_definitions.ts:16:1:16:17 | [DeclStmt] let color = ... | semmle.order | 111 |
 | type_definitions.ts:16:5:16:9 | [VarDecl] color | semmle.label | [VarDecl] color |
 | type_definitions.ts:16:5:16:16 | [VariableDeclarator] color: Color | semmle.label | [VariableDeclarator] color: Color |
 | type_definitions.ts:16:12:16:16 | [LocalTypeAccess] Color | semmle.label | [LocalTypeAccess] Color |
 | type_definitions.ts:18:1:18:33 | [EnumDeclaration,TypeDefinition] enum En ... ember } | semmle.label | [EnumDeclaration,TypeDefinition] enum En ... ember } |
-| type_definitions.ts:18:1:18:33 | [EnumDeclaration,TypeDefinition] enum En ... ember } | semmle.order | 111 |
+| type_definitions.ts:18:1:18:33 | [EnumDeclaration,TypeDefinition] enum En ... ember } | semmle.order | 112 |
 | type_definitions.ts:18:6:18:22 | [VarDecl] EnumWithOneMember | semmle.label | [VarDecl] EnumWithOneMember |
 | type_definitions.ts:18:26:18:31 | [EnumMember,TypeDefinition] member | semmle.label | [EnumMember,TypeDefinition] member |
 | type_definitions.ts:18:26:18:31 | [VarDecl] member | semmle.label | [VarDecl] member |
 | type_definitions.ts:19:1:19:25 | [DeclStmt] let e = ... | semmle.label | [DeclStmt] let e = ... |
-| type_definitions.ts:19:1:19:25 | [DeclStmt] let e = ... | semmle.order | 112 |
+| type_definitions.ts:19:1:19:25 | [DeclStmt] let e = ... | semmle.order | 113 |
 | type_definitions.ts:19:5:19:5 | [VarDecl] e | semmle.label | [VarDecl] e |
 | type_definitions.ts:19:5:19:24 | [VariableDeclarator] e: EnumWithOneMember | semmle.label | [VariableDeclarator] e: EnumWithOneMember |
 | type_definitions.ts:19:8:19:24 | [LocalTypeAccess] EnumWithOneMember | semmle.label | [LocalTypeAccess] EnumWithOneMember |
 | type_definitions.ts:21:1:21:20 | [TypeAliasDeclaration,TypeDefinition] type Alias<T> = T[]; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Alias<T> = T[]; |
-| type_definitions.ts:21:1:21:20 | [TypeAliasDeclaration,TypeDefinition] type Alias<T> = T[]; | semmle.order | 113 |
+| type_definitions.ts:21:1:21:20 | [TypeAliasDeclaration,TypeDefinition] type Alias<T> = T[]; | semmle.order | 114 |
 | type_definitions.ts:21:6:21:10 | [Identifier] Alias | semmle.label | [Identifier] Alias |
 | type_definitions.ts:21:12:21:12 | [Identifier] T | semmle.label | [Identifier] T |
 | type_definitions.ts:21:12:21:12 | [TypeParameter] T | semmle.label | [TypeParameter] T |
 | type_definitions.ts:21:17:21:17 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
 | type_definitions.ts:21:17:21:19 | [ArrayTypeExpr] T[] | semmle.label | [ArrayTypeExpr] T[] |
 | type_definitions.ts:22:1:22:39 | [DeclStmt] let aliasForNumberArray = ... | semmle.label | [DeclStmt] let aliasForNumberArray = ... |
-| type_definitions.ts:22:1:22:39 | [DeclStmt] let aliasForNumberArray = ... | semmle.order | 114 |
+| type_definitions.ts:22:1:22:39 | [DeclStmt] let aliasForNumberArray = ... | semmle.order | 115 |
 | type_definitions.ts:22:5:22:23 | [VarDecl] aliasForNumberArray | semmle.label | [VarDecl] aliasForNumberArray |
 | type_definitions.ts:22:5:22:38 | [VariableDeclarator] aliasFo ... number> | semmle.label | [VariableDeclarator] aliasFo ... number> |
 | type_definitions.ts:22:26:22:30 | [LocalTypeAccess] Alias | semmle.label | [LocalTypeAccess] Alias |
@@ -1794,6 +1837,10 @@ edges
 | file://:0:0:0:0 | (Arguments) | tst.ts:370:13:370:28 | [MethodCallExpr] A.resolvedFile() | semmle.order | 0 |
 | file://:0:0:0:0 | (Arguments) | tst.ts:374:13:374:28 | [MethodCallExpr] B.resolvedFile() | semmle.label | 0 |
 | file://:0:0:0:0 | (Arguments) | tst.ts:374:13:374:28 | [MethodCallExpr] B.resolvedFile() | semmle.order | 0 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:385:36:385:52 | [ArrayExpr] [42, true, "hi!"] | semmle.label | 0 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:385:36:385:52 | [ArrayExpr] [42, true, "hi!"] | semmle.order | 0 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:385:55:385:72 | [ArrayExpr] [0, false, "bye!"] | semmle.label | 1 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:385:55:385:72 | [ArrayExpr] [0, false, "bye!"] | semmle.order | 1 |
 | file://:0:0:0:0 | (Parameters) | tst.ts:14:17:14:17 | [SimpleParameter] x | semmle.label | 0 |
 | file://:0:0:0:0 | (Parameters) | tst.ts:14:17:14:17 | [SimpleParameter] x | semmle.order | 0 |
 | file://:0:0:0:0 | (Parameters) | tst.ts:14:28:14:28 | [SimpleParameter] y | semmle.label | 1 |
@@ -1866,6 +1913,10 @@ edges
 | file://:0:0:0:0 | (Parameters) | tst.ts:344:9:344:13 | [SimpleParameter] value | semmle.order | 0 |
 | file://:0:0:0:0 | (Parameters) | tst.ts:349:9:349:13 | [SimpleParameter] value | semmle.label | 0 |
 | file://:0:0:0:0 | (Parameters) | tst.ts:349:9:349:13 | [SimpleParameter] value | semmle.order | 0 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:383:40:383:40 | [SimpleParameter] x | semmle.label | 0 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:383:40:383:40 | [SimpleParameter] x | semmle.order | 0 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:383:46:383:46 | [SimpleParameter] y | semmle.label | 1 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:383:46:383:46 | [SimpleParameter] y | semmle.order | 1 |
 | file://:0:0:0:0 | (Parameters) | type_alias.ts:14:10:14:17 | [SimpleParameter] property | semmle.label | 0 |
 | file://:0:0:0:0 | (Parameters) | type_alias.ts:14:10:14:17 | [SimpleParameter] property | semmle.order | 0 |
 | file://:0:0:0:0 | (Parameters) | type_alias.ts:21:19:21:21 | [SimpleParameter] key | semmle.label | 0 |
@@ -1884,6 +1935,10 @@ edges
 | file://:0:0:0:0 | (TypeParameters) | tst.ts:332:20:332:35 | [TypeParameter] S extends string | semmle.order | 0 |
 | file://:0:0:0:0 | (TypeParameters) | tst.ts:342:17:342:24 | [TypeParameter] in out T | semmle.label | 0 |
 | file://:0:0:0:0 | (TypeParameters) | tst.ts:342:17:342:24 | [TypeParameter] in out T | semmle.order | 0 |
+| file://:0:0:0:0 | (TypeParameters) | tst.ts:381:43:381:58 | [TypeParameter] U extends number | semmle.label | 0 |
+| file://:0:0:0:0 | (TypeParameters) | tst.ts:381:43:381:58 | [TypeParameter] U extends number | semmle.order | 0 |
+| file://:0:0:0:0 | (TypeParameters) | tst.ts:383:37:383:37 | [TypeParameter] T | semmle.label | 0 |
+| file://:0:0:0:0 | (TypeParameters) | tst.ts:383:37:383:37 | [TypeParameter] T | semmle.order | 0 |
 | file://:0:0:0:0 | (TypeParameters) | type_alias.ts:5:19:5:19 | [TypeParameter] T | semmle.label | 0 |
 | file://:0:0:0:0 | (TypeParameters) | type_alias.ts:5:19:5:19 | [TypeParameter] T | semmle.order | 0 |
 | file://:0:0:0:0 | (TypeParameters) | type_definitions.ts:3:13:3:13 | [TypeParameter] S | semmle.label | 0 |
@@ -4078,6 +4133,76 @@ edges
 | tst.ts:374:13:374:26 | [DotExpr] B.resolvedFile | tst.ts:374:15:374:26 | [Label] resolvedFile | semmle.order | 2 |
 | tst.ts:374:13:374:28 | [MethodCallExpr] B.resolvedFile() | tst.ts:374:13:374:26 | [DotExpr] B.resolvedFile | semmle.label | 0 |
 | tst.ts:374:13:374:28 | [MethodCallExpr] B.resolvedFile() | tst.ts:374:13:374:26 | [DotExpr] B.resolvedFile | semmle.order | 0 |
+| tst.ts:379:1:386:1 | [NamespaceDeclaration] module ... ; } | tst.ts:379:8:379:11 | [VarDecl] TS48 | semmle.label | 1 |
+| tst.ts:379:1:386:1 | [NamespaceDeclaration] module ... ; } | tst.ts:379:8:379:11 | [VarDecl] TS48 | semmle.order | 1 |
+| tst.ts:379:1:386:1 | [NamespaceDeclaration] module ... ; } | tst.ts:381:5:381:73 | [TypeAliasDeclaration,TypeDefinition] type So ... never; | semmle.label | 2 |
+| tst.ts:379:1:386:1 | [NamespaceDeclaration] module ... ; } | tst.ts:381:5:381:73 | [TypeAliasDeclaration,TypeDefinition] type So ... never; | semmle.order | 2 |
+| tst.ts:379:1:386:1 | [NamespaceDeclaration] module ... ; } | tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | semmle.label | 3 |
+| tst.ts:379:1:386:1 | [NamespaceDeclaration] module ... ; } | tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | semmle.order | 3 |
+| tst.ts:379:1:386:1 | [NamespaceDeclaration] module ... ; } | tst.ts:385:5:385:74 | [DeclStmt] let [a, ... ye!"]); | semmle.label | 4 |
+| tst.ts:379:1:386:1 | [NamespaceDeclaration] module ... ; } | tst.ts:385:5:385:74 | [DeclStmt] let [a, ... ye!"]); | semmle.order | 4 |
+| tst.ts:381:5:381:73 | [TypeAliasDeclaration,TypeDefinition] type So ... never; | tst.ts:381:10:381:16 | [Identifier] SomeNum | semmle.label | 1 |
+| tst.ts:381:5:381:73 | [TypeAliasDeclaration,TypeDefinition] type So ... never; | tst.ts:381:10:381:16 | [Identifier] SomeNum | semmle.order | 1 |
+| tst.ts:381:5:381:73 | [TypeAliasDeclaration,TypeDefinition] type So ... never; | tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | semmle.label | 2 |
+| tst.ts:381:5:381:73 | [TypeAliasDeclaration,TypeDefinition] type So ... never; | tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | semmle.order | 2 |
+| tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | tst.ts:381:20:381:24 | [LiteralTypeExpr] "100" | semmle.label | 1 |
+| tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | tst.ts:381:20:381:24 | [LiteralTypeExpr] "100" | semmle.order | 1 |
+| tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | tst.ts:381:34:381:60 | [TemplateLiteralTypeExpr] `${infe ... umber}` | semmle.label | 2 |
+| tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | tst.ts:381:34:381:60 | [TemplateLiteralTypeExpr] `${infe ... umber}` | semmle.order | 2 |
+| tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | tst.ts:381:64:381:64 | [LocalTypeAccess] U | semmle.label | 3 |
+| tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | tst.ts:381:64:381:64 | [LocalTypeAccess] U | semmle.order | 3 |
+| tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | tst.ts:381:68:381:72 | [KeywordTypeExpr] never | semmle.label | 4 |
+| tst.ts:381:20:381:72 | [ConditionalTypeExpr] "100" e ... : never | tst.ts:381:68:381:72 | [KeywordTypeExpr] never | semmle.order | 4 |
+| tst.ts:381:34:381:60 | [TemplateLiteralTypeExpr] `${infe ... umber}` | tst.ts:381:37:381:58 | [InferTypeExpr] infer U ... number | semmle.label | 1 |
+| tst.ts:381:34:381:60 | [TemplateLiteralTypeExpr] `${infe ... umber}` | tst.ts:381:37:381:58 | [InferTypeExpr] infer U ... number | semmle.order | 1 |
+| tst.ts:381:37:381:58 | [InferTypeExpr] infer U ... number | file://:0:0:0:0 | (TypeParameters) | semmle.label | -100 |
+| tst.ts:381:37:381:58 | [InferTypeExpr] infer U ... number | file://:0:0:0:0 | (TypeParameters) | semmle.order | -100 |
+| tst.ts:381:43:381:58 | [TypeParameter] U extends number | tst.ts:381:43:381:43 | [Identifier] U | semmle.label | 1 |
+| tst.ts:381:43:381:58 | [TypeParameter] U extends number | tst.ts:381:43:381:43 | [Identifier] U | semmle.order | 1 |
+| tst.ts:381:43:381:58 | [TypeParameter] U extends number | tst.ts:381:53:381:58 | [KeywordTypeExpr] number | semmle.label | 2 |
+| tst.ts:381:43:381:58 | [TypeParameter] U extends number | tst.ts:381:53:381:58 | [KeywordTypeExpr] number | semmle.order | 2 |
+| tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | file://:0:0:0:0 | (Parameters) | semmle.label | 1 |
+| tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | file://:0:0:0:0 | (Parameters) | semmle.order | 1 |
+| tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | file://:0:0:0:0 | (TypeParameters) | semmle.label | 2 |
+| tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | file://:0:0:0:0 | (TypeParameters) | semmle.order | 2 |
+| tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | tst.ts:383:22:383:35 | [VarDecl] chooseRandomly | semmle.label | 0 |
+| tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | tst.ts:383:22:383:35 | [VarDecl] chooseRandomly | semmle.order | 0 |
+| tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | tst.ts:383:53:383:53 | [LocalTypeAccess] T | semmle.label | 4 |
+| tst.ts:383:5:383:54 | [FunctionDeclStmt] declare ... T): T; | tst.ts:383:53:383:53 | [LocalTypeAccess] T | semmle.order | 4 |
+| tst.ts:383:37:383:37 | [TypeParameter] T | tst.ts:383:37:383:37 | [Identifier] T | semmle.label | 1 |
+| tst.ts:383:37:383:37 | [TypeParameter] T | tst.ts:383:37:383:37 | [Identifier] T | semmle.order | 1 |
+| tst.ts:383:40:383:40 | [SimpleParameter] x | tst.ts:383:43:383:43 | [LocalTypeAccess] T | semmle.label | 0 |
+| tst.ts:383:40:383:40 | [SimpleParameter] x | tst.ts:383:43:383:43 | [LocalTypeAccess] T | semmle.order | 0 |
+| tst.ts:383:46:383:46 | [SimpleParameter] y | tst.ts:383:49:383:49 | [LocalTypeAccess] T | semmle.label | 0 |
+| tst.ts:383:46:383:46 | [SimpleParameter] y | tst.ts:383:49:383:49 | [LocalTypeAccess] T | semmle.order | 0 |
+| tst.ts:385:5:385:74 | [DeclStmt] let [a, ... ye!"]); | tst.ts:385:9:385:73 | [VariableDeclarator] [a, b, ... bye!"]) | semmle.label | 1 |
+| tst.ts:385:5:385:74 | [DeclStmt] let [a, ... ye!"]); | tst.ts:385:9:385:73 | [VariableDeclarator] [a, b, ... bye!"]) | semmle.order | 1 |
+| tst.ts:385:9:385:17 | [ArrayPattern] [a, b, c] | tst.ts:385:10:385:10 | [VarDecl] a | semmle.label | 1 |
+| tst.ts:385:9:385:17 | [ArrayPattern] [a, b, c] | tst.ts:385:10:385:10 | [VarDecl] a | semmle.order | 1 |
+| tst.ts:385:9:385:17 | [ArrayPattern] [a, b, c] | tst.ts:385:13:385:13 | [VarDecl] b | semmle.label | 2 |
+| tst.ts:385:9:385:17 | [ArrayPattern] [a, b, c] | tst.ts:385:13:385:13 | [VarDecl] b | semmle.order | 2 |
+| tst.ts:385:9:385:17 | [ArrayPattern] [a, b, c] | tst.ts:385:16:385:16 | [VarDecl] c | semmle.label | 3 |
+| tst.ts:385:9:385:17 | [ArrayPattern] [a, b, c] | tst.ts:385:16:385:16 | [VarDecl] c | semmle.order | 3 |
+| tst.ts:385:9:385:73 | [VariableDeclarator] [a, b, ... bye!"]) | tst.ts:385:9:385:17 | [ArrayPattern] [a, b, c] | semmle.label | 1 |
+| tst.ts:385:9:385:73 | [VariableDeclarator] [a, b, ... bye!"]) | tst.ts:385:9:385:17 | [ArrayPattern] [a, b, c] | semmle.order | 1 |
+| tst.ts:385:9:385:73 | [VariableDeclarator] [a, b, ... bye!"]) | tst.ts:385:21:385:73 | [CallExpr] chooseR ... bye!"]) | semmle.label | 2 |
+| tst.ts:385:9:385:73 | [VariableDeclarator] [a, b, ... bye!"]) | tst.ts:385:21:385:73 | [CallExpr] chooseR ... bye!"]) | semmle.order | 2 |
+| tst.ts:385:21:385:73 | [CallExpr] chooseR ... bye!"]) | file://:0:0:0:0 | (Arguments) | semmle.label | 1 |
+| tst.ts:385:21:385:73 | [CallExpr] chooseR ... bye!"]) | file://:0:0:0:0 | (Arguments) | semmle.order | 1 |
+| tst.ts:385:21:385:73 | [CallExpr] chooseR ... bye!"]) | tst.ts:385:21:385:34 | [VarRef] chooseRandomly | semmle.label | 0 |
+| tst.ts:385:21:385:73 | [CallExpr] chooseR ... bye!"]) | tst.ts:385:21:385:34 | [VarRef] chooseRandomly | semmle.order | 0 |
+| tst.ts:385:36:385:52 | [ArrayExpr] [42, true, "hi!"] | tst.ts:385:37:385:38 | [Literal] 42 | semmle.label | 1 |
+| tst.ts:385:36:385:52 | [ArrayExpr] [42, true, "hi!"] | tst.ts:385:37:385:38 | [Literal] 42 | semmle.order | 1 |
+| tst.ts:385:36:385:52 | [ArrayExpr] [42, true, "hi!"] | tst.ts:385:41:385:44 | [Literal] true | semmle.label | 2 |
+| tst.ts:385:36:385:52 | [ArrayExpr] [42, true, "hi!"] | tst.ts:385:41:385:44 | [Literal] true | semmle.order | 2 |
+| tst.ts:385:36:385:52 | [ArrayExpr] [42, true, "hi!"] | tst.ts:385:47:385:51 | [Literal] "hi!" | semmle.label | 3 |
+| tst.ts:385:36:385:52 | [ArrayExpr] [42, true, "hi!"] | tst.ts:385:47:385:51 | [Literal] "hi!" | semmle.order | 3 |
+| tst.ts:385:55:385:72 | [ArrayExpr] [0, false, "bye!"] | tst.ts:385:56:385:56 | [Literal] 0 | semmle.label | 1 |
+| tst.ts:385:55:385:72 | [ArrayExpr] [0, false, "bye!"] | tst.ts:385:56:385:56 | [Literal] 0 | semmle.order | 1 |
+| tst.ts:385:55:385:72 | [ArrayExpr] [0, false, "bye!"] | tst.ts:385:59:385:63 | [Literal] false | semmle.label | 2 |
+| tst.ts:385:55:385:72 | [ArrayExpr] [0, false, "bye!"] | tst.ts:385:59:385:63 | [Literal] false | semmle.order | 2 |
+| tst.ts:385:55:385:72 | [ArrayExpr] [0, false, "bye!"] | tst.ts:385:66:385:71 | [Literal] "bye!" | semmle.label | 3 |
+| tst.ts:385:55:385:72 | [ArrayExpr] [0, false, "bye!"] | tst.ts:385:66:385:71 | [Literal] "bye!" | semmle.order | 3 |
 | tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.label | 1 |
 | tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.order | 1 |
 | tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | tstModuleCJS.cts:1:17:1:28 | [VarDecl] tstModuleCJS | semmle.label | 0 |
diff --git a/javascript/ql/test/library-tests/TypeScript/Types/tests.expected b/javascript/ql/test/library-tests/TypeScript/Types/tests.expected
index ce517db8d6d..6727ab01b13 100644
--- a/javascript/ql/test/library-tests/TypeScript/Types/tests.expected
+++ b/javascript/ql/test/library-tests/TypeScript/Types/tests.expected
@@ -441,7 +441,7 @@ getExprType
 | tst.ts:320:19:320:29 | toLowerCase | () => string |
 | tst.ts:325:7:325:14 | ErrorMap | { new (entries?: readonly (readonly [string, Er... |
 | tst.ts:325:18:325:20 | Map | MapConstructor |
-| tst.ts:325:18:325:35 | Map<string, Error> | any |
+| tst.ts:325:18:325:35 | Map<string, Error> | { new (entries?: readonly (readonly [string, Er... |
 | tst.ts:327:7:327:14 | errorMap | Map<string, Error> |
 | tst.ts:327:18:327:31 | new ErrorMap() | Map<string, Error> |
 | tst.ts:327:22:327:29 | ErrorMap | { new (entries?: readonly (readonly [string, Er... |
@@ -502,6 +502,23 @@ getExprType
 | tst.ts:374:13:374:26 | B.resolvedFile | () => "tstSuffixB.ios.ts" |
 | tst.ts:374:13:374:28 | B.resolvedFile() | "tstSuffixB.ios.ts" |
 | tst.ts:374:15:374:26 | resolvedFile | () => "tstSuffixB.ios.ts" |
+| tst.ts:379:8:379:11 | TS48 | typeof TS48 in library-tests/TypeScript/Types/tst.ts |
+| tst.ts:383:22:383:35 | chooseRandomly | <T>(x: T, y: T) => T |
+| tst.ts:383:40:383:40 | x | T |
+| tst.ts:383:46:383:46 | y | T |
+| tst.ts:385:10:385:10 | a | number |
+| tst.ts:385:13:385:13 | b | boolean |
+| tst.ts:385:16:385:16 | c | string |
+| tst.ts:385:21:385:34 | chooseRandomly | <T>(x: T, y: T) => T |
+| tst.ts:385:21:385:73 | chooseR ... bye!"]) | [number, boolean, string] |
+| tst.ts:385:36:385:52 | [42, true, "hi!"] | [number, boolean, string] |
+| tst.ts:385:37:385:38 | 42 | 42 |
+| tst.ts:385:41:385:44 | true | true |
+| tst.ts:385:47:385:51 | "hi!" | "hi!" |
+| tst.ts:385:55:385:72 | [0, false, "bye!"] | [number, boolean, string] |
+| tst.ts:385:56:385:56 | 0 | 0 |
+| tst.ts:385:59:385:63 | false | false |
+| tst.ts:385:66:385:71 | "bye!" | "bye!" |
 | tstModuleCJS.cts:1:17:1:28 | tstModuleCJS | () => "a" \| "b" |
 | tstModuleCJS.cts:2:12:2:15 | Math | Math |
 | tstModuleCJS.cts:2:12:2:22 | Math.random | () => number |
@@ -606,6 +623,7 @@ getTypeDefinitionType
 | tst.ts:331:1:334:14 | type Fi ...  never; | FirstString<T> |
 | tst.ts:336:1:336:51 | type F  ... lean]>; | "a" \| "b" |
 | tst.ts:342:1:345:1 | interfa ... void;\\n} | State<T> |
+| tst.ts:381:5:381:73 | type So ...  never; | 100 |
 | type_alias.ts:1:1:1:17 | type B = boolean; | boolean |
 | type_alias.ts:5:1:5:50 | type Va ... ay<T>>; | ValueOrArray<T> |
 | type_alias.ts:9:1:15:13 | type Js ... Json[]; | Json |
@@ -861,6 +879,16 @@ getTypeExprType
 | tst.ts:325:30:325:34 | Error | Error |
 | tst.ts:331:6:331:16 | FirstString | FirstString<T> |
 | tst.ts:331:18:331:18 | T | T |
+| tst.ts:332:3:332:3 | T | T |
+| tst.ts:332:13:332:50 | [infer  ... nown[]] | [S, ...unknown[]] |
+| tst.ts:332:14:332:35 | infer S ...  string | S |
+| tst.ts:332:20:332:20 | S | S |
+| tst.ts:332:30:332:35 | string | string |
+| tst.ts:332:38:332:49 | ...unknown[] | unknown |
+| tst.ts:332:41:332:47 | unknown | unknown |
+| tst.ts:332:41:332:49 | unknown[] | unknown[] |
+| tst.ts:333:9:333:9 | S | S |
+| tst.ts:334:9:334:13 | never | never |
 | tst.ts:336:6:336:6 | F | "a" \| "b" |
 | tst.ts:336:10:336:20 | FirstString | FirstString<T> |
 | tst.ts:336:10:336:50 | FirstSt ... olean]> | "a" \| "b" |
@@ -881,6 +909,18 @@ getTypeExprType
 | tst.ts:347:14:347:18 | State | State<T> |
 | tst.ts:347:14:347:26 | State<number> | State<number> |
 | tst.ts:347:20:347:25 | number | number |
+| tst.ts:381:10:381:16 | SomeNum | 100 |
+| tst.ts:381:20:381:24 | "100" | "100" |
+| tst.ts:381:20:381:72 | "100" e ... : never | 100 |
+| tst.ts:381:37:381:58 | infer U ...  number | U |
+| tst.ts:381:43:381:43 | U | U |
+| tst.ts:381:53:381:58 | number | number |
+| tst.ts:381:64:381:64 | U | U |
+| tst.ts:381:68:381:72 | never | never |
+| tst.ts:383:37:383:37 | T | T |
+| tst.ts:383:43:383:43 | T | T |
+| tst.ts:383:49:383:49 | T | T |
+| tst.ts:383:53:383:53 | T | T |
 | tstModuleCJS.cts:1:33:1:35 | 'a' | "a" |
 | tstModuleCJS.cts:1:33:1:41 | 'a' \| 'b' | "a" \| "b" |
 | tstModuleCJS.cts:1:39:1:41 | 'b' | "b" |
@@ -1027,6 +1067,15 @@ tupleTypes
 | tst.ts:42:25:42:30 | [1, 2] | readonly [1, 2] | 1 | 2 | 2 | no-rest |
 | tst.ts:42:25:42:39 | [1, 2] as const | readonly [1, 2] | 0 | 1 | 2 | no-rest |
 | tst.ts:42:25:42:39 | [1, 2] as const | readonly [1, 2] | 1 | 2 | 2 | no-rest |
+| tst.ts:385:21:385:73 | chooseR ... bye!"]) | [number, boolean, string] | 0 | number | 3 | no-rest |
+| tst.ts:385:21:385:73 | chooseR ... bye!"]) | [number, boolean, string] | 1 | boolean | 3 | no-rest |
+| tst.ts:385:21:385:73 | chooseR ... bye!"]) | [number, boolean, string] | 2 | string | 3 | no-rest |
+| tst.ts:385:36:385:52 | [42, true, "hi!"] | [number, boolean, string] | 0 | number | 3 | no-rest |
+| tst.ts:385:36:385:52 | [42, true, "hi!"] | [number, boolean, string] | 1 | boolean | 3 | no-rest |
+| tst.ts:385:36:385:52 | [42, true, "hi!"] | [number, boolean, string] | 2 | string | 3 | no-rest |
+| tst.ts:385:55:385:72 | [0, false, "bye!"] | [number, boolean, string] | 0 | number | 3 | no-rest |
+| tst.ts:385:55:385:72 | [0, false, "bye!"] | [number, boolean, string] | 1 | boolean | 3 | no-rest |
+| tst.ts:385:55:385:72 | [0, false, "bye!"] | [number, boolean, string] | 2 | string | 3 | no-rest |
 unknownType
 | tst.ts:40:5:40:15 | unknownType | unknown |
 | tst.ts:47:8:47:8 | e | unknown |
diff --git a/javascript/ql/test/library-tests/TypeScript/Types/tst.ts b/javascript/ql/test/library-tests/TypeScript/Types/tst.ts
index ed8787112d3..67e31b27afa 100644
--- a/javascript/ql/test/library-tests/TypeScript/Types/tst.ts
+++ b/javascript/ql/test/library-tests/TypeScript/Types/tst.ts
@@ -373,3 +373,14 @@ import * as B from './tstSuffixB';
 
 console.log(B.resolvedFile()); // <- 'tstSuffixB.ios.ts'
 
+
+/////////////////
+
+module TS48 {
+    // SomeNum used to be 'number'; now it's '100'.
+    type SomeNum = "100" extends `${infer U extends number}` ? U : never;
+
+    declare function chooseRandomly<T>(x: T, y: T): T;
+
+    let [a, b, c] = chooseRandomly([42, true, "hi!"], [0, false, "bye!"]);    
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/YAML/printAst.expected b/javascript/ql/test/library-tests/YAML/printAst.expected
index 765288fe38e..1be958a78a4 100644
--- a/javascript/ql/test/library-tests/YAML/printAst.expected
+++ b/javascript/ql/test/library-tests/YAML/printAst.expected
@@ -1,6 +1,6 @@
 nodes
-| external.yml:1:1:1:2 | [YAMLScalar] 42 | semmle.label | [YAMLScalar] 42 |
-| external.yml:1:1:1:2 | [YAMLScalar] 42 | semmle.order | 1 |
+| external.yml:1:1:1:2 | [YamlScalar] 42 | semmle.label | [YamlScalar] 42 |
+| external.yml:1:1:1:2 | [YamlScalar] 42 | semmle.order | 1 |
 | file://:0:0:0:0 | (Mapping 0) name: | semmle.label | (Mapping 0) name: |
 | file://:0:0:0:0 | (Mapping 0) name: | semmle.label | (Mapping 0) name: |
 | file://:0:0:0:0 | (Mapping 0) street: | semmle.label | (Mapping 0) street: |
@@ -15,137 +15,137 @@ nodes
 | file://:0:0:0:0 | (Mapping 1) y: | semmle.label | (Mapping 1) y: |
 | file://:0:0:0:0 | (Mapping 2) country: | semmle.label | (Mapping 2) country: |
 | file://:0:0:0:0 | (Mapping 2) country: | semmle.label | (Mapping 2) country: |
-| merge.yaml:1:1:3:8 | [YAMLSequence] - &A {  ... y: 42 } | semmle.label | [YAMLSequence] - &A {  ... y: 42 } |
-| merge.yaml:1:1:3:8 | [YAMLSequence] - &A {  ... y: 42 } | semmle.order | 2 |
-| merge.yaml:1:3:1:21 | [YAMLMapping] &A { x: 23, y: 42 } | semmle.label | [YAMLMapping] &A { x: 23, y: 42 } |
-| merge.yaml:1:8:1:8 | [YAMLScalar] x | semmle.label | [YAMLScalar] x |
-| merge.yaml:1:11:1:12 | [YAMLScalar] 23 | semmle.label | [YAMLScalar] 23 |
-| merge.yaml:1:15:1:15 | [YAMLScalar] y | semmle.label | [YAMLScalar] y |
-| merge.yaml:1:18:1:19 | [YAMLScalar] 42 | semmle.label | [YAMLScalar] 42 |
-| merge.yaml:2:3:2:3 | [YAMLScalar] x | semmle.label | [YAMLScalar] x |
-| merge.yaml:2:3:3:8 | [YAMLMapping] x: 56 | semmle.label | [YAMLMapping] x: 56 |
-| merge.yaml:2:6:2:7 | [YAMLScalar] 56 | semmle.label | [YAMLScalar] 56 |
-| merge.yaml:3:3:3:4 | [YAMLScalar] << | semmle.label | [YAMLScalar] << |
-| merge.yaml:3:7:3:8 | [YAMLAliasNode] *A | semmle.label | [YAMLAliasNode] *A |
-| tst.yml:1:1:14:23 | [YAMLSequence] - "name ...  Knopf" | semmle.label | [YAMLSequence] - "name ...  Knopf" |
-| tst.yml:1:1:14:23 | [YAMLSequence] - "name ...  Knopf" | semmle.order | 3 |
-| tst.yml:1:3:1:8 | [YAMLScalar] "name" | semmle.label | [YAMLScalar] "name" |
-| tst.yml:1:3:7:0 | [YAMLMapping] "name": "Jim Knopf" | semmle.label | [YAMLMapping] "name": "Jim Knopf" |
-| tst.yml:1:11:1:21 | [YAMLScalar] "Jim Knopf" | semmle.label | [YAMLScalar] "Jim Knopf" |
-| tst.yml:2:3:2:9 | [YAMLScalar] address | semmle.label | [YAMLScalar] address |
-| tst.yml:2:12:6:3 | [YAMLMapping] { | semmle.label | [YAMLMapping] { |
-| tst.yml:3:5:3:12 | [YAMLScalar] "street" | semmle.label | [YAMLScalar] "street" |
-| tst.yml:3:14:3:13 | [YAMLScalar]  | semmle.label | [YAMLScalar]  |
-| tst.yml:4:5:4:12 | [YAMLScalar] "number" | semmle.label | [YAMLScalar] "number" |
-| tst.yml:4:15:4:16 | [YAMLScalar] -1 | semmle.label | [YAMLScalar] -1 |
-| tst.yml:5:5:5:13 | [YAMLScalar] "country" | semmle.label | [YAMLScalar] "country" |
-| tst.yml:5:16:5:27 | [YAMLScalar] "Lummerland" | semmle.label | [YAMLScalar] "Lummerland" |
-| tst.yml:7:3:7:6 | [YAMLScalar] name | semmle.label | [YAMLScalar] name |
-| tst.yml:7:3:14:0 | [YAMLMapping] name: Frau Mahlzahn | semmle.label | [YAMLMapping] name: Frau Mahlzahn |
-| tst.yml:7:9:7:21 | [YAMLScalar] Frau Mahlzahn | semmle.label | [YAMLScalar] Frau Mahlzahn |
-| tst.yml:8:3:8:9 | [YAMLScalar] address | semmle.label | [YAMLScalar] address |
-| tst.yml:9:5:9:10 | [YAMLScalar] street | semmle.label | [YAMLScalar] street |
-| tst.yml:9:5:14:0 | [YAMLMapping] street: \| | semmle.label | [YAMLMapping] street: \| |
-| tst.yml:9:13:11:0 | [YAMLScalar] \| | semmle.label | [YAMLScalar] \| |
-| tst.yml:11:5:11:10 | [YAMLScalar] number | semmle.label | [YAMLScalar] number |
-| tst.yml:11:13:11:15 | [YAMLScalar] 133 | semmle.label | [YAMLScalar] 133 |
-| tst.yml:12:5:12:11 | [YAMLScalar] country | semmle.label | [YAMLScalar] country |
-| tst.yml:12:14:13:18 | [YAMLScalar] < | semmle.label | [YAMLScalar] < |
-| tst.yml:14:3:14:23 | [YAMLScalar] !includ ... nal.yml | semmle.label | [YAMLScalar] !includ ... nal.yml |
+| merge.yaml:1:1:3:8 | [YamlSequence] - &A {  ... y: 42 } | semmle.label | [YamlSequence] - &A {  ... y: 42 } |
+| merge.yaml:1:1:3:8 | [YamlSequence] - &A {  ... y: 42 } | semmle.order | 2 |
+| merge.yaml:1:3:1:21 | [YamlMapping] &A { x: 23, y: 42 } | semmle.label | [YamlMapping] &A { x: 23, y: 42 } |
+| merge.yaml:1:8:1:8 | [YamlScalar] x | semmle.label | [YamlScalar] x |
+| merge.yaml:1:11:1:12 | [YamlScalar] 23 | semmle.label | [YamlScalar] 23 |
+| merge.yaml:1:15:1:15 | [YamlScalar] y | semmle.label | [YamlScalar] y |
+| merge.yaml:1:18:1:19 | [YamlScalar] 42 | semmle.label | [YamlScalar] 42 |
+| merge.yaml:2:3:2:3 | [YamlScalar] x | semmle.label | [YamlScalar] x |
+| merge.yaml:2:3:3:8 | [YamlMapping] x: 56 | semmle.label | [YamlMapping] x: 56 |
+| merge.yaml:2:6:2:7 | [YamlScalar] 56 | semmle.label | [YamlScalar] 56 |
+| merge.yaml:3:3:3:4 | [YamlScalar] << | semmle.label | [YamlScalar] << |
+| merge.yaml:3:7:3:8 | [YamlAliasNode] *A | semmle.label | [YamlAliasNode] *A |
+| tst.yml:1:1:14:23 | [YamlSequence] - "name ...  Knopf" | semmle.label | [YamlSequence] - "name ...  Knopf" |
+| tst.yml:1:1:14:23 | [YamlSequence] - "name ...  Knopf" | semmle.order | 3 |
+| tst.yml:1:3:1:8 | [YamlScalar] "name" | semmle.label | [YamlScalar] "name" |
+| tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | semmle.label | [YamlMapping] "name": "Jim Knopf" |
+| tst.yml:1:11:1:21 | [YamlScalar] "Jim Knopf" | semmle.label | [YamlScalar] "Jim Knopf" |
+| tst.yml:2:3:2:9 | [YamlScalar] address | semmle.label | [YamlScalar] address |
+| tst.yml:2:12:6:3 | [YamlMapping] { | semmle.label | [YamlMapping] { |
+| tst.yml:3:5:3:12 | [YamlScalar] "street" | semmle.label | [YamlScalar] "street" |
+| tst.yml:3:14:3:13 | [YamlScalar]  | semmle.label | [YamlScalar]  |
+| tst.yml:4:5:4:12 | [YamlScalar] "number" | semmle.label | [YamlScalar] "number" |
+| tst.yml:4:15:4:16 | [YamlScalar] -1 | semmle.label | [YamlScalar] -1 |
+| tst.yml:5:5:5:13 | [YamlScalar] "country" | semmle.label | [YamlScalar] "country" |
+| tst.yml:5:16:5:27 | [YamlScalar] "Lummerland" | semmle.label | [YamlScalar] "Lummerland" |
+| tst.yml:7:3:7:6 | [YamlScalar] name | semmle.label | [YamlScalar] name |
+| tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | semmle.label | [YamlMapping] name: Frau Mahlzahn |
+| tst.yml:7:9:7:21 | [YamlScalar] Frau Mahlzahn | semmle.label | [YamlScalar] Frau Mahlzahn |
+| tst.yml:8:3:8:9 | [YamlScalar] address | semmle.label | [YamlScalar] address |
+| tst.yml:9:5:9:10 | [YamlScalar] street | semmle.label | [YamlScalar] street |
+| tst.yml:9:5:14:0 | [YamlMapping] street: \| | semmle.label | [YamlMapping] street: \| |
+| tst.yml:9:13:11:0 | [YamlScalar] \| | semmle.label | [YamlScalar] \| |
+| tst.yml:11:5:11:10 | [YamlScalar] number | semmle.label | [YamlScalar] number |
+| tst.yml:11:13:11:15 | [YamlScalar] 133 | semmle.label | [YamlScalar] 133 |
+| tst.yml:12:5:12:11 | [YamlScalar] country | semmle.label | [YamlScalar] country |
+| tst.yml:12:14:13:18 | [YamlScalar] < | semmle.label | [YamlScalar] < |
+| tst.yml:14:3:14:23 | [YamlScalar] !includ ... nal.yml | semmle.label | [YamlScalar] !includ ... nal.yml |
 edges
-| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:1:3:1:8 | [YAMLScalar] "name" | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:1:3:1:8 | [YAMLScalar] "name" | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:1:11:1:21 | [YAMLScalar] "Jim Knopf" | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:1:11:1:21 | [YAMLScalar] "Jim Knopf" | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:7:3:7:6 | [YAMLScalar] name | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:7:3:7:6 | [YAMLScalar] name | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:7:9:7:21 | [YAMLScalar] Frau Mahlzahn | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:7:9:7:21 | [YAMLScalar] Frau Mahlzahn | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:3:5:3:12 | [YAMLScalar] "street" | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:3:5:3:12 | [YAMLScalar] "street" | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:3:14:3:13 | [YAMLScalar]  | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:3:14:3:13 | [YAMLScalar]  | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:5:9:10 | [YAMLScalar] street | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:5:9:10 | [YAMLScalar] street | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:13:11:0 | [YAMLScalar] \| | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:13:11:0 | [YAMLScalar] \| | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:8:1:8 | [YAMLScalar] x | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:8:1:8 | [YAMLScalar] x | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:11:1:12 | [YAMLScalar] 23 | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:11:1:12 | [YAMLScalar] 23 | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:2:3:2:3 | [YAMLScalar] x | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:2:3:2:3 | [YAMLScalar] x | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:2:6:2:7 | [YAMLScalar] 56 | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:2:6:2:7 | [YAMLScalar] 56 | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 1) <<: | merge.yaml:3:3:3:4 | [YAMLScalar] << | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 1) <<: | merge.yaml:3:3:3:4 | [YAMLScalar] << | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 1) <<: | merge.yaml:3:7:3:8 | [YAMLAliasNode] *A | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 1) <<: | merge.yaml:3:7:3:8 | [YAMLAliasNode] *A | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:2:3:2:9 | [YAMLScalar] address | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:2:3:2:9 | [YAMLScalar] address | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:2:12:6:3 | [YAMLMapping] { | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:2:12:6:3 | [YAMLMapping] { | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:8:3:8:9 | [YAMLScalar] address | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:8:3:8:9 | [YAMLScalar] address | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:9:5:14:0 | [YAMLMapping] street: \| | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:9:5:14:0 | [YAMLMapping] street: \| | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:5:4:12 | [YAMLScalar] "number" | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:5:4:12 | [YAMLScalar] "number" | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:15:4:16 | [YAMLScalar] -1 | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:15:4:16 | [YAMLScalar] -1 | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:11:5:11:10 | [YAMLScalar] number | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:11:5:11:10 | [YAMLScalar] number | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:11:13:11:15 | [YAMLScalar] 133 | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:11:13:11:15 | [YAMLScalar] 133 | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 1) y: | merge.yaml:1:15:1:15 | [YAMLScalar] y | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 1) y: | merge.yaml:1:15:1:15 | [YAMLScalar] y | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 1) y: | merge.yaml:1:18:1:19 | [YAMLScalar] 42 | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 1) y: | merge.yaml:1:18:1:19 | [YAMLScalar] 42 | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:5:5:5:13 | [YAMLScalar] "country" | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:5:5:5:13 | [YAMLScalar] "country" | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:5:16:5:27 | [YAMLScalar] "Lummerland" | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:5:16:5:27 | [YAMLScalar] "Lummerland" | semmle.order | 1 |
-| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:12:5:12:11 | [YAMLScalar] country | semmle.label | 0 |
-| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:12:5:12:11 | [YAMLScalar] country | semmle.order | 0 |
-| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:12:14:13:18 | [YAMLScalar] < | semmle.label | 1 |
-| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:12:14:13:18 | [YAMLScalar] < | semmle.order | 1 |
-| merge.yaml:1:1:3:8 | [YAMLSequence] - &A {  ... y: 42 } | merge.yaml:1:3:1:21 | [YAMLMapping] &A { x: 23, y: 42 } | semmle.label | 0 |
-| merge.yaml:1:1:3:8 | [YAMLSequence] - &A {  ... y: 42 } | merge.yaml:1:3:1:21 | [YAMLMapping] &A { x: 23, y: 42 } | semmle.order | 0 |
-| merge.yaml:1:1:3:8 | [YAMLSequence] - &A {  ... y: 42 } | merge.yaml:2:3:3:8 | [YAMLMapping] x: 56 | semmle.label | 1 |
-| merge.yaml:1:1:3:8 | [YAMLSequence] - &A {  ... y: 42 } | merge.yaml:2:3:3:8 | [YAMLMapping] x: 56 | semmle.order | 1 |
-| merge.yaml:1:3:1:21 | [YAMLMapping] &A { x: 23, y: 42 } | file://:0:0:0:0 | (Mapping 0) x: | semmle.label | 0 |
-| merge.yaml:1:3:1:21 | [YAMLMapping] &A { x: 23, y: 42 } | file://:0:0:0:0 | (Mapping 0) x: | semmle.order | 0 |
-| merge.yaml:1:3:1:21 | [YAMLMapping] &A { x: 23, y: 42 } | file://:0:0:0:0 | (Mapping 1) y: | semmle.label | 1 |
-| merge.yaml:1:3:1:21 | [YAMLMapping] &A { x: 23, y: 42 } | file://:0:0:0:0 | (Mapping 1) y: | semmle.order | 1 |
-| merge.yaml:2:3:3:8 | [YAMLMapping] x: 56 | file://:0:0:0:0 | (Mapping 0) x: | semmle.label | 0 |
-| merge.yaml:2:3:3:8 | [YAMLMapping] x: 56 | file://:0:0:0:0 | (Mapping 0) x: | semmle.order | 0 |
-| merge.yaml:2:3:3:8 | [YAMLMapping] x: 56 | file://:0:0:0:0 | (Mapping 1) <<: | semmle.label | 1 |
-| merge.yaml:2:3:3:8 | [YAMLMapping] x: 56 | file://:0:0:0:0 | (Mapping 1) <<: | semmle.order | 1 |
-| tst.yml:1:1:14:23 | [YAMLSequence] - "name ...  Knopf" | tst.yml:1:3:7:0 | [YAMLMapping] "name": "Jim Knopf" | semmle.label | 0 |
-| tst.yml:1:1:14:23 | [YAMLSequence] - "name ...  Knopf" | tst.yml:1:3:7:0 | [YAMLMapping] "name": "Jim Knopf" | semmle.order | 0 |
-| tst.yml:1:1:14:23 | [YAMLSequence] - "name ...  Knopf" | tst.yml:7:3:14:0 | [YAMLMapping] name: Frau Mahlzahn | semmle.label | 1 |
-| tst.yml:1:1:14:23 | [YAMLSequence] - "name ...  Knopf" | tst.yml:7:3:14:0 | [YAMLMapping] name: Frau Mahlzahn | semmle.order | 1 |
-| tst.yml:1:1:14:23 | [YAMLSequence] - "name ...  Knopf" | tst.yml:14:3:14:23 | [YAMLScalar] !includ ... nal.yml | semmle.label | 2 |
-| tst.yml:1:1:14:23 | [YAMLSequence] - "name ...  Knopf" | tst.yml:14:3:14:23 | [YAMLScalar] !includ ... nal.yml | semmle.order | 2 |
-| tst.yml:1:3:7:0 | [YAMLMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 0) name: | semmle.label | 0 |
-| tst.yml:1:3:7:0 | [YAMLMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 0) name: | semmle.order | 0 |
-| tst.yml:1:3:7:0 | [YAMLMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 1) address: | semmle.label | 1 |
-| tst.yml:1:3:7:0 | [YAMLMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 1) address: | semmle.order | 1 |
-| tst.yml:2:12:6:3 | [YAMLMapping] { | file://:0:0:0:0 | (Mapping 0) street: | semmle.label | 0 |
-| tst.yml:2:12:6:3 | [YAMLMapping] { | file://:0:0:0:0 | (Mapping 0) street: | semmle.order | 0 |
-| tst.yml:2:12:6:3 | [YAMLMapping] { | file://:0:0:0:0 | (Mapping 1) number: | semmle.label | 1 |
-| tst.yml:2:12:6:3 | [YAMLMapping] { | file://:0:0:0:0 | (Mapping 1) number: | semmle.order | 1 |
-| tst.yml:2:12:6:3 | [YAMLMapping] { | file://:0:0:0:0 | (Mapping 2) country: | semmle.label | 2 |
-| tst.yml:2:12:6:3 | [YAMLMapping] { | file://:0:0:0:0 | (Mapping 2) country: | semmle.order | 2 |
-| tst.yml:7:3:14:0 | [YAMLMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 0) name: | semmle.label | 0 |
-| tst.yml:7:3:14:0 | [YAMLMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 0) name: | semmle.order | 0 |
-| tst.yml:7:3:14:0 | [YAMLMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 1) address: | semmle.label | 1 |
-| tst.yml:7:3:14:0 | [YAMLMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 1) address: | semmle.order | 1 |
-| tst.yml:9:5:14:0 | [YAMLMapping] street: \| | file://:0:0:0:0 | (Mapping 0) street: | semmle.label | 0 |
-| tst.yml:9:5:14:0 | [YAMLMapping] street: \| | file://:0:0:0:0 | (Mapping 0) street: | semmle.order | 0 |
-| tst.yml:9:5:14:0 | [YAMLMapping] street: \| | file://:0:0:0:0 | (Mapping 1) number: | semmle.label | 1 |
-| tst.yml:9:5:14:0 | [YAMLMapping] street: \| | file://:0:0:0:0 | (Mapping 1) number: | semmle.order | 1 |
-| tst.yml:9:5:14:0 | [YAMLMapping] street: \| | file://:0:0:0:0 | (Mapping 2) country: | semmle.label | 2 |
-| tst.yml:9:5:14:0 | [YAMLMapping] street: \| | file://:0:0:0:0 | (Mapping 2) country: | semmle.order | 2 |
+| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:1:3:1:8 | [YamlScalar] "name" | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:1:3:1:8 | [YamlScalar] "name" | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:1:11:1:21 | [YamlScalar] "Jim Knopf" | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:1:11:1:21 | [YamlScalar] "Jim Knopf" | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:7:3:7:6 | [YamlScalar] name | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:7:3:7:6 | [YamlScalar] name | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:7:9:7:21 | [YamlScalar] Frau Mahlzahn | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 0) name: | tst.yml:7:9:7:21 | [YamlScalar] Frau Mahlzahn | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:3:5:3:12 | [YamlScalar] "street" | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:3:5:3:12 | [YamlScalar] "street" | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:3:14:3:13 | [YamlScalar]  | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:3:14:3:13 | [YamlScalar]  | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:5:9:10 | [YamlScalar] street | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:5:9:10 | [YamlScalar] street | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:13:11:0 | [YamlScalar] \| | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 0) street: | tst.yml:9:13:11:0 | [YamlScalar] \| | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:8:1:8 | [YamlScalar] x | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:8:1:8 | [YamlScalar] x | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:11:1:12 | [YamlScalar] 23 | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:1:11:1:12 | [YamlScalar] 23 | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:2:3:2:3 | [YamlScalar] x | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:2:3:2:3 | [YamlScalar] x | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:2:6:2:7 | [YamlScalar] 56 | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 0) x: | merge.yaml:2:6:2:7 | [YamlScalar] 56 | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 1) <<: | merge.yaml:3:3:3:4 | [YamlScalar] << | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 1) <<: | merge.yaml:3:3:3:4 | [YamlScalar] << | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 1) <<: | merge.yaml:3:7:3:8 | [YamlAliasNode] *A | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 1) <<: | merge.yaml:3:7:3:8 | [YamlAliasNode] *A | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:2:3:2:9 | [YamlScalar] address | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:2:3:2:9 | [YamlScalar] address | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:2:12:6:3 | [YamlMapping] { | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:2:12:6:3 | [YamlMapping] { | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:8:3:8:9 | [YamlScalar] address | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:8:3:8:9 | [YamlScalar] address | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:9:5:14:0 | [YamlMapping] street: \| | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 1) address: | tst.yml:9:5:14:0 | [YamlMapping] street: \| | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:5:4:12 | [YamlScalar] "number" | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:5:4:12 | [YamlScalar] "number" | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:15:4:16 | [YamlScalar] -1 | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:4:15:4:16 | [YamlScalar] -1 | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:11:5:11:10 | [YamlScalar] number | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:11:5:11:10 | [YamlScalar] number | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:11:13:11:15 | [YamlScalar] 133 | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 1) number: | tst.yml:11:13:11:15 | [YamlScalar] 133 | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 1) y: | merge.yaml:1:15:1:15 | [YamlScalar] y | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 1) y: | merge.yaml:1:15:1:15 | [YamlScalar] y | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 1) y: | merge.yaml:1:18:1:19 | [YamlScalar] 42 | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 1) y: | merge.yaml:1:18:1:19 | [YamlScalar] 42 | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:5:5:5:13 | [YamlScalar] "country" | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:5:5:5:13 | [YamlScalar] "country" | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:5:16:5:27 | [YamlScalar] "Lummerland" | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:5:16:5:27 | [YamlScalar] "Lummerland" | semmle.order | 1 |
+| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:12:5:12:11 | [YamlScalar] country | semmle.label | 0 |
+| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:12:5:12:11 | [YamlScalar] country | semmle.order | 0 |
+| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:12:14:13:18 | [YamlScalar] < | semmle.label | 1 |
+| file://:0:0:0:0 | (Mapping 2) country: | tst.yml:12:14:13:18 | [YamlScalar] < | semmle.order | 1 |
+| merge.yaml:1:1:3:8 | [YamlSequence] - &A {  ... y: 42 } | merge.yaml:1:3:1:21 | [YamlMapping] &A { x: 23, y: 42 } | semmle.label | 0 |
+| merge.yaml:1:1:3:8 | [YamlSequence] - &A {  ... y: 42 } | merge.yaml:1:3:1:21 | [YamlMapping] &A { x: 23, y: 42 } | semmle.order | 0 |
+| merge.yaml:1:1:3:8 | [YamlSequence] - &A {  ... y: 42 } | merge.yaml:2:3:3:8 | [YamlMapping] x: 56 | semmle.label | 1 |
+| merge.yaml:1:1:3:8 | [YamlSequence] - &A {  ... y: 42 } | merge.yaml:2:3:3:8 | [YamlMapping] x: 56 | semmle.order | 1 |
+| merge.yaml:1:3:1:21 | [YamlMapping] &A { x: 23, y: 42 } | file://:0:0:0:0 | (Mapping 0) x: | semmle.label | 0 |
+| merge.yaml:1:3:1:21 | [YamlMapping] &A { x: 23, y: 42 } | file://:0:0:0:0 | (Mapping 0) x: | semmle.order | 0 |
+| merge.yaml:1:3:1:21 | [YamlMapping] &A { x: 23, y: 42 } | file://:0:0:0:0 | (Mapping 1) y: | semmle.label | 1 |
+| merge.yaml:1:3:1:21 | [YamlMapping] &A { x: 23, y: 42 } | file://:0:0:0:0 | (Mapping 1) y: | semmle.order | 1 |
+| merge.yaml:2:3:3:8 | [YamlMapping] x: 56 | file://:0:0:0:0 | (Mapping 0) x: | semmle.label | 0 |
+| merge.yaml:2:3:3:8 | [YamlMapping] x: 56 | file://:0:0:0:0 | (Mapping 0) x: | semmle.order | 0 |
+| merge.yaml:2:3:3:8 | [YamlMapping] x: 56 | file://:0:0:0:0 | (Mapping 1) <<: | semmle.label | 1 |
+| merge.yaml:2:3:3:8 | [YamlMapping] x: 56 | file://:0:0:0:0 | (Mapping 1) <<: | semmle.order | 1 |
+| tst.yml:1:1:14:23 | [YamlSequence] - "name ...  Knopf" | tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | semmle.label | 0 |
+| tst.yml:1:1:14:23 | [YamlSequence] - "name ...  Knopf" | tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | semmle.order | 0 |
+| tst.yml:1:1:14:23 | [YamlSequence] - "name ...  Knopf" | tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | semmle.label | 1 |
+| tst.yml:1:1:14:23 | [YamlSequence] - "name ...  Knopf" | tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | semmle.order | 1 |
+| tst.yml:1:1:14:23 | [YamlSequence] - "name ...  Knopf" | tst.yml:14:3:14:23 | [YamlScalar] !includ ... nal.yml | semmle.label | 2 |
+| tst.yml:1:1:14:23 | [YamlSequence] - "name ...  Knopf" | tst.yml:14:3:14:23 | [YamlScalar] !includ ... nal.yml | semmle.order | 2 |
+| tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 0) name: | semmle.label | 0 |
+| tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 0) name: | semmle.order | 0 |
+| tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 1) address: | semmle.label | 1 |
+| tst.yml:1:3:7:0 | [YamlMapping] "name": "Jim Knopf" | file://:0:0:0:0 | (Mapping 1) address: | semmle.order | 1 |
+| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 0) street: | semmle.label | 0 |
+| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 0) street: | semmle.order | 0 |
+| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 1) number: | semmle.label | 1 |
+| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 1) number: | semmle.order | 1 |
+| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 2) country: | semmle.label | 2 |
+| tst.yml:2:12:6:3 | [YamlMapping] { | file://:0:0:0:0 | (Mapping 2) country: | semmle.order | 2 |
+| tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 0) name: | semmle.label | 0 |
+| tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 0) name: | semmle.order | 0 |
+| tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 1) address: | semmle.label | 1 |
+| tst.yml:7:3:14:0 | [YamlMapping] name: Frau Mahlzahn | file://:0:0:0:0 | (Mapping 1) address: | semmle.order | 1 |
+| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 0) street: | semmle.label | 0 |
+| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 0) street: | semmle.order | 0 |
+| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 1) number: | semmle.label | 1 |
+| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 1) number: | semmle.order | 1 |
+| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 2) country: | semmle.label | 2 |
+| tst.yml:9:5:14:0 | [YamlMapping] street: \| | file://:0:0:0:0 | (Mapping 2) country: | semmle.order | 2 |
 graphProperties
 | semmle.graphKind | tree |
diff --git a/javascript/ql/test/library-tests/YAML/tests.ql b/javascript/ql/test/library-tests/YAML/tests.ql
index 664b727402e..469b57fa67c 100644
--- a/javascript/ql/test/library-tests/YAML/tests.ql
+++ b/javascript/ql/test/library-tests/YAML/tests.ql
@@ -1,18 +1,18 @@
 import javascript
 
-query predicate anchors(YAMLNode n, string anchor) { n.getAnchor() = anchor }
+query predicate anchors(YamlNode n, string anchor) { n.getAnchor() = anchor }
 
-query predicate eval(YAMLNode n, YAMLValue eval) {
+query predicate eval(YamlNode n, YamlValue eval) {
   not n.eval() = n and
   eval = n.eval()
 }
 
-query predicate yamlParseError(YAMLParseError err) { any() }
+query predicate yamlParseError(YamlParseError err) { any() }
 
-query predicate yamlMapping_maps(YAMLMapping m, YAMLValue k, YAMLValue v) { m.maps(k, v) }
+query predicate yamlMapping_maps(YamlMapping m, YamlValue k, YamlValue v) { m.maps(k, v) }
 
-query predicate yamlNode(YAMLNode n, string tag) { tag = n.getTag() }
+query predicate yamlNode(YamlNode n, string tag) { tag = n.getTag() }
 
-query predicate yamlScalar(YAMLScalar s, string style, string value) {
+query predicate yamlScalar(YamlScalar s, string style, string value) {
   style = s.getStyle() and value = s.getValue()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/AngularJS/dependency-dataflow/ScopeMethodCalls.ql b/javascript/ql/test/library-tests/frameworks/AngularJS/dependency-dataflow/ScopeMethodCalls.ql
index 612439f0be0..53a27ecdf82 100644
--- a/javascript/ql/test/library-tests/frameworks/AngularJS/dependency-dataflow/ScopeMethodCalls.ql
+++ b/javascript/ql/test/library-tests/frameworks/AngularJS/dependency-dataflow/ScopeMethodCalls.ql
@@ -1,5 +1,5 @@
 import javascript
 
-from AngularJS::ScopeServiceReference s, MethodCallExpr mce
+from AngularJS::ScopeServiceReference s, DataFlow::MethodCallNode mce
 where mce = s.getAMethodCall(_)
 select mce
diff --git a/javascript/ql/test/library-tests/frameworks/AngularJS/dependency-resolution/DependencyResolution_full.ql b/javascript/ql/test/library-tests/frameworks/AngularJS/dependency-resolution/DependencyResolution_full.ql
index eb12430a456..be1f2c1acef 100644
--- a/javascript/ql/test/library-tests/frameworks/AngularJS/dependency-resolution/DependencyResolution_full.ql
+++ b/javascript/ql/test/library-tests/frameworks/AngularJS/dependency-resolution/DependencyResolution_full.ql
@@ -1,6 +1,6 @@
 import javascript
 private import AngularJS
 
-from InjectableFunction f, SimpleParameter p, DataFlow::Node nd
+from InjectableFunction f, DataFlow::ParameterNode p, DataFlow::Node nd
 where nd = f.getCustomServiceDependency(p)
 select p.getName(), nd
diff --git a/javascript/ql/test/library-tests/frameworks/AngularJS/scopes/ScopeAccess.expected b/javascript/ql/test/library-tests/frameworks/AngularJS/scopes/ScopeAccess.expected
index d7a6e49b6cd..1560c2076bc 100644
--- a/javascript/ql/test/library-tests/frameworks/AngularJS/scopes/ScopeAccess.expected
+++ b/javascript/ql/test/library-tests/frameworks/AngularJS/scopes/ScopeAccess.expected
@@ -1,92 +1,137 @@
 | isolate scope for directive1 | scope-access.js:4:41:4:45 | scope |
+| isolate scope for directive1 | scope-access.js:4:41:4:45 | scope |
 | isolate scope for directive1 | scope-access.js:5:17:5:21 | scope |
 | isolate scope for directive1 | scope-access.js:7:20:7:21 | {} |
 | isolate scope for directive2 | scope-access.js:12:34:12:39 | $scope |
+| isolate scope for directive2 | scope-access.js:12:34:12:39 | $scope |
 | isolate scope for directive2 | scope-access.js:13:17:13:22 | $scope |
 | isolate scope for directive2 | scope-access.js:15:20:15:21 | {} |
 | isolate scope for directive3 | scope-access.js:20:39:20:44 | $scope |
+| isolate scope for directive3 | scope-access.js:20:39:20:44 | $scope |
 | isolate scope for directive3 | scope-access.js:21:17:21:22 | $scope |
 | isolate scope for directive3 | scope-access.js:23:20:23:21 | {} |
 | isolate scope for directive4 | scope-access.js:28:45:28:45 | a |
+| isolate scope for directive4 | scope-access.js:28:45:28:45 | a |
 | isolate scope for directive4 | scope-access.js:29:17:29:17 | a |
 | isolate scope for directive4 | scope-access.js:31:20:31:21 | {} |
+| isolate scope for directive5 | scope-access.js:36:25:36:24 | this |
 | isolate scope for directive5 | scope-access.js:37:17:37:20 | this |
 | isolate scope for directive5 | scope-access.js:39:20:39:21 | {} |
+| isolate scope for directive6 | scope-access.js:45:25:45:24 | this |
+| isolate scope for directive6 | scope-access.js:46:18:46:26 | return of anonymous function |
 | isolate scope for directive6 | scope-access.js:46:23:46:26 | this |
 | isolate scope for directive6 | scope-access.js:48:20:48:21 | {} |
 | isolate scope for myCustomer | dev-guide-5.js:11:12:13:5 | { // Sc ... y\\n    } |
 | isolate scope for myCustomer | dev-guide-6.js:11:12:13:5 | { // Sc ... y\\n    } |
 | scope for <directive7>...</> | scope-access.js:54:34:54:39 | $scope |
+| scope for <directive7>...</> | scope-access.js:54:34:54:39 | $scope |
 | scope for <directive7>...</> | scope-access.js:55:17:55:22 | $scope |
 | scope for <div>...</> | dev-guide-1.js:4:49:4:54 | $scope |
+| scope for <div>...</> | dev-guide-1.js:4:49:4:54 | $scope |
+| scope for <div>...</> | dev-guide-1.js:4:49:4:54 | $scope |
 | scope for <div>...</> | dev-guide-1.js:5:3:5:8 | $scope |
 | scope for <div>...</> | dev-guide-1.js:7:3:7:8 | $scope |
+| scope for <div>...</> | dev-guide-1.js:7:21:7:20 | $scope |
 | scope for <div>...</> | dev-guide-1.js:8:5:8:10 | $scope |
 | scope for <div>...</> | dev-guide-1.js:8:34:8:39 | $scope |
 | scope for <div>...</> | dev-guide-2.js:4:66:4:71 | $scope |
+| scope for <div>...</> | dev-guide-2.js:4:66:4:71 | $scope |
 | scope for <div>...</> | dev-guide-2.js:5:3:5:8 | $scope |
 | scope for <div>...</> | dev-guide-2.js:8:51:8:56 | $scope |
+| scope for <div>...</> | dev-guide-2.js:8:51:8:56 | $scope |
 | scope for <div>...</> | dev-guide-2.js:9:3:9:8 | $scope |
 | scope for <div>...</> | dev-guide-3.js:4:52:4:57 | $scope |
+| scope for <div>...</> | dev-guide-3.js:4:52:4:57 | $scope |
+| scope for <div>...</> | dev-guide-3.js:4:52:4:57 | $scope |
 | scope for <div>...</> | dev-guide-3.js:5:3:5:8 | $scope |
 | scope for <div>...</> | dev-guide-3.js:6:3:6:8 | $scope |
+| scope for <div>...</> | dev-guide-3.js:6:25:6:24 | $scope |
 | scope for <div>...</> | dev-guide-3.js:7:5:7:10 | $scope |
 | scope for <div>...</> | dev-guide-4.js:4:52:4:57 | $scope |
+| scope for <div>...</> | dev-guide-4.js:4:52:4:57 | $scope |
 | scope for <div>...</> | dev-guide-4.js:5:3:5:8 | $scope |
 | scope for <div>...</> | dev-guide-4.js:10:51:10:56 | $scope |
+| scope for <div>...</> | dev-guide-4.js:10:51:10:56 | $scope |
 | scope for <div>...</> | dev-guide-4.js:11:3:11:8 | $scope |
 | scope for <div>...</> | dev-guide-5.js:4:47:4:52 | $scope |
 | scope for <div>...</> | dev-guide-5.js:4:47:4:52 | $scope |
+| scope for <div>...</> | dev-guide-5.js:4:47:4:52 | $scope |
+| scope for <div>...</> | dev-guide-5.js:4:47:4:52 | $scope |
 | scope for <div>...</> | dev-guide-5.js:5:3:5:8 | $scope |
 | scope for <div>...</> | dev-guide-5.js:5:3:5:8 | $scope |
 | scope for <div>...</> | dev-guide-5.js:6:3:6:8 | $scope |
 | scope for <div>...</> | dev-guide-5.js:6:3:6:8 | $scope |
 | scope for <div>...</> | dev-guide-6.js:4:47:4:52 | $scope |
 | scope for <div>...</> | dev-guide-6.js:4:47:4:52 | $scope |
+| scope for <div>...</> | dev-guide-6.js:4:47:4:52 | $scope |
+| scope for <div>...</> | dev-guide-6.js:4:47:4:52 | $scope |
 | scope for <div>...</> | dev-guide-6.js:5:3:5:8 | $scope |
 | scope for <div>...</> | dev-guide-6.js:5:3:5:8 | $scope |
 | scope for <div>...</> | dev-guide-6.js:6:3:6:8 | $scope |
 | scope for <div>...</> | dev-guide-6.js:6:3:6:8 | $scope |
 | scope for <elementthatusescontroller1>...</> | scope-access.js:59:52:59:57 | $scope |
+| scope for <elementthatusescontroller1>...</> | scope-access.js:59:52:59:57 | $scope |
 | scope for <elementthatusescontroller1>...</> | scope-access.js:60:9:60:14 | $scope |
 | scope for <li>...</> | dev-guide-3.js:4:52:4:57 | $scope |
 | scope for <li>...</> | dev-guide-3.js:4:52:4:57 | $scope |
+| scope for <li>...</> | dev-guide-3.js:4:52:4:57 | $scope |
+| scope for <li>...</> | dev-guide-3.js:4:52:4:57 | $scope |
+| scope for <li>...</> | dev-guide-3.js:4:52:4:57 | $scope |
+| scope for <li>...</> | dev-guide-3.js:4:52:4:57 | $scope |
 | scope for <li>...</> | dev-guide-3.js:5:3:5:8 | $scope |
 | scope for <li>...</> | dev-guide-3.js:5:3:5:8 | $scope |
 | scope for <li>...</> | dev-guide-3.js:6:3:6:8 | $scope |
 | scope for <li>...</> | dev-guide-3.js:6:3:6:8 | $scope |
+| scope for <li>...</> | dev-guide-3.js:6:25:6:24 | $scope |
+| scope for <li>...</> | dev-guide-3.js:6:25:6:24 | $scope |
 | scope for <li>...</> | dev-guide-3.js:7:5:7:10 | $scope |
 | scope for <li>...</> | dev-guide-3.js:7:5:7:10 | $scope |
 | scope in dev-guide-1.html | dev-guide-1.js:4:49:4:54 | $scope |
+| scope in dev-guide-1.html | dev-guide-1.js:4:49:4:54 | $scope |
+| scope in dev-guide-1.html | dev-guide-1.js:4:49:4:54 | $scope |
 | scope in dev-guide-1.html | dev-guide-1.js:5:3:5:8 | $scope |
 | scope in dev-guide-1.html | dev-guide-1.js:7:3:7:8 | $scope |
+| scope in dev-guide-1.html | dev-guide-1.js:7:21:7:20 | $scope |
 | scope in dev-guide-1.html | dev-guide-1.js:8:5:8:10 | $scope |
 | scope in dev-guide-1.html | dev-guide-1.js:8:34:8:39 | $scope |
 | scope in dev-guide-2.html | dev-guide-2.js:4:66:4:71 | $scope |
+| scope in dev-guide-2.html | dev-guide-2.js:4:66:4:71 | $scope |
 | scope in dev-guide-2.html | dev-guide-2.js:5:3:5:8 | $scope |
 | scope in dev-guide-2.html | dev-guide-2.js:8:51:8:56 | $scope |
+| scope in dev-guide-2.html | dev-guide-2.js:8:51:8:56 | $scope |
 | scope in dev-guide-2.html | dev-guide-2.js:9:3:9:8 | $scope |
 | scope in dev-guide-3.html | dev-guide-3.js:4:52:4:57 | $scope |
+| scope in dev-guide-3.html | dev-guide-3.js:4:52:4:57 | $scope |
+| scope in dev-guide-3.html | dev-guide-3.js:4:52:4:57 | $scope |
 | scope in dev-guide-3.html | dev-guide-3.js:5:3:5:8 | $scope |
 | scope in dev-guide-3.html | dev-guide-3.js:6:3:6:8 | $scope |
+| scope in dev-guide-3.html | dev-guide-3.js:6:25:6:24 | $scope |
 | scope in dev-guide-3.html | dev-guide-3.js:7:5:7:10 | $scope |
 | scope in dev-guide-4.html | dev-guide-4.js:4:52:4:57 | $scope |
+| scope in dev-guide-4.html | dev-guide-4.js:4:52:4:57 | $scope |
 | scope in dev-guide-4.html | dev-guide-4.js:5:3:5:8 | $scope |
 | scope in dev-guide-4.html | dev-guide-4.js:10:51:10:56 | $scope |
+| scope in dev-guide-4.html | dev-guide-4.js:10:51:10:56 | $scope |
 | scope in dev-guide-4.html | dev-guide-4.js:11:3:11:8 | $scope |
 | scope in dev-guide-5.html | dev-guide-5.js:4:47:4:52 | $scope |
+| scope in dev-guide-5.html | dev-guide-5.js:4:47:4:52 | $scope |
 | scope in dev-guide-5.html | dev-guide-5.js:5:3:5:8 | $scope |
 | scope in dev-guide-5.html | dev-guide-5.js:6:3:6:8 | $scope |
 | scope in dev-guide-5.html | dev-guide-6.js:4:47:4:52 | $scope |
+| scope in dev-guide-5.html | dev-guide-6.js:4:47:4:52 | $scope |
 | scope in dev-guide-5.html | dev-guide-6.js:5:3:5:8 | $scope |
 | scope in dev-guide-5.html | dev-guide-6.js:6:3:6:8 | $scope |
 | scope in dev-guide-6.html | dev-guide-5.js:4:47:4:52 | $scope |
+| scope in dev-guide-6.html | dev-guide-5.js:4:47:4:52 | $scope |
 | scope in dev-guide-6.html | dev-guide-5.js:5:3:5:8 | $scope |
 | scope in dev-guide-6.html | dev-guide-5.js:6:3:6:8 | $scope |
 | scope in dev-guide-6.html | dev-guide-6.js:4:47:4:52 | $scope |
+| scope in dev-guide-6.html | dev-guide-6.js:4:47:4:52 | $scope |
 | scope in dev-guide-6.html | dev-guide-6.js:5:3:5:8 | $scope |
 | scope in dev-guide-6.html | dev-guide-6.js:6:3:6:8 | $scope |
 | scope in scope-access.html | scope-access.js:54:34:54:39 | $scope |
+| scope in scope-access.html | scope-access.js:54:34:54:39 | $scope |
 | scope in scope-access.html | scope-access.js:55:17:55:22 | $scope |
 | scope in scope-access.html | scope-access.js:59:52:59:57 | $scope |
+| scope in scope-access.html | scope-access.js:59:52:59:57 | $scope |
 | scope in scope-access.html | scope-access.js:60:9:60:14 | $scope |
diff --git a/javascript/ql/test/library-tests/frameworks/Express/CookieMiddlewareInstance.qll b/javascript/ql/test/library-tests/frameworks/Express/CookieMiddlewareInstance.qll
index 2f69ec905ae..025aaf04d00 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/CookieMiddlewareInstance.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/CookieMiddlewareInstance.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_CookieMiddlewareInstance(
-  HTTP::CookieMiddlewareInstance instance, DataFlow::Node res
+  Http::CookieMiddlewareInstance instance, DataFlow::Node res
 ) {
   res = instance.getASecretKey()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/HeaderAccess.qll b/javascript/ql/test/library-tests/frameworks/Express/HeaderAccess.qll
index 22d1d6aee53..69d34318ae1 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/HeaderAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/HeaderAccess.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderAccess(HTTP::RequestHeaderAccess access, string res) {
+query predicate test_HeaderAccess(Http::RequestHeaderAccess access, string res) {
   res = access.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition.qll b/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition.qll
index 45ec0af926a..115aefb0e80 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition(HTTP::HeaderDefinition hd, Express::RouteHandler rh) {
+query predicate test_HeaderDefinition(Http::HeaderDefinition hd, Express::RouteHandler rh) {
   rh = hd.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_defines.qll b/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_defines.qll
index 2a82f238c29..eb8e7800cdd 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_defines.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_defines.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_defines(HTTP::HeaderDefinition hd, string name, string value) {
+query predicate test_HeaderDefinition_defines(Http::HeaderDefinition hd, string name, string value) {
   hd.defines(name, value) and hd.getRouteHandler() instanceof Express::RouteHandler
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_getAHeaderName.qll b/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_getAHeaderName.qll
index f618f71ca34..dc534c8cfce 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_getAHeaderName.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_getAHeaderName.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_getAHeaderName(HTTP::HeaderDefinition hd, string res) {
+query predicate test_HeaderDefinition_getAHeaderName(Http::HeaderDefinition hd, string res) {
   hd.getRouteHandler() instanceof Express::RouteHandler and res = hd.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_getNameExpr.qll b/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_getNameExpr.qll
index a1db639b021..717d96cbba3 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_getNameExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/HeaderDefinition_getNameExpr.qll
@@ -1,5 +1,7 @@
 import javascript
 
-query predicate test_HeaderDefinition_getNameExpr(HTTP::ExplicitHeaderDefinition hd, Expr res) {
-  hd.getRouteHandler() instanceof Express::RouteHandler and res = hd.getNameExpr()
+query predicate test_HeaderDefinition_getNameExpr(
+  Http::ExplicitHeaderDefinition hd, DataFlow::Node res
+) {
+  hd.getRouteHandler() instanceof Express::RouteHandler and res = hd.getNameNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RedirectInvocation.qll b/javascript/ql/test/library-tests/frameworks/Express/RedirectInvocation.qll
index 909c3779416..3f1b8710454 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RedirectInvocation.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RedirectInvocation.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RedirectInvocation(HTTP::RedirectInvocation red, Express::RouteHandler rh) {
+query predicate test_RedirectInvocation(Http::RedirectInvocation red, Express::RouteHandler rh) {
   rh = red.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.qll b/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.qll
index b2e780fa3a5..07ff4f22e0a 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RequestExpr.qll
@@ -1,9 +1,9 @@
 import javascript
 
-query predicate test_RequestExpr(Express::RequestExpr e, HTTP::RouteHandler res) {
+query predicate test_RequestExpr(Express::RequestNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
 
-query predicate test_RequestExprStandalone(Express::RequestExpr e) {
+query predicate test_RequestExprStandalone(Express::RequestNode e) {
   not exists(e.getRouteHandler())
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.qll b/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.qll
index c27020e2aa1..8a7f2f046e2 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RequestInputAccess.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RequestInputAccess(
-  HTTP::RequestInputAccess ria, string res0, Express::RouteHandler rh
+  Http::RequestInputAccess ria, string res0, Express::RouteHandler rh
 ) {
   ria.getRouteHandler() = rh and res0 = ria.getKind()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/ResponseBody.qll b/javascript/ql/test/library-tests/frameworks/Express/ResponseBody.qll
index db571874490..8091681dfd7 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/ResponseBody.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/ResponseBody.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_ResponseBody(HTTP::ResponseBody rb, Express::RouteHandler rh) {
+query predicate test_ResponseBody(Http::ResponseBody rb, Express::RouteHandler rh) {
   rb.getRouteHandler() = rh
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/ResponseExpr.qll b/javascript/ql/test/library-tests/frameworks/Express/ResponseExpr.qll
index 25356cfd48c..5e911c96993 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/ResponseExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/ResponseExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_ResponseExpr(Express::ResponseExpr e, HTTP::RouteHandler res) {
+query predicate test_ResponseExpr(Express::ResponseNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/ResponseSendArgument.qll b/javascript/ql/test/library-tests/frameworks/Express/ResponseSendArgument.qll
index fec7829f284..5fe3699e89c 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/ResponseSendArgument.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/ResponseSendArgument.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_ResponseSendArgument(HTTP::ResponseSendArgument send, Express::RouteHandler rh) {
+query predicate test_ResponseSendArgument(Http::ResponseSendArgument send, Express::RouteHandler rh) {
   rh = send.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteExpr.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteExpr.qll
deleted file mode 100644
index bc8010494fd..00000000000
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteExpr.qll
+++ /dev/null
@@ -1,5 +0,0 @@
-import javascript
-
-query predicate test_RouteExpr(Express::RouteExpr e, Express::RouterDefinition res) {
-  res = e.getRouter()
-}
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.qll
index 4873bcf2d99..5a737738b62 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler.qll
@@ -1,5 +1,7 @@
 import javascript
 
-query predicate test_RouteHandler(Express::RouteHandler rh, Parameter res0, Parameter res1) {
+query predicate test_RouteHandler(
+  Express::RouteHandler rh, DataFlow::ParameterNode res0, DataFlow::ParameterNode res1
+) {
   res0 = rh.getRequestParameter() and res1 = rh.getResponseParameter()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerContainer.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerContainer.qll
index af341dc3028..994e8a318e2 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerContainer.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerContainer.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate getRouteHandlerContainerStep(
-  HTTP::RouteHandlerCandidateContainer container, DataFlow::SourceNode handler,
+  Http::RouteHandlerCandidateContainer container, DataFlow::SourceNode handler,
   DataFlow::SourceNode access
 ) {
   handler = container.getRouteHandler(access)
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.qll
index a6c008294dd..4d3190d34fe 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouteHandlerExpr(
-  Express::RouteHandlerExpr rhe, Express::RouteSetup res0, boolean isLast
+  Express::RouteHandlerNode rhe, Express::RouteSetup res0, boolean isLast
 ) {
   (if rhe.isLastHandler() then isLast = true else isLast = false) and
   res0 = rhe.getSetup()
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.qll
index b42d063bbfa..4cf5088b28d 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAMatchingAncestor.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouteHandlerExpr_getAMatchingAncestor(
-  Express::RouteHandlerExpr expr, Express::RouteHandlerExpr res
+  Express::RouteHandlerNode expr, Express::RouteHandlerNode res
 ) {
   res = expr.getAMatchingAncestor()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAsSubRouter.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAsSubRouter.qll
index 3bb2799d7fb..10fa029b178 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAsSubRouter.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getAsSubRouter.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouteHandlerExpr_getAsSubRouter(
-  Express::RouteHandlerExpr expr, Express::RouterDefinition res
+  Express::RouteHandlerNode expr, Express::RouterDefinition res
 ) {
   res = expr.getAsSubRouter()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.qll
index 962ef8aab5b..7a58c892ef5 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getBody.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouteHandlerExpr_getBody(
-  Express::RouteHandlerExpr rhe, Express::RouteHandler res
+  Express::RouteHandlerNode rhe, Express::RouteHandler res
 ) {
   res = rhe.getBody()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.qll
index 93d7457b2f1..ac513215c40 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getNextMiddleware.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouteHandlerExpr_getNextMiddleware(
-  Express::RouteHandlerExpr expr, Express::RouteHandlerExpr res
+  Express::RouteHandlerNode expr, Express::RouteHandlerNode res
 ) {
   res = expr.getNextMiddleware()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.qll
index a202198b205..ebe1982a7bf 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandlerExpr_getPreviousMiddleware.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouteHandlerExpr_getPreviousMiddleware(
-  Express::RouteHandlerExpr expr, Express::RouteHandlerExpr res
+  Express::RouteHandlerNode expr, Express::RouteHandlerNode res
 ) {
   res = expr.getPreviousMiddleware()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestBodyAccess.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestBodyAccess.qll
index 805200c7f8d..80800ecd755 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestBodyAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestBodyAccess.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RouteHandler_getARequestBodyAccess(Express::RouteHandler rh, Expr res) {
+query predicate test_RouteHandler_getARequestBodyAccess(Express::RouteHandler rh, DataFlow::Node res) {
   res = rh.getARequestBodyAccess()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.qll
index 77cbf26c64c..04b657d87c3 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getARequestExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RouteHandler_getARequestExpr(Express::RouteHandler rh, HTTP::RequestExpr res) {
-  res = rh.getARequestExpr()
+query predicate test_RouteHandler_getARequestExpr(Express::RouteHandler rh, Http::RequestNode res) {
+  res = rh.getARequestNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getAResponseExpr.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getAResponseExpr.qll
index 499f53fc7df..70fead62bd5 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getAResponseExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getAResponseExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RouteHandler_getAResponseExpr(Express::RouteHandler rh, HTTP::ResponseExpr res) {
-  res = rh.getAResponseExpr()
+query predicate test_RouteHandler_getAResponseExpr(Express::RouteHandler rh, Http::ResponseNode res) {
+  res = rh.getAResponseNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getAResponseHeader.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getAResponseHeader.qll
index 24f59d9b604..490205a9881 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getAResponseHeader.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteHandler_getAResponseHeader.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouteHandler_getAResponseHeader(
-  Express::RouteHandler rh, string name, HTTP::HeaderDefinition res
+  Express::RouteHandler rh, string name, Http::HeaderDefinition res
 ) {
   res = rh.getAResponseHeader(name)
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.qll
index d291a319a79..26aff886cfa 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup.qll
@@ -1,6 +1,6 @@
 import javascript
 
-query predicate test_RouteSetup(Express::RouteSetup rs, Expr res0, boolean isUseCall) {
+query predicate test_RouteSetup(Express::RouteSetup rs, DataFlow::Node res0, boolean isUseCall) {
   (if rs.isUseCall() then isUseCall = true else isUseCall = false) and
   res0 = rs.getServer()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.qll
index 605747a2581..97673b15773 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getARouteHandlerExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RouteSetup_getARouteHandlerExpr(Express::RouteSetup r, Expr res) {
-  res = r.getARouteHandlerExpr()
+query predicate test_RouteSetup_getARouteHandlerExpr(Express::RouteSetup r, DataFlow::Node res) {
+  res = r.getARouteHandlerNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.qll
index fd21c22a11e..0c3336c4a75 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getLastRouteHandlerExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RouteSetup_getLastRouteHandlerExpr(Express::RouteSetup r, Expr res) {
-  res = r.getLastRouteHandlerExpr()
+query predicate test_RouteSetup_getLastRouteHandlerExpr(Express::RouteSetup r, DataFlow::Node res) {
+  res = r.getLastRouteHandlerNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.qll
index 48b0477a710..22d02c637ea 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRequestMethod.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RouteSetup_getRequestMethod(Express::RouteSetup rs, HTTP::RequestMethodName res) {
+query predicate test_RouteSetup_getRequestMethod(Express::RouteSetup rs, Http::RequestMethodName res) {
   res = rs.getRequestMethod()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.qll
index db5dccb8d00..680ef07b2ee 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getRouteHandlerExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RouteSetup_getRouteHandlerExpr(Express::RouteSetup r, int i, Expr res) {
-  res = r.getRouteHandlerExpr(i)
+query predicate test_RouteSetup_getRouteHandlerExpr(Express::RouteSetup r, int i, DataFlow::Node res) {
+  res = r.getRouteHandlerNode(i)
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.qll
index fdb65023000..1b6e30803ac 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_getServer.qll
@@ -1,3 +1,5 @@
 import javascript
 
-query predicate test_RouteSetup_getServer(Express::RouteSetup rs, Expr res) { res = rs.getServer() }
+query predicate test_RouteSetup_getServer(Express::RouteSetup rs, DataFlow::Node res) {
+  res = rs.getServer()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_handlesSameRequestMethodAs.qll b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_handlesSameRequestMethodAs.qll
index a39f945f3ca..13f37d70384 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_handlesSameRequestMethodAs.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouteSetup_handlesSameRequestMethodAs.qll
@@ -4,7 +4,7 @@ query predicate test_RouteSetup_handlesSameRequestMethodAs(
   Express::RouteSetup rs, Express::RouteSetup rs2
 ) {
   rs.handlesSameRequestMethodAs(rs2) and
-  rs.getLocation().getStartLine() < rs2.getLocation().getStartLine() and
-  rs.getLocation().getFile().getBaseName() = "csurf-example.js" and
-  rs2.getLocation().getFile().getBaseName() = "csurf-example.js"
+  rs.asExpr().getLocation().getStartLine() < rs2.asExpr().getLocation().getStartLine() and
+  rs.asExpr().getLocation().getFile().getBaseName() = "csurf-example.js" and
+  rs2.asExpr().getLocation().getFile().getBaseName() = "csurf-example.js"
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.qll b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.qll
index d9a5314002b..0117cbc3e1e 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getARouteHandler.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouterDefinition_getARouteHandler(
-  Express::RouterDefinition r, HTTP::RouteHandler res
+  Express::RouterDefinition r, Http::RouteHandler res
 ) {
   res = r.getARouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStack.qll b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStack.qll
index ba7f8a43576..93a0d53b3ac 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStack.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStack.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouterDefinition_getMiddlewareStack(
-  Express::RouterDefinition r, Express::RouteHandlerExpr res
+  Express::RouterDefinition r, Express::RouteHandlerNode res
 ) {
   res = r.getMiddlewareStack()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.qll b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.qll
index 36b9447abf0..7de8ccc7114 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/RouterDefinition_getMiddlewareStackAt.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouterDefinition_getMiddlewareStackAt(
-  Express::RouterDefinition r, ControlFlowNode nd, Express::RouteHandlerExpr res
+  Express::RouterDefinition r, ControlFlowNode nd, Express::RouteHandlerNode res
 ) {
   res = r.getMiddlewareStackAt(nd)
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/SetCookie.qll b/javascript/ql/test/library-tests/frameworks/Express/SetCookie.qll
index adaa6cd3959..5e6c10d9ce4 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/SetCookie.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/SetCookie.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_SetCookie(HTTP::CookieDefinition cookiedef, Express::RouteHandler rh) {
+query predicate test_SetCookie(Http::CookieDefinition cookiedef, Express::RouteHandler rh) {
   rh = cookiedef.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.qll b/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.qll
index 7d5a60cfab2..2ffc514a6d0 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/StandardRouteHandler.qll
@@ -1,7 +1,8 @@
 import javascript
 
 query predicate test_StandardRouteHandler(
-  Express::StandardRouteHandler rh, Expr res0, SimpleParameter res1, SimpleParameter res2
+  Express::StandardRouteHandler rh, DataFlow::Node res0, DataFlow::ParameterNode res1,
+  DataFlow::ParameterNode res2
 ) {
   res0 = rh.getServer() and res1 = rh.getRequestParameter() and res2 = rh.getResponseParameter()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/isRequest.qll b/javascript/ql/test/library-tests/frameworks/Express/isRequest.qll
index 90c641e5be1..9aa8ef4c9fa 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/isRequest.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/isRequest.qll
@@ -1,3 +1,3 @@
 import javascript
 
-query predicate test_isRequest(Expr nd) { Express::isRequest(nd) }
+query predicate test_isRequest(DataFlow::Node nd) { Express::isRequest(nd) }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/isResponse.qll b/javascript/ql/test/library-tests/frameworks/Express/isResponse.qll
index edc219adb67..0ebf42be544 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/isResponse.qll
+++ b/javascript/ql/test/library-tests/frameworks/Express/isResponse.qll
@@ -1,3 +1,3 @@
 import javascript
 
-query predicate test_isResponse(Expr nd) { Express::isResponse(nd) }
+query predicate test_isResponse(DataFlow::Node nd) { Express::isResponse(nd) }
diff --git a/javascript/ql/test/library-tests/frameworks/Express/tests.expected b/javascript/ql/test/library-tests/frameworks/Express/tests.expected
index 898a778ce1b..cce9e29c946 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/Express/tests.expected
@@ -769,50 +769,72 @@ test_RouterDefinition_getMiddlewareStackAt
 | src/subrouter.js:2:11:2:19 | express() | src/subrouter.js:13:1:13:0 | exit node of <toplevel> | src/subrouter.js:5:14:5:28 | makeSubRouter() |
 test_isRequest
 | src/advanced-routehandler-registration.js:6:7:6:9 | req |
+| src/advanced-routehandler-registration.js:6:7:6:9 | req |
 | src/advanced-routehandler-registration.js:6:32:6:34 | req |
 | src/advanced-routehandler-registration.js:7:7:7:9 | req |
+| src/advanced-routehandler-registration.js:7:7:7:9 | req |
 | src/advanced-routehandler-registration.js:7:32:7:34 | req |
 | src/advanced-routehandler-registration.js:15:7:15:9 | req |
+| src/advanced-routehandler-registration.js:15:7:15:9 | req |
 | src/advanced-routehandler-registration.js:15:32:15:34 | req |
 | src/advanced-routehandler-registration.js:16:7:16:9 | req |
+| src/advanced-routehandler-registration.js:16:7:16:9 | req |
 | src/advanced-routehandler-registration.js:16:32:16:34 | req |
 | src/advanced-routehandler-registration.js:24:7:24:9 | req |
+| src/advanced-routehandler-registration.js:24:7:24:9 | req |
 | src/advanced-routehandler-registration.js:24:32:24:34 | req |
 | src/advanced-routehandler-registration.js:25:7:25:9 | req |
+| src/advanced-routehandler-registration.js:25:7:25:9 | req |
 | src/advanced-routehandler-registration.js:25:32:25:34 | req |
 | src/advanced-routehandler-registration.js:46:20:46:22 | req |
+| src/advanced-routehandler-registration.js:46:20:46:22 | req |
 | src/advanced-routehandler-registration.js:47:27:47:29 | req |
 | src/advanced-routehandler-registration.js:51:10:51:12 | req |
+| src/advanced-routehandler-registration.js:51:10:51:12 | req |
 | src/advanced-routehandler-registration.js:51:40:51:42 | req |
 | src/advanced-routehandler-registration.js:59:20:59:22 | req |
+| src/advanced-routehandler-registration.js:59:20:59:22 | req |
 | src/advanced-routehandler-registration.js:60:18:60:20 | req |
 | src/advanced-routehandler-registration.js:64:10:64:12 | req |
+| src/advanced-routehandler-registration.js:64:10:64:12 | req |
 | src/advanced-routehandler-registration.js:64:45:64:47 | req |
 | src/advanced-routehandler-registration.js:68:13:68:15 | req |
+| src/advanced-routehandler-registration.js:68:13:68:15 | req |
 | src/advanced-routehandler-registration.js:68:38:68:40 | req |
 | src/advanced-routehandler-registration.js:69:20:69:22 | req |
+| src/advanced-routehandler-registration.js:69:20:69:22 | req |
 | src/advanced-routehandler-registration.js:70:18:70:20 | req |
 | src/advanced-routehandler-registration.js:73:10:73:12 | req |
+| src/advanced-routehandler-registration.js:73:10:73:12 | req |
 | src/advanced-routehandler-registration.js:73:47:73:49 | req |
 | src/advanced-routehandler-registration.js:81:20:81:22 | req |
+| src/advanced-routehandler-registration.js:81:20:81:22 | req |
 | src/advanced-routehandler-registration.js:82:27:82:29 | req |
 | src/advanced-routehandler-registration.js:92:10:92:12 | req |
+| src/advanced-routehandler-registration.js:92:10:92:12 | req |
 | src/advanced-routehandler-registration.js:92:40:92:42 | req |
 | src/advanced-routehandler-registration.js:100:20:100:22 | req |
+| src/advanced-routehandler-registration.js:100:20:100:22 | req |
 | src/advanced-routehandler-registration.js:101:31:101:33 | req |
 | src/advanced-routehandler-registration.js:111:10:111:12 | req |
+| src/advanced-routehandler-registration.js:111:10:111:12 | req |
 | src/advanced-routehandler-registration.js:111:40:111:42 | req |
 | src/advanced-routehandler-registration.js:123:21:123:23 | req |
+| src/advanced-routehandler-registration.js:123:21:123:23 | req |
 | src/advanced-routehandler-registration.js:123:46:123:48 | req |
 | src/advanced-routehandler-registration.js:124:21:124:23 | req |
+| src/advanced-routehandler-registration.js:124:21:124:23 | req |
 | src/advanced-routehandler-registration.js:124:46:124:48 | req |
 | src/advanced-routehandler-registration.js:146:29:146:31 | req |
 | src/advanced-routehandler-registration.js:156:22:156:24 | req |
+| src/advanced-routehandler-registration.js:156:22:156:24 | req |
 | src/advanced-routehandler-registration.js:156:47:156:49 | req |
 | src/advanced-routehandler-registration.js:157:28:157:30 | req |
+| src/advanced-routehandler-registration.js:157:28:157:30 | req |
 | src/advanced-routehandler-registration.js:157:53:157:55 | req |
 | src/controllers/handler-in-bulk-require.js:1:45:1:47 | req |
 | src/csurf-example.js:20:28:20:30 | req |
+| src/csurf-example.js:20:28:20:30 | req |
 | src/csurf-example.js:22:35:22:37 | req |
 | src/csurf-example.js:25:32:25:34 | req |
 | src/csurf-example.js:32:40:32:42 | req |
@@ -820,22 +842,28 @@ test_isRequest
 | src/csurf-example.js:40:37:40:39 | req |
 | src/exportedHandler.js:1:44:1:46 | req |
 | src/express2.js:3:34:3:36 | req |
+| src/express2.js:3:34:3:36 | req |
 | src/express2.js:3:46:3:48 | req |
 | src/express2.js:4:41:4:47 | request |
+| src/express2.js:4:41:4:47 | request |
 | src/express2.js:4:60:4:66 | request |
 | src/express3.js:4:32:4:34 | req |
+| src/express3.js:4:32:4:34 | req |
 | src/express3.js:5:14:5:16 | req |
 | src/express3.js:5:35:5:37 | req |
 | src/express3.js:10:22:10:24 | req |
 | src/express4.js:4:32:4:34 | req |
+| src/express4.js:4:32:4:34 | req |
 | src/express4.js:5:27:5:29 | req |
 | src/express4.js:6:18:6:20 | req |
 | src/express4.js:7:18:7:20 | req |
 | src/express.js:4:32:4:34 | req |
+| src/express.js:4:32:4:34 | req |
 | src/express.js:5:16:5:18 | req |
 | src/express.js:6:26:6:28 | req |
 | src/express.js:16:28:16:30 | req |
 | src/express.js:22:39:22:41 | req |
+| src/express.js:22:39:22:41 | req |
 | src/express.js:23:3:23:5 | req |
 | src/express.js:24:3:24:5 | req |
 | src/express.js:25:3:25:5 | req |
@@ -847,43 +875,55 @@ test_isRequest
 | src/express.js:37:22:37:24 | req |
 | src/express.js:42:13:42:15 | req |
 | src/express.js:46:31:46:33 | req |
+| src/express.js:46:31:46:33 | req |
 | src/express.js:47:3:47:5 | req |
 | src/express.js:48:3:48:5 | req |
 | src/express.js:49:3:49:5 | req |
 | src/express.js:50:3:50:5 | req |
 | src/inheritedFromNode.js:4:24:4:26 | req |
+| src/inheritedFromNode.js:4:24:4:26 | req |
 | src/inheritedFromNode.js:7:2:7:4 | req |
 | src/middleware-flow.js:5:20:5:22 | req |
+| src/middleware-flow.js:5:20:5:22 | req |
 | src/middleware-flow.js:6:5:6:7 | req |
 | src/middleware-flow.js:7:5:7:7 | req |
 | src/middleware-flow.js:8:5:8:7 | req |
 | src/middleware-flow.js:17:25:17:27 | req |
+| src/middleware-flow.js:17:25:17:27 | req |
 | src/middleware-flow.js:18:9:18:11 | req |
 | src/middleware-flow.js:19:9:19:11 | req |
 | src/middleware-flow.js:20:9:20:11 | req |
 | src/middleware-flow.js:23:18:23:20 | req |
+| src/middleware-flow.js:23:18:23:20 | req |
 | src/middleware-flow.js:23:33:23:35 | req |
 | src/middleware-flow.js:24:18:24:20 | req |
+| src/middleware-flow.js:24:18:24:20 | req |
 | src/middleware-flow.js:24:33:24:35 | req |
 | src/middleware-flow.js:39:24:39:26 | req |
+| src/middleware-flow.js:39:24:39:26 | req |
 | src/middleware-flow.js:40:5:40:7 | req |
 | src/middleware-flow.js:41:5:41:7 | req |
 | src/middleware-flow.js:42:5:42:7 | req |
 | src/params.js:4:19:4:21 | req |
+| src/params.js:4:19:4:21 | req |
 | src/params.js:5:17:5:19 | req |
 | src/params.js:6:17:6:19 | req |
 | src/params.js:14:33:14:35 | req |
 | src/passport.js:27:13:27:15 | req |
+| src/passport.js:27:13:27:15 | req |
 | src/passport.js:28:2:28:4 | req |
 | src/responseExprs.js:4:32:4:34 | req |
 | src/responseExprs.js:7:32:7:34 | req |
 | src/responseExprs.js:10:39:10:41 | req |
 | src/responseExprs.js:13:32:13:34 | req |
 | src/responseExprs.js:16:39:16:41 | req |
+| src/responseExprs.js:16:39:16:41 | req |
 | src/responseExprs.js:17:5:17:7 | req |
 | src/route-collection.js:2:7:2:9 | req |
+| src/route-collection.js:2:7:2:9 | req |
 | src/route-collection.js:2:32:2:34 | req |
 | src/route-collection.js:3:7:3:9 | req |
+| src/route-collection.js:3:7:3:9 | req |
 | src/route-collection.js:3:32:3:34 | req |
 | src/route.js:5:21:5:23 | req |
 test_RouteSetup_getRouter
@@ -1067,37 +1107,52 @@ test_ResponseExpr
 | src/advanced-routehandler-registration.js:24:12:24:14 | res | src/advanced-routehandler-registration.js:24:6:24:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:25:12:25:14 | res | src/advanced-routehandler-registration.js:25:6:25:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:46:25:46:27 | res | src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:46:25:46:27 | res | src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:46:25:46:27 | res | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:46:25:46:27 | res | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:47:32:47:34 | res | src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:47:32:47:34 | res | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:51:15:51:17 | res | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
+| src/advanced-routehandler-registration.js:51:15:51:17 | res | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:51:45:51:47 | res | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:59:25:59:27 | res | src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:59:25:59:27 | res | src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:59:25:59:27 | res | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:59:25:59:27 | res | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:60:23:60:25 | res | src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:60:23:60:25 | res | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:64:15:64:17 | res | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
+| src/advanced-routehandler-registration.js:64:15:64:17 | res | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:64:50:64:52 | res | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:68:18:68:20 | res | src/advanced-routehandler-registration.js:68:12:68:41 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:68:18:68:20 | res | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:68:18:68:20 | res | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:69:25:69:27 | res | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:69:25:69:27 | res | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:69:25:69:27 | res | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:69:25:69:27 | res | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:70:23:70:25 | res | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:70:23:70:25 | res | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:73:15:73:17 | res | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
+| src/advanced-routehandler-registration.js:73:15:73:17 | res | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:73:52:73:54 | res | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:81:25:81:27 | res | src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:81:25:81:27 | res | src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:81:25:81:27 | res | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:81:25:81:27 | res | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:82:32:82:34 | res | src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:82:32:82:34 | res | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:92:15:92:17 | res | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
+| src/advanced-routehandler-registration.js:92:15:92:17 | res | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:92:45:92:47 | res | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:100:25:100:27 | res | src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:100:25:100:27 | res | src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:100:25:100:27 | res | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:100:25:100:27 | res | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:101:36:101:38 | res | src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:101:36:101:38 | res | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:111:15:111:17 | res | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
+| src/advanced-routehandler-registration.js:111:15:111:17 | res | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:111:45:111:47 | res | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:123:26:123:28 | res | src/advanced-routehandler-registration.js:123:20:123:49 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:124:26:124:28 | res | src/advanced-routehandler-registration.js:124:20:124:49 | (req, r ... og(req) |
@@ -1106,32 +1161,40 @@ test_ResponseExpr
 | src/advanced-routehandler-registration.js:157:33:157:35 | res | src/advanced-routehandler-registration.js:157:27:157:56 | (req, r ... og(req) |
 | src/controllers/handler-in-bulk-require.js:1:50:1:52 | res | src/controllers/handler-in-bulk-require.js:1:44:1:66 | (req, r ... defined |
 | src/csurf-example.js:20:33:20:35 | res | src/csurf-example.js:20:18:23:1 | functio ... () })\\n} |
+| src/csurf-example.js:20:33:20:35 | res | src/csurf-example.js:20:18:23:1 | functio ... () })\\n} |
 | src/csurf-example.js:22:3:22:5 | res | src/csurf-example.js:20:18:23:1 | functio ... () })\\n} |
 | src/csurf-example.js:25:37:25:39 | res | src/csurf-example.js:25:22:27:1 | functio ... ere')\\n} |
+| src/csurf-example.js:25:37:25:39 | res | src/csurf-example.js:25:22:27:1 | functio ... ere')\\n} |
 | src/csurf-example.js:26:3:26:5 | res | src/csurf-example.js:25:22:27:1 | functio ... ere')\\n} |
 | src/csurf-example.js:26:3:26:43 | res.sen ...  here') | src/csurf-example.js:25:22:27:1 | functio ... ere')\\n} |
 | src/csurf-example.js:32:45:32:47 | res | src/csurf-example.js:32:30:34:3 | functio ... e')\\n  } |
+| src/csurf-example.js:32:45:32:47 | res | src/csurf-example.js:32:30:34:3 | functio ... e')\\n  } |
 | src/csurf-example.js:33:5:33:7 | res | src/csurf-example.js:32:30:34:3 | functio ... e')\\n  } |
 | src/csurf-example.js:33:5:33:35 | res.sen ...  here') | src/csurf-example.js:32:30:34:3 | functio ... e')\\n  } |
 | src/csurf-example.js:39:41:39:43 | res | src/csurf-example.js:39:26:39:47 | functio ... res) {} |
 | src/csurf-example.js:40:42:40:44 | res | src/csurf-example.js:40:27:40:48 | functio ... res) {} |
 | src/exportedHandler.js:1:49:1:51 | res | src/exportedHandler.js:1:19:1:55 | functio ... res) {} |
 | src/express2.js:3:39:3:41 | res | src/express2.js:3:25:3:55 | functio ... , res } |
+| src/express2.js:3:39:3:41 | res | src/express2.js:3:25:3:55 | functio ... , res } |
 | src/express2.js:3:46:3:53 | req, res | src/express2.js:3:25:3:55 | functio ... , res } |
 | src/express2.js:3:51:3:53 | res | src/express2.js:3:25:3:55 | functio ... , res } |
 | src/express2.js:4:50:4:55 | result | src/express2.js:4:32:4:76 | functio ... esult } |
+| src/express2.js:4:50:4:55 | result | src/express2.js:4:32:4:76 | functio ... esult } |
 | src/express2.js:4:60:4:74 | request, result | src/express2.js:4:32:4:76 | functio ... esult } |
 | src/express2.js:4:69:4:74 | result | src/express2.js:4:32:4:76 | functio ... esult } |
 | src/express3.js:4:37:4:39 | res | src/express3.js:4:23:7:1 | functio ... al");\\n} |
+| src/express3.js:4:37:4:39 | res | src/express3.js:4:23:7:1 | functio ... al");\\n} |
 | src/express3.js:5:3:5:5 | res | src/express3.js:4:23:7:1 | functio ... al");\\n} |
 | src/express3.js:5:3:5:51 | res.hea ... "val")) | src/express3.js:4:23:7:1 | functio ... al");\\n} |
 | src/express3.js:6:3:6:5 | res | src/express3.js:4:23:7:1 | functio ... al");\\n} |
 | src/express3.js:6:3:6:17 | res.send("val") | src/express3.js:4:23:7:1 | functio ... al");\\n} |
 | src/express3.js:10:27:10:29 | res | src/express3.js:10:12:10:32 | functio ...  res){} |
 | src/express4.js:4:37:4:39 | res | src/express4.js:4:23:9:1 | functio ... ic1);\\n} |
+| src/express4.js:4:37:4:39 | res | src/express4.js:4:23:9:1 | functio ... ic1);\\n} |
 | src/express4.js:8:3:8:5 | res | src/express4.js:4:23:9:1 | functio ... ic1);\\n} |
 | src/express4.js:8:3:8:20 | res.send(dynamic1) | src/express4.js:4:23:9:1 | functio ... ic1);\\n} |
 | src/express.js:4:37:4:39 | res | src/express.js:4:23:9:1 | functio ... res);\\n} |
+| src/express.js:4:37:4:39 | res | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:5:3:5:5 | res | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:6:3:6:5 | res | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:6:3:6:45 | res.hea ... rget")) | src/express.js:4:23:9:1 | functio ... res);\\n} |
@@ -1139,18 +1202,22 @@ test_ResponseExpr
 | src/express.js:7:3:7:42 | res.hea ... plain") | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:8:7:8:9 | res | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:11:14:11:16 | arg | src/express.js:4:23:9:1 | functio ... res);\\n} |
+| src/express.js:11:14:11:16 | arg | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:12:3:12:5 | arg | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:12:3:12:54 | arg.hea ... , true) | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:16:33:16:35 | res | src/express.js:16:19:18:3 | functio ... ");\\n  } |
+| src/express.js:16:33:16:35 | res | src/express.js:16:19:18:3 | functio ... ");\\n  } |
 | src/express.js:17:5:17:7 | res | src/express.js:16:19:18:3 | functio ... ");\\n  } |
 | src/express.js:17:5:17:24 | res.send("Go away.") | src/express.js:16:19:18:3 | functio ... ");\\n  } |
 | src/express.js:22:44:22:46 | res | src/express.js:22:30:32:1 | functio ... ar');\\n} |
+| src/express.js:22:44:22:46 | res | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:31:3:31:5 | res | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:31:3:31:26 | res.coo ...  'bar') | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:37:27:37:29 | res | src/express.js:37:12:37:32 | functio ...  res){} |
 | src/express.js:42:18:42:20 | res | src/express.js:42:12:42:28 | (req, res) => f() |
 | src/express.js:46:36:46:38 | res | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/inheritedFromNode.js:4:29:4:31 | res | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} |
+| src/inheritedFromNode.js:4:29:4:31 | res | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} |
 | src/inheritedFromNode.js:5:2:5:4 | res | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} |
 | src/inheritedFromNode.js:6:2:6:4 | res | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} |
 | src/middleware-flow.js:5:25:5:27 | res | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} |
@@ -1159,20 +1226,27 @@ test_ResponseExpr
 | src/middleware-flow.js:24:23:24:25 | res | src/middleware-flow.js:24:17:24:41 | (req, r ... q.db; } |
 | src/middleware-flow.js:39:29:39:31 | res | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} |
 | src/params.js:4:24:4:26 | res | src/params.js:4:18:12:1 | (req, r ...     }\\n} |
+| src/params.js:4:24:4:26 | res | src/params.js:4:18:12:1 | (req, r ...     }\\n} |
 | src/params.js:8:9:8:11 | res | src/params.js:4:18:12:1 | (req, r ...     }\\n} |
 | src/params.js:8:9:8:23 | res.send(value) | src/params.js:4:18:12:1 | (req, r ...     }\\n} |
 | src/params.js:14:38:14:40 | res | src/params.js:14:24:16:1 | functio ... lo");\\n} |
+| src/params.js:14:38:14:40 | res | src/params.js:14:24:16:1 | functio ... lo");\\n} |
 | src/params.js:15:3:15:5 | res | src/params.js:14:24:16:1 | functio ... lo");\\n} |
 | src/params.js:15:3:15:19 | res.send("Hello") | src/params.js:14:24:16:1 | functio ... lo");\\n} |
 | src/responseExprs.js:4:37:4:40 | res1 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
+| src/responseExprs.js:4:37:4:40 | res1 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:5:5:5:8 | res1 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:37:7:40 | res2 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
+| src/responseExprs.js:7:37:7:40 | res2 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:8:5:8:8 | res2 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:44:10:47 | res3 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
+| src/responseExprs.js:10:44:10:47 | res3 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
 | src/responseExprs.js:11:5:11:8 | res3 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
 | src/responseExprs.js:13:37:13:40 | res4 | src/responseExprs.js:13:23:15:1 | functio ... res4;\\n} |
+| src/responseExprs.js:13:37:13:40 | res4 | src/responseExprs.js:13:23:15:1 | functio ... res4;\\n} |
 | src/responseExprs.js:14:5:14:8 | res4 | src/responseExprs.js:13:23:15:1 | functio ... res4;\\n} |
 | src/responseExprs.js:16:44:16:46 | res | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
+| src/responseExprs.js:16:44:16:46 | res | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
 | src/responseExprs.js:19:5:19:7 | res | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
 | src/responseExprs.js:19:5:19:16 | res.append() | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
 | src/responseExprs.js:20:5:20:7 | res | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
@@ -1210,6 +1284,8 @@ test_ResponseExpr
 | src/responseExprs.js:37:5:37:28 | f(res.a ... ppend() | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
 | src/responseExprs.js:37:7:37:9 | res | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
 | src/responseExprs.js:37:7:37:18 | res.append() | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
+| src/responseExprs.js:39:5:41:5 | return of function f | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
+| src/responseExprs.js:39:16:39:21 | resArg | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
 | src/responseExprs.js:39:16:39:21 | resArg | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
 | src/responseExprs.js:40:16:40:21 | resArg | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
 | src/responseExprs.js:40:16:40:30 | resArg.append() | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
@@ -1524,85 +1600,6 @@ test_RouteSetup_getRequestMethod
 | src/routesetups.js:12:1:12:16 | root.post('', h) | POST |
 | src/subrouter.js:9:3:9:35 | router. ... ndler1) | POST |
 | src/subrouter.js:10:3:10:41 | router. ... ndler2) | POST |
-test_RouteExpr
-| src/advanced-routehandler-registration.js:10:3:10:24 | app.get ... es0[p]) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:19:3:19:18 | app.use(handler) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:28:3:28:24 | app.get ... es2[p]) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:37:3:37:12 | app.use(h) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:51:1:51:61 | app.use ... ever")) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:64:1:64:54 | app.use ... , res)) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:73:1:73:56 | app.use ... , res)) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:92:1:92:61 | app.use ... ever")) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:111:1:111:61 | app.use ... ever")) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:116:3:116:31 | app.get ... tes[p]) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:118:1:118:30 | app.get ... utes.a) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:119:1:119:30 | app.get ... utes.b) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:125:29:125:41 | app.get(k, v) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:126:1:126:32 | app.get ... t("a")) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:127:1:127:32 | app.get ... t("b")) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:135:2:135:53 | app.get ... andler) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:139:1:139:58 | app.get ... andler) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:144:1:144:32 | app.use ... , args) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:147:1:147:37 | app.use ... (data)) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:150:2:150:14 | app.get(k, v) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:153:1:153:41 | app.get ... KEY!")) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:160:1:160:33 | app.get ... t("c")) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:161:1:161:39 | app.get ... own())) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:162:1:162:23 | app.get ... nown()) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/advanced-routehandler-registration.js:163:1:163:33 | app.get ... t("f")) | src/advanced-routehandler-registration.js:2:11:2:19 | express() |
-| src/auth.js:4:1:4:53 | app.use ... d' }})) | src/auth.js:1:13:1:32 | require('express')() |
-| src/csurf-example.js:13:1:13:20 | app.use('/api', api) | src/csurf-example.js:7:11:7:19 | express() |
-| src/csurf-example.js:16:1:16:51 | app.use ... lse })) | src/csurf-example.js:7:11:7:19 | express() |
-| src/csurf-example.js:17:1:17:23 | app.use ... rser()) | src/csurf-example.js:7:11:7:19 | express() |
-| src/csurf-example.js:18:1:18:31 | app.use ... rue })) | src/csurf-example.js:7:11:7:19 | express() |
-| src/csurf-example.js:20:1:23:2 | app.get ... ) })\\n}) | src/csurf-example.js:7:11:7:19 | express() |
-| src/csurf-example.js:25:1:27:2 | app.pos ... re')\\n}) | src/csurf-example.js:7:11:7:19 | express() |
-| src/csurf-example.js:32:3:34:4 | router. ... ')\\n  }) | src/csurf-example.js:30:16:30:35 | new express.Router() |
-| src/csurf-example.js:39:1:39:48 | app.get ... es) {}) | src/csurf-example.js:7:11:7:19 | express() |
-| src/csurf-example.js:40:1:40:49 | app.pos ... es) {}) | src/csurf-example.js:7:11:7:19 | express() |
-| src/express2.js:2:14:2:23 | e.Router() | src/express2.js:2:14:2:23 | e.Router() |
-| src/express2.js:3:1:3:56 | router. ...  res }) | src/express2.js:2:14:2:23 | e.Router() |
-| src/express2.js:3:1:4:77 | router. ... sult }) | src/express2.js:2:14:2:23 | e.Router() |
-| src/express2.js:6:1:6:15 | app.use(router) | src/express2.js:5:11:5:13 | e() |
-| src/express3.js:4:1:7:2 | app.get ... l");\\n}) | src/express3.js:2:11:2:19 | express() |
-| src/express3.js:12:1:12:21 | app.use ... dler()) | src/express3.js:2:11:2:19 | express() |
-| src/express4.js:4:1:9:2 | app.get ... c1);\\n}) | src/express4.js:2:11:2:19 | express() |
-| src/express.js:4:1:9:2 | app.get ... es);\\n}) | src/express.js:2:11:2:19 | express() |
-| src/express.js:16:3:18:4 | router. ... );\\n  }) | src/express.js:2:11:2:19 | express() |
-| src/express.js:22:1:32:2 | app.pos ... r');\\n}) | src/express.js:2:11:2:19 | express() |
-| src/express.js:34:1:34:53 | app.get ... andler) | src/express.js:2:11:2:19 | express() |
-| src/express.js:39:1:39:21 | app.use ... dler()) | src/express.js:2:11:2:19 | express() |
-| src/express.js:44:1:44:26 | app.use ... dler()) | src/express.js:2:11:2:19 | express() |
-| src/express.js:46:1:51:2 | app.pos ... me];\\n}) | src/express.js:2:11:2:19 | express() |
-| src/inheritedFromNode.js:4:1:8:2 | app.pos ... url;\\n}) | src/inheritedFromNode.js:2:11:2:19 | express() |
-| src/middleware-flow.js:13:5:13:25 | router. ... tallDb) | src/middleware-flow.js:2:13:2:21 | express() |
-| src/middleware-flow.js:17:5:21:6 | router. ... \\n    }) | src/middleware-flow.js:2:13:2:21 | express() |
-| src/middleware-flow.js:27:9:27:33 | router. ... ers[p]) | src/middleware-flow.js:2:13:2:21 | express() |
-| src/middleware-flow.js:39:1:43:2 | unrelat ... .db;\\n}) | src/middleware-flow.js:37:22:37:30 | express() |
-| src/params.js:4:1:12:2 | app.par ...    }\\n}) | src/params.js:2:11:2:19 | express() |
-| src/params.js:4:1:12:2 | app.par ...    }\\n}) | src/params.js:4:1:12:2 | app.par ...    }\\n}) |
-| src/params.js:14:1:16:2 | app.get ... o");\\n}) | src/params.js:2:11:2:19 | express() |
-| src/responseExprs.js:4:1:6:2 | app.get ... res1\\n}) | src/responseExprs.js:2:11:2:19 | express() |
-| src/responseExprs.js:7:1:9:2 | app.get ... es2;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
-| src/responseExprs.js:10:1:12:2 | app.get ... es3;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
-| src/responseExprs.js:13:1:15:2 | app.get ... es4;\\n}) | src/responseExprs.js:2:11:2:19 | express() |
-| src/responseExprs.js:16:1:42:2 | app.pos ...    }\\n}) | src/responseExprs.js:2:11:2:19 | express() |
-| src/route.js:2:14:2:29 | express.Router() | src/route.js:2:14:2:29 | express.Router() |
-| src/route.js:4:1:4:31 | router. ... er_id') | src/route.js:2:14:2:29 | express.Router() |
-| src/route.js:4:1:5:39 | router. ... xt) {}) | src/route.js:2:14:2:29 | express.Router() |
-| src/routesetups.js:3:1:3:16 | express.Router() | src/routesetups.js:3:1:3:16 | express.Router() |
-| src/routesetups.js:3:1:4:14 | express ... ('', h) | src/routesetups.js:3:1:3:16 | express.Router() |
-| src/routesetups.js:3:1:5:12 | express ... ('', h) | src/routesetups.js:3:1:3:16 | express.Router() |
-| src/routesetups.js:7:11:7:32 | express ... erver() | src/routesetups.js:7:11:7:32 | express ... erver() |
-| src/routesetups.js:8:1:8:12 | app.error(h) | src/routesetups.js:7:11:7:32 | express ... erver() |
-| src/routesetups.js:10:14:10:29 | express.Router() | src/routesetups.js:10:14:10:29 | express.Router() |
-| src/routesetups.js:11:12:11:28 | router.route('/') | src/routesetups.js:10:14:10:29 | express.Router() |
-| src/routesetups.js:12:1:12:16 | root.post('', h) | src/routesetups.js:10:14:10:29 | express.Router() |
-| src/subrouter.js:4:1:4:26 | app.use ... rotect) | src/subrouter.js:2:11:2:19 | express() |
-| src/subrouter.js:5:1:5:29 | app.use ... uter()) | src/subrouter.js:2:11:2:19 | express() |
-| src/subrouter.js:8:16:8:31 | express.Router() | src/subrouter.js:8:16:8:31 | express.Router() |
-| src/subrouter.js:9:3:9:35 | router. ... ndler1) | src/subrouter.js:8:16:8:31 | express.Router() |
-| src/subrouter.js:10:3:10:41 | router. ... ndler2) | src/subrouter.js:8:16:8:31 | express.Router() |
 test_RouteHandler_getAResponseExpr
 | src/advanced-routehandler-registration.js:6:6:6:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:6:12:6:14 | res |
 | src/advanced-routehandler-registration.js:7:6:7:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:7:12:7:14 | res |
@@ -1611,37 +1608,52 @@ test_RouteHandler_getAResponseExpr
 | src/advanced-routehandler-registration.js:24:6:24:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:24:12:24:14 | res |
 | src/advanced-routehandler-registration.js:25:6:25:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:25:12:25:14 | res |
 | src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:46:25:46:27 | res |
+| src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:46:25:46:27 | res |
 | src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:47:32:47:34 | res |
 | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:46:25:46:27 | res |
+| src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:46:25:46:27 | res |
 | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:47:32:47:34 | res |
 | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:51:15:51:17 | res |
+| src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:51:15:51:17 | res |
 | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:51:45:51:47 | res |
 | src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:59:25:59:27 | res |
+| src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:59:25:59:27 | res |
 | src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:60:23:60:25 | res |
 | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:59:25:59:27 | res |
+| src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:59:25:59:27 | res |
 | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:60:23:60:25 | res |
 | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:64:15:64:17 | res |
+| src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:64:15:64:17 | res |
 | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:64:50:64:52 | res |
 | src/advanced-routehandler-registration.js:68:12:68:41 | (req, r ... og(req) | src/advanced-routehandler-registration.js:68:18:68:20 | res |
 | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:68:18:68:20 | res |
 | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:69:25:69:27 | res |
+| src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:69:25:69:27 | res |
 | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:70:23:70:25 | res |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:68:18:68:20 | res |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:69:25:69:27 | res |
+| src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:69:25:69:27 | res |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:70:23:70:25 | res |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:73:15:73:17 | res |
+| src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:73:15:73:17 | res |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:73:52:73:54 | res |
 | src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:81:25:81:27 | res |
+| src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:81:25:81:27 | res |
 | src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:82:32:82:34 | res |
 | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:81:25:81:27 | res |
+| src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:81:25:81:27 | res |
 | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:82:32:82:34 | res |
 | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:92:15:92:17 | res |
+| src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:92:15:92:17 | res |
 | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:92:45:92:47 | res |
 | src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:100:25:100:27 | res |
+| src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:100:25:100:27 | res |
 | src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:101:36:101:38 | res |
 | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:100:25:100:27 | res |
+| src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:100:25:100:27 | res |
 | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:101:36:101:38 | res |
 | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:111:15:111:17 | res |
+| src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:111:15:111:17 | res |
 | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:111:45:111:47 | res |
 | src/advanced-routehandler-registration.js:123:20:123:49 | (req, r ... og(req) | src/advanced-routehandler-registration.js:123:26:123:28 | res |
 | src/advanced-routehandler-registration.js:124:20:124:49 | (req, r ... og(req) | src/advanced-routehandler-registration.js:124:26:124:28 | res |
@@ -1650,32 +1662,40 @@ test_RouteHandler_getAResponseExpr
 | src/advanced-routehandler-registration.js:157:27:157:56 | (req, r ... og(req) | src/advanced-routehandler-registration.js:157:33:157:35 | res |
 | src/controllers/handler-in-bulk-require.js:1:44:1:66 | (req, r ... defined | src/controllers/handler-in-bulk-require.js:1:50:1:52 | res |
 | src/csurf-example.js:20:18:23:1 | functio ... () })\\n} | src/csurf-example.js:20:33:20:35 | res |
+| src/csurf-example.js:20:18:23:1 | functio ... () })\\n} | src/csurf-example.js:20:33:20:35 | res |
 | src/csurf-example.js:20:18:23:1 | functio ... () })\\n} | src/csurf-example.js:22:3:22:5 | res |
 | src/csurf-example.js:25:22:27:1 | functio ... ere')\\n} | src/csurf-example.js:25:37:25:39 | res |
+| src/csurf-example.js:25:22:27:1 | functio ... ere')\\n} | src/csurf-example.js:25:37:25:39 | res |
 | src/csurf-example.js:25:22:27:1 | functio ... ere')\\n} | src/csurf-example.js:26:3:26:5 | res |
 | src/csurf-example.js:25:22:27:1 | functio ... ere')\\n} | src/csurf-example.js:26:3:26:43 | res.sen ...  here') |
 | src/csurf-example.js:32:30:34:3 | functio ... e')\\n  } | src/csurf-example.js:32:45:32:47 | res |
+| src/csurf-example.js:32:30:34:3 | functio ... e')\\n  } | src/csurf-example.js:32:45:32:47 | res |
 | src/csurf-example.js:32:30:34:3 | functio ... e')\\n  } | src/csurf-example.js:33:5:33:7 | res |
 | src/csurf-example.js:32:30:34:3 | functio ... e')\\n  } | src/csurf-example.js:33:5:33:35 | res.sen ...  here') |
 | src/csurf-example.js:39:26:39:47 | functio ... res) {} | src/csurf-example.js:39:41:39:43 | res |
 | src/csurf-example.js:40:27:40:48 | functio ... res) {} | src/csurf-example.js:40:42:40:44 | res |
 | src/exportedHandler.js:1:19:1:55 | functio ... res) {} | src/exportedHandler.js:1:49:1:51 | res |
 | src/express2.js:3:25:3:55 | functio ... , res } | src/express2.js:3:39:3:41 | res |
+| src/express2.js:3:25:3:55 | functio ... , res } | src/express2.js:3:39:3:41 | res |
 | src/express2.js:3:25:3:55 | functio ... , res } | src/express2.js:3:46:3:53 | req, res |
 | src/express2.js:3:25:3:55 | functio ... , res } | src/express2.js:3:51:3:53 | res |
 | src/express2.js:4:32:4:76 | functio ... esult } | src/express2.js:4:50:4:55 | result |
+| src/express2.js:4:32:4:76 | functio ... esult } | src/express2.js:4:50:4:55 | result |
 | src/express2.js:4:32:4:76 | functio ... esult } | src/express2.js:4:60:4:74 | request, result |
 | src/express2.js:4:32:4:76 | functio ... esult } | src/express2.js:4:69:4:74 | result |
 | src/express3.js:4:23:7:1 | functio ... al");\\n} | src/express3.js:4:37:4:39 | res |
+| src/express3.js:4:23:7:1 | functio ... al");\\n} | src/express3.js:4:37:4:39 | res |
 | src/express3.js:4:23:7:1 | functio ... al");\\n} | src/express3.js:5:3:5:5 | res |
 | src/express3.js:4:23:7:1 | functio ... al");\\n} | src/express3.js:5:3:5:51 | res.hea ... "val")) |
 | src/express3.js:4:23:7:1 | functio ... al");\\n} | src/express3.js:6:3:6:5 | res |
 | src/express3.js:4:23:7:1 | functio ... al");\\n} | src/express3.js:6:3:6:17 | res.send("val") |
 | src/express3.js:10:12:10:32 | functio ...  res){} | src/express3.js:10:27:10:29 | res |
 | src/express4.js:4:23:9:1 | functio ... ic1);\\n} | src/express4.js:4:37:4:39 | res |
+| src/express4.js:4:23:9:1 | functio ... ic1);\\n} | src/express4.js:4:37:4:39 | res |
 | src/express4.js:4:23:9:1 | functio ... ic1);\\n} | src/express4.js:8:3:8:5 | res |
 | src/express4.js:4:23:9:1 | functio ... ic1);\\n} | src/express4.js:8:3:8:20 | res.send(dynamic1) |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:4:37:4:39 | res |
+| src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:4:37:4:39 | res |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:5:3:5:5 | res |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:6:3:6:5 | res |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:6:3:6:45 | res.hea ... rget")) |
@@ -1683,18 +1703,22 @@ test_RouteHandler_getAResponseExpr
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:7:3:7:42 | res.hea ... plain") |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:8:7:8:9 | res |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:11:14:11:16 | arg |
+| src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:11:14:11:16 | arg |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:12:3:12:5 | arg |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:12:3:12:54 | arg.hea ... , true) |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:16:33:16:35 | res |
+| src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:16:33:16:35 | res |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:17:5:17:7 | res |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:17:5:17:24 | res.send("Go away.") |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:22:44:22:46 | res |
+| src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:22:44:22:46 | res |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:31:3:31:5 | res |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:31:3:31:26 | res.coo ...  'bar') |
 | src/express.js:37:12:37:32 | functio ...  res){} | src/express.js:37:27:37:29 | res |
 | src/express.js:42:12:42:28 | (req, res) => f() | src/express.js:42:18:42:20 | res |
 | src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:46:36:46:38 | res |
 | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} | src/inheritedFromNode.js:4:29:4:31 | res |
+| src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} | src/inheritedFromNode.js:4:29:4:31 | res |
 | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} | src/inheritedFromNode.js:5:2:5:4 | res |
 | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} | src/inheritedFromNode.js:6:2:6:4 | res |
 | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} | src/middleware-flow.js:5:25:5:27 | res |
@@ -1703,20 +1727,27 @@ test_RouteHandler_getAResponseExpr
 | src/middleware-flow.js:24:17:24:41 | (req, r ... q.db; } | src/middleware-flow.js:24:23:24:25 | res |
 | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} | src/middleware-flow.js:39:29:39:31 | res |
 | src/params.js:4:18:12:1 | (req, r ...     }\\n} | src/params.js:4:24:4:26 | res |
+| src/params.js:4:18:12:1 | (req, r ...     }\\n} | src/params.js:4:24:4:26 | res |
 | src/params.js:4:18:12:1 | (req, r ...     }\\n} | src/params.js:8:9:8:11 | res |
 | src/params.js:4:18:12:1 | (req, r ...     }\\n} | src/params.js:8:9:8:23 | res.send(value) |
 | src/params.js:14:24:16:1 | functio ... lo");\\n} | src/params.js:14:38:14:40 | res |
+| src/params.js:14:24:16:1 | functio ... lo");\\n} | src/params.js:14:38:14:40 | res |
 | src/params.js:14:24:16:1 | functio ... lo");\\n} | src/params.js:15:3:15:5 | res |
 | src/params.js:14:24:16:1 | functio ... lo");\\n} | src/params.js:15:3:15:19 | res.send("Hello") |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:4:37:4:40 | res1 |
+| src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:4:37:4:40 | res1 |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:5:5:5:8 | res1 |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:7:37:7:40 | res2 |
+| src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:7:37:7:40 | res2 |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:8:5:8:8 | res2 |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:10:44:10:47 | res3 |
+| src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:10:44:10:47 | res3 |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:11:5:11:8 | res3 |
 | src/responseExprs.js:13:23:15:1 | functio ... res4;\\n} | src/responseExprs.js:13:37:13:40 | res4 |
+| src/responseExprs.js:13:23:15:1 | functio ... res4;\\n} | src/responseExprs.js:13:37:13:40 | res4 |
 | src/responseExprs.js:13:23:15:1 | functio ... res4;\\n} | src/responseExprs.js:14:5:14:8 | res4 |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:16:44:16:46 | res |
+| src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:16:44:16:46 | res |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:19:5:19:7 | res |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:19:5:19:16 | res.append() |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:20:5:20:7 | res |
@@ -1754,6 +1785,8 @@ test_RouteHandler_getAResponseExpr
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:37:5:37:28 | f(res.a ... ppend() |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:37:7:37:9 | res |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:37:7:37:18 | res.append() |
+| src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:39:5:41:5 | return of function f |
+| src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:39:16:39:21 | resArg |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:39:16:39:21 | resArg |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:40:16:40:21 | resArg |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:40:16:40:30 | resArg.append() |
@@ -1768,25 +1801,35 @@ test_isResponse
 | src/advanced-routehandler-registration.js:24:12:24:14 | res |
 | src/advanced-routehandler-registration.js:25:12:25:14 | res |
 | src/advanced-routehandler-registration.js:46:25:46:27 | res |
+| src/advanced-routehandler-registration.js:46:25:46:27 | res |
 | src/advanced-routehandler-registration.js:47:32:47:34 | res |
 | src/advanced-routehandler-registration.js:51:15:51:17 | res |
+| src/advanced-routehandler-registration.js:51:15:51:17 | res |
 | src/advanced-routehandler-registration.js:51:45:51:47 | res |
 | src/advanced-routehandler-registration.js:59:25:59:27 | res |
+| src/advanced-routehandler-registration.js:59:25:59:27 | res |
 | src/advanced-routehandler-registration.js:60:23:60:25 | res |
 | src/advanced-routehandler-registration.js:64:15:64:17 | res |
+| src/advanced-routehandler-registration.js:64:15:64:17 | res |
 | src/advanced-routehandler-registration.js:64:50:64:52 | res |
 | src/advanced-routehandler-registration.js:68:18:68:20 | res |
 | src/advanced-routehandler-registration.js:69:25:69:27 | res |
+| src/advanced-routehandler-registration.js:69:25:69:27 | res |
 | src/advanced-routehandler-registration.js:70:23:70:25 | res |
 | src/advanced-routehandler-registration.js:73:15:73:17 | res |
+| src/advanced-routehandler-registration.js:73:15:73:17 | res |
 | src/advanced-routehandler-registration.js:73:52:73:54 | res |
 | src/advanced-routehandler-registration.js:81:25:81:27 | res |
+| src/advanced-routehandler-registration.js:81:25:81:27 | res |
 | src/advanced-routehandler-registration.js:82:32:82:34 | res |
 | src/advanced-routehandler-registration.js:92:15:92:17 | res |
+| src/advanced-routehandler-registration.js:92:15:92:17 | res |
 | src/advanced-routehandler-registration.js:92:45:92:47 | res |
 | src/advanced-routehandler-registration.js:100:25:100:27 | res |
+| src/advanced-routehandler-registration.js:100:25:100:27 | res |
 | src/advanced-routehandler-registration.js:101:36:101:38 | res |
 | src/advanced-routehandler-registration.js:111:15:111:17 | res |
+| src/advanced-routehandler-registration.js:111:15:111:17 | res |
 | src/advanced-routehandler-registration.js:111:45:111:47 | res |
 | src/advanced-routehandler-registration.js:123:26:123:28 | res |
 | src/advanced-routehandler-registration.js:124:26:124:28 | res |
@@ -1795,32 +1838,40 @@ test_isResponse
 | src/advanced-routehandler-registration.js:157:33:157:35 | res |
 | src/controllers/handler-in-bulk-require.js:1:50:1:52 | res |
 | src/csurf-example.js:20:33:20:35 | res |
+| src/csurf-example.js:20:33:20:35 | res |
 | src/csurf-example.js:22:3:22:5 | res |
 | src/csurf-example.js:25:37:25:39 | res |
+| src/csurf-example.js:25:37:25:39 | res |
 | src/csurf-example.js:26:3:26:5 | res |
 | src/csurf-example.js:26:3:26:43 | res.sen ...  here') |
 | src/csurf-example.js:32:45:32:47 | res |
+| src/csurf-example.js:32:45:32:47 | res |
 | src/csurf-example.js:33:5:33:7 | res |
 | src/csurf-example.js:33:5:33:35 | res.sen ...  here') |
 | src/csurf-example.js:39:41:39:43 | res |
 | src/csurf-example.js:40:42:40:44 | res |
 | src/exportedHandler.js:1:49:1:51 | res |
 | src/express2.js:3:39:3:41 | res |
+| src/express2.js:3:39:3:41 | res |
 | src/express2.js:3:46:3:53 | req, res |
 | src/express2.js:3:51:3:53 | res |
 | src/express2.js:4:50:4:55 | result |
+| src/express2.js:4:50:4:55 | result |
 | src/express2.js:4:60:4:74 | request, result |
 | src/express2.js:4:69:4:74 | result |
 | src/express3.js:4:37:4:39 | res |
+| src/express3.js:4:37:4:39 | res |
 | src/express3.js:5:3:5:5 | res |
 | src/express3.js:5:3:5:51 | res.hea ... "val")) |
 | src/express3.js:6:3:6:5 | res |
 | src/express3.js:6:3:6:17 | res.send("val") |
 | src/express3.js:10:27:10:29 | res |
 | src/express4.js:4:37:4:39 | res |
+| src/express4.js:4:37:4:39 | res |
 | src/express4.js:8:3:8:5 | res |
 | src/express4.js:8:3:8:20 | res.send(dynamic1) |
 | src/express.js:4:37:4:39 | res |
+| src/express.js:4:37:4:39 | res |
 | src/express.js:5:3:5:5 | res |
 | src/express.js:6:3:6:5 | res |
 | src/express.js:6:3:6:45 | res.hea ... rget")) |
@@ -1828,18 +1879,22 @@ test_isResponse
 | src/express.js:7:3:7:42 | res.hea ... plain") |
 | src/express.js:8:7:8:9 | res |
 | src/express.js:11:14:11:16 | arg |
+| src/express.js:11:14:11:16 | arg |
 | src/express.js:12:3:12:5 | arg |
 | src/express.js:12:3:12:54 | arg.hea ... , true) |
 | src/express.js:16:33:16:35 | res |
+| src/express.js:16:33:16:35 | res |
 | src/express.js:17:5:17:7 | res |
 | src/express.js:17:5:17:24 | res.send("Go away.") |
 | src/express.js:22:44:22:46 | res |
+| src/express.js:22:44:22:46 | res |
 | src/express.js:31:3:31:5 | res |
 | src/express.js:31:3:31:26 | res.coo ...  'bar') |
 | src/express.js:37:27:37:29 | res |
 | src/express.js:42:18:42:20 | res |
 | src/express.js:46:36:46:38 | res |
 | src/inheritedFromNode.js:4:29:4:31 | res |
+| src/inheritedFromNode.js:4:29:4:31 | res |
 | src/inheritedFromNode.js:5:2:5:4 | res |
 | src/inheritedFromNode.js:6:2:6:4 | res |
 | src/middleware-flow.js:5:25:5:27 | res |
@@ -1848,20 +1903,27 @@ test_isResponse
 | src/middleware-flow.js:24:23:24:25 | res |
 | src/middleware-flow.js:39:29:39:31 | res |
 | src/params.js:4:24:4:26 | res |
+| src/params.js:4:24:4:26 | res |
 | src/params.js:8:9:8:11 | res |
 | src/params.js:8:9:8:23 | res.send(value) |
 | src/params.js:14:38:14:40 | res |
+| src/params.js:14:38:14:40 | res |
 | src/params.js:15:3:15:5 | res |
 | src/params.js:15:3:15:19 | res.send("Hello") |
 | src/responseExprs.js:4:37:4:40 | res1 |
+| src/responseExprs.js:4:37:4:40 | res1 |
 | src/responseExprs.js:5:5:5:8 | res1 |
 | src/responseExprs.js:7:37:7:40 | res2 |
+| src/responseExprs.js:7:37:7:40 | res2 |
 | src/responseExprs.js:8:5:8:8 | res2 |
 | src/responseExprs.js:10:44:10:47 | res3 |
+| src/responseExprs.js:10:44:10:47 | res3 |
 | src/responseExprs.js:11:5:11:8 | res3 |
 | src/responseExprs.js:13:37:13:40 | res4 |
+| src/responseExprs.js:13:37:13:40 | res4 |
 | src/responseExprs.js:14:5:14:8 | res4 |
 | src/responseExprs.js:16:44:16:46 | res |
+| src/responseExprs.js:16:44:16:46 | res |
 | src/responseExprs.js:19:5:19:7 | res |
 | src/responseExprs.js:19:5:19:16 | res.append() |
 | src/responseExprs.js:20:5:20:7 | res |
@@ -1899,6 +1961,8 @@ test_isResponse
 | src/responseExprs.js:37:5:37:28 | f(res.a ... ppend() |
 | src/responseExprs.js:37:7:37:9 | res |
 | src/responseExprs.js:37:7:37:18 | res.append() |
+| src/responseExprs.js:39:5:41:5 | return of function f |
+| src/responseExprs.js:39:16:39:21 | resArg |
 | src/responseExprs.js:39:16:39:21 | resArg |
 | src/responseExprs.js:40:16:40:21 | resArg |
 | src/responseExprs.js:40:16:40:30 | resArg.append() |
@@ -2547,64 +2611,93 @@ test_RouteHandlerExpr_getPreviousMiddleware
 | src/subrouter.js:5:14:5:28 | makeSubRouter() | src/subrouter.js:4:19:4:25 | protect |
 test_RequestExpr
 | src/advanced-routehandler-registration.js:6:7:6:9 | req | src/advanced-routehandler-registration.js:6:6:6:35 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:6:7:6:9 | req | src/advanced-routehandler-registration.js:6:6:6:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:6:32:6:34 | req | src/advanced-routehandler-registration.js:6:6:6:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:7:7:7:9 | req | src/advanced-routehandler-registration.js:7:6:7:35 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:7:7:7:9 | req | src/advanced-routehandler-registration.js:7:6:7:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:7:32:7:34 | req | src/advanced-routehandler-registration.js:7:6:7:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:15:7:15:9 | req | src/advanced-routehandler-registration.js:15:6:15:35 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:15:7:15:9 | req | src/advanced-routehandler-registration.js:15:6:15:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:15:32:15:34 | req | src/advanced-routehandler-registration.js:15:6:15:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:16:7:16:9 | req | src/advanced-routehandler-registration.js:16:6:16:35 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:16:7:16:9 | req | src/advanced-routehandler-registration.js:16:6:16:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:16:32:16:34 | req | src/advanced-routehandler-registration.js:16:6:16:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:24:7:24:9 | req | src/advanced-routehandler-registration.js:24:6:24:35 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:24:7:24:9 | req | src/advanced-routehandler-registration.js:24:6:24:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:24:32:24:34 | req | src/advanced-routehandler-registration.js:24:6:24:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:25:7:25:9 | req | src/advanced-routehandler-registration.js:25:6:25:35 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:25:7:25:9 | req | src/advanced-routehandler-registration.js:25:6:25:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:25:32:25:34 | req | src/advanced-routehandler-registration.js:25:6:25:35 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:46:20:46:22 | req | src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:46:20:46:22 | req | src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:46:20:46:22 | req | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:46:20:46:22 | req | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:47:27:47:29 | req | src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:47:27:47:29 | req | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:51:10:51:12 | req | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
+| src/advanced-routehandler-registration.js:51:10:51:12 | req | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:51:40:51:42 | req | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:59:20:59:22 | req | src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:59:20:59:22 | req | src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:59:20:59:22 | req | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:59:20:59:22 | req | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:60:18:60:20 | req | src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:60:18:60:20 | req | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:64:10:64:12 | req | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
+| src/advanced-routehandler-registration.js:64:10:64:12 | req | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:64:45:64:47 | req | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:68:13:68:15 | req | src/advanced-routehandler-registration.js:68:12:68:41 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:68:13:68:15 | req | src/advanced-routehandler-registration.js:68:12:68:41 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:68:13:68:15 | req | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:68:13:68:15 | req | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:68:13:68:15 | req | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:68:13:68:15 | req | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:68:38:68:40 | req | src/advanced-routehandler-registration.js:68:12:68:41 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:68:38:68:40 | req | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:68:38:68:40 | req | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:69:20:69:22 | req | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:69:20:69:22 | req | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:69:20:69:22 | req | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:69:20:69:22 | req | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:70:18:70:20 | req | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:70:18:70:20 | req | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:73:10:73:12 | req | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
+| src/advanced-routehandler-registration.js:73:10:73:12 | req | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:73:47:73:49 | req | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) |
 | src/advanced-routehandler-registration.js:81:20:81:22 | req | src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:81:20:81:22 | req | src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:81:20:81:22 | req | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:81:20:81:22 | req | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:82:27:82:29 | req | src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:82:27:82:29 | req | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:92:10:92:12 | req | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
+| src/advanced-routehandler-registration.js:92:10:92:12 | req | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:92:40:92:42 | req | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:100:20:100:22 | req | src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:100:20:100:22 | req | src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } |
+| src/advanced-routehandler-registration.js:100:20:100:22 | req | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:100:20:100:22 | req | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:101:31:101:33 | req | src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } |
 | src/advanced-routehandler-registration.js:101:31:101:33 | req | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:111:10:111:12 | req | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
+| src/advanced-routehandler-registration.js:111:10:111:12 | req | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:111:40:111:42 | req | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") |
 | src/advanced-routehandler-registration.js:123:21:123:23 | req | src/advanced-routehandler-registration.js:123:20:123:49 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:123:21:123:23 | req | src/advanced-routehandler-registration.js:123:20:123:49 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:123:46:123:48 | req | src/advanced-routehandler-registration.js:123:20:123:49 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:124:21:124:23 | req | src/advanced-routehandler-registration.js:124:20:124:49 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:124:21:124:23 | req | src/advanced-routehandler-registration.js:124:20:124:49 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:124:46:124:48 | req | src/advanced-routehandler-registration.js:124:20:124:49 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:146:29:146:31 | req | src/advanced-routehandler-registration.js:146:28:146:50 | (req, r ... defined |
 | src/advanced-routehandler-registration.js:156:22:156:24 | req | src/advanced-routehandler-registration.js:156:21:156:50 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:156:22:156:24 | req | src/advanced-routehandler-registration.js:156:21:156:50 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:156:47:156:49 | req | src/advanced-routehandler-registration.js:156:21:156:50 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:157:28:157:30 | req | src/advanced-routehandler-registration.js:157:27:157:56 | (req, r ... og(req) |
+| src/advanced-routehandler-registration.js:157:28:157:30 | req | src/advanced-routehandler-registration.js:157:27:157:56 | (req, r ... og(req) |
 | src/advanced-routehandler-registration.js:157:53:157:55 | req | src/advanced-routehandler-registration.js:157:27:157:56 | (req, r ... og(req) |
 | src/controllers/handler-in-bulk-require.js:1:45:1:47 | req | src/controllers/handler-in-bulk-require.js:1:44:1:66 | (req, r ... defined |
 | src/csurf-example.js:20:28:20:30 | req | src/csurf-example.js:20:18:23:1 | functio ... () })\\n} |
+| src/csurf-example.js:20:28:20:30 | req | src/csurf-example.js:20:18:23:1 | functio ... () })\\n} |
 | src/csurf-example.js:22:35:22:37 | req | src/csurf-example.js:20:18:23:1 | functio ... () })\\n} |
 | src/csurf-example.js:25:32:25:34 | req | src/csurf-example.js:25:22:27:1 | functio ... ere')\\n} |
 | src/csurf-example.js:32:40:32:42 | req | src/csurf-example.js:32:30:34:3 | functio ... e')\\n  } |
@@ -2612,22 +2705,28 @@ test_RequestExpr
 | src/csurf-example.js:40:37:40:39 | req | src/csurf-example.js:40:27:40:48 | functio ... res) {} |
 | src/exportedHandler.js:1:44:1:46 | req | src/exportedHandler.js:1:19:1:55 | functio ... res) {} |
 | src/express2.js:3:34:3:36 | req | src/express2.js:3:25:3:55 | functio ... , res } |
+| src/express2.js:3:34:3:36 | req | src/express2.js:3:25:3:55 | functio ... , res } |
 | src/express2.js:3:46:3:48 | req | src/express2.js:3:25:3:55 | functio ... , res } |
 | src/express2.js:4:41:4:47 | request | src/express2.js:4:32:4:76 | functio ... esult } |
+| src/express2.js:4:41:4:47 | request | src/express2.js:4:32:4:76 | functio ... esult } |
 | src/express2.js:4:60:4:66 | request | src/express2.js:4:32:4:76 | functio ... esult } |
 | src/express3.js:4:32:4:34 | req | src/express3.js:4:23:7:1 | functio ... al");\\n} |
+| src/express3.js:4:32:4:34 | req | src/express3.js:4:23:7:1 | functio ... al");\\n} |
 | src/express3.js:5:14:5:16 | req | src/express3.js:4:23:7:1 | functio ... al");\\n} |
 | src/express3.js:5:35:5:37 | req | src/express3.js:4:23:7:1 | functio ... al");\\n} |
 | src/express3.js:10:22:10:24 | req | src/express3.js:10:12:10:32 | functio ...  res){} |
 | src/express4.js:4:32:4:34 | req | src/express4.js:4:23:9:1 | functio ... ic1);\\n} |
+| src/express4.js:4:32:4:34 | req | src/express4.js:4:23:9:1 | functio ... ic1);\\n} |
 | src/express4.js:5:27:5:29 | req | src/express4.js:4:23:9:1 | functio ... ic1);\\n} |
 | src/express4.js:6:18:6:20 | req | src/express4.js:4:23:9:1 | functio ... ic1);\\n} |
 | src/express4.js:7:18:7:20 | req | src/express4.js:4:23:9:1 | functio ... ic1);\\n} |
 | src/express.js:4:32:4:34 | req | src/express.js:4:23:9:1 | functio ... res);\\n} |
+| src/express.js:4:32:4:34 | req | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:5:16:5:18 | req | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:6:26:6:28 | req | src/express.js:4:23:9:1 | functio ... res);\\n} |
 | src/express.js:16:28:16:30 | req | src/express.js:16:19:18:3 | functio ... ");\\n  } |
 | src/express.js:22:39:22:41 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
+| src/express.js:22:39:22:41 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:23:3:23:5 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:24:3:24:5 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
 | src/express.js:25:3:25:5 | req | src/express.js:22:30:32:1 | functio ... ar');\\n} |
@@ -2639,47 +2738,60 @@ test_RequestExpr
 | src/express.js:37:22:37:24 | req | src/express.js:37:12:37:32 | functio ...  res){} |
 | src/express.js:42:13:42:15 | req | src/express.js:42:12:42:28 | (req, res) => f() |
 | src/express.js:46:31:46:33 | req | src/express.js:46:22:51:1 | functio ... ame];\\n} |
+| src/express.js:46:31:46:33 | req | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/express.js:47:3:47:5 | req | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/express.js:48:3:48:5 | req | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/express.js:49:3:49:5 | req | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/express.js:50:3:50:5 | req | src/express.js:46:22:51:1 | functio ... ame];\\n} |
 | src/inheritedFromNode.js:4:24:4:26 | req | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} |
+| src/inheritedFromNode.js:4:24:4:26 | req | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} |
 | src/inheritedFromNode.js:7:2:7:4 | req | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} |
 | src/middleware-flow.js:5:20:5:22 | req | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} |
+| src/middleware-flow.js:5:20:5:22 | req | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} |
 | src/middleware-flow.js:6:5:6:7 | req | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} |
 | src/middleware-flow.js:7:5:7:7 | req | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} |
 | src/middleware-flow.js:8:5:8:7 | req | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} |
 | src/middleware-flow.js:17:25:17:27 | req | src/middleware-flow.js:17:24:21:5 | (req, r ... ;\\n    } |
+| src/middleware-flow.js:17:25:17:27 | req | src/middleware-flow.js:17:24:21:5 | (req, r ... ;\\n    } |
 | src/middleware-flow.js:18:9:18:11 | req | src/middleware-flow.js:17:24:21:5 | (req, r ... ;\\n    } |
 | src/middleware-flow.js:19:9:19:11 | req | src/middleware-flow.js:17:24:21:5 | (req, r ... ;\\n    } |
 | src/middleware-flow.js:20:9:20:11 | req | src/middleware-flow.js:17:24:21:5 | (req, r ... ;\\n    } |
 | src/middleware-flow.js:23:18:23:20 | req | src/middleware-flow.js:23:17:23:41 | (req, r ... q.db; } |
+| src/middleware-flow.js:23:18:23:20 | req | src/middleware-flow.js:23:17:23:41 | (req, r ... q.db; } |
 | src/middleware-flow.js:23:33:23:35 | req | src/middleware-flow.js:23:17:23:41 | (req, r ... q.db; } |
 | src/middleware-flow.js:24:18:24:20 | req | src/middleware-flow.js:24:17:24:41 | (req, r ... q.db; } |
+| src/middleware-flow.js:24:18:24:20 | req | src/middleware-flow.js:24:17:24:41 | (req, r ... q.db; } |
 | src/middleware-flow.js:24:33:24:35 | req | src/middleware-flow.js:24:17:24:41 | (req, r ... q.db; } |
 | src/middleware-flow.js:39:24:39:26 | req | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} |
+| src/middleware-flow.js:39:24:39:26 | req | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} |
 | src/middleware-flow.js:40:5:40:7 | req | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} |
 | src/middleware-flow.js:41:5:41:7 | req | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} |
 | src/middleware-flow.js:42:5:42:7 | req | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} |
 | src/params.js:4:19:4:21 | req | src/params.js:4:18:12:1 | (req, r ...     }\\n} |
+| src/params.js:4:19:4:21 | req | src/params.js:4:18:12:1 | (req, r ...     }\\n} |
 | src/params.js:5:17:5:19 | req | src/params.js:4:18:12:1 | (req, r ...     }\\n} |
 | src/params.js:6:17:6:19 | req | src/params.js:4:18:12:1 | (req, r ...     }\\n} |
 | src/params.js:14:33:14:35 | req | src/params.js:14:24:16:1 | functio ... lo");\\n} |
 | src/passport.js:27:13:27:15 | req | src/passport.js:27:4:29:1 | functio ... ccss`\\n} |
+| src/passport.js:27:13:27:15 | req | src/passport.js:27:4:29:1 | functio ... ccss`\\n} |
 | src/passport.js:28:2:28:4 | req | src/passport.js:27:4:29:1 | functio ... ccss`\\n} |
 | src/responseExprs.js:4:32:4:34 | req | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} |
 | src/responseExprs.js:7:32:7:34 | req | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} |
 | src/responseExprs.js:10:39:10:41 | req | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} |
 | src/responseExprs.js:13:32:13:34 | req | src/responseExprs.js:13:23:15:1 | functio ... res4;\\n} |
 | src/responseExprs.js:16:39:16:41 | req | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
+| src/responseExprs.js:16:39:16:41 | req | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
 | src/responseExprs.js:17:5:17:7 | req | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} |
 | src/route-collection.js:2:7:2:9 | req | src/route-collection.js:2:6:2:35 | (req, r ... og(req) |
+| src/route-collection.js:2:7:2:9 | req | src/route-collection.js:2:6:2:35 | (req, r ... og(req) |
 | src/route-collection.js:2:32:2:34 | req | src/route-collection.js:2:6:2:35 | (req, r ... og(req) |
 | src/route-collection.js:3:7:3:9 | req | src/route-collection.js:3:6:3:35 | (req, r ... og(req) |
+| src/route-collection.js:3:7:3:9 | req | src/route-collection.js:3:6:3:35 | (req, r ... og(req) |
 | src/route-collection.js:3:32:3:34 | req | src/route-collection.js:3:6:3:35 | (req, r ... og(req) |
 | src/route.js:5:21:5:23 | req | src/route.js:5:12:5:38 | functio ... ext) {} |
 test_RequestExprStandalone
 | typed_src/tst.ts:5:15:5:15 | x |
+| typed_src/tst.ts:5:15:5:15 | x |
 | typed_src/tst.ts:6:3:6:3 | x |
 test_RouteHandlerExpr_getAsSubRouter
 | src/csurf-example.js:13:17:13:19 | api | src/csurf-example.js:30:16:30:35 | new express.Router() |
@@ -2690,64 +2802,93 @@ test_Credentials
 | src/auth.js:4:39:4:48 | 'passw0rd' | password |
 test_RouteHandler_getARequestExpr
 | src/advanced-routehandler-registration.js:6:6:6:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:6:7:6:9 | req |
+| src/advanced-routehandler-registration.js:6:6:6:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:6:7:6:9 | req |
 | src/advanced-routehandler-registration.js:6:6:6:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:6:32:6:34 | req |
 | src/advanced-routehandler-registration.js:7:6:7:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:7:7:7:9 | req |
+| src/advanced-routehandler-registration.js:7:6:7:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:7:7:7:9 | req |
 | src/advanced-routehandler-registration.js:7:6:7:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:7:32:7:34 | req |
 | src/advanced-routehandler-registration.js:15:6:15:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:15:7:15:9 | req |
+| src/advanced-routehandler-registration.js:15:6:15:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:15:7:15:9 | req |
 | src/advanced-routehandler-registration.js:15:6:15:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:15:32:15:34 | req |
 | src/advanced-routehandler-registration.js:16:6:16:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:16:7:16:9 | req |
+| src/advanced-routehandler-registration.js:16:6:16:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:16:7:16:9 | req |
 | src/advanced-routehandler-registration.js:16:6:16:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:16:32:16:34 | req |
 | src/advanced-routehandler-registration.js:24:6:24:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:24:7:24:9 | req |
+| src/advanced-routehandler-registration.js:24:6:24:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:24:7:24:9 | req |
 | src/advanced-routehandler-registration.js:24:6:24:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:24:32:24:34 | req |
 | src/advanced-routehandler-registration.js:25:6:25:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:25:7:25:9 | req |
+| src/advanced-routehandler-registration.js:25:6:25:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:25:7:25:9 | req |
 | src/advanced-routehandler-registration.js:25:6:25:35 | (req, r ... og(req) | src/advanced-routehandler-registration.js:25:32:25:34 | req |
 | src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:46:20:46:22 | req |
+| src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:46:20:46:22 | req |
 | src/advanced-routehandler-registration.js:46:11:48:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:47:27:47:29 | req |
 | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:46:20:46:22 | req |
+| src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:46:20:46:22 | req |
 | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:47:27:47:29 | req |
 | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:51:10:51:12 | req |
+| src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:51:10:51:12 | req |
 | src/advanced-routehandler-registration.js:51:9:51:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:51:40:51:42 | req |
 | src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:59:20:59:22 | req |
+| src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:59:20:59:22 | req |
 | src/advanced-routehandler-registration.js:59:11:61:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:60:18:60:20 | req |
 | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:59:20:59:22 | req |
+| src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:59:20:59:22 | req |
 | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:60:18:60:20 | req |
 | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:64:10:64:12 | req |
+| src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:64:10:64:12 | req |
 | src/advanced-routehandler-registration.js:64:9:64:53 | (req, r ... q, res) | src/advanced-routehandler-registration.js:64:45:64:47 | req |
 | src/advanced-routehandler-registration.js:68:12:68:41 | (req, r ... og(req) | src/advanced-routehandler-registration.js:68:13:68:15 | req |
+| src/advanced-routehandler-registration.js:68:12:68:41 | (req, r ... og(req) | src/advanced-routehandler-registration.js:68:13:68:15 | req |
 | src/advanced-routehandler-registration.js:68:12:68:41 | (req, r ... og(req) | src/advanced-routehandler-registration.js:68:38:68:40 | req |
 | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:68:13:68:15 | req |
+| src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:68:13:68:15 | req |
 | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:68:38:68:40 | req |
 | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:69:20:69:22 | req |
+| src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:69:20:69:22 | req |
 | src/advanced-routehandler-registration.js:69:11:71:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:70:18:70:20 | req |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:68:13:68:15 | req |
+| src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:68:13:68:15 | req |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:68:38:68:40 | req |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:69:20:69:22 | req |
+| src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:69:20:69:22 | req |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:70:18:70:20 | req |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:73:10:73:12 | req |
+| src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:73:10:73:12 | req |
 | src/advanced-routehandler-registration.js:73:9:73:55 | (req, r ... q, res) | src/advanced-routehandler-registration.js:73:47:73:49 | req |
 | src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:81:20:81:22 | req |
+| src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:81:20:81:22 | req |
 | src/advanced-routehandler-registration.js:81:11:83:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:82:27:82:29 | req |
 | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:81:20:81:22 | req |
+| src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:81:20:81:22 | req |
 | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:82:27:82:29 | req |
 | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:92:10:92:12 | req |
+| src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:92:10:92:12 | req |
 | src/advanced-routehandler-registration.js:92:9:92:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:92:40:92:42 | req |
 | src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:100:20:100:22 | req |
+| src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:100:20:100:22 | req |
 | src/advanced-routehandler-registration.js:100:11:102:3 | functio ... s);\\n  } | src/advanced-routehandler-registration.js:101:31:101:33 | req |
 | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:100:20:100:22 | req |
+| src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:100:20:100:22 | req |
 | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:101:31:101:33 | req |
 | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:111:10:111:12 | req |
+| src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:111:10:111:12 | req |
 | src/advanced-routehandler-registration.js:111:9:111:60 | (req, r ... tever") | src/advanced-routehandler-registration.js:111:40:111:42 | req |
 | src/advanced-routehandler-registration.js:123:20:123:49 | (req, r ... og(req) | src/advanced-routehandler-registration.js:123:21:123:23 | req |
+| src/advanced-routehandler-registration.js:123:20:123:49 | (req, r ... og(req) | src/advanced-routehandler-registration.js:123:21:123:23 | req |
 | src/advanced-routehandler-registration.js:123:20:123:49 | (req, r ... og(req) | src/advanced-routehandler-registration.js:123:46:123:48 | req |
 | src/advanced-routehandler-registration.js:124:20:124:49 | (req, r ... og(req) | src/advanced-routehandler-registration.js:124:21:124:23 | req |
+| src/advanced-routehandler-registration.js:124:20:124:49 | (req, r ... og(req) | src/advanced-routehandler-registration.js:124:21:124:23 | req |
 | src/advanced-routehandler-registration.js:124:20:124:49 | (req, r ... og(req) | src/advanced-routehandler-registration.js:124:46:124:48 | req |
 | src/advanced-routehandler-registration.js:146:28:146:50 | (req, r ... defined | src/advanced-routehandler-registration.js:146:29:146:31 | req |
 | src/advanced-routehandler-registration.js:156:21:156:50 | (req, r ... og(req) | src/advanced-routehandler-registration.js:156:22:156:24 | req |
+| src/advanced-routehandler-registration.js:156:21:156:50 | (req, r ... og(req) | src/advanced-routehandler-registration.js:156:22:156:24 | req |
 | src/advanced-routehandler-registration.js:156:21:156:50 | (req, r ... og(req) | src/advanced-routehandler-registration.js:156:47:156:49 | req |
 | src/advanced-routehandler-registration.js:157:27:157:56 | (req, r ... og(req) | src/advanced-routehandler-registration.js:157:28:157:30 | req |
+| src/advanced-routehandler-registration.js:157:27:157:56 | (req, r ... og(req) | src/advanced-routehandler-registration.js:157:28:157:30 | req |
 | src/advanced-routehandler-registration.js:157:27:157:56 | (req, r ... og(req) | src/advanced-routehandler-registration.js:157:53:157:55 | req |
 | src/controllers/handler-in-bulk-require.js:1:44:1:66 | (req, r ... defined | src/controllers/handler-in-bulk-require.js:1:45:1:47 | req |
 | src/csurf-example.js:20:18:23:1 | functio ... () })\\n} | src/csurf-example.js:20:28:20:30 | req |
+| src/csurf-example.js:20:18:23:1 | functio ... () })\\n} | src/csurf-example.js:20:28:20:30 | req |
 | src/csurf-example.js:20:18:23:1 | functio ... () })\\n} | src/csurf-example.js:22:35:22:37 | req |
 | src/csurf-example.js:25:22:27:1 | functio ... ere')\\n} | src/csurf-example.js:25:32:25:34 | req |
 | src/csurf-example.js:32:30:34:3 | functio ... e')\\n  } | src/csurf-example.js:32:40:32:42 | req |
@@ -2755,22 +2896,28 @@ test_RouteHandler_getARequestExpr
 | src/csurf-example.js:40:27:40:48 | functio ... res) {} | src/csurf-example.js:40:37:40:39 | req |
 | src/exportedHandler.js:1:19:1:55 | functio ... res) {} | src/exportedHandler.js:1:44:1:46 | req |
 | src/express2.js:3:25:3:55 | functio ... , res } | src/express2.js:3:34:3:36 | req |
+| src/express2.js:3:25:3:55 | functio ... , res } | src/express2.js:3:34:3:36 | req |
 | src/express2.js:3:25:3:55 | functio ... , res } | src/express2.js:3:46:3:48 | req |
 | src/express2.js:4:32:4:76 | functio ... esult } | src/express2.js:4:41:4:47 | request |
+| src/express2.js:4:32:4:76 | functio ... esult } | src/express2.js:4:41:4:47 | request |
 | src/express2.js:4:32:4:76 | functio ... esult } | src/express2.js:4:60:4:66 | request |
 | src/express3.js:4:23:7:1 | functio ... al");\\n} | src/express3.js:4:32:4:34 | req |
+| src/express3.js:4:23:7:1 | functio ... al");\\n} | src/express3.js:4:32:4:34 | req |
 | src/express3.js:4:23:7:1 | functio ... al");\\n} | src/express3.js:5:14:5:16 | req |
 | src/express3.js:4:23:7:1 | functio ... al");\\n} | src/express3.js:5:35:5:37 | req |
 | src/express3.js:10:12:10:32 | functio ...  res){} | src/express3.js:10:22:10:24 | req |
 | src/express4.js:4:23:9:1 | functio ... ic1);\\n} | src/express4.js:4:32:4:34 | req |
+| src/express4.js:4:23:9:1 | functio ... ic1);\\n} | src/express4.js:4:32:4:34 | req |
 | src/express4.js:4:23:9:1 | functio ... ic1);\\n} | src/express4.js:5:27:5:29 | req |
 | src/express4.js:4:23:9:1 | functio ... ic1);\\n} | src/express4.js:6:18:6:20 | req |
 | src/express4.js:4:23:9:1 | functio ... ic1);\\n} | src/express4.js:7:18:7:20 | req |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:4:32:4:34 | req |
+| src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:4:32:4:34 | req |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:5:16:5:18 | req |
 | src/express.js:4:23:9:1 | functio ... res);\\n} | src/express.js:6:26:6:28 | req |
 | src/express.js:16:19:18:3 | functio ... ");\\n  } | src/express.js:16:28:16:30 | req |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:22:39:22:41 | req |
+| src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:22:39:22:41 | req |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:23:3:23:5 | req |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:24:3:24:5 | req |
 | src/express.js:22:30:32:1 | functio ... ar');\\n} | src/express.js:25:3:25:5 | req |
@@ -2782,43 +2929,55 @@ test_RouteHandler_getARequestExpr
 | src/express.js:37:12:37:32 | functio ...  res){} | src/express.js:37:22:37:24 | req |
 | src/express.js:42:12:42:28 | (req, res) => f() | src/express.js:42:13:42:15 | req |
 | src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:46:31:46:33 | req |
+| src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:46:31:46:33 | req |
 | src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:47:3:47:5 | req |
 | src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:48:3:48:5 | req |
 | src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:49:3:49:5 | req |
 | src/express.js:46:22:51:1 | functio ... ame];\\n} | src/express.js:50:3:50:5 | req |
 | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} | src/inheritedFromNode.js:4:24:4:26 | req |
+| src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} | src/inheritedFromNode.js:4:24:4:26 | req |
 | src/inheritedFromNode.js:4:15:8:1 | functio ... .url;\\n} | src/inheritedFromNode.js:7:2:7:4 | req |
 | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} | src/middleware-flow.js:5:20:5:22 | req |
+| src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} | src/middleware-flow.js:5:20:5:22 | req |
 | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} | src/middleware-flow.js:6:5:6:7 | req |
 | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} | src/middleware-flow.js:7:5:7:7 | req |
 | src/middleware-flow.js:5:1:10:1 | functio ... xt();\\n} | src/middleware-flow.js:8:5:8:7 | req |
 | src/middleware-flow.js:17:24:21:5 | (req, r ... ;\\n    } | src/middleware-flow.js:17:25:17:27 | req |
+| src/middleware-flow.js:17:24:21:5 | (req, r ... ;\\n    } | src/middleware-flow.js:17:25:17:27 | req |
 | src/middleware-flow.js:17:24:21:5 | (req, r ... ;\\n    } | src/middleware-flow.js:18:9:18:11 | req |
 | src/middleware-flow.js:17:24:21:5 | (req, r ... ;\\n    } | src/middleware-flow.js:19:9:19:11 | req |
 | src/middleware-flow.js:17:24:21:5 | (req, r ... ;\\n    } | src/middleware-flow.js:20:9:20:11 | req |
 | src/middleware-flow.js:23:17:23:41 | (req, r ... q.db; } | src/middleware-flow.js:23:18:23:20 | req |
+| src/middleware-flow.js:23:17:23:41 | (req, r ... q.db; } | src/middleware-flow.js:23:18:23:20 | req |
 | src/middleware-flow.js:23:17:23:41 | (req, r ... q.db; } | src/middleware-flow.js:23:33:23:35 | req |
 | src/middleware-flow.js:24:17:24:41 | (req, r ... q.db; } | src/middleware-flow.js:24:18:24:20 | req |
+| src/middleware-flow.js:24:17:24:41 | (req, r ... q.db; } | src/middleware-flow.js:24:18:24:20 | req |
 | src/middleware-flow.js:24:17:24:41 | (req, r ... q.db; } | src/middleware-flow.js:24:33:24:35 | req |
 | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} | src/middleware-flow.js:39:24:39:26 | req |
+| src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} | src/middleware-flow.js:39:24:39:26 | req |
 | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} | src/middleware-flow.js:40:5:40:7 | req |
 | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} | src/middleware-flow.js:41:5:41:7 | req |
 | src/middleware-flow.js:39:23:43:1 | (req, r ... s.db;\\n} | src/middleware-flow.js:42:5:42:7 | req |
 | src/params.js:4:18:12:1 | (req, r ...     }\\n} | src/params.js:4:19:4:21 | req |
+| src/params.js:4:18:12:1 | (req, r ...     }\\n} | src/params.js:4:19:4:21 | req |
 | src/params.js:4:18:12:1 | (req, r ...     }\\n} | src/params.js:5:17:5:19 | req |
 | src/params.js:4:18:12:1 | (req, r ...     }\\n} | src/params.js:6:17:6:19 | req |
 | src/params.js:14:24:16:1 | functio ... lo");\\n} | src/params.js:14:33:14:35 | req |
 | src/passport.js:27:4:29:1 | functio ... ccss`\\n} | src/passport.js:27:13:27:15 | req |
+| src/passport.js:27:4:29:1 | functio ... ccss`\\n} | src/passport.js:27:13:27:15 | req |
 | src/passport.js:27:4:29:1 | functio ... ccss`\\n} | src/passport.js:28:2:28:4 | req |
 | src/responseExprs.js:4:23:6:1 | functio ...  res1\\n} | src/responseExprs.js:4:32:4:34 | req |
 | src/responseExprs.js:7:23:9:1 | functio ... res2;\\n} | src/responseExprs.js:7:32:7:34 | req |
 | src/responseExprs.js:10:23:12:1 | functio ... res3;\\n} | src/responseExprs.js:10:39:10:41 | req |
 | src/responseExprs.js:13:23:15:1 | functio ... res4;\\n} | src/responseExprs.js:13:32:13:34 | req |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:16:39:16:41 | req |
+| src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:16:39:16:41 | req |
 | src/responseExprs.js:16:30:42:1 | functio ...     }\\n} | src/responseExprs.js:17:5:17:7 | req |
 | src/route-collection.js:2:6:2:35 | (req, r ... og(req) | src/route-collection.js:2:7:2:9 | req |
+| src/route-collection.js:2:6:2:35 | (req, r ... og(req) | src/route-collection.js:2:7:2:9 | req |
 | src/route-collection.js:2:6:2:35 | (req, r ... og(req) | src/route-collection.js:2:32:2:34 | req |
 | src/route-collection.js:3:6:3:35 | (req, r ... og(req) | src/route-collection.js:3:7:3:9 | req |
+| src/route-collection.js:3:6:3:35 | (req, r ... og(req) | src/route-collection.js:3:7:3:9 | req |
 | src/route-collection.js:3:6:3:35 | (req, r ... og(req) | src/route-collection.js:3:32:3:34 | req |
 | src/route.js:5:12:5:38 | functio ... ext) {} | src/route.js:5:21:5:23 | req |
 getRouteHandlerContainerStep
diff --git a/javascript/ql/test/library-tests/frameworks/Express/tests.ql b/javascript/ql/test/library-tests/frameworks/Express/tests.ql
index ec76c73df27..d708732267a 100644
--- a/javascript/ql/test/library-tests/frameworks/Express/tests.ql
+++ b/javascript/ql/test/library-tests/frameworks/Express/tests.ql
@@ -27,7 +27,6 @@ import RouterDefinition_getASubRouter
 import HeaderDefinition_getNameExpr
 import appCreation
 import RouteSetup_getRequestMethod
-import RouteExpr
 import RouteHandler_getAResponseExpr
 import isResponse
 import ResponseBody
diff --git a/javascript/ql/test/library-tests/frameworks/Firebase/tests.ql b/javascript/ql/test/library-tests/frameworks/Firebase/tests.ql
index 5cc891ec78c..13f4a097102 100644
--- a/javascript/ql/test/library-tests/frameworks/Firebase/tests.ql
+++ b/javascript/ql/test/library-tests/frameworks/Firebase/tests.ql
@@ -6,8 +6,8 @@ query predicate firebaseSnapshot(DataFlow::SourceNode snap) { snap = Firebase::s
 
 query predicate firebaseVal(Firebase::FirebaseVal val) { any() }
 
-query predicate requestInputAccess(HTTP::RequestInputAccess acc) { any() }
+query predicate requestInputAccess(Http::RequestInputAccess acc) { any() }
 
-query predicate responseSendArgument(HTTP::ResponseSendArgument send) { any() }
+query predicate responseSendArgument(Http::ResponseSendArgument send) { any() }
 
-query predicate routeHandler(HTTP::RouteHandler handler) { any() }
+query predicate routeHandler(Http::RouteHandler handler) { any() }
diff --git a/javascript/ql/test/library-tests/frameworks/GWT/GWTGeneratedTopLevel.ql b/javascript/ql/test/library-tests/frameworks/GWT/GWTGeneratedTopLevel.ql
index bc3d25d7e2d..335086bd7de 100644
--- a/javascript/ql/test/library-tests/frameworks/GWT/GWTGeneratedTopLevel.ql
+++ b/javascript/ql/test/library-tests/frameworks/GWT/GWTGeneratedTopLevel.ql
@@ -1,4 +1,4 @@
 import semmle.javascript.frameworks.GWT
 
-from GWTGeneratedTopLevel g
+from GwtGeneratedTopLevel g
 select g
diff --git a/javascript/ql/test/library-tests/frameworks/GWT/GWTHeader.ql b/javascript/ql/test/library-tests/frameworks/GWT/GWTHeader.ql
index 14a5da47e4a..c504c8ca7bd 100644
--- a/javascript/ql/test/library-tests/frameworks/GWT/GWTHeader.ql
+++ b/javascript/ql/test/library-tests/frameworks/GWT/GWTHeader.ql
@@ -1,4 +1,4 @@
 import semmle.javascript.frameworks.GWT
 
-from GWTHeader h
+from GwtHeader h
 select h
diff --git a/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/AdditionalRouteHandlers.ql b/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/AdditionalRouteHandlers.ql
index 6f35b3854d3..d91d43b7cde 100644
--- a/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/AdditionalRouteHandlers.ql
+++ b/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/AdditionalRouteHandlers.ql
@@ -1,5 +1,5 @@
 import javascript
 private import semmle.javascript.heuristics.AdditionalRouteHandlers
 
-from HTTP::RouteHandler rh
+from Http::RouteHandler rh
 select rh
diff --git a/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/tests.ql b/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/tests.ql
index ce0066ac8df..c85948e7552 100644
--- a/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/tests.ql
+++ b/javascript/ql/test/library-tests/frameworks/HTTP-heuristics/tests.ql
@@ -1,9 +1,9 @@
 import javascript
 
-query predicate routeHandler(HTTP::RouteHandler rh) { any() }
+query predicate routeHandler(Http::RouteHandler rh) { any() }
 
-query predicate routeHandlerCandidate(HTTP::RouteHandlerCandidate rh) { any() }
+query predicate routeHandlerCandidate(Http::RouteHandlerCandidate rh) { any() }
 
-query predicate routeSetup(HTTP::RouteSetup rh) { any() }
+query predicate routeSetup(Http::RouteSetup rh) { any() }
 
-query predicate routeSetupCandidate(HTTP::RouteSetupCandidate rh) { any() }
+query predicate routeSetupCandidate(Http::RouteSetupCandidate rh) { any() }
diff --git a/javascript/ql/test/library-tests/frameworks/HTTP/RemoteRequestInput.ql b/javascript/ql/test/library-tests/frameworks/HTTP/RemoteRequestInput.ql
index 8d8e4ab0362..03699197e14 100644
--- a/javascript/ql/test/library-tests/frameworks/HTTP/RemoteRequestInput.ql
+++ b/javascript/ql/test/library-tests/frameworks/HTTP/RemoteRequestInput.ql
@@ -1,4 +1,4 @@
 import javascript
 
-from HTTP::RequestInputAccess input
+from Http::RequestInputAccess input
 select input, input.getKind()
diff --git a/javascript/ql/test/library-tests/frameworks/HTTP/ResponseBody.ql b/javascript/ql/test/library-tests/frameworks/HTTP/ResponseBody.ql
index 7723b4e284b..ab7aa08ea08 100644
--- a/javascript/ql/test/library-tests/frameworks/HTTP/ResponseBody.ql
+++ b/javascript/ql/test/library-tests/frameworks/HTTP/ResponseBody.ql
@@ -1,4 +1,4 @@
 import javascript
 
-from HTTP::ResponseBody rb
+from Http::ResponseBody rb
 select rb
diff --git a/javascript/ql/test/library-tests/frameworks/Micro/TestMicro.ql b/javascript/ql/test/library-tests/frameworks/Micro/TestMicro.ql
index 97f4d7caf1e..56bf865f138 100644
--- a/javascript/ql/test/library-tests/frameworks/Micro/TestMicro.ql
+++ b/javascript/ql/test/library-tests/frameworks/Micro/TestMicro.ql
@@ -1,17 +1,17 @@
 import javascript
 
-query HTTP::RouteHandler routeHandler() { any() }
+query Http::RouteHandler routeHandler() { any() }
 
-query HTTP::Servers::RequestSource requestSource() { any() }
+query Http::Servers::RequestSource requestSource() { any() }
 
-query HTTP::Servers::ResponseSource responseSource() { any() }
+query Http::Servers::ResponseSource responseSource() { any() }
 
-query HTTP::RequestInputAccess requestInputAccess(string kind) { kind = result.getKind() }
+query Http::RequestInputAccess requestInputAccess(string kind) { kind = result.getKind() }
 
-query HTTP::RequestInputAccess userControlledObject() { result.isUserControlledObject() }
+query Http::RequestInputAccess userControlledObject() { result.isUserControlledObject() }
 
-query HTTP::ResponseSendArgument responseSendArgument() { any() }
+query Http::ResponseSendArgument responseSendArgument() { any() }
 
-query HTTP::ResponseSendArgument responseSendArgumentHandler(HTTP::RouteHandler h) {
+query Http::ResponseSendArgument responseSendArgumentHandler(Http::RouteHandler h) {
   h = result.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Nest/test.ql b/javascript/ql/test/library-tests/frameworks/Nest/test.ql
index 120727d2548..898d244bed2 100644
--- a/javascript/ql/test/library-tests/frameworks/Nest/test.ql
+++ b/javascript/ql/test/library-tests/frameworks/Nest/test.ql
@@ -1,19 +1,19 @@
 import javascript
 private import semmle.javascript.security.dataflow.ServerSideUrlRedirectCustomizations
 
-query HTTP::RouteHandler routeHandler() { any() }
+query Http::RouteHandler routeHandler() { any() }
 
-query HTTP::Servers::RequestSource requestSource() { any() }
+query Http::Servers::RequestSource requestSource() { any() }
 
-query HTTP::Servers::ResponseSource responseSource() { any() }
+query Http::Servers::ResponseSource responseSource() { any() }
 
 query RemoteFlowSource requestInputAccess(string kind) {
-  kind = result.(HTTP::RequestInputAccess).getKind()
+  kind = result.(Http::RequestInputAccess).getKind()
   or
-  not result instanceof HTTP::RequestInputAccess and
+  not result instanceof Http::RequestInputAccess and
   kind = "RemoteFlowSource"
 }
 
-query HTTP::ResponseSendArgument responseSendArgument() { any() }
+query Http::ResponseSendArgument responseSendArgument() { any() }
 
 query ServerSideUrlRedirect::Sink redirectSink() { any() }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderAccess.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderAccess.qll
index 22d1d6aee53..69d34318ae1 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderAccess.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderAccess(HTTP::RequestHeaderAccess access, string res) {
+query predicate test_HeaderAccess(Http::RequestHeaderAccess access, string res) {
   res = access.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition.qll
index c1255a117c0..ec753397e68 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition(HTTP::HeaderDefinition hd, NodeJSLib::RouteHandler rh) {
+query predicate test_HeaderDefinition(Http::HeaderDefinition hd, NodeJSLib::RouteHandler rh) {
   rh = hd.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_defines.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_defines.qll
index a07c98b46be..1bc5d691f70 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_defines.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_defines.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_defines(HTTP::HeaderDefinition hd, string name, string value) {
+query predicate test_HeaderDefinition_defines(Http::HeaderDefinition hd, string name, string value) {
   hd.defines(name, value) and hd.getRouteHandler() instanceof NodeJSLib::RouteHandler
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_getAHeaderName.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_getAHeaderName.qll
index 7fcda812700..69b5623bd08 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_getAHeaderName.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_getAHeaderName.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_getAHeaderName(HTTP::HeaderDefinition hd, string res) {
+query predicate test_HeaderDefinition_getAHeaderName(Http::HeaderDefinition hd, string res) {
   hd.getRouteHandler() instanceof NodeJSLib::RouteHandler and res = hd.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_getNameExpr.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_getNameExpr.qll
index 87f73f43770..4e1c2c5364d 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_getNameExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/HeaderDefinition_getNameExpr.qll
@@ -1,5 +1,7 @@
 import javascript
 
-query predicate test_HeaderDefinition_getNameExpr(HTTP::ExplicitHeaderDefinition hd, Expr res) {
-  hd.getRouteHandler() instanceof NodeJSLib::RouteHandler and res = hd.getNameExpr()
+query predicate test_HeaderDefinition_getNameExpr(
+  Http::ExplicitHeaderDefinition hd, DataFlow::Node res
+) {
+  hd.getRouteHandler() instanceof NodeJSLib::RouteHandler and res = hd.getNameNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RequestExpr.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RequestExpr.qll
index 50db052e625..b9f4176406d 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RequestExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RequestExpr(NodeJSLib::RequestExpr e, HTTP::RouteHandler res) {
+query predicate test_RequestExpr(NodeJSLib::RequestNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RequestInputAccess.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RequestInputAccess.qll
index 7134c96d028..2234da53435 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RequestInputAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RequestInputAccess.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RequestInputAccess(
-  HTTP::RequestInputAccess ria, string res, NodeJSLib::RouteHandler rh
+  Http::RequestInputAccess ria, string res, NodeJSLib::RouteHandler rh
 ) {
   ria.getRouteHandler() = rh and res = ria.getKind()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/ResponseExpr.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/ResponseExpr.qll
index 106b07d9006..b8884efa167 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/ResponseExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/ResponseExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_ResponseExpr(NodeJSLib::ResponseExpr e, HTTP::RouteHandler res) {
+query predicate test_ResponseExpr(NodeJSLib::ResponseNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/ResponseSendArgument.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/ResponseSendArgument.qll
index 7d859f4d569..890cc9f92fe 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/ResponseSendArgument.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/ResponseSendArgument.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_ResponseSendArgument(
-  HTTP::ResponseSendArgument send, NodeJSLib::RouteHandler rh
+  Http::ResponseSendArgument send, NodeJSLib::RouteHandler rh
 ) {
   rh = send.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler.qll
index 61f7f8dea0e..9114d2d48f1 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler.qll
@@ -1,3 +1,5 @@
 import javascript
 
-query predicate test_RouteHandler(NodeJSLib::RouteHandler rh, Expr res) { res = rh.getServer() }
+query predicate test_RouteHandler(NodeJSLib::RouteHandler rh, DataFlow::Node res) {
+  res = rh.getServer()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getARequestExpr.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getARequestExpr.qll
index e43789bb1a7..b1080b85811 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getARequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getARequestExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RouteHandler_getARequestExpr(NodeJSLib::RouteHandler rh, HTTP::RequestExpr res) {
-  res = rh.getARequestExpr()
+query predicate test_RouteHandler_getARequestExpr(NodeJSLib::RouteHandler rh, Http::RequestNode res) {
+  res = rh.getARequestNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getAResponseExpr.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getAResponseExpr.qll
index fcef32d90e9..05d27f18222 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getAResponseExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getAResponseExpr.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RouteHandler_getAResponseExpr(
-  NodeJSLib::RouteHandler rh, HTTP::ResponseExpr res
+  NodeJSLib::RouteHandler rh, Http::ResponseNode res
 ) {
-  res = rh.getAResponseExpr()
+  res = rh.getAResponseNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getAResponseHeader.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getAResponseHeader.qll
index 6733b1bd917..1c14fc6ac11 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getAResponseHeader.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteHandler_getAResponseHeader.qll
@@ -1,7 +1,7 @@
 import semmle.javascript.frameworks.Express
 
 query predicate test_RouteHandler_getAResponseHeader(
-  NodeJSLib::RouteHandler rh, string name, HTTP::HeaderDefinition res
+  NodeJSLib::RouteHandler rh, string name, Http::HeaderDefinition res
 ) {
   res = rh.getAResponseHeader(name)
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteSetup_getServer.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteSetup_getServer.qll
index a10c7e0da8e..24dfd61fb66 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteSetup_getServer.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/RouteSetup_getServer.qll
@@ -1,3 +1,5 @@
 import javascript
 
-query predicate test_RouteSetup_getServer(NodeJSLib::RouteSetup r, Expr res) { res = r.getServer() }
+query predicate test_RouteSetup_getServer(NodeJSLib::RouteSetup r, DataFlow::Node res) {
+  res = r.getServer()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/ServerDefinition_getARouteHandler.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/ServerDefinition_getARouteHandler.qll
index 1902689a53e..900b632faed 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/ServerDefinition_getARouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/ServerDefinition_getARouteHandler.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_ServerDefinition_getARouteHandler(
-  NodeJSLib::ServerDefinition s, HTTP::RouteHandler res
+  NodeJSLib::ServerDefinition s, Http::RouteHandler res
 ) {
   res = s.getARouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/isCreateServer.qll b/javascript/ql/test/library-tests/frameworks/NodeJSLib/isCreateServer.qll
index 86bcb37b728..aacfe28ae28 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/isCreateServer.qll
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/isCreateServer.qll
@@ -1,3 +1,3 @@
 import javascript
 
-query predicate test_isCreateServer(CallExpr e) { NodeJSLib::isCreateServer(e) }
+query predicate test_isCreateServer(DataFlow::CallNode e) { NodeJSLib::isCreateServer(e) }
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/tests.expected b/javascript/ql/test/library-tests/frameworks/NodeJSLib/tests.expected
index 49655c0ffa3..7d2d6abfddb 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/tests.expected
@@ -27,6 +27,7 @@ test_RouteHandler_getAResponseHeader
 | src/http.js:12:19:16:1 | functio ... ar");\\n} | content-type | src/http.js:13:3:13:44 | res.set ... /html') |
 | src/https.js:4:33:10:1 | functio ... .foo;\\n} | location | src/https.js:7:3:7:42 | res.wri ... rget }) |
 | src/https.js:12:20:16:1 | functio ... ar");\\n} | content-type | src/https.js:13:3:13:44 | res.set ... /html') |
+| src/indirect2.js:9:1:11:1 | functio ... res);\\n} | content-type | src/indirect2.js:14:3:14:51 | res.set ... /json') |
 | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} | content-type | src/indirect2.js:14:3:14:51 | res.set ... /json') |
 test_HeaderDefinition_defines
 | src/http.js:13:3:13:44 | res.set ... /html') | content-type | text/html |
@@ -44,40 +45,61 @@ test_ResponseExpr
 | createServer.js:3:38:3:40 | res | createServer.js:3:23:3:44 | functio ... res) {} |
 | createServer.js:4:37:4:39 | res | createServer.js:4:31:4:46 | (req, res) => {} |
 | createServer.js:25:52:25:54 | res | createServer.js:25:37:27:5 | functio ... ;\\n    } |
+| createServer.js:25:52:25:54 | res | createServer.js:25:37:27:5 | functio ... ;\\n    } |
 | createServer.js:26:9:26:11 | res | createServer.js:25:37:27:5 | functio ... ;\\n    } |
 | src/http.js:4:46:4:48 | res | src/http.js:4:32:10:1 | functio ... .foo;\\n} |
+| src/http.js:4:46:4:48 | res | src/http.js:4:32:10:1 | functio ... .foo;\\n} |
 | src/http.js:7:3:7:5 | res | src/http.js:4:32:10:1 | functio ... .foo;\\n} |
 | src/http.js:12:33:12:35 | res | src/http.js:12:19:16:1 | functio ... ar");\\n} |
+| src/http.js:12:33:12:35 | res | src/http.js:12:19:16:1 | functio ... ar");\\n} |
 | src/http.js:13:3:13:5 | res | src/http.js:12:19:16:1 | functio ... ar");\\n} |
 | src/http.js:14:3:14:5 | res | src/http.js:12:19:16:1 | functio ... ar");\\n} |
 | src/http.js:15:3:15:5 | res | src/http.js:12:19:16:1 | functio ... ar");\\n} |
 | src/http.js:55:25:55:27 | res | src/http.js:55:12:55:30 | function(req,res){} |
 | src/http.js:60:27:60:29 | res | src/http.js:60:14:60:32 | function(req,res){} |
 | src/http.js:62:33:62:35 | res | src/http.js:62:19:65:1 | functio ... r2");\\n} |
+| src/http.js:62:33:62:35 | res | src/http.js:62:19:65:1 | functio ... r2");\\n} |
 | src/http.js:63:3:63:5 | res | src/http.js:62:19:65:1 | functio ... r2");\\n} |
 | src/http.js:64:3:64:5 | res | src/http.js:62:19:65:1 | functio ... r2");\\n} |
 | src/http.js:68:17:68:19 | res | src/http.js:68:12:68:27 | (req,res) => f() |
 | src/http.js:72:34:72:36 | res | src/http.js:72:19:76:1 | functio ... \\n  })\\n} |
+| src/http.js:72:34:72:36 | res | src/http.js:72:19:76:1 | functio ... \\n  })\\n} |
+| src/http.js:72:34:72:36 | res | src/http.js:72:19:76:1 | functio ... \\n  })\\n} |
+| src/http.js:73:18:73:17 | res | src/http.js:72:19:76:1 | functio ... \\n  })\\n} |
 | src/http.js:74:5:74:7 | res | src/http.js:72:19:76:1 | functio ... \\n  })\\n} |
 | src/http.js:81:46:81:48 | res | src/http.js:81:22:86:1 | functio ... la");\\n} |
+| src/http.js:81:46:81:48 | res | src/http.js:81:22:86:1 | functio ... la");\\n} |
+| src/http.js:81:46:81:48 | res | src/http.js:81:22:86:1 | functio ... la");\\n} |
+| src/http.js:82:18:82:17 | res | src/http.js:81:22:86:1 | functio ... la");\\n} |
 | src/http.js:83:5:83:7 | res | src/http.js:81:22:86:1 | functio ... la");\\n} |
 | src/http.js:85:3:85:5 | res | src/http.js:81:22:86:1 | functio ... la");\\n} |
 | src/https.js:4:47:4:49 | res | src/https.js:4:33:10:1 | functio ... .foo;\\n} |
+| src/https.js:4:47:4:49 | res | src/https.js:4:33:10:1 | functio ... .foo;\\n} |
 | src/https.js:7:3:7:5 | res | src/https.js:4:33:10:1 | functio ... .foo;\\n} |
 | src/https.js:12:34:12:36 | res | src/https.js:12:20:16:1 | functio ... ar");\\n} |
+| src/https.js:12:34:12:36 | res | src/https.js:12:20:16:1 | functio ... ar");\\n} |
 | src/https.js:13:3:13:5 | res | src/https.js:12:20:16:1 | functio ... ar");\\n} |
 | src/https.js:14:3:14:5 | res | src/https.js:12:20:16:1 | functio ... ar");\\n} |
 | src/https.js:15:3:15:5 | res | src/https.js:12:20:16:1 | functio ... ar");\\n} |
 | src/indirect2.js:9:19:9:21 | res | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
+| src/indirect2.js:9:19:9:21 | res | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
 | src/indirect2.js:10:47:10:49 | res | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
+| src/indirect2.js:13:33:13:35 | res | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
+| src/indirect2.js:13:33:13:35 | res | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
 | src/indirect2.js:13:33:13:35 | res | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} |
+| src/indirect2.js:13:33:13:35 | res | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} |
+| src/indirect2.js:14:3:14:5 | res | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
 | src/indirect2.js:14:3:14:5 | res | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} |
+| src/indirect2.js:15:3:15:5 | res | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
 | src/indirect2.js:15:3:15:5 | res | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} |
 | src/indirect.js:16:26:16:28 | res | src/indirect.js:16:12:20:5 | functio ... ;\\n    } |
+| src/indirect.js:16:26:16:28 | res | src/indirect.js:16:12:20:5 | functio ... ;\\n    } |
 | src/indirect.js:19:38:19:40 | res | src/indirect.js:16:12:20:5 | functio ... ;\\n    } |
 | src/indirect.js:25:30:25:32 | res | src/indirect.js:25:24:27:3 | (req, r ... ");\\n  } |
+| src/indirect.js:25:30:25:32 | res | src/indirect.js:25:24:27:3 | (req, r ... ");\\n  } |
 | src/indirect.js:26:5:26:7 | res | src/indirect.js:25:24:27:3 | (req, r ... ");\\n  } |
 | src/indirect.js:28:29:28:31 | res | src/indirect.js:28:15:30:3 | functio ... ");\\n  } |
+| src/indirect.js:28:29:28:31 | res | src/indirect.js:28:15:30:3 | functio ... ");\\n  } |
 | src/indirect.js:29:5:29:7 | res | src/indirect.js:28:15:30:3 | functio ... ");\\n  } |
 test_HeaderDefinition
 | src/http.js:7:3:7:42 | res.wri ... rget }) | src/http.js:4:32:10:1 | functio ... .foo;\\n} |
@@ -85,6 +107,7 @@ test_HeaderDefinition
 | src/http.js:63:3:63:40 | res.set ... , "23") | src/http.js:62:19:65:1 | functio ... r2");\\n} |
 | src/https.js:7:3:7:42 | res.wri ... rget }) | src/https.js:4:33:10:1 | functio ... .foo;\\n} |
 | src/https.js:13:3:13:44 | res.set ... /html') | src/https.js:12:20:16:1 | functio ... ar");\\n} |
+| src/indirect2.js:14:3:14:51 | res.set ... /json') | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
 | src/indirect2.js:14:3:14:51 | res.set ... /json') | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} |
 test_RouteSetup_getServer
 | createServer.js:2:1:2:42 | https.c ... es) {}) | createServer.js:2:1:2:42 | https.c ... es) {}) |
@@ -145,40 +168,61 @@ test_RouteHandler_getAResponseExpr
 | createServer.js:3:23:3:44 | functio ... res) {} | createServer.js:3:38:3:40 | res |
 | createServer.js:4:31:4:46 | (req, res) => {} | createServer.js:4:37:4:39 | res |
 | createServer.js:25:37:27:5 | functio ... ;\\n    } | createServer.js:25:52:25:54 | res |
+| createServer.js:25:37:27:5 | functio ... ;\\n    } | createServer.js:25:52:25:54 | res |
 | createServer.js:25:37:27:5 | functio ... ;\\n    } | createServer.js:26:9:26:11 | res |
 | src/http.js:4:32:10:1 | functio ... .foo;\\n} | src/http.js:4:46:4:48 | res |
+| src/http.js:4:32:10:1 | functio ... .foo;\\n} | src/http.js:4:46:4:48 | res |
 | src/http.js:4:32:10:1 | functio ... .foo;\\n} | src/http.js:7:3:7:5 | res |
 | src/http.js:12:19:16:1 | functio ... ar");\\n} | src/http.js:12:33:12:35 | res |
+| src/http.js:12:19:16:1 | functio ... ar");\\n} | src/http.js:12:33:12:35 | res |
 | src/http.js:12:19:16:1 | functio ... ar");\\n} | src/http.js:13:3:13:5 | res |
 | src/http.js:12:19:16:1 | functio ... ar");\\n} | src/http.js:14:3:14:5 | res |
 | src/http.js:12:19:16:1 | functio ... ar");\\n} | src/http.js:15:3:15:5 | res |
 | src/http.js:55:12:55:30 | function(req,res){} | src/http.js:55:25:55:27 | res |
 | src/http.js:60:14:60:32 | function(req,res){} | src/http.js:60:27:60:29 | res |
 | src/http.js:62:19:65:1 | functio ... r2");\\n} | src/http.js:62:33:62:35 | res |
+| src/http.js:62:19:65:1 | functio ... r2");\\n} | src/http.js:62:33:62:35 | res |
 | src/http.js:62:19:65:1 | functio ... r2");\\n} | src/http.js:63:3:63:5 | res |
 | src/http.js:62:19:65:1 | functio ... r2");\\n} | src/http.js:64:3:64:5 | res |
 | src/http.js:68:12:68:27 | (req,res) => f() | src/http.js:68:17:68:19 | res |
 | src/http.js:72:19:76:1 | functio ... \\n  })\\n} | src/http.js:72:34:72:36 | res |
+| src/http.js:72:19:76:1 | functio ... \\n  })\\n} | src/http.js:72:34:72:36 | res |
+| src/http.js:72:19:76:1 | functio ... \\n  })\\n} | src/http.js:72:34:72:36 | res |
+| src/http.js:72:19:76:1 | functio ... \\n  })\\n} | src/http.js:73:18:73:17 | res |
 | src/http.js:72:19:76:1 | functio ... \\n  })\\n} | src/http.js:74:5:74:7 | res |
 | src/http.js:81:22:86:1 | functio ... la");\\n} | src/http.js:81:46:81:48 | res |
+| src/http.js:81:22:86:1 | functio ... la");\\n} | src/http.js:81:46:81:48 | res |
+| src/http.js:81:22:86:1 | functio ... la");\\n} | src/http.js:81:46:81:48 | res |
+| src/http.js:81:22:86:1 | functio ... la");\\n} | src/http.js:82:18:82:17 | res |
 | src/http.js:81:22:86:1 | functio ... la");\\n} | src/http.js:83:5:83:7 | res |
 | src/http.js:81:22:86:1 | functio ... la");\\n} | src/http.js:85:3:85:5 | res |
 | src/https.js:4:33:10:1 | functio ... .foo;\\n} | src/https.js:4:47:4:49 | res |
+| src/https.js:4:33:10:1 | functio ... .foo;\\n} | src/https.js:4:47:4:49 | res |
 | src/https.js:4:33:10:1 | functio ... .foo;\\n} | src/https.js:7:3:7:5 | res |
 | src/https.js:12:20:16:1 | functio ... ar");\\n} | src/https.js:12:34:12:36 | res |
+| src/https.js:12:20:16:1 | functio ... ar");\\n} | src/https.js:12:34:12:36 | res |
 | src/https.js:12:20:16:1 | functio ... ar");\\n} | src/https.js:13:3:13:5 | res |
 | src/https.js:12:20:16:1 | functio ... ar");\\n} | src/https.js:14:3:14:5 | res |
 | src/https.js:12:20:16:1 | functio ... ar");\\n} | src/https.js:15:3:15:5 | res |
 | src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:9:19:9:21 | res |
+| src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:9:19:9:21 | res |
 | src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:10:47:10:49 | res |
+| src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:13:33:13:35 | res |
+| src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:13:33:13:35 | res |
+| src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:14:3:14:5 | res |
+| src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:15:3:15:5 | res |
+| src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} | src/indirect2.js:13:33:13:35 | res |
 | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} | src/indirect2.js:13:33:13:35 | res |
 | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} | src/indirect2.js:14:3:14:5 | res |
 | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} | src/indirect2.js:15:3:15:5 | res |
 | src/indirect.js:16:12:20:5 | functio ... ;\\n    } | src/indirect.js:16:26:16:28 | res |
+| src/indirect.js:16:12:20:5 | functio ... ;\\n    } | src/indirect.js:16:26:16:28 | res |
 | src/indirect.js:16:12:20:5 | functio ... ;\\n    } | src/indirect.js:19:38:19:40 | res |
 | src/indirect.js:25:24:27:3 | (req, r ... ");\\n  } | src/indirect.js:25:30:25:32 | res |
+| src/indirect.js:25:24:27:3 | (req, r ... ");\\n  } | src/indirect.js:25:30:25:32 | res |
 | src/indirect.js:25:24:27:3 | (req, r ... ");\\n  } | src/indirect.js:26:5:26:7 | res |
 | src/indirect.js:28:15:30:3 | functio ... ");\\n  } | src/indirect.js:28:29:28:31 | res |
+| src/indirect.js:28:15:30:3 | functio ... ");\\n  } | src/indirect.js:28:29:28:31 | res |
 | src/indirect.js:28:15:30:3 | functio ... ");\\n  } | src/indirect.js:29:5:29:7 | res |
 test_ServerDefinition_getARouteHandler
 | createServer.js:2:1:2:42 | https.c ... es) {}) | createServer.js:2:20:2:41 | functio ... res) {} |
@@ -286,6 +330,7 @@ test_RequestExpr
 | createServer.js:4:32:4:34 | req | createServer.js:4:31:4:46 | (req, res) => {} |
 | createServer.js:25:47:25:49 | req | createServer.js:25:37:27:5 | functio ... ;\\n    } |
 | src/http.js:4:41:4:43 | req | src/http.js:4:32:10:1 | functio ... .foo;\\n} |
+| src/http.js:4:41:4:43 | req | src/http.js:4:32:10:1 | functio ... .foo;\\n} |
 | src/http.js:6:26:6:28 | req | src/http.js:4:32:10:1 | functio ... .foo;\\n} |
 | src/http.js:8:3:8:5 | req | src/http.js:4:32:10:1 | functio ... .foo;\\n} |
 | src/http.js:9:3:9:5 | req | src/http.js:4:32:10:1 | functio ... .foo;\\n} |
@@ -293,22 +338,29 @@ test_RequestExpr
 | src/http.js:55:21:55:23 | req | src/http.js:55:12:55:30 | function(req,res){} |
 | src/http.js:60:23:60:25 | req | src/http.js:60:14:60:32 | function(req,res){} |
 | src/http.js:62:28:62:30 | req | src/http.js:62:19:65:1 | functio ... r2");\\n} |
+| src/http.js:62:28:62:30 | req | src/http.js:62:19:65:1 | functio ... r2");\\n} |
 | src/http.js:63:17:63:19 | req | src/http.js:62:19:65:1 | functio ... r2");\\n} |
 | src/http.js:68:13:68:15 | req | src/http.js:68:12:68:27 | (req,res) => f() |
 | src/http.js:72:29:72:31 | req | src/http.js:72:19:76:1 | functio ... \\n  })\\n} |
+| src/http.js:72:29:72:31 | req | src/http.js:72:19:76:1 | functio ... \\n  })\\n} |
 | src/http.js:73:3:73:5 | req | src/http.js:72:19:76:1 | functio ... \\n  })\\n} |
 | src/http.js:81:41:81:43 | req | src/http.js:81:22:86:1 | functio ... la");\\n} |
+| src/http.js:81:41:81:43 | req | src/http.js:81:22:86:1 | functio ... la");\\n} |
 | src/http.js:82:3:82:5 | req | src/http.js:81:22:86:1 | functio ... la");\\n} |
 | src/https.js:4:42:4:44 | req | src/https.js:4:33:10:1 | functio ... .foo;\\n} |
+| src/https.js:4:42:4:44 | req | src/https.js:4:33:10:1 | functio ... .foo;\\n} |
 | src/https.js:6:26:6:28 | req | src/https.js:4:33:10:1 | functio ... .foo;\\n} |
 | src/https.js:8:3:8:5 | req | src/https.js:4:33:10:1 | functio ... .foo;\\n} |
 | src/https.js:9:3:9:5 | req | src/https.js:4:33:10:1 | functio ... .foo;\\n} |
 | src/https.js:12:29:12:31 | req | src/https.js:12:20:16:1 | functio ... ar");\\n} |
 | src/indirect2.js:9:14:9:16 | req | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
+| src/indirect2.js:9:14:9:16 | req | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
 | src/indirect2.js:10:12:10:14 | req | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
 | src/indirect2.js:10:42:10:44 | req | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
+| src/indirect2.js:13:28:13:30 | req | src/indirect2.js:9:1:11:1 | functio ... res);\\n} |
 | src/indirect2.js:13:28:13:30 | req | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} |
 | src/indirect.js:16:21:16:23 | req | src/indirect.js:16:12:20:5 | functio ... ;\\n    } |
+| src/indirect.js:16:21:16:23 | req | src/indirect.js:16:12:20:5 | functio ... ;\\n    } |
 | src/indirect.js:17:28:17:30 | req | src/indirect.js:16:12:20:5 | functio ... ;\\n    } |
 | src/indirect.js:19:33:19:35 | req | src/indirect.js:16:12:20:5 | functio ... ;\\n    } |
 | src/indirect.js:25:25:25:27 | req | src/indirect.js:25:24:27:3 | (req, r ... ");\\n  } |
@@ -328,6 +380,7 @@ test_RouteHandler_getARequestExpr
 | createServer.js:4:31:4:46 | (req, res) => {} | createServer.js:4:32:4:34 | req |
 | createServer.js:25:37:27:5 | functio ... ;\\n    } | createServer.js:25:47:25:49 | req |
 | src/http.js:4:32:10:1 | functio ... .foo;\\n} | src/http.js:4:41:4:43 | req |
+| src/http.js:4:32:10:1 | functio ... .foo;\\n} | src/http.js:4:41:4:43 | req |
 | src/http.js:4:32:10:1 | functio ... .foo;\\n} | src/http.js:6:26:6:28 | req |
 | src/http.js:4:32:10:1 | functio ... .foo;\\n} | src/http.js:8:3:8:5 | req |
 | src/http.js:4:32:10:1 | functio ... .foo;\\n} | src/http.js:9:3:9:5 | req |
@@ -335,22 +388,29 @@ test_RouteHandler_getARequestExpr
 | src/http.js:55:12:55:30 | function(req,res){} | src/http.js:55:21:55:23 | req |
 | src/http.js:60:14:60:32 | function(req,res){} | src/http.js:60:23:60:25 | req |
 | src/http.js:62:19:65:1 | functio ... r2");\\n} | src/http.js:62:28:62:30 | req |
+| src/http.js:62:19:65:1 | functio ... r2");\\n} | src/http.js:62:28:62:30 | req |
 | src/http.js:62:19:65:1 | functio ... r2");\\n} | src/http.js:63:17:63:19 | req |
 | src/http.js:68:12:68:27 | (req,res) => f() | src/http.js:68:13:68:15 | req |
 | src/http.js:72:19:76:1 | functio ... \\n  })\\n} | src/http.js:72:29:72:31 | req |
+| src/http.js:72:19:76:1 | functio ... \\n  })\\n} | src/http.js:72:29:72:31 | req |
 | src/http.js:72:19:76:1 | functio ... \\n  })\\n} | src/http.js:73:3:73:5 | req |
 | src/http.js:81:22:86:1 | functio ... la");\\n} | src/http.js:81:41:81:43 | req |
+| src/http.js:81:22:86:1 | functio ... la");\\n} | src/http.js:81:41:81:43 | req |
 | src/http.js:81:22:86:1 | functio ... la");\\n} | src/http.js:82:3:82:5 | req |
 | src/https.js:4:33:10:1 | functio ... .foo;\\n} | src/https.js:4:42:4:44 | req |
+| src/https.js:4:33:10:1 | functio ... .foo;\\n} | src/https.js:4:42:4:44 | req |
 | src/https.js:4:33:10:1 | functio ... .foo;\\n} | src/https.js:6:26:6:28 | req |
 | src/https.js:4:33:10:1 | functio ... .foo;\\n} | src/https.js:8:3:8:5 | req |
 | src/https.js:4:33:10:1 | functio ... .foo;\\n} | src/https.js:9:3:9:5 | req |
 | src/https.js:12:20:16:1 | functio ... ar");\\n} | src/https.js:12:29:12:31 | req |
 | src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:9:14:9:16 | req |
+| src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:9:14:9:16 | req |
 | src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:10:12:10:14 | req |
 | src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:10:42:10:44 | req |
+| src/indirect2.js:9:1:11:1 | functio ... res);\\n} | src/indirect2.js:13:28:13:30 | req |
 | src/indirect2.js:13:1:16:1 | functio ... \\"");\\n} | src/indirect2.js:13:28:13:30 | req |
 | src/indirect.js:16:12:20:5 | functio ... ;\\n    } | src/indirect.js:16:21:16:23 | req |
+| src/indirect.js:16:12:20:5 | functio ... ;\\n    } | src/indirect.js:16:21:16:23 | req |
 | src/indirect.js:16:12:20:5 | functio ... ;\\n    } | src/indirect.js:17:28:17:30 | req |
 | src/indirect.js:16:12:20:5 | functio ... ;\\n    } | src/indirect.js:19:33:19:35 | req |
 | src/indirect.js:25:24:27:3 | (req, r ... ");\\n  } | src/indirect.js:25:25:25:27 | req |
diff --git a/javascript/ql/test/library-tests/frameworks/Redux/test.expected b/javascript/ql/test/library-tests/frameworks/Redux/test.expected
index cf08bd3c11d..d7d000d8caf 100644
--- a/javascript/ql/test/library-tests/frameworks/Redux/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Redux/test.expected
@@ -125,7 +125,7 @@ getAffectedStateAccessPath
 getADispatchFunctionNode
 | react-redux.jsx:65:20:65:32 | use moduleImport("react-redux").getMember("exports").getMember("useDispatch").getReturn() |
 getADispatchedValueNode
-| react-redux.jsx:27:12:30:5 | def getASuccessor(Label::entryPoint("react-redux-connect")).getParameter(1).getMember("manualAction").getReturn() |
+| react-redux.jsx:27:12:30:5 | def entryPoint("react-redux-connect").getParameter(1).getMember("manualAction").getReturn() |
 | react-redux.jsx:69:18:69:39 | def moduleImport("react-redux").getMember("exports").getMember("useDispatch").getReturn().getParameter(0) |
 | react-redux.jsx:70:18:70:38 | def moduleImport("react-redux").getMember("exports").getMember("useDispatch").getReturn().getParameter(0) |
 getAnUntypedActionInReducer
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/Credentials.ql b/javascript/ql/test/library-tests/frameworks/SQL/Credentials.ql
index 5e32f342c20..2451052eaf4 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/Credentials.ql
+++ b/javascript/ql/test/library-tests/frameworks/SQL/Credentials.ql
@@ -1,4 +1,4 @@
 import javascript
 
-from CredentialsExpr ce
+from CredentialsNode ce
 select ce, ce.getCredentialsKind()
diff --git a/javascript/ql/test/library-tests/frameworks/Templating/CodeInjection.expected b/javascript/ql/test/library-tests/frameworks/Templating/CodeInjection.expected
index b224b32777c..d9d9baa15df 100644
--- a/javascript/ql/test/library-tests/frameworks/Templating/CodeInjection.expected
+++ b/javascript/ql/test/library-tests/frameworks/Templating/CodeInjection.expected
@@ -136,18 +136,18 @@ edges
 | views/njk_sinks.njk:23:42:23:75 | dataInE ...  \| safe | views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} |
 | views/njk_sinks.njk:23:42:23:75 | dataInE ...  \| safe | views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} |
 #select
-| views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> | app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> | $@ flows to here and is interpreted by AngularJS, which may evaluate it as code. | app.js:65:22:65:42 | req.que ... pedHtml | User-provided value |
-| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | $@ flows to here and is interpreted by AngularJS, which may evaluate it as code. | app.js:66:18:66:34 | req.query.rawHtml | User-provided value |
-| views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> | app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> | $@ flows to here and is interpreted by AngularJS, which may evaluate it as code. | app.js:65:22:65:42 | req.que ... pedHtml | User-provided value |
-| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | $@ flows to here and is interpreted by AngularJS, which may evaluate it as code. | app.js:66:18:66:34 | req.query.rawHtml | User-provided value |
-| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | $@ flows to here and is interpreted as code. | app.js:15:30:15:58 | req.que ... tedCode | User-provided value |
-| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | $@ flows to here and is interpreted as code. | app.js:17:25:17:48 | req.que ... shSink1 | User-provided value |
-| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | $@ flows to here and is interpreted as code. | app.js:19:35:19:68 | req.que ... rString | User-provided value |
-| views/hbs_sinks.hbs:25:39:25:63 | {{ dataInGeneratedCode }} | app.js:34:30:34:58 | req.que ... tedCode | views/hbs_sinks.hbs:25:39:25:63 | {{ dataInGeneratedCode }} | $@ flows to here and is interpreted as code. | app.js:34:30:34:58 | req.que ... tedCode | User-provided value |
-| views/hbs_sinks.hbs:28:19:28:38 | {{ backslashSink1 }} | app.js:36:25:36:48 | req.que ... shSink1 | views/hbs_sinks.hbs:28:19:28:38 | {{ backslashSink1 }} | $@ flows to here and is interpreted as code. | app.js:36:25:36:48 | req.que ... shSink1 | User-provided value |
-| views/hbs_sinks.hbs:33:39:33:68 | {{ dataInEventHandlerString }} | app.js:38:35:38:68 | req.que ... rString | views/hbs_sinks.hbs:33:39:33:68 | {{ dataInEventHandlerString }} | $@ flows to here and is interpreted as code. | app.js:38:35:38:68 | req.que ... rString | User-provided value |
-| views/njk_sinks.njk:13:39:13:63 | {{ dataInGeneratedCode }} | app.js:53:30:53:58 | req.que ... tedCode | views/njk_sinks.njk:13:39:13:63 | {{ dataInGeneratedCode }} | $@ flows to here and is interpreted as code. | app.js:53:30:53:58 | req.que ... tedCode | User-provided value |
-| views/njk_sinks.njk:14:42:14:76 | {{ dataInGeneratedCodeRaw \| safe }} | app.js:54:33:54:64 | req.que ... CodeRaw | views/njk_sinks.njk:14:42:14:76 | {{ dataInGeneratedCodeRaw \| safe }} | $@ flows to here and is interpreted as code. | app.js:54:33:54:64 | req.que ... CodeRaw | User-provided value |
-| views/njk_sinks.njk:17:19:17:38 | {{ backslashSink1 }} | app.js:56:25:56:48 | req.que ... shSink1 | views/njk_sinks.njk:17:19:17:38 | {{ backslashSink1 }} | $@ flows to here and is interpreted as code. | app.js:56:25:56:48 | req.que ... shSink1 | User-provided value |
-| views/njk_sinks.njk:22:39:22:68 | {{ dataInEventHandlerString }} | app.js:58:35:58:68 | req.que ... rString | views/njk_sinks.njk:22:39:22:68 | {{ dataInEventHandlerString }} | $@ flows to here and is interpreted as code. | app.js:58:35:58:68 | req.que ... rString | User-provided value |
-| views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} | app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} | $@ flows to here and is interpreted as code. | app.js:59:38:59:74 | req.que ... ringRaw | User-provided value |
+| views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> | app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_include.ejs:2:5:2:22 | <%= escapedHtml %> | $@ flows to this location and is interpreted by AngularJS, which may evaluate it as code. | app.js:65:22:65:42 | req.que ... pedHtml | User-provided value |
+| views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_include.ejs:3:5:3:18 | <%- rawHtml %> | $@ flows to this location and is interpreted by AngularJS, which may evaluate it as code. | app.js:66:18:66:34 | req.query.rawHtml | User-provided value |
+| views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> | app.js:65:22:65:42 | req.que ... pedHtml | views/angularjs_sinks.ejs:3:9:3:26 | <%= escapedHtml %> | $@ flows to this location and is interpreted by AngularJS, which may evaluate it as code. | app.js:65:22:65:42 | req.que ... pedHtml | User-provided value |
+| views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | app.js:66:18:66:34 | req.query.rawHtml | views/angularjs_sinks.ejs:4:9:4:22 | <%- rawHtml %> | $@ flows to this location and is interpreted by AngularJS, which may evaluate it as code. | app.js:66:18:66:34 | req.query.rawHtml | User-provided value |
+| views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | app.js:15:30:15:58 | req.que ... tedCode | views/ejs_sinks.ejs:13:39:13:64 | <%= dataInGeneratedCode %> | $@ flows to this location and is interpreted as code. | app.js:15:30:15:58 | req.que ... tedCode | User-provided value |
+| views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | app.js:17:25:17:48 | req.que ... shSink1 | views/ejs_sinks.ejs:16:19:16:39 | <%= backslashSink1 %> | $@ flows to this location and is interpreted as code. | app.js:17:25:17:48 | req.que ... shSink1 | User-provided value |
+| views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | app.js:19:35:19:68 | req.que ... rString | views/ejs_sinks.ejs:21:39:21:69 | <%= dataInEventHandlerString %> | $@ flows to this location and is interpreted as code. | app.js:19:35:19:68 | req.que ... rString | User-provided value |
+| views/hbs_sinks.hbs:25:39:25:63 | {{ dataInGeneratedCode }} | app.js:34:30:34:58 | req.que ... tedCode | views/hbs_sinks.hbs:25:39:25:63 | {{ dataInGeneratedCode }} | $@ flows to this location and is interpreted as code. | app.js:34:30:34:58 | req.que ... tedCode | User-provided value |
+| views/hbs_sinks.hbs:28:19:28:38 | {{ backslashSink1 }} | app.js:36:25:36:48 | req.que ... shSink1 | views/hbs_sinks.hbs:28:19:28:38 | {{ backslashSink1 }} | $@ flows to this location and is interpreted as code. | app.js:36:25:36:48 | req.que ... shSink1 | User-provided value |
+| views/hbs_sinks.hbs:33:39:33:68 | {{ dataInEventHandlerString }} | app.js:38:35:38:68 | req.que ... rString | views/hbs_sinks.hbs:33:39:33:68 | {{ dataInEventHandlerString }} | $@ flows to this location and is interpreted as code. | app.js:38:35:38:68 | req.que ... rString | User-provided value |
+| views/njk_sinks.njk:13:39:13:63 | {{ dataInGeneratedCode }} | app.js:53:30:53:58 | req.que ... tedCode | views/njk_sinks.njk:13:39:13:63 | {{ dataInGeneratedCode }} | $@ flows to this location and is interpreted as code. | app.js:53:30:53:58 | req.que ... tedCode | User-provided value |
+| views/njk_sinks.njk:14:42:14:76 | {{ dataInGeneratedCodeRaw \| safe }} | app.js:54:33:54:64 | req.que ... CodeRaw | views/njk_sinks.njk:14:42:14:76 | {{ dataInGeneratedCodeRaw \| safe }} | $@ flows to this location and is interpreted as code. | app.js:54:33:54:64 | req.que ... CodeRaw | User-provided value |
+| views/njk_sinks.njk:17:19:17:38 | {{ backslashSink1 }} | app.js:56:25:56:48 | req.que ... shSink1 | views/njk_sinks.njk:17:19:17:38 | {{ backslashSink1 }} | $@ flows to this location and is interpreted as code. | app.js:56:25:56:48 | req.que ... shSink1 | User-provided value |
+| views/njk_sinks.njk:22:39:22:68 | {{ dataInEventHandlerString }} | app.js:58:35:58:68 | req.que ... rString | views/njk_sinks.njk:22:39:22:68 | {{ dataInEventHandlerString }} | $@ flows to this location and is interpreted as code. | app.js:58:35:58:68 | req.que ... rString | User-provided value |
+| views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} | app.js:59:38:59:74 | req.que ... ringRaw | views/njk_sinks.njk:23:39:23:78 | {{ dataInEventHandlerStringRaw \| safe }} | $@ flows to this location and is interpreted as code. | app.js:59:38:59:74 | req.que ... ringRaw | User-provided value |
diff --git a/javascript/ql/test/library-tests/frameworks/connect/tests.expected b/javascript/ql/test/library-tests/frameworks/connect/tests.expected
index 65e9bf665e3..f383805827a 100644
--- a/javascript/ql/test/library-tests/frameworks/connect/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/connect/tests.expected
@@ -9,6 +9,7 @@ test_RouteSetup
 | src/test.js:32:1:35:2 | app.use ... rl);\\n}) |
 test_RequestInputAccess
 | src/test.js:8:5:8:26 | req.coo ... ('foo') | cookie | src/test.js:6:9:9:1 | functio ... oo');\\n} |
+| src/test.js:28:20:28:22 | url | url | src/test.js:28:9:30:1 | functio ... bar);\\n} |
 | src/test.js:33:15:33:21 | req.url | url | src/test.js:32:9:35:1 | functio ... url);\\n} |
 test_RouteHandler_getAResponseHeader
 | src/test.js:6:9:9:1 | functio ... oo');\\n} | header1 | src/test.js:7:5:7:32 | res.set ... 1', '') |
@@ -18,14 +19,17 @@ test_HeaderDefinition_defines
 | src/test.js:25:5:25:32 | res.set ... 2', '') | header2 |  |
 test_ResponseExpr
 | src/test.js:6:32:6:34 | res | src/test.js:6:9:9:1 | functio ... oo');\\n} |
+| src/test.js:6:32:6:34 | res | src/test.js:6:9:9:1 | functio ... oo');\\n} |
 | src/test.js:7:5:7:7 | res | src/test.js:6:9:9:1 | functio ... oo');\\n} |
 | src/test.js:15:27:15:29 | res | src/test.js:15:12:15:32 | functio ...  res){} |
 | src/test.js:19:22:19:24 | res | src/test.js:19:9:19:27 | function(req,res){} |
 | src/test.js:20:23:20:25 | res | src/test.js:20:10:20:28 | function(req,res){} |
 | src/test.js:24:31:24:33 | res | src/test.js:24:9:26:1 | functio ...  '');\\n} |
+| src/test.js:24:31:24:33 | res | src/test.js:24:9:26:1 | functio ...  '');\\n} |
 | src/test.js:25:5:25:7 | res | src/test.js:24:9:26:1 | functio ...  '');\\n} |
 | src/test.js:28:42:28:44 | res | src/test.js:28:9:30:1 | functio ... bar);\\n} |
 | src/test.js:32:24:32:26 | res | src/test.js:32:9:35:1 | functio ... url);\\n} |
+| src/test.js:32:24:32:26 | res | src/test.js:32:9:35:1 | functio ... url);\\n} |
 | src/test.js:34:5:34:7 | res | src/test.js:32:9:35:1 | functio ... url);\\n} |
 test_HeaderDefinition
 | src/test.js:7:5:7:32 | res.set ... 1', '') | src/test.js:6:9:9:1 | functio ... oo');\\n} |
@@ -46,14 +50,17 @@ test_ServerDefinition
 | src/test.js:4:11:4:19 | connect() |
 test_RouteHandler_getAResponseExpr
 | src/test.js:6:9:9:1 | functio ... oo');\\n} | src/test.js:6:32:6:34 | res |
+| src/test.js:6:9:9:1 | functio ... oo');\\n} | src/test.js:6:32:6:34 | res |
 | src/test.js:6:9:9:1 | functio ... oo');\\n} | src/test.js:7:5:7:7 | res |
 | src/test.js:15:12:15:32 | functio ...  res){} | src/test.js:15:27:15:29 | res |
 | src/test.js:19:9:19:27 | function(req,res){} | src/test.js:19:22:19:24 | res |
 | src/test.js:20:10:20:28 | function(req,res){} | src/test.js:20:23:20:25 | res |
 | src/test.js:24:9:26:1 | functio ...  '');\\n} | src/test.js:24:31:24:33 | res |
+| src/test.js:24:9:26:1 | functio ...  '');\\n} | src/test.js:24:31:24:33 | res |
 | src/test.js:24:9:26:1 | functio ...  '');\\n} | src/test.js:25:5:25:7 | res |
 | src/test.js:28:9:30:1 | functio ... bar);\\n} | src/test.js:28:42:28:44 | res |
 | src/test.js:32:9:35:1 | functio ... url);\\n} | src/test.js:32:24:32:26 | res |
+| src/test.js:32:9:35:1 | functio ... url);\\n} | src/test.js:32:24:32:26 | res |
 | src/test.js:32:9:35:1 | functio ... url);\\n} | src/test.js:34:5:34:7 | res |
 test_RouteSetup_getARouteHandler
 | src/test.js:6:1:9:2 | app.use ... o');\\n}) | src/test.js:6:9:9:1 | functio ... oo');\\n} |
@@ -76,6 +83,7 @@ test_RouteHandler
 | src/test.js:32:9:35:1 | functio ... url);\\n} | src/test.js:4:11:4:19 | connect() |
 test_RequestExpr
 | src/test.js:6:27:6:29 | req | src/test.js:6:9:9:1 | functio ... oo');\\n} |
+| src/test.js:6:27:6:29 | req | src/test.js:6:9:9:1 | functio ... oo');\\n} |
 | src/test.js:8:5:8:7 | req | src/test.js:6:9:9:1 | functio ... oo');\\n} |
 | src/test.js:15:22:15:24 | req | src/test.js:15:12:15:32 | functio ...  res){} |
 | src/test.js:19:18:19:20 | req | src/test.js:19:9:19:27 | function(req,res){} |
@@ -83,12 +91,14 @@ test_RequestExpr
 | src/test.js:24:26:24:28 | req | src/test.js:24:9:26:1 | functio ...  '');\\n} |
 | src/test.js:28:19:28:39 | {url, q ... ookies} | src/test.js:28:9:30:1 | functio ... bar);\\n} |
 | src/test.js:32:19:32:21 | req | src/test.js:32:9:35:1 | functio ... url);\\n} |
+| src/test.js:32:19:32:21 | req | src/test.js:32:9:35:1 | functio ... url);\\n} |
 | src/test.js:33:15:33:17 | req | src/test.js:32:9:35:1 | functio ... url);\\n} |
 test_Credentials
 | src/test.js:12:19:12:28 | 'username' | user name |
 | src/test.js:12:31:12:40 | 'password' | password |
 test_RouteHandler_getARequestExpr
 | src/test.js:6:9:9:1 | functio ... oo');\\n} | src/test.js:6:27:6:29 | req |
+| src/test.js:6:9:9:1 | functio ... oo');\\n} | src/test.js:6:27:6:29 | req |
 | src/test.js:6:9:9:1 | functio ... oo');\\n} | src/test.js:8:5:8:7 | req |
 | src/test.js:15:12:15:32 | functio ...  res){} | src/test.js:15:22:15:24 | req |
 | src/test.js:19:9:19:27 | function(req,res){} | src/test.js:19:18:19:20 | req |
@@ -96,4 +106,5 @@ test_RouteHandler_getARequestExpr
 | src/test.js:24:9:26:1 | functio ...  '');\\n} | src/test.js:24:26:24:28 | req |
 | src/test.js:28:9:30:1 | functio ... bar);\\n} | src/test.js:28:19:28:39 | {url, q ... ookies} |
 | src/test.js:32:9:35:1 | functio ... url);\\n} | src/test.js:32:19:32:21 | req |
+| src/test.js:32:9:35:1 | functio ... url);\\n} | src/test.js:32:19:32:21 | req |
 | src/test.js:32:9:35:1 | functio ... url);\\n} | src/test.js:33:15:33:17 | req |
diff --git a/javascript/ql/test/library-tests/frameworks/connect/tests.ql b/javascript/ql/test/library-tests/frameworks/connect/tests.ql
index 24ddefeaf5d..6c11c8ffd6b 100644
--- a/javascript/ql/test/library-tests/frameworks/connect/tests.ql
+++ b/javascript/ql/test/library-tests/frameworks/connect/tests.ql
@@ -3,48 +3,52 @@ import javascript
 query predicate test_RouteSetup(Connect::RouteSetup rs) { any() }
 
 query predicate test_RequestInputAccess(
-  HTTP::RequestInputAccess ria, string res, Connect::RouteHandler rh
+  Http::RequestInputAccess ria, string res, Connect::RouteHandler rh
 ) {
   ria.getRouteHandler() = rh and res = ria.getKind()
 }
 
 query predicate test_RouteHandler_getAResponseHeader(
-  Connect::RouteHandler rh, string name, HTTP::HeaderDefinition res
+  Connect::RouteHandler rh, string name, Http::HeaderDefinition res
 ) {
   res = rh.getAResponseHeader(name)
 }
 
-query predicate test_HeaderDefinition_defines(HTTP::HeaderDefinition hd, string name, string value) {
+query predicate test_HeaderDefinition_defines(Http::HeaderDefinition hd, string name, string value) {
   hd.defines(name, value) and hd.getRouteHandler() instanceof Connect::RouteHandler
 }
 
-query predicate test_ResponseExpr(HTTP::ResponseExpr e, HTTP::RouteHandler res) {
+query predicate test_ResponseExpr(Http::ResponseNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
 
-query predicate test_HeaderDefinition(HTTP::HeaderDefinition hd, Connect::RouteHandler rh) {
+query predicate test_HeaderDefinition(Http::HeaderDefinition hd, Connect::RouteHandler rh) {
   rh = hd.getRouteHandler()
 }
 
-query predicate test_RouteSetup_getServer(Connect::RouteSetup rs, Expr res) { res = rs.getServer() }
+query predicate test_RouteSetup_getServer(Connect::RouteSetup rs, DataFlow::Node res) {
+  res = rs.getServer()
+}
 
-query predicate test_HeaderDefinition_getAHeaderName(HTTP::HeaderDefinition hd, string res) {
+query predicate test_HeaderDefinition_getAHeaderName(Http::HeaderDefinition hd, string res) {
   hd.getRouteHandler() instanceof Connect::RouteHandler and res = hd.getAHeaderName()
 }
 
 query predicate test_ServerDefinition(Connect::ServerDefinition s) { any() }
 
-query predicate test_RouteHandler_getAResponseExpr(Connect::RouteHandler rh, HTTP::ResponseExpr res) {
-  res = rh.getAResponseExpr()
+query predicate test_RouteHandler_getAResponseExpr(Connect::RouteHandler rh, Http::ResponseNode res) {
+  res = rh.getAResponseNode()
 }
 
 query predicate test_RouteSetup_getARouteHandler(Connect::RouteSetup r, DataFlow::SourceNode res) {
   res = r.getARouteHandler()
 }
 
-query predicate test_RouteHandler(Connect::RouteHandler rh, Expr res) { res = rh.getServer() }
+query predicate test_RouteHandler(Connect::RouteHandler rh, DataFlow::Node res) {
+  res = rh.getServer()
+}
 
-query predicate test_RequestExpr(HTTP::RequestExpr e, HTTP::RouteHandler res) {
+query predicate test_RequestExpr(Http::RequestNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
 
@@ -52,6 +56,6 @@ query predicate test_Credentials(Connect::Credentials cr, string res) {
   res = cr.getCredentialsKind()
 }
 
-query predicate test_RouteHandler_getARequestExpr(Connect::RouteHandler rh, HTTP::RequestExpr res) {
-  res = rh.getARequestExpr()
+query predicate test_RouteHandler_getARequestExpr(Connect::RouteHandler rh, Http::RequestNode res) {
+  res = rh.getARequestNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/data/test.expected b/javascript/ql/test/library-tests/frameworks/data/test.expected
index e25a105b759..138547cc7ff 100644
--- a/javascript/ql/test/library-tests/frameworks/data/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/data/test.expected
@@ -55,6 +55,17 @@ taintFlow
 | test.js:182:12:182:19 | source() | test.js:182:12:182:19 | source() |
 | test.js:187:31:187:31 | x | test.js:189:10:189:10 | x |
 | test.js:203:32:203:39 | source() | test.js:203:32:203:39 | source() |
+| test.js:207:24:207:31 | source() | test.js:207:24:207:31 | source() |
+| test.js:208:24:208:31 | source() | test.js:208:24:208:31 | source() |
+| test.js:211:34:211:41 | source() | test.js:211:34:211:41 | source() |
+| test.js:214:34:214:41 | source() | test.js:214:34:214:41 | source() |
+| test.js:223:45:223:52 | source() | test.js:223:45:223:52 | source() |
+| test.js:225:39:225:46 | source() | test.js:225:39:225:46 | source() |
+| test.js:226:50:226:57 | source() | test.js:226:50:226:57 | source() |
+| test.js:230:59:230:66 | source() | test.js:230:59:230:66 | source() |
+| test.js:231:59:231:66 | source() | test.js:231:59:231:66 | source() |
+| test.js:232:59:232:66 | source() | test.js:232:59:232:66 | source() |
+| test.js:233:59:233:66 | source() | test.js:233:59:233:66 | source() |
 isSink
 | test.js:54:18:54:25 | source() | test-sink |
 | test.js:55:22:55:29 | source() | test-sink |
@@ -113,6 +124,18 @@ isSink
 | test.js:182:12:182:19 | source() | test-sink |
 | test.js:196:12:196:29 | this._wrappedField | test-sink |
 | test.js:203:32:203:39 | source() | test-sink |
+| test.js:207:24:207:31 | source() | test-sink |
+| test.js:208:24:208:31 | source() | test-sink |
+| test.js:211:34:211:41 | source() | test-sink |
+| test.js:214:34:214:41 | source() | test-sink |
+| test.js:222:52:222:52 | 0 | test-sink |
+| test.js:223:45:223:52 | source() | test-sink |
+| test.js:225:39:225:46 | source() | test-sink |
+| test.js:226:50:226:57 | source() | test-sink |
+| test.js:230:59:230:66 | source() | test-sink |
+| test.js:231:59:231:66 | source() | test-sink |
+| test.js:232:59:232:66 | source() | test-sink |
+| test.js:233:59:233:66 | source() | test-sink |
 syntaxErrors
 | Member[foo |
 | Member[foo] .Member[bar] |
diff --git a/javascript/ql/test/library-tests/frameworks/data/test.js b/javascript/ql/test/library-tests/frameworks/data/test.js
index d31016e3fda..d34940bd065 100644
--- a/javascript/ql/test/library-tests/frameworks/data/test.js
+++ b/javascript/ql/test/library-tests/frameworks/data/test.js
@@ -203,3 +203,32 @@ class OtherClass {
     this.accessorAroundField = source(); // NOT OK
   }
 }
+
+testlib.foo.memberSink(source()); // NOT OK
+testlib.bar.memberSink(source()); // NOT OK
+testlib.memberSink(source()); // OK
+testlib.overloadedSink('safe', source()); // OK
+testlib.overloadedSink('danger', source()); // NOT OK
+
+function typeVars() {
+  testlib.typevar.a.b().c.mySink(source()); // NOT OK
+
+  testlib.typevar.mySink(source()); // OK - does not match sub path
+  testlib.typevar.a.mySink(source()); // OK - does not match sub path
+  testlib.typevar.a.b.mySink(source()); // OK - does not match sub path
+  testlib.typevar.a.b.c.mySink(source()); // OK - does not match sub path
+  testlib.typevar.a.b(1).c.mySink(source()); // OK - does not match sub path
+
+  testlib.typevar.a.b().c.a.b().c.mySink(source(), 0); // OK
+  testlib.typevar.a.b().c.a.b().c.mySink(0, source()); // NOT OK
+
+  testlib.typevar.left.x.right.mySink(source()); // NOT OK
+  testlib.typevar.left.left.x.right.right.mySink(source()); // NOT OK
+  testlib.typevar.left.x.right.right.mySink(source()); // OK - mismatched left and right
+  testlib.typevar.left.left.x.right.mySink(source()); // OK - mismatched left and right
+
+  testlib.typevar.getThis().getThis().left.x.right.mySink(source()); // NOT OK
+  testlib.typevar.left.getThis().getThis().x.right.mySink(source()); // NOT OK
+  testlib.typevar.left.x.getThis().getThis().right.mySink(source()); // NOT OK
+  testlib.typevar.left.x.right.getThis().getThis().mySink(source()); // NOT OK
+}
diff --git a/javascript/ql/test/library-tests/frameworks/data/test.ql b/javascript/ql/test/library-tests/frameworks/data/test.ql
index ff385f3afff..053e41e22ff 100644
--- a/javascript/ql/test/library-tests/frameworks/data/test.ql
+++ b/javascript/ql/test/library-tests/frameworks/data/test.ql
@@ -14,6 +14,17 @@ class Steps extends ModelInput::SummaryModelCsv {
         "testlib;;Member[preserveAllButFirstArgument];Argument[1..];ReturnValue;taint",
         "testlib;;Member[preserveAllIfCall].Call;Argument[0..];ReturnValue;taint",
         "testlib;;Member[getSource].ReturnValue.Member[continue];Argument[this];ReturnValue;taint",
+        "testlib;~HasThisFlow;;;Member[getThis].ReturnValue;type",
+      ]
+  }
+}
+
+class TypeDefs extends ModelInput::TypeModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "testlib;~HasThisFlow;testlib;;Member[typevar]",
+        "testlib;~HasThisFlow;testlib;~HasThisFlow;Member[left,right,x]",
       ]
   }
 }
@@ -38,6 +49,22 @@ class Sinks extends ModelInput::SinkModelCsv {
         "testlib;;Member[MethodDecorator].DecoratedMember.ReturnValue;test-sink",
         "testlib;;Member[MethodDecoratorWithArgs].ReturnValue.DecoratedMember.ReturnValue;test-sink",
         "testlib;;Member[ParamDecoratorSink].DecoratedParameter;test-sink",
+        "testlib;;AnyMember.Member[memberSink].Argument[0];test-sink",
+        "testlib;;Member[overloadedSink].WithStringArgument[0=danger].Argument[1];test-sink",
+        "testlib;;Member[typevar].TypeVar[ABC].Member[mySink].Argument[0];test-sink",
+        "testlib;;Member[typevar].TypeVar[ABC].TypeVar[ABC].Member[mySink].Argument[1];test-sink",
+        "testlib;;Member[typevar].TypeVar[LeftRight].Member[mySink].Argument[0];test-sink",
+      ]
+  }
+}
+
+class TypeVars extends ModelInput::TypeVariableModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "ABC;Member[a].Member[b].WithArity[0].ReturnValue.Member[c]", //
+        "LeftRight;Member[left].TypeVar[LeftRight].Member[right]", //
+        "LeftRight;Member[x]",
       ]
   }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/HeaderAccess.qll b/javascript/ql/test/library-tests/frameworks/fastify/HeaderAccess.qll
index 22d1d6aee53..69d34318ae1 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/HeaderAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/HeaderAccess.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderAccess(HTTP::RequestHeaderAccess access, string res) {
+query predicate test_HeaderAccess(Http::RequestHeaderAccess access, string res) {
   res = access.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition.qll b/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition.qll
index bf3ef7fb7fc..f3cef14be34 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition(HTTP::HeaderDefinition hd, Fastify::RouteHandler rh) {
+query predicate test_HeaderDefinition(Http::HeaderDefinition hd, Fastify::RouteHandler rh) {
   rh = hd.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_defines.qll b/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_defines.qll
index 43413a4dc4b..3bfab852a0c 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_defines.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_defines.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_defines(HTTP::HeaderDefinition hd, string name, string value) {
+query predicate test_HeaderDefinition_defines(Http::HeaderDefinition hd, string name, string value) {
   hd.defines(name, value) and hd.getRouteHandler() instanceof Fastify::RouteHandler
 }
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_getAHeaderName.qll b/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_getAHeaderName.qll
index 62e1d62c06f..41ae7de8a97 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_getAHeaderName.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_getAHeaderName.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_getAHeaderName(HTTP::HeaderDefinition hd, string res) {
+query predicate test_HeaderDefinition_getAHeaderName(Http::HeaderDefinition hd, string res) {
   hd.getRouteHandler() instanceof Fastify::RouteHandler and res = hd.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/RedirectInvocation.qll b/javascript/ql/test/library-tests/frameworks/fastify/RedirectInvocation.qll
index fffbf35a79e..e0044bcbee1 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/RedirectInvocation.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RedirectInvocation.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RedirectInvocation(HTTP::RedirectInvocation invk, Fastify::RouteHandler rh) {
+query predicate test_RedirectInvocation(Http::RedirectInvocation invk, Fastify::RouteHandler rh) {
   invk.getRouteHandler() = rh
 }
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/RequestInputAccess.qll b/javascript/ql/test/library-tests/frameworks/fastify/RequestInputAccess.qll
index d8cdc2a4ccb..bb649d75b4c 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/RequestInputAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RequestInputAccess.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RequestInputAccess(
-  HTTP::RequestInputAccess ria, string res, Fastify::RouteHandler rh, boolean isUserControlledObject
+  Http::RequestInputAccess ria, string res, Fastify::RouteHandler rh, boolean isUserControlledObject
 ) {
   ria.getRouteHandler() = rh and
   res = ria.getKind() and
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/ResponseSendArgument.qll b/javascript/ql/test/library-tests/frameworks/fastify/ResponseSendArgument.qll
index 8f221b18bd7..de79ce0cd5b 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/ResponseSendArgument.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/ResponseSendArgument.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_ResponseSendArgument(HTTP::ResponseSendArgument arg, Fastify::RouteHandler rh) {
+query predicate test_ResponseSendArgument(Http::ResponseSendArgument arg, Fastify::RouteHandler rh) {
   arg.getRouteHandler() = rh
 }
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler.qll b/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler.qll
index 89598e2169e..68ec89563ea 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler.qll
@@ -1,3 +1,5 @@
 import javascript
 
-query predicate test_RouteHandler(Fastify::RouteHandler rh, Expr res) { res = rh.getServer() }
+query predicate test_RouteHandler(Fastify::RouteHandler rh, DataFlow::Node res) {
+  res = rh.getServer()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getARequestExpr.qll b/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getARequestExpr.qll
index dbc8d7cb896..b3e0fc1b098 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getARequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getARequestExpr.qll
@@ -1,5 +1,5 @@
 import semmle.javascript.frameworks.Express
 
-query predicate test_RouteHandler_getARequestExpr(Fastify::RouteHandler rh, HTTP::RequestExpr res) {
-  res = rh.getARequestExpr()
+query predicate test_RouteHandler_getARequestExpr(Fastify::RouteHandler rh, Http::RequestNode res) {
+  res = rh.getARequestNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getAResponseHeader.qll b/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getAResponseHeader.qll
index a5394519940..fd2f356be13 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getAResponseHeader.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getAResponseHeader.qll
@@ -1,7 +1,7 @@
 import semmle.javascript.frameworks.Express
 
 query predicate test_RouteHandler_getAResponseHeader(
-  Fastify::RouteHandler rh, string name, HTTP::HeaderDefinition res
+  Fastify::RouteHandler rh, string name, Http::HeaderDefinition res
 ) {
   res = rh.getAResponseHeader(name)
 }
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/RouteSetup_getServer.qll b/javascript/ql/test/library-tests/frameworks/fastify/RouteSetup_getServer.qll
index 8339498d094..5a19750fd50 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/RouteSetup_getServer.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RouteSetup_getServer.qll
@@ -1,3 +1,5 @@
 import javascript
 
-query predicate test_RouteSetup_getServer(Fastify::RouteSetup rs, Expr res) { res = rs.getServer() }
+query predicate test_RouteSetup_getServer(Fastify::RouteSetup rs, DataFlow::Node res) {
+  res = rs.getServer()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/fastify/tests.expected b/javascript/ql/test/library-tests/frameworks/fastify/tests.expected
index 1371bf551c8..36a5420a178 100644
--- a/javascript/ql/test/library-tests/frameworks/fastify/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/fastify/tests.expected
@@ -97,23 +97,28 @@ test_RouteHandler_getARequestExpr
 | src/fastify.js:20:26:20:47 | (reques ... ) => {} | src/fastify.js:20:27:20:33 | request |
 | src/fastify.js:26:17:28:3 | (reques ... nse\\n  } | src/fastify.js:26:18:26:24 | request |
 | src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:34:26:34:32 | request |
+| src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:34:26:34:32 | request |
 | src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:36:5:36:11 | request |
 | src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:37:5:37:11 | request |
 | src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:38:5:38:11 | request |
 | src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:39:5:39:11 | request |
 | src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | src/fastify.js:54:26:54:32 | request |
+| src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | src/fastify.js:54:26:54:32 | request |
 | src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | src/fastify.js:55:5:55:11 | request |
 | src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | src/fastify.js:56:5:56:11 | request |
 | src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | src/fastify.js:57:5:57:11 | request |
 | src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | src/fastify.js:65:26:65:32 | request |
+| src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | src/fastify.js:65:26:65:32 | request |
 | src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | src/fastify.js:66:5:66:11 | request |
 | src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | src/fastify.js:67:5:67:11 | request |
 | src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | src/fastify.js:68:5:68:11 | request |
 | src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | src/fastify.js:76:26:76:32 | request |
+| src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | src/fastify.js:76:26:76:32 | request |
 | src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | src/fastify.js:77:5:77:11 | request |
 | src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | src/fastify.js:78:5:78:11 | request |
 | src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | src/fastify.js:79:5:79:11 | request |
 | src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | src/fastify.js:87:26:87:32 | request |
+| src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | src/fastify.js:87:26:87:32 | request |
 | src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | src/fastify.js:88:5:88:11 | request |
 | src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | src/fastify.js:89:5:89:11 | request |
 | src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | src/fastify.js:90:5:90:11 | request |
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/HeaderAccess.qll b/javascript/ql/test/library-tests/frameworks/hapi/HeaderAccess.qll
index 22d1d6aee53..69d34318ae1 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/HeaderAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/HeaderAccess.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderAccess(HTTP::RequestHeaderAccess access, string res) {
+query predicate test_HeaderAccess(Http::RequestHeaderAccess access, string res) {
   res = access.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition.qll b/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition.qll
index 5ed82a5f591..612a1fa082b 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition(HTTP::HeaderDefinition hd, Hapi::RouteHandler rh) {
+query predicate test_HeaderDefinition(Http::HeaderDefinition hd, Hapi::RouteHandler rh) {
   rh = hd.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition_defines.qll b/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition_defines.qll
index 56ccb45dcfb..836b4e686f6 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition_defines.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition_defines.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_defines(HTTP::HeaderDefinition hd, string name, string value) {
+query predicate test_HeaderDefinition_defines(Http::HeaderDefinition hd, string name, string value) {
   hd.defines(name, value) and hd.getRouteHandler() instanceof Hapi::RouteHandler
 }
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition_getAHeaderName.qll b/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition_getAHeaderName.qll
index 7bc108da973..06f3fe3f220 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition_getAHeaderName.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/HeaderDefinition_getAHeaderName.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_getAHeaderName(HTTP::HeaderDefinition hd, string res) {
+query predicate test_HeaderDefinition_getAHeaderName(Http::HeaderDefinition hd, string res) {
   hd.getRouteHandler() instanceof Hapi::RouteHandler and res = hd.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/RequestExpr.qll b/javascript/ql/test/library-tests/frameworks/hapi/RequestExpr.qll
index d412847a950..166b20ce8ed 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/RequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/RequestExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RequestExpr(Hapi::RequestExpr e, HTTP::RouteHandler res) {
+query predicate test_RequestExpr(Hapi::RequestNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/RequestInputAccess.qll b/javascript/ql/test/library-tests/frameworks/hapi/RequestInputAccess.qll
index 4146cb91cb6..5ce1fe4b5f6 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/RequestInputAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/RequestInputAccess.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RequestInputAccess(
-  HTTP::RequestInputAccess ria, string res, Hapi::RouteHandler rh
+  Http::RequestInputAccess ria, string res, Hapi::RouteHandler rh
 ) {
   ria.getRouteHandler() = rh and res = ria.getKind()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/ResponseExpr.qll b/javascript/ql/test/library-tests/frameworks/hapi/ResponseExpr.qll
index 9acfedd73f7..3e2c2bca5c6 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/ResponseExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/ResponseExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_ResponseExpr(Hapi::ResponseExpr e, HTTP::RouteHandler res) {
+query predicate test_ResponseExpr(Hapi::ResponseNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler.qll b/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler.qll
index 45e51d1b999..58bcd7ab42b 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler.qll
@@ -1,3 +1,5 @@
 import javascript
 
-query predicate test_RouteHandler(Hapi::RouteHandler rh, Expr res) { res = rh.getServer() }
+query predicate test_RouteHandler(Hapi::RouteHandler rh, DataFlow::Node res) {
+  res = rh.getServer()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler_getARequestExpr.qll b/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler_getARequestExpr.qll
index 51b719430d7..06bbbe11fde 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler_getARequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler_getARequestExpr.qll
@@ -1,5 +1,5 @@
 import semmle.javascript.frameworks.Express
 
-query predicate test_RouteHandler_getARequestExpr(Hapi::RouteHandler rh, HTTP::RequestExpr res) {
-  res = rh.getARequestExpr()
+query predicate test_RouteHandler_getARequestExpr(Hapi::RouteHandler rh, Http::RequestNode res) {
+  res = rh.getARequestNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler_getAResponseHeader.qll b/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler_getAResponseHeader.qll
index 84aa08d92e1..4eb30875385 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler_getAResponseHeader.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/RouteHandler_getAResponseHeader.qll
@@ -1,7 +1,7 @@
 import semmle.javascript.frameworks.Express
 
 query predicate test_RouteHandler_getAResponseHeader(
-  Hapi::RouteHandler rh, string name, HTTP::HeaderDefinition res
+  Hapi::RouteHandler rh, string name, Http::HeaderDefinition res
 ) {
   res = rh.getAResponseHeader(name)
 }
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/RouteSetup_getServer.qll b/javascript/ql/test/library-tests/frameworks/hapi/RouteSetup_getServer.qll
index ffdbe44e168..11c510a91d6 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/RouteSetup_getServer.qll
+++ b/javascript/ql/test/library-tests/frameworks/hapi/RouteSetup_getServer.qll
@@ -1,3 +1,5 @@
 import javascript
 
-query predicate test_RouteSetup_getServer(Hapi::RouteSetup rs, Expr res) { res = rs.getServer() }
+query predicate test_RouteSetup_getServer(Hapi::RouteSetup rs, DataFlow::Node res) {
+  res = rs.getServer()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/hapi/tests.expected b/javascript/ql/test/library-tests/frameworks/hapi/tests.expected
index 2579ed7a75a..fb73a32acf6 100644
--- a/javascript/ql/test/library-tests/frameworks/hapi/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/hapi/tests.expected
@@ -48,9 +48,11 @@ test_RouteHandler
 | src/hapi.js:34:12:34:30 | function (req, h){} | src/hapi.js:4:15:4:31 | new Hapi.Server() |
 test_RequestExpr
 | src/hapi.js:13:32:13:38 | request | src/hapi.js:13:14:15:5 | functio ... n\\n    } |
+| src/hapi.js:13:32:13:38 | request | src/hapi.js:13:14:15:5 | functio ... n\\n    } |
 | src/hapi.js:14:9:14:15 | request | src/hapi.js:13:14:15:5 | functio ... n\\n    } |
 | src/hapi.js:17:48:17:54 | request | src/hapi.js:17:30:18:1 | functio ... ndler\\n} |
 | src/hapi.js:20:19:20:25 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
+| src/hapi.js:20:19:20:25 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:21:3:21:9 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:22:3:22:9 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:23:3:23:9 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
@@ -60,9 +62,11 @@ test_RequestExpr
 | src/hapi.js:34:22:34:24 | req | src/hapi.js:34:12:34:30 | function (req, h){} |
 test_RouteHandler_getARequestExpr
 | src/hapi.js:13:14:15:5 | functio ... n\\n    } | src/hapi.js:13:32:13:38 | request |
+| src/hapi.js:13:14:15:5 | functio ... n\\n    } | src/hapi.js:13:32:13:38 | request |
 | src/hapi.js:13:14:15:5 | functio ... n\\n    } | src/hapi.js:14:9:14:15 | request |
 | src/hapi.js:17:30:18:1 | functio ... ndler\\n} | src/hapi.js:17:48:17:54 | request |
 | src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:20:19:20:25 | request |
+| src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:20:19:20:25 | request |
 | src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:21:3:21:9 | request |
 | src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:22:3:22:9 | request |
 | src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:23:3:23:9 | request |
diff --git a/javascript/ql/test/library-tests/frameworks/koa/ContextExpr.qll b/javascript/ql/test/library-tests/frameworks/koa/ContextExpr.qll
index d33c4e12229..c1218e2aabe 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/ContextExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/ContextExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_ContextExpr(Koa::ContextExpr e, Koa::RouteHandler res) {
+query predicate test_ContextExpr(Koa::ContextNode e, Koa::RouteHandler res) {
   res = e.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/HeaderAccess.qll b/javascript/ql/test/library-tests/frameworks/koa/HeaderAccess.qll
index 22d1d6aee53..69d34318ae1 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/HeaderAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/HeaderAccess.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderAccess(HTTP::RequestHeaderAccess access, string res) {
+query predicate test_HeaderAccess(Http::RequestHeaderAccess access, string res) {
   res = access.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition.qll b/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition.qll
index 972b3999b41..338717d1d28 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition(HTTP::HeaderDefinition hd, Koa::RouteHandler rh) {
+query predicate test_HeaderDefinition(Http::HeaderDefinition hd, Koa::RouteHandler rh) {
   rh = hd.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition_defines.qll b/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition_defines.qll
index 1fd1f5550b8..d33943b9b57 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition_defines.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition_defines.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_defines(HTTP::HeaderDefinition hd, string name, string value) {
+query predicate test_HeaderDefinition_defines(Http::HeaderDefinition hd, string name, string value) {
   hd.defines(name, value) and hd.getRouteHandler() instanceof Koa::RouteHandler
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition_getAHeaderName.qll b/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition_getAHeaderName.qll
index faec0fac04d..20d6e34bb42 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition_getAHeaderName.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/HeaderDefinition_getAHeaderName.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_getAHeaderName(HTTP::HeaderDefinition hd, string res) {
+query predicate test_HeaderDefinition_getAHeaderName(Http::HeaderDefinition hd, string res) {
   hd.getRouteHandler() instanceof Koa::RouteHandler and res = hd.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/RedirectInvocation.qll b/javascript/ql/test/library-tests/frameworks/koa/RedirectInvocation.qll
index 8648d75eb63..802fc6a5c18 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/RedirectInvocation.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/RedirectInvocation.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RedirectInvocation(
-  HTTP::RedirectInvocation redirect, Expr url, HTTP::RouteHandler rh
+  Http::RedirectInvocation redirect, DataFlow::Node url, Http::RouteHandler rh
 ) {
   redirect.getUrlArgument() = url and
   redirect.getRouteHandler() = rh
diff --git a/javascript/ql/test/library-tests/frameworks/koa/RequestExpr.qll b/javascript/ql/test/library-tests/frameworks/koa/RequestExpr.qll
index cb80c0da255..94e18fa6477 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/RequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/RequestExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RequestExpr(Koa::RequestExpr e, HTTP::RouteHandler res) {
+query predicate test_RequestExpr(Koa::RequestNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/RequestInputAccess.qll b/javascript/ql/test/library-tests/frameworks/koa/RequestInputAccess.qll
index 2e4e226fd3e..2c1601520f1 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/RequestInputAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/RequestInputAccess.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RequestInputAccess(
-  HTTP::RequestInputAccess ria, string res, Koa::RouteHandler rh
+  Http::RequestInputAccess ria, string res, Koa::RouteHandler rh
 ) {
   ria.getRouteHandler() = rh and res = ria.getKind()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/ResponseExpr.qll b/javascript/ql/test/library-tests/frameworks/koa/ResponseExpr.qll
index dc846988cc2..a6d1108ebec 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/ResponseExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/ResponseExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_ResponseExpr(Koa::ResponseExpr e, HTTP::RouteHandler res) {
+query predicate test_ResponseExpr(Koa::ResponseNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/ResponseSendArgument.qll b/javascript/ql/test/library-tests/frameworks/koa/ResponseSendArgument.qll
index f0c3e9d2ea2..ccec2620e4f 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/ResponseSendArgument.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/ResponseSendArgument.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_ResponseSendArgument(HTTP::ResponseSendArgument send, Koa::RouteHandler rh) {
+query predicate test_ResponseSendArgument(Http::ResponseSendArgument send, Koa::RouteHandler rh) {
   rh = send.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/RouteHandler.qll b/javascript/ql/test/library-tests/frameworks/koa/RouteHandler.qll
index 032d5a29366..1c7fafa4d40 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/RouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/RouteHandler.qll
@@ -1,3 +1,3 @@
 import javascript
 
-query predicate test_RouteHandler(Koa::RouteHandler rh, Expr res) { res = rh.getServer() }
+query predicate test_RouteHandler(Koa::RouteHandler rh, DataFlow::Node res) { res = rh.getServer() }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAContextExpr.qll b/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAContextExpr.qll
index cbbe41ebb85..c5049096d5a 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAContextExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAContextExpr.qll
@@ -1,5 +1,5 @@
 import semmle.javascript.frameworks.Express
 
-query predicate test_RouteHandler_getAContextExpr(Koa::RouteHandler rh, Expr res) {
-  res = rh.getAContextExpr()
+query predicate test_RouteHandler_getAContextExpr(Koa::RouteHandler rh, DataFlow::Node res) {
+  res = rh.getAContextNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getARequestExpr.qll b/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getARequestExpr.qll
index ca15b9b465b..7e251ad1ea8 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getARequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getARequestExpr.qll
@@ -1,5 +1,5 @@
 import semmle.javascript.frameworks.Express
 
-query predicate test_RouteHandler_getARequestExpr(Koa::RouteHandler rh, HTTP::RequestExpr res) {
-  res = rh.getARequestExpr()
+query predicate test_RouteHandler_getARequestExpr(Koa::RouteHandler rh, Http::RequestNode res) {
+  res = rh.getARequestNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAResponseExpr.qll b/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAResponseExpr.qll
index 6d5fa8ff746..045a8b5fae4 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAResponseExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAResponseExpr.qll
@@ -1,5 +1,5 @@
 import semmle.javascript.frameworks.Express
 
-query predicate test_RouteHandler_getAResponseExpr(Koa::RouteHandler rh, HTTP::ResponseExpr res) {
-  res = rh.getAResponseExpr()
+query predicate test_RouteHandler_getAResponseExpr(Koa::RouteHandler rh, Http::ResponseNode res) {
+  res = rh.getAResponseNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAResponseHeader.qll b/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAResponseHeader.qll
index 98c613dc5c8..f1b8b481d36 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAResponseHeader.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/RouteHandler_getAResponseHeader.qll
@@ -1,7 +1,7 @@
 import semmle.javascript.frameworks.Express
 
 query predicate test_RouteHandler_getAResponseHeader(
-  Koa::RouteHandler rh, string name, HTTP::HeaderDefinition res
+  Koa::RouteHandler rh, string name, Http::HeaderDefinition res
 ) {
   res = rh.getAResponseHeader(name)
 }
diff --git a/javascript/ql/test/library-tests/frameworks/koa/RouteSetup_getServer.qll b/javascript/ql/test/library-tests/frameworks/koa/RouteSetup_getServer.qll
index bb674e0d192..b54b2249817 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/RouteSetup_getServer.qll
+++ b/javascript/ql/test/library-tests/frameworks/koa/RouteSetup_getServer.qll
@@ -1,3 +1,5 @@
 import javascript
 
-query predicate test_RouteSetup_getServer(Koa::RouteSetup rs, Expr res) { res = rs.getServer() }
+query predicate test_RouteSetup_getServer(Koa::RouteSetup rs, DataFlow::Node res) {
+  res = rs.getServer()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/koa/tests.expected b/javascript/ql/test/library-tests/frameworks/koa/tests.expected
index e0a56e4e532..042fc7227c2 100644
--- a/javascript/ql/test/library-tests/frameworks/koa/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/koa/tests.expected
@@ -41,11 +41,15 @@ test_HeaderDefinition_defines
 test_ResponseExpr
 | src/koa.js:12:3:12:15 | this.response | src/koa.js:10:10:28:1 | functio ... az');\\n} |
 | src/koa.js:14:3:14:14 | ctx.response | src/koa.js:10:10:28:1 | functio ... az');\\n} |
+| src/koa.js:15:7:15:24 | rsp | src/koa.js:10:10:28:1 | functio ... az');\\n} |
 | src/koa.js:15:13:15:24 | ctx.response | src/koa.js:10:10:28:1 | functio ... az');\\n} |
 | src/koa.js:16:3:16:5 | rsp | src/koa.js:10:10:28:1 | functio ... az');\\n} |
 | src/koa.js:18:3:18:14 | ctx.response | src/koa.js:10:10:28:1 | functio ... az');\\n} |
 | src/koa.js:44:2:44:13 | ctx.response | src/koa.js:30:10:45:1 | async c ... url);\\n} |
 test_RouteHandler_getAContextExpr
+| src/koa.js:7:1:7:22 | functio ... r1() {} | src/koa.js:7:1:7:0 | this |
+| src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:10:10:10:9 | this |
+| src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:10:28:10:30 | ctx |
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:10:28:10:30 | ctx |
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:11:3:11:6 | this |
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:12:3:12:6 | this |
@@ -63,6 +67,7 @@ test_RouteHandler_getAContextExpr
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:26:3:26:5 | ctx |
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:27:3:27:5 | ctx |
 | src/koa.js:30:10:45:1 | async c ... url);\\n} | src/koa.js:30:16:30:18 | ctx |
+| src/koa.js:30:10:45:1 | async c ... url);\\n} | src/koa.js:30:16:30:18 | ctx |
 | src/koa.js:30:10:45:1 | async c ... url);\\n} | src/koa.js:31:2:31:4 | ctx |
 | src/koa.js:30:10:45:1 | async c ... url);\\n} | src/koa.js:32:2:32:4 | ctx |
 | src/koa.js:30:10:45:1 | async c ... url);\\n} | src/koa.js:33:2:33:4 | ctx |
@@ -77,9 +82,11 @@ test_RouteHandler_getAContextExpr
 | src/koa.js:30:10:45:1 | async c ... url);\\n} | src/koa.js:43:2:43:4 | ctx |
 | src/koa.js:30:10:45:1 | async c ... url);\\n} | src/koa.js:44:2:44:4 | ctx |
 | src/koa.js:47:10:56:1 | async c ... .foo;\\n} | src/koa.js:47:16:47:18 | ctx |
+| src/koa.js:47:10:56:1 | async c ... .foo;\\n} | src/koa.js:47:16:47:18 | ctx |
 | src/koa.js:47:10:56:1 | async c ... .foo;\\n} | src/koa.js:48:16:48:18 | ctx |
 | src/koa.js:47:10:56:1 | async c ... .foo;\\n} | src/koa.js:51:14:51:16 | ctx |
 | src/koa.js:47:10:56:1 | async c ... .foo;\\n} | src/koa.js:54:16:54:18 | ctx |
+| src/koa.js:59:10:61:1 | functio ... .url;\\n} | src/koa.js:59:10:59:9 | this |
 | src/koa.js:59:10:61:1 | functio ... .url;\\n} | src/koa.js:60:2:60:5 | this |
 test_HeaderDefinition
 | src/koa.js:11:3:11:25 | this.se ... 1', '') | src/koa.js:10:10:28:1 | functio ... az');\\n} |
@@ -111,6 +118,7 @@ test_HeaderAccess
 test_RouteHandler_getAResponseExpr
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:12:3:12:15 | this.response |
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:14:3:14:14 | ctx.response |
+| src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:15:7:15:24 | rsp |
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:15:13:15:24 | ctx.response |
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:16:3:16:5 | rsp |
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:18:3:18:14 | ctx.response |
@@ -155,6 +163,9 @@ test_RouteHandler_getARequestExpr
 | src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:26:3:26:13 | ctx.request |
 | src/koa.js:59:10:61:1 | functio ... .url;\\n} | src/koa.js:60:2:60:13 | this.request |
 test_ContextExpr
+| src/koa.js:7:1:7:0 | this | src/koa.js:7:1:7:22 | functio ... r1() {} |
+| src/koa.js:10:10:10:9 | this | src/koa.js:10:10:28:1 | functio ... az');\\n} |
+| src/koa.js:10:28:10:30 | ctx | src/koa.js:10:10:28:1 | functio ... az');\\n} |
 | src/koa.js:10:28:10:30 | ctx | src/koa.js:10:10:28:1 | functio ... az');\\n} |
 | src/koa.js:11:3:11:6 | this | src/koa.js:10:10:28:1 | functio ... az');\\n} |
 | src/koa.js:12:3:12:6 | this | src/koa.js:10:10:28:1 | functio ... az');\\n} |
@@ -172,6 +183,7 @@ test_ContextExpr
 | src/koa.js:26:3:26:5 | ctx | src/koa.js:10:10:28:1 | functio ... az');\\n} |
 | src/koa.js:27:3:27:5 | ctx | src/koa.js:10:10:28:1 | functio ... az');\\n} |
 | src/koa.js:30:16:30:18 | ctx | src/koa.js:30:10:45:1 | async c ... url);\\n} |
+| src/koa.js:30:16:30:18 | ctx | src/koa.js:30:10:45:1 | async c ... url);\\n} |
 | src/koa.js:31:2:31:4 | ctx | src/koa.js:30:10:45:1 | async c ... url);\\n} |
 | src/koa.js:32:2:32:4 | ctx | src/koa.js:30:10:45:1 | async c ... url);\\n} |
 | src/koa.js:33:2:33:4 | ctx | src/koa.js:30:10:45:1 | async c ... url);\\n} |
@@ -186,9 +198,11 @@ test_ContextExpr
 | src/koa.js:43:2:43:4 | ctx | src/koa.js:30:10:45:1 | async c ... url);\\n} |
 | src/koa.js:44:2:44:4 | ctx | src/koa.js:30:10:45:1 | async c ... url);\\n} |
 | src/koa.js:47:16:47:18 | ctx | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
+| src/koa.js:47:16:47:18 | ctx | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
 | src/koa.js:48:16:48:18 | ctx | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
 | src/koa.js:51:14:51:16 | ctx | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
 | src/koa.js:54:16:54:18 | ctx | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
+| src/koa.js:59:10:59:9 | this | src/koa.js:59:10:61:1 | functio ... .url;\\n} |
 | src/koa.js:60:2:60:5 | this | src/koa.js:59:10:61:1 | functio ... .url;\\n} |
 test_RedirectInvocation
 | src/koa.js:43:2:43:18 | ctx.redirect(url) | src/koa.js:43:15:43:17 | url | src/koa.js:30:10:45:1 | async c ... url);\\n} |
diff --git a/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition.qll b/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition.qll
index 9e101f7ea37..d5661ccaa94 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition(HTTP::HeaderDefinition hd, Restify::RouteHandler rh) {
+query predicate test_HeaderDefinition(Http::HeaderDefinition hd, Restify::RouteHandler rh) {
   rh = hd.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition_defines.qll b/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition_defines.qll
index 3f6694173ca..8851bc55c77 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition_defines.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition_defines.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_defines(HTTP::HeaderDefinition hd, string name, string value) {
+query predicate test_HeaderDefinition_defines(Http::HeaderDefinition hd, string name, string value) {
   hd.defines(name, value) and hd.getRouteHandler() instanceof Restify::RouteHandler
 }
diff --git a/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition_getAHeaderName.qll b/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition_getAHeaderName.qll
index f546a156991..9881464b56b 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition_getAHeaderName.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/HeaderDefinition_getAHeaderName.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_HeaderDefinition_getAHeaderName(HTTP::HeaderDefinition hd, string res) {
+query predicate test_HeaderDefinition_getAHeaderName(Http::HeaderDefinition hd, string res) {
   hd.getRouteHandler() instanceof Restify::RouteHandler and res = hd.getAHeaderName()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/restify/RequestExpr.qll b/javascript/ql/test/library-tests/frameworks/restify/RequestExpr.qll
index 16facf7c3a9..2c4f75d365a 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/RequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/RequestExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_RequestExpr(Restify::RequestExpr e, HTTP::RouteHandler res) {
+query predicate test_RequestExpr(Restify::RequestNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/restify/RequestInputAccess.qll b/javascript/ql/test/library-tests/frameworks/restify/RequestInputAccess.qll
index 0c9f028f443..64cb1d74293 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/RequestInputAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/RequestInputAccess.qll
@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_RequestInputAccess(
-  HTTP::RequestInputAccess ria, string res, Restify::RouteHandler rh
+  Http::RequestInputAccess ria, string res, Restify::RouteHandler rh
 ) {
   ria.getRouteHandler() = rh and res = ria.getKind()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/restify/ResponseExpr.qll b/javascript/ql/test/library-tests/frameworks/restify/ResponseExpr.qll
index a02524c0b9f..b4fd9368a1d 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/ResponseExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/ResponseExpr.qll
@@ -1,5 +1,5 @@
 import javascript
 
-query predicate test_ResponseExpr(Restify::ResponseExpr e, HTTP::RouteHandler res) {
+query predicate test_ResponseExpr(Restify::ResponseNode e, Http::RouteHandler res) {
   res = e.getRouteHandler()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/restify/RouteHandler.qll b/javascript/ql/test/library-tests/frameworks/restify/RouteHandler.qll
index c15bb690a72..dc7315cc492 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/RouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/RouteHandler.qll
@@ -1,3 +1,5 @@
 import javascript
 
-query predicate test_RouteHandler(Restify::RouteHandler rh, Expr res) { res = rh.getServer() }
+query predicate test_RouteHandler(Restify::RouteHandler rh, DataFlow::Node res) {
+  res = rh.getServer()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getARequestExpr.qll b/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getARequestExpr.qll
index 97c54cbceff..4f76b514b2f 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getARequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getARequestExpr.qll
@@ -1,5 +1,5 @@
 import semmle.javascript.frameworks.Express
 
-query predicate test_RouteHandler_getARequestExpr(Restify::RouteHandler rh, HTTP::RequestExpr res) {
-  res = rh.getARequestExpr()
+query predicate test_RouteHandler_getARequestExpr(Restify::RouteHandler rh, Http::RequestNode res) {
+  res = rh.getARequestNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getAResponseExpr.qll b/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getAResponseExpr.qll
index 749964afa52..22d5d612a41 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getAResponseExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getAResponseExpr.qll
@@ -1,5 +1,5 @@
 import semmle.javascript.frameworks.Express
 
-query predicate test_RouteHandler_getAResponseExpr(Restify::RouteHandler rh, HTTP::ResponseExpr res) {
-  res = rh.getAResponseExpr()
+query predicate test_RouteHandler_getAResponseExpr(Restify::RouteHandler rh, Http::ResponseNode res) {
+  res = rh.getAResponseNode()
 }
diff --git a/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getAResponseHeader.qll b/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getAResponseHeader.qll
index d807f4879ab..f072f0146e6 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getAResponseHeader.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/RouteHandler_getAResponseHeader.qll
@@ -1,7 +1,7 @@
 import semmle.javascript.frameworks.Express
 
 query predicate test_RouteHandler_getAResponseHeader(
-  Restify::RouteHandler rh, string name, HTTP::HeaderDefinition res
+  Restify::RouteHandler rh, string name, Http::HeaderDefinition res
 ) {
   res = rh.getAResponseHeader(name)
 }
diff --git a/javascript/ql/test/library-tests/frameworks/restify/RouteSetup_getServer.qll b/javascript/ql/test/library-tests/frameworks/restify/RouteSetup_getServer.qll
index fb6d67c3e54..e84c65c3fc2 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/RouteSetup_getServer.qll
+++ b/javascript/ql/test/library-tests/frameworks/restify/RouteSetup_getServer.qll
@@ -1,3 +1,5 @@
 import javascript
 
-query predicate test_RouteSetup_getServer(Restify::RouteSetup rs, Expr res) { res = rs.getServer() }
+query predicate test_RouteSetup_getServer(Restify::RouteSetup rs, DataFlow::Node res) {
+  res = rs.getServer()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/restify/tests.expected b/javascript/ql/test/library-tests/frameworks/restify/tests.expected
index 618b05e7cca..3f26379a3fa 100644
--- a/javascript/ql/test/library-tests/frameworks/restify/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/restify/tests.expected
@@ -18,8 +18,10 @@ test_HeaderDefinition_defines
 | src/test.js:13:5:13:37 | respons ... 2', '') | header2 |  |
 test_ResponseExpr
 | src/test.js:9:46:9:53 | response | src/test.js:9:19:11:1 | functio ... ition\\n} |
+| src/test.js:9:46:9:53 | response | src/test.js:9:19:11:1 | functio ... ition\\n} |
 | src/test.js:10:5:10:12 | response | src/test.js:9:19:11:1 | functio ... ition\\n} |
 | src/test.js:12:46:12:53 | response | src/test.js:12:19:22:1 | functio ... okie;\\n} |
+| src/test.js:12:46:12:53 | response | src/test.js:12:19:22:1 | functio ... okie;\\n} |
 | src/test.js:13:5:13:12 | response | src/test.js:12:19:22:1 | functio ... okie;\\n} |
 test_HeaderDefinition
 | src/test.js:10:5:10:34 | respons ... 1', '') | src/test.js:9:19:11:1 | functio ... ition\\n} |
@@ -36,8 +38,10 @@ test_ServerDefinition
 | src/test.js:4:15:4:36 | restify ... erver() |
 test_RouteHandler_getAResponseExpr
 | src/test.js:9:19:11:1 | functio ... ition\\n} | src/test.js:9:46:9:53 | response |
+| src/test.js:9:19:11:1 | functio ... ition\\n} | src/test.js:9:46:9:53 | response |
 | src/test.js:9:19:11:1 | functio ... ition\\n} | src/test.js:10:5:10:12 | response |
 | src/test.js:12:19:22:1 | functio ... okie;\\n} | src/test.js:12:46:12:53 | response |
+| src/test.js:12:19:22:1 | functio ... okie;\\n} | src/test.js:12:46:12:53 | response |
 | src/test.js:12:19:22:1 | functio ... okie;\\n} | src/test.js:13:5:13:12 | response |
 test_RouteSetup_getARouteHandler
 | src/test.js:7:1:7:26 | server2 ... ndler1) | src/test.js:6:1:6:21 | functio ... er1(){} |
@@ -50,6 +54,7 @@ test_RouteHandler
 test_RequestExpr
 | src/test.js:9:37:9:43 | request | src/test.js:9:19:11:1 | functio ... ition\\n} |
 | src/test.js:12:37:12:43 | request | src/test.js:12:19:22:1 | functio ... okie;\\n} |
+| src/test.js:12:37:12:43 | request | src/test.js:12:19:22:1 | functio ... okie;\\n} |
 | src/test.js:14:5:14:11 | request | src/test.js:12:19:22:1 | functio ... okie;\\n} |
 | src/test.js:15:5:15:11 | request | src/test.js:12:19:22:1 | functio ... okie;\\n} |
 | src/test.js:16:5:16:11 | request | src/test.js:12:19:22:1 | functio ... okie;\\n} |
@@ -61,6 +66,7 @@ test_RequestExpr
 test_RouteHandler_getARequestExpr
 | src/test.js:9:19:11:1 | functio ... ition\\n} | src/test.js:9:37:9:43 | request |
 | src/test.js:12:19:22:1 | functio ... okie;\\n} | src/test.js:12:37:12:43 | request |
+| src/test.js:12:19:22:1 | functio ... okie;\\n} | src/test.js:12:37:12:43 | request |
 | src/test.js:12:19:22:1 | functio ... okie;\\n} | src/test.js:14:5:14:11 | request |
 | src/test.js:12:19:22:1 | functio ... okie;\\n} | src/test.js:15:5:15:11 | request |
 | src/test.js:12:19:22:1 | functio ... okie;\\n} | src/test.js:16:5:16:11 | request |
diff --git a/javascript/ql/test/query-tests/Declarations/UnusedParameter/UnusedParameter.expected b/javascript/ql/test/query-tests/Declarations/UnusedParameter/UnusedParameter.expected
index fde6450e8e0..34cf2d268dc 100644
--- a/javascript/ql/test/query-tests/Declarations/UnusedParameter/UnusedParameter.expected
+++ b/javascript/ql/test/query-tests/Declarations/UnusedParameter/UnusedParameter.expected
@@ -1,6 +1,6 @@
-| istype.ts:18:15:18:18 | node | Unused parameter node. |
-| parameter_field.ts:6:15:6:15 | x | Unused parameter x. |
-| tst2.js:1:12:1:12 | x | Unused parameter x. |
-| tst2.js:29:12:29:12 | x | Unused parameter x. |
-| tst.js:7:32:7:34 | idx | Unused parameter idx. |
-| tst.js:12:13:12:13 | x | Unused parameter x. |
+| istype.ts:18:15:18:18 | node | The parameter 'node' is never used. |
+| parameter_field.ts:6:15:6:15 | x | The parameter 'x' is never used. |
+| tst2.js:1:12:1:12 | x | The parameter 'x' is never used. |
+| tst2.js:29:12:29:12 | x | The parameter 'x' is never used. |
+| tst.js:7:32:7:34 | idx | The parameter 'idx' is never used. |
+| tst.js:12:13:12:13 | x | The parameter 'x' is never used. |
diff --git a/javascript/ql/test/query-tests/Expressions/BitwiseSignCheck/BitwiseSignCheck.expected b/javascript/ql/test/query-tests/Expressions/BitwiseSignCheck/BitwiseSignCheck.expected
index 95e202a6752..c82afd5c4ca 100644
--- a/javascript/ql/test/query-tests/Expressions/BitwiseSignCheck/BitwiseSignCheck.expected
+++ b/javascript/ql/test/query-tests/Expressions/BitwiseSignCheck/BitwiseSignCheck.expected
@@ -1,3 +1,3 @@
-| tst.js:2:9:2:24 | (x & (1<<n)) > 0 | Sign check of a bitwise operation |
-| tst.js:14:13:14:25 | (x >>> 0) > 0 | Sign check of a bitwise operation |
-| tst.js:23:1:23:21 | (x & 0x ... 00) > 0 | Sign check of a bitwise operation |
+| tst.js:2:9:2:24 | (x & (1<<n)) > 0 | Potentially unsafe sign check of a bitwise operation. |
+| tst.js:14:13:14:25 | (x >>> 0) > 0 | Potentially unsafe sign check of a bitwise operation. |
+| tst.js:23:1:23:21 | (x & 0x ... 00) > 0 | Potentially unsafe sign check of a bitwise operation. |
diff --git a/javascript/ql/test/query-tests/RegExp/RegExpAlwaysMatches/RegExpAlwaysMatches.expected b/javascript/ql/test/query-tests/RegExp/RegExpAlwaysMatches/RegExpAlwaysMatches.expected
index 20c613bdd91..5d3568e728c 100644
--- a/javascript/ql/test/query-tests/RegExp/RegExpAlwaysMatches/RegExpAlwaysMatches.expected
+++ b/javascript/ql/test/query-tests/RegExp/RegExpAlwaysMatches/RegExpAlwaysMatches.expected
@@ -3,6 +3,5 @@
 | tst.js:22:11:22:34 | ^(?:https?:\|ftp:\|file:)? | This regular expression always matches when used in a test $@, as it can match an empty substring. | tst.js:22:10:22:43 | /^(?:ht ... test(x) | here |
 | tst.js:30:11:30:20 | (foo\|bar)? | This regular expression always matches when used in a test $@, as it can match an empty substring. | tst.js:30:10:30:29 | /(foo\|bar)?/.test(x) | here |
 | tst.js:34:21:34:26 | (baz)? | This regular expression always matches when used in a test $@, as it can match an empty substring. | tst.js:34:10:34:35 | /^foo\|b ... test(x) | here |
-| tst.js:58:20:58:25 | [a-z]* | This regular expression always the matches at index 0 when used $@, as it matches the empty substring. | tst.js:58:10:58:27 | x.search(/[a-z]*/) | here |
-| tst.js:70:20:70:26 | ^(foo)? | This regular expression always the matches at index 0 when used $@, as it matches the empty substring. | tst.js:70:10:70:28 | x.search(/^(foo)?/) | here |
-| tst.js:86:22:86:21 |  | This regular expression always matches when used in a test $@, as it can match an empty substring. | tst.js:86:10:86:31 | new Reg ... test(x) | here |
+| tst.js:58:20:58:25 | [a-z]* | This regular expression always matches at index 0 when used $@, as it matches the empty substring. | tst.js:58:10:58:27 | x.search(/[a-z]*/) | here |
+| tst.js:70:20:70:26 | ^(foo)? | This regular expression always matches at index 0 when used $@, as it matches the empty substring. | tst.js:70:10:70:28 | x.search(/^(foo)?/) | here |
diff --git a/javascript/ql/test/query-tests/RegExp/RegExpAlwaysMatches/tst.js b/javascript/ql/test/query-tests/RegExp/RegExpAlwaysMatches/tst.js
index c9f581a6f65..a266e2d86f6 100644
--- a/javascript/ql/test/query-tests/RegExp/RegExpAlwaysMatches/tst.js
+++ b/javascript/ql/test/query-tests/RegExp/RegExpAlwaysMatches/tst.js
@@ -83,10 +83,10 @@ function nonWordBoundary(x) {
 }
 
 function emptyRegex(x) {
-  return new RegExp("").test(x); // NOT OK
+  return new RegExp("").test(x); // OK
 }
 
 function parserTest(x) {
   /(\w\s*:\s*[^:}]+|#){|@import[^\n]+(?:url|,)/.test(x); // OK
-  /^((?:a{0,2}|-)|\w\{\d,\d\})+X$/.text(x); // ok 
-}
\ No newline at end of file
+  /^((?:a{0,2}|-)|\w\{\d,\d\})+X$/.text(x); // ok
+}
diff --git a/javascript/ql/test/query-tests/Security/CWE-020/SuspiciousRegexpRange/tst.js b/javascript/ql/test/query-tests/Security/CWE-020/SuspiciousRegexpRange/tst.js
index 62d325539ff..a698856d379 100644
--- a/javascript/ql/test/query-tests/Security/CWE-020/SuspiciousRegexpRange/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-020/SuspiciousRegexpRange/tst.js
@@ -25,3 +25,6 @@ var numberToLetter = /[7-F]/; // NOT OK
 var overlapsWithClass1 = /[0-9\d]/; // NOT OK
 
 var overlapsWithClass2 = /[\w,.-?:*+]/; // NOT OK
+
+var tst2 = /^([ァ-ヾ]|[ｧ-ﾝﾞﾟ])+$/; // OK
+var tst3 = /[0-9０-９]/; // OK
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlip.expected b/javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlip.expected
index 71a0dbc910a..ab5556d36a6 100644
--- a/javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlip.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlip.expected
@@ -126,13 +126,13 @@ edges
 | ZipSlipBadUnzipper.js:7:20:7:29 | entry.path | ZipSlipBadUnzipper.js:7:9:7:29 | fileName |
 | ZipSlipBadUnzipper.js:7:20:7:29 | entry.path | ZipSlipBadUnzipper.js:7:9:7:29 | fileName |
 #select
-| AdmZipBad.js:6:24:6:41 | zipEntry.entryName | AdmZipBad.js:6:24:6:41 | zipEntry.entryName | AdmZipBad.js:6:24:6:41 | zipEntry.entryName | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | AdmZipBad.js:6:24:6:41 | zipEntry.entryName | item path |
-| TarSlipBad.js:6:36:6:46 | header.name | TarSlipBad.js:6:36:6:46 | header.name | TarSlipBad.js:6:36:6:46 | header.name | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | TarSlipBad.js:6:36:6:46 | header.name | item path |
-| TarSlipBad.js:9:17:9:31 | header.linkname | TarSlipBad.js:9:17:9:31 | header.linkname | TarSlipBad.js:9:17:9:31 | header.linkname | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | TarSlipBad.js:9:17:9:31 | header.linkname | item path |
-| ZipSlipBad2.js:6:22:6:29 | fileName | ZipSlipBad2.js:5:37:5:46 | entry.path | ZipSlipBad2.js:6:22:6:29 | fileName | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlipBad2.js:5:37:5:46 | entry.path | item path |
-| ZipSlipBad.js:8:37:8:44 | fileName | ZipSlipBad.js:7:22:7:31 | entry.path | ZipSlipBad.js:8:37:8:44 | fileName | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlipBad.js:7:22:7:31 | entry.path | item path |
-| ZipSlipBad.js:16:30:16:37 | fileName | ZipSlipBad.js:15:22:15:31 | entry.path | ZipSlipBad.js:16:30:16:37 | fileName | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlipBad.js:15:22:15:31 | entry.path | item path |
-| ZipSlipBad.js:23:28:23:35 | fileName | ZipSlipBad.js:22:22:22:31 | entry.path | ZipSlipBad.js:23:28:23:35 | fileName | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlipBad.js:22:22:22:31 | entry.path | item path |
-| ZipSlipBad.js:31:26:31:29 | name | ZipSlipBad.js:30:14:30:17 | name | ZipSlipBad.js:31:26:31:29 | name | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlipBad.js:30:14:30:17 | name | item path |
-| ZipSlipBad.js:35:26:35:29 | name | ZipSlipBad.js:34:16:34:19 | name | ZipSlipBad.js:35:26:35:29 | name | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlipBad.js:34:16:34:19 | name | item path |
-| ZipSlipBadUnzipper.js:8:37:8:44 | fileName | ZipSlipBadUnzipper.js:7:20:7:29 | entry.path | ZipSlipBadUnzipper.js:8:37:8:44 | fileName | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlipBadUnzipper.js:7:20:7:29 | entry.path | item path |
+| AdmZipBad.js:6:24:6:41 | zipEntry.entryName | AdmZipBad.js:6:24:6:41 | zipEntry.entryName | AdmZipBad.js:6:24:6:41 | zipEntry.entryName | $@ depends on $@ which may contain '..' | AdmZipBad.js:6:24:6:41 | zipEntry.entryName | File system operation | AdmZipBad.js:6:24:6:41 | zipEntry.entryName | unsanitized archive entry |
+| TarSlipBad.js:6:36:6:46 | header.name | TarSlipBad.js:6:36:6:46 | header.name | TarSlipBad.js:6:36:6:46 | header.name | $@ depends on $@ which may contain '..' | TarSlipBad.js:6:36:6:46 | header.name | File system operation | TarSlipBad.js:6:36:6:46 | header.name | unsanitized archive entry |
+| TarSlipBad.js:9:17:9:31 | header.linkname | TarSlipBad.js:9:17:9:31 | header.linkname | TarSlipBad.js:9:17:9:31 | header.linkname | $@ depends on $@ which may contain '..' | TarSlipBad.js:9:17:9:31 | header.linkname | File system operation | TarSlipBad.js:9:17:9:31 | header.linkname | unsanitized archive entry |
+| ZipSlipBad2.js:5:37:5:46 | entry.path | ZipSlipBad2.js:5:37:5:46 | entry.path | ZipSlipBad2.js:6:22:6:29 | fileName | $@ depends on $@ which may contain '..' | ZipSlipBad2.js:6:22:6:29 | fileName | File system operation | ZipSlipBad2.js:5:37:5:46 | entry.path | unsanitized archive entry |
+| ZipSlipBad.js:7:22:7:31 | entry.path | ZipSlipBad.js:7:22:7:31 | entry.path | ZipSlipBad.js:8:37:8:44 | fileName | $@ depends on $@ which may contain '..' | ZipSlipBad.js:8:37:8:44 | fileName | File system operation | ZipSlipBad.js:7:22:7:31 | entry.path | unsanitized archive entry |
+| ZipSlipBad.js:15:22:15:31 | entry.path | ZipSlipBad.js:15:22:15:31 | entry.path | ZipSlipBad.js:16:30:16:37 | fileName | $@ depends on $@ which may contain '..' | ZipSlipBad.js:16:30:16:37 | fileName | File system operation | ZipSlipBad.js:15:22:15:31 | entry.path | unsanitized archive entry |
+| ZipSlipBad.js:22:22:22:31 | entry.path | ZipSlipBad.js:22:22:22:31 | entry.path | ZipSlipBad.js:23:28:23:35 | fileName | $@ depends on $@ which may contain '..' | ZipSlipBad.js:23:28:23:35 | fileName | File system operation | ZipSlipBad.js:22:22:22:31 | entry.path | unsanitized archive entry |
+| ZipSlipBad.js:30:14:30:17 | name | ZipSlipBad.js:30:14:30:17 | name | ZipSlipBad.js:31:26:31:29 | name | $@ depends on $@ which may contain '..' | ZipSlipBad.js:31:26:31:29 | name | File system operation | ZipSlipBad.js:30:14:30:17 | name | unsanitized archive entry |
+| ZipSlipBad.js:34:16:34:19 | name | ZipSlipBad.js:34:16:34:19 | name | ZipSlipBad.js:35:26:35:29 | name | $@ depends on $@ which may contain '..' | ZipSlipBad.js:35:26:35:29 | name | File system operation | ZipSlipBad.js:34:16:34:19 | name | unsanitized archive entry |
+| ZipSlipBadUnzipper.js:7:20:7:29 | entry.path | ZipSlipBadUnzipper.js:7:20:7:29 | entry.path | ZipSlipBadUnzipper.js:8:37:8:44 | fileName | $@ depends on $@ which may contain '..' | ZipSlipBadUnzipper.js:8:37:8:44 | fileName | File system operation | ZipSlipBadUnzipper.js:7:20:7:29 | entry.path | unsanitized archive entry |
diff --git a/javascript/ql/test/query-tests/Security/CWE-073/TemplateObjectInjection.expected b/javascript/ql/test/query-tests/Security/CWE-073/TemplateObjectInjection.expected
index 589023997f5..5036473570d 100644
--- a/javascript/ql/test/query-tests/Security/CWE-073/TemplateObjectInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-073/TemplateObjectInjection.expected
@@ -108,13 +108,13 @@ edges
 | tst.js:29:39:29:41 | str | tst.js:29:28:29:42 | JSON.parse(str) |
 | tst.js:29:39:29:41 | str | tst.js:29:28:29:42 | JSON.parse(str) |
 #select
-| routes.js:2:23:2:30 | req.body | routes.js:2:23:2:30 | req.body | routes.js:2:23:2:30 | req.body | Template object injection due to $@. | routes.js:2:23:2:30 | req.body | user-provided value |
-| tst2.js:7:28:7:40 | bodyParameter | tst2.js:6:25:6:32 | req.body | tst2.js:7:28:7:40 | bodyParameter | Template object injection due to $@. | tst2.js:6:25:6:32 | req.body | user-provided value |
-| tst2.js:27:28:27:40 | bodyParameter | tst2.js:26:25:26:32 | req.body | tst2.js:27:28:27:40 | bodyParameter | Template object injection due to $@. | tst2.js:26:25:26:32 | req.body | user-provided value |
-| tst2.js:35:28:35:40 | bodyParameter | tst2.js:34:25:34:32 | req.body | tst2.js:35:28:35:40 | bodyParameter | Template object injection due to $@. | tst2.js:34:25:34:32 | req.body | user-provided value |
-| tst2.js:43:28:43:40 | bodyParameter | tst2.js:42:25:42:32 | req.body | tst2.js:43:28:43:40 | bodyParameter | Template object injection due to $@. | tst2.js:42:25:42:32 | req.body | user-provided value |
-| tst2.js:52:28:52:40 | bodyParameter | tst2.js:51:25:51:32 | req.body | tst2.js:52:28:52:40 | bodyParameter | Template object injection due to $@. | tst2.js:51:25:51:32 | req.body | user-provided value |
-| tst.js:10:28:10:40 | bodyParameter | tst.js:7:25:7:32 | req.body | tst.js:10:28:10:40 | bodyParameter | Template object injection due to $@. | tst.js:7:25:7:32 | req.body | user-provided value |
-| tst.js:11:28:11:41 | queryParameter | tst.js:8:26:8:49 | req.que ... rameter | tst.js:11:28:11:41 | queryParameter | Template object injection due to $@. | tst.js:8:26:8:49 | req.que ... rameter | user-provided value |
-| tst.js:24:28:24:30 | obj | tst.js:8:26:8:49 | req.que ... rameter | tst.js:24:28:24:30 | obj | Template object injection due to $@. | tst.js:8:26:8:49 | req.que ... rameter | user-provided value |
-| tst.js:29:28:29:42 | JSON.parse(str) | tst.js:8:26:8:49 | req.que ... rameter | tst.js:29:28:29:42 | JSON.parse(str) | Template object injection due to $@. | tst.js:8:26:8:49 | req.que ... rameter | user-provided value |
+| routes.js:2:23:2:30 | req.body | routes.js:2:23:2:30 | req.body | routes.js:2:23:2:30 | req.body | Template object depends on $@. | routes.js:2:23:2:30 | req.body | a user-provided value |
+| tst2.js:7:28:7:40 | bodyParameter | tst2.js:6:25:6:32 | req.body | tst2.js:7:28:7:40 | bodyParameter | Template object depends on $@. | tst2.js:6:25:6:32 | req.body | a user-provided value |
+| tst2.js:27:28:27:40 | bodyParameter | tst2.js:26:25:26:32 | req.body | tst2.js:27:28:27:40 | bodyParameter | Template object depends on $@. | tst2.js:26:25:26:32 | req.body | a user-provided value |
+| tst2.js:35:28:35:40 | bodyParameter | tst2.js:34:25:34:32 | req.body | tst2.js:35:28:35:40 | bodyParameter | Template object depends on $@. | tst2.js:34:25:34:32 | req.body | a user-provided value |
+| tst2.js:43:28:43:40 | bodyParameter | tst2.js:42:25:42:32 | req.body | tst2.js:43:28:43:40 | bodyParameter | Template object depends on $@. | tst2.js:42:25:42:32 | req.body | a user-provided value |
+| tst2.js:52:28:52:40 | bodyParameter | tst2.js:51:25:51:32 | req.body | tst2.js:52:28:52:40 | bodyParameter | Template object depends on $@. | tst2.js:51:25:51:32 | req.body | a user-provided value |
+| tst.js:10:28:10:40 | bodyParameter | tst.js:7:25:7:32 | req.body | tst.js:10:28:10:40 | bodyParameter | Template object depends on $@. | tst.js:7:25:7:32 | req.body | a user-provided value |
+| tst.js:11:28:11:41 | queryParameter | tst.js:8:26:8:49 | req.que ... rameter | tst.js:11:28:11:41 | queryParameter | Template object depends on $@. | tst.js:8:26:8:49 | req.que ... rameter | a user-provided value |
+| tst.js:24:28:24:30 | obj | tst.js:8:26:8:49 | req.que ... rameter | tst.js:24:28:24:30 | obj | Template object depends on $@. | tst.js:8:26:8:49 | req.que ... rameter | a user-provided value |
+| tst.js:29:28:29:42 | JSON.parse(str) | tst.js:8:26:8:49 | req.que ... rameter | tst.js:29:28:29:42 | JSON.parse(str) | Template object depends on $@. | tst.js:8:26:8:49 | req.que ... rameter | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected b/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
index 3e53d9b79b8..9039adda7e6 100644
--- a/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection.expected
@@ -134,6 +134,12 @@ nodes
 | form-parsers.js:59:10:59:33 | "touch  ... ilename |
 | form-parsers.js:59:21:59:24 | part |
 | form-parsers.js:59:21:59:33 | part.filename |
+| lib/subLib4/index.js:6:32:6:35 | name |
+| lib/subLib4/index.js:7:18:7:21 | name |
+| lib/subLib4/subsub.js:3:28:3:31 | name |
+| lib/subLib4/subsub.js:4:10:4:25 | "rm -rf " + name |
+| lib/subLib4/subsub.js:4:10:4:25 | "rm -rf " + name |
+| lib/subLib4/subsub.js:4:22:4:25 | name |
 | lib/subLib/index.js:7:32:7:35 | name |
 | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
 | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
@@ -232,6 +238,8 @@ edges
 | child_process-test.js:73:25:73:31 | req.url | child_process-test.js:73:15:73:38 | url.par ... , true) |
 | child_process-test.js:73:25:73:31 | req.url | child_process-test.js:73:15:73:38 | url.par ... , true) |
 | child_process-test.js:83:19:83:36 | req.query.fileName | child_process-test.js:83:19:83:36 | req.query.fileName |
+| child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib4/index.js:6:32:6:35 | name |
+| child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib4/index.js:6:32:6:35 | name |
 | child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib/index.js:7:32:7:35 | name |
 | child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib/index.js:7:32:7:35 | name |
 | child_process-test.js:94:21:94:30 | ctx.params | child_process-test.js:94:21:94:35 | ctx.params.host |
@@ -306,6 +314,11 @@ edges
 | form-parsers.js:59:21:59:24 | part | form-parsers.js:59:21:59:33 | part.filename |
 | form-parsers.js:59:21:59:33 | part.filename | form-parsers.js:59:10:59:33 | "touch  ... ilename |
 | form-parsers.js:59:21:59:33 | part.filename | form-parsers.js:59:10:59:33 | "touch  ... ilename |
+| lib/subLib4/index.js:6:32:6:35 | name | lib/subLib4/index.js:7:18:7:21 | name |
+| lib/subLib4/index.js:7:18:7:21 | name | lib/subLib4/subsub.js:3:28:3:31 | name |
+| lib/subLib4/subsub.js:3:28:3:31 | name | lib/subLib4/subsub.js:4:22:4:25 | name |
+| lib/subLib4/subsub.js:4:22:4:25 | name | lib/subLib4/subsub.js:4:10:4:25 | "rm -rf " + name |
+| lib/subLib4/subsub.js:4:22:4:25 | name | lib/subLib4/subsub.js:4:10:4:25 | "rm -rf " + name |
 | lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name |
 | lib/subLib/index.js:8:22:8:25 | name | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
 | lib/subLib/index.js:8:22:8:25 | name | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name |
@@ -355,53 +368,54 @@ edges
 | third-party-command-injection.js:5:20:5:26 | command | third-party-command-injection.js:6:21:6:27 | command |
 | third-party-command-injection.js:5:20:5:26 | command | third-party-command-injection.js:6:21:6:27 | command |
 #select
-| child_process-test.js:17:13:17:15 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:17:13:17:15 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:18:17:18:19 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:18:17:18:19 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:19:17:19:19 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:19:17:19:19 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:20:21:20:23 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:20:21:20:23 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:21:14:21:16 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:21:14:21:16 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:22:18:22:20 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:22:18:22:20 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:23:13:23:15 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:23:13:23:15 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:25:13:25:31 | "foo" + cmd + "bar" | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:25:13:25:31 | "foo" + cmd + "bar" | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:39:5:39:31 | cp.spaw ...  cmd ]) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:39:26:39:28 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:44:5:44:34 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:43:15:43:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:54:5:54:39 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:53:15:53:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:56:5:56:59 | cp.spaw ...  cmd])) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:56:25:56:58 | ['/C',  ... , cmd]) | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:56:5:56:59 | cp.spaw ...  cmd])) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:56:54:56:56 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:57:5:57:50 | cp.spaw ... t(cmd)) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:6:15:6:49 | url.par ... ry.path | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:57:5:57:50 | cp.spaw ... t(cmd)) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:57:25:57:49 | ['/C',  ... at(cmd) | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:62:5:62:39 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:53:15:53:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:67:3:67:21 | cp.spawn(cmd, args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:48:15:48:17 | cmd | This command depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
-| child_process-test.js:75:29:75:31 | cmd | child_process-test.js:73:25:73:31 | req.url | child_process-test.js:75:29:75:31 | cmd | This command depends on $@. | child_process-test.js:73:25:73:31 | req.url | a user-provided value |
-| child_process-test.js:83:19:83:36 | req.query.fileName | child_process-test.js:83:19:83:36 | req.query.fileName | child_process-test.js:83:19:83:36 | req.query.fileName | This command depends on $@. | child_process-test.js:83:19:83:36 | req.query.fileName | a user-provided value |
-| child_process-test.js:94:11:94:35 | "ping " ... ms.host | child_process-test.js:94:21:94:30 | ctx.params | child_process-test.js:94:11:94:35 | "ping " ... ms.host | This command depends on $@. | child_process-test.js:94:21:94:30 | ctx.params | a user-provided value |
-| exec-sh2.js:10:12:10:57 | cp.spaw ... ptions) | exec-sh2.js:14:25:14:31 | req.url | exec-sh2.js:10:40:10:46 | command | This command depends on $@. | exec-sh2.js:14:25:14:31 | req.url | a user-provided value |
-| exec-sh.js:15:12:15:61 | cp.spaw ... ptions) | exec-sh.js:19:25:19:31 | req.url | exec-sh.js:15:44:15:50 | command | This command depends on $@. | exec-sh.js:19:25:19:31 | req.url | a user-provided value |
-| execSeries.js:14:41:14:47 | command | execSeries.js:18:34:18:40 | req.url | execSeries.js:14:41:14:47 | command | This command depends on $@. | execSeries.js:18:34:18:40 | req.url | a user-provided value |
-| form-parsers.js:9:8:9:39 | "touch  ... nalname | form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:8:9:39 | "touch  ... nalname | This command depends on $@. | form-parsers.js:9:19:9:26 | req.file | a user-provided value |
-| form-parsers.js:14:10:14:37 | "touch  ... nalname | form-parsers.js:13:3:13:11 | req.files | form-parsers.js:14:10:14:37 | "touch  ... nalname | This command depends on $@. | form-parsers.js:13:3:13:11 | req.files | a user-provided value |
-| form-parsers.js:25:10:25:28 | "touch " + filename | form-parsers.js:24:48:24:55 | filename | form-parsers.js:25:10:25:28 | "touch " + filename | This command depends on $@. | form-parsers.js:24:48:24:55 | filename | a user-provided value |
-| form-parsers.js:36:10:36:31 | "touch  ... ds.name | form-parsers.js:35:25:35:30 | fields | form-parsers.js:36:10:36:31 | "touch  ... ds.name | This command depends on $@. | form-parsers.js:35:25:35:30 | fields | a user-provided value |
-| form-parsers.js:41:10:41:31 | "touch  ... ds.name | form-parsers.js:40:26:40:31 | fields | form-parsers.js:41:10:41:31 | "touch  ... ds.name | This command depends on $@. | form-parsers.js:40:26:40:31 | fields | a user-provided value |
-| form-parsers.js:53:10:53:31 | "touch  ... ds.name | form-parsers.js:52:34:52:39 | fields | form-parsers.js:53:10:53:31 | "touch  ... ds.name | This command depends on $@. | form-parsers.js:52:34:52:39 | fields | a user-provided value |
-| form-parsers.js:59:10:59:33 | "touch  ... ilename | form-parsers.js:58:30:58:33 | part | form-parsers.js:59:10:59:33 | "touch  ... ilename | This command depends on $@. | form-parsers.js:58:30:58:33 | part | a user-provided value |
-| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | This command depends on $@. | child_process-test.js:85:37:85:54 | req.query.fileName | a user-provided value |
-| other.js:7:33:7:35 | cmd | other.js:5:25:5:31 | req.url | other.js:7:33:7:35 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:8:28:8:30 | cmd | other.js:5:25:5:31 | req.url | other.js:8:28:8:30 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:9:32:9:34 | cmd | other.js:5:25:5:31 | req.url | other.js:9:32:9:34 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:10:29:10:31 | cmd | other.js:5:25:5:31 | req.url | other.js:10:29:10:31 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:11:29:11:31 | cmd | other.js:5:25:5:31 | req.url | other.js:11:29:11:31 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:12:27:12:29 | cmd | other.js:5:25:5:31 | req.url | other.js:12:27:12:29 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:14:28:14:30 | cmd | other.js:5:25:5:31 | req.url | other.js:14:28:14:30 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:15:34:15:36 | cmd | other.js:5:25:5:31 | req.url | other.js:15:34:15:36 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:16:21:16:23 | cmd | other.js:5:25:5:31 | req.url | other.js:16:21:16:23 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:17:27:17:29 | cmd | other.js:5:25:5:31 | req.url | other.js:17:27:17:29 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:18:22:18:24 | cmd | other.js:5:25:5:31 | req.url | other.js:18:22:18:24 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:19:36:19:38 | cmd | other.js:5:25:5:31 | req.url | other.js:19:36:19:38 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:22:21:22:23 | cmd | other.js:5:25:5:31 | req.url | other.js:22:21:22:23 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:23:28:23:30 | cmd | other.js:5:25:5:31 | req.url | other.js:23:28:23:30 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:26:34:26:36 | cmd | other.js:5:25:5:31 | req.url | other.js:26:34:26:36 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:28:27:28:29 | cmd | other.js:5:25:5:31 | req.url | other.js:28:27:28:29 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:30:33:30:35 | cmd | other.js:5:25:5:31 | req.url | other.js:30:33:30:35 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| other.js:34:44:34:46 | cmd | other.js:5:25:5:31 | req.url | other.js:34:44:34:46 | cmd | This command depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
-| third-party-command-injection.js:6:21:6:27 | command | third-party-command-injection.js:5:20:5:26 | command | third-party-command-injection.js:6:21:6:27 | command | This command depends on $@. | third-party-command-injection.js:5:20:5:26 | command | a server-provided value |
+| child_process-test.js:17:13:17:15 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:17:13:17:15 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:18:17:18:19 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:18:17:18:19 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:19:17:19:19 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:19:17:19:19 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:20:21:20:23 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:20:21:20:23 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:21:14:21:16 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:21:14:21:16 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:22:18:22:20 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:22:18:22:20 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:23:13:23:15 | cmd | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:23:13:23:15 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:25:13:25:31 | "foo" + cmd + "bar" | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:25:13:25:31 | "foo" + cmd + "bar" | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:39:5:39:31 | cp.spaw ...  cmd ]) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:39:26:39:28 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:44:5:44:34 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:43:15:43:17 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:54:5:54:39 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:53:15:53:17 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:56:5:56:59 | cp.spaw ...  cmd])) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:56:25:56:58 | ['/C',  ... , cmd]) | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:56:5:56:59 | cp.spaw ...  cmd])) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:56:54:56:56 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:57:5:57:50 | cp.spaw ... t(cmd)) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:6:15:6:49 | url.par ... ry.path | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:57:5:57:50 | cp.spaw ... t(cmd)) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:57:25:57:49 | ['/C',  ... at(cmd) | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:62:5:62:39 | cp.exec ... , args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:53:15:53:17 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:67:3:67:21 | cp.spawn(cmd, args) | child_process-test.js:6:25:6:31 | req.url | child_process-test.js:48:15:48:17 | cmd | Command line depends on $@. | child_process-test.js:6:25:6:31 | req.url | a user-provided value |
+| child_process-test.js:75:29:75:31 | cmd | child_process-test.js:73:25:73:31 | req.url | child_process-test.js:75:29:75:31 | cmd | Command line depends on $@. | child_process-test.js:73:25:73:31 | req.url | a user-provided value |
+| child_process-test.js:83:19:83:36 | req.query.fileName | child_process-test.js:83:19:83:36 | req.query.fileName | child_process-test.js:83:19:83:36 | req.query.fileName | Command line depends on $@. | child_process-test.js:83:19:83:36 | req.query.fileName | a user-provided value |
+| child_process-test.js:94:11:94:35 | "ping " ... ms.host | child_process-test.js:94:21:94:30 | ctx.params | child_process-test.js:94:11:94:35 | "ping " ... ms.host | Command line depends on $@. | child_process-test.js:94:21:94:30 | ctx.params | a user-provided value |
+| exec-sh2.js:10:12:10:57 | cp.spaw ... ptions) | exec-sh2.js:14:25:14:31 | req.url | exec-sh2.js:10:40:10:46 | command | Command line depends on $@. | exec-sh2.js:14:25:14:31 | req.url | a user-provided value |
+| exec-sh.js:15:12:15:61 | cp.spaw ... ptions) | exec-sh.js:19:25:19:31 | req.url | exec-sh.js:15:44:15:50 | command | Command line depends on $@. | exec-sh.js:19:25:19:31 | req.url | a user-provided value |
+| execSeries.js:14:41:14:47 | command | execSeries.js:18:34:18:40 | req.url | execSeries.js:14:41:14:47 | command | Command line depends on $@. | execSeries.js:18:34:18:40 | req.url | a user-provided value |
+| form-parsers.js:9:8:9:39 | "touch  ... nalname | form-parsers.js:9:19:9:26 | req.file | form-parsers.js:9:8:9:39 | "touch  ... nalname | Command line depends on $@. | form-parsers.js:9:19:9:26 | req.file | a user-provided value |
+| form-parsers.js:14:10:14:37 | "touch  ... nalname | form-parsers.js:13:3:13:11 | req.files | form-parsers.js:14:10:14:37 | "touch  ... nalname | Command line depends on $@. | form-parsers.js:13:3:13:11 | req.files | a user-provided value |
+| form-parsers.js:25:10:25:28 | "touch " + filename | form-parsers.js:24:48:24:55 | filename | form-parsers.js:25:10:25:28 | "touch " + filename | Command line depends on $@. | form-parsers.js:24:48:24:55 | filename | a user-provided value |
+| form-parsers.js:36:10:36:31 | "touch  ... ds.name | form-parsers.js:35:25:35:30 | fields | form-parsers.js:36:10:36:31 | "touch  ... ds.name | Command line depends on $@. | form-parsers.js:35:25:35:30 | fields | a user-provided value |
+| form-parsers.js:41:10:41:31 | "touch  ... ds.name | form-parsers.js:40:26:40:31 | fields | form-parsers.js:41:10:41:31 | "touch  ... ds.name | Command line depends on $@. | form-parsers.js:40:26:40:31 | fields | a user-provided value |
+| form-parsers.js:53:10:53:31 | "touch  ... ds.name | form-parsers.js:52:34:52:39 | fields | form-parsers.js:53:10:53:31 | "touch  ... ds.name | Command line depends on $@. | form-parsers.js:52:34:52:39 | fields | a user-provided value |
+| form-parsers.js:59:10:59:33 | "touch  ... ilename | form-parsers.js:58:30:58:33 | part | form-parsers.js:59:10:59:33 | "touch  ... ilename | Command line depends on $@. | form-parsers.js:58:30:58:33 | part | a user-provided value |
+| lib/subLib4/subsub.js:4:10:4:25 | "rm -rf " + name | child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib4/subsub.js:4:10:4:25 | "rm -rf " + name | Command line depends on $@. | child_process-test.js:85:37:85:54 | req.query.fileName | a user-provided value |
+| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | child_process-test.js:85:37:85:54 | req.query.fileName | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | Command line depends on $@. | child_process-test.js:85:37:85:54 | req.query.fileName | a user-provided value |
+| other.js:7:33:7:35 | cmd | other.js:5:25:5:31 | req.url | other.js:7:33:7:35 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:8:28:8:30 | cmd | other.js:5:25:5:31 | req.url | other.js:8:28:8:30 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:9:32:9:34 | cmd | other.js:5:25:5:31 | req.url | other.js:9:32:9:34 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:10:29:10:31 | cmd | other.js:5:25:5:31 | req.url | other.js:10:29:10:31 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:11:29:11:31 | cmd | other.js:5:25:5:31 | req.url | other.js:11:29:11:31 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:12:27:12:29 | cmd | other.js:5:25:5:31 | req.url | other.js:12:27:12:29 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:14:28:14:30 | cmd | other.js:5:25:5:31 | req.url | other.js:14:28:14:30 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:15:34:15:36 | cmd | other.js:5:25:5:31 | req.url | other.js:15:34:15:36 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:16:21:16:23 | cmd | other.js:5:25:5:31 | req.url | other.js:16:21:16:23 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:17:27:17:29 | cmd | other.js:5:25:5:31 | req.url | other.js:17:27:17:29 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:18:22:18:24 | cmd | other.js:5:25:5:31 | req.url | other.js:18:22:18:24 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:19:36:19:38 | cmd | other.js:5:25:5:31 | req.url | other.js:19:36:19:38 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:22:21:22:23 | cmd | other.js:5:25:5:31 | req.url | other.js:22:21:22:23 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:23:28:23:30 | cmd | other.js:5:25:5:31 | req.url | other.js:23:28:23:30 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:26:34:26:36 | cmd | other.js:5:25:5:31 | req.url | other.js:26:34:26:36 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:28:27:28:29 | cmd | other.js:5:25:5:31 | req.url | other.js:28:27:28:29 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:30:33:30:35 | cmd | other.js:5:25:5:31 | req.url | other.js:30:33:30:35 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| other.js:34:44:34:46 | cmd | other.js:5:25:5:31 | req.url | other.js:34:44:34:46 | cmd | Command line depends on $@. | other.js:5:25:5:31 | req.url | a user-provided value |
+| third-party-command-injection.js:6:21:6:27 | command | third-party-command-injection.js:5:20:5:26 | command | third-party-command-injection.js:6:21:6:27 | command | Command line depends on $@. | third-party-command-injection.js:5:20:5:26 | command | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction.expected b/javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction.expected
index 035eff50202..eca344b0218 100644
--- a/javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction.expected
@@ -284,6 +284,12 @@ nodes
 | lib/subLib3/my-file.ts:3:28:3:31 | name |
 | lib/subLib3/my-file.ts:4:22:4:25 | name |
 | lib/subLib3/my-file.ts:4:22:4:25 | name |
+| lib/subLib4/index.js:6:32:6:35 | name |
+| lib/subLib4/index.js:6:32:6:35 | name |
+| lib/subLib4/index.js:7:18:7:21 | name |
+| lib/subLib4/subsub.js:3:28:3:31 | name |
+| lib/subLib4/subsub.js:4:22:4:25 | name |
+| lib/subLib4/subsub.js:4:22:4:25 | name |
 | lib/subLib/amdSub.js:3:28:3:31 | name |
 | lib/subLib/amdSub.js:3:28:3:31 | name |
 | lib/subLib/amdSub.js:4:22:4:25 | name |
@@ -640,6 +646,11 @@ edges
 | lib/subLib3/my-file.ts:3:28:3:31 | name | lib/subLib3/my-file.ts:4:22:4:25 | name |
 | lib/subLib3/my-file.ts:3:28:3:31 | name | lib/subLib3/my-file.ts:4:22:4:25 | name |
 | lib/subLib3/my-file.ts:3:28:3:31 | name | lib/subLib3/my-file.ts:4:22:4:25 | name |
+| lib/subLib4/index.js:6:32:6:35 | name | lib/subLib4/index.js:7:18:7:21 | name |
+| lib/subLib4/index.js:6:32:6:35 | name | lib/subLib4/index.js:7:18:7:21 | name |
+| lib/subLib4/index.js:7:18:7:21 | name | lib/subLib4/subsub.js:3:28:3:31 | name |
+| lib/subLib4/subsub.js:3:28:3:31 | name | lib/subLib4/subsub.js:4:22:4:25 | name |
+| lib/subLib4/subsub.js:3:28:3:31 | name | lib/subLib4/subsub.js:4:22:4:25 | name |
 | lib/subLib/amdSub.js:3:28:3:31 | name | lib/subLib/amdSub.js:4:22:4:25 | name |
 | lib/subLib/amdSub.js:3:28:3:31 | name | lib/subLib/amdSub.js:4:22:4:25 | name |
 | lib/subLib/amdSub.js:3:28:3:31 | name | lib/subLib/amdSub.js:4:22:4:25 | name |
@@ -653,88 +664,89 @@ edges
 | lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name |
 | lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name |
 #select
-| lib/isImported.js:6:10:6:25 | "rm -rf " + name | lib/isImported.js:5:49:5:52 | name | lib/isImported.js:6:22:6:25 | name | $@ based on $@ is later used in $@. | lib/isImported.js:6:10:6:25 | "rm -rf " + name | String concatenation | lib/isImported.js:5:49:5:52 | name | library input | lib/isImported.js:6:2:6:26 | cp.exec ... + name) | shell command |
-| lib/lib2.js:4:10:4:25 | "rm -rf " + name | lib/lib2.js:3:28:3:31 | name | lib/lib2.js:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/lib2.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/lib2.js:3:28:3:31 | name | library input | lib/lib2.js:4:2:4:26 | cp.exec ... + name) | shell command |
-| lib/lib2.js:8:10:8:25 | "rm -rf " + name | lib/lib2.js:7:32:7:35 | name | lib/lib2.js:8:22:8:25 | name | $@ based on $@ is later used in $@. | lib/lib2.js:8:10:8:25 | "rm -rf " + name | String concatenation | lib/lib2.js:7:32:7:35 | name | library input | lib/lib2.js:8:2:8:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:4:10:4:25 | "rm -rf " + name | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/lib.js:3:28:3:31 | name | library input | lib/lib.js:4:2:4:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:11:10:11:25 | "rm -rf " + name | lib/lib.js:10:32:10:35 | name | lib/lib.js:11:22:11:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:11:10:11:25 | "rm -rf " + name | String concatenation | lib/lib.js:10:32:10:35 | name | library input | lib/lib.js:11:2:11:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:15:10:15:25 | "rm -rf " + name | lib/lib.js:14:36:14:39 | name | lib/lib.js:15:22:15:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:15:10:15:25 | "rm -rf " + name | String concatenation | lib/lib.js:14:36:14:39 | name | library input | lib/lib.js:15:2:15:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:20:10:20:25 | "rm -rf " + name | lib/lib.js:19:34:19:37 | name | lib/lib.js:20:22:20:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:20:10:20:25 | "rm -rf " + name | String concatenation | lib/lib.js:19:34:19:37 | name | library input | lib/lib.js:20:2:20:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:27:10:27:25 | "rm -rf " + name | lib/lib.js:26:35:26:38 | name | lib/lib.js:27:22:27:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:27:10:27:25 | "rm -rf " + name | String concatenation | lib/lib.js:26:35:26:38 | name | library input | lib/lib.js:27:2:27:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:35:11:35:26 | "rm -rf " + name | lib/lib.js:34:14:34:17 | name | lib/lib.js:35:23:35:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:35:11:35:26 | "rm -rf " + name | String concatenation | lib/lib.js:34:14:34:17 | name | library input | lib/lib.js:35:3:35:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:38:11:38:26 | "rm -rf " + name | lib/lib.js:37:13:37:16 | name | lib/lib.js:38:23:38:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:38:11:38:26 | "rm -rf " + name | String concatenation | lib/lib.js:37:13:37:16 | name | library input | lib/lib.js:38:3:38:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:41:11:41:26 | "rm -rf " + name | lib/lib.js:40:6:40:9 | name | lib/lib.js:41:23:41:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:41:11:41:26 | "rm -rf " + name | String concatenation | lib/lib.js:40:6:40:9 | name | library input | lib/lib.js:41:3:41:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:50:35:50:50 | "rm -rf " + name | lib/lib.js:49:31:49:34 | name | lib/lib.js:50:47:50:50 | name | $@ based on $@ is later used in $@. | lib/lib.js:50:35:50:50 | "rm -rf " + name | String concatenation | lib/lib.js:49:31:49:34 | name | library input | lib/lib.js:50:2:50:51 | require ... + name) | shell command |
-| lib/lib.js:54:13:54:28 | "rm -rf " + name | lib/lib.js:53:33:53:36 | name | lib/lib.js:54:25:54:28 | name | $@ based on $@ is later used in $@. | lib/lib.js:54:13:54:28 | "rm -rf " + name | String concatenation | lib/lib.js:53:33:53:36 | name | library input | lib/lib.js:55:2:55:14 | cp.exec(cmd1) | shell command |
-| lib/lib.js:57:13:57:28 | "rm -rf " + name | lib/lib.js:53:33:53:36 | name | lib/lib.js:57:25:57:28 | name | $@ based on $@ is later used in $@. | lib/lib.js:57:13:57:28 | "rm -rf " + name | String concatenation | lib/lib.js:53:33:53:36 | name | library input | lib/lib.js:59:3:59:14 | cp.exec(cmd) | shell command |
-| lib/lib.js:65:10:65:25 | "rm -rf " + name | lib/lib.js:64:41:64:44 | name | lib/lib.js:65:22:65:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:65:10:65:25 | "rm -rf " + name | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:65:2:65:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:71:10:71:31 | "cat /f ...  + name | lib/lib.js:64:41:64:44 | name | lib/lib.js:71:28:71:31 | name | $@ based on $@ is later used in $@. | lib/lib.js:71:10:71:31 | "cat /f ...  + name | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:71:2:71:32 | cp.exec ... + name) | shell command |
-| lib/lib.js:73:10:73:31 | "cat \\" ...  + "\\"" | lib/lib.js:64:41:64:44 | name | lib/lib.js:73:21:73:24 | name | $@ based on $@ is later used in $@. | lib/lib.js:73:10:73:31 | "cat \\" ...  + "\\"" | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:73:2:73:32 | cp.exec ... + "\\"") | shell command |
-| lib/lib.js:75:10:75:29 | "cat '" + name + "'" | lib/lib.js:64:41:64:44 | name | lib/lib.js:75:20:75:23 | name | $@ based on $@ is later used in $@. | lib/lib.js:75:10:75:29 | "cat '" + name + "'" | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:75:2:75:30 | cp.exec ...  + "'") | shell command |
-| lib/lib.js:77:10:77:37 | "cat '/ ... e + "'" | lib/lib.js:64:41:64:44 | name | lib/lib.js:77:28:77:31 | name | $@ based on $@ is later used in $@. | lib/lib.js:77:10:77:37 | "cat '/ ... e + "'" | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:77:2:77:38 | cp.exec ...  + "'") | shell command |
-| lib/lib.js:83:10:83:25 | "rm -rf " + name | lib/lib.js:82:35:82:38 | name | lib/lib.js:83:22:83:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:83:10:83:25 | "rm -rf " + name | String concatenation | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:83:2:83:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:86:13:86:16 | name | lib/lib.js:82:35:82:38 | name | lib/lib.js:86:13:86:16 | name | $@ based on $@ is later used in $@. | lib/lib.js:86:13:86:16 | name | Array element | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:87:2:87:25 | cp.exec ... n(" ")) | shell command |
-| lib/lib.js:89:21:89:24 | name | lib/lib.js:82:35:82:38 | name | lib/lib.js:89:21:89:24 | name | $@ based on $@ is later used in $@. | lib/lib.js:89:21:89:24 | name | Array element | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:89:2:89:36 | cp.exec ... n(" ")) | shell command |
-| lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | lib/lib.js:82:35:82:38 | name | lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | $@ based on $@ is later used in $@. | lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | Array element | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:91:2:91:50 | cp.exec ... n(" ")) | shell command |
-| lib/lib.js:98:35:98:38 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:98:35:98:38 | name | $@ based on $@ is later used in $@. | lib/lib.js:98:35:98:38 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:98:2:98:40 | cp.exec ...  name)) | shell command |
-| lib/lib.js:100:37:100:40 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:100:37:100:40 | name | $@ based on $@ is later used in $@. | lib/lib.js:100:37:100:40 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:100:2:100:42 | cp.exec ...  name)) | shell command |
-| lib/lib.js:102:46:102:49 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:102:46:102:49 | name | $@ based on $@ is later used in $@. | lib/lib.js:102:46:102:49 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:102:2:102:51 | cp.exec ...  name)) | shell command |
-| lib/lib.js:108:41:108:44 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:108:41:108:44 | name | $@ based on $@ is later used in $@. | lib/lib.js:108:41:108:44 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:108:2:108:46 | cp.exec ...  name)) | shell command |
-| lib/lib.js:112:10:112:25 | "rm -rf " + name | lib/lib.js:111:34:111:37 | name | lib/lib.js:112:22:112:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:112:10:112:25 | "rm -rf " + name | String concatenation | lib/lib.js:111:34:111:37 | name | library input | lib/lib.js:112:2:112:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:121:10:121:25 | "rm -rf " + name | lib/lib.js:120:33:120:36 | name | lib/lib.js:121:22:121:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:121:10:121:25 | "rm -rf " + name | String concatenation | lib/lib.js:120:33:120:36 | name | library input | lib/lib.js:121:2:121:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:131:11:131:26 | "rm -rf " + name | lib/lib.js:130:6:130:9 | name | lib/lib.js:131:23:131:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:131:11:131:26 | "rm -rf " + name | String concatenation | lib/lib.js:130:6:130:9 | name | library input | lib/lib.js:131:3:131:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:149:12:149:27 | "rm -rf " + name | lib/lib.js:148:37:148:40 | name | lib/lib.js:149:24:149:27 | name | $@ based on $@ is later used in $@. | lib/lib.js:149:12:149:27 | "rm -rf " + name | String concatenation | lib/lib.js:148:37:148:40 | name | library input | lib/lib.js:152:2:152:23 | cp.spaw ... gs, cb) | shell command |
-| lib/lib.js:161:13:161:28 | "rm -rf " + name | lib/lib.js:155:38:155:41 | name | lib/lib.js:161:25:161:28 | name | $@ based on $@ is later used in $@. | lib/lib.js:161:13:161:28 | "rm -rf " + name | String concatenation | lib/lib.js:155:38:155:41 | name | library input | lib/lib.js:163:2:167:2 | cp.spaw ... t' }\\n\\t) | shell command |
-| lib/lib.js:173:10:173:23 | "fo \| " + name | lib/lib.js:170:41:170:44 | name | lib/lib.js:173:20:173:23 | name | $@ based on $@ is later used in $@. | lib/lib.js:173:10:173:23 | "fo \| " + name | String concatenation | lib/lib.js:170:41:170:44 | name | library input | lib/lib.js:173:2:173:24 | cp.exec ... + name) | shell command |
-| lib/lib.js:182:10:182:27 | "rm -rf " + broken | lib/lib.js:177:38:177:41 | name | lib/lib.js:182:22:182:27 | broken | $@ based on $@ is later used in $@. | lib/lib.js:182:10:182:27 | "rm -rf " + broken | String concatenation | lib/lib.js:177:38:177:41 | name | library input | lib/lib.js:182:2:182:28 | cp.exec ... broken) | shell command |
-| lib/lib.js:187:10:187:25 | "rm -rf " + name | lib/lib.js:186:34:186:37 | name | lib/lib.js:187:22:187:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:187:10:187:25 | "rm -rf " + name | String concatenation | lib/lib.js:186:34:186:37 | name | library input | lib/lib.js:187:2:187:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:190:11:190:26 | "rm -rf " + name | lib/lib.js:186:34:186:37 | name | lib/lib.js:190:23:190:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:190:11:190:26 | "rm -rf " + name | String concatenation | lib/lib.js:186:34:186:37 | name | library input | lib/lib.js:190:3:190:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:197:10:197:25 | "rm -rf " + name | lib/lib.js:196:45:196:48 | name | lib/lib.js:197:22:197:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:197:10:197:25 | "rm -rf " + name | String concatenation | lib/lib.js:196:45:196:48 | name | library input | lib/lib.js:197:2:197:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:200:11:200:26 | "rm -rf " + name | lib/lib.js:196:45:196:48 | name | lib/lib.js:200:23:200:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:200:11:200:26 | "rm -rf " + name | String concatenation | lib/lib.js:196:45:196:48 | name | library input | lib/lib.js:200:3:200:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:207:10:207:25 | "rm -rf " + name | lib/lib.js:206:45:206:48 | name | lib/lib.js:207:22:207:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:207:10:207:25 | "rm -rf " + name | String concatenation | lib/lib.js:206:45:206:48 | name | library input | lib/lib.js:207:2:207:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:212:11:212:26 | "rm -rf " + name | lib/lib.js:206:45:206:48 | name | lib/lib.js:212:23:212:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:212:11:212:26 | "rm -rf " + name | String concatenation | lib/lib.js:206:45:206:48 | name | library input | lib/lib.js:212:3:212:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:217:10:217:25 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:217:22:217:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:217:10:217:25 | "rm -rf " + name | String concatenation | lib/lib.js:216:39:216:42 | name | library input | lib/lib.js:217:2:217:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:220:11:220:26 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:220:23:220:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:220:11:220:26 | "rm -rf " + name | String concatenation | lib/lib.js:216:39:216:42 | name | library input | lib/lib.js:220:3:220:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:224:10:224:25 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:224:22:224:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:224:10:224:25 | "rm -rf " + name | String concatenation | lib/lib.js:216:39:216:42 | name | library input | lib/lib.js:224:2:224:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:228:10:228:25 | "rm -rf " + name | lib/lib.js:227:39:227:42 | name | lib/lib.js:228:22:228:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:228:10:228:25 | "rm -rf " + name | String concatenation | lib/lib.js:227:39:227:42 | name | library input | lib/lib.js:228:2:228:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:236:10:236:25 | "rm -rf " + name | lib/lib.js:227:39:227:42 | name | lib/lib.js:236:22:236:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:236:10:236:25 | "rm -rf " + name | String concatenation | lib/lib.js:227:39:227:42 | name | library input | lib/lib.js:236:2:236:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:249:10:249:25 | "rm -rf " + name | lib/lib.js:248:42:248:45 | name | lib/lib.js:249:22:249:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:249:10:249:25 | "rm -rf " + name | String concatenation | lib/lib.js:248:42:248:45 | name | library input | lib/lib.js:249:2:249:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:258:10:258:25 | "rm -rf " + name | lib/lib.js:257:35:257:38 | name | lib/lib.js:258:22:258:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:258:10:258:25 | "rm -rf " + name | String concatenation | lib/lib.js:257:35:257:38 | name | library input | lib/lib.js:258:2:258:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:261:11:261:33 | "rm -rf ...  + name | lib/lib.js:257:35:257:38 | name | lib/lib.js:261:30:261:33 | name | $@ based on $@ is later used in $@. | lib/lib.js:261:11:261:33 | "rm -rf ...  + name | String concatenation | lib/lib.js:257:35:257:38 | name | library input | lib/lib.js:261:3:261:34 | cp.exec ... + name) | shell command |
-| lib/lib.js:268:10:268:32 | "rm -rf ... version | lib/lib.js:267:46:267:48 | obj | lib/lib.js:268:22:268:32 | obj.version | $@ based on $@ is later used in $@. | lib/lib.js:268:10:268:32 | "rm -rf ... version | String concatenation | lib/lib.js:267:46:267:48 | obj | library input | lib/lib.js:268:2:268:33 | cp.exec ... ersion) | shell command |
-| lib/lib.js:277:11:277:30 | "rm -rf " + opts.bla | lib/lib.js:276:8:276:11 | opts | lib/lib.js:277:23:277:30 | opts.bla | $@ based on $@ is later used in $@. | lib/lib.js:277:11:277:30 | "rm -rf " + opts.bla | String concatenation | lib/lib.js:276:8:276:11 | opts | library input | lib/lib.js:277:3:277:31 | cp.exec ... ts.bla) | shell command |
-| lib/lib.js:308:11:308:26 | "rm -rf " + name | lib/lib.js:307:39:307:42 | name | lib/lib.js:308:23:308:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:308:11:308:26 | "rm -rf " + name | String concatenation | lib/lib.js:307:39:307:42 | name | library input | lib/lib.js:308:3:308:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:315:10:315:25 | "rm -rf " + name | lib/lib.js:314:40:314:43 | name | lib/lib.js:315:22:315:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:315:10:315:25 | "rm -rf " + name | String concatenation | lib/lib.js:314:40:314:43 | name | library input | lib/lib.js:315:2:315:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:320:11:320:26 | "rm -rf " + name | lib/lib.js:314:40:314:43 | name | lib/lib.js:320:23:320:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:320:11:320:26 | "rm -rf " + name | String concatenation | lib/lib.js:314:40:314:43 | name | library input | lib/lib.js:320:3:320:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:325:12:325:51 | "MyWind ... " + arg | lib/lib.js:324:40:324:42 | arg | lib/lib.js:325:49:325:51 | arg | $@ based on $@ is later used in $@. | lib/lib.js:325:12:325:51 | "MyWind ... " + arg | String concatenation | lib/lib.js:324:40:324:42 | arg | library input | lib/lib.js:326:2:326:13 | cp.exec(cmd) | shell command |
-| lib/lib.js:340:10:340:26 | "rm -rf " + id(n) | lib/lib.js:339:39:339:39 | n | lib/lib.js:340:22:340:26 | id(n) | $@ based on $@ is later used in $@. | lib/lib.js:340:10:340:26 | "rm -rf " + id(n) | String concatenation | lib/lib.js:339:39:339:39 | n | library input | lib/lib.js:340:2:340:27 | cp.exec ...  id(n)) | shell command |
-| lib/lib.js:351:10:351:27 | "rm -rf " + unsafe | lib/lib.js:349:29:349:34 | unsafe | lib/lib.js:351:22:351:27 | unsafe | $@ based on $@ is later used in $@. | lib/lib.js:351:10:351:27 | "rm -rf " + unsafe | String concatenation | lib/lib.js:349:29:349:34 | unsafe | library input | lib/lib.js:351:2:351:28 | cp.exec ... unsafe) | shell command |
-| lib/lib.js:366:17:366:56 | "learn  ... + model | lib/lib.js:360:20:360:23 | opts | lib/lib.js:366:28:366:42 | this.learn_args | $@ based on $@ is later used in $@. | lib/lib.js:366:17:366:56 | "learn  ... + model | String concatenation | lib/lib.js:360:20:360:23 | opts | library input | lib/lib.js:367:3:367:18 | cp.exec(command) | shell command |
-| lib/lib.js:406:10:406:25 | "rm -rf " + name | lib/lib.js:405:39:405:42 | name | lib/lib.js:406:22:406:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:406:10:406:25 | "rm -rf " + name | String concatenation | lib/lib.js:405:39:405:42 | name | library input | lib/lib.js:406:2:406:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:415:10:415:25 | "rm -rf " + name | lib/lib.js:414:40:414:43 | name | lib/lib.js:415:22:415:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:415:10:415:25 | "rm -rf " + name | String concatenation | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:415:2:415:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:417:28:417:31 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:417:28:417:31 | name | $@ based on $@ is later used in $@. | lib/lib.js:417:28:417:31 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:417:2:417:66 | cp.exec ...  => {}) | shell command |
-| lib/lib.js:418:25:418:28 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:418:25:418:28 | name | $@ based on $@ is later used in $@. | lib/lib.js:418:25:418:28 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:418:2:418:45 | cp.spaw ...  true}) | shell command |
-| lib/lib.js:419:32:419:35 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:419:32:419:35 | name | $@ based on $@ is later used in $@. | lib/lib.js:419:32:419:35 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:419:2:419:52 | cp.exec ...  true}) | shell command |
-| lib/lib.js:420:29:420:32 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:420:29:420:32 | name | $@ based on $@ is later used in $@. | lib/lib.js:420:29:420:32 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:420:2:420:49 | cp.spaw ...  true}) | shell command |
-| lib/lib.js:424:24:424:27 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:424:24:424:27 | name | $@ based on $@ is later used in $@. | lib/lib.js:424:24:424:27 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:424:2:424:40 | spawn(" ... WN_OPT) | shell command |
-| lib/lib.js:426:11:426:14 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:426:11:426:14 | name | $@ based on $@ is later used in $@. | lib/lib.js:426:11:426:14 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:427:2:427:28 | spawn(" ... WN_OPT) | shell command |
-| lib/lib.js:436:19:436:22 | last | lib/lib.js:414:40:414:43 | name | lib/lib.js:436:19:436:22 | last | $@ based on $@ is later used in $@. | lib/lib.js:436:19:436:22 | last | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:428:2:428:70 | spawn(" ... WN_OPT) | shell command |
-| lib/lib.js:442:12:442:27 | "rm -rf " + name | lib/lib.js:441:39:441:42 | name | lib/lib.js:442:24:442:27 | name | $@ based on $@ is later used in $@. | lib/lib.js:442:12:442:27 | "rm -rf " + name | String concatenation | lib/lib.js:441:39:441:42 | name | library input | lib/lib.js:442:2:442:28 | asyncEx ... + name) | shell command |
-| lib/lib.js:447:13:447:28 | "rm -rf " + name | lib/lib.js:446:20:446:23 | name | lib/lib.js:447:25:447:28 | name | $@ based on $@ is later used in $@. | lib/lib.js:447:13:447:28 | "rm -rf " + name | String concatenation | lib/lib.js:446:20:446:23 | name | library input | lib/lib.js:447:3:447:29 | asyncEx ... + name) | shell command |
-| lib/lib.js:478:27:478:46 | config.installedPath | lib/lib.js:477:33:477:38 | config | lib/lib.js:478:27:478:46 | config.installedPath | $@ based on $@ is later used in $@. | lib/lib.js:478:27:478:46 | config.installedPath | Path concatenation | lib/lib.js:477:33:477:38 | config | library input | lib/lib.js:479:12:479:20 | exec(cmd) | shell command |
-| lib/lib.js:483:13:483:33 | ' my na ...  + name | lib/lib.js:482:40:482:43 | name | lib/lib.js:483:30:483:33 | name | $@ based on $@ is later used in $@. | lib/lib.js:483:13:483:33 | ' my na ...  + name | String concatenation | lib/lib.js:482:40:482:43 | name | library input | lib/lib.js:485:2:485:20 | cp.exec(cmd + args) | shell command |
-| lib/lib.js:499:19:499:34 | "rm -rf " + name | lib/lib.js:498:45:498:48 | name | lib/lib.js:499:31:499:34 | name | $@ based on $@ is later used in $@. | lib/lib.js:499:19:499:34 | "rm -rf " + name | String concatenation | lib/lib.js:498:45:498:48 | name | library input | lib/lib.js:499:3:499:35 | MyThing ... + name) | shell command |
-| lib/lib.js:510:10:510:25 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:510:22:510:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:510:10:510:25 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:510:2:510:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:513:11:513:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:513:23:513:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:513:11:513:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:513:3:513:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:519:11:519:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:519:23:519:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:519:11:519:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:519:3:519:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:525:11:525:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:525:23:525:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:525:11:525:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:525:3:525:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:531:11:531:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:531:23:531:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:531:11:531:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:531:3:531:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:537:11:537:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:537:23:537:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:537:11:537:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:537:3:537:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:543:11:543:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:543:23:543:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:543:11:543:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:543:3:543:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:545:11:545:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:545:23:545:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:545:11:545:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:545:3:545:27 | cp.exec ... + name) | shell command |
-| lib/subLib2/compiled-file.ts:4:13:4:28 | "rm -rf " + name | lib/subLib2/compiled-file.ts:3:26:3:29 | name | lib/subLib2/compiled-file.ts:4:25:4:28 | name | $@ based on $@ is later used in $@. | lib/subLib2/compiled-file.ts:4:13:4:28 | "rm -rf " + name | String concatenation | lib/subLib2/compiled-file.ts:3:26:3:29 | name | library input | lib/subLib2/compiled-file.ts:4:5:4:29 | cp.exec ... + name) | shell command |
-| lib/subLib2/special-file.js:4:10:4:25 | "rm -rf " + name | lib/subLib2/special-file.js:3:28:3:31 | name | lib/subLib2/special-file.js:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/subLib2/special-file.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib2/special-file.js:3:28:3:31 | name | library input | lib/subLib2/special-file.js:4:2:4:26 | cp.exec ... + name) | shell command |
-| lib/subLib3/my-file.ts:4:10:4:25 | "rm -rf " + name | lib/subLib3/my-file.ts:3:28:3:31 | name | lib/subLib3/my-file.ts:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/subLib3/my-file.ts:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib3/my-file.ts:3:28:3:31 | name | library input | lib/subLib3/my-file.ts:4:2:4:26 | cp.exec ... + name) | shell command |
-| lib/subLib/amdSub.js:4:10:4:25 | "rm -rf " + name | lib/subLib/amdSub.js:3:28:3:31 | name | lib/subLib/amdSub.js:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/subLib/amdSub.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib/amdSub.js:3:28:3:31 | name | library input | lib/subLib/amdSub.js:4:2:4:26 | cp.exec ... + name) | shell command |
-| lib/subLib/index.js:4:10:4:25 | "rm -rf " + name | lib/subLib/index.js:3:28:3:31 | name | lib/subLib/index.js:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/subLib/index.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib/index.js:3:28:3:31 | name | library input | lib/subLib/index.js:4:2:4:26 | cp.exec ... + name) | shell command |
-| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name | $@ based on $@ is later used in $@. | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | String concatenation | lib/subLib/index.js:7:32:7:35 | name | library input | lib/subLib/index.js:8:2:8:26 | cp.exec ... + name) | shell command |
+| lib/isImported.js:6:10:6:25 | "rm -rf " + name | lib/isImported.js:5:49:5:52 | name | lib/isImported.js:6:22:6:25 | name | $@ which depends on $@ is later used in $@. | lib/isImported.js:6:10:6:25 | "rm -rf " + name | String concatenation | lib/isImported.js:5:49:5:52 | name | library input | lib/isImported.js:6:2:6:26 | cp.exec ... + name) | a shell command |
+| lib/lib2.js:4:10:4:25 | "rm -rf " + name | lib/lib2.js:3:28:3:31 | name | lib/lib2.js:4:22:4:25 | name | $@ which depends on $@ is later used in $@. | lib/lib2.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/lib2.js:3:28:3:31 | name | library input | lib/lib2.js:4:2:4:26 | cp.exec ... + name) | a shell command |
+| lib/lib2.js:8:10:8:25 | "rm -rf " + name | lib/lib2.js:7:32:7:35 | name | lib/lib2.js:8:22:8:25 | name | $@ which depends on $@ is later used in $@. | lib/lib2.js:8:10:8:25 | "rm -rf " + name | String concatenation | lib/lib2.js:7:32:7:35 | name | library input | lib/lib2.js:8:2:8:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:4:10:4:25 | "rm -rf " + name | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:22:4:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/lib.js:3:28:3:31 | name | library input | lib/lib.js:4:2:4:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:11:10:11:25 | "rm -rf " + name | lib/lib.js:10:32:10:35 | name | lib/lib.js:11:22:11:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:11:10:11:25 | "rm -rf " + name | String concatenation | lib/lib.js:10:32:10:35 | name | library input | lib/lib.js:11:2:11:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:15:10:15:25 | "rm -rf " + name | lib/lib.js:14:36:14:39 | name | lib/lib.js:15:22:15:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:15:10:15:25 | "rm -rf " + name | String concatenation | lib/lib.js:14:36:14:39 | name | library input | lib/lib.js:15:2:15:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:20:10:20:25 | "rm -rf " + name | lib/lib.js:19:34:19:37 | name | lib/lib.js:20:22:20:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:20:10:20:25 | "rm -rf " + name | String concatenation | lib/lib.js:19:34:19:37 | name | library input | lib/lib.js:20:2:20:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:27:10:27:25 | "rm -rf " + name | lib/lib.js:26:35:26:38 | name | lib/lib.js:27:22:27:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:27:10:27:25 | "rm -rf " + name | String concatenation | lib/lib.js:26:35:26:38 | name | library input | lib/lib.js:27:2:27:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:35:11:35:26 | "rm -rf " + name | lib/lib.js:34:14:34:17 | name | lib/lib.js:35:23:35:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:35:11:35:26 | "rm -rf " + name | String concatenation | lib/lib.js:34:14:34:17 | name | library input | lib/lib.js:35:3:35:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:38:11:38:26 | "rm -rf " + name | lib/lib.js:37:13:37:16 | name | lib/lib.js:38:23:38:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:38:11:38:26 | "rm -rf " + name | String concatenation | lib/lib.js:37:13:37:16 | name | library input | lib/lib.js:38:3:38:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:41:11:41:26 | "rm -rf " + name | lib/lib.js:40:6:40:9 | name | lib/lib.js:41:23:41:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:41:11:41:26 | "rm -rf " + name | String concatenation | lib/lib.js:40:6:40:9 | name | library input | lib/lib.js:41:3:41:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:50:35:50:50 | "rm -rf " + name | lib/lib.js:49:31:49:34 | name | lib/lib.js:50:47:50:50 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:50:35:50:50 | "rm -rf " + name | String concatenation | lib/lib.js:49:31:49:34 | name | library input | lib/lib.js:50:2:50:51 | require ... + name) | a shell command |
+| lib/lib.js:54:13:54:28 | "rm -rf " + name | lib/lib.js:53:33:53:36 | name | lib/lib.js:54:25:54:28 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:54:13:54:28 | "rm -rf " + name | String concatenation | lib/lib.js:53:33:53:36 | name | library input | lib/lib.js:55:2:55:14 | cp.exec(cmd1) | a shell command |
+| lib/lib.js:57:13:57:28 | "rm -rf " + name | lib/lib.js:53:33:53:36 | name | lib/lib.js:57:25:57:28 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:57:13:57:28 | "rm -rf " + name | String concatenation | lib/lib.js:53:33:53:36 | name | library input | lib/lib.js:59:3:59:14 | cp.exec(cmd) | a shell command |
+| lib/lib.js:65:10:65:25 | "rm -rf " + name | lib/lib.js:64:41:64:44 | name | lib/lib.js:65:22:65:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:65:10:65:25 | "rm -rf " + name | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:65:2:65:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:71:10:71:31 | "cat /f ...  + name | lib/lib.js:64:41:64:44 | name | lib/lib.js:71:28:71:31 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:71:10:71:31 | "cat /f ...  + name | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:71:2:71:32 | cp.exec ... + name) | a shell command |
+| lib/lib.js:73:10:73:31 | "cat \\" ...  + "\\"" | lib/lib.js:64:41:64:44 | name | lib/lib.js:73:21:73:24 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:73:10:73:31 | "cat \\" ...  + "\\"" | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:73:2:73:32 | cp.exec ... + "\\"") | a shell command |
+| lib/lib.js:75:10:75:29 | "cat '" + name + "'" | lib/lib.js:64:41:64:44 | name | lib/lib.js:75:20:75:23 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:75:10:75:29 | "cat '" + name + "'" | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:75:2:75:30 | cp.exec ...  + "'") | a shell command |
+| lib/lib.js:77:10:77:37 | "cat '/ ... e + "'" | lib/lib.js:64:41:64:44 | name | lib/lib.js:77:28:77:31 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:77:10:77:37 | "cat '/ ... e + "'" | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:77:2:77:38 | cp.exec ...  + "'") | a shell command |
+| lib/lib.js:83:10:83:25 | "rm -rf " + name | lib/lib.js:82:35:82:38 | name | lib/lib.js:83:22:83:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:83:10:83:25 | "rm -rf " + name | String concatenation | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:83:2:83:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:86:13:86:16 | name | lib/lib.js:82:35:82:38 | name | lib/lib.js:86:13:86:16 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:86:13:86:16 | name | Array element | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:87:2:87:25 | cp.exec ... n(" ")) | a shell command |
+| lib/lib.js:89:21:89:24 | name | lib/lib.js:82:35:82:38 | name | lib/lib.js:89:21:89:24 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:89:21:89:24 | name | Array element | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:89:2:89:36 | cp.exec ... n(" ")) | a shell command |
+| lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | lib/lib.js:82:35:82:38 | name | lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | $@ which depends on $@ is later used in $@. | lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | Array element | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:91:2:91:50 | cp.exec ... n(" ")) | a shell command |
+| lib/lib.js:98:35:98:38 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:98:35:98:38 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:98:35:98:38 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:98:2:98:40 | cp.exec ...  name)) | a shell command |
+| lib/lib.js:100:37:100:40 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:100:37:100:40 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:100:37:100:40 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:100:2:100:42 | cp.exec ...  name)) | a shell command |
+| lib/lib.js:102:46:102:49 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:102:46:102:49 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:102:46:102:49 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:102:2:102:51 | cp.exec ...  name)) | a shell command |
+| lib/lib.js:108:41:108:44 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:108:41:108:44 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:108:41:108:44 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:108:2:108:46 | cp.exec ...  name)) | a shell command |
+| lib/lib.js:112:10:112:25 | "rm -rf " + name | lib/lib.js:111:34:111:37 | name | lib/lib.js:112:22:112:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:112:10:112:25 | "rm -rf " + name | String concatenation | lib/lib.js:111:34:111:37 | name | library input | lib/lib.js:112:2:112:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:121:10:121:25 | "rm -rf " + name | lib/lib.js:120:33:120:36 | name | lib/lib.js:121:22:121:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:121:10:121:25 | "rm -rf " + name | String concatenation | lib/lib.js:120:33:120:36 | name | library input | lib/lib.js:121:2:121:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:131:11:131:26 | "rm -rf " + name | lib/lib.js:130:6:130:9 | name | lib/lib.js:131:23:131:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:131:11:131:26 | "rm -rf " + name | String concatenation | lib/lib.js:130:6:130:9 | name | library input | lib/lib.js:131:3:131:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:149:12:149:27 | "rm -rf " + name | lib/lib.js:148:37:148:40 | name | lib/lib.js:149:24:149:27 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:149:12:149:27 | "rm -rf " + name | String concatenation | lib/lib.js:148:37:148:40 | name | library input | lib/lib.js:152:2:152:23 | cp.spaw ... gs, cb) | a shell command |
+| lib/lib.js:161:13:161:28 | "rm -rf " + name | lib/lib.js:155:38:155:41 | name | lib/lib.js:161:25:161:28 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:161:13:161:28 | "rm -rf " + name | String concatenation | lib/lib.js:155:38:155:41 | name | library input | lib/lib.js:163:2:167:2 | cp.spaw ... t' }\\n\\t) | a shell command |
+| lib/lib.js:173:10:173:23 | "fo \| " + name | lib/lib.js:170:41:170:44 | name | lib/lib.js:173:20:173:23 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:173:10:173:23 | "fo \| " + name | String concatenation | lib/lib.js:170:41:170:44 | name | library input | lib/lib.js:173:2:173:24 | cp.exec ... + name) | a shell command |
+| lib/lib.js:182:10:182:27 | "rm -rf " + broken | lib/lib.js:177:38:177:41 | name | lib/lib.js:182:22:182:27 | broken | $@ which depends on $@ is later used in $@. | lib/lib.js:182:10:182:27 | "rm -rf " + broken | String concatenation | lib/lib.js:177:38:177:41 | name | library input | lib/lib.js:182:2:182:28 | cp.exec ... broken) | a shell command |
+| lib/lib.js:187:10:187:25 | "rm -rf " + name | lib/lib.js:186:34:186:37 | name | lib/lib.js:187:22:187:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:187:10:187:25 | "rm -rf " + name | String concatenation | lib/lib.js:186:34:186:37 | name | library input | lib/lib.js:187:2:187:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:190:11:190:26 | "rm -rf " + name | lib/lib.js:186:34:186:37 | name | lib/lib.js:190:23:190:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:190:11:190:26 | "rm -rf " + name | String concatenation | lib/lib.js:186:34:186:37 | name | library input | lib/lib.js:190:3:190:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:197:10:197:25 | "rm -rf " + name | lib/lib.js:196:45:196:48 | name | lib/lib.js:197:22:197:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:197:10:197:25 | "rm -rf " + name | String concatenation | lib/lib.js:196:45:196:48 | name | library input | lib/lib.js:197:2:197:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:200:11:200:26 | "rm -rf " + name | lib/lib.js:196:45:196:48 | name | lib/lib.js:200:23:200:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:200:11:200:26 | "rm -rf " + name | String concatenation | lib/lib.js:196:45:196:48 | name | library input | lib/lib.js:200:3:200:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:207:10:207:25 | "rm -rf " + name | lib/lib.js:206:45:206:48 | name | lib/lib.js:207:22:207:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:207:10:207:25 | "rm -rf " + name | String concatenation | lib/lib.js:206:45:206:48 | name | library input | lib/lib.js:207:2:207:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:212:11:212:26 | "rm -rf " + name | lib/lib.js:206:45:206:48 | name | lib/lib.js:212:23:212:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:212:11:212:26 | "rm -rf " + name | String concatenation | lib/lib.js:206:45:206:48 | name | library input | lib/lib.js:212:3:212:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:217:10:217:25 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:217:22:217:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:217:10:217:25 | "rm -rf " + name | String concatenation | lib/lib.js:216:39:216:42 | name | library input | lib/lib.js:217:2:217:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:220:11:220:26 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:220:23:220:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:220:11:220:26 | "rm -rf " + name | String concatenation | lib/lib.js:216:39:216:42 | name | library input | lib/lib.js:220:3:220:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:224:10:224:25 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:224:22:224:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:224:10:224:25 | "rm -rf " + name | String concatenation | lib/lib.js:216:39:216:42 | name | library input | lib/lib.js:224:2:224:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:228:10:228:25 | "rm -rf " + name | lib/lib.js:227:39:227:42 | name | lib/lib.js:228:22:228:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:228:10:228:25 | "rm -rf " + name | String concatenation | lib/lib.js:227:39:227:42 | name | library input | lib/lib.js:228:2:228:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:236:10:236:25 | "rm -rf " + name | lib/lib.js:227:39:227:42 | name | lib/lib.js:236:22:236:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:236:10:236:25 | "rm -rf " + name | String concatenation | lib/lib.js:227:39:227:42 | name | library input | lib/lib.js:236:2:236:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:249:10:249:25 | "rm -rf " + name | lib/lib.js:248:42:248:45 | name | lib/lib.js:249:22:249:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:249:10:249:25 | "rm -rf " + name | String concatenation | lib/lib.js:248:42:248:45 | name | library input | lib/lib.js:249:2:249:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:258:10:258:25 | "rm -rf " + name | lib/lib.js:257:35:257:38 | name | lib/lib.js:258:22:258:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:258:10:258:25 | "rm -rf " + name | String concatenation | lib/lib.js:257:35:257:38 | name | library input | lib/lib.js:258:2:258:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:261:11:261:33 | "rm -rf ...  + name | lib/lib.js:257:35:257:38 | name | lib/lib.js:261:30:261:33 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:261:11:261:33 | "rm -rf ...  + name | String concatenation | lib/lib.js:257:35:257:38 | name | library input | lib/lib.js:261:3:261:34 | cp.exec ... + name) | a shell command |
+| lib/lib.js:268:10:268:32 | "rm -rf ... version | lib/lib.js:267:46:267:48 | obj | lib/lib.js:268:22:268:32 | obj.version | $@ which depends on $@ is later used in $@. | lib/lib.js:268:10:268:32 | "rm -rf ... version | String concatenation | lib/lib.js:267:46:267:48 | obj | library input | lib/lib.js:268:2:268:33 | cp.exec ... ersion) | a shell command |
+| lib/lib.js:277:11:277:30 | "rm -rf " + opts.bla | lib/lib.js:276:8:276:11 | opts | lib/lib.js:277:23:277:30 | opts.bla | $@ which depends on $@ is later used in $@. | lib/lib.js:277:11:277:30 | "rm -rf " + opts.bla | String concatenation | lib/lib.js:276:8:276:11 | opts | library input | lib/lib.js:277:3:277:31 | cp.exec ... ts.bla) | a shell command |
+| lib/lib.js:308:11:308:26 | "rm -rf " + name | lib/lib.js:307:39:307:42 | name | lib/lib.js:308:23:308:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:308:11:308:26 | "rm -rf " + name | String concatenation | lib/lib.js:307:39:307:42 | name | library input | lib/lib.js:308:3:308:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:315:10:315:25 | "rm -rf " + name | lib/lib.js:314:40:314:43 | name | lib/lib.js:315:22:315:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:315:10:315:25 | "rm -rf " + name | String concatenation | lib/lib.js:314:40:314:43 | name | library input | lib/lib.js:315:2:315:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:320:11:320:26 | "rm -rf " + name | lib/lib.js:314:40:314:43 | name | lib/lib.js:320:23:320:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:320:11:320:26 | "rm -rf " + name | String concatenation | lib/lib.js:314:40:314:43 | name | library input | lib/lib.js:320:3:320:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:325:12:325:51 | "MyWind ... " + arg | lib/lib.js:324:40:324:42 | arg | lib/lib.js:325:49:325:51 | arg | $@ which depends on $@ is later used in $@. | lib/lib.js:325:12:325:51 | "MyWind ... " + arg | String concatenation | lib/lib.js:324:40:324:42 | arg | library input | lib/lib.js:326:2:326:13 | cp.exec(cmd) | a shell command |
+| lib/lib.js:340:10:340:26 | "rm -rf " + id(n) | lib/lib.js:339:39:339:39 | n | lib/lib.js:340:22:340:26 | id(n) | $@ which depends on $@ is later used in $@. | lib/lib.js:340:10:340:26 | "rm -rf " + id(n) | String concatenation | lib/lib.js:339:39:339:39 | n | library input | lib/lib.js:340:2:340:27 | cp.exec ...  id(n)) | a shell command |
+| lib/lib.js:351:10:351:27 | "rm -rf " + unsafe | lib/lib.js:349:29:349:34 | unsafe | lib/lib.js:351:22:351:27 | unsafe | $@ which depends on $@ is later used in $@. | lib/lib.js:351:10:351:27 | "rm -rf " + unsafe | String concatenation | lib/lib.js:349:29:349:34 | unsafe | library input | lib/lib.js:351:2:351:28 | cp.exec ... unsafe) | a shell command |
+| lib/lib.js:366:17:366:56 | "learn  ... + model | lib/lib.js:360:20:360:23 | opts | lib/lib.js:366:28:366:42 | this.learn_args | $@ which depends on $@ is later used in $@. | lib/lib.js:366:17:366:56 | "learn  ... + model | String concatenation | lib/lib.js:360:20:360:23 | opts | library input | lib/lib.js:367:3:367:18 | cp.exec(command) | a shell command |
+| lib/lib.js:406:10:406:25 | "rm -rf " + name | lib/lib.js:405:39:405:42 | name | lib/lib.js:406:22:406:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:406:10:406:25 | "rm -rf " + name | String concatenation | lib/lib.js:405:39:405:42 | name | library input | lib/lib.js:406:2:406:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:415:10:415:25 | "rm -rf " + name | lib/lib.js:414:40:414:43 | name | lib/lib.js:415:22:415:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:415:10:415:25 | "rm -rf " + name | String concatenation | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:415:2:415:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:417:28:417:31 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:417:28:417:31 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:417:28:417:31 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:417:2:417:66 | cp.exec ...  => {}) | a shell command |
+| lib/lib.js:418:25:418:28 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:418:25:418:28 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:418:25:418:28 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:418:2:418:45 | cp.spaw ...  true}) | a shell command |
+| lib/lib.js:419:32:419:35 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:419:32:419:35 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:419:32:419:35 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:419:2:419:52 | cp.exec ...  true}) | a shell command |
+| lib/lib.js:420:29:420:32 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:420:29:420:32 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:420:29:420:32 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:420:2:420:49 | cp.spaw ...  true}) | a shell command |
+| lib/lib.js:424:24:424:27 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:424:24:424:27 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:424:24:424:27 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:424:2:424:40 | spawn(" ... WN_OPT) | a shell command |
+| lib/lib.js:426:11:426:14 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:426:11:426:14 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:426:11:426:14 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:427:2:427:28 | spawn(" ... WN_OPT) | a shell command |
+| lib/lib.js:436:19:436:22 | last | lib/lib.js:414:40:414:43 | name | lib/lib.js:436:19:436:22 | last | $@ which depends on $@ is later used in $@. | lib/lib.js:436:19:436:22 | last | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:428:2:428:70 | spawn(" ... WN_OPT) | a shell command |
+| lib/lib.js:442:12:442:27 | "rm -rf " + name | lib/lib.js:441:39:441:42 | name | lib/lib.js:442:24:442:27 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:442:12:442:27 | "rm -rf " + name | String concatenation | lib/lib.js:441:39:441:42 | name | library input | lib/lib.js:442:2:442:28 | asyncEx ... + name) | a shell command |
+| lib/lib.js:447:13:447:28 | "rm -rf " + name | lib/lib.js:446:20:446:23 | name | lib/lib.js:447:25:447:28 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:447:13:447:28 | "rm -rf " + name | String concatenation | lib/lib.js:446:20:446:23 | name | library input | lib/lib.js:447:3:447:29 | asyncEx ... + name) | a shell command |
+| lib/lib.js:478:27:478:46 | config.installedPath | lib/lib.js:477:33:477:38 | config | lib/lib.js:478:27:478:46 | config.installedPath | $@ which depends on $@ is later used in $@. | lib/lib.js:478:27:478:46 | config.installedPath | Path concatenation | lib/lib.js:477:33:477:38 | config | library input | lib/lib.js:479:12:479:20 | exec(cmd) | a shell command |
+| lib/lib.js:483:13:483:33 | ' my na ...  + name | lib/lib.js:482:40:482:43 | name | lib/lib.js:483:30:483:33 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:483:13:483:33 | ' my na ...  + name | String concatenation | lib/lib.js:482:40:482:43 | name | library input | lib/lib.js:485:2:485:20 | cp.exec(cmd + args) | a shell command |
+| lib/lib.js:499:19:499:34 | "rm -rf " + name | lib/lib.js:498:45:498:48 | name | lib/lib.js:499:31:499:34 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:499:19:499:34 | "rm -rf " + name | String concatenation | lib/lib.js:498:45:498:48 | name | library input | lib/lib.js:499:3:499:35 | MyThing ... + name) | a shell command |
+| lib/lib.js:510:10:510:25 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:510:22:510:25 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:510:10:510:25 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:510:2:510:26 | cp.exec ... + name) | a shell command |
+| lib/lib.js:513:11:513:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:513:23:513:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:513:11:513:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:513:3:513:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:519:11:519:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:519:23:519:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:519:11:519:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:519:3:519:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:525:11:525:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:525:23:525:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:525:11:525:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:525:3:525:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:531:11:531:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:531:23:531:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:531:11:531:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:531:3:531:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:537:11:537:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:537:23:537:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:537:11:537:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:537:3:537:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:543:11:543:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:543:23:543:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:543:11:543:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:543:3:543:27 | cp.exec ... + name) | a shell command |
+| lib/lib.js:545:11:545:26 | "rm -rf " + name | lib/lib.js:509:39:509:42 | name | lib/lib.js:545:23:545:26 | name | $@ which depends on $@ is later used in $@. | lib/lib.js:545:11:545:26 | "rm -rf " + name | String concatenation | lib/lib.js:509:39:509:42 | name | library input | lib/lib.js:545:3:545:27 | cp.exec ... + name) | a shell command |
+| lib/subLib2/compiled-file.ts:4:13:4:28 | "rm -rf " + name | lib/subLib2/compiled-file.ts:3:26:3:29 | name | lib/subLib2/compiled-file.ts:4:25:4:28 | name | $@ which depends on $@ is later used in $@. | lib/subLib2/compiled-file.ts:4:13:4:28 | "rm -rf " + name | String concatenation | lib/subLib2/compiled-file.ts:3:26:3:29 | name | library input | lib/subLib2/compiled-file.ts:4:5:4:29 | cp.exec ... + name) | a shell command |
+| lib/subLib2/special-file.js:4:10:4:25 | "rm -rf " + name | lib/subLib2/special-file.js:3:28:3:31 | name | lib/subLib2/special-file.js:4:22:4:25 | name | $@ which depends on $@ is later used in $@. | lib/subLib2/special-file.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib2/special-file.js:3:28:3:31 | name | library input | lib/subLib2/special-file.js:4:2:4:26 | cp.exec ... + name) | a shell command |
+| lib/subLib3/my-file.ts:4:10:4:25 | "rm -rf " + name | lib/subLib3/my-file.ts:3:28:3:31 | name | lib/subLib3/my-file.ts:4:22:4:25 | name | $@ which depends on $@ is later used in $@. | lib/subLib3/my-file.ts:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib3/my-file.ts:3:28:3:31 | name | library input | lib/subLib3/my-file.ts:4:2:4:26 | cp.exec ... + name) | a shell command |
+| lib/subLib4/subsub.js:4:10:4:25 | "rm -rf " + name | lib/subLib4/index.js:6:32:6:35 | name | lib/subLib4/subsub.js:4:22:4:25 | name | $@ which depends on $@ is later used in $@. | lib/subLib4/subsub.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib4/index.js:6:32:6:35 | name | library input | lib/subLib4/subsub.js:4:2:4:26 | cp.exec ... + name) | a shell command |
+| lib/subLib/amdSub.js:4:10:4:25 | "rm -rf " + name | lib/subLib/amdSub.js:3:28:3:31 | name | lib/subLib/amdSub.js:4:22:4:25 | name | $@ which depends on $@ is later used in $@. | lib/subLib/amdSub.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib/amdSub.js:3:28:3:31 | name | library input | lib/subLib/amdSub.js:4:2:4:26 | cp.exec ... + name) | a shell command |
+| lib/subLib/index.js:4:10:4:25 | "rm -rf " + name | lib/subLib/index.js:3:28:3:31 | name | lib/subLib/index.js:4:22:4:25 | name | $@ which depends on $@ is later used in $@. | lib/subLib/index.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib/index.js:3:28:3:31 | name | library input | lib/subLib/index.js:4:2:4:26 | cp.exec ... + name) | a shell command |
+| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name | $@ which depends on $@ is later used in $@. | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | String concatenation | lib/subLib/index.js:7:32:7:35 | name | library input | lib/subLib/index.js:8:2:8:26 | cp.exec ... + name) | a shell command |
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib4/index.js b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib4/index.js
new file mode 100644
index 00000000000..820349c5c62
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib4/index.js
@@ -0,0 +1,8 @@
+const dispatch = {
+  GET: require("./bla"),
+  POST: require("./subsub"),
+};
+
+module.exports.foo = function (name, type) {
+  dispatch[type](name);
+};
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib4/package.json b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib4/package.json
new file mode 100644
index 00000000000..87942f96b4d
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib4/package.json
@@ -0,0 +1,5 @@
+{
+  "name": "my-sub-lib",
+  "version": "0.0.7",
+  "main": "./index.js"
+}
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib4/subsub.js b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib4/subsub.js
new file mode 100644
index 00000000000..952288a82ce
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib4/subsub.js
@@ -0,0 +1,5 @@
+const cp = require("child_process")
+
+module.exports = function (name) {
+	cp.exec("rm -rf " + name); // NOT OK - functions exported as part of a submodule are also flagged.
+};
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
index 3af55bfd598..3effc99fcb3 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
@@ -116,6 +116,11 @@ nodes
 | classnames.js:15:47:15:63 | clsx(window.name) |
 | classnames.js:15:52:15:62 | window.name |
 | classnames.js:15:52:15:62 | window.name |
+| classnames.js:17:32:17:79 | `<span  ... <span>` |
+| classnames.js:17:32:17:79 | `<span  ... <span>` |
+| classnames.js:17:48:17:64 | clsx(window.name) |
+| classnames.js:17:53:17:63 | window.name |
+| classnames.js:17:53:17:63 | window.name |
 | clipboard.ts:8:11:8:51 | html |
 | clipboard.ts:8:11:8:51 | html |
 | clipboard.ts:8:18:8:51 | clipboa ... /html') |
@@ -1187,6 +1192,10 @@ edges
 | classnames.js:15:47:15:63 | clsx(window.name) | classnames.js:15:31:15:78 | `<span  ... <span>` |
 | classnames.js:15:52:15:62 | window.name | classnames.js:15:47:15:63 | clsx(window.name) |
 | classnames.js:15:52:15:62 | window.name | classnames.js:15:47:15:63 | clsx(window.name) |
+| classnames.js:17:48:17:64 | clsx(window.name) | classnames.js:17:32:17:79 | `<span  ... <span>` |
+| classnames.js:17:48:17:64 | clsx(window.name) | classnames.js:17:32:17:79 | `<span  ... <span>` |
+| classnames.js:17:53:17:63 | window.name | classnames.js:17:48:17:64 | clsx(window.name) |
+| classnames.js:17:53:17:63 | window.name | classnames.js:17:48:17:64 | clsx(window.name) |
 | clipboard.ts:8:11:8:51 | html | clipboard.ts:15:25:15:28 | html |
 | clipboard.ts:8:11:8:51 | html | clipboard.ts:15:25:15:28 | html |
 | clipboard.ts:8:11:8:51 | html | clipboard.ts:15:25:15:28 | html |
@@ -2182,6 +2191,7 @@ edges
 | classnames.js:11:31:11:79 | `<span  ... <span>` | classnames.js:10:45:10:55 | window.name | classnames.js:11:31:11:79 | `<span  ... <span>` | Cross-site scripting vulnerability due to $@. | classnames.js:10:45:10:55 | window.name | user-provided value |
 | classnames.js:13:31:13:83 | `<span  ... <span>` | classnames.js:13:57:13:67 | window.name | classnames.js:13:31:13:83 | `<span  ... <span>` | Cross-site scripting vulnerability due to $@. | classnames.js:13:57:13:67 | window.name | user-provided value |
 | classnames.js:15:31:15:78 | `<span  ... <span>` | classnames.js:15:52:15:62 | window.name | classnames.js:15:31:15:78 | `<span  ... <span>` | Cross-site scripting vulnerability due to $@. | classnames.js:15:52:15:62 | window.name | user-provided value |
+| classnames.js:17:32:17:79 | `<span  ... <span>` | classnames.js:17:53:17:63 | window.name | classnames.js:17:32:17:79 | `<span  ... <span>` | Cross-site scripting vulnerability due to $@. | classnames.js:17:53:17:63 | window.name | user-provided value |
 | clipboard.ts:15:25:15:28 | html | clipboard.ts:8:18:8:51 | clipboa ... /html') | clipboard.ts:15:25:15:28 | html | Cross-site scripting vulnerability due to $@. | clipboard.ts:8:18:8:51 | clipboa ... /html') | user-provided value |
 | clipboard.ts:24:23:24:58 | e.clipb ... /html') | clipboard.ts:24:23:24:58 | e.clipb ... /html') | clipboard.ts:24:23:24:58 | e.clipb ... /html') | Cross-site scripting vulnerability due to $@. | clipboard.ts:24:23:24:58 | e.clipb ... /html') | user-provided value |
 | clipboard.ts:29:19:29:54 | e.clipb ... /html') | clipboard.ts:29:19:29:54 | e.clipb ... /html') | clipboard.ts:29:19:29:54 | e.clipb ... /html') | Cross-site scripting vulnerability due to $@. | clipboard.ts:29:19:29:54 | e.clipb ... /html') | user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
index f8f72db0b4a..fa65ccbe3df 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
@@ -116,6 +116,11 @@ nodes
 | classnames.js:15:47:15:63 | clsx(window.name) |
 | classnames.js:15:52:15:62 | window.name |
 | classnames.js:15:52:15:62 | window.name |
+| classnames.js:17:32:17:79 | `<span  ... <span>` |
+| classnames.js:17:32:17:79 | `<span  ... <span>` |
+| classnames.js:17:48:17:64 | clsx(window.name) |
+| classnames.js:17:53:17:63 | window.name |
+| classnames.js:17:53:17:63 | window.name |
 | clipboard.ts:8:11:8:51 | html |
 | clipboard.ts:8:11:8:51 | html |
 | clipboard.ts:8:18:8:51 | clipboa ... /html') |
@@ -1237,6 +1242,10 @@ edges
 | classnames.js:15:47:15:63 | clsx(window.name) | classnames.js:15:31:15:78 | `<span  ... <span>` |
 | classnames.js:15:52:15:62 | window.name | classnames.js:15:47:15:63 | clsx(window.name) |
 | classnames.js:15:52:15:62 | window.name | classnames.js:15:47:15:63 | clsx(window.name) |
+| classnames.js:17:48:17:64 | clsx(window.name) | classnames.js:17:32:17:79 | `<span  ... <span>` |
+| classnames.js:17:48:17:64 | clsx(window.name) | classnames.js:17:32:17:79 | `<span  ... <span>` |
+| classnames.js:17:53:17:63 | window.name | classnames.js:17:48:17:64 | clsx(window.name) |
+| classnames.js:17:53:17:63 | window.name | classnames.js:17:48:17:64 | clsx(window.name) |
 | clipboard.ts:8:11:8:51 | html | clipboard.ts:15:25:15:28 | html |
 | clipboard.ts:8:11:8:51 | html | clipboard.ts:15:25:15:28 | html |
 | clipboard.ts:8:11:8:51 | html | clipboard.ts:15:25:15:28 | html |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/classnames.js b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/classnames.js
index e18f7844f68..a0e75045a2e 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/classnames.js
+++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/classnames.js
@@ -13,4 +13,6 @@ function main() {
     document.body.innerHTML = `<span class="${safeStyle(window.name)}">Hello<span>`; // NOT OK
     document.body.innerHTML = `<span class="${safeStyle('foo')}">Hello<span>`; // OK
     document.body.innerHTML = `<span class="${clsx(window.name)}">Hello<span>`; // NOT OK
+
+    document.body.innerHTML += `<span class="${clsx(window.name)}">Hello<span>`; // NOT OK
 }
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/UnsafeHtmlConstruction.expected b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/UnsafeHtmlConstruction.expected
index 94f1fe314b0..c5e4ad2d60b 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/UnsafeHtmlConstruction.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/UnsafeHtmlConstruction.expected
@@ -8,6 +8,14 @@ nodes
 | jquery-plugin.js:12:31:12:41 | options.foo |
 | jquery-plugin.js:14:31:14:35 | stuff |
 | jquery-plugin.js:14:31:14:35 | stuff |
+| lib2/index.ts:1:28:1:28 | s |
+| lib2/index.ts:1:28:1:28 | s |
+| lib2/index.ts:2:29:2:29 | s |
+| lib2/index.ts:2:29:2:29 | s |
+| lib/src/MyNode.ts:1:28:1:28 | s |
+| lib/src/MyNode.ts:1:28:1:28 | s |
+| lib/src/MyNode.ts:2:29:2:29 | s |
+| lib/src/MyNode.ts:2:29:2:29 | s |
 | main.js:1:55:1:55 | s |
 | main.js:1:55:1:55 | s |
 | main.js:2:29:2:29 | s |
@@ -56,6 +64,22 @@ nodes
 | main.js:93:43:93:43 | x |
 | main.js:93:43:93:43 | x |
 | main.js:94:31:94:31 | x |
+| main.js:98:43:98:43 | x |
+| main.js:98:43:98:43 | x |
+| main.js:99:28:99:28 | x |
+| main.js:99:28:99:28 | x |
+| main.js:103:43:103:43 | x |
+| main.js:103:43:103:43 | x |
+| main.js:105:26:105:26 | x |
+| main.js:105:26:105:26 | x |
+| main.js:109:41:109:41 | x |
+| main.js:109:41:109:41 | x |
+| main.js:111:37:111:37 | x |
+| main.js:111:37:111:37 | x |
+| main.js:116:47:116:47 | s |
+| main.js:116:47:116:47 | s |
+| main.js:117:34:117:34 | s |
+| main.js:117:34:117:34 | s |
 | typed.ts:1:39:1:39 | s |
 | typed.ts:1:39:1:39 | s |
 | typed.ts:2:29:2:29 | s |
@@ -80,6 +104,14 @@ edges
 | jquery-plugin.js:11:34:11:40 | options | jquery-plugin.js:12:31:12:37 | options |
 | jquery-plugin.js:12:31:12:37 | options | jquery-plugin.js:12:31:12:41 | options.foo |
 | jquery-plugin.js:12:31:12:37 | options | jquery-plugin.js:12:31:12:41 | options.foo |
+| lib2/index.ts:1:28:1:28 | s | lib2/index.ts:2:29:2:29 | s |
+| lib2/index.ts:1:28:1:28 | s | lib2/index.ts:2:29:2:29 | s |
+| lib2/index.ts:1:28:1:28 | s | lib2/index.ts:2:29:2:29 | s |
+| lib2/index.ts:1:28:1:28 | s | lib2/index.ts:2:29:2:29 | s |
+| lib/src/MyNode.ts:1:28:1:28 | s | lib/src/MyNode.ts:2:29:2:29 | s |
+| lib/src/MyNode.ts:1:28:1:28 | s | lib/src/MyNode.ts:2:29:2:29 | s |
+| lib/src/MyNode.ts:1:28:1:28 | s | lib/src/MyNode.ts:2:29:2:29 | s |
+| lib/src/MyNode.ts:1:28:1:28 | s | lib/src/MyNode.ts:2:29:2:29 | s |
 | main.js:1:55:1:55 | s | main.js:2:29:2:29 | s |
 | main.js:1:55:1:55 | s | main.js:2:29:2:29 | s |
 | main.js:1:55:1:55 | s | main.js:2:29:2:29 | s |
@@ -126,6 +158,30 @@ edges
 | main.js:93:43:93:43 | x | main.js:94:31:94:31 | x |
 | main.js:93:43:93:43 | x | main.js:94:31:94:31 | x |
 | main.js:94:31:94:31 | x | main.js:89:21:89:21 | x |
+| main.js:98:43:98:43 | x | main.js:99:28:99:28 | x |
+| main.js:98:43:98:43 | x | main.js:99:28:99:28 | x |
+| main.js:98:43:98:43 | x | main.js:99:28:99:28 | x |
+| main.js:98:43:98:43 | x | main.js:99:28:99:28 | x |
+| main.js:98:43:98:43 | x | main.js:103:43:103:43 | x |
+| main.js:98:43:98:43 | x | main.js:103:43:103:43 | x |
+| main.js:98:43:98:43 | x | main.js:103:43:103:43 | x |
+| main.js:98:43:98:43 | x | main.js:103:43:103:43 | x |
+| main.js:98:43:98:43 | x | main.js:105:26:105:26 | x |
+| main.js:98:43:98:43 | x | main.js:105:26:105:26 | x |
+| main.js:98:43:98:43 | x | main.js:105:26:105:26 | x |
+| main.js:98:43:98:43 | x | main.js:105:26:105:26 | x |
+| main.js:98:43:98:43 | x | main.js:109:41:109:41 | x |
+| main.js:98:43:98:43 | x | main.js:109:41:109:41 | x |
+| main.js:98:43:98:43 | x | main.js:109:41:109:41 | x |
+| main.js:98:43:98:43 | x | main.js:109:41:109:41 | x |
+| main.js:98:43:98:43 | x | main.js:111:37:111:37 | x |
+| main.js:98:43:98:43 | x | main.js:111:37:111:37 | x |
+| main.js:98:43:98:43 | x | main.js:111:37:111:37 | x |
+| main.js:98:43:98:43 | x | main.js:111:37:111:37 | x |
+| main.js:116:47:116:47 | s | main.js:117:34:117:34 | s |
+| main.js:116:47:116:47 | s | main.js:117:34:117:34 | s |
+| main.js:116:47:116:47 | s | main.js:117:34:117:34 | s |
+| main.js:116:47:116:47 | s | main.js:117:34:117:34 | s |
 | typed.ts:1:39:1:39 | s | typed.ts:2:29:2:29 | s |
 | typed.ts:1:39:1:39 | s | typed.ts:2:29:2:29 | s |
 | typed.ts:1:39:1:39 | s | typed.ts:2:29:2:29 | s |
@@ -141,17 +197,25 @@ edges
 | typed.ts:16:11:16:21 | s | typed.ts:17:29:17:29 | s |
 | typed.ts:16:15:16:21 | id("x") | typed.ts:16:11:16:21 | s |
 #select
-| jquery-plugin.js:12:31:12:41 | options.foo | jquery-plugin.js:11:34:11:40 | options | jquery-plugin.js:12:31:12:41 | options.foo | $@ based on $@ might later cause $@. | jquery-plugin.js:12:31:12:41 | options.foo | HTML construction | jquery-plugin.js:11:34:11:40 | options | library input | jquery-plugin.js:12:20:12:53 | "<span> ... /span>" | cross-site scripting |
-| jquery-plugin.js:14:31:14:35 | stuff | jquery-plugin.js:11:27:11:31 | stuff | jquery-plugin.js:14:31:14:35 | stuff | $@ based on $@ might later cause $@. | jquery-plugin.js:14:31:14:35 | stuff | HTML construction | jquery-plugin.js:11:27:11:31 | stuff | library input | jquery-plugin.js:14:20:14:47 | "<span> ... /span>" | cross-site scripting |
-| main.js:2:29:2:29 | s | main.js:1:55:1:55 | s | main.js:2:29:2:29 | s | $@ based on $@ might later cause $@. | main.js:2:29:2:29 | s | HTML construction | main.js:1:55:1:55 | s | library input | main.js:3:49:3:52 | html | cross-site scripting |
-| main.js:7:49:7:49 | s | main.js:6:49:6:49 | s | main.js:7:49:7:49 | s | $@ based on $@ might later cause $@. | main.js:7:49:7:49 | s | XML parsing | main.js:6:49:6:49 | s | library input | main.js:8:48:8:66 | doc.documentElement | cross-site scripting |
-| main.js:12:49:12:49 | s | main.js:11:60:11:60 | s | main.js:12:49:12:49 | s | $@ based on $@ might later cause $@. | main.js:12:49:12:49 | s | XML parsing | main.js:11:60:11:60 | s | library input | main.js:16:21:16:35 | xml.cloneNode() | cross-site scripting |
-| main.js:12:49:12:49 | s | main.js:11:60:11:60 | s | main.js:12:49:12:49 | s | $@ based on $@ might later cause $@. | main.js:12:49:12:49 | s | XML parsing | main.js:11:60:11:60 | s | library input | main.js:17:48:17:50 | tmp | cross-site scripting |
-| main.js:22:34:22:34 | s | main.js:21:47:21:47 | s | main.js:22:34:22:34 | s | $@ based on $@ might later cause $@. | main.js:22:34:22:34 | s | Markdown rendering | main.js:21:47:21:47 | s | library input | main.js:23:53:23:56 | html | cross-site scripting |
-| main.js:47:65:47:73 | this.step | main.js:52:41:52:41 | s | main.js:47:65:47:73 | this.step | $@ based on $@ might later cause $@. | main.js:47:65:47:73 | this.step | HTML construction | main.js:52:41:52:41 | s | library input | main.js:47:54:47:85 | "<span> ... /span>" | cross-site scripting |
-| main.js:62:19:62:31 | settings.name | main.js:56:28:56:34 | options | main.js:62:19:62:31 | settings.name | $@ based on $@ might later cause $@. | main.js:62:19:62:31 | settings.name | HTML construction | main.js:56:28:56:34 | options | library input | main.js:62:11:62:40 | "<b>" + ...  "</b>" | cross-site scripting |
-| main.js:67:63:67:69 | attrVal | main.js:66:35:66:41 | attrVal | main.js:67:63:67:69 | attrVal | $@ based on $@ might later cause $@. | main.js:67:63:67:69 | attrVal | HTML construction | main.js:66:35:66:41 | attrVal | library input | main.js:67:47:67:78 | "<img a ...  "\\"/>" | cross-site scripting |
-| main.js:81:35:81:37 | val | main.js:79:34:79:36 | val | main.js:81:35:81:37 | val | $@ based on $@ might later cause $@. | main.js:81:35:81:37 | val | HTML construction | main.js:79:34:79:36 | val | library input | main.js:81:24:81:49 | "<span> ... /span>" | cross-site scripting |
-| main.js:90:23:90:23 | x | main.js:93:43:93:43 | x | main.js:90:23:90:23 | x | $@ based on $@ might later cause $@. | main.js:90:23:90:23 | x | HTML construction | main.js:93:43:93:43 | x | library input | main.js:94:20:94:32 | createHTML(x) | cross-site scripting |
-| typed.ts:2:29:2:29 | s | typed.ts:1:39:1:39 | s | typed.ts:2:29:2:29 | s | $@ based on $@ might later cause $@. | typed.ts:2:29:2:29 | s | HTML construction | typed.ts:1:39:1:39 | s | library input | typed.ts:3:31:3:34 | html | cross-site scripting |
-| typed.ts:8:40:8:40 | s | typed.ts:6:43:6:43 | s | typed.ts:8:40:8:40 | s | $@ based on $@ might later cause $@. | typed.ts:8:40:8:40 | s | HTML construction | typed.ts:6:43:6:43 | s | library input | typed.ts:8:29:8:52 | "<span> ... /span>" | cross-site scripting |
+| jquery-plugin.js:12:31:12:41 | options.foo | jquery-plugin.js:11:34:11:40 | options | jquery-plugin.js:12:31:12:41 | options.foo | $@ which depends on $@ might later allow $@. | jquery-plugin.js:12:31:12:41 | options.foo | HTML construction | jquery-plugin.js:11:34:11:40 | options | library input | jquery-plugin.js:12:20:12:53 | "<span> ... /span>" | cross-site scripting |
+| jquery-plugin.js:14:31:14:35 | stuff | jquery-plugin.js:11:27:11:31 | stuff | jquery-plugin.js:14:31:14:35 | stuff | $@ which depends on $@ might later allow $@. | jquery-plugin.js:14:31:14:35 | stuff | HTML construction | jquery-plugin.js:11:27:11:31 | stuff | library input | jquery-plugin.js:14:20:14:47 | "<span> ... /span>" | cross-site scripting |
+| lib2/index.ts:2:29:2:29 | s | lib2/index.ts:1:28:1:28 | s | lib2/index.ts:2:29:2:29 | s | $@ which depends on $@ might later allow $@. | lib2/index.ts:2:29:2:29 | s | HTML construction | lib2/index.ts:1:28:1:28 | s | library input | lib2/index.ts:3:49:3:52 | html | cross-site scripting |
+| lib/src/MyNode.ts:2:29:2:29 | s | lib/src/MyNode.ts:1:28:1:28 | s | lib/src/MyNode.ts:2:29:2:29 | s | $@ which depends on $@ might later allow $@. | lib/src/MyNode.ts:2:29:2:29 | s | HTML construction | lib/src/MyNode.ts:1:28:1:28 | s | library input | lib/src/MyNode.ts:3:49:3:52 | html | cross-site scripting |
+| main.js:2:29:2:29 | s | main.js:1:55:1:55 | s | main.js:2:29:2:29 | s | $@ which depends on $@ might later allow $@. | main.js:2:29:2:29 | s | HTML construction | main.js:1:55:1:55 | s | library input | main.js:3:49:3:52 | html | cross-site scripting |
+| main.js:7:49:7:49 | s | main.js:6:49:6:49 | s | main.js:7:49:7:49 | s | $@ which depends on $@ might later allow $@. | main.js:7:49:7:49 | s | XML parsing | main.js:6:49:6:49 | s | library input | main.js:8:48:8:66 | doc.documentElement | cross-site scripting |
+| main.js:12:49:12:49 | s | main.js:11:60:11:60 | s | main.js:12:49:12:49 | s | $@ which depends on $@ might later allow $@. | main.js:12:49:12:49 | s | XML parsing | main.js:11:60:11:60 | s | library input | main.js:16:21:16:35 | xml.cloneNode() | cross-site scripting |
+| main.js:12:49:12:49 | s | main.js:11:60:11:60 | s | main.js:12:49:12:49 | s | $@ which depends on $@ might later allow $@. | main.js:12:49:12:49 | s | XML parsing | main.js:11:60:11:60 | s | library input | main.js:17:48:17:50 | tmp | cross-site scripting |
+| main.js:22:34:22:34 | s | main.js:21:47:21:47 | s | main.js:22:34:22:34 | s | $@ which depends on $@ might later allow $@. | main.js:22:34:22:34 | s | Markdown rendering | main.js:21:47:21:47 | s | library input | main.js:23:53:23:56 | html | cross-site scripting |
+| main.js:47:65:47:73 | this.step | main.js:52:41:52:41 | s | main.js:47:65:47:73 | this.step | $@ which depends on $@ might later allow $@. | main.js:47:65:47:73 | this.step | HTML construction | main.js:52:41:52:41 | s | library input | main.js:47:54:47:85 | "<span> ... /span>" | cross-site scripting |
+| main.js:62:19:62:31 | settings.name | main.js:56:28:56:34 | options | main.js:62:19:62:31 | settings.name | $@ which depends on $@ might later allow $@. | main.js:62:19:62:31 | settings.name | HTML construction | main.js:56:28:56:34 | options | library input | main.js:62:11:62:40 | "<b>" + ...  "</b>" | cross-site scripting |
+| main.js:67:63:67:69 | attrVal | main.js:66:35:66:41 | attrVal | main.js:67:63:67:69 | attrVal | $@ which depends on $@ might later allow $@. | main.js:67:63:67:69 | attrVal | HTML construction | main.js:66:35:66:41 | attrVal | library input | main.js:67:47:67:78 | "<img a ...  "\\"/>" | cross-site scripting |
+| main.js:81:35:81:37 | val | main.js:79:34:79:36 | val | main.js:81:35:81:37 | val | $@ which depends on $@ might later allow $@. | main.js:81:35:81:37 | val | HTML construction | main.js:79:34:79:36 | val | library input | main.js:81:24:81:49 | "<span> ... /span>" | cross-site scripting |
+| main.js:90:23:90:23 | x | main.js:93:43:93:43 | x | main.js:90:23:90:23 | x | $@ which depends on $@ might later allow $@. | main.js:90:23:90:23 | x | HTML construction | main.js:93:43:93:43 | x | library input | main.js:94:20:94:32 | createHTML(x) | cross-site scripting |
+| main.js:99:28:99:28 | x | main.js:98:43:98:43 | x | main.js:99:28:99:28 | x | $@ which depends on $@ might later allow $@. | main.js:99:28:99:28 | x | Markdown rendering | main.js:98:43:98:43 | x | library input | main.js:100:24:100:26 | svg | cross-site scripting |
+| main.js:103:43:103:43 | x | main.js:98:43:98:43 | x | main.js:103:43:103:43 | x | $@ which depends on $@ might later allow $@. | main.js:103:43:103:43 | x | Markdown rendering | main.js:98:43:98:43 | x | library input | main.js:103:20:103:44 | myMerma ... id", x) | cross-site scripting |
+| main.js:105:26:105:26 | x | main.js:98:43:98:43 | x | main.js:105:26:105:26 | x | $@ which depends on $@ might later allow $@. | main.js:105:26:105:26 | x | Markdown rendering | main.js:98:43:98:43 | x | library input | main.js:106:24:106:26 | svg | cross-site scripting |
+| main.js:109:41:109:41 | x | main.js:98:43:98:43 | x | main.js:109:41:109:41 | x | $@ which depends on $@ might later allow $@. | main.js:109:41:109:41 | x | Markdown rendering | main.js:98:43:98:43 | x | library input | main.js:109:20:109:42 | mermaid ... id", x) | cross-site scripting |
+| main.js:111:37:111:37 | x | main.js:98:43:98:43 | x | main.js:111:37:111:37 | x | $@ which depends on $@ might later allow $@. | main.js:111:37:111:37 | x | Markdown rendering | main.js:98:43:98:43 | x | library input | main.js:112:24:112:26 | svg | cross-site scripting |
+| main.js:117:34:117:34 | s | main.js:116:47:116:47 | s | main.js:117:34:117:34 | s | $@ which depends on $@ might later allow $@. | main.js:117:34:117:34 | s | Markdown rendering | main.js:116:47:116:47 | s | library input | main.js:118:53:118:56 | html | cross-site scripting |
+| typed.ts:2:29:2:29 | s | typed.ts:1:39:1:39 | s | typed.ts:2:29:2:29 | s | $@ which depends on $@ might later allow $@. | typed.ts:2:29:2:29 | s | HTML construction | typed.ts:1:39:1:39 | s | library input | typed.ts:3:31:3:34 | html | cross-site scripting |
+| typed.ts:8:40:8:40 | s | typed.ts:6:43:6:43 | s | typed.ts:8:40:8:40 | s | $@ which depends on $@ might later allow $@. | typed.ts:8:40:8:40 | s | HTML construction | typed.ts:6:43:6:43 | s | library input | typed.ts:8:29:8:52 | "<span> ... /span>" | cross-site scripting |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib/package.json b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib/package.json
new file mode 100644
index 00000000000..b849ee492e2
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib/package.json
@@ -0,0 +1,10 @@
+{
+    "name": "my-unsafe-library",
+    "main": "./index.js",
+    "exports": {
+        "./MyNode": {
+            "require": "./lib/MyNode.cjs",
+            "import": "./lib/MyNode.mjs"
+        }
+    }
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib/src/MyNode.ts b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib/src/MyNode.ts
new file mode 100644
index 00000000000..91e81238605
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib/src/MyNode.ts
@@ -0,0 +1,4 @@
+export function trivialXss(s: string) {
+    const html = "<span>" + s + "</span>"; // NOT OK
+    document.querySelector("#html").innerHTML = html;
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib2/index.ts b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib2/index.ts
new file mode 100644
index 00000000000..21bb420b71f
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib2/index.ts
@@ -0,0 +1,4 @@
+export function trivialXss(s: string) {
+    const html = "<span>" + s + "</span>"; // NOT OK - this file is recognized as a main file.
+    document.querySelector("#html").innerHTML = html;
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib2/package.json b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib2/package.json
new file mode 100644
index 00000000000..8c1cbff3c1d
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib2/package.json
@@ -0,0 +1,10 @@
+{
+    "name": "my-unsafe-library",
+    "main": "./foobar.js",
+    "exports": {
+        "./MyNode": {
+            "require": "./lib/MyNode.cjs",
+            "import": "./lib/MyNode.mjs"
+        }
+    }
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib2/src/MyNode.ts b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib2/src/MyNode.ts
new file mode 100644
index 00000000000..35908c88f16
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/lib2/src/MyNode.ts
@@ -0,0 +1,4 @@
+export function trivialXss(s: string) {
+    const html = "<span>" + s + "</span>"; // OK - this file is not recognized as a main file.
+    document.querySelector("#html").innerHTML = html;
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/main.js b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/main.js
index 2e9d344b1f3..01d376a2f8b 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/main.js
+++ b/javascript/ql/test/query-tests/Security/CWE-079/UnsafeHtmlConstruction/main.js
@@ -92,4 +92,28 @@ function createHTML(x) {
 
 module.exports.usesCreateHTML = function (x) {
     $("#foo").html(createHTML(x));
-}
\ No newline at end of file
+}
+
+const myMermaid = require('mermaid');
+module.exports.usesCreateHTML = function (x) {
+    myMermaid.render("id", x, function (svg) { // NOT OK
+        $("#foo").html(svg);
+    });
+    
+    $("#foo").html(myMermaid.render("id", x)); // NOT OK
+
+    mermaid.render("id", x, function (svg) {// NOT OK
+        $("#foo").html(svg); 
+    });
+
+    $("#foo").html(mermaid.render("id", x)); // NOT OK
+
+    mermaid.mermaidAPI.render("id", x, function (svg) {// NOT OK
+        $("#foo").html(svg);
+    });
+}
+
+module.exports.xssThroughMarkdown = function (s) {
+    const html = markdown.render(s); // NOT OK
+    document.querySelector("#markdown").innerHTML = html;
+}
diff --git a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected
index a67ec182885..3755224b9c1 100644
--- a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected
@@ -157,6 +157,18 @@ nodes
 | tst.js:26:26:26:40 | location.search |
 | tst.js:26:26:26:53 | locatio ... ring(1) |
 | tst.js:26:26:26:53 | locatio ... ring(1) |
+| tst.js:29:9:29:82 | source |
+| tst.js:29:18:29:41 | documen ... .search |
+| tst.js:29:18:29:41 | documen ... .search |
+| tst.js:29:18:29:82 | documen ... , "$1") |
+| tst.js:31:18:31:23 | source |
+| tst.js:31:18:31:23 | source |
+| tst.js:33:14:33:19 | source |
+| tst.js:33:14:33:19 | source |
+| tst.js:35:28:35:33 | source |
+| tst.js:35:28:35:33 | source |
+| tst.js:37:33:37:38 | source |
+| tst.js:37:33:37:38 | source |
 edges
 | NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
 | NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
@@ -262,55 +274,70 @@ edges
 | tst.js:26:26:26:40 | location.search | tst.js:26:26:26:53 | locatio ... ring(1) |
 | tst.js:26:26:26:40 | location.search | tst.js:26:26:26:53 | locatio ... ring(1) |
 | tst.js:26:26:26:40 | location.search | tst.js:26:26:26:53 | locatio ... ring(1) |
+| tst.js:29:9:29:82 | source | tst.js:31:18:31:23 | source |
+| tst.js:29:9:29:82 | source | tst.js:31:18:31:23 | source |
+| tst.js:29:9:29:82 | source | tst.js:33:14:33:19 | source |
+| tst.js:29:9:29:82 | source | tst.js:33:14:33:19 | source |
+| tst.js:29:9:29:82 | source | tst.js:35:28:35:33 | source |
+| tst.js:29:9:29:82 | source | tst.js:35:28:35:33 | source |
+| tst.js:29:9:29:82 | source | tst.js:37:33:37:38 | source |
+| tst.js:29:9:29:82 | source | tst.js:37:33:37:38 | source |
+| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
+| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
+| tst.js:29:18:29:82 | documen ... , "$1") | tst.js:29:9:29:82 | source |
 #select
-| NoSQLCodeInjection.js:18:24:18:37 | req.body.query | NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query | $@ flows to here and is interpreted as code. | NoSQLCodeInjection.js:18:24:18:31 | req.body | User-provided value |
-| NoSQLCodeInjection.js:19:24:19:48 | "name = ... dy.name | NoSQLCodeInjection.js:19:36:19:43 | req.body | NoSQLCodeInjection.js:19:24:19:48 | "name = ... dy.name | $@ flows to here and is interpreted as code. | NoSQLCodeInjection.js:19:36:19:43 | req.body | User-provided value |
-| NoSQLCodeInjection.js:22:24:22:48 | "name = ... dy.name | NoSQLCodeInjection.js:22:36:22:43 | req.body | NoSQLCodeInjection.js:22:24:22:48 | "name = ... dy.name | $@ flows to here and is interpreted as code. | NoSQLCodeInjection.js:22:36:22:43 | req.body | User-provided value |
-| angularjs.js:10:22:10:36 | location.search | angularjs.js:10:22:10:36 | location.search | angularjs.js:10:22:10:36 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:10:22:10:36 | location.search | User-provided value |
-| angularjs.js:13:23:13:37 | location.search | angularjs.js:13:23:13:37 | location.search | angularjs.js:13:23:13:37 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:13:23:13:37 | location.search | User-provided value |
-| angularjs.js:16:28:16:42 | location.search | angularjs.js:16:28:16:42 | location.search | angularjs.js:16:28:16:42 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:16:28:16:42 | location.search | User-provided value |
-| angularjs.js:19:22:19:36 | location.search | angularjs.js:19:22:19:36 | location.search | angularjs.js:19:22:19:36 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:19:22:19:36 | location.search | User-provided value |
-| angularjs.js:22:27:22:41 | location.search | angularjs.js:22:27:22:41 | location.search | angularjs.js:22:27:22:41 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:22:27:22:41 | location.search | User-provided value |
-| angularjs.js:25:23:25:37 | location.search | angularjs.js:25:23:25:37 | location.search | angularjs.js:25:23:25:37 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:25:23:25:37 | location.search | User-provided value |
-| angularjs.js:28:33:28:47 | location.search | angularjs.js:28:33:28:47 | location.search | angularjs.js:28:33:28:47 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:28:33:28:47 | location.search | User-provided value |
-| angularjs.js:31:28:31:42 | location.search | angularjs.js:31:28:31:42 | location.search | angularjs.js:31:28:31:42 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:31:28:31:42 | location.search | User-provided value |
-| angularjs.js:34:18:34:32 | location.search | angularjs.js:34:18:34:32 | location.search | angularjs.js:34:18:34:32 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:34:18:34:32 | location.search | User-provided value |
-| angularjs.js:40:18:40:32 | location.search | angularjs.js:40:18:40:32 | location.search | angularjs.js:40:18:40:32 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:40:18:40:32 | location.search | User-provided value |
-| angularjs.js:44:17:44:31 | location.search | angularjs.js:44:17:44:31 | location.search | angularjs.js:44:17:44:31 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:44:17:44:31 | location.search | User-provided value |
-| angularjs.js:47:16:47:30 | location.search | angularjs.js:47:16:47:30 | location.search | angularjs.js:47:16:47:30 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:47:16:47:30 | location.search | User-provided value |
-| angularjs.js:50:22:50:36 | location.search | angularjs.js:50:22:50:36 | location.search | angularjs.js:50:22:50:36 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:50:22:50:36 | location.search | User-provided value |
-| angularjs.js:53:32:53:46 | location.search | angularjs.js:53:32:53:46 | location.search | angularjs.js:53:32:53:46 | location.search | $@ flows to here and is interpreted as code. | angularjs.js:53:32:53:46 | location.search | User-provided value |
-| express.js:7:24:7:69 | "return ...  + "];" | express.js:7:44:7:62 | req.param("wobble") | express.js:7:24:7:69 | "return ...  + "];" | $@ flows to here and is interpreted as code. | express.js:7:44:7:62 | req.param("wobble") | User-provided value |
-| express.js:9:34:9:79 | "return ...  + "];" | express.js:9:54:9:72 | req.param("wobble") | express.js:9:34:9:79 | "return ...  + "];" | $@ flows to here and is interpreted as code. | express.js:9:54:9:72 | req.param("wobble") | User-provided value |
-| express.js:12:8:12:53 | "return ...  + "];" | express.js:12:28:12:46 | req.param("wobble") | express.js:12:8:12:53 | "return ...  + "];" | $@ flows to here and is interpreted as code. | express.js:12:28:12:46 | req.param("wobble") | User-provided value |
-| express.js:15:22:15:54 | req.par ... ction") | express.js:15:22:15:54 | req.par ... ction") | express.js:15:22:15:54 | req.par ... ction") | $@ flows to here and is interpreted as code. | express.js:15:22:15:54 | req.par ... ction") | User-provided value |
-| express.js:17:30:17:53 | req.par ... cript") | express.js:17:30:17:53 | req.par ... cript") | express.js:17:30:17:53 | req.par ... cript") | $@ flows to here and is interpreted as code. | express.js:17:30:17:53 | req.par ... cript") | User-provided value |
-| express.js:19:37:19:70 | req.par ... odule") | express.js:19:37:19:70 | req.par ... odule") | express.js:19:37:19:70 | req.par ... odule") | $@ flows to here and is interpreted as code. | express.js:19:37:19:70 | req.par ... odule") | User-provided value |
-| express.js:21:19:21:48 | req.par ... ntext") | express.js:21:19:21:48 | req.par ... ntext") | express.js:21:19:21:48 | req.par ... ntext") | $@ flows to here and is interpreted as code. | express.js:21:19:21:48 | req.par ... ntext") | User-provided value |
-| express.js:27:34:27:38 | taint | express.js:26:17:26:35 | req.param("wobble") | express.js:27:34:27:38 | taint | $@ flows to here and is interpreted as code. | express.js:26:17:26:35 | req.param("wobble") | User-provided value |
-| module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | $@ flows to here and is interpreted as code. | module.js:9:16:9:29 | req.query.code | User-provided value |
-| module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | $@ flows to here and is interpreted as code. | module.js:11:17:11:30 | req.query.code | User-provided value |
-| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | $@ flows to here and is interpreted as code. | react-native.js:7:17:7:33 | req.param("code") | User-provided value |
-| react-native.js:10:23:10:29 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:10:23:10:29 | tainted | $@ flows to here and is interpreted as code. | react-native.js:7:17:7:33 | req.param("code") | User-provided value |
-| react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash | $@ flows to here and is interpreted as code. | react.js:10:56:10:77 | documen ... on.hash | User-provided value |
-| template-sinks.js:19:17:19:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:19:17:19:23 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:20:16:20:22 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:20:16:20:22 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:21:18:21:24 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:21:18:21:24 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:22:17:22:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:22:17:22:23 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:23:18:23:24 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:23:18:23:24 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:24:16:24:22 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:24:16:24:22 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:25:27:25:33 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:25:27:25:33 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:26:21:26:27 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:26:21:26:27 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:27:17:27:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:27:17:27:23 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:28:24:28:30 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:28:24:28:30 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:29:21:29:27 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:29:21:29:27 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:30:19:30:25 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:30:19:30:25 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:31:16:31:22 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:31:16:31:22 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| template-sinks.js:32:17:32:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:32:17:32:23 | tainted | $@ flows to here and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
-| tst.js:2:6:2:83 | documen ... t=")+8) | tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) | $@ flows to here and is interpreted as code. | tst.js:2:6:2:27 | documen ... on.href | User-provided value |
-| tst.js:5:12:5:33 | documen ... on.hash | tst.js:5:12:5:33 | documen ... on.hash | tst.js:5:12:5:33 | documen ... on.hash | $@ flows to here and is interpreted as code. | tst.js:5:12:5:33 | documen ... on.hash | User-provided value |
-| tst.js:14:10:14:74 | documen ... , "$1") | tst.js:14:10:14:33 | documen ... .search | tst.js:14:10:14:74 | documen ... , "$1") | $@ flows to here and is interpreted as code. | tst.js:14:10:14:33 | documen ... .search | User-provided value |
-| tst.js:17:21:17:42 | documen ... on.hash | tst.js:17:21:17:42 | documen ... on.hash | tst.js:17:21:17:42 | documen ... on.hash | $@ flows to here and is interpreted as code. | tst.js:17:21:17:42 | documen ... on.hash | User-provided value |
-| tst.js:20:30:20:51 | documen ... on.hash | tst.js:20:30:20:51 | documen ... on.hash | tst.js:20:30:20:51 | documen ... on.hash | $@ flows to here and is interpreted as code. | tst.js:20:30:20:51 | documen ... on.hash | User-provided value |
-| tst.js:23:6:23:46 | atob(do ... ing(1)) | tst.js:23:11:23:32 | documen ... on.hash | tst.js:23:6:23:46 | atob(do ... ing(1)) | $@ flows to here and is interpreted as code. | tst.js:23:11:23:32 | documen ... on.hash | User-provided value |
-| tst.js:26:26:26:53 | locatio ... ring(1) | tst.js:26:26:26:40 | location.search | tst.js:26:26:26:53 | locatio ... ring(1) | $@ flows to here and is interpreted as code. | tst.js:26:26:26:40 | location.search | User-provided value |
+| NoSQLCodeInjection.js:18:24:18:37 | req.body.query | NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query | $@ flows to this location and is interpreted as code. | NoSQLCodeInjection.js:18:24:18:31 | req.body | User-provided value |
+| NoSQLCodeInjection.js:19:24:19:48 | "name = ... dy.name | NoSQLCodeInjection.js:19:36:19:43 | req.body | NoSQLCodeInjection.js:19:24:19:48 | "name = ... dy.name | $@ flows to this location and is interpreted as code. | NoSQLCodeInjection.js:19:36:19:43 | req.body | User-provided value |
+| NoSQLCodeInjection.js:22:24:22:48 | "name = ... dy.name | NoSQLCodeInjection.js:22:36:22:43 | req.body | NoSQLCodeInjection.js:22:24:22:48 | "name = ... dy.name | $@ flows to this location and is interpreted as code. | NoSQLCodeInjection.js:22:36:22:43 | req.body | User-provided value |
+| angularjs.js:10:22:10:36 | location.search | angularjs.js:10:22:10:36 | location.search | angularjs.js:10:22:10:36 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:10:22:10:36 | location.search | User-provided value |
+| angularjs.js:13:23:13:37 | location.search | angularjs.js:13:23:13:37 | location.search | angularjs.js:13:23:13:37 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:13:23:13:37 | location.search | User-provided value |
+| angularjs.js:16:28:16:42 | location.search | angularjs.js:16:28:16:42 | location.search | angularjs.js:16:28:16:42 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:16:28:16:42 | location.search | User-provided value |
+| angularjs.js:19:22:19:36 | location.search | angularjs.js:19:22:19:36 | location.search | angularjs.js:19:22:19:36 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:19:22:19:36 | location.search | User-provided value |
+| angularjs.js:22:27:22:41 | location.search | angularjs.js:22:27:22:41 | location.search | angularjs.js:22:27:22:41 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:22:27:22:41 | location.search | User-provided value |
+| angularjs.js:25:23:25:37 | location.search | angularjs.js:25:23:25:37 | location.search | angularjs.js:25:23:25:37 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:25:23:25:37 | location.search | User-provided value |
+| angularjs.js:28:33:28:47 | location.search | angularjs.js:28:33:28:47 | location.search | angularjs.js:28:33:28:47 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:28:33:28:47 | location.search | User-provided value |
+| angularjs.js:31:28:31:42 | location.search | angularjs.js:31:28:31:42 | location.search | angularjs.js:31:28:31:42 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:31:28:31:42 | location.search | User-provided value |
+| angularjs.js:34:18:34:32 | location.search | angularjs.js:34:18:34:32 | location.search | angularjs.js:34:18:34:32 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:34:18:34:32 | location.search | User-provided value |
+| angularjs.js:40:18:40:32 | location.search | angularjs.js:40:18:40:32 | location.search | angularjs.js:40:18:40:32 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:40:18:40:32 | location.search | User-provided value |
+| angularjs.js:44:17:44:31 | location.search | angularjs.js:44:17:44:31 | location.search | angularjs.js:44:17:44:31 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:44:17:44:31 | location.search | User-provided value |
+| angularjs.js:47:16:47:30 | location.search | angularjs.js:47:16:47:30 | location.search | angularjs.js:47:16:47:30 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:47:16:47:30 | location.search | User-provided value |
+| angularjs.js:50:22:50:36 | location.search | angularjs.js:50:22:50:36 | location.search | angularjs.js:50:22:50:36 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:50:22:50:36 | location.search | User-provided value |
+| angularjs.js:53:32:53:46 | location.search | angularjs.js:53:32:53:46 | location.search | angularjs.js:53:32:53:46 | location.search | $@ flows to this location and is interpreted as code. | angularjs.js:53:32:53:46 | location.search | User-provided value |
+| express.js:7:24:7:69 | "return ...  + "];" | express.js:7:44:7:62 | req.param("wobble") | express.js:7:24:7:69 | "return ...  + "];" | $@ flows to this location and is interpreted as code. | express.js:7:44:7:62 | req.param("wobble") | User-provided value |
+| express.js:9:34:9:79 | "return ...  + "];" | express.js:9:54:9:72 | req.param("wobble") | express.js:9:34:9:79 | "return ...  + "];" | $@ flows to this location and is interpreted as code. | express.js:9:54:9:72 | req.param("wobble") | User-provided value |
+| express.js:12:8:12:53 | "return ...  + "];" | express.js:12:28:12:46 | req.param("wobble") | express.js:12:8:12:53 | "return ...  + "];" | $@ flows to this location and is interpreted as code. | express.js:12:28:12:46 | req.param("wobble") | User-provided value |
+| express.js:15:22:15:54 | req.par ... ction") | express.js:15:22:15:54 | req.par ... ction") | express.js:15:22:15:54 | req.par ... ction") | $@ flows to this location and is interpreted as code. | express.js:15:22:15:54 | req.par ... ction") | User-provided value |
+| express.js:17:30:17:53 | req.par ... cript") | express.js:17:30:17:53 | req.par ... cript") | express.js:17:30:17:53 | req.par ... cript") | $@ flows to this location and is interpreted as code. | express.js:17:30:17:53 | req.par ... cript") | User-provided value |
+| express.js:19:37:19:70 | req.par ... odule") | express.js:19:37:19:70 | req.par ... odule") | express.js:19:37:19:70 | req.par ... odule") | $@ flows to this location and is interpreted as code. | express.js:19:37:19:70 | req.par ... odule") | User-provided value |
+| express.js:21:19:21:48 | req.par ... ntext") | express.js:21:19:21:48 | req.par ... ntext") | express.js:21:19:21:48 | req.par ... ntext") | $@ flows to this location and is interpreted as code. | express.js:21:19:21:48 | req.par ... ntext") | User-provided value |
+| express.js:27:34:27:38 | taint | express.js:26:17:26:35 | req.param("wobble") | express.js:27:34:27:38 | taint | $@ flows to this location and is interpreted as code. | express.js:26:17:26:35 | req.param("wobble") | User-provided value |
+| module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | $@ flows to this location and is interpreted as code. | module.js:9:16:9:29 | req.query.code | User-provided value |
+| module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | $@ flows to this location and is interpreted as code. | module.js:11:17:11:30 | req.query.code | User-provided value |
+| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | $@ flows to this location and is interpreted as code. | react-native.js:7:17:7:33 | req.param("code") | User-provided value |
+| react-native.js:10:23:10:29 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:10:23:10:29 | tainted | $@ flows to this location and is interpreted as code. | react-native.js:7:17:7:33 | req.param("code") | User-provided value |
+| react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash | react.js:10:56:10:77 | documen ... on.hash | $@ flows to this location and is interpreted as code. | react.js:10:56:10:77 | documen ... on.hash | User-provided value |
+| template-sinks.js:19:17:19:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:19:17:19:23 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:20:16:20:22 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:20:16:20:22 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:21:18:21:24 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:21:18:21:24 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:22:17:22:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:22:17:22:23 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:23:18:23:24 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:23:18:23:24 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:24:16:24:22 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:24:16:24:22 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:25:27:25:33 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:25:27:25:33 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:26:21:26:27 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:26:21:26:27 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:27:17:27:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:27:17:27:23 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:28:24:28:30 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:28:24:28:30 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:29:21:29:27 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:29:21:29:27 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:30:19:30:25 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:30:19:30:25 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:31:16:31:22 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:31:16:31:22 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| template-sinks.js:32:17:32:23 | tainted | template-sinks.js:17:19:17:31 | req.query.foo | template-sinks.js:32:17:32:23 | tainted | $@ flows to this location and is interpreted as a template, which may contain code. | template-sinks.js:17:19:17:31 | req.query.foo | User-provided value |
+| tst.js:2:6:2:83 | documen ... t=")+8) | tst.js:2:6:2:27 | documen ... on.href | tst.js:2:6:2:83 | documen ... t=")+8) | $@ flows to this location and is interpreted as code. | tst.js:2:6:2:27 | documen ... on.href | User-provided value |
+| tst.js:5:12:5:33 | documen ... on.hash | tst.js:5:12:5:33 | documen ... on.hash | tst.js:5:12:5:33 | documen ... on.hash | $@ flows to this location and is interpreted as code. | tst.js:5:12:5:33 | documen ... on.hash | User-provided value |
+| tst.js:14:10:14:74 | documen ... , "$1") | tst.js:14:10:14:33 | documen ... .search | tst.js:14:10:14:74 | documen ... , "$1") | $@ flows to this location and is interpreted as code. | tst.js:14:10:14:33 | documen ... .search | User-provided value |
+| tst.js:17:21:17:42 | documen ... on.hash | tst.js:17:21:17:42 | documen ... on.hash | tst.js:17:21:17:42 | documen ... on.hash | $@ flows to this location and is interpreted as code. | tst.js:17:21:17:42 | documen ... on.hash | User-provided value |
+| tst.js:20:30:20:51 | documen ... on.hash | tst.js:20:30:20:51 | documen ... on.hash | tst.js:20:30:20:51 | documen ... on.hash | $@ flows to this location and is interpreted as code. | tst.js:20:30:20:51 | documen ... on.hash | User-provided value |
+| tst.js:23:6:23:46 | atob(do ... ing(1)) | tst.js:23:11:23:32 | documen ... on.hash | tst.js:23:6:23:46 | atob(do ... ing(1)) | $@ flows to this location and is interpreted as code. | tst.js:23:11:23:32 | documen ... on.hash | User-provided value |
+| tst.js:26:26:26:53 | locatio ... ring(1) | tst.js:26:26:26:40 | location.search | tst.js:26:26:26:53 | locatio ... ring(1) | $@ flows to this location and is interpreted as code. | tst.js:26:26:26:40 | location.search | User-provided value |
+| tst.js:31:18:31:23 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:31:18:31:23 | source | $@ flows to this location and is interpreted as code. | tst.js:29:18:29:41 | documen ... .search | User-provided value |
+| tst.js:33:14:33:19 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:33:14:33:19 | source | $@ flows to this location and is interpreted as code. | tst.js:29:18:29:41 | documen ... .search | User-provided value |
+| tst.js:35:28:35:33 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:35:28:35:33 | source | $@ flows to this location and is interpreted as code. | tst.js:29:18:29:41 | documen ... .search | User-provided value |
+| tst.js:37:33:37:38 | source | tst.js:29:18:29:41 | documen ... .search | tst.js:37:33:37:38 | source | $@ flows to this location and is interpreted as code. | tst.js:29:18:29:41 | documen ... .search | User-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected
index e81da50b153..f196cddb063 100644
--- a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected
@@ -161,6 +161,18 @@ nodes
 | tst.js:26:26:26:40 | location.search |
 | tst.js:26:26:26:53 | locatio ... ring(1) |
 | tst.js:26:26:26:53 | locatio ... ring(1) |
+| tst.js:29:9:29:82 | source |
+| tst.js:29:18:29:41 | documen ... .search |
+| tst.js:29:18:29:41 | documen ... .search |
+| tst.js:29:18:29:82 | documen ... , "$1") |
+| tst.js:31:18:31:23 | source |
+| tst.js:31:18:31:23 | source |
+| tst.js:33:14:33:19 | source |
+| tst.js:33:14:33:19 | source |
+| tst.js:35:28:35:33 | source |
+| tst.js:35:28:35:33 | source |
+| tst.js:37:33:37:38 | source |
+| tst.js:37:33:37:38 | source |
 edges
 | NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
 | NoSQLCodeInjection.js:18:24:18:31 | req.body | NoSQLCodeInjection.js:18:24:18:37 | req.body.query |
@@ -270,5 +282,16 @@ edges
 | tst.js:26:26:26:40 | location.search | tst.js:26:26:26:53 | locatio ... ring(1) |
 | tst.js:26:26:26:40 | location.search | tst.js:26:26:26:53 | locatio ... ring(1) |
 | tst.js:26:26:26:40 | location.search | tst.js:26:26:26:53 | locatio ... ring(1) |
+| tst.js:29:9:29:82 | source | tst.js:31:18:31:23 | source |
+| tst.js:29:9:29:82 | source | tst.js:31:18:31:23 | source |
+| tst.js:29:9:29:82 | source | tst.js:33:14:33:19 | source |
+| tst.js:29:9:29:82 | source | tst.js:33:14:33:19 | source |
+| tst.js:29:9:29:82 | source | tst.js:35:28:35:33 | source |
+| tst.js:29:9:29:82 | source | tst.js:35:28:35:33 | source |
+| tst.js:29:9:29:82 | source | tst.js:37:33:37:38 | source |
+| tst.js:29:9:29:82 | source | tst.js:37:33:37:38 | source |
+| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
+| tst.js:29:18:29:41 | documen ... .search | tst.js:29:18:29:82 | documen ... , "$1") |
+| tst.js:29:18:29:82 | documen ... , "$1") | tst.js:29:9:29:82 | source |
 #select
 | eslint-escope-build.js:21:16:21:16 | c | eslint-escope-build.js:20:22:20:22 | c | eslint-escope-build.js:21:16:21:16 | c | $@ flows to here and is interpreted as code. | eslint-escope-build.js:20:22:20:22 | c | User-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/ImproperCodeSanitization.expected b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/ImproperCodeSanitization.expected
index f42fbd481a5..879a4b39bf2 100644
--- a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/ImproperCodeSanitization.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/ImproperCodeSanitization.expected
@@ -65,11 +65,11 @@ edges
 | bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) | bad-code-sanitization.js:63:24:63:55 | `obj[${ ... )}]=42` |
 | bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) | bad-code-sanitization.js:63:24:63:55 | `obj[${ ... )}]=42` |
 #select
-| bad-code-sanitization.js:8:27:8:46 | statements.join(';') | bad-code-sanitization.js:2:69:2:87 | JSON.stringify(key) | bad-code-sanitization.js:8:27:8:46 | statements.join(';') | $@ flows to here and is used to construct code. | bad-code-sanitization.js:2:69:2:87 | JSON.stringify(key) | Improperly sanitized value |
-| bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | $@ flows to here and is used to construct code. | bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | Improperly sanitized value |
-| bad-code-sanitization.js:19:27:19:47 | JSON.st ... (input) | bad-code-sanitization.js:19:27:19:47 | JSON.st ... (input) | bad-code-sanitization.js:19:27:19:47 | JSON.st ... (input) | $@ flows to here and is used to construct code. | bad-code-sanitization.js:19:27:19:47 | JSON.st ... (input) | Improperly sanitized value |
-| bad-code-sanitization.js:31:30:31:50 | JSON.st ... (input) | bad-code-sanitization.js:31:30:31:50 | JSON.st ... (input) | bad-code-sanitization.js:31:30:31:50 | JSON.st ... (input) | $@ flows to here and is used to construct code. | bad-code-sanitization.js:31:30:31:50 | JSON.st ... (input) | Improperly sanitized value |
-| bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | $@ flows to here and is used to construct code. | bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | Improperly sanitized value |
-| bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | $@ flows to here and is used to construct code. | bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | Improperly sanitized value |
-| bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | $@ flows to here and is used to construct code. | bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | Improperly sanitized value |
-| bad-code-sanitization.js:64:27:64:36 | assignment | bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) | bad-code-sanitization.js:64:27:64:36 | assignment | $@ flows to here and is used to construct code. | bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) | Improperly sanitized value |
+| bad-code-sanitization.js:8:27:8:46 | statements.join(';') | bad-code-sanitization.js:2:69:2:87 | JSON.stringify(key) | bad-code-sanitization.js:8:27:8:46 | statements.join(';') | Code construction depends on $@. | bad-code-sanitization.js:2:69:2:87 | JSON.stringify(key) | an improperly sanitized value |
+| bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | Code construction depends on $@. | bad-code-sanitization.js:15:44:15:63 | htmlescape(pathname) | an improperly sanitized value |
+| bad-code-sanitization.js:19:27:19:47 | JSON.st ... (input) | bad-code-sanitization.js:19:27:19:47 | JSON.st ... (input) | bad-code-sanitization.js:19:27:19:47 | JSON.st ... (input) | Code construction depends on $@. | bad-code-sanitization.js:19:27:19:47 | JSON.st ... (input) | an improperly sanitized value |
+| bad-code-sanitization.js:31:30:31:50 | JSON.st ... (input) | bad-code-sanitization.js:31:30:31:50 | JSON.st ... (input) | bad-code-sanitization.js:31:30:31:50 | JSON.st ... (input) | Code construction depends on $@. | bad-code-sanitization.js:31:30:31:50 | JSON.st ... (input) | an improperly sanitized value |
+| bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | Code construction depends on $@. | bad-code-sanitization.js:40:23:40:43 | JSON.st ... (input) | an improperly sanitized value |
+| bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | Code construction depends on $@. | bad-code-sanitization.js:44:22:44:42 | JSON.st ... (input) | an improperly sanitized value |
+| bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | Code construction depends on $@. | bad-code-sanitization.js:52:28:52:62 | JSON.st ... bble")) | an improperly sanitized value |
+| bad-code-sanitization.js:64:27:64:36 | assignment | bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) | bad-code-sanitization.js:64:27:64:36 | assignment | Code construction depends on $@. | bad-code-sanitization.js:63:31:63:49 | JSON.stringify(key) | an improperly sanitized value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/UnsafeCodeConstruction.expected b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/UnsafeCodeConstruction.expected
index 49511750e6f..eb5e4889ee1 100644
--- a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/UnsafeCodeConstruction.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/UnsafeCodeConstruction.expected
@@ -33,7 +33,7 @@ edges
 | lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data |
 | lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data |
 #select
-| lib/index.js:2:21:2:24 | data | lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data | $@ flows to here and is later $@. | lib/index.js:1:35:1:38 | data | Library input | lib/index.js:2:15:2:30 | "(" + data + ")" | interpreted as code |
-| lib/index.js:6:26:6:29 | name | lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name | $@ flows to here and is later $@. | lib/index.js:5:35:5:38 | name | Library input | lib/index.js:6:17:6:29 | "obj." + name | interpreted as code |
-| lib/index.js:14:21:14:24 | data | lib/index.js:13:38:13:41 | data | lib/index.js:14:21:14:24 | data | $@ flows to here and is later $@. | lib/index.js:13:38:13:41 | data | Library input | lib/index.js:14:15:14:30 | "(" + data + ")" | interpreted as code |
-| lib/index.js:22:7:22:10 | data | lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data | $@ flows to here and is later $@. | lib/index.js:19:26:19:29 | data | Library input | lib/index.js:25:24:25:26 | str | interpreted as code |
+| lib/index.js:2:21:2:24 | data | lib/index.js:1:35:1:38 | data | lib/index.js:2:21:2:24 | data | $@ flows to this location and is later $@. | lib/index.js:1:35:1:38 | data | Library input | lib/index.js:2:15:2:30 | "(" + data + ")" | interpreted as code |
+| lib/index.js:6:26:6:29 | name | lib/index.js:5:35:5:38 | name | lib/index.js:6:26:6:29 | name | $@ flows to this location and is later $@. | lib/index.js:5:35:5:38 | name | Library input | lib/index.js:6:17:6:29 | "obj." + name | interpreted as code |
+| lib/index.js:14:21:14:24 | data | lib/index.js:13:38:13:41 | data | lib/index.js:14:21:14:24 | data | $@ flows to this location and is later $@. | lib/index.js:13:38:13:41 | data | Library input | lib/index.js:14:15:14:30 | "(" + data + ")" | interpreted as code |
+| lib/index.js:22:7:22:10 | data | lib/index.js:19:26:19:29 | data | lib/index.js:22:7:22:10 | data | $@ flows to this location and is later $@. | lib/index.js:19:26:19:29 | data | Library input | lib/index.js:25:24:25:26 | str | interpreted as code |
diff --git a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/tst.js b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/tst.js
index d846ffbb7d2..5b51da5daf2 100644
--- a/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/tst.js
@@ -24,3 +24,15 @@ eval(atob(document.location.hash.substring(1)));
 
 // NOT OK
 $('<a>').attr("onclick", location.search.substring(1));
+
+(function test() {
+    var source = document.location.search.replace(/.*\bfoo\s*=\s*([^;]*).*/, "$1"); 
+
+    new Function(source); // NOT OK
+
+    Function(source); // NOT OK
+
+    new Function("a", "b", source); // NOT OK
+
+    new Function(...["a", "b"], source); // NOT OK
+})();
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-094/UnsafeDynamicMethodAccess/UnsafeDynamicMethodAccess.expected b/javascript/ql/test/query-tests/Security/CWE-094/UnsafeDynamicMethodAccess/UnsafeDynamicMethodAccess.expected
index e7c7a4eb681..e9c0bd5adbd 100644
--- a/javascript/ql/test/query-tests/Security/CWE-094/UnsafeDynamicMethodAccess/UnsafeDynamicMethodAccess.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-094/UnsafeDynamicMethodAccess/UnsafeDynamicMethodAccess.expected
@@ -72,9 +72,9 @@ edges
 | tst.js:21:17:21:23 | message | tst.js:21:17:21:28 | message.name |
 | tst.js:21:17:21:28 | message.name | tst.js:21:12:21:28 | '' + message.name |
 #select
-| example.js:13:5:13:24 | window[message.name] | example.js:9:37:9:38 | ev | example.js:13:5:13:24 | window[message.name] | Invocation of method derived from $@ may lead to remote code execution. | example.js:9:37:9:38 | ev | user-controlled value |
-| tst.js:5:5:5:24 | window[message.name] | tst.js:3:37:3:38 | ev | tst.js:5:5:5:24 | window[message.name] | Invocation of method derived from $@ may lead to remote code execution. | tst.js:3:37:3:38 | ev | user-controlled value |
-| tst.js:6:9:6:28 | window[message.name] | tst.js:3:37:3:38 | ev | tst.js:6:9:6:28 | window[message.name] | Invocation of method derived from $@ may lead to remote code execution. | tst.js:3:37:3:38 | ev | user-controlled value |
-| tst.js:11:5:11:19 | f[message.name] | tst.js:3:37:3:38 | ev | tst.js:11:5:11:19 | f[message.name] | Invocation of method derived from $@ may lead to remote code execution. | tst.js:3:37:3:38 | ev | user-controlled value |
-| tst.js:15:5:15:14 | window[ev] | tst.js:3:37:3:38 | ev | tst.js:15:5:15:14 | window[ev] | Invocation of method derived from $@ may lead to remote code execution. | tst.js:3:37:3:38 | ev | user-controlled value |
-| tst.js:21:5:21:29 | window[ ... e.name] | tst.js:3:37:3:38 | ev | tst.js:21:5:21:29 | window[ ... e.name] | Invocation of method derived from $@ may lead to remote code execution. | tst.js:3:37:3:38 | ev | user-controlled value |
+| example.js:13:5:13:24 | window[message.name] | example.js:9:37:9:38 | ev | example.js:13:5:13:24 | window[message.name] | This method is invoked using $@, which may allow remote code execution. | example.js:9:37:9:38 | ev | a user-controlled value |
+| tst.js:5:5:5:24 | window[message.name] | tst.js:3:37:3:38 | ev | tst.js:5:5:5:24 | window[message.name] | This method is invoked using $@, which may allow remote code execution. | tst.js:3:37:3:38 | ev | a user-controlled value |
+| tst.js:6:9:6:28 | window[message.name] | tst.js:3:37:3:38 | ev | tst.js:6:9:6:28 | window[message.name] | This method is invoked using $@, which may allow remote code execution. | tst.js:3:37:3:38 | ev | a user-controlled value |
+| tst.js:11:5:11:19 | f[message.name] | tst.js:3:37:3:38 | ev | tst.js:11:5:11:19 | f[message.name] | This method is invoked using $@, which may allow remote code execution. | tst.js:3:37:3:38 | ev | a user-controlled value |
+| tst.js:15:5:15:14 | window[ev] | tst.js:3:37:3:38 | ev | tst.js:15:5:15:14 | window[ev] | This method is invoked using $@, which may allow remote code execution. | tst.js:3:37:3:38 | ev | a user-controlled value |
+| tst.js:21:5:21:29 | window[ ... e.name] | tst.js:3:37:3:38 | ev | tst.js:21:5:21:29 | window[ ... e.name] | This method is invoked using $@, which may allow remote code execution. | tst.js:3:37:3:38 | ev | a user-controlled value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected b/javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected
index ca8495e8784..16100503c35 100644
--- a/javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected
@@ -187,24 +187,24 @@ edges
 | logInjectionBad.js:73:20:73:26 | q.query | logInjectionBad.js:73:20:73:35 | q.query.username |
 | logInjectionBad.js:73:20:73:35 | q.query.username | logInjectionBad.js:73:9:73:35 | username |
 #select
-| logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
-| logInjectionBad.js:23:37:23:44 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:23:37:23:44 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
-| logInjectionBad.js:24:35:24:42 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:24:35:24:42 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
-| logInjectionBad.js:25:36:25:43 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:25:36:25:43 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
-| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
-| logInjectionBad.js:49:18:49:54 | ansiCol ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:49:18:49:54 | ansiCol ... ername) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
-| logInjectionBad.js:50:18:50:47 | colors. ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:50:18:50:47 | colors. ... ername) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
-| logInjectionBad.js:51:18:51:61 | wrapAns ... e), 20) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:51:18:51:61 | wrapAns ... e), 20) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
-| logInjectionBad.js:52:17:52:47 | underli ... name))) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:52:17:52:47 | underli ... name))) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
-| logInjectionBad.js:53:17:53:76 | highlig ...  true}) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:53:17:53:76 | highlig ...  true}) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
-| logInjectionBad.js:54:17:54:51 | clc.red ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:54:17:54:51 | clc.red ... ername) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
-| logInjectionBad.js:55:17:55:65 | sliceAn ... 20, 30) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:55:17:55:65 | sliceAn ... 20, 30) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
-| logInjectionBad.js:56:17:56:55 | kleur.b ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:56:17:56:55 | kleur.b ... ername) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
-| logInjectionBad.js:57:17:57:48 | chalk.u ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:57:17:57:48 | chalk.u ... ername) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
-| logInjectionBad.js:58:17:58:59 | stripAn ... rname)) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:58:17:58:59 | stripAn ... rname)) | $@ flows to log entry. | logInjectionBad.js:46:23:46:29 | req.url | User-provided value |
-| logInjectionBad.js:66:17:66:43 | prettyj ... ername) | logInjectionBad.js:63:23:63:29 | req.url | logInjectionBad.js:66:17:66:43 | prettyj ... ername) | $@ flows to log entry. | logInjectionBad.js:63:23:63:29 | req.url | User-provided value |
-| logInjectionBad.js:75:15:75:22 | username | logInjectionBad.js:72:23:72:29 | req.url | logInjectionBad.js:75:15:75:22 | username | $@ flows to log entry. | logInjectionBad.js:72:23:72:29 | req.url | User-provided value |
-| logInjectionBad.js:82:30:82:37 | username | logInjectionBad.js:72:23:72:29 | req.url | logInjectionBad.js:82:30:82:37 | username | $@ flows to log entry. | logInjectionBad.js:72:23:72:29 | req.url | User-provided value |
-| logInjectionBad.js:91:26:91:33 | username | logInjectionBad.js:72:23:72:29 | req.url | logInjectionBad.js:91:26:91:33 | username | $@ flows to log entry. | logInjectionBad.js:72:23:72:29 | req.url | User-provided value |
-| logInjectionBad.js:99:26:99:33 | username | logInjectionBad.js:72:23:72:29 | req.url | logInjectionBad.js:99:26:99:33 | username | $@ flows to log entry. | logInjectionBad.js:72:23:72:29 | req.url | User-provided value |
-| logInjectionBad.js:113:37:113:44 | username | logInjectionBad.js:72:23:72:29 | req.url | logInjectionBad.js:113:37:113:44 | username | $@ flows to log entry. | logInjectionBad.js:72:23:72:29 | req.url | User-provided value |
+| logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | Log entry depends on $@. | logInjectionBad.js:19:23:19:29 | req.url | a user-provided value |
+| logInjectionBad.js:23:37:23:44 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:23:37:23:44 | username | Log entry depends on $@. | logInjectionBad.js:19:23:19:29 | req.url | a user-provided value |
+| logInjectionBad.js:24:35:24:42 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:24:35:24:42 | username | Log entry depends on $@. | logInjectionBad.js:19:23:19:29 | req.url | a user-provided value |
+| logInjectionBad.js:25:36:25:43 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:25:36:25:43 | username | Log entry depends on $@. | logInjectionBad.js:19:23:19:29 | req.url | a user-provided value |
+| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | Log entry depends on $@. | logInjectionBad.js:19:23:19:29 | req.url | a user-provided value |
+| logInjectionBad.js:49:18:49:54 | ansiCol ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:49:18:49:54 | ansiCol ... ername) | Log entry depends on $@. | logInjectionBad.js:46:23:46:29 | req.url | a user-provided value |
+| logInjectionBad.js:50:18:50:47 | colors. ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:50:18:50:47 | colors. ... ername) | Log entry depends on $@. | logInjectionBad.js:46:23:46:29 | req.url | a user-provided value |
+| logInjectionBad.js:51:18:51:61 | wrapAns ... e), 20) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:51:18:51:61 | wrapAns ... e), 20) | Log entry depends on $@. | logInjectionBad.js:46:23:46:29 | req.url | a user-provided value |
+| logInjectionBad.js:52:17:52:47 | underli ... name))) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:52:17:52:47 | underli ... name))) | Log entry depends on $@. | logInjectionBad.js:46:23:46:29 | req.url | a user-provided value |
+| logInjectionBad.js:53:17:53:76 | highlig ...  true}) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:53:17:53:76 | highlig ...  true}) | Log entry depends on $@. | logInjectionBad.js:46:23:46:29 | req.url | a user-provided value |
+| logInjectionBad.js:54:17:54:51 | clc.red ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:54:17:54:51 | clc.red ... ername) | Log entry depends on $@. | logInjectionBad.js:46:23:46:29 | req.url | a user-provided value |
+| logInjectionBad.js:55:17:55:65 | sliceAn ... 20, 30) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:55:17:55:65 | sliceAn ... 20, 30) | Log entry depends on $@. | logInjectionBad.js:46:23:46:29 | req.url | a user-provided value |
+| logInjectionBad.js:56:17:56:55 | kleur.b ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:56:17:56:55 | kleur.b ... ername) | Log entry depends on $@. | logInjectionBad.js:46:23:46:29 | req.url | a user-provided value |
+| logInjectionBad.js:57:17:57:48 | chalk.u ... ername) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:57:17:57:48 | chalk.u ... ername) | Log entry depends on $@. | logInjectionBad.js:46:23:46:29 | req.url | a user-provided value |
+| logInjectionBad.js:58:17:58:59 | stripAn ... rname)) | logInjectionBad.js:46:23:46:29 | req.url | logInjectionBad.js:58:17:58:59 | stripAn ... rname)) | Log entry depends on $@. | logInjectionBad.js:46:23:46:29 | req.url | a user-provided value |
+| logInjectionBad.js:66:17:66:43 | prettyj ... ername) | logInjectionBad.js:63:23:63:29 | req.url | logInjectionBad.js:66:17:66:43 | prettyj ... ername) | Log entry depends on $@. | logInjectionBad.js:63:23:63:29 | req.url | a user-provided value |
+| logInjectionBad.js:75:15:75:22 | username | logInjectionBad.js:72:23:72:29 | req.url | logInjectionBad.js:75:15:75:22 | username | Log entry depends on $@. | logInjectionBad.js:72:23:72:29 | req.url | a user-provided value |
+| logInjectionBad.js:82:30:82:37 | username | logInjectionBad.js:72:23:72:29 | req.url | logInjectionBad.js:82:30:82:37 | username | Log entry depends on $@. | logInjectionBad.js:72:23:72:29 | req.url | a user-provided value |
+| logInjectionBad.js:91:26:91:33 | username | logInjectionBad.js:72:23:72:29 | req.url | logInjectionBad.js:91:26:91:33 | username | Log entry depends on $@. | logInjectionBad.js:72:23:72:29 | req.url | a user-provided value |
+| logInjectionBad.js:99:26:99:33 | username | logInjectionBad.js:72:23:72:29 | req.url | logInjectionBad.js:99:26:99:33 | username | Log entry depends on $@. | logInjectionBad.js:72:23:72:29 | req.url | a user-provided value |
+| logInjectionBad.js:113:37:113:44 | username | logInjectionBad.js:72:23:72:29 | req.url | logInjectionBad.js:113:37:113:44 | username | Log entry depends on $@. | logInjectionBad.js:72:23:72:29 | req.url | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-134/TaintedFormatString.expected b/javascript/ql/test/query-tests/Security/CWE-134/TaintedFormatString.expected
index 0ea3425b00e..90a153b4ad8 100644
--- a/javascript/ql/test/query-tests/Security/CWE-134/TaintedFormatString.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-134/TaintedFormatString.expected
@@ -81,23 +81,23 @@ edges
 | tst.js:25:33:25:48 | req.query.format | tst.js:25:33:25:48 | req.query.format |
 | tst.js:26:34:26:49 | req.query.format | tst.js:26:34:26:49 | req.query.format |
 #select
-| tst.js:5:15:5:30 | req.query.format | tst.js:5:15:5:30 | req.query.format | tst.js:5:15:5:30 | req.query.format | $@ flows here and is used in a format string. | tst.js:5:15:5:30 | req.query.format | User-provided value |
-| tst.js:6:26:6:41 | req.query.format | tst.js:6:26:6:41 | req.query.format | tst.js:6:26:6:41 | req.query.format | $@ flows here and is used in a format string. | tst.js:6:26:6:41 | req.query.format | User-provided value |
-| tst.js:7:15:7:30 | req.query.format | tst.js:7:15:7:30 | req.query.format | tst.js:7:15:7:30 | req.query.format | $@ flows here and is used in a format string. | tst.js:7:15:7:30 | req.query.format | User-provided value |
-| tst.js:8:17:8:32 | req.query.format | tst.js:8:17:8:32 | req.query.format | tst.js:8:17:8:32 | req.query.format | $@ flows here and is used in a format string. | tst.js:8:17:8:32 | req.query.format | User-provided value |
-| tst.js:9:16:9:31 | req.query.format | tst.js:9:16:9:31 | req.query.format | tst.js:9:16:9:31 | req.query.format | $@ flows here and is used in a format string. | tst.js:9:16:9:31 | req.query.format | User-provided value |
-| tst.js:10:12:10:27 | req.query.format | tst.js:10:12:10:27 | req.query.format | tst.js:10:12:10:27 | req.query.format | $@ flows here and is used in a format string. | tst.js:10:12:10:27 | req.query.format | User-provided value |
-| tst.js:11:32:11:47 | req.query.format | tst.js:11:32:11:47 | req.query.format | tst.js:11:32:11:47 | req.query.format | $@ flows here and is used in a format string. | tst.js:11:32:11:47 | req.query.format | User-provided value |
-| tst.js:12:21:12:36 | req.query.format | tst.js:12:21:12:36 | req.query.format | tst.js:12:21:12:36 | req.query.format | $@ flows here and is used in a format string. | tst.js:12:21:12:36 | req.query.format | User-provided value |
-| tst.js:13:35:13:50 | req.query.format | tst.js:13:35:13:50 | req.query.format | tst.js:13:35:13:50 | req.query.format | $@ flows here and is used in a format string. | tst.js:13:35:13:50 | req.query.format | User-provided value |
-| tst.js:14:29:14:44 | req.query.format | tst.js:14:29:14:44 | req.query.format | tst.js:14:29:14:44 | req.query.format | $@ flows here and is used in a format string. | tst.js:14:29:14:44 | req.query.format | User-provided value |
-| tst.js:15:30:15:45 | req.query.format | tst.js:15:30:15:45 | req.query.format | tst.js:15:30:15:45 | req.query.format | $@ flows here and is used in a format string. | tst.js:15:30:15:45 | req.query.format | User-provided value |
-| tst.js:16:26:16:41 | req.query.format | tst.js:16:26:16:41 | req.query.format | tst.js:16:26:16:41 | req.query.format | $@ flows here and is used in a format string. | tst.js:16:26:16:41 | req.query.format | User-provided value |
-| tst.js:17:30:17:45 | req.query.format | tst.js:17:30:17:45 | req.query.format | tst.js:17:30:17:45 | req.query.format | $@ flows here and is used in a format string. | tst.js:17:30:17:45 | req.query.format | User-provided value |
-| tst.js:18:38:18:53 | req.query.format | tst.js:18:38:18:53 | req.query.format | tst.js:18:38:18:53 | req.query.format | $@ flows here and is used in a format string. | tst.js:18:38:18:53 | req.query.format | User-provided value |
-| tst.js:20:17:20:32 | req.query.format | tst.js:20:17:20:32 | req.query.format | tst.js:20:17:20:32 | req.query.format | $@ flows here and is used in a format string. | tst.js:20:17:20:32 | req.query.format | User-provided value |
-| tst.js:21:16:21:31 | req.query.format | tst.js:21:16:21:31 | req.query.format | tst.js:21:16:21:31 | req.query.format | $@ flows here and is used in a format string. | tst.js:21:16:21:31 | req.query.format | User-provided value |
-| tst.js:22:17:22:32 | req.query.format | tst.js:22:17:22:32 | req.query.format | tst.js:22:17:22:32 | req.query.format | $@ flows here and is used in a format string. | tst.js:22:17:22:32 | req.query.format | User-provided value |
-| tst.js:24:25:24:40 | req.query.format | tst.js:24:25:24:40 | req.query.format | tst.js:24:25:24:40 | req.query.format | $@ flows here and is used in a format string. | tst.js:24:25:24:40 | req.query.format | User-provided value |
-| tst.js:25:33:25:48 | req.query.format | tst.js:25:33:25:48 | req.query.format | tst.js:25:33:25:48 | req.query.format | $@ flows here and is used in a format string. | tst.js:25:33:25:48 | req.query.format | User-provided value |
-| tst.js:26:34:26:49 | req.query.format | tst.js:26:34:26:49 | req.query.format | tst.js:26:34:26:49 | req.query.format | $@ flows here and is used in a format string. | tst.js:26:34:26:49 | req.query.format | User-provided value |
+| tst.js:5:15:5:30 | req.query.format | tst.js:5:15:5:30 | req.query.format | tst.js:5:15:5:30 | req.query.format | Format string depends on $@. | tst.js:5:15:5:30 | req.query.format | a user-provided value |
+| tst.js:6:26:6:41 | req.query.format | tst.js:6:26:6:41 | req.query.format | tst.js:6:26:6:41 | req.query.format | Format string depends on $@. | tst.js:6:26:6:41 | req.query.format | a user-provided value |
+| tst.js:7:15:7:30 | req.query.format | tst.js:7:15:7:30 | req.query.format | tst.js:7:15:7:30 | req.query.format | Format string depends on $@. | tst.js:7:15:7:30 | req.query.format | a user-provided value |
+| tst.js:8:17:8:32 | req.query.format | tst.js:8:17:8:32 | req.query.format | tst.js:8:17:8:32 | req.query.format | Format string depends on $@. | tst.js:8:17:8:32 | req.query.format | a user-provided value |
+| tst.js:9:16:9:31 | req.query.format | tst.js:9:16:9:31 | req.query.format | tst.js:9:16:9:31 | req.query.format | Format string depends on $@. | tst.js:9:16:9:31 | req.query.format | a user-provided value |
+| tst.js:10:12:10:27 | req.query.format | tst.js:10:12:10:27 | req.query.format | tst.js:10:12:10:27 | req.query.format | Format string depends on $@. | tst.js:10:12:10:27 | req.query.format | a user-provided value |
+| tst.js:11:32:11:47 | req.query.format | tst.js:11:32:11:47 | req.query.format | tst.js:11:32:11:47 | req.query.format | Format string depends on $@. | tst.js:11:32:11:47 | req.query.format | a user-provided value |
+| tst.js:12:21:12:36 | req.query.format | tst.js:12:21:12:36 | req.query.format | tst.js:12:21:12:36 | req.query.format | Format string depends on $@. | tst.js:12:21:12:36 | req.query.format | a user-provided value |
+| tst.js:13:35:13:50 | req.query.format | tst.js:13:35:13:50 | req.query.format | tst.js:13:35:13:50 | req.query.format | Format string depends on $@. | tst.js:13:35:13:50 | req.query.format | a user-provided value |
+| tst.js:14:29:14:44 | req.query.format | tst.js:14:29:14:44 | req.query.format | tst.js:14:29:14:44 | req.query.format | Format string depends on $@. | tst.js:14:29:14:44 | req.query.format | a user-provided value |
+| tst.js:15:30:15:45 | req.query.format | tst.js:15:30:15:45 | req.query.format | tst.js:15:30:15:45 | req.query.format | Format string depends on $@. | tst.js:15:30:15:45 | req.query.format | a user-provided value |
+| tst.js:16:26:16:41 | req.query.format | tst.js:16:26:16:41 | req.query.format | tst.js:16:26:16:41 | req.query.format | Format string depends on $@. | tst.js:16:26:16:41 | req.query.format | a user-provided value |
+| tst.js:17:30:17:45 | req.query.format | tst.js:17:30:17:45 | req.query.format | tst.js:17:30:17:45 | req.query.format | Format string depends on $@. | tst.js:17:30:17:45 | req.query.format | a user-provided value |
+| tst.js:18:38:18:53 | req.query.format | tst.js:18:38:18:53 | req.query.format | tst.js:18:38:18:53 | req.query.format | Format string depends on $@. | tst.js:18:38:18:53 | req.query.format | a user-provided value |
+| tst.js:20:17:20:32 | req.query.format | tst.js:20:17:20:32 | req.query.format | tst.js:20:17:20:32 | req.query.format | Format string depends on $@. | tst.js:20:17:20:32 | req.query.format | a user-provided value |
+| tst.js:21:16:21:31 | req.query.format | tst.js:21:16:21:31 | req.query.format | tst.js:21:16:21:31 | req.query.format | Format string depends on $@. | tst.js:21:16:21:31 | req.query.format | a user-provided value |
+| tst.js:22:17:22:32 | req.query.format | tst.js:22:17:22:32 | req.query.format | tst.js:22:17:22:32 | req.query.format | Format string depends on $@. | tst.js:22:17:22:32 | req.query.format | a user-provided value |
+| tst.js:24:25:24:40 | req.query.format | tst.js:24:25:24:40 | req.query.format | tst.js:24:25:24:40 | req.query.format | Format string depends on $@. | tst.js:24:25:24:40 | req.query.format | a user-provided value |
+| tst.js:25:33:25:48 | req.query.format | tst.js:25:33:25:48 | req.query.format | tst.js:25:33:25:48 | req.query.format | Format string depends on $@. | tst.js:25:33:25:48 | req.query.format | a user-provided value |
+| tst.js:26:34:26:49 | req.query.format | tst.js:26:34:26:49 | req.query.format | tst.js:26:34:26:49 | req.query.format | Format string depends on $@. | tst.js:26:34:26:49 | req.query.format | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-178/CaseSensitiveMiddlewarePath.expected b/javascript/ql/test/query-tests/Security/CWE-178/CaseSensitiveMiddlewarePath.expected
index a79b3100a80..2e8cf4ee415 100644
--- a/javascript/ql/test/query-tests/Security/CWE-178/CaseSensitiveMiddlewarePath.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-178/CaseSensitiveMiddlewarePath.expected
@@ -1,3 +1,7 @@
-| tst.js:8:9:8:19 | /\\/foo\\/.*/ | This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '/FOO/' will bypass the middleware. | tst.js:8:9:8:19 | /\\/foo\\/.*/ | pattern | tst.js:60:1:61:2 | app.get ... ware\\n}) | here |
-| tst.js:14:5:14:28 | new Reg ... (.*)?') | This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '/FOO' will bypass the middleware. | tst.js:14:5:14:28 | new Reg ... (.*)?') | pattern | tst.js:60:1:61:2 | app.get ... ware\\n}) | here |
-| tst.js:41:9:41:25 | /\\/foo\\/([0-9]+)/ | This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '/FOO/' will bypass the middleware. | tst.js:41:9:41:25 | /\\/foo\\/([0-9]+)/ | pattern | tst.js:60:1:61:2 | app.get ... ware\\n}) | here |
+| tst.js:8:9:8:19 | /\\/foo\\/.*/ | This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '/FOO/1' will bypass the middleware. | tst.js:8:9:8:19 | /\\/foo\\/.*/ | pattern | tst.js:60:1:61:2 | app.get ... ware\\n}) | here |
+| tst.js:14:5:14:28 | new Reg ... (.*)?') | This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '/FOO/1' will bypass the middleware. | tst.js:14:5:14:28 | new Reg ... (.*)?') | pattern | tst.js:60:1:61:2 | app.get ... ware\\n}) | here |
+| tst.js:41:9:41:25 | /\\/foo\\/([0-9]+)/ | This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '/FOO/1' will bypass the middleware. | tst.js:41:9:41:25 | /\\/foo\\/([0-9]+)/ | pattern | tst.js:60:1:61:2 | app.get ... ware\\n}) | here |
+| tst.js:64:5:64:28 | new Reg ... (.*)?') | This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '/BAR/1' will bypass the middleware. | tst.js:64:5:64:28 | new Reg ... (.*)?') | pattern | tst.js:73:1:74:2 | app.get ... ware\\n}) | here |
+| tst.js:76:9:76:20 | /\\/baz\\/bla/ | This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '/BAZ/BLA' will bypass the middleware. | tst.js:76:9:76:20 | /\\/baz\\/bla/ | pattern | tst.js:77:1:79:2 | app.get ...  });\\n}) | here |
+| tst.js:86:9:86:30 | /\\/[Bb] ... 3\\/[a]/ | This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '/BAZ3/A' will bypass the middleware. | tst.js:86:9:86:30 | /\\/[Bb] ... 3\\/[a]/ | pattern | tst.js:87:1:89:2 | app.get ...  });\\n}) | here |
+| tst.js:91:9:91:40 | /\\/summ ... ntGame/ | This route uses a case-sensitive path $@, but is guarding a case-insensitive path $@. A path such as '/CURRENTGAME' will bypass the middleware. | tst.js:91:9:91:40 | /\\/summ ... ntGame/ | pattern | tst.js:93:1:95:2 | app.get ... O");\\n}) | here |
diff --git a/javascript/ql/test/query-tests/Security/CWE-178/tst.js b/javascript/ql/test/query-tests/Security/CWE-178/tst.js
index 1acb57b16ea..5fcc3cc94a0 100644
--- a/javascript/ql/test/query-tests/Security/CWE-178/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-178/tst.js
@@ -59,3 +59,37 @@ app.use(/\/foo\/([0-9]+)/i, (req, res) => { // OK - not middleware (also case in
 
 app.get('/foo/:param', (req, res) => { // OK - not a middleware
 });
+
+app.get(
+    new RegExp('^/bar(.*)?'), // NOT OK - case sensitive
+    unknown(),
+    function(req, res, next) {
+        if (req.params.blah) {
+            next();
+        }
+    }
+);
+
+app.get('/bar/*', (req, res) => { // OK - not a middleware
+});
+
+app.use(/\/baz\/bla/, unknown()); // NOT OK - case sensitive
+app.get('/baz/bla', (req, resp) => {
+  resp.send({ test: 123 });
+});
+
+app.use(/\/[Bb][Aa][Zz]2\/[aA]/, unknown()); // OK - not case sensitive
+app.get('/baz2/a', (req, resp) => {
+  resp.send({ test: 123 });
+});
+
+app.use(/\/[Bb][Aa][Zz]3\/[a]/, unknown()); // NOT OK - case sensitive
+app.get('/baz3/a', (req, resp) => {
+  resp.send({ test: 123 });
+});
+
+app.use(/\/summonerByName|\/currentGame/,apiLimit1, apiLimit2);
+
+app.get('/currentGame', function (req, res) {
+    res.send("FOO");
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.expected b/javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.expected
index 36d71d9c229..5e7e2362ccb 100644
--- a/javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-200/FileAccessToHttp.expected
@@ -135,12 +135,12 @@ edges
 | sentAsHeaders.js:24:31:24:53 | "http:/ ... content | sentAsHeaders.js:24:20:24:55 | { Refer ... ntent } |
 | sentAsHeaders.js:24:47:24:53 | content | sentAsHeaders.js:24:31:24:53 | "http:/ ... content |
 #select
-| FileAccessToHttp.js:5:11:10:1 | {\\n  hos ... ent }\\n} | FileAccessToHttp.js:4:15:4:47 | fs.read ... "utf8") | FileAccessToHttp.js:5:11:10:1 | {\\n  hos ... ent }\\n} | $@ flows directly to outbound network request | FileAccessToHttp.js:4:15:4:47 | fs.read ... "utf8") | File data |
-| bufferRead.js:33:21:33:28 | postData | bufferRead.js:12:22:12:43 | new Buf ... s.size) | bufferRead.js:33:21:33:28 | postData | $@ flows directly to outbound network request | bufferRead.js:12:22:12:43 | new Buf ... s.size) | File data |
-| googlecompiler.js:38:18:38:26 | post_data | googlecompiler.js:44:54:44:57 | data | googlecompiler.js:38:18:38:26 | post_data | $@ flows directly to outbound network request | googlecompiler.js:44:54:44:57 | data | File data |
-| readFileSync.js:26:18:26:18 | s | readFileSync.js:5:12:5:39 | fs.read ... t.txt") | readFileSync.js:26:18:26:18 | s | $@ flows directly to outbound network request | readFileSync.js:5:12:5:39 | fs.read ... t.txt") | File data |
-| readStreamRead.js:30:19:30:23 | chunk | readStreamRead.js:13:21:13:35 | readable.read() | readStreamRead.js:30:19:30:23 | chunk | $@ flows directly to outbound network request | readStreamRead.js:13:21:13:35 | readable.read() | File data |
-| request.js:8:11:8:20 | {jsonData} | request.js:28:52:28:55 | data | request.js:8:11:8:20 | {jsonData} | $@ flows directly to outbound network request | request.js:28:52:28:55 | data | File data |
-| request.js:16:11:23:3 | {\\n    u ... ody\\n  } | request.js:43:51:43:54 | data | request.js:16:11:23:3 | {\\n    u ... ody\\n  } | $@ flows directly to outbound network request | request.js:43:51:43:54 | data | File data |
-| sentAsHeaders.js:14:20:19:9 | {\\n      ...       } | sentAsHeaders.js:10:79:10:84 | buffer | sentAsHeaders.js:14:20:19:9 | {\\n      ...       } | $@ flows directly to outbound network request | sentAsHeaders.js:10:79:10:84 | buffer | File data |
-| sentAsHeaders.js:20:20:25:9 | {\\n      ...       } | sentAsHeaders.js:10:79:10:84 | buffer | sentAsHeaders.js:20:20:25:9 | {\\n      ...       } | $@ flows directly to outbound network request | sentAsHeaders.js:10:79:10:84 | buffer | File data |
+| FileAccessToHttp.js:5:11:10:1 | {\\n  hos ... ent }\\n} | FileAccessToHttp.js:4:15:4:47 | fs.read ... "utf8") | FileAccessToHttp.js:5:11:10:1 | {\\n  hos ... ent }\\n} | Outbound network request depends on $@ | FileAccessToHttp.js:4:15:4:47 | fs.read ... "utf8") | file data |
+| bufferRead.js:33:21:33:28 | postData | bufferRead.js:12:22:12:43 | new Buf ... s.size) | bufferRead.js:33:21:33:28 | postData | Outbound network request depends on $@ | bufferRead.js:12:22:12:43 | new Buf ... s.size) | file data |
+| googlecompiler.js:38:18:38:26 | post_data | googlecompiler.js:44:54:44:57 | data | googlecompiler.js:38:18:38:26 | post_data | Outbound network request depends on $@ | googlecompiler.js:44:54:44:57 | data | file data |
+| readFileSync.js:26:18:26:18 | s | readFileSync.js:5:12:5:39 | fs.read ... t.txt") | readFileSync.js:26:18:26:18 | s | Outbound network request depends on $@ | readFileSync.js:5:12:5:39 | fs.read ... t.txt") | file data |
+| readStreamRead.js:30:19:30:23 | chunk | readStreamRead.js:13:21:13:35 | readable.read() | readStreamRead.js:30:19:30:23 | chunk | Outbound network request depends on $@ | readStreamRead.js:13:21:13:35 | readable.read() | file data |
+| request.js:8:11:8:20 | {jsonData} | request.js:28:52:28:55 | data | request.js:8:11:8:20 | {jsonData} | Outbound network request depends on $@ | request.js:28:52:28:55 | data | file data |
+| request.js:16:11:23:3 | {\\n    u ... ody\\n  } | request.js:43:51:43:54 | data | request.js:16:11:23:3 | {\\n    u ... ody\\n  } | Outbound network request depends on $@ | request.js:43:51:43:54 | data | file data |
+| sentAsHeaders.js:14:20:19:9 | {\\n      ...       } | sentAsHeaders.js:10:79:10:84 | buffer | sentAsHeaders.js:14:20:19:9 | {\\n      ...       } | Outbound network request depends on $@ | sentAsHeaders.js:10:79:10:84 | buffer | file data |
+| sentAsHeaders.js:20:20:25:9 | {\\n      ...       } | sentAsHeaders.js:10:79:10:84 | buffer | sentAsHeaders.js:20:20:25:9 | {\\n      ...       } | Outbound network request depends on $@ | sentAsHeaders.js:10:79:10:84 | buffer | file data |
diff --git a/javascript/ql/test/query-tests/Security/CWE-201/PostMessageStar.expected b/javascript/ql/test/query-tests/Security/CWE-201/PostMessageStar.expected
index bb1736fd461..e4c14a2060c 100644
--- a/javascript/ql/test/query-tests/Security/CWE-201/PostMessageStar.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-201/PostMessageStar.expected
@@ -30,8 +30,8 @@ edges
 | PostMessageStar2.js:13:27:13:33 | authKey | PostMessageStar2.js:13:27:13:33 | authKey |
 | PostMessageStar.js:1:27:1:34 | userName | PostMessageStar.js:1:27:1:34 | userName |
 #select
-| PostMessageStar2.js:1:27:1:34 | password | PostMessageStar2.js:1:27:1:34 | password | PostMessageStar2.js:1:27:1:34 | password | Sensitive data returned from $@ is sent to another window without origin restriction. | PostMessageStar2.js:1:27:1:34 | password | here |
-| PostMessageStar2.js:8:29:8:32 | data | PostMessageStar2.js:5:14:5:21 | password | PostMessageStar2.js:8:29:8:32 | data | Sensitive data returned from $@ is sent to another window without origin restriction. | PostMessageStar2.js:5:14:5:21 | password | here |
-| PostMessageStar2.js:9:29:9:36 | data.foo | PostMessageStar2.js:5:14:5:21 | password | PostMessageStar2.js:9:29:9:36 | data.foo | Sensitive data returned from $@ is sent to another window without origin restriction. | PostMessageStar2.js:5:14:5:21 | password | here |
-| PostMessageStar2.js:13:27:13:33 | authKey | PostMessageStar2.js:13:27:13:33 | authKey | PostMessageStar2.js:13:27:13:33 | authKey | Sensitive data returned from $@ is sent to another window without origin restriction. | PostMessageStar2.js:13:27:13:33 | authKey | here |
-| PostMessageStar.js:1:27:1:34 | userName | PostMessageStar.js:1:27:1:34 | userName | PostMessageStar.js:1:27:1:34 | userName | Sensitive data returned from $@ is sent to another window without origin restriction. | PostMessageStar.js:1:27:1:34 | userName | here |
+| PostMessageStar2.js:1:27:1:34 | password | PostMessageStar2.js:1:27:1:34 | password | PostMessageStar2.js:1:27:1:34 | password | $@ is sent to another window without origin restriction. | PostMessageStar2.js:1:27:1:34 | password | Sensitive data |
+| PostMessageStar2.js:8:29:8:32 | data | PostMessageStar2.js:5:14:5:21 | password | PostMessageStar2.js:8:29:8:32 | data | $@ is sent to another window without origin restriction. | PostMessageStar2.js:5:14:5:21 | password | Sensitive data |
+| PostMessageStar2.js:9:29:9:36 | data.foo | PostMessageStar2.js:5:14:5:21 | password | PostMessageStar2.js:9:29:9:36 | data.foo | $@ is sent to another window without origin restriction. | PostMessageStar2.js:5:14:5:21 | password | Sensitive data |
+| PostMessageStar2.js:13:27:13:33 | authKey | PostMessageStar2.js:13:27:13:33 | authKey | PostMessageStar2.js:13:27:13:33 | authKey | $@ is sent to another window without origin restriction. | PostMessageStar2.js:13:27:13:33 | authKey | Sensitive data |
+| PostMessageStar.js:1:27:1:34 | userName | PostMessageStar.js:1:27:1:34 | userName | PostMessageStar.js:1:27:1:34 | userName | $@ is sent to another window without origin restriction. | PostMessageStar.js:1:27:1:34 | userName | Sensitive data |
diff --git a/javascript/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected b/javascript/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
index dfee2aaa859..adb198c1616 100644
--- a/javascript/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected
@@ -29,6 +29,6 @@ edges
 | tst.js:17:11:17:11 | e | tst.js:17:11:17:17 | e.stack |
 | tst.js:17:11:17:11 | e | tst.js:17:11:17:17 | e.stack |
 #select
-| node.js:11:13:11:21 | err.stack | node.js:8:10:8:12 | err | node.js:11:13:11:21 | err.stack | Stack trace information from $@ may be exposed to an external user here. | node.js:8:10:8:12 | err | here |
-| tst.js:7:13:7:13 | e | tst.js:6:12:6:12 | e | tst.js:7:13:7:13 | e | Stack trace information from $@ may be exposed to an external user here. | tst.js:6:12:6:12 | e | here |
-| tst.js:17:11:17:17 | e.stack | tst.js:6:12:6:12 | e | tst.js:17:11:17:17 | e.stack | Stack trace information from $@ may be exposed to an external user here. | tst.js:6:12:6:12 | e | here |
+| node.js:11:13:11:21 | err.stack | node.js:8:10:8:12 | err | node.js:11:13:11:21 | err.stack | $@ flows to this location and may be exposed to an external user. | node.js:8:10:8:12 | err | Stack trace information |
+| tst.js:7:13:7:13 | e | tst.js:6:12:6:12 | e | tst.js:7:13:7:13 | e | $@ flows to this location and may be exposed to an external user. | tst.js:6:12:6:12 | e | Stack trace information |
+| tst.js:17:11:17:17 | e.stack | tst.js:6:12:6:12 | e | tst.js:17:11:17:17 | e.stack | $@ flows to this location and may be exposed to an external user. | tst.js:6:12:6:12 | e | Stack trace information |
diff --git a/javascript/ql/test/query-tests/Security/CWE-312/BuildArtifactLeak.expected b/javascript/ql/test/query-tests/Security/CWE-312/BuildArtifactLeak.expected
index 0a78ec598dd..c0042639c9f 100644
--- a/javascript/ql/test/query-tests/Security/CWE-312/BuildArtifactLeak.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-312/BuildArtifactLeak.expected
@@ -54,6 +54,6 @@ edges
 | build-leaks.js:41:67:41:84 | JSON.stringify(pw) | build-leaks.js:41:43:41:86 | { "proc ... y(pw) } |
 | build-leaks.js:41:82:41:83 | pw | build-leaks.js:41:67:41:84 | JSON.stringify(pw) |
 #select
-| build-leaks.js:4:39:6:1 | { // NO ... .env)\\n} | build-leaks.js:5:35:5:45 | process.env | build-leaks.js:4:39:6:1 | { // NO ... .env)\\n} | Sensitive data returned by $@ is stored in a build artifact here. | build-leaks.js:5:35:5:45 | process.env | process environment |
-| build-leaks.js:34:26:34:57 | getEnv( ... ngified | build-leaks.js:15:24:15:34 | process.env | build-leaks.js:34:26:34:57 | getEnv( ... ngified | Sensitive data returned by $@ is stored in a build artifact here. | build-leaks.js:15:24:15:34 | process.env | process environment |
-| build-leaks.js:41:43:41:86 | { "proc ... y(pw) } | build-leaks.js:40:14:40:60 | url.par ... assword | build-leaks.js:41:43:41:86 | { "proc ... y(pw) } | Sensitive data returned by $@ is stored in a build artifact here. | build-leaks.js:40:14:40:60 | url.par ... assword | an access to current_password |
+| build-leaks.js:4:39:6:1 | { // NO ... .env)\\n} | build-leaks.js:5:35:5:45 | process.env | build-leaks.js:4:39:6:1 | { // NO ... .env)\\n} | Sensitive data returned by $@ flows to this location and is stored in a build artifact. | build-leaks.js:5:35:5:45 | process.env | process environment |
+| build-leaks.js:34:26:34:57 | getEnv( ... ngified | build-leaks.js:15:24:15:34 | process.env | build-leaks.js:34:26:34:57 | getEnv( ... ngified | Sensitive data returned by $@ flows to this location and is stored in a build artifact. | build-leaks.js:15:24:15:34 | process.env | process environment |
+| build-leaks.js:41:43:41:86 | { "proc ... y(pw) } | build-leaks.js:40:14:40:60 | url.par ... assword | build-leaks.js:41:43:41:86 | { "proc ... y(pw) } | Sensitive data returned by $@ flows to this location and is stored in a build artifact. | build-leaks.js:40:14:40:60 | url.par ... assword | an access to current_password |
diff --git a/javascript/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected b/javascript/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected
index 6fc52f66868..00f897a2756 100644
--- a/javascript/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected
@@ -288,42 +288,42 @@ edges
 | passwords_in_server_5.js:7:12:7:12 | x | passwords_in_server_5.js:8:17:8:17 | x |
 | passwords_in_server_5.js:7:12:7:12 | x | passwords_in_server_5.js:8:17:8:17 | x |
 #select
-| passwords.js:2:17:2:24 | password | passwords.js:2:17:2:24 | password | passwords.js:2:17:2:24 | password | Sensitive data returned by $@ is logged here. | passwords.js:2:17:2:24 | password | an access to password |
-| passwords.js:3:17:3:26 | o.password | passwords.js:3:17:3:26 | o.password | passwords.js:3:17:3:26 | o.password | Sensitive data returned by $@ is logged here. | passwords.js:3:17:3:26 | o.password | an access to password |
-| passwords.js:4:17:4:29 | getPassword() | passwords.js:4:17:4:29 | getPassword() | passwords.js:4:17:4:29 | getPassword() | Sensitive data returned by $@ is logged here. | passwords.js:4:17:4:29 | getPassword() | a call to getPassword |
-| passwords.js:5:17:5:31 | o.getPassword() | passwords.js:5:17:5:31 | o.getPassword() | passwords.js:5:17:5:31 | o.getPassword() | Sensitive data returned by $@ is logged here. | passwords.js:5:17:5:31 | o.getPassword() | a call to getPassword |
-| passwords.js:8:21:8:21 | x | passwords.js:10:11:10:18 | password | passwords.js:8:21:8:21 | x | Sensitive data returned by $@ is logged here. | passwords.js:10:11:10:18 | password | an access to password |
-| passwords.js:12:18:12:25 | password | passwords.js:12:18:12:25 | password | passwords.js:12:18:12:25 | password | Sensitive data returned by $@ is logged here. | passwords.js:12:18:12:25 | password | an access to password |
-| passwords.js:14:17:14:38 | name +  ... assword | passwords.js:14:31:14:38 | password | passwords.js:14:17:14:38 | name +  ... assword | Sensitive data returned by $@ is logged here. | passwords.js:14:31:14:38 | password | an access to password |
-| passwords.js:16:17:16:38 | `${name ... sword}` | passwords.js:16:29:16:36 | password | passwords.js:16:17:16:38 | `${name ... sword}` | Sensitive data returned by $@ is logged here. | passwords.js:16:29:16:36 | password | an access to password |
-| passwords.js:21:17:21:20 | obj1 | passwords.js:18:16:20:5 | {\\n      ... x\\n    } | passwords.js:21:17:21:20 | obj1 | Sensitive data returned by $@ is logged here. | passwords.js:18:16:20:5 | {\\n      ... x\\n    } | an access to password |
-| passwords.js:26:17:26:20 | obj2 | passwords.js:24:12:24:19 | password | passwords.js:26:17:26:20 | obj2 | Sensitive data returned by $@ is logged here. | passwords.js:24:12:24:19 | password | an access to password |
-| passwords.js:29:17:29:20 | obj3 | passwords.js:30:14:30:21 | password | passwords.js:29:17:29:20 | obj3 | Sensitive data returned by $@ is logged here. | passwords.js:30:14:30:21 | password | an access to password |
-| passwords.js:78:17:78:38 | temp.en ... assword | passwords.js:77:37:77:53 | req.body.password | passwords.js:78:17:78:38 | temp.en ... assword | Sensitive data returned by $@ is logged here. | passwords.js:77:37:77:53 | req.body.password | an access to password |
-| passwords.js:81:17:81:31 | `pw: ${secret}` | passwords.js:80:18:80:25 | password | passwords.js:81:17:81:31 | `pw: ${secret}` | Sensitive data returned by $@ is logged here. | passwords.js:80:18:80:25 | password | an access to password |
-| passwords.js:93:21:93:46 | "Passwo ... assword | passwords.js:93:39:93:46 | password | passwords.js:93:21:93:46 | "Passwo ... assword | Sensitive data returned by $@ is logged here. | passwords.js:93:39:93:46 | password | an access to password |
-| passwords.js:98:21:98:46 | "Passwo ... assword | passwords.js:98:39:98:46 | password | passwords.js:98:21:98:46 | "Passwo ... assword | Sensitive data returned by $@ is logged here. | passwords.js:98:39:98:46 | password | an access to password |
-| passwords.js:105:21:105:46 | "Passwo ... assword | passwords.js:105:39:105:46 | password | passwords.js:105:21:105:46 | "Passwo ... assword | Sensitive data returned by $@ is logged here. | passwords.js:105:39:105:46 | password | an access to password |
-| passwords.js:110:21:110:46 | "Passwo ... assword | passwords.js:110:39:110:46 | password | passwords.js:110:21:110:46 | "Passwo ... assword | Sensitive data returned by $@ is logged here. | passwords.js:110:39:110:46 | password | an access to password |
-| passwords.js:114:25:114:50 | "Passwo ... assword | passwords.js:114:43:114:50 | password | passwords.js:114:25:114:50 | "Passwo ... assword | Sensitive data returned by $@ is logged here. | passwords.js:114:43:114:50 | password | an access to password |
-| passwords.js:119:21:119:46 | "Passwo ... assword | passwords.js:119:39:119:46 | password | passwords.js:119:21:119:46 | "Passwo ... assword | Sensitive data returned by $@ is logged here. | passwords.js:119:39:119:46 | password | an access to password |
-| passwords.js:122:17:122:49 | name +  ... tring() | passwords.js:122:31:122:38 | password | passwords.js:122:17:122:49 | name +  ... tring() | Sensitive data returned by $@ is logged here. | passwords.js:122:31:122:38 | password | an access to password |
-| passwords.js:123:17:123:48 | name +  ... lueOf() | passwords.js:123:31:123:38 | password | passwords.js:123:17:123:48 | name +  ... lueOf() | Sensitive data returned by $@ is logged here. | passwords.js:123:31:123:38 | password | an access to password |
-| passwords.js:135:17:135:22 | config | passwords.js:127:18:132:5 | {\\n      ... )\\n    } | passwords.js:135:17:135:22 | config | Sensitive data returned by $@ is logged here. | passwords.js:127:18:132:5 | {\\n      ... )\\n    } | an access to password |
-| passwords.js:135:17:135:22 | config | passwords.js:130:12:130:19 | password | passwords.js:135:17:135:22 | config | Sensitive data returned by $@ is logged here. | passwords.js:130:12:130:19 | password | an access to password |
-| passwords.js:135:17:135:22 | config | passwords.js:131:12:131:24 | getPassword() | passwords.js:135:17:135:22 | config | Sensitive data returned by $@ is logged here. | passwords.js:131:12:131:24 | getPassword() | a call to getPassword |
-| passwords.js:136:17:136:24 | config.x | passwords.js:130:12:130:19 | password | passwords.js:136:17:136:24 | config.x | Sensitive data returned by $@ is logged here. | passwords.js:130:12:130:19 | password | an access to password |
-| passwords.js:137:17:137:24 | config.y | passwords.js:131:12:131:24 | getPassword() | passwords.js:137:17:137:24 | config.y | Sensitive data returned by $@ is logged here. | passwords.js:131:12:131:24 | getPassword() | a call to getPassword |
-| passwords.js:142:26:142:34 | arguments | passwords.js:147:12:147:19 | password | passwords.js:142:26:142:34 | arguments | Sensitive data returned by $@ is logged here. | passwords.js:147:12:147:19 | password | an access to password |
-| passwords.js:142:26:142:34 | arguments | passwords.js:150:21:150:31 | process.env | passwords.js:142:26:142:34 | arguments | Sensitive data returned by $@ is logged here. | passwords.js:150:21:150:31 | process.env | process environment |
-| passwords.js:142:26:142:34 | arguments | passwords.js:152:33:152:43 | process.env | passwords.js:142:26:142:34 | arguments | Sensitive data returned by $@ is logged here. | passwords.js:152:33:152:43 | process.env | process environment |
-| passwords.js:156:17:156:27 | process.env | passwords.js:156:17:156:27 | process.env | passwords.js:156:17:156:27 | process.env | Sensitive data returned by $@ is logged here. | passwords.js:156:17:156:27 | process.env | process environment |
-| passwords.js:163:14:163:41 | passwor ... g, "*") | passwords.js:163:14:163:21 | password | passwords.js:163:14:163:41 | passwor ... g, "*") | Sensitive data returned by $@ is logged here. | passwords.js:163:14:163:21 | password | an access to password |
-| passwords.js:164:14:164:42 | passwor ... g, "*") | passwords.js:164:14:164:21 | password | passwords.js:164:14:164:42 | passwor ... g, "*") | Sensitive data returned by $@ is logged here. | passwords.js:164:14:164:21 | password | an access to password |
-| passwords.js:169:17:169:45 | passwor ... g, "*") | passwords.js:169:17:169:24 | password | passwords.js:169:17:169:45 | passwor ... g, "*") | Sensitive data returned by $@ is logged here. | passwords.js:169:17:169:24 | password | an access to password |
-| passwords.js:170:11:170:39 | passwor ... g, "*") | passwords.js:170:11:170:18 | password | passwords.js:170:11:170:39 | passwor ... g, "*") | Sensitive data returned by $@ is logged here. | passwords.js:170:11:170:18 | password | an access to password |
-| passwords_in_server_1.js:6:13:6:20 | password | passwords_in_server_1.js:6:13:6:20 | password | passwords_in_server_1.js:6:13:6:20 | password | Sensitive data returned by $@ is logged here. | passwords_in_server_1.js:6:13:6:20 | password | an access to password |
-| passwords_in_server_2.js:3:13:3:20 | password | passwords_in_server_2.js:3:13:3:20 | password | passwords_in_server_2.js:3:13:3:20 | password | Sensitive data returned by $@ is logged here. | passwords_in_server_2.js:3:13:3:20 | password | an access to password |
-| passwords_in_server_3.js:2:13:2:20 | password | passwords_in_server_3.js:2:13:2:20 | password | passwords_in_server_3.js:2:13:2:20 | password | Sensitive data returned by $@ is logged here. | passwords_in_server_3.js:2:13:2:20 | password | an access to password |
-| passwords_in_server_4.js:2:13:2:20 | password | passwords_in_server_4.js:2:13:2:20 | password | passwords_in_server_4.js:2:13:2:20 | password | Sensitive data returned by $@ is logged here. | passwords_in_server_4.js:2:13:2:20 | password | an access to password |
-| passwords_in_server_5.js:8:17:8:17 | x | passwords_in_server_5.js:4:7:4:24 | req.query.password | passwords_in_server_5.js:8:17:8:17 | x | Sensitive data returned by $@ is logged here. | passwords_in_server_5.js:4:7:4:24 | req.query.password | an access to password |
+| passwords.js:2:17:2:24 | password | passwords.js:2:17:2:24 | password | passwords.js:2:17:2:24 | password | $@ is logged here. | passwords.js:2:17:2:24 | password | Sensitive data returned by an access to password |
+| passwords.js:3:17:3:26 | o.password | passwords.js:3:17:3:26 | o.password | passwords.js:3:17:3:26 | o.password | $@ is logged here. | passwords.js:3:17:3:26 | o.password | Sensitive data returned by an access to password |
+| passwords.js:4:17:4:29 | getPassword() | passwords.js:4:17:4:29 | getPassword() | passwords.js:4:17:4:29 | getPassword() | $@ is logged here. | passwords.js:4:17:4:29 | getPassword() | Sensitive data returned by a call to getPassword |
+| passwords.js:5:17:5:31 | o.getPassword() | passwords.js:5:17:5:31 | o.getPassword() | passwords.js:5:17:5:31 | o.getPassword() | $@ is logged here. | passwords.js:5:17:5:31 | o.getPassword() | Sensitive data returned by a call to getPassword |
+| passwords.js:8:21:8:21 | x | passwords.js:10:11:10:18 | password | passwords.js:8:21:8:21 | x | $@ is logged here. | passwords.js:10:11:10:18 | password | Sensitive data returned by an access to password |
+| passwords.js:12:18:12:25 | password | passwords.js:12:18:12:25 | password | passwords.js:12:18:12:25 | password | $@ is logged here. | passwords.js:12:18:12:25 | password | Sensitive data returned by an access to password |
+| passwords.js:14:17:14:38 | name +  ... assword | passwords.js:14:31:14:38 | password | passwords.js:14:17:14:38 | name +  ... assword | $@ is logged here. | passwords.js:14:31:14:38 | password | Sensitive data returned by an access to password |
+| passwords.js:16:17:16:38 | `${name ... sword}` | passwords.js:16:29:16:36 | password | passwords.js:16:17:16:38 | `${name ... sword}` | $@ is logged here. | passwords.js:16:29:16:36 | password | Sensitive data returned by an access to password |
+| passwords.js:21:17:21:20 | obj1 | passwords.js:18:16:20:5 | {\\n      ... x\\n    } | passwords.js:21:17:21:20 | obj1 | $@ is logged here. | passwords.js:18:16:20:5 | {\\n      ... x\\n    } | Sensitive data returned by an access to password |
+| passwords.js:26:17:26:20 | obj2 | passwords.js:24:12:24:19 | password | passwords.js:26:17:26:20 | obj2 | $@ is logged here. | passwords.js:24:12:24:19 | password | Sensitive data returned by an access to password |
+| passwords.js:29:17:29:20 | obj3 | passwords.js:30:14:30:21 | password | passwords.js:29:17:29:20 | obj3 | $@ is logged here. | passwords.js:30:14:30:21 | password | Sensitive data returned by an access to password |
+| passwords.js:78:17:78:38 | temp.en ... assword | passwords.js:77:37:77:53 | req.body.password | passwords.js:78:17:78:38 | temp.en ... assword | $@ is logged here. | passwords.js:77:37:77:53 | req.body.password | Sensitive data returned by an access to password |
+| passwords.js:81:17:81:31 | `pw: ${secret}` | passwords.js:80:18:80:25 | password | passwords.js:81:17:81:31 | `pw: ${secret}` | $@ is logged here. | passwords.js:80:18:80:25 | password | Sensitive data returned by an access to password |
+| passwords.js:93:21:93:46 | "Passwo ... assword | passwords.js:93:39:93:46 | password | passwords.js:93:21:93:46 | "Passwo ... assword | $@ is logged here. | passwords.js:93:39:93:46 | password | Sensitive data returned by an access to password |
+| passwords.js:98:21:98:46 | "Passwo ... assword | passwords.js:98:39:98:46 | password | passwords.js:98:21:98:46 | "Passwo ... assword | $@ is logged here. | passwords.js:98:39:98:46 | password | Sensitive data returned by an access to password |
+| passwords.js:105:21:105:46 | "Passwo ... assword | passwords.js:105:39:105:46 | password | passwords.js:105:21:105:46 | "Passwo ... assword | $@ is logged here. | passwords.js:105:39:105:46 | password | Sensitive data returned by an access to password |
+| passwords.js:110:21:110:46 | "Passwo ... assword | passwords.js:110:39:110:46 | password | passwords.js:110:21:110:46 | "Passwo ... assword | $@ is logged here. | passwords.js:110:39:110:46 | password | Sensitive data returned by an access to password |
+| passwords.js:114:25:114:50 | "Passwo ... assword | passwords.js:114:43:114:50 | password | passwords.js:114:25:114:50 | "Passwo ... assword | $@ is logged here. | passwords.js:114:43:114:50 | password | Sensitive data returned by an access to password |
+| passwords.js:119:21:119:46 | "Passwo ... assword | passwords.js:119:39:119:46 | password | passwords.js:119:21:119:46 | "Passwo ... assword | $@ is logged here. | passwords.js:119:39:119:46 | password | Sensitive data returned by an access to password |
+| passwords.js:122:17:122:49 | name +  ... tring() | passwords.js:122:31:122:38 | password | passwords.js:122:17:122:49 | name +  ... tring() | $@ is logged here. | passwords.js:122:31:122:38 | password | Sensitive data returned by an access to password |
+| passwords.js:123:17:123:48 | name +  ... lueOf() | passwords.js:123:31:123:38 | password | passwords.js:123:17:123:48 | name +  ... lueOf() | $@ is logged here. | passwords.js:123:31:123:38 | password | Sensitive data returned by an access to password |
+| passwords.js:135:17:135:22 | config | passwords.js:127:18:132:5 | {\\n      ... )\\n    } | passwords.js:135:17:135:22 | config | $@ is logged here. | passwords.js:127:18:132:5 | {\\n      ... )\\n    } | Sensitive data returned by an access to password |
+| passwords.js:135:17:135:22 | config | passwords.js:130:12:130:19 | password | passwords.js:135:17:135:22 | config | $@ is logged here. | passwords.js:130:12:130:19 | password | Sensitive data returned by an access to password |
+| passwords.js:135:17:135:22 | config | passwords.js:131:12:131:24 | getPassword() | passwords.js:135:17:135:22 | config | $@ is logged here. | passwords.js:131:12:131:24 | getPassword() | Sensitive data returned by a call to getPassword |
+| passwords.js:136:17:136:24 | config.x | passwords.js:130:12:130:19 | password | passwords.js:136:17:136:24 | config.x | $@ is logged here. | passwords.js:130:12:130:19 | password | Sensitive data returned by an access to password |
+| passwords.js:137:17:137:24 | config.y | passwords.js:131:12:131:24 | getPassword() | passwords.js:137:17:137:24 | config.y | $@ is logged here. | passwords.js:131:12:131:24 | getPassword() | Sensitive data returned by a call to getPassword |
+| passwords.js:142:26:142:34 | arguments | passwords.js:147:12:147:19 | password | passwords.js:142:26:142:34 | arguments | $@ is logged here. | passwords.js:147:12:147:19 | password | Sensitive data returned by an access to password |
+| passwords.js:142:26:142:34 | arguments | passwords.js:150:21:150:31 | process.env | passwords.js:142:26:142:34 | arguments | $@ is logged here. | passwords.js:150:21:150:31 | process.env | Sensitive data returned by process environment |
+| passwords.js:142:26:142:34 | arguments | passwords.js:152:33:152:43 | process.env | passwords.js:142:26:142:34 | arguments | $@ is logged here. | passwords.js:152:33:152:43 | process.env | Sensitive data returned by process environment |
+| passwords.js:156:17:156:27 | process.env | passwords.js:156:17:156:27 | process.env | passwords.js:156:17:156:27 | process.env | $@ is logged here. | passwords.js:156:17:156:27 | process.env | Sensitive data returned by process environment |
+| passwords.js:163:14:163:41 | passwor ... g, "*") | passwords.js:163:14:163:21 | password | passwords.js:163:14:163:41 | passwor ... g, "*") | $@ is logged here. | passwords.js:163:14:163:21 | password | Sensitive data returned by an access to password |
+| passwords.js:164:14:164:42 | passwor ... g, "*") | passwords.js:164:14:164:21 | password | passwords.js:164:14:164:42 | passwor ... g, "*") | $@ is logged here. | passwords.js:164:14:164:21 | password | Sensitive data returned by an access to password |
+| passwords.js:169:17:169:45 | passwor ... g, "*") | passwords.js:169:17:169:24 | password | passwords.js:169:17:169:45 | passwor ... g, "*") | $@ is logged here. | passwords.js:169:17:169:24 | password | Sensitive data returned by an access to password |
+| passwords.js:170:11:170:39 | passwor ... g, "*") | passwords.js:170:11:170:18 | password | passwords.js:170:11:170:39 | passwor ... g, "*") | $@ is logged here. | passwords.js:170:11:170:18 | password | Sensitive data returned by an access to password |
+| passwords_in_server_1.js:6:13:6:20 | password | passwords_in_server_1.js:6:13:6:20 | password | passwords_in_server_1.js:6:13:6:20 | password | $@ is logged here. | passwords_in_server_1.js:6:13:6:20 | password | Sensitive data returned by an access to password |
+| passwords_in_server_2.js:3:13:3:20 | password | passwords_in_server_2.js:3:13:3:20 | password | passwords_in_server_2.js:3:13:3:20 | password | $@ is logged here. | passwords_in_server_2.js:3:13:3:20 | password | Sensitive data returned by an access to password |
+| passwords_in_server_3.js:2:13:2:20 | password | passwords_in_server_3.js:2:13:2:20 | password | passwords_in_server_3.js:2:13:2:20 | password | $@ is logged here. | passwords_in_server_3.js:2:13:2:20 | password | Sensitive data returned by an access to password |
+| passwords_in_server_4.js:2:13:2:20 | password | passwords_in_server_4.js:2:13:2:20 | password | passwords_in_server_4.js:2:13:2:20 | password | $@ is logged here. | passwords_in_server_4.js:2:13:2:20 | password | Sensitive data returned by an access to password |
+| passwords_in_server_5.js:8:17:8:17 | x | passwords_in_server_5.js:4:7:4:24 | req.query.password | passwords_in_server_5.js:8:17:8:17 | x | $@ is logged here. | passwords_in_server_5.js:4:7:4:24 | req.query.password | Sensitive data returned by an access to password |
diff --git a/javascript/ql/test/query-tests/Security/CWE-312/CleartextStorage.expected b/javascript/ql/test/query-tests/Security/CWE-312/CleartextStorage.expected
index 096bcfe6528..dcd11c291c5 100644
--- a/javascript/ql/test/query-tests/Security/CWE-312/CleartextStorage.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-312/CleartextStorage.expected
@@ -53,13 +53,13 @@ edges
 | tst-webstorage.js:3:20:3:32 | data.password | tst-webstorage.js:3:20:3:32 | data.password |
 | tst-webstorage.js:4:29:4:41 | data.password | tst-webstorage.js:4:29:4:41 | data.password |
 #select
-| CleartextStorage2.js:7:19:7:34 | 'password=' + pw | CleartextStorage2.js:5:12:5:58 | url.par ... assword | CleartextStorage2.js:7:19:7:34 | 'password=' + pw | Sensitive data returned by $@ is stored here. | CleartextStorage2.js:5:12:5:58 | url.par ... assword | an access to current_password |
-| CleartextStorage.js:7:26:7:27 | pw | CleartextStorage.js:5:12:5:40 | req.par ... sword") | CleartextStorage.js:7:26:7:27 | pw | Sensitive data returned by $@ is stored here. | CleartextStorage.js:5:12:5:40 | req.par ... sword") | a call to param |
-| tst-angularjs.js:3:32:3:45 | data1.password | tst-angularjs.js:3:32:3:45 | data1.password | tst-angularjs.js:3:32:3:45 | data1.password | Sensitive data returned by $@ is stored here. | tst-angularjs.js:3:32:3:45 | data1.password | an access to password |
-| tst-angularjs.js:4:33:4:46 | data2.password | tst-angularjs.js:4:33:4:46 | data2.password | tst-angularjs.js:4:33:4:46 | data2.password | Sensitive data returned by $@ is stored here. | tst-angularjs.js:4:33:4:46 | data2.password | an access to password |
-| tst-angularjs.js:5:27:5:40 | data3.password | tst-angularjs.js:5:27:5:40 | data3.password | tst-angularjs.js:5:27:5:40 | data3.password | Sensitive data returned by $@ is stored here. | tst-angularjs.js:5:27:5:40 | data3.password | an access to password |
-| tst-angularjs.js:6:33:6:46 | data4.password | tst-angularjs.js:6:33:6:46 | data4.password | tst-angularjs.js:6:33:6:46 | data4.password | Sensitive data returned by $@ is stored here. | tst-angularjs.js:6:33:6:46 | data4.password | an access to password |
-| tst-webstorage.js:1:18:1:30 | data.password | tst-webstorage.js:1:18:1:30 | data.password | tst-webstorage.js:1:18:1:30 | data.password | Sensitive data returned by $@ is stored here. | tst-webstorage.js:1:18:1:30 | data.password | an access to password |
-| tst-webstorage.js:2:27:2:39 | data.password | tst-webstorage.js:2:27:2:39 | data.password | tst-webstorage.js:2:27:2:39 | data.password | Sensitive data returned by $@ is stored here. | tst-webstorage.js:2:27:2:39 | data.password | an access to password |
-| tst-webstorage.js:3:20:3:32 | data.password | tst-webstorage.js:3:20:3:32 | data.password | tst-webstorage.js:3:20:3:32 | data.password | Sensitive data returned by $@ is stored here. | tst-webstorage.js:3:20:3:32 | data.password | an access to password |
-| tst-webstorage.js:4:29:4:41 | data.password | tst-webstorage.js:4:29:4:41 | data.password | tst-webstorage.js:4:29:4:41 | data.password | Sensitive data returned by $@ is stored here. | tst-webstorage.js:4:29:4:41 | data.password | an access to password |
+| CleartextStorage2.js:7:19:7:34 | 'password=' + pw | CleartextStorage2.js:5:12:5:58 | url.par ... assword | CleartextStorage2.js:7:19:7:34 | 'password=' + pw | $@ is stored here. | CleartextStorage2.js:5:12:5:58 | url.par ... assword | Sensitive data returned by an access to current_password |
+| CleartextStorage.js:7:26:7:27 | pw | CleartextStorage.js:5:12:5:40 | req.par ... sword") | CleartextStorage.js:7:26:7:27 | pw | $@ is stored here. | CleartextStorage.js:5:12:5:40 | req.par ... sword") | Sensitive data returned by a call to param |
+| tst-angularjs.js:3:32:3:45 | data1.password | tst-angularjs.js:3:32:3:45 | data1.password | tst-angularjs.js:3:32:3:45 | data1.password | $@ is stored here. | tst-angularjs.js:3:32:3:45 | data1.password | Sensitive data returned by an access to password |
+| tst-angularjs.js:4:33:4:46 | data2.password | tst-angularjs.js:4:33:4:46 | data2.password | tst-angularjs.js:4:33:4:46 | data2.password | $@ is stored here. | tst-angularjs.js:4:33:4:46 | data2.password | Sensitive data returned by an access to password |
+| tst-angularjs.js:5:27:5:40 | data3.password | tst-angularjs.js:5:27:5:40 | data3.password | tst-angularjs.js:5:27:5:40 | data3.password | $@ is stored here. | tst-angularjs.js:5:27:5:40 | data3.password | Sensitive data returned by an access to password |
+| tst-angularjs.js:6:33:6:46 | data4.password | tst-angularjs.js:6:33:6:46 | data4.password | tst-angularjs.js:6:33:6:46 | data4.password | $@ is stored here. | tst-angularjs.js:6:33:6:46 | data4.password | Sensitive data returned by an access to password |
+| tst-webstorage.js:1:18:1:30 | data.password | tst-webstorage.js:1:18:1:30 | data.password | tst-webstorage.js:1:18:1:30 | data.password | $@ is stored here. | tst-webstorage.js:1:18:1:30 | data.password | Sensitive data returned by an access to password |
+| tst-webstorage.js:2:27:2:39 | data.password | tst-webstorage.js:2:27:2:39 | data.password | tst-webstorage.js:2:27:2:39 | data.password | $@ is stored here. | tst-webstorage.js:2:27:2:39 | data.password | Sensitive data returned by an access to password |
+| tst-webstorage.js:3:20:3:32 | data.password | tst-webstorage.js:3:20:3:32 | data.password | tst-webstorage.js:3:20:3:32 | data.password | $@ is stored here. | tst-webstorage.js:3:20:3:32 | data.password | Sensitive data returned by an access to password |
+| tst-webstorage.js:4:29:4:41 | data.password | tst-webstorage.js:4:29:4:41 | data.password | tst-webstorage.js:4:29:4:41 | data.password | $@ is stored here. | tst-webstorage.js:4:29:4:41 | data.password | Sensitive data returned by an access to password |
diff --git a/javascript/ql/test/query-tests/Security/CWE-327/BrokenCryptoAlgorithm.expected b/javascript/ql/test/query-tests/Security/CWE-327/BrokenCryptoAlgorithm.expected
index 491d6a3aa00..f72598a1561 100644
--- a/javascript/ql/test/query-tests/Security/CWE-327/BrokenCryptoAlgorithm.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-327/BrokenCryptoAlgorithm.expected
@@ -20,6 +20,6 @@ edges
 | tst.js:17:17:17:25 | o.trusted | tst.js:17:17:17:25 | o.trusted |
 | tst.js:19:17:19:24 | password | tst.js:19:17:19:24 | password |
 #select
-| tst.js:11:17:11:26 | secretText | tst.js:3:18:3:24 | trusted | tst.js:11:17:11:26 | secretText | Sensitive data from $@ is used in a broken or weak cryptographic algorithm. | tst.js:3:18:3:24 | trusted | an access to trusted |
-| tst.js:11:17:11:26 | secretText | tst.js:11:17:11:26 | secretText | tst.js:11:17:11:26 | secretText | Sensitive data from $@ is used in a broken or weak cryptographic algorithm. | tst.js:11:17:11:26 | secretText | an access to secretText |
-| tst.js:17:17:17:25 | o.trusted | tst.js:17:17:17:25 | o.trusted | tst.js:17:17:17:25 | o.trusted | Sensitive data from $@ is used in a broken or weak cryptographic algorithm. | tst.js:17:17:17:25 | o.trusted | an access to trusted |
+| tst.js:11:17:11:26 | secretText | tst.js:3:18:3:24 | trusted | tst.js:11:17:11:26 | secretText | A broken or weak cryptographic algorithm depends on $@. | tst.js:3:18:3:24 | trusted | sensitive data froman access to trusted |
+| tst.js:11:17:11:26 | secretText | tst.js:11:17:11:26 | secretText | tst.js:11:17:11:26 | secretText | A broken or weak cryptographic algorithm depends on $@. | tst.js:11:17:11:26 | secretText | sensitive data froman access to secretText |
+| tst.js:17:17:17:25 | o.trusted | tst.js:17:17:17:25 | o.trusted | tst.js:17:17:17:25 | o.trusted | A broken or weak cryptographic algorithm depends on $@. | tst.js:17:17:17:25 | o.trusted | sensitive data froman access to trusted |
diff --git a/javascript/ql/test/query-tests/Security/CWE-338/InsecureRandomness.expected b/javascript/ql/test/query-tests/Security/CWE-338/InsecureRandomness.expected
index 42da210c266..a453cbb5759 100644
--- a/javascript/ql/test/query-tests/Security/CWE-338/InsecureRandomness.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-338/InsecureRandomness.expected
@@ -92,6 +92,13 @@ nodes
 | tst.js:121:18:121:30 | Math.random() |
 | tst.js:121:18:121:30 | Math.random() |
 | tst.js:121:18:121:30 | Math.random() |
+| tst.js:136:9:136:67 | password |
+| tst.js:136:9:136:67 | password |
+| tst.js:136:21:136:67 | chars[M ... ength)] |
+| tst.js:136:27:136:66 | Math.fl ... length) |
+| tst.js:136:38:136:50 | Math.random() |
+| tst.js:136:38:136:50 | Math.random() |
+| tst.js:136:38:136:65 | Math.ra ... .length |
 edges
 | tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() |
 | tst.js:6:31:6:43 | Math.random() | tst.js:6:20:6:43 | "prefix ... andom() |
@@ -158,26 +165,33 @@ edges
 | tst.js:118:34:118:62 | Math.ra ... 000_000 | tst.js:118:23:118:63 | Math.fl ... 00_000) |
 | tst.js:120:16:120:28 | Math.random() | tst.js:120:16:120:28 | Math.random() |
 | tst.js:121:18:121:30 | Math.random() | tst.js:121:18:121:30 | Math.random() |
+| tst.js:136:21:136:67 | chars[M ... ength)] | tst.js:136:9:136:67 | password |
+| tst.js:136:21:136:67 | chars[M ... ength)] | tst.js:136:9:136:67 | password |
+| tst.js:136:27:136:66 | Math.fl ... length) | tst.js:136:21:136:67 | chars[M ... ength)] |
+| tst.js:136:38:136:50 | Math.random() | tst.js:136:38:136:65 | Math.ra ... .length |
+| tst.js:136:38:136:50 | Math.random() | tst.js:136:38:136:65 | Math.ra ... .length |
+| tst.js:136:38:136:65 | Math.ra ... .length | tst.js:136:27:136:66 | Math.fl ... length) |
 #select
-| tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:2:20:2:32 | Math.random() | random value |
-| tst.js:6:20:6:43 | "prefix ... andom() | tst.js:6:31:6:43 | Math.random() | tst.js:6:20:6:43 | "prefix ... andom() | Cryptographically insecure $@ in a security context. | tst.js:6:31:6:43 | Math.random() | random value |
-| tst.js:10:20:10:32 | Math.random() | tst.js:10:20:10:32 | Math.random() | tst.js:10:20:10:32 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:10:20:10:32 | Math.random() | random value |
-| tst.js:20:20:20:36 | "prefix" + suffix | tst.js:19:18:19:30 | Math.random() | tst.js:20:20:20:36 | "prefix" + suffix | Cryptographically insecure $@ in a security context. | tst.js:19:18:19:30 | Math.random() | random value |
-| tst.js:29:20:29:21 | pw | tst.js:28:14:28:26 | Math.random() | tst.js:29:20:29:21 | pw | Cryptographically insecure $@ in a security context. | tst.js:28:14:28:26 | Math.random() | random value |
-| tst.js:41:20:41:33 | !Math.random() | tst.js:41:21:41:33 | Math.random() | tst.js:41:20:41:33 | !Math.random() | Cryptographically insecure $@ in a security context. | tst.js:41:21:41:33 | Math.random() | random value |
-| tst.js:45:18:45:30 | Math.random() | tst.js:45:18:45:30 | Math.random() | tst.js:45:18:45:30 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:45:18:45:30 | Math.random() | random value |
-| tst.js:50:16:50:28 | Math.random() | tst.js:50:16:50:28 | Math.random() | tst.js:50:16:50:28 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:50:16:50:28 | Math.random() | random value |
-| tst.js:55:17:55:29 | Math.random() | tst.js:55:17:55:29 | Math.random() | tst.js:55:17:55:29 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:55:17:55:29 | Math.random() | random value |
-| tst.js:61:17:61:34 | '' + Math.random() | tst.js:61:22:61:34 | Math.random() | tst.js:61:17:61:34 | '' + Math.random() | Cryptographically insecure $@ in a security context. | tst.js:61:22:61:34 | Math.random() | random value |
-| tst.js:66:18:66:42 | Math.fl ... ndom()) | tst.js:66:29:66:41 | Math.random() | tst.js:66:18:66:42 | Math.fl ... ndom()) | Cryptographically insecure $@ in a security context. | tst.js:66:29:66:41 | Math.random() | random value |
-| tst.js:73:23:73:28 | concat | tst.js:71:27:71:39 | Math.random() | tst.js:73:23:73:28 | concat | Cryptographically insecure $@ in a security context. | tst.js:71:27:71:39 | Math.random() | random value |
-| tst.js:77:16:77:21 | secret | tst.js:80:7:80:19 | Math.random() | tst.js:77:16:77:21 | secret | Cryptographically insecure $@ in a security context. | tst.js:80:7:80:19 | Math.random() | random value |
-| tst.js:84:19:84:31 | Math.random() | tst.js:84:19:84:31 | Math.random() | tst.js:84:19:84:31 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:84:19:84:31 | Math.random() | random value |
-| tst.js:90:32:90:44 | Math.random() | tst.js:90:32:90:44 | Math.random() | tst.js:90:32:90:44 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:90:32:90:44 | Math.random() | random value |
-| tst.js:95:33:95:45 | Math.random() | tst.js:95:33:95:45 | Math.random() | tst.js:95:33:95:45 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:95:33:95:45 | Math.random() | random value |
-| tst.js:115:16:115:56 | Math.fl ... 00_000) | tst.js:115:27:115:39 | Math.random() | tst.js:115:16:115:56 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:115:27:115:39 | Math.random() | random value |
-| tst.js:116:22:116:62 | Math.fl ... 00_000) | tst.js:116:33:116:45 | Math.random() | tst.js:116:22:116:62 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:116:33:116:45 | Math.random() | random value |
-| tst.js:117:15:117:55 | Math.fl ... 00_000) | tst.js:117:26:117:38 | Math.random() | tst.js:117:15:117:55 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:117:26:117:38 | Math.random() | random value |
-| tst.js:118:23:118:63 | Math.fl ... 00_000) | tst.js:118:34:118:46 | Math.random() | tst.js:118:23:118:63 | Math.fl ... 00_000) | Cryptographically insecure $@ in a security context. | tst.js:118:34:118:46 | Math.random() | random value |
-| tst.js:120:16:120:28 | Math.random() | tst.js:120:16:120:28 | Math.random() | tst.js:120:16:120:28 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:120:16:120:28 | Math.random() | random value |
-| tst.js:121:18:121:30 | Math.random() | tst.js:121:18:121:30 | Math.random() | tst.js:121:18:121:30 | Math.random() | Cryptographically insecure $@ in a security context. | tst.js:121:18:121:30 | Math.random() | random value |
+| tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() | tst.js:2:20:2:32 | Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:2:20:2:32 | Math.random() | Math.random() |
+| tst.js:6:20:6:43 | "prefix ... andom() | tst.js:6:31:6:43 | Math.random() | tst.js:6:20:6:43 | "prefix ... andom() | This security context depends on a cryptographically insecure random number at $@. | tst.js:6:31:6:43 | Math.random() | Math.random() |
+| tst.js:10:20:10:32 | Math.random() | tst.js:10:20:10:32 | Math.random() | tst.js:10:20:10:32 | Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:10:20:10:32 | Math.random() | Math.random() |
+| tst.js:20:20:20:36 | "prefix" + suffix | tst.js:19:18:19:30 | Math.random() | tst.js:20:20:20:36 | "prefix" + suffix | This security context depends on a cryptographically insecure random number at $@. | tst.js:19:18:19:30 | Math.random() | Math.random() |
+| tst.js:29:20:29:21 | pw | tst.js:28:14:28:26 | Math.random() | tst.js:29:20:29:21 | pw | This security context depends on a cryptographically insecure random number at $@. | tst.js:28:14:28:26 | Math.random() | Math.random() |
+| tst.js:41:20:41:33 | !Math.random() | tst.js:41:21:41:33 | Math.random() | tst.js:41:20:41:33 | !Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:41:21:41:33 | Math.random() | Math.random() |
+| tst.js:45:18:45:30 | Math.random() | tst.js:45:18:45:30 | Math.random() | tst.js:45:18:45:30 | Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:45:18:45:30 | Math.random() | Math.random() |
+| tst.js:50:16:50:28 | Math.random() | tst.js:50:16:50:28 | Math.random() | tst.js:50:16:50:28 | Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:50:16:50:28 | Math.random() | Math.random() |
+| tst.js:55:17:55:29 | Math.random() | tst.js:55:17:55:29 | Math.random() | tst.js:55:17:55:29 | Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:55:17:55:29 | Math.random() | Math.random() |
+| tst.js:61:17:61:34 | '' + Math.random() | tst.js:61:22:61:34 | Math.random() | tst.js:61:17:61:34 | '' + Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:61:22:61:34 | Math.random() | Math.random() |
+| tst.js:66:18:66:42 | Math.fl ... ndom()) | tst.js:66:29:66:41 | Math.random() | tst.js:66:18:66:42 | Math.fl ... ndom()) | This security context depends on a cryptographically insecure random number at $@. | tst.js:66:29:66:41 | Math.random() | Math.random() |
+| tst.js:73:23:73:28 | concat | tst.js:71:27:71:39 | Math.random() | tst.js:73:23:73:28 | concat | This security context depends on a cryptographically insecure random number at $@. | tst.js:71:27:71:39 | Math.random() | Math.random() |
+| tst.js:77:16:77:21 | secret | tst.js:80:7:80:19 | Math.random() | tst.js:77:16:77:21 | secret | This security context depends on a cryptographically insecure random number at $@. | tst.js:80:7:80:19 | Math.random() | Math.random() |
+| tst.js:84:19:84:31 | Math.random() | tst.js:84:19:84:31 | Math.random() | tst.js:84:19:84:31 | Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:84:19:84:31 | Math.random() | Math.random() |
+| tst.js:90:32:90:44 | Math.random() | tst.js:90:32:90:44 | Math.random() | tst.js:90:32:90:44 | Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:90:32:90:44 | Math.random() | Math.random() |
+| tst.js:95:33:95:45 | Math.random() | tst.js:95:33:95:45 | Math.random() | tst.js:95:33:95:45 | Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:95:33:95:45 | Math.random() | Math.random() |
+| tst.js:115:16:115:56 | Math.fl ... 00_000) | tst.js:115:27:115:39 | Math.random() | tst.js:115:16:115:56 | Math.fl ... 00_000) | This security context depends on a cryptographically insecure random number at $@. | tst.js:115:27:115:39 | Math.random() | Math.random() |
+| tst.js:116:22:116:62 | Math.fl ... 00_000) | tst.js:116:33:116:45 | Math.random() | tst.js:116:22:116:62 | Math.fl ... 00_000) | This security context depends on a cryptographically insecure random number at $@. | tst.js:116:33:116:45 | Math.random() | Math.random() |
+| tst.js:117:15:117:55 | Math.fl ... 00_000) | tst.js:117:26:117:38 | Math.random() | tst.js:117:15:117:55 | Math.fl ... 00_000) | This security context depends on a cryptographically insecure random number at $@. | tst.js:117:26:117:38 | Math.random() | Math.random() |
+| tst.js:118:23:118:63 | Math.fl ... 00_000) | tst.js:118:34:118:46 | Math.random() | tst.js:118:23:118:63 | Math.fl ... 00_000) | This security context depends on a cryptographically insecure random number at $@. | tst.js:118:34:118:46 | Math.random() | Math.random() |
+| tst.js:120:16:120:28 | Math.random() | tst.js:120:16:120:28 | Math.random() | tst.js:120:16:120:28 | Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:120:16:120:28 | Math.random() | Math.random() |
+| tst.js:121:18:121:30 | Math.random() | tst.js:121:18:121:30 | Math.random() | tst.js:121:18:121:30 | Math.random() | This security context depends on a cryptographically insecure random number at $@. | tst.js:121:18:121:30 | Math.random() | Math.random() |
+| tst.js:136:9:136:67 | password | tst.js:136:38:136:50 | Math.random() | tst.js:136:9:136:67 | password | This security context depends on a cryptographically insecure random number at $@. | tst.js:136:38:136:50 | Math.random() | Math.random() |
diff --git a/javascript/ql/test/query-tests/Security/CWE-338/tst.js b/javascript/ql/test/query-tests/Security/CWE-338/tst.js
index 77393b8983c..b0f318eb717 100644
--- a/javascript/ql/test/query-tests/Security/CWE-338/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-338/tst.js
@@ -119,4 +119,21 @@ function uid() {
     var liquid = Math.random(); // OK
     var UUID = Math.random(); // NOT OK
     var MY_UID = Math.random(); // NOK OK
+}
+
+function buildPass(opts, length) {
+    const digits = '0123456789'.split('');
+    const letters = 'abcdefghijklmnopqrstuvwxyz'.split('');
+    const specials = '!@#$%^&*()_+{}|:"<>?[];\',./`~'.split('');
+
+    const chars = [];
+    opts.digits && chars.push(...digits);
+    opts.letters && chars.push(...letters);
+    opts.specials && chars.push(...specials);
+
+    const password = "";
+    for (let i = 0; i < length; i++) {
+        password += chars[Math.floor(Math.random() * chars.length)]; // NOT OK
+    }
+    return password;
 }
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-367/tst.js b/javascript/ql/test/query-tests/Security/CWE-367/tst.js
index 9682f2bd8a3..a0dc22eab3c 100644
--- a/javascript/ql/test/query-tests/Security/CWE-367/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-367/tst.js
@@ -36,3 +36,8 @@ fs.access("myfile", (err) => {
     // ....
   });
 });
+
+const filePath3 = createFile();
+if (fs.existsSync(filePath3)) {
+  fs.readFileSync(filePath3); // OK - a read after an existence check is OK 
+}
diff --git a/javascript/ql/test/query-tests/Security/CWE-400/DeepObjectResourceExhaustion/DeepObjectResourceExhaustion.expected b/javascript/ql/test/query-tests/Security/CWE-400/DeepObjectResourceExhaustion/DeepObjectResourceExhaustion.expected
index c93bc1c7111..1b6796f21c4 100644
--- a/javascript/ql/test/query-tests/Security/CWE-400/DeepObjectResourceExhaustion/DeepObjectResourceExhaustion.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-400/DeepObjectResourceExhaustion/DeepObjectResourceExhaustion.expected
@@ -5,4 +5,4 @@ nodes
 edges
 | tst.js:9:29:9:36 | req.body | tst.js:9:29:9:36 | req.body |
 #select
-| tst.js:9:29:9:36 | req.body | tst.js:9:29:9:36 | req.body | tst.js:9:29:9:36 | req.body | Denial of service caused by processing user input from $@ with $@. | tst.js:9:29:9:36 | req.body | here | tst.js:4:21:4:35 | allErrors: true | allErrors: true |
+| tst.js:9:29:9:36 | req.body | tst.js:9:29:9:36 | req.body | tst.js:9:29:9:36 | req.body | Denial of service caused by processing $@ with $@. | tst.js:9:29:9:36 | req.body | user input | tst.js:4:21:4:35 | allErrors: true | allErrors: true |
diff --git a/javascript/ql/test/query-tests/Security/CWE-400/RemovePropertyInjection/RemotePropertyInjection.expected b/javascript/ql/test/query-tests/Security/CWE-400/RemovePropertyInjection/RemotePropertyInjection.expected
index 4eecfb2b0ee..b6b903ec82f 100644
--- a/javascript/ql/test/query-tests/Security/CWE-400/RemovePropertyInjection/RemotePropertyInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-400/RemovePropertyInjection/RemotePropertyInjection.expected
@@ -33,8 +33,8 @@ edges
 | tstNonExpr.js:5:17:5:23 | req.url | tstNonExpr.js:5:7:5:23 | userVal |
 | tstNonExpr.js:5:17:5:23 | req.url | tstNonExpr.js:5:7:5:23 | userVal |
 #select
-| tst.js:9:8:9:11 | prop | tst.js:8:28:8:51 | req.que ... trolled | tst.js:9:8:9:11 | prop | A $@ is used as a property name to write to. | tst.js:8:28:8:51 | req.que ... trolled | user-provided value |
-| tst.js:13:15:13:18 | prop | tst.js:8:28:8:51 | req.que ... trolled | tst.js:13:15:13:18 | prop | A $@ is used as a property name to write to. | tst.js:8:28:8:51 | req.que ... trolled | user-provided value |
-| tst.js:14:31:14:34 | prop | tst.js:8:28:8:51 | req.que ... trolled | tst.js:14:31:14:34 | prop | A $@ is used as a property name to write to. | tst.js:8:28:8:51 | req.que ... trolled | user-provided value |
-| tst.js:16:10:16:13 | prop | tst.js:8:28:8:51 | req.que ... trolled | tst.js:16:10:16:13 | prop | A $@ is used as a property name to write to. | tst.js:8:28:8:51 | req.que ... trolled | user-provided value |
-| tstNonExpr.js:8:17:8:23 | userVal | tstNonExpr.js:5:17:5:23 | req.url | tstNonExpr.js:8:17:8:23 | userVal | A $@ is used as a header name. | tstNonExpr.js:5:17:5:23 | req.url | user-provided value |
+| tst.js:9:8:9:11 | prop | tst.js:8:28:8:51 | req.que ... trolled | tst.js:9:8:9:11 | prop | A property name to write to depends on $@. | tst.js:8:28:8:51 | req.que ... trolled | a user-provided value |
+| tst.js:13:15:13:18 | prop | tst.js:8:28:8:51 | req.que ... trolled | tst.js:13:15:13:18 | prop | A property name to write to depends on $@. | tst.js:8:28:8:51 | req.que ... trolled | a user-provided value |
+| tst.js:14:31:14:34 | prop | tst.js:8:28:8:51 | req.que ... trolled | tst.js:14:31:14:34 | prop | A property name to write to depends on $@. | tst.js:8:28:8:51 | req.que ... trolled | a user-provided value |
+| tst.js:16:10:16:13 | prop | tst.js:8:28:8:51 | req.que ... trolled | tst.js:16:10:16:13 | prop | A property name to write to depends on $@. | tst.js:8:28:8:51 | req.que ... trolled | a user-provided value |
+| tstNonExpr.js:8:17:8:23 | userVal | tstNonExpr.js:5:17:5:23 | req.url | tstNonExpr.js:8:17:8:23 | userVal | A header name depends on $@. | tstNonExpr.js:5:17:5:23 | req.url | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected b/javascript/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
index 9e405b7a8d4..89085c15dd9 100644
--- a/javascript/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected
@@ -17,7 +17,7 @@ edges
 | tst.js:12:26:12:40 | req.params.data | tst.js:12:26:12:40 | req.params.data |
 | tst.js:13:29:13:43 | req.params.data | tst.js:13:29:13:43 | req.params.data |
 #select
-| tst.js:7:22:7:36 | req.params.data | tst.js:7:22:7:36 | req.params.data | tst.js:7:22:7:36 | req.params.data | Unsafe deserialization of $@. | tst.js:7:22:7:36 | req.params.data | user input |
-| tst.js:8:25:8:39 | req.params.data | tst.js:8:25:8:39 | req.params.data | tst.js:8:25:8:39 | req.params.data | Unsafe deserialization of $@. | tst.js:8:25:8:39 | req.params.data | user input |
-| tst.js:12:26:12:40 | req.params.data | tst.js:12:26:12:40 | req.params.data | tst.js:12:26:12:40 | req.params.data | Unsafe deserialization of $@. | tst.js:12:26:12:40 | req.params.data | user input |
-| tst.js:13:29:13:43 | req.params.data | tst.js:13:29:13:43 | req.params.data | tst.js:13:29:13:43 | req.params.data | Unsafe deserialization of $@. | tst.js:13:29:13:43 | req.params.data | user input |
+| tst.js:7:22:7:36 | req.params.data | tst.js:7:22:7:36 | req.params.data | tst.js:7:22:7:36 | req.params.data | Unsafe deserialization that depends on $@. | tst.js:7:22:7:36 | req.params.data | a user-provided value |
+| tst.js:8:25:8:39 | req.params.data | tst.js:8:25:8:39 | req.params.data | tst.js:8:25:8:39 | req.params.data | Unsafe deserialization that depends on $@. | tst.js:8:25:8:39 | req.params.data | a user-provided value |
+| tst.js:12:26:12:40 | req.params.data | tst.js:12:26:12:40 | req.params.data | tst.js:12:26:12:40 | req.params.data | Unsafe deserialization that depends on $@. | tst.js:12:26:12:40 | req.params.data | a user-provided value |
+| tst.js:13:29:13:43 | req.params.data | tst.js:13:29:13:43 | req.params.data | tst.js:13:29:13:43 | req.params.data | Unsafe deserialization that depends on $@. | tst.js:13:29:13:43 | req.params.data | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-506/HardcodedDataInterpretedAsCode.expected b/javascript/ql/test/query-tests/Security/CWE-506/HardcodedDataInterpretedAsCode.expected
index 6d3b0afd9b1..76c630812c5 100644
--- a/javascript/ql/test/query-tests/Security/CWE-506/HardcodedDataInterpretedAsCode.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-506/HardcodedDataInterpretedAsCode.expected
@@ -41,7 +41,7 @@ edges
 | tst.js:7:8:7:11 | test | tst.js:7:8:7:15 | test+"n" |
 | tst.js:7:8:7:11 | test | tst.js:7:8:7:15 | test+"n" |
 #select
-| event-stream-orig.js:96:15:96:41 | e("2e2f ... 17461") | event-stream-orig.js:96:17:96:40 | "2e2f74 ... 617461" | event-stream-orig.js:96:15:96:41 | e("2e2f ... 17461") | Hard-coded data from $@ is interpreted as an import path. | event-stream-orig.js:96:17:96:40 | "2e2f74 ... 617461" | here |
-| event-stream.js:9:11:9:37 | e("2e2f ... 17461") | event-stream.js:9:13:9:36 | "2e2f74 ... 617461" | event-stream.js:9:11:9:37 | e("2e2f ... 17461") | Hard-coded data from $@ is interpreted as an import path. | event-stream.js:9:13:9:36 | "2e2f74 ... 617461" | here |
-| tst.js:2:6:2:57 | Buffer. ... tring() | tst.js:1:29:1:88 | '636f6e ... 6e2729' | tst.js:2:6:2:57 | Buffer. ... tring() | Hard-coded data from $@ is interpreted as code. | tst.js:1:29:1:88 | '636f6e ... 6e2729' | here |
-| tst.js:7:8:7:15 | test+"n" | tst.js:5:12:5:23 | "0123456789" | tst.js:7:8:7:15 | test+"n" | Hard-coded data from $@ is interpreted as code. | tst.js:5:12:5:23 | "0123456789" | here |
+| event-stream-orig.js:96:15:96:41 | e("2e2f ... 17461") | event-stream-orig.js:96:17:96:40 | "2e2f74 ... 617461" | event-stream-orig.js:96:15:96:41 | e("2e2f ... 17461") | $@ is interpreted as An import path. | event-stream-orig.js:96:17:96:40 | "2e2f74 ... 617461" | Hard-coded data |
+| event-stream.js:9:11:9:37 | e("2e2f ... 17461") | event-stream.js:9:13:9:36 | "2e2f74 ... 617461" | event-stream.js:9:11:9:37 | e("2e2f ... 17461") | $@ is interpreted as An import path. | event-stream.js:9:13:9:36 | "2e2f74 ... 617461" | Hard-coded data |
+| tst.js:2:6:2:57 | Buffer. ... tring() | tst.js:1:29:1:88 | '636f6e ... 6e2729' | tst.js:2:6:2:57 | Buffer. ... tring() | $@ is interpreted as Code. | tst.js:1:29:1:88 | '636f6e ... 6e2729' | Hard-coded data |
+| tst.js:7:8:7:15 | test+"n" | tst.js:5:12:5:23 | "0123456789" | tst.js:7:8:7:15 | test+"n" | $@ is interpreted as Code. | tst.js:5:12:5:23 | "0123456789" | Hard-coded data |
diff --git a/javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/ClientSideUrlRedirect.expected b/javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/ClientSideUrlRedirect.expected
index adde7d7e41d..42858918c47 100644
--- a/javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/ClientSideUrlRedirect.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/ClientSideUrlRedirect.expected
@@ -413,65 +413,65 @@ edges
 | typed.ts:28:24:28:34 | redirectUri | typed.ts:29:33:29:43 | redirectUri |
 | typed.ts:28:24:28:34 | redirectUri | typed.ts:29:33:29:43 | redirectUri |
 #select
-| electron.js:7:20:7:29 | getTaint() | electron.js:4:12:4:22 | window.name | electron.js:7:20:7:29 | getTaint() | Untrusted URL redirection due to $@. | electron.js:4:12:4:22 | window.name | user-provided value |
-| react.js:10:60:10:81 | documen ... on.hash | react.js:10:60:10:81 | documen ... on.hash | react.js:10:60:10:81 | documen ... on.hash | Untrusted URL redirection due to $@. | react.js:10:60:10:81 | documen ... on.hash | user-provided value |
-| react.js:21:24:21:45 | documen ... on.hash | react.js:21:24:21:45 | documen ... on.hash | react.js:21:24:21:45 | documen ... on.hash | Untrusted URL redirection due to $@. | react.js:21:24:21:45 | documen ... on.hash | user-provided value |
-| react.js:28:43:28:74 | documen ... bstr(1) | react.js:28:43:28:64 | documen ... on.hash | react.js:28:43:28:74 | documen ... bstr(1) | Untrusted URL redirection due to $@. | react.js:28:43:28:64 | documen ... on.hash | user-provided value |
-| react.js:34:43:34:74 | documen ... bstr(1) | react.js:34:43:34:64 | documen ... on.hash | react.js:34:43:34:74 | documen ... bstr(1) | Untrusted URL redirection due to $@. | react.js:34:43:34:64 | documen ... on.hash | user-provided value |
-| react.js:40:19:40:50 | documen ... bstr(1) | react.js:40:19:40:40 | documen ... on.hash | react.js:40:19:40:50 | documen ... bstr(1) | Untrusted URL redirection due to $@. | react.js:40:19:40:40 | documen ... on.hash | user-provided value |
-| sanitizer.js:4:27:4:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:4:27:4:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
-| sanitizer.js:16:27:16:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:16:27:16:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
-| sanitizer.js:19:27:19:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:19:27:19:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
-| sanitizer.js:22:27:22:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:22:27:22:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
-| sanitizer.js:25:27:25:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:25:27:25:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
-| sanitizer.js:28:27:28:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:28:27:28:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
-| sanitizer.js:31:27:31:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:31:27:31:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
-| sanitizer.js:37:27:37:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:37:27:37:29 | url | Untrusted URL redirection due to $@. | sanitizer.js:2:15:2:25 | window.name | user-provided value |
-| tst2.js:4:21:4:55 | href.su ... '?')+1) | tst2.js:2:14:2:28 | window.location | tst2.js:4:21:4:55 | href.su ... '?')+1) | Untrusted URL redirection due to $@. | tst2.js:2:14:2:28 | window.location | user-provided value |
-| tst2.js:4:21:4:55 | href.su ... '?')+1) | tst2.js:2:14:2:33 | window.location.href | tst2.js:4:21:4:55 | href.su ... '?')+1) | Untrusted URL redirection due to $@. | tst2.js:2:14:2:33 | window.location.href | user-provided value |
-| tst6.js:4:21:4:28 | redirect | tst6.js:2:18:2:45 | $locati ... irect') | tst6.js:4:21:4:28 | redirect | Untrusted URL redirection due to $@. | tst6.js:2:18:2:45 | $locati ... irect') | user-provided value |
-| tst6.js:6:17:6:24 | redirect | tst6.js:2:18:2:45 | $locati ... irect') | tst6.js:6:17:6:24 | redirect | Untrusted URL redirection due to $@. | tst6.js:2:18:2:45 | $locati ... irect') | user-provided value |
-| tst6.js:8:21:8:56 | $locati ... + "foo" | tst6.js:8:21:8:48 | $locati ... irect') | tst6.js:8:21:8:56 | $locati ... + "foo" | Untrusted URL redirection due to $@. | tst6.js:8:21:8:48 | $locati ... irect') | user-provided value |
-| tst7.js:2:12:2:35 | documen ... .search | tst7.js:2:12:2:35 | documen ... .search | tst7.js:2:12:2:35 | documen ... .search | Untrusted URL redirection due to $@. | tst7.js:2:12:2:35 | documen ... .search | user-provided value |
-| tst7.js:5:27:5:50 | documen ... .search | tst7.js:5:27:5:50 | documen ... .search | tst7.js:5:27:5:50 | documen ... .search | Untrusted URL redirection due to $@. | tst7.js:5:27:5:50 | documen ... .search | user-provided value |
-| tst9.js:2:21:2:55 | documen ... ring(1) | tst9.js:2:21:2:42 | documen ... on.hash | tst9.js:2:21:2:55 | documen ... ring(1) | Untrusted URL redirection due to $@. | tst9.js:2:21:2:42 | documen ... on.hash | user-provided value |
-| tst10.js:5:17:5:46 | '/' + d ... .search | tst10.js:5:23:5:46 | documen ... .search | tst10.js:5:17:5:46 | '/' + d ... .search | Untrusted URL redirection due to $@. | tst10.js:5:23:5:46 | documen ... .search | user-provided value |
-| tst10.js:8:17:8:47 | '//' +  ... .search | tst10.js:8:24:8:47 | documen ... .search | tst10.js:8:17:8:47 | '//' +  ... .search | Untrusted URL redirection due to $@. | tst10.js:8:24:8:47 | documen ... .search | user-provided value |
-| tst10.js:11:17:11:50 | '//foo' ... .search | tst10.js:11:27:11:50 | documen ... .search | tst10.js:11:17:11:50 | '//foo' ... .search | Untrusted URL redirection due to $@. | tst10.js:11:27:11:50 | documen ... .search | user-provided value |
-| tst10.js:14:17:14:56 | 'https: ... .search | tst10.js:14:33:14:56 | documen ... .search | tst10.js:14:17:14:56 | 'https: ... .search | Untrusted URL redirection due to $@. | tst10.js:14:33:14:56 | documen ... .search | user-provided value |
-| tst12.js:5:23:5:25 | loc | tst12.js:3:20:3:39 | window.location.hash | tst12.js:5:23:5:25 | loc | Untrusted URL redirection due to $@. | tst12.js:3:20:3:39 | window.location.hash | user-provided value |
-| tst13.js:4:15:4:21 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:4:15:4:21 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:8:21:8:27 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:8:21:8:27 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:12:14:12:20 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:12:14:12:20 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:16:17:16:23 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:16:17:16:23 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:20:14:20:20 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:20:14:20:20 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:24:14:24:20 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:24:14:24:20 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:28:21:28:27 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:28:21:28:27 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:32:17:32:23 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:32:17:32:23 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:36:21:36:27 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:36:21:36:27 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:40:15:40:21 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:40:15:40:21 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:44:14:44:20 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:44:14:44:20 | payload | Untrusted URL redirection due to $@. | tst13.js:2:19:2:42 | documen ... .search | user-provided value |
-| tst13.js:50:23:50:23 | e | tst13.js:49:32:49:32 | e | tst13.js:50:23:50:23 | e | Untrusted URL redirection due to $@. | tst13.js:49:32:49:32 | e | user-provided value |
-| tst13.js:53:28:53:28 | e | tst13.js:52:34:52:34 | e | tst13.js:53:28:53:28 | e | Untrusted URL redirection due to $@. | tst13.js:52:34:52:34 | e | user-provided value |
-| tst13.js:61:18:61:24 | payload | tst13.js:59:19:59:42 | documen ... .search | tst13.js:61:18:61:24 | payload | Untrusted URL redirection due to $@. | tst13.js:59:19:59:42 | documen ... .search | user-provided value |
-| tst13.js:67:21:67:27 | payload | tst13.js:65:19:65:39 | history ... on.hash | tst13.js:67:21:67:27 | payload | Untrusted URL redirection due to $@. | tst13.js:65:19:65:39 | history ... on.hash | user-provided value |
-| tst13.js:74:21:74:27 | payload | tst13.js:72:19:72:39 | history ... on.hash | tst13.js:74:21:74:27 | payload | Untrusted URL redirection due to $@. | tst13.js:72:19:72:39 | history ... on.hash | user-provided value |
-| tst13.js:80:21:80:23 | url | tst13.js:78:15:78:38 | documen ... .search | tst13.js:80:21:80:23 | url | Untrusted URL redirection due to $@. | tst13.js:78:15:78:38 | documen ... .search | user-provided value |
-| tst13.js:81:28:81:30 | url | tst13.js:78:15:78:38 | documen ... .search | tst13.js:81:28:81:30 | url | Untrusted URL redirection due to $@. | tst13.js:78:15:78:38 | documen ... .search | user-provided value |
-| tst13.js:82:27:82:29 | url | tst13.js:78:15:78:38 | documen ... .search | tst13.js:82:27:82:29 | url | Untrusted URL redirection due to $@. | tst13.js:78:15:78:38 | documen ... .search | user-provided value |
-| tst13.js:83:22:83:24 | url | tst13.js:78:15:78:38 | documen ... .search | tst13.js:83:22:83:24 | url | Untrusted URL redirection due to $@. | tst13.js:78:15:78:38 | documen ... .search | user-provided value |
-| tst.js:2:19:2:72 | /.*redi ... ref)[1] | tst.js:2:47:2:63 | document.location | tst.js:2:19:2:72 | /.*redi ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:2:47:2:63 | document.location | user-provided value |
-| tst.js:2:19:2:72 | /.*redi ... ref)[1] | tst.js:2:47:2:68 | documen ... on.href | tst.js:2:19:2:72 | /.*redi ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:2:47:2:68 | documen ... on.href | user-provided value |
-| tst.js:6:20:6:59 | indirec ... ref)[1] | tst.js:6:34:6:50 | document.location | tst.js:6:20:6:59 | indirec ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:6:34:6:50 | document.location | user-provided value |
-| tst.js:6:20:6:59 | indirec ... ref)[1] | tst.js:6:34:6:55 | documen ... on.href | tst.js:6:20:6:59 | indirec ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:6:34:6:55 | documen ... on.href | user-provided value |
-| tst.js:10:19:10:84 | new Reg ... ref)[1] | tst.js:10:59:10:75 | document.location | tst.js:10:19:10:84 | new Reg ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:10:59:10:75 | document.location | user-provided value |
-| tst.js:10:19:10:84 | new Reg ... ref)[1] | tst.js:10:59:10:80 | documen ... on.href | tst.js:10:19:10:84 | new Reg ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:10:59:10:80 | documen ... on.href | user-provided value |
-| tst.js:14:20:14:59 | indirec ... ref)[1] | tst.js:14:34:14:50 | document.location | tst.js:14:20:14:59 | indirec ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:14:34:14:50 | document.location | user-provided value |
-| tst.js:14:20:14:59 | indirec ... ref)[1] | tst.js:14:34:14:55 | documen ... on.href | tst.js:14:20:14:59 | indirec ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:14:34:14:55 | documen ... on.href | user-provided value |
-| tst.js:18:19:18:84 | new Reg ... ref)[1] | tst.js:18:59:18:75 | document.location | tst.js:18:19:18:84 | new Reg ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:18:59:18:75 | document.location | user-provided value |
-| tst.js:18:19:18:84 | new Reg ... ref)[1] | tst.js:18:59:18:80 | documen ... on.href | tst.js:18:19:18:84 | new Reg ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:18:59:18:80 | documen ... on.href | user-provided value |
-| tst.js:22:20:22:59 | indirec ... ref)[1] | tst.js:22:34:22:50 | document.location | tst.js:22:20:22:59 | indirec ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:22:34:22:50 | document.location | user-provided value |
-| tst.js:22:20:22:59 | indirec ... ref)[1] | tst.js:22:34:22:55 | documen ... on.href | tst.js:22:20:22:59 | indirec ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:22:34:22:55 | documen ... on.href | user-provided value |
-| tst.js:26:22:26:82 | new Reg ... ref)[1] | tst.js:26:62:26:78 | win.location.href | tst.js:26:22:26:82 | new Reg ... ref)[1] | Untrusted URL redirection due to $@. | tst.js:26:62:26:78 | win.location.href | user-provided value |
-| typed.ts:8:33:8:43 | redirectUri | typed.ts:4:22:4:36 | location.search | typed.ts:8:33:8:43 | redirectUri | Untrusted URL redirection due to $@. | typed.ts:4:22:4:36 | location.search | user-provided value |
-| typed.ts:29:33:29:43 | redirectUri | typed.ts:25:25:25:34 | loc.search | typed.ts:29:33:29:43 | redirectUri | Untrusted URL redirection due to $@. | typed.ts:25:25:25:34 | loc.search | user-provided value |
+| electron.js:7:20:7:29 | getTaint() | electron.js:4:12:4:22 | window.name | electron.js:7:20:7:29 | getTaint() | Untrusted URL redirection depends on $@. | electron.js:4:12:4:22 | window.name | a user-provided value |
+| react.js:10:60:10:81 | documen ... on.hash | react.js:10:60:10:81 | documen ... on.hash | react.js:10:60:10:81 | documen ... on.hash | Untrusted URL redirection depends on $@. | react.js:10:60:10:81 | documen ... on.hash | a user-provided value |
+| react.js:21:24:21:45 | documen ... on.hash | react.js:21:24:21:45 | documen ... on.hash | react.js:21:24:21:45 | documen ... on.hash | Untrusted URL redirection depends on $@. | react.js:21:24:21:45 | documen ... on.hash | a user-provided value |
+| react.js:28:43:28:74 | documen ... bstr(1) | react.js:28:43:28:64 | documen ... on.hash | react.js:28:43:28:74 | documen ... bstr(1) | Untrusted URL redirection depends on $@. | react.js:28:43:28:64 | documen ... on.hash | a user-provided value |
+| react.js:34:43:34:74 | documen ... bstr(1) | react.js:34:43:34:64 | documen ... on.hash | react.js:34:43:34:74 | documen ... bstr(1) | Untrusted URL redirection depends on $@. | react.js:34:43:34:64 | documen ... on.hash | a user-provided value |
+| react.js:40:19:40:50 | documen ... bstr(1) | react.js:40:19:40:40 | documen ... on.hash | react.js:40:19:40:50 | documen ... bstr(1) | Untrusted URL redirection depends on $@. | react.js:40:19:40:40 | documen ... on.hash | a user-provided value |
+| sanitizer.js:4:27:4:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:4:27:4:29 | url | Untrusted URL redirection depends on $@. | sanitizer.js:2:15:2:25 | window.name | a user-provided value |
+| sanitizer.js:16:27:16:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:16:27:16:29 | url | Untrusted URL redirection depends on $@. | sanitizer.js:2:15:2:25 | window.name | a user-provided value |
+| sanitizer.js:19:27:19:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:19:27:19:29 | url | Untrusted URL redirection depends on $@. | sanitizer.js:2:15:2:25 | window.name | a user-provided value |
+| sanitizer.js:22:27:22:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:22:27:22:29 | url | Untrusted URL redirection depends on $@. | sanitizer.js:2:15:2:25 | window.name | a user-provided value |
+| sanitizer.js:25:27:25:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:25:27:25:29 | url | Untrusted URL redirection depends on $@. | sanitizer.js:2:15:2:25 | window.name | a user-provided value |
+| sanitizer.js:28:27:28:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:28:27:28:29 | url | Untrusted URL redirection depends on $@. | sanitizer.js:2:15:2:25 | window.name | a user-provided value |
+| sanitizer.js:31:27:31:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:31:27:31:29 | url | Untrusted URL redirection depends on $@. | sanitizer.js:2:15:2:25 | window.name | a user-provided value |
+| sanitizer.js:37:27:37:29 | url | sanitizer.js:2:15:2:25 | window.name | sanitizer.js:37:27:37:29 | url | Untrusted URL redirection depends on $@. | sanitizer.js:2:15:2:25 | window.name | a user-provided value |
+| tst2.js:4:21:4:55 | href.su ... '?')+1) | tst2.js:2:14:2:28 | window.location | tst2.js:4:21:4:55 | href.su ... '?')+1) | Untrusted URL redirection depends on $@. | tst2.js:2:14:2:28 | window.location | a user-provided value |
+| tst2.js:4:21:4:55 | href.su ... '?')+1) | tst2.js:2:14:2:33 | window.location.href | tst2.js:4:21:4:55 | href.su ... '?')+1) | Untrusted URL redirection depends on $@. | tst2.js:2:14:2:33 | window.location.href | a user-provided value |
+| tst6.js:4:21:4:28 | redirect | tst6.js:2:18:2:45 | $locati ... irect') | tst6.js:4:21:4:28 | redirect | Untrusted URL redirection depends on $@. | tst6.js:2:18:2:45 | $locati ... irect') | a user-provided value |
+| tst6.js:6:17:6:24 | redirect | tst6.js:2:18:2:45 | $locati ... irect') | tst6.js:6:17:6:24 | redirect | Untrusted URL redirection depends on $@. | tst6.js:2:18:2:45 | $locati ... irect') | a user-provided value |
+| tst6.js:8:21:8:56 | $locati ... + "foo" | tst6.js:8:21:8:48 | $locati ... irect') | tst6.js:8:21:8:56 | $locati ... + "foo" | Untrusted URL redirection depends on $@. | tst6.js:8:21:8:48 | $locati ... irect') | a user-provided value |
+| tst7.js:2:12:2:35 | documen ... .search | tst7.js:2:12:2:35 | documen ... .search | tst7.js:2:12:2:35 | documen ... .search | Untrusted URL redirection depends on $@. | tst7.js:2:12:2:35 | documen ... .search | a user-provided value |
+| tst7.js:5:27:5:50 | documen ... .search | tst7.js:5:27:5:50 | documen ... .search | tst7.js:5:27:5:50 | documen ... .search | Untrusted URL redirection depends on $@. | tst7.js:5:27:5:50 | documen ... .search | a user-provided value |
+| tst9.js:2:21:2:55 | documen ... ring(1) | tst9.js:2:21:2:42 | documen ... on.hash | tst9.js:2:21:2:55 | documen ... ring(1) | Untrusted URL redirection depends on $@. | tst9.js:2:21:2:42 | documen ... on.hash | a user-provided value |
+| tst10.js:5:17:5:46 | '/' + d ... .search | tst10.js:5:23:5:46 | documen ... .search | tst10.js:5:17:5:46 | '/' + d ... .search | Untrusted URL redirection depends on $@. | tst10.js:5:23:5:46 | documen ... .search | a user-provided value |
+| tst10.js:8:17:8:47 | '//' +  ... .search | tst10.js:8:24:8:47 | documen ... .search | tst10.js:8:17:8:47 | '//' +  ... .search | Untrusted URL redirection depends on $@. | tst10.js:8:24:8:47 | documen ... .search | a user-provided value |
+| tst10.js:11:17:11:50 | '//foo' ... .search | tst10.js:11:27:11:50 | documen ... .search | tst10.js:11:17:11:50 | '//foo' ... .search | Untrusted URL redirection depends on $@. | tst10.js:11:27:11:50 | documen ... .search | a user-provided value |
+| tst10.js:14:17:14:56 | 'https: ... .search | tst10.js:14:33:14:56 | documen ... .search | tst10.js:14:17:14:56 | 'https: ... .search | Untrusted URL redirection depends on $@. | tst10.js:14:33:14:56 | documen ... .search | a user-provided value |
+| tst12.js:5:23:5:25 | loc | tst12.js:3:20:3:39 | window.location.hash | tst12.js:5:23:5:25 | loc | Untrusted URL redirection depends on $@. | tst12.js:3:20:3:39 | window.location.hash | a user-provided value |
+| tst13.js:4:15:4:21 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:4:15:4:21 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:8:21:8:27 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:8:21:8:27 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:12:14:12:20 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:12:14:12:20 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:16:17:16:23 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:16:17:16:23 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:20:14:20:20 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:20:14:20:20 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:24:14:24:20 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:24:14:24:20 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:28:21:28:27 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:28:21:28:27 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:32:17:32:23 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:32:17:32:23 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:36:21:36:27 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:36:21:36:27 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:40:15:40:21 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:40:15:40:21 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:44:14:44:20 | payload | tst13.js:2:19:2:42 | documen ... .search | tst13.js:44:14:44:20 | payload | Untrusted URL redirection depends on $@. | tst13.js:2:19:2:42 | documen ... .search | a user-provided value |
+| tst13.js:50:23:50:23 | e | tst13.js:49:32:49:32 | e | tst13.js:50:23:50:23 | e | Untrusted URL redirection depends on $@. | tst13.js:49:32:49:32 | e | a user-provided value |
+| tst13.js:53:28:53:28 | e | tst13.js:52:34:52:34 | e | tst13.js:53:28:53:28 | e | Untrusted URL redirection depends on $@. | tst13.js:52:34:52:34 | e | a user-provided value |
+| tst13.js:61:18:61:24 | payload | tst13.js:59:19:59:42 | documen ... .search | tst13.js:61:18:61:24 | payload | Untrusted URL redirection depends on $@. | tst13.js:59:19:59:42 | documen ... .search | a user-provided value |
+| tst13.js:67:21:67:27 | payload | tst13.js:65:19:65:39 | history ... on.hash | tst13.js:67:21:67:27 | payload | Untrusted URL redirection depends on $@. | tst13.js:65:19:65:39 | history ... on.hash | a user-provided value |
+| tst13.js:74:21:74:27 | payload | tst13.js:72:19:72:39 | history ... on.hash | tst13.js:74:21:74:27 | payload | Untrusted URL redirection depends on $@. | tst13.js:72:19:72:39 | history ... on.hash | a user-provided value |
+| tst13.js:80:21:80:23 | url | tst13.js:78:15:78:38 | documen ... .search | tst13.js:80:21:80:23 | url | Untrusted URL redirection depends on $@. | tst13.js:78:15:78:38 | documen ... .search | a user-provided value |
+| tst13.js:81:28:81:30 | url | tst13.js:78:15:78:38 | documen ... .search | tst13.js:81:28:81:30 | url | Untrusted URL redirection depends on $@. | tst13.js:78:15:78:38 | documen ... .search | a user-provided value |
+| tst13.js:82:27:82:29 | url | tst13.js:78:15:78:38 | documen ... .search | tst13.js:82:27:82:29 | url | Untrusted URL redirection depends on $@. | tst13.js:78:15:78:38 | documen ... .search | a user-provided value |
+| tst13.js:83:22:83:24 | url | tst13.js:78:15:78:38 | documen ... .search | tst13.js:83:22:83:24 | url | Untrusted URL redirection depends on $@. | tst13.js:78:15:78:38 | documen ... .search | a user-provided value |
+| tst.js:2:19:2:72 | /.*redi ... ref)[1] | tst.js:2:47:2:63 | document.location | tst.js:2:19:2:72 | /.*redi ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:2:47:2:63 | document.location | a user-provided value |
+| tst.js:2:19:2:72 | /.*redi ... ref)[1] | tst.js:2:47:2:68 | documen ... on.href | tst.js:2:19:2:72 | /.*redi ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:2:47:2:68 | documen ... on.href | a user-provided value |
+| tst.js:6:20:6:59 | indirec ... ref)[1] | tst.js:6:34:6:50 | document.location | tst.js:6:20:6:59 | indirec ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:6:34:6:50 | document.location | a user-provided value |
+| tst.js:6:20:6:59 | indirec ... ref)[1] | tst.js:6:34:6:55 | documen ... on.href | tst.js:6:20:6:59 | indirec ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:6:34:6:55 | documen ... on.href | a user-provided value |
+| tst.js:10:19:10:84 | new Reg ... ref)[1] | tst.js:10:59:10:75 | document.location | tst.js:10:19:10:84 | new Reg ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:10:59:10:75 | document.location | a user-provided value |
+| tst.js:10:19:10:84 | new Reg ... ref)[1] | tst.js:10:59:10:80 | documen ... on.href | tst.js:10:19:10:84 | new Reg ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:10:59:10:80 | documen ... on.href | a user-provided value |
+| tst.js:14:20:14:59 | indirec ... ref)[1] | tst.js:14:34:14:50 | document.location | tst.js:14:20:14:59 | indirec ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:14:34:14:50 | document.location | a user-provided value |
+| tst.js:14:20:14:59 | indirec ... ref)[1] | tst.js:14:34:14:55 | documen ... on.href | tst.js:14:20:14:59 | indirec ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:14:34:14:55 | documen ... on.href | a user-provided value |
+| tst.js:18:19:18:84 | new Reg ... ref)[1] | tst.js:18:59:18:75 | document.location | tst.js:18:19:18:84 | new Reg ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:18:59:18:75 | document.location | a user-provided value |
+| tst.js:18:19:18:84 | new Reg ... ref)[1] | tst.js:18:59:18:80 | documen ... on.href | tst.js:18:19:18:84 | new Reg ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:18:59:18:80 | documen ... on.href | a user-provided value |
+| tst.js:22:20:22:59 | indirec ... ref)[1] | tst.js:22:34:22:50 | document.location | tst.js:22:20:22:59 | indirec ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:22:34:22:50 | document.location | a user-provided value |
+| tst.js:22:20:22:59 | indirec ... ref)[1] | tst.js:22:34:22:55 | documen ... on.href | tst.js:22:20:22:59 | indirec ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:22:34:22:55 | documen ... on.href | a user-provided value |
+| tst.js:26:22:26:82 | new Reg ... ref)[1] | tst.js:26:62:26:78 | win.location.href | tst.js:26:22:26:82 | new Reg ... ref)[1] | Untrusted URL redirection depends on $@. | tst.js:26:62:26:78 | win.location.href | a user-provided value |
+| typed.ts:8:33:8:43 | redirectUri | typed.ts:4:22:4:36 | location.search | typed.ts:8:33:8:43 | redirectUri | Untrusted URL redirection depends on $@. | typed.ts:4:22:4:36 | location.search | a user-provided value |
+| typed.ts:29:33:29:43 | redirectUri | typed.ts:25:25:25:34 | loc.search | typed.ts:29:33:29:43 | redirectUri | Untrusted URL redirection depends on $@. | typed.ts:25:25:25:34 | loc.search | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/ServerSideUrlRedirect.expected b/javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/ServerSideUrlRedirect.expected
index 5fa8a043558..69fe203f855 100644
--- a/javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/ServerSideUrlRedirect.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-601/ServerSideUrlRedirect/ServerSideUrlRedirect.expected
@@ -198,29 +198,29 @@ edges
 | react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
 | react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:33 | tainted |
 #select
-| express.js:7:16:7:34 | req.param("target") | express.js:7:16:7:34 | req.param("target") | express.js:7:16:7:34 | req.param("target") | Untrusted URL redirection due to $@. | express.js:7:16:7:34 | req.param("target") | user-provided value |
-| express.js:12:26:12:44 | req.param("target") | express.js:12:26:12:44 | req.param("target") | express.js:12:26:12:44 | req.param("target") | Untrusted URL redirection due to $@. | express.js:12:26:12:44 | req.param("target") | user-provided value |
-| express.js:33:18:33:23 | target | express.js:27:16:27:34 | req.param("target") | express.js:33:18:33:23 | target | Untrusted URL redirection due to $@. | express.js:27:16:27:34 | req.param("target") | user-provided value |
-| express.js:35:16:35:21 | target | express.js:27:16:27:34 | req.param("target") | express.js:35:16:35:21 | target | Untrusted URL redirection due to $@. | express.js:27:16:27:34 | req.param("target") | user-provided value |
-| express.js:40:16:40:108 | (req.pa ... ntacts" | express.js:40:69:40:87 | req.param('action') | express.js:40:16:40:108 | (req.pa ... ntacts" | Untrusted URL redirection due to $@. | express.js:40:69:40:87 | req.param('action') | user-provided value |
-| express.js:74:16:74:43 | `${req. ... )}/foo` | express.js:74:19:74:37 | req.param("target") | express.js:74:16:74:43 | `${req. ... )}/foo` | Untrusted URL redirection due to $@. | express.js:74:19:74:37 | req.param("target") | user-provided value |
-| express.js:90:18:90:23 | target | express.js:83:16:83:34 | req.param("target") | express.js:90:18:90:23 | target | Untrusted URL redirection due to $@. | express.js:83:16:83:34 | req.param("target") | user-provided value |
-| express.js:97:16:97:21 | target | express.js:83:16:83:34 | req.param("target") | express.js:97:16:97:21 | target | Untrusted URL redirection due to $@. | express.js:83:16:83:34 | req.param("target") | user-provided value |
-| express.js:118:16:118:72 | [req.qu ... oin('') | express.js:118:17:118:30 | req.query.page | express.js:118:16:118:72 | [req.qu ... oin('') | Untrusted URL redirection due to $@. | express.js:118:17:118:30 | req.query.page | user-provided value |
-| express.js:134:16:134:36 | '/' + r ... ms.user | express.js:134:22:134:36 | req.params.user | express.js:134:16:134:36 | '/' + r ... ms.user | Untrusted URL redirection due to $@. | express.js:134:22:134:36 | req.params.user | user-provided value |
-| express.js:135:16:135:37 | '//' +  ... ms.user | express.js:135:23:135:37 | req.params.user | express.js:135:16:135:37 | '//' +  ... ms.user | Untrusted URL redirection due to $@. | express.js:135:23:135:37 | req.params.user | user-provided value |
-| express.js:136:16:136:36 | 'u' + r ... ms.user | express.js:136:22:136:36 | req.params.user | express.js:136:16:136:36 | 'u' + r ... ms.user | Untrusted URL redirection due to $@. | express.js:136:22:136:36 | req.params.user | user-provided value |
-| express.js:143:16:143:28 | req.query.foo | express.js:143:16:143:28 | req.query.foo | express.js:143:16:143:28 | req.query.foo | Untrusted URL redirection due to $@. | express.js:143:16:143:28 | req.query.foo | user-provided value |
-| express.js:146:16:146:24 | query.foo | express.js:146:16:146:24 | query.foo | express.js:146:16:146:24 | query.foo | Untrusted URL redirection due to $@. | express.js:146:16:146:24 | query.foo | user-provided value |
-| express.js:155:18:155:23 | target | express.js:150:16:150:34 | req.param("target") | express.js:155:18:155:23 | target | Untrusted URL redirection due to $@. | express.js:150:16:150:34 | req.param("target") | user-provided value |
-| express.js:160:18:160:23 | target | express.js:150:16:150:34 | req.param("target") | express.js:160:18:160:23 | target | Untrusted URL redirection due to $@. | express.js:150:16:150:34 | req.param("target") | user-provided value |
-| koa.js:7:15:7:17 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:7:15:7:17 | url | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
-| koa.js:8:15:8:26 | `${url}${x}` | koa.js:6:12:6:27 | ctx.query.target | koa.js:8:15:8:26 | `${url}${x}` | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
-| koa.js:14:16:14:18 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:14:16:14:18 | url | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
-| koa.js:20:16:20:18 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:20:16:20:18 | url | Untrusted URL redirection due to $@. | koa.js:6:12:6:27 | ctx.query.target | user-provided value |
-| next.ts:11:31:11:50 | req.body.callbackUrl | next.ts:11:31:11:38 | req.body | next.ts:11:31:11:50 | req.body.callbackUrl | Untrusted URL redirection due to $@. | next.ts:11:31:11:38 | req.body | user-provided value |
-| node.js:6:34:6:39 | target | node.js:5:26:5:32 | req.url | node.js:6:34:6:39 | target | Untrusted URL redirection due to $@. | node.js:5:26:5:32 | req.url | user-provided value |
-| node.js:14:34:14:45 | '/' + target | node.js:10:26:10:32 | req.url | node.js:14:34:14:45 | '/' + target | Untrusted URL redirection due to $@. | node.js:10:26:10:32 | req.url | user-provided value |
-| node.js:31:34:31:55 | target  ... =" + me | node.js:28:26:28:32 | req.url | node.js:31:34:31:55 | target  ... =" + me | Untrusted URL redirection due to $@. | node.js:28:26:28:32 | req.url | user-provided value |
-| react-native.js:8:17:8:23 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:17:8:23 | tainted | Untrusted URL redirection due to $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
-| react-native.js:9:26:9:32 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:9:26:9:32 | tainted | Untrusted URL redirection due to $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
+| express.js:7:16:7:34 | req.param("target") | express.js:7:16:7:34 | req.param("target") | express.js:7:16:7:34 | req.param("target") | Untrusted URL redirection depends on $@. | express.js:7:16:7:34 | req.param("target") | a user-provided value |
+| express.js:12:26:12:44 | req.param("target") | express.js:12:26:12:44 | req.param("target") | express.js:12:26:12:44 | req.param("target") | Untrusted URL redirection depends on $@. | express.js:12:26:12:44 | req.param("target") | a user-provided value |
+| express.js:33:18:33:23 | target | express.js:27:16:27:34 | req.param("target") | express.js:33:18:33:23 | target | Untrusted URL redirection depends on $@. | express.js:27:16:27:34 | req.param("target") | a user-provided value |
+| express.js:35:16:35:21 | target | express.js:27:16:27:34 | req.param("target") | express.js:35:16:35:21 | target | Untrusted URL redirection depends on $@. | express.js:27:16:27:34 | req.param("target") | a user-provided value |
+| express.js:40:16:40:108 | (req.pa ... ntacts" | express.js:40:69:40:87 | req.param('action') | express.js:40:16:40:108 | (req.pa ... ntacts" | Untrusted URL redirection depends on $@. | express.js:40:69:40:87 | req.param('action') | a user-provided value |
+| express.js:74:16:74:43 | `${req. ... )}/foo` | express.js:74:19:74:37 | req.param("target") | express.js:74:16:74:43 | `${req. ... )}/foo` | Untrusted URL redirection depends on $@. | express.js:74:19:74:37 | req.param("target") | a user-provided value |
+| express.js:90:18:90:23 | target | express.js:83:16:83:34 | req.param("target") | express.js:90:18:90:23 | target | Untrusted URL redirection depends on $@. | express.js:83:16:83:34 | req.param("target") | a user-provided value |
+| express.js:97:16:97:21 | target | express.js:83:16:83:34 | req.param("target") | express.js:97:16:97:21 | target | Untrusted URL redirection depends on $@. | express.js:83:16:83:34 | req.param("target") | a user-provided value |
+| express.js:118:16:118:72 | [req.qu ... oin('') | express.js:118:17:118:30 | req.query.page | express.js:118:16:118:72 | [req.qu ... oin('') | Untrusted URL redirection depends on $@. | express.js:118:17:118:30 | req.query.page | a user-provided value |
+| express.js:134:16:134:36 | '/' + r ... ms.user | express.js:134:22:134:36 | req.params.user | express.js:134:16:134:36 | '/' + r ... ms.user | Untrusted URL redirection depends on $@. | express.js:134:22:134:36 | req.params.user | a user-provided value |
+| express.js:135:16:135:37 | '//' +  ... ms.user | express.js:135:23:135:37 | req.params.user | express.js:135:16:135:37 | '//' +  ... ms.user | Untrusted URL redirection depends on $@. | express.js:135:23:135:37 | req.params.user | a user-provided value |
+| express.js:136:16:136:36 | 'u' + r ... ms.user | express.js:136:22:136:36 | req.params.user | express.js:136:16:136:36 | 'u' + r ... ms.user | Untrusted URL redirection depends on $@. | express.js:136:22:136:36 | req.params.user | a user-provided value |
+| express.js:143:16:143:28 | req.query.foo | express.js:143:16:143:28 | req.query.foo | express.js:143:16:143:28 | req.query.foo | Untrusted URL redirection depends on $@. | express.js:143:16:143:28 | req.query.foo | a user-provided value |
+| express.js:146:16:146:24 | query.foo | express.js:146:16:146:24 | query.foo | express.js:146:16:146:24 | query.foo | Untrusted URL redirection depends on $@. | express.js:146:16:146:24 | query.foo | a user-provided value |
+| express.js:155:18:155:23 | target | express.js:150:16:150:34 | req.param("target") | express.js:155:18:155:23 | target | Untrusted URL redirection depends on $@. | express.js:150:16:150:34 | req.param("target") | a user-provided value |
+| express.js:160:18:160:23 | target | express.js:150:16:150:34 | req.param("target") | express.js:160:18:160:23 | target | Untrusted URL redirection depends on $@. | express.js:150:16:150:34 | req.param("target") | a user-provided value |
+| koa.js:7:15:7:17 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:7:15:7:17 | url | Untrusted URL redirection depends on $@. | koa.js:6:12:6:27 | ctx.query.target | a user-provided value |
+| koa.js:8:15:8:26 | `${url}${x}` | koa.js:6:12:6:27 | ctx.query.target | koa.js:8:15:8:26 | `${url}${x}` | Untrusted URL redirection depends on $@. | koa.js:6:12:6:27 | ctx.query.target | a user-provided value |
+| koa.js:14:16:14:18 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:14:16:14:18 | url | Untrusted URL redirection depends on $@. | koa.js:6:12:6:27 | ctx.query.target | a user-provided value |
+| koa.js:20:16:20:18 | url | koa.js:6:12:6:27 | ctx.query.target | koa.js:20:16:20:18 | url | Untrusted URL redirection depends on $@. | koa.js:6:12:6:27 | ctx.query.target | a user-provided value |
+| next.ts:11:31:11:50 | req.body.callbackUrl | next.ts:11:31:11:38 | req.body | next.ts:11:31:11:50 | req.body.callbackUrl | Untrusted URL redirection depends on $@. | next.ts:11:31:11:38 | req.body | a user-provided value |
+| node.js:6:34:6:39 | target | node.js:5:26:5:32 | req.url | node.js:6:34:6:39 | target | Untrusted URL redirection depends on $@. | node.js:5:26:5:32 | req.url | a user-provided value |
+| node.js:14:34:14:45 | '/' + target | node.js:10:26:10:32 | req.url | node.js:14:34:14:45 | '/' + target | Untrusted URL redirection depends on $@. | node.js:10:26:10:32 | req.url | a user-provided value |
+| node.js:31:34:31:55 | target  ... =" + me | node.js:28:26:28:32 | req.url | node.js:31:34:31:55 | target  ... =" + me | Untrusted URL redirection depends on $@. | node.js:28:26:28:32 | req.url | a user-provided value |
+| react-native.js:8:17:8:23 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:17:8:23 | tainted | Untrusted URL redirection depends on $@. | react-native.js:7:17:7:33 | req.param("code") | a user-provided value |
+| react-native.js:9:26:9:32 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:9:26:9:32 | tainted | Untrusted URL redirection depends on $@. | react-native.js:7:17:7:33 | req.param("code") | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-611/Xxe.expected b/javascript/ql/test/query-tests/Security/CWE-611/Xxe.expected
index 32f65045a60..db04692fccb 100644
--- a/javascript/ql/test/query-tests/Security/CWE-611/Xxe.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-611/Xxe.expected
@@ -45,11 +45,11 @@ edges
 | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") |
 | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") |
 #select
-| domparser.js:11:55:11:57 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:11:55:11:57 | src | A $@ is parsed as XML without guarding against external entity expansion. | domparser.js:2:13:2:36 | documen ... .search | user-provided value |
-| domparser.js:14:57:14:59 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:14:57:14:59 | src | A $@ is parsed as XML without guarding against external entity expansion. | domparser.js:2:13:2:36 | documen ... .search | user-provided value |
-| libxml.noent.js:6:21:6:41 | req.par ... e-xml") | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | A $@ is parsed as XML without guarding against external entity expansion. | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | user-provided value |
-| libxml.noent.js:11:21:11:41 | req.par ... e-xml") | libxml.noent.js:11:21:11:41 | req.par ... e-xml") | libxml.noent.js:11:21:11:41 | req.par ... e-xml") | A $@ is parsed as XML without guarding against external entity expansion. | libxml.noent.js:11:21:11:41 | req.par ... e-xml") | user-provided value |
-| libxml.noent.js:14:27:14:47 | req.par ... e-xml") | libxml.noent.js:14:27:14:47 | req.par ... e-xml") | libxml.noent.js:14:27:14:47 | req.par ... e-xml") | A $@ is parsed as XML without guarding against external entity expansion. | libxml.noent.js:14:27:14:47 | req.par ... e-xml") | user-provided value |
-| libxml.noent.js:16:27:16:66 | req.fil ... 'utf8') | libxml.noent.js:16:27:16:35 | req.files | libxml.noent.js:16:27:16:66 | req.fil ... 'utf8') | A $@ is parsed as XML without guarding against external entity expansion. | libxml.noent.js:16:27:16:35 | req.files | user-provided value |
-| libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | A $@ is parsed as XML without guarding against external entity expansion. | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | user-provided value |
-| libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | A $@ is parsed as XML without guarding against external entity expansion. | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | user-provided value |
+| domparser.js:11:55:11:57 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:11:55:11:57 | src | XML parsing depends on $@ without guarding against external entity expansion. | domparser.js:2:13:2:36 | documen ... .search | a user-provided value |
+| domparser.js:14:57:14:59 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:14:57:14:59 | src | XML parsing depends on $@ without guarding against external entity expansion. | domparser.js:2:13:2:36 | documen ... .search | a user-provided value |
+| libxml.noent.js:6:21:6:41 | req.par ... e-xml") | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | XML parsing depends on $@ without guarding against external entity expansion. | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | a user-provided value |
+| libxml.noent.js:11:21:11:41 | req.par ... e-xml") | libxml.noent.js:11:21:11:41 | req.par ... e-xml") | libxml.noent.js:11:21:11:41 | req.par ... e-xml") | XML parsing depends on $@ without guarding against external entity expansion. | libxml.noent.js:11:21:11:41 | req.par ... e-xml") | a user-provided value |
+| libxml.noent.js:14:27:14:47 | req.par ... e-xml") | libxml.noent.js:14:27:14:47 | req.par ... e-xml") | libxml.noent.js:14:27:14:47 | req.par ... e-xml") | XML parsing depends on $@ without guarding against external entity expansion. | libxml.noent.js:14:27:14:47 | req.par ... e-xml") | a user-provided value |
+| libxml.noent.js:16:27:16:66 | req.fil ... 'utf8') | libxml.noent.js:16:27:16:35 | req.files | libxml.noent.js:16:27:16:66 | req.fil ... 'utf8') | XML parsing depends on $@ without guarding against external entity expansion. | libxml.noent.js:16:27:16:35 | req.files | a user-provided value |
+| libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | XML parsing depends on $@ without guarding against external entity expansion. | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | a user-provided value |
+| libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | XML parsing depends on $@ without guarding against external entity expansion. | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.expected b/javascript/ql/test/query-tests/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.expected
index dc2b32cdd9e..c1ac8d456f2 100644
--- a/javascript/ql/test/query-tests/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.expected
@@ -17,5 +17,5 @@ edges
 | tst.js:18:78:18:85 | req.host | tst.js:18:11:18:127 | `Hi, lo ... reset.` |
 | tst.js:18:78:18:85 | req.host | tst.js:18:11:18:127 | `Hi, lo ... reset.` |
 #select
-| tst.js:17:11:17:113 | `Hi, lo ... token}` | tst.js:17:84:17:91 | req.host | tst.js:17:11:17:113 | `Hi, lo ... token}` | Links in this email can be hijacked by poisoning the HTTP host header $@. | tst.js:17:84:17:91 | req.host | here |
-| tst.js:18:11:18:127 | `Hi, lo ... reset.` | tst.js:18:78:18:85 | req.host | tst.js:18:11:18:127 | `Hi, lo ... reset.` | Links in this email can be hijacked by poisoning the HTTP host header $@. | tst.js:18:78:18:85 | req.host | here |
+| tst.js:17:11:17:113 | `Hi, lo ... token}` | tst.js:17:84:17:91 | req.host | tst.js:17:11:17:113 | `Hi, lo ... token}` | Links in this email can be hijacked by poisoning the $@. | tst.js:17:84:17:91 | req.host | HTTP host header |
+| tst.js:18:11:18:127 | `Hi, lo ... reset.` | tst.js:18:78:18:85 | req.host | tst.js:18:11:18:127 | `Hi, lo ... reset.` | Links in this email can be hijacked by poisoning the $@. | tst.js:18:78:18:85 | req.host | HTTP host header |
diff --git a/javascript/ql/test/query-tests/Security/CWE-643/XpathInjection.expected b/javascript/ql/test/query-tests/Security/CWE-643/XpathInjection.expected
index 1e747774b61..cfe53f22576 100644
--- a/javascript/ql/test/query-tests/Security/CWE-643/XpathInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-643/XpathInjection.expected
@@ -46,10 +46,10 @@ edges
 | tst.js:6:17:6:37 | req.par ... rName") | tst.js:6:7:6:37 | tainted |
 | tst.js:6:17:6:37 | req.par ... rName") | tst.js:6:7:6:37 | tainted |
 #select
-| XpathInjectionBad.js:9:34:9:96 | "//user ... text()" | XpathInjectionBad.js:6:18:6:38 | req.par ... rName") | XpathInjectionBad.js:9:34:9:96 | "//user ... text()" | $@ flows here and is used in an XPath expression. | XpathInjectionBad.js:6:18:6:38 | req.par ... rName") | User-provided value |
-| tst2.js:2:27:2:31 | query | tst2.js:1:13:1:34 | documen ... on.hash | tst2.js:2:27:2:31 | query | $@ flows here and is used in an XPath expression. | tst2.js:1:13:1:34 | documen ... on.hash | User-provided value |
-| tst2.js:3:19:3:23 | query | tst2.js:1:13:1:34 | documen ... on.hash | tst2.js:3:19:3:23 | query | $@ flows here and is used in an XPath expression. | tst2.js:1:13:1:34 | documen ... on.hash | User-provided value |
-| tst.js:7:15:7:21 | tainted | tst.js:6:17:6:37 | req.par ... rName") | tst.js:7:15:7:21 | tainted | $@ flows here and is used in an XPath expression. | tst.js:6:17:6:37 | req.par ... rName") | User-provided value |
-| tst.js:8:16:8:22 | tainted | tst.js:6:17:6:37 | req.par ... rName") | tst.js:8:16:8:22 | tainted | $@ flows here and is used in an XPath expression. | tst.js:6:17:6:37 | req.par ... rName") | User-provided value |
-| tst.js:9:17:9:23 | tainted | tst.js:6:17:6:37 | req.par ... rName") | tst.js:9:17:9:23 | tainted | $@ flows here and is used in an XPath expression. | tst.js:6:17:6:37 | req.par ... rName") | User-provided value |
-| tst.js:11:8:11:14 | tainted | tst.js:6:17:6:37 | req.par ... rName") | tst.js:11:8:11:14 | tainted | $@ flows here and is used in an XPath expression. | tst.js:6:17:6:37 | req.par ... rName") | User-provided value |
+| XpathInjectionBad.js:9:34:9:96 | "//user ... text()" | XpathInjectionBad.js:6:18:6:38 | req.par ... rName") | XpathInjectionBad.js:9:34:9:96 | "//user ... text()" | XPath expression depends on $@. | XpathInjectionBad.js:6:18:6:38 | req.par ... rName") | a user-provided value |
+| tst2.js:2:27:2:31 | query | tst2.js:1:13:1:34 | documen ... on.hash | tst2.js:2:27:2:31 | query | XPath expression depends on $@. | tst2.js:1:13:1:34 | documen ... on.hash | a user-provided value |
+| tst2.js:3:19:3:23 | query | tst2.js:1:13:1:34 | documen ... on.hash | tst2.js:3:19:3:23 | query | XPath expression depends on $@. | tst2.js:1:13:1:34 | documen ... on.hash | a user-provided value |
+| tst.js:7:15:7:21 | tainted | tst.js:6:17:6:37 | req.par ... rName") | tst.js:7:15:7:21 | tainted | XPath expression depends on $@. | tst.js:6:17:6:37 | req.par ... rName") | a user-provided value |
+| tst.js:8:16:8:22 | tainted | tst.js:6:17:6:37 | req.par ... rName") | tst.js:8:16:8:22 | tainted | XPath expression depends on $@. | tst.js:6:17:6:37 | req.par ... rName") | a user-provided value |
+| tst.js:9:17:9:23 | tainted | tst.js:6:17:6:37 | req.par ... rName") | tst.js:9:17:9:23 | tainted | XPath expression depends on $@. | tst.js:6:17:6:37 | req.par ... rName") | a user-provided value |
+| tst.js:11:8:11:14 | tainted | tst.js:6:17:6:37 | req.par ... rName") | tst.js:11:8:11:14 | tainted | XPath expression depends on $@. | tst.js:6:17:6:37 | req.par ... rName") | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.expected b/javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.expected
index 7d24e94a590..ea3beb41dd0 100644
--- a/javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-730/RegExpInjection.expected
@@ -130,20 +130,20 @@ edges
 | tst.js:3:21:3:29 | data.name | tst.js:3:16:3:35 | "^"+ data.name + "$" |
 | tst.js:3:21:3:29 | data.name | tst.js:3:16:3:35 | "^"+ data.name + "$" |
 #select
-| RegExpInjection.js:8:23:8:45 | "\\\\b" + ... (.*)\\n" | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:8:23:8:45 | "\\\\b" + ... (.*)\\n" | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
-| RegExpInjection.js:19:14:19:22 | wrap(key) | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:19:14:19:22 | wrap(key) | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
-| RegExpInjection.js:21:14:21:22 | wrap(key) | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:21:14:21:22 | wrap(key) | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
-| RegExpInjection.js:27:14:27:21 | getKey() | RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:27:14:27:21 | getKey() | This regular expression is constructed from a $@. | RegExpInjection.js:24:12:24:27 | req.param("key") | user-provided value |
-| RegExpInjection.js:31:23:31:23 | s | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:31:23:31:23 | s | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
-| RegExpInjection.js:31:23:31:23 | s | RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:31:23:31:23 | s | This regular expression is constructed from a $@. | RegExpInjection.js:24:12:24:27 | req.param("key") | user-provided value |
-| RegExpInjection.js:40:23:40:27 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:40:23:40:27 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
-| RegExpInjection.js:41:26:41:30 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:41:26:41:30 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
-| RegExpInjection.js:42:25:42:29 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:42:25:42:29 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
-| RegExpInjection.js:45:20:45:24 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:45:20:45:24 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
-| RegExpInjection.js:46:23:46:27 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:46:23:46:27 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
-| RegExpInjection.js:47:22:47:26 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:47:22:47:26 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
-| RegExpInjection.js:50:46:50:50 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:50:46:50:50 | input | This regular expression is constructed from a $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | user-provided value |
-| RegExpInjection.js:54:14:54:52 | key.spl ... in("-") | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:54:14:54:52 | key.spl ... in("-") | This regular expression is constructed from a $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | user-provided value |
-| RegExpInjection.js:64:14:64:18 | input | RegExpInjection.js:60:39:60:56 | req.param("input") | RegExpInjection.js:64:14:64:18 | input | This regular expression is constructed from a $@. | RegExpInjection.js:60:39:60:56 | req.param("input") | user-provided value |
-| RegExpInjection.js:87:14:87:55 | "^.*\\.( ...  + ")$" | RegExpInjection.js:82:15:82:32 | req.param("input") | RegExpInjection.js:87:14:87:55 | "^.*\\.( ...  + ")$" | This regular expression is constructed from a $@. | RegExpInjection.js:82:15:82:32 | req.param("input") | user-provided value |
-| tst.js:3:16:3:35 | "^"+ data.name + "$" | tst.js:1:46:1:46 | e | tst.js:3:16:3:35 | "^"+ data.name + "$" | This regular expression is constructed from a $@. | tst.js:1:46:1:46 | e | user-provided value |
+| RegExpInjection.js:8:23:8:45 | "\\\\b" + ... (.*)\\n" | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:8:23:8:45 | "\\\\b" + ... (.*)\\n" | This regular expression depends on $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | a user-provided value |
+| RegExpInjection.js:19:14:19:22 | wrap(key) | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:19:14:19:22 | wrap(key) | This regular expression depends on $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | a user-provided value |
+| RegExpInjection.js:21:14:21:22 | wrap(key) | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:21:14:21:22 | wrap(key) | This regular expression depends on $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | a user-provided value |
+| RegExpInjection.js:27:14:27:21 | getKey() | RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:27:14:27:21 | getKey() | This regular expression depends on $@. | RegExpInjection.js:24:12:24:27 | req.param("key") | a user-provided value |
+| RegExpInjection.js:31:23:31:23 | s | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:31:23:31:23 | s | This regular expression depends on $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | a user-provided value |
+| RegExpInjection.js:31:23:31:23 | s | RegExpInjection.js:24:12:24:27 | req.param("key") | RegExpInjection.js:31:23:31:23 | s | This regular expression depends on $@. | RegExpInjection.js:24:12:24:27 | req.param("key") | a user-provided value |
+| RegExpInjection.js:40:23:40:27 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:40:23:40:27 | input | This regular expression depends on $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | a user-provided value |
+| RegExpInjection.js:41:26:41:30 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:41:26:41:30 | input | This regular expression depends on $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | a user-provided value |
+| RegExpInjection.js:42:25:42:29 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:42:25:42:29 | input | This regular expression depends on $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | a user-provided value |
+| RegExpInjection.js:45:20:45:24 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:45:20:45:24 | input | This regular expression depends on $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | a user-provided value |
+| RegExpInjection.js:46:23:46:27 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:46:23:46:27 | input | This regular expression depends on $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | a user-provided value |
+| RegExpInjection.js:47:22:47:26 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:47:22:47:26 | input | This regular expression depends on $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | a user-provided value |
+| RegExpInjection.js:50:46:50:50 | input | RegExpInjection.js:5:39:5:56 | req.param("input") | RegExpInjection.js:50:46:50:50 | input | This regular expression depends on $@. | RegExpInjection.js:5:39:5:56 | req.param("input") | a user-provided value |
+| RegExpInjection.js:54:14:54:52 | key.spl ... in("-") | RegExpInjection.js:5:13:5:28 | req.param("key") | RegExpInjection.js:54:14:54:52 | key.spl ... in("-") | This regular expression depends on $@. | RegExpInjection.js:5:13:5:28 | req.param("key") | a user-provided value |
+| RegExpInjection.js:64:14:64:18 | input | RegExpInjection.js:60:39:60:56 | req.param("input") | RegExpInjection.js:64:14:64:18 | input | This regular expression depends on $@. | RegExpInjection.js:60:39:60:56 | req.param("input") | a user-provided value |
+| RegExpInjection.js:87:14:87:55 | "^.*\\.( ...  + ")$" | RegExpInjection.js:82:15:82:32 | req.param("input") | RegExpInjection.js:87:14:87:55 | "^.*\\.( ...  + ")$" | This regular expression depends on $@. | RegExpInjection.js:82:15:82:32 | req.param("input") | a user-provided value |
+| tst.js:3:16:3:35 | "^"+ data.name + "$" | tst.js:1:46:1:46 | e | tst.js:3:16:3:35 | "^"+ data.name + "$" | This regular expression depends on $@. | tst.js:1:46:1:46 | e | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-776/XmlBomb.expected b/javascript/ql/test/query-tests/Security/CWE-776/XmlBomb.expected
index 22968e7a3b1..02f6d4342da 100644
--- a/javascript/ql/test/query-tests/Security/CWE-776/XmlBomb.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-776/XmlBomb.expected
@@ -56,13 +56,13 @@ edges
 | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") |
 | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") |
 #select
-| closure.js:4:24:4:26 | src | closure.js:2:13:2:36 | documen ... .search | closure.js:4:24:4:26 | src | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | closure.js:2:13:2:36 | documen ... .search | user-provided value |
-| domparser.js:6:37:6:39 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:6:37:6:39 | src | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | domparser.js:2:13:2:36 | documen ... .search | user-provided value |
-| domparser.js:11:55:11:57 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:11:55:11:57 | src | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | domparser.js:2:13:2:36 | documen ... .search | user-provided value |
-| domparser.js:14:57:14:59 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:14:57:14:59 | src | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | domparser.js:2:13:2:36 | documen ... .search | user-provided value |
-| expat.js:6:16:6:36 | req.par ... e-xml") | expat.js:6:16:6:36 | req.par ... e-xml") | expat.js:6:16:6:36 | req.par ... e-xml") | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | expat.js:6:16:6:36 | req.par ... e-xml") | user-provided value |
-| jquery.js:5:14:5:16 | src | jquery.js:2:13:2:36 | documen ... .search | jquery.js:5:14:5:16 | src | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | jquery.js:2:13:2:36 | documen ... .search | user-provided value |
-| libxml.js:6:21:6:41 | req.par ... e-xml") | libxml.js:6:21:6:41 | req.par ... e-xml") | libxml.js:6:21:6:41 | req.par ... e-xml") | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | libxml.js:6:21:6:41 | req.par ... e-xml") | user-provided value |
-| libxml.noent.js:6:21:6:41 | req.par ... e-xml") | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | user-provided value |
-| libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | user-provided value |
-| libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | user-provided value |
+| closure.js:4:24:4:26 | src | closure.js:2:13:2:36 | documen ... .search | closure.js:4:24:4:26 | src | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | closure.js:2:13:2:36 | documen ... .search | a user-provided value |
+| domparser.js:6:37:6:39 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:6:37:6:39 | src | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | domparser.js:2:13:2:36 | documen ... .search | a user-provided value |
+| domparser.js:11:55:11:57 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:11:55:11:57 | src | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | domparser.js:2:13:2:36 | documen ... .search | a user-provided value |
+| domparser.js:14:57:14:59 | src | domparser.js:2:13:2:36 | documen ... .search | domparser.js:14:57:14:59 | src | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | domparser.js:2:13:2:36 | documen ... .search | a user-provided value |
+| expat.js:6:16:6:36 | req.par ... e-xml") | expat.js:6:16:6:36 | req.par ... e-xml") | expat.js:6:16:6:36 | req.par ... e-xml") | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | expat.js:6:16:6:36 | req.par ... e-xml") | a user-provided value |
+| jquery.js:5:14:5:16 | src | jquery.js:2:13:2:36 | documen ... .search | jquery.js:5:14:5:16 | src | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | jquery.js:2:13:2:36 | documen ... .search | a user-provided value |
+| libxml.js:6:21:6:41 | req.par ... e-xml") | libxml.js:6:21:6:41 | req.par ... e-xml") | libxml.js:6:21:6:41 | req.par ... e-xml") | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | libxml.js:6:21:6:41 | req.par ... e-xml") | a user-provided value |
+| libxml.noent.js:6:21:6:41 | req.par ... e-xml") | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | libxml.noent.js:6:21:6:41 | req.par ... e-xml") | a user-provided value |
+| libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | libxml.sax.js:6:22:6:42 | req.par ... e-xml") | a user-provided value |
+| libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | libxml.saxpush.js:6:15:6:35 | req.par ... e-xml") | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.expected b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.expected
index 7f1b07adbe4..9dda37bb055 100644
--- a/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-834/LoopBoundInjection.expected
@@ -82,12 +82,12 @@ edges
 | LoopBoundInjectionLodash.js:12:18:12:20 | val | LoopBoundInjectionLodash.js:13:13:13:15 | val |
 | LoopBoundInjectionLodash.js:12:18:12:20 | val | LoopBoundInjectionLodash.js:13:13:13:15 | val |
 #select
-| LoopBoundInjectionBad.js:20:25:20:27 | val | LoopBoundInjectionBad.js:8:13:8:20 | req.body | LoopBoundInjectionBad.js:20:25:20:27 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:8:13:8:20 | req.body | here |
-| LoopBoundInjectionBad.js:29:16:29:18 | val | LoopBoundInjectionBad.js:10:15:10:22 | req.body | LoopBoundInjectionBad.js:29:16:29:18 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:10:15:10:22 | req.body | here |
-| LoopBoundInjectionBad.js:38:15:38:17 | val | LoopBoundInjectionBad.js:12:25:12:32 | req.body | LoopBoundInjectionBad.js:38:15:38:17 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:12:25:12:32 | req.body | here |
-| LoopBoundInjectionBad.js:51:25:51:27 | val | LoopBoundInjectionBad.js:14:19:14:26 | req.body | LoopBoundInjectionBad.js:51:25:51:27 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:14:19:14:26 | req.body | here |
-| LoopBoundInjectionExitBad.js:20:22:20:24 | val | LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | LoopBoundInjectionExitBad.js:20:22:20:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | here |
-| LoopBoundInjectionExitBad.js:34:22:34:24 | val | LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | LoopBoundInjectionExitBad.js:34:22:34:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | here |
-| LoopBoundInjectionExitBad.js:49:22:49:24 | val | LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | LoopBoundInjectionExitBad.js:49:22:49:24 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | here |
-| LoopBoundInjectionExitBad.js:60:8:60:10 | val | LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | LoopBoundInjectionExitBad.js:60:8:60:10 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | here |
-| LoopBoundInjectionLodash.js:13:13:13:15 | val | LoopBoundInjectionLodash.js:9:13:9:20 | req.body | LoopBoundInjectionLodash.js:13:13:13:15 | val | Iterating over user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionLodash.js:9:13:9:20 | req.body | here |
+| LoopBoundInjectionBad.js:20:25:20:27 | val | LoopBoundInjectionBad.js:8:13:8:20 | req.body | LoopBoundInjectionBad.js:20:25:20:27 | val | Iteration over a user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:8:13:8:20 | req.body | a user-provided value |
+| LoopBoundInjectionBad.js:29:16:29:18 | val | LoopBoundInjectionBad.js:10:15:10:22 | req.body | LoopBoundInjectionBad.js:29:16:29:18 | val | Iteration over a user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:10:15:10:22 | req.body | a user-provided value |
+| LoopBoundInjectionBad.js:38:15:38:17 | val | LoopBoundInjectionBad.js:12:25:12:32 | req.body | LoopBoundInjectionBad.js:38:15:38:17 | val | Iteration over a user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:12:25:12:32 | req.body | a user-provided value |
+| LoopBoundInjectionBad.js:51:25:51:27 | val | LoopBoundInjectionBad.js:14:19:14:26 | req.body | LoopBoundInjectionBad.js:51:25:51:27 | val | Iteration over a user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionBad.js:14:19:14:26 | req.body | a user-provided value |
+| LoopBoundInjectionExitBad.js:20:22:20:24 | val | LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | LoopBoundInjectionExitBad.js:20:22:20:24 | val | Iteration over a user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:8:9:8:16 | req.body | a user-provided value |
+| LoopBoundInjectionExitBad.js:34:22:34:24 | val | LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | LoopBoundInjectionExitBad.js:34:22:34:24 | val | Iteration over a user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:10:9:10:16 | req.body | a user-provided value |
+| LoopBoundInjectionExitBad.js:49:22:49:24 | val | LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | LoopBoundInjectionExitBad.js:49:22:49:24 | val | Iteration over a user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:12:10:12:17 | req.body | a user-provided value |
+| LoopBoundInjectionExitBad.js:60:8:60:10 | val | LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | LoopBoundInjectionExitBad.js:60:8:60:10 | val | Iteration over a user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionExitBad.js:14:14:14:21 | req.body | a user-provided value |
+| LoopBoundInjectionLodash.js:13:13:13:15 | val | LoopBoundInjectionLodash.js:9:13:9:20 | req.body | LoopBoundInjectionLodash.js:13:13:13:15 | val | Iteration over a user-controlled object with a potentially unbounded .length property from $@. | LoopBoundInjectionLodash.js:9:13:9:20 | req.body | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-843/TypeConfusionThroughParameterTampering.expected b/javascript/ql/test/query-tests/Security/CWE-843/TypeConfusionThroughParameterTampering.expected
index 997d8968fcc..13c97e3f327 100644
--- a/javascript/ql/test/query-tests/Security/CWE-843/TypeConfusionThroughParameterTampering.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-843/TypeConfusionThroughParameterTampering.expected
@@ -16,10 +16,6 @@ nodes
 | tst.js:27:5:27:7 | foo |
 | tst.js:28:5:28:7 | foo |
 | tst.js:28:5:28:7 | foo |
-| tst.js:36:9:36:11 | foo |
-| tst.js:36:9:36:11 | foo |
-| tst.js:41:5:41:7 | foo |
-| tst.js:41:5:41:7 | foo |
 | tst.js:45:9:45:35 | foo |
 | tst.js:45:15:45:35 | ctx.req ... ery.foo |
 | tst.js:45:15:45:35 | ctx.req ... ery.foo |
@@ -38,12 +34,14 @@ nodes
 | tst.js:92:9:92:16 | data.foo |
 | tst.js:92:9:92:16 | data.foo |
 | tst.js:92:9:92:16 | data.foo |
-| tst.js:95:9:95:16 | data.foo |
-| tst.js:95:9:95:16 | data.foo |
-| tst.js:95:9:95:16 | data.foo |
 | tst.js:98:9:98:16 | data.foo |
 | tst.js:98:9:98:16 | data.foo |
 | tst.js:98:9:98:16 | data.foo |
+| tst.js:103:9:103:29 | data |
+| tst.js:103:16:103:29 | req.query.data |
+| tst.js:103:16:103:29 | req.query.data |
+| tst.js:104:5:104:8 | data |
+| tst.js:104:5:104:8 | data |
 edges
 | tst.js:5:9:5:27 | foo | tst.js:6:5:6:7 | foo |
 | tst.js:5:9:5:27 | foo | tst.js:6:5:6:7 | foo |
@@ -56,10 +54,6 @@ edges
 | tst.js:5:9:5:27 | foo | tst.js:27:5:27:7 | foo |
 | tst.js:5:9:5:27 | foo | tst.js:28:5:28:7 | foo |
 | tst.js:5:9:5:27 | foo | tst.js:28:5:28:7 | foo |
-| tst.js:5:9:5:27 | foo | tst.js:36:9:36:11 | foo |
-| tst.js:5:9:5:27 | foo | tst.js:36:9:36:11 | foo |
-| tst.js:5:9:5:27 | foo | tst.js:41:5:41:7 | foo |
-| tst.js:5:9:5:27 | foo | tst.js:41:5:41:7 | foo |
 | tst.js:5:15:5:27 | req.query.foo | tst.js:5:9:5:27 | foo |
 | tst.js:5:15:5:27 | req.query.foo | tst.js:5:9:5:27 | foo |
 | tst.js:14:16:14:18 | bar | tst.js:15:9:15:11 | bar |
@@ -77,8 +71,11 @@ edges
 | tst.js:80:23:80:23 | p | tst.js:82:9:82:9 | p |
 | tst.js:90:5:90:12 | data.foo | tst.js:90:5:90:12 | data.foo |
 | tst.js:92:9:92:16 | data.foo | tst.js:92:9:92:16 | data.foo |
-| tst.js:95:9:95:16 | data.foo | tst.js:95:9:95:16 | data.foo |
 | tst.js:98:9:98:16 | data.foo | tst.js:98:9:98:16 | data.foo |
+| tst.js:103:9:103:29 | data | tst.js:104:5:104:8 | data |
+| tst.js:103:9:103:29 | data | tst.js:104:5:104:8 | data |
+| tst.js:103:16:103:29 | req.query.data | tst.js:103:9:103:29 | data |
+| tst.js:103:16:103:29 | req.query.data | tst.js:103:9:103:29 | data |
 #select
 | tst.js:6:5:6:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:6:5:6:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
 | tst.js:8:5:8:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:8:5:8:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
@@ -86,12 +83,10 @@ edges
 | tst.js:15:9:15:11 | bar | tst.js:5:15:5:27 | req.query.foo | tst.js:15:9:15:11 | bar | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
 | tst.js:27:5:27:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:27:5:27:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
 | tst.js:28:5:28:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:28:5:28:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
-| tst.js:36:9:36:11 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:36:9:36:11 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
-| tst.js:41:5:41:7 | foo | tst.js:5:15:5:27 | req.query.foo | tst.js:41:5:41:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:5:15:5:27 | req.query.foo | this HTTP request parameter |
 | tst.js:46:5:46:7 | foo | tst.js:45:15:45:35 | ctx.req ... ery.foo | tst.js:46:5:46:7 | foo | Potential type confusion as $@ may be either an array or a string. | tst.js:45:15:45:35 | ctx.req ... ery.foo | this HTTP request parameter |
 | tst.js:81:9:81:9 | p | tst.js:77:25:77:38 | req.query.path | tst.js:81:9:81:9 | p | Potential type confusion as $@ may be either an array or a string. | tst.js:77:25:77:38 | req.query.path | this HTTP request parameter |
 | tst.js:82:9:82:9 | p | tst.js:77:25:77:38 | req.query.path | tst.js:82:9:82:9 | p | Potential type confusion as $@ may be either an array or a string. | tst.js:77:25:77:38 | req.query.path | this HTTP request parameter |
 | tst.js:90:5:90:12 | data.foo | tst.js:90:5:90:12 | data.foo | tst.js:90:5:90:12 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:90:5:90:12 | data.foo | this HTTP request parameter |
 | tst.js:92:9:92:16 | data.foo | tst.js:92:9:92:16 | data.foo | tst.js:92:9:92:16 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:92:9:92:16 | data.foo | this HTTP request parameter |
-| tst.js:95:9:95:16 | data.foo | tst.js:95:9:95:16 | data.foo | tst.js:95:9:95:16 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:95:9:95:16 | data.foo | this HTTP request parameter |
 | tst.js:98:9:98:16 | data.foo | tst.js:98:9:98:16 | data.foo | tst.js:98:9:98:16 | data.foo | Potential type confusion as $@ may be either an array or a string. | tst.js:98:9:98:16 | data.foo | this HTTP request parameter |
+| tst.js:104:5:104:8 | data | tst.js:103:16:103:29 | req.query.data | tst.js:104:5:104:8 | data | Potential type confusion as $@ may be either an array or a string. | tst.js:103:16:103:29 | req.query.data | this HTTP request parameter |
diff --git a/javascript/ql/test/query-tests/Security/CWE-843/tst.js b/javascript/ql/test/query-tests/Security/CWE-843/tst.js
index d49f7ce53d2..3f5840b9f08 100644
--- a/javascript/ql/test/query-tests/Security/CWE-843/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-843/tst.js
@@ -100,7 +100,8 @@ express().get('/foo', function (req, res) {
 });
 
 express().get('/foo', function (req, res) {
-    let data = req.query;
+    let data = req.query.data;
+    data.indexOf(); // NOT OK
     if (Array.isArray(data)) {
         data.indexOf(); // OK
     } else {
diff --git a/javascript/ql/test/query-tests/Security/CWE-912/HttpToFileAccess.expected b/javascript/ql/test/query-tests/Security/CWE-912/HttpToFileAccess.expected
index 53a6ddea6a5..5884bbc52f7 100644
--- a/javascript/ql/test/query-tests/Security/CWE-912/HttpToFileAccess.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-912/HttpToFileAccess.expected
@@ -29,7 +29,7 @@ edges
 | tst.js:15:26:15:26 | c | tst.js:24:22:24:22 | c |
 | tst.js:15:26:15:26 | c | tst.js:24:22:24:22 | c |
 #select
-| HttpToFileAccess.js:6:37:6:37 | d | HttpToFileAccess.js:5:18:5:18 | d | HttpToFileAccess.js:6:37:6:37 | d | $@ flows to file system | HttpToFileAccess.js:5:18:5:18 | d | Untrusted data |
-| tst.js:16:33:16:33 | c | tst.js:15:26:15:26 | c | tst.js:16:33:16:33 | c | $@ flows to file system | tst.js:15:26:15:26 | c | Untrusted data |
-| tst.js:19:25:19:25 | c | tst.js:15:26:15:26 | c | tst.js:19:25:19:25 | c | $@ flows to file system | tst.js:15:26:15:26 | c | Untrusted data |
-| tst.js:24:22:24:22 | c | tst.js:15:26:15:26 | c | tst.js:24:22:24:22 | c | $@ flows to file system | tst.js:15:26:15:26 | c | Untrusted data |
+| HttpToFileAccess.js:6:37:6:37 | d | HttpToFileAccess.js:5:18:5:18 | d | HttpToFileAccess.js:6:37:6:37 | d | $@ flows to file system. | HttpToFileAccess.js:5:18:5:18 | d | Untrusted data |
+| tst.js:16:33:16:33 | c | tst.js:15:26:15:26 | c | tst.js:16:33:16:33 | c | $@ flows to file system. | tst.js:15:26:15:26 | c | Untrusted data |
+| tst.js:19:25:19:25 | c | tst.js:15:26:15:26 | c | tst.js:19:25:19:25 | c | $@ flows to file system. | tst.js:15:26:15:26 | c | Untrusted data |
+| tst.js:24:22:24:22 | c | tst.js:15:26:15:26 | c | tst.js:24:22:24:22 | c | $@ flows to file system. | tst.js:15:26:15:26 | c | Untrusted data |
diff --git a/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/PrototypePollutingAssignment.expected b/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/PrototypePollutingAssignment.expected
index 662b3315c80..7705d224298 100644
--- a/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/PrototypePollutingAssignment.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/PrototypePollutingAssignment.expected
@@ -111,6 +111,12 @@ nodes
 | lib.js:119:13:119:24 | obj[path[0]] |
 | lib.js:119:17:119:20 | path |
 | lib.js:119:17:119:23 | path[0] |
+| lib.js:127:14:127:17 | path |
+| lib.js:127:14:127:17 | path |
+| lib.js:128:9:128:20 | obj[path[0]] |
+| lib.js:128:9:128:20 | obj[path[0]] |
+| lib.js:128:13:128:16 | path |
+| lib.js:128:13:128:19 | path[0] |
 | sublib/sub.js:1:37:1:40 | path |
 | sublib/sub.js:1:37:1:40 | path |
 | sublib/sub.js:2:3:2:14 | obj[path[0]] |
@@ -165,6 +171,13 @@ nodes
 | tst.js:97:9:97:19 | req.query.x |
 | tst.js:97:9:97:19 | req.query.x |
 | tst.js:97:9:97:45 | req.que ... /g, '') |
+| tst.js:102:9:102:38 | taint |
+| tst.js:102:17:102:38 | String( ... y.data) |
+| tst.js:102:24:102:37 | req.query.data |
+| tst.js:102:24:102:37 | req.query.data |
+| tst.js:105:5:105:17 | object[taint] |
+| tst.js:105:5:105:17 | object[taint] |
+| tst.js:105:12:105:16 | taint |
 edges
 | lib.js:1:38:1:40 | obj | lib.js:6:7:6:9 | obj |
 | lib.js:1:38:1:40 | obj | lib.js:6:7:6:9 | obj |
@@ -269,6 +282,11 @@ edges
 | lib.js:119:17:119:20 | path | lib.js:119:17:119:23 | path[0] |
 | lib.js:119:17:119:23 | path[0] | lib.js:119:13:119:24 | obj[path[0]] |
 | lib.js:119:17:119:23 | path[0] | lib.js:119:13:119:24 | obj[path[0]] |
+| lib.js:127:14:127:17 | path | lib.js:128:13:128:16 | path |
+| lib.js:127:14:127:17 | path | lib.js:128:13:128:16 | path |
+| lib.js:128:13:128:16 | path | lib.js:128:13:128:19 | path[0] |
+| lib.js:128:13:128:19 | path[0] | lib.js:128:9:128:20 | obj[path[0]] |
+| lib.js:128:13:128:19 | path[0] | lib.js:128:9:128:20 | obj[path[0]] |
 | sublib/sub.js:1:37:1:40 | path | sublib/sub.js:2:7:2:10 | path |
 | sublib/sub.js:1:37:1:40 | path | sublib/sub.js:2:7:2:10 | path |
 | sublib/sub.js:2:7:2:10 | path | sublib/sub.js:2:7:2:13 | path[0] |
@@ -318,6 +336,12 @@ edges
 | tst.js:97:9:97:19 | req.query.x | tst.js:97:9:97:45 | req.que ... /g, '') |
 | tst.js:97:9:97:45 | req.que ... /g, '') | tst.js:97:5:97:46 | obj[req ... g, '')] |
 | tst.js:97:9:97:45 | req.que ... /g, '') | tst.js:97:5:97:46 | obj[req ... g, '')] |
+| tst.js:102:9:102:38 | taint | tst.js:105:12:105:16 | taint |
+| tst.js:102:17:102:38 | String( ... y.data) | tst.js:102:9:102:38 | taint |
+| tst.js:102:24:102:37 | req.query.data | tst.js:102:17:102:38 | String( ... y.data) |
+| tst.js:102:24:102:37 | req.query.data | tst.js:102:17:102:38 | String( ... y.data) |
+| tst.js:105:12:105:16 | taint | tst.js:105:5:105:17 | object[taint] |
+| tst.js:105:12:105:16 | taint | tst.js:105:5:105:17 | object[taint] |
 #select
 | lib.js:6:7:6:9 | obj | lib.js:1:43:1:46 | path | lib.js:6:7:6:9 | obj | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:1:43:1:46 | path | library input |
 | lib.js:15:3:15:14 | obj[path[0]] | lib.js:14:38:14:41 | path | lib.js:15:3:15:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:14:38:14:41 | path | library input |
@@ -329,6 +353,7 @@ edges
 | lib.js:87:10:87:14 | proto | lib.js:83:14:83:22 | arguments | lib.js:87:10:87:14 | proto | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:83:14:83:22 | arguments | library input |
 | lib.js:108:3:108:10 | obj[one] | lib.js:104:13:104:21 | arguments | lib.js:108:3:108:10 | obj[one] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:104:13:104:21 | arguments | library input |
 | lib.js:119:13:119:24 | obj[path[0]] | lib.js:118:29:118:32 | path | lib.js:119:13:119:24 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:118:29:118:32 | path | library input |
+| lib.js:128:9:128:20 | obj[path[0]] | lib.js:127:14:127:17 | path | lib.js:128:9:128:20 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:127:14:127:17 | path | library input |
 | sublib/sub.js:2:3:2:14 | obj[path[0]] | sublib/sub.js:1:37:1:40 | path | sublib/sub.js:2:3:2:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | sublib/sub.js:1:37:1:40 | path | library input |
 | tst.js:8:5:8:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:8:5:8:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
 | tst.js:9:5:9:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:9:5:9:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
@@ -342,3 +367,4 @@ edges
 | tst.js:87:9:87:21 | object[taint] | tst.js:77:24:77:37 | req.query.data | tst.js:87:9:87:21 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:77:24:77:37 | req.query.data | user controlled input |
 | tst.js:94:5:94:37 | obj[req ... ', '')] | tst.js:94:9:94:19 | req.query.x | tst.js:94:5:94:37 | obj[req ... ', '')] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:94:9:94:19 | req.query.x | user controlled input |
 | tst.js:97:5:97:46 | obj[req ... g, '')] | tst.js:97:9:97:19 | req.query.x | tst.js:97:5:97:46 | obj[req ... g, '')] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:97:9:97:19 | req.query.x | user controlled input |
+| tst.js:105:5:105:17 | object[taint] | tst.js:102:24:102:37 | req.query.data | tst.js:105:5:105:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:102:24:102:37 | req.query.data | user controlled input |
diff --git a/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/lib.js b/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/lib.js
index b65f6fb3c1f..fb550533d12 100644
--- a/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/lib.js
+++ b/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/lib.js
@@ -119,4 +119,19 @@ module.exports.returnsObj = function () {
             obj[path[0]][path[1]] = value; // NOT OK
         }
     }
+}
+
+class MyClass {
+    constructor() {}
+
+    set(obj, path, value) {
+        obj[path[0]][path[1]] = value; // NOT OK
+    }
+
+    static staticSet(obj, path, value) {
+        obj[path[0]][path[1]] = value; // OK - not exported
+    }
+}
+module.exports.returnsMewMyClass = function () {
+    return new MyClass();
 }
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/tst.js b/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/tst.js
index 61e2ff7300b..517d7d10230 100644
--- a/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/tst.js
@@ -97,3 +97,17 @@ app.get('/foo', (req, res) => {
     obj[req.query.x.replace(/__proto__/g, '')].x = 'foo'; // NOT OK - "__pr__proto__oto__"
     obj[req.query.x.replace('o', '0')].x = 'foo'; // OK
 });
+
+app.get('/bar', (req, res) => {
+    let taint = String(req.query.data);
+
+    let object = {};
+    object[taint][taint] = taint; // NOT OK
+    
+    const bad = ["__proto__", "constructor"];
+    if (bad.includes(taint)) {
+        return;
+    }
+
+    object[taint][taint] = taint; // OK
+});
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Statements/NestedLoopsSameVariable/NestedLoopsSameVariable.expected b/javascript/ql/test/query-tests/Statements/NestedLoopsSameVariable/NestedLoopsSameVariable.expected
index 7efbbd3bfd3..3b56bbcfc44 100644
--- a/javascript/ql/test/query-tests/Statements/NestedLoopsSameVariable/NestedLoopsSameVariable.expected
+++ b/javascript/ql/test/query-tests/Statements/NestedLoopsSameVariable/NestedLoopsSameVariable.expected
@@ -1 +1 @@
-| tst.js:3:16:3:18 | i>5 | This for statement uses the same loop variable as an enclosing $@. | tst.js:1:1:9:1 | for (va ... , k);\\n} | for statement |
+| tst.js:3:16:3:18 | i>5 | Nested for statement uses loop variable $@ of enclosing $@. | tst.js:3:23:3:23 | i | i | tst.js:1:1:9:1 | for (va ... , k);\\n} | for statement |
diff --git a/javascript/ql/test/tutorials/Introducing the JavaScript libraries/query20.qll b/javascript/ql/test/tutorials/Introducing the JavaScript libraries/query20.qll
index 86c7ab712c5..7b8b7843fc8 100644
--- a/javascript/ql/test/tutorials/Introducing the JavaScript libraries/query20.qll	
+++ b/javascript/ql/test/tutorials/Introducing the JavaScript libraries/query20.qll	
@@ -1,5 +1,5 @@
 import javascript
 
 query predicate test_query20(SQL::SqlString ss, string res) {
-  ss instanceof AddExpr and res = "Use templating instead of string concatenation."
+  ss.asExpr() instanceof AddExpr and res = "Use templating instead of string concatenation."
 }
diff --git a/javascript/ql/test/tutorials/Validating RAML-based APIs/RAML.qll b/javascript/ql/test/tutorials/Validating RAML-based APIs/RAML.qll
index 1156ea4c398..a871d5e751e 100644
--- a/javascript/ql/test/tutorials/Validating RAML-based APIs/RAML.qll	
+++ b/javascript/ql/test/tutorials/Validating RAML-based APIs/RAML.qll	
@@ -3,7 +3,7 @@ import javascript
 import HTTP
 
 /** A RAML specification. */
-class RamlSpec extends YAMLDocument, YAMLMapping {
+class RamlSpec extends YamlDocument, YamlMapping {
   RamlSpec() { getLocation().getFile().getExtension() = "raml" }
 }
 
@@ -11,10 +11,10 @@ class RamlSpec extends YAMLDocument, YAMLMapping {
 deprecated class RAMLSpec = RamlSpec;
 
 /** A RAML resource specification. */
-class RamlResource extends YAMLMapping {
+class RamlResource extends YamlMapping {
   RamlResource() {
     getDocument() instanceof RamlSpec and
-    exists(YAMLMapping m, string name |
+    exists(YamlMapping m, string name |
       this = m.lookup(name) and
       name.matches("/%")
     )
@@ -41,16 +41,16 @@ class RamlResource extends YAMLMapping {
 deprecated class RAMLResource = RamlResource;
 
 /** A RAML method specification. */
-class RamlMethod extends YAMLValue {
+class RamlMethod extends YamlValue {
   RamlMethod() {
     getDocument() instanceof RamlSpec and
-    exists(YAMLMapping obj | this = obj.lookup(httpVerb()))
+    exists(YamlMapping obj | this = obj.lookup(httpVerb()))
   }
 
   /** Get the response specification for the given status code. */
-  YAMLValue getResponse(int code) {
-    exists(YAMLMapping obj, string s |
-      obj = this.(YAMLMapping).lookup("responses") and
+  YamlValue getResponse(int code) {
+    exists(YamlMapping obj, string s |
+      obj = this.(YamlMapping).lookup("responses") and
       result = obj.lookup(s) and
       code = s.toInt()
     )
diff --git a/javascript/ql/test/tutorials/Validating RAML-based APIs/query1.ql b/javascript/ql/test/tutorials/Validating RAML-based APIs/query1.ql
index a20fd7f18f1..6a5c8cf71cb 100644
--- a/javascript/ql/test/tutorials/Validating RAML-based APIs/query1.ql	
+++ b/javascript/ql/test/tutorials/Validating RAML-based APIs/query1.ql	
@@ -1,7 +1,7 @@
 import javascript
 
 /** A RAML specification. */
-class RamlSpec extends YAMLDocument, YAMLMapping {
+class RamlSpec extends YamlDocument, YamlMapping {
   RamlSpec() { getLocation().getFile().getExtension() = "raml" }
 }
 
diff --git a/javascript/ql/test/tutorials/Validating RAML-based APIs/query2.ql b/javascript/ql/test/tutorials/Validating RAML-based APIs/query2.ql
index e0230cbfdb0..47e264001e4 100644
--- a/javascript/ql/test/tutorials/Validating RAML-based APIs/query2.ql	
+++ b/javascript/ql/test/tutorials/Validating RAML-based APIs/query2.ql	
@@ -3,15 +3,15 @@ import javascript
 string httpVerb() { result = ["get", "put", "post", "delete"] }
 
 /** A RAML specification. */
-class RamlSpec extends YAMLDocument, YAMLMapping {
+class RamlSpec extends YamlDocument, YamlMapping {
   RamlSpec() { getLocation().getFile().getExtension() = "raml" }
 }
 
 /** A RAML resource specification. */
-class RamlResource extends YAMLMapping {
+class RamlResource extends YamlMapping {
   RamlResource() {
     getDocument() instanceof RamlSpec and
-    exists(YAMLMapping m, string name |
+    exists(YamlMapping m, string name |
       this = m.lookup(name) and
       name.matches("/%")
     )
@@ -35,16 +35,16 @@ class RamlResource extends YAMLMapping {
 }
 
 /** A RAML method specification. */
-class RamlMethod extends YAMLValue {
+class RamlMethod extends YamlValue {
   RamlMethod() {
     getDocument() instanceof RamlSpec and
-    exists(YAMLMapping obj | this = obj.lookup(httpVerb()))
+    exists(YamlMapping obj | this = obj.lookup(httpVerb()))
   }
 
   /** Get the response specification for the given status code. */
-  YAMLValue getResponse(int code) {
-    exists(YAMLMapping obj, string s |
-      obj = this.(YAMLMapping).lookup("responses") and
+  YamlValue getResponse(int code) {
+    exists(YamlMapping obj, string s |
+      obj = this.(YamlMapping).lookup("responses") and
       result = obj.lookup(s) and
       code = s.toInt()
     )
diff --git a/javascript/ql/test/tutorials/Validating RAML-based APIs/query3.ql b/javascript/ql/test/tutorials/Validating RAML-based APIs/query3.ql
index 60ee68a8369..12e38689590 100644
--- a/javascript/ql/test/tutorials/Validating RAML-based APIs/query3.ql	
+++ b/javascript/ql/test/tutorials/Validating RAML-based APIs/query3.ql	
@@ -3,15 +3,15 @@ import javascript
 string httpVerb() { result = ["get", "put", "post", "delete"] }
 
 /** A RAML specification. */
-class RamlSpec extends YAMLDocument, YAMLMapping {
+class RamlSpec extends YamlDocument, YamlMapping {
   RamlSpec() { getLocation().getFile().getExtension() = "raml" }
 }
 
 /** A RAML resource specification. */
-class RamlResource extends YAMLMapping {
+class RamlResource extends YamlMapping {
   RamlResource() {
     getDocument() instanceof RamlSpec and
-    exists(YAMLMapping m, string name |
+    exists(YamlMapping m, string name |
       this = m.lookup(name) and
       name.matches("/%")
     )
@@ -34,10 +34,10 @@ class RamlResource extends YAMLMapping {
   }
 }
 
-class RamlMethod extends YAMLValue {
+class RamlMethod extends YamlValue {
   RamlMethod() {
     getDocument() instanceof RamlSpec and
-    exists(YAMLMapping obj | this = obj.lookup(httpVerb()))
+    exists(YamlMapping obj | this = obj.lookup(httpVerb()))
   }
 }
 
diff --git a/javascript/ql/test/tutorials/Validating RAML-based APIs/query4.ql b/javascript/ql/test/tutorials/Validating RAML-based APIs/query4.ql
index 0cabb0adb25..fe3986d2763 100644
--- a/javascript/ql/test/tutorials/Validating RAML-based APIs/query4.ql	
+++ b/javascript/ql/test/tutorials/Validating RAML-based APIs/query4.ql	
@@ -3,15 +3,15 @@ import javascript
 string httpVerb() { result = ["get", "put", "post", "delete"] }
 
 /** A RAML specification. */
-class RamlSpec extends YAMLDocument, YAMLMapping {
+class RamlSpec extends YamlDocument, YamlMapping {
   RamlSpec() { getLocation().getFile().getExtension() = "raml" }
 }
 
 /** A RAML resource specification. */
-class RamlResource extends YAMLMapping {
+class RamlResource extends YamlMapping {
   RamlResource() {
     getDocument() instanceof RamlSpec and
-    exists(YAMLMapping m, string name |
+    exists(YamlMapping m, string name |
       this = m.lookup(name) and
       name.matches("/%")
     )
@@ -35,16 +35,16 @@ class RamlResource extends YAMLMapping {
 }
 
 /** A RAML method specification. */
-class RamlMethod extends YAMLValue {
+class RamlMethod extends YamlValue {
   RamlMethod() {
     getDocument() instanceof RamlSpec and
-    exists(YAMLMapping obj | this = obj.lookup(httpVerb()))
+    exists(YamlMapping obj | this = obj.lookup(httpVerb()))
   }
 
   /** Get the response specification for the given status code. */
-  YAMLValue getResponse(int code) {
-    exists(YAMLMapping obj, string s |
-      obj = this.(YAMLMapping).lookup("responses") and
+  YamlValue getResponse(int code) {
+    exists(YamlMapping obj, string s |
+      obj = this.(YamlMapping).lookup("responses") and
       result = obj.lookup(s) and
       code = s.toInt()
     )
diff --git a/misc/bazel/workspace.bzl b/misc/bazel/workspace.bzl
index 7b89bff5693..3231cd4eaa6 100644
--- a/misc/bazel/workspace.bzl
+++ b/misc/bazel/workspace.bzl
@@ -26,6 +26,14 @@ def codeql_workspace(repository_name = "codeql"):
             sha256 = sha256,
         )
 
+    http_archive(
+        name = "fishhook",
+        url = "https://github.com/facebook/fishhook/archive/aadc161ac3b80db07a9908851839a17ba63a9eb1.zip",
+        build_file = "@%s//swift/tools/fishhook:BUILD.fishhook.bazel" % repository_name,
+        strip_prefix = "fishhook-aadc161ac3b80db07a9908851839a17ba63a9eb1",
+        sha256 = "9f2cdee6dcc2039d4c47d25ab5141fe0678ce6ed27ef482cab17fe9fa38a30ce",
+    )
+
     maybe(
         repo_rule = http_archive,
         name = "rules_pkg",
diff --git a/misc/scripts/models-as-data/generate_flow_model.py b/misc/scripts/models-as-data/generate_flow_model.py
index 016b97950b4..bb46565ea3b 100644
--- a/misc/scripts/models-as-data/generate_flow_model.py
+++ b/misc/scripts/models-as-data/generate_flow_model.py
@@ -15,12 +15,13 @@ class Generator:
         self.generateSources = False
         self.generateSummaries = False
         self.generateNegativeSummaries = False
+        self.generateTypeBasedSummaries = False
         self.dryRun = False
 
 
     def printHelp(self):
         print(f"""Usage:
-python3 GenerateFlowModel.py <library-database> <outputQll> [--with-sinks] [--with-sources] [--with-summaries] [--dry-run]
+python3 GenerateFlowModel.py <library-database> <outputQll> [<friendlyFrameworkName>] [--with-sinks] [--with-sources] [--with-summaries] [--with-typebased-summaries] [--dry-run]
 
 This generates summary, source and sink models for the code in the database.
 The files will be placed in `{self.language}/ql/lib/semmle/code/{self.language}/frameworks/<outputQll>` where
@@ -33,30 +34,37 @@ Which models are generated is controlled by the flags:
     --with-sources
     --with-summaries
     --with-negative-summaries
+    --with-typebased-summaries (Experimental - only for C#)
 If none of these flags are specified, all models are generated.
 
     --dry-run: Only run the queries, but don't write to file.
 
 Example invocations:
 $ python3 GenerateFlowModel.py /tmp/dbs/my_library_db "mylibrary/Framework.qll"
+$ python3 GenerateFlowModel.py /tmp/dbs/my_library_db "mylibrary/Framework.qll" "Friendly Name of Framework"
 $ python3 GenerateFlowModel.py /tmp/dbs/my_library_db "mylibrary/FrameworkSinks.qll" --with-sinks
 
 Requirements: `codeql` should both appear on your path.
     """)
 
 
-    def setenvironment(self, target, database):
+    def setenvironment(self, target, database, friendlyName):
         self.codeQlRoot = subprocess.check_output(["git", "rev-parse", "--show-toplevel"]).decode("utf-8").strip()
         if not target.endswith(".qll"):
             target += ".qll"
         filename = os.path.basename(target)
         dirname = os.path.dirname(target)
+        if friendlyName is not None:
+            self.friendlyname = friendlyName
+        else:
+            self.friendlyname = filename[:-4]
         self.shortname = filename[:-4]
         self.database = database
         self.generatedFrameworks = os.path.join(
             self.codeQlRoot, f"{self.language}/ql/lib/semmle/code/{self.language}/frameworks/")
         self.frameworkTarget = os.path.join(self.generatedFrameworks, dirname, filename)
         self.negativeFrameworkTarget = os.path.join(self.generatedFrameworks, dirname, "Negative" + filename)
+        self.typeBasedFrameworkTarget = os.path.join(self.generatedFrameworks, dirname, "TypeBased" + filename)
 
         self.workDir = tempfile.mkdtemp()
         os.makedirs(self.generatedFrameworks, exist_ok=True)
@@ -85,18 +93,26 @@ Requirements: `codeql` should both appear on your path.
             sys.argv.remove("--with-negative-summaries")
             generator.generateNegativeSummaries = True
 
+        if "--with-typebased-summaries" in sys.argv:
+            sys.argv.remove("--with-typebased-summaries")
+            generator.generateTypeBasedSummaries = True
+
         if "--dry-run" in sys.argv:
             sys.argv.remove("--dry-run")
             generator.dryRun = True
 
-        if not generator.generateSinks and not generator.generateSources and not generator.generateSummaries and not generator.generateNegativeSummaries:
+        if not generator.generateSinks and not generator.generateSources and not generator.generateSummaries and not generator.generateNegativeSummaries and not generator.generateTypeBasedSummaries:
             generator.generateSinks = generator.generateSources = generator.generateSummaries = generator.generateNegativeSummaries = True
 
-        if len(sys.argv) != 3:
+        if len(sys.argv) < 3 or len(sys.argv) > 4:
             generator.printHelp()
             sys.exit(1)
-        
-        generator.setenvironment(sys.argv[2], sys.argv[1])
+
+        friendlyName = None
+        if len(sys.argv) == 4:
+            friendlyName = sys.argv[3]
+
+        generator.setenvironment(sys.argv[2], sys.argv[1], friendlyName)
         return generator
 
 
@@ -178,7 +194,7 @@ private class {0}{1}Csv extends {2} {{
         return f"""
 /** 
  * THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
- * Definitions of taint steps in the {self.shortname} framework.
+ * Definitions of taint steps in the {self.friendlyname} framework.
  */
 
 import {self.language}
@@ -198,9 +214,9 @@ private import semmle.code.{self.language}.dataflow.ExternalFlow
             negativeSummaryCsv = ""
 
         return f"""
-/** 
+/**
  * THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
- * Definitions of negative summaries in the {self.shortname} framework.
+ * Definitions of negative summaries in the {self.friendlyname} framework.
  */
 
 import {self.language}
@@ -210,6 +226,25 @@ private import semmle.code.{self.language}.dataflow.ExternalFlow
 
         """
 
+    def makeTypeBasedContent(self):
+        if self.generateTypeBasedSummaries:
+            typeBasedSummaryRows = self.runQuery("type based summary models", "CaptureTypeBasedSummaryModels.ql")
+            typeBasedSummaryCsv = self.asCsvModel("SummaryModelCsv", "TypeBasedSummary", typeBasedSummaryRows)
+        else:
+            typeBasedSummaryCsv = ""
+
+        return f"""
+/**
+ * THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+ * Definitions of type based summaries in the {self.friendlyname} framework.
+ */
+
+import {self.language}
+private import semmle.code.{self.language}.dataflow.ExternalFlow
+
+{typeBasedSummaryCsv}
+
+        """
 
     def save(self, content, target):
         with open(target, "w") as targetQll:
@@ -228,6 +263,7 @@ private import semmle.code.{self.language}.dataflow.ExternalFlow
     def run(self):
         content = self.makeContent()
         negativeContent = self.makeNegativeContent()
+        typeBasedContent = self.makeTypeBasedContent()
 
         if self.dryRun:
             print("CSV Models generated, but not written to file.")
@@ -238,3 +274,6 @@ private import semmle.code.{self.language}.dataflow.ExternalFlow
 
         if self.generateNegativeSummaries:
             self.save(negativeContent, self.negativeFrameworkTarget)
+
+        if self.generateTypeBasedSummaries:
+            self.save(typeBasedContent, self.typeBasedFrameworkTarget)
diff --git a/python/ql/lib/change-notes/2022-08-25-variable-fix.md b/python/ql/lib/change-notes/2022-08-25-variable-fix.md
new file mode 100644
index 00000000000..13ed77cb314
--- /dev/null
+++ b/python/ql/lib/change-notes/2022-08-25-variable-fix.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Reads of global/non-local variables (without annotations) inside functions defined on classes now works properly in the case where the class had an attribute defined with the same name as the non-local variable.
diff --git a/python/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md b/python/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md
new file mode 100644
index 00000000000..efdaf85f2ed
--- /dev/null
+++ b/python/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed an issue in the taint tracking analysis where implicit reads were not allowed by default in sinks or additional taint steps that used flow states.
\ No newline at end of file
diff --git a/python/ql/lib/change-notes/2022-09-12-CallNode-getArgByName.md b/python/ql/lib/change-notes/2022-09-12-CallNode-getArgByName.md
new file mode 100644
index 00000000000..4bcde8386a8
--- /dev/null
+++ b/python/ql/lib/change-notes/2022-09-12-CallNode-getArgByName.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Changed `CallNode.getArgByName` such that it has results for keyword arguments given after a dictionary unpacking argument, as the `bar=2` argument in `func(foo=1, **kwargs, bar=2)`.
diff --git a/python/ql/lib/change-notes/2022-09-12-deprecate-pointsto.md b/python/ql/lib/change-notes/2022-09-12-deprecate-pointsto.md
new file mode 100644
index 00000000000..e3b67321a40
--- /dev/null
+++ b/python/ql/lib/change-notes/2022-09-12-deprecate-pointsto.md
@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* Some unused predicates in `SsaDefinitions.qll`, `TObject.qll`, `protocols.qll`, and the `pointsto/` folder have been deprecated.
\ No newline at end of file
diff --git a/python/ql/lib/change-notes/2022-09-12-uppercase.md b/python/ql/lib/change-notes/2022-09-12-uppercase.md
new file mode 100644
index 00000000000..996861f1c2c
--- /dev/null
+++ b/python/ql/lib/change-notes/2022-09-12-uppercase.md
@@ -0,0 +1,5 @@
+---
+category: deprecated
+---
+* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
+  The old name still exists as a deprecated alias.
\ No newline at end of file
diff --git a/python/ql/lib/design.md b/python/ql/lib/design.md
new file mode 100644
index 00000000000..a390f50beee
--- /dev/null
+++ b/python/ql/lib/design.md
@@ -0,0 +1,24 @@
+# The Python libraries
+
+The Python libraries are a collection of libraries for analysing Python code.
+Everythng can be imported by importing `python.qll`.
+
+## The analysis layers
+
+The analysis is built up in layers. the stack looks like this:
+
+- AST (coms from the extractor)
+- Control flow graph (CFG) (built by the extractor)
+- SSA
+- Call graph
+- Data flow
+
+## Avoiding non-monotonic recursion
+
+Given the many interactivg layers, it is imprtant to decie which predicates are allowed to be mutually recursive in order to avoid non-monotonic recursion when negation is used to express the predicates.
+As an example, we have defined local source as those whcih do not receive local flow. This means that the local flow relation is not allowed to be recursive with anything depending on local sources.
+
+Some particular reatrictions to keep in mind:
+
+- Typetracking needs to use a local flow step not including summaries
+- Typetracking needs to use a call graph not including summaries
diff --git a/python/ql/lib/semmle/python/ApiGraphs.qll b/python/ql/lib/semmle/python/ApiGraphs.qll
index 066dd0ce7d4..786d45e4d8e 100644
--- a/python/ql/lib/semmle/python/ApiGraphs.qll
+++ b/python/ql/lib/semmle/python/ApiGraphs.qll
@@ -380,6 +380,21 @@ module API {
     not m.matches("%.%")
   }
 
+  /**
+   * Holds if an import of module `m` exists.
+   *
+   * This is determined without referring to `Node`,
+   * allowing this predicate to be used in a negative
+   * context when constructing new nodes.
+   */
+  predicate moduleImportExists(string m) {
+    Impl::isImported(m) and
+    // restrict `moduleImport` so it will never give results for a dotted name. Note
+    // that we cannot move this logic to the `MkModuleImport` construction, since we
+    // need the intermediate API graph nodes for the prefixes in `import foo.bar.baz`.
+    not m.matches("%.%")
+  }
+
   /** Gets a node corresponding to the built-in with the given name, if any. */
   Node builtin(string n) { result = moduleImport("builtins").getMember(n) }
 
@@ -453,6 +468,30 @@ module API {
     int getNumArgument() { result = count(this.getArg(_)) }
   }
 
+  /**
+   * An API entry point.
+   *
+   * By default, API graph nodes are only created for nodes that come from an external
+   * library or escape into an external library. The points where values are cross the boundary
+   * between codebases are called "entry points".
+   *
+   * Anything imported from an external package is considered to be an entry point, but
+   * additional entry points may be added by extending this class.
+   */
+  abstract class EntryPoint extends string {
+    bindingset[this]
+    EntryPoint() { any() }
+
+    /** Gets a data-flow node corresponding to a use-node for this entry point. */
+    DataFlow::LocalSourceNode getASource() { none() }
+
+    /** Gets a data-flow node corresponding to a def-node for this entry point. */
+    DataFlow::Node getASink() { none() }
+
+    /** Gets an API-node for this entry point. */
+    API::Node getANode() { result = root().getASuccessor(Label::entryPoint(this)) }
+  }
+
   /**
    * Provides the actual implementation of API graphs, cached for performance.
    *
@@ -581,14 +620,38 @@ module API {
      *
      * Ignores relative imports, such as `from ..foo.bar import baz`.
      */
-    private predicate imports(DataFlow::Node imp, string name) {
+    private predicate imports(DataFlow::CfgNode imp, string name) {
       exists(PY::ImportExprNode iexpr |
-        imp.asCfgNode() = iexpr and
+        imp.getNode() = iexpr and
         not iexpr.getNode().isRelative() and
         name = iexpr.getNode().getImportedModuleName()
       )
     }
 
+    /**
+     * Holds if the module `name` is imported.
+     *
+     * This is determined syntactically.
+     */
+    cached
+    predicate isImported(string name) {
+      // Ignore the following module name for Python 2, as we alias `__builtin__` to `builtins` elsewhere
+      (name != "__builtin__" or PY::major_version() = 3) and
+      (
+        exists(PY::ImportExpr iexpr |
+          not iexpr.isRelative() and
+          name = iexpr.getImportedModuleName()
+        )
+        or
+        // When we `import foo.bar.baz` we want to create API graph nodes also for the prefixes
+        // `foo` and `foo.bar`:
+        name = any(PY::ImportExpr e | not e.isRelative()).getAnImportedModuleName()
+      )
+      or
+      // The `builtins` module should always be implicitly available
+      name = "builtins"
+    }
+
     private import semmle.python.dataflow.new.internal.Builtins
     private import semmle.python.dataflow.new.internal.ImportStar
 
@@ -607,7 +670,7 @@ module API {
      */
     private TApiNode potential_import_star_base(PY::Scope s) {
       exists(DataFlow::Node n |
-        n.asCfgNode() = ImportStar::potentialImportStarBase(s) and
+        n.(DataFlow::CfgNode).getNode() = ImportStar::potentialImportStarBase(s) and
         use(result, n)
       )
     }
@@ -629,17 +692,17 @@ module API {
         or
         // TODO: I had expected `DataFlow::AttrWrite` to contain the attribute writes from a dict, that's how JS works.
         exists(PY::Dict dict, PY::KeyValuePair item |
-          dict = pred.asExpr() and
+          dict = pred.(DataFlow::ExprNode).getNode().getNode() and
           dict.getItem(_) = item and
           lbl = Label::member(item.getKey().(PY::StrConst).getS()) and
-          rhs.asExpr() = item.getValue()
+          rhs.(DataFlow::ExprNode).getNode().getNode() = item.getValue()
         )
         or
-        exists(PY::CallableExpr fn | fn = pred.asExpr() |
+        exists(PY::CallableExpr fn | fn = pred.(DataFlow::ExprNode).getNode().getNode() |
           not fn.getInnerScope().isAsync() and
           lbl = Label::return() and
           exists(PY::Return ret |
-            rhs.asExpr() = ret.getValue() and
+            rhs.(DataFlow::ExprNode).getNode().getNode() = ret.getValue() and
             ret.getScope() = fn.getInnerScope()
           )
         )
@@ -652,6 +715,12 @@ module API {
       |
         lbl = Label::memberFromRef(aw)
       )
+      or
+      exists(EntryPoint entry |
+        base = root() and
+        lbl = Label::entryPoint(entry) and
+        rhs = entry.getASink()
+      )
     }
 
     /**
@@ -686,9 +755,9 @@ module API {
           // "benign" and let subclasses edges flow through anyway.
           // see example in https://github.com/django/django/blob/c2250cfb80e27cdf8d098428824da2800a18cadf/tests/auth_tests/test_views.py#L40-L46
           (
-            ref.asExpr() = clsExpr
+            ref.(DataFlow::ExprNode).getNode().getNode() = clsExpr
             or
-            ref.asExpr() = clsExpr.getADecoratorCall()
+            ref.(DataFlow::ExprNode).getNode().getNode() = clsExpr.getADecoratorCall()
           )
         )
         or
@@ -701,7 +770,7 @@ module API {
       )
       or
       exists(DataFlow::Node def, PY::CallableExpr fn |
-        rhs(base, def) and fn = trackDefNode(def).asExpr()
+        rhs(base, def) and fn = trackDefNode(def).(DataFlow::ExprNode).getNode().getNode()
       |
         exists(int i, int offset |
           if exists(PY::Parameter p | p = fn.getInnerScope().getAnArg() and p.isSelf())
@@ -709,18 +778,19 @@ module API {
           else offset = 0
         |
           lbl = Label::parameter(i - offset) and
-          ref.asExpr() = fn.getInnerScope().getArg(i)
+          ref.(DataFlow::ExprNode).getNode().getNode() = fn.getInnerScope().getArg(i)
         )
         or
         exists(string name, PY::Parameter param |
           lbl = Label::keywordParameter(name) and
           param = fn.getInnerScope().getArgByName(name) and
           not param.isSelf() and
-          ref.asExpr() = param
+          ref.(DataFlow::ExprNode).getNode().getNode() = param
         )
         or
         lbl = Label::selfParameter() and
-        ref.asExpr() = any(PY::Parameter p | p = fn.getInnerScope().getAnArg() and p.isSelf())
+        ref.(DataFlow::ExprNode).getNode().getNode() =
+          any(PY::Parameter p | p = fn.getInnerScope().getAnArg() and p.isSelf())
       )
       or
       // Built-ins, treated as members of the module `builtins`
@@ -732,9 +802,15 @@ module API {
         base = potential_import_star_base(s) and
         lbl =
           Label::member(any(string name |
-              ImportStar::namePossiblyDefinedInImportStar(ref.asCfgNode(), name, s)
+              ImportStar::namePossiblyDefinedInImportStar(ref.(DataFlow::CfgNode).getNode(), name, s)
             ))
       )
+      or
+      exists(EntryPoint entry |
+        base = root() and
+        lbl = Label::entryPoint(entry) and
+        ref = entry.getASource()
+      )
     }
 
     /**
@@ -818,7 +894,7 @@ module API {
     DataFlow::LocalSourceNode trackUseNode(DataFlow::LocalSourceNode src) {
       Stages::TypeTracking::ref() and
       result = trackUseNode(src, DataFlow::TypeTracker::end()) and
-      not result instanceof DataFlow::ModuleVariableNode
+      result instanceof DataFlow::ExprNode
     }
 
     /**
@@ -909,7 +985,8 @@ module API {
         MkLabelSelfParameter() or
         MkLabelReturn() or
         MkLabelSubclass() or
-        MkLabelAwait()
+        MkLabelAwait() or
+        MkLabelEntryPoint(EntryPoint ep)
 
       /** A label for a module. */
       class LabelModule extends ApiLabel, MkLabelModule {
@@ -983,6 +1060,15 @@ module API {
       class LabelAwait extends ApiLabel, MkLabelAwait {
         override string toString() { result = "getAwaited()" }
       }
+
+      /** A label for entry points. */
+      class LabelEntryPoint extends ApiLabel, MkLabelEntryPoint {
+        private EntryPoint entry;
+
+        LabelEntryPoint() { this = MkLabelEntryPoint(entry) }
+
+        override string toString() { result = "entryPoint(\"" + entry + "\")" }
+      }
     }
 
     /** Gets the edge label for the module `m`. */
@@ -998,7 +1084,7 @@ module API {
     ApiLabel memberFromRef(DataFlow::AttrRef ref) {
       result = member(ref.getAttributeName())
       or
-      not exists(ref.getAttributeName()) and
+      ref.unknownAttribute() and
       result = unknownMember()
     }
 
@@ -1019,5 +1105,8 @@ module API {
 
     /** Gets the `await` edge label. */
     LabelAwait await() { any() }
+
+    /** Gets the label going from the root node to the nodes associated with the given entry point. */
+    LabelEntryPoint entryPoint(EntryPoint ep) { result = MkLabelEntryPoint(ep) }
   }
 }
diff --git a/python/ql/lib/semmle/python/Concepts.qll b/python/ql/lib/semmle/python/Concepts.qll
index c86a74e2584..b4f1c73e633 100644
--- a/python/ql/lib/semmle/python/Concepts.qll
+++ b/python/ql/lib/semmle/python/Concepts.qll
@@ -565,7 +565,7 @@ module XML {
 }
 
 /** Provides classes for modeling LDAP-related APIs. */
-module LDAP {
+module Ldap {
   /**
    * A data-flow node that executes an LDAP query.
    *
@@ -598,6 +598,9 @@ module LDAP {
   }
 }
 
+/** DEPRECATED: Alias for Ldap */
+deprecated module LDAP = Ldap;
+
 /**
  * A data-flow node that escapes meta-characters, which could be used to prevent
  * injection attacks.
@@ -706,7 +709,7 @@ class LdapFilterEscaping extends Escaping {
 }
 
 /** Provides classes for modeling HTTP-related APIs. */
-module HTTP {
+module Http {
   /** Gets an HTTP verb, in upper case */
   string httpVerb() { result in ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"] }
 
@@ -917,7 +920,7 @@ module HTTP {
        * Extend this class to model new APIs. If you want to refine existing API models,
        * extend `HttpResponse` instead.
        */
-      abstract class Range extends HTTP::Server::HttpResponse::Range {
+      abstract class Range extends Http::Server::HttpResponse::Range {
         /** Gets the data-flow node that specifies the location of this HTTP redirect response. */
         abstract DataFlow::Node getRedirectLocation();
       }
@@ -1046,73 +1049,14 @@ module HTTP {
     }
   }
 
-  /** Provides classes for modeling HTTP clients. */
-  module Client {
-    /**
-     * A data-flow node that makes an outgoing HTTP request.
-     *
-     * Extend this class to refine existing API models. If you want to model new APIs,
-     * extend `HTTP::Client::Request::Range` instead.
-     */
-    class Request extends DataFlow::Node instanceof Request::Range {
-      /**
-       * Gets a data-flow node that contributes to the URL of the request.
-       * Depending on the framework, a request may have multiple nodes which contribute to the URL.
-       */
-      DataFlow::Node getAUrlPart() { result = super.getAUrlPart() }
-
-      /** Gets a string that identifies the framework used for this request. */
-      string getFramework() { result = super.getFramework() }
-
-      /**
-       * Holds if this request is made using a mode that disables SSL/TLS
-       * certificate validation, where `disablingNode` represents the point at
-       * which the validation was disabled, and `argumentOrigin` represents the origin
-       * of the argument that disabled the validation (which could be the same node as
-       * `disablingNode`).
-       */
-      predicate disablesCertificateValidation(
-        DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
-      ) {
-        super.disablesCertificateValidation(disablingNode, argumentOrigin)
-      }
-    }
-
-    /** Provides a class for modeling new HTTP requests. */
-    module Request {
-      /**
-       * A data-flow node that makes an outgoing HTTP request.
-       *
-       * Extend this class to model new APIs. If you want to refine existing API models,
-       * extend `HTTP::Client::Request` instead.
-       */
-      abstract class Range extends DataFlow::Node {
-        /**
-         * Gets a data-flow node that contributes to the URL of the request.
-         * Depending on the framework, a request may have multiple nodes which contribute to the URL.
-         */
-        abstract DataFlow::Node getAUrlPart();
-
-        /** Gets a string that identifies the framework used for this request. */
-        abstract string getFramework();
-
-        /**
-         * Holds if this request is made using a mode that disables SSL/TLS
-         * certificate validation, where `disablingNode` represents the point at
-         * which the validation was disabled, and `argumentOrigin` represents the origin
-         * of the argument that disabled the validation (which could be the same node as
-         * `disablingNode`).
-         */
-        abstract predicate disablesCertificateValidation(
-          DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
-        );
-      }
-    }
-    // TODO: investigate whether we should treat responses to client requests as
-    // remote-flow-sources in general.
-  }
+  import semmle.python.internal.ConceptsShared::Http::Client as Client
+  // TODO: investigate whether we should treat responses to client requests as
+  // remote-flow-sources in general.
 }
 
+/** DEPRECATED: Alias for Http */
+deprecated module HTTP = Http;
+
 /**
  * Provides models for cryptographic things.
  *
diff --git a/python/ql/lib/semmle/python/Flow.qll b/python/ql/lib/semmle/python/Flow.qll
index ce886151135..b63a958efe6 100644
--- a/python/ql/lib/semmle/python/Flow.qll
+++ b/python/ql/lib/semmle/python/Flow.qll
@@ -376,7 +376,7 @@ class CallNode extends ControlFlowNode {
   ControlFlowNode getArgByName(string name) {
     exists(Call c, Keyword k |
       this.getNode() = c and
-      k = c.getAKeyword() and
+      k = c.getANamedArg() and
       k.getValue() = result.getNode() and
       k.getArg() = name and
       result.getBasicBlock().dominates(this.getBasicBlock())
diff --git a/python/ql/lib/semmle/python/dataflow/new/FlowSummary.qll b/python/ql/lib/semmle/python/dataflow/new/FlowSummary.qll
new file mode 100644
index 00000000000..14b4b6d4796
--- /dev/null
+++ b/python/ql/lib/semmle/python/dataflow/new/FlowSummary.qll
@@ -0,0 +1,107 @@
+/** Provides classes and predicates for defining flow summaries. */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.frameworks.data.ModelsAsData
+private import semmle.python.ApiGraphs
+private import internal.FlowSummaryImpl as Impl
+private import internal.DataFlowUtil
+private import internal.DataFlowPrivate
+
+// import all instances below
+private module Summaries {
+  private import semmle.python.Frameworks
+}
+
+class SummaryComponent = Impl::Public::SummaryComponent;
+
+/** Provides predicates for constructing summary components. */
+module SummaryComponent {
+  private import Impl::Public::SummaryComponent as SC
+
+  predicate parameter = SC::parameter/1;
+
+  predicate argument = SC::argument/1;
+
+  predicate content = SC::content/1;
+
+  /** Gets a summary component that represents a list element. */
+  SummaryComponent listElement() { result = content(any(ListElementContent c)) }
+
+  /** Gets a summary component that represents the return value of a call. */
+  SummaryComponent return() { result = SC::return(any(ReturnKind rk)) }
+}
+
+class SummaryComponentStack = Impl::Public::SummaryComponentStack;
+
+/** Provides predicates for constructing stacks of summary components. */
+module SummaryComponentStack {
+  private import Impl::Public::SummaryComponentStack as SCS
+
+  predicate singleton = SCS::singleton/1;
+
+  predicate push = SCS::push/2;
+
+  predicate argument = SCS::argument/1;
+
+  /** Gets a singleton stack representing the return value of a call. */
+  SummaryComponentStack return() { result = singleton(SummaryComponent::return()) }
+}
+
+/** A callable with a flow summary, identified by a unique string. */
+abstract class SummarizedCallable extends LibraryCallable, Impl::Public::SummarizedCallable {
+  bindingset[this]
+  SummarizedCallable() { any() }
+
+  /**
+   * Same as
+   *
+   * ```ql
+   * propagatesFlow(
+   *   SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+   * )
+   * ```
+   *
+   * but uses an external (string) representation of the input and output stacks.
+   */
+  pragma[nomagic]
+  predicate propagatesFlowExt(string input, string output, boolean preservesValue) { none() }
+}
+
+class RequiredSummaryComponentStack = Impl::Public::RequiredSummaryComponentStack;
+// // This gives access to getNodeFromPath, which is not constrained to `CallNode`s
+// // as `resolvedSummaryBase` is.
+// private import semmle.python.frameworks.data.internal.ApiGraphModels as AGM
+//
+// private class SummarizedCallableFromModel extends SummarizedCallable {
+//   string package;
+//   string type;
+//   string path;
+//   SummarizedCallableFromModel() {
+//     ModelOutput::relevantSummaryModel(package, type, path, _, _, _) and
+//     this = package + ";" + type + ";" + path
+//   }
+//   override CallCfgNode getACall() {
+//     exists(API::CallNode base |
+//       ModelOutput::resolvedSummaryBase(package, type, path, base) and
+//       result = base.getACall()
+//     )
+//   }
+//   override ArgumentNode getACallback() {
+//     exists(API::Node base |
+//       base = AGM::getNodeFromPath(package, type, path) and
+//       result = base.getAValueReachableFromSource()
+//     )
+//   }
+//   override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
+//     exists(string kind |
+//       ModelOutput::relevantSummaryModel(package, type, path, input, output, kind)
+//     |
+//       kind = "value" and
+//       preservesValue = true
+//       or
+//       kind = "taint" and
+//       preservesValue = false
+//     )
+//   }
+// }
diff --git a/python/ql/lib/semmle/python/frameworks/data/internal/AccessPathSyntax.qll b/python/ql/lib/semmle/python/dataflow/new/internal/AccessPathSyntax.qll
similarity index 100%
rename from python/ql/lib/semmle/python/frameworks/data/internal/AccessPathSyntax.qll
rename to python/ql/lib/semmle/python/dataflow/new/internal/AccessPathSyntax.qll
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/Attributes.qll b/python/ql/lib/semmle/python/dataflow/new/internal/Attributes.qll
index 49c8c7e5ab5..ff88dd47d35 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/Attributes.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/Attributes.qll
@@ -40,7 +40,7 @@ abstract class AttrRef extends Node {
     or
     exists(LocalSourceNode nodeFrom |
       nodeFrom.flowsTo(this.getAttributeNameExpr()) and
-      attrName = nodeFrom.asExpr().(StrConst).getText()
+      attrName = nodeFrom.(CfgNode).getNode().getNode().(StrConst).getText()
     )
   }
 
@@ -50,6 +50,9 @@ abstract class AttrRef extends Node {
    * better results.
    */
   abstract string getAttributeName();
+
+  /** Holds if a name could not be determined for this attribute. */
+  predicate unknownAttribute() { not exists(this.getAttributeName()) }
 }
 
 /**
@@ -175,7 +178,7 @@ private class SetAttrCallAsAttrWrite extends AttrWrite, CfgNode {
   override ExprNode getAttributeNameExpr() { result.asCfgNode() = node.getName() }
 
   override string getAttributeName() {
-    result = this.getAttributeNameExpr().asExpr().(StrConst).getText()
+    result = this.getAttributeNameExpr().(CfgNode).getNode().getNode().(StrConst).getText()
   }
 }
 
@@ -251,7 +254,7 @@ private class GetAttrCallAsAttrRead extends AttrRead, CfgNode {
   override ExprNode getAttributeNameExpr() { result.asCfgNode() = node.getName() }
 
   override string getAttributeName() {
-    result = this.getAttributeNameExpr().asExpr().(StrConst).getText()
+    result = this.getAttributeNameExpr().(CfgNode).getNode().getNode().(StrConst).getText()
   }
 }
 
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/Builtins.qll b/python/ql/lib/semmle/python/dataflow/new/internal/Builtins.qll
index 84fbf9398eb..9ed9e7d7a2b 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/Builtins.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/Builtins.qll
@@ -60,9 +60,9 @@ module Builtins {
    * Currently this is an over-approximation, and may not account for things like overwriting a
    * built-in with a different value.
    */
-  DataFlow::Node likelyBuiltin(string name) {
+  DataFlow::CfgNode likelyBuiltin(string name) {
     exists(Module m |
-      result.asCfgNode() =
+      result.getNode() =
         any(NameNode n |
           possible_builtin_accessed_in_module(n, name, m) and
           not possible_builtin_defined_in_module(name, m)
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatchPointsTo.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatchPointsTo.qll
index 1d50a12364f..09ba8238155 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatchPointsTo.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatchPointsTo.qll
@@ -7,15 +7,22 @@
 private import python
 private import DataFlowPublic
 private import semmle.python.SpecialMethods
+private import FlowSummaryImpl as FlowSummaryImpl
 
 /** A parameter position represented by an integer. */
 class ParameterPosition extends int {
   ParameterPosition() { exists(any(DataFlowCallable c).getParameter(this)) }
+
+  /** Holds if this position represents a positional parameter at position `pos`. */
+  predicate isPositional(int pos) { this = pos } // with the current representation, all parameters are positional
 }
 
 /** An argument position represented by an integer. */
 class ArgumentPosition extends int {
-  ArgumentPosition() { exists(any(DataFlowCall c).getArg(this)) }
+  ArgumentPosition() { this in [-2, -1] or exists(any(Call c).getArg(this)) }
+
+  /** Holds if this position represents a positional argument at position `pos`. */
+  predicate isPositional(int pos) { this = pos } // with the current representation, all arguments are positional
 }
 
 /** Holds if arguments at position `apos` match parameters at position `ppos`. */
@@ -96,7 +103,7 @@ module ArgumentPassing {
    * Used to limit the size of predicates.
    */
   predicate connects(CallNode call, CallableValue callable) {
-    exists(DataFlowCall c |
+    exists(NormalCall c |
       call = c.getNode() and
       callable = c.getCallable().getCallableValue()
     )
@@ -268,6 +275,18 @@ module ArgumentPassing {
 
 import ArgumentPassing
 
+/** A callable defined in library code, identified by a unique string. */
+abstract class LibraryCallable extends string {
+  bindingset[this]
+  LibraryCallable() { any() }
+
+  /** Gets a call to this library callable. */
+  abstract CallCfgNode getACall();
+
+  /** Gets a data-flow node, where this library callable is used as a call-back. */
+  abstract ArgumentNode getACallback();
+}
+
 /**
  * IPA type for DataFlowCallable.
  *
@@ -282,27 +301,33 @@ newtype TDataFlowCallable =
     callable instanceof ClassValue
   } or
   TLambda(Function lambda) { lambda.isLambda() } or
-  TModule(Module m)
+  TModule(Module m) or
+  TLibraryCallable(LibraryCallable callable)
 
 /** A callable. */
-abstract class DataFlowCallable extends TDataFlowCallable {
+class DataFlowCallable extends TDataFlowCallable {
   /** Gets a textual representation of this element. */
-  abstract string toString();
+  string toString() { result = "DataFlowCallable" }
 
   /** Gets a call to this callable. */
-  abstract CallNode getACall();
+  CallNode getACall() { none() }
 
   /** Gets the scope of this callable */
-  abstract Scope getScope();
+  Scope getScope() { none() }
 
   /** Gets the specified parameter of this callable */
-  abstract NameNode getParameter(int n);
+  NameNode getParameter(int n) { none() }
 
   /** Gets the name of this callable. */
-  abstract string getName();
+  string getName() { none() }
 
-  /** Gets a callable value for this callable, if one exists. */
-  abstract CallableValue getCallableValue();
+  /** Gets a callable value for this callable, if any. */
+  CallableValue getCallableValue() { none() }
+
+  /** Gets the underlying library callable, if any. */
+  LibraryCallable asLibraryCallable() { this = TLibraryCallable(result) }
+
+  Location getLocation() { none() }
 }
 
 /** A class representing a callable value. */
@@ -343,6 +368,8 @@ class DataFlowLambda extends DataFlowCallable, TLambda {
   override FunctionValue getCallableValue() {
     result.getOrigin().getNode() = lambda.getDefinition()
   }
+
+  Expr getDefinition() { result = lambda.getDefinition() }
 }
 
 /** A class representing the scope in which a `ModuleVariableNode` appears. */
@@ -364,6 +391,27 @@ class DataFlowModuleScope extends DataFlowCallable, TModule {
   override CallableValue getCallableValue() { none() }
 }
 
+class LibraryCallableValue extends DataFlowCallable, TLibraryCallable {
+  LibraryCallable callable;
+
+  LibraryCallableValue() { this = TLibraryCallable(callable) }
+
+  override string toString() { result = callable.toString() }
+
+  override CallNode getACall() { result = callable.getACall().getNode() }
+
+  /** Gets a data-flow node, where this library callable is used as a call-back. */
+  ArgumentNode getACallback() { result = callable.getACallback() }
+
+  override Scope getScope() { none() }
+
+  override NameNode getParameter(int n) { none() }
+
+  override string getName() { result = callable }
+
+  override LibraryCallable asLibraryCallable() { result = callable }
+}
+
 /**
  * IPA type for DataFlowCall.
  *
@@ -379,90 +427,140 @@ class DataFlowModuleScope extends DataFlowCallable, TModule {
  * TODO: Add `TClassMethodCall` mapping `cls` appropriately.
  */
 newtype TDataFlowCall =
-  TFunctionCall(CallNode call) { call = any(FunctionValue f).getAFunctionCall() } or
-  /** Bound methods need to make room for the explicit self parameter */
-  TMethodCall(CallNode call) { call = any(FunctionValue f).getAMethodCall() } or
-  TClassCall(CallNode call) { call = any(ClassValue c | not c.isAbsent()).getACall() } or
-  TSpecialCall(SpecialMethodCallNode special)
+  /**
+   * Includes function calls, method calls, class calls and library calls.
+   * All these will be associated with a `CallNode`.
+   */
+  TNormalCall(CallNode call) or
+  /**
+   * Includes calls to special methods.
+   * These will be associated with a `SpecialMethodCallNode`.
+   */
+  TSpecialCall(SpecialMethodCallNode special) or
+  /** A synthesized call inside a summarized callable */
+  TSummaryCall(FlowSummaryImpl::Public::SummarizedCallable c, Node receiver) {
+    FlowSummaryImpl::Private::summaryCallbackRange(c, receiver)
+  }
 
-/** A call. */
+/** A call found in the program source (as opposed to a synthesised summary call). */
+class TExtractedDataFlowCall = TSpecialCall or TNormalCall;
+
+/** A call that is taken into account by the global data flow computation. */
 abstract class DataFlowCall extends TDataFlowCall {
   /** Gets a textual representation of this element. */
   abstract string toString();
 
-  /** Get the callable to which this call goes. */
+  /** Get the callable to which this call goes, if such exists. */
   abstract DataFlowCallable getCallable();
 
   /**
    * Gets the argument to this call that will be sent
-   * to the `n`th parameter of the callable.
+   * to the `n`th parameter of the callable, if any.
    */
   abstract Node getArg(int n);
 
-  /** Get the control flow node representing this call. */
+  /** Get the control flow node representing this call, if any. */
   abstract ControlFlowNode getNode();
 
   /** Gets the enclosing callable of this call. */
   abstract DataFlowCallable getEnclosingCallable();
 
   /** Gets the location of this dataflow call. */
-  Location getLocation() { result = this.getNode().getLocation() }
+  abstract Location getLocation();
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/** A call found in the program source (as opposed to a synthesised call). */
+abstract class ExtractedDataFlowCall extends DataFlowCall, TExtractedDataFlowCall {
+  final override Location getLocation() { result = this.getNode().getLocation() }
+
+  abstract override DataFlowCallable getCallable();
+
+  abstract override Node getArg(int n);
+
+  abstract override ControlFlowNode getNode();
+}
+
+/** A call associated with a `CallNode`. */
+class NormalCall extends ExtractedDataFlowCall, TNormalCall {
+  CallNode call;
+
+  NormalCall() { this = TNormalCall(call) }
+
+  override string toString() { result = call.toString() }
+
+  abstract override Node getArg(int n);
+
+  override CallNode getNode() { result = call }
+
+  abstract override DataFlowCallable getCallable();
+
+  override DataFlowCallable getEnclosingCallable() { result.getScope() = call.getNode().getScope() }
 }
 
 /**
- * A call to a function/lambda.
+ * A call to a function.
  * This excludes calls to bound methods, classes, and special methods.
  * Bound method calls and class calls insert an argument for the explicit
  * `self` parameter, and special method calls have special argument passing.
  */
-class FunctionCall extends DataFlowCall, TFunctionCall {
-  CallNode call;
-  DataFlowCallable callable;
+class FunctionCall extends NormalCall {
+  DataFlowCallableValue callable;
 
   FunctionCall() {
-    this = TFunctionCall(call) and
+    call = any(FunctionValue f).getAFunctionCall() and
     call = callable.getACall()
   }
 
-  override string toString() { result = call.toString() }
+  override Node getArg(int n) { result = getArg(call, TNoShift(), callable.getCallableValue(), n) }
+
+  override DataFlowCallable getCallable() { result = callable }
+}
+
+/** A call to a lambda. */
+class LambdaCall extends NormalCall {
+  DataFlowLambda callable;
+
+  LambdaCall() {
+    call = callable.getACall() and
+    callable = TLambda(any(Function f))
+  }
 
   override Node getArg(int n) { result = getArg(call, TNoShift(), callable.getCallableValue(), n) }
 
-  override ControlFlowNode getNode() { result = call }
-
   override DataFlowCallable getCallable() { result = callable }
-
-  override DataFlowCallable getEnclosingCallable() { result.getScope() = call.getNode().getScope() }
 }
 
 /**
  * Represents a call to a bound method call.
  * The node representing the instance is inserted as argument to the `self` parameter.
  */
-class MethodCall extends DataFlowCall, TMethodCall {
-  CallNode call;
+class MethodCall extends NormalCall {
   FunctionValue bm;
 
-  MethodCall() {
-    this = TMethodCall(call) and
-    call = bm.getACall()
-  }
+  MethodCall() { call = bm.getAMethodCall() }
 
   private CallableValue getCallableValue() { result = bm }
 
-  override string toString() { result = call.toString() }
-
   override Node getArg(int n) {
     n > 0 and result = getArg(call, TShiftOneUp(), this.getCallableValue(), n)
     or
     n = 0 and result = TCfgNode(call.getFunction().(AttrNode).getObject())
   }
 
-  override ControlFlowNode getNode() { result = call }
-
   override DataFlowCallable getCallable() { result = TCallableValue(this.getCallableValue()) }
-
-  override DataFlowCallable getEnclosingCallable() { result.getScope() = call.getScope() }
 }
 
 /**
@@ -471,34 +569,27 @@ class MethodCall extends DataFlowCall, TMethodCall {
  * That makes the call node be the post-update node holding the value of the object
  * after the constructor has run.
  */
-class ClassCall extends DataFlowCall, TClassCall {
-  CallNode call;
+class ClassCall extends NormalCall {
   ClassValue c;
 
   ClassCall() {
-    this = TClassCall(call) and
+    not c.isAbsent() and
     call = c.getACall()
   }
 
   private CallableValue getCallableValue() { c.getScope().getInitMethod() = result.getScope() }
 
-  override string toString() { result = call.toString() }
-
   override Node getArg(int n) {
     n > 0 and result = getArg(call, TShiftOneUp(), this.getCallableValue(), n)
     or
     n = 0 and result = TSyntheticPreUpdateNode(TCfgNode(call))
   }
 
-  override ControlFlowNode getNode() { result = call }
-
   override DataFlowCallable getCallable() { result = TCallableValue(this.getCallableValue()) }
-
-  override DataFlowCallable getEnclosingCallable() { result.getScope() = call.getScope() }
 }
 
 /** A call to a special method. */
-class SpecialCall extends DataFlowCall, TSpecialCall {
+class SpecialCall extends ExtractedDataFlowCall, TSpecialCall {
   SpecialMethodCallNode special;
 
   SpecialCall() { this = TSpecialCall(special) }
@@ -518,8 +609,172 @@ class SpecialCall extends DataFlowCall, TSpecialCall {
   }
 }
 
+/**
+ * A call to a summarized callable, a `LibraryCallable`.
+ *
+ * We currently exclude all resolved calls. This means that a call to, say, `map`, which
+ * is a `ClassCall`, cannot currently be given a summary.
+ * We hope to lift this restriction in the future and include all potential calls to summaries
+ * in this class.
+ */
+class LibraryCall extends NormalCall {
+  LibraryCall() {
+    // TODO: share this with `resolvedCall`
+    not (
+      call = any(DataFlowCallableValue cv).getACall()
+      or
+      call = any(DataFlowLambda l).getACall()
+      or
+      // TODO: this should be covered by `DataFlowCallableValue`, but a `ClassValue` is not a `CallableValue`.
+      call = any(ClassValue c).getACall()
+    )
+  }
+
+  // TODO: Implement Python calling convention?
+  override Node getArg(int n) { result = TCfgNode(call.getArg(n)) }
+
+  // We cannot refer to a `LibraryCallable` here,
+  // as that could in turn refer to type tracking.
+  // This call will be tied to a `LibraryCallable` via
+  // `getViableCallabe` when the global data flow is assembled.
+  override DataFlowCallable getCallable() { none() }
+}
+
+/**
+ * A synthesized call inside a callable with a flow summary.
+ *
+ * For example, in
+ * ```python
+ * map(lambda x: x + 1, [1, 2, 3])
+ * ```
+ *
+ * there is a synthesized call to the lambda argument inside `map`.
+ */
+class SummaryCall extends DataFlowCall, TSummaryCall {
+  private FlowSummaryImpl::Public::SummarizedCallable c;
+  private Node receiver;
+
+  SummaryCall() { this = TSummaryCall(c, receiver) }
+
+  /** Gets the data flow node that this call targets. */
+  Node getReceiver() { result = receiver }
+
+  override DataFlowCallable getEnclosingCallable() { result.asLibraryCallable() = c }
+
+  override DataFlowCallable getCallable() { none() }
+
+  override Node getArg(int n) { none() }
+
+  override ControlFlowNode getNode() { none() }
+
+  override string toString() { result = "[summary] call to " + receiver + " in " + c }
+
+  override Location getLocation() { none() }
+}
+
+/**
+ * The value of a parameter at function entry, viewed as a node in a data
+ * flow graph.
+ */
+abstract class ParameterNodeImpl extends Node {
+  abstract Parameter getParameter();
+
+  /**
+   * Holds if this node is the parameter of callable `c` at the
+   * (zero-based) index `i`.
+   */
+  abstract predicate isParameterOf(DataFlowCallable c, int i);
+}
+
+/** A parameter for a library callable with a flow summary. */
+class SummaryParameterNode extends ParameterNodeImpl, TSummaryParameterNode {
+  private FlowSummaryImpl::Public::SummarizedCallable sc;
+  private int pos;
+
+  SummaryParameterNode() { this = TSummaryParameterNode(sc, pos) }
+
+  override Parameter getParameter() { none() }
+
+  override predicate isParameterOf(DataFlowCallable c, int i) {
+    sc = c.asLibraryCallable() and i = pos
+  }
+
+  override DataFlowCallable getEnclosingCallable() { result.asLibraryCallable() = sc }
+
+  override string toString() { result = "parameter " + pos + " of " + sc }
+
+  // Hack to return "empty location"
+  override predicate hasLocationInfo(
+    string file, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    file = "" and
+    startline = 0 and
+    startcolumn = 0 and
+    endline = 0 and
+    endcolumn = 0
+  }
+}
+
+/** A data-flow node used to model flow summaries. */
+class SummaryNode extends Node, TSummaryNode {
+  private FlowSummaryImpl::Public::SummarizedCallable c;
+  private FlowSummaryImpl::Private::SummaryNodeState state;
+
+  SummaryNode() { this = TSummaryNode(c, state) }
+
+  override DataFlowCallable getEnclosingCallable() { result.asLibraryCallable() = c }
+
+  override string toString() { result = "[summary] " + state + " in " + c }
+
+  // Hack to return "empty location"
+  override predicate hasLocationInfo(
+    string file, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    file = "" and
+    startline = 0 and
+    startcolumn = 0 and
+    endline = 0 and
+    endcolumn = 0
+  }
+}
+
+private class SummaryReturnNode extends SummaryNode, ReturnNode {
+  private ReturnKind rk;
+
+  SummaryReturnNode() { FlowSummaryImpl::Private::summaryReturnNode(this, rk) }
+
+  override ReturnKind getKind() { result = rk }
+}
+
+private class SummaryArgumentNode extends SummaryNode, ArgumentNode {
+  SummaryArgumentNode() { FlowSummaryImpl::Private::summaryArgumentNode(_, this, _) }
+
+  override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
+    FlowSummaryImpl::Private::summaryArgumentNode(call, this, pos)
+  }
+}
+
+private class SummaryPostUpdateNode extends SummaryNode, PostUpdateNode {
+  private Node pre;
+
+  SummaryPostUpdateNode() { FlowSummaryImpl::Private::summaryPostUpdateNode(this, pre) }
+
+  override Node getPreUpdateNode() { result = pre }
+}
+
 /** Gets a viable run-time target for the call `call`. */
-DataFlowCallable viableCallable(DataFlowCall call) { result = call.getCallable() }
+DataFlowCallable viableCallable(ExtractedDataFlowCall call) {
+  result = call.getCallable()
+  or
+  // A call to a library callable with a flow summary
+  // In this situation we can not resolve the callable from the call,
+  // as that would make data flow depend on type tracking.
+  // Instead we reolve the call from the summary.
+  exists(LibraryCallable callable |
+    result = TLibraryCallable(callable) and
+    call.getNode() = callable.getACall().getNode()
+  )
+}
 
 private newtype TReturnKind = TNormalReturnKind()
 
@@ -533,26 +788,51 @@ class ReturnKind extends TReturnKind {
 }
 
 /** A data flow node that represents a value returned by a callable. */
-class ReturnNode extends CfgNode {
-  Return ret;
-
-  // See `TaintTrackingImplementation::returnFlowStep`
-  ReturnNode() { node = ret.getValue().getAFlowNode() }
-
+abstract class ReturnNode extends Node {
   /** Gets the kind of this return node. */
   ReturnKind getKind() { any() }
 }
 
-/** A data flow node that represents the output of a call. */
-class OutNode extends CfgNode {
-  OutNode() { node instanceof CallNode }
+/** A data flow node that represents a value returned by a callable. */
+class ExtractedReturnNode extends ReturnNode, CfgNode {
+  // See `TaintTrackingImplementation::returnFlowStep`
+  ExtractedReturnNode() { node = any(Return ret).getValue().getAFlowNode() }
+
+  override ReturnKind getKind() { any() }
+}
+
+/** A data-flow node that represents the output of a call. */
+abstract class OutNode extends Node {
+  /** Gets the underlying call, where this node is a corresponding output of kind `kind`. */
+  abstract DataFlowCall getCall(ReturnKind kind);
+}
+
+private module OutNodes {
+  /**
+   * A data-flow node that reads a value returned directly by a callable.
+   */
+  class ExprOutNode extends OutNode, ExprNode {
+    private DataFlowCall call;
+
+    ExprOutNode() { call.(ExtractedDataFlowCall).getNode() = this.getNode() }
+
+    override DataFlowCall getCall(ReturnKind kind) {
+      result = call and
+      kind = kind
+    }
+  }
+
+  private class SummaryOutNode extends SummaryNode, OutNode {
+    SummaryOutNode() { FlowSummaryImpl::Private::summaryOutNode(_, this, _) }
+
+    override DataFlowCall getCall(ReturnKind kind) {
+      FlowSummaryImpl::Private::summaryOutNode(result, this, kind)
+    }
+  }
 }
 
 /**
  * Gets a node that can read the value returned from `call` with return kind
  * `kind`.
  */
-OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
-  call.getNode() = result.getNode() and
-  kind = TNormalReturnKind()
-}
+OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) { call = result.getCall(kind) }
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
index a8e812a6972..be44f39f13c 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
@@ -1,7 +1,8 @@
 private import python
 private import DataFlowPublic
 private import semmle.python.essa.SsaCompute
-private import semmle.python.dataflow.new.internal.ImportStar
+private import semmle.python.dataflow.new.internal.ImportResolution
+private import FlowSummaryImpl as FlowSummaryImpl
 // Since we allow extra data-flow steps from modeled frameworks, we import these
 // up-front, to ensure these are included. This provides a more seamless experience from
 // a user point of view, since they don't need to know they need to import a specific
@@ -21,7 +22,7 @@ import DataFlowDispatchPointsTo
 DataFlowCallable nodeGetEnclosingCallable(Node n) { result = n.getEnclosingCallable() }
 
 /** Holds if `p` is a `ParameterNode` of `c` with position `pos`. */
-predicate isParameterNode(ParameterNode p, DataFlowCallable c, ParameterPosition pos) {
+predicate isParameterNode(ParameterNodeImpl p, DataFlowCallable c, ParameterPosition pos) {
   p.isParameterOf(c, pos)
 }
 
@@ -77,7 +78,7 @@ module SyntheticPreUpdateNode {
    * that is mapped to the `self` parameter. That way, constructor calls represent the value of the
    * object after the constructor (currently only `__init__`) has run.
    */
-  CfgNode objectCreationNode() { result.getNode().(CallNode) = any(ClassCall c).getNode() }
+  CfgNode objectCreationNode() { result.getNode() = any(ClassCall c).getNode() }
 }
 
 import SyntheticPreUpdateNode
@@ -87,6 +88,8 @@ deprecated module syntheticPostUpdateNode = SyntheticPostUpdateNode;
 
 /** A module collecting the different reasons for synthesising a post-update node. */
 module SyntheticPostUpdateNode {
+  private import semmle.python.SpecialMethods
+
   /** A post-update node is synthesized for all nodes which satisfy `NeedsSyntheticPostUpdateNode`. */
   class SyntheticPostUpdateNode extends PostUpdateNode, TSyntheticPostUpdateNode {
     NeedsSyntheticPostUpdateNode pre;
@@ -136,6 +139,8 @@ module SyntheticPostUpdateNode {
   Node argumentPreUpdateNode() {
     result = any(FunctionCall c).getArg(_)
     or
+    result = any(LambdaCall c).getArg(_)
+    or
     // Avoid argument 0 of method calls as those have read post-update nodes.
     exists(MethodCall c, int n | n > 0 | result = c.getArg(n))
     or
@@ -145,11 +150,18 @@ module SyntheticPostUpdateNode {
     exists(ClassCall c, int n | n > 0 | result = c.getArg(n))
     or
     // any argument of any call that we have not been able to resolve
-    exists(CallNode call | not call = any(DataFlowCall c).getNode() |
+    exists(CallNode call | not resolvedCall(call) |
       result.(CfgNode).getNode() in [call.getArg(_), call.getArgByName(_)]
     )
   }
 
+  /** Holds if `call` can be resolved as a normal call */
+  private predicate resolvedCall(CallNode call) {
+    call = any(DataFlowCallableValue cv).getACall()
+    or
+    call = any(DataFlowLambda l).getACall()
+  }
+
   /** Gets the pre-update node associated with a store. This is used for when an object might have its value changed after a store. */
   CfgNode storePreUpdateNode() {
     exists(Attribute a |
@@ -287,10 +299,22 @@ module EssaFlow {
  * This is the local flow predicate that is used as a building block in global
  * data flow.
  *
+ * It includes flow steps from flow summaries.
+ */
+predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
+  simpleLocalFlowStepForTypetracking(nodeFrom, nodeTo)
+  or
+  summaryFlowSteps(nodeFrom, nodeTo)
+}
+
+/**
+ * This is the local flow predicate that is used as a building block in
+ * type tracking, it does _not_ include steps from flow summaries.
+ *
  * Local flow can happen either at import time, when the module is initialised
  * or at runtime when callables in the module are called.
  */
-predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
+predicate simpleLocalFlowStepForTypetracking(Node nodeFrom, Node nodeTo) {
   // If there is local flow out of a node `node`, we want flow
   // both out of `node` and any post-update node of `node`.
   exists(Node node |
@@ -326,6 +350,34 @@ predicate runtimeLocalFlowStep(Node nodeFrom, Node nodeTo) {
   EssaFlow::essaFlowStep(nodeFrom, nodeTo)
 }
 
+predicate summaryFlowSteps(Node nodeFrom, Node nodeTo) {
+  // If there is local flow out of a node `node`, we want flow
+  // both out of `node` and any post-update node of `node`.
+  exists(Node node |
+    nodeFrom = update(node) and
+    (
+      importTimeSummaryFlowStep(node, nodeTo) or
+      runtimeSummaryFlowStep(node, nodeTo)
+    )
+  )
+}
+
+predicate importTimeSummaryFlowStep(Node nodeFrom, Node nodeTo) {
+  // As a proxy for whether statements can be executed at import time,
+  // we check if they appear at the top level.
+  // This will miss statements inside functions called from the top level.
+  isTopLevel(nodeFrom) and
+  isTopLevel(nodeTo) and
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true)
+}
+
+predicate runtimeSummaryFlowStep(Node nodeFrom, Node nodeTo) {
+  // Anything not at the top level can be executed at runtime.
+  not isTopLevel(nodeFrom) and
+  not isTopLevel(nodeTo) and
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true)
+}
+
 /** `ModuleVariable`s are accessed via jump steps at runtime. */
 predicate runtimeJumpStep(Node nodeFrom, Node nodeTo) {
   // Module variable read
@@ -335,11 +387,7 @@ predicate runtimeJumpStep(Node nodeFrom, Node nodeTo) {
   nodeFrom = nodeTo.(ModuleVariableNode).getAWrite()
   or
   // Setting the possible values of the variable at the end of import time
-  exists(SsaVariable def |
-    def = any(SsaVariable var).getAnUltimateDefinition() and
-    def.getDefinition() = nodeFrom.asCfgNode() and
-    def.getVariable() = nodeTo.(ModuleVariableNode).getVariable()
-  )
+  nodeFrom = nodeTo.(ModuleVariableNode).getADefiningWrite()
 }
 
 /**
@@ -423,9 +471,9 @@ predicate jumpStepSharedWithTypeTracker(Node nodeFrom, Node nodeTo) {
   runtimeJumpStep(nodeFrom, nodeTo)
   or
   // Read of module attribute:
-  exists(AttrRead r, ModuleValue mv |
-    r.getObject().asCfgNode().pointsTo(mv) and
-    module_export(mv.getScope(), r.getAttributeName(), nodeFrom) and
+  exists(AttrRead r |
+    ImportResolution::module_export(ImportResolution::getModule(r.getObject()),
+      r.getAttributeName(), nodeFrom) and
     nodeTo = r
   )
   or
@@ -449,22 +497,6 @@ predicate jumpStepNotSharedWithTypeTracker(Node nodeFrom, Node nodeTo) {
   any(Orm::AdditionalOrmSteps es).jumpStep(nodeFrom, nodeTo)
 }
 
-/**
- * Holds if the module `m` defines a name `name` by assigning `defn` to it. This is an
- * overapproximation, as `name` may not in fact be exported (e.g. by defining an `__all__` that does
- * not include `name`).
- */
-private predicate module_export(Module m, string name, CfgNode defn) {
-  exists(EssaVariable v |
-    v.getName() = name and
-    v.getAUse() = ImportStar::getStarImported*(m).getANormalExit()
-  |
-    defn.getNode() = v.getDefinition().(AssignmentDefinition).getValue()
-    or
-    defn.getNode() = v.getDefinition().(ArgumentRefinement).getArgument()
-  )
-}
-
 //--------
 // Field flow
 //--------
@@ -494,6 +526,8 @@ predicate storeStep(Node nodeFrom, Content c, Node nodeTo) {
   matchStoreStep(nodeFrom, c, nodeTo)
   or
   any(Orm::AdditionalOrmSteps es).storeStep(nodeFrom, c, nodeTo)
+  or
+  FlowSummaryImpl::Private::Steps::summaryStoreStep(nodeFrom, c, nodeTo)
 }
 
 /**
@@ -687,6 +721,8 @@ predicate readStep(Node nodeFrom, Content c, Node nodeTo) {
   attributeReadStep(nodeFrom, c, nodeTo)
   or
   kwUnpackReadStep(nodeFrom, c, nodeTo)
+  or
+  FlowSummaryImpl::Private::Steps::summaryReadStep(nodeFrom, c, nodeTo)
 }
 
 /** Data flows from a sequence to a subscript of the sequence. */
@@ -811,6 +847,8 @@ predicate clearsContent(Node n, Content c) {
   matchClearStep(n, c)
   or
   attributeClearStep(n, c)
+  or
+  FlowSummaryImpl::Private::Steps::summaryClearsContent(n, c)
 }
 
 /**
@@ -862,15 +900,38 @@ int accessPathLimit() { result = 5 }
 predicate forceHighPrecision(Content c) { none() }
 
 /** Holds if `n` should be hidden from path explanations. */
-predicate nodeIsHidden(Node n) { none() }
+predicate nodeIsHidden(Node n) {
+  n instanceof SummaryNode
+  or
+  n instanceof SummaryParameterNode
+}
 
 class LambdaCallKind = Unit;
 
 /** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
-predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) { none() }
+predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) {
+  // lambda
+  kind = kind and
+  creation.asExpr() = c.(DataFlowLambda).getDefinition()
+  or
+  // normal function
+  exists(FunctionDef def |
+    def.defines(creation.asVar().getSourceVariable()) and
+    def.getDefinedFunction() = c.(DataFlowCallableValue).getCallableValue().getScope()
+  )
+  or
+  // summarized function
+  exists(Call call |
+    creation.asExpr() = call.getAnArg() and
+    creation = c.(LibraryCallableValue).getACallback()
+  )
+}
 
 /** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
-predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { none() }
+predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) {
+  receiver = call.(SummaryCall).getReceiver() and
+  exists(kind)
+}
 
 /** Extra data-flow steps needed for lambda flow analysis. */
 predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
@@ -882,4 +943,6 @@ predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preserves
  * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
  * by default as a heuristic.
  */
-predicate allowParameterReturnInSelf(ParameterNode p) { none() }
+predicate allowParameterReturnInSelf(ParameterNode p) {
+  FlowSummaryImpl::Private::summaryAllowParameterReturnInSelf(p)
+}
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll
index 8ab76dc56df..4a00d0aafc3 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -9,6 +9,7 @@ import Attributes
 import LocalSources
 private import semmle.python.essa.SsaCompute
 private import semmle.python.dataflow.new.internal.ImportStar
+private import FlowSummaryImpl as FlowSummaryImpl
 
 /**
  * IPA type for data flow nodes.
@@ -100,7 +101,17 @@ newtype TNode =
   //
   // So for now we live with having these synthetic ORM nodes for _all_ classes, which
   // is a bit wasteful, but we don't think it will hurt too much.
-  TSyntheticOrmModelNode(Class cls)
+  TSyntheticOrmModelNode(Class cls) or
+  TSummaryNode(
+    FlowSummaryImpl::Public::SummarizedCallable c, FlowSummaryImpl::Private::SummaryNodeState state
+  ) {
+    FlowSummaryImpl::Private::summaryNodeRange(c, state)
+  } or
+  TSummaryParameterNode(FlowSummaryImpl::Public::SummarizedCallable c, ParameterPosition pos) {
+    FlowSummaryImpl::Private::summaryParameterNodeRange(c, pos)
+  }
+
+class TParameterNode = TCfgNode or TSummaryParameterNode;
 
 /** Helper for `Node::getEnclosingCallable`. */
 private DataFlowCallable getCallableScope(Scope s) {
@@ -277,40 +288,56 @@ ExprNode exprNode(DataFlowExpr e) { result.getNode().getNode() = e }
  * The value of a parameter at function entry, viewed as a node in a data
  * flow graph.
  */
-class ParameterNode extends CfgNode, LocalSourceNode {
+class ParameterNode extends Node, TParameterNode instanceof ParameterNodeImpl {
+  /** Gets the parameter corresponding to this node, if any. */
+  final Parameter getParameter() { result = super.getParameter() }
+}
+
+/** A parameter node found in the source code (not in a summary). */
+class ExtractedParameterNode extends ParameterNodeImpl, CfgNode {
+  //, LocalSourceNode {
   ParameterDefinition def;
 
-  ParameterNode() {
+  ExtractedParameterNode() {
     node = def.getDefiningNode() and
     // Disregard parameters that we cannot resolve
     // TODO: Make this unnecessary
     exists(DataFlowCallable c | node = c.getParameter(_))
   }
 
-  /**
-   * Holds if this node is the parameter of callable `c` at the
-   * (zero-based) index `i`.
-   */
-  predicate isParameterOf(DataFlowCallable c, int i) { node = c.getParameter(i) }
+  override predicate isParameterOf(DataFlowCallable c, int i) { node = c.getParameter(i) }
 
   override DataFlowCallable getEnclosingCallable() { this.isParameterOf(result, _) }
 
   /** Gets the `Parameter` this `ParameterNode` represents. */
-  Parameter getParameter() { result = def.getParameter() }
+  override Parameter getParameter() { result = def.getParameter() }
 }
 
+class LocalSourceParameterNode extends ExtractedParameterNode, LocalSourceNode { }
+
 /** Gets a node corresponding to parameter `p`. */
-ParameterNode parameterNode(Parameter p) { result.getParameter() = p }
+ExtractedParameterNode parameterNode(Parameter p) { result.getParameter() = p }
 
 /** A data flow node that represents a call argument. */
-class ArgumentNode extends Node {
-  ArgumentNode() { this = any(DataFlowCall c).getArg(_) }
-
+abstract class ArgumentNode extends Node {
   /** Holds if this argument occurs at the given position in the given call. */
-  predicate argumentOf(DataFlowCall call, int pos) { this = call.getArg(pos) }
+  abstract predicate argumentOf(DataFlowCall call, ArgumentPosition pos);
 
-  /** Gets the call in which this node is an argument. */
-  final DataFlowCall getCall() { this.argumentOf(result, _) }
+  /** Gets the call in which this node is an argument, if any. */
+  final ExtractedDataFlowCall getCall() { this.argumentOf(result, _) }
+}
+
+/** A data flow node that represents a call argument found in the source code. */
+class ExtractedArgumentNode extends ArgumentNode {
+  ExtractedArgumentNode() { this = any(ExtractedDataFlowCall c).getArg(_) }
+
+  final override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
+    this.extractedArgumentOf(call, pos)
+  }
+
+  predicate extractedArgumentOf(ExtractedDataFlowCall call, ArgumentPosition pos) {
+    this = call.getArg(pos)
+  }
 }
 
 /**
@@ -390,7 +417,16 @@ class ModuleVariableNode extends Node, TModuleVariableNode {
 
   /** Gets an `EssaNode` that corresponds to an assignment of this global variable. */
   EssaNode getAWrite() {
-    result.asVar().getDefinition().(EssaNodeDefinition).definedBy(var, any(DefinitionNode defn))
+    result.getVar().getDefinition().(EssaNodeDefinition).definedBy(var, any(DefinitionNode defn))
+  }
+
+  /** Gets the possible values of the variable at the end of import time */
+  CfgNode getADefiningWrite() {
+    exists(SsaVariable def |
+      def = any(SsaVariable ssa_var).getAnUltimateDefinition() and
+      def.getDefinition() = result.asCfgNode() and
+      def.getVariable() = var
+    )
   }
 
   override DataFlowCallable getEnclosingCallable() { result.(DataFlowModuleScope).getScope() = mod }
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowUtil.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowUtil.qll
index ca10138dd58..fc697d45524 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowUtil.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowUtil.qll
@@ -5,12 +5,20 @@
 private import python
 private import DataFlowPrivate
 import DataFlowPublic
+private import FlowSummaryImpl as FlowSummaryImpl
 
 /**
  * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
  * (intra-procedural) step.
  */
-predicate localFlowStep(Node nodeFrom, Node nodeTo) { simpleLocalFlowStep(nodeFrom, nodeTo) }
+predicate localFlowStep(Node nodeFrom, Node nodeTo) {
+  simpleLocalFlowStep(nodeFrom, nodeTo)
+  or
+  // Simple flow through library code is included in the exposed local
+  // step relation, even though flow is technically inter-procedural.
+  // This is a convention followed across languages.
+  FlowSummaryImpl::Private::Steps::summaryThroughStepValue(nodeFrom, nodeTo, _)
+}
 
 /**
  * Holds if data flows from `source` to `sink` in zero or more local
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll b/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll
new file mode 100644
index 00000000000..d857cdaa359
--- /dev/null
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll
@@ -0,0 +1,1247 @@
+/**
+ * Provides classes and predicates for defining flow summaries.
+ *
+ * The definitions in this file are language-independent, and language-specific
+ * definitions are passed in via the `DataFlowImplSpecific` and
+ * `FlowSummaryImplSpecific` modules.
+ */
+
+private import FlowSummaryImplSpecific
+private import DataFlowImplSpecific::Private
+private import DataFlowImplSpecific::Public
+private import DataFlowImplCommon
+
+/** Provides classes and predicates for defining flow summaries. */
+module Public {
+  private import Private
+
+  /**
+   * A component used in a flow summary.
+   *
+   * Either a parameter or an argument at a given position, a specific
+   * content type, or a return kind.
+   */
+  class SummaryComponent extends TSummaryComponent {
+    /** Gets a textual representation of this summary component. */
+    string toString() {
+      exists(ContentSet c | this = TContentSummaryComponent(c) and result = c.toString())
+      or
+      exists(ContentSet c | this = TWithoutContentSummaryComponent(c) and result = "without " + c)
+      or
+      exists(ContentSet c | this = TWithContentSummaryComponent(c) and result = "with " + c)
+      or
+      exists(ArgumentPosition pos |
+        this = TParameterSummaryComponent(pos) and result = "parameter " + pos
+      )
+      or
+      exists(ParameterPosition pos |
+        this = TArgumentSummaryComponent(pos) and result = "argument " + pos
+      )
+      or
+      exists(ReturnKind rk | this = TReturnSummaryComponent(rk) and result = "return (" + rk + ")")
+    }
+  }
+
+  /** Provides predicates for constructing summary components. */
+  module SummaryComponent {
+    /** Gets a summary component for content `c`. */
+    SummaryComponent content(ContentSet c) { result = TContentSummaryComponent(c) }
+
+    /** Gets a summary component where data is not allowed to be stored in `c`. */
+    SummaryComponent withoutContent(ContentSet c) { result = TWithoutContentSummaryComponent(c) }
+
+    /** Gets a summary component where data must be stored in `c`. */
+    SummaryComponent withContent(ContentSet c) { result = TWithContentSummaryComponent(c) }
+
+    /** Gets a summary component for a parameter at position `pos`. */
+    SummaryComponent parameter(ArgumentPosition pos) { result = TParameterSummaryComponent(pos) }
+
+    /** Gets a summary component for an argument at position `pos`. */
+    SummaryComponent argument(ParameterPosition pos) { result = TArgumentSummaryComponent(pos) }
+
+    /** Gets a summary component for a return of kind `rk`. */
+    SummaryComponent return(ReturnKind rk) { result = TReturnSummaryComponent(rk) }
+  }
+
+  /**
+   * A (non-empty) stack of summary components.
+   *
+   * A stack is used to represent where data is read from (input) or where it
+   * is written to (output). For example, an input stack `[Field f, Argument 0]`
+   * means that data is read from field `f` from the `0`th argument, while an
+   * output stack `[Field g, Return]` means that data is written to the field
+   * `g` of the returned object.
+   */
+  class SummaryComponentStack extends TSummaryComponentStack {
+    /** Gets the head of this stack. */
+    SummaryComponent head() {
+      this = TSingletonSummaryComponentStack(result) or
+      this = TConsSummaryComponentStack(result, _)
+    }
+
+    /** Gets the tail of this stack, if any. */
+    SummaryComponentStack tail() { this = TConsSummaryComponentStack(_, result) }
+
+    /** Gets the length of this stack. */
+    int length() {
+      this = TSingletonSummaryComponentStack(_) and result = 1
+      or
+      result = 1 + this.tail().length()
+    }
+
+    /** Gets the stack obtained by dropping the first `i` elements, if any. */
+    SummaryComponentStack drop(int i) {
+      i = 0 and result = this
+      or
+      result = this.tail().drop(i - 1)
+    }
+
+    /** Holds if this stack contains summary component `c`. */
+    predicate contains(SummaryComponent c) { c = this.drop(_).head() }
+
+    /** Gets the bottom element of this stack. */
+    SummaryComponent bottom() {
+      this = TSingletonSummaryComponentStack(result) or result = this.tail().bottom()
+    }
+
+    /** Gets a textual representation of this stack. */
+    string toString() {
+      exists(SummaryComponent head, SummaryComponentStack tail |
+        head = this.head() and
+        tail = this.tail() and
+        result = tail + "." + head
+      )
+      or
+      exists(SummaryComponent c |
+        this = TSingletonSummaryComponentStack(c) and
+        result = c.toString()
+      )
+    }
+  }
+
+  /** Provides predicates for constructing stacks of summary components. */
+  module SummaryComponentStack {
+    /** Gets a singleton stack containing `c`. */
+    SummaryComponentStack singleton(SummaryComponent c) {
+      result = TSingletonSummaryComponentStack(c)
+    }
+
+    /**
+     * Gets the stack obtained by pushing `head` onto `tail`.
+     *
+     * Make sure to override `RequiredSummaryComponentStack::required()` in order
+     * to ensure that the constructed stack exists.
+     */
+    SummaryComponentStack push(SummaryComponent head, SummaryComponentStack tail) {
+      result = TConsSummaryComponentStack(head, tail)
+    }
+
+    /** Gets a singleton stack for an argument at position `pos`. */
+    SummaryComponentStack argument(ParameterPosition pos) {
+      result = singleton(SummaryComponent::argument(pos))
+    }
+
+    /** Gets a singleton stack representing a return of kind `rk`. */
+    SummaryComponentStack return(ReturnKind rk) { result = singleton(SummaryComponent::return(rk)) }
+  }
+
+  private predicate noComponentSpecificCsv(SummaryComponent sc) {
+    not exists(getComponentSpecificCsv(sc))
+  }
+
+  /** Gets a textual representation of this component used for flow summaries. */
+  private string getComponentCsv(SummaryComponent sc) {
+    result = getComponentSpecificCsv(sc)
+    or
+    noComponentSpecificCsv(sc) and
+    (
+      exists(ArgumentPosition pos |
+        sc = TParameterSummaryComponent(pos) and
+        result = "Parameter[" + getArgumentPositionCsv(pos) + "]"
+      )
+      or
+      exists(ParameterPosition pos |
+        sc = TArgumentSummaryComponent(pos) and
+        result = "Argument[" + getParameterPositionCsv(pos) + "]"
+      )
+      or
+      sc = TReturnSummaryComponent(getReturnValueKind()) and result = "ReturnValue"
+    )
+  }
+
+  /** Gets a textual representation of this stack used for flow summaries. */
+  string getComponentStackCsv(SummaryComponentStack stack) {
+    exists(SummaryComponent head, SummaryComponentStack tail |
+      head = stack.head() and
+      tail = stack.tail() and
+      result = getComponentStackCsv(tail) + "." + getComponentCsv(head)
+    )
+    or
+    exists(SummaryComponent c |
+      stack = TSingletonSummaryComponentStack(c) and
+      result = getComponentCsv(c)
+    )
+  }
+
+  /**
+   * A class that exists for QL technical reasons only (the IPA type used
+   * to represent component stacks needs to be bounded).
+   */
+  class RequiredSummaryComponentStack extends Unit {
+    /**
+     * Holds if the stack obtained by pushing `head` onto `tail` is required.
+     */
+    abstract predicate required(SummaryComponent head, SummaryComponentStack tail);
+  }
+
+  /** A callable with a flow summary. */
+  abstract class SummarizedCallable extends SummarizedCallableBase {
+    bindingset[this]
+    SummarizedCallable() { any() }
+
+    /**
+     * Holds if data may flow from `input` to `output` through this callable.
+     *
+     * `preservesValue` indicates whether this is a value-preserving step
+     * or a taint-step.
+     *
+     * Input specifications are restricted to stacks that end with
+     * `SummaryComponent::argument(_)`, preceded by zero or more
+     * `SummaryComponent::return(_)` or `SummaryComponent::content(_)` components.
+     *
+     * Output specifications are restricted to stacks that end with
+     * `SummaryComponent::return(_)` or `SummaryComponent::argument(_)`.
+     *
+     * Output stacks ending with `SummaryComponent::return(_)` can be preceded by zero
+     * or more `SummaryComponent::content(_)` components.
+     *
+     * Output stacks ending with `SummaryComponent::argument(_)` can be preceded by an
+     * optional `SummaryComponent::parameter(_)` component, which in turn can be preceded
+     * by zero or more `SummaryComponent::content(_)` components.
+     */
+    pragma[nomagic]
+    predicate propagatesFlow(
+      SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+    ) {
+      none()
+    }
+
+    /**
+     * Holds if the summary is auto generated.
+     */
+    predicate isAutoGenerated() { none() }
+  }
+
+  /** A callable with a flow summary stating there is no flow via the callable. */
+  class NegativeSummarizedCallable extends SummarizedCallableBase {
+    NegativeSummarizedCallable() { negativeSummaryElement(this, _) }
+
+    /**
+     *  Holds if the negative summary is auto generated.
+     */
+    predicate isAutoGenerated() { negativeSummaryElement(this, true) }
+  }
+}
+
+/**
+ * Provides predicates for compiling flow summaries down to atomic local steps,
+ * read steps, and store steps.
+ */
+module Private {
+  private import Public
+  import AccessPathSyntax
+
+  newtype TSummaryComponent =
+    TContentSummaryComponent(ContentSet c) or
+    TParameterSummaryComponent(ArgumentPosition pos) or
+    TArgumentSummaryComponent(ParameterPosition pos) or
+    TReturnSummaryComponent(ReturnKind rk) or
+    TWithoutContentSummaryComponent(ContentSet c) or
+    TWithContentSummaryComponent(ContentSet c)
+
+  private TParameterSummaryComponent thisParam() {
+    result = TParameterSummaryComponent(instanceParameterPosition())
+  }
+
+  newtype TSummaryComponentStack =
+    TSingletonSummaryComponentStack(SummaryComponent c) or
+    TConsSummaryComponentStack(SummaryComponent head, SummaryComponentStack tail) {
+      any(RequiredSummaryComponentStack x).required(head, tail)
+      or
+      any(RequiredSummaryComponentStack x).required(TParameterSummaryComponent(_), tail) and
+      head = thisParam()
+      or
+      derivedFluentFlowPush(_, _, _, head, tail, _)
+    }
+
+  pragma[nomagic]
+  private predicate summary(
+    SummarizedCallable c, SummaryComponentStack input, SummaryComponentStack output,
+    boolean preservesValue
+  ) {
+    c.propagatesFlow(input, output, preservesValue)
+    or
+    // observe side effects of callbacks on input arguments
+    c.propagatesFlow(output, input, preservesValue) and
+    preservesValue = true and
+    isCallbackParameter(input) and
+    isContentOfArgument(output, _)
+    or
+    // flow from the receiver of a callback into the instance-parameter
+    exists(SummaryComponentStack s, SummaryComponentStack callbackRef |
+      c.propagatesFlow(s, _, _) or c.propagatesFlow(_, s, _)
+    |
+      callbackRef = s.drop(_) and
+      (isCallbackParameter(callbackRef) or callbackRef.head() = TReturnSummaryComponent(_)) and
+      input = callbackRef.tail() and
+      output = TConsSummaryComponentStack(thisParam(), input) and
+      preservesValue = true
+    )
+    or
+    exists(SummaryComponentStack arg, SummaryComponentStack return |
+      derivedFluentFlow(c, input, arg, return, preservesValue)
+    |
+      arg.length() = 1 and
+      output = return
+      or
+      exists(SummaryComponent head, SummaryComponentStack tail |
+        derivedFluentFlowPush(c, input, arg, head, tail, 0) and
+        output = SummaryComponentStack::push(head, tail)
+      )
+    )
+    or
+    // Chain together summaries where values get passed into callbacks along the way
+    exists(SummaryComponentStack mid, boolean preservesValue1, boolean preservesValue2 |
+      c.propagatesFlow(input, mid, preservesValue1) and
+      c.propagatesFlow(mid, output, preservesValue2) and
+      mid.drop(mid.length() - 2) =
+        SummaryComponentStack::push(TParameterSummaryComponent(_),
+          SummaryComponentStack::singleton(TArgumentSummaryComponent(_))) and
+      preservesValue = preservesValue1.booleanAnd(preservesValue2)
+    )
+  }
+
+  /**
+   * Holds if `c` has a flow summary from `input` to `arg`, where `arg`
+   * writes to (contents of) arguments at position `pos`, and `c` has a
+   * value-preserving flow summary from the arguments at position `pos`
+   * to a return value (`return`).
+   *
+   * In such a case, we derive flow from `input` to (contents of) the return
+   * value.
+   *
+   * As an example, this simplifies modeling of fluent methods:
+   * for `StringBuilder.append(x)` with a specified value flow from qualifier to
+   * return value and taint flow from argument 0 to the qualifier, then this
+   * allows us to infer taint flow from argument 0 to the return value.
+   */
+  pragma[nomagic]
+  private predicate derivedFluentFlow(
+    SummarizedCallable c, SummaryComponentStack input, SummaryComponentStack arg,
+    SummaryComponentStack return, boolean preservesValue
+  ) {
+    exists(ParameterPosition pos |
+      summary(c, input, arg, preservesValue) and
+      isContentOfArgument(arg, pos) and
+      summary(c, SummaryComponentStack::argument(pos), return, true) and
+      return.bottom() = TReturnSummaryComponent(_)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate derivedFluentFlowPush(
+    SummarizedCallable c, SummaryComponentStack input, SummaryComponentStack arg,
+    SummaryComponent head, SummaryComponentStack tail, int i
+  ) {
+    derivedFluentFlow(c, input, arg, tail, _) and
+    head = arg.drop(i).head() and
+    i = arg.length() - 2
+    or
+    exists(SummaryComponent head0, SummaryComponentStack tail0 |
+      derivedFluentFlowPush(c, input, arg, head0, tail0, i + 1) and
+      head = arg.drop(i).head() and
+      tail = SummaryComponentStack::push(head0, tail0)
+    )
+  }
+
+  private predicate isCallbackParameter(SummaryComponentStack s) {
+    s.head() = TParameterSummaryComponent(_) and exists(s.tail())
+  }
+
+  private predicate isContentOfArgument(SummaryComponentStack s, ParameterPosition pos) {
+    s.head() = TContentSummaryComponent(_) and isContentOfArgument(s.tail(), pos)
+    or
+    s = SummaryComponentStack::argument(pos)
+  }
+
+  private predicate outputState(SummarizedCallable c, SummaryComponentStack s) {
+    summary(c, _, s, _)
+    or
+    exists(SummaryComponentStack out |
+      outputState(c, out) and
+      out.head() = TContentSummaryComponent(_) and
+      s = out.tail()
+    )
+    or
+    // Add the argument node corresponding to the requested post-update node
+    inputState(c, s) and isCallbackParameter(s)
+  }
+
+  private predicate inputState(SummarizedCallable c, SummaryComponentStack s) {
+    summary(c, s, _, _)
+    or
+    exists(SummaryComponentStack inp | inputState(c, inp) and s = inp.tail())
+    or
+    exists(SummaryComponentStack out |
+      outputState(c, out) and
+      out.head() = TParameterSummaryComponent(_) and
+      s = out.tail()
+    )
+  }
+
+  private newtype TSummaryNodeState =
+    TSummaryNodeInputState(SummaryComponentStack s) { inputState(_, s) } or
+    TSummaryNodeOutputState(SummaryComponentStack s) { outputState(_, s) }
+
+  /**
+   * A state used to break up (complex) flow summaries into atomic flow steps.
+   * For a flow summary
+   *
+   * ```ql
+   * propagatesFlow(
+   *   SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+   * )
+   * ```
+   *
+   * the following states are used:
+   *
+   * - `TSummaryNodeInputState(SummaryComponentStack s)`:
+   *   this state represents that the components in `s` _have been read_ from the
+   *   input.
+   * - `TSummaryNodeOutputState(SummaryComponentStack s)`:
+   *   this state represents that the components in `s` _remain to be written_ to
+   *   the output.
+   */
+  class SummaryNodeState extends TSummaryNodeState {
+    /** Holds if this state is a valid input state for `c`. */
+    pragma[nomagic]
+    predicate isInputState(SummarizedCallable c, SummaryComponentStack s) {
+      this = TSummaryNodeInputState(s) and
+      inputState(c, s)
+    }
+
+    /** Holds if this state is a valid output state for `c`. */
+    pragma[nomagic]
+    predicate isOutputState(SummarizedCallable c, SummaryComponentStack s) {
+      this = TSummaryNodeOutputState(s) and
+      outputState(c, s)
+    }
+
+    /** Gets a textual representation of this state. */
+    string toString() {
+      exists(SummaryComponentStack s |
+        this = TSummaryNodeInputState(s) and
+        result = "read: " + s
+      )
+      or
+      exists(SummaryComponentStack s |
+        this = TSummaryNodeOutputState(s) and
+        result = "to write: " + s
+      )
+    }
+  }
+
+  /**
+   * Holds if `state` represents having read from a parameter at position
+   * `pos` in `c`. In this case we are not synthesizing a data-flow node,
+   * but instead assume that a relevant parameter node already exists.
+   */
+  private predicate parameterReadState(
+    SummarizedCallable c, SummaryNodeState state, ParameterPosition pos
+  ) {
+    state.isInputState(c, SummaryComponentStack::argument(pos))
+  }
+
+  /**
+   * Holds if a synthesized summary node is needed for the state `state` in summarized
+   * callable `c`.
+   */
+  predicate summaryNodeRange(SummarizedCallable c, SummaryNodeState state) {
+    state.isInputState(c, _) and
+    not parameterReadState(c, state, _)
+    or
+    state.isOutputState(c, _)
+  }
+
+  pragma[noinline]
+  private Node summaryNodeInputState(SummarizedCallable c, SummaryComponentStack s) {
+    exists(SummaryNodeState state | state.isInputState(c, s) |
+      result = summaryNode(c, state)
+      or
+      exists(ParameterPosition pos |
+        parameterReadState(c, state, pos) and
+        result.(ParamNode).isParameterOf(inject(c), pos)
+      )
+    )
+  }
+
+  pragma[noinline]
+  private Node summaryNodeOutputState(SummarizedCallable c, SummaryComponentStack s) {
+    exists(SummaryNodeState state |
+      state.isOutputState(c, s) and
+      result = summaryNode(c, state)
+    )
+  }
+
+  /**
+   * Holds if a write targets `post`, which is a post-update node for a
+   * parameter at position `pos` in `c`.
+   */
+  private predicate isParameterPostUpdate(Node post, SummarizedCallable c, ParameterPosition pos) {
+    post = summaryNodeOutputState(c, SummaryComponentStack::argument(pos))
+  }
+
+  /** Holds if a parameter node at position `pos` is required for `c`. */
+  predicate summaryParameterNodeRange(SummarizedCallable c, ParameterPosition pos) {
+    parameterReadState(c, _, pos)
+    or
+    isParameterPostUpdate(_, c, pos)
+  }
+
+  private predicate callbackOutput(
+    SummarizedCallable c, SummaryComponentStack s, Node receiver, ReturnKind rk
+  ) {
+    any(SummaryNodeState state).isInputState(c, s) and
+    s.head() = TReturnSummaryComponent(rk) and
+    receiver = summaryNodeInputState(c, s.tail())
+  }
+
+  private predicate callbackInput(
+    SummarizedCallable c, SummaryComponentStack s, Node receiver, ArgumentPosition pos
+  ) {
+    any(SummaryNodeState state).isOutputState(c, s) and
+    s.head() = TParameterSummaryComponent(pos) and
+    receiver = summaryNodeInputState(c, s.tail())
+  }
+
+  /** Holds if a call targeting `receiver` should be synthesized inside `c`. */
+  predicate summaryCallbackRange(SummarizedCallable c, Node receiver) {
+    callbackOutput(c, _, receiver, _)
+    or
+    callbackInput(c, _, receiver, _)
+  }
+
+  /**
+   * Gets the type of synthesized summary node `n`.
+   *
+   * The type is computed based on the language-specific predicates
+   * `getContentType()`, `getReturnType()`, `getCallbackParameterType()`, and
+   * `getCallbackReturnType()`.
+   */
+  DataFlowType summaryNodeType(Node n) {
+    exists(Node pre |
+      summaryPostUpdateNode(n, pre) and
+      result = getNodeType(pre)
+    )
+    or
+    exists(SummarizedCallable c, SummaryComponentStack s, SummaryComponent head | head = s.head() |
+      n = summaryNodeInputState(c, s) and
+      (
+        exists(ContentSet cont | result = getContentType(cont) |
+          head = TContentSummaryComponent(cont) or
+          head = TWithContentSummaryComponent(cont)
+        )
+        or
+        exists(ContentSet cont |
+          head = TWithoutContentSummaryComponent(cont) and
+          result = getNodeType(summaryNodeInputState(c, s.tail()))
+        )
+        or
+        exists(ReturnKind rk |
+          head = TReturnSummaryComponent(rk) and
+          result =
+            getCallbackReturnType(getNodeType(summaryNodeInputState(pragma[only_bind_out](c),
+                  s.tail())), rk)
+        )
+      )
+      or
+      n = summaryNodeOutputState(c, s) and
+      (
+        exists(ContentSet cont |
+          head = TContentSummaryComponent(cont) and result = getContentType(cont)
+        )
+        or
+        s.length() = 1 and
+        exists(ReturnKind rk |
+          head = TReturnSummaryComponent(rk) and
+          result = getReturnType(c, rk)
+        )
+        or
+        exists(ArgumentPosition pos | head = TParameterSummaryComponent(pos) |
+          result =
+            getCallbackParameterType(getNodeType(summaryNodeInputState(pragma[only_bind_out](c),
+                  s.tail())), pos)
+        )
+      )
+    )
+  }
+
+  /** Holds if summary node `out` contains output of kind `rk` from call `c`. */
+  predicate summaryOutNode(DataFlowCall c, Node out, ReturnKind rk) {
+    exists(SummarizedCallable callable, SummaryComponentStack s, Node receiver |
+      callbackOutput(callable, s, receiver, rk) and
+      out = summaryNodeInputState(callable, s) and
+      c = summaryDataFlowCall(receiver)
+    )
+  }
+
+  /** Holds if summary node `arg` is at position `pos` in the call `c`. */
+  predicate summaryArgumentNode(DataFlowCall c, Node arg, ArgumentPosition pos) {
+    exists(SummarizedCallable callable, SummaryComponentStack s, Node receiver |
+      callbackInput(callable, s, receiver, pos) and
+      arg = summaryNodeOutputState(callable, s) and
+      c = summaryDataFlowCall(receiver)
+    )
+  }
+
+  /** Holds if summary node `post` is a post-update node with pre-update node `pre`. */
+  predicate summaryPostUpdateNode(Node post, Node pre) {
+    exists(SummarizedCallable c, ParameterPosition pos |
+      isParameterPostUpdate(post, c, pos) and
+      pre.(ParamNode).isParameterOf(inject(c), pos)
+    )
+    or
+    exists(SummarizedCallable callable, SummaryComponentStack s |
+      callbackInput(callable, s, _, _) and
+      pre = summaryNodeOutputState(callable, s) and
+      post = summaryNodeInputState(callable, s)
+    )
+  }
+
+  /** Holds if summary node `ret` is a return node of kind `rk`. */
+  predicate summaryReturnNode(Node ret, ReturnKind rk) {
+    exists(SummarizedCallable callable, SummaryComponentStack s |
+      ret = summaryNodeOutputState(callable, s) and
+      s = TSingletonSummaryComponentStack(TReturnSummaryComponent(rk))
+    )
+  }
+
+  /**
+   * Holds if flow is allowed to pass from parameter `p`, to a return
+   * node, and back out to `p`.
+   */
+  predicate summaryAllowParameterReturnInSelf(ParamNode p) {
+    exists(SummarizedCallable c, ParameterPosition ppos | p.isParameterOf(inject(c), ppos) |
+      exists(SummaryComponentStack inputContents, SummaryComponentStack outputContents |
+        summary(c, inputContents, outputContents, _) and
+        inputContents.bottom() = pragma[only_bind_into](TArgumentSummaryComponent(ppos)) and
+        outputContents.bottom() = pragma[only_bind_into](TArgumentSummaryComponent(ppos))
+      )
+    )
+  }
+
+  /** Provides a compilation of flow summaries to atomic data-flow steps. */
+  module Steps {
+    /**
+     * Holds if there is a local step from `pred` to `succ`, which is synthesized
+     * from a flow summary.
+     */
+    predicate summaryLocalStep(Node pred, Node succ, boolean preservesValue) {
+      exists(
+        SummarizedCallable c, SummaryComponentStack inputContents,
+        SummaryComponentStack outputContents
+      |
+        summary(c, inputContents, outputContents, preservesValue) and
+        pred = summaryNodeInputState(c, inputContents) and
+        succ = summaryNodeOutputState(c, outputContents)
+      |
+        preservesValue = true
+        or
+        preservesValue = false and not summary(c, inputContents, outputContents, true)
+      )
+      or
+      exists(SummarizedCallable c, SummaryComponentStack s |
+        pred = summaryNodeInputState(c, s.tail()) and
+        succ = summaryNodeInputState(c, s) and
+        s.head() = [SummaryComponent::withContent(_), SummaryComponent::withoutContent(_)] and
+        preservesValue = true
+      )
+    }
+
+    /**
+     * Holds if there is a read step of content `c` from `pred` to `succ`, which
+     * is synthesized from a flow summary.
+     */
+    predicate summaryReadStep(Node pred, ContentSet c, Node succ) {
+      exists(SummarizedCallable sc, SummaryComponentStack s |
+        pred = summaryNodeInputState(sc, s.tail()) and
+        succ = summaryNodeInputState(sc, s) and
+        SummaryComponent::content(c) = s.head()
+      )
+    }
+
+    /**
+     * Holds if there is a store step of content `c` from `pred` to `succ`, which
+     * is synthesized from a flow summary.
+     */
+    predicate summaryStoreStep(Node pred, ContentSet c, Node succ) {
+      exists(SummarizedCallable sc, SummaryComponentStack s |
+        pred = summaryNodeOutputState(sc, s) and
+        succ = summaryNodeOutputState(sc, s.tail()) and
+        SummaryComponent::content(c) = s.head()
+      )
+    }
+
+    /**
+     * Holds if values stored inside content `c` are cleared at `n`. `n` is a
+     * synthesized summary node, so in order for values to be cleared at calls
+     * to the relevant method, it is important that flow does not pass over
+     * the argument, either via use-use flow or def-use flow.
+     *
+     * Example:
+     *
+     * ```
+     * a.b = taint;
+     * a.clearB(); // assume we have a flow summary for `clearB` that clears `b` on the qualifier
+     * sink(a.b);
+     * ```
+     *
+     * In the above, flow should not pass from `a` on the first line (or the second
+     * line) to `a` on the third line. Instead, there will be synthesized flow from
+     * `a` on line 2 to the post-update node for `a` on that line (via an intermediate
+     * node where field `b` is cleared).
+     */
+    predicate summaryClearsContent(Node n, ContentSet c) {
+      exists(SummarizedCallable sc, SummaryNodeState state, SummaryComponentStack stack |
+        n = summaryNode(sc, state) and
+        state.isInputState(sc, stack) and
+        stack.head() = SummaryComponent::withoutContent(c)
+      )
+    }
+
+    /**
+     * Holds if the value that is being tracked is expected to be stored inside
+     * content `c` at `n`.
+     */
+    predicate summaryExpectsContent(Node n, ContentSet c) {
+      exists(SummarizedCallable sc, SummaryNodeState state, SummaryComponentStack stack |
+        n = summaryNode(sc, state) and
+        state.isInputState(sc, stack) and
+        stack.head() = SummaryComponent::withContent(c)
+      )
+    }
+
+    pragma[noinline]
+    private predicate viableParam(
+      DataFlowCall call, SummarizedCallable sc, ParameterPosition ppos, ParamNode p
+    ) {
+      exists(DataFlowCallable c |
+        c = inject(sc) and
+        p.isParameterOf(c, ppos) and
+        c = viableCallable(call)
+      )
+    }
+
+    pragma[nomagic]
+    private ParamNode summaryArgParam0(DataFlowCall call, ArgNode arg, SummarizedCallable sc) {
+      exists(ParameterPosition ppos |
+        argumentPositionMatch(call, arg, ppos) and
+        viableParam(call, sc, ppos, result)
+      )
+    }
+
+    /**
+     * Holds if use-use flow starting from `arg` should be prohibited.
+     *
+     * This is the case when `arg` is the argument of a call that targets a
+     * flow summary where the corresponding parameter either clears contents
+     * or expects contents.
+     */
+    pragma[nomagic]
+    predicate prohibitsUseUseFlow(ArgNode arg, SummarizedCallable sc) {
+      exists(ParamNode p, Node mid, ParameterPosition ppos, Node ret |
+        p = summaryArgParam0(_, arg, sc) and
+        p.isParameterOf(_, pragma[only_bind_into](ppos)) and
+        summaryLocalStep(p, mid, true) and
+        summaryLocalStep(mid, ret, true) and
+        isParameterPostUpdate(ret, _, pragma[only_bind_into](ppos))
+      |
+        summaryClearsContent(mid, _) or
+        summaryExpectsContent(mid, _)
+      )
+    }
+
+    bindingset[ret]
+    private ParamNode summaryArgParam(
+      ArgNode arg, ReturnNodeExt ret, OutNodeExt out, SummarizedCallable sc
+    ) {
+      exists(DataFlowCall call, ReturnKindExt rk |
+        result = summaryArgParam0(call, arg, sc) and
+        ret.getKind() = pragma[only_bind_into](rk) and
+        out = pragma[only_bind_into](rk).getAnOutNode(call)
+      )
+    }
+
+    /**
+     * Holds if `arg` flows to `out` using a simple value-preserving flow
+     * summary, that is, a flow summary without reads and stores.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summaryThroughStepValue(ArgNode arg, Node out, SummarizedCallable sc) {
+      exists(ReturnKind rk, ReturnNode ret, DataFlowCall call |
+        summaryLocalStep(summaryArgParam0(call, arg, sc), ret, true) and
+        ret.getKind() = pragma[only_bind_into](rk) and
+        out = getAnOutNode(call, pragma[only_bind_into](rk))
+      )
+    }
+
+    /**
+     * Holds if `arg` flows to `out` using a simple flow summary involving taint
+     * step, that is, a flow summary without reads and stores.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summaryThroughStepTaint(ArgNode arg, Node out, SummarizedCallable sc) {
+      exists(ReturnNodeExt ret | summaryLocalStep(summaryArgParam(arg, ret, out, sc), ret, false))
+    }
+
+    /**
+     * Holds if there is a read(+taint) of `c` from `arg` to `out` using a
+     * flow summary.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summaryGetterStep(ArgNode arg, ContentSet c, Node out, SummarizedCallable sc) {
+      exists(Node mid, ReturnNodeExt ret |
+        summaryReadStep(summaryArgParam(arg, ret, out, sc), c, mid) and
+        summaryLocalStep(mid, ret, _)
+      )
+    }
+
+    /**
+     * Holds if there is a (taint+)store of `arg` into content `c` of `out` using a
+     * flow summary.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summarySetterStep(ArgNode arg, ContentSet c, Node out, SummarizedCallable sc) {
+      exists(Node mid, ReturnNodeExt ret |
+        summaryLocalStep(summaryArgParam(arg, ret, out, sc), mid, _) and
+        summaryStoreStep(mid, c, ret)
+      )
+    }
+  }
+
+  /**
+   * Provides a means of translating externally (e.g., CSV) defined flow
+   * summaries into a `SummarizedCallable`s.
+   */
+  module External {
+    /** Holds if `spec` is a relevant external specification. */
+    private predicate relevantSpec(string spec) {
+      summaryElement(_, spec, _, _, _) or
+      summaryElement(_, _, spec, _, _) or
+      sourceElement(_, spec, _, _) or
+      sinkElement(_, spec, _, _)
+    }
+
+    private class AccessPathRange extends AccessPath::Range {
+      AccessPathRange() { relevantSpec(this) }
+    }
+
+    /** Holds if specification component `c` parses as parameter `n`. */
+    predicate parseParam(AccessPathToken token, ArgumentPosition pos) {
+      token.getName() = "Parameter" and
+      pos = parseParamBody(token.getAnArgument())
+    }
+
+    /** Holds if specification component `c` parses as argument `n`. */
+    predicate parseArg(AccessPathToken token, ParameterPosition pos) {
+      token.getName() = "Argument" and
+      pos = parseArgBody(token.getAnArgument())
+    }
+
+    private SummaryComponent interpretComponent(AccessPathToken token) {
+      exists(ParameterPosition pos |
+        parseArg(token, pos) and result = SummaryComponent::argument(pos)
+      )
+      or
+      exists(ArgumentPosition pos |
+        parseParam(token, pos) and result = SummaryComponent::parameter(pos)
+      )
+      or
+      token = "ReturnValue" and result = SummaryComponent::return(getReturnValueKind())
+      or
+      result = interpretComponentSpecific(token)
+    }
+
+    /**
+     * Holds if `spec` specifies summary component stack `stack`.
+     */
+    predicate interpretSpec(AccessPath spec, SummaryComponentStack stack) {
+      interpretSpec(spec, spec.getNumToken(), stack)
+    }
+
+    /** Holds if the first `n` tokens of `spec` resolves to `stack`. */
+    private predicate interpretSpec(AccessPath spec, int n, SummaryComponentStack stack) {
+      n = 1 and
+      stack = SummaryComponentStack::singleton(interpretComponent(spec.getToken(0)))
+      or
+      exists(SummaryComponent head, SummaryComponentStack tail |
+        interpretSpec(spec, n, head, tail) and
+        stack = SummaryComponentStack::push(head, tail)
+      )
+    }
+
+    /** Holds if the first `n` tokens of `spec` resolves to `head` followed by `tail` */
+    private predicate interpretSpec(
+      AccessPath spec, int n, SummaryComponent head, SummaryComponentStack tail
+    ) {
+      interpretSpec(spec, n - 1, tail) and
+      head = interpretComponent(spec.getToken(n - 1))
+    }
+
+    private class MkStack extends RequiredSummaryComponentStack {
+      override predicate required(SummaryComponent head, SummaryComponentStack tail) {
+        interpretSpec(_, _, head, tail)
+      }
+    }
+
+    private class SummarizedCallableExternal extends SummarizedCallable {
+      SummarizedCallableExternal() { summaryElement(this, _, _, _, _) }
+
+      private predicate relevantSummaryElementGenerated(
+        AccessPath inSpec, AccessPath outSpec, string kind
+      ) {
+        summaryElement(this, inSpec, outSpec, kind, true) and
+        not summaryElement(this, _, _, _, false)
+      }
+
+      private predicate relevantSummaryElement(AccessPath inSpec, AccessPath outSpec, string kind) {
+        summaryElement(this, inSpec, outSpec, kind, false)
+        or
+        this.relevantSummaryElementGenerated(inSpec, outSpec, kind)
+      }
+
+      override predicate propagatesFlow(
+        SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+      ) {
+        exists(AccessPath inSpec, AccessPath outSpec, string kind |
+          this.relevantSummaryElement(inSpec, outSpec, kind) and
+          interpretSpec(inSpec, input) and
+          interpretSpec(outSpec, output)
+        |
+          kind = "value" and preservesValue = true
+          or
+          kind = "taint" and preservesValue = false
+        )
+      }
+
+      override predicate isAutoGenerated() { this.relevantSummaryElementGenerated(_, _, _) }
+    }
+
+    /** Holds if component `c` of specification `spec` cannot be parsed. */
+    predicate invalidSpecComponent(AccessPath spec, string c) {
+      c = spec.getToken(_) and
+      not exists(interpretComponent(c))
+    }
+
+    private predicate inputNeedsReference(AccessPathToken c) {
+      c.getName() = "Argument" or
+      inputNeedsReferenceSpecific(c)
+    }
+
+    private predicate outputNeedsReference(AccessPathToken c) {
+      c.getName() = ["Argument", "ReturnValue"] or
+      outputNeedsReferenceSpecific(c)
+    }
+
+    private predicate sourceElementRef(InterpretNode ref, AccessPath output, string kind) {
+      exists(SourceOrSinkElement e |
+        sourceElement(e, output, kind, _) and
+        if outputNeedsReference(output.getToken(0))
+        then e = ref.getCallTarget()
+        else e = ref.asElement()
+      )
+    }
+
+    private predicate sinkElementRef(InterpretNode ref, AccessPath input, string kind) {
+      exists(SourceOrSinkElement e |
+        sinkElement(e, input, kind, _) and
+        if inputNeedsReference(input.getToken(0))
+        then e = ref.getCallTarget()
+        else e = ref.asElement()
+      )
+    }
+
+    /** Holds if the first `n` tokens of `output` resolve to the given interpretation. */
+    private predicate interpretOutput(
+      AccessPath output, int n, InterpretNode ref, InterpretNode node
+    ) {
+      sourceElementRef(ref, output, _) and
+      n = 0 and
+      (
+        if output = ""
+        then
+          // Allow language-specific interpretation of the empty access path
+          interpretOutputSpecific("", ref, node)
+        else node = ref
+      )
+      or
+      exists(InterpretNode mid, AccessPathToken c |
+        interpretOutput(output, n - 1, ref, mid) and
+        c = output.getToken(n - 1)
+      |
+        exists(ArgumentPosition apos, ParameterPosition ppos |
+          node.asNode().(PostUpdateNode).getPreUpdateNode().(ArgNode).argumentOf(mid.asCall(), apos) and
+          parameterMatch(ppos, apos)
+        |
+          c = "Argument" or parseArg(c, ppos)
+        )
+        or
+        exists(ArgumentPosition apos, ParameterPosition ppos |
+          node.asNode().(ParamNode).isParameterOf(mid.asCallable(), ppos) and
+          parameterMatch(ppos, apos)
+        |
+          c = "Parameter" or parseParam(c, apos)
+        )
+        or
+        c = "ReturnValue" and
+        node.asNode() = getAnOutNodeExt(mid.asCall(), TValueReturn(getReturnValueKind()))
+        or
+        interpretOutputSpecific(c, mid, node)
+      )
+    }
+
+    /** Holds if the first `n` tokens of `input` resolve to the given interpretation. */
+    private predicate interpretInput(AccessPath input, int n, InterpretNode ref, InterpretNode node) {
+      sinkElementRef(ref, input, _) and
+      n = 0 and
+      (
+        if input = ""
+        then
+          // Allow language-specific interpretation of the empty access path
+          interpretInputSpecific("", ref, node)
+        else node = ref
+      )
+      or
+      exists(InterpretNode mid, AccessPathToken c |
+        interpretInput(input, n - 1, ref, mid) and
+        c = input.getToken(n - 1)
+      |
+        exists(ArgumentPosition apos, ParameterPosition ppos |
+          node.asNode().(ArgNode).argumentOf(mid.asCall(), apos) and
+          parameterMatch(ppos, apos)
+        |
+          c = "Argument" or parseArg(c, ppos)
+        )
+        or
+        exists(ReturnNodeExt ret |
+          c = "ReturnValue" and
+          ret = node.asNode() and
+          ret.getKind().(ValueReturnKind).getKind() = getReturnValueKind() and
+          mid.asCallable() = getNodeEnclosingCallable(ret)
+        )
+        or
+        interpretInputSpecific(c, mid, node)
+      )
+    }
+
+    /**
+     * Holds if `node` is specified as a source with the given kind in a CSV flow
+     * model.
+     */
+    predicate isSourceNode(InterpretNode node, string kind) {
+      exists(InterpretNode ref, AccessPath output |
+        sourceElementRef(ref, output, kind) and
+        interpretOutput(output, output.getNumToken(), ref, node)
+      )
+    }
+
+    /**
+     * Holds if `node` is specified as a sink with the given kind in a CSV flow
+     * model.
+     */
+    predicate isSinkNode(InterpretNode node, string kind) {
+      exists(InterpretNode ref, AccessPath input |
+        sinkElementRef(ref, input, kind) and
+        interpretInput(input, input.getNumToken(), ref, node)
+      )
+    }
+  }
+
+  /** Provides a query predicate for outputting a set of relevant flow summaries. */
+  module TestOutput {
+    /** A flow summary to include in the `summary/1` query predicate. */
+    abstract class RelevantSummarizedCallable instanceof SummarizedCallable {
+      /** Gets the string representation of this callable used by `summary/1`. */
+      abstract string getCallableCsv();
+
+      /** Holds if flow is propagated between `input` and `output`. */
+      predicate relevantSummary(
+        SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+      ) {
+        super.propagatesFlow(input, output, preservesValue)
+      }
+
+      string toString() { result = super.toString() }
+    }
+
+    /** A flow summary to include in the `negativeSummary/1` query predicate. */
+    abstract class RelevantNegativeSummarizedCallable instanceof NegativeSummarizedCallable {
+      /** Gets the string representation of this callable used by `summary/1`. */
+      abstract string getCallableCsv();
+
+      string toString() { result = super.toString() }
+    }
+
+    /** Render the kind in the format used in flow summaries. */
+    private string renderKind(boolean preservesValue) {
+      preservesValue = true and result = "value"
+      or
+      preservesValue = false and result = "taint"
+    }
+
+    private string renderProvenance(SummarizedCallable c) {
+      if c.isAutoGenerated() then result = "generated" else result = "manual"
+    }
+
+    private string renderProvenanceNegative(NegativeSummarizedCallable c) {
+      if c.isAutoGenerated() then result = "generated" else result = "manual"
+    }
+
+    /**
+     * A query predicate for outputting flow summaries in semi-colon separated format in QL tests.
+     * The syntax is: "namespace;type;overrides;name;signature;ext;inputspec;outputspec;kind;provenance"",
+     * ext is hardcoded to empty.
+     */
+    query predicate summary(string csv) {
+      exists(
+        RelevantSummarizedCallable c, SummaryComponentStack input, SummaryComponentStack output,
+        boolean preservesValue
+      |
+        c.relevantSummary(input, output, preservesValue) and
+        csv =
+          c.getCallableCsv() // Callable information
+            + getComponentStackCsv(input) + ";" // input
+            + getComponentStackCsv(output) + ";" // output
+            + renderKind(preservesValue) + ";" // kind
+            + renderProvenance(c) // provenance
+      )
+    }
+
+    /**
+     * Holds if a negative flow summary `csv` exists (semi-colon separated format). Used for testing purposes.
+     * The syntax is: "namespace;type;name;signature;provenance"",
+     */
+    query predicate negativeSummary(string csv) {
+      exists(RelevantNegativeSummarizedCallable c |
+        csv =
+          c.getCallableCsv() // Callable information
+            + renderProvenanceNegative(c) // provenance
+      )
+    }
+  }
+
+  /**
+   * Provides query predicates for rendering the generated data flow graph for
+   * a summarized callable.
+   *
+   * Import this module into a `.ql` file of `@kind graph` to render the graph.
+   * The graph is restricted to callables from `RelevantSummarizedCallable`.
+   */
+  module RenderSummarizedCallable {
+    /** A summarized callable to include in the graph. */
+    abstract class RelevantSummarizedCallable instanceof SummarizedCallable {
+      string toString() { result = super.toString() }
+    }
+
+    private newtype TNodeOrCall =
+      MkNode(Node n) {
+        exists(RelevantSummarizedCallable c |
+          n = summaryNode(c, _)
+          or
+          n.(ParamNode).isParameterOf(inject(c), _)
+        )
+      } or
+      MkCall(DataFlowCall call) {
+        call = summaryDataFlowCall(_) and
+        call.getEnclosingCallable() = inject(any(RelevantSummarizedCallable c))
+      }
+
+    private class NodeOrCall extends TNodeOrCall {
+      Node asNode() { this = MkNode(result) }
+
+      DataFlowCall asCall() { this = MkCall(result) }
+
+      string toString() {
+        result = this.asNode().toString()
+        or
+        result = this.asCall().toString()
+      }
+
+      /**
+       * Holds if this element is at the specified location.
+       * The location spans column `startcolumn` of line `startline` to
+       * column `endcolumn` of line `endline` in file `filepath`.
+       * For more information, see
+       * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+       */
+      predicate hasLocationInfo(
+        string filepath, int startline, int startcolumn, int endline, int endcolumn
+      ) {
+        this.asNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+        or
+        this.asCall().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+      }
+    }
+
+    query predicate nodes(NodeOrCall n, string key, string val) {
+      key = "semmle.label" and val = n.toString()
+    }
+
+    private predicate edgesComponent(NodeOrCall a, NodeOrCall b, string value) {
+      exists(boolean preservesValue |
+        Private::Steps::summaryLocalStep(a.asNode(), b.asNode(), preservesValue) and
+        if preservesValue = true then value = "value" else value = "taint"
+      )
+      or
+      exists(ContentSet c |
+        Private::Steps::summaryReadStep(a.asNode(), c, b.asNode()) and
+        value = "read (" + c + ")"
+        or
+        Private::Steps::summaryStoreStep(a.asNode(), c, b.asNode()) and
+        value = "store (" + c + ")"
+        or
+        Private::Steps::summaryClearsContent(a.asNode(), c) and
+        b = a and
+        value = "clear (" + c + ")"
+        or
+        Private::Steps::summaryExpectsContent(a.asNode(), c) and
+        b = a and
+        value = "expect (" + c + ")"
+      )
+      or
+      summaryPostUpdateNode(b.asNode(), a.asNode()) and
+      value = "post-update"
+      or
+      b.asCall() = summaryDataFlowCall(a.asNode()) and
+      value = "receiver"
+      or
+      exists(ArgumentPosition pos |
+        summaryArgumentNode(b.asCall(), a.asNode(), pos) and
+        value = "argument (" + pos + ")"
+      )
+    }
+
+    query predicate edges(NodeOrCall a, NodeOrCall b, string key, string value) {
+      key = "semmle.label" and
+      value = strictconcat(string s | edgesComponent(a, b, s) | s, " / ")
+    }
+  }
+}
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImplSpecific.qll b/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImplSpecific.qll
new file mode 100644
index 00000000000..2f12e3a03d9
--- /dev/null
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImplSpecific.qll
@@ -0,0 +1,225 @@
+/**
+ * Provides Python specific classes and predicates for defining flow summaries.
+ *
+ * Flow summaries are defined for callables that are not extracted.
+ * Such callables go by different names in different parts of our codebase:
+ *
+ * - in `FlowSummary.qll`, which is user facing, they are called `SummarizedCallable`s.
+ *   These contain summaries, implemented by the user via the predicates `propagatesFlow` and `propagatesFlowExt`.
+ *
+ * - in the data flow layer, they are called `LibraryCallable`s (as in the Ruby codebase).
+ *   These are identified by strings and has predicates for finding calls to them.
+ *
+ * Having both extracted and non-extracted callables means that we now have three types of calls:
+ * - Extracted calls to extracted callables, either `NormalCall` or `SpecialCall`. These are handled by standard data flow.
+ * - Extracted calls to non-extracted callables, `LibraryCall`. These are handled by loking up the relevant summary when the
+ *   global data flwo graph is connected up via `getViableCallable`.
+ * - Non-extracted calls, `SummaryCall`. These are synthesised by the flow summary framework.
+ *
+ * The first two can be referred to as `ExtractedDataFlowCall`. In fact, `LibraryCall` is a subclass of `NormalCall`, where
+ * `getCallable` is set to `none()`. The member predicate `ExtractedDataFlowCall::getCallable` is _not_ the mechanism for
+ * call resolution in global data flow. That mechanism is `getViableCallable`.
+ * Resolving a call to a non-extracted callable goes via `LibraryCallable::getACall`, which may involve type tracking.
+ * To avoid that type tracking becomes mutualy recursive with data flow, type tracking must use a call graph not including summaries.
+ * Type tracking sees the callgraph given by `ExtractedDataFlowCall::getACallable`.
+ *
+ * We do not support summaries of special methods via the special methods framework,
+ * the summary would have to identify the call.
+ *
+ * We might, while we still extract the standard library, want to support flow summaries of
+ * extracted callables, so that we can model part of the standard library with flow summaries.
+ * For this to work, we have be careful with the enclosing callable predicate.
+ */
+
+private import python
+private import DataFlowPrivate
+private import DataFlowPublic
+private import DataFlowImplCommon
+private import FlowSummaryImpl::Private
+private import FlowSummaryImpl::Public
+private import semmle.python.dataflow.new.FlowSummary as FlowSummary
+
+class SummarizedCallableBase = string;
+
+/** View a `SummarizedCallable` as a `DataFlowCallable`. */
+DataFlowCallable inject(SummarizedCallable c) { result.asLibraryCallable() = c }
+
+/** Gets the parameter position of the instance parameter. */
+ArgumentPosition instanceParameterPosition() { none() } // disables implicit summary flow to `this` for callbacks
+
+/** Gets the synthesized summary data-flow node for the given values. */
+Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = TSummaryNode(c, state) }
+
+/** Gets the synthesized data-flow call for `receiver`. */
+SummaryCall summaryDataFlowCall(Node receiver) { receiver = result.getReceiver() }
+
+/** Gets the type of content `c`. */
+DataFlowType getContentType(Content c) { any() }
+
+/** Gets the return type of kind `rk` for callable `c`. */
+bindingset[c, rk]
+DataFlowType getReturnType(SummarizedCallable c, ReturnKind rk) { any() }
+
+/**
+ * Gets the type of the `i`th parameter in a synthesized call that targets a
+ * callback of type `t`.
+ */
+bindingset[t, i]
+DataFlowType getCallbackParameterType(DataFlowType t, int i) { any() }
+
+/**
+ * Gets the return type of kind `rk` in a synthesized call that targets a
+ * callback of type `t`.
+ */
+DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) { any() }
+
+/**
+ * Holds if an external flow summary exists for `c` with input specification
+ * `input`, output specification `output`, kind `kind`, and a flag `generated`
+ * stating whether the summary is autogenerated.
+ */
+predicate summaryElement(
+  FlowSummary::SummarizedCallable c, string input, string output, string kind, boolean generated
+) {
+  exists(boolean preservesValue |
+    c.propagatesFlowExt(input, output, preservesValue) and
+    (if preservesValue = true then kind = "value" else kind = "taint") and
+    generated = false
+  )
+}
+
+/**
+ * Holds if a negative flow summary exists for `c`, which means that there is no
+ * flow through `c`. The flag `generated` states whether the summary is autogenerated.
+ * Note. Negative flow summaries has not been implemented for Python.
+ */
+predicate negativeSummaryElement(FlowSummary::SummarizedCallable c, boolean generated) { none() }
+
+/**
+ * Gets the summary component for specification component `c`, if any.
+ *
+ * This covers all the Python-specific components of a flow summary.
+ */
+SummaryComponent interpretComponentSpecific(AccessPathToken c) {
+  c = "ListElement" and
+  result = FlowSummary::SummaryComponent::listElement()
+}
+
+/** Gets the textual representation of a summary component in the format used for flow summaries. */
+string getComponentSpecificCsv(SummaryComponent sc) {
+  sc = TContentSummaryComponent(any(ListElementContent c)) and
+  result = "ListElement"
+}
+
+/** Gets the textual representation of a parameter position in the format used for flow summaries. */
+string getParameterPositionCsv(ParameterPosition pos) { result = pos.toString() }
+
+/** Gets the textual representation of an argument position in the format used for flow summaries. */
+string getArgumentPositionCsv(ArgumentPosition pos) { result = pos.toString() }
+
+/** Holds if input specification component `c` needs a reference. */
+predicate inputNeedsReferenceSpecific(string c) { none() }
+
+/** Holds if output specification component `c` needs a reference. */
+predicate outputNeedsReferenceSpecific(string c) { none() }
+
+/** Gets the return kind corresponding to specification `"ReturnValue"`. */
+ReturnKind getReturnValueKind() { any() }
+
+/**
+ * All definitions in this module are required by the shared implementation
+ * (for source/sink interpretation), but they are unused for Python, where
+ * we rely on API graphs instead.
+ */
+private module UnusedSourceSinkInterpretation {
+  /**
+   * Holds if an external source specification exists for `n` with output specification
+   * `output`, kind `kind`, and a flag `generated` stating whether the source specification is
+   * autogenerated.
+   */
+  predicate sourceElement(AstNode n, string output, string kind, boolean generated) { none() }
+
+  /**
+   * Holds if an external sink specification exists for `n` with input specification
+   * `input`, kind `kind` and a flag `generated` stating whether the sink specification is
+   * autogenerated.
+   */
+  predicate sinkElement(AstNode n, string input, string kind, boolean generated) { none() }
+
+  class SourceOrSinkElement = AstNode;
+
+  /** An entity used to interpret a source/sink specification. */
+  class InterpretNode extends AstNode_ {
+    // InterpretNode is going away, this is just a dummy implementation.
+    // However, we have some old location tests picking them up, so we
+    // explicitly define them to not exist.
+    InterpretNode() { none() }
+
+    /** Gets the element that this node corresponds to, if any. */
+    SourceOrSinkElement asElement() { none() }
+
+    /** Gets the data-flow node that this node corresponds to, if any. */
+    Node asNode() { none() }
+
+    /** Gets the call that this node corresponds to, if any. */
+    DataFlowCall asCall() { none() }
+
+    /** Gets the callable that this node corresponds to, if any. */
+    DataFlowCallable asCallable() { none() }
+
+    /** Gets the target of this call, if any. */
+    SourceOrSinkElement getCallTarget() { none() }
+  }
+
+  /** Provides additional sink specification logic. */
+  predicate interpretOutputSpecific(string c, InterpretNode mid, InterpretNode node) { none() }
+
+  /** Provides additional source specification logic. */
+  predicate interpretInputSpecific(string c, InterpretNode mid, InterpretNode node) { none() }
+}
+
+import UnusedSourceSinkInterpretation
+
+module ParsePositions {
+  private import FlowSummaryImpl
+
+  private predicate isParamBody(string body) {
+    exists(AccessPathToken tok |
+      tok.getName() = "Parameter" and
+      body = tok.getAnArgument()
+    )
+  }
+
+  private predicate isArgBody(string body) {
+    exists(AccessPathToken tok |
+      tok.getName() = "Argument" and
+      body = tok.getAnArgument()
+    )
+  }
+
+  predicate isParsedParameterPosition(string c, int i) {
+    isParamBody(c) and
+    i = AccessPath::parseInt(c)
+  }
+
+  predicate isParsedArgumentPosition(string c, int i) {
+    isArgBody(c) and
+    i = AccessPath::parseInt(c)
+  }
+}
+
+/** Gets the argument position obtained by parsing `X` in `Parameter[X]`. */
+ArgumentPosition parseParamBody(string s) {
+  exists(int i |
+    ParsePositions::isParsedParameterPosition(s, i) and
+    result.isPositional(i)
+  )
+}
+
+/** Gets the parameter position obtained by parsing `X` in `Argument[X]`. */
+ParameterPosition parseArgBody(string s) {
+  exists(int i |
+    ParsePositions::isParsedArgumentPosition(s, i) and
+    result.isPositional(i)
+  )
+}
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/ImportResolution.qll b/python/ql/lib/semmle/python/dataflow/new/internal/ImportResolution.qll
new file mode 100644
index 00000000000..0c346fa2dd4
--- /dev/null
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/ImportResolution.qll
@@ -0,0 +1,29 @@
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.internal.ImportStar
+private import semmle.python.dataflow.new.TypeTracker
+
+module ImportResolution {
+  /**
+   * Holds if the module `m` defines a name `name` by assigning `defn` to it. This is an
+   * overapproximation, as `name` may not in fact be exported (e.g. by defining an `__all__` that does
+   * not include `name`).
+   */
+  predicate module_export(Module m, string name, DataFlow::CfgNode defn) {
+    exists(EssaVariable v |
+      v.getName() = name and
+      v.getAUse() = ImportStar::getStarImported*(m).getANormalExit()
+    |
+      defn.getNode() = v.getDefinition().(AssignmentDefinition).getValue()
+      or
+      defn.getNode() = v.getDefinition().(ArgumentRefinement).getArgument()
+    )
+  }
+
+  Module getModule(DataFlow::CfgNode node) {
+    exists(ModuleValue mv |
+      node.getNode().pointsTo(mv) and
+      result = mv.getScope()
+    )
+  }
+}
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/ImportStar.qll b/python/ql/lib/semmle/python/dataflow/new/internal/ImportStar.qll
index 7c05f4cc736..ae115342dba 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/ImportStar.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/ImportStar.qll
@@ -2,6 +2,8 @@
 
 private import python
 private import semmle.python.dataflow.new.internal.Builtins
+private import semmle.python.dataflow.new.internal.ImportResolution
+private import semmle.python.dataflow.new.DataFlow
 
 cached
 module ImportStar {
@@ -71,8 +73,10 @@ module ImportStar {
    */
   cached
   Module getStarImported(Module m) {
-    exists(ImportStar i |
-      i.getScope() = m and result = i.getModule().pointsTo().(ModuleValue).getScope()
+    exists(ImportStar i, DataFlow::CfgNode imported_module |
+      imported_module.getNode().getNode() = i.getModule() and
+      i.getScope() = m and
+      result = ImportResolution::getModule(imported_module)
     )
   }
 
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/IterableUnpacking.qll b/python/ql/lib/semmle/python/dataflow/new/internal/IterableUnpacking.qll
index 4bf73dba0a3..f576529e3c6 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/IterableUnpacking.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/IterableUnpacking.qll
@@ -244,7 +244,7 @@ class UnpackingAssignmentSequenceTarget extends UnpackingAssignmentTarget instan
  */
 predicate iterableUnpackingAssignmentFlowStep(Node nodeFrom, Node nodeTo) {
   exists(AssignmentTarget target |
-    nodeFrom.asExpr() = target.getValue() and
+    nodeFrom.(CfgNode).getNode().getNode() = target.getValue() and
     nodeTo = TIterableSequenceNode(target)
   )
 }
@@ -255,7 +255,7 @@ predicate iterableUnpackingAssignmentFlowStep(Node nodeFrom, Node nodeTo) {
  */
 predicate iterableUnpackingForReadStep(CfgNode nodeFrom, Content c, Node nodeTo) {
   exists(ForTarget target |
-    nodeFrom.asExpr() = target.getSource() and
+    nodeFrom.getNode().getNode() = target.getSource() and
     target instanceof SequenceNode and
     nodeTo = TIterableSequenceNode(target)
   ) and
@@ -273,7 +273,7 @@ predicate iterableUnpackingForReadStep(CfgNode nodeFrom, Content c, Node nodeTo)
 predicate iterableUnpackingTupleFlowStep(Node nodeFrom, Node nodeTo) {
   exists(UnpackingAssignmentSequenceTarget target |
     nodeFrom = TIterableSequenceNode(target) and
-    nodeTo.asCfgNode() = target
+    nodeTo.(CfgNode).getNode() = target
   )
 }
 
@@ -305,7 +305,7 @@ predicate iterableUnpackingConvertingReadStep(Node nodeFrom, Content c, Node nod
 predicate iterableUnpackingConvertingStoreStep(Node nodeFrom, Content c, Node nodeTo) {
   exists(UnpackingAssignmentSequenceTarget target |
     nodeFrom = TIterableElementNode(target) and
-    nodeTo.asCfgNode() = target and
+    nodeTo.(CfgNode).getNode() = target and
     exists(int index | exists(target.getElement(index)) |
       c.(TupleElementContent).getIndex() = index
     )
@@ -331,7 +331,7 @@ predicate iterableUnpackingElementReadStep(Node nodeFrom, Content c, Node nodeTo
     not exists(target.getAnElement().(StarredNode)) and
     starIndex = -1
   |
-    nodeFrom.asCfgNode() = target and
+    nodeFrom.(CfgNode).getNode() = target and
     element = target.getElement(index) and
     (
       if starIndex = -1 or index < starIndex
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/LocalSources.qll b/python/ql/lib/semmle/python/dataflow/new/internal/LocalSources.qll
index 08d8dff2a02..473d85d0851 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/LocalSources.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/LocalSources.qll
@@ -36,7 +36,7 @@ class LocalSourceNode extends Node {
   LocalSourceNode() {
     Stages::DataFlow::ref() and
     this instanceof ExprNode and
-    not simpleLocalFlowStep(_, this)
+    not simpleLocalFlowStepForTypetracking(_, this)
     or
     // We include all module variable nodes, as these act as stepping stones between writes and
     // reads of global variables. Without them, type tracking based on `LocalSourceNode`s would be
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/MatchUnpacking.qll b/python/ql/lib/semmle/python/dataflow/new/internal/MatchUnpacking.qll
index 948536d5598..1447b726f2a 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/MatchUnpacking.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/MatchUnpacking.qll
@@ -69,8 +69,8 @@ predicate matchSubjectFlowStep(Node nodeFrom, Node nodeTo) {
     subject = match.getSubject() and
     target = match.getCase(_).(Case).getPattern()
   |
-    nodeFrom.asExpr() = subject and
-    nodeTo.asCfgNode().getNode() = target
+    nodeFrom.(CfgNode).getNode().getNode() = subject and
+    nodeTo.(CfgNode).getNode().getNode() = target
   )
 }
 
@@ -84,12 +84,13 @@ predicate matchAsFlowStep(Node nodeFrom, Node nodeTo) {
     // That way, information can propagate from the interior pattern to the alias.
     //
     // the subject flows to the interior pattern
-    nodeFrom.asCfgNode().getNode() = subject and
-    nodeTo.asCfgNode().getNode() = subject.getPattern()
+    nodeFrom.(CfgNode).getNode().getNode() = subject and
+    nodeTo.(CfgNode).getNode().getNode() = subject.getPattern()
     or
     // the interior pattern flows to the alias
-    nodeFrom.asCfgNode().getNode() = subject.getPattern() and
-    nodeTo.asVar().getDefinition().(PatternAliasDefinition).getDefiningNode().getNode() = alias
+    nodeFrom.(CfgNode).getNode().getNode() = subject.getPattern() and
+    nodeTo.(EssaNode).getVar().getDefinition().(PatternAliasDefinition).getDefiningNode().getNode() =
+      alias
   )
 }
 
@@ -99,8 +100,8 @@ predicate matchAsFlowStep(Node nodeFrom, Node nodeTo) {
  */
 predicate matchOrFlowStep(Node nodeFrom, Node nodeTo) {
   exists(MatchOrPattern subject, Pattern pattern | pattern = subject.getAPattern() |
-    nodeFrom.asCfgNode().getNode() = subject and
-    nodeTo.asCfgNode().getNode() = pattern
+    nodeFrom.(CfgNode).getNode().getNode() = subject and
+    nodeTo.(CfgNode).getNode().getNode() = pattern
   )
 }
 
@@ -110,8 +111,8 @@ predicate matchOrFlowStep(Node nodeFrom, Node nodeTo) {
  */
 predicate matchLiteralFlowStep(Node nodeFrom, Node nodeTo) {
   exists(MatchLiteralPattern pattern, Expr literal | literal = pattern.getLiteral() |
-    nodeFrom.asExpr() = literal and
-    nodeTo.asCfgNode().getNode() = pattern
+    nodeFrom.(CfgNode).getNode().getNode() = literal and
+    nodeTo.(CfgNode).getNode().getNode() = pattern
   )
 }
 
@@ -121,8 +122,14 @@ predicate matchLiteralFlowStep(Node nodeFrom, Node nodeTo) {
  */
 predicate matchCaptureFlowStep(Node nodeFrom, Node nodeTo) {
   exists(MatchCapturePattern capture, Name var | capture.getVariable() = var |
-    nodeFrom.asCfgNode().getNode() = capture and
-    nodeTo.asVar().getDefinition().(PatternCaptureDefinition).getDefiningNode().getNode() = var
+    nodeFrom.(CfgNode).getNode().getNode() = capture and
+    nodeTo
+        .(EssaNode)
+        .getVar()
+        .getDefinition()
+        .(PatternCaptureDefinition)
+        .getDefiningNode()
+        .getNode() = var
   )
 }
 
@@ -132,8 +139,8 @@ predicate matchCaptureFlowStep(Node nodeFrom, Node nodeTo) {
  */
 predicate matchValueFlowStep(Node nodeFrom, Node nodeTo) {
   exists(MatchValuePattern pattern, Expr value | value = pattern.getValue() |
-    nodeFrom.asExpr() = value and
-    nodeTo.asCfgNode().getNode() = pattern
+    nodeFrom.(CfgNode).getNode().getNode() = value and
+    nodeTo.(CfgNode).getNode().getNode() = pattern
   )
 }
 
@@ -145,8 +152,8 @@ predicate matchSequenceReadStep(Node nodeFrom, Content c, Node nodeTo) {
   exists(MatchSequencePattern subject, int index, Pattern element |
     element = subject.getPattern(index)
   |
-    nodeFrom.asCfgNode().getNode() = subject and
-    nodeTo.asCfgNode().getNode() = element and
+    nodeFrom.(CfgNode).getNode().getNode() = subject and
+    nodeTo.(CfgNode).getNode().getNode() = element and
     (
       // tuple content
       c.(TupleElementContent).getIndex() = index
@@ -173,7 +180,7 @@ predicate matchStarReadStep(Node nodeFrom, Content c, Node nodeTo) {
   exists(MatchSequencePattern subject, int index, MatchStarPattern star |
     star = subject.getPattern(index)
   |
-    nodeFrom.asCfgNode().getNode() = subject and
+    nodeFrom.(CfgNode).getNode().getNode() = subject and
     nodeTo = TStarPatternElementNode(star) and
     (
       // tuple content
@@ -200,7 +207,7 @@ predicate matchStarReadStep(Node nodeFrom, Content c, Node nodeTo) {
 predicate matchStarStoreStep(Node nodeFrom, Content c, Node nodeTo) {
   exists(MatchStarPattern star |
     nodeFrom = TStarPatternElementNode(star) and
-    nodeTo.asCfgNode().getNode() = star.getTarget() and
+    nodeTo.(CfgNode).getNode().getNode() = star.getTarget() and
     c instanceof ListElementContent
   )
 }
@@ -218,8 +225,8 @@ predicate matchMappingReadStep(Node nodeFrom, Content c, Node nodeTo) {
     key = keyValue.getKey() and
     value = keyValue.getValue()
   |
-    nodeFrom.asCfgNode().getNode() = subject and
-    nodeTo.asCfgNode().getNode() = value and
+    nodeFrom.(CfgNode).getNode().getNode() = subject and
+    nodeTo.(CfgNode).getNode().getNode() = value and
     c.(DictionaryElementContent).getKey() = key.getLiteral().(StrConst).getText()
   )
 }
@@ -233,8 +240,8 @@ predicate matchMappingReadStep(Node nodeFrom, Content c, Node nodeTo) {
  */
 predicate matchMappingFlowStep(Node nodeFrom, Node nodeTo) {
   exists(MatchMappingPattern subject, MatchDoubleStarPattern dstar | dstar = subject.getAMapping() |
-    nodeFrom.asCfgNode().getNode() = subject and
-    nodeTo.asCfgNode().getNode() = dstar.getTarget()
+    nodeFrom.(CfgNode).getNode().getNode() = subject and
+    nodeTo.(CfgNode).getNode().getNode() = dstar.getTarget()
   )
 }
 
@@ -251,7 +258,7 @@ predicate matchMappingClearStep(Node n, Content c) {
     key = keyValue.getKey() and
     dstar = subject.getAMapping()
   |
-    n.asCfgNode().getNode() = dstar.getTarget() and
+    n.(CfgNode).getNode().getNode() = dstar.getTarget() and
     c.(DictionaryElementContent).getKey() = key.getLiteral().(StrConst).getText()
   )
 }
@@ -266,8 +273,8 @@ predicate matchClassReadStep(Node nodeFrom, Content c, Node nodeTo) {
     attr = keyword.getAttribute() and
     value = keyword.getValue()
   |
-    nodeFrom.asCfgNode().getNode() = subject and
-    nodeTo.asCfgNode().getNode() = value and
+    nodeFrom.(CfgNode).getNode().getNode() = subject and
+    nodeTo.(CfgNode).getNode().getNode() = value and
     c.(AttributeContent).getAttribute() = attr.getId()
   )
 }
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackerSpecific.qll b/python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackerSpecific.qll
index e6db2839263..d46530bddcb 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackerSpecific.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackerSpecific.qll
@@ -11,7 +11,7 @@ class Node = DataFlowPublic::Node;
 
 class TypeTrackingNode = DataFlowPublic::TypeTrackingNode;
 
-predicate simpleLocalFlowStep = DataFlowPrivate::simpleLocalFlowStep/2;
+predicate simpleLocalFlowStep = DataFlowPrivate::simpleLocalFlowStepForTypetracking/2;
 
 predicate jumpStep = DataFlowPrivate::jumpStepSharedWithTypeTracker/2;
 
@@ -35,16 +35,22 @@ string getPossibleContentName() {
  */
 pragma[nomagic]
 private DataFlowPrivate::DataFlowCallable getCallableForArgument(
-  DataFlowPublic::ArgumentNode nodeFrom, int i
+  DataFlowPublic::ExtractedArgumentNode nodeFrom, int i
 ) {
-  exists(DataFlowPrivate::DataFlowCall call |
-    nodeFrom.argumentOf(call, i) and
+  exists(DataFlowPrivate::ExtractedDataFlowCall call |
+    nodeFrom.extractedArgumentOf(call, i) and
     result = call.getCallable()
   )
 }
 
-/** Holds if `nodeFrom` steps to `nodeTo` by being passed as a parameter in a call. */
-predicate callStep(DataFlowPublic::ArgumentNode nodeFrom, DataFlowPublic::ParameterNode nodeTo) {
+/**
+ * Holds if `nodeFrom` steps to `nodeTo` by being passed as a parameter in a call.
+ *
+ * Flow into summarized library methods is not included, as that will lead to negative
+ * recursion (or, at best, terrible performance), since identifying calls to library
+ * methods is done using API graphs (which uses type tracking).
+ */
+predicate callStep(DataFlowPublic::ArgumentNode nodeFrom, DataFlowPrivate::ParameterNodeImpl nodeTo) {
   // TODO: Support special methods?
   exists(DataFlowPrivate::DataFlowCallable callable, int i |
     callable = getCallableForArgument(nodeFrom, i) and
@@ -54,8 +60,9 @@ predicate callStep(DataFlowPublic::ArgumentNode nodeFrom, DataFlowPublic::Parame
 
 /** Holds if `nodeFrom` steps to `nodeTo` by being returned from a call. */
 predicate returnStep(DataFlowPrivate::ReturnNode nodeFrom, Node nodeTo) {
-  exists(DataFlowPrivate::DataFlowCall call |
-    nodeFrom.getEnclosingCallable() = call.getCallable() and nodeTo.asCfgNode() = call.getNode()
+  exists(DataFlowPrivate::ExtractedDataFlowCall call |
+    nodeFrom.getEnclosingCallable() = call.getCallable() and
+    nodeTo.(DataFlowPublic::CfgNode).getNode() = call.getNode()
   )
 }
 
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking1/TaintTrackingImpl.qll b/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking1/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking1/TaintTrackingImpl.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking1/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll b/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll b/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll b/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/python/ql/lib/semmle/python/essa/SsaDefinitions.qll b/python/ql/lib/semmle/python/essa/SsaDefinitions.qll
index 810afc3179a..4896016eb78 100644
--- a/python/ql/lib/semmle/python/essa/SsaDefinitions.qll
+++ b/python/ql/lib/semmle/python/essa/SsaDefinitions.qll
@@ -78,7 +78,9 @@ module SsaSource {
 
   /** Holds if `v` is defined by a `for` statement, the definition being `defn` */
   cached
-  predicate iteration_defined_variable(Variable v, ControlFlowNode defn, ControlFlowNode sequence) {
+  deprecated predicate iteration_defined_variable(
+    Variable v, ControlFlowNode defn, ControlFlowNode sequence
+  ) {
     exists(ForNode for | for.iterates(defn, sequence)) and
     defn.(NameNode).defines(v)
   }
diff --git a/python/ql/lib/semmle/python/frameworks/Aiohttp.qll b/python/ql/lib/semmle/python/frameworks/Aiohttp.qll
index 5f687a01b49..2557b544ee1 100644
--- a/python/ql/lib/semmle/python/frameworks/Aiohttp.qll
+++ b/python/ql/lib/semmle/python/frameworks/Aiohttp.qll
@@ -59,7 +59,7 @@ module AiohttpWebModel {
    * Extend this class to refine existing API models. If you want to model new APIs,
    * extend `AiohttpRouteSetup::Range` instead.
    */
-  class AiohttpRouteSetup extends HTTP::Server::RouteSetup::Range {
+  class AiohttpRouteSetup extends Http::Server::RouteSetup::Range {
     AiohttpRouteSetup::Range range;
 
     AiohttpRouteSetup() { this = range }
@@ -161,7 +161,7 @@ module AiohttpWebModel {
 
     AiohttpAddRouteCall() {
       exists(string funcName |
-        funcName = HTTP::httpVerbLower() and
+        funcName = Http::httpVerbLower() and
         routeArgsStart = 0
         or
         funcName = "view" and
@@ -192,7 +192,7 @@ module AiohttpWebModel {
 
     AiohttpDecoratorRouteSetup() {
       exists(string decoratorName |
-        decoratorName = HTTP::httpVerbLower() and
+        decoratorName = Http::httpVerbLower() and
         routeArgsStart = 0
         or
         decoratorName = "view" and
@@ -237,7 +237,7 @@ module AiohttpWebModel {
       // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
       // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
       result = this.getAMethod() and
-      result.getName() = HTTP::httpVerbLower()
+      result.getName() = Http::httpVerbLower()
     }
   }
 
@@ -252,7 +252,7 @@ module AiohttpWebModel {
   }
 
   /** A request handler defined in an `aiohttp.web` view class, that has no known route. */
-  private class AiohttpViewClassRequestHandlerWithoutKnownRoute extends HTTP::Server::RequestHandler::Range {
+  private class AiohttpViewClassRequestHandlerWithoutKnownRoute extends Http::Server::RequestHandler::Range {
     AiohttpViewClassRequestHandlerWithoutKnownRoute() {
       exists(AiohttpViewClass vc | vc.getARequestHandler() = this) and
       not exists(AiohttpRouteSetup setup | setup.getARequestHandler() = this)
@@ -493,7 +493,7 @@ module AiohttpWebModel {
    * - https://docs.aiohttp.org/en/stable/web_reference.html#aiohttp.web.Response
    * - https://docs.aiohttp.org/en/stable/web_quickstart.html#aiohttp-web-exceptions
    */
-  class AiohttpWebResponseInstantiation extends HTTP::Server::HttpResponse::Range,
+  class AiohttpWebResponseInstantiation extends Http::Server::HttpResponse::Range,
     Response::InstanceSource, DataFlow::CallCfgNode {
     API::Node apiNode;
 
@@ -562,7 +562,7 @@ module AiohttpWebModel {
    * See the part about redirects at https://docs.aiohttp.org/en/stable/web_quickstart.html#aiohttp-web-exceptions
    */
   class AiohttpRedirectExceptionInstantiation extends AiohttpWebResponseInstantiation,
-    HTTP::Server::HttpRedirectResponse::Range {
+    Http::Server::HttpRedirectResponse::Range {
     AiohttpRedirectExceptionInstantiation() {
       exists(string httpRedirectExceptionClassName |
         httpRedirectExceptionClassName in [
@@ -585,7 +585,7 @@ module AiohttpWebModel {
   /**
    * A call to `set_cookie` on a HTTP Response.
    */
-  class AiohttpResponseSetCookieCall extends HTTP::Server::CookieWrite::Range, DataFlow::CallCfgNode {
+  class AiohttpResponseSetCookieCall extends Http::Server::CookieWrite::Range, DataFlow::CallCfgNode {
     AiohttpResponseSetCookieCall() {
       this = aiohttpResponseInstance().getMember("set_cookie").getACall()
     }
@@ -600,7 +600,7 @@ module AiohttpWebModel {
   /**
    * A call to `del_cookie` on a HTTP Response.
    */
-  class AiohttpResponseDelCookieCall extends HTTP::Server::CookieWrite::Range, DataFlow::CallCfgNode {
+  class AiohttpResponseDelCookieCall extends Http::Server::CookieWrite::Range, DataFlow::CallCfgNode {
     AiohttpResponseDelCookieCall() {
       this = aiohttpResponseInstance().getMember("del_cookie").getACall()
     }
@@ -616,7 +616,7 @@ module AiohttpWebModel {
    * A dict-like write to an item of the `cookies` attribute on a HTTP response, such as
    * `response.cookies[name] = value`.
    */
-  class AiohttpResponseCookieSubscriptWrite extends HTTP::Server::CookieWrite::Range {
+  class AiohttpResponseCookieSubscriptWrite extends Http::Server::CookieWrite::Range {
     DataFlow::Node index;
     DataFlow::Node value;
 
@@ -661,11 +661,11 @@ private module AiohttpClientModel {
     private API::Node instance() { result = classRef().getReturn() }
 
     /** A method call on a ClientSession that sends off a request */
-    private class OutgoingRequestCall extends HTTP::Client::Request::Range, API::CallNode {
+    private class OutgoingRequestCall extends Http::Client::Request::Range, API::CallNode {
       string methodName;
 
       OutgoingRequestCall() {
-        methodName in [HTTP::httpVerbLower(), "request"] and
+        methodName in [Http::httpVerbLower(), "request"] and
         this = instance().getMember(methodName).getACall()
       }
 
diff --git a/python/ql/lib/semmle/python/frameworks/Django.qll b/python/ql/lib/semmle/python/frameworks/Django.qll
index a430513cb62..e67bb8cf385 100644
--- a/python/ql/lib/semmle/python/frameworks/Django.qll
+++ b/python/ql/lib/semmle/python/frameworks/Django.qll
@@ -1155,11 +1155,11 @@ module PrivateDjango {
     /** Gets a reference to the `django.http` module. */
     API::Node http() { result = django().getMember("http") }
 
-    /** DEPRECATED: Alias for `Http` */
-    deprecated module http = Http;
+    /** DEPRECATED: Alias for `DjangoHttp` */
+    deprecated module http = DjangoHttp;
 
     /** Provides models for the `django.http` module */
-    module Http {
+    module DjangoHttp {
       // ---------------------------------------------------------------------------
       // django.http.request
       // ---------------------------------------------------------------------------
@@ -1251,7 +1251,7 @@ module PrivateDjango {
               // special handling of the `build_absolute_uri` method, see
               // https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpRequest.build_absolute_uri
               exists(DataFlow::AttrRead attr, DataFlow::CallCfgNode call, DataFlow::Node instance |
-                instance = DjangoImpl::Http::Request::HttpRequest::instance() and
+                instance = DjangoImpl::DjangoHttp::Request::HttpRequest::instance() and
                 attr.getObject() = instance
               |
                 attr.getAttributeName() = "build_absolute_uri" and
@@ -1359,7 +1359,7 @@ module PrivateDjango {
            *
            * Use the predicate `HttpResponse::instance()` to get references to instances of `django.http.response.HttpResponse`.
            */
-          abstract class InstanceSource extends HTTP::Server::HttpResponse::Range, DataFlow::Node {
+          abstract class InstanceSource extends Http::Server::HttpResponse::Range, DataFlow::Node {
           }
 
           /** A direct instantiation of `django.http.response.HttpResponse`. */
@@ -1421,7 +1421,7 @@ module PrivateDjango {
            * Use the predicate `HttpResponseRedirect::instance()` to get references to instances of `django.http.response.HttpResponseRedirect`.
            */
           abstract class InstanceSource extends HttpResponse::InstanceSource,
-            HTTP::Server::HttpRedirectResponse::Range, DataFlow::Node { }
+            Http::Server::HttpRedirectResponse::Range, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseRedirect`. */
           private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
@@ -1483,7 +1483,7 @@ module PrivateDjango {
            * Use the predicate `HttpResponsePermanentRedirect::instance()` to get references to instances of `django.http.response.HttpResponsePermanentRedirect`.
            */
           abstract class InstanceSource extends HttpResponse::InstanceSource,
-            HTTP::Server::HttpRedirectResponse::Range, DataFlow::Node { }
+            Http::Server::HttpRedirectResponse::Range, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponsePermanentRedirect`. */
           private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
@@ -2066,17 +2066,18 @@ module PrivateDjango {
 
         /** Gets a reference to the `django.http.response.HttpResponse.write` function. */
         private DataFlow::TypeTrackingNode write(
-          DjangoImpl::Http::Response::HttpResponse::InstanceSource instance, DataFlow::TypeTracker t
+          DjangoImpl::DjangoHttp::Response::HttpResponse::InstanceSource instance,
+          DataFlow::TypeTracker t
         ) {
           t.startInAttr("write") and
-          instance = DjangoImpl::Http::Response::HttpResponse::instance() and
+          instance = DjangoImpl::DjangoHttp::Response::HttpResponse::instance() and
           result = instance
           or
           exists(DataFlow::TypeTracker t2 | result = write(instance, t2).track(t2, t))
         }
 
         /** Gets a reference to the `django.http.response.HttpResponse.write` function. */
-        DataFlow::Node write(DjangoImpl::Http::Response::HttpResponse::InstanceSource instance) {
+        DataFlow::Node write(DjangoImpl::DjangoHttp::Response::HttpResponse::InstanceSource instance) {
           write(instance, DataFlow::TypeTracker::end()).flowsTo(result)
         }
 
@@ -2085,8 +2086,8 @@ module PrivateDjango {
          *
          * See https://docs.djangoproject.com/en/3.1/ref/request-response/#django.http.HttpResponse.write
          */
-        class HttpResponseWriteCall extends HTTP::Server::HttpResponse::Range, DataFlow::CallCfgNode {
-          DjangoImpl::Http::Response::HttpResponse::InstanceSource instance;
+        class HttpResponseWriteCall extends Http::Server::HttpResponse::Range, DataFlow::CallCfgNode {
+          DjangoImpl::DjangoHttp::Response::HttpResponse::InstanceSource instance;
 
           HttpResponseWriteCall() { this.getFunction() = write(instance) }
 
@@ -2104,10 +2105,10 @@ module PrivateDjango {
         /**
          * A call to `set_cookie` on a HTTP Response.
          */
-        class DjangoResponseSetCookieCall extends HTTP::Server::CookieWrite::Range,
+        class DjangoResponseSetCookieCall extends Http::Server::CookieWrite::Range,
           DataFlow::MethodCallNode {
           DjangoResponseSetCookieCall() {
-            this.calls(DjangoImpl::Http::Response::HttpResponse::instance(), "set_cookie")
+            this.calls(DjangoImpl::DjangoHttp::Response::HttpResponse::instance(), "set_cookie")
           }
 
           override DataFlow::Node getHeaderArg() { none() }
@@ -2124,10 +2125,10 @@ module PrivateDjango {
         /**
          * A call to `delete_cookie` on a HTTP Response.
          */
-        class DjangoResponseDeleteCookieCall extends HTTP::Server::CookieWrite::Range,
+        class DjangoResponseDeleteCookieCall extends Http::Server::CookieWrite::Range,
           DataFlow::MethodCallNode {
           DjangoResponseDeleteCookieCall() {
-            this.calls(DjangoImpl::Http::Response::HttpResponse::instance(), "delete_cookie")
+            this.calls(DjangoImpl::DjangoHttp::Response::HttpResponse::instance(), "delete_cookie")
           }
 
           override DataFlow::Node getHeaderArg() { none() }
@@ -2143,7 +2144,7 @@ module PrivateDjango {
          * A dict-like write to an item of the `cookies` attribute on a HTTP response, such as
          * `response.cookies[name] = value`.
          */
-        class DjangoResponseCookieSubscriptWrite extends HTTP::Server::CookieWrite::Range {
+        class DjangoResponseCookieSubscriptWrite extends Http::Server::CookieWrite::Range {
           DataFlow::Node index;
           DataFlow::Node value;
 
@@ -2154,7 +2155,7 @@ module PrivateDjango {
               this.asCfgNode() = subscript
             |
               cookieLookup.getAttributeName() = "cookies" and
-              cookieLookup.getObject() = DjangoImpl::Http::Response::HttpResponse::instance() and
+              cookieLookup.getObject() = DjangoImpl::DjangoHttp::Response::HttpResponse::instance() and
               exists(DataFlow::Node subscriptObj |
                 subscriptObj.asCfgNode() = subscript.getObject()
               |
@@ -2315,7 +2316,7 @@ module PrivateDjango {
       // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
       result = this.getAMethod() and
       (
-        result.getName() = HTTP::httpVerbLower()
+        result.getName() = Http::httpVerbLower()
         or
         result.getName() = "get_redirect_url"
       )
@@ -2410,7 +2411,7 @@ module PrivateDjango {
   }
 
   /** A data-flow node that sets up a route on a server, using the django framework. */
-  abstract class DjangoRouteSetup extends HTTP::Server::RouteSetup::Range, DataFlow::CfgNode {
+  abstract class DjangoRouteSetup extends Http::Server::RouteSetup::Range, DataFlow::CfgNode {
     /** Gets the data-flow node that is used as the argument for the view handler. */
     abstract DataFlow::Node getViewArg();
 
@@ -2427,7 +2428,7 @@ module PrivateDjango {
   }
 
   /** A request handler defined in a django view class, that has no known route. */
-  private class DjangoViewClassHandlerWithoutKnownRoute extends HTTP::Server::RequestHandler::Range,
+  private class DjangoViewClassHandlerWithoutKnownRoute extends Http::Server::RequestHandler::Range,
     DjangoRouteHandler {
     DjangoViewClassHandlerWithoutKnownRoute() {
       exists(DjangoViewClass vc | vc.getARequestHandler() = this) and
@@ -2586,7 +2587,7 @@ module PrivateDjango {
   // HttpRequest taint modeling
   // ---------------------------------------------------------------------------
   /** A parameter that will receive the django `HttpRequest` instance when a request handler is invoked. */
-  private class DjangoRequestHandlerRequestParam extends DjangoImpl::Http::Request::HttpRequest::InstanceSource,
+  private class DjangoRequestHandlerRequestParam extends DjangoImpl::DjangoHttp::Request::HttpRequest::InstanceSource,
     RemoteFlowSource::Range, DataFlow::ParameterNode {
     DjangoRequestHandlerRequestParam() {
       this.getParameter() = any(DjangoRouteSetup setup).getARequestHandler().getRequestParam()
@@ -2603,7 +2604,7 @@ module PrivateDjango {
    *
    * See https://docs.djangoproject.com/en/3.1/topics/class-based-views/generic-display/#dynamic-filtering
    */
-  private class DjangoViewClassRequestAttributeRead extends DjangoImpl::Http::Request::HttpRequest::InstanceSource,
+  private class DjangoViewClassRequestAttributeRead extends DjangoImpl::DjangoHttp::Request::HttpRequest::InstanceSource,
     RemoteFlowSource::Range, DataFlow::Node {
     DjangoViewClassRequestAttributeRead() {
       exists(DataFlow::AttrRead read | this = read |
@@ -2678,7 +2679,7 @@ module PrivateDjango {
    *
    * See https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#redirect
    */
-  private class DjangoShortcutsRedirectCall extends HTTP::Server::HttpRedirectResponse::Range,
+  private class DjangoShortcutsRedirectCall extends Http::Server::HttpRedirectResponse::Range,
     DataFlow::CallCfgNode {
     DjangoShortcutsRedirectCall() { this = DjangoImpl::Shortcuts::redirect().getACall() }
 
@@ -2712,7 +2713,7 @@ module PrivateDjango {
    *
    * See https://docs.djangoproject.com/en/3.1/ref/class-based-views/base/#redirectview
    */
-  private class DjangoRedirectViewGetRedirectUrlReturn extends HTTP::Server::HttpRedirectResponse::Range,
+  private class DjangoRedirectViewGetRedirectUrlReturn extends Http::Server::HttpRedirectResponse::Range,
     DataFlow::CfgNode {
     DjangoRedirectViewGetRedirectUrlReturn() {
       node = any(GetRedirectUrlFunction f).getAReturnValueFlowNode()
@@ -2751,7 +2752,7 @@ module PrivateDjango {
   /**
    * A custom middleware stack
    */
-  private class DjangoSettingsMiddlewareStack extends HTTP::Server::CsrfProtectionSetting::Range {
+  private class DjangoSettingsMiddlewareStack extends Http::Server::CsrfProtectionSetting::Range {
     List list;
 
     DjangoSettingsMiddlewareStack() {
@@ -2787,7 +2788,7 @@ module PrivateDjango {
     }
   }
 
-  private class DjangoCsrfDecorator extends HTTP::Server::CsrfLocalProtectionSetting::Range {
+  private class DjangoCsrfDecorator extends Http::Server::CsrfLocalProtectionSetting::Range {
     string decoratorName;
     Function function;
 
diff --git a/python/ql/lib/semmle/python/frameworks/FastApi.qll b/python/ql/lib/semmle/python/frameworks/FastApi.qll
index f042dafea59..b45ef81f88a 100644
--- a/python/ql/lib/semmle/python/frameworks/FastApi.qll
+++ b/python/ql/lib/semmle/python/frameworks/FastApi.qll
@@ -48,10 +48,10 @@ private module FastApi {
    *
    * See https://fastapi.tiangolo.com/tutorial/first-steps/#define-a-path-operation-decorator
    */
-  private class FastApiRouteSetup extends HTTP::Server::RouteSetup::Range, DataFlow::CallCfgNode {
+  private class FastApiRouteSetup extends Http::Server::RouteSetup::Range, DataFlow::CallCfgNode {
     FastApiRouteSetup() {
       exists(string routeAddingMethod |
-        routeAddingMethod = HTTP::httpVerbLower()
+        routeAddingMethod = Http::httpVerbLower()
         or
         routeAddingMethod in ["api_route", "websocket"]
       |
@@ -195,7 +195,7 @@ private module FastApi {
     abstract class InstanceSource extends DataFlow::LocalSourceNode { }
 
     /** A direct instantiation of a response class. */
-    private class ResponseInstantiation extends InstanceSource, HTTP::Server::HttpResponse::Range,
+    private class ResponseInstantiation extends InstanceSource, Http::Server::HttpResponse::Range,
       DataFlow::CallCfgNode {
       API::Node baseApiNode;
       API::Node responseClass;
@@ -223,7 +223,7 @@ private module FastApi {
      * A direct instantiation of a redirect response.
      */
     private class RedirectResponseInstantiation extends ResponseInstantiation,
-      HTTP::Server::HttpRedirectResponse::Range {
+      Http::Server::HttpRedirectResponse::Range {
       RedirectResponseInstantiation() { baseApiNode = getModeledResponseClass("RedirectResponse") }
 
       override DataFlow::Node getRedirectLocation() {
@@ -245,7 +245,7 @@ private module FastApi {
     /**
      * An implicit response from a return of FastAPI request handler.
      */
-    private class FastApiRequestHandlerReturn extends HTTP::Server::HttpResponse::Range,
+    private class FastApiRequestHandlerReturn extends Http::Server::HttpResponse::Range,
       DataFlow::CfgNode {
       FastApiRouteSetup routeSetup;
 
@@ -291,7 +291,7 @@ private module FastApi {
      * `response_class` set to a `RedirectResponse`.
      */
     private class FastApiRequestHandlerRedirectReturn extends FastApiRequestHandlerReturn,
-      HTTP::Server::HttpRedirectResponse::Range {
+      Http::Server::HttpRedirectResponse::Range {
       FastApiRequestHandlerRedirectReturn() {
         exists(API::Node responseClass |
           responseClass.getAValueReachableFromSource() = routeSetup.getResponseClassArg() and
@@ -332,7 +332,7 @@ private module FastApi {
     /**
      * A call to `set_cookie` on a FastAPI Response.
      */
-    private class SetCookieCall extends HTTP::Server::CookieWrite::Range, DataFlow::MethodCallNode {
+    private class SetCookieCall extends Http::Server::CookieWrite::Range, DataFlow::MethodCallNode {
       SetCookieCall() { this.calls(instance(), "set_cookie") }
 
       override DataFlow::Node getHeaderArg() { none() }
@@ -348,7 +348,7 @@ private module FastApi {
      * A call to `append` on a `headers` of a FastAPI Response, with the `Set-Cookie`
      * header-key.
      */
-    private class HeadersAppendCookie extends HTTP::Server::CookieWrite::Range,
+    private class HeadersAppendCookie extends Http::Server::CookieWrite::Range,
       DataFlow::MethodCallNode {
       HeadersAppendCookie() {
         exists(DataFlow::AttrRead headers, DataFlow::Node keyArg |
diff --git a/python/ql/lib/semmle/python/frameworks/Flask.qll b/python/ql/lib/semmle/python/frameworks/Flask.qll
index 8ee93fcec52..890e45a2ab5 100644
--- a/python/ql/lib/semmle/python/frameworks/Flask.qll
+++ b/python/ql/lib/semmle/python/frameworks/Flask.qll
@@ -116,7 +116,7 @@ module Flask {
      *
      * Use the predicate `Response::instance()` to get references to instances of `flask.Response`.
      */
-    abstract class InstanceSource extends HTTP::Server::HttpResponse::Range, DataFlow::Node { }
+    abstract class InstanceSource extends Http::Server::HttpResponse::Range, DataFlow::Node { }
 
     /** A direct instantiation of `flask.Response`. */
     private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
@@ -229,7 +229,7 @@ module Flask {
       // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
       // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
       result = this.getAMethod() and
-      result.getName() = HTTP::httpVerbLower()
+      result.getName() = Http::httpVerbLower()
     }
   }
 
@@ -241,7 +241,7 @@ module Flask {
   }
 
   /** A route setup made by flask (sharing handling of URL patterns). */
-  abstract class FlaskRouteSetup extends HTTP::Server::RouteSetup::Range {
+  abstract class FlaskRouteSetup extends Http::Server::RouteSetup::Range {
     override Parameter getARoutedParameter() {
       // If we don't know the URL pattern, we simply mark all parameters as a routed
       // parameter. This should give us more RemoteFlowSources but could also lead to
@@ -312,7 +312,7 @@ module Flask {
   }
 
   /** A request handler defined in a django view class, that has no known route. */
-  private class FlaskViewClassHandlerWithoutKnownRoute extends HTTP::Server::RequestHandler::Range {
+  private class FlaskViewClassHandlerWithoutKnownRoute extends Http::Server::RequestHandler::Range {
     FlaskViewClassHandlerWithoutKnownRoute() {
       exists(FlaskViewClass vc | vc.getARequestHandler() = this) and
       not exists(FlaskRouteSetup setup | setup.getARequestHandler() = this)
@@ -439,7 +439,7 @@ module Flask {
   // ---------------------------------------------------------------------------
   // Implicit response from returns of flask request handlers
   // ---------------------------------------------------------------------------
-  private class FlaskRouteHandlerReturn extends HTTP::Server::HttpResponse::Range, DataFlow::CfgNode {
+  private class FlaskRouteHandlerReturn extends Http::Server::HttpResponse::Range, DataFlow::CfgNode {
     FlaskRouteHandlerReturn() {
       exists(Function routeHandler |
         routeHandler = any(FlaskRouteSetup rs).getARequestHandler() and
@@ -462,7 +462,7 @@ module Flask {
    *
    * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.redirect
    */
-  private class FlaskRedirectCall extends HTTP::Server::HttpRedirectResponse::Range,
+  private class FlaskRedirectCall extends Http::Server::HttpRedirectResponse::Range,
     DataFlow::CallCfgNode {
     FlaskRedirectCall() { this = API::moduleImport("flask").getMember("redirect").getACall() }
 
@@ -490,7 +490,7 @@ module Flask {
    *
    * See https://flask.palletsprojects.com/en/2.0.x/api/#flask.Response.set_cookie
    */
-  class FlaskResponseSetCookieCall extends HTTP::Server::CookieWrite::Range,
+  class FlaskResponseSetCookieCall extends Http::Server::CookieWrite::Range,
     DataFlow::MethodCallNode {
     FlaskResponseSetCookieCall() { this.calls(Flask::Response::instance(), "set_cookie") }
 
@@ -506,7 +506,7 @@ module Flask {
    *
    * See https://flask.palletsprojects.com/en/2.0.x/api/#flask.Response.delete_cookie
    */
-  class FlaskResponseDeleteCookieCall extends HTTP::Server::CookieWrite::Range,
+  class FlaskResponseDeleteCookieCall extends Http::Server::CookieWrite::Range,
     DataFlow::MethodCallNode {
     FlaskResponseDeleteCookieCall() { this.calls(Flask::Response::instance(), "delete_cookie") }
 
diff --git a/python/ql/lib/semmle/python/frameworks/Httpx.qll b/python/ql/lib/semmle/python/frameworks/Httpx.qll
index b746de6ee5e..ec6a446db2e 100644
--- a/python/ql/lib/semmle/python/frameworks/Httpx.qll
+++ b/python/ql/lib/semmle/python/frameworks/Httpx.qll
@@ -23,11 +23,11 @@ private module HttpxModel {
    *
    * See https://www.python-httpx.org/api/
    */
-  private class RequestCall extends HTTP::Client::Request::Range, API::CallNode {
+  private class RequestCall extends Http::Client::Request::Range, API::CallNode {
     string methodName;
 
     RequestCall() {
-      methodName in [HTTP::httpVerbLower(), "request", "stream"] and
+      methodName in [Http::httpVerbLower(), "request", "stream"] and
       this = API::moduleImport("httpx").getMember(methodName).getACall()
     }
 
@@ -64,11 +64,11 @@ private module HttpxModel {
     }
 
     /** A method call on a Client that sends off a request */
-    private class OutgoingRequestCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
+    private class OutgoingRequestCall extends Http::Client::Request::Range, DataFlow::CallCfgNode {
       string methodName;
 
       OutgoingRequestCall() {
-        methodName in [HTTP::httpVerbLower(), "request", "stream"] and
+        methodName in [Http::httpVerbLower(), "request", "stream"] and
         this = classRef().getReturn().getMember(methodName).getACall()
       }
 
diff --git a/python/ql/lib/semmle/python/frameworks/Ldap.qll b/python/ql/lib/semmle/python/frameworks/Ldap.qll
index 2f78c20cbe5..fddebba24f9 100644
--- a/python/ql/lib/semmle/python/frameworks/Ldap.qll
+++ b/python/ql/lib/semmle/python/frameworks/Ldap.qll
@@ -13,13 +13,13 @@ private import semmle.python.ApiGraphs
  *
  * See https://www.python-ldap.org/en/python-ldap-3.3.0/index.html
  */
-private module Ldap {
+private module PythonLdap {
   /**
    * The execution of an `ldap` query.
    *
    * See https://www.python-ldap.org/en/python-ldap-3.3.0/reference/ldap.html#functions
    */
-  private class LdapQueryExecution extends DataFlow::CallCfgNode, LDAP::LdapExecution::Range {
+  private class LdapQueryExecution extends DataFlow::CallCfgNode, Ldap::LdapExecution::Range {
     LdapQueryExecution() {
       this =
         API::moduleImport("ldap")
diff --git a/python/ql/lib/semmle/python/frameworks/Ldap3.qll b/python/ql/lib/semmle/python/frameworks/Ldap3.qll
index 6bf3d58cf99..860df4a3b84 100644
--- a/python/ql/lib/semmle/python/frameworks/Ldap3.qll
+++ b/python/ql/lib/semmle/python/frameworks/Ldap3.qll
@@ -15,7 +15,7 @@ private import semmle.python.ApiGraphs
  */
 private module Ldap3 {
   /** The execution of an `ldap` query. */
-  private class LdapQueryExecution extends DataFlow::CallCfgNode, LDAP::LdapExecution::Range {
+  private class LdapQueryExecution extends DataFlow::CallCfgNode, Ldap::LdapExecution::Range {
     LdapQueryExecution() {
       this =
         API::moduleImport("ldap3")
diff --git a/python/ql/lib/semmle/python/frameworks/Libtaxii.qll b/python/ql/lib/semmle/python/frameworks/Libtaxii.qll
index 44298b7c08f..5df0e7127ec 100644
--- a/python/ql/lib/semmle/python/frameworks/Libtaxii.qll
+++ b/python/ql/lib/semmle/python/frameworks/Libtaxii.qll
@@ -22,7 +22,7 @@ private module Libtaxii {
    * A call to `libtaxii.common.parse`.
    * When the `allow_url` parameter value is set to `True`, there is an SSRF vulnerability..
    */
-  private class ParseCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
+  private class ParseCall extends Http::Client::Request::Range, DataFlow::CallCfgNode {
     ParseCall() {
       this = API::moduleImport("libtaxii").getMember("common").getMember("parse").getACall() and
       this.getArgByName("allow_url").getALocalSource().asExpr() = any(True t)
diff --git a/python/ql/lib/semmle/python/frameworks/Peewee.qll b/python/ql/lib/semmle/python/frameworks/Peewee.qll
index 189ab14876a..977428fb98b 100644
--- a/python/ql/lib/semmle/python/frameworks/Peewee.qll
+++ b/python/ql/lib/semmle/python/frameworks/Peewee.qll
@@ -32,7 +32,7 @@ private module Peewee {
             .getASubclass*()
       or
       // Ohter known subclasses, semi auto generated by using
-      // ```codeql
+      // ```ql
       // class DBClass extends Class, SelfRefMixin {
       //   DBClass() {
       //     exists(this.getLocation().getFile().getRelativePath()) and
diff --git a/python/ql/lib/semmle/python/frameworks/Pycurl.qll b/python/ql/lib/semmle/python/frameworks/Pycurl.qll
index 6a5fbcbcfeb..4317cfb7eca 100644
--- a/python/ql/lib/semmle/python/frameworks/Pycurl.qll
+++ b/python/ql/lib/semmle/python/frameworks/Pycurl.qll
@@ -36,7 +36,7 @@ private module Pycurl {
      *
      * See http://pycurl.io/docs/latest/curlobject.html#pycurl.Curl.setopt.
      */
-    private class OutgoingRequestCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
+    private class OutgoingRequestCall extends Http::Client::Request::Range, DataFlow::CallCfgNode {
       OutgoingRequestCall() {
         this = instance().getMember("setopt").getACall() and
         this.getArg(0).asCfgNode().(AttrNode).getName() = "URL"
diff --git a/python/ql/lib/semmle/python/frameworks/Requests.qll b/python/ql/lib/semmle/python/frameworks/Requests.qll
index 0c944d889d2..d32860b177e 100644
--- a/python/ql/lib/semmle/python/frameworks/Requests.qll
+++ b/python/ql/lib/semmle/python/frameworks/Requests.qll
@@ -28,11 +28,11 @@ private module Requests {
    *
    * See https://requests.readthedocs.io/en/latest/api/#requests.request
    */
-  private class OutgoingRequestCall extends HTTP::Client::Request::Range, API::CallNode {
+  private class OutgoingRequestCall extends Http::Client::Request::Range, API::CallNode {
     string methodName;
 
     OutgoingRequestCall() {
-      methodName in [HTTP::httpVerbLower(), "request"] and
+      methodName in [Http::httpVerbLower(), "request"] and
       (
         this = API::moduleImport("requests").getMember(methodName).getACall()
         or
diff --git a/python/ql/lib/semmle/python/frameworks/RestFramework.qll b/python/ql/lib/semmle/python/frameworks/RestFramework.qll
index c8f73f909c2..8406ee51e27 100644
--- a/python/ql/lib/semmle/python/frameworks/RestFramework.qll
+++ b/python/ql/lib/semmle/python/frameworks/RestFramework.qll
@@ -158,7 +158,7 @@ private module RestFramework {
    * `HTTP::Server::RequestHandler`. We only need this for the ones that doesn't have a
    * known route setup.
    */
-  class RestFrameworkFunctionBasedViewWithoutKnownRoute extends HTTP::Server::RequestHandler::Range,
+  class RestFrameworkFunctionBasedViewWithoutKnownRoute extends Http::Server::RequestHandler::Range,
     PrivateDjango::DjangoRouteHandler instanceof RestFrameworkFunctionBasedView {
     RestFrameworkFunctionBasedViewWithoutKnownRoute() {
       not exists(PrivateDjango::DjangoRouteSetup setup | setup.getARequestHandler() = this)
@@ -220,7 +220,7 @@ private module RestFramework {
      *
      * Use the predicate `Request::instance()` to get references to instances of `rest_framework.request.Request`.
      */
-    abstract class InstanceSource extends PrivateDjango::DjangoImpl::Http::Request::HttpRequest::InstanceSource {
+    abstract class InstanceSource extends PrivateDjango::DjangoImpl::DjangoHttp::Request::HttpRequest::InstanceSource {
     }
 
     /** A direct instantiation of `rest_framework.request.Request`. */
@@ -296,7 +296,7 @@ private module RestFramework {
     }
 
     /** A direct instantiation of `rest_framework.response.Response`. */
-    private class ClassInstantiation extends PrivateDjango::DjangoImpl::Http::Response::HttpResponse::InstanceSource,
+    private class ClassInstantiation extends PrivateDjango::DjangoImpl::DjangoHttp::Response::HttpResponse::InstanceSource,
       DataFlow::CallCfgNode {
       ClassInstantiation() { this = classRef().getACall() }
 
@@ -320,7 +320,7 @@ private module RestFramework {
    */
   module ApiException {
     /** A direct instantiation of `rest_framework.exceptions.ApiException` or subclass. */
-    private class ClassInstantiation extends HTTP::Server::HttpResponse::Range,
+    private class ClassInstantiation extends Http::Server::HttpResponse::Range,
       DataFlow::CallCfgNode {
       string className;
 
diff --git a/python/ql/lib/semmle/python/frameworks/Starlette.qll b/python/ql/lib/semmle/python/frameworks/Starlette.qll
index e22259d560c..a105d62c5b7 100644
--- a/python/ql/lib/semmle/python/frameworks/Starlette.qll
+++ b/python/ql/lib/semmle/python/frameworks/Starlette.qll
@@ -85,7 +85,7 @@ module Starlette {
     }
 
     /** An attribute read on a `starlette.websockets.WebSocket` instance that is a `starlette.requests.URL` instance. */
-    private class UrlInstances extends URL::InstanceSource {
+    private class UrlInstances extends Url::InstanceSource {
       UrlInstances() {
         this.(DataFlow::AttrRead).getObject() = instance() and
         this.(DataFlow::AttrRead).getAttributeName() = "url"
@@ -98,7 +98,7 @@ module Starlette {
    *
    * See the URL part of https://www.starlette.io/websockets/.
    */
-  module URL {
+  module Url {
     /** Gets a reference to the `starlette.requests.URL` class. */
     private API::Node classRef() {
       result = API::moduleImport("starlette").getMember("requests").getMember("URL")
@@ -159,4 +159,7 @@ module Starlette {
       }
     }
   }
+
+  /** DEPRECATED: Alias for Url */
+  deprecated module URL = Url;
 }
diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib.qll b/python/ql/lib/semmle/python/frameworks/Stdlib.qll
index 3ba54a41718..dc93677dea0 100644
--- a/python/ql/lib/semmle/python/frameworks/Stdlib.qll
+++ b/python/ql/lib/semmle/python/frameworks/Stdlib.qll
@@ -9,6 +9,7 @@ private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
 private import semmle.python.ApiGraphs
+private import semmle.python.dataflow.new.FlowSummary
 private import semmle.python.frameworks.PEP249
 private import semmle.python.frameworks.internal.PoorMansFunctionResolution
 private import semmle.python.frameworks.internal.SelfRefMixin
@@ -1877,7 +1878,7 @@ private module StdlibPrivate {
   API::Node http() { result = API::moduleImport("http") }
 
   /** Provides models for the `http` module. */
-  module Http {
+  module StdlibHttp {
     // -------------------------------------------------------------------------
     // http.server
     // -------------------------------------------------------------------------
@@ -1944,9 +1945,9 @@ private module StdlibPrivate {
           SimpleHttpServer::SimpleHttpRequestHandler::classRef(),
           CgiHttpServer::CgiHttpRequestHandler::classRef(),
           // Python 3
-          Http::Server::BaseHttpRequestHandler::classRef(),
-          Http::Server::SimpleHttpRequestHandler::classRef(),
-          Http::Server::CgiHttpRequestHandler::classRef()
+          StdlibHttp::Server::BaseHttpRequestHandler::classRef(),
+          StdlibHttp::Server::SimpleHttpRequestHandler::classRef(),
+          StdlibHttp::Server::CgiHttpRequestHandler::classRef()
         ].getASubclass*()
     }
 
@@ -2026,10 +2027,10 @@ private module StdlibPrivate {
      *
      * Not essential for any functionality, but provides a consistent modeling.
      */
-    private class RequestHandlerFunc extends HTTP::Server::RequestHandler::Range {
+    private class RequestHandlerFunc extends Http::Server::RequestHandler::Range {
       RequestHandlerFunc() {
         this = any(HttpRequestHandlerClassDef cls).getAMethod() and
-        this.getName() = "do_" + HTTP::httpVerb()
+        this.getName() = "do_" + Http::httpVerb()
       }
 
       override Parameter getARoutedParameter() { none() }
@@ -2064,7 +2065,7 @@ private module StdlibPrivate {
      * See https://github.com/python/cpython/blob/b567b9d74bd9e476a3027335873bb0508d6e450f/Lib/wsgiref/handlers.py#L137
      * for how a request is processed and given to an application.
      */
-    class WsgirefSimpleServerApplication extends HTTP::Server::RequestHandler::Range {
+    class WsgirefSimpleServerApplication extends Http::Server::RequestHandler::Range {
       WsgirefSimpleServerApplication() {
         exists(DataFlow::Node appArg, DataFlow::CallCfgNode setAppCall |
           (
@@ -2098,8 +2099,8 @@ private module StdlibPrivate {
      *
      * See https://docs.python.org/3.10/library/wsgiref.html#wsgiref.simple_server.WSGIRequestHandler.get_environ
      */
-    class WSGIEnvirontParameter extends RemoteFlowSource::Range, DataFlow::ParameterNode {
-      WSGIEnvirontParameter() {
+    class WsgiEnvirontParameter extends RemoteFlowSource::Range, DataFlow::ParameterNode {
+      WsgiEnvirontParameter() {
         exists(WsgirefSimpleServerApplication func |
           if func.isMethod()
           then this.getParameter() = func.getArg(1)
@@ -2112,6 +2113,9 @@ private module StdlibPrivate {
       }
     }
 
+    /** DEPRECATED: Alias for WsgiEnvirontParameter */
+    deprecated class WSGIEnvirontParameter = WsgiEnvirontParameter;
+
     /**
      * Gets a reference to the parameter of a `WsgirefSimpleServerApplication` that
      * takes the `start_response` function.
@@ -2163,7 +2167,7 @@ private module StdlibPrivate {
      *
      * See https://github.com/python/cpython/blob/b567b9d74bd9e476a3027335873bb0508d6e450f/Lib/wsgiref/handlers.py#L276
      */
-    class WsgirefSimpleServerApplicationWriteCall extends HTTP::Server::HttpResponse::Range,
+    class WsgirefSimpleServerApplicationWriteCall extends Http::Server::HttpResponse::Range,
       DataFlow::CallCfgNode {
       WsgirefSimpleServerApplicationWriteCall() { this.getFunction() = writeFunction() }
 
@@ -2177,7 +2181,7 @@ private module StdlibPrivate {
     /**
      * A return from a `WsgirefSimpleServerApplication`, which is included in the response body.
      */
-    class WsgirefSimpleServerApplicationReturn extends HTTP::Server::HttpResponse::Range,
+    class WsgirefSimpleServerApplicationReturn extends Http::Server::HttpResponse::Range,
       DataFlow::CfgNode {
       WsgirefSimpleServerApplicationReturn() {
         exists(WsgirefSimpleServerApplication requestHandler |
@@ -2264,7 +2268,7 @@ private module StdlibPrivate {
     }
 
     /** A method call on a HttpConnection that sends off a request */
-    private class RequestCall extends HTTP::Client::Request::Range, DataFlow::MethodCallNode {
+    private class RequestCall extends Http::Client::Request::Range, DataFlow::MethodCallNode {
       RequestCall() { this.calls(instance(_), ["request", "_send_request", "putrequest"]) }
 
       DataFlow::Node getUrlArg() { result in [this.getArg(1), this.getArgByName("url")] }
@@ -3667,6 +3671,23 @@ private module StdlibPrivate {
 
     override DataFlow::Node getAPathArgument() { result = this.getAnInput() }
   }
+
+  /** A flow summary for `reversed`. */
+  class ReversedSummary extends SummarizedCallable {
+    ReversedSummary() { this = "builtins.reversed" }
+
+    override DataFlow::CallCfgNode getACall() { result = API::builtin("reversed").getACall() }
+
+    override DataFlow::ArgumentNode getACallback() {
+      result = API::builtin("reversed").getAValueReachableFromSource()
+    }
+
+    override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
+      input = "Argument[0].ListElement" and
+      output = "ReturnValue.ListElement" and
+      preservesValue = true
+    }
+  }
 }
 
 // ---------------------------------------------------------------------------
diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib/Urllib.qll b/python/ql/lib/semmle/python/frameworks/Stdlib/Urllib.qll
index fa932af2673..3e0177f8a14 100644
--- a/python/ql/lib/semmle/python/frameworks/Stdlib/Urllib.qll
+++ b/python/ql/lib/semmle/python/frameworks/Stdlib/Urllib.qll
@@ -30,7 +30,7 @@ private module Urllib {
      * See
      * - https://docs.python.org/3.9/library/urllib.request.html#urllib.request.Request
      */
-    private class RequestCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
+    private class RequestCall extends Http::Client::Request::Range, DataFlow::CallCfgNode {
       RequestCall() {
         this = API::moduleImport("urllib").getMember("request").getMember("Request").getACall()
       }
@@ -52,7 +52,7 @@ private module Urllib {
      * See
      * - https://docs.python.org/3.9/library/urllib.request.html#urllib.request.urlopen
      */
-    private class UrlOpenCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
+    private class UrlOpenCall extends Http::Client::Request::Range, DataFlow::CallCfgNode {
       UrlOpenCall() {
         this = API::moduleImport("urllib").getMember("request").getMember("urlopen").getACall()
       }
diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib/Urllib2.qll b/python/ql/lib/semmle/python/frameworks/Stdlib/Urllib2.qll
index e7e119d98c1..7fc9e5ea468 100644
--- a/python/ql/lib/semmle/python/frameworks/Stdlib/Urllib2.qll
+++ b/python/ql/lib/semmle/python/frameworks/Stdlib/Urllib2.qll
@@ -20,7 +20,7 @@ private module Urllib2 {
    * See
    * - https://docs.python.org/2/library/urllib2.html#urllib2.Request
    */
-  private class RequestCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
+  private class RequestCall extends Http::Client::Request::Range, DataFlow::CallCfgNode {
     RequestCall() { this = API::moduleImport("urllib2").getMember("Request").getACall() }
 
     override DataFlow::Node getAUrlPart() { result in [this.getArg(0), this.getArgByName("url")] }
@@ -40,7 +40,7 @@ private module Urllib2 {
    * See
    * - https://docs.python.org/2/library/urllib2.html#urllib2.urlopen
    */
-  private class UrlOpenCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
+  private class UrlOpenCall extends Http::Client::Request::Range, DataFlow::CallCfgNode {
     UrlOpenCall() { this = API::moduleImport("urllib2").getMember("urlopen").getACall() }
 
     override DataFlow::Node getAUrlPart() { result in [this.getArg(0), this.getArgByName("url")] }
diff --git a/python/ql/lib/semmle/python/frameworks/Tornado.qll b/python/ql/lib/semmle/python/frameworks/Tornado.qll
index d66da17aa5d..77c60097cb5 100644
--- a/python/ql/lib/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/lib/semmle/python/frameworks/Tornado.qll
@@ -99,7 +99,7 @@ private module Tornado {
             // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
             // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
             result = this.getAMethod() and
-            result.getName() = HTTP::httpVerbLower()
+            result.getName() = Http::httpVerbLower()
           }
 
           /** Gets a reference to this class. */
@@ -375,7 +375,7 @@ private module Tornado {
   }
 
   /** A tornado route setup. */
-  abstract class TornadoRouteSetup extends HTTP::Server::RouteSetup::Range {
+  abstract class TornadoRouteSetup extends Http::Server::RouteSetup::Range {
     override string getFramework() { result = "Tornado" }
   }
 
@@ -437,7 +437,7 @@ private module Tornado {
   }
 
   /** A request handler defined in a tornado RequestHandler class, that has no known route. */
-  private class TornadoRequestHandlerWithoutKnownRoute extends HTTP::Server::RequestHandler::Range {
+  private class TornadoRequestHandlerWithoutKnownRoute extends Http::Server::RequestHandler::Range {
     TornadoRequestHandlerWithoutKnownRoute() {
       exists(TornadoModule::Web::RequestHandler::RequestHandlerClass cls |
         cls.getARequestHandler() = this
@@ -464,7 +464,7 @@ private module Tornado {
    *
    * See https://www.tornadoweb.org/en/stable/web.html#tornado.web.RequestHandler.redirect
    */
-  private class TornadoRequestHandlerRedirectCall extends HTTP::Server::HttpRedirectResponse::Range,
+  private class TornadoRequestHandlerRedirectCall extends Http::Server::HttpRedirectResponse::Range,
     DataFlow::CallCfgNode {
     TornadoRequestHandlerRedirectCall() {
       this.getFunction() = TornadoModule::Web::RequestHandler::redirectMethod()
@@ -486,7 +486,7 @@ private module Tornado {
    *
    * See https://www.tornadoweb.org/en/stable/web.html#tornado.web.RequestHandler.write
    */
-  private class TornadoRequestHandlerWriteCall extends HTTP::Server::HttpResponse::Range,
+  private class TornadoRequestHandlerWriteCall extends Http::Server::HttpResponse::Range,
     DataFlow::CallCfgNode {
     TornadoRequestHandlerWriteCall() {
       this.getFunction() = TornadoModule::Web::RequestHandler::writeMethod()
@@ -504,7 +504,7 @@ private module Tornado {
    *
    * See https://www.tornadoweb.org/en/stable/web.html#tornado.web.RequestHandler.set_cookie
    */
-  class TornadoRequestHandlerSetCookieCall extends HTTP::Server::CookieWrite::Range,
+  class TornadoRequestHandlerSetCookieCall extends Http::Server::CookieWrite::Range,
     DataFlow::MethodCallNode {
     TornadoRequestHandlerSetCookieCall() {
       this.calls(TornadoModule::Web::RequestHandler::instance(), "set_cookie")
diff --git a/python/ql/lib/semmle/python/frameworks/Twisted.qll b/python/ql/lib/semmle/python/frameworks/Twisted.qll
index c316321555e..34218c7543f 100644
--- a/python/ql/lib/semmle/python/frameworks/Twisted.qll
+++ b/python/ql/lib/semmle/python/frameworks/Twisted.qll
@@ -60,7 +60,7 @@ private module Twisted {
   }
 
   /** A method that handles incoming requests, on a `twisted.web.resource.Resource` subclass. */
-  class TwistedResourceRequestHandler extends HTTP::Server::RequestHandler::Range {
+  class TwistedResourceRequestHandler extends Http::Server::RequestHandler::Range {
     TwistedResourceRequestHandler() { this = any(TwistedResourceSubclass cls).getARequestHandler() }
 
     Parameter getRequestParameter() { result = this.getArg(getRequestParamIndex(this.getName())) }
@@ -176,7 +176,7 @@ private module Twisted {
   /**
    * Implicit response from returns of render methods.
    */
-  private class TwistedResourceRenderMethodReturn extends HTTP::Server::HttpResponse::Range,
+  private class TwistedResourceRenderMethodReturn extends Http::Server::HttpResponse::Range,
     DataFlow::CfgNode {
     TwistedResourceRenderMethodReturn() {
       this.asCfgNode() = any(TwistedResourceRenderMethod meth).getAReturnValueFlowNode()
@@ -194,7 +194,7 @@ private module Twisted {
    *
    * See https://twistedmatrix.com/documents/21.2.0/api/twisted.web.server.Request.html#write
    */
-  class TwistedRequestWriteCall extends HTTP::Server::HttpResponse::Range, DataFlow::MethodCallNode {
+  class TwistedRequestWriteCall extends Http::Server::HttpResponse::Range, DataFlow::MethodCallNode {
     TwistedRequestWriteCall() { this.calls(Request::instance(), "write") }
 
     override DataFlow::Node getBody() {
@@ -211,7 +211,7 @@ private module Twisted {
    *
    * See https://twistedmatrix.com/documents/21.2.0/api/twisted.web.http.Request.html#redirect
    */
-  class TwistedRequestRedirectCall extends HTTP::Server::HttpRedirectResponse::Range,
+  class TwistedRequestRedirectCall extends Http::Server::HttpRedirectResponse::Range,
     DataFlow::MethodCallNode {
     TwistedRequestRedirectCall() { this.calls(Request::instance(), "redirect") }
 
@@ -231,7 +231,7 @@ private module Twisted {
    *
    * See https://twistedmatrix.com/documents/21.2.0/api/twisted.web.http.Request.html#addCookie
    */
-  class TwistedRequestAddCookieCall extends HTTP::Server::CookieWrite::Range,
+  class TwistedRequestAddCookieCall extends Http::Server::CookieWrite::Range,
     DataFlow::MethodCallNode {
     TwistedRequestAddCookieCall() { this.calls(Twisted::Request::instance(), "addCookie") }
 
@@ -247,7 +247,7 @@ private module Twisted {
    *
    * See https://twistedmatrix.com/documents/21.2.0/api/twisted.web.http.Request.html#cookies
    */
-  class TwistedRequestCookiesAppendCall extends HTTP::Server::CookieWrite::Range,
+  class TwistedRequestCookiesAppendCall extends Http::Server::CookieWrite::Range,
     DataFlow::MethodCallNode {
     TwistedRequestCookiesAppendCall() {
       exists(DataFlow::AttrRead cookiesLookup |
diff --git a/python/ql/lib/semmle/python/frameworks/Urllib3.qll b/python/ql/lib/semmle/python/frameworks/Urllib3.qll
index 418a135fbfc..0214dadfc10 100644
--- a/python/ql/lib/semmle/python/frameworks/Urllib3.qll
+++ b/python/ql/lib/semmle/python/frameworks/Urllib3.qll
@@ -49,7 +49,7 @@ private module Urllib3 {
      * - https://urllib3.readthedocs.io/en/stable/reference/urllib3.request.html#urllib3.request.RequestMethods
      * - https://urllib3.readthedocs.io/en/stable/reference/urllib3.connectionpool.html#urllib3.HTTPConnectionPool.urlopen
      */
-    private class RequestCall extends HTTP::Client::Request::Range, API::CallNode {
+    private class RequestCall extends Http::Client::Request::Range, API::CallNode {
       RequestCall() {
         this =
           classRef()
diff --git a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
index 69563a3eab4..fb5ac61cc91 100644
--- a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
+++ b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
@@ -72,6 +72,8 @@ private class Unit = Specific::Unit;
 
 private module API = Specific::API;
 
+private module DataFlow = Specific::DataFlow;
+
 private import Specific::AccessPathSyntax
 
 /** Module containing hooks for providing input data to be interpreted as a model. */
@@ -155,6 +157,38 @@ module ModelInput {
      */
     abstract predicate row(string row);
   }
+
+  /**
+   * A unit class for adding additional type model rows from CodeQL models.
+   */
+  class TypeModel extends Unit {
+    /**
+     * Gets a data-flow node that is a source of the type `package;type`.
+     */
+    DataFlow::Node getASource(string package, string type) { none() }
+
+    /**
+     * Gets a data flow node that is a sink of the type `package;type`,
+     * usually because it is an argument passed to a parameter of that type.
+     */
+    DataFlow::Node getASink(string package, string type) { none() }
+  }
+
+  /**
+   * A unit class for adding additional type variable model rows.
+   */
+  class TypeVariableModelCsv extends Unit {
+    /**
+     * Holds if `row` specifies a path through a type variable.
+     *
+     * A row of form,
+     * ```
+     * name;path
+     * ```
+     * means `path` can be substituted for a token `TypeVar[name]`.
+     */
+    abstract predicate row(string row);
+  }
 }
 
 private import ModelInput
@@ -182,6 +216,8 @@ private predicate summaryModel(string row) { any(SummaryModelCsv s).row(inverseP
 
 private predicate typeModel(string row) { any(TypeModelCsv s).row(inversePad(row)) }
 
+private predicate typeVariableModel(string row) { any(TypeVariableModelCsv s).row(inversePad(row)) }
+
 /** Holds if a source model exists for the given parameters. */
 predicate sourceModel(string package, string type, string path, string kind) {
   exists(string row |
@@ -219,7 +255,7 @@ private predicate summaryModel(
   )
 }
 
-/** Holds if an type model exists for the given parameters. */
+/** Holds if a type model exists for the given parameters. */
 private predicate typeModel(
   string package1, string type1, string package2, string type2, string path
 ) {
@@ -233,6 +269,15 @@ private predicate typeModel(
   )
 }
 
+/** Holds if a type variable model exists for the given parameters. */
+private predicate typeVariableModel(string name, string path) {
+  exists(string row |
+    typeVariableModel(row) and
+    row.splitAt(";", 0) = name and
+    row.splitAt(";", 1) = path
+  )
+}
+
 /**
  * Gets a package that should be seen as an alias for the given other `package`,
  * or the `package` itself.
@@ -253,7 +298,7 @@ private predicate isRelevantPackage(string package) {
     sourceModel(package, _, _, _) or
     sinkModel(package, _, _, _) or
     summaryModel(package, _, _, _, _, _) or
-    typeModel(package, _, _, _, _)
+    typeModel(_, _, package, _, _)
   ) and
   (
     Specific::isPackageUsed(package)
@@ -290,6 +335,8 @@ private class AccessPathRange extends AccessPath::Range {
       summaryModel(package, _, _, this, _, _) or
       summaryModel(package, _, _, _, this, _)
     )
+    or
+    typeVariableModel(_, this)
   }
 }
 
@@ -339,6 +386,57 @@ private predicate invocationMatchesCallSiteFilter(Specific::InvokeNode invoke, A
   Specific::invocationMatchesExtraCallSiteFilter(invoke, token)
 }
 
+private class TypeModelUseEntry extends API::EntryPoint {
+  private string package;
+  private string type;
+
+  TypeModelUseEntry() {
+    exists(any(TypeModel tm).getASource(package, type)) and
+    this = "TypeModelUseEntry;" + package + ";" + type
+  }
+
+  override DataFlow::LocalSourceNode getASource() {
+    result = any(TypeModel tm).getASource(package, type)
+  }
+
+  API::Node getNodeForType(string package_, string type_) {
+    package = package_ and type = type_ and result = this.getANode()
+  }
+}
+
+private class TypeModelDefEntry extends API::EntryPoint {
+  private string package;
+  private string type;
+
+  TypeModelDefEntry() {
+    exists(any(TypeModel tm).getASink(package, type)) and
+    this = "TypeModelDefEntry;" + package + ";" + type
+  }
+
+  override DataFlow::Node getASink() { result = any(TypeModel tm).getASink(package, type) }
+
+  API::Node getNodeForType(string package_, string type_) {
+    package = package_ and type = type_ and result = this.getANode()
+  }
+}
+
+/**
+ * Gets an API node identified by the given `(package,type)` pair.
+ */
+pragma[nomagic]
+private API::Node getNodeFromType(string package, string type) {
+  exists(string package2, string type2, AccessPath path2 |
+    typeModel(package, type, package2, type2, path2) and
+    result = getNodeFromPath(package2, type2, path2)
+  )
+  or
+  result = any(TypeModelUseEntry e).getNodeForType(package, type)
+  or
+  result = any(TypeModelDefEntry e).getNodeForType(package, type)
+  or
+  result = Specific::getExtraNodeFromType(package, type)
+}
+
 /**
  * Gets the API node identified by the first `n` tokens of `path` in the given `(package, type, path)` tuple.
  */
@@ -347,12 +445,8 @@ private API::Node getNodeFromPath(string package, string type, AccessPath path,
   isRelevantFullPath(package, type, path) and
   (
     n = 0 and
-    exists(string package2, string type2, AccessPath path2 |
-      typeModel(package, type, package2, type2, path2) and
-      result = getNodeFromPath(package2, type2, path2, path2.getNumToken())
-    )
+    result = getNodeFromType(package, type)
     or
-    // Language-specific cases, such as handling of global variables
     result = Specific::getExtraNodeFromPath(package, type, path, n)
   )
   or
@@ -361,6 +455,72 @@ private API::Node getNodeFromPath(string package, string type, AccessPath path,
   // Similar to the other recursive case, but where the path may have stepped through one or more call-site filters
   result =
     getSuccessorFromInvoke(getInvocationFromPath(package, type, path, n - 1), path.getToken(n - 1))
+  or
+  // Apply a subpath
+  result =
+    getNodeFromSubPath(getNodeFromPath(package, type, path, n - 1), getSubPathAt(path, n - 1))
+  or
+  // Apply a type step
+  typeStep(getNodeFromPath(package, type, path, n), result)
+}
+
+/**
+ * Gets a subpath for the `TypeVar` token found at the `n`th token of `path`.
+ */
+pragma[nomagic]
+private AccessPath getSubPathAt(AccessPath path, int n) {
+  exists(string typeVarName |
+    path.getToken(n).getAnArgument("TypeVar") = typeVarName and
+    typeVariableModel(typeVarName, result)
+  )
+}
+
+/**
+ * Gets a node that is found by evaluating the first `n` tokens of `subPath` starting at `base`.
+ */
+pragma[nomagic]
+private API::Node getNodeFromSubPath(API::Node base, AccessPath subPath, int n) {
+  exists(AccessPath path, int k |
+    base = [getNodeFromPath(_, _, path, k), getNodeFromSubPath(_, path, k)] and
+    subPath = getSubPathAt(path, k) and
+    result = base and
+    n = 0
+  )
+  or
+  exists(string package, string type, AccessPath basePath |
+    typeStepModel(package, type, basePath, subPath) and
+    base = getNodeFromPath(package, type, basePath) and
+    result = base and
+    n = 0
+  )
+  or
+  result = getSuccessorFromNode(getNodeFromSubPath(base, subPath, n - 1), subPath.getToken(n - 1))
+  or
+  result =
+    getSuccessorFromInvoke(getInvocationFromSubPath(base, subPath, n - 1), subPath.getToken(n - 1))
+  or
+  result =
+    getNodeFromSubPath(getNodeFromSubPath(base, subPath, n - 1), getSubPathAt(subPath, n - 1))
+  or
+  typeStep(getNodeFromSubPath(base, subPath, n), result)
+}
+
+/**
+ * Gets a call site that is found by evaluating the first `n` tokens of `subPath` starting at `base`.
+ */
+private Specific::InvokeNode getInvocationFromSubPath(API::Node base, AccessPath subPath, int n) {
+  result = Specific::getAnInvocationOf(getNodeFromSubPath(base, subPath, n))
+  or
+  result = getInvocationFromSubPath(base, subPath, n - 1) and
+  invocationMatchesCallSiteFilter(result, subPath.getToken(n - 1))
+}
+
+/**
+ * Gets a node that is found by evaluating `subPath` starting at `base`.
+ */
+pragma[nomagic]
+private API::Node getNodeFromSubPath(API::Node base, AccessPath subPath) {
+  result = getNodeFromSubPath(base, subPath, subPath.getNumToken())
 }
 
 /** Gets the node identified by the given `(package, type, path)` tuple. */
@@ -368,6 +528,20 @@ API::Node getNodeFromPath(string package, string type, AccessPath path) {
   result = getNodeFromPath(package, type, path, path.getNumToken())
 }
 
+pragma[nomagic]
+private predicate typeStepModel(string package, string type, AccessPath basePath, AccessPath output) {
+  summaryModel(package, type, basePath, "", output, "type")
+}
+
+pragma[nomagic]
+private predicate typeStep(API::Node pred, API::Node succ) {
+  exists(string package, string type, AccessPath basePath, AccessPath output |
+    typeStepModel(package, type, basePath, output) and
+    pred = getNodeFromPath(package, type, basePath) and
+    succ = getNodeFromSubPath(pred, output)
+  )
+}
+
 /**
  * Gets an invocation identified by the given `(package, type, path)` tuple.
  *
@@ -390,7 +564,7 @@ Specific::InvokeNode getInvocationFromPath(string package, string type, AccessPa
  */
 bindingset[name]
 predicate isValidTokenNameInIdentifyingAccessPath(string name) {
-  name = ["Argument", "Parameter", "ReturnValue", "WithArity"]
+  name = ["Argument", "Parameter", "ReturnValue", "WithArity", "TypeVar"]
   or
   Specific::isExtraValidTokenNameInIdentifyingAccessPath(name)
 }
@@ -418,6 +592,9 @@ predicate isValidTokenArgumentInIdentifyingAccessPath(string name, string argume
   name = "WithArity" and
   argument.regexpMatch("\\d+(\\.\\.(\\d+)?)?")
   or
+  name = "TypeVar" and
+  exists(argument)
+  or
   Specific::isExtraValidTokenArgumentInIdentifyingAccessPath(name, argument)
 }
 
@@ -469,12 +646,7 @@ module ModelOutput {
    * Holds if `node` is seen as an instance of `(package,type)` due to a type definition
    * contributed by a CSV model.
    */
-  API::Node getATypeNode(string package, string type) {
-    exists(string package2, string type2, AccessPath path |
-      typeModel(package, type, package2, type2, path) and
-      result = getNodeFromPath(package2, type2, path)
-    )
-  }
+  API::Node getATypeNode(string package, string type) { result = getNodeFromType(package, type) }
 
   /**
    * Gets an error message relating to an invalid CSV row in a model.
@@ -489,6 +661,8 @@ module ModelOutput {
       any(SummaryModelCsv csv).row(row) and kind = "summary" and expectedArity = 6
       or
       any(TypeModelCsv csv).row(row) and kind = "type" and expectedArity = 5
+      or
+      any(TypeVariableModelCsv csv).row(row) and kind = "type-variable" and expectedArity = 2
     |
       actualArity = count(row.indexOf(";")) + 1 and
       actualArity != expectedArity and
@@ -499,7 +673,7 @@ module ModelOutput {
     or
     // Check names and arguments of access path tokens
     exists(AccessPath path, AccessPathToken token |
-      isRelevantFullPath(_, _, path) and
+      (isRelevantFullPath(_, _, path) or typeVariableModel(_, path)) and
       token = path.getToken(_)
     |
       not isValidTokenNameInIdentifyingAccessPath(token.getName()) and
diff --git a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsSpecific.qll b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsSpecific.qll
index 92f7dcbd50b..2f53c4fdeea 100644
--- a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsSpecific.qll
+++ b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsSpecific.qll
@@ -20,28 +20,29 @@
  */
 
 private import python as PY
-private import semmle.python.dataflow.new.DataFlow
 private import ApiGraphModels
 import semmle.python.ApiGraphs::API as API
 
 class Unit = PY::Unit;
 
 // Re-export libraries needed by ApiGraphModels.qll
-import semmle.python.frameworks.data.internal.AccessPathSyntax as AccessPathSyntax
+import semmle.python.dataflow.new.internal.AccessPathSyntax as AccessPathSyntax
+import semmle.python.dataflow.new.DataFlow::DataFlow as DataFlow
 private import AccessPathSyntax
 
 /**
  * Holds if models describing `package` may be relevant for the analysis of this database.
  */
-predicate isPackageUsed(string package) { exists(API::moduleImport(package)) }
+predicate isPackageUsed(string package) { API::moduleImportExists(package) }
 
 /** Gets a Python-specific interpretation of the `(package, type, path)` tuple after resolving the first `n` access path tokens. */
 bindingset[package, type, path]
-API::Node getExtraNodeFromPath(string package, string type, AccessPath path, int n) {
+API::Node getExtraNodeFromPath(string package, string type, AccessPath path, int n) { none() }
+
+/** Gets a Python-specific interpretation of the `(package, type)` tuple. */
+API::Node getExtraNodeFromType(string package, string type) {
   type = "" and
-  n = 0 and
-  result = API::moduleImport(package) and
-  exists(path)
+  result = API::moduleImport(package)
 }
 
 /**
diff --git a/python/ql/lib/semmle/python/internal/ConceptsShared.qll b/python/ql/lib/semmle/python/internal/ConceptsShared.qll
index 027e587d9d3..2f6c8bb8b29 100644
--- a/python/ql/lib/semmle/python/internal/ConceptsShared.qll
+++ b/python/ql/lib/semmle/python/internal/ConceptsShared.qll
@@ -87,3 +87,70 @@ module Cryptography {
     predicate isWeak() { this = "ECB" }
   }
 }
+
+/** Provides classes for modeling HTTP-related APIs. */
+module Http {
+  /** Provides classes for modeling HTTP clients. */
+  module Client {
+    /**
+     * A data-flow node that makes an outgoing HTTP request.
+     *
+     * Extend this class to refine existing API models. If you want to model new APIs,
+     * extend `Http::Client::Request::Range` instead.
+     */
+    class Request extends DataFlow::Node instanceof Request::Range {
+      /**
+       * Gets a data-flow node that contributes to the URL of the request.
+       * Depending on the framework, a request may have multiple nodes which contribute to the URL.
+       */
+      DataFlow::Node getAUrlPart() { result = super.getAUrlPart() }
+
+      /** Gets a string that identifies the framework used for this request. */
+      string getFramework() { result = super.getFramework() }
+
+      /**
+       * Holds if this request is made using a mode that disables SSL/TLS
+       * certificate validation, where `disablingNode` represents the point at
+       * which the validation was disabled, and `argumentOrigin` represents the origin
+       * of the argument that disabled the validation (which could be the same node as
+       * `disablingNode`).
+       */
+      predicate disablesCertificateValidation(
+        DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+      ) {
+        super.disablesCertificateValidation(disablingNode, argumentOrigin)
+      }
+    }
+
+    /** Provides a class for modeling new HTTP requests. */
+    module Request {
+      /**
+       * A data-flow node that makes an outgoing HTTP request.
+       *
+       * Extend this class to model new APIs. If you want to refine existing API models,
+       * extend `Http::Client::Request` instead.
+       */
+      abstract class Range extends DataFlow::Node {
+        /**
+         * Gets a data-flow node that contributes to the URL of the request.
+         * Depending on the framework, a request may have multiple nodes which contribute to the URL.
+         */
+        abstract DataFlow::Node getAUrlPart();
+
+        /** Gets a string that identifies the framework used for this request. */
+        abstract string getFramework();
+
+        /**
+         * Holds if this request is made using a mode that disables SSL/TLS
+         * certificate validation, where `disablingNode` represents the point at
+         * which the validation was disabled, and `argumentOrigin` represents the origin
+         * of the argument that disabled the validation (which could be the same node as
+         * `disablingNode`).
+         */
+        abstract predicate disablesCertificateValidation(
+          DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+        );
+      }
+    }
+  }
+}
diff --git a/python/ql/lib/semmle/python/objects/TObject.qll b/python/ql/lib/semmle/python/objects/TObject.qll
index ee6bcb8340d..58be33ddd91 100644
--- a/python/ql/lib/semmle/python/objects/TObject.qll
+++ b/python/ql/lib/semmle/python/objects/TObject.qll
@@ -334,7 +334,7 @@ predicate call3(
 }
 
 bindingset[self, function]
-predicate method_binding(
+deprecated predicate method_binding(
   AttrNode instantiation, ObjectInternal self, CallableObjectInternal function,
   PointsToContext context
 ) {
@@ -357,7 +357,9 @@ predicate method_binding(
 
 /** Helper for method_binding */
 pragma[noinline]
-predicate receiver(AttrNode instantiation, PointsToContext context, ObjectInternal obj, string name) {
+deprecated predicate receiver(
+  AttrNode instantiation, PointsToContext context, ObjectInternal obj, string name
+) {
   PointsToInternal::pointsTo(instantiation.getObject(name), context, obj, _)
 }
 
diff --git a/python/ql/lib/semmle/python/pointsto/Base.qll b/python/ql/lib/semmle/python/pointsto/Base.qll
index adc2abedaa0..a3407419da2 100644
--- a/python/ql/lib/semmle/python/pointsto/Base.qll
+++ b/python/ql/lib/semmle/python/pointsto/Base.qll
@@ -13,7 +13,7 @@ import semmle.python.essa.SsaDefinitions
 private import semmle.python.types.Builtins
 private import semmle.python.internal.CachedStages
 
-module BasePointsTo {
+deprecated module BasePointsTo {
   /** INTERNAL -- Use n.refersTo(value, _, origin) instead */
   pragma[noinline]
   predicate points_to(ControlFlowNode f, Object value, ControlFlowNode origin) {
@@ -27,13 +27,13 @@ module BasePointsTo {
 }
 
 /** Gets the kwargs parameter (`**kwargs`). In a function definition this is always a dict. */
-predicate kwargs_points_to(ControlFlowNode f, ClassObject cls) {
+deprecated predicate kwargs_points_to(ControlFlowNode f, ClassObject cls) {
   exists(Function func | func.getKwarg() = f.getNode()) and
   cls = theDictType()
 }
 
 /** Gets the varargs parameter (`*varargs`). In a function definition this is always a tuple. */
-predicate varargs_points_to(ControlFlowNode f, ClassObject cls) {
+deprecated predicate varargs_points_to(ControlFlowNode f, ClassObject cls) {
   exists(Function func | func.getVararg() = f.getNode()) and
   cls = theTupleType()
 }
@@ -45,7 +45,7 @@ predicate varargs_points_to(ControlFlowNode f, ClassObject cls) {
  *  This exists primarily for internal use. Use getAnInferredType() instead.
  */
 pragma[noinline]
-ClassObject simple_types(Object obj) {
+deprecated ClassObject simple_types(Object obj) {
   result = comprehension(obj.getOrigin())
   or
   result = collection_literal(obj.getOrigin())
@@ -59,7 +59,7 @@ ClassObject simple_types(Object obj) {
   obj = unknownValue() and result = theUnknownType()
 }
 
-private ClassObject comprehension(Expr e) {
+deprecated private ClassObject comprehension(Expr e) {
   e instanceof ListComp and result = theListType()
   or
   e instanceof SetComp and result = theSetType()
@@ -69,7 +69,7 @@ private ClassObject comprehension(Expr e) {
   e instanceof GeneratorExp and result = theGeneratorType()
 }
 
-private ClassObject collection_literal(Expr e) {
+deprecated private ClassObject collection_literal(Expr e) {
   e instanceof List and result = theListType()
   or
   e instanceof Set and result = theSetType()
@@ -79,7 +79,7 @@ private ClassObject collection_literal(Expr e) {
   e instanceof Tuple and result = theTupleType()
 }
 
-private int tuple_index_value(Object t, int i) {
+deprecated private int tuple_index_value(Object t, int i) {
   result = t.(TupleNode).getElement(i).getNode().(Num).getN().toInt()
   or
   exists(Object item |
@@ -89,7 +89,7 @@ private int tuple_index_value(Object t, int i) {
 }
 
 pragma[noinline]
-int version_tuple_value(Object t) {
+deprecated int version_tuple_value(Object t) {
   not exists(tuple_index_value(t, 1)) and result = tuple_index_value(t, 0) * 10
   or
   not exists(tuple_index_value(t, 2)) and
@@ -102,7 +102,7 @@ int version_tuple_value(Object t) {
 }
 
 /** Choose a version numbers that represent the extreme of supported versions. */
-private int major_minor() {
+deprecated private int major_minor() {
   if major_version() = 3
   then (
     result = 33 or result = 37
@@ -113,7 +113,7 @@ private int major_minor() {
 }
 
 /** Compares the given tuple object to both the maximum and minimum possible sys.version_info values */
-int version_tuple_compare(Object t) {
+deprecated int version_tuple_compare(Object t) {
   version_tuple_value(t) < major_minor() and result = -1
   or
   version_tuple_value(t) = major_minor() and result = 0
@@ -122,7 +122,7 @@ int version_tuple_compare(Object t) {
 }
 
 /** Holds if `cls` is a new-style class if it were to have no explicit base classes */
-predicate baseless_is_new_style(ClassObject cls) {
+deprecated predicate baseless_is_new_style(ClassObject cls) {
   cls.isBuiltin()
   or
   major_version() = 3 and exists(cls)
@@ -160,7 +160,7 @@ private predicate class_defines_name(Class cls, string name) {
 }
 
 /** Gets a return value CFG node, provided that is safe to track across returns */
-ControlFlowNode safe_return_node(PyFunctionObject func) {
+deprecated ControlFlowNode safe_return_node(PyFunctionObject func) {
   result = func.getAReturnedNode() and
   // Not a parameter
   not exists(Parameter p, SsaVariable pvar |
@@ -172,7 +172,7 @@ ControlFlowNode safe_return_node(PyFunctionObject func) {
 }
 
 /** Holds if it can be determined from the control flow graph alone that this function can never return */
-predicate function_can_never_return(FunctionObject func) {
+deprecated predicate function_can_never_return(FunctionObject func) {
   /*
    * A Python function never returns if it has no normal exits that are not dominated by a
    * call to a function which itself never returns.
@@ -188,7 +188,9 @@ predicate function_can_never_return(FunctionObject func) {
 
 /** Hold if outer contains inner, both are contained within a test and inner is a use is a plain use or an attribute lookup */
 pragma[noinline]
-predicate contains_interesting_expression_within_test(ControlFlowNode outer, ControlFlowNode inner) {
+deprecated predicate contains_interesting_expression_within_test(
+  ControlFlowNode outer, ControlFlowNode inner
+) {
   inner.isLoad() and
   exists(ControlFlowNode test |
     outer.getAChild*() = inner and
@@ -208,7 +210,7 @@ predicate test_contains(ControlFlowNode expr, ControlFlowNode use) {
 }
 
 /** Holds if `test` is a test (a branch), `use` is within that test and `def` is an edge from that test with `sense` */
-predicate refinement_test(
+deprecated predicate refinement_test(
   ControlFlowNode test, ControlFlowNode use, boolean sense, PyEdgeRefinement def
 ) {
   /*
@@ -224,7 +226,7 @@ predicate refinement_test(
 
 /** Holds if `f` is an import of the form `from .[...] import name` and the enclosing scope is an __init__ module */
 pragma[noinline]
-predicate live_import_from_dot_in_init(ImportMemberNode f, EssaVariable var) {
+deprecated predicate live_import_from_dot_in_init(ImportMemberNode f, EssaVariable var) {
   exists(string name |
     import_from_dot_in_init(f.getModule(name)) and
     var.getSourceVariable().getName() = name and
@@ -249,13 +251,13 @@ Object undefinedVariable() { py_special_objects(result, "_semmle_undefined_value
 /** Gets the pseudo-object representing an unknown value */
 Object unknownValue() { result.asBuiltin() = Builtin::unknown() }
 
-BuiltinCallable theTypeNewMethod() {
+deprecated BuiltinCallable theTypeNewMethod() {
   result.asBuiltin() = theTypeType().asBuiltin().getMember("__new__")
 }
 
 /** Gets the `value, cls, origin` that `f` would refer to if it has not been assigned some other value */
 pragma[noinline]
-predicate potential_builtin_points_to(
+deprecated predicate potential_builtin_points_to(
   NameNode f, Object value, ClassObject cls, ControlFlowNode origin
 ) {
   f.isGlobal() and
@@ -269,7 +271,7 @@ predicate potential_builtin_points_to(
 }
 
 pragma[noinline]
-predicate builtin_name_points_to(string name, Object value, ClassObject cls) {
+deprecated predicate builtin_name_points_to(string name, Object value, ClassObject cls) {
   value = Object::builtin(name) and cls.asBuiltin() = value.asBuiltin().getClass()
 }
 
@@ -331,7 +333,9 @@ module BaseFlow {
 }
 
 /** Points-to for syntactic elements where context is not relevant */
-predicate simple_points_to(ControlFlowNode f, Object value, ClassObject cls, ControlFlowNode origin) {
+deprecated predicate simple_points_to(
+  ControlFlowNode f, Object value, ClassObject cls, ControlFlowNode origin
+) {
   kwargs_points_to(f, cls) and value = f and origin = f
   or
   varargs_points_to(f, cls) and value = f and origin = f
@@ -347,7 +351,9 @@ predicate simple_points_to(ControlFlowNode f, Object value, ClassObject cls, Con
  * Holds if `bit` is a binary expression node with a bitwise operator.
  * Helper for `this_binary_expr_points_to`.
  */
-predicate bitwise_expression_node(BinaryExprNode bit, ControlFlowNode left, ControlFlowNode right) {
+deprecated predicate bitwise_expression_node(
+  BinaryExprNode bit, ControlFlowNode left, ControlFlowNode right
+) {
   exists(Operator op | op = bit.getNode().getOp() |
     op instanceof BitAnd or
     op instanceof BitOr or
@@ -357,13 +363,13 @@ predicate bitwise_expression_node(BinaryExprNode bit, ControlFlowNode left, Cont
   right = bit.getRight()
 }
 
-private Module theCollectionsAbcModule() {
+deprecated private Module theCollectionsAbcModule() {
   result.getName() = "_abcoll"
   or
   result.getName() = "_collections_abc"
 }
 
-ClassObject collectionsAbcClass(string name) {
+deprecated ClassObject collectionsAbcClass(string name) {
   exists(Class cls |
     result.getPyClass() = cls and
     cls.getName() = name and
diff --git a/python/ql/lib/semmle/python/pointsto/Filters.qll b/python/ql/lib/semmle/python/pointsto/Filters.qll
index 117845d3c7f..dbf9baf5279 100644
--- a/python/ql/lib/semmle/python/pointsto/Filters.qll
+++ b/python/ql/lib/semmle/python/pointsto/Filters.qll
@@ -13,7 +13,7 @@ predicate hasattr(CallNode c, ControlFlowNode obj, string attr) {
 }
 
 /** Holds if `c` is a call to `callable(obj)`. */
-predicate is_callable(CallNode c, ControlFlowNode obj) {
+deprecated predicate is_callable(CallNode c, ControlFlowNode obj) {
   c.getFunction().(NameNode).getId() = "callable" and
   obj = c.getArg(0)
 }
@@ -26,7 +26,7 @@ predicate isinstance(CallNode fc, ControlFlowNode cls, ControlFlowNode use) {
 }
 
 /** Holds if `c` is a call to `issubclass(use, cls)`. */
-predicate issubclass(CallNode fc, ControlFlowNode cls, ControlFlowNode use) {
+deprecated predicate issubclass(CallNode fc, ControlFlowNode cls, ControlFlowNode use) {
   fc.getFunction().(NameNode).getId() = "issubclass" and
   fc.getArg(0) = use and
   cls = fc.getArg(1)
diff --git a/python/ql/lib/semmle/python/pointsto/PointsToContext.qll b/python/ql/lib/semmle/python/pointsto/PointsToContext.qll
index ad86a49ba6f..a63381e5e20 100644
--- a/python/ql/lib/semmle/python/pointsto/PointsToContext.qll
+++ b/python/ql/lib/semmle/python/pointsto/PointsToContext.qll
@@ -122,7 +122,7 @@ private newtype TPointsToContext =
   } or
   TObjectContext(SelfInstanceInternal object)
 
-module Context {
+deprecated module Context {
   PointsToContext forObject(ObjectInternal object) { result = TObjectContext(object) }
 }
 
diff --git a/python/ql/lib/semmle/python/protocols.qll b/python/ql/lib/semmle/python/protocols.qll
index f1f7e6a3ed7..fc341dadc33 100644
--- a/python/ql/lib/semmle/python/protocols.qll
+++ b/python/ql/lib/semmle/python/protocols.qll
@@ -1,19 +1,19 @@
 import python
 
 /** Retained for backwards compatibility use ClassObject.isIterator() instead. */
-predicate is_iterator(ClassObject c) { c.isIterator() }
+deprecated predicate is_iterator(ClassObject c) { c.isIterator() }
 
 /** Retained for backwards compatibility use ClassObject.isIterable() instead. */
-predicate is_iterable(ClassObject c) { c.isIterable() }
+deprecated predicate is_iterable(ClassObject c) { c.isIterable() }
 
 /** Retained for backwards compatibility use ClassObject.isCollection() instead. */
-predicate is_collection(ClassObject c) { c.isCollection() }
+deprecated predicate is_collection(ClassObject c) { c.isCollection() }
 
 /** Retained for backwards compatibility use ClassObject.isMapping() instead. */
-predicate is_mapping(ClassObject c) { c.isMapping() }
+deprecated predicate is_mapping(ClassObject c) { c.isMapping() }
 
 /** Retained for backwards compatibility use ClassObject.isSequence() instead. */
-predicate is_sequence(ClassObject c) { c.isSequence() }
+deprecated predicate is_sequence(ClassObject c) { c.isSequence() }
 
 /** Retained for backwards compatibility use ClassObject.isContextManager() instead. */
-predicate is_context_manager(ClassObject c) { c.isContextManager() }
+deprecated predicate is_context_manager(ClassObject c) { c.isContextManager() }
diff --git a/python/ql/lib/semmle/python/security/OverlyLargeRangeQuery.qll b/python/ql/lib/semmle/python/security/OverlyLargeRangeQuery.qll
index f83a6411618..65e662f0bc5 100644
--- a/python/ql/lib/semmle/python/security/OverlyLargeRangeQuery.qll
+++ b/python/ql/lib/semmle/python/security/OverlyLargeRangeQuery.qll
@@ -96,7 +96,10 @@ class OverlyWideRange extends RegExpCharacterRange {
       toCodePoint("A") <= high
       or
       // a non-alphanumeric char as part of the range boundaries
-      exists(int bound | bound = [low, high] | not isAlphanumeric(bound.toUnicode()))
+      exists(int bound | bound = [low, high] | not isAlphanumeric(bound.toUnicode())) and
+      // while still being ascii
+      low < 128 and
+      high < 128
     ) and
     // allowlist for known ranges
     not this = allowedWideRanges()
@@ -173,7 +176,7 @@ module RangePrinter {
   }
 
   /** Gets the number of parts we should print for a given `range`. */
-  private int parts(OverlyWideRange range) { result = 1 + strictcount(cutoff(range, _)) }
+  private int parts(OverlyWideRange range) { result = 1 + count(cutoff(range, _)) }
 
   /** Holds if the given part of a range should span from `low` to `high`. */
   private predicate part(OverlyWideRange range, int part, string low, string high) {
diff --git a/python/ql/lib/semmle/python/security/dataflow/CleartextStorageCustomizations.qll b/python/ql/lib/semmle/python/security/dataflow/CleartextStorageCustomizations.qll
index 3c7bc43ffa2..0ff32823d68 100644
--- a/python/ql/lib/semmle/python/security/dataflow/CleartextStorageCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/CleartextStorageCustomizations.qll
@@ -56,7 +56,7 @@ module CleartextStorage {
   /** The data written to a cookie on a HTTP response, considered as a flow sink. */
   class CookieWriteAsSink extends Sink {
     CookieWriteAsSink() {
-      exists(HTTP::Server::CookieWrite write |
+      exists(Http::Server::CookieWrite write |
         this = write.getValueArg()
         or
         this = write.getHeaderArg()
diff --git a/python/ql/lib/semmle/python/security/dataflow/LdapInjectionCustomizations.qll b/python/ql/lib/semmle/python/security/dataflow/LdapInjectionCustomizations.qll
index dc038ad25b0..fbab127511b 100644
--- a/python/ql/lib/semmle/python/security/dataflow/LdapInjectionCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/LdapInjectionCustomizations.qll
@@ -64,14 +64,14 @@ module LdapInjection {
    * A logging operation, considered as a flow sink.
    */
   class LdapExecutionAsDnSink extends DnSink {
-    LdapExecutionAsDnSink() { this = any(LDAP::LdapExecution ldap).getBaseDn() }
+    LdapExecutionAsDnSink() { this = any(Ldap::LdapExecution ldap).getBaseDn() }
   }
 
   /**
    * A logging operation, considered as a flow sink.
    */
   class LdapExecutionAsFilterSink extends FilterSink {
-    LdapExecutionAsFilterSink() { this = any(LDAP::LdapExecution ldap).getFilter() }
+    LdapExecutionAsFilterSink() { this = any(Ldap::LdapExecution ldap).getFilter() }
   }
 
   /**
diff --git a/python/ql/lib/semmle/python/security/dataflow/ReflectedXSSCustomizations.qll b/python/ql/lib/semmle/python/security/dataflow/ReflectedXSSCustomizations.qll
index e2a9fab37a3..ea826c3b0c5 100644
--- a/python/ql/lib/semmle/python/security/dataflow/ReflectedXSSCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/ReflectedXSSCustomizations.qll
@@ -48,7 +48,7 @@ module ReflectedXss {
    */
   class ServerHttpResponseBodyAsSink extends Sink {
     ServerHttpResponseBodyAsSink() {
-      exists(HTTP::Server::HttpResponse response |
+      exists(Http::Server::HttpResponse response |
         response.getMimetype().toLowerCase() = "text/html" and
         this = response.getBody()
       )
diff --git a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
index b6df75addf0..e5a0be727cf 100644
--- a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
@@ -28,7 +28,7 @@ module ServerSideRequestForgery {
     /**
      * Gets the request this sink belongs to.
      */
-    abstract HTTP::Client::Request getRequest();
+    abstract Http::Client::Request getRequest();
   }
 
   /**
@@ -57,7 +57,7 @@ module ServerSideRequestForgery {
 
   /** The URL of an HTTP request, considered as a sink. */
   class HttpRequestUrlAsSink extends Sink {
-    HTTP::Client::Request req;
+    Http::Client::Request req;
 
     HttpRequestUrlAsSink() {
       req.getAUrlPart() = this and
@@ -74,7 +74,7 @@ module ServerSideRequestForgery {
       not req.getScope().getEnclosingModule().getName() in ["http.client", "httplib"]
     }
 
-    override HTTP::Client::Request getRequest() { result = req }
+    override Http::Client::Request getRequest() { result = req }
   }
 
   /**
diff --git a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll
index 2872ca5192f..36ec416cca2 100644
--- a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll
@@ -42,7 +42,7 @@ class FullServerSideRequestForgeryConfiguration extends TaintTracking::Configura
 /**
  * Holds if all URL parts of `request` is fully user controlled.
  */
-predicate fullyControlledRequest(HTTP::Client::Request request) {
+predicate fullyControlledRequest(Http::Client::Request request) {
   exists(FullServerSideRequestForgeryConfiguration fullConfig |
     forall(DataFlow::Node urlPart | urlPart = request.getAUrlPart() |
       fullConfig.hasFlow(_, urlPart)
diff --git a/python/ql/lib/semmle/python/security/dataflow/StackTraceExposureCustomizations.qll b/python/ql/lib/semmle/python/security/dataflow/StackTraceExposureCustomizations.qll
index 3596fa80f72..09f84327a63 100644
--- a/python/ql/lib/semmle/python/security/dataflow/StackTraceExposureCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/StackTraceExposureCustomizations.qll
@@ -49,6 +49,6 @@ module StackTraceExposure {
    * The body of a HTTP response that will be returned from a server, considered as a flow sink.
    */
   class ServerHttpResponseBodyAsSink extends Sink {
-    ServerHttpResponseBodyAsSink() { this = any(HTTP::Server::HttpResponse response).getBody() }
+    ServerHttpResponseBodyAsSink() { this = any(Http::Server::HttpResponse response).getBody() }
   }
 }
diff --git a/python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll b/python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll
index 0da2f779c8a..b4843f1a8eb 100644
--- a/python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll
@@ -48,7 +48,7 @@ module UrlRedirect {
    */
   class RedirectLocationAsSink extends Sink {
     RedirectLocationAsSink() {
-      this = any(HTTP::Server::HttpRedirectResponse e).getRedirectLocation()
+      this = any(Http::Server::HttpRedirectResponse e).getRedirectLocation()
     }
   }
 
diff --git a/python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll b/python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll
index 000c247fc71..d006837466b 100644
--- a/python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll
+++ b/python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll
@@ -115,6 +115,7 @@ private newtype TStatePair =
 private int rankState(State state) {
   state =
     rank[result](State s, Location l |
+      stateInsideBacktracking(s) and
       l = s.getRepr().getLocation()
     |
       s order by l.getStartLine(), l.getStartColumn(), s.toString()
diff --git a/python/ql/lib/semmle/python/security/regexp/NfaUtils.qll b/python/ql/lib/semmle/python/security/regexp/NfaUtils.qll
index fdcb10c2f85..5112bdad11e 100644
--- a/python/ql/lib/semmle/python/security/regexp/NfaUtils.qll
+++ b/python/ql/lib/semmle/python/security/regexp/NfaUtils.qll
@@ -93,8 +93,6 @@ class RegExpRoot extends RegExpTerm {
    * Holds if this root term is relevant to the ReDoS analysis.
    */
   predicate isRelevant() {
-    // there is at least one repetition
-    getRoot(any(InfiniteRepetitionQuantifier q)) = this and
     // is actually used as a RegExp
     this.isUsedAsRegExp() and
     // not excluded for library specific reasons
@@ -877,6 +875,107 @@ predicate isStartState(State state) {
  */
 signature predicate isCandidateSig(State state, string pump);
 
+/**
+ * Holds if `state` is a candidate for ReDoS.
+ */
+signature predicate isCandidateSig(State state);
+
+/**
+ * Predicates for constructing a prefix string that leads to a given state.
+ */
+module PrefixConstruction<isCandidateSig/1 isCandidate> {
+  /**
+   * Holds if `state` is the textually last start state for the regular expression.
+   */
+  private predicate lastStartState(RelevantState state) {
+    exists(RegExpRoot root |
+      state =
+        max(RelevantState s, Location l |
+          isStartState(s) and
+          getRoot(s.getRepr()) = root and
+          l = s.getRepr().getLocation()
+        |
+          s
+          order by
+            l.getStartLine(), l.getStartColumn(), s.getRepr().toString(), l.getEndColumn(),
+            l.getEndLine()
+        )
+    )
+  }
+
+  /**
+   * Holds if there exists any transition (Epsilon() or other) from `a` to `b`.
+   */
+  private predicate existsTransition(State a, State b) { delta(a, _, b) }
+
+  /**
+   * Gets the minimum number of transitions it takes to reach `state` from the `start` state.
+   */
+  int prefixLength(State start, State state) =
+    shortestDistances(lastStartState/1, existsTransition/2)(start, state, result)
+
+  /**
+   * Gets the minimum number of transitions it takes to reach `state` from the start state.
+   */
+  private int lengthFromStart(State state) { result = prefixLength(_, state) }
+
+  /**
+   * Gets a string for which the regular expression will reach `state`.
+   *
+   * Has at most one result for any given `state`.
+   * This predicate will not always have a result even if there is a ReDoS issue in
+   * the regular expression.
+   */
+  string prefix(State state) {
+    lastStartState(state) and
+    result = ""
+    or
+    // the search stops past the last redos candidate state.
+    lengthFromStart(state) <= max(lengthFromStart(any(State s | isCandidate(s)))) and
+    exists(State prev |
+      // select a unique predecessor (by an arbitrary measure)
+      prev =
+        min(State s, Location loc |
+          lengthFromStart(s) = lengthFromStart(state) - 1 and
+          loc = s.getRepr().getLocation() and
+          delta(s, _, state)
+        |
+          s
+          order by
+            loc.getStartLine(), loc.getStartColumn(), loc.getEndLine(), loc.getEndColumn(),
+            s.getRepr().toString()
+        )
+    |
+      // greedy search for the shortest prefix
+      result = prefix(prev) and delta(prev, Epsilon(), state)
+      or
+      not delta(prev, Epsilon(), state) and
+      result = prefix(prev) + getCanonicalEdgeChar(prev, state)
+    )
+  }
+
+  /**
+   * Gets a canonical char for which there exists a transition from `prev` to `next` in the NFA.
+   */
+  private string getCanonicalEdgeChar(State prev, State next) {
+    result =
+      min(string c | delta(prev, any(InputSymbol symbol | c = intersect(Any(), symbol)), next))
+  }
+
+  /** A state within a regular expression that contains a candidate state. */
+  class RelevantState instanceof State {
+    RelevantState() {
+      exists(State s | isCandidate(s) | getRoot(s.getRepr()) = getRoot(this.getRepr()))
+    }
+
+    /** Gets a string representation for this state in a regular expression. */
+    string toString() { result = State.super.toString() }
+
+    /** Gets the term represented by this state. */
+    RegExpTerm getRepr() { result = State.super.getRepr() }
+  }
+}
+
 /**
  * A module for pruning candidate ReDoS states.
  * The candidates are specified by the `isCandidate` signature predicate.
@@ -910,95 +1009,11 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
   /** Gets a state that can reach the `accept-any` state using only epsilon steps. */
   private State acceptsAnySuffix() { epsilonSucc*(result) = AcceptAnySuffix(_) }
 
-  /**
-   * Predicates for constructing a prefix string that leads to a given state.
-   */
-  private module PrefixConstruction {
-    /**
-     * Holds if `state` is the textually last start state for the regular expression.
-     */
-    private predicate lastStartState(State state) {
-      exists(RegExpRoot root |
-        state =
-          max(State s, Location l |
-            s = stateInPumpableRegexp() and
-            isStartState(s) and
-            getRoot(s.getRepr()) = root and
-            l = s.getRepr().getLocation()
-          |
-            s
-            order by
-              l.getStartLine(), l.getStartColumn(), s.getRepr().toString(), l.getEndColumn(),
-              l.getEndLine()
-          )
-      )
-    }
+  predicate isCandidateState(State s) { isReDoSCandidate(s, _) }
 
-    /**
-     * Holds if there exists any transition (Epsilon() or other) from `a` to `b`.
-     */
-    private predicate existsTransition(State a, State b) { delta(a, _, b) }
+  import PrefixConstruction<isCandidateState/1> as Prefix
 
-    /**
-     * Gets the minimum number of transitions it takes to reach `state` from the `start` state.
-     */
-    int prefixLength(State start, State state) =
-      shortestDistances(lastStartState/1, existsTransition/2)(start, state, result)
-
-    /**
-     * Gets the minimum number of transitions it takes to reach `state` from the start state.
-     */
-    private int lengthFromStart(State state) { result = prefixLength(_, state) }
-
-    /**
-     * Gets a string for which the regular expression will reach `state`.
-     *
-     * Has at most one result for any given `state`.
-     * This predicate will not always have a result even if there is a ReDoS issue in
-     * the regular expression.
-     */
-    string prefix(State state) {
-      lastStartState(state) and
-      result = ""
-      or
-      // the search stops past the last redos candidate state.
-      lengthFromStart(state) <= max(lengthFromStart(any(State s | isReDoSCandidate(s, _)))) and
-      exists(State prev |
-        // select a unique predecessor (by an arbitrary measure)
-        prev =
-          min(State s, Location loc |
-            lengthFromStart(s) = lengthFromStart(state) - 1 and
-            loc = s.getRepr().getLocation() and
-            delta(s, _, state)
-          |
-            s
-            order by
-              loc.getStartLine(), loc.getStartColumn(), loc.getEndLine(), loc.getEndColumn(),
-              s.getRepr().toString()
-          )
-      |
-        // greedy search for the shortest prefix
-        result = prefix(prev) and delta(prev, Epsilon(), state)
-        or
-        not delta(prev, Epsilon(), state) and
-        result = prefix(prev) + getCanonicalEdgeChar(prev, state)
-      )
-    }
-
-    /**
-     * Gets a canonical char for which there exists a transition from `prev` to `next` in the NFA.
-     */
-    private string getCanonicalEdgeChar(State prev, State next) {
-      result =
-        min(string c | delta(prev, any(InputSymbol symbol | c = intersect(Any(), symbol)), next))
-    }
-
-    /** Gets a state within a regular expression that has a pumpable state. */
-    pragma[noinline]
-    State stateInPumpableRegexp() {
-      exists(State s | isReDoSCandidate(s, _) | getRoot(s.getRepr()) = getRoot(result.getRepr()))
-    }
-  }
+  class RelevantState = Prefix::RelevantState;
 
   /**
    * Predicates for testing the presence of a rejecting suffix.
@@ -1018,8 +1033,6 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
    * using epsilon transitions. But any attempt at repeating `w` will end in a state that accepts all suffixes.
    */
   private module SuffixConstruction {
-    import PrefixConstruction
-
     /**
      * Holds if all states reachable from `fork` by repeating `w`
      * are likely rejectable by appending some suffix.
@@ -1035,32 +1048,26 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * This predicate might find impossible suffixes when searching for suffixes of length > 1, which can cause FPs.
      */
     pragma[noinline]
-    private predicate isLikelyRejectable(State s) {
-      s = stateInPumpableRegexp() and
-      (
-        // exists a reject edge with some char.
-        hasRejectEdge(s)
-        or
-        hasEdgeToLikelyRejectable(s)
-        or
-        // stopping here is rejection
-        isRejectState(s)
-      )
+    private predicate isLikelyRejectable(RelevantState s) {
+      // exists a reject edge with some char.
+      hasRejectEdge(s)
+      or
+      hasEdgeToLikelyRejectable(s)
+      or
+      // stopping here is rejection
+      isRejectState(s)
     }
 
     /**
      * Holds if `s` is not an accept state, and there is no epsilon transition to an accept state.
      */
-    predicate isRejectState(State s) {
-      s = stateInPumpableRegexp() and not epsilonSucc*(s) = Accept(_)
-    }
+    predicate isRejectState(RelevantState s) { not epsilonSucc*(s) = Accept(_) }
 
     /**
      * Holds if there is likely a non-empty suffix leading to rejection starting in `s`.
      */
     pragma[noopt]
-    predicate hasEdgeToLikelyRejectable(State s) {
-      s = stateInPumpableRegexp() and
+    predicate hasEdgeToLikelyRejectable(RelevantState s) {
       // all edges (at least one) with some char leads to another state that is rejectable.
       // the `next` states might not share a common suffix, which can cause FPs.
       exists(string char | char = hasEdgeToLikelyRejectableHelper(s) |
@@ -1075,8 +1082,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * and `s` has not been found to be rejectable by `hasRejectEdge` or `isRejectState`.
      */
     pragma[noinline]
-    private string hasEdgeToLikelyRejectableHelper(State s) {
-      s = stateInPumpableRegexp() and
+    private string hasEdgeToLikelyRejectableHelper(RelevantState s) {
       not hasRejectEdge(s) and
       not isRejectState(s) and
       deltaClosedChar(s, result, _)
@@ -1087,9 +1093,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * along epsilon edges, such that there is a transition from
      * `prev` to `next` that the character symbol `char`.
      */
-    predicate deltaClosedChar(State prev, string char, State next) {
-      prev = stateInPumpableRegexp() and
-      next = stateInPumpableRegexp() and
+    predicate deltaClosedChar(RelevantState prev, string char, RelevantState next) {
       deltaClosed(prev, getAnInputSymbolMatchingRelevant(char), next)
     }
 
@@ -1099,18 +1103,28 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
       result = getAnInputSymbolMatching(char)
     }
 
+    pragma[noinline]
+    RegExpRoot relevantRoot() {
+      exists(RegExpTerm term, State s |
+        s.getRepr() = term and isCandidateState(s) and result = term.getRootTerm()
+      )
+    }
+
     /**
      * Gets a char used for finding possible suffixes inside `root`.
      */
     pragma[noinline]
     private string relevant(RegExpRoot root) {
-      exists(ascii(result)) and exists(root)
-      or
-      exists(InputSymbol s | belongsTo(s, root) | result = intersect(s, _))
-      or
-      // The characters from `hasSimpleRejectEdge`. Only `\n` is really needed (as `\n` is not in the `ascii` relation).
-      // The three chars must be kept in sync with `hasSimpleRejectEdge`.
-      result = ["|", "\n", "Z"] and exists(root)
+      root = relevantRoot() and
+      (
+        exists(ascii(result)) and exists(root)
+        or
+        exists(InputSymbol s | belongsTo(s, root) | result = intersect(s, _))
+        or
+        // The characters from `hasSimpleRejectEdge`. Only `\n` is really needed (as `\n` is not in the `ascii` relation).
+        // The three chars must be kept in sync with `hasSimpleRejectEdge`.
+        result = ["|", "\n", "Z"] and exists(root)
+      )
     }
 
     /**
@@ -1208,12 +1222,12 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
   predicate hasReDoSResult(RegExpTerm t, string pump, State s, string prefixMsg) {
     isReDoSAttackable(t, pump, s) and
     (
-      prefixMsg = "starting with '" + escape(PrefixConstruction::prefix(s)) + "' and " and
-      not PrefixConstruction::prefix(s) = ""
+      prefixMsg = "starting with '" + escape(Prefix::prefix(s)) + "' and " and
+      not Prefix::prefix(s) = ""
       or
-      PrefixConstruction::prefix(s) = "" and prefixMsg = ""
+      Prefix::prefix(s) = "" and prefixMsg = ""
       or
-      not exists(PrefixConstruction::prefix(s)) and prefixMsg = ""
+      not exists(Prefix::prefix(s)) and prefixMsg = ""
     )
   }
 
diff --git a/python/ql/src/Exceptions/CatchingBaseException.ql b/python/ql/src/Exceptions/CatchingBaseException.ql
index 828cbf46e4b..5205af33441 100644
--- a/python/ql/src/Exceptions/CatchingBaseException.ql
+++ b/python/ql/src/Exceptions/CatchingBaseException.ql
@@ -13,11 +13,12 @@
  */
 
 import python
+import semmle.python.ApiGraphs
 
 predicate doesnt_reraise(ExceptStmt ex) { ex.getAFlowNode().getBasicBlock().reachesExit() }
 
 predicate catches_base_exception(ExceptStmt ex) {
-  ex.getType().pointsTo(ClassValue::baseException())
+  ex.getType() = API::builtin("BaseException").getAValueReachableFromSource().asExpr()
   or
   not exists(ex.getType())
 }
diff --git a/python/ql/src/Exceptions/EmptyExcept.ql b/python/ql/src/Exceptions/EmptyExcept.ql
index 207ba6dd247..bfd0915a783 100644
--- a/python/ql/src/Exceptions/EmptyExcept.ql
+++ b/python/ql/src/Exceptions/EmptyExcept.ql
@@ -12,6 +12,7 @@
  */
 
 import python
+import semmle.python.ApiGraphs
 
 predicate empty_except(ExceptStmt ex) {
   not exists(Stmt s | s = ex.getAStmt() and not s instanceof Pass)
@@ -28,7 +29,7 @@ predicate no_comment(ExceptStmt ex) {
 }
 
 predicate non_local_control_flow(ExceptStmt ex) {
-  ex.getType().pointsTo(ClassValue::stopIteration())
+  ex.getType() = API::builtin("StopIteration").getAValueReachableFromSource().asExpr()
 }
 
 predicate try_has_normal_exit(Try try) {
@@ -61,27 +62,32 @@ predicate subscript(Stmt s) {
   s.(Delete).getATarget() instanceof Subscript
 }
 
-predicate encode_decode(Call ex, ClassValue type) {
+predicate encode_decode(Call ex, Expr type) {
   exists(string name | ex.getFunc().(Attribute).getName() = name |
-    name = "encode" and type = ClassValue::unicodeEncodeError()
+    name = "encode" and
+    type = API::builtin("UnicodeEncodeError").getAValueReachableFromSource().asExpr()
     or
-    name = "decode" and type = ClassValue::unicodeDecodeError()
+    name = "decode" and
+    type = API::builtin("UnicodeDecodeError").getAValueReachableFromSource().asExpr()
   )
 }
 
-predicate small_handler(ExceptStmt ex, Stmt s, ClassValue type) {
+predicate small_handler(ExceptStmt ex, Stmt s, Expr type) {
   not exists(ex.getTry().getStmt(1)) and
   s = ex.getTry().getStmt(0) and
-  ex.getType().pointsTo(type)
+  ex.getType() = type
 }
 
 predicate focussed_handler(ExceptStmt ex) {
-  exists(Stmt s, ClassValue type | small_handler(ex, s, type) |
-    subscript(s) and type.getASuperType() = ClassValue::lookupError()
+  exists(Stmt s, Expr type | small_handler(ex, s, type) |
+    subscript(s) and
+    type = API::builtin("IndexError").getASubclass*().getAValueReachableFromSource().asExpr()
     or
-    attribute_access(s) and type = ClassValue::attributeError()
+    attribute_access(s) and
+    type = API::builtin("AttributeError").getAValueReachableFromSource().asExpr()
     or
-    s.(ExprStmt).getValue() instanceof Name and type = ClassValue::nameError()
+    s.(ExprStmt).getValue() instanceof Name and
+    type = API::builtin("NameError").getAValueReachableFromSource().asExpr()
     or
     encode_decode(s.(ExprStmt).getValue(), type)
   )
diff --git a/python/ql/src/Exceptions/RaisingTuple.ql b/python/ql/src/Exceptions/RaisingTuple.ql
index abfe785e9cb..9116430ac18 100644
--- a/python/ql/src/Exceptions/RaisingTuple.ql
+++ b/python/ql/src/Exceptions/RaisingTuple.ql
@@ -10,11 +10,14 @@
  */
 
 import python
+import semmle.python.dataflow.new.DataFlow
 
-from Raise r, Value v, AstNode origin
+from Raise r, DataFlow::LocalSourceNode origin
 where
-  r.getException().pointsTo(v, origin) and
-  v.getClass() = ClassValue::tuple() and
+  exists(DataFlow::Node exception | exception.asExpr() = r.getException() |
+    origin.flowsTo(exception)
+  ) and
+  origin.asExpr() instanceof Tuple and
   major_version() = 2
 /* Raising a tuple is a type error in Python 3, so is handled by the IllegalRaise query. */
 select r,
diff --git a/python/ql/src/Exceptions/UnguardedNextInGenerator.ql b/python/ql/src/Exceptions/UnguardedNextInGenerator.ql
index 0ff11dfd5b0..0bd49f2c8c8 100644
--- a/python/ql/src/Exceptions/UnguardedNextInGenerator.ql
+++ b/python/ql/src/Exceptions/UnguardedNextInGenerator.ql
@@ -11,17 +11,22 @@
  */
 
 import python
+private import semmle.python.ApiGraphs
 
-FunctionValue iter() { result = Value::named("iter") }
+API::Node iter() { result = API::builtin("iter") }
 
-BuiltinFunctionValue next() { result = Value::named("next") }
+API::Node next() { result = API::builtin("next") }
+
+API::Node stopIteration() { result = API::builtin("StopIteration") }
 
 predicate call_to_iter(CallNode call, EssaVariable sequence) {
-  sequence.getAUse() = iter().getArgumentForCall(call, 0)
+  call = iter().getACall().asCfgNode() and
+  call.getArg(0) = sequence.getAUse()
 }
 
 predicate call_to_next(CallNode call, ControlFlowNode iter) {
-  iter = next().getArgumentForCall(call, 0)
+  call = next().getACall().asCfgNode() and
+  call.getArg(0) = iter
 }
 
 predicate call_to_next_has_default(CallNode call) {
@@ -47,7 +52,7 @@ predicate iter_not_exhausted(EssaVariable iterator) {
 predicate stop_iteration_handled(CallNode call) {
   exists(Try t |
     t.containsInScope(call.getNode()) and
-    t.getAHandler().getType().pointsTo(ClassValue::stopIteration())
+    t.getAHandler().getType() = stopIteration().getAValueReachableFromSource().asExpr()
   )
 }
 
@@ -61,5 +66,11 @@ where
   ) and
   call.getNode().getScope().(Function).isGenerator() and
   not exists(Comp comp | comp.contains(call.getNode())) and
-  not stop_iteration_handled(call)
+  not stop_iteration_handled(call) and
+  // PEP 479 removes this concern from 3.7 onwards
+  // see: https://peps.python.org/pep-0479/
+  //
+  // However, we do not know the minor version of the analyzed code (only of the extractor),
+  // so we only alert on Python 2.
+  major_version() = 2
 select call, "Call to next() in a generator"
diff --git a/python/ql/src/Functions/ModificationOfParameterWithDefault.ql b/python/ql/src/Functions/ModificationOfParameterWithDefault.ql
index 9ff89d30e3f..e4a50065b41 100644
--- a/python/ql/src/Functions/ModificationOfParameterWithDefault.ql
+++ b/python/ql/src/Functions/ModificationOfParameterWithDefault.ql
@@ -19,5 +19,5 @@ from
   ModificationOfParameterWithDefault::Configuration config, DataFlow::PathNode source,
   DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ flows to here and is mutated.", source.getNode(),
-  "Default value"
+select sink.getNode(), source, sink, "This expression mutates $@.", source.getNode(),
+  "a default value"
diff --git a/python/ql/src/Lexical/CommentedOutCode.ql b/python/ql/src/Lexical/CommentedOutCode.ql
index d40ce95598a..d604e0290bf 100644
--- a/python/ql/src/Lexical/CommentedOutCode.ql
+++ b/python/ql/src/Lexical/CommentedOutCode.ql
@@ -16,4 +16,4 @@ import Lexical.CommentedOutCode
 
 from CommentedOutCodeBlock c
 where not c.maybeExampleCode()
-select c, "These comments appear to contain commented-out code."
+select c, "This comment appears to contain commented-out code."
diff --git a/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll b/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
index 5fa996c97a7..fc2e64fc786 100644
--- a/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
+++ b/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
@@ -65,13 +65,17 @@ private class DefaultSafeExternalApi extends SafeExternalApi {
 
 /** A node representing data being passed to an external API through a call. */
 class ExternalApiDataNode extends DataFlow::Node {
-  DataFlowPrivate::DataFlowCall call;
   DataFlowPrivate::DataFlowCallable callable;
   int i;
 
   ExternalApiDataNode() {
-    exists(call.getLocation().getFile().getRelativePath()) and
-    callable = call.getCallable() and
+    exists(DataFlowPrivate::DataFlowCall call |
+      exists(call.getLocation().getFile().getRelativePath())
+    |
+      callable = call.getCallable() and
+      // TODO: this ignores some complexity of keyword arguments (especially keyword-only args)
+      this = call.getArg(i)
+    ) and
     not any(SafeExternalApi safe).getSafeCallable() = callable and
     exists(Value cv | cv = callable.getCallableValue() |
       cv.isAbsent()
@@ -82,8 +86,6 @@ class ExternalApiDataNode extends DataFlow::Node {
       or
       not exists(cv.(CallableValue).getScope().getLocation().getFile().getRelativePath())
     ) and
-    // TODO: this ignores some complexity of keyword arguments (especially keyword-only args)
-    this = call.getArg(i) and
     // Not already modeled as a taint step
     not exists(DataFlow::Node next | TaintTrackingPrivate::defaultAdditionalTaintStep(this, next)) and
     // for `list.append(x)`, we have a additional taint step from x -> [post] list.
diff --git a/python/ql/src/Security/CWE-022/TarSlip.ql b/python/ql/src/Security/CWE-022/TarSlip.ql
index b2ad6cb3372..241355f1c1b 100644
--- a/python/ql/src/Security/CWE-022/TarSlip.ql
+++ b/python/ql/src/Security/CWE-022/TarSlip.ql
@@ -18,5 +18,5 @@ import DataFlow::PathGraph
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Extraction of tarfile from $@", source.getNode(),
+select sink.getNode(), source, sink, "This file extraction depends on $@", source.getNode(),
   "a potentially untrusted source"
diff --git a/python/ql/src/Security/CWE-078/CommandInjection.ql b/python/ql/src/Security/CWE-078/CommandInjection.ql
index d0f9214e937..8ac08164a8c 100644
--- a/python/ql/src/Security/CWE-078/CommandInjection.ql
+++ b/python/ql/src/Security/CWE-078/CommandInjection.ql
@@ -20,5 +20,5 @@ import DataFlow::PathGraph
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "This command depends on $@.", source.getNode(),
+select sink.getNode(), source, sink, "This command line depends on $@.", source.getNode(),
   "a user-provided value"
diff --git a/python/ql/src/Security/CWE-090/LdapInjection.ql b/python/ql/src/Security/CWE-090/LdapInjection.ql
index 3dc80218583..14ffbb95518 100644
--- a/python/ql/src/Security/CWE-090/LdapInjection.ql
+++ b/python/ql/src/Security/CWE-090/LdapInjection.ql
@@ -23,6 +23,5 @@ where
   or
   any(FilterConfiguration filterConfig).hasFlowPath(source, sink) and
   parameterName = "filter"
-select sink.getNode(), source, sink,
-  "$@ LDAP query parameter (" + parameterName + ") comes from $@.", sink.getNode(), "This",
-  source.getNode(), "a user-provided value"
+select sink.getNode(), source, sink, "$@ depends on $@.", sink.getNode(),
+  "LDAP query parameter (" + parameterName + ")", source.getNode(), "a user-provided value"
diff --git a/python/ql/src/Security/CWE-094/CodeInjection.ql b/python/ql/src/Security/CWE-094/CodeInjection.ql
index d99843fc8a6..c4334d925f4 100644
--- a/python/ql/src/Security/CWE-094/CodeInjection.ql
+++ b/python/ql/src/Security/CWE-094/CodeInjection.ql
@@ -20,5 +20,5 @@ import DataFlow::PathGraph
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ flows to here and is interpreted as code.",
-  source.getNode(), "A user-provided value"
+select sink.getNode(), source, sink, "This code execution depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/python/ql/src/Security/CWE-117/LogInjection.ql b/python/ql/src/Security/CWE-117/LogInjection.ql
index 46ceb893e86..045d8300e0c 100644
--- a/python/ql/src/Security/CWE-117/LogInjection.ql
+++ b/python/ql/src/Security/CWE-117/LogInjection.ql
@@ -17,5 +17,5 @@ import DataFlow::PathGraph
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ flows to log entry.", source.getNode(),
-  "User-provided value"
+select sink.getNode(), source, sink, "This log entry depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/python/ql/src/Security/CWE-209/StackTraceExposure.ql b/python/ql/src/Security/CWE-209/StackTraceExposure.ql
index 317d58f0371..7b8cf74c597 100644
--- a/python/ql/src/Security/CWE-209/StackTraceExposure.ql
+++ b/python/ql/src/Security/CWE-209/StackTraceExposure.ql
@@ -19,5 +19,6 @@ import DataFlow::PathGraph
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "$@ may be exposed to an external user", source.getNode(),
-  "Error information"
+select sink.getNode(), source, sink,
+  "$@ flows to this location and may be exposed to an external user.", source.getNode(),
+  "Stack trace information"
diff --git a/python/ql/src/Security/CWE-295/RequestWithoutValidation.ql b/python/ql/src/Security/CWE-295/RequestWithoutValidation.ql
index 85df934ed97..125957e59b6 100644
--- a/python/ql/src/Security/CWE-295/RequestWithoutValidation.ql
+++ b/python/ql/src/Security/CWE-295/RequestWithoutValidation.ql
@@ -13,10 +13,9 @@
 import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.Concepts
-private import semmle.python.ApiGraphs
 
 from
-  HTTP::Client::Request request, DataFlow::Node disablingNode, DataFlow::Node origin, string ending
+  Http::Client::Request request, DataFlow::Node disablingNode, DataFlow::Node origin, string ending
 where
   request.disablesCertificateValidation(disablingNode, origin) and
   // Showing the origin is only useful when it's a different node than the one disabling
diff --git a/python/ql/src/Security/CWE-352/CSRFProtectionDisabled.ql b/python/ql/src/Security/CWE-352/CSRFProtectionDisabled.ql
index 36a4e315ffc..75b161b9e5b 100644
--- a/python/ql/src/Security/CWE-352/CSRFProtectionDisabled.ql
+++ b/python/ql/src/Security/CWE-352/CSRFProtectionDisabled.ql
@@ -14,24 +14,24 @@
 import python
 import semmle.python.Concepts
 
-predicate relevantSetting(HTTP::Server::CsrfProtectionSetting s) {
+predicate relevantSetting(Http::Server::CsrfProtectionSetting s) {
   // rule out test code as this is a common place to turn off CSRF protection.
   // We don't use normal `TestScope` to find test files, since we also want to match
   // a settings file such as `.../integration-tests/settings.py`
   not s.getLocation().getFile().getAbsolutePath().matches("%test%")
 }
 
-predicate vulnerableSetting(HTTP::Server::CsrfProtectionSetting s) {
+predicate vulnerableSetting(Http::Server::CsrfProtectionSetting s) {
   s.getVerificationSetting() = false and
-  not exists(HTTP::Server::CsrfLocalProtectionSetting p | p.csrfEnabled()) and
+  not exists(Http::Server::CsrfLocalProtectionSetting p | p.csrfEnabled()) and
   relevantSetting(s)
 }
 
-from HTTP::Server::CsrfProtectionSetting setting
+from Http::Server::CsrfProtectionSetting setting
 where
   vulnerableSetting(setting) and
   // We have seen examples of dummy projects with vulnerable settings alongside a main
   // project with a protecting settings file. We want to rule out this scenario, so we
   // require all non-test settings to be vulnerable.
-  forall(HTTP::Server::CsrfProtectionSetting s | relevantSetting(s) | vulnerableSetting(s))
+  forall(Http::Server::CsrfProtectionSetting s | relevantSetting(s) | vulnerableSetting(s))
 select setting, "Potential CSRF vulnerability due to forgery protection being disabled or weakened."
diff --git a/python/ql/src/Security/CWE-502/UnsafeDeserialization.ql b/python/ql/src/Security/CWE-502/UnsafeDeserialization.ql
index 86275621156..545c54890bf 100644
--- a/python/ql/src/Security/CWE-502/UnsafeDeserialization.ql
+++ b/python/ql/src/Security/CWE-502/UnsafeDeserialization.ql
@@ -18,4 +18,5 @@ import DataFlow::PathGraph
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Deserializing of $@.", source.getNode(), "untrusted input"
+select sink.getNode(), source, sink, "Unsafe deserialization depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/python/ql/src/Security/CWE-601/UrlRedirect.ql b/python/ql/src/Security/CWE-601/UrlRedirect.ql
index f0388e05556..98110eaf5d8 100644
--- a/python/ql/src/Security/CWE-601/UrlRedirect.ql
+++ b/python/ql/src/Security/CWE-601/UrlRedirect.ql
@@ -18,5 +18,5 @@ import DataFlow::PathGraph
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.", source.getNode(),
-  "A user-provided value"
+select sink.getNode(), source, sink, "Untrusted URL redirection depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/python/ql/src/Security/CWE-611/Xxe.ql b/python/ql/src/Security/CWE-611/Xxe.ql
index 5cc6da25467..9bb705efc33 100644
--- a/python/ql/src/Security/CWE-611/Xxe.ql
+++ b/python/ql/src/Security/CWE-611/Xxe.ql
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
-  "A $@ is parsed as XML without guarding against external entity expansion.", source.getNode(),
-  "user-provided value"
+  "XML parsing depends on $@ without guarding against external entity expansion.", source.getNode(),
+  "a user-provided value"
diff --git a/python/ql/src/Security/CWE-643/XpathInjection.ql b/python/ql/src/Security/CWE-643/XpathInjection.ql
index 5363542278b..9056fe43a05 100644
--- a/python/ql/src/Security/CWE-643/XpathInjection.ql
+++ b/python/ql/src/Security/CWE-643/XpathInjection.ql
@@ -17,4 +17,5 @@ import DataFlow::PathGraph
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink, source, sink, "This Xpath query depends on $@.", source, "a user-provided value"
+select sink.getNode(), source, sink, "XPath expression depends on $@.", source.getNode(),
+  "a user-provided value"
diff --git a/python/ql/src/Security/CWE-730/PolynomialReDoS.ql b/python/ql/src/Security/CWE-730/PolynomialReDoS.ql
index 8ae99513f7b..278b7369a38 100644
--- a/python/ql/src/Security/CWE-730/PolynomialReDoS.ql
+++ b/python/ql/src/Security/CWE-730/PolynomialReDoS.ql
@@ -4,6 +4,7 @@
  *              to match may be vulnerable to denial-of-service attacks.
  * @kind path-problem
  * @problem.severity warning
+ * @security-severity 7.5
  * @precision high
  * @id py/polynomial-redos
  * @tags security
diff --git a/python/ql/src/Security/CWE-730/ReDoS.ql b/python/ql/src/Security/CWE-730/ReDoS.ql
index b87f6b3d8f4..0e66d3cdb79 100644
--- a/python/ql/src/Security/CWE-730/ReDoS.ql
+++ b/python/ql/src/Security/CWE-730/ReDoS.ql
@@ -5,6 +5,7 @@
  *              attacks.
  * @kind problem
  * @problem.severity error
+ * @security-severity 7.5
  * @precision high
  * @id py/redos
  * @tags security
diff --git a/python/ql/src/Security/CWE-730/RegexInjection.ql b/python/ql/src/Security/CWE-730/RegexInjection.ql
index d9191c9ded5..571cac2bdd8 100644
--- a/python/ql/src/Security/CWE-730/RegexInjection.ql
+++ b/python/ql/src/Security/CWE-730/RegexInjection.ql
@@ -5,6 +5,7 @@
  *              exponential time on certain inputs.
  * @kind path-problem
  * @problem.severity error
+ * @security-severity 7.5
  * @precision high
  * @id py/regex-injection
  * @tags security
@@ -23,6 +24,6 @@ from
 where
   config.hasFlowPath(source, sink) and
   regexExecution = sink.getNode().(Sink).getRegexExecution()
-select sink.getNode(), source, sink,
-  "$@ regular expression is constructed from a $@ and executed by $@.", sink.getNode(), "This",
-  source.getNode(), "user-provided value", regexExecution, regexExecution.getName()
+select sink.getNode(), source, sink, "$@ depends on $@ and executed by $@.", sink.getNode(),
+  "This regular expression", source.getNode(), "a user-provided value", regexExecution,
+  regexExecution.getName()
diff --git a/python/ql/src/Security/CWE-776/XmlBomb.ql b/python/ql/src/Security/CWE-776/XmlBomb.ql
index 54d483db17e..1dde46e651c 100644
--- a/python/ql/src/Security/CWE-776/XmlBomb.ql
+++ b/python/ql/src/Security/CWE-776/XmlBomb.ql
@@ -19,5 +19,5 @@ import DataFlow::PathGraph
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink,
-  "A $@ is parsed as XML without guarding against uncontrolled entity expansion.", source.getNode(),
-  "user-provided value"
+  "XML parsing depends on $@ without guarding against uncontrolled entity expansion.",
+  source.getNode(), "a user-provided value"
diff --git a/python/ql/src/Security/CWE-918/FullServerSideRequestForgery.ql b/python/ql/src/Security/CWE-918/FullServerSideRequestForgery.ql
index d7ad6465f77..37334fea87c 100644
--- a/python/ql/src/Security/CWE-918/FullServerSideRequestForgery.ql
+++ b/python/ql/src/Security/CWE-918/FullServerSideRequestForgery.ql
@@ -16,7 +16,7 @@ import DataFlow::PathGraph
 
 from
   FullServerSideRequestForgeryConfiguration fullConfig, DataFlow::PathNode source,
-  DataFlow::PathNode sink, HTTP::Client::Request request
+  DataFlow::PathNode sink, Http::Client::Request request
 where
   request = sink.getNode().(Sink).getRequest() and
   fullConfig.hasFlowPath(source, sink) and
diff --git a/python/ql/src/Security/CWE-918/PartialServerSideRequestForgery.ql b/python/ql/src/Security/CWE-918/PartialServerSideRequestForgery.ql
index 6c28f921020..8f8d72c7d65 100644
--- a/python/ql/src/Security/CWE-918/PartialServerSideRequestForgery.ql
+++ b/python/ql/src/Security/CWE-918/PartialServerSideRequestForgery.ql
@@ -16,7 +16,7 @@ import DataFlow::PathGraph
 
 from
   PartialServerSideRequestForgeryConfiguration partialConfig, DataFlow::PathNode source,
-  DataFlow::PathNode sink, HTTP::Client::Request request
+  DataFlow::PathNode sink, Http::Client::Request request
 where
   request = sink.getNode().(Sink).getRequest() and
   partialConfig.hasFlowPath(source, sink) and
diff --git a/python/ql/src/Statements/UnreachableCode.ql b/python/ql/src/Statements/UnreachableCode.ql
index 04e9f79c415..47426af2c34 100644
--- a/python/ql/src/Statements/UnreachableCode.ql
+++ b/python/ql/src/Statements/UnreachableCode.ql
@@ -61,4 +61,4 @@ predicate reportable_unreachable(Stmt s) {
 
 from Stmt s
 where reportable_unreachable(s)
-select s, "Unreachable statement."
+select s, "This statement is unreachable."
diff --git a/python/ql/src/Variables/UnusedLocalVariable.ql b/python/ql/src/Variables/UnusedLocalVariable.ql
index e52c7fccaff..2202359fa0b 100644
--- a/python/ql/src/Variables/UnusedLocalVariable.ql
+++ b/python/ql/src/Variables/UnusedLocalVariable.ql
@@ -43,4 +43,4 @@ where
   unused_local(unused, v) and
   // If unused is part of a tuple, count it as unused if all elements of that tuple are unused.
   forall(Name el | el = unused.getParentNode().(Tuple).getAnElt() | unused_local(el, _))
-select unused, "The value assigned to local variable '" + v.getId() + "' is never used."
+select unused, "Variable " + v.getId() + " is not used"
diff --git a/python/ql/src/change-notes/2022-08-23-alert-messages.md b/python/ql/src/change-notes/2022-08-23-alert-messages.md
new file mode 100644
index 00000000000..22f4c5c6682
--- /dev/null
+++ b/python/ql/src/change-notes/2022-08-23-alert-messages.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The alert message of many queries have been changed to make the message consistent with other languages.
\ No newline at end of file
diff --git a/python/ql/src/change-notes/2022-08-29-missing-security-severity.md b/python/ql/src/change-notes/2022-08-29-missing-security-severity.md
new file mode 100644
index 00000000000..9c95f67e66b
--- /dev/null
+++ b/python/ql/src/change-notes/2022-08-29-missing-security-severity.md
@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Added the `security-severity` tag the `py/redos`, `py/polynomial-redos`, and `py/regex-injection` queries.
\ No newline at end of file
diff --git a/python/ql/src/experimental/semmle/python/Concepts.qll b/python/ql/src/experimental/semmle/python/Concepts.qll
index 6729bed0097..16aa54ccea5 100644
--- a/python/ql/src/experimental/semmle/python/Concepts.qll
+++ b/python/ql/src/experimental/semmle/python/Concepts.qll
@@ -416,7 +416,7 @@ class CsvWriter extends DataFlow::Node {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `Cookie::Range` instead.
  */
-class Cookie extends HTTP::Server::CookieWrite instanceof Cookie::Range {
+class Cookie extends Http::Server::CookieWrite instanceof Cookie::Range {
   /**
    * Holds if this cookie is secure.
    */
@@ -441,7 +441,7 @@ module Cookie {
    * Extend this class to model new APIs. If you want to refine existing API models,
    * extend `Cookie` instead.
    */
-  abstract class Range extends HTTP::Server::CookieWrite::Range {
+  abstract class Range extends Http::Server::CookieWrite::Range {
     /**
      * Holds if this cookie is secure.
      */
diff --git a/python/ql/src/experimental/semmle/python/frameworks/Django.qll b/python/ql/src/experimental/semmle/python/frameworks/Django.qll
index f1895af0ea9..d9822014466 100644
--- a/python/ql/src/experimental/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/experimental/semmle/python/frameworks/Django.qll
@@ -15,18 +15,21 @@ private module ExperimentalPrivateDjango {
   private module DjangoMod {
     API::Node http() { result = API::moduleImport("django").getMember("http") }
 
-    module Http {
+    module DjangoHttp {
       API::Node response() { result = http().getMember("response") }
 
       API::Node request() { result = http().getMember("request") }
 
       module Request {
         module HttpRequest {
-          class DjangoGETParameter extends DataFlow::Node, RemoteFlowSource::Range {
-            DjangoGETParameter() { this = request().getMember("GET").getMember("get").getACall() }
+          class DjangoGetParameter extends DataFlow::Node, RemoteFlowSource::Range {
+            DjangoGetParameter() { this = request().getMember("GET").getMember("get").getACall() }
 
             override string getSourceType() { result = "django.http.request.GET.get" }
           }
+
+          /** DEPRECATED: Alias for DjangoGetParameter */
+          deprecated class DjangoGETParameter = DjangoGetParameter;
         }
       }
 
@@ -51,7 +54,7 @@ private module ExperimentalPrivateDjango {
            *
            * Use the predicate `HttpResponse::instance()` to get references to instances of `django.http.response.HttpResponse`.
            */
-          abstract class InstanceSource extends HTTP::Server::HttpResponse::Range, DataFlow::Node {
+          abstract class InstanceSource extends Http::Server::HttpResponse::Range, DataFlow::Node {
           }
 
           /** A direct instantiation of `django.http.response.HttpResponse`. */
@@ -153,7 +156,7 @@ private module ExperimentalPrivateDjango {
            */
           class DjangoResponseSetCookieCall extends DataFlow::MethodCallNode, Cookie::Range {
             DjangoResponseSetCookieCall() {
-              this.calls(PrivateDjango::DjangoImpl::Http::Response::HttpResponse::instance(),
+              this.calls(PrivateDjango::DjangoImpl::DjangoHttp::Response::HttpResponse::instance(),
                 "set_cookie")
             }
 
diff --git a/python/ql/src/experimental/semmle/python/frameworks/LDAP.qll b/python/ql/src/experimental/semmle/python/frameworks/LDAP.qll
index 6ba16ae4a4e..d95149bfc50 100644
--- a/python/ql/src/experimental/semmle/python/frameworks/LDAP.qll
+++ b/python/ql/src/experimental/semmle/python/frameworks/LDAP.qll
@@ -126,9 +126,9 @@ private module Ldap {
           (
             // ldap_connection.start_tls_s()
             // see https://www.python-ldap.org/en/python-ldap-3.3.0/reference/ldap.html#ldap.LDAPObject.start_tls_s
-            exists(DataFlow::MethodCallNode startTLS |
-              startTLS.getObject().getALocalSource() = initialize and
-              startTLS.getMethodName() = "start_tls_s"
+            exists(DataFlow::MethodCallNode startTls |
+              startTls.getObject().getALocalSource() = initialize and
+              startTls.getMethodName() = "start_tls_s"
             )
             or
             // ldap_connection.set_option(ldap.OPT_X_TLS_%s, True)
@@ -234,9 +234,9 @@ private module Ldap {
         or
         // ldap_connection.start_tls_s()
         // see https://www.python-ldap.org/en/python-ldap-3.3.0/reference/ldap.html#ldap.LDAPObject.start_tls_s
-        exists(DataFlow::MethodCallNode startTLS |
-          startTLS.getMethodName() = "start_tls_s" and
-          startTLS.getObject().getALocalSource() = this
+        exists(DataFlow::MethodCallNode startTls |
+          startTls.getMethodName() = "start_tls_s" and
+          startTls.getObject().getALocalSource() = this
         )
       }
 
diff --git a/python/ql/src/experimental/semmle/python/libraries/SmtpLib.qll b/python/ql/src/experimental/semmle/python/libraries/SmtpLib.qll
index 8d69bcb1a62..3eeca7a560c 100644
--- a/python/ql/src/experimental/semmle/python/libraries/SmtpLib.qll
+++ b/python/ql/src/experimental/semmle/python/libraries/SmtpLib.qll
@@ -31,8 +31,8 @@ module SmtpLib {
    * argument. Used because of the impossibility to get local source nodes from `_subparts`'
    * `(List|Tuple)` elements.
    */
-  private class SMTPMessageConfig extends TaintTracking2::Configuration {
-    SMTPMessageConfig() { this = "SMTPMessageConfig" }
+  private class SmtpMessageConfig extends TaintTracking2::Configuration {
+    SmtpMessageConfig() { this = "SMTPMessageConfig" }
 
     override predicate isSource(DataFlow::Node source) { source = mimeText(_) }
 
@@ -87,7 +87,7 @@ module SmtpLib {
         sink =
           [sendCall.getArg(2), sendCall.getArg(2).(DataFlow::MethodCallNode).getObject()]
               .getALocalSource() and
-        any(SMTPMessageConfig a)
+        any(SmtpMessageConfig a)
             .hasFlow(source, sink.(DataFlow::CallCfgNode).getArgByName("_subparts"))
         or
         // via .attach()
@@ -117,7 +117,7 @@ module SmtpLib {
    * * `sub` would be `message["Subject"]` (`Subscript`)
    * * `result` would be `"multipart test"`
    */
-  private DataFlow::Node getSMTPSubscriptByIndex(DataFlow::CallCfgNode sendCall, string index) {
+  private DataFlow::Node getSmtpSubscriptByIndex(DataFlow::CallCfgNode sendCall, string index) {
     exists(DefinitionNode def, Subscript sub |
       sub = def.getNode() and
       DataFlow::exprNode(sub.getObject()).getALocalSource() =
@@ -163,15 +163,15 @@ module SmtpLib {
     override DataFlow::Node getHtmlBody() { result = getSmtpMessage(this, "html") }
 
     override DataFlow::Node getTo() {
-      result in [this.getArg(1), getSMTPSubscriptByIndex(this, "To")]
+      result in [this.getArg(1), getSmtpSubscriptByIndex(this, "To")]
     }
 
     override DataFlow::Node getFrom() {
-      result in [this.getArg(0), getSMTPSubscriptByIndex(this, "From")]
+      result in [this.getArg(0), getSmtpSubscriptByIndex(this, "From")]
     }
 
     override DataFlow::Node getSubject() {
-      result in [this.getArg(2), getSMTPSubscriptByIndex(this, "Subject")]
+      result in [this.getArg(2), getSmtpSubscriptByIndex(this, "Subject")]
     }
   }
 }
diff --git a/python/ql/src/meta/alerts/RequestHandlers.ql b/python/ql/src/meta/alerts/RequestHandlers.ql
index 2f79a3f1b35..3f2eae0d06b 100644
--- a/python/ql/src/meta/alerts/RequestHandlers.ql
+++ b/python/ql/src/meta/alerts/RequestHandlers.ql
@@ -13,7 +13,7 @@ private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.Concepts
 private import meta.MetaMetrics
 
-from HTTP::Server::RequestHandler requestHandler, string title
+from Http::Server::RequestHandler requestHandler, string title
 where
   not requestHandler.getLocation().getFile() instanceof IgnoredFile and
   if requestHandler.isMethod()
diff --git a/python/ql/test/query-tests/Exceptions/generators/UnguardedNextInGenerator.expected b/python/ql/test/2/query-tests/Exceptions/generators/UnguardedNextInGenerator.expected
similarity index 100%
rename from python/ql/test/query-tests/Exceptions/generators/UnguardedNextInGenerator.expected
rename to python/ql/test/2/query-tests/Exceptions/generators/UnguardedNextInGenerator.expected
diff --git a/python/ql/test/query-tests/Exceptions/generators/UnguardedNextInGenerator.qlref b/python/ql/test/2/query-tests/Exceptions/generators/UnguardedNextInGenerator.qlref
similarity index 100%
rename from python/ql/test/query-tests/Exceptions/generators/UnguardedNextInGenerator.qlref
rename to python/ql/test/2/query-tests/Exceptions/generators/UnguardedNextInGenerator.qlref
diff --git a/python/ql/test/query-tests/Exceptions/generators/test.py b/python/ql/test/2/query-tests/Exceptions/generators/test.py
similarity index 100%
rename from python/ql/test/query-tests/Exceptions/generators/test.py
rename to python/ql/test/2/query-tests/Exceptions/generators/test.py
diff --git a/python/ql/test/2/query-tests/Exceptions/raising/RaisingTuple.expected b/python/ql/test/2/query-tests/Exceptions/raising/RaisingTuple.expected
index f95dd5defde..7200c147ea9 100644
--- a/python/ql/test/2/query-tests/Exceptions/raising/RaisingTuple.expected
+++ b/python/ql/test/2/query-tests/Exceptions/raising/RaisingTuple.expected
@@ -1,3 +1,3 @@
-| test.py:8:5:8:12 | Raise | Raising $@ will result in the first element (recursively) being raised and all other elements being discarded. | test.py:7:10:7:29 | Tuple | a tuple |
-| test.py:11:5:11:32 | Raise | Raising $@ will result in the first element (recursively) being raised and all other elements being discarded. | test.py:11:12:11:31 | Tuple | a tuple |
-| test.py:15:5:15:23 | Raise | Raising $@ will result in the first element (recursively) being raised and all other elements being discarded. | test.py:14:10:14:19 | Tuple | a tuple |
+| test.py:8:5:8:12 | Raise | Raising $@ will result in the first element (recursively) being raised and all other elements being discarded. | test.py:7:10:7:29 | ControlFlowNode for Tuple | a tuple |
+| test.py:11:5:11:32 | Raise | Raising $@ will result in the first element (recursively) being raised and all other elements being discarded. | test.py:11:12:11:31 | ControlFlowNode for Tuple | a tuple |
+| test.py:15:5:15:23 | Raise | Raising $@ will result in the first element (recursively) being raised and all other elements being discarded. | test.py:14:10:14:19 | ControlFlowNode for Tuple | a tuple |
diff --git a/python/ql/test/experimental/dataflow/TestUtil/NormalDataflowTest.qll b/python/ql/test/experimental/dataflow/TestUtil/NormalDataflowTest.qll
index 5f19564c028..b0f0009b30d 100644
--- a/python/ql/test/experimental/dataflow/TestUtil/NormalDataflowTest.qll
+++ b/python/ql/test/experimental/dataflow/TestUtil/NormalDataflowTest.qll
@@ -13,7 +13,7 @@ class DataFlowTest extends FlowTest {
   }
 }
 
-query predicate missingAnnotationOnSINK(Location location, string error, string element) {
+query predicate missingAnnotationOnSink(Location location, string error, string element) {
   error = "ERROR, you should add `# $ MISSING: flow` annotation" and
   exists(DataFlow::Node sink |
     exists(DataFlow::CallCfgNode call |
@@ -31,3 +31,6 @@ query predicate missingAnnotationOnSINK(Location location, string error, string
     )
   )
 }
+
+/** DEPRECATED: Alias for missingAnnotationOnSink */
+deprecated predicate missingAnnotationOnSINK = missingAnnotationOnSink/3;
diff --git a/python/ql/test/experimental/dataflow/TestUtil/NormalTaintTrackingTest.qll b/python/ql/test/experimental/dataflow/TestUtil/NormalTaintTrackingTest.qll
new file mode 100644
index 00000000000..9619679da03
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/TestUtil/NormalTaintTrackingTest.qll
@@ -0,0 +1,33 @@
+import python
+import experimental.dataflow.TestUtil.FlowTest
+import experimental.dataflow.testTaintConfig
+private import semmle.python.dataflow.new.internal.PrintNode
+
+class DataFlowTest extends FlowTest {
+  DataFlowTest() { this = "DataFlowTest" }
+
+  override string flowTag() { result = "flow" }
+
+  override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(TestConfiguration cfg | cfg.hasFlow(source, sink))
+  }
+}
+
+query predicate missingAnnotationOnSink(Location location, string error, string element) {
+  error = "ERROR, you should add `# $ MISSING: flow` annotation" and
+  exists(DataFlow::Node sink |
+    exists(DataFlow::CallCfgNode call |
+      // note: we only care about `SINK` and not `SINK_F`, so we have to reconstruct manually.
+      call.getFunction().asCfgNode().(NameNode).getId() = "SINK" and
+      (sink = call.getArg(_) or sink = call.getArgByName(_))
+    ) and
+    location = sink.getLocation() and
+    element = prettyExpr(sink.asExpr()) and
+    not any(TestConfiguration config).hasFlow(_, sink) and
+    not exists(FalseNegativeExpectation missingResult |
+      missingResult.getTag() = "flow" and
+      missingResult.getLocation().getFile() = location.getFile() and
+      missingResult.getLocation().getStartLine() = location.getStartLine()
+    )
+  )
+}
diff --git a/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll b/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
index 311b87a61c2..e96922bc25e 100644
--- a/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
+++ b/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
@@ -2,6 +2,7 @@ import python
 import semmle.python.dataflow.new.DataFlow
 import TestUtilities.InlineExpectationsTest
 private import semmle.python.dataflow.new.internal.PrintNode
+private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
 
 /**
  * A routing test is designed to test that values are routed to the
diff --git a/python/ql/test/experimental/dataflow/TestUtil/UnresolvedCalls.qll b/python/ql/test/experimental/dataflow/TestUtil/UnresolvedCalls.qll
index eaf480ec664..ea123e9ca45 100644
--- a/python/ql/test/experimental/dataflow/TestUtil/UnresolvedCalls.qll
+++ b/python/ql/test/experimental/dataflow/TestUtil/UnresolvedCalls.qll
@@ -12,7 +12,13 @@ class UnresolvedCallExpectations extends InlineExpectationsTest {
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(location.getFile().getRelativePath()) and
     exists(CallNode call |
-      not exists(DataFlowPrivate::DataFlowCall dfc | dfc.getNode() = call) and
+      not exists(DataFlowPrivate::DataFlowCall dfc | dfc.getNode() = call |
+        // For every `CallNode`, there is a `DataFlowCall` in the form of a `NormalCall`.
+        // It does not really count, as it has some abstract overrides. For instance, it does not
+        // define `getCallable`, so checking for the existence of this guarantees that we are in a
+        // properly resolved call.
+        exists(dfc.getCallable())
+      ) and
       not call = API::builtin(_).getACall().asCfgNode() and
       location = call.getLocation() and
       tag = "unresolved_call" and
diff --git a/python/ql/test/experimental/dataflow/basic/callGraphSinks.expected b/python/ql/test/experimental/dataflow/basic/callGraphSinks.expected
index 17f3028ae23..01ae02a1ad0 100644
--- a/python/ql/test/experimental/dataflow/basic/callGraphSinks.expected
+++ b/python/ql/test/experimental/dataflow/basic/callGraphSinks.expected
@@ -1,2 +1,3 @@
+| file://:0:0:0:0 | parameter 0 of builtins.reversed |
 | test.py:1:19:1:19 | ControlFlowNode for x |
 | test.py:7:5:7:20 | ControlFlowNode for obfuscated_id() |
diff --git a/python/ql/test/experimental/dataflow/basic/callGraphSources.expected b/python/ql/test/experimental/dataflow/basic/callGraphSources.expected
index 4023ba8f3ea..0b4613c42de 100644
--- a/python/ql/test/experimental/dataflow/basic/callGraphSources.expected
+++ b/python/ql/test/experimental/dataflow/basic/callGraphSources.expected
@@ -1,2 +1,3 @@
+| file://:0:0:0:0 | [summary] to write: return (return) in builtins.reversed |
 | test.py:4:10:4:10 | ControlFlowNode for z |
 | test.py:7:19:7:19 | ControlFlowNode for a |
diff --git a/python/ql/test/experimental/dataflow/basic/global.expected b/python/ql/test/experimental/dataflow/basic/global.expected
index 8894bcc190a..885d61309d4 100644
--- a/python/ql/test/experimental/dataflow/basic/global.expected
+++ b/python/ql/test/experimental/dataflow/basic/global.expected
@@ -1,3 +1,4 @@
+| file://:0:0:0:0 | [summary] read: argument 0.List element in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
 | test.py:1:1:1:21 | ControlFlowNode for FunctionExpr | test.py:1:5:1:17 | GSSA Variable obfuscated_id |
 | test.py:1:1:1:21 | ControlFlowNode for FunctionExpr | test.py:7:5:7:17 | ControlFlowNode for obfuscated_id |
 | test.py:1:5:1:17 | GSSA Variable obfuscated_id | test.py:7:5:7:17 | ControlFlowNode for obfuscated_id |
diff --git a/python/ql/test/experimental/dataflow/basic/globalStep.expected b/python/ql/test/experimental/dataflow/basic/globalStep.expected
index 9f228998b9c..38611776824 100644
--- a/python/ql/test/experimental/dataflow/basic/globalStep.expected
+++ b/python/ql/test/experimental/dataflow/basic/globalStep.expected
@@ -1,3 +1,4 @@
+| file://:0:0:0:0 | [summary] read: argument 0.List element in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
 | test.py:1:1:1:21 | ControlFlowNode for FunctionExpr | test.py:1:5:1:17 | GSSA Variable obfuscated_id |
 | test.py:1:1:1:21 | ControlFlowNode for FunctionExpr | test.py:1:5:1:17 | GSSA Variable obfuscated_id |
 | test.py:1:1:1:21 | ControlFlowNode for FunctionExpr | test.py:7:5:7:17 | ControlFlowNode for obfuscated_id |
diff --git a/python/ql/test/experimental/dataflow/basic/local.expected b/python/ql/test/experimental/dataflow/basic/local.expected
index c02b341eeae..33636a8e81d 100644
--- a/python/ql/test/experimental/dataflow/basic/local.expected
+++ b/python/ql/test/experimental/dataflow/basic/local.expected
@@ -1,3 +1,8 @@
+| file://:0:0:0:0 | [summary] read: argument 0.List element in builtins.reversed | file://:0:0:0:0 | [summary] read: argument 0.List element in builtins.reversed |
+| file://:0:0:0:0 | [summary] read: argument 0.List element in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
+| file://:0:0:0:0 | [summary] to write: return (return) in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return) in builtins.reversed |
+| file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
+| file://:0:0:0:0 | parameter 0 of builtins.reversed | file://:0:0:0:0 | parameter 0 of builtins.reversed |
 | test.py:0:0:0:0 | GSSA Variable __name__ | test.py:0:0:0:0 | GSSA Variable __name__ |
 | test.py:0:0:0:0 | GSSA Variable __package__ | test.py:0:0:0:0 | GSSA Variable __package__ |
 | test.py:0:0:0:0 | GSSA Variable b | test.py:0:0:0:0 | GSSA Variable b |
diff --git a/python/ql/test/experimental/dataflow/basic/localStep.expected b/python/ql/test/experimental/dataflow/basic/localStep.expected
index e147bb9f4fc..900e4ac3900 100644
--- a/python/ql/test/experimental/dataflow/basic/localStep.expected
+++ b/python/ql/test/experimental/dataflow/basic/localStep.expected
@@ -1,3 +1,4 @@
+| file://:0:0:0:0 | [summary] read: argument 0.List element in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
 | test.py:1:1:1:21 | ControlFlowNode for FunctionExpr | test.py:1:5:1:17 | GSSA Variable obfuscated_id |
 | test.py:1:5:1:17 | GSSA Variable obfuscated_id | test.py:7:5:7:17 | ControlFlowNode for obfuscated_id |
 | test.py:1:19:1:19 | ControlFlowNode for x | test.py:1:19:1:19 | SSA variable x |
diff --git a/python/ql/test/experimental/dataflow/basic/sinks.expected b/python/ql/test/experimental/dataflow/basic/sinks.expected
index bfebc2ef31e..3aa3245c465 100644
--- a/python/ql/test/experimental/dataflow/basic/sinks.expected
+++ b/python/ql/test/experimental/dataflow/basic/sinks.expected
@@ -1,3 +1,7 @@
+| file://:0:0:0:0 | [summary] read: argument 0.List element in builtins.reversed |
+| file://:0:0:0:0 | [summary] to write: return (return) in builtins.reversed |
+| file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
+| file://:0:0:0:0 | parameter 0 of builtins.reversed |
 | test.py:0:0:0:0 | GSSA Variable __name__ |
 | test.py:0:0:0:0 | GSSA Variable __package__ |
 | test.py:0:0:0:0 | GSSA Variable b |
diff --git a/python/ql/test/experimental/dataflow/basic/sources.expected b/python/ql/test/experimental/dataflow/basic/sources.expected
index bfebc2ef31e..3aa3245c465 100644
--- a/python/ql/test/experimental/dataflow/basic/sources.expected
+++ b/python/ql/test/experimental/dataflow/basic/sources.expected
@@ -1,3 +1,7 @@
+| file://:0:0:0:0 | [summary] read: argument 0.List element in builtins.reversed |
+| file://:0:0:0:0 | [summary] to write: return (return) in builtins.reversed |
+| file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
+| file://:0:0:0:0 | parameter 0 of builtins.reversed |
 | test.py:0:0:0:0 | GSSA Variable __name__ |
 | test.py:0:0:0:0 | GSSA Variable __package__ |
 | test.py:0:0:0:0 | GSSA Variable b |
diff --git a/python/ql/test/experimental/dataflow/calls/test.py b/python/ql/test/experimental/dataflow/calls/test.py
index 8a617ded45b..144a6a79fe1 100644
--- a/python/ql/test/experimental/dataflow/calls/test.py
+++ b/python/ql/test/experimental/dataflow/calls/test.py
@@ -31,7 +31,7 @@ try:
     # `mypkg.foo` is a `missing module variable`, but `mypkg.subpkg.bar` is compeltely
     # ignored.
     import mypkg
-    mypkg.foo(42)
-    mypkg.subpkg.bar(43)
+    mypkg.foo(42) # $ call=mypkg.foo(..) qlclass=NormalCall
+    mypkg.subpkg.bar(43) # $ call=mypkg.subpkg.bar(..) qlclass=LibraryCall arg_0=43
 except:
     pass
diff --git a/python/ql/test/experimental/dataflow/coverage/NormalDataflowTest.expected b/python/ql/test/experimental/dataflow/coverage/NormalDataflowTest.expected
index dd7fb126526..3875da4e143 100644
--- a/python/ql/test/experimental/dataflow/coverage/NormalDataflowTest.expected
+++ b/python/ql/test/experimental/dataflow/coverage/NormalDataflowTest.expected
@@ -1,2 +1,2 @@
-missingAnnotationOnSINK
+missingAnnotationOnSink
 failures
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
index 1962bf2889e..92b466cd25a 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
+++ b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
@@ -94,7 +94,7 @@ def with_multiple_kw_args(a, b, c):
 def test_multiple_kw_args():
     with_multiple_kw_args(b=arg2, c=arg3, a=arg1)  #$ arg1 arg2 arg3
     with_multiple_kw_args(arg1, *(arg2,), arg3)  #$ arg1 MISSING: arg2 arg3
-    with_multiple_kw_args(arg1, **{"c": arg3}, b=arg2)  #$ arg1 arg3 func=with_multiple_kw_args MISSING: arg2
+    with_multiple_kw_args(arg1, **{"c": arg3}, b=arg2)  #$ arg1 arg2 arg3 func=with_multiple_kw_args MISSING:
     with_multiple_kw_args(**{"b": arg2}, **{"c": arg3}, **{"a": arg1})  #$ arg1 arg2 arg3 func=with_multiple_kw_args
 
 
diff --git a/python/ql/test/experimental/dataflow/coverage/classesCallGraph.expected b/python/ql/test/experimental/dataflow/coverage/classesCallGraph.expected
index a5477d5667e..f297c4be6e3 100644
--- a/python/ql/test/experimental/dataflow/coverage/classesCallGraph.expected
+++ b/python/ql/test/experimental/dataflow/coverage/classesCallGraph.expected
@@ -1,8 +1,10 @@
+| classes.py:14:17:14:60 | ControlFlowNode for Attribute() | classes.py:14:17:14:60 | ControlFlowNode for Attribute() |
 | classes.py:45:16:45:35 | ControlFlowNode for Attribute() | classes.py:45:16:45:35 | ControlFlowNode for Attribute() |
 | classes.py:60:17:60:27 | [pre objCreate] ControlFlowNode for With_init() | classes.py:54:18:54:21 | ControlFlowNode for self |
 | classes.py:242:9:242:24 | ControlFlowNode for set() | classes.py:242:9:242:24 | ControlFlowNode for set() |
 | classes.py:247:9:247:30 | ControlFlowNode for frozenset() | classes.py:247:9:247:30 | ControlFlowNode for frozenset() |
 | classes.py:252:9:252:28 | ControlFlowNode for dict() | classes.py:252:9:252:28 | ControlFlowNode for dict() |
+| classes.py:559:16:559:17 | ControlFlowNode for Str | classes.py:565:5:565:22 | ControlFlowNode for Subscript |
 | classes.py:565:5:565:16 | ControlFlowNode for with_getitem | classes.py:555:21:555:24 | ControlFlowNode for self |
 | classes.py:565:18:565:21 | ControlFlowNode for arg2 | classes.py:555:27:555:29 | ControlFlowNode for key |
 | classes.py:581:5:581:16 | ControlFlowNode for with_setitem | classes.py:570:21:570:24 | ControlFlowNode for self |
@@ -11,29 +13,68 @@
 | classes.py:595:9:595:20 | ControlFlowNode for with_delitem | classes.py:586:21:586:24 | ControlFlowNode for self |
 | classes.py:595:22:595:25 | ControlFlowNode for arg2 | classes.py:586:27:586:29 | ControlFlowNode for key |
 | classes.py:618:16:618:28 | ControlFlowNode for Attribute() | classes.py:618:16:618:28 | ControlFlowNode for Attribute() |
+| classes.py:659:15:659:18 | ControlFlowNode for self | classes.py:667:5:667:19 | ControlFlowNode for BinaryExpr |
+| classes.py:661:16:661:19 | ControlFlowNode for self | classes.py:667:5:667:19 | ControlFlowNode for BinaryExpr |
 | classes.py:667:5:667:12 | ControlFlowNode for with_add | classes.py:657:17:657:20 | ControlFlowNode for self |
+| classes.py:667:5:667:12 | ControlFlowNode for with_add | classes.py:667:5:667:19 | ControlFlowNode for BinaryExpr |
 | classes.py:667:16:667:19 | ControlFlowNode for arg2 | classes.py:657:23:657:27 | ControlFlowNode for other |
+| classes.py:674:15:674:18 | ControlFlowNode for self | classes.py:682:5:682:19 | ControlFlowNode for BinaryExpr |
+| classes.py:676:16:676:19 | ControlFlowNode for self | classes.py:682:5:682:19 | ControlFlowNode for BinaryExpr |
 | classes.py:682:5:682:12 | ControlFlowNode for with_sub | classes.py:672:17:672:20 | ControlFlowNode for self |
+| classes.py:682:5:682:12 | ControlFlowNode for with_sub | classes.py:682:5:682:19 | ControlFlowNode for BinaryExpr |
 | classes.py:682:16:682:19 | ControlFlowNode for arg2 | classes.py:672:23:672:27 | ControlFlowNode for other |
+| classes.py:689:15:689:18 | ControlFlowNode for self | classes.py:697:5:697:19 | ControlFlowNode for BinaryExpr |
+| classes.py:691:16:691:19 | ControlFlowNode for self | classes.py:697:5:697:19 | ControlFlowNode for BinaryExpr |
 | classes.py:697:5:697:12 | ControlFlowNode for with_mul | classes.py:687:17:687:20 | ControlFlowNode for self |
+| classes.py:697:5:697:12 | ControlFlowNode for with_mul | classes.py:697:5:697:19 | ControlFlowNode for BinaryExpr |
 | classes.py:697:16:697:19 | ControlFlowNode for arg2 | classes.py:687:23:687:27 | ControlFlowNode for other |
+| classes.py:704:15:704:18 | ControlFlowNode for self | classes.py:712:5:712:22 | ControlFlowNode for BinaryExpr |
+| classes.py:706:16:706:19 | ControlFlowNode for self | classes.py:712:5:712:22 | ControlFlowNode for BinaryExpr |
 | classes.py:712:5:712:15 | ControlFlowNode for with_matmul | classes.py:702:20:702:23 | ControlFlowNode for self |
+| classes.py:712:5:712:15 | ControlFlowNode for with_matmul | classes.py:712:5:712:22 | ControlFlowNode for BinaryExpr |
 | classes.py:712:19:712:22 | ControlFlowNode for arg2 | classes.py:702:26:702:30 | ControlFlowNode for other |
+| classes.py:719:15:719:18 | ControlFlowNode for self | classes.py:727:5:727:23 | ControlFlowNode for BinaryExpr |
+| classes.py:721:16:721:19 | ControlFlowNode for self | classes.py:727:5:727:23 | ControlFlowNode for BinaryExpr |
 | classes.py:727:5:727:16 | ControlFlowNode for with_truediv | classes.py:717:21:717:24 | ControlFlowNode for self |
+| classes.py:727:5:727:16 | ControlFlowNode for with_truediv | classes.py:727:5:727:23 | ControlFlowNode for BinaryExpr |
 | classes.py:727:20:727:23 | ControlFlowNode for arg2 | classes.py:717:27:717:31 | ControlFlowNode for other |
+| classes.py:734:15:734:18 | ControlFlowNode for self | classes.py:742:5:742:25 | ControlFlowNode for BinaryExpr |
+| classes.py:736:16:736:19 | ControlFlowNode for self | classes.py:742:5:742:25 | ControlFlowNode for BinaryExpr |
 | classes.py:742:5:742:17 | ControlFlowNode for with_floordiv | classes.py:732:22:732:25 | ControlFlowNode for self |
+| classes.py:742:5:742:17 | ControlFlowNode for with_floordiv | classes.py:742:5:742:25 | ControlFlowNode for BinaryExpr |
 | classes.py:742:22:742:25 | ControlFlowNode for arg2 | classes.py:732:28:732:32 | ControlFlowNode for other |
+| classes.py:749:15:749:18 | ControlFlowNode for self | classes.py:757:5:757:19 | ControlFlowNode for BinaryExpr |
+| classes.py:751:16:751:19 | ControlFlowNode for self | classes.py:757:5:757:19 | ControlFlowNode for BinaryExpr |
 | classes.py:757:5:757:12 | ControlFlowNode for with_mod | classes.py:747:17:747:20 | ControlFlowNode for self |
+| classes.py:757:5:757:12 | ControlFlowNode for with_mod | classes.py:757:5:757:19 | ControlFlowNode for BinaryExpr |
 | classes.py:757:16:757:19 | ControlFlowNode for arg2 | classes.py:747:23:747:27 | ControlFlowNode for other |
+| classes.py:779:15:779:18 | ControlFlowNode for self | classes.py:793:5:793:20 | ControlFlowNode for BinaryExpr |
+| classes.py:781:16:781:19 | ControlFlowNode for self | classes.py:793:5:793:20 | ControlFlowNode for BinaryExpr |
 | classes.py:793:5:793:12 | ControlFlowNode for with_pow | classes.py:777:17:777:20 | ControlFlowNode for self |
+| classes.py:793:5:793:12 | ControlFlowNode for with_pow | classes.py:793:5:793:20 | ControlFlowNode for BinaryExpr |
 | classes.py:793:17:793:20 | ControlFlowNode for arg2 | classes.py:777:23:777:27 | ControlFlowNode for other |
+| classes.py:800:15:800:18 | ControlFlowNode for self | classes.py:808:5:808:23 | ControlFlowNode for BinaryExpr |
+| classes.py:802:16:802:19 | ControlFlowNode for self | classes.py:808:5:808:23 | ControlFlowNode for BinaryExpr |
 | classes.py:808:5:808:15 | ControlFlowNode for with_lshift | classes.py:798:20:798:23 | ControlFlowNode for self |
+| classes.py:808:5:808:15 | ControlFlowNode for with_lshift | classes.py:808:5:808:23 | ControlFlowNode for BinaryExpr |
 | classes.py:808:20:808:23 | ControlFlowNode for arg2 | classes.py:798:26:798:30 | ControlFlowNode for other |
+| classes.py:815:15:815:18 | ControlFlowNode for self | classes.py:823:5:823:23 | ControlFlowNode for BinaryExpr |
+| classes.py:817:16:817:19 | ControlFlowNode for self | classes.py:823:5:823:23 | ControlFlowNode for BinaryExpr |
 | classes.py:823:5:823:15 | ControlFlowNode for with_rshift | classes.py:813:20:813:23 | ControlFlowNode for self |
+| classes.py:823:5:823:15 | ControlFlowNode for with_rshift | classes.py:823:5:823:23 | ControlFlowNode for BinaryExpr |
 | classes.py:823:20:823:23 | ControlFlowNode for arg2 | classes.py:813:26:813:30 | ControlFlowNode for other |
+| classes.py:830:15:830:18 | ControlFlowNode for self | classes.py:838:5:838:19 | ControlFlowNode for BinaryExpr |
+| classes.py:832:16:832:19 | ControlFlowNode for self | classes.py:838:5:838:19 | ControlFlowNode for BinaryExpr |
 | classes.py:838:5:838:12 | ControlFlowNode for with_and | classes.py:828:17:828:20 | ControlFlowNode for self |
+| classes.py:838:5:838:12 | ControlFlowNode for with_and | classes.py:838:5:838:19 | ControlFlowNode for BinaryExpr |
 | classes.py:838:16:838:19 | ControlFlowNode for arg2 | classes.py:828:23:828:27 | ControlFlowNode for other |
+| classes.py:845:15:845:18 | ControlFlowNode for self | classes.py:853:5:853:19 | ControlFlowNode for BinaryExpr |
+| classes.py:847:16:847:19 | ControlFlowNode for self | classes.py:853:5:853:19 | ControlFlowNode for BinaryExpr |
 | classes.py:853:5:853:12 | ControlFlowNode for with_xor | classes.py:843:17:843:20 | ControlFlowNode for self |
+| classes.py:853:5:853:12 | ControlFlowNode for with_xor | classes.py:853:5:853:19 | ControlFlowNode for BinaryExpr |
 | classes.py:853:16:853:19 | ControlFlowNode for arg2 | classes.py:843:23:843:27 | ControlFlowNode for other |
+| classes.py:860:15:860:18 | ControlFlowNode for self | classes.py:868:5:868:18 | ControlFlowNode for BinaryExpr |
+| classes.py:862:16:862:19 | ControlFlowNode for self | classes.py:868:5:868:18 | ControlFlowNode for BinaryExpr |
 | classes.py:868:5:868:11 | ControlFlowNode for with_or | classes.py:858:16:858:19 | ControlFlowNode for self |
+| classes.py:868:5:868:11 | ControlFlowNode for with_or | classes.py:868:5:868:18 | ControlFlowNode for BinaryExpr |
 | classes.py:868:15:868:18 | ControlFlowNode for arg2 | classes.py:858:22:858:26 | ControlFlowNode for other |
diff --git a/python/ql/test/experimental/dataflow/coverage/classesCallGraph.ql b/python/ql/test/experimental/dataflow/coverage/classesCallGraph.ql
index 1f8edfc1c79..c1b66d0f323 100644
--- a/python/ql/test/experimental/dataflow/coverage/classesCallGraph.ql
+++ b/python/ql/test/experimental/dataflow/coverage/classesCallGraph.ql
@@ -20,7 +20,7 @@ class CallGraphConfig extends DataFlow::Configuration {
     node instanceof DataFlow::ParameterNode and
     // exclude parameters to the SINK-functions
     not exists(DataFlowPrivate::DataFlowCallable c |
-      node.(DataFlow::ParameterNode).isParameterOf(c, _) and
+      c.getParameter(_) = node.asCfgNode() and
       c.getName().matches("SINK_")
     )
   }
diff --git a/python/ql/test/experimental/dataflow/fieldflow/NormalDataflowTest.expected b/python/ql/test/experimental/dataflow/fieldflow/NormalDataflowTest.expected
index dd7fb126526..3875da4e143 100644
--- a/python/ql/test/experimental/dataflow/fieldflow/NormalDataflowTest.expected
+++ b/python/ql/test/experimental/dataflow/fieldflow/NormalDataflowTest.expected
@@ -1,2 +1,2 @@
-missingAnnotationOnSINK
+missingAnnotationOnSink
 failures
diff --git a/python/ql/test/experimental/dataflow/match/NormalDataflowTest.expected b/python/ql/test/experimental/dataflow/match/NormalDataflowTest.expected
index dd7fb126526..3875da4e143 100644
--- a/python/ql/test/experimental/dataflow/match/NormalDataflowTest.expected
+++ b/python/ql/test/experimental/dataflow/match/NormalDataflowTest.expected
@@ -1,2 +1,2 @@
-missingAnnotationOnSINK
+missingAnnotationOnSink
 failures
diff --git a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/README.md b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/README.md
index 7f098028457..59e9087ee49 100644
--- a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/README.md
+++ b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/README.md
@@ -39,7 +39,7 @@ diff '--color=auto' -u -r test-1-normal/NormalDataflowTest.expected test-5-max-i
 --- test-1-normal/NormalDataflowTest.expected	2022-02-27 10:33:00.603882599 +0100
 +++ test-5-max-import-depth-3/NormalDataflowTest.expected	2022-02-28 10:10:08.930743800 +0100
 @@ -1,2 +1,3 @@
- missingAnnotationOnSINK
+ missingAnnotationOnSink
  failures
 +| ../src/urandom_problem.py:43:6:43:8 | ControlFlowNode for foo | Fixed missing result:flow="SOURCE, l:-15 -> foo" |
 diff '--color=auto' -u -r test-1-normal/options test-5-max-import-depth-3/options
@@ -88,7 +88,7 @@ diff '--color=auto' -u -r test-4-max-import-depth-100/NormalDataflowTest.expecte
 --- test-4-max-import-depth-100/NormalDataflowTest.expected     2022-02-28 10:10:02.206608379 +0100
 +++ test-6-max-import-depth-2/NormalDataflowTest.expected       2022-02-28 10:10:13.882716665 +0100
 @@ -1,3 +1,5 @@
- missingAnnotationOnSINK
+ missingAnnotationOnSink
 +| ../src/isfile_no_problem.py:43:6:43:8 | ../src/isfile_no_problem.py:43 | ERROR, you should add `# $ MISSING: flow` annotation | foo |
  failures
 +| ../src/isfile_no_problem.py:43:11:43:41 | Comment # $ flow="SOURCE, l:-15 -> foo" | Missing result:flow="SOURCE, l:-15 -> foo" |
diff --git a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-1-normal/NormalDataflowTest.expected b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-1-normal/NormalDataflowTest.expected
index dd7fb126526..3875da4e143 100644
--- a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-1-normal/NormalDataflowTest.expected
+++ b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-1-normal/NormalDataflowTest.expected
@@ -1,2 +1,2 @@
-missingAnnotationOnSINK
+missingAnnotationOnSink
 failures
diff --git a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-2-without-splitting/NormalDataflowTest.expected b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-2-without-splitting/NormalDataflowTest.expected
index dc83fab3907..ceeb0ef30e0 100644
--- a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-2-without-splitting/NormalDataflowTest.expected
+++ b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-2-without-splitting/NormalDataflowTest.expected
@@ -1,3 +1,3 @@
-missingAnnotationOnSINK
+missingAnnotationOnSink
 failures
 | ../src/urandom_problem.py:43:6:43:8 | ControlFlowNode for foo | Fixed missing result:flow="SOURCE, l:-15 -> foo" |
diff --git a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-3-max-import-depth-0/NormalDataflowTest.expected b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-3-max-import-depth-0/NormalDataflowTest.expected
index dc83fab3907..ceeb0ef30e0 100644
--- a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-3-max-import-depth-0/NormalDataflowTest.expected
+++ b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-3-max-import-depth-0/NormalDataflowTest.expected
@@ -1,3 +1,3 @@
-missingAnnotationOnSINK
+missingAnnotationOnSink
 failures
 | ../src/urandom_problem.py:43:6:43:8 | ControlFlowNode for foo | Fixed missing result:flow="SOURCE, l:-15 -> foo" |
diff --git a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-4-max-import-depth-100/NormalDataflowTest.expected b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-4-max-import-depth-100/NormalDataflowTest.expected
index dc83fab3907..ceeb0ef30e0 100644
--- a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-4-max-import-depth-100/NormalDataflowTest.expected
+++ b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-4-max-import-depth-100/NormalDataflowTest.expected
@@ -1,3 +1,3 @@
-missingAnnotationOnSINK
+missingAnnotationOnSink
 failures
 | ../src/urandom_problem.py:43:6:43:8 | ControlFlowNode for foo | Fixed missing result:flow="SOURCE, l:-15 -> foo" |
diff --git a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-5-max-import-depth-3/NormalDataflowTest.expected b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-5-max-import-depth-3/NormalDataflowTest.expected
index dc83fab3907..ceeb0ef30e0 100644
--- a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-5-max-import-depth-3/NormalDataflowTest.expected
+++ b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-5-max-import-depth-3/NormalDataflowTest.expected
@@ -1,3 +1,3 @@
-missingAnnotationOnSINK
+missingAnnotationOnSink
 failures
 | ../src/urandom_problem.py:43:6:43:8 | ControlFlowNode for foo | Fixed missing result:flow="SOURCE, l:-15 -> foo" |
diff --git a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-6-max-import-depth-2/NormalDataflowTest.expected b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-6-max-import-depth-2/NormalDataflowTest.expected
index aa4bfeb5ae4..7b5784017f3 100644
--- a/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-6-max-import-depth-2/NormalDataflowTest.expected
+++ b/python/ql/test/experimental/dataflow/strange-pointsto-interaction-investigation/test-6-max-import-depth-2/NormalDataflowTest.expected
@@ -1,4 +1,4 @@
-missingAnnotationOnSINK
+missingAnnotationOnSink
 | ../src/isfile_no_problem.py:43:6:43:8 | ../src/isfile_no_problem.py:43 | ERROR, you should add `# $ MISSING: flow` annotation | foo |
 failures
 | ../src/isfile_no_problem.py:43:11:43:41 | Comment # $ flow="SOURCE, l:-15 -> foo" | Missing result:flow="SOURCE, l:-15 -> foo" |
diff --git a/python/ql/test/experimental/dataflow/summaries/NormalTaintTrackingTest.expected b/python/ql/test/experimental/dataflow/summaries/NormalTaintTrackingTest.expected
new file mode 100644
index 00000000000..3875da4e143
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/summaries/NormalTaintTrackingTest.expected
@@ -0,0 +1,2 @@
+missingAnnotationOnSink
+failures
diff --git a/python/ql/test/experimental/dataflow/summaries/NormalTaintTrackingTest.ql b/python/ql/test/experimental/dataflow/summaries/NormalTaintTrackingTest.ql
new file mode 100644
index 00000000000..afb44b6b2ed
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/summaries/NormalTaintTrackingTest.ql
@@ -0,0 +1,3 @@
+import python
+private import TestSummaries
+import experimental.dataflow.TestUtil.NormalTaintTrackingTest
diff --git a/python/ql/test/experimental/dataflow/summaries/TestSummaries.qll b/python/ql/test/experimental/dataflow/summaries/TestSummaries.qll
new file mode 100644
index 00000000000..971a653c469
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/summaries/TestSummaries.qll
@@ -0,0 +1,134 @@
+private import python
+private import semmle.python.dataflow.new.FlowSummary
+private import semmle.python.ApiGraphs
+
+/**
+ * This module ensures that the `callStep` predicate in
+ * our type tracker implelemtation does not refer to the
+ * `getACall` predicate on `SummarizedCallable`.
+ */
+module RecursionGuard {
+  private import semmle.python.dataflow.new.internal.TypeTrackerSpecific as TT
+
+  private class RecursionGuard extends SummarizedCallable {
+    RecursionGuard() { this = "RecursionGuard" }
+
+    override DataFlow::CallCfgNode getACall() {
+      result.getFunction().asCfgNode().(NameNode).getId() = this and
+      (TT::callStep(_, _) implies any())
+    }
+
+    override DataFlow::ArgumentNode getACallback() { result.asExpr().(Name).getId() = this }
+  }
+}
+
+private class SummarizedCallableIdentity extends SummarizedCallable {
+  SummarizedCallableIdentity() { this = "identity" }
+
+  override DataFlow::CallCfgNode getACall() {
+    result.getFunction().asCfgNode().(NameNode).getId() = this
+  }
+
+  override DataFlow::ArgumentNode getACallback() { result.asExpr().(Name).getId() = this }
+
+  override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
+    input = "Argument[0]" and
+    output = "ReturnValue" and
+    preservesValue = true
+  }
+}
+
+// For lambda flow to work, implement lambdaCall and lambdaCreation
+private class SummarizedCallableApplyLambda extends SummarizedCallable {
+  SummarizedCallableApplyLambda() { this = "apply_lambda" }
+
+  override DataFlow::CallCfgNode getACall() {
+    result.getFunction().asCfgNode().(NameNode).getId() = this
+  }
+
+  override DataFlow::ArgumentNode getACallback() { result.asExpr().(Name).getId() = this }
+
+  override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
+    input = "Argument[1]" and
+    output = "Argument[0].Parameter[0]" and
+    preservesValue = true
+    or
+    input = "Argument[0].ReturnValue" and
+    output = "ReturnValue" and
+    preservesValue = true
+  }
+}
+
+private class SummarizedCallableReversed extends SummarizedCallable {
+  SummarizedCallableReversed() { this = "reversed" }
+
+  override DataFlow::CallCfgNode getACall() {
+    result.getFunction().asCfgNode().(NameNode).getId() = this
+  }
+
+  override DataFlow::ArgumentNode getACallback() { result.asExpr().(Name).getId() = this }
+
+  override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
+    input = "Argument[0].ListElement" and
+    output = "ReturnValue.ListElement" and
+    preservesValue = true
+  }
+}
+
+private class SummarizedCallableMap extends SummarizedCallable {
+  SummarizedCallableMap() { this = "list_map" }
+
+  override DataFlow::CallCfgNode getACall() {
+    result.getFunction().asCfgNode().(NameNode).getId() = this
+  }
+
+  override DataFlow::ArgumentNode getACallback() { result.asExpr().(Name).getId() = this }
+
+  override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
+    input = "Argument[1].ListElement" and
+    output = "Argument[0].Parameter[0]" and
+    preservesValue = true
+    or
+    input = "Argument[0].ReturnValue" and
+    output = "ReturnValue.ListElement" and
+    preservesValue = true
+  }
+}
+
+private class SummarizedCallableAppend extends SummarizedCallable {
+  SummarizedCallableAppend() { this = "append_to_list" }
+
+  override DataFlow::CallCfgNode getACall() {
+    result.getFunction().asCfgNode().(NameNode).getId() = this
+  }
+
+  override DataFlow::ArgumentNode getACallback() { result.asExpr().(Name).getId() = this }
+
+  override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
+    input = "Argument[0]" and
+    output = "ReturnValue" and
+    preservesValue = false
+    or
+    input = "Argument[1]" and
+    output = "ReturnValue.ListElement" and
+    preservesValue = true
+  }
+}
+
+private class SummarizedCallableJsonLoads extends SummarizedCallable {
+  SummarizedCallableJsonLoads() { this = "json.loads" }
+
+  override DataFlow::CallCfgNode getACall() {
+    result = API::moduleImport("json").getMember("loads").getACall()
+  }
+
+  override DataFlow::ArgumentNode getACallback() {
+    result = API::moduleImport("json").getMember("loads").getAValueReachableFromSource()
+  }
+
+  override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
+    input = "Argument[0]" and
+    output = "ReturnValue.ListElement" and
+    preservesValue = true
+  }
+}
diff --git a/python/ql/test/experimental/dataflow/summaries/summaries.expected b/python/ql/test/experimental/dataflow/summaries/summaries.expected
new file mode 100644
index 00000000000..2d1190eb69c
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/summaries/summaries.expected
@@ -0,0 +1,70 @@
+edges
+| summaries.py:32:11:32:26 | ControlFlowNode for identity() | summaries.py:33:6:33:12 | ControlFlowNode for tainted |
+| summaries.py:32:20:32:25 | ControlFlowNode for SOURCE | summaries.py:32:11:32:26 | ControlFlowNode for identity() |
+| summaries.py:36:18:36:54 | ControlFlowNode for apply_lambda() | summaries.py:37:6:37:19 | ControlFlowNode for tainted_lambda |
+| summaries.py:36:48:36:53 | ControlFlowNode for SOURCE | summaries.py:36:18:36:54 | ControlFlowNode for apply_lambda() |
+| summaries.py:44:25:44:32 | ControlFlowNode for List | summaries.py:45:6:45:20 | ControlFlowNode for Subscript |
+| summaries.py:44:26:44:31 | ControlFlowNode for SOURCE | summaries.py:44:25:44:32 | ControlFlowNode for List |
+| summaries.py:51:18:51:46 | ControlFlowNode for list_map() [List element] | summaries.py:52:6:52:19 | ControlFlowNode for tainted_mapped [List element] |
+| summaries.py:51:38:51:45 | ControlFlowNode for List [List element] | summaries.py:51:18:51:46 | ControlFlowNode for list_map() [List element] |
+| summaries.py:51:39:51:44 | ControlFlowNode for SOURCE | summaries.py:51:38:51:45 | ControlFlowNode for List [List element] |
+| summaries.py:52:6:52:19 | ControlFlowNode for tainted_mapped [List element] | summaries.py:52:6:52:22 | ControlFlowNode for Subscript |
+| summaries.py:57:27:57:63 | ControlFlowNode for list_map() [List element] | summaries.py:58:6:58:28 | ControlFlowNode for tainted_mapped_explicit [List element] |
+| summaries.py:57:55:57:62 | ControlFlowNode for List [List element] | summaries.py:57:27:57:63 | ControlFlowNode for list_map() [List element] |
+| summaries.py:57:56:57:61 | ControlFlowNode for SOURCE | summaries.py:57:55:57:62 | ControlFlowNode for List [List element] |
+| summaries.py:58:6:58:28 | ControlFlowNode for tainted_mapped_explicit [List element] | summaries.py:58:6:58:31 | ControlFlowNode for Subscript |
+| summaries.py:60:26:60:53 | ControlFlowNode for list_map() [List element] | summaries.py:61:6:61:27 | ControlFlowNode for tainted_mapped_summary [List element] |
+| summaries.py:60:45:60:52 | ControlFlowNode for List [List element] | summaries.py:60:26:60:53 | ControlFlowNode for list_map() [List element] |
+| summaries.py:60:46:60:51 | ControlFlowNode for SOURCE | summaries.py:60:45:60:52 | ControlFlowNode for List [List element] |
+| summaries.py:61:6:61:27 | ControlFlowNode for tainted_mapped_summary [List element] | summaries.py:61:6:61:30 | ControlFlowNode for Subscript |
+| summaries.py:63:16:63:41 | ControlFlowNode for append_to_list() [List element] | summaries.py:64:6:64:17 | ControlFlowNode for tainted_list [List element] |
+| summaries.py:63:35:63:40 | ControlFlowNode for SOURCE | summaries.py:63:16:63:41 | ControlFlowNode for append_to_list() [List element] |
+| summaries.py:64:6:64:17 | ControlFlowNode for tainted_list [List element] | summaries.py:64:6:64:20 | ControlFlowNode for Subscript |
+| summaries.py:67:22:67:39 | ControlFlowNode for json_loads() [List element] | summaries.py:68:6:68:23 | ControlFlowNode for tainted_resultlist [List element] |
+| summaries.py:67:33:67:38 | ControlFlowNode for SOURCE | summaries.py:67:22:67:39 | ControlFlowNode for json_loads() [List element] |
+| summaries.py:67:33:67:38 | ControlFlowNode for SOURCE | summaries.py:68:6:68:26 | ControlFlowNode for Subscript |
+| summaries.py:68:6:68:23 | ControlFlowNode for tainted_resultlist [List element] | summaries.py:68:6:68:26 | ControlFlowNode for Subscript |
+nodes
+| summaries.py:32:11:32:26 | ControlFlowNode for identity() | semmle.label | ControlFlowNode for identity() |
+| summaries.py:32:20:32:25 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| summaries.py:33:6:33:12 | ControlFlowNode for tainted | semmle.label | ControlFlowNode for tainted |
+| summaries.py:36:18:36:54 | ControlFlowNode for apply_lambda() | semmle.label | ControlFlowNode for apply_lambda() |
+| summaries.py:36:48:36:53 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| summaries.py:37:6:37:19 | ControlFlowNode for tainted_lambda | semmle.label | ControlFlowNode for tainted_lambda |
+| summaries.py:44:25:44:32 | ControlFlowNode for List | semmle.label | ControlFlowNode for List |
+| summaries.py:44:26:44:31 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| summaries.py:45:6:45:20 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
+| summaries.py:51:18:51:46 | ControlFlowNode for list_map() [List element] | semmle.label | ControlFlowNode for list_map() [List element] |
+| summaries.py:51:38:51:45 | ControlFlowNode for List [List element] | semmle.label | ControlFlowNode for List [List element] |
+| summaries.py:51:39:51:44 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| summaries.py:52:6:52:19 | ControlFlowNode for tainted_mapped [List element] | semmle.label | ControlFlowNode for tainted_mapped [List element] |
+| summaries.py:52:6:52:22 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
+| summaries.py:57:27:57:63 | ControlFlowNode for list_map() [List element] | semmle.label | ControlFlowNode for list_map() [List element] |
+| summaries.py:57:55:57:62 | ControlFlowNode for List [List element] | semmle.label | ControlFlowNode for List [List element] |
+| summaries.py:57:56:57:61 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| summaries.py:58:6:58:28 | ControlFlowNode for tainted_mapped_explicit [List element] | semmle.label | ControlFlowNode for tainted_mapped_explicit [List element] |
+| summaries.py:58:6:58:31 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
+| summaries.py:60:26:60:53 | ControlFlowNode for list_map() [List element] | semmle.label | ControlFlowNode for list_map() [List element] |
+| summaries.py:60:45:60:52 | ControlFlowNode for List [List element] | semmle.label | ControlFlowNode for List [List element] |
+| summaries.py:60:46:60:51 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| summaries.py:61:6:61:27 | ControlFlowNode for tainted_mapped_summary [List element] | semmle.label | ControlFlowNode for tainted_mapped_summary [List element] |
+| summaries.py:61:6:61:30 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
+| summaries.py:63:16:63:41 | ControlFlowNode for append_to_list() [List element] | semmle.label | ControlFlowNode for append_to_list() [List element] |
+| summaries.py:63:35:63:40 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| summaries.py:64:6:64:17 | ControlFlowNode for tainted_list [List element] | semmle.label | ControlFlowNode for tainted_list [List element] |
+| summaries.py:64:6:64:20 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
+| summaries.py:67:22:67:39 | ControlFlowNode for json_loads() [List element] | semmle.label | ControlFlowNode for json_loads() [List element] |
+| summaries.py:67:33:67:38 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| summaries.py:68:6:68:23 | ControlFlowNode for tainted_resultlist [List element] | semmle.label | ControlFlowNode for tainted_resultlist [List element] |
+| summaries.py:68:6:68:26 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
+subpaths
+invalidSpecComponent
+#select
+| summaries.py:33:6:33:12 | ControlFlowNode for tainted | summaries.py:32:20:32:25 | ControlFlowNode for SOURCE | summaries.py:33:6:33:12 | ControlFlowNode for tainted | $@ | summaries.py:32:20:32:25 | ControlFlowNode for SOURCE | ControlFlowNode for SOURCE |
+| summaries.py:37:6:37:19 | ControlFlowNode for tainted_lambda | summaries.py:36:48:36:53 | ControlFlowNode for SOURCE | summaries.py:37:6:37:19 | ControlFlowNode for tainted_lambda | $@ | summaries.py:36:48:36:53 | ControlFlowNode for SOURCE | ControlFlowNode for SOURCE |
+| summaries.py:45:6:45:20 | ControlFlowNode for Subscript | summaries.py:44:26:44:31 | ControlFlowNode for SOURCE | summaries.py:45:6:45:20 | ControlFlowNode for Subscript | $@ | summaries.py:44:26:44:31 | ControlFlowNode for SOURCE | ControlFlowNode for SOURCE |
+| summaries.py:52:6:52:22 | ControlFlowNode for Subscript | summaries.py:51:39:51:44 | ControlFlowNode for SOURCE | summaries.py:52:6:52:22 | ControlFlowNode for Subscript | $@ | summaries.py:51:39:51:44 | ControlFlowNode for SOURCE | ControlFlowNode for SOURCE |
+| summaries.py:58:6:58:31 | ControlFlowNode for Subscript | summaries.py:57:56:57:61 | ControlFlowNode for SOURCE | summaries.py:58:6:58:31 | ControlFlowNode for Subscript | $@ | summaries.py:57:56:57:61 | ControlFlowNode for SOURCE | ControlFlowNode for SOURCE |
+| summaries.py:61:6:61:30 | ControlFlowNode for Subscript | summaries.py:60:46:60:51 | ControlFlowNode for SOURCE | summaries.py:61:6:61:30 | ControlFlowNode for Subscript | $@ | summaries.py:60:46:60:51 | ControlFlowNode for SOURCE | ControlFlowNode for SOURCE |
+| summaries.py:64:6:64:20 | ControlFlowNode for Subscript | summaries.py:63:35:63:40 | ControlFlowNode for SOURCE | summaries.py:64:6:64:20 | ControlFlowNode for Subscript | $@ | summaries.py:63:35:63:40 | ControlFlowNode for SOURCE | ControlFlowNode for SOURCE |
+| summaries.py:68:6:68:26 | ControlFlowNode for Subscript | summaries.py:67:33:67:38 | ControlFlowNode for SOURCE | summaries.py:68:6:68:26 | ControlFlowNode for Subscript | $@ | summaries.py:67:33:67:38 | ControlFlowNode for SOURCE | ControlFlowNode for SOURCE |
diff --git a/python/ql/test/experimental/dataflow/summaries/summaries.py b/python/ql/test/experimental/dataflow/summaries/summaries.py
new file mode 100644
index 00000000000..1532a5393d8
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/summaries/summaries.py
@@ -0,0 +1,68 @@
+
+import sys
+import os
+
+sys.path.append(os.path.dirname(os.path.dirname((__file__))))
+from testlib import expects
+
+# These are defined so that we can evaluate the test code.
+NONSOURCE = "not a source"
+SOURCE = "source"
+
+
+def is_source(x):
+    return x == "source" or x == b"source" or x == 42 or x == 42.0 or x == 42j
+
+
+def SINK(x):
+    if is_source(x):
+        print("OK")
+    else:
+        print("Unexpected flow", x)
+
+
+def SINK_F(x):
+    if is_source(x):
+        print("Unexpected flow", x)
+    else:
+        print("OK")
+
+
+# Simple summary
+tainted = identity(SOURCE)
+SINK(tainted)  # $ flow="SOURCE, l:-1 -> tainted"
+
+# Lambda summary
+tainted_lambda = apply_lambda(lambda x: x + 1, SOURCE)
+SINK(tainted_lambda)  # $ flow="SOURCE, l:-1 -> tainted_lambda"
+
+# A lambda that breaks the flow
+untainted_lambda = apply_lambda(lambda x: 1, SOURCE)
+SINK_F(untainted_lambda)
+
+# Collection summaries
+tainted_list = reversed([SOURCE])
+SINK(tainted_list[0])  # $ flow="SOURCE, l:-1 -> tainted_list[0]"
+
+# Complex summaries
+def add_colon(x):
+    return x + ":"
+
+tainted_mapped = list_map(add_colon, [SOURCE])
+SINK(tainted_mapped[0])  # $ flow="SOURCE, l:-1 -> tainted_mapped[0]"
+
+def explicit_identity(x):
+    return x
+
+tainted_mapped_explicit = list_map(explicit_identity, [SOURCE])
+SINK(tainted_mapped_explicit[0])  # $ flow="SOURCE, l:-1 -> tainted_mapped_explicit[0]"
+
+tainted_mapped_summary = list_map(identity, [SOURCE])
+SINK(tainted_mapped_summary[0])  # $ flow="SOURCE, l:-1 -> tainted_mapped_summary[0]"
+
+tainted_list = append_to_list([], SOURCE)
+SINK(tainted_list[0])  # $ flow="SOURCE, l:-1 -> tainted_list[0]"
+
+from json import loads as json_loads
+tainted_resultlist = json_loads(SOURCE)
+SINK(tainted_resultlist[0])  # $ flow="SOURCE, l:-1 -> tainted_resultlist[0]"
diff --git a/python/ql/test/experimental/dataflow/summaries/summaries.ql b/python/ql/test/experimental/dataflow/summaries/summaries.ql
new file mode 100644
index 00000000000..f2c0a522279
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/summaries/summaries.ql
@@ -0,0 +1,21 @@
+/**
+ * @kind path-problem
+ */
+
+import python
+import semmle.python.dataflow.new.FlowSummary
+import DataFlow::PathGraph
+import semmle.python.dataflow.new.TaintTracking
+import semmle.python.dataflow.new.internal.FlowSummaryImpl
+import semmle.python.ApiGraphs
+import experimental.dataflow.testTaintConfig
+private import TestSummaries
+
+query predicate invalidSpecComponent(SummarizedCallable sc, string s, string c) {
+  (sc.propagatesFlowExt(s, _, _) or sc.propagatesFlowExt(_, s, _)) and
+  Private::External::invalidSpecComponent(s, c)
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, TestConfiguration conf
+where conf.hasFlowPath(source, sink)
+select sink, source, sink, "$@", source, source.toString()
diff --git a/python/ql/test/experimental/dataflow/testTaintConfig.qll b/python/ql/test/experimental/dataflow/testTaintConfig.qll
new file mode 100644
index 00000000000..13d0620be92
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/testTaintConfig.qll
@@ -0,0 +1,51 @@
+/**
+ * Configuration to test selected data flow
+ * Sources in the source code are denoted by the special name `SOURCE`,
+ * and sinks are denoted by arguments to the special function `SINK`.
+ * For example, given the test code
+ * ```python
+ *  def test():
+ *      s = SOURCE
+ *      SINK(s)
+ * ```
+ * `SOURCE` will be a source and the second occurrence of `s` will be a sink.
+ *
+ * In order to test literals, alternative sources are defined for each type:
+ *
+ *  for | use
+ * ----------
+ * string | `"source"`
+ * integer | `42`
+ * float | `42.0`
+ * complex | `42j` (not supported yet)
+ */
+
+private import python
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TaintTracking
+
+class TestConfiguration extends TaintTracking::Configuration {
+  TestConfiguration() { this = "TestConfiguration" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node.(DataFlow::CfgNode).getNode().(NameNode).getId() = "SOURCE"
+    or
+    node.(DataFlow::CfgNode).getNode().getNode().(StrConst).getS() = "source"
+    or
+    node.(DataFlow::CfgNode).getNode().getNode().(IntegerLiteral).getN() = "42"
+    or
+    node.(DataFlow::CfgNode).getNode().getNode().(FloatLiteral).getN() = "42.0"
+    // No support for complex numbers
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    exists(CallNode call |
+      call.getFunction().(NameNode).getId() in ["SINK", "SINK_F"] and
+      node.(DataFlow::CfgNode).getNode() = call.getAnArg()
+    )
+  }
+
+  override predicate isSanitizerIn(DataFlow::Node node) { this.isSource(node) }
+
+  override int explorationLimit() { result = 5 }
+}
diff --git a/python/ql/test/experimental/dataflow/typetracking/test.py b/python/ql/test/experimental/dataflow/typetracking/test.py
index 819d85c1d8a..5277450c151 100644
--- a/python/ql/test/experimental/dataflow/typetracking/test.py
+++ b/python/ql/test/experimental/dataflow/typetracking/test.py
@@ -158,3 +158,27 @@ def test_long_import_chain_full_path():
     from foo.bar import baz # $ tracked_foo_bar_baz
     x = baz # $ tracked_foo_bar_baz
     do_stuff(x) # $ tracked_foo_bar_baz
+
+# ------------------------------------------------------------------------------
+# Global variable to method body flow
+# ------------------------------------------------------------------------------
+
+some_value = get_tracked() # $ tracked
+other_value = get_tracked() # $ tracked
+print(some_value) # $ tracked
+print(other_value) # $ tracked
+
+class MyClass(object):
+    # Since we define some_value method on the class, flow for some_value gets blocked
+    # into the methods
+    def some_value(self):
+        print(some_value) # $ tracked
+        print(other_value) # $ tracked
+
+    def other_name(self):
+        print(some_value) # $ tracked
+        print(other_value) # $ tracked
+
+    def with_global_modifier(self):
+        global some_value
+        print(some_value) # $ tracked
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/README.md b/python/ql/test/experimental/dataflow/typetracking_imports/README.md
new file mode 100644
index 00000000000..4063a2851f9
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/README.md
@@ -0,0 +1,5 @@
+A testcase observed in real code, where mixing `from .this import that` with `from .other import *` (in that order) causes import resolution to not work properly.
+
+This needs to be in a separate folder, since using relative imports requires a valid top-level package. We emulate real extractor behavior using `-R` extractor option.
+
+From this directory, you can run the code with `python -m pkg.use`.
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/highlight_problem.expected b/python/ql/test/experimental/dataflow/typetracking_imports/highlight_problem.expected
new file mode 100644
index 00000000000..9aa55c97f1c
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/highlight_problem.expected
@@ -0,0 +1,9 @@
+| pkg/alias_only_direct.py:0:0:0:0 | Module pkg.alias_only_direct | pkg/alias_only_direct.py:1:22:1:24 | GSSA Variable foo | use to normal exit |
+| pkg/alias_problem.py:0:0:0:0 | Module pkg.alias_problem | pkg/alias_problem.py:1:22:1:24 | GSSA Variable foo | no use to normal exit |
+| pkg/alias_problem.py:0:0:0:0 | Module pkg.alias_problem | pkg/alias_problem.py:2:1:2:20 | GSSA Variable foo | use to normal exit |
+| pkg/alias_problem_fixed.py:0:0:0:0 | Module pkg.alias_problem_fixed | pkg/alias_problem_fixed.py:0:0:0:0 | GSSA Variable foo | no use to normal exit |
+| pkg/alias_problem_fixed.py:0:0:0:0 | Module pkg.alias_problem_fixed | pkg/alias_problem_fixed.py:3:22:3:24 | GSSA Variable foo | use to normal exit |
+| pkg/problem_absolute_import.py:0:0:0:0 | Module pkg.problem_absolute_import | pkg/problem_absolute_import.py:1:25:1:27 | GSSA Variable foo | no use to normal exit |
+| pkg/problem_absolute_import.py:0:0:0:0 | Module pkg.problem_absolute_import | pkg/problem_absolute_import.py:2:1:2:23 | GSSA Variable foo | use to normal exit |
+| pkg/works_absolute_import.py:0:0:0:0 | Module pkg.works_absolute_import | pkg/works_absolute_import.py:0:0:0:0 | GSSA Variable foo | no use to normal exit |
+| pkg/works_absolute_import.py:0:0:0:0 | Module pkg.works_absolute_import | pkg/works_absolute_import.py:2:25:2:27 | GSSA Variable foo | use to normal exit |
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/highlight_problem.ql b/python/ql/test/experimental/dataflow/typetracking_imports/highlight_problem.ql
new file mode 100644
index 00000000000..fc1441be479
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/highlight_problem.ql
@@ -0,0 +1,15 @@
+import python
+
+// looking at `module_export` predicate in DataFlowPrivate, the core of the problem is
+// that in alias_problem.py, the direct import of `foo` does not flow to a normal exit of
+// the module. Instead there is a second variable foo coming from `from .other import*` that
+// goes to the normal exit of the module.
+from Module m, EssaVariable v, string useToNormalExit
+where
+  m = v.getScope().getEnclosingModule() and
+  not m.getName() in ["pkg.use", "pkg.foo_def"] and
+  v.getName() = "foo" and
+  if v.getAUse() = m.getANormalExit()
+  then useToNormalExit = "use to normal exit"
+  else useToNormalExit = "no use to normal exit"
+select m, v, useToNormalExit
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/options b/python/ql/test/experimental/dataflow/typetracking_imports/options
new file mode 100644
index 00000000000..1bbc489d153
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/options
@@ -0,0 +1 @@
+semmle-extractor-options: --max-import-depth=1 -R ./pkg/
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/pkg/__init__.py b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_only_direct.py b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_only_direct.py
new file mode 100644
index 00000000000..f609b0fc1aa
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_only_direct.py
@@ -0,0 +1 @@
+from .foo_def import foo # $ tracked
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_problem.py b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_problem.py
new file mode 100644
index 00000000000..0f0d11e47ae
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_problem.py
@@ -0,0 +1,2 @@
+from .foo_def import foo # $ tracked
+from .other import *
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_problem_fixed.py b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_problem_fixed.py
new file mode 100644
index 00000000000..19eb63bfc30
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_problem_fixed.py
@@ -0,0 +1,3 @@
+# this ordering makes the problem go away
+from .other import *
+from .foo_def import foo # $ tracked
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_star.py b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_star.py
new file mode 100644
index 00000000000..45a80b5b57f
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/alias_star.py
@@ -0,0 +1,2 @@
+from .foo_def import *
+from .other import *
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/pkg/foo_def.py b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/foo_def.py
new file mode 100644
index 00000000000..515c77e5e57
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/foo_def.py
@@ -0,0 +1,5 @@
+# apparently adding the assignment makes type-tracker unhappy, so we add this eval so
+# it's possible to run the example and see that everything works
+exec("tracked = 'tracked'")
+foo = tracked # $ tracked
+print(foo) # $ tracked
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/pkg/other.py b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/other.py
new file mode 100644
index 00000000000..6d2e01a45d8
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/other.py
@@ -0,0 +1 @@
+bar = "bar-text"
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/pkg/problem_absolute_import.py b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/problem_absolute_import.py
new file mode 100644
index 00000000000..289f108ea96
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/problem_absolute_import.py
@@ -0,0 +1,2 @@
+from pkg.foo_def import foo # $ tracked
+from pkg.other import *
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/pkg/use.py b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/use.py
new file mode 100644
index 00000000000..023af8684f2
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/use.py
@@ -0,0 +1,46 @@
+def test_direct_import():
+    from .foo_def import foo # $ tracked
+    print(foo) # $ tracked
+
+test_direct_import()
+
+
+def test_alias_problem():
+    from .alias_problem import foo # $ MISSING: tracked
+    print(foo) # $ MISSING: tracked
+
+test_alias_problem()
+
+
+def test_alias_problem_fixed():
+    from .alias_problem_fixed import foo # $ tracked
+    print(foo) # $ tracked
+
+test_alias_problem_fixed()
+
+
+def test_alias_star():
+    from .alias_star import foo # $ tracked
+    print(foo) # $ tracked
+
+test_alias_star()
+
+
+def test_alias_only_direct():
+    from .alias_only_direct import foo # $ tracked
+    print(foo) # $ tracked
+
+test_alias_only_direct()
+
+
+def test_problem_absolute_import():
+    from pkg.problem_absolute_import import foo # $ MISSING: tracked
+    print(foo) # $ MISSING: tracked
+
+test_problem_absolute_import()
+
+def test_works_absolute_import():
+    from pkg.works_absolute_import import foo # $ tracked
+    print(foo) # $ tracked
+
+test_works_absolute_import()
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/pkg/works_absolute_import.py b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/works_absolute_import.py
new file mode 100644
index 00000000000..3199bb24a15
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/pkg/works_absolute_import.py
@@ -0,0 +1,2 @@
+from pkg.other import *
+from pkg.foo_def import foo # $ tracked
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/tracked.expected b/python/ql/test/experimental/dataflow/typetracking_imports/tracked.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/python/ql/test/experimental/dataflow/typetracking_imports/tracked.qlref b/python/ql/test/experimental/dataflow/typetracking_imports/tracked.qlref
new file mode 100644
index 00000000000..2c005903470
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking_imports/tracked.qlref
@@ -0,0 +1 @@
+../typetracking/tracked.ql
diff --git a/python/ql/test/experimental/meta/ConceptsTest.qll b/python/ql/test/experimental/meta/ConceptsTest.qll
index c792a7005b4..9690b7b1497 100644
--- a/python/ql/test/experimental/meta/ConceptsTest.qll
+++ b/python/ql/test/experimental/meta/ConceptsTest.qll
@@ -239,7 +239,7 @@ class HttpServerRouteSetupTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(location.getFile().getRelativePath()) and
-    exists(HTTP::Server::RouteSetup setup |
+    exists(Http::Server::RouteSetup setup |
       location = setup.getLocation() and
       element = setup.toString() and
       (
@@ -261,14 +261,14 @@ class HttpServerRequestHandlerTest extends InlineExpectationsTest {
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(location.getFile().getRelativePath()) and
     (
-      exists(HTTP::Server::RequestHandler handler |
+      exists(Http::Server::RequestHandler handler |
         location = handler.getLocation() and
         element = handler.toString() and
         value = "" and
         tag = "requestHandler"
       )
       or
-      exists(HTTP::Server::RequestHandler handler, Parameter param |
+      exists(Http::Server::RequestHandler handler, Parameter param |
         param = handler.getARoutedParameter() and
         location = param.getLocation() and
         element = param.toString() and
@@ -299,21 +299,21 @@ class HttpServerHttpResponseTest extends InlineExpectationsTest {
     // we need to do this step since we expect subclasses could override getARelevantTag
     tag = getARelevantTag() and
     (
-      exists(HTTP::Server::HttpResponse response |
+      exists(Http::Server::HttpResponse response |
         location = response.getLocation() and
         element = response.toString() and
         value = "" and
         tag = "HttpResponse"
       )
       or
-      exists(HTTP::Server::HttpResponse response |
+      exists(Http::Server::HttpResponse response |
         location = response.getLocation() and
         element = response.toString() and
         value = prettyNodeForInlineTest(response.getBody()) and
         tag = "responseBody"
       )
       or
-      exists(HTTP::Server::HttpResponse response |
+      exists(Http::Server::HttpResponse response |
         location = response.getLocation() and
         element = response.toString() and
         // Ensure that an expectation value such as "mimetype=text/html; charset=utf-8" is parsed as a
@@ -338,14 +338,14 @@ class HttpServerHttpRedirectResponseTest extends InlineExpectationsTest {
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(location.getFile().getRelativePath()) and
     (
-      exists(HTTP::Server::HttpRedirectResponse redirect |
+      exists(Http::Server::HttpRedirectResponse redirect |
         location = redirect.getLocation() and
         element = redirect.toString() and
         value = "" and
         tag = "HttpRedirectResponse"
       )
       or
-      exists(HTTP::Server::HttpRedirectResponse redirect |
+      exists(Http::Server::HttpRedirectResponse redirect |
         location = redirect.getLocation() and
         element = redirect.toString() and
         value = prettyNodeForInlineTest(redirect.getRedirectLocation()) and
@@ -364,7 +364,7 @@ class HttpServerCookieWriteTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(location.getFile().getRelativePath()) and
-    exists(HTTP::Server::CookieWrite cookieWrite |
+    exists(Http::Server::CookieWrite cookieWrite |
       location = cookieWrite.getLocation() and
       (
         element = cookieWrite.toString() and
@@ -519,7 +519,7 @@ class HttpClientRequestTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(location.getFile().getRelativePath()) and
-    exists(HTTP::Client::Request req, DataFlow::Node url |
+    exists(Http::Client::Request req, DataFlow::Node url |
       url = req.getAUrlPart() and
       location = url.getLocation() and
       element = url.toString() and
@@ -528,7 +528,7 @@ class HttpClientRequestTest extends InlineExpectationsTest {
     )
     or
     exists(location.getFile().getRelativePath()) and
-    exists(HTTP::Client::Request req |
+    exists(Http::Client::Request req |
       req.disablesCertificateValidation(_, _) and
       location = req.getLocation() and
       element = req.toString() and
@@ -545,7 +545,7 @@ class CsrfProtectionSettingTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(location.getFile().getRelativePath()) and
-    exists(HTTP::Server::CsrfProtectionSetting setting |
+    exists(Http::Server::CsrfProtectionSetting setting |
       location = setting.getLocation() and
       element = setting.toString() and
       value = setting.getVerificationSetting().toString() and
@@ -561,7 +561,7 @@ class CsrfLocalProtectionSettingTest extends InlineExpectationsTest {
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(location.getFile().getRelativePath()) and
-    exists(HTTP::Server::CsrfLocalProtectionSetting p |
+    exists(Http::Server::CsrfLocalProtectionSetting p |
       location = p.getLocation() and
       element = p.toString() and
       value = p.getRequestHandler().getName().toString() and
diff --git a/python/ql/test/library-tests/ApiGraphs/py3/test_entry_point.py b/python/ql/test/library-tests/ApiGraphs/py3/test_entry_point.py
new file mode 100644
index 00000000000..17d0cfacc4b
--- /dev/null
+++ b/python/ql/test/library-tests/ApiGraphs/py3/test_entry_point.py
@@ -0,0 +1,2 @@
+"magic_string".foo.bar #$ use=entryPoint("CustomEntryPoint").getMember("foo").getMember("bar")
+"magic_string2".foo.bar
diff --git a/python/ql/test/library-tests/ApiGraphs/py3/verifyApiGraphs.ql b/python/ql/test/library-tests/ApiGraphs/py3/verifyApiGraphs.ql
index 477ed4454fb..c1f7e8ad5e1 100644
--- a/python/ql/test/library-tests/ApiGraphs/py3/verifyApiGraphs.ql
+++ b/python/ql/test/library-tests/ApiGraphs/py3/verifyApiGraphs.ql
@@ -1,3 +1,11 @@
 // Note: This is not using standard inline-expectation tests, so will not alert if you
 // have not manually added an annotation to a line!
 import TestUtilities.VerifyApiGraphs
+
+class CustomEntryPoint extends API::EntryPoint {
+  CustomEntryPoint() { this = "CustomEntryPoint" }
+
+  override DataFlow::LocalSourceNode getASource() {
+    result.asExpr().(StrConst).getText() = "magic_string"
+  }
+}
diff --git a/python/ql/test/library-tests/PointsTo/new/ImpliesDataflow.expected b/python/ql/test/library-tests/PointsTo/new/ImpliesDataflow.expected
index 7258d55076a..5dcf739c068 100644
--- a/python/ql/test/library-tests/PointsTo/new/ImpliesDataflow.expected
+++ b/python/ql/test/library-tests/PointsTo/new/ImpliesDataflow.expected
@@ -12,6 +12,5 @@
 | code/q_super.py:37:14:37:17 | ControlFlowNode for self | code/q_super.py:27:32:27:35 | ControlFlowNode for self |
 | code/q_super.py:48:5:48:17 | ControlFlowNode for ClassExpr | code/q_super.py:51:25:51:29 | ControlFlowNode for Attribute |
 | code/q_super.py:63:5:63:17 | ControlFlowNode for ClassExpr | code/q_super.py:66:19:66:23 | ControlFlowNode for Attribute |
-| code/r_regressions.py:46:1:46:14 | ControlFlowNode for FunctionExpr | code/r_regressions.py:52:9:52:12 | ControlFlowNode for fail |
 | code/t_type.py:3:1:3:16 | ControlFlowNode for ClassExpr | code/t_type.py:6:1:6:9 | ControlFlowNode for type() |
 | code/t_type.py:3:1:3:16 | ControlFlowNode for ClassExpr | code/t_type.py:13:5:13:13 | ControlFlowNode for type() |
diff --git a/python/ql/test/library-tests/frameworks/data/test.ql b/python/ql/test/library-tests/frameworks/data/test.ql
index cdd1782052a..00411a5f95f 100644
--- a/python/ql/test/library-tests/frameworks/data/test.ql
+++ b/python/ql/test/library-tests/frameworks/data/test.ql
@@ -1,5 +1,5 @@
 import python
-import semmle.python.frameworks.data.internal.AccessPathSyntax as AccessPathSyntax
+import semmle.python.dataflow.new.internal.AccessPathSyntax as AccessPathSyntax
 import semmle.python.frameworks.data.ModelsAsData
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.dataflow.new.DataFlow
diff --git a/python/ql/test/library-tests/frameworks/data/warnings.ql b/python/ql/test/library-tests/frameworks/data/warnings.ql
index 3443233179e..20b87211765 100644
--- a/python/ql/test/library-tests/frameworks/data/warnings.ql
+++ b/python/ql/test/library-tests/frameworks/data/warnings.ql
@@ -1,5 +1,5 @@
 import python
-import semmle.python.frameworks.data.internal.AccessPathSyntax as AccessPathSyntax
+import semmle.python.dataflow.new.internal.AccessPathSyntax as AccessPathSyntax
 import semmle.python.frameworks.data.internal.ApiGraphModels as ApiGraphModels
 import semmle.python.frameworks.data.ModelsAsData
 
diff --git a/python/ql/test/library-tests/frameworks/django-orm/NormalDataflowTest.expected b/python/ql/test/library-tests/frameworks/django-orm/NormalDataflowTest.expected
index dd7fb126526..3875da4e143 100644
--- a/python/ql/test/library-tests/frameworks/django-orm/NormalDataflowTest.expected
+++ b/python/ql/test/library-tests/frameworks/django-orm/NormalDataflowTest.expected
@@ -1,2 +1,2 @@
-missingAnnotationOnSINK
+missingAnnotationOnSink
 failures
diff --git a/python/ql/test/library-tests/variables/scopes/access.expected b/python/ql/test/library-tests/variables/scopes/access.expected
new file mode 100644
index 00000000000..5706e86b1d1
--- /dev/null
+++ b/python/ql/test/library-tests/variables/scopes/access.expected
@@ -0,0 +1,124 @@
+| in_class.py:0:0:0:0 | Module in_class | Global Variable MyClass | in_class.py:5:7:5:13 | MyClass |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable MyClass | in_class.py:33:6:33:12 | MyClass |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable MyClass | in_class.py:41:7:41:13 | MyClass |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable NameError | in_class.py:17:16:17:24 | NameError |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable bar | in_class.py:2:1:2:3 | bar |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable bar | in_class.py:14:15:14:17 | bar |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable baz | in_class.py:16:19:16:21 | baz |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable foo | in_class.py:1:1:1:3 | foo |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable foo | in_class.py:13:15:13:17 | foo |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable foo | in_class.py:31:17:31:19 | foo |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable mc | in_class.py:33:1:33:2 | mc |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable mc | in_class.py:35:1:35:2 | mc |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable mc | in_class.py:38:7:38:8 | mc |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable object | in_class.py:5:15:5:20 | object |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable object | in_class.py:30:15:30:20 | object |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:9:9:9:13 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:12:9:12:13 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:13:9:13:13 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:14:9:14:13 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:16:13:16:17 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:20:9:20:13 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:21:9:21:13 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:22:9:22:13 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:25:9:25:13 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:34:1:34:5 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:37:1:37:5 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:38:1:38:5 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:40:1:40:5 | print |
+| in_class.py:0:0:0:0 | Module in_class | Global Variable print | in_class.py:41:1:41:5 | print |
+| in_class.py:5:1:5:22 | Class MyClass | Local Variable Sub | in_class.py:30:11:30:13 | Sub |
+| in_class.py:5:1:5:22 | Class MyClass | Local Variable baz | in_class.py:6:5:6:7 | baz |
+| in_class.py:5:1:5:22 | Class MyClass | Local Variable baz | in_class.py:28:15:28:17 | baz |
+| in_class.py:5:1:5:22 | Class MyClass | Local Variable ex | in_class.py:28:5:28:6 | ex |
+| in_class.py:5:1:5:22 | Class MyClass | Local Variable foo | in_class.py:8:9:8:11 | foo |
+| in_class.py:5:1:5:22 | Class MyClass | Local Variable func | in_class.py:24:9:24:12 | func |
+| in_class.py:5:1:5:22 | Class MyClass | Local Variable func | in_class.py:28:10:28:13 | func |
+| in_class.py:5:1:5:22 | Class MyClass | Local Variable use | in_class.py:11:9:11:11 | use |
+| in_class.py:8:5:8:18 | Function foo | Local Variable self | in_class.py:8:13:8:16 | self |
+| in_class.py:11:5:11:18 | Function use | Local Variable self | in_class.py:11:13:11:16 | self |
+| in_class.py:11:5:11:18 | Function use | Local Variable self | in_class.py:21:15:21:18 | self |
+| in_class.py:11:5:11:18 | Function use | Local Variable self | in_class.py:22:15:22:18 | self |
+| in_class.py:24:5:24:18 | Function func | Local Variable arg | in_class.py:24:14:24:16 | arg |
+| in_class.py:24:5:24:18 | Function func | Local Variable arg | in_class.py:25:27:25:29 | arg |
+| in_class.py:30:5:30:22 | Class Sub | Local Variable stuff | in_class.py:31:9:31:13 | stuff |
+| test.py:0:0:0:0 | Module test | Global Variable C | test.py:30:7:30:7 | C |
+| test.py:0:0:0:0 | Module test | Global Variable base | test.py:30:9:30:12 | base |
+| test.py:0:0:0:0 | Module test | Global Variable func0 | test.py:5:5:5:9 | func0 |
+| test.py:0:0:0:0 | Module test | Global Variable func1 | test.py:8:5:8:9 | func1 |
+| test.py:0:0:0:0 | Module test | Global Variable func2 | test.py:15:5:15:9 | func2 |
+| test.py:0:0:0:0 | Module test | Global Variable func3 | test.py:22:5:22:9 | func3 |
+| test.py:0:0:0:0 | Module test | Global Variable func4 | test.py:38:5:38:9 | func4 |
+| test.py:0:0:0:0 | Module test | Global Variable func5 | test.py:44:5:44:9 | func5 |
+| test.py:0:0:0:0 | Module test | Global Variable func6 | test.py:47:5:47:9 | func6 |
+| test.py:0:0:0:0 | Module test | Global Variable global0 | test.py:2:1:2:7 | global0 |
+| test.py:0:0:0:0 | Module test | Global Variable global0 | test.py:13:5:13:11 | global0 |
+| test.py:0:0:0:0 | Module test | Global Variable global1 | test.py:3:1:3:7 | global1 |
+| test.py:0:0:0:0 | Module test | Global Variable global1 | test.py:13:33:13:39 | global1 |
+| test.py:0:0:0:0 | Module test | Global Variable global_local | test.py:12:5:12:16 | global_local |
+| test.py:0:0:0:0 | Module test | Global Variable range | test.py:52:17:52:21 | range |
+| test.py:0:0:0:0 | Module test | Global Variable seq | test.py:48:26:48:28 | seq |
+| test.py:0:0:0:0 | Module test | Global Variable use_in_loop | test.py:51:5:51:15 | use_in_loop |
+| test.py:5:1:5:26 | Function func0 | Local Variable param0 | test.py:5:11:5:16 | param0 |
+| test.py:5:1:5:26 | Function func0 | Local Variable param0 | test.py:6:12:6:17 | param0 |
+| test.py:5:1:5:26 | Function func0 | Local Variable param1 | test.py:5:19:5:24 | param1 |
+| test.py:5:1:5:26 | Function func0 | Local Variable param1 | test.py:6:21:6:26 | param1 |
+| test.py:8:1:8:12 | Function func1 | Local Variable local0 | test.py:10:5:10:10 | local0 |
+| test.py:8:1:8:12 | Function func1 | Local Variable local0 | test.py:13:15:13:20 | local0 |
+| test.py:8:1:8:12 | Function func1 | Local Variable local1 | test.py:11:5:11:10 | local1 |
+| test.py:8:1:8:12 | Function func1 | Local Variable local1 | test.py:13:24:13:29 | local1 |
+| test.py:15:1:15:12 | Function func2 | Local Variable inner1 | test.py:17:9:17:14 | inner1 |
+| test.py:15:1:15:12 | Function func2 | Local Variable inner1 | test.py:20:12:20:17 | inner1 |
+| test.py:15:1:15:12 | Function func2 | Local Variable local2 | test.py:16:5:16:10 | local2 |
+| test.py:15:1:15:12 | Function func2 | Local Variable local2 | test.py:18:18:18:23 | local2 |
+| test.py:17:5:17:23 | Function inner1 | Local Variable local3 | test.py:18:9:18:14 | local3 |
+| test.py:17:5:17:23 | Function inner1 | Local Variable local3 | test.py:19:16:19:21 | local3 |
+| test.py:17:5:17:23 | Function inner1 | Local Variable param2 | test.py:17:16:17:21 | param2 |
+| test.py:22:1:22:26 | Function func3 | Local Variable inner_outer | test.py:24:9:24:19 | inner_outer |
+| test.py:22:1:22:26 | Function func3 | Local Variable local4 | test.py:23:5:23:10 | local4 |
+| test.py:22:1:22:26 | Function func3 | Local Variable local4 | test.py:26:29:26:34 | local4 |
+| test.py:22:1:22:26 | Function func3 | Local Variable local4 | test.py:28:23:28:28 | local4 |
+| test.py:22:1:22:26 | Function func3 | Local Variable param4 | test.py:22:11:22:16 | param4 |
+| test.py:22:1:22:26 | Function func3 | Local Variable param4 | test.py:26:47:26:52 | param4 |
+| test.py:22:1:22:26 | Function func3 | Local Variable param4 | test.py:28:32:28:37 | param4 |
+| test.py:22:1:22:26 | Function func3 | Local Variable param5 | test.py:22:19:22:24 | param5 |
+| test.py:22:1:22:26 | Function func3 | Local Variable param5 | test.py:28:41:28:46 | param5 |
+| test.py:24:5:24:22 | Function inner_outer | Local Variable inner2 | test.py:25:13:25:18 | inner2 |
+| test.py:24:5:24:22 | Function inner_outer | Local Variable inner2 | test.py:28:16:28:21 | inner2 |
+| test.py:24:5:24:22 | Function inner_outer | Local Variable local5 | test.py:26:20:26:25 | local5 |
+| test.py:24:5:24:22 | Function inner_outer | Local Variable local5 | test.py:27:9:27:14 | local5 |
+| test.py:25:9:25:27 | Function inner2 | Local Variable param3 | test.py:25:20:25:25 | param3 |
+| test.py:25:9:25:27 | Function inner2 | Local Variable param3 | test.py:26:38:26:43 | param3 |
+| test.py:30:1:30:14 | Class C | Local Variable class_local | test.py:32:5:32:15 | class_local |
+| test.py:30:1:30:14 | Class C | Local Variable meth | test.py:34:9:34:12 | meth |
+| test.py:34:5:34:19 | Function meth | Local Variable mlocal | test.py:35:9:35:14 | mlocal |
+| test.py:34:5:34:19 | Function meth | Local Variable mlocal | test.py:36:16:36:21 | mlocal |
+| test.py:34:5:34:19 | Function meth | Local Variable self | test.py:34:14:34:17 | self |
+| test.py:34:5:34:19 | Function meth | Local Variable self | test.py:35:18:35:21 | self |
+| test.py:38:1:38:18 | Function func4 | Local Variable Local | test.py:39:11:39:15 | Local |
+| test.py:38:1:38:18 | Function func4 | Local Variable Local | test.py:42:12:42:16 | Local |
+| test.py:38:1:38:18 | Function func4 | Local Variable param6 | test.py:38:11:38:16 | param6 |
+| test.py:38:1:38:18 | Function func4 | Local Variable param6 | test.py:41:20:41:25 | param6 |
+| test.py:39:5:39:16 | Class Local | Local Variable meth_inner | test.py:40:13:40:22 | meth_inner |
+| test.py:40:9:40:29 | Function meth_inner | Local Variable self | test.py:40:24:40:27 | self |
+| test.py:44:1:44:15 | Function func5 | Local Variable seq | test.py:44:11:44:13 | seq |
+| test.py:44:1:44:15 | Function func5 | Local Variable seq | test.py:45:24:45:26 | seq |
+| test.py:45:12:45:27 | Function listcomp | Local Variable .0 | test.py:45:12:45:27 | .0 |
+| test.py:45:12:45:27 | Function listcomp | Local Variable .0 | test.py:45:12:45:27 | .0 |
+| test.py:45:12:45:27 | Function listcomp | Local Variable x | test.py:45:13:45:13 | x |
+| test.py:45:12:45:27 | Function listcomp | Local Variable x | test.py:45:19:45:19 | x |
+| test.py:47:1:47:16 | Function func6 | Local Variable y | test.py:47:11:47:11 | y |
+| test.py:47:1:47:16 | Function func6 | Local Variable z | test.py:47:14:47:14 | z |
+| test.py:47:1:47:16 | Function func6 | Local Variable z | test.py:48:15:48:15 | z |
+| test.py:48:12:48:29 | Function listcomp | Local Variable .0 | test.py:48:12:48:29 | .0 |
+| test.py:48:12:48:29 | Function listcomp | Local Variable .0 | test.py:48:12:48:29 | .0 |
+| test.py:48:12:48:29 | Function listcomp | Local Variable y | test.py:48:13:48:13 | y |
+| test.py:48:12:48:29 | Function listcomp | Local Variable y | test.py:48:21:48:21 | y |
+| test.py:51:1:51:21 | Function use_in_loop | Local Variable seq | test.py:51:17:51:19 | seq |
+| test.py:51:1:51:21 | Function use_in_loop | Local Variable seq | test.py:53:14:53:16 | seq |
+| test.py:51:1:51:21 | Function use_in_loop | Local Variable v | test.py:53:9:53:9 | v |
+| test.py:51:1:51:21 | Function use_in_loop | Local Variable v | test.py:54:9:54:9 | v |
+| test.py:52:5:52:25 | Function listcomp | Local Variable .0 | test.py:52:5:52:25 | .0 |
+| test.py:52:5:52:25 | Function listcomp | Local Variable .0 | test.py:52:5:52:25 | .0 |
+| test.py:52:5:52:25 | Function listcomp | Local Variable v | test.py:52:6:52:6 | v |
+| test.py:52:5:52:25 | Function listcomp | Local Variable v | test.py:52:12:52:12 | v |
diff --git a/python/ql/test/library-tests/variables/scopes/access.ql b/python/ql/test/library-tests/variables/scopes/access.ql
new file mode 100644
index 00000000000..96ba0eddcfb
--- /dev/null
+++ b/python/ql/test/library-tests/variables/scopes/access.ql
@@ -0,0 +1,7 @@
+import python
+
+from Variable v, Scope s, Name n
+where
+  n = v.getAnAccess() and
+  s = v.getScope()
+select s, v, n
diff --git a/python/ql/test/library-tests/variables/scopes/free.expected b/python/ql/test/library-tests/variables/scopes/free.expected
index 3277eb55dd6..e379ea3fb47 100644
--- a/python/ql/test/library-tests/variables/scopes/free.expected
+++ b/python/ql/test/library-tests/variables/scopes/free.expected
@@ -1,9 +1,9 @@
-| Local Variable local2 | Function func2 | Function inner1 |
-| Local Variable local4 | Function func3 | Function inner2 |
-| Local Variable local4 | Function func3 | Function inner_outer |
-| Local Variable local5 | Function inner_outer | Function inner2 |
-| Local Variable param4 | Function func3 | Function inner2 |
-| Local Variable param4 | Function func3 | Function inner_outer |
-| Local Variable param5 | Function func3 | Function inner_outer |
-| Local Variable param6 | Function func4 | Function meth_inner |
-| Local Variable z | Function func6 | Function listcomp |
+| Local Variable local2 | test.py:15:1:15:12 | Function func2 | test.py:17:5:17:23 | Function inner1 |
+| Local Variable local4 | test.py:22:1:22:26 | Function func3 | test.py:24:5:24:22 | Function inner_outer |
+| Local Variable local4 | test.py:22:1:22:26 | Function func3 | test.py:25:9:25:27 | Function inner2 |
+| Local Variable local5 | test.py:24:5:24:22 | Function inner_outer | test.py:25:9:25:27 | Function inner2 |
+| Local Variable param4 | test.py:22:1:22:26 | Function func3 | test.py:24:5:24:22 | Function inner_outer |
+| Local Variable param4 | test.py:22:1:22:26 | Function func3 | test.py:25:9:25:27 | Function inner2 |
+| Local Variable param5 | test.py:22:1:22:26 | Function func3 | test.py:24:5:24:22 | Function inner_outer |
+| Local Variable param6 | test.py:38:1:38:18 | Function func4 | test.py:40:9:40:29 | Function meth_inner |
+| Local Variable z | test.py:47:1:47:16 | Function func6 | test.py:48:12:48:29 | Function listcomp |
diff --git a/python/ql/test/library-tests/variables/scopes/free.ql b/python/ql/test/library-tests/variables/scopes/free.ql
index cd5e0325de0..f396514e272 100644
--- a/python/ql/test/library-tests/variables/scopes/free.ql
+++ b/python/ql/test/library-tests/variables/scopes/free.ql
@@ -5,4 +5,4 @@ where
   v.escapes() and
   inner = v.getAnAccess().getScope() and
   inner != v.getScope()
-select v.toString(), v.getScope().toString(), inner.toString()
+select v, v.getScope(), inner
diff --git a/python/ql/test/library-tests/variables/scopes/globals.expected b/python/ql/test/library-tests/variables/scopes/globals.expected
index c0ed16f7582..6ecad1addd5 100644
--- a/python/ql/test/library-tests/variables/scopes/globals.expected
+++ b/python/ql/test/library-tests/variables/scopes/globals.expected
@@ -1,17 +1,27 @@
-| Global Variable C | Module test |
-| Global Variable __name__ | Module test |
-| Global Variable __package__ | Module test |
-| Global Variable base | Module test |
-| Global Variable func0 | Module test |
-| Global Variable func1 | Module test |
-| Global Variable func2 | Module test |
-| Global Variable func3 | Module test |
-| Global Variable func4 | Module test |
-| Global Variable func5 | Module test |
-| Global Variable func6 | Module test |
-| Global Variable global0 | Module test |
-| Global Variable global1 | Module test |
-| Global Variable global_local | Module test |
-| Global Variable range | Module test |
-| Global Variable seq | Module test |
-| Global Variable use_in_loop | Module test |
+| Global Variable C | test.py:0:0:0:0 | Module test |
+| Global Variable MyClass | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable NameError | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable __name__ | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable __name__ | test.py:0:0:0:0 | Module test |
+| Global Variable __package__ | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable __package__ | test.py:0:0:0:0 | Module test |
+| Global Variable bar | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable base | test.py:0:0:0:0 | Module test |
+| Global Variable baz | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable foo | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable func0 | test.py:0:0:0:0 | Module test |
+| Global Variable func1 | test.py:0:0:0:0 | Module test |
+| Global Variable func2 | test.py:0:0:0:0 | Module test |
+| Global Variable func3 | test.py:0:0:0:0 | Module test |
+| Global Variable func4 | test.py:0:0:0:0 | Module test |
+| Global Variable func5 | test.py:0:0:0:0 | Module test |
+| Global Variable func6 | test.py:0:0:0:0 | Module test |
+| Global Variable global0 | test.py:0:0:0:0 | Module test |
+| Global Variable global1 | test.py:0:0:0:0 | Module test |
+| Global Variable global_local | test.py:0:0:0:0 | Module test |
+| Global Variable mc | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable object | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable print | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable range | test.py:0:0:0:0 | Module test |
+| Global Variable seq | test.py:0:0:0:0 | Module test |
+| Global Variable use_in_loop | test.py:0:0:0:0 | Module test |
diff --git a/python/ql/test/library-tests/variables/scopes/globals.ql b/python/ql/test/library-tests/variables/scopes/globals.ql
index 65e572c2ab4..903872eec7b 100644
--- a/python/ql/test/library-tests/variables/scopes/globals.ql
+++ b/python/ql/test/library-tests/variables/scopes/globals.ql
@@ -1,4 +1,4 @@
 import python
 
 from GlobalVariable l
-select l.toString(), l.getScope().toString()
+select l, l.getScope()
diff --git a/python/ql/test/library-tests/variables/scopes/in_class.py b/python/ql/test/library-tests/variables/scopes/in_class.py
new file mode 100644
index 00000000000..4ce839732b8
--- /dev/null
+++ b/python/ql/test/library-tests/variables/scopes/in_class.py
@@ -0,0 +1,41 @@
+foo = "foo-text"
+bar = "bar-text"
+
+
+class MyClass(object):
+    baz = "baz"
+
+    def foo(self):
+        print("foo()")
+
+    def use(self):
+        print("! use()")
+        print(foo) # foo-text
+        print(bar) # bar-text
+        try:
+            print(baz)
+        except NameError:
+            pass
+
+        print("=== access on self ===")
+        print(self.foo)
+        print(self.baz)
+
+    def func(arg):
+        print("! func()", arg)
+        return 42
+
+    ex = func(baz)
+
+    class Sub(object):
+        stuff = foo
+
+mc = MyClass()
+print()
+mc.use()
+
+print("\n! mc.ex")
+print(mc.ex)
+
+print("\n! MyClass.Sub.stuff")
+print(MyClass.Sub().stuff) # foo-text
diff --git a/python/ql/test/library-tests/variables/scopes/locals.expected b/python/ql/test/library-tests/variables/scopes/locals.expected
index 1a662bdb671..91f93cf2527 100644
--- a/python/ql/test/library-tests/variables/scopes/locals.expected
+++ b/python/ql/test/library-tests/variables/scopes/locals.expected
@@ -2,7 +2,13 @@
 | Local Variable .0 | test.py:48:12:48:29 | Function listcomp | fast |
 | Local Variable .0 | test.py:52:5:52:25 | Function listcomp | fast |
 | Local Variable Local | test.py:38:1:38:18 | Function func4 | fast |
+| Local Variable Sub | in_class.py:5:1:5:22 | Class MyClass | name |
+| Local Variable arg | in_class.py:24:5:24:18 | Function func | fast |
+| Local Variable baz | in_class.py:5:1:5:22 | Class MyClass | name |
 | Local Variable class_local | test.py:30:1:30:14 | Class C | name |
+| Local Variable ex | in_class.py:5:1:5:22 | Class MyClass | name |
+| Local Variable foo | in_class.py:5:1:5:22 | Class MyClass | name |
+| Local Variable func | in_class.py:5:1:5:22 | Class MyClass | name |
 | Local Variable inner1 | test.py:15:1:15:12 | Function func2 | fast |
 | Local Variable inner2 | test.py:24:5:24:22 | Function inner_outer | fast |
 | Local Variable inner_outer | test.py:22:1:22:26 | Function func3 | fast |
@@ -22,10 +28,14 @@
 | Local Variable param4 | test.py:22:1:22:26 | Function func3 | fast |
 | Local Variable param5 | test.py:22:1:22:26 | Function func3 | fast |
 | Local Variable param6 | test.py:38:1:38:18 | Function func4 | fast |
+| Local Variable self | in_class.py:8:5:8:18 | Function foo | fast |
+| Local Variable self | in_class.py:11:5:11:18 | Function use | fast |
 | Local Variable self | test.py:34:5:34:19 | Function meth | fast |
 | Local Variable self | test.py:40:9:40:29 | Function meth_inner | fast |
 | Local Variable seq | test.py:44:1:44:15 | Function func5 | fast |
 | Local Variable seq | test.py:51:1:51:21 | Function use_in_loop | fast |
+| Local Variable stuff | in_class.py:30:5:30:22 | Class Sub | name |
+| Local Variable use | in_class.py:5:1:5:22 | Class MyClass | name |
 | Local Variable v | test.py:51:1:51:21 | Function use_in_loop | fast |
 | Local Variable v | test.py:52:5:52:25 | Function listcomp | fast |
 | Local Variable x | test.py:45:12:45:27 | Function listcomp | fast |
diff --git a/python/ql/test/library-tests/variables/scopes/lookup.expected b/python/ql/test/library-tests/variables/scopes/lookup.expected
index 2418f1d9283..daee16f7914 100644
--- a/python/ql/test/library-tests/variables/scopes/lookup.expected
+++ b/python/ql/test/library-tests/variables/scopes/lookup.expected
@@ -1,34 +1,64 @@
-| 6 | ControlFlowNode for param0 | local |
-| 6 | ControlFlowNode for param1 | local |
-| 12 | ControlFlowNode for global_local | global |
-| 13 | ControlFlowNode for global1 | global |
-| 13 | ControlFlowNode for local0 | local |
-| 13 | ControlFlowNode for local1 | local |
-| 18 | ControlFlowNode for local2 | non-local |
-| 19 | ControlFlowNode for local3 | local |
-| 20 | ControlFlowNode for inner1 | local |
-| 26 | ControlFlowNode for local4 | non-local |
-| 26 | ControlFlowNode for local5 | non-local |
-| 26 | ControlFlowNode for param3 | local |
-| 26 | ControlFlowNode for param4 | non-local |
-| 28 | ControlFlowNode for inner2 | local |
-| 28 | ControlFlowNode for local4 | non-local |
-| 28 | ControlFlowNode for param4 | non-local |
-| 28 | ControlFlowNode for param5 | non-local |
-| 30 | ControlFlowNode for base | global |
-| 35 | ControlFlowNode for self | local |
-| 36 | ControlFlowNode for mlocal | local |
-| 41 | ControlFlowNode for param6 | non-local |
-| 42 | ControlFlowNode for Local | local |
-| 45 | ControlFlowNode for .0 | local |
-| 45 | ControlFlowNode for seq | local |
-| 45 | ControlFlowNode for x | local |
-| 48 | ControlFlowNode for .0 | local |
-| 48 | ControlFlowNode for seq | global |
-| 48 | ControlFlowNode for y | local |
-| 48 | ControlFlowNode for z | non-local |
-| 52 | ControlFlowNode for .0 | local |
-| 52 | ControlFlowNode for range | global |
-| 52 | ControlFlowNode for v | local |
-| 53 | ControlFlowNode for seq | local |
-| 54 | ControlFlowNode for v | local |
+| in_class.py:5:15:5:20 | ControlFlowNode for object | global |
+| in_class.py:9:9:9:13 | ControlFlowNode for print | global |
+| in_class.py:12:9:12:13 | ControlFlowNode for print | global |
+| in_class.py:13:9:13:13 | ControlFlowNode for print | global |
+| in_class.py:13:15:13:17 | ControlFlowNode for foo | global |
+| in_class.py:14:9:14:13 | ControlFlowNode for print | global |
+| in_class.py:14:15:14:17 | ControlFlowNode for bar | global |
+| in_class.py:16:13:16:17 | ControlFlowNode for print | global |
+| in_class.py:16:19:16:21 | ControlFlowNode for baz | global |
+| in_class.py:17:16:17:24 | ControlFlowNode for NameError | global |
+| in_class.py:20:9:20:13 | ControlFlowNode for print | global |
+| in_class.py:21:9:21:13 | ControlFlowNode for print | global |
+| in_class.py:21:15:21:18 | ControlFlowNode for self | local |
+| in_class.py:22:9:22:13 | ControlFlowNode for print | global |
+| in_class.py:22:15:22:18 | ControlFlowNode for self | local |
+| in_class.py:25:9:25:13 | ControlFlowNode for print | global |
+| in_class.py:25:27:25:29 | ControlFlowNode for arg | local |
+| in_class.py:28:10:28:13 | ControlFlowNode for func | local |
+| in_class.py:28:15:28:17 | ControlFlowNode for baz | local |
+| in_class.py:30:15:30:20 | ControlFlowNode for object | global |
+| in_class.py:31:17:31:19 | ControlFlowNode for foo | global |
+| in_class.py:33:6:33:12 | ControlFlowNode for MyClass | global |
+| in_class.py:34:1:34:5 | ControlFlowNode for print | global |
+| in_class.py:35:1:35:2 | ControlFlowNode for mc | global |
+| in_class.py:37:1:37:5 | ControlFlowNode for print | global |
+| in_class.py:38:1:38:5 | ControlFlowNode for print | global |
+| in_class.py:38:7:38:8 | ControlFlowNode for mc | global |
+| in_class.py:40:1:40:5 | ControlFlowNode for print | global |
+| in_class.py:41:1:41:5 | ControlFlowNode for print | global |
+| in_class.py:41:7:41:13 | ControlFlowNode for MyClass | global |
+| test.py:6:12:6:17 | ControlFlowNode for param0 | local |
+| test.py:6:21:6:26 | ControlFlowNode for param1 | local |
+| test.py:12:5:12:16 | ControlFlowNode for global_local | global |
+| test.py:13:15:13:20 | ControlFlowNode for local0 | local |
+| test.py:13:24:13:29 | ControlFlowNode for local1 | local |
+| test.py:13:33:13:39 | ControlFlowNode for global1 | global |
+| test.py:18:18:18:23 | ControlFlowNode for local2 | non-local |
+| test.py:19:16:19:21 | ControlFlowNode for local3 | local |
+| test.py:20:12:20:17 | ControlFlowNode for inner1 | local |
+| test.py:26:20:26:25 | ControlFlowNode for local5 | non-local |
+| test.py:26:29:26:34 | ControlFlowNode for local4 | non-local |
+| test.py:26:38:26:43 | ControlFlowNode for param3 | local |
+| test.py:26:47:26:52 | ControlFlowNode for param4 | non-local |
+| test.py:28:16:28:21 | ControlFlowNode for inner2 | local |
+| test.py:28:23:28:28 | ControlFlowNode for local4 | non-local |
+| test.py:28:32:28:37 | ControlFlowNode for param4 | non-local |
+| test.py:28:41:28:46 | ControlFlowNode for param5 | non-local |
+| test.py:30:9:30:12 | ControlFlowNode for base | global |
+| test.py:35:18:35:21 | ControlFlowNode for self | local |
+| test.py:36:16:36:21 | ControlFlowNode for mlocal | local |
+| test.py:41:20:41:25 | ControlFlowNode for param6 | non-local |
+| test.py:42:12:42:16 | ControlFlowNode for Local | local |
+| test.py:45:12:45:27 | ControlFlowNode for .0 | local |
+| test.py:45:13:45:13 | ControlFlowNode for x | local |
+| test.py:45:24:45:26 | ControlFlowNode for seq | local |
+| test.py:48:12:48:29 | ControlFlowNode for .0 | local |
+| test.py:48:13:48:13 | ControlFlowNode for y | local |
+| test.py:48:15:48:15 | ControlFlowNode for z | non-local |
+| test.py:48:26:48:28 | ControlFlowNode for seq | global |
+| test.py:52:5:52:25 | ControlFlowNode for .0 | local |
+| test.py:52:6:52:6 | ControlFlowNode for v | local |
+| test.py:52:17:52:21 | ControlFlowNode for range | global |
+| test.py:53:14:53:16 | ControlFlowNode for seq | local |
+| test.py:54:9:54:9 | ControlFlowNode for v | local |
diff --git a/python/ql/test/library-tests/variables/scopes/lookup.ql b/python/ql/test/library-tests/variables/scopes/lookup.ql
index 84dfaac48b5..03368dff847 100644
--- a/python/ql/test/library-tests/variables/scopes/lookup.ql
+++ b/python/ql/test/library-tests/variables/scopes/lookup.ql
@@ -15,4 +15,4 @@ where
     not n.isNonLocal() and
     l = "none"
   )
-select n.getLocation().getStartLine(), n.toString(), l
+select n, l
diff --git a/python/ql/test/library-tests/variables/scopes/scopes.expected b/python/ql/test/library-tests/variables/scopes/scopes.expected
index cf4a6edbfbb..365fe38014b 100644
--- a/python/ql/test/library-tests/variables/scopes/scopes.expected
+++ b/python/ql/test/library-tests/variables/scopes/scopes.expected
@@ -1,7 +1,14 @@
 | Global Variable C | test.py:0:0:0:0 | Module test |
+| Global Variable MyClass | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable NameError | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable __name__ | in_class.py:0:0:0:0 | Module in_class |
 | Global Variable __name__ | test.py:0:0:0:0 | Module test |
+| Global Variable __package__ | in_class.py:0:0:0:0 | Module in_class |
 | Global Variable __package__ | test.py:0:0:0:0 | Module test |
+| Global Variable bar | in_class.py:0:0:0:0 | Module in_class |
 | Global Variable base | test.py:0:0:0:0 | Module test |
+| Global Variable baz | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable foo | in_class.py:0:0:0:0 | Module in_class |
 | Global Variable func0 | test.py:0:0:0:0 | Module test |
 | Global Variable func1 | test.py:0:0:0:0 | Module test |
 | Global Variable func2 | test.py:0:0:0:0 | Module test |
@@ -12,6 +19,9 @@
 | Global Variable global0 | test.py:0:0:0:0 | Module test |
 | Global Variable global1 | test.py:0:0:0:0 | Module test |
 | Global Variable global_local | test.py:0:0:0:0 | Module test |
+| Global Variable mc | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable object | in_class.py:0:0:0:0 | Module in_class |
+| Global Variable print | in_class.py:0:0:0:0 | Module in_class |
 | Global Variable range | test.py:0:0:0:0 | Module test |
 | Global Variable seq | test.py:0:0:0:0 | Module test |
 | Global Variable use_in_loop | test.py:0:0:0:0 | Module test |
@@ -19,7 +29,13 @@
 | Local Variable .0 | test.py:48:12:48:29 | Function listcomp |
 | Local Variable .0 | test.py:52:5:52:25 | Function listcomp |
 | Local Variable Local | test.py:38:1:38:18 | Function func4 |
+| Local Variable Sub | in_class.py:5:1:5:22 | Class MyClass |
+| Local Variable arg | in_class.py:24:5:24:18 | Function func |
+| Local Variable baz | in_class.py:5:1:5:22 | Class MyClass |
 | Local Variable class_local | test.py:30:1:30:14 | Class C |
+| Local Variable ex | in_class.py:5:1:5:22 | Class MyClass |
+| Local Variable foo | in_class.py:5:1:5:22 | Class MyClass |
+| Local Variable func | in_class.py:5:1:5:22 | Class MyClass |
 | Local Variable inner1 | test.py:15:1:15:12 | Function func2 |
 | Local Variable inner2 | test.py:24:5:24:22 | Function inner_outer |
 | Local Variable inner_outer | test.py:22:1:22:26 | Function func3 |
@@ -39,10 +55,14 @@
 | Local Variable param4 | test.py:22:1:22:26 | Function func3 |
 | Local Variable param5 | test.py:22:1:22:26 | Function func3 |
 | Local Variable param6 | test.py:38:1:38:18 | Function func4 |
+| Local Variable self | in_class.py:8:5:8:18 | Function foo |
+| Local Variable self | in_class.py:11:5:11:18 | Function use |
 | Local Variable self | test.py:34:5:34:19 | Function meth |
 | Local Variable self | test.py:40:9:40:29 | Function meth_inner |
 | Local Variable seq | test.py:44:1:44:15 | Function func5 |
 | Local Variable seq | test.py:51:1:51:21 | Function use_in_loop |
+| Local Variable stuff | in_class.py:30:5:30:22 | Class Sub |
+| Local Variable use | in_class.py:5:1:5:22 | Class MyClass |
 | Local Variable v | test.py:51:1:51:21 | Function use_in_loop |
 | Local Variable v | test.py:52:5:52:25 | Function listcomp |
 | Local Variable x | test.py:45:12:45:27 | Function listcomp |
diff --git a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected
index 86daf9cb09e..71f4137f1ef 100644
--- a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected
+++ b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected
@@ -83,26 +83,26 @@ nodes
 | test.py:147:9:147:9 | ControlFlowNode for l | semmle.label | ControlFlowNode for l |
 subpaths
 #select
-| test.py:3:5:3:5 | ControlFlowNode for l | test.py:2:12:2:12 | ControlFlowNode for l | test.py:3:5:3:5 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:2:12:2:12 | ControlFlowNode for l | Default value |
-| test.py:8:5:8:5 | ControlFlowNode for l | test.py:7:11:7:11 | ControlFlowNode for l | test.py:8:5:8:5 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:7:11:7:11 | ControlFlowNode for l | Default value |
-| test.py:13:9:13:9 | ControlFlowNode for l | test.py:12:14:12:14 | ControlFlowNode for l | test.py:13:9:13:9 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:12:14:12:14 | ControlFlowNode for l | Default value |
-| test.py:18:5:18:5 | ControlFlowNode for l | test.py:17:15:17:15 | ControlFlowNode for l | test.py:18:5:18:5 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:17:15:17:15 | ControlFlowNode for l | Default value |
-| test.py:23:5:23:5 | ControlFlowNode for l | test.py:22:15:22:15 | ControlFlowNode for l | test.py:23:5:23:5 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:22:15:22:15 | ControlFlowNode for l | Default value |
-| test.py:28:5:28:5 | ControlFlowNode for l | test.py:27:12:27:12 | ControlFlowNode for l | test.py:28:5:28:5 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:27:12:27:12 | ControlFlowNode for l | Default value |
-| test.py:39:5:39:5 | ControlFlowNode for l | test.py:43:14:43:14 | ControlFlowNode for l | test.py:39:5:39:5 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:43:14:43:14 | ControlFlowNode for l | Default value |
-| test.py:49:5:49:5 | ControlFlowNode for l | test.py:48:14:48:14 | ControlFlowNode for l | test.py:49:5:49:5 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:48:14:48:14 | ControlFlowNode for l | Default value |
-| test.py:54:5:54:5 | ControlFlowNode for d | test.py:53:10:53:10 | ControlFlowNode for d | test.py:54:5:54:5 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:53:10:53:10 | ControlFlowNode for d | Default value |
-| test.py:59:5:59:5 | ControlFlowNode for d | test.py:58:19:58:19 | ControlFlowNode for d | test.py:59:5:59:5 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:58:19:58:19 | ControlFlowNode for d | Default value |
-| test.py:64:5:64:5 | ControlFlowNode for d | test.py:63:28:63:28 | ControlFlowNode for d | test.py:64:5:64:5 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:63:28:63:28 | ControlFlowNode for d | Default value |
-| test.py:68:5:68:5 | ControlFlowNode for d | test.py:72:19:72:19 | ControlFlowNode for d | test.py:68:5:68:5 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:72:19:72:19 | ControlFlowNode for d | Default value |
-| test.py:78:5:78:5 | ControlFlowNode for d | test.py:77:17:77:17 | ControlFlowNode for d | test.py:78:5:78:5 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:77:17:77:17 | ControlFlowNode for d | Default value |
-| test.py:83:5:83:5 | ControlFlowNode for d | test.py:82:26:82:26 | ControlFlowNode for d | test.py:83:5:83:5 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:82:26:82:26 | ControlFlowNode for d | Default value |
-| test.py:88:5:88:5 | ControlFlowNode for d | test.py:87:35:87:35 | ControlFlowNode for d | test.py:88:5:88:5 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:87:35:87:35 | ControlFlowNode for d | Default value |
-| test.py:92:5:92:5 | ControlFlowNode for d | test.py:96:26:96:26 | ControlFlowNode for d | test.py:92:5:92:5 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:96:26:96:26 | ControlFlowNode for d | Default value |
-| test.py:109:9:109:9 | ControlFlowNode for d | test.py:108:14:108:14 | ControlFlowNode for d | test.py:109:9:109:9 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:108:14:108:14 | ControlFlowNode for d | Default value |
-| test.py:115:5:115:5 | ControlFlowNode for d | test.py:113:20:113:20 | ControlFlowNode for d | test.py:115:5:115:5 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:113:20:113:20 | ControlFlowNode for d | Default value |
-| test.py:121:5:121:5 | ControlFlowNode for d | test.py:119:29:119:29 | ControlFlowNode for d | test.py:121:5:121:5 | ControlFlowNode for d | $@ flows to here and is mutated. | test.py:119:29:119:29 | ControlFlowNode for d | Default value |
-| test.py:128:9:128:9 | ControlFlowNode for l | test.py:124:15:124:15 | ControlFlowNode for l | test.py:128:9:128:9 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:124:15:124:15 | ControlFlowNode for l | Default value |
-| test.py:135:9:135:9 | ControlFlowNode for l | test.py:131:23:131:23 | ControlFlowNode for l | test.py:135:9:135:9 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:131:23:131:23 | ControlFlowNode for l | Default value |
-| test.py:140:9:140:9 | ControlFlowNode for l | test.py:138:15:138:15 | ControlFlowNode for l | test.py:140:9:140:9 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:138:15:138:15 | ControlFlowNode for l | Default value |
-| test.py:147:9:147:9 | ControlFlowNode for l | test.py:145:23:145:23 | ControlFlowNode for l | test.py:147:9:147:9 | ControlFlowNode for l | $@ flows to here and is mutated. | test.py:145:23:145:23 | ControlFlowNode for l | Default value |
+| test.py:3:5:3:5 | ControlFlowNode for l | test.py:2:12:2:12 | ControlFlowNode for l | test.py:3:5:3:5 | ControlFlowNode for l | This expression mutates $@. | test.py:2:12:2:12 | ControlFlowNode for l | a default value |
+| test.py:8:5:8:5 | ControlFlowNode for l | test.py:7:11:7:11 | ControlFlowNode for l | test.py:8:5:8:5 | ControlFlowNode for l | This expression mutates $@. | test.py:7:11:7:11 | ControlFlowNode for l | a default value |
+| test.py:13:9:13:9 | ControlFlowNode for l | test.py:12:14:12:14 | ControlFlowNode for l | test.py:13:9:13:9 | ControlFlowNode for l | This expression mutates $@. | test.py:12:14:12:14 | ControlFlowNode for l | a default value |
+| test.py:18:5:18:5 | ControlFlowNode for l | test.py:17:15:17:15 | ControlFlowNode for l | test.py:18:5:18:5 | ControlFlowNode for l | This expression mutates $@. | test.py:17:15:17:15 | ControlFlowNode for l | a default value |
+| test.py:23:5:23:5 | ControlFlowNode for l | test.py:22:15:22:15 | ControlFlowNode for l | test.py:23:5:23:5 | ControlFlowNode for l | This expression mutates $@. | test.py:22:15:22:15 | ControlFlowNode for l | a default value |
+| test.py:28:5:28:5 | ControlFlowNode for l | test.py:27:12:27:12 | ControlFlowNode for l | test.py:28:5:28:5 | ControlFlowNode for l | This expression mutates $@. | test.py:27:12:27:12 | ControlFlowNode for l | a default value |
+| test.py:39:5:39:5 | ControlFlowNode for l | test.py:43:14:43:14 | ControlFlowNode for l | test.py:39:5:39:5 | ControlFlowNode for l | This expression mutates $@. | test.py:43:14:43:14 | ControlFlowNode for l | a default value |
+| test.py:49:5:49:5 | ControlFlowNode for l | test.py:48:14:48:14 | ControlFlowNode for l | test.py:49:5:49:5 | ControlFlowNode for l | This expression mutates $@. | test.py:48:14:48:14 | ControlFlowNode for l | a default value |
+| test.py:54:5:54:5 | ControlFlowNode for d | test.py:53:10:53:10 | ControlFlowNode for d | test.py:54:5:54:5 | ControlFlowNode for d | This expression mutates $@. | test.py:53:10:53:10 | ControlFlowNode for d | a default value |
+| test.py:59:5:59:5 | ControlFlowNode for d | test.py:58:19:58:19 | ControlFlowNode for d | test.py:59:5:59:5 | ControlFlowNode for d | This expression mutates $@. | test.py:58:19:58:19 | ControlFlowNode for d | a default value |
+| test.py:64:5:64:5 | ControlFlowNode for d | test.py:63:28:63:28 | ControlFlowNode for d | test.py:64:5:64:5 | ControlFlowNode for d | This expression mutates $@. | test.py:63:28:63:28 | ControlFlowNode for d | a default value |
+| test.py:68:5:68:5 | ControlFlowNode for d | test.py:72:19:72:19 | ControlFlowNode for d | test.py:68:5:68:5 | ControlFlowNode for d | This expression mutates $@. | test.py:72:19:72:19 | ControlFlowNode for d | a default value |
+| test.py:78:5:78:5 | ControlFlowNode for d | test.py:77:17:77:17 | ControlFlowNode for d | test.py:78:5:78:5 | ControlFlowNode for d | This expression mutates $@. | test.py:77:17:77:17 | ControlFlowNode for d | a default value |
+| test.py:83:5:83:5 | ControlFlowNode for d | test.py:82:26:82:26 | ControlFlowNode for d | test.py:83:5:83:5 | ControlFlowNode for d | This expression mutates $@. | test.py:82:26:82:26 | ControlFlowNode for d | a default value |
+| test.py:88:5:88:5 | ControlFlowNode for d | test.py:87:35:87:35 | ControlFlowNode for d | test.py:88:5:88:5 | ControlFlowNode for d | This expression mutates $@. | test.py:87:35:87:35 | ControlFlowNode for d | a default value |
+| test.py:92:5:92:5 | ControlFlowNode for d | test.py:96:26:96:26 | ControlFlowNode for d | test.py:92:5:92:5 | ControlFlowNode for d | This expression mutates $@. | test.py:96:26:96:26 | ControlFlowNode for d | a default value |
+| test.py:109:9:109:9 | ControlFlowNode for d | test.py:108:14:108:14 | ControlFlowNode for d | test.py:109:9:109:9 | ControlFlowNode for d | This expression mutates $@. | test.py:108:14:108:14 | ControlFlowNode for d | a default value |
+| test.py:115:5:115:5 | ControlFlowNode for d | test.py:113:20:113:20 | ControlFlowNode for d | test.py:115:5:115:5 | ControlFlowNode for d | This expression mutates $@. | test.py:113:20:113:20 | ControlFlowNode for d | a default value |
+| test.py:121:5:121:5 | ControlFlowNode for d | test.py:119:29:119:29 | ControlFlowNode for d | test.py:121:5:121:5 | ControlFlowNode for d | This expression mutates $@. | test.py:119:29:119:29 | ControlFlowNode for d | a default value |
+| test.py:128:9:128:9 | ControlFlowNode for l | test.py:124:15:124:15 | ControlFlowNode for l | test.py:128:9:128:9 | ControlFlowNode for l | This expression mutates $@. | test.py:124:15:124:15 | ControlFlowNode for l | a default value |
+| test.py:135:9:135:9 | ControlFlowNode for l | test.py:131:23:131:23 | ControlFlowNode for l | test.py:135:9:135:9 | ControlFlowNode for l | This expression mutates $@. | test.py:131:23:131:23 | ControlFlowNode for l | a default value |
+| test.py:140:9:140:9 | ControlFlowNode for l | test.py:138:15:138:15 | ControlFlowNode for l | test.py:140:9:140:9 | ControlFlowNode for l | This expression mutates $@. | test.py:138:15:138:15 | ControlFlowNode for l | a default value |
+| test.py:147:9:147:9 | ControlFlowNode for l | test.py:145:23:145:23 | ControlFlowNode for l | test.py:147:9:147:9 | ControlFlowNode for l | This expression mutates $@. | test.py:145:23:145:23 | ControlFlowNode for l | a default value |
diff --git a/python/ql/test/query-tests/Functions/general/ModificationOfParameterWithDefault.expected b/python/ql/test/query-tests/Functions/general/ModificationOfParameterWithDefault.expected
index c32326d4942..a2eff0d757f 100644
--- a/python/ql/test/query-tests/Functions/general/ModificationOfParameterWithDefault.expected
+++ b/python/ql/test/query-tests/Functions/general/ModificationOfParameterWithDefault.expected
@@ -34,11 +34,11 @@ nodes
 | functions_test.py:196:28:196:28 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
 subpaths
 #select
-| functions_test.py:40:5:40:5 | ControlFlowNode for x | functions_test.py:39:9:39:9 | ControlFlowNode for x | functions_test.py:40:5:40:5 | ControlFlowNode for x | $@ flows to here and is mutated. | functions_test.py:39:9:39:9 | ControlFlowNode for x | Default value |
-| functions_test.py:134:5:134:5 | ControlFlowNode for x | functions_test.py:133:15:133:15 | ControlFlowNode for x | functions_test.py:134:5:134:5 | ControlFlowNode for x | $@ flows to here and is mutated. | functions_test.py:133:15:133:15 | ControlFlowNode for x | Default value |
-| functions_test.py:152:5:152:5 | ControlFlowNode for x | functions_test.py:157:27:157:27 | ControlFlowNode for y | functions_test.py:152:5:152:5 | ControlFlowNode for x | $@ flows to here and is mutated. | functions_test.py:157:27:157:27 | ControlFlowNode for y | Default value |
-| functions_test.py:155:5:155:5 | ControlFlowNode for x | functions_test.py:157:27:157:27 | ControlFlowNode for y | functions_test.py:155:5:155:5 | ControlFlowNode for x | $@ flows to here and is mutated. | functions_test.py:157:27:157:27 | ControlFlowNode for y | Default value |
-| functions_test.py:183:9:183:9 | ControlFlowNode for x | functions_test.py:192:18:192:18 | ControlFlowNode for x | functions_test.py:183:9:183:9 | ControlFlowNode for x | $@ flows to here and is mutated. | functions_test.py:192:18:192:18 | ControlFlowNode for x | Default value |
-| functions_test.py:183:9:183:9 | ControlFlowNode for x | functions_test.py:195:18:195:18 | ControlFlowNode for x | functions_test.py:183:9:183:9 | ControlFlowNode for x | $@ flows to here and is mutated. | functions_test.py:195:18:195:18 | ControlFlowNode for x | Default value |
-| functions_test.py:185:9:185:9 | ControlFlowNode for x | functions_test.py:192:18:192:18 | ControlFlowNode for x | functions_test.py:185:9:185:9 | ControlFlowNode for x | $@ flows to here and is mutated. | functions_test.py:192:18:192:18 | ControlFlowNode for x | Default value |
-| functions_test.py:185:9:185:9 | ControlFlowNode for x | functions_test.py:195:18:195:18 | ControlFlowNode for x | functions_test.py:185:9:185:9 | ControlFlowNode for x | $@ flows to here and is mutated. | functions_test.py:195:18:195:18 | ControlFlowNode for x | Default value |
+| functions_test.py:40:5:40:5 | ControlFlowNode for x | functions_test.py:39:9:39:9 | ControlFlowNode for x | functions_test.py:40:5:40:5 | ControlFlowNode for x | This expression mutates $@. | functions_test.py:39:9:39:9 | ControlFlowNode for x | a default value |
+| functions_test.py:134:5:134:5 | ControlFlowNode for x | functions_test.py:133:15:133:15 | ControlFlowNode for x | functions_test.py:134:5:134:5 | ControlFlowNode for x | This expression mutates $@. | functions_test.py:133:15:133:15 | ControlFlowNode for x | a default value |
+| functions_test.py:152:5:152:5 | ControlFlowNode for x | functions_test.py:157:27:157:27 | ControlFlowNode for y | functions_test.py:152:5:152:5 | ControlFlowNode for x | This expression mutates $@. | functions_test.py:157:27:157:27 | ControlFlowNode for y | a default value |
+| functions_test.py:155:5:155:5 | ControlFlowNode for x | functions_test.py:157:27:157:27 | ControlFlowNode for y | functions_test.py:155:5:155:5 | ControlFlowNode for x | This expression mutates $@. | functions_test.py:157:27:157:27 | ControlFlowNode for y | a default value |
+| functions_test.py:183:9:183:9 | ControlFlowNode for x | functions_test.py:192:18:192:18 | ControlFlowNode for x | functions_test.py:183:9:183:9 | ControlFlowNode for x | This expression mutates $@. | functions_test.py:192:18:192:18 | ControlFlowNode for x | a default value |
+| functions_test.py:183:9:183:9 | ControlFlowNode for x | functions_test.py:195:18:195:18 | ControlFlowNode for x | functions_test.py:183:9:183:9 | ControlFlowNode for x | This expression mutates $@. | functions_test.py:195:18:195:18 | ControlFlowNode for x | a default value |
+| functions_test.py:185:9:185:9 | ControlFlowNode for x | functions_test.py:192:18:192:18 | ControlFlowNode for x | functions_test.py:185:9:185:9 | ControlFlowNode for x | This expression mutates $@. | functions_test.py:192:18:192:18 | ControlFlowNode for x | a default value |
+| functions_test.py:185:9:185:9 | ControlFlowNode for x | functions_test.py:195:18:195:18 | ControlFlowNode for x | functions_test.py:185:9:185:9 | ControlFlowNode for x | This expression mutates $@. | functions_test.py:195:18:195:18 | ControlFlowNode for x | a default value |
diff --git a/python/ql/test/query-tests/Lexical/commented_out_code/CommentedOutCode.expected b/python/ql/test/query-tests/Lexical/commented_out_code/CommentedOutCode.expected
index ac6b27d1a22..ba25d2e5559 100644
--- a/python/ql/test/query-tests/Lexical/commented_out_code/CommentedOutCode.expected
+++ b/python/ql/test/query-tests/Lexical/commented_out_code/CommentedOutCode.expected
@@ -1,3 +1,3 @@
-| test.py:15:5:16:28 | Commented out code | These comments appear to contain commented-out code. |
-| test.py:21:1:72:9 | Commented out code | These comments appear to contain commented-out code. |
-| test.py:78:1:85:9 | Commented out code | These comments appear to contain commented-out code. |
+| test.py:15:5:16:28 | Commented out code | This comment appears to contain commented-out code. |
+| test.py:21:1:72:9 | Commented out code | This comment appears to contain commented-out code. |
+| test.py:78:1:85:9 | Commented out code | This comment appears to contain commented-out code. |
diff --git a/python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.expected b/python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.expected
index 3cd40605b96..5049c5bc551 100644
--- a/python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.expected
+++ b/python/ql/test/query-tests/Security/CWE-022-TarSlip/TarSlip.expected
@@ -23,8 +23,8 @@ nodes
 | tarslip.py:59:21:59:25 | ControlFlowNode for entry | semmle.label | ControlFlowNode for entry |
 subpaths
 #select
-| tarslip.py:13:1:13:3 | ControlFlowNode for tar | tarslip.py:12:7:12:39 | ControlFlowNode for Attribute() | tarslip.py:13:1:13:3 | ControlFlowNode for tar | Extraction of tarfile from $@ | tarslip.py:12:7:12:39 | ControlFlowNode for Attribute() | a potentially untrusted source |
-| tarslip.py:18:17:18:21 | ControlFlowNode for entry | tarslip.py:16:7:16:39 | ControlFlowNode for Attribute() | tarslip.py:18:17:18:21 | ControlFlowNode for entry | Extraction of tarfile from $@ | tarslip.py:16:7:16:39 | ControlFlowNode for Attribute() | a potentially untrusted source |
-| tarslip.py:37:17:37:21 | ControlFlowNode for entry | tarslip.py:33:7:33:39 | ControlFlowNode for Attribute() | tarslip.py:37:17:37:21 | ControlFlowNode for entry | Extraction of tarfile from $@ | tarslip.py:33:7:33:39 | ControlFlowNode for Attribute() | a potentially untrusted source |
-| tarslip.py:41:24:41:26 | ControlFlowNode for tar | tarslip.py:40:7:40:39 | ControlFlowNode for Attribute() | tarslip.py:41:24:41:26 | ControlFlowNode for tar | Extraction of tarfile from $@ | tarslip.py:40:7:40:39 | ControlFlowNode for Attribute() | a potentially untrusted source |
-| tarslip.py:59:21:59:25 | ControlFlowNode for entry | tarslip.py:56:7:56:39 | ControlFlowNode for Attribute() | tarslip.py:59:21:59:25 | ControlFlowNode for entry | Extraction of tarfile from $@ | tarslip.py:56:7:56:39 | ControlFlowNode for Attribute() | a potentially untrusted source |
+| tarslip.py:13:1:13:3 | ControlFlowNode for tar | tarslip.py:12:7:12:39 | ControlFlowNode for Attribute() | tarslip.py:13:1:13:3 | ControlFlowNode for tar | This file extraction depends on $@ | tarslip.py:12:7:12:39 | ControlFlowNode for Attribute() | a potentially untrusted source |
+| tarslip.py:18:17:18:21 | ControlFlowNode for entry | tarslip.py:16:7:16:39 | ControlFlowNode for Attribute() | tarslip.py:18:17:18:21 | ControlFlowNode for entry | This file extraction depends on $@ | tarslip.py:16:7:16:39 | ControlFlowNode for Attribute() | a potentially untrusted source |
+| tarslip.py:37:17:37:21 | ControlFlowNode for entry | tarslip.py:33:7:33:39 | ControlFlowNode for Attribute() | tarslip.py:37:17:37:21 | ControlFlowNode for entry | This file extraction depends on $@ | tarslip.py:33:7:33:39 | ControlFlowNode for Attribute() | a potentially untrusted source |
+| tarslip.py:41:24:41:26 | ControlFlowNode for tar | tarslip.py:40:7:40:39 | ControlFlowNode for Attribute() | tarslip.py:41:24:41:26 | ControlFlowNode for tar | This file extraction depends on $@ | tarslip.py:40:7:40:39 | ControlFlowNode for Attribute() | a potentially untrusted source |
+| tarslip.py:59:21:59:25 | ControlFlowNode for entry | tarslip.py:56:7:56:39 | ControlFlowNode for Attribute() | tarslip.py:59:21:59:25 | ControlFlowNode for entry | This file extraction depends on $@ | tarslip.py:56:7:56:39 | ControlFlowNode for Attribute() | a potentially untrusted source |
diff --git a/python/ql/test/query-tests/Security/CWE-078-CommandInjection-py2/CommandInjection.expected b/python/ql/test/query-tests/Security/CWE-078-CommandInjection-py2/CommandInjection.expected
index 3c000eb1070..8d26b3f6d5c 100644
--- a/python/ql/test/query-tests/Security/CWE-078-CommandInjection-py2/CommandInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-078-CommandInjection-py2/CommandInjection.expected
@@ -23,12 +23,12 @@ nodes
 | command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
 subpaths
 #select
-| command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:23:20:23:32 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:23:20:23:32 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:25:19:25:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:25:19:25:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:26:19:26:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:26:19:26:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:27:19:27:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:27:19:27:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:19:15:19:27 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:20:15:20:27 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:21:15:21:27 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:23:20:23:32 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:23:20:23:32 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:25:19:25:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:25:19:25:31 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:26:19:26:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:26:19:26:31 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:27:19:27:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:27:19:27:31 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:28:19:28:31 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:29:19:29:31 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-078-CommandInjection/CommandInjection.expected b/python/ql/test/query-tests/Security/CWE-078-CommandInjection/CommandInjection.expected
index 449bc4d0efb..cce39a976db 100644
--- a/python/ql/test/query-tests/Security/CWE-078-CommandInjection/CommandInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-078-CommandInjection/CommandInjection.expected
@@ -52,16 +52,16 @@ nodes
 | command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
 subpaths
 #select
-| command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr | command_injection.py:11:13:11:19 | ControlFlowNode for request | command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:11:13:11:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:26:23:26:25 | ControlFlowNode for cmd | command_injection.py:25:11:25:17 | ControlFlowNode for request | command_injection.py:26:23:26:25 | ControlFlowNode for cmd | This command depends on $@. | command_injection.py:25:11:25:17 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr | command_injection.py:31:13:31:19 | ControlFlowNode for request | command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:31:13:31:19 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:41:15:41:21 | ControlFlowNode for command | command_injection.py:38:15:38:21 | ControlFlowNode for request | command_injection.py:41:15:41:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:38:15:38:21 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:42:15:42:21 | ControlFlowNode for command | command_injection.py:38:15:38:21 | ControlFlowNode for request | command_injection.py:42:15:42:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:38:15:38:21 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:55:15:55:21 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:55:15:55:21 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:56:14:56:20 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:56:14:56:20 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:57:21:57:27 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:57:21:57:27 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:58:27:58:33 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:58:27:58:33 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:59:20:59:26 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:59:20:59:26 | ControlFlowNode for command | This command depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr | command_injection.py:71:12:71:18 | ControlFlowNode for request | command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:71:12:71:18 | ControlFlowNode for request | a user-provided value |
-| command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr | command_injection.py:78:12:78:18 | ControlFlowNode for request | command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr | This command depends on $@. | command_injection.py:78:12:78:18 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr | command_injection.py:11:13:11:19 | ControlFlowNode for request | command_injection.py:13:15:13:27 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:11:13:11:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr | command_injection.py:18:13:18:19 | ControlFlowNode for request | command_injection.py:20:22:20:34 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:18:13:18:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:26:23:26:25 | ControlFlowNode for cmd | command_injection.py:25:11:25:17 | ControlFlowNode for request | command_injection.py:26:23:26:25 | ControlFlowNode for cmd | This command line depends on $@. | command_injection.py:25:11:25:17 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr | command_injection.py:31:13:31:19 | ControlFlowNode for request | command_injection.py:33:14:33:26 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:31:13:31:19 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:41:15:41:21 | ControlFlowNode for command | command_injection.py:38:15:38:21 | ControlFlowNode for request | command_injection.py:41:15:41:21 | ControlFlowNode for command | This command line depends on $@. | command_injection.py:38:15:38:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:42:15:42:21 | ControlFlowNode for command | command_injection.py:38:15:38:21 | ControlFlowNode for request | command_injection.py:42:15:42:21 | ControlFlowNode for command | This command line depends on $@. | command_injection.py:38:15:38:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:55:15:55:21 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:55:15:55:21 | ControlFlowNode for command | This command line depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:56:14:56:20 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:56:14:56:20 | ControlFlowNode for command | This command line depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:57:21:57:27 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:57:21:57:27 | ControlFlowNode for command | This command line depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:58:27:58:33 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:58:27:58:33 | ControlFlowNode for command | This command line depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:59:20:59:26 | ControlFlowNode for command | command_injection.py:54:15:54:21 | ControlFlowNode for request | command_injection.py:59:20:59:26 | ControlFlowNode for command | This command line depends on $@. | command_injection.py:54:15:54:21 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr | command_injection.py:71:12:71:18 | ControlFlowNode for request | command_injection.py:73:19:73:30 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:71:12:71:18 | ControlFlowNode for request | a user-provided value |
+| command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr | command_injection.py:78:12:78:18 | ControlFlowNode for request | command_injection.py:80:19:80:30 | ControlFlowNode for BinaryExpr | This command line depends on $@. | command_injection.py:78:12:78:18 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-090-LdapInjection/LdapInjection.expected b/python/ql/test/query-tests/Security/CWE-090-LdapInjection/LdapInjection.expected
index a003f56b09f..7dcddaaae83 100644
--- a/python/ql/test/query-tests/Security/CWE-090-LdapInjection/LdapInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-090-LdapInjection/LdapInjection.expected
@@ -82,18 +82,18 @@ nodes
 | ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | semmle.label | ControlFlowNode for search_filter |
 subpaths
 #select
-| ldap3_bad.py:21:17:21:18 | ControlFlowNode for dn | ldap3_bad.py:13:17:13:23 | ControlFlowNode for request | ldap3_bad.py:21:17:21:18 | ControlFlowNode for dn | $@ LDAP query parameter (DN) comes from $@. | ldap3_bad.py:21:17:21:18 | ControlFlowNode for dn | This | ldap3_bad.py:13:17:13:23 | ControlFlowNode for request | a user-provided value |
-| ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | ldap3_bad.py:13:17:13:23 | ControlFlowNode for request | ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | $@ LDAP query parameter (filter) comes from $@. | ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | This | ldap3_bad.py:13:17:13:23 | ControlFlowNode for request | a user-provided value |
-| ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | ldap3_bad.py:14:21:14:27 | ControlFlowNode for request | ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | $@ LDAP query parameter (filter) comes from $@. | ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | This | ldap3_bad.py:14:21:14:27 | ControlFlowNode for request | a user-provided value |
-| ldap3_bad.py:38:9:38:10 | ControlFlowNode for dn | ldap3_bad.py:30:17:30:23 | ControlFlowNode for request | ldap3_bad.py:38:9:38:10 | ControlFlowNode for dn | $@ LDAP query parameter (DN) comes from $@. | ldap3_bad.py:38:9:38:10 | ControlFlowNode for dn | This | ldap3_bad.py:30:17:30:23 | ControlFlowNode for request | a user-provided value |
-| ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | ldap3_bad.py:30:17:30:23 | ControlFlowNode for request | ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | $@ LDAP query parameter (filter) comes from $@. | ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | This | ldap3_bad.py:30:17:30:23 | ControlFlowNode for request | a user-provided value |
-| ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | ldap3_bad.py:31:21:31:27 | ControlFlowNode for request | ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | $@ LDAP query parameter (filter) comes from $@. | ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | This | ldap3_bad.py:31:21:31:27 | ControlFlowNode for request | a user-provided value |
-| ldap_bad.py:21:9:21:10 | ControlFlowNode for dn | ldap_bad.py:13:17:13:23 | ControlFlowNode for request | ldap_bad.py:21:9:21:10 | ControlFlowNode for dn | $@ LDAP query parameter (DN) comes from $@. | ldap_bad.py:21:9:21:10 | ControlFlowNode for dn | This | ldap_bad.py:13:17:13:23 | ControlFlowNode for request | a user-provided value |
-| ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | ldap_bad.py:13:17:13:23 | ControlFlowNode for request | ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | $@ LDAP query parameter (filter) comes from $@. | ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | This | ldap_bad.py:13:17:13:23 | ControlFlowNode for request | a user-provided value |
-| ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | ldap_bad.py:14:21:14:27 | ControlFlowNode for request | ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | $@ LDAP query parameter (filter) comes from $@. | ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | This | ldap_bad.py:14:21:14:27 | ControlFlowNode for request | a user-provided value |
-| ldap_bad.py:37:9:37:10 | ControlFlowNode for dn | ldap_bad.py:30:17:30:23 | ControlFlowNode for request | ldap_bad.py:37:9:37:10 | ControlFlowNode for dn | $@ LDAP query parameter (DN) comes from $@. | ldap_bad.py:37:9:37:10 | ControlFlowNode for dn | This | ldap_bad.py:30:17:30:23 | ControlFlowNode for request | a user-provided value |
-| ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | ldap_bad.py:30:17:30:23 | ControlFlowNode for request | ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | $@ LDAP query parameter (filter) comes from $@. | ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | This | ldap_bad.py:30:17:30:23 | ControlFlowNode for request | a user-provided value |
-| ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | ldap_bad.py:31:21:31:27 | ControlFlowNode for request | ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | $@ LDAP query parameter (filter) comes from $@. | ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | This | ldap_bad.py:31:21:31:27 | ControlFlowNode for request | a user-provided value |
-| ldap_bad.py:55:9:55:10 | ControlFlowNode for dn | ldap_bad.py:47:17:47:23 | ControlFlowNode for request | ldap_bad.py:55:9:55:10 | ControlFlowNode for dn | $@ LDAP query parameter (DN) comes from $@. | ldap_bad.py:55:9:55:10 | ControlFlowNode for dn | This | ldap_bad.py:47:17:47:23 | ControlFlowNode for request | a user-provided value |
-| ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | ldap_bad.py:47:17:47:23 | ControlFlowNode for request | ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | $@ LDAP query parameter (filter) comes from $@. | ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | This | ldap_bad.py:47:17:47:23 | ControlFlowNode for request | a user-provided value |
-| ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | ldap_bad.py:48:21:48:27 | ControlFlowNode for request | ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | $@ LDAP query parameter (filter) comes from $@. | ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | This | ldap_bad.py:48:21:48:27 | ControlFlowNode for request | a user-provided value |
+| ldap3_bad.py:21:17:21:18 | ControlFlowNode for dn | ldap3_bad.py:13:17:13:23 | ControlFlowNode for request | ldap3_bad.py:21:17:21:18 | ControlFlowNode for dn | $@ depends on $@. | ldap3_bad.py:21:17:21:18 | ControlFlowNode for dn | LDAP query parameter (DN) | ldap3_bad.py:13:17:13:23 | ControlFlowNode for request | a user-provided value |
+| ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | ldap3_bad.py:13:17:13:23 | ControlFlowNode for request | ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | $@ depends on $@. | ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | LDAP query parameter (filter) | ldap3_bad.py:13:17:13:23 | ControlFlowNode for request | a user-provided value |
+| ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | ldap3_bad.py:14:21:14:27 | ControlFlowNode for request | ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | $@ depends on $@. | ldap3_bad.py:21:21:21:33 | ControlFlowNode for search_filter | LDAP query parameter (filter) | ldap3_bad.py:14:21:14:27 | ControlFlowNode for request | a user-provided value |
+| ldap3_bad.py:38:9:38:10 | ControlFlowNode for dn | ldap3_bad.py:30:17:30:23 | ControlFlowNode for request | ldap3_bad.py:38:9:38:10 | ControlFlowNode for dn | $@ depends on $@. | ldap3_bad.py:38:9:38:10 | ControlFlowNode for dn | LDAP query parameter (DN) | ldap3_bad.py:30:17:30:23 | ControlFlowNode for request | a user-provided value |
+| ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | ldap3_bad.py:30:17:30:23 | ControlFlowNode for request | ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | $@ depends on $@. | ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | LDAP query parameter (filter) | ldap3_bad.py:30:17:30:23 | ControlFlowNode for request | a user-provided value |
+| ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | ldap3_bad.py:31:21:31:27 | ControlFlowNode for request | ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | $@ depends on $@. | ldap3_bad.py:38:13:38:25 | ControlFlowNode for search_filter | LDAP query parameter (filter) | ldap3_bad.py:31:21:31:27 | ControlFlowNode for request | a user-provided value |
+| ldap_bad.py:21:9:21:10 | ControlFlowNode for dn | ldap_bad.py:13:17:13:23 | ControlFlowNode for request | ldap_bad.py:21:9:21:10 | ControlFlowNode for dn | $@ depends on $@. | ldap_bad.py:21:9:21:10 | ControlFlowNode for dn | LDAP query parameter (DN) | ldap_bad.py:13:17:13:23 | ControlFlowNode for request | a user-provided value |
+| ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | ldap_bad.py:13:17:13:23 | ControlFlowNode for request | ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | $@ depends on $@. | ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | LDAP query parameter (filter) | ldap_bad.py:13:17:13:23 | ControlFlowNode for request | a user-provided value |
+| ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | ldap_bad.py:14:21:14:27 | ControlFlowNode for request | ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | $@ depends on $@. | ldap_bad.py:21:33:21:45 | ControlFlowNode for search_filter | LDAP query parameter (filter) | ldap_bad.py:14:21:14:27 | ControlFlowNode for request | a user-provided value |
+| ldap_bad.py:37:9:37:10 | ControlFlowNode for dn | ldap_bad.py:30:17:30:23 | ControlFlowNode for request | ldap_bad.py:37:9:37:10 | ControlFlowNode for dn | $@ depends on $@. | ldap_bad.py:37:9:37:10 | ControlFlowNode for dn | LDAP query parameter (DN) | ldap_bad.py:30:17:30:23 | ControlFlowNode for request | a user-provided value |
+| ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | ldap_bad.py:30:17:30:23 | ControlFlowNode for request | ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | $@ depends on $@. | ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | LDAP query parameter (filter) | ldap_bad.py:30:17:30:23 | ControlFlowNode for request | a user-provided value |
+| ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | ldap_bad.py:31:21:31:27 | ControlFlowNode for request | ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | $@ depends on $@. | ldap_bad.py:37:33:37:45 | ControlFlowNode for search_filter | LDAP query parameter (filter) | ldap_bad.py:31:21:31:27 | ControlFlowNode for request | a user-provided value |
+| ldap_bad.py:55:9:55:10 | ControlFlowNode for dn | ldap_bad.py:47:17:47:23 | ControlFlowNode for request | ldap_bad.py:55:9:55:10 | ControlFlowNode for dn | $@ depends on $@. | ldap_bad.py:55:9:55:10 | ControlFlowNode for dn | LDAP query parameter (DN) | ldap_bad.py:47:17:47:23 | ControlFlowNode for request | a user-provided value |
+| ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | ldap_bad.py:47:17:47:23 | ControlFlowNode for request | ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | $@ depends on $@. | ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | LDAP query parameter (filter) | ldap_bad.py:47:17:47:23 | ControlFlowNode for request | a user-provided value |
+| ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | ldap_bad.py:48:21:48:27 | ControlFlowNode for request | ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | $@ depends on $@. | ldap_bad.py:55:43:55:55 | ControlFlowNode for search_filter | LDAP query parameter (filter) | ldap_bad.py:48:21:48:27 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-094-CodeInjection/CodeInjection.expected b/python/ql/test/query-tests/Security/CWE-094-CodeInjection/CodeInjection.expected
index c0bff3e7d11..97f5bc54118 100644
--- a/python/ql/test/query-tests/Security/CWE-094-CodeInjection/CodeInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-094-CodeInjection/CodeInjection.expected
@@ -16,7 +16,7 @@ nodes
 | code_injection.py:21:20:21:27 | ControlFlowNode for obj_name | semmle.label | ControlFlowNode for obj_name |
 subpaths
 #select
-| code_injection.py:7:10:7:13 | ControlFlowNode for code | code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:7:10:7:13 | ControlFlowNode for code | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:18 | ControlFlowNode for request | A user-provided value |
-| code_injection.py:8:10:8:13 | ControlFlowNode for code | code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:8:10:8:13 | ControlFlowNode for code | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:18 | ControlFlowNode for request | A user-provided value |
-| code_injection.py:10:10:10:12 | ControlFlowNode for cmd | code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:10:10:10:12 | ControlFlowNode for cmd | $@ flows to here and is interpreted as code. | code_injection.py:6:12:6:18 | ControlFlowNode for request | A user-provided value |
-| code_injection.py:21:20:21:27 | ControlFlowNode for obj_name | code_injection.py:18:16:18:22 | ControlFlowNode for request | code_injection.py:21:20:21:27 | ControlFlowNode for obj_name | $@ flows to here and is interpreted as code. | code_injection.py:18:16:18:22 | ControlFlowNode for request | A user-provided value |
+| code_injection.py:7:10:7:13 | ControlFlowNode for code | code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:7:10:7:13 | ControlFlowNode for code | This code execution depends on $@. | code_injection.py:6:12:6:18 | ControlFlowNode for request | a user-provided value |
+| code_injection.py:8:10:8:13 | ControlFlowNode for code | code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:8:10:8:13 | ControlFlowNode for code | This code execution depends on $@. | code_injection.py:6:12:6:18 | ControlFlowNode for request | a user-provided value |
+| code_injection.py:10:10:10:12 | ControlFlowNode for cmd | code_injection.py:6:12:6:18 | ControlFlowNode for request | code_injection.py:10:10:10:12 | ControlFlowNode for cmd | This code execution depends on $@. | code_injection.py:6:12:6:18 | ControlFlowNode for request | a user-provided value |
+| code_injection.py:21:20:21:27 | ControlFlowNode for obj_name | code_injection.py:18:16:18:22 | ControlFlowNode for request | code_injection.py:21:20:21:27 | ControlFlowNode for obj_name | This code execution depends on $@. | code_injection.py:18:16:18:22 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-117-LogInjection/LogInjection.expected b/python/ql/test/query-tests/Security/CWE-117-LogInjection/LogInjection.expected
index e27b369e640..9641f49e3e2 100644
--- a/python/ql/test/query-tests/Security/CWE-117-LogInjection/LogInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-117-LogInjection/LogInjection.expected
@@ -22,7 +22,7 @@ nodes
 | LogInjectionBad.py:37:19:37:38 | ControlFlowNode for BinaryExpr | semmle.label | ControlFlowNode for BinaryExpr |
 subpaths
 #select
-| LogInjectionBad.py:18:21:18:40 | ControlFlowNode for BinaryExpr | LogInjectionBad.py:17:12:17:18 | ControlFlowNode for request | LogInjectionBad.py:18:21:18:40 | ControlFlowNode for BinaryExpr | $@ flows to log entry. | LogInjectionBad.py:17:12:17:18 | ControlFlowNode for request | User-provided value |
-| LogInjectionBad.py:24:18:24:37 | ControlFlowNode for BinaryExpr | LogInjectionBad.py:23:12:23:18 | ControlFlowNode for request | LogInjectionBad.py:24:18:24:37 | ControlFlowNode for BinaryExpr | $@ flows to log entry. | LogInjectionBad.py:23:12:23:18 | ControlFlowNode for request | User-provided value |
-| LogInjectionBad.py:30:25:30:44 | ControlFlowNode for BinaryExpr | LogInjectionBad.py:29:12:29:18 | ControlFlowNode for request | LogInjectionBad.py:30:25:30:44 | ControlFlowNode for BinaryExpr | $@ flows to log entry. | LogInjectionBad.py:29:12:29:18 | ControlFlowNode for request | User-provided value |
-| LogInjectionBad.py:37:19:37:38 | ControlFlowNode for BinaryExpr | LogInjectionBad.py:35:12:35:18 | ControlFlowNode for request | LogInjectionBad.py:37:19:37:38 | ControlFlowNode for BinaryExpr | $@ flows to log entry. | LogInjectionBad.py:35:12:35:18 | ControlFlowNode for request | User-provided value |
+| LogInjectionBad.py:18:21:18:40 | ControlFlowNode for BinaryExpr | LogInjectionBad.py:17:12:17:18 | ControlFlowNode for request | LogInjectionBad.py:18:21:18:40 | ControlFlowNode for BinaryExpr | This log entry depends on $@. | LogInjectionBad.py:17:12:17:18 | ControlFlowNode for request | a user-provided value |
+| LogInjectionBad.py:24:18:24:37 | ControlFlowNode for BinaryExpr | LogInjectionBad.py:23:12:23:18 | ControlFlowNode for request | LogInjectionBad.py:24:18:24:37 | ControlFlowNode for BinaryExpr | This log entry depends on $@. | LogInjectionBad.py:23:12:23:18 | ControlFlowNode for request | a user-provided value |
+| LogInjectionBad.py:30:25:30:44 | ControlFlowNode for BinaryExpr | LogInjectionBad.py:29:12:29:18 | ControlFlowNode for request | LogInjectionBad.py:30:25:30:44 | ControlFlowNode for BinaryExpr | This log entry depends on $@. | LogInjectionBad.py:29:12:29:18 | ControlFlowNode for request | a user-provided value |
+| LogInjectionBad.py:37:19:37:38 | ControlFlowNode for BinaryExpr | LogInjectionBad.py:35:12:35:18 | ControlFlowNode for request | LogInjectionBad.py:37:19:37:38 | ControlFlowNode for BinaryExpr | This log entry depends on $@. | LogInjectionBad.py:35:12:35:18 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-209-StackTraceExposure/StackTraceExposure.expected b/python/ql/test/query-tests/Security/CWE-209-StackTraceExposure/StackTraceExposure.expected
index cf73f12b9a4..12bda8e4bea 100644
--- a/python/ql/test/query-tests/Security/CWE-209-StackTraceExposure/StackTraceExposure.expected
+++ b/python/ql/test/query-tests/Security/CWE-209-StackTraceExposure/StackTraceExposure.expected
@@ -19,7 +19,7 @@ nodes
 subpaths
 | test.py:50:29:50:31 | ControlFlowNode for err | test.py:52:18:52:20 | ControlFlowNode for msg | test.py:53:12:53:27 | ControlFlowNode for BinaryExpr | test.py:50:16:50:32 | ControlFlowNode for format_error() |
 #select
-| test.py:16:16:16:37 | ControlFlowNode for Attribute() | test.py:16:16:16:37 | ControlFlowNode for Attribute() | test.py:16:16:16:37 | ControlFlowNode for Attribute() | $@ may be exposed to an external user | test.py:16:16:16:37 | ControlFlowNode for Attribute() | Error information |
-| test.py:24:16:24:16 | ControlFlowNode for e | test.py:23:25:23:25 | SSA variable e | test.py:24:16:24:16 | ControlFlowNode for e | $@ may be exposed to an external user | test.py:23:25:23:25 | SSA variable e | Error information |
-| test.py:32:16:32:30 | ControlFlowNode for Attribute | test.py:31:25:31:25 | SSA variable e | test.py:32:16:32:30 | ControlFlowNode for Attribute | $@ may be exposed to an external user | test.py:31:25:31:25 | SSA variable e | Error information |
-| test.py:50:16:50:32 | ControlFlowNode for format_error() | test.py:49:15:49:36 | ControlFlowNode for Attribute() | test.py:50:16:50:32 | ControlFlowNode for format_error() | $@ may be exposed to an external user | test.py:49:15:49:36 | ControlFlowNode for Attribute() | Error information |
+| test.py:16:16:16:37 | ControlFlowNode for Attribute() | test.py:16:16:16:37 | ControlFlowNode for Attribute() | test.py:16:16:16:37 | ControlFlowNode for Attribute() | $@ flows to this location and may be exposed to an external user. | test.py:16:16:16:37 | ControlFlowNode for Attribute() | Stack trace information |
+| test.py:24:16:24:16 | ControlFlowNode for e | test.py:23:25:23:25 | SSA variable e | test.py:24:16:24:16 | ControlFlowNode for e | $@ flows to this location and may be exposed to an external user. | test.py:23:25:23:25 | SSA variable e | Stack trace information |
+| test.py:32:16:32:30 | ControlFlowNode for Attribute | test.py:31:25:31:25 | SSA variable e | test.py:32:16:32:30 | ControlFlowNode for Attribute | $@ flows to this location and may be exposed to an external user. | test.py:31:25:31:25 | SSA variable e | Stack trace information |
+| test.py:50:16:50:32 | ControlFlowNode for format_error() | test.py:49:15:49:36 | ControlFlowNode for Attribute() | test.py:50:16:50:32 | ControlFlowNode for format_error() | $@ flows to this location and may be exposed to an external user. | test.py:49:15:49:36 | ControlFlowNode for Attribute() | Stack trace information |
diff --git a/python/ql/test/query-tests/Security/CWE-502-UnsafeDeserialization/UnsafeDeserialization.expected b/python/ql/test/query-tests/Security/CWE-502-UnsafeDeserialization/UnsafeDeserialization.expected
index cee0bf3ad7c..9cab4ce7d16 100644
--- a/python/ql/test/query-tests/Security/CWE-502-UnsafeDeserialization/UnsafeDeserialization.expected
+++ b/python/ql/test/query-tests/Security/CWE-502-UnsafeDeserialization/UnsafeDeserialization.expected
@@ -13,7 +13,7 @@ nodes
 | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | semmle.label | ControlFlowNode for payload |
 subpaths
 #select
-| unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | untrusted input |
-| unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | untrusted input |
-| unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | untrusted input |
-| unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | Deserializing of $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | untrusted input |
+| unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:15:18:15:24 | ControlFlowNode for payload | Unsafe deserialization depends on $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | a user-provided value |
+| unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:16:15:16:21 | ControlFlowNode for payload | Unsafe deserialization depends on $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | a user-provided value |
+| unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:18:19:18:25 | ControlFlowNode for payload | Unsafe deserialization depends on $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | a user-provided value |
+| unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | unsafe_deserialization.py:21:16:21:22 | ControlFlowNode for payload | Unsafe deserialization depends on $@. | unsafe_deserialization.py:14:15:14:21 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-601-UrlRedirect/UrlRedirect.expected b/python/ql/test/query-tests/Security/CWE-601-UrlRedirect/UrlRedirect.expected
index 0be499849ff..750e61d048d 100644
--- a/python/ql/test/query-tests/Security/CWE-601-UrlRedirect/UrlRedirect.expected
+++ b/python/ql/test/query-tests/Security/CWE-601-UrlRedirect/UrlRedirect.expected
@@ -42,11 +42,11 @@ nodes
 | test.py:83:21:83:26 | ControlFlowNode for unsafe | semmle.label | ControlFlowNode for unsafe |
 subpaths
 #select
-| test.py:8:21:8:26 | ControlFlowNode for target | test.py:7:14:7:20 | ControlFlowNode for request | test.py:8:21:8:26 | ControlFlowNode for target | Untrusted URL redirection due to $@. | test.py:7:14:7:20 | ControlFlowNode for request | A user-provided value |
-| test.py:32:21:32:24 | ControlFlowNode for safe | test.py:30:17:30:23 | ControlFlowNode for request | test.py:32:21:32:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:30:17:30:23 | ControlFlowNode for request | A user-provided value |
-| test.py:39:21:39:24 | ControlFlowNode for safe | test.py:37:17:37:23 | ControlFlowNode for request | test.py:39:21:39:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:37:17:37:23 | ControlFlowNode for request | A user-provided value |
-| test.py:46:21:46:24 | ControlFlowNode for safe | test.py:44:17:44:23 | ControlFlowNode for request | test.py:46:21:46:24 | ControlFlowNode for safe | Untrusted URL redirection due to $@. | test.py:44:17:44:23 | ControlFlowNode for request | A user-provided value |
-| test.py:62:21:62:26 | ControlFlowNode for unsafe | test.py:60:17:60:23 | ControlFlowNode for request | test.py:62:21:62:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:60:17:60:23 | ControlFlowNode for request | A user-provided value |
-| test.py:69:21:69:26 | ControlFlowNode for unsafe | test.py:67:17:67:23 | ControlFlowNode for request | test.py:69:21:69:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:67:17:67:23 | ControlFlowNode for request | A user-provided value |
-| test.py:76:21:76:26 | ControlFlowNode for unsafe | test.py:74:17:74:23 | ControlFlowNode for request | test.py:76:21:76:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:74:17:74:23 | ControlFlowNode for request | A user-provided value |
-| test.py:83:21:83:26 | ControlFlowNode for unsafe | test.py:81:17:81:23 | ControlFlowNode for request | test.py:83:21:83:26 | ControlFlowNode for unsafe | Untrusted URL redirection due to $@. | test.py:81:17:81:23 | ControlFlowNode for request | A user-provided value |
+| test.py:8:21:8:26 | ControlFlowNode for target | test.py:7:14:7:20 | ControlFlowNode for request | test.py:8:21:8:26 | ControlFlowNode for target | Untrusted URL redirection depends on $@. | test.py:7:14:7:20 | ControlFlowNode for request | a user-provided value |
+| test.py:32:21:32:24 | ControlFlowNode for safe | test.py:30:17:30:23 | ControlFlowNode for request | test.py:32:21:32:24 | ControlFlowNode for safe | Untrusted URL redirection depends on $@. | test.py:30:17:30:23 | ControlFlowNode for request | a user-provided value |
+| test.py:39:21:39:24 | ControlFlowNode for safe | test.py:37:17:37:23 | ControlFlowNode for request | test.py:39:21:39:24 | ControlFlowNode for safe | Untrusted URL redirection depends on $@. | test.py:37:17:37:23 | ControlFlowNode for request | a user-provided value |
+| test.py:46:21:46:24 | ControlFlowNode for safe | test.py:44:17:44:23 | ControlFlowNode for request | test.py:46:21:46:24 | ControlFlowNode for safe | Untrusted URL redirection depends on $@. | test.py:44:17:44:23 | ControlFlowNode for request | a user-provided value |
+| test.py:62:21:62:26 | ControlFlowNode for unsafe | test.py:60:17:60:23 | ControlFlowNode for request | test.py:62:21:62:26 | ControlFlowNode for unsafe | Untrusted URL redirection depends on $@. | test.py:60:17:60:23 | ControlFlowNode for request | a user-provided value |
+| test.py:69:21:69:26 | ControlFlowNode for unsafe | test.py:67:17:67:23 | ControlFlowNode for request | test.py:69:21:69:26 | ControlFlowNode for unsafe | Untrusted URL redirection depends on $@. | test.py:67:17:67:23 | ControlFlowNode for request | a user-provided value |
+| test.py:76:21:76:26 | ControlFlowNode for unsafe | test.py:74:17:74:23 | ControlFlowNode for request | test.py:76:21:76:26 | ControlFlowNode for unsafe | Untrusted URL redirection depends on $@. | test.py:74:17:74:23 | ControlFlowNode for request | a user-provided value |
+| test.py:83:21:83:26 | ControlFlowNode for unsafe | test.py:81:17:81:23 | ControlFlowNode for request | test.py:83:21:83:26 | ControlFlowNode for unsafe | Untrusted URL redirection depends on $@. | test.py:81:17:81:23 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-611-Xxe/Xxe.expected b/python/ql/test/query-tests/Security/CWE-611-Xxe/Xxe.expected
index 004369d79cf..402ee97db09 100644
--- a/python/ql/test/query-tests/Security/CWE-611-Xxe/Xxe.expected
+++ b/python/ql/test/query-tests/Security/CWE-611-Xxe/Xxe.expected
@@ -16,5 +16,5 @@ nodes
 | test.py:30:34:30:44 | ControlFlowNode for xml_content | semmle.label | ControlFlowNode for xml_content |
 subpaths
 #select
-| test.py:9:34:9:44 | ControlFlowNode for xml_content | test.py:8:19:8:25 | ControlFlowNode for request | test.py:9:34:9:44 | ControlFlowNode for xml_content | A $@ is parsed as XML without guarding against external entity expansion. | test.py:8:19:8:25 | ControlFlowNode for request | user-provided value |
-| test.py:30:34:30:44 | ControlFlowNode for xml_content | test.py:19:19:19:25 | ControlFlowNode for request | test.py:30:34:30:44 | ControlFlowNode for xml_content | A $@ is parsed as XML without guarding against external entity expansion. | test.py:19:19:19:25 | ControlFlowNode for request | user-provided value |
+| test.py:9:34:9:44 | ControlFlowNode for xml_content | test.py:8:19:8:25 | ControlFlowNode for request | test.py:9:34:9:44 | ControlFlowNode for xml_content | XML parsing depends on $@ without guarding against external entity expansion. | test.py:8:19:8:25 | ControlFlowNode for request | a user-provided value |
+| test.py:30:34:30:44 | ControlFlowNode for xml_content | test.py:19:19:19:25 | ControlFlowNode for request | test.py:30:34:30:44 | ControlFlowNode for xml_content | XML parsing depends on $@ without guarding against external entity expansion. | test.py:19:19:19:25 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-643-XPathInjection/XpathInjection.expected b/python/ql/test/query-tests/Security/CWE-643-XPathInjection/XpathInjection.expected
index 9a10b21d56d..d0068a4b872 100644
--- a/python/ql/test/query-tests/Security/CWE-643-XPathInjection/XpathInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-643-XPathInjection/XpathInjection.expected
@@ -34,9 +34,9 @@ nodes
 | xpathFlow.py:49:29:49:38 | ControlFlowNode for xpathQuery | semmle.label | ControlFlowNode for xpathQuery |
 subpaths
 #select
-| xpathBad.py:13:20:13:43 | ControlFlowNode for BinaryExpr | xpathBad.py:9:7:9:13 | ControlFlowNode for request | xpathBad.py:13:20:13:43 | ControlFlowNode for BinaryExpr | This Xpath query depends on $@. | xpathBad.py:9:7:9:13 | ControlFlowNode for request | a user-provided value |
-| xpathFlow.py:14:20:14:29 | ControlFlowNode for xpathQuery | xpathFlow.py:11:18:11:24 | ControlFlowNode for request | xpathFlow.py:14:20:14:29 | ControlFlowNode for xpathQuery | This Xpath query depends on $@. | xpathFlow.py:11:18:11:24 | ControlFlowNode for request | a user-provided value |
-| xpathFlow.py:23:29:23:38 | ControlFlowNode for xpathQuery | xpathFlow.py:20:18:20:24 | ControlFlowNode for request | xpathFlow.py:23:29:23:38 | ControlFlowNode for xpathQuery | This Xpath query depends on $@. | xpathFlow.py:20:18:20:24 | ControlFlowNode for request | a user-provided value |
-| xpathFlow.py:32:29:32:38 | ControlFlowNode for xpathQuery | xpathFlow.py:30:18:30:24 | ControlFlowNode for request | xpathFlow.py:32:29:32:38 | ControlFlowNode for xpathQuery | This Xpath query depends on $@. | xpathFlow.py:30:18:30:24 | ControlFlowNode for request | a user-provided value |
-| xpathFlow.py:41:31:41:40 | ControlFlowNode for xpathQuery | xpathFlow.py:39:18:39:24 | ControlFlowNode for request | xpathFlow.py:41:31:41:40 | ControlFlowNode for xpathQuery | This Xpath query depends on $@. | xpathFlow.py:39:18:39:24 | ControlFlowNode for request | a user-provided value |
-| xpathFlow.py:49:29:49:38 | ControlFlowNode for xpathQuery | xpathFlow.py:47:18:47:24 | ControlFlowNode for request | xpathFlow.py:49:29:49:38 | ControlFlowNode for xpathQuery | This Xpath query depends on $@. | xpathFlow.py:47:18:47:24 | ControlFlowNode for request | a user-provided value |
+| xpathBad.py:13:20:13:43 | ControlFlowNode for BinaryExpr | xpathBad.py:9:7:9:13 | ControlFlowNode for request | xpathBad.py:13:20:13:43 | ControlFlowNode for BinaryExpr | XPath expression depends on $@. | xpathBad.py:9:7:9:13 | ControlFlowNode for request | a user-provided value |
+| xpathFlow.py:14:20:14:29 | ControlFlowNode for xpathQuery | xpathFlow.py:11:18:11:24 | ControlFlowNode for request | xpathFlow.py:14:20:14:29 | ControlFlowNode for xpathQuery | XPath expression depends on $@. | xpathFlow.py:11:18:11:24 | ControlFlowNode for request | a user-provided value |
+| xpathFlow.py:23:29:23:38 | ControlFlowNode for xpathQuery | xpathFlow.py:20:18:20:24 | ControlFlowNode for request | xpathFlow.py:23:29:23:38 | ControlFlowNode for xpathQuery | XPath expression depends on $@. | xpathFlow.py:20:18:20:24 | ControlFlowNode for request | a user-provided value |
+| xpathFlow.py:32:29:32:38 | ControlFlowNode for xpathQuery | xpathFlow.py:30:18:30:24 | ControlFlowNode for request | xpathFlow.py:32:29:32:38 | ControlFlowNode for xpathQuery | XPath expression depends on $@. | xpathFlow.py:30:18:30:24 | ControlFlowNode for request | a user-provided value |
+| xpathFlow.py:41:31:41:40 | ControlFlowNode for xpathQuery | xpathFlow.py:39:18:39:24 | ControlFlowNode for request | xpathFlow.py:41:31:41:40 | ControlFlowNode for xpathQuery | XPath expression depends on $@. | xpathFlow.py:39:18:39:24 | ControlFlowNode for request | a user-provided value |
+| xpathFlow.py:49:29:49:38 | ControlFlowNode for xpathQuery | xpathFlow.py:47:18:47:24 | ControlFlowNode for request | xpathFlow.py:49:29:49:38 | ControlFlowNode for xpathQuery | XPath expression depends on $@. | xpathFlow.py:47:18:47:24 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Security/CWE-730-RegexInjection/RegexInjection.expected b/python/ql/test/query-tests/Security/CWE-730-RegexInjection/RegexInjection.expected
index 598b60ae38a..317815142fe 100644
--- a/python/ql/test/query-tests/Security/CWE-730-RegexInjection/RegexInjection.expected
+++ b/python/ql/test/query-tests/Security/CWE-730-RegexInjection/RegexInjection.expected
@@ -23,6 +23,6 @@ nodes
 | re_bad.py:37:16:37:29 | ControlFlowNode for unsafe_pattern | semmle.label | ControlFlowNode for unsafe_pattern |
 subpaths
 #select
-| re_bad.py:14:15:14:28 | ControlFlowNode for unsafe_pattern | re_bad.py:13:22:13:28 | ControlFlowNode for request | re_bad.py:14:15:14:28 | ControlFlowNode for unsafe_pattern | $@ regular expression is constructed from a $@ and executed by $@. | re_bad.py:14:15:14:28 | ControlFlowNode for unsafe_pattern | This | re_bad.py:13:22:13:28 | ControlFlowNode for request | user-provided value | re_bad.py:14:5:14:33 | ControlFlowNode for Attribute() | re.search |
-| re_bad.py:25:35:25:48 | ControlFlowNode for unsafe_pattern | re_bad.py:24:22:24:28 | ControlFlowNode for request | re_bad.py:25:35:25:48 | ControlFlowNode for unsafe_pattern | $@ regular expression is constructed from a $@ and executed by $@. | re_bad.py:25:35:25:48 | ControlFlowNode for unsafe_pattern | This | re_bad.py:24:22:24:28 | ControlFlowNode for request | user-provided value | re_bad.py:26:5:26:31 | ControlFlowNode for Attribute() | re.search |
-| re_bad.py:37:16:37:29 | ControlFlowNode for unsafe_pattern | re_bad.py:36:22:36:28 | ControlFlowNode for request | re_bad.py:37:16:37:29 | ControlFlowNode for unsafe_pattern | $@ regular expression is constructed from a $@ and executed by $@. | re_bad.py:37:16:37:29 | ControlFlowNode for unsafe_pattern | This | re_bad.py:36:22:36:28 | ControlFlowNode for request | user-provided value | re_bad.py:37:5:37:41 | ControlFlowNode for Attribute() | re.search |
+| re_bad.py:14:15:14:28 | ControlFlowNode for unsafe_pattern | re_bad.py:13:22:13:28 | ControlFlowNode for request | re_bad.py:14:15:14:28 | ControlFlowNode for unsafe_pattern | $@ depends on $@ and executed by $@. | re_bad.py:14:15:14:28 | ControlFlowNode for unsafe_pattern | This regular expression | re_bad.py:13:22:13:28 | ControlFlowNode for request | a user-provided value | re_bad.py:14:5:14:33 | ControlFlowNode for Attribute() | re.search |
+| re_bad.py:25:35:25:48 | ControlFlowNode for unsafe_pattern | re_bad.py:24:22:24:28 | ControlFlowNode for request | re_bad.py:25:35:25:48 | ControlFlowNode for unsafe_pattern | $@ depends on $@ and executed by $@. | re_bad.py:25:35:25:48 | ControlFlowNode for unsafe_pattern | This regular expression | re_bad.py:24:22:24:28 | ControlFlowNode for request | a user-provided value | re_bad.py:26:5:26:31 | ControlFlowNode for Attribute() | re.search |
+| re_bad.py:37:16:37:29 | ControlFlowNode for unsafe_pattern | re_bad.py:36:22:36:28 | ControlFlowNode for request | re_bad.py:37:16:37:29 | ControlFlowNode for unsafe_pattern | $@ depends on $@ and executed by $@. | re_bad.py:37:16:37:29 | ControlFlowNode for unsafe_pattern | This regular expression | re_bad.py:36:22:36:28 | ControlFlowNode for request | a user-provided value | re_bad.py:37:5:37:41 | ControlFlowNode for Attribute() | re.search |
diff --git a/python/ql/test/query-tests/Security/CWE-776-XmlBomb/XmlBomb.expected b/python/ql/test/query-tests/Security/CWE-776-XmlBomb/XmlBomb.expected
index 15c439d0761..79ebe0bfef7 100644
--- a/python/ql/test/query-tests/Security/CWE-776-XmlBomb/XmlBomb.expected
+++ b/python/ql/test/query-tests/Security/CWE-776-XmlBomb/XmlBomb.expected
@@ -9,4 +9,4 @@ nodes
 | test.py:30:34:30:44 | ControlFlowNode for xml_content | semmle.label | ControlFlowNode for xml_content |
 subpaths
 #select
-| test.py:30:34:30:44 | ControlFlowNode for xml_content | test.py:19:19:19:25 | ControlFlowNode for request | test.py:30:34:30:44 | ControlFlowNode for xml_content | A $@ is parsed as XML without guarding against uncontrolled entity expansion. | test.py:19:19:19:25 | ControlFlowNode for request | user-provided value |
+| test.py:30:34:30:44 | ControlFlowNode for xml_content | test.py:19:19:19:25 | ControlFlowNode for request | test.py:30:34:30:44 | ControlFlowNode for xml_content | XML parsing depends on $@ without guarding against uncontrolled entity expansion. | test.py:19:19:19:25 | ControlFlowNode for request | a user-provided value |
diff --git a/python/ql/test/query-tests/Statements/unreachable/UnreachableCode.expected b/python/ql/test/query-tests/Statements/unreachable/UnreachableCode.expected
index 74e56473a61..2417041f472 100644
--- a/python/ql/test/query-tests/Statements/unreachable/UnreachableCode.expected
+++ b/python/ql/test/query-tests/Statements/unreachable/UnreachableCode.expected
@@ -1,6 +1,6 @@
-| test.py:8:9:8:28 | AssignStmt | Unreachable statement. |
-| test.py:10:9:10:28 | Return | Unreachable statement. |
-| test.py:16:9:16:21 | ExprStmt | Unreachable statement. |
-| test.py:21:5:21:38 | For | Unreachable statement. |
-| test.py:28:9:28:21 | ExprStmt | Unreachable statement. |
-| test.py:84:5:84:21 | ExceptStmt | Unreachable statement. |
+| test.py:8:9:8:28 | AssignStmt | This statement is unreachable. |
+| test.py:10:9:10:28 | Return | This statement is unreachable. |
+| test.py:16:9:16:21 | ExprStmt | This statement is unreachable. |
+| test.py:21:5:21:38 | For | This statement is unreachable. |
+| test.py:28:9:28:21 | ExprStmt | This statement is unreachable. |
+| test.py:84:5:84:21 | ExceptStmt | This statement is unreachable. |
diff --git a/python/ql/test/query-tests/Variables/unused/UnusedLocalVariable.expected b/python/ql/test/query-tests/Variables/unused/UnusedLocalVariable.expected
index a902cad04cb..e0c2505bdda 100644
--- a/python/ql/test/query-tests/Variables/unused/UnusedLocalVariable.expected
+++ b/python/ql/test/query-tests/Variables/unused/UnusedLocalVariable.expected
@@ -1,5 +1,5 @@
-| variables_test.py:29:5:29:5 | x | The value assigned to local variable 'x' is never used. |
-| variables_test.py:89:5:89:5 | a | The value assigned to local variable 'a' is never used. |
-| variables_test.py:89:7:89:7 | b | The value assigned to local variable 'b' is never used. |
-| variables_test.py:89:9:89:9 | c | The value assigned to local variable 'c' is never used. |
-| variables_test.py:95:5:95:7 | var | The value assigned to local variable 'var' is never used. |
+| variables_test.py:29:5:29:5 | x | Variable x is not used |
+| variables_test.py:89:5:89:5 | a | Variable a is not used |
+| variables_test.py:89:7:89:7 | b | Variable b is not used |
+| variables_test.py:89:9:89:9 | c | Variable c is not used |
+| variables_test.py:95:5:95:7 | var | Variable var is not used |
diff --git a/python/ql/test/query-tests/Variables/unused_local_nonlocal/UnusedLocalVariable.expected b/python/ql/test/query-tests/Variables/unused_local_nonlocal/UnusedLocalVariable.expected
index 3cb5b2a8e63..9abbf310179 100644
--- a/python/ql/test/query-tests/Variables/unused_local_nonlocal/UnusedLocalVariable.expected
+++ b/python/ql/test/query-tests/Variables/unused_local_nonlocal/UnusedLocalVariable.expected
@@ -1 +1 @@
-| variables_test.py:32:9:32:12 | test | The value assigned to local variable 'test' is never used. |
+| variables_test.py:32:9:32:12 | test | Variable test is not used |
diff --git a/ql/ql/src/codeql_ql/ast/Ast.qll b/ql/ql/src/codeql_ql/ast/Ast.qll
index 7e7013b36c7..89f819f4223 100644
--- a/ql/ql/src/codeql_ql/ast/Ast.qll
+++ b/ql/ql/src/codeql_ql/ast/Ast.qll
@@ -521,6 +521,9 @@ class ClasslessPredicate extends TClasslessPredicate, Predicate, ModuleDeclarati
   }
 
   override predicate isPrivate() { Predicate.super.isPrivate() }
+
+  /** Holds if this classless predicate is a signature predicate with no body. */
+  predicate isSignature() { not exists(this.getBody()) }
 }
 
 /**
@@ -2477,15 +2480,18 @@ class BindingSet extends Annotation {
  */
 module YAML {
   /** A node in a YAML file */
-  class YAMLNode extends TYamlNode, AstNode {
+  class YamlNode extends TYamlNode, AstNode {
     /** Holds if the predicate is a root node (has no parent) */
     predicate isRoot() { not exists(this.getParent()) }
 
     override AstNode getParent() { toGenerateYaml(result) = toGenerateYaml(this).getParent() }
   }
 
+  /** DEPRECATED: Alias for YamlNode */
+  deprecated class YAMLNode = YamlNode;
+
   /** A YAML comment. */
-  class YamlComment extends TYamlCommemt, YAMLNode {
+  class YamlComment extends TYamlCommemt, YamlNode {
     Yaml::Comment yamlcomment;
 
     YamlComment() { this = TYamlCommemt(yamlcomment) }
@@ -2497,7 +2503,7 @@ module YAML {
   deprecated class YAMLComment = YamlComment;
 
   /** A YAML entry. */
-  class YamlEntry extends TYamlEntry, YAMLNode {
+  class YamlEntry extends TYamlEntry, YamlNode {
     Yaml::Entry yamle;
 
     YamlEntry() { this = TYamlEntry(yamle) }
@@ -2527,7 +2533,7 @@ module YAML {
   deprecated class YAMLEntry = YamlEntry;
 
   /** A YAML key. */
-  class YamlKey extends TYamlKey, YAMLNode {
+  class YamlKey extends TYamlKey, YamlNode {
     Yaml::Key yamlkey;
 
     YamlKey() { this = TYamlKey(yamlkey) }
@@ -2566,7 +2572,7 @@ module YAML {
   deprecated class YAMLKey = YamlKey;
 
   /** A YAML list item. */
-  class YamlListItem extends TYamlListitem, YAMLNode {
+  class YamlListItem extends TYamlListitem, YamlNode {
     Yaml::Listitem yamllistitem;
 
     YamlListItem() { this = TYamlListitem(yamllistitem) }
@@ -2583,7 +2589,7 @@ module YAML {
   deprecated class YAMLListItem = YamlListItem;
 
   /** A YAML value. */
-  class YamlValue extends TYamlValue, YAMLNode {
+  class YamlValue extends TYamlValue, YamlNode {
     Yaml::Value yamlvalue;
 
     YamlValue() { this = TYamlValue(yamlvalue) }
@@ -2691,7 +2697,7 @@ module YAML {
     Location getLocation() {
       // hacky, just pick the first node in the file.
       result =
-        min(YAMLNode entry, Location l, File f |
+        min(YamlNode entry, Location l, File f |
           entry.getLocation().getFile() = file and
           f = file and
           l = entry.getLocation()
diff --git a/ql/ql/src/codeql_ql/ast/internal/Predicate.qll b/ql/ql/src/codeql_ql/ast/internal/Predicate.qll
index d0a5cac8534..689880ce7e9 100644
--- a/ql/ql/src/codeql_ql/ast/internal/Predicate.qll
+++ b/ql/ql/src/codeql_ql/ast/internal/Predicate.qll
@@ -209,7 +209,9 @@ module PredConsistency {
         not exists(p0.getAlias())
       ) and
     c > 1 and
-    resolvePredicateExpr(pe, p)
+    resolvePredicateExpr(pe, p) and
+    // parameterized modules are expected to resolve to multiple.
+    not exists(ClasslessPredicate sig | not sig.isSignature() and resolvePredicateExpr(pe, sig))
   }
 
   query predicate multipleResolveCall(Call call, int c, PredicateOrBuiltin p) {
@@ -225,6 +227,6 @@ module PredConsistency {
     c > 1 and
     resolveCall(call, p) and
     // parameterized modules are expected to resolve to multiple.
-    not exists(Predicate sig | not exists(sig.getBody()) and resolveCall(call, sig))
+    not exists(ClasslessPredicate sig | not sig.isSignature() and resolveCall(call, sig))
   }
 }
diff --git a/ql/ql/src/codeql_ql/style/MisspellingQuery.qll b/ql/ql/src/codeql_ql/style/MisspellingQuery.qll
index 822a1cfcb07..ad1fd800fb3 100644
--- a/ql/ql/src/codeql_ql/style/MisspellingQuery.qll
+++ b/ql/ql/src/codeql_ql/style/MisspellingQuery.qll
@@ -1,6 +1,6 @@
 import ql
 private import NodeName
-private import TypoDatabase
+private import codeql.typos.TypoDatabase
 
 predicate misspelling(string wrong, string right, string mistake) {
   mistake = "common misspelling" and
diff --git a/ql/ql/src/codeql_ql/style/NodeName.qll b/ql/ql/src/codeql_ql/style/NodeName.qll
index 6d02b7bb70c..e5384864f92 100644
--- a/ql/ql/src/codeql_ql/style/NodeName.qll
+++ b/ql/ql/src/codeql_ql/style/NodeName.qll
@@ -9,18 +9,18 @@ string getName(AstNode node, string kind) {
   or
   // not including CharPreds or db relations. The remaining are: classlessPredicate, classPredicate, newTypeBranch.
   result = node.(ClasslessPredicate).getName() and
-  kind = "classlessPredicate"
+  kind = "predicate"
   or
   result = node.(ClassPredicate).getName() and
-  kind = "classPredicate"
+  kind = "predicate"
   or
   result = node.(NewTypeBranch).getName() and
-  kind = "newtypeBranch"
+  kind = "newtype"
   or
   result = node.(NewType).getName() and
   kind = "newtype"
   or
-  result = node.(VarDecl).getName() and
+  result = node.(VarDef).getName() and
   kind = "variable" and
   not node = any(FieldDecl f).getVarDecl()
   or
@@ -28,5 +28,5 @@ string getName(AstNode node, string kind) {
   or
   result = node.(Module).getName() and kind = "module"
   or
-  result = node.(Import).importedAs() and kind = "import"
+  result = node.(Import).importedAs() and kind = "module"
 }
diff --git a/ql/ql/src/codeql_ql/style/TypoDatabase.qll b/ql/ql/src/codeql_ql/style/TypoDatabase.qll
index a41f003a8c0..f480b9ebc8b 100644
--- a/ql/ql/src/codeql_ql/style/TypoDatabase.qll
+++ b/ql/ql/src/codeql_ql/style/TypoDatabase.qll
@@ -1,9035 +1,4 @@
-/**
- * Holds if `wrong` is a common misspelling of `right`.
- *
- * This predicate was automatically generated by
- *     python buildutils-internal/scripts/generate-typos.py
- * which uses http://en.wikipedia.org/wiki/Wikipedia:Lists_of_common_misspellings/For_machines (with custom additions) on 2018-01-19.
- *
- * This file is available under the Creative Commons Attribution-ShareAlike License
- * (https://en.wikipedia.org/wiki/Wikipedia:Text_of_Creative_Commons_Attribution-ShareAlike_3.0_Unported_License).
- */
-predicate typos(string wrong, string right) {
-  wrong = "abandonned" and right = "abandoned"
-  or
-  wrong = "abbout" and right = "about"
-  or
-  wrong = "aberation" and right = "aberration"
-  or
-  wrong = "abilityes" and right = "abilities"
-  or
-  wrong = "abilties" and right = "abilities"
-  or
-  wrong = "abilty" and right = "ability"
-  or
-  wrong = "abondon" and right = "abandon"
-  or
-  wrong = "abondoned" and right = "abandoned"
-  or
-  wrong = "abondoning" and right = "abandoning"
-  or
-  wrong = "abondons" and right = "abandons"
-  or
-  wrong = "aborigene" and right = "aborigine"
-  or
-  wrong = "abortificant" and right = "abortifacient"
-  or
-  wrong = "abotu" and right = "about"
-  or
-  wrong = "abreviate" and right = "abbreviate"
-  or
-  wrong = "abreviated" and right = "abbreviated"
-  or
-  wrong = "abreviation" and right = "abbreviation"
-  or
-  wrong = "abritrary" and right = "arbitrary"
-  or
-  wrong = "absail" and right = "abseil"
-  or
-  wrong = "absailing" and right = "abseiling"
-  or
-  wrong = "abscence" and right = "absence"
-  or
-  wrong = "absense" and right = "absence"
-  or
-  wrong = "absolutly" and right = "absolutely"
-  or
-  wrong = "absorbsion" and right = "absorption"
-  or
-  wrong = "absorbtion" and right = "absorption"
-  or
-  wrong = "abudance" and right = "abundance"
-  or
-  wrong = "abundacies" and right = "abundances"
-  or
-  wrong = "abundancies" and right = "abundances"
-  or
-  wrong = "abundunt" and right = "abundant"
-  or
-  wrong = "abutts" and right = "abuts"
-  or
-  wrong = "acadamy" and right = "academy"
-  or
-  wrong = "acadmic" and right = "academic"
-  or
-  wrong = "accademic" and right = "academic"
-  or
-  wrong = "accademy" and right = "academy"
-  or
-  wrong = "acccess" and right = "access"
-  or
-  wrong = "acccused" and right = "accused"
-  or
-  wrong = "accelleration" and right = "acceleration"
-  or
-  wrong = "accension" and right = "accession"
-  or
-  wrong = "accension" and right = "ascension"
-  or
-  wrong = "acceptence" and right = "acceptance"
-  or
-  wrong = "acceptible" and right = "acceptable"
-  or
-  wrong = "accesories" and right = "accessories"
-  or
-  wrong = "accessable" and right = "accessible"
-  or
-  wrong = "accidant" and right = "accident"
-  or
-  wrong = "accidentaly" and right = "accidentally"
-  or
-  wrong = "accidently" and right = "accidentally"
-  or
-  wrong = "acclimitization" and right = "acclimatization"
-  or
-  wrong = "accomadate" and right = "accommodate"
-  or
-  wrong = "accomadated" and right = "accommodated"
-  or
-  wrong = "accomadates" and right = "accommodates"
-  or
-  wrong = "accomadating" and right = "accommodating"
-  or
-  wrong = "accomadation" and right = "accommodation"
-  or
-  wrong = "accomadations" and right = "accommodations"
-  or
-  wrong = "accomdate" and right = "accommodate"
-  or
-  wrong = "accomodate" and right = "accommodate"
-  or
-  wrong = "accomodated" and right = "accommodated"
-  or
-  wrong = "accomodates" and right = "accommodates"
-  or
-  wrong = "accomodating" and right = "accommodating"
-  or
-  wrong = "accomodation" and right = "accommodation"
-  or
-  wrong = "accomodations" and right = "accommodations"
-  or
-  wrong = "accompanyed" and right = "accompanied"
-  or
-  wrong = "accordeon" and right = "accordion"
-  or
-  wrong = "accordian" and right = "accordion"
-  or
-  wrong = "accoring" and right = "according"
-  or
-  wrong = "accoustic" and right = "acoustic"
-  or
-  wrong = "accquainted" and right = "acquainted"
-  or
-  wrong = "accrediation" and right = "accreditation"
-  or
-  wrong = "accredidation" and right = "accreditation"
-  or
-  wrong = "accross" and right = "across"
-  or
-  wrong = "accussed" and right = "accused"
-  or
-  wrong = "acedemic" and right = "academic"
-  or
-  wrong = "acheive" and right = "achieve"
-  or
-  wrong = "acheived" and right = "achieved"
-  or
-  wrong = "acheivement" and right = "achievement"
-  or
-  wrong = "acheivements" and right = "achievements"
-  or
-  wrong = "acheives" and right = "achieves"
-  or
-  wrong = "acheiving" and right = "achieving"
-  or
-  wrong = "acheivment" and right = "achievement"
-  or
-  wrong = "acheivments" and right = "achievements"
-  or
-  wrong = "achievment" and right = "achievement"
-  or
-  wrong = "achievments" and right = "achievements"
-  or
-  wrong = "achive" and right = "achieve"
-  or
-  wrong = "achive" and right = "archive"
-  or
-  wrong = "achived" and right = "achieved"
-  or
-  wrong = "achived" and right = "archived"
-  or
-  wrong = "achivement" and right = "achievement"
-  or
-  wrong = "achivements" and right = "achievements"
-  or
-  wrong = "acident" and right = "accident"
-  or
-  wrong = "acknowldeged" and right = "acknowledged"
-  or
-  wrong = "acknowledgeing" and right = "acknowledging"
-  or
-  wrong = "ackward" and right = "awkward"
-  or
-  wrong = "ackward" and right = "backward"
-  or
-  wrong = "acommodate" and right = "accommodate"
-  or
-  wrong = "acomplish" and right = "accomplish"
-  or
-  wrong = "acomplished" and right = "accomplished"
-  or
-  wrong = "acomplishment" and right = "accomplishment"
-  or
-  wrong = "acomplishments" and right = "accomplishments"
-  or
-  wrong = "acording" and right = "according"
-  or
-  wrong = "acordingly" and right = "accordingly"
-  or
-  wrong = "acquaintence" and right = "acquaintance"
-  or
-  wrong = "acquaintences" and right = "acquaintances"
-  or
-  wrong = "acquiantence" and right = "acquaintance"
-  or
-  wrong = "acquiantences" and right = "acquaintances"
-  or
-  wrong = "acquited" and right = "acquitted"
-  or
-  wrong = "activites" and right = "activities"
-  or
-  wrong = "activly" and right = "actively"
-  or
-  wrong = "actualy" and right = "actually"
-  or
-  wrong = "acuracy" and right = "accuracy"
-  or
-  wrong = "acused" and right = "accused"
-  or
-  wrong = "acustom" and right = "accustom"
-  or
-  wrong = "acustommed" and right = "accustomed"
-  or
-  wrong = "adapater" and right = "adapter"
-  or
-  wrong = "adavanced" and right = "advanced"
-  or
-  wrong = "adbandon" and right = "abandon"
-  or
-  wrong = "addional" and right = "additional"
-  or
-  wrong = "addionally" and right = "additionally"
-  or
-  wrong = "additinally" and right = "additionally"
-  or
-  wrong = "additionaly" and right = "additionally"
-  or
-  wrong = "additonal" and right = "additional"
-  or
-  wrong = "additonally" and right = "additionally"
-  or
-  wrong = "addmission" and right = "admission"
-  or
-  wrong = "addopt" and right = "adopt"
-  or
-  wrong = "addopted" and right = "adopted"
-  or
-  wrong = "addoptive" and right = "adoptive"
-  or
-  wrong = "addres" and right = "adders"
-  or
-  wrong = "addres" and right = "address"
-  or
-  wrong = "addresable" and right = "addressable"
-  or
-  wrong = "addresed" and right = "addressed"
-  or
-  wrong = "addresing" and right = "addressing"
-  or
-  wrong = "addressess" and right = "addresses"
-  or
-  wrong = "addtion" and right = "addition"
-  or
-  wrong = "addtional" and right = "additional"
-  or
-  wrong = "adecuate" and right = "adequate"
-  or
-  wrong = "adequit" and right = "adequate"
-  or
-  wrong = "adhearing" and right = "adhering"
-  or
-  wrong = "adherance" and right = "adherence"
-  or
-  wrong = "admendment" and right = "amendment"
-  or
-  wrong = "admininistrative" and right = "administrative"
-  or
-  wrong = "adminstered" and right = "administered"
-  or
-  wrong = "adminstrate" and right = "administrate"
-  or
-  wrong = "adminstration" and right = "administration"
-  or
-  wrong = "adminstrative" and right = "administrative"
-  or
-  wrong = "adminstrator" and right = "administrator"
-  or
-  wrong = "admissability" and right = "admissibility"
-  or
-  wrong = "admissable" and right = "admissible"
-  or
-  wrong = "admited" and right = "admitted"
-  or
-  wrong = "admitedly" and right = "admittedly"
-  or
-  wrong = "adn" and right = "and"
-  or
-  wrong = "adolecent" and right = "adolescent"
-  or
-  wrong = "adquire" and right = "acquire"
-  or
-  wrong = "adquired" and right = "acquired"
-  or
-  wrong = "adquires" and right = "acquires"
-  or
-  wrong = "adquiring" and right = "acquiring"
-  or
-  wrong = "adres" and right = "address"
-  or
-  wrong = "adresable" and right = "addressable"
-  or
-  wrong = "adresing" and right = "addressing"
-  or
-  wrong = "adress" and right = "address"
-  or
-  wrong = "adressable" and right = "addressable"
-  or
-  wrong = "adressed" and right = "addressed"
-  or
-  wrong = "adressing" and right = "addressing"
-  or
-  wrong = "adressing" and right = "dressing"
-  or
-  wrong = "adventrous" and right = "adventurous"
-  or
-  wrong = "advertisment" and right = "advertisement"
-  or
-  wrong = "advertisments" and right = "advertisements"
-  or
-  wrong = "advesary" and right = "adversary"
-  or
-  wrong = "adviced" and right = "advised"
-  or
-  wrong = "aeriel" and right = "aerial"
-  or
-  wrong = "aeriels" and right = "aerials"
-  or
-  wrong = "afair" and right = "affair"
-  or
-  wrong = "afficianados" and right = "aficionados"
-  or
-  wrong = "afficionado" and right = "aficionado"
-  or
-  wrong = "afficionados" and right = "aficionados"
-  or
-  wrong = "affilate" and right = "affiliate"
-  or
-  wrong = "affilliate" and right = "affiliate"
-  or
-  wrong = "affort" and right = "afford"
-  or
-  wrong = "affort" and right = "effort"
-  or
-  wrong = "aforememtioned" and right = "aforementioned"
-  or
-  wrong = "againnst" and right = "against"
-  or
-  wrong = "agains" and right = "against"
-  or
-  wrong = "agaisnt" and right = "against"
-  or
-  wrong = "aganist" and right = "against"
-  or
-  wrong = "aggaravates" and right = "aggravates"
-  or
-  wrong = "aggreed" and right = "agreed"
-  or
-  wrong = "aggreement" and right = "agreement"
-  or
-  wrong = "aggregious" and right = "egregious"
-  or
-  wrong = "aggresive" and right = "aggressive"
-  or
-  wrong = "agian" and right = "again"
-  or
-  wrong = "agianst" and right = "against"
-  or
-  wrong = "agin" and right = "again"
-  or
-  wrong = "agina" and right = "again"
-  or
-  wrong = "agina" and right = "angina"
-  or
-  wrong = "aginst" and right = "against"
-  or
-  wrong = "agravate" and right = "aggravate"
-  or
-  wrong = "agre" and right = "agree"
-  or
-  wrong = "agred" and right = "agreed"
-  or
-  wrong = "agreeement" and right = "agreement"
-  or
-  wrong = "agreemnt" and right = "agreement"
-  or
-  wrong = "agregate" and right = "aggregate"
-  or
-  wrong = "agregates" and right = "aggregates"
-  or
-  wrong = "agreing" and right = "agreeing"
-  or
-  wrong = "agression" and right = "aggression"
-  or
-  wrong = "agressive" and right = "aggressive"
-  or
-  wrong = "agressively" and right = "aggressively"
-  or
-  wrong = "agressor" and right = "aggressor"
-  or
-  wrong = "agricultue" and right = "agriculture"
-  or
-  wrong = "agriculure" and right = "agriculture"
-  or
-  wrong = "agricuture" and right = "agriculture"
-  or
-  wrong = "agrieved" and right = "aggrieved"
-  or
-  wrong = "agrument" and right = "argument"
-  or
-  wrong = "agruments" and right = "arguments"
-  or
-  wrong = "ahev" and right = "have"
-  or
-  wrong = "ahppen" and right = "happen"
-  or
-  wrong = "ahve" and right = "have"
-  or
-  wrong = "aicraft" and right = "aircraft"
-  or
-  wrong = "aiport" and right = "airport"
-  or
-  wrong = "airbourne" and right = "airborne"
-  or
-  wrong = "aircaft" and right = "aircraft"
-  or
-  wrong = "aircrafts" and right = "aircraft"
-  or
-  wrong = "airporta" and right = "airports"
-  or
-  wrong = "airrcraft" and right = "aircraft"
-  or
-  wrong = "aisian" and right = "asian"
-  or
-  wrong = "albiet" and right = "albeit"
-  or
-  wrong = "alchohol" and right = "alcohol"
-  or
-  wrong = "alchoholic" and right = "alcoholic"
-  or
-  wrong = "alchol" and right = "alcohol"
-  or
-  wrong = "alcholic" and right = "alcoholic"
-  or
-  wrong = "alcohal" and right = "alcohol"
-  or
-  wrong = "alcoholical" and right = "alcoholic"
-  or
-  wrong = "aledge" and right = "allege"
-  or
-  wrong = "aledged" and right = "alleged"
-  or
-  wrong = "aledges" and right = "alleges"
-  or
-  wrong = "alege" and right = "allege"
-  or
-  wrong = "aleged" and right = "alleged"
-  or
-  wrong = "alegience" and right = "allegiance"
-  or
-  wrong = "algebraical" and right = "algebraic"
-  or
-  wrong = "algorhitms" and right = "algorithms"
-  or
-  wrong = "algoritm" and right = "algorithm"
-  or
-  wrong = "algoritms" and right = "algorithms"
-  or
-  wrong = "alientating" and right = "alienating"
-  or
-  wrong = "alledge" and right = "allege"
-  or
-  wrong = "alledged" and right = "alleged"
-  or
-  wrong = "alledgedly" and right = "allegedly"
-  or
-  wrong = "alledges" and right = "alleges"
-  or
-  wrong = "allegedely" and right = "allegedly"
-  or
-  wrong = "allegedy" and right = "allegedly"
-  or
-  wrong = "allegely" and right = "allegedly"
-  or
-  wrong = "allegence" and right = "allegiance"
-  or
-  wrong = "allegience" and right = "allegiance"
-  or
-  wrong = "allign" and right = "align"
-  or
-  wrong = "alligned" and right = "aligned"
-  or
-  wrong = "alliviate" and right = "alleviate"
-  or
-  wrong = "allopone" and right = "allophone"
-  or
-  wrong = "allopones" and right = "allophones"
-  or
-  wrong = "allready" and right = "already"
-  or
-  wrong = "allthough" and right = "although"
-  or
-  wrong = "alltogether" and right = "altogether"
-  or
-  wrong = "almsot" and right = "almost"
-  or
-  wrong = "alochol" and right = "alcohol"
-  or
-  wrong = "alomst" and right = "almost"
-  or
-  wrong = "alot" and right = "allot"
-  or
-  wrong = "alotted" and right = "allotted"
-  or
-  wrong = "alowed" and right = "allowed"
-  or
-  wrong = "alowing" and right = "allowing"
-  or
-  wrong = "alreayd" and right = "already"
-  or
-  wrong = "alse" and right = "else"
-  or
-  wrong = "alsot" and right = "also"
-  or
-  wrong = "alternitives" and right = "alternatives"
-  or
-  wrong = "altho" and right = "although"
-  or
-  wrong = "althought" and right = "although"
-  or
-  wrong = "altough" and right = "although"
-  or
-  wrong = "alusion" and right = "allusion"
-  or
-  wrong = "alusion" and right = "illusion"
-  or
-  wrong = "alwasy" and right = "always"
-  or
-  wrong = "alwyas" and right = "always"
-  or
-  wrong = "amalgomated" and right = "amalgamated"
-  or
-  wrong = "amatuer" and right = "amateur"
-  or
-  wrong = "amature" and right = "amateur"
-  or
-  wrong = "amature" and right = "armature"
-  or
-  wrong = "amendmant" and right = "amendment"
-  or
-  wrong = "amercia" and right = "america"
-  or
-  wrong = "amerliorate" and right = "ameliorate"
-  or
-  wrong = "amke" and right = "make"
-  or
-  wrong = "amking" and right = "making"
-  or
-  wrong = "ammend" and right = "amend"
-  or
-  wrong = "ammended" and right = "amended"
-  or
-  wrong = "ammendment" and right = "amendment"
-  or
-  wrong = "ammendments" and right = "amendments"
-  or
-  wrong = "ammount" and right = "amount"
-  or
-  wrong = "ammused" and right = "amused"
-  or
-  wrong = "amoung" and right = "among"
-  or
-  wrong = "amoungst" and right = "amongst"
-  or
-  wrong = "amung" and right = "among"
-  or
-  wrong = "amunition" and right = "ammunition"
-  or
-  wrong = "analagous" and right = "analogous"
-  or
-  wrong = "analitic" and right = "analytic"
-  or
-  wrong = "analogeous" and right = "analogous"
-  or
-  wrong = "anarchim" and right = "anarchism"
-  or
-  wrong = "anarchistm" and right = "anarchism"
-  or
-  wrong = "anbd" and right = "and"
-  or
-  wrong = "ancestory" and right = "ancestry"
-  or
-  wrong = "ancilliary" and right = "ancillary"
-  or
-  wrong = "andd" and right = "and"
-  or
-  wrong = "androgenous" and right = "androgynous"
-  or
-  wrong = "androgeny" and right = "androgyny"
-  or
-  wrong = "anihilation" and right = "annihilation"
-  or
-  wrong = "aniversary" and right = "anniversary"
-  or
-  wrong = "annoint" and right = "anoint"
-  or
-  wrong = "annointed" and right = "anointed"
-  or
-  wrong = "annointing" and right = "anointing"
-  or
-  wrong = "annoints" and right = "anoints"
-  or
-  wrong = "annouced" and right = "announced"
-  or
-  wrong = "annualy" and right = "annually"
-  or
-  wrong = "annuled" and right = "annulled"
-  or
-  wrong = "anohter" and right = "another"
-  or
-  wrong = "anomolies" and right = "anomalies"
-  or
-  wrong = "anomolous" and right = "anomalous"
-  or
-  wrong = "anomoly" and right = "anomaly"
-  or
-  wrong = "anonimity" and right = "anonymity"
-  or
-  wrong = "anounced" and right = "announced"
-  or
-  wrong = "anouncement" and right = "announcement"
-  or
-  wrong = "ansalisation" and right = "nasalisation"
-  or
-  wrong = "ansalization" and right = "nasalization"
-  or
-  wrong = "ansestors" and right = "ancestors"
-  or
-  wrong = "antartic" and right = "antarctic"
-  or
-  wrong = "anthromorphization" and right = "anthropomorphization"
-  or
-  wrong = "anthropolgist" and right = "anthropologist"
-  or
-  wrong = "anthropolgy" and right = "anthropology"
-  or
-  wrong = "anual" and right = "annual"
-  or
-  wrong = "anulled" and right = "annulled"
-  or
-  wrong = "anwsered" and right = "answered"
-  or
-  wrong = "anyhwere" and right = "anywhere"
-  or
-  wrong = "anytying" and right = "anything"
-  or
-  wrong = "aparent" and right = "apparent"
-  or
-  wrong = "aparment" and right = "apartment"
-  or
-  wrong = "apenines" and right = "apennines"
-  or
-  wrong = "aplication" and right = "application"
-  or
-  wrong = "aplied" and right = "applied"
-  or
-  wrong = "apolegetics" and right = "apologetics"
-  or
-  wrong = "apon" and right = "apron"
-  or
-  wrong = "apon" and right = "upon"
-  or
-  wrong = "apparant" and right = "apparent"
-  or
-  wrong = "apparantly" and right = "apparently"
-  or
-  wrong = "appart" and right = "apart"
-  or
-  wrong = "appartment" and right = "apartment"
-  or
-  wrong = "appartments" and right = "apartments"
-  or
-  wrong = "appealling" and right = "appalling"
-  or
-  wrong = "appealling" and right = "appealing"
-  or
-  wrong = "appeareance" and right = "appearance"
-  or
-  wrong = "appearence" and right = "appearance"
-  or
-  wrong = "appearences" and right = "appearances"
-  or
-  wrong = "appenines" and right = "apennines"
-  or
-  wrong = "apperance" and right = "appearance"
-  or
-  wrong = "apperances" and right = "appearances"
-  or
-  wrong = "appereance" and right = "appearance"
-  or
-  wrong = "appereances" and right = "appearances"
-  or
-  wrong = "applicaiton" and right = "application"
-  or
-  wrong = "applicaitons" and right = "applications"
-  or
-  wrong = "appologies" and right = "apologies"
-  or
-  wrong = "appology" and right = "apology"
-  or
-  wrong = "apprearance" and right = "appearance"
-  or
-  wrong = "apprieciate" and right = "appreciate"
-  or
-  wrong = "approachs" and right = "approaches"
-  or
-  wrong = "appropiate" and right = "appropriate"
-  or
-  wrong = "appropraite" and right = "appropriate"
-  or
-  wrong = "appropropiate" and right = "appropriate"
-  or
-  wrong = "approproximate" and right = "approximate"
-  or
-  wrong = "approxamately" and right = "approximately"
-  or
-  wrong = "approxiately" and right = "approximately"
-  or
-  wrong = "approximitely" and right = "approximately"
-  or
-  wrong = "aprehensive" and right = "apprehensive"
-  or
-  wrong = "apropriate" and right = "appropriate"
-  or
-  wrong = "aproval" and right = "approval"
-  or
-  wrong = "aproximate" and right = "approximate"
-  or
-  wrong = "aproximately" and right = "approximately"
-  or
-  wrong = "aquaduct" and right = "aqueduct"
-  or
-  wrong = "aquaintance" and right = "acquaintance"
-  or
-  wrong = "aquainted" and right = "acquainted"
-  or
-  wrong = "aquiantance" and right = "acquaintance"
-  or
-  wrong = "aquire" and right = "acquire"
-  or
-  wrong = "aquired" and right = "acquired"
-  or
-  wrong = "aquiring" and right = "acquiring"
-  or
-  wrong = "aquisition" and right = "acquisition"
-  or
-  wrong = "aquitted" and right = "acquitted"
-  or
-  wrong = "aranged" and right = "arranged"
-  or
-  wrong = "arangement" and right = "arrangement"
-  or
-  wrong = "arbitarily" and right = "arbitrarily"
-  or
-  wrong = "arbitary" and right = "arbitrary"
-  or
-  wrong = "archaelogical" and right = "archaeological"
-  or
-  wrong = "archaelogists" and right = "archaeologists"
-  or
-  wrong = "archaelogy" and right = "archaeology"
-  or
-  wrong = "archaoelogy" and right = "archaeology"
-  or
-  wrong = "archaoelogy" and right = "archeology"
-  or
-  wrong = "archaology" and right = "archaeology"
-  or
-  wrong = "archaology" and right = "archeology"
-  or
-  wrong = "archeaologist" and right = "archaeologist"
-  or
-  wrong = "archeaologist" and right = "archeologist"
-  or
-  wrong = "archeaologists" and right = "archaeologists"
-  or
-  wrong = "archeaologists" and right = "archeologists"
-  or
-  wrong = "archetect" and right = "architect"
-  or
-  wrong = "archetects" and right = "architects"
-  or
-  wrong = "archetectural" and right = "architectural"
-  or
-  wrong = "archetecturally" and right = "architecturally"
-  or
-  wrong = "archetecture" and right = "architecture"
-  or
-  wrong = "archiac" and right = "archaic"
-  or
-  wrong = "archictect" and right = "architect"
-  or
-  wrong = "archimedian" and right = "archimedean"
-  or
-  wrong = "architecht" and right = "architect"
-  or
-  wrong = "architechturally" and right = "architecturally"
-  or
-  wrong = "architechture" and right = "architecture"
-  or
-  wrong = "architechtures" and right = "architectures"
-  or
-  wrong = "architectual" and right = "architectural"
-  or
-  wrong = "archtype" and right = "archetype"
-  or
-  wrong = "archtypes" and right = "archetypes"
-  or
-  wrong = "aready" and right = "already"
-  or
-  wrong = "areodynamics" and right = "aerodynamics"
-  or
-  wrong = "argubly" and right = "arguably"
-  or
-  wrong = "arguement" and right = "argument"
-  or
-  wrong = "arguements" and right = "arguments"
-  or
-  wrong = "arised" and right = "arose"
-  or
-  wrong = "arival" and right = "arrival"
-  or
-  wrong = "armamant" and right = "armament"
-  or
-  wrong = "armistace" and right = "armistice"
-  or
-  wrong = "arogant" and right = "arrogant"
-  or
-  wrong = "arogent" and right = "arrogant"
-  or
-  wrong = "aroud" and right = "around"
-  or
-  wrong = "arrangment" and right = "arrangement"
-  or
-  wrong = "arrangments" and right = "arrangements"
-  or
-  wrong = "arrengement" and right = "arrangement"
-  or
-  wrong = "arrengements" and right = "arrangements"
-  or
-  wrong = "arround" and right = "around"
-  or
-  wrong = "artcile" and right = "article"
-  or
-  wrong = "artical" and right = "article"
-  or
-  wrong = "artice" and right = "article"
-  or
-  wrong = "articel" and right = "article"
-  or
-  wrong = "artifical" and right = "artificial"
-  or
-  wrong = "artifically" and right = "artificially"
-  or
-  wrong = "artillary" and right = "artillery"
-  or
-  wrong = "arund" and right = "around"
-  or
-  wrong = "asetic" and right = "ascetic"
-  or
-  wrong = "asign" and right = "assign"
-  or
-  wrong = "aslo" and right = "also"
-  or
-  wrong = "asnyc" and right = "async"
-  or
-  wrong = "asociated" and right = "associated"
-  or
-  wrong = "asorbed" and right = "absorbed"
-  or
-  wrong = "asphyxation" and right = "asphyxiation"
-  or
-  wrong = "assasin" and right = "assassin"
-  or
-  wrong = "assasinate" and right = "assassinate"
-  or
-  wrong = "assasinated" and right = "assassinated"
-  or
-  wrong = "assasinates" and right = "assassinates"
-  or
-  wrong = "assasination" and right = "assassination"
-  or
-  wrong = "assasinations" and right = "assassinations"
-  or
-  wrong = "assasined" and right = "assassinated"
-  or
-  wrong = "assasins" and right = "assassins"
-  or
-  wrong = "assassintation" and right = "assassination"
-  or
-  wrong = "assemple" and right = "assemble"
-  or
-  wrong = "assertation" and right = "assertion"
-  or
-  wrong = "asside" and right = "aside"
-  or
-  wrong = "assisnate" and right = "assassinate"
-  or
-  wrong = "assit" and right = "assist"
-  or
-  wrong = "assitant" and right = "assistant"
-  or
-  wrong = "assocation" and right = "association"
-  or
-  wrong = "assoicate" and right = "associate"
-  or
-  wrong = "assoicated" and right = "associated"
-  or
-  wrong = "assoicates" and right = "associates"
-  or
-  wrong = "assosication" and right = "assassination"
-  or
-  wrong = "asssassans" and right = "assassins"
-  or
-  wrong = "assualt" and right = "assault"
-  or
-  wrong = "assualted" and right = "assaulted"
-  or
-  wrong = "assymetric" and right = "asymmetric"
-  or
-  wrong = "assymetrical" and right = "asymmetrical"
-  or
-  wrong = "asteriod" and right = "asteroid"
-  or
-  wrong = "asthetic" and right = "aesthetic"
-  or
-  wrong = "asthetical" and right = "aesthetical"
-  or
-  wrong = "asthetically" and right = "aesthetically"
-  or
-  wrong = "asume" and right = "assume"
-  or
-  wrong = "atain" and right = "attain"
-  or
-  wrong = "atempting" and right = "attempting"
-  or
-  wrong = "atheistical" and right = "atheistic"
-  or
-  wrong = "athenean" and right = "athenian"
-  or
-  wrong = "atheneans" and right = "athenians"
-  or
-  wrong = "athiesm" and right = "atheism"
-  or
-  wrong = "athiest" and right = "atheist"
-  or
-  wrong = "atorney" and right = "attorney"
-  or
-  wrong = "atribute" and right = "attribute"
-  or
-  wrong = "atributed" and right = "attributed"
-  or
-  wrong = "atributes" and right = "attributes"
-  or
-  wrong = "attaindre" and right = "attainder"
-  or
-  wrong = "attaindre" and right = "attained"
-  or
-  wrong = "attemp" and right = "attempt"
-  or
-  wrong = "attemped" and right = "attempted"
-  or
-  wrong = "attemt" and right = "attempt"
-  or
-  wrong = "attemted" and right = "attempted"
-  or
-  wrong = "attemting" and right = "attempting"
-  or
-  wrong = "attemts" and right = "attempts"
-  or
-  wrong = "attendence" and right = "attendance"
-  or
-  wrong = "attendent" and right = "attendant"
-  or
-  wrong = "attendents" and right = "attendants"
-  or
-  wrong = "attened" and right = "attended"
-  or
-  wrong = "attension" and right = "attention"
-  or
-  wrong = "attitide" and right = "attitude"
-  or
-  wrong = "attributred" and right = "attributed"
-  or
-  wrong = "attrocities" and right = "atrocities"
-  or
-  wrong = "audeince" and right = "audience"
-  or
-  wrong = "auromated" and right = "automated"
-  or
-  wrong = "austrailia" and right = "australia"
-  or
-  wrong = "austrailian" and right = "australian"
-  or
-  wrong = "auther" and right = "author"
-  or
-  wrong = "authobiographic" and right = "autobiographic"
-  or
-  wrong = "authobiography" and right = "autobiography"
-  or
-  wrong = "authorative" and right = "authoritative"
-  or
-  wrong = "authorites" and right = "authorities"
-  or
-  wrong = "authorithy" and right = "authority"
-  or
-  wrong = "authoritiers" and right = "authorities"
-  or
-  wrong = "authoritive" and right = "authoritative"
-  or
-  wrong = "authrorities" and right = "authorities"
-  or
-  wrong = "autochtonous" and right = "autochthonous"
-  or
-  wrong = "autoctonous" and right = "autochthonous"
-  or
-  wrong = "automaticly" and right = "automatically"
-  or
-  wrong = "automibile" and right = "automobile"
-  or
-  wrong = "automonomous" and right = "autonomous"
-  or
-  wrong = "autor" and right = "author"
-  or
-  wrong = "autority" and right = "authority"
-  or
-  wrong = "auxilary" and right = "auxiliary"
-  or
-  wrong = "auxillaries" and right = "auxiliaries"
-  or
-  wrong = "auxillary" and right = "auxiliary"
-  or
-  wrong = "auxilliaries" and right = "auxiliaries"
-  or
-  wrong = "auxilliary" and right = "auxiliary"
-  or
-  wrong = "availabe" and right = "available"
-  or
-  wrong = "availablity" and right = "availability"
-  or
-  wrong = "availaible" and right = "available"
-  or
-  wrong = "availble" and right = "available"
-  or
-  wrong = "availiable" and right = "available"
-  or
-  wrong = "availible" and right = "available"
-  or
-  wrong = "avalable" and right = "available"
-  or
-  wrong = "avalance" and right = "avalanche"
-  or
-  wrong = "avaliable" and right = "available"
-  or
-  wrong = "avation" and right = "aviation"
-  or
-  wrong = "averageed" and right = "averaged"
-  or
-  wrong = "avilable" and right = "available"
-  or
-  wrong = "awared" and right = "awarded"
-  or
-  wrong = "awya" and right = "away"
-  or
-  wrong = "baceause" and right = "because"
-  or
-  wrong = "backgorund" and right = "background"
-  or
-  wrong = "backrounds" and right = "backgrounds"
-  or
-  wrong = "bakc" and right = "back"
-  or
-  wrong = "banannas" and right = "bananas"
-  or
-  wrong = "bandwith" and right = "bandwidth"
-  or
-  wrong = "bankrupcy" and right = "bankruptcy"
-  or
-  wrong = "banruptcy" and right = "bankruptcy"
-  or
-  wrong = "baout" and right = "about"
-  or
-  wrong = "baout" and right = "bout"
-  or
-  wrong = "basicaly" and right = "basically"
-  or
-  wrong = "basicly" and right = "basically"
-  or
-  wrong = "bcak" and right = "back"
-  or
-  wrong = "beachead" and right = "beachhead"
-  or
-  wrong = "beacuse" and right = "because"
-  or
-  wrong = "beastiality" and right = "bestiality"
-  or
-  wrong = "beatiful" and right = "beautiful"
-  or
-  wrong = "beaurocracy" and right = "bureaucracy"
-  or
-  wrong = "beaurocratic" and right = "bureaucratic"
-  or
-  wrong = "beautyfull" and right = "beautiful"
-  or
-  wrong = "becamae" and right = "became"
-  or
-  wrong = "becames" and right = "became"
-  or
-  wrong = "becames" and right = "becomes"
-  or
-  wrong = "becasue" and right = "because"
-  or
-  wrong = "beccause" and right = "because"
-  or
-  wrong = "becomeing" and right = "becoming"
-  or
-  wrong = "becomming" and right = "becoming"
-  or
-  wrong = "becouse" and right = "because"
-  or
-  wrong = "becuase" and right = "because"
-  or
-  wrong = "bedore" and right = "before"
-  or
-  wrong = "beeing" and right = "being"
-  or
-  wrong = "befoer" and right = "before"
-  or
-  wrong = "beggin" and right = "begging"
-  or
-  wrong = "beggin" and right = "begin"
-  or
-  wrong = "begginer" and right = "beginner"
-  or
-  wrong = "begginers" and right = "beginners"
-  or
-  wrong = "beggining" and right = "beginning"
-  or
-  wrong = "begginings" and right = "beginnings"
-  or
-  wrong = "beggins" and right = "begins"
-  or
-  wrong = "begining" and right = "beginning"
-  or
-  wrong = "beginnig" and right = "beginning"
-  or
-  wrong = "behavour" and right = "behavior"
-  or
-  wrong = "behavour" and right = "behaviour"
-  or
-  wrong = "beleagured" and right = "beleaguered"
-  or
-  wrong = "beleif" and right = "belief"
-  or
-  wrong = "beleive" and right = "believe"
-  or
-  wrong = "beleived" and right = "believed"
-  or
-  wrong = "beleives" and right = "believes"
-  or
-  wrong = "beleiving" and right = "believing"
-  or
-  wrong = "beligum" and right = "belgium"
-  or
-  wrong = "belive" and right = "believe"
-  or
-  wrong = "belived" and right = "believed"
-  or
-  wrong = "belived" and right = "beloved"
-  or
-  wrong = "belives" and right = "beliefs"
-  or
-  wrong = "belives" and right = "believes"
-  or
-  wrong = "belligerant" and right = "belligerent"
-  or
-  wrong = "bellweather" and right = "bellwether"
-  or
-  wrong = "bemusemnt" and right = "bemusement"
-  or
-  wrong = "beneficary" and right = "beneficiary"
-  or
-  wrong = "beng" and right = "being"
-  or
-  wrong = "benificial" and right = "beneficial"
-  or
-  wrong = "benifit" and right = "benefit"
-  or
-  wrong = "benifits" and right = "benefits"
-  or
-  wrong = "bergamont" and right = "bergamot"
-  or
-  wrong = "bernouilli" and right = "bernoulli"
-  or
-  wrong = "beseige" and right = "besiege"
-  or
-  wrong = "beseiged" and right = "besieged"
-  or
-  wrong = "beseiging" and right = "besieging"
-  or
-  wrong = "beteen" and right = "between"
-  or
-  wrong = "betwen" and right = "between"
-  or
-  wrong = "beween" and right = "between"
-  or
-  wrong = "bewteen" and right = "between"
-  or
-  wrong = "bigining" and right = "beginning"
-  or
-  wrong = "biginning" and right = "beginning"
-  or
-  wrong = "bilateraly" and right = "bilaterally"
-  or
-  wrong = "billingualism" and right = "bilingualism"
-  or
-  wrong = "binominal" and right = "binomial"
-  or
-  wrong = "bizzare" and right = "bizarre"
-  or
-  wrong = "blaim" and right = "blame"
-  or
-  wrong = "blaimed" and right = "blamed"
-  or
-  wrong = "blessure" and right = "blessing"
-  or
-  wrong = "blitzkreig" and right = "blitzkrieg"
-  or
-  wrong = "boaut" and right = "about"
-  or
-  wrong = "boaut" and right = "boat"
-  or
-  wrong = "boaut" and right = "bout"
-  or
-  wrong = "bodydbuilder" and right = "bodybuilder"
-  or
-  wrong = "bolean" and right = "boolean"
-  or
-  wrong = "bombardement" and right = "bombardment"
-  or
-  wrong = "bombarment" and right = "bombardment"
-  or
-  wrong = "bondary" and right = "boundary"
-  or
-  wrong = "bonnano" and right = "bonanno"
-  or
-  wrong = "boook" and right = "book"
-  or
-  wrong = "borke" and right = "broke"
-  or
-  wrong = "boundry" and right = "boundary"
-  or
-  wrong = "bouyancy" and right = "buoyancy"
-  or
-  wrong = "bouyant" and right = "buoyant"
-  or
-  wrong = "boyant" and right = "buoyant"
-  or
-  wrong = "bradcast" and right = "broadcast"
-  or
-  wrong = "brasillian" and right = "brazilian"
-  or
-  wrong = "breakthough" and right = "breakthrough"
-  or
-  wrong = "breakthroughts" and right = "breakthroughs"
-  or
-  wrong = "breif" and right = "brief"
-  or
-  wrong = "breifly" and right = "briefly"
-  or
-  wrong = "brethen" and right = "brethren"
-  or
-  wrong = "bretheren" and right = "brethren"
-  or
-  wrong = "briliant" and right = "brilliant"
-  or
-  wrong = "brillant" and right = "brilliant"
-  or
-  wrong = "brimestone" and right = "brimstone"
-  or
-  wrong = "britian" and right = "britain"
-  or
-  wrong = "brittish" and right = "british"
-  or
-  wrong = "broacasted" and right = "broadcast"
-  or
-  wrong = "broadacasting" and right = "broadcasting"
-  or
-  wrong = "broady" and right = "broadly"
-  or
-  wrong = "buddah" and right = "buddha"
-  or
-  wrong = "buddist" and right = "buddhist"
-  or
-  wrong = "buisness" and right = "business"
-  or
-  wrong = "buisnessman" and right = "businessman"
-  or
-  wrong = "buoancy" and right = "buoyancy"
-  or
-  wrong = "buring" and right = "burin"
-  or
-  wrong = "buring" and right = "burning"
-  or
-  wrong = "buring" and right = "burying"
-  or
-  wrong = "buring" and right = "during"
-  or
-  wrong = "burried" and right = "buried"
-  or
-  wrong = "busines" and right = "business"
-  or
-  wrong = "busineses" and right = "business"
-  or
-  wrong = "busineses" and right = "businesses"
-  or
-  wrong = "busness" and right = "business"
-  or
-  wrong = "bussiness" and right = "business"
-  or
-  wrong = "caculater" and right = "calculator"
-  or
-  wrong = "cacuses" and right = "caucuses"
-  or
-  wrong = "cahracters" and right = "characters"
-  or
-  wrong = "calaber" and right = "caliber"
-  or
-  wrong = "calander" and right = "calendar"
-  or
-  wrong = "calander" and right = "calender"
-  or
-  wrong = "calander" and right = "colander"
-  or
-  wrong = "calculater" and right = "calculator"
-  or
-  wrong = "calculs" and right = "calculus"
-  or
-  wrong = "calender" and right = "calendar"
-  or
-  wrong = "calenders" and right = "calendars"
-  or
-  wrong = "caligraphy" and right = "calligraphy"
-  or
-  wrong = "caluclate" and right = "calculate"
-  or
-  wrong = "caluclated" and right = "calculated"
-  or
-  wrong = "caluculate" and right = "calculate"
-  or
-  wrong = "caluculated" and right = "calculated"
-  or
-  wrong = "calulate" and right = "calculate"
-  or
-  wrong = "calulated" and right = "calculated"
-  or
-  wrong = "calulater" and right = "calculator"
-  or
-  wrong = "cambrige" and right = "cambridge"
-  or
-  wrong = "camoflage" and right = "camouflage"
-  or
-  wrong = "campagin" and right = "campaign"
-  or
-  wrong = "campain" and right = "campaign"
-  or
-  wrong = "campains" and right = "campaigns"
-  or
-  wrong = "candadate" and right = "candidate"
-  or
-  wrong = "candiate" and right = "candidate"
-  or
-  wrong = "candidiate" and right = "candidate"
-  or
-  wrong = "cannister" and right = "canister"
-  or
-  wrong = "cannisters" and right = "canisters"
-  or
-  wrong = "cannnot" and right = "cannot"
-  or
-  wrong = "cannonical" and right = "canonical"
-  or
-  wrong = "cannotation" and right = "connotation"
-  or
-  wrong = "cannotations" and right = "connotations"
-  or
-  wrong = "caost" and right = "coast"
-  or
-  wrong = "caperbility" and right = "capability"
-  or
-  wrong = "capible" and right = "capable"
-  or
-  wrong = "captial" and right = "capital"
-  or
-  wrong = "captued" and right = "captured"
-  or
-  wrong = "capturd" and right = "captured"
-  or
-  wrong = "carachter" and right = "character"
-  or
-  wrong = "caracterized" and right = "characterized"
-  or
-  wrong = "carcas" and right = "caracas"
-  or
-  wrong = "carcas" and right = "carcass"
-  or
-  wrong = "carefull" and right = "careful"
-  or
-  wrong = "careing" and right = "caring"
-  or
-  wrong = "carismatic" and right = "charismatic"
-  or
-  wrong = "carmalite" and right = "carmelite"
-  or
-  wrong = "carnagie" and right = "carnegie"
-  or
-  wrong = "carnege" and right = "carnage"
-  or
-  wrong = "carnege" and right = "carnegie"
-  or
-  wrong = "carnige" and right = "carnage"
-  or
-  wrong = "carnige" and right = "carnegie"
-  or
-  wrong = "carnigie" and right = "carnegie"
-  or
-  wrong = "carreer" and right = "career"
-  or
-  wrong = "carrers" and right = "careers"
-  or
-  wrong = "carribbean" and right = "caribbean"
-  or
-  wrong = "carribean" and right = "caribbean"
-  or
-  wrong = "carryng" and right = "carrying"
-  or
-  wrong = "cartdridge" and right = "cartridge"
-  or
-  wrong = "carthagian" and right = "carthaginian"
-  or
-  wrong = "carthographer" and right = "cartographer"
-  or
-  wrong = "cartilege" and right = "cartilage"
-  or
-  wrong = "cartilidge" and right = "cartilage"
-  or
-  wrong = "cartrige" and right = "cartridge"
-  or
-  wrong = "casette" and right = "cassette"
-  or
-  wrong = "casion" and right = "caisson"
-  or
-  wrong = "cassawory" and right = "cassowary"
-  or
-  wrong = "cassowarry" and right = "cassowary"
-  or
-  wrong = "casue" and right = "cause"
-  or
-  wrong = "casued" and right = "caused"
-  or
-  wrong = "casues" and right = "causes"
-  or
-  wrong = "casuing" and right = "causing"
-  or
-  wrong = "casulaties" and right = "casualties"
-  or
-  wrong = "casulaty" and right = "casualty"
-  or
-  wrong = "catagories" and right = "categories"
-  or
-  wrong = "catagorized" and right = "categorized"
-  or
-  wrong = "catagory" and right = "category"
-  or
-  wrong = "cataline" and right = "catalina"
-  or
-  wrong = "cataline" and right = "catiline"
-  or
-  wrong = "catapillar" and right = "caterpillar"
-  or
-  wrong = "catapillars" and right = "caterpillars"
-  or
-  wrong = "catapiller" and right = "caterpillar"
-  or
-  wrong = "catapillers" and right = "caterpillars"
-  or
-  wrong = "catepillar" and right = "caterpillar"
-  or
-  wrong = "catepillars" and right = "caterpillars"
-  or
-  wrong = "catergorize" and right = "categorize"
-  or
-  wrong = "catergorized" and right = "categorized"
-  or
-  wrong = "caterpilar" and right = "caterpillar"
-  or
-  wrong = "caterpilars" and right = "caterpillars"
-  or
-  wrong = "caterpiller" and right = "caterpillar"
-  or
-  wrong = "caterpillers" and right = "caterpillars"
-  or
-  wrong = "cathlic" and right = "catholic"
-  or
-  wrong = "catholocism" and right = "catholicism"
-  or
-  wrong = "catterpilar" and right = "caterpillar"
-  or
-  wrong = "catterpilars" and right = "caterpillars"
-  or
-  wrong = "catterpillar" and right = "caterpillar"
-  or
-  wrong = "catterpillars" and right = "caterpillars"
-  or
-  wrong = "cattleship" and right = "battleship"
-  or
-  wrong = "causalities" and right = "casualties"
-  or
-  wrong = "ceasar" and right = "caesar"
-  or
-  wrong = "celcius" and right = "celsius"
-  or
-  wrong = "cellpading" and right = "cellpadding"
-  or
-  wrong = "cementary" and right = "cemetery"
-  or
-  wrong = "cemetarey" and right = "cemetery"
-  or
-  wrong = "cemetaries" and right = "cemeteries"
-  or
-  wrong = "cemetary" and right = "cemetery"
-  or
-  wrong = "cencus" and right = "census"
-  or
-  wrong = "censur" and right = "censor"
-  or
-  wrong = "censur" and right = "censure"
-  or
-  wrong = "cententenial" and right = "centennial"
-  or
-  wrong = "centruies" and right = "centuries"
-  or
-  wrong = "centruy" and right = "century"
-  or
-  wrong = "centuties" and right = "centuries"
-  or
-  wrong = "centuty" and right = "century"
-  or
-  wrong = "ceratin" and right = "certain"
-  or
-  wrong = "ceratin" and right = "keratin"
-  or
-  wrong = "cerimonial" and right = "ceremonial"
-  or
-  wrong = "cerimonies" and right = "ceremonies"
-  or
-  wrong = "cerimonious" and right = "ceremonious"
-  or
-  wrong = "cerimony" and right = "ceremony"
-  or
-  wrong = "ceromony" and right = "ceremony"
-  or
-  wrong = "certainity" and right = "certainty"
-  or
-  wrong = "certian" and right = "certain"
-  or
-  wrong = "cervial" and right = "cervical"
-  or
-  wrong = "cervial" and right = "serval"
-  or
-  wrong = "cervial" and right = "servile"
-  or
-  wrong = "chalenging" and right = "challenging"
-  or
-  wrong = "challange" and right = "challenge"
-  or
-  wrong = "challanged" and right = "challenged"
-  or
-  wrong = "challege" and right = "challenge"
-  or
-  wrong = "champange" and right = "champagne"
-  or
-  wrong = "changable" and right = "changeable"
-  or
-  wrong = "charachter" and right = "character"
-  or
-  wrong = "charachters" and right = "characters"
-  or
-  wrong = "charactersistic" and right = "characteristic"
-  or
-  wrong = "charactor" and right = "character"
-  or
-  wrong = "charactors" and right = "characters"
-  or
-  wrong = "charasmatic" and right = "charismatic"
-  or
-  wrong = "charaterized" and right = "characterized"
-  or
-  wrong = "chariman" and right = "chairman"
-  or
-  wrong = "charistics" and right = "characteristics"
-  or
-  wrong = "chasr" and right = "chase"
-  or
-  wrong = "chasr" and right = "chaser"
-  or
-  wrong = "cheif" and right = "chief"
-  or
-  wrong = "cheifs" and right = "chiefs"
-  or
-  wrong = "chemcial" and right = "chemical"
-  or
-  wrong = "chemcially" and right = "chemically"
-  or
-  wrong = "chemestry" and right = "chemistry"
-  or
-  wrong = "chemicaly" and right = "chemically"
-  or
-  wrong = "childbird" and right = "childbirth"
-  or
-  wrong = "childen" and right = "children"
-  or
-  wrong = "choclate" and right = "chocolate"
-  or
-  wrong = "choosen" and right = "chosen"
-  or
-  wrong = "chracter" and right = "character"
-  or
-  wrong = "chuch" and right = "church"
-  or
-  wrong = "churchs" and right = "churches"
-  or
-  wrong = "cincinatti" and right = "cincinnati"
-  or
-  wrong = "cincinnatti" and right = "cincinnati"
-  or
-  wrong = "circulaton" and right = "circulation"
-  or
-  wrong = "circumsicion" and right = "circumcision"
-  or
-  wrong = "circut" and right = "circuit"
-  or
-  wrong = "ciricuit" and right = "circuit"
-  or
-  wrong = "ciriculum" and right = "curriculum"
-  or
-  wrong = "civillian" and right = "civilian"
-  or
-  wrong = "claer" and right = "clear"
-  or
-  wrong = "claerer" and right = "clearer"
-  or
-  wrong = "claerly" and right = "clearly"
-  or
-  wrong = "claimes" and right = "claims"
-  or
-  wrong = "clas" and right = "class"
-  or
-  wrong = "clasic" and right = "classic"
-  or
-  wrong = "clasical" and right = "classical"
-  or
-  wrong = "clasically" and right = "classically"
-  or
-  wrong = "cleareance" and right = "clearance"
-  or
-  wrong = "clera" and right = "clear"
-  or
-  wrong = "clera" and right = "sclera"
-  or
-  wrong = "clincial" and right = "clinical"
-  or
-  wrong = "clinicaly" and right = "clinically"
-  or
-  wrong = "cmo" and right = "com"
-  or
-  wrong = "cmoputer" and right = "computer"
-  or
-  wrong = "coctail" and right = "cocktail"
-  or
-  wrong = "coform" and right = "conform"
-  or
-  wrong = "cognizent" and right = "cognizant"
-  or
-  wrong = "coincedentally" and right = "coincidentally"
-  or
-  wrong = "colaborations" and right = "collaborations"
-  or
-  wrong = "colateral" and right = "collateral"
-  or
-  wrong = "colelctive" and right = "collective"
-  or
-  wrong = "collaberative" and right = "collaborative"
-  or
-  wrong = "collecton" and right = "collection"
-  or
-  wrong = "collegue" and right = "colleague"
-  or
-  wrong = "collegues" and right = "colleagues"
-  or
-  wrong = "collonade" and right = "colonnade"
-  or
-  wrong = "collonies" and right = "colonies"
-  or
-  wrong = "collony" and right = "colony"
-  or
-  wrong = "collosal" and right = "colossal"
-  or
-  wrong = "colonizators" and right = "colonizers"
-  or
-  wrong = "comander" and right = "commandeer"
-  or
-  wrong = "comander" and right = "commander"
-  or
-  wrong = "comando" and right = "commando"
-  or
-  wrong = "comandos" and right = "commandos"
-  or
-  wrong = "comany" and right = "company"
-  or
-  wrong = "comapany" and right = "company"
-  or
-  wrong = "comback" and right = "comeback"
-  or
-  wrong = "combanations" and right = "combinations"
-  or
-  wrong = "combinatins" and right = "combinations"
-  or
-  wrong = "combusion" and right = "combustion"
-  or
-  wrong = "comdemnation" and right = "condemnation"
-  or
-  wrong = "comemmorates" and right = "commemorates"
-  or
-  wrong = "comemoretion" and right = "commemoration"
-  or
-  wrong = "comision" and right = "commission"
-  or
-  wrong = "comisioned" and right = "commissioned"
-  or
-  wrong = "comisioner" and right = "commissioner"
-  or
-  wrong = "comisioning" and right = "commissioning"
-  or
-  wrong = "comisions" and right = "commissions"
-  or
-  wrong = "comission" and right = "commission"
-  or
-  wrong = "comissioned" and right = "commissioned"
-  or
-  wrong = "comissioner" and right = "commissioner"
-  or
-  wrong = "comissioning" and right = "commissioning"
-  or
-  wrong = "comissions" and right = "commissions"
-  or
-  wrong = "comited" and right = "committed"
-  or
-  wrong = "comiting" and right = "committing"
-  or
-  wrong = "comitted" and right = "committed"
-  or
-  wrong = "comittee" and right = "committee"
-  or
-  wrong = "comitting" and right = "committing"
-  or
-  wrong = "commandoes" and right = "commandos"
-  or
-  wrong = "commedic" and right = "comedic"
-  or
-  wrong = "commemerative" and right = "commemorative"
-  or
-  wrong = "commemmorate" and right = "commemorate"
-  or
-  wrong = "commemmorating" and right = "commemorating"
-  or
-  wrong = "commerical" and right = "commercial"
-  or
-  wrong = "commerically" and right = "commercially"
-  or
-  wrong = "commericial" and right = "commercial"
-  or
-  wrong = "commericially" and right = "commercially"
-  or
-  wrong = "commerorative" and right = "commemorative"
-  or
-  wrong = "comming" and right = "coming"
-  or
-  wrong = "comminication" and right = "communication"
-  or
-  wrong = "commision" and right = "commission"
-  or
-  wrong = "commisioned" and right = "commissioned"
-  or
-  wrong = "commisioner" and right = "commissioner"
-  or
-  wrong = "commisioning" and right = "commissioning"
-  or
-  wrong = "commisions" and right = "commissions"
-  or
-  wrong = "commited" and right = "committed"
-  or
-  wrong = "commitee" and right = "committee"
-  or
-  wrong = "commiting" and right = "committing"
-  or
-  wrong = "committe" and right = "committee"
-  or
-  wrong = "committment" and right = "commitment"
-  or
-  wrong = "committments" and right = "commitments"
-  or
-  wrong = "commmemorated" and right = "commemorated"
-  or
-  wrong = "commongly" and right = "commonly"
-  or
-  wrong = "commonweath" and right = "commonwealth"
-  or
-  wrong = "commuications" and right = "communications"
-  or
-  wrong = "commuinications" and right = "communications"
-  or
-  wrong = "communciation" and right = "communication"
-  or
-  wrong = "communiation" and right = "communication"
-  or
-  wrong = "communites" and right = "communities"
-  or
-  wrong = "compability" and right = "compatibility"
-  or
-  wrong = "comparision" and right = "comparison"
-  or
-  wrong = "comparisions" and right = "comparisons"
-  or
-  wrong = "comparitive" and right = "comparative"
-  or
-  wrong = "comparitively" and right = "comparatively"
-  or
-  wrong = "compatabilities" and right = "compatibilities"
-  or
-  wrong = "compatability" and right = "compatibility"
-  or
-  wrong = "compatable" and right = "compatible"
-  or
-  wrong = "compatablities" and right = "compatibilities"
-  or
-  wrong = "compatablity" and right = "compatibility"
-  or
-  wrong = "compatiable" and right = "compatible"
-  or
-  wrong = "compatiblities" and right = "compatibilities"
-  or
-  wrong = "compatiblity" and right = "compatibility"
-  or
-  wrong = "compeitions" and right = "competitions"
-  or
-  wrong = "compensantion" and right = "compensation"
-  or
-  wrong = "competance" and right = "competence"
-  or
-  wrong = "competant" and right = "competent"
-  or
-  wrong = "competative" and right = "competitive"
-  or
-  wrong = "competion" and right = "competition"
-  or
-  wrong = "competion" and right = "completion"
-  or
-  wrong = "competitiion" and right = "competition"
-  or
-  wrong = "competive" and right = "competitive"
-  or
-  wrong = "competiveness" and right = "competitiveness"
-  or
-  wrong = "comphrehensive" and right = "comprehensive"
-  or
-  wrong = "compitent" and right = "competent"
-  or
-  wrong = "completelyl" and right = "completely"
-  or
-  wrong = "completetion" and right = "completion"
-  or
-  wrong = "complier" and right = "compiler"
-  or
-  wrong = "componant" and right = "component"
-  or
-  wrong = "comprable" and right = "comparable"
-  or
-  wrong = "comprimise" and right = "compromise"
-  or
-  wrong = "compulsary" and right = "compulsory"
-  or
-  wrong = "compulsery" and right = "compulsory"
-  or
-  wrong = "computarized" and right = "computerized"
-  or
-  wrong = "concensus" and right = "consensus"
-  or
-  wrong = "concider" and right = "consider"
-  or
-  wrong = "concidered" and right = "considered"
-  or
-  wrong = "concidering" and right = "considering"
-  or
-  wrong = "conciders" and right = "considers"
-  or
-  wrong = "concieted" and right = "conceited"
-  or
-  wrong = "concieved" and right = "conceived"
-  or
-  wrong = "concious" and right = "conscious"
-  or
-  wrong = "conciously" and right = "consciously"
-  or
-  wrong = "conciousness" and right = "consciousness"
-  or
-  wrong = "condamned" and right = "condemned"
-  or
-  wrong = "condemmed" and right = "condemned"
-  or
-  wrong = "condidtion" and right = "condition"
-  or
-  wrong = "condidtions" and right = "conditions"
-  or
-  wrong = "conected" and right = "connected"
-  or
-  wrong = "conection" and right = "connection"
-  or
-  wrong = "conesencus" and right = "consensus"
-  or
-  wrong = "confidental" and right = "confidential"
-  or
-  wrong = "confidentally" and right = "confidentially"
-  or
-  wrong = "confids" and right = "confides"
-  or
-  wrong = "configureable" and right = "configurable"
-  or
-  wrong = "confortable" and right = "comfortable"
-  or
-  wrong = "congradulations" and right = "congratulations"
-  or
-  wrong = "congresional" and right = "congressional"
-  or
-  wrong = "conived" and right = "connived"
-  or
-  wrong = "conjecutre" and right = "conjecture"
-  or
-  wrong = "conjuction" and right = "conjunction"
-  or
-  wrong = "connectinos" and right = "connections"
-  or
-  wrong = "conneticut" and right = "connecticut"
-  or
-  wrong = "conotations" and right = "connotations"
-  or
-  wrong = "conquerd" and right = "conquered"
-  or
-  wrong = "conquerer" and right = "conqueror"
-  or
-  wrong = "conquerers" and right = "conquerors"
-  or
-  wrong = "conqured" and right = "conquered"
-  or
-  wrong = "conscent" and right = "consent"
-  or
-  wrong = "consciouness" and right = "consciousness"
-  or
-  wrong = "consdider" and right = "consider"
-  or
-  wrong = "consdidered" and right = "considered"
-  or
-  wrong = "consdiered" and right = "considered"
-  or
-  wrong = "consectutive" and right = "consecutive"
-  or
-  wrong = "consenquently" and right = "consequently"
-  or
-  wrong = "consentrate" and right = "concentrate"
-  or
-  wrong = "consentrated" and right = "concentrated"
-  or
-  wrong = "consentrates" and right = "concentrates"
-  or
-  wrong = "consept" and right = "concept"
-  or
-  wrong = "consequentually" and right = "consequently"
-  or
-  wrong = "consequeseces" and right = "consequences"
-  or
-  wrong = "consern" and right = "concern"
-  or
-  wrong = "conserned" and right = "concerned"
-  or
-  wrong = "conserning" and right = "concerning"
-  or
-  wrong = "conservitive" and right = "conservative"
-  or
-  wrong = "consiciousness" and right = "consciousness"
-  or
-  wrong = "consicousness" and right = "consciousness"
-  or
-  wrong = "considerd" and right = "considered"
-  or
-  wrong = "consideres" and right = "considered"
-  or
-  wrong = "consious" and right = "conscious"
-  or
-  wrong = "consistant" and right = "consistent"
-  or
-  wrong = "consistantly" and right = "consistently"
-  or
-  wrong = "consituencies" and right = "constituencies"
-  or
-  wrong = "consituency" and right = "constituency"
-  or
-  wrong = "consituted" and right = "constituted"
-  or
-  wrong = "consitution" and right = "constitution"
-  or
-  wrong = "consitutional" and right = "constitutional"
-  or
-  wrong = "consolodate" and right = "consolidate"
-  or
-  wrong = "consolodated" and right = "consolidated"
-  or
-  wrong = "consonent" and right = "consonant"
-  or
-  wrong = "consonents" and right = "consonants"
-  or
-  wrong = "consorcium" and right = "consortium"
-  or
-  wrong = "conspiracys" and right = "conspiracies"
-  or
-  wrong = "conspiriator" and right = "conspirator"
-  or
-  wrong = "consructor" and right = "constructor"
-  or
-  wrong = "constaints" and right = "constraints"
-  or
-  wrong = "constanly" and right = "constantly"
-  or
-  wrong = "constarnation" and right = "consternation"
-  or
-  wrong = "constatn" and right = "constant"
-  or
-  wrong = "constinually" and right = "continually"
-  or
-  wrong = "constituant" and right = "constituent"
-  or
-  wrong = "constituants" and right = "constituents"
-  or
-  wrong = "constituion" and right = "constitution"
-  or
-  wrong = "constituional" and right = "constitutional"
-  or
-  wrong = "consttruction" and right = "construction"
-  or
-  wrong = "constuction" and right = "construction"
-  or
-  wrong = "consulant" and right = "consultant"
-  or
-  wrong = "consumate" and right = "consummate"
-  or
-  wrong = "consumated" and right = "consummated"
-  or
-  wrong = "contaiminate" and right = "contaminate"
-  or
-  wrong = "containes" and right = "contains"
-  or
-  wrong = "contamporaries" and right = "contemporaries"
-  or
-  wrong = "contamporary" and right = "contemporary"
-  or
-  wrong = "contempoary" and right = "contemporary"
-  or
-  wrong = "contemporaneus" and right = "contemporaneous"
-  or
-  wrong = "contempory" and right = "contemporary"
-  or
-  wrong = "contendor" and right = "contender"
-  or
-  wrong = "contian" and right = "contain"
-  or
-  wrong = "contians" and right = "contains"
-  or
-  wrong = "contibute" and right = "contribute"
-  or
-  wrong = "contibuted" and right = "contributed"
-  or
-  wrong = "contibutes" and right = "contributes"
-  or
-  wrong = "contigent" and right = "contingent"
-  or
-  wrong = "contined" and right = "continued"
-  or
-  wrong = "continential" and right = "continental"
-  or
-  wrong = "continous" and right = "continuous"
-  or
-  wrong = "continously" and right = "continuously"
-  or
-  wrong = "continueing" and right = "continuing"
-  or
-  wrong = "contravercial" and right = "controversial"
-  or
-  wrong = "contraversy" and right = "controversy"
-  or
-  wrong = "contributer" and right = "contributor"
-  or
-  wrong = "contributers" and right = "contributors"
-  or
-  wrong = "contritutions" and right = "contributions"
-  or
-  wrong = "controled" and right = "controlled"
-  or
-  wrong = "controling" and right = "controlling"
-  or
-  wrong = "controll" and right = "control"
-  or
-  wrong = "controlls" and right = "controls"
-  or
-  wrong = "controvercial" and right = "controversial"
-  or
-  wrong = "controvercy" and right = "controversy"
-  or
-  wrong = "controveries" and right = "controversies"
-  or
-  wrong = "controversal" and right = "controversial"
-  or
-  wrong = "controversey" and right = "controversy"
-  or
-  wrong = "controvertial" and right = "controversial"
-  or
-  wrong = "controvery" and right = "controversy"
-  or
-  wrong = "contruction" and right = "construction"
-  or
-  wrong = "contructor" and right = "constructor"
-  or
-  wrong = "contstruction" and right = "construction"
-  or
-  wrong = "conveinent" and right = "convenient"
-  or
-  wrong = "convenant" and right = "covenant"
-  or
-  wrong = "convential" and right = "conventional"
-  or
-  wrong = "convertables" and right = "convertibles"
-  or
-  wrong = "convertion" and right = "conversion"
-  or
-  wrong = "conviced" and right = "convinced"
-  or
-  wrong = "convienient" and right = "convenient"
-  or
-  wrong = "coordiantion" and right = "coordination"
-  or
-  wrong = "coorperation" and right = "cooperation"
-  or
-  wrong = "coorperation" and right = "corporation"
-  or
-  wrong = "coorperations" and right = "corporations"
-  or
-  wrong = "copmetitors" and right = "competitors"
-  or
-  wrong = "coputer" and right = "computer"
-  or
-  wrong = "copywrite" and right = "copyright"
-  or
-  wrong = "coridal" and right = "cordial"
-  or
-  wrong = "cornmitted" and right = "committed"
-  or
-  wrong = "corosion" and right = "corrosion"
-  or
-  wrong = "corparate" and right = "corporate"
-  or
-  wrong = "corperations" and right = "corporations"
-  or
-  wrong = "correcters" and right = "correctors"
-  or
-  wrong = "correponding" and right = "corresponding"
-  or
-  wrong = "correposding" and right = "corresponding"
-  or
-  wrong = "correspondant" and right = "correspondent"
-  or
-  wrong = "correspondants" and right = "correspondents"
-  or
-  wrong = "corridoors" and right = "corridors"
-  or
-  wrong = "corrispond" and right = "correspond"
-  or
-  wrong = "corrispondant" and right = "correspondent"
-  or
-  wrong = "corrispondants" and right = "correspondents"
-  or
-  wrong = "corrisponded" and right = "corresponded"
-  or
-  wrong = "corrisponding" and right = "corresponding"
-  or
-  wrong = "corrisponds" and right = "corresponds"
-  or
-  wrong = "costitution" and right = "constitution"
-  or
-  wrong = "coucil" and right = "council"
-  or
-  wrong = "coudl" and right = "cloud"
-  or
-  wrong = "coudl" and right = "could"
-  or
-  wrong = "councellor" and right = "councillor"
-  or
-  wrong = "councellor" and right = "councilor"
-  or
-  wrong = "councellor" and right = "counselor"
-  or
-  wrong = "councellors" and right = "councillors"
-  or
-  wrong = "councellors" and right = "councilors"
-  or
-  wrong = "councellors" and right = "counselors"
-  or
-  wrong = "counries" and right = "countries"
-  or
-  wrong = "countains" and right = "contains"
-  or
-  wrong = "countires" and right = "countries"
-  or
-  wrong = "coururier" and right = "courier"
-  or
-  wrong = "coururier" and right = "couturier"
-  or
-  wrong = "coverted" and right = "converted"
-  or
-  wrong = "coverted" and right = "covered"
-  or
-  wrong = "coverted" and right = "coveted"
-  or
-  wrong = "cpoy" and right = "copy"
-  or
-  wrong = "cpoy" and right = "coy"
-  or
-  wrong = "creaeted" and right = "created"
-  or
-  wrong = "creedence" and right = "credence"
-  or
-  wrong = "critereon" and right = "criterion"
-  or
-  wrong = "criterias" and right = "criteria"
-  or
-  wrong = "criticists" and right = "critics"
-  or
-  wrong = "critising" and right = "criticising"
-  or
-  wrong = "critising" and right = "criticizing"
-  or
-  wrong = "critisising" and right = "criticising"
-  or
-  wrong = "critisism" and right = "criticism"
-  or
-  wrong = "critisisms" and right = "criticisms"
-  or
-  wrong = "critisize" and right = "criticise"
-  or
-  wrong = "critisize" and right = "criticize"
-  or
-  wrong = "critisized" and right = "criticised"
-  or
-  wrong = "critisized" and right = "criticized"
-  or
-  wrong = "critisizes" and right = "criticises"
-  or
-  wrong = "critisizes" and right = "criticizes"
-  or
-  wrong = "critisizing" and right = "criticising"
-  or
-  wrong = "critisizing" and right = "criticizing"
-  or
-  wrong = "critized" and right = "criticized"
-  or
-  wrong = "critizing" and right = "criticizing"
-  or
-  wrong = "crockodiles" and right = "crocodiles"
-  or
-  wrong = "crowm" and right = "crown"
-  or
-  wrong = "crtical" and right = "critical"
-  or
-  wrong = "crticised" and right = "criticised"
-  or
-  wrong = "crucifiction" and right = "crucifixion"
-  or
-  wrong = "crusies" and right = "cruises"
-  or
-  wrong = "crutial" and right = "crucial"
-  or
-  wrong = "crystalisation" and right = "crystallisation"
-  or
-  wrong = "culiminating" and right = "culminating"
-  or
-  wrong = "cumulatative" and right = "cumulative"
-  or
-  wrong = "curch" and right = "church"
-  or
-  wrong = "curcuit" and right = "circuit"
-  or
-  wrong = "currenly" and right = "currently"
-  or
-  wrong = "curriculem" and right = "curriculum"
-  or
-  wrong = "cxan" and right = "cyan"
-  or
-  wrong = "cyclinder" and right = "cylinder"
-  or
-  wrong = "dacquiri" and right = "daiquiri"
-  or
-  wrong = "daed" and right = "dead"
-  or
-  wrong = "dael" and right = "dahl"
-  or
-  wrong = "dael" and right = "deal"
-  or
-  wrong = "dael" and right = "dial"
-  or
-  wrong = "dalmation" and right = "dalmatian"
-  or
-  wrong = "damenor" and right = "demeanor"
-  or
-  wrong = "dammage" and right = "damage"
-  or
-  wrong = "dardenelles" and right = "dardanelles"
-  or
-  wrong = "daugher" and right = "daughter"
-  or
-  wrong = "deafult" and right = "default"
-  or
-  wrong = "debateable" and right = "debatable"
-  or
-  wrong = "decendant" and right = "descendant"
-  or
-  wrong = "decendants" and right = "descendants"
-  or
-  wrong = "decendent" and right = "descendant"
-  or
-  wrong = "decendents" and right = "descendants"
-  or
-  wrong = "decideable" and right = "decidable"
-  or
-  wrong = "decidely" and right = "decidedly"
-  or
-  wrong = "decieved" and right = "deceived"
-  or
-  wrong = "decison" and right = "decision"
-  or
-  wrong = "decomissioned" and right = "decommissioned"
-  or
-  wrong = "decomposit" and right = "decompose"
-  or
-  wrong = "decomposited" and right = "decomposed"
-  or
-  wrong = "decompositing" and right = "decomposing"
-  or
-  wrong = "decomposits" and right = "decomposes"
-  or
-  wrong = "decress" and right = "decrees"
-  or
-  wrong = "decribe" and right = "describe"
-  or
-  wrong = "decribed" and right = "described"
-  or
-  wrong = "decribes" and right = "describes"
-  or
-  wrong = "decribing" and right = "describing"
-  or
-  wrong = "dectect" and right = "detect"
-  or
-  wrong = "defendent" and right = "defendant"
-  or
-  wrong = "defendents" and right = "defendants"
-  or
-  wrong = "deffensively" and right = "defensively"
-  or
-  wrong = "deffine" and right = "define"
-  or
-  wrong = "deffined" and right = "defined"
-  or
-  wrong = "definance" and right = "defiance"
-  or
-  wrong = "definate" and right = "definite"
-  or
-  wrong = "definately" and right = "definitely"
-  or
-  wrong = "definatly" and right = "definitely"
-  or
-  wrong = "definetly" and right = "definitely"
-  or
-  wrong = "definining" and right = "defining"
-  or
-  wrong = "definit" and right = "definite"
-  or
-  wrong = "definitly" and right = "definitely"
-  or
-  wrong = "definiton" and right = "definition"
-  or
-  wrong = "defintion" and right = "definition"
-  or
-  wrong = "defualt" and right = "default"
-  or
-  wrong = "defult" and right = "default"
-  or
-  wrong = "degrate" and right = "degrade"
-  or
-  wrong = "delagates" and right = "delegates"
-  or
-  wrong = "delapidated" and right = "dilapidated"
-  or
-  wrong = "delerious" and right = "delirious"
-  or
-  wrong = "delevopment" and right = "development"
-  or
-  wrong = "deliberatly" and right = "deliberately"
-  or
-  wrong = "delusionally" and right = "delusively"
-  or
-  wrong = "demenor" and right = "demeanor"
-  or
-  wrong = "demographical" and right = "demographic"
-  or
-  wrong = "demolision" and right = "demolition"
-  or
-  wrong = "demorcracy" and right = "democracy"
-  or
-  wrong = "demostration" and right = "demonstration"
-  or
-  wrong = "denegrating" and right = "denigrating"
-  or
-  wrong = "densly" and right = "densely"
-  or
-  wrong = "deparment" and right = "department"
-  or
-  wrong = "deparmental" and right = "departmental"
-  or
-  wrong = "deparments" and right = "departments"
-  or
-  wrong = "dependance" and right = "dependence"
-  or
-  wrong = "dependancy" and right = "dependency"
-  or
-  wrong = "deram" and right = "dram"
-  or
-  wrong = "deram" and right = "dream"
-  or
-  wrong = "deriviated" and right = "derived"
-  or
-  wrong = "derivitive" and right = "derivative"
-  or
-  wrong = "derogitory" and right = "derogatory"
-  or
-  wrong = "descendands" and right = "descendants"
-  or
-  wrong = "descibed" and right = "described"
-  or
-  wrong = "desciptors" and right = "descriptors"
-  or
-  wrong = "descision" and right = "decision"
-  or
-  wrong = "descisions" and right = "decisions"
-  or
-  wrong = "descriibes" and right = "describes"
-  or
-  wrong = "descripters" and right = "descriptors"
-  or
-  wrong = "descripton" and right = "description"
-  or
-  wrong = "desctruction" and right = "destruction"
-  or
-  wrong = "descuss" and right = "discuss"
-  or
-  wrong = "desgined" and right = "designed"
-  or
-  wrong = "deside" and right = "decide"
-  or
-  wrong = "desigining" and right = "designing"
-  or
-  wrong = "desinations" and right = "destinations"
-  or
-  wrong = "desintegrated" and right = "disintegrated"
-  or
-  wrong = "desintegration" and right = "disintegration"
-  or
-  wrong = "desireable" and right = "desirable"
-  or
-  wrong = "desitned" and right = "destined"
-  or
-  wrong = "desktiop" and right = "desktop"
-  or
-  wrong = "desorder" and right = "disorder"
-  or
-  wrong = "desoriented" and right = "disoriented"
-  or
-  wrong = "desparate" and right = "desperate"
-  or
-  wrong = "desparate" and right = "disparate"
-  or
-  wrong = "despict" and right = "depict"
-  or
-  wrong = "despiration" and right = "desperation"
-  or
-  wrong = "dessicated" and right = "desiccated"
-  or
-  wrong = "dessigned" and right = "designed"
-  or
-  wrong = "destablized" and right = "destabilized"
-  or
-  wrong = "destory" and right = "destroy"
-  or
-  wrong = "desugered" and right = "desugared"
-  or
-  wrong = "detailled" and right = "detailed"
-  or
-  wrong = "detatched" and right = "detached"
-  or
-  wrong = "deteoriated" and right = "deteriorated"
-  or
-  wrong = "deteriate" and right = "deteriorate"
-  or
-  wrong = "deterioriating" and right = "deteriorating"
-  or
-  wrong = "determinining" and right = "determining"
-  or
-  wrong = "detremental" and right = "detrimental"
-  or
-  wrong = "devasted" and right = "devastated"
-  or
-  wrong = "develope" and right = "develop"
-  or
-  wrong = "developement" and right = "development"
-  or
-  wrong = "developped" and right = "developed"
-  or
-  wrong = "develpment" and right = "development"
-  or
-  wrong = "devels" and right = "delves"
-  or
-  wrong = "devestated" and right = "devastated"
-  or
-  wrong = "devestating" and right = "devastating"
-  or
-  wrong = "devide" and right = "divide"
-  or
-  wrong = "devided" and right = "divided"
-  or
-  wrong = "devistating" and right = "devastating"
-  or
-  wrong = "devolopement" and right = "development"
-  or
-  wrong = "diablical" and right = "diabolical"
-  or
-  wrong = "diamons" and right = "diamonds"
-  or
-  wrong = "diaster" and right = "disaster"
-  or
-  wrong = "dichtomy" and right = "dichotomy"
-  or
-  wrong = "diconnects" and right = "disconnects"
-  or
-  wrong = "dicover" and right = "discover"
-  or
-  wrong = "dicovered" and right = "discovered"
-  or
-  wrong = "dicovering" and right = "discovering"
-  or
-  wrong = "dicovers" and right = "discovers"
-  or
-  wrong = "dicovery" and right = "discovery"
-  or
-  wrong = "dictionarys" and right = "dictionaries"
-  or
-  wrong = "dicussed" and right = "discussed"
-  or
-  wrong = "diea" and right = "die"
-  or
-  wrong = "diea" and right = "idea"
-  or
-  wrong = "dieing" and right = "dyeing"
-  or
-  wrong = "dieing" and right = "dying"
-  or
-  wrong = "dieties" and right = "deities"
-  or
-  wrong = "diety" and right = "deity"
-  or
-  wrong = "diferent" and right = "different"
-  or
-  wrong = "diferrent" and right = "different"
-  or
-  wrong = "differentiatiations" and right = "differentiations"
-  or
-  wrong = "differnt" and right = "different"
-  or
-  wrong = "difficulity" and right = "difficulty"
-  or
-  wrong = "diffrent" and right = "different"
-  or
-  wrong = "dificulties" and right = "difficulties"
-  or
-  wrong = "dificulty" and right = "difficulty"
-  or
-  wrong = "dimenions" and right = "dimensions"
-  or
-  wrong = "dimention" and right = "dimension"
-  or
-  wrong = "dimentional" and right = "dimensional"
-  or
-  wrong = "dimentions" and right = "dimensions"
-  or
-  wrong = "dimesnional" and right = "dimensional"
-  or
-  wrong = "diminuitive" and right = "diminutive"
-  or
-  wrong = "dimunitive" and right = "diminutive"
-  or
-  wrong = "diosese" and right = "diocese"
-  or
-  wrong = "diphtong" and right = "diphthong"
-  or
-  wrong = "diphtongs" and right = "diphthongs"
-  or
-  wrong = "diplomancy" and right = "diplomacy"
-  or
-  wrong = "dipthong" and right = "diphthong"
-  or
-  wrong = "dipthongs" and right = "diphthongs"
-  or
-  wrong = "directoty" and right = "directory"
-  or
-  wrong = "dirived" and right = "derived"
-  or
-  wrong = "disagreeed" and right = "disagreed"
-  or
-  wrong = "disapeared" and right = "disappeared"
-  or
-  wrong = "disapointing" and right = "disappointing"
-  or
-  wrong = "disappearred" and right = "disappeared"
-  or
-  wrong = "disaproval" and right = "disapproval"
-  or
-  wrong = "disasterous" and right = "disastrous"
-  or
-  wrong = "disatisfaction" and right = "dissatisfaction"
-  or
-  wrong = "disatisfied" and right = "dissatisfied"
-  or
-  wrong = "disatrous" and right = "disastrous"
-  or
-  wrong = "discontentment" and right = "discontent"
-  or
-  wrong = "discribe" and right = "describe"
-  or
-  wrong = "discribed" and right = "described"
-  or
-  wrong = "discribes" and right = "describes"
-  or
-  wrong = "discribing" and right = "describing"
-  or
-  wrong = "disctinction" and right = "distinction"
-  or
-  wrong = "disctinctive" and right = "distinctive"
-  or
-  wrong = "disemination" and right = "dissemination"
-  or
-  wrong = "disenchanged" and right = "disenchanted"
-  or
-  wrong = "disiplined" and right = "disciplined"
-  or
-  wrong = "disobediance" and right = "disobedience"
-  or
-  wrong = "disobediant" and right = "disobedient"
-  or
-  wrong = "disolved" and right = "dissolved"
-  or
-  wrong = "disover" and right = "discover"
-  or
-  wrong = "dispair" and right = "despair"
-  or
-  wrong = "disparingly" and right = "disparagingly"
-  or
-  wrong = "dispence" and right = "dispense"
-  or
-  wrong = "dispenced" and right = "dispensed"
-  or
-  wrong = "dispencing" and right = "dispensing"
-  or
-  wrong = "dispicable" and right = "despicable"
-  or
-  wrong = "dispite" and right = "despite"
-  or
-  wrong = "dispostion" and right = "disposition"
-  or
-  wrong = "disproportiate" and right = "disproportionate"
-  or
-  wrong = "disputandem" and right = "disputandum"
-  or
-  wrong = "disricts" and right = "districts"
-  or
-  wrong = "dissagreement" and right = "disagreement"
-  or
-  wrong = "dissapear" and right = "disappear"
-  or
-  wrong = "dissapearance" and right = "disappearance"
-  or
-  wrong = "dissapeared" and right = "disappeared"
-  or
-  wrong = "dissapearing" and right = "disappearing"
-  or
-  wrong = "dissapears" and right = "disappears"
-  or
-  wrong = "dissappear" and right = "disappear"
-  or
-  wrong = "dissappears" and right = "disappears"
-  or
-  wrong = "dissappointed" and right = "disappointed"
-  or
-  wrong = "dissarray" and right = "disarray"
-  or
-  wrong = "dissobediance" and right = "disobedience"
-  or
-  wrong = "dissobediant" and right = "disobedient"
-  or
-  wrong = "dissobedience" and right = "disobedience"
-  or
-  wrong = "dissobedient" and right = "disobedient"
-  or
-  wrong = "distiction" and right = "distinction"
-  or
-  wrong = "distingish" and right = "distinguish"
-  or
-  wrong = "distingished" and right = "distinguished"
-  or
-  wrong = "distingishes" and right = "distinguishes"
-  or
-  wrong = "distingishing" and right = "distinguishing"
-  or
-  wrong = "distingquished" and right = "distinguished"
-  or
-  wrong = "distrubution" and right = "distribution"
-  or
-  wrong = "distruction" and right = "destruction"
-  or
-  wrong = "distructive" and right = "destructive"
-  or
-  wrong = "ditributed" and right = "distributed"
-  or
-  wrong = "diversed" and right = "diverged"
-  or
-  wrong = "diversed" and right = "diverse"
-  or
-  wrong = "divice" and right = "device"
-  or
-  wrong = "divinition" and right = "divination"
-  or
-  wrong = "divison" and right = "division"
-  or
-  wrong = "divisons" and right = "divisions"
-  or
-  wrong = "doccument" and right = "document"
-  or
-  wrong = "doccumented" and right = "documented"
-  or
-  wrong = "doccuments" and right = "documents"
-  or
-  wrong = "docrines" and right = "doctrines"
-  or
-  wrong = "doctines" and right = "doctrines"
-  or
-  wrong = "documenatry" and right = "documentary"
-  or
-  wrong = "doens" and right = "does"
-  or
-  wrong = "doign" and right = "doing"
-  or
-  wrong = "dominaton" and right = "domination"
-  or
-  wrong = "dominent" and right = "dominant"
-  or
-  wrong = "dominiant" and right = "dominant"
-  or
-  wrong = "donig" and right = "doing"
-  or
-  wrong = "doub" and right = "daub"
-  or
-  wrong = "doub" and right = "doubt"
-  or
-  wrong = "doulbe" and right = "double"
-  or
-  wrong = "dowloads" and right = "downloads"
-  or
-  wrong = "dramtic" and right = "dramatic"
-  or
-  wrong = "draughtman" and right = "draughtsman"
-  or
-  wrong = "dravadian" and right = "dravidian"
-  or
-  wrong = "dreasm" and right = "dreams"
-  or
-  wrong = "driectly" and right = "directly"
-  or
-  wrong = "drnik" and right = "drink"
-  or
-  wrong = "druming" and right = "drumming"
-  or
-  wrong = "drummless" and right = "drumless"
-  or
-  wrong = "dum" and right = "dumb"
-  or
-  wrong = "dupicate" and right = "duplicate"
-  or
-  wrong = "durig" and right = "during"
-  or
-  wrong = "durring" and right = "during"
-  or
-  wrong = "duting" and right = "during"
-  or
-  wrong = "dyas" and right = "dryas"
-  or
-  wrong = "eahc" and right = "each"
-  or
-  wrong = "ealier" and right = "earlier"
-  or
-  wrong = "earlies" and right = "earliest"
-  or
-  wrong = "earnt" and right = "earned"
-  or
-  wrong = "ecclectic" and right = "eclectic"
-  or
-  wrong = "eceonomy" and right = "economy"
-  or
-  wrong = "ecidious" and right = "deciduous"
-  or
-  wrong = "eclispe" and right = "eclipse"
-  or
-  wrong = "ecomonic" and right = "economic"
-  or
-  wrong = "ect" and right = "etc"
-  or
-  wrong = "editting" and right = "editing"
-  or
-  wrong = "eearly" and right = "early"
-  or
-  wrong = "efel" and right = "evil"
-  or
-  wrong = "effeciency" and right = "efficiency"
-  or
-  wrong = "effecient" and right = "efficient"
-  or
-  wrong = "effeciently" and right = "efficiently"
-  or
-  wrong = "efficency" and right = "efficiency"
-  or
-  wrong = "efficent" and right = "efficient"
-  or
-  wrong = "efficently" and right = "efficiently"
-  or
-  wrong = "efford" and right = "afford"
-  or
-  wrong = "efford" and right = "effort"
-  or
-  wrong = "effords" and right = "affords"
-  or
-  wrong = "effords" and right = "efforts"
-  or
-  wrong = "effulence" and right = "effluence"
-  or
-  wrong = "eigth" and right = "eight"
-  or
-  wrong = "eigth" and right = "eighth"
-  or
-  wrong = "eiter" and right = "either"
-  or
-  wrong = "elction" and right = "election"
-  or
-  wrong = "electic" and right = "eclectic"
-  or
-  wrong = "electic" and right = "electric"
-  or
-  wrong = "electon" and right = "election"
-  or
-  wrong = "electon" and right = "electron"
-  or
-  wrong = "electrial" and right = "electrical"
-  or
-  wrong = "electricly" and right = "electrically"
-  or
-  wrong = "electricty" and right = "electricity"
-  or
-  wrong = "elementay" and right = "elementary"
-  or
-  wrong = "eleminated" and right = "eliminated"
-  or
-  wrong = "eleminating" and right = "eliminating"
-  or
-  wrong = "eles" and right = "eels"
-  or
-  wrong = "eletricity" and right = "electricity"
-  or
-  wrong = "elicided" and right = "elicited"
-  or
-  wrong = "eligable" and right = "eligible"
-  or
-  wrong = "elimentary" and right = "elementary"
-  or
-  wrong = "ellected" and right = "elected"
-  or
-  wrong = "elphant" and right = "elephant"
-  or
-  wrong = "embarass" and right = "embarrass"
-  or
-  wrong = "embarassed" and right = "embarrassed"
-  or
-  wrong = "embarassing" and right = "embarrassing"
-  or
-  wrong = "embarassment" and right = "embarrassment"
-  or
-  wrong = "embargos" and right = "embargoes"
-  or
-  wrong = "embarras" and right = "embarrass"
-  or
-  wrong = "embarrased" and right = "embarrassed"
-  or
-  wrong = "embarrasing" and right = "embarrassing"
-  or
-  wrong = "embarrasment" and right = "embarrassment"
-  or
-  wrong = "embezelled" and right = "embezzled"
-  or
-  wrong = "emblamatic" and right = "emblematic"
-  or
-  wrong = "eminate" and right = "emanate"
-  or
-  wrong = "eminated" and right = "emanated"
-  or
-  wrong = "emision" and right = "emission"
-  or
-  wrong = "emited" and right = "emitted"
-  or
-  wrong = "emiting" and right = "emitting"
-  or
-  wrong = "emition" and right = "emission"
-  or
-  wrong = "emition" and right = "emotion"
-  or
-  wrong = "emmediately" and right = "immediately"
-  or
-  wrong = "emmigrated" and right = "emigrated"
-  or
-  wrong = "emmigrated" and right = "immigrated"
-  or
-  wrong = "emminent" and right = "eminent"
-  or
-  wrong = "emminent" and right = "imminent"
-  or
-  wrong = "emminently" and right = "eminently"
-  or
-  wrong = "emmisaries" and right = "emissaries"
-  or
-  wrong = "emmisarries" and right = "emissaries"
-  or
-  wrong = "emmisarry" and right = "emissary"
-  or
-  wrong = "emmisary" and right = "emissary"
-  or
-  wrong = "emmision" and right = "emission"
-  or
-  wrong = "emmisions" and right = "emissions"
-  or
-  wrong = "emmited" and right = "emitted"
-  or
-  wrong = "emmiting" and right = "emitting"
-  or
-  wrong = "emmitted" and right = "emitted"
-  or
-  wrong = "emmitting" and right = "emitting"
-  or
-  wrong = "emnity" and right = "enmity"
-  or
-  wrong = "emperical" and right = "empirical"
-  or
-  wrong = "emphaised" and right = "emphasised"
-  or
-  wrong = "emphsis" and right = "emphasis"
-  or
-  wrong = "emphysyma" and right = "emphysema"
-  or
-  wrong = "empirial" and right = "empirical"
-  or
-  wrong = "empirial" and right = "imperial"
-  or
-  wrong = "emporer" and right = "emperor"
-  or
-  wrong = "emprisoned" and right = "imprisoned"
-  or
-  wrong = "enameld" and right = "enameled"
-  or
-  wrong = "enchancement" and right = "enhancement"
-  or
-  wrong = "encouraing" and right = "encouraging"
-  or
-  wrong = "encryptiion" and right = "encryption"
-  or
-  wrong = "encylopedia" and right = "encyclopedia"
-  or
-  wrong = "endevors" and right = "endeavors"
-  or
-  wrong = "endevour" and right = "endeavour"
-  or
-  wrong = "endig" and right = "ending"
-  or
-  wrong = "endolithes" and right = "endoliths"
-  or
-  wrong = "enduce" and right = "induce"
-  or
-  wrong = "ened" and right = "need"
-  or
-  wrong = "enforceing" and right = "enforcing"
-  or
-  wrong = "engagment" and right = "engagement"
-  or
-  wrong = "engeneer" and right = "engineer"
-  or
-  wrong = "engeneering" and right = "engineering"
-  or
-  wrong = "engieneer" and right = "engineer"
-  or
-  wrong = "engieneers" and right = "engineers"
-  or
-  wrong = "enlargment" and right = "enlargement"
-  or
-  wrong = "enlargments" and right = "enlargements"
-  or
-  wrong = "enlish" and right = "english"
-  or
-  wrong = "enlish" and right = "enlist"
-  or
-  wrong = "enourmous" and right = "enormous"
-  or
-  wrong = "enourmously" and right = "enormously"
-  or
-  wrong = "ensconsed" and right = "ensconced"
-  or
-  wrong = "entaglements" and right = "entanglements"
-  or
-  wrong = "enteratinment" and right = "entertainment"
-  or
-  wrong = "enthusiatic" and right = "enthusiastic"
-  or
-  wrong = "entitity" and right = "entity"
-  or
-  wrong = "entitlied" and right = "entitled"
-  or
-  wrong = "entrepeneur" and right = "entrepreneur"
-  or
-  wrong = "entrepeneurs" and right = "entrepreneurs"
-  or
-  wrong = "enviorment" and right = "environment"
-  or
-  wrong = "enviormental" and right = "environmental"
-  or
-  wrong = "enviormentally" and right = "environmentally"
-  or
-  wrong = "enviorments" and right = "environments"
-  or
-  wrong = "enviornment" and right = "environment"
-  or
-  wrong = "enviornmental" and right = "environmental"
-  or
-  wrong = "enviornmentalist" and right = "environmentalist"
-  or
-  wrong = "enviornmentally" and right = "environmentally"
-  or
-  wrong = "enviornments" and right = "environments"
-  or
-  wrong = "enviroment" and right = "environment"
-  or
-  wrong = "enviromental" and right = "environmental"
-  or
-  wrong = "enviromentalist" and right = "environmentalist"
-  or
-  wrong = "enviromentally" and right = "environmentally"
-  or
-  wrong = "enviroments" and right = "environments"
-  or
-  wrong = "environemnt" and right = "environment"
-  or
-  wrong = "envolutionary" and right = "evolutionary"
-  or
-  wrong = "envrionments" and right = "environments"
-  or
-  wrong = "enxt" and right = "next"
-  or
-  wrong = "epidsodes" and right = "episodes"
-  or
-  wrong = "epsiode" and right = "episode"
-  or
-  wrong = "equialent" and right = "equivalent"
-  or
-  wrong = "equilibium" and right = "equilibrium"
-  or
-  wrong = "equilibrum" and right = "equilibrium"
-  or
-  wrong = "equiped" and right = "equipped"
-  or
-  wrong = "equippment" and right = "equipment"
-  or
-  wrong = "equitorial" and right = "equatorial"
-  or
-  wrong = "equivelant" and right = "equivalent"
-  or
-  wrong = "equivelent" and right = "equivalent"
-  or
-  wrong = "equivilant" and right = "equivalent"
-  or
-  wrong = "equivilent" and right = "equivalent"
-  or
-  wrong = "equivlalent" and right = "equivalent"
-  or
-  wrong = "erally" and right = "orally"
-  or
-  wrong = "erally" and right = "really"
-  or
-  wrong = "eratic" and right = "erratic"
-  or
-  wrong = "eratically" and right = "erratically"
-  or
-  wrong = "eraticly" and right = "erratically"
-  or
-  wrong = "erested" and right = "arrested"
-  or
-  wrong = "erested" and right = "erected"
-  or
-  wrong = "errupted" and right = "erupted"
-  or
-  wrong = "esential" and right = "essential"
-  or
-  wrong = "esitmated" and right = "estimated"
-  or
-  wrong = "esle" and right = "else"
-  or
-  wrong = "especialy" and right = "especially"
-  or
-  wrong = "essencial" and right = "essential"
-  or
-  wrong = "essense" and right = "essence"
-  or
-  wrong = "essentail" and right = "essential"
-  or
-  wrong = "essentialy" and right = "essentially"
-  or
-  wrong = "essentual" and right = "essential"
-  or
-  wrong = "essesital" and right = "essential"
-  or
-  wrong = "estabishes" and right = "establishes"
-  or
-  wrong = "establising" and right = "establishing"
-  or
-  wrong = "ethnocentricm" and right = "ethnocentrism"
-  or
-  wrong = "ethose" and right = "ethos"
-  or
-  wrong = "ethose" and right = "those"
-  or
-  wrong = "europian" and right = "european"
-  or
-  wrong = "europians" and right = "europeans"
-  or
-  wrong = "eurpean" and right = "european"
-  or
-  wrong = "eurpoean" and right = "european"
-  or
-  wrong = "evenhtually" and right = "eventually"
-  or
-  wrong = "eventally" and right = "eventually"
-  or
-  wrong = "eventially" and right = "eventually"
-  or
-  wrong = "eventualy" and right = "eventually"
-  or
-  wrong = "everthing" and right = "everything"
-  or
-  wrong = "everyting" and right = "everything"
-  or
-  wrong = "eveyr" and right = "every"
-  or
-  wrong = "evidentally" and right = "evidently"
-  or
-  wrong = "exagerate" and right = "exaggerate"
-  or
-  wrong = "exagerated" and right = "exaggerated"
-  or
-  wrong = "exagerates" and right = "exaggerates"
-  or
-  wrong = "exagerating" and right = "exaggerating"
-  or
-  wrong = "exagerrate" and right = "exaggerate"
-  or
-  wrong = "exagerrated" and right = "exaggerated"
-  or
-  wrong = "exagerrates" and right = "exaggerates"
-  or
-  wrong = "exagerrating" and right = "exaggerating"
-  or
-  wrong = "examinated" and right = "examined"
-  or
-  wrong = "exampt" and right = "exempt"
-  or
-  wrong = "exapansion" and right = "expansion"
-  or
-  wrong = "excact" and right = "exact"
-  or
-  wrong = "excange" and right = "exchange"
-  or
-  wrong = "excecute" and right = "execute"
-  or
-  wrong = "excecuted" and right = "executed"
-  or
-  wrong = "excecutes" and right = "executes"
-  or
-  wrong = "excecuting" and right = "executing"
-  or
-  wrong = "excecution" and right = "execution"
-  or
-  wrong = "excedded" and right = "exceeded"
-  or
-  wrong = "excelent" and right = "excellent"
-  or
-  wrong = "excell" and right = "excel"
-  or
-  wrong = "excellance" and right = "excellence"
-  or
-  wrong = "excellant" and right = "excellent"
-  or
-  wrong = "excells" and right = "excels"
-  or
-  wrong = "excercise" and right = "exercise"
-  or
-  wrong = "exchanching" and right = "exchanging"
-  or
-  wrong = "excisted" and right = "existed"
-  or
-  wrong = "exculsivly" and right = "exclusively"
-  or
-  wrong = "execising" and right = "exercising"
-  or
-  wrong = "exection" and right = "execution"
-  or
-  wrong = "exectued" and right = "executed"
-  or
-  wrong = "exeedingly" and right = "exceedingly"
-  or
-  wrong = "exelent" and right = "excellent"
-  or
-  wrong = "exellent" and right = "excellent"
-  or
-  wrong = "exemple" and right = "example"
-  or
-  wrong = "exept" and right = "except"
-  or
-  wrong = "exeptional" and right = "exceptional"
-  or
-  wrong = "exerbate" and right = "exacerbate"
-  or
-  wrong = "exerbated" and right = "exacerbated"
-  or
-  wrong = "exerciese" and right = "exercises"
-  or
-  wrong = "exerpt" and right = "excerpt"
-  or
-  wrong = "exerpts" and right = "excerpts"
-  or
-  wrong = "exersize" and right = "exercise"
-  or
-  wrong = "exerternal" and right = "external"
-  or
-  wrong = "exhalted" and right = "exalted"
-  or
-  wrong = "exhibtion" and right = "exhibition"
-  or
-  wrong = "exibition" and right = "exhibition"
-  or
-  wrong = "exibitions" and right = "exhibitions"
-  or
-  wrong = "exicting" and right = "exciting"
-  or
-  wrong = "exinct" and right = "extinct"
-  or
-  wrong = "existance" and right = "existence"
-  or
-  wrong = "existant" and right = "existent"
-  or
-  wrong = "existince" and right = "existence"
-  or
-  wrong = "exliled" and right = "exiled"
-  or
-  wrong = "exludes" and right = "excludes"
-  or
-  wrong = "exmaple" and right = "example"
-  or
-  wrong = "exonorate" and right = "exonerate"
-  or
-  wrong = "exoskelaton" and right = "exoskeleton"
-  or
-  wrong = "expalin" and right = "explain"
-  or
-  wrong = "expatriot" and right = "expatriate"
-  or
-  wrong = "expeced" and right = "expected"
-  or
-  wrong = "expecially" and right = "especially"
-  or
-  wrong = "expeditonary" and right = "expeditionary"
-  or
-  wrong = "expeiments" and right = "experiments"
-  or
-  wrong = "expell" and right = "expel"
-  or
-  wrong = "expells" and right = "expels"
-  or
-  wrong = "experiance" and right = "experience"
-  or
-  wrong = "experianced" and right = "experienced"
-  or
-  wrong = "expession" and right = "expression"
-  or
-  wrong = "expessions" and right = "expressions"
-  or
-  wrong = "expiditions" and right = "expeditions"
-  or
-  wrong = "expierence" and right = "experience"
-  or
-  wrong = "explaination" and right = "explanation"
-  or
-  wrong = "explaning" and right = "explaining"
-  or
-  wrong = "explictly" and right = "explicitly"
-  or
-  wrong = "exploititive" and right = "exploitative"
-  or
-  wrong = "explotation" and right = "exploitation"
-  or
-  wrong = "expropiated" and right = "expropriated"
-  or
-  wrong = "expropiation" and right = "expropriation"
-  or
-  wrong = "exressed" and right = "expressed"
-  or
-  wrong = "extemely" and right = "extremely"
-  or
-  wrong = "extened" and right = "extended"
-  or
-  wrong = "extention" and right = "extension"
-  or
-  wrong = "extentions" and right = "extensions"
-  or
-  wrong = "extered" and right = "exerted"
-  or
-  wrong = "extermist" and right = "extremist"
-  or
-  wrong = "extint" and right = "extant"
-  or
-  wrong = "extint" and right = "extinct"
-  or
-  wrong = "extracter" and right = "extractor"
-  or
-  wrong = "extradiction" and right = "extradition"
-  or
-  wrong = "extraterrestial" and right = "extraterrestrial"
-  or
-  wrong = "extraterrestials" and right = "extraterrestrials"
-  or
-  wrong = "extravagent" and right = "extravagant"
-  or
-  wrong = "extrememly" and right = "extremely"
-  or
-  wrong = "extremeophile" and right = "extremophile"
-  or
-  wrong = "extremly" and right = "extremely"
-  or
-  wrong = "extrordinarily" and right = "extraordinarily"
-  or
-  wrong = "extrordinary" and right = "extraordinary"
-  or
-  wrong = "eyar" and right = "eyas"
-  or
-  wrong = "eyar" and right = "year"
-  or
-  wrong = "eyars" and right = "eyas"
-  or
-  wrong = "eyars" and right = "years"
-  or
-  wrong = "eyasr" and right = "eyas"
-  or
-  wrong = "eyasr" and right = "years"
-  or
-  wrong = "faciliate" and right = "facilitate"
-  or
-  wrong = "faciliated" and right = "facilitated"
-  or
-  wrong = "faciliates" and right = "facilitates"
-  or
-  wrong = "facilites" and right = "facilities"
-  or
-  wrong = "facillitate" and right = "facilitate"
-  or
-  wrong = "facinated" and right = "fascinated"
-  or
-  wrong = "facist" and right = "fascist"
-  or
-  wrong = "familes" and right = "families"
-  or
-  wrong = "familliar" and right = "familiar"
-  or
-  wrong = "famoust" and right = "famous"
-  or
-  wrong = "fanatism" and right = "fanaticism"
-  or
-  wrong = "farenheit" and right = "fahrenheit"
-  or
-  wrong = "fatc" and right = "fact"
-  or
-  wrong = "faught" and right = "fought"
-  or
-  wrong = "favoutrable" and right = "favourable"
-  or
-  wrong = "feasable" and right = "feasible"
-  or
-  wrong = "febuary" and right = "february"
-  or
-  wrong = "feburary" and right = "february"
-  or
-  wrong = "fedreally" and right = "federally"
-  or
-  wrong = "femminist" and right = "feminist"
-  or
-  wrong = "feromone" and right = "pheromone"
-  or
-  wrong = "fertily" and right = "fertility"
-  or
-  wrong = "fianite" and right = "finite"
-  or
-  wrong = "fianlly" and right = "finally"
-  or
-  wrong = "ficticious" and right = "fictitious"
-  or
-  wrong = "fictious" and right = "fictitious"
-  or
-  wrong = "fidn" and right = "find"
-  or
-  wrong = "fiel" and right = "feel"
-  or
-  wrong = "fiel" and right = "field"
-  or
-  wrong = "fiel" and right = "file"
-  or
-  wrong = "fiel" and right = "phial"
-  or
-  wrong = "fiels" and right = "feels"
-  or
-  wrong = "fiels" and right = "fields"
-  or
-  wrong = "fiels" and right = "files"
-  or
-  wrong = "fiels" and right = "phials"
-  or
-  wrong = "fiercly" and right = "fiercely"
-  or
-  wrong = "fightings" and right = "fighting"
-  or
-  wrong = "filiament" and right = "filament"
-  or
-  wrong = "fimilies" and right = "families"
-  or
-  wrong = "finacial" and right = "financial"
-  or
-  wrong = "finaly" and right = "finally"
-  or
-  wrong = "financialy" and right = "financially"
-  or
-  wrong = "firends" and right = "friends"
-  or
-  wrong = "firts" and right = "first"
-  or
-  wrong = "firts" and right = "flirts"
-  or
-  wrong = "fisionable" and right = "fissionable"
-  or
-  wrong = "flamable" and right = "flammable"
-  or
-  wrong = "flawess" and right = "flawless"
-  or
-  wrong = "fleed" and right = "fled"
-  or
-  wrong = "fleed" and right = "freed"
-  or
-  wrong = "flemmish" and right = "flemish"
-  or
-  wrong = "florescent" and right = "fluorescent"
-  or
-  wrong = "flourescent" and right = "fluorescent"
-  or
-  wrong = "flourine" and right = "fluorine"
-  or
-  wrong = "flourishment" and right = "flourishing"
-  or
-  wrong = "fluorish" and right = "flourish"
-  or
-  wrong = "follwoing" and right = "following"
-  or
-  wrong = "folowing" and right = "following"
-  or
-  wrong = "fomed" and right = "formed"
-  or
-  wrong = "fomr" and right = "form"
-  or
-  wrong = "fomr" and right = "from"
-  or
-  wrong = "fonetic" and right = "phonetic"
-  or
-  wrong = "fontrier" and right = "fontier"
-  or
-  wrong = "foootball" and right = "football"
-  or
-  wrong = "forbad" and right = "forbade"
-  or
-  wrong = "forbiden" and right = "forbidden"
-  or
-  wrong = "foreward" and right = "foreword"
-  or
-  wrong = "forfiet" and right = "forfeit"
-  or
-  wrong = "forhead" and right = "forehead"
-  or
-  wrong = "foriegn" and right = "foreign"
-  or
-  wrong = "formalhaut" and right = "fomalhaut"
-  or
-  wrong = "formallize" and right = "formalize"
-  or
-  wrong = "formallized" and right = "formalized"
-  or
-  wrong = "formaly" and right = "formally"
-  or
-  wrong = "formaly" and right = "formerly"
-  or
-  wrong = "formelly" and right = "formerly"
-  or
-  wrong = "formidible" and right = "formidable"
-  or
-  wrong = "formost" and right = "foremost"
-  or
-  wrong = "forsaw" and right = "foresaw"
-  or
-  wrong = "forseeable" and right = "foreseeable"
-  or
-  wrong = "fortelling" and right = "foretelling"
-  or
-  wrong = "forunner" and right = "forerunner"
-  or
-  wrong = "foucs" and right = "focus"
-  or
-  wrong = "foudn" and right = "found"
-  or
-  wrong = "fougth" and right = "fought"
-  or
-  wrong = "foundaries" and right = "foundries"
-  or
-  wrong = "foundary" and right = "foundry"
-  or
-  wrong = "foundland" and right = "newfoundland"
-  or
-  wrong = "fourties" and right = "forties"
-  or
-  wrong = "fourty" and right = "forty"
-  or
-  wrong = "fouth" and right = "fourth"
-  or
-  wrong = "foward" and right = "forward"
-  or
-  wrong = "framwork" and right = "framework"
-  or
-  wrong = "fransiscan" and right = "franciscan"
-  or
-  wrong = "fransiscans" and right = "franciscans"
-  or
-  wrong = "freind" and right = "friend"
-  or
-  wrong = "freindly" and right = "friendly"
-  or
-  wrong = "frequentily" and right = "frequently"
-  or
-  wrong = "frome" and right = "from"
-  or
-  wrong = "fromed" and right = "formed"
-  or
-  wrong = "froniter" and right = "frontier"
-  or
-  wrong = "fucntion" and right = "function"
-  or
-  wrong = "fucntioning" and right = "functioning"
-  or
-  wrong = "fufill" and right = "fulfill"
-  or
-  wrong = "fufilled" and right = "fulfilled"
-  or
-  wrong = "fulfiled" and right = "fulfilled"
-  or
-  wrong = "fullfill" and right = "fulfill"
-  or
-  wrong = "fullfilled" and right = "fulfilled"
-  or
-  wrong = "funcion" and right = "function"
-  or
-  wrong = "fundametal" and right = "fundamental"
-  or
-  wrong = "fundametals" and right = "fundamentals"
-  or
-  wrong = "funguses" and right = "fungi"
-  or
-  wrong = "funtion" and right = "function"
-  or
-  wrong = "funtions" and right = "functions"
-  or
-  wrong = "furuther" and right = "further"
-  or
-  wrong = "futher" and right = "further"
-  or
-  wrong = "futhermore" and right = "furthermore"
-  or
-  wrong = "futhroc" and right = "futhark"
-  or
-  wrong = "futhroc" and right = "futhorc"
-  or
-  wrong = "gae" and right = "gael"
-  or
-  wrong = "gae" and right = "gale"
-  or
-  wrong = "gae" and right = "game"
-  or
-  wrong = "galatic" and right = "galactic"
-  or
-  wrong = "galations" and right = "galatians"
-  or
-  wrong = "gallaxies" and right = "galaxies"
-  or
-  wrong = "galvinized" and right = "galvanized"
-  or
-  wrong = "ganerate" and right = "generate"
-  or
-  wrong = "ganes" and right = "games"
-  or
-  wrong = "ganster" and right = "gangster"
-  or
-  wrong = "garantee" and right = "guarantee"
-  or
-  wrong = "garanteed" and right = "guaranteed"
-  or
-  wrong = "garantees" and right = "guarantees"
-  or
-  wrong = "garnison" and right = "garrison"
-  or
-  wrong = "gaurantee" and right = "guarantee"
-  or
-  wrong = "gauranteed" and right = "guaranteed"
-  or
-  wrong = "gaurantees" and right = "guarantees"
-  or
-  wrong = "gaurd" and right = "gourd"
-  or
-  wrong = "gaurd" and right = "guard"
-  or
-  wrong = "gaurentee" and right = "guarantee"
-  or
-  wrong = "gaurenteed" and right = "guaranteed"
-  or
-  wrong = "gaurentees" and right = "guarantees"
-  or
-  wrong = "geneological" and right = "genealogical"
-  or
-  wrong = "geneologies" and right = "genealogies"
-  or
-  wrong = "geneology" and right = "genealogy"
-  or
-  wrong = "generaly" and right = "generally"
-  or
-  wrong = "generatting" and right = "generating"
-  or
-  wrong = "genialia" and right = "genitalia"
-  or
-  wrong = "geographicial" and right = "geographical"
-  or
-  wrong = "geometrician" and right = "geometer"
-  or
-  wrong = "geometricians" and right = "geometers"
-  or
-  wrong = "gerat" and right = "great"
-  or
-  wrong = "ghandi" and right = "gandhi"
-  or
-  wrong = "glamourous" and right = "glamorous"
-  or
-  wrong = "glight" and right = "flight"
-  or
-  wrong = "gnawwed" and right = "gnawed"
-  or
-  wrong = "godess" and right = "goddess"
-  or
-  wrong = "godesses" and right = "goddesses"
-  or
-  wrong = "godounov" and right = "godunov"
-  or
-  wrong = "gogin" and right = "gauguin"
-  or
-  wrong = "gogin" and right = "going"
-  or
-  wrong = "goign" and right = "going"
-  or
-  wrong = "gonig" and right = "going"
-  or
-  wrong = "gothenberg" and right = "gothenburg"
-  or
-  wrong = "gottleib" and right = "gottlieb"
-  or
-  wrong = "gouvener" and right = "governor"
-  or
-  wrong = "govement" and right = "government"
-  or
-  wrong = "govenment" and right = "government"
-  or
-  wrong = "govenrment" and right = "government"
-  or
-  wrong = "goverance" and right = "governance"
-  or
-  wrong = "goverment" and right = "government"
-  or
-  wrong = "govermental" and right = "governmental"
-  or
-  wrong = "governer" and right = "governor"
-  or
-  wrong = "governmnet" and right = "government"
-  or
-  wrong = "govorment" and right = "government"
-  or
-  wrong = "govormental" and right = "governmental"
-  or
-  wrong = "govornment" and right = "government"
-  or
-  wrong = "gracefull" and right = "graceful"
-  or
-  wrong = "graet" and right = "great"
-  or
-  wrong = "grafitti" and right = "graffiti"
-  or
-  wrong = "gramatically" and right = "grammatically"
-  or
-  wrong = "grammaticaly" and right = "grammatically"
-  or
-  wrong = "grammer" and right = "grammar"
-  or
-  wrong = "grat" and right = "great"
-  or
-  wrong = "gratuitious" and right = "gratuitous"
-  or
-  wrong = "greatful" and right = "grateful"
-  or
-  wrong = "greatfully" and right = "gratefully"
-  or
-  wrong = "greif" and right = "grief"
-  or
-  wrong = "gridles" and right = "griddles"
-  or
-  wrong = "gropu" and right = "group"
-  or
-  wrong = "grwo" and right = "grow"
-  or
-  wrong = "guaduloupe" and right = "guadalupe"
-  or
-  wrong = "guaduloupe" and right = "guadeloupe"
-  or
-  wrong = "guadulupe" and right = "guadalupe"
-  or
-  wrong = "guadulupe" and right = "guadeloupe"
-  or
-  wrong = "guage" and right = "gauge"
-  or
-  wrong = "guarentee" and right = "guarantee"
-  or
-  wrong = "guarenteed" and right = "guaranteed"
-  or
-  wrong = "guarentees" and right = "guarantees"
-  or
-  wrong = "guatamala" and right = "guatemala"
-  or
-  wrong = "guatamalan" and right = "guatemalan"
-  or
-  wrong = "guerrila" and right = "guerrilla"
-  or
-  wrong = "guerrilas" and right = "guerrillas"
-  or
-  wrong = "guidence" and right = "guidance"
-  or
-  wrong = "guilia" and right = "giulia"
-  or
-  wrong = "guilio" and right = "giulio"
-  or
-  wrong = "guiness" and right = "guinness"
-  or
-  wrong = "guiseppe" and right = "giuseppe"
-  or
-  wrong = "gunanine" and right = "guanine"
-  or
-  wrong = "gurantee" and right = "guarantee"
-  or
-  wrong = "guranteed" and right = "guaranteed"
-  or
-  wrong = "gurantees" and right = "guarantees"
-  or
-  wrong = "guttaral" and right = "guttural"
-  or
-  wrong = "gutteral" and right = "guttural"
-  or
-  wrong = "habaeus" and right = "habeas"
-  or
-  wrong = "habeus" and right = "habeas"
-  or
-  wrong = "habsbourg" and right = "habsburg"
-  or
-  wrong = "haemorrage" and right = "haemorrhage"
-  or
-  wrong = "haev" and right = "have"
-  or
-  wrong = "haev" and right = "heave"
-  or
-  wrong = "halarious" and right = "hilarious"
-  or
-  wrong = "hallowean" and right = "halloween"
-  or
-  wrong = "halp" and right = "help"
-  or
-  wrong = "hander" and right = "handler"
-  or
-  wrong = "hapen" and right = "happen"
-  or
-  wrong = "hapened" and right = "happened"
-  or
-  wrong = "hapening" and right = "happening"
-  or
-  wrong = "happend" and right = "happened"
-  or
-  wrong = "happended" and right = "happened"
-  or
-  wrong = "happenned" and right = "happened"
-  or
-  wrong = "harased" and right = "harassed"
-  or
-  wrong = "harases" and right = "harasses"
-  or
-  wrong = "harasment" and right = "harassment"
-  or
-  wrong = "harasments" and right = "harassments"
-  or
-  wrong = "harassement" and right = "harassment"
-  or
-  wrong = "harras" and right = "harass"
-  or
-  wrong = "harrased" and right = "harassed"
-  or
-  wrong = "harrases" and right = "harasses"
-  or
-  wrong = "harrasing" and right = "harassing"
-  or
-  wrong = "harrasment" and right = "harassment"
-  or
-  wrong = "harrasments" and right = "harassments"
-  or
-  wrong = "harrassed" and right = "harassed"
-  or
-  wrong = "harrasses" and right = "harassed"
-  or
-  wrong = "harrassing" and right = "harassing"
-  or
-  wrong = "harrassment" and right = "harassment"
-  or
-  wrong = "harrassments" and right = "harassments"
-  or
-  wrong = "hatian" and right = "haitian"
-  or
-  wrong = "haviest" and right = "heaviest"
-  or
-  wrong = "headquarer" and right = "headquarter"
-  or
-  wrong = "headquater" and right = "headquarter"
-  or
-  wrong = "headquatered" and right = "headquartered"
-  or
-  wrong = "headquaters" and right = "headquarters"
-  or
-  wrong = "healthercare" and right = "healthcare"
-  or
-  wrong = "heared" and right = "heard"
-  or
-  wrong = "heathy" and right = "healthy"
-  or
-  wrong = "heidelburg" and right = "heidelberg"
-  or
-  wrong = "heigher" and right = "higher"
-  or
-  wrong = "heirarchy" and right = "hierarchy"
-  or
-  wrong = "heiroglyphics" and right = "hieroglyphics"
-  or
-  wrong = "helment" and right = "helmet"
-  or
-  wrong = "helpfull" and right = "helpful"
-  or
-  wrong = "helpped" and right = "helped"
-  or
-  wrong = "hemmorhage" and right = "hemorrhage"
-  or
-  wrong = "herad" and right = "heard"
-  or
-  wrong = "herad" and right = "hera"
-  or
-  wrong = "heridity" and right = "heredity"
-  or
-  wrong = "heroe" and right = "hero"
-  or
-  wrong = "heros" and right = "heroes"
-  or
-  wrong = "hertiage" and right = "heritage"
-  or
-  wrong = "hertzs" and right = "hertz"
-  or
-  wrong = "hesistant" and right = "hesitant"
-  or
-  wrong = "heterogenous" and right = "heterogeneous"
-  or
-  wrong = "hieght" and right = "height"
-  or
-  wrong = "hierachical" and right = "hierarchical"
-  or
-  wrong = "hierachies" and right = "hierarchies"
-  or
-  wrong = "hierachy" and right = "hierarchy"
-  or
-  wrong = "hierarcical" and right = "hierarchical"
-  or
-  wrong = "hierarcy" and right = "hierarchy"
-  or
-  wrong = "hieroglph" and right = "hieroglyph"
-  or
-  wrong = "hieroglphs" and right = "hieroglyphs"
-  or
-  wrong = "higer" and right = "higher"
-  or
-  wrong = "higest" and right = "highest"
-  or
-  wrong = "higway" and right = "highway"
-  or
-  wrong = "hillarious" and right = "hilarious"
-  or
-  wrong = "himselv" and right = "himself"
-  or
-  wrong = "hinderance" and right = "hindrance"
-  or
-  wrong = "hinderence" and right = "hindrance"
-  or
-  wrong = "hindrence" and right = "hindrance"
-  or
-  wrong = "hipopotamus" and right = "hippopotamus"
-  or
-  wrong = "hismelf" and right = "himself"
-  or
-  wrong = "histocompatability" and right = "histocompatibility"
-  or
-  wrong = "historicians" and right = "historians"
-  or
-  wrong = "holf" and right = "hold"
-  or
-  wrong = "holliday" and right = "holiday"
-  or
-  wrong = "homogeneize" and right = "homogenize"
-  or
-  wrong = "homogeneized" and right = "homogenized"
-  or
-  wrong = "honory" and right = "honorary"
-  or
-  wrong = "horrifing" and right = "horrifying"
-  or
-  wrong = "hosited" and right = "hoisted"
-  or
-  wrong = "hospitible" and right = "hospitable"
-  or
-  wrong = "hounour" and right = "honour"
-  or
-  wrong = "housr" and right = "hours"
-  or
-  wrong = "housr" and right = "house"
-  or
-  wrong = "howver" and right = "however"
-  or
-  wrong = "hsitorians" and right = "historians"
-  or
-  wrong = "hstory" and right = "history"
-  or
-  wrong = "hten" and right = "hen"
-  or
-  wrong = "hten" and right = "the"
-  or
-  wrong = "hten" and right = "then"
-  or
-  wrong = "htere" and right = "here"
-  or
-  wrong = "htere" and right = "there"
-  or
-  wrong = "htey" and right = "they"
-  or
-  wrong = "htikn" and right = "think"
-  or
-  wrong = "hting" and right = "thing"
-  or
-  wrong = "htink" and right = "think"
-  or
-  wrong = "htis" and right = "this"
-  or
-  wrong = "humer" and right = "humor"
-  or
-  wrong = "humer" and right = "humour"
-  or
-  wrong = "humerous" and right = "humerus"
-  or
-  wrong = "humerous" and right = "humorous"
-  or
-  wrong = "huminoid" and right = "humanoid"
-  or
-  wrong = "humoural" and right = "humoral"
-  or
-  wrong = "humurous" and right = "humorous"
-  or
-  wrong = "husban" and right = "husband"
-  or
-  wrong = "hvae" and right = "have"
-  or
-  wrong = "hvaing" and right = "having"
-  or
-  wrong = "hvea" and right = "have"
-  or
-  wrong = "hvea" and right = "heave"
-  or
-  wrong = "hwihc" and right = "which"
-  or
-  wrong = "hwile" and right = "while"
-  or
-  wrong = "hwole" and right = "whole"
-  or
-  wrong = "hydogen" and right = "hydrogen"
-  or
-  wrong = "hydropile" and right = "hydrophile"
-  or
-  wrong = "hydropilic" and right = "hydrophilic"
-  or
-  wrong = "hydropobe" and right = "hydrophobe"
-  or
-  wrong = "hydropobic" and right = "hydrophobic"
-  or
-  wrong = "hygeine" and right = "hygiene"
-  or
-  wrong = "hyjack" and right = "hijack"
-  or
-  wrong = "hyjacking" and right = "hijacking"
-  or
-  wrong = "hypocracy" and right = "hypocrisy"
-  or
-  wrong = "hypocrasy" and right = "hypocrisy"
-  or
-  wrong = "hypocricy" and right = "hypocrisy"
-  or
-  wrong = "hypocrit" and right = "hypocrite"
-  or
-  wrong = "hypocrits" and right = "hypocrites"
-  or
-  wrong = "iconclastic" and right = "iconoclastic"
-  or
-  wrong = "idaeidae" and right = "idea"
-  or
-  wrong = "idaes" and right = "ideas"
-  or
-  wrong = "idealogies" and right = "ideologies"
-  or
-  wrong = "idealogy" and right = "ideology"
-  or
-  wrong = "identicial" and right = "identical"
-  or
-  wrong = "identifers" and right = "identifiers"
-  or
-  wrong = "ideosyncratic" and right = "idiosyncratic"
-  or
-  wrong = "idesa" and right = "ideas"
-  or
-  wrong = "idesa" and right = "ides"
-  or
-  wrong = "idiosyncracy" and right = "idiosyncrasy"
-  or
-  wrong = "ihaca" and right = "ithaca"
-  or
-  wrong = "illegimacy" and right = "illegitimacy"
-  or
-  wrong = "illegitmate" and right = "illegitimate"
-  or
-  wrong = "illess" and right = "illness"
-  or
-  wrong = "illiegal" and right = "illegal"
-  or
-  wrong = "illution" and right = "illusion"
-  or
-  wrong = "ilness" and right = "illness"
-  or
-  wrong = "ilogical" and right = "illogical"
-  or
-  wrong = "imagenary" and right = "imaginary"
-  or
-  wrong = "imagin" and right = "imagine"
-  or
-  wrong = "imaginery" and right = "imagery"
-  or
-  wrong = "imaginery" and right = "imaginary"
-  or
-  wrong = "imanent" and right = "eminent"
-  or
-  wrong = "imanent" and right = "imminent"
-  or
-  wrong = "imcomplete" and right = "incomplete"
-  or
-  wrong = "imediately" and right = "immediately"
-  or
-  wrong = "imense" and right = "immense"
-  or
-  wrong = "imigrant" and right = "emigrant"
-  or
-  wrong = "imigrant" and right = "immigrant"
-  or
-  wrong = "imigrated" and right = "emigrated"
-  or
-  wrong = "imigrated" and right = "immigrated"
-  or
-  wrong = "imigration" and right = "emigration"
-  or
-  wrong = "imigration" and right = "immigration"
-  or
-  wrong = "iminent" and right = "eminent"
-  or
-  wrong = "iminent" and right = "immanent"
-  or
-  wrong = "iminent" and right = "imminent"
-  or
-  wrong = "immediatley" and right = "immediately"
-  or
-  wrong = "immediatly" and right = "immediately"
-  or
-  wrong = "immidately" and right = "immediately"
-  or
-  wrong = "immidiately" and right = "immediately"
-  or
-  wrong = "immitate" and right = "imitate"
-  or
-  wrong = "immitated" and right = "imitated"
-  or
-  wrong = "immitating" and right = "imitating"
-  or
-  wrong = "immitator" and right = "imitator"
-  or
-  wrong = "immunosupressant" and right = "immunosuppressant"
-  or
-  wrong = "impecabbly" and right = "impeccably"
-  or
-  wrong = "impedence" and right = "impedance"
-  or
-  wrong = "implamenting" and right = "implementing"
-  or
-  wrong = "impliment" and right = "implement"
-  or
-  wrong = "implimented" and right = "implemented"
-  or
-  wrong = "imploys" and right = "employs"
-  or
-  wrong = "importamt" and right = "important"
-  or
-  wrong = "impressario" and right = "impresario"
-  or
-  wrong = "imprioned" and right = "imprisoned"
-  or
-  wrong = "imprisonned" and right = "imprisoned"
-  or
-  wrong = "improvision" and right = "improvisation"
-  or
-  wrong = "improvments" and right = "improvements"
-  or
-  wrong = "inablility" and right = "inability"
-  or
-  wrong = "inaccessable" and right = "inaccessible"
-  or
-  wrong = "inadiquate" and right = "inadequate"
-  or
-  wrong = "inadquate" and right = "inadequate"
-  or
-  wrong = "inadvertant" and right = "inadvertent"
-  or
-  wrong = "inadvertantly" and right = "inadvertently"
-  or
-  wrong = "inagurated" and right = "inaugurated"
-  or
-  wrong = "inaguration" and right = "inauguration"
-  or
-  wrong = "inappropiate" and right = "inappropriate"
-  or
-  wrong = "inaugures" and right = "inaugurates"
-  or
-  wrong = "inbalance" and right = "imbalance"
-  or
-  wrong = "inbalanced" and right = "imbalanced"
-  or
-  wrong = "inbetween" and right = "between"
-  or
-  wrong = "incarcirated" and right = "incarcerated"
-  or
-  wrong = "incidentially" and right = "incidentally"
-  or
-  wrong = "incidently" and right = "incidentally"
-  or
-  wrong = "inclreased" and right = "increased"
-  or
-  wrong = "includ" and right = "include"
-  or
-  wrong = "includng" and right = "including"
-  or
-  wrong = "incompatabilities" and right = "incompatibilities"
-  or
-  wrong = "incompatability" and right = "incompatibility"
-  or
-  wrong = "incompatable" and right = "incompatible"
-  or
-  wrong = "incompatablities" and right = "incompatibilities"
-  or
-  wrong = "incompatablity" and right = "incompatibility"
-  or
-  wrong = "incompatiblities" and right = "incompatibilities"
-  or
-  wrong = "incompatiblity" and right = "incompatibility"
-  or
-  wrong = "incompetance" and right = "incompetence"
-  or
-  wrong = "incompetant" and right = "incompetent"
-  or
-  wrong = "incomptable" and right = "incompatible"
-  or
-  wrong = "incomptetent" and right = "incompetent"
-  or
-  wrong = "inconsistant" and right = "inconsistent"
-  or
-  wrong = "incoroporated" and right = "incorporated"
-  or
-  wrong = "incorperation" and right = "incorporation"
-  or
-  wrong = "incorportaed" and right = "incorporated"
-  or
-  wrong = "incorprates" and right = "incorporates"
-  or
-  wrong = "incorruptable" and right = "incorruptible"
-  or
-  wrong = "incramentally" and right = "incrementally"
-  or
-  wrong = "increadible" and right = "incredible"
-  or
-  wrong = "incredable" and right = "incredible"
-  or
-  wrong = "inctroduce" and right = "introduce"
-  or
-  wrong = "inctroduced" and right = "introduced"
-  or
-  wrong = "incuding" and right = "including"
-  or
-  wrong = "incunabla" and right = "incunabula"
-  or
-  wrong = "indefinately" and right = "indefinitely"
-  or
-  wrong = "indefineable" and right = "undefinable"
-  or
-  wrong = "indefinitly" and right = "indefinitely"
-  or
-  wrong = "indentical" and right = "identical"
-  or
-  wrong = "indepedantly" and right = "independently"
-  or
-  wrong = "indepedence" and right = "independence"
-  or
-  wrong = "independance" and right = "independence"
-  or
-  wrong = "independant" and right = "independent"
-  or
-  wrong = "independantly" and right = "independently"
-  or
-  wrong = "independece" and right = "independence"
-  or
-  wrong = "independendet" and right = "independent"
-  or
-  wrong = "indespensable" and right = "indispensable"
-  or
-  wrong = "indespensible" and right = "indispensable"
-  or
-  wrong = "indictement" and right = "indictment"
-  or
-  wrong = "indigineous" and right = "indigenous"
-  or
-  wrong = "indipendence" and right = "independence"
-  or
-  wrong = "indipendent" and right = "independent"
-  or
-  wrong = "indipendently" and right = "independently"
-  or
-  wrong = "indispensible" and right = "indispensable"
-  or
-  wrong = "indisputible" and right = "indisputable"
-  or
-  wrong = "indisputibly" and right = "indisputably"
-  or
-  wrong = "indite" and right = "indict"
-  or
-  wrong = "individualy" and right = "individually"
-  or
-  wrong = "indpendent" and right = "independent"
-  or
-  wrong = "indpendently" and right = "independently"
-  or
-  wrong = "indulgue" and right = "indulge"
-  or
-  wrong = "indutrial" and right = "industrial"
-  or
-  wrong = "indviduals" and right = "individuals"
-  or
-  wrong = "inefficienty" and right = "inefficiently"
-  or
-  wrong = "inevatible" and right = "inevitable"
-  or
-  wrong = "inevitible" and right = "inevitable"
-  or
-  wrong = "inevititably" and right = "inevitably"
-  or
-  wrong = "infalability" and right = "infallibility"
-  or
-  wrong = "infallable" and right = "infallible"
-  or
-  wrong = "infectuous" and right = "infectious"
-  or
-  wrong = "infered" and right = "inferred"
-  or
-  wrong = "infilitrate" and right = "infiltrate"
-  or
-  wrong = "infilitrated" and right = "infiltrated"
-  or
-  wrong = "infilitration" and right = "infiltration"
-  or
-  wrong = "infinit" and right = "infinite"
-  or
-  wrong = "inflamation" and right = "inflammation"
-  or
-  wrong = "influencial" and right = "influential"
-  or
-  wrong = "influented" and right = "influenced"
-  or
-  wrong = "infomation" and right = "information"
-  or
-  wrong = "informtion" and right = "information"
-  or
-  wrong = "infrantryman" and right = "infantryman"
-  or
-  wrong = "infrigement" and right = "infringement"
-  or
-  wrong = "ingenius" and right = "ingenious"
-  or
-  wrong = "ingreediants" and right = "ingredients"
-  or
-  wrong = "inhabitans" and right = "inhabitants"
-  or
-  wrong = "inherantly" and right = "inherently"
-  or
-  wrong = "inheritage" and right = "heritage"
-  or
-  wrong = "inheritage" and right = "inheritance"
-  or
-  wrong = "inheritence" and right = "inheritance"
-  or
-  wrong = "inital" and right = "initial"
-  or
-  wrong = "initalize" and right = "initialize"
-  or
-  wrong = "initally" and right = "initially"
-  or
-  wrong = "initation" and right = "initiation"
-  or
-  wrong = "initiaitive" and right = "initiative"
-  or
-  wrong = "inlcuding" and right = "including"
-  or
-  wrong = "inmigrant" and right = "immigrant"
-  or
-  wrong = "inmigrants" and right = "immigrants"
-  or
-  wrong = "innoculated" and right = "inoculated"
-  or
-  wrong = "inocence" and right = "innocence"
-  or
-  wrong = "inofficial" and right = "unofficial"
-  or
-  wrong = "inot" and right = "into"
-  or
-  wrong = "inpeach" and right = "impeach"
-  or
-  wrong = "inpending" and right = "impending"
-  or
-  wrong = "inpenetrable" and right = "impenetrable"
-  or
-  wrong = "inpolite" and right = "impolite"
-  or
-  wrong = "inprisonment" and right = "imprisonment"
-  or
-  wrong = "inproving" and right = "improving"
-  or
-  wrong = "insectiverous" and right = "insectivorous"
-  or
-  wrong = "insensative" and right = "insensitive"
-  or
-  wrong = "inseperable" and right = "inseparable"
-  or
-  wrong = "insistance" and right = "insistence"
-  or
-  wrong = "insitution" and right = "institution"
-  or
-  wrong = "insitutions" and right = "institutions"
-  or
-  wrong = "inspite" and right = "inspire"
-  or
-  wrong = "instade" and right = "instead"
-  or
-  wrong = "instatance" and right = "instance"
-  or
-  wrong = "institue" and right = "institute"
-  or
-  wrong = "instuction" and right = "instruction"
-  or
-  wrong = "instuments" and right = "instruments"
-  or
-  wrong = "instutionalized" and right = "institutionalized"
-  or
-  wrong = "instutions" and right = "intuitions"
-  or
-  wrong = "insurence" and right = "insurance"
-  or
-  wrong = "intelectual" and right = "intellectual"
-  or
-  wrong = "inteligence" and right = "intelligence"
-  or
-  wrong = "inteligent" and right = "intelligent"
-  or
-  wrong = "intenational" and right = "international"
-  or
-  wrong = "intented" and right = "indented"
-  or
-  wrong = "intented" and right = "intended"
-  or
-  wrong = "intepretation" and right = "interpretation"
-  or
-  wrong = "intepretator" and right = "interpretor"
-  or
-  wrong = "interational" and right = "international"
-  or
-  wrong = "interbread" and right = "interbred"
-  or
-  wrong = "interbread" and right = "interbreed"
-  or
-  wrong = "interchangable" and right = "interchangeable"
-  or
-  wrong = "interchangably" and right = "interchangeably"
-  or
-  wrong = "intercontinential" and right = "intercontinental"
-  or
-  wrong = "intercontinetal" and right = "intercontinental"
-  or
-  wrong = "intered" and right = "interned"
-  or
-  wrong = "intered" and right = "interred"
-  or
-  wrong = "interelated" and right = "interrelated"
-  or
-  wrong = "interferance" and right = "interference"
-  or
-  wrong = "interfereing" and right = "interfering"
-  or
-  wrong = "intergrated" and right = "integrated"
-  or
-  wrong = "intergration" and right = "integration"
-  or
-  wrong = "interm" and right = "interim"
-  or
-  wrong = "internation" and right = "international"
-  or
-  wrong = "interpet" and right = "interpret"
-  or
-  wrong = "interrim" and right = "interim"
-  or
-  wrong = "interrugum" and right = "interregnum"
-  or
-  wrong = "intertaining" and right = "entertaining"
-  or
-  wrong = "interupt" and right = "interrupt"
-  or
-  wrong = "intervines" and right = "intervenes"
-  or
-  wrong = "intevene" and right = "intervene"
-  or
-  wrong = "intial" and right = "initial"
-  or
-  wrong = "intialize" and right = "initialize"
-  or
-  wrong = "intialized" and right = "initialized"
-  or
-  wrong = "intially" and right = "initially"
-  or
-  wrong = "intrduced" and right = "introduced"
-  or
-  wrong = "intrest" and right = "interest"
-  or
-  wrong = "introdued" and right = "introduced"
-  or
-  wrong = "intruduced" and right = "introduced"
-  or
-  wrong = "intrument" and right = "instrument"
-  or
-  wrong = "intrumental" and right = "instrumental"
-  or
-  wrong = "intruments" and right = "instruments"
-  or
-  wrong = "intrusted" and right = "entrusted"
-  or
-  wrong = "intutive" and right = "intuitive"
-  or
-  wrong = "intutively" and right = "intuitively"
-  or
-  wrong = "inudstry" and right = "industry"
-  or
-  wrong = "inumerable" and right = "enumerable"
-  or
-  wrong = "inumerable" and right = "innumerable"
-  or
-  wrong = "inventer" and right = "inventor"
-  or
-  wrong = "invertibrates" and right = "invertebrates"
-  or
-  wrong = "investingate" and right = "investigate"
-  or
-  wrong = "involvment" and right = "involvement"
-  or
-  wrong = "irelevent" and right = "irrelevant"
-  or
-  wrong = "iresistable" and right = "irresistible"
-  or
-  wrong = "iresistably" and right = "irresistibly"
-  or
-  wrong = "iresistible" and right = "irresistible"
-  or
-  wrong = "iresistibly" and right = "irresistibly"
-  or
-  wrong = "iritable" and right = "irritable"
-  or
-  wrong = "iritated" and right = "irritated"
-  or
-  wrong = "ironicly" and right = "ironically"
-  or
-  wrong = "irregardless" and right = "regardless"
-  or
-  wrong = "irrelevent" and right = "irrelevant"
-  or
-  wrong = "irreplacable" and right = "irreplaceable"
-  or
-  wrong = "irresistable" and right = "irresistible"
-  or
-  wrong = "irresistably" and right = "irresistibly"
-  or
-  wrong = "israelies" and right = "israelis"
-  or
-  wrong = "issueing" and right = "issuing"
-  or
-  wrong = "itnroduced" and right = "introduced"
-  or
-  wrong = "iunior" and right = "junior"
-  or
-  wrong = "iwll" and right = "will"
-  or
-  wrong = "iwth" and right = "with"
-  or
-  wrong = "janurary" and right = "january"
-  or
-  wrong = "januray" and right = "january"
-  or
-  wrong = "japanes" and right = "japanese"
-  or
-  wrong = "jaques" and right = "jacques"
-  or
-  wrong = "jeapardy" and right = "jeopardy"
-  or
-  wrong = "jewllery" and right = "jewellery"
-  or
-  wrong = "johanine" and right = "johannine"
-  or
-  wrong = "jorunal" and right = "journal"
-  or
-  wrong = "jospeh" and right = "joseph"
-  or
-  wrong = "jouney" and right = "journey"
-  or
-  wrong = "journied" and right = "journeyed"
-  or
-  wrong = "journies" and right = "journeys"
-  or
-  wrong = "jstu" and right = "just"
-  or
-  wrong = "jsut" and right = "just"
-  or
-  wrong = "juadaism" and right = "judaism"
-  or
-  wrong = "juadism" and right = "judaism"
-  or
-  wrong = "judical" and right = "judicial"
-  or
-  wrong = "judisuary" and right = "judiciary"
-  or
-  wrong = "juducial" and right = "judicial"
-  or
-  wrong = "juristiction" and right = "jurisdiction"
-  or
-  wrong = "juristictions" and right = "jurisdictions"
-  or
-  wrong = "kindergarden" and right = "kindergarten"
-  or
-  wrong = "klenex" and right = "kleenex"
-  or
-  wrong = "knifes" and right = "knives"
-  or
-  wrong = "knive" and right = "knife"
-  or
-  wrong = "knowlege" and right = "knowledge"
-  or
-  wrong = "knowlegeable" and right = "knowledgeable"
-  or
-  wrong = "knwo" and right = "know"
-  or
-  wrong = "knwos" and right = "knows"
-  or
-  wrong = "konw" and right = "know"
-  or
-  wrong = "konws" and right = "knows"
-  or
-  wrong = "kwno" and right = "know"
-  or
-  wrong = "labatory" and right = "laboratory"
-  or
-  wrong = "labatory" and right = "lavatory"
-  or
-  wrong = "labled" and right = "labeled"
-  or
-  wrong = "labled" and right = "labelled"
-  or
-  wrong = "labratory" and right = "laboratory"
-  or
-  wrong = "laguage" and right = "language"
-  or
-  wrong = "laguages" and right = "languages"
-  or
-  wrong = "langage" and right = "language"
-  or
-  wrong = "langauge" and right = "language"
-  or
-  wrong = "larg" and right = "large"
-  or
-  wrong = "largst" and right = "largest"
-  or
-  wrong = "larrry" and right = "larry"
-  or
-  wrong = "lastr" and right = "last"
-  or
-  wrong = "lattitude" and right = "latitude"
-  or
-  wrong = "launchs" and right = "launch"
-  or
-  wrong = "launchs" and right = "launches"
-  or
-  wrong = "launhed" and right = "launched"
-  or
-  wrong = "lavae" and right = "larvae"
-  or
-  wrong = "layed" and right = "laid"
-  or
-  wrong = "lazyness" and right = "laziness"
-  or
-  wrong = "leage" and right = "league"
-  or
-  wrong = "leanr" and right = "lean"
-  or
-  wrong = "leanr" and right = "leaner"
-  or
-  wrong = "leanr" and right = "learn"
-  or
-  wrong = "leathal" and right = "lethal"
-  or
-  wrong = "lefted" and right = "left"
-  or
-  wrong = "legitamate" and right = "legitimate"
-  or
-  wrong = "legitmate" and right = "legitimate"
-  or
-  wrong = "leibnitz" and right = "leibniz"
-  or
-  wrong = "lengh" and right = "length"
-  or
-  wrong = "lenght" and right = "length"
-  or
-  wrong = "lengt" and right = "length"
-  or
-  wrong = "lenth" and right = "length"
-  or
-  wrong = "leran" and right = "learn"
-  or
-  wrong = "lerans" and right = "learns"
-  or
-  wrong = "leutenant" and right = "lieutenant"
-  or
-  wrong = "levetate" and right = "levitate"
-  or
-  wrong = "levetated" and right = "levitated"
-  or
-  wrong = "levetates" and right = "levitates"
-  or
-  wrong = "levetating" and right = "levitating"
-  or
-  wrong = "levle" and right = "level"
-  or
-  wrong = "liasion" and right = "liaison"
-  or
-  wrong = "liason" and right = "liaison"
-  or
-  wrong = "liasons" and right = "liaisons"
-  or
-  wrong = "libaries" and right = "libraries"
-  or
-  wrong = "libary" and right = "library"
-  or
-  wrong = "libell" and right = "libel"
-  or
-  wrong = "libguistic" and right = "linguistic"
-  or
-  wrong = "libguistics" and right = "linguistics"
-  or
-  wrong = "libitarianisn" and right = "libertarianism"
-  or
-  wrong = "lible" and right = "liable"
-  or
-  wrong = "lible" and right = "libel"
-  or
-  wrong = "lieing" and right = "lying"
-  or
-  wrong = "liek" and right = "like"
-  or
-  wrong = "liekd" and right = "liked"
-  or
-  wrong = "liesure" and right = "leisure"
-  or
-  wrong = "lieuenant" and right = "lieutenant"
-  or
-  wrong = "lieved" and right = "lived"
-  or
-  wrong = "liftime" and right = "lifetime"
-  or
-  wrong = "likelyhood" and right = "likelihood"
-  or
-  wrong = "linnaena" and right = "linnaean"
-  or
-  wrong = "lippizaner" and right = "lipizzaner"
-  or
-  wrong = "liquify" and right = "liquefy"
-  or
-  wrong = "liscense" and right = "licence"
-  or
-  wrong = "liscense" and right = "license"
-  or
-  wrong = "lisence" and right = "licence"
-  or
-  wrong = "lisence" and right = "license"
-  or
-  wrong = "lisense" and right = "licence"
-  or
-  wrong = "lisense" and right = "license"
-  or
-  wrong = "listners" and right = "listeners"
-  or
-  wrong = "litature" and right = "literature"
-  or
-  wrong = "literaly" and right = "literally"
-  or
-  wrong = "literture" and right = "literature"
-  or
-  wrong = "littel" and right = "little"
-  or
-  wrong = "litterally" and right = "literally"
-  or
-  wrong = "liuke" and right = "like"
-  or
-  wrong = "livley" and right = "lively"
-  or
-  wrong = "lmits" and right = "limits"
-  or
-  wrong = "loev" and right = "love"
-  or
-  wrong = "lonelyness" and right = "loneliness"
-  or
-  wrong = "longitudonal" and right = "longitudinal"
-  or
-  wrong = "lonley" and right = "lonely"
-  or
-  wrong = "lonly" and right = "lonely"
-  or
-  wrong = "lonly" and right = "only"
-  or
-  wrong = "loosing" and right = "losing"
-  or
-  wrong = "lotharingen" and right = "lothringen"
-  or
-  wrong = "lsat" and right = "last"
-  or
-  wrong = "lukid" and right = "likud"
-  or
-  wrong = "lveo" and right = "love"
-  or
-  wrong = "lvoe" and right = "love"
-  or
-  wrong = "lybia" and right = "libya"
-  or
-  wrong = "maching" and right = "machine"
-  or
-  wrong = "maching" and right = "marching"
-  or
-  wrong = "maching" and right = "matching"
-  or
-  wrong = "mackeral" and right = "mackerel"
-  or
-  wrong = "magasine" and right = "magazine"
-  or
-  wrong = "magincian" and right = "magician"
-  or
-  wrong = "magisine" and right = "magazine"
-  or
-  wrong = "magizine" and right = "magazine"
-  or
-  wrong = "magnificient" and right = "magnificent"
-  or
-  wrong = "magolia" and right = "magnolia"
-  or
-  wrong = "mailny" and right = "mainly"
-  or
-  wrong = "maintainance" and right = "maintenance"
-  or
-  wrong = "maintainence" and right = "maintenance"
-  or
-  wrong = "maintance" and right = "maintenance"
-  or
-  wrong = "maintenence" and right = "maintenance"
-  or
-  wrong = "maintinaing" and right = "maintaining"
-  or
-  wrong = "maintioned" and right = "mentioned"
-  or
-  wrong = "majoroty" and right = "majority"
-  or
-  wrong = "maked" and right = "made"
-  or
-  wrong = "maked" and right = "marked"
-  or
-  wrong = "makse" and right = "makes"
-  or
-  wrong = "malcom" and right = "malcolm"
-  or
-  wrong = "maltesian" and right = "maltese"
-  or
-  wrong = "mamal" and right = "mammal"
-  or
-  wrong = "mamalian" and right = "mammalian"
-  or
-  wrong = "managable" and right = "manageable"
-  or
-  wrong = "managable" and right = "manageably"
-  or
-  wrong = "managment" and right = "management"
-  or
-  wrong = "maneouvre" and right = "manoeuvre"
-  or
-  wrong = "maneouvred" and right = "manoeuvred"
-  or
-  wrong = "maneouvres" and right = "manoeuvres"
-  or
-  wrong = "maneouvring" and right = "manoeuvring"
-  or
-  wrong = "manisfestations" and right = "manifestations"
-  or
-  wrong = "manoeuverability" and right = "maneuverability"
-  or
-  wrong = "manouver" and right = "maneuver"
-  or
-  wrong = "manouver" and right = "manoeuvre"
-  or
-  wrong = "manouverability" and right = "maneuverability"
-  or
-  wrong = "manouverability" and right = "manoeuverability"
-  or
-  wrong = "manouverability" and right = "manoeuvrability"
-  or
-  wrong = "manouverable" and right = "maneuverable"
-  or
-  wrong = "manouverable" and right = "manoeuvrable"
-  or
-  wrong = "manouvers" and right = "maneuvers"
-  or
-  wrong = "manouvers" and right = "manoeuvres"
-  or
-  wrong = "mantained" and right = "maintained"
-  or
-  wrong = "manuever" and right = "maneuver"
-  or
-  wrong = "manuever" and right = "manoeuvre"
-  or
-  wrong = "manuevers" and right = "maneuvers"
-  or
-  wrong = "manuevers" and right = "manoeuvres"
-  or
-  wrong = "manufacturedd" and right = "manufactured"
-  or
-  wrong = "manufature" and right = "manufacture"
-  or
-  wrong = "manufatured" and right = "manufactured"
-  or
-  wrong = "manufaturing" and right = "manufacturing"
-  or
-  wrong = "manuver" and right = "maneuver"
-  or
-  wrong = "mariage" and right = "marriage"
-  or
-  wrong = "marjority" and right = "majority"
-  or
-  wrong = "markes" and right = "marks"
-  or
-  wrong = "marketting" and right = "marketing"
-  or
-  wrong = "marmelade" and right = "marmalade"
-  or
-  wrong = "marrage" and right = "marriage"
-  or
-  wrong = "marraige" and right = "marriage"
-  or
-  wrong = "marrtyred" and right = "martyred"
-  or
-  wrong = "marryied" and right = "married"
-  or
-  wrong = "massachussets" and right = "massachusetts"
-  or
-  wrong = "massachussetts" and right = "massachusetts"
-  or
-  wrong = "masterbation" and right = "masturbation"
-  or
-  wrong = "mataphysical" and right = "metaphysical"
-  or
-  wrong = "materalists" and right = "materialist"
-  or
-  wrong = "mathamatics" and right = "mathematics"
-  or
-  wrong = "mathematican" and right = "mathematician"
-  or
-  wrong = "mathematicas" and right = "mathematics"
-  or
-  wrong = "matheticians" and right = "mathematicians"
-  or
-  wrong = "mathmatically" and right = "mathematically"
-  or
-  wrong = "mathmatician" and right = "mathematician"
-  or
-  wrong = "mathmaticians" and right = "mathematicians"
-  or
-  wrong = "mccarthyst" and right = "mccarthyist"
-  or
-  wrong = "mchanics" and right = "mechanics"
-  or
-  wrong = "meaninng" and right = "meaning"
-  or
-  wrong = "mear" and right = "mare"
-  or
-  wrong = "mear" and right = "mere"
-  or
-  wrong = "mear" and right = "wear"
-  or
-  wrong = "mechandise" and right = "merchandise"
-  or
-  wrong = "medacine" and right = "medicine"
-  or
-  wrong = "medeival" and right = "medieval"
-  or
-  wrong = "medevial" and right = "medieval"
-  or
-  wrong = "mediciney" and right = "mediciny"
-  or
-  wrong = "medievel" and right = "medieval"
-  or
-  wrong = "mediterainnean" and right = "mediterranean"
-  or
-  wrong = "mediteranean" and right = "mediterranean"
-  or
-  wrong = "meerkrat" and right = "meerkat"
-  or
-  wrong = "melieux" and right = "milieux"
-  or
-  wrong = "membranaphone" and right = "membranophone"
-  or
-  wrong = "memeber" and right = "member"
-  or
-  wrong = "menally" and right = "mentally"
-  or
-  wrong = "meranda" and right = "miranda"
-  or
-  wrong = "meranda" and right = "veranda"
-  or
-  wrong = "mercentile" and right = "mercantile"
-  or
-  wrong = "mesage" and right = "message"
-  or
-  wrong = "messanger" and right = "messenger"
-  or
-  wrong = "messenging" and right = "messaging"
-  or
-  wrong = "messsage" and right = "message"
-  or
-  wrong = "metalic" and right = "metallic"
-  or
-  wrong = "metalurgic" and right = "metallurgic"
-  or
-  wrong = "metalurgical" and right = "metallurgical"
-  or
-  wrong = "metalurgy" and right = "metallurgy"
-  or
-  wrong = "metamorphysis" and right = "metamorphosis"
-  or
-  wrong = "metaphoricial" and right = "metaphorical"
-  or
-  wrong = "meterologist" and right = "meteorologist"
-  or
-  wrong = "meterology" and right = "meteorology"
-  or
-  wrong = "methaphor" and right = "metaphor"
-  or
-  wrong = "methaphors" and right = "metaphors"
-  or
-  wrong = "michagan" and right = "michigan"
-  or
-  wrong = "micoscopy" and right = "microscopy"
-  or
-  wrong = "midwifes" and right = "midwives"
-  or
-  wrong = "mileau" and right = "milieu"
-  or
-  wrong = "milennia" and right = "millennia"
-  or
-  wrong = "milennium" and right = "millennium"
-  or
-  wrong = "mileu" and right = "milieu"
-  or
-  wrong = "miliary" and right = "military"
-  or
-  wrong = "miligram" and right = "milligram"
-  or
-  wrong = "milion" and right = "million"
-  or
-  wrong = "miliraty" and right = "military"
-  or
-  wrong = "millenia" and right = "millennia"
-  or
-  wrong = "millenial" and right = "millennial"
-  or
-  wrong = "millenialism" and right = "millennialism"
-  or
-  wrong = "millenium" and right = "millennium"
-  or
-  wrong = "millepede" and right = "millipede"
-  or
-  wrong = "millioniare" and right = "millionaire"
-  or
-  wrong = "millitant" and right = "militant"
-  or
-  wrong = "millitary" and right = "military"
-  or
-  wrong = "millon" and right = "million"
-  or
-  wrong = "miltary" and right = "military"
-  or
-  wrong = "minature" and right = "miniature"
-  or
-  wrong = "minerial" and right = "mineral"
-  or
-  wrong = "ministery" and right = "ministry"
-  or
-  wrong = "minsitry" and right = "ministry"
-  or
-  wrong = "minstries" and right = "ministries"
-  or
-  wrong = "minstry" and right = "ministry"
-  or
-  wrong = "minumum" and right = "minimum"
-  or
-  wrong = "mirrorred" and right = "mirrored"
-  or
-  wrong = "miscelaneous" and right = "miscellaneous"
-  or
-  wrong = "miscellanious" and right = "miscellaneous"
-  or
-  wrong = "miscellanous" and right = "miscellaneous"
-  or
-  wrong = "mischeivous" and right = "mischievous"
-  or
-  wrong = "mischevious" and right = "mischievous"
-  or
-  wrong = "mischievious" and right = "mischievous"
-  or
-  wrong = "misdameanor" and right = "misdemeanor"
-  or
-  wrong = "misdameanors" and right = "misdemeanors"
-  or
-  wrong = "misdemenor" and right = "misdemeanor"
-  or
-  wrong = "misdemenors" and right = "misdemeanors"
-  or
-  wrong = "misfourtunes" and right = "misfortunes"
-  or
-  wrong = "misile" and right = "missile"
-  or
-  wrong = "misouri" and right = "missouri"
-  or
-  wrong = "mispell" and right = "misspell"
-  or
-  wrong = "mispelled" and right = "misspelled"
-  or
-  wrong = "mispelling" and right = "misspelling"
-  or
-  wrong = "missen" and right = "mizzen"
-  or
-  wrong = "missisipi" and right = "mississippi"
-  or
-  wrong = "missisippi" and right = "mississippi"
-  or
-  wrong = "missle" and right = "missile"
-  or
-  wrong = "missonary" and right = "missionary"
-  or
-  wrong = "misterious" and right = "mysterious"
-  or
-  wrong = "mistery" and right = "mystery"
-  or
-  wrong = "misteryous" and right = "mysterious"
-  or
-  wrong = "mkae" and right = "make"
-  or
-  wrong = "mkaes" and right = "makes"
-  or
-  wrong = "mkaing" and right = "making"
-  or
-  wrong = "mkea" and right = "make"
-  or
-  wrong = "moderm" and right = "modem"
-  or
-  wrong = "modle" and right = "model"
-  or
-  wrong = "moent" and right = "moment"
-  or
-  wrong = "moeny" and right = "money"
-  or
-  wrong = "mohammedans" and right = "muslims"
-  or
-  wrong = "moil" and right = "mohel"
-  or
-  wrong = "moil" and right = "soil"
-  or
-  wrong = "moleclues" and right = "molecules"
-  or
-  wrong = "momento" and right = "memento"
-  or
-  wrong = "monestaries" and right = "monasteries"
-  or
-  wrong = "monestary" and right = "monastery"
-  or
-  wrong = "monestary" and right = "monetary"
-  or
-  wrong = "monickers" and right = "monikers"
-  or
-  wrong = "monolite" and right = "monolithic"
-  or
-  wrong = "monserrat" and right = "montserrat"
-  or
-  wrong = "montains" and right = "mountains"
-  or
-  wrong = "montanous" and right = "mountainous"
-  or
-  wrong = "montnana" and right = "montana"
-  or
-  wrong = "monts" and right = "months"
-  or
-  wrong = "montypic" and right = "monotypic"
-  or
-  wrong = "moreso" and right = "more"
-  or
-  wrong = "morgage" and right = "mortgage"
-  or
-  wrong = "morisette" and right = "morissette"
-  or
-  wrong = "morrisette" and right = "morissette"
-  or
-  wrong = "morroccan" and right = "moroccan"
-  or
-  wrong = "morrocco" and right = "morocco"
-  or
-  wrong = "morroco" and right = "morocco"
-  or
-  wrong = "mortage" and right = "mortgage"
-  or
-  wrong = "mosture" and right = "moisture"
-  or
-  wrong = "motiviated" and right = "motivated"
-  or
-  wrong = "mounth" and right = "month"
-  or
-  wrong = "movei" and right = "movie"
-  or
-  wrong = "movment" and right = "movement"
-  or
-  wrong = "mroe" and right = "more"
-  or
-  wrong = "mucuous" and right = "mucous"
-  or
-  wrong = "muder" and right = "murder"
-  or
-  wrong = "mudering" and right = "murdering"
-  or
-  wrong = "muhammadan" and right = "muslim"
-  or
-  wrong = "multicultralism" and right = "multiculturalism"
-  or
-  wrong = "multipled" and right = "multiplied"
-  or
-  wrong = "multiplers" and right = "multipliers"
-  or
-  wrong = "munbers" and right = "numbers"
-  or
-  wrong = "muncipalities" and right = "municipalities"
-  or
-  wrong = "muncipality" and right = "municipality"
-  or
-  wrong = "munnicipality" and right = "municipality"
-  or
-  wrong = "muscels" and right = "muscles"
-  or
-  wrong = "muscels" and right = "mussels"
-  or
-  wrong = "muscial" and right = "musical"
-  or
-  wrong = "muscician" and right = "musician"
-  or
-  wrong = "muscicians" and right = "musicians"
-  or
-  wrong = "mutiliated" and right = "mutilated"
-  or
-  wrong = "mutiple" and right = "multiple"
-  or
-  wrong = "myraid" and right = "myriad"
-  or
-  wrong = "mysef" and right = "myself"
-  or
-  wrong = "mysogynist" and right = "misogynist"
-  or
-  wrong = "mysogyny" and right = "misogyny"
-  or
-  wrong = "mysterous" and right = "mysterious"
-  or
-  wrong = "mythraic" and right = "mithraic"
-  or
-  wrong = "naieve" and right = "naive"
-  or
-  wrong = "naploeon" and right = "napoleon"
-  or
-  wrong = "napolean" and right = "napoleon"
-  or
-  wrong = "napoleonian" and right = "napoleonic"
-  or
-  wrong = "naturaly" and right = "naturally"
-  or
-  wrong = "naturely" and right = "naturally"
-  or
-  wrong = "naturual" and right = "natural"
-  or
-  wrong = "naturually" and right = "naturally"
-  or
-  wrong = "nazereth" and right = "nazareth"
-  or
-  wrong = "neccesarily" and right = "necessarily"
-  or
-  wrong = "neccesary" and right = "necessary"
-  or
-  wrong = "neccessarily" and right = "necessarily"
-  or
-  wrong = "neccessary" and right = "necessary"
-  or
-  wrong = "neccessities" and right = "necessities"
-  or
-  wrong = "necesarily" and right = "necessarily"
-  or
-  wrong = "necesary" and right = "necessary"
-  or
-  wrong = "necessiate" and right = "necessitate"
-  or
-  wrong = "neglible" and right = "negligible"
-  or
-  wrong = "negligable" and right = "negligible"
-  or
-  wrong = "negociate" and right = "negotiate"
-  or
-  wrong = "negociation" and right = "negotiation"
-  or
-  wrong = "negociations" and right = "negotiations"
-  or
-  wrong = "negotation" and right = "negotiation"
-  or
-  wrong = "neice" and right = "nice"
-  or
-  wrong = "neice" and right = "niece"
-  or
-  wrong = "neigborhood" and right = "neighborhood"
-  or
-  wrong = "neigbour" and right = "neighbor"
-  or
-  wrong = "neigbour" and right = "neighbour"
-  or
-  wrong = "neigbourhood" and right = "neighbourhood"
-  or
-  wrong = "neigbouring" and right = "neighboring"
-  or
-  wrong = "neigbouring" and right = "neighbouring"
-  or
-  wrong = "neigbours" and right = "neighbors"
-  or
-  wrong = "neigbours" and right = "neighbours"
-  or
-  wrong = "neolitic" and right = "neolithic"
-  or
-  wrong = "nessasarily" and right = "necessarily"
-  or
-  wrong = "nessecary" and right = "necessary"
-  or
-  wrong = "nestin" and right = "nesting"
-  or
-  wrong = "neverthless" and right = "nevertheless"
-  or
-  wrong = "newletters" and right = "newsletters"
-  or
-  wrong = "nickle" and right = "nickel"
-  or
-  wrong = "nightime" and right = "nighttime"
-  or
-  wrong = "nineth" and right = "ninth"
-  or
-  wrong = "ninteenth" and right = "nineteenth"
-  or
-  wrong = "ninty" and right = "ninety"
-  or
-  wrong = "nkow" and right = "know"
-  or
-  wrong = "nkwo" and right = "know"
-  or
-  wrong = "nmae" and right = "name"
-  or
-  wrong = "noncombatents" and right = "noncombatants"
-  or
-  wrong = "nonsence" and right = "nonsense"
-  or
-  wrong = "nontheless" and right = "nonetheless"
-  or
-  wrong = "norhern" and right = "northern"
-  or
-  wrong = "northen" and right = "northern"
-  or
-  wrong = "northereastern" and right = "northeastern"
-  or
-  wrong = "notabley" and right = "notably"
-  or
-  wrong = "noteable" and right = "notable"
-  or
-  wrong = "noteably" and right = "notably"
-  or
-  wrong = "noteriety" and right = "notoriety"
-  or
-  wrong = "noth" and right = "north"
-  or
-  wrong = "nothern" and right = "northern"
-  or
-  wrong = "noticable" and right = "noticeable"
-  or
-  wrong = "noticably" and right = "noticeably"
-  or
-  wrong = "notications" and right = "notifications"
-  or
-  wrong = "noticeing" and right = "noticing"
-  or
-  wrong = "noticible" and right = "noticeable"
-  or
-  wrong = "notwhithstanding" and right = "notwithstanding"
-  or
-  wrong = "noveau" and right = "nouveau"
-  or
-  wrong = "novermber" and right = "november"
-  or
-  wrong = "nowdays" and right = "nowadays"
-  or
-  wrong = "nowe" and right = "now"
-  or
-  wrong = "nto" and right = "not"
-  or
-  wrong = "nubmer" and right = "number"
-  or
-  wrong = "nucular" and right = "nuclear"
-  or
-  wrong = "nuculear" and right = "nuclear"
-  or
-  wrong = "nuisanse" and right = "nuisance"
-  or
-  wrong = "nullabour" and right = "nullarbor"
-  or
-  wrong = "numberous" and right = "numerous"
-  or
-  wrong = "nuremburg" and right = "nuremberg"
-  or
-  wrong = "nusance" and right = "nuisance"
-  or
-  wrong = "nutritent" and right = "nutrient"
-  or
-  wrong = "nutritents" and right = "nutrients"
-  or
-  wrong = "nuturing" and right = "nurturing"
-  or
-  wrong = "obect" and right = "object"
-  or
-  wrong = "obediance" and right = "obedience"
-  or
-  wrong = "obediant" and right = "obedient"
-  or
-  wrong = "obejct" and right = "object"
-  or
-  wrong = "obession" and right = "obsession"
-  or
-  wrong = "obssessed" and right = "obsessed"
-  or
-  wrong = "obstacal" and right = "obstacle"
-  or
-  wrong = "obstancles" and right = "obstacles"
-  or
-  wrong = "obstruced" and right = "obstructed"
-  or
-  wrong = "ocasion" and right = "occasion"
-  or
-  wrong = "ocasional" and right = "occasional"
-  or
-  wrong = "ocasionally" and right = "occasionally"
-  or
-  wrong = "ocasionaly" and right = "occasionally"
-  or
-  wrong = "ocasioned" and right = "occasioned"
-  or
-  wrong = "ocasions" and right = "occasions"
-  or
-  wrong = "ocassion" and right = "occasion"
-  or
-  wrong = "ocassional" and right = "occasional"
-  or
-  wrong = "ocassionally" and right = "occasionally"
-  or
-  wrong = "ocassionaly" and right = "occasionally"
-  or
-  wrong = "ocassioned" and right = "occasioned"
-  or
-  wrong = "ocassions" and right = "occasions"
-  or
-  wrong = "occaison" and right = "occasion"
-  or
-  wrong = "occassion" and right = "occasion"
-  or
-  wrong = "occassional" and right = "occasional"
-  or
-  wrong = "occassionally" and right = "occasionally"
-  or
-  wrong = "occassionaly" and right = "occasionally"
-  or
-  wrong = "occassioned" and right = "occasioned"
-  or
-  wrong = "occassions" and right = "occasions"
-  or
-  wrong = "occationally" and right = "occasionally"
-  or
-  wrong = "occour" and right = "occur"
-  or
-  wrong = "occurance" and right = "occurrence"
-  or
-  wrong = "occurances" and right = "occurrences"
-  or
-  wrong = "occured" and right = "occurred"
-  or
-  wrong = "occurence" and right = "occurrence"
-  or
-  wrong = "occurences" and right = "occurrences"
-  or
-  wrong = "occuring" and right = "occurring"
-  or
-  wrong = "occurr" and right = "occur"
-  or
-  wrong = "occurrance" and right = "occurrence"
-  or
-  wrong = "occurrances" and right = "occurrences"
-  or
-  wrong = "octohedra" and right = "octahedra"
-  or
-  wrong = "octohedral" and right = "octahedral"
-  or
-  wrong = "octohedron" and right = "octahedron"
-  or
-  wrong = "ocuntries" and right = "countries"
-  or
-  wrong = "ocuntry" and right = "country"
-  or
-  wrong = "ocurr" and right = "occur"
-  or
-  wrong = "ocurrance" and right = "occurrence"
-  or
-  wrong = "ocurred" and right = "occurred"
-  or
-  wrong = "ocurrence" and right = "occurrence"
-  or
-  wrong = "offcers" and right = "officers"
-  or
-  wrong = "offcially" and right = "officially"
-  or
-  wrong = "offereings" and right = "offerings"
-  or
-  wrong = "offical" and right = "official"
-  or
-  wrong = "offically" and right = "officially"
-  or
-  wrong = "officals" and right = "officials"
-  or
-  wrong = "officaly" and right = "officially"
-  or
-  wrong = "officialy" and right = "officially"
-  or
-  wrong = "offred" and right = "offered"
-  or
-  wrong = "oftenly" and right = "often"
-  or
-  wrong = "oging" and right = "going"
-  or
-  wrong = "oging" and right = "ogling"
-  or
-  wrong = "oject" and right = "object"
-  or
-  wrong = "omision" and right = "omission"
-  or
-  wrong = "omited" and right = "omitted"
-  or
-  wrong = "omiting" and right = "omitting"
-  or
-  wrong = "omlette" and right = "omelette"
-  or
-  wrong = "ommision" and right = "omission"
-  or
-  wrong = "ommited" and right = "omitted"
-  or
-  wrong = "ommiting" and right = "omitting"
-  or
-  wrong = "ommitted" and right = "omitted"
-  or
-  wrong = "ommitting" and right = "omitting"
-  or
-  wrong = "omniverous" and right = "omnivorous"
-  or
-  wrong = "omniverously" and right = "omnivorously"
-  or
-  wrong = "omre" and right = "more"
-  or
-  wrong = "onot" and right = "not"
-  or
-  wrong = "onot" and right = "note"
-  or
-  wrong = "onyl" and right = "only"
-  or
-  wrong = "openess" and right = "openness"
-  or
-  wrong = "oponent" and right = "opponent"
-  or
-  wrong = "oportunity" and right = "opportunity"
-  or
-  wrong = "opose" and right = "oppose"
-  or
-  wrong = "oposite" and right = "opposite"
-  or
-  wrong = "oposition" and right = "opposition"
-  or
-  wrong = "oppenly" and right = "openly"
-  or
-  wrong = "oppinion" and right = "opinion"
-  or
-  wrong = "opponant" and right = "opponent"
-  or
-  wrong = "oppononent" and right = "opponent"
-  or
-  wrong = "oppositition" and right = "opposition"
-  or
-  wrong = "oppossed" and right = "opposed"
-  or
-  wrong = "opprotunity" and right = "opportunity"
-  or
-  wrong = "opression" and right = "oppression"
-  or
-  wrong = "opressive" and right = "oppressive"
-  or
-  wrong = "opthalmic" and right = "ophthalmic"
-  or
-  wrong = "opthalmologist" and right = "ophthalmologist"
-  or
-  wrong = "opthalmology" and right = "ophthalmology"
-  or
-  wrong = "opthamologist" and right = "ophthalmologist"
-  or
-  wrong = "optmizations" and right = "optimizations"
-  or
-  wrong = "optomism" and right = "optimism"
-  or
-  wrong = "orded" and right = "ordered"
-  or
-  wrong = "organim" and right = "organism"
-  or
-  wrong = "organistion" and right = "organisation"
-  or
-  wrong = "organiztion" and right = "organization"
-  or
-  wrong = "orgin" and right = "organ"
-  or
-  wrong = "orgin" and right = "origin"
-  or
-  wrong = "orginal" and right = "original"
-  or
-  wrong = "orginally" and right = "originally"
-  or
-  wrong = "orginize" and right = "organise"
-  or
-  wrong = "oridinarily" and right = "ordinarily"
-  or
-  wrong = "origanaly" and right = "originally"
-  or
-  wrong = "originall" and right = "original"
-  or
-  wrong = "originall" and right = "originally"
-  or
-  wrong = "originaly" and right = "originally"
-  or
-  wrong = "originially" and right = "originally"
-  or
-  wrong = "originnally" and right = "originally"
-  or
-  wrong = "origional" and right = "original"
-  or
-  wrong = "orignally" and right = "originally"
-  or
-  wrong = "orignially" and right = "originally"
-  or
-  wrong = "otehr" and right = "other"
-  or
-  wrong = "oublisher" and right = "publisher"
-  or
-  wrong = "ouevre" and right = "oeuvre"
-  or
-  wrong = "ouput" and right = "output"
-  or
-  wrong = "oustanding" and right = "outstanding"
-  or
-  wrong = "overriden" and right = "overridden"
-  or
-  wrong = "overshaddowed" and right = "overshadowed"
-  or
-  wrong = "overwelming" and right = "overwhelming"
-  or
-  wrong = "overwheliming" and right = "overwhelming"
-  or
-  wrong = "owrk" and right = "work"
-  or
-  wrong = "owudl" and right = "would"
-  or
-  wrong = "oxigen" and right = "oxygen"
-  or
-  wrong = "oximoron" and right = "oxymoron"
-  or
-  wrong = "p0enis" and right = "penis"
-  or
-  wrong = "paide" and right = "paid"
-  or
-  wrong = "paitience" and right = "patience"
-  or
-  wrong = "palce" and right = "palace"
-  or
-  wrong = "palce" and right = "place"
-  or
-  wrong = "paleolitic" and right = "paleolithic"
-  or
-  wrong = "paliamentarian" and right = "parliamentarian"
-  or
-  wrong = "palistian" and right = "palestinian"
-  or
-  wrong = "palistinian" and right = "palestinian"
-  or
-  wrong = "palistinians" and right = "palestinians"
-  or
-  wrong = "pallete" and right = "palette"
-  or
-  wrong = "pamflet" and right = "pamphlet"
-  or
-  wrong = "pamplet" and right = "pamphlet"
-  or
-  wrong = "pantomine" and right = "pantomime"
-  or
-  wrong = "papanicalou" and right = "papanicolaou"
-  or
-  wrong = "paralel" and right = "parallel"
-  or
-  wrong = "paralell" and right = "parallel"
-  or
-  wrong = "paralelly" and right = "parallelly"
-  or
-  wrong = "paralely" and right = "parallelly"
-  or
-  wrong = "parallely" and right = "parallelly"
-  or
-  wrong = "paramater" and right = "parameter"
-  or
-  wrong = "paramters" and right = "parameters"
-  or
-  wrong = "parametarized" and right = "parameterized"
-  or
-  wrong = "paranthesis" and right = "parenthesis"
-  or
-  wrong = "paraphenalia" and right = "paraphernalia"
-  or
-  wrong = "parellels" and right = "parallels"
-  or
-  wrong = "parisitic" and right = "parasitic"
-  or
-  wrong = "parituclar" and right = "particular"
-  or
-  wrong = "parliment" and right = "parliament"
-  or
-  wrong = "parrakeets" and right = "parakeets"
-  or
-  wrong = "parralel" and right = "parallel"
-  or
-  wrong = "parrallel" and right = "parallel"
-  or
-  wrong = "parrallell" and right = "parallel"
-  or
-  wrong = "parrallelly" and right = "parallelly"
-  or
-  wrong = "parrallely" and right = "parallelly"
-  or
-  wrong = "partialy" and right = "partially"
-  or
-  wrong = "particually" and right = "particularly"
-  or
-  wrong = "particualr" and right = "particular"
-  or
-  wrong = "particuarly" and right = "particularly"
-  or
-  wrong = "particularily" and right = "particularly"
-  or
-  wrong = "particulary" and right = "particularly"
-  or
-  wrong = "pary" and right = "party"
-  or
-  wrong = "pased" and right = "passed"
-  or
-  wrong = "pasengers" and right = "passengers"
-  or
-  wrong = "passerbys" and right = "passersby"
-  or
-  wrong = "pasttime" and right = "pastime"
-  or
-  wrong = "pastural" and right = "pastoral"
-  or
-  wrong = "paticular" and right = "particular"
-  or
-  wrong = "pattented" and right = "patented"
-  or
-  wrong = "pavillion" and right = "pavilion"
-  or
-  wrong = "payed" and right = "paid"
-  or
-  wrong = "pblisher" and right = "publisher"
-  or
-  wrong = "pbulisher" and right = "publisher"
-  or
-  wrong = "peageant" and right = "pageant"
-  or
-  wrong = "peaple" and right = "people"
-  or
-  wrong = "peaples" and right = "peoples"
-  or
-  wrong = "peculure" and right = "peculiar"
-  or
-  wrong = "pedestrain" and right = "pedestrian"
-  or
-  wrong = "peformed" and right = "performed"
-  or
-  wrong = "peice" and right = "piece"
-  or
-  wrong = "peloponnes" and right = "peloponnesus"
-  or
-  wrong = "penatly" and right = "penalty"
-  or
-  wrong = "penerator" and right = "penetrator"
-  or
-  wrong = "penisula" and right = "peninsula"
-  or
-  wrong = "penisular" and right = "peninsular"
-  or
-  wrong = "penninsula" and right = "peninsula"
-  or
-  wrong = "penninsular" and right = "peninsular"
-  or
-  wrong = "pennisula" and right = "peninsula"
-  or
-  wrong = "pennyslvania" and right = "pennsylvania"
-  or
-  wrong = "pensinula" and right = "peninsula"
-  or
-  wrong = "pensle" and right = "pencil"
-  or
-  wrong = "peom" and right = "poem"
-  or
-  wrong = "peoms" and right = "poems"
-  or
-  wrong = "peopel" and right = "people"
-  or
-  wrong = "peopels" and right = "peoples"
-  or
-  wrong = "peotry" and right = "poetry"
-  or
-  wrong = "perade" and right = "parade"
-  or
-  wrong = "percepted" and right = "perceived"
-  or
-  wrong = "percieve" and right = "perceive"
-  or
-  wrong = "percieved" and right = "perceived"
-  or
-  wrong = "perenially" and right = "perennially"
-  or
-  wrong = "peretrator" and right = "perpetrator"
-  or
-  wrong = "perfomance" and right = "performance"
-  or
-  wrong = "perfomers" and right = "performers"
-  or
-  wrong = "performence" and right = "performance"
-  or
-  wrong = "performes" and right = "performed"
-  or
-  wrong = "performes" and right = "performs"
-  or
-  wrong = "perhasp" and right = "perhaps"
-  or
-  wrong = "perheaps" and right = "perhaps"
-  or
-  wrong = "perhpas" and right = "perhaps"
-  or
-  wrong = "peripathetic" and right = "peripatetic"
-  or
-  wrong = "peristent" and right = "persistent"
-  or
-  wrong = "perjery" and right = "perjury"
-  or
-  wrong = "perjorative" and right = "pejorative"
-  or
-  wrong = "permanant" and right = "permanent"
-  or
-  wrong = "permenant" and right = "permanent"
-  or
-  wrong = "permenantly" and right = "permanently"
-  or
-  wrong = "permissable" and right = "permissible"
-  or
-  wrong = "perogative" and right = "prerogative"
-  or
-  wrong = "peronal" and right = "personal"
-  or
-  wrong = "perosnality" and right = "personality"
-  or
-  wrong = "perpertrated" and right = "perpetrated"
-  or
-  wrong = "perphas" and right = "perhaps"
-  or
-  wrong = "perpindicular" and right = "perpendicular"
-  or
-  wrong = "persan" and right = "person"
-  or
-  wrong = "perseverence" and right = "perseverance"
-  or
-  wrong = "persistance" and right = "persistence"
-  or
-  wrong = "persistant" and right = "persistent"
-  or
-  wrong = "personel" and right = "personal"
-  or
-  wrong = "personel" and right = "personnel"
-  or
-  wrong = "personell" and right = "personnel"
-  or
-  wrong = "personnell" and right = "personnel"
-  or
-  wrong = "persuded" and right = "persuaded"
-  or
-  wrong = "persue" and right = "pursue"
-  or
-  wrong = "persued" and right = "pursued"
-  or
-  wrong = "persuing" and right = "pursuing"
-  or
-  wrong = "persuit" and right = "pursuit"
-  or
-  wrong = "persuits" and right = "pursuits"
-  or
-  wrong = "pertubation" and right = "perturbation"
-  or
-  wrong = "pertubations" and right = "perturbations"
-  or
-  wrong = "pessiary" and right = "pessary"
-  or
-  wrong = "petetion" and right = "petition"
-  or
-  wrong = "pharoah" and right = "pharaoh"
-  or
-  wrong = "phenomenom" and right = "phenomenon"
-  or
-  wrong = "phenomenonal" and right = "phenomenal"
-  or
-  wrong = "phenomenonly" and right = "phenomenally"
-  or
-  wrong = "phenomonenon" and right = "phenomenon"
-  or
-  wrong = "phenomonon" and right = "phenomenon"
-  or
-  wrong = "phenonmena" and right = "phenomena"
-  or
-  wrong = "philipines" and right = "philippines"
-  or
-  wrong = "philisopher" and right = "philosopher"
-  or
-  wrong = "philisophical" and right = "philosophical"
-  or
-  wrong = "philisophy" and right = "philosophy"
-  or
-  wrong = "phillipine" and right = "philippine"
-  or
-  wrong = "phillipines" and right = "philippines"
-  or
-  wrong = "phillippines" and right = "philippines"
-  or
-  wrong = "phillosophically" and right = "philosophically"
-  or
-  wrong = "philospher" and right = "philosopher"
-  or
-  wrong = "philosphies" and right = "philosophies"
-  or
-  wrong = "philosphy" and right = "philosophy"
-  or
-  wrong = "phonecian" and right = "phoenecian"
-  or
-  wrong = "phongraph" and right = "phonograph"
-  or
-  wrong = "phylosophical" and right = "philosophical"
-  or
-  wrong = "physicaly" and right = "physically"
-  or
-  wrong = "piblisher" and right = "publisher"
-  or
-  wrong = "pich" and right = "pitch"
-  or
-  wrong = "pilgrimmage" and right = "pilgrimage"
-  or
-  wrong = "pilgrimmages" and right = "pilgrimages"
-  or
-  wrong = "pinapple" and right = "pineapple"
-  or
-  wrong = "pinnaple" and right = "pineapple"
-  or
-  wrong = "pinoneered" and right = "pioneered"
-  or
-  wrong = "plagarism" and right = "plagiarism"
-  or
-  wrong = "planation" and right = "plantation"
-  or
-  wrong = "planed" and right = "planned"
-  or
-  wrong = "plantiff" and right = "plaintiff"
-  or
-  wrong = "plateu" and right = "plateau"
-  or
-  wrong = "plausable" and right = "plausible"
-  or
-  wrong = "playright" and right = "playwright"
-  or
-  wrong = "playwrite" and right = "playwright"
-  or
-  wrong = "playwrites" and right = "playwrights"
-  or
-  wrong = "pleasent" and right = "pleasant"
-  or
-  wrong = "plebicite" and right = "plebiscite"
-  or
-  wrong = "plesant" and right = "pleasant"
-  or
-  wrong = "poenis" and right = "penis"
-  or
-  wrong = "poeoples" and right = "peoples"
-  or
-  wrong = "poety" and right = "poetry"
-  or
-  wrong = "poisin" and right = "poison"
-  or
-  wrong = "polical" and right = "political"
-  or
-  wrong = "polinator" and right = "pollinator"
-  or
-  wrong = "polinators" and right = "pollinators"
-  or
-  wrong = "politican" and right = "politician"
-  or
-  wrong = "politicans" and right = "politicians"
-  or
-  wrong = "poltical" and right = "political"
-  or
-  wrong = "polute" and right = "pollute"
-  or
-  wrong = "poluted" and right = "polluted"
-  or
-  wrong = "polutes" and right = "pollutes"
-  or
-  wrong = "poluting" and right = "polluting"
-  or
-  wrong = "polution" and right = "pollution"
-  or
-  wrong = "polyphonyic" and right = "polyphonic"
-  or
-  wrong = "polysaccaride" and right = "polysaccharide"
-  or
-  wrong = "polysaccharid" and right = "polysaccharide"
-  or
-  wrong = "pomegranite" and right = "pomegranate"
-  or
-  wrong = "pomotion" and right = "promotion"
-  or
-  wrong = "poportional" and right = "proportional"
-  or
-  wrong = "popoulation" and right = "population"
-  or
-  wrong = "popularaty" and right = "popularity"
-  or
-  wrong = "populare" and right = "popular"
-  or
-  wrong = "populer" and right = "popular"
-  or
-  wrong = "porshan" and right = "portion"
-  or
-  wrong = "porshon" and right = "portion"
-  or
-  wrong = "portait" and right = "portrait"
-  or
-  wrong = "portayed" and right = "portrayed"
-  or
-  wrong = "portraing" and right = "portraying"
-  or
-  wrong = "portugese" and right = "portuguese"
-  or
-  wrong = "portuguease" and right = "portuguese"
-  or
-  wrong = "portugues" and right = "portuguese"
-  or
-  wrong = "posess" and right = "possess"
-  or
-  wrong = "posessed" and right = "possessed"
-  or
-  wrong = "posesses" and right = "possesses"
-  or
-  wrong = "posessing" and right = "possessing"
-  or
-  wrong = "posession" and right = "possession"
-  or
-  wrong = "posessions" and right = "possessions"
-  or
-  wrong = "posion" and right = "poison"
-  or
-  wrong = "positon" and right = "position"
-  or
-  wrong = "positon" and right = "positron"
-  or
-  wrong = "possable" and right = "possible"
-  or
-  wrong = "possably" and right = "possibly"
-  or
-  wrong = "posseses" and right = "possesses"
-  or
-  wrong = "possesing" and right = "possessing"
-  or
-  wrong = "possesion" and right = "possession"
-  or
-  wrong = "possessess" and right = "possesses"
-  or
-  wrong = "possibile" and right = "possible"
-  or
-  wrong = "possibilty" and right = "possibility"
-  or
-  wrong = "possiblility" and right = "possibility"
-  or
-  wrong = "possiblilty" and right = "possibility"
-  or
-  wrong = "possiblities" and right = "possibilities"
-  or
-  wrong = "possiblity" and right = "possibility"
-  or
-  wrong = "possition" and right = "position"
-  or
-  wrong = "postdam" and right = "potsdam"
-  or
-  wrong = "posthomous" and right = "posthumous"
-  or
-  wrong = "postion" and right = "position"
-  or
-  wrong = "postive" and right = "positive"
-  or
-  wrong = "potatos" and right = "potatoes"
-  or
-  wrong = "potrait" and right = "portrait"
-  or
-  wrong = "potrayed" and right = "portrayed"
-  or
-  wrong = "poulations" and right = "populations"
-  or
-  wrong = "poverful" and right = "powerful"
-  or
-  wrong = "poweful" and right = "powerful"
-  or
-  wrong = "powerfull" and right = "powerful"
-  or
-  wrong = "ppublisher" and right = "publisher"
-  or
-  wrong = "practial" and right = "practical"
-  or
-  wrong = "practially" and right = "practically"
-  or
-  wrong = "practicaly" and right = "practically"
-  or
-  wrong = "practicioner" and right = "practitioner"
-  or
-  wrong = "practicioners" and right = "practitioners"
-  or
-  wrong = "practicly" and right = "practically"
-  or
-  wrong = "practioner" and right = "practitioner"
-  or
-  wrong = "practioners" and right = "practitioners"
-  or
-  wrong = "prairy" and right = "prairie"
-  or
-  wrong = "prarie" and right = "prairie"
-  or
-  wrong = "praries" and right = "prairies"
-  or
-  wrong = "pratice" and right = "practice"
-  or
-  wrong = "preample" and right = "preamble"
-  or
-  wrong = "precedessor" and right = "predecessor"
-  or
-  wrong = "preceed" and right = "precede"
-  or
-  wrong = "preceeded" and right = "preceded"
-  or
-  wrong = "preceeding" and right = "preceding"
-  or
-  wrong = "preceeds" and right = "precedes"
-  or
-  wrong = "precendence" and right = "precedence"
-  or
-  wrong = "precentage" and right = "percentage"
-  or
-  wrong = "precice" and right = "precise"
-  or
-  wrong = "precisly" and right = "precisely"
-  or
-  wrong = "precurser" and right = "precursor"
-  or
-  wrong = "predecesors" and right = "predecessors"
-  or
-  wrong = "predicatble" and right = "predictable"
-  or
-  wrong = "predicitons" and right = "predictions"
-  or
-  wrong = "predomiantly" and right = "predominately"
-  or
-  wrong = "prefered" and right = "preferred"
-  or
-  wrong = "prefering" and right = "preferring"
-  or
-  wrong = "preferrably" and right = "preferably"
-  or
-  wrong = "pregancies" and right = "pregnancies"
-  or
-  wrong = "preiod" and right = "period"
-  or
-  wrong = "preliferation" and right = "proliferation"
-  or
-  wrong = "premeire" and right = "premiere"
-  or
-  wrong = "premeired" and right = "premiered"
-  or
-  wrong = "premillenial" and right = "premillennial"
-  or
-  wrong = "preminence" and right = "preeminence"
-  or
-  wrong = "premission" and right = "permission"
-  or
-  wrong = "premonasterians" and right = "premonstratensians"
-  or
-  wrong = "preocupation" and right = "preoccupation"
-  or
-  wrong = "prepair" and right = "prepare"
-  or
-  wrong = "prepartion" and right = "preparation"
-  or
-  wrong = "prepatory" and right = "preparatory"
-  or
-  wrong = "preperation" and right = "preparation"
-  or
-  wrong = "preperations" and right = "preparations"
-  or
-  wrong = "preriod" and right = "period"
-  or
-  wrong = "presedential" and right = "presidential"
-  or
-  wrong = "presense" and right = "presence"
-  or
-  wrong = "presidenital" and right = "presidential"
-  or
-  wrong = "presidental" and right = "presidential"
-  or
-  wrong = "presitgious" and right = "prestigious"
-  or
-  wrong = "prespective" and right = "perspective"
-  or
-  wrong = "prestigeous" and right = "prestigious"
-  or
-  wrong = "prestigous" and right = "prestigious"
-  or
-  wrong = "presumabely" and right = "presumably"
-  or
-  wrong = "presumibly" and right = "presumably"
-  or
-  wrong = "pretection" and right = "protection"
-  or
-  wrong = "prevelant" and right = "prevalent"
-  or
-  wrong = "preverse" and right = "perverse"
-  or
-  wrong = "previvous" and right = "previous"
-  or
-  wrong = "pricipal" and right = "principal"
-  or
-  wrong = "priciple" and right = "principle"
-  or
-  wrong = "priestood" and right = "priesthood"
-  or
-  wrong = "primarly" and right = "primarily"
-  or
-  wrong = "primative" and right = "primitive"
-  or
-  wrong = "primatively" and right = "primitively"
-  or
-  wrong = "primatives" and right = "primitives"
-  or
-  wrong = "primordal" and right = "primordial"
-  or
-  wrong = "principaly" and right = "principality"
-  or
-  wrong = "principial" and right = "principal"
-  or
-  wrong = "principlaity" and right = "principality"
-  or
-  wrong = "principly" and right = "principally"
-  or
-  wrong = "prinicipal" and right = "principal"
-  or
-  wrong = "privalege" and right = "privilege"
-  or
-  wrong = "privaleges" and right = "privileges"
-  or
-  wrong = "priveledges" and right = "privileges"
-  or
-  wrong = "privelege" and right = "privilege"
-  or
-  wrong = "priveleged" and right = "privileged"
-  or
-  wrong = "priveleges" and right = "privileges"
-  or
-  wrong = "privelige" and right = "privilege"
-  or
-  wrong = "priveliged" and right = "privileged"
-  or
-  wrong = "priveliges" and right = "privileges"
-  or
-  wrong = "privelleges" and right = "privileges"
-  or
-  wrong = "privilage" and right = "privilege"
-  or
-  wrong = "priviledge" and right = "privilege"
-  or
-  wrong = "priviledges" and right = "privileges"
-  or
-  wrong = "privledge" and right = "privilege"
-  or
-  wrong = "privte" and right = "private"
-  or
-  wrong = "probabilaty" and right = "probability"
-  or
-  wrong = "probablistic" and right = "probabilistic"
-  or
-  wrong = "probablly" and right = "probably"
-  or
-  wrong = "probalibity" and right = "probability"
-  or
-  wrong = "probaly" and right = "probably"
-  or
-  wrong = "probelm" and right = "problem"
-  or
-  wrong = "proccess" and right = "process"
-  or
-  wrong = "proccessing" and right = "processing"
-  or
-  wrong = "procede" and right = "precede"
-  or
-  wrong = "procede" and right = "proceed"
-  or
-  wrong = "proceded" and right = "preceded"
-  or
-  wrong = "proceded" and right = "proceeded"
-  or
-  wrong = "procedes" and right = "precedes"
-  or
-  wrong = "procedes" and right = "proceeds"
-  or
-  wrong = "procedger" and right = "procedure"
-  or
-  wrong = "proceding" and right = "preceding"
-  or
-  wrong = "proceding" and right = "proceeding"
-  or
-  wrong = "procedings" and right = "proceedings"
-  or
-  wrong = "proceedure" and right = "procedure"
-  or
-  wrong = "proces" and right = "process"
-  or
-  wrong = "procesed" and right = "processed"
-  or
-  wrong = "processer" and right = "processor"
-  or
-  wrong = "proclaimation" and right = "proclamation"
-  or
-  wrong = "proclamed" and right = "proclaimed"
-  or
-  wrong = "proclaming" and right = "proclaiming"
-  or
-  wrong = "proclomation" and right = "proclamation"
-  or
-  wrong = "profesion" and right = "profession"
-  or
-  wrong = "profesion" and right = "profusion"
-  or
-  wrong = "profesor" and right = "professor"
-  or
-  wrong = "professer" and right = "professor"
-  or
-  wrong = "proffesed" and right = "professed"
-  or
-  wrong = "proffesion" and right = "profession"
-  or
-  wrong = "proffesional" and right = "professional"
-  or
-  wrong = "proffesor" and right = "professor"
-  or
-  wrong = "profilic" and right = "prolific"
-  or
-  wrong = "progessed" and right = "progressed"
-  or
-  wrong = "progidy" and right = "prodigy"
-  or
-  wrong = "programable" and right = "programmable"
-  or
-  wrong = "progrom" and right = "pogrom"
-  or
-  wrong = "progrom" and right = "program"
-  or
-  wrong = "progroms" and right = "pogroms"
-  or
-  wrong = "progroms" and right = "programs"
-  or
-  wrong = "prohabition" and right = "prohibition"
-  or
-  wrong = "prologomena" and right = "prolegomena"
-  or
-  wrong = "prominance" and right = "prominence"
-  or
-  wrong = "prominant" and right = "prominent"
-  or
-  wrong = "prominantly" and right = "prominently"
-  or
-  wrong = "prominately" and right = "predominately"
-  or
-  wrong = "prominately" and right = "prominently"
-  or
-  wrong = "promiscous" and right = "promiscuous"
-  or
-  wrong = "promotted" and right = "promoted"
-  or
-  wrong = "pronomial" and right = "pronominal"
-  or
-  wrong = "pronouced" and right = "pronounced"
-  or
-  wrong = "pronounched" and right = "pronounced"
-  or
-  wrong = "pronounciation" and right = "pronunciation"
-  or
-  wrong = "proove" and right = "prove"
-  or
-  wrong = "prooved" and right = "proved"
-  or
-  wrong = "prophacy" and right = "prophecy"
-  or
-  wrong = "propietary" and right = "proprietary"
-  or
-  wrong = "propmted" and right = "prompted"
-  or
-  wrong = "propoganda" and right = "propaganda"
-  or
-  wrong = "propogate" and right = "propagate"
-  or
-  wrong = "propogates" and right = "propagates"
-  or
-  wrong = "propogation" and right = "propagation"
-  or
-  wrong = "propostion" and right = "proposition"
-  or
-  wrong = "propotions" and right = "proportions"
-  or
-  wrong = "propper" and right = "proper"
-  or
-  wrong = "propperly" and right = "properly"
-  or
-  wrong = "proprietory" and right = "proprietary"
-  or
-  wrong = "proseletyzing" and right = "proselytizing"
-  or
-  wrong = "protaganist" and right = "protagonist"
-  or
-  wrong = "protaganists" and right = "protagonists"
-  or
-  wrong = "protocal" and right = "protocol"
-  or
-  wrong = "protoganist" and right = "protagonist"
-  or
-  wrong = "prototpe" and right = "prototype"
-  or
-  wrong = "protoype" and right = "prototype"
-  or
-  wrong = "protrayed" and right = "portrayed"
-  or
-  wrong = "protruberance" and right = "protuberance"
-  or
-  wrong = "protruberances" and right = "protuberances"
-  or
-  wrong = "prouncements" and right = "pronouncements"
-  or
-  wrong = "provacative" and right = "provocative"
-  or
-  wrong = "provded" and right = "provided"
-  or
-  wrong = "provicial" and right = "provincial"
-  or
-  wrong = "provinicial" and right = "provincial"
-  or
-  wrong = "provisiosn" and right = "provision"
-  or
-  wrong = "provisonal" and right = "provisional"
-  or
-  wrong = "proximty" and right = "proximity"
-  or
-  wrong = "pseudononymous" and right = "pseudonymous"
-  or
-  wrong = "pseudonyn" and right = "pseudonym"
-  or
-  wrong = "psuedo" and right = "pseudo"
-  or
-  wrong = "psycology" and right = "psychology"
-  or
-  wrong = "psyhic" and right = "psychic"
-  or
-  wrong = "pubilsher" and right = "publisher"
-  or
-  wrong = "pubisher" and right = "publisher"
-  or
-  wrong = "publiaher" and right = "publisher"
-  or
-  wrong = "publically" and right = "publicly"
-  or
-  wrong = "publicaly" and right = "publicly"
-  or
-  wrong = "publicher" and right = "publisher"
-  or
-  wrong = "publihser" and right = "publisher"
-  or
-  wrong = "publisehr" and right = "publisher"
-  or
-  wrong = "publiser" and right = "publisher"
-  or
-  wrong = "publisger" and right = "publisher"
-  or
-  wrong = "publisheed" and right = "published"
-  or
-  wrong = "publisherr" and right = "publisher"
-  or
-  wrong = "publishher" and right = "publisher"
-  or
-  wrong = "publishor" and right = "publisher"
-  or
-  wrong = "publishre" and right = "publisher"
-  or
-  wrong = "publissher" and right = "publisher"
-  or
-  wrong = "publlisher" and right = "publisher"
-  or
-  wrong = "publsiher" and right = "publisher"
-  or
-  wrong = "publusher" and right = "publisher"
-  or
-  wrong = "puchasing" and right = "purchasing"
-  or
-  wrong = "pucini" and right = "puccini"
-  or
-  wrong = "pulisher" and right = "publisher"
-  or
-  wrong = "pumkin" and right = "pumpkin"
-  or
-  wrong = "puplisher" and right = "publisher"
-  or
-  wrong = "puritannical" and right = "puritanical"
-  or
-  wrong = "purposedly" and right = "purposely"
-  or
-  wrong = "purpotedly" and right = "purportedly"
-  or
-  wrong = "pursuade" and right = "persuade"
-  or
-  wrong = "pursuaded" and right = "persuaded"
-  or
-  wrong = "pursuades" and right = "persuades"
-  or
-  wrong = "pususading" and right = "persuading"
-  or
-  wrong = "puting" and right = "putting"
-  or
-  wrong = "pwoer" and right = "power"
-  or
-  wrong = "pyscic" and right = "psychic"
-  or
-  wrong = "qtuie" and right = "quiet"
-  or
-  wrong = "qtuie" and right = "quite"
-  or
-  wrong = "quantaty" and right = "quantity"
-  or
-  wrong = "quantitiy" and right = "quantity"
-  or
-  wrong = "quarantaine" and right = "quarantine"
-  or
-  wrong = "queenland" and right = "queensland"
-  or
-  wrong = "questonable" and right = "questionable"
-  or
-  wrong = "quicklyu" and right = "quickly"
-  or
-  wrong = "quinessential" and right = "quintessential"
-  or
-  wrong = "quitted" and right = "quit"
-  or
-  wrong = "quizes" and right = "quizzes"
-  or
-  wrong = "qutie" and right = "quiet"
-  or
-  wrong = "qutie" and right = "quite"
-  or
-  wrong = "rabinnical" and right = "rabbinical"
-  or
-  wrong = "racaus" and right = "raucous"
-  or
-  wrong = "radiactive" and right = "radioactive"
-  or
-  wrong = "radify" and right = "ratify"
-  or
-  wrong = "raelly" and right = "really"
-  or
-  wrong = "rarified" and right = "rarefied"
-  or
-  wrong = "reaccurring" and right = "recurring"
-  or
-  wrong = "reacing" and right = "reaching"
-  or
-  wrong = "reacll" and right = "recall"
-  or
-  wrong = "readmition" and right = "readmission"
-  or
-  wrong = "realitvely" and right = "relatively"
-  or
-  wrong = "realsitic" and right = "realistic"
-  or
-  wrong = "realtions" and right = "relations"
-  or
-  wrong = "realy" and right = "really"
-  or
-  wrong = "realyl" and right = "really"
-  or
-  wrong = "reasearch" and right = "research"
-  or
-  wrong = "rebiulding" and right = "rebuilding"
-  or
-  wrong = "rebllions" and right = "rebellions"
-  or
-  wrong = "rebounce" and right = "rebound"
-  or
-  wrong = "reccomend" and right = "recommend"
-  or
-  wrong = "reccomendations" and right = "recommendations"
-  or
-  wrong = "reccomended" and right = "recommended"
-  or
-  wrong = "reccomending" and right = "recommending"
-  or
-  wrong = "reccommend" and right = "recommend"
-  or
-  wrong = "reccommended" and right = "recommended"
-  or
-  wrong = "reccommending" and right = "recommending"
-  or
-  wrong = "reccuring" and right = "recurring"
-  or
-  wrong = "receeded" and right = "receded"
-  or
-  wrong = "receeding" and right = "receding"
-  or
-  wrong = "recepient" and right = "recipient"
-  or
-  wrong = "recepients" and right = "recipients"
-  or
-  wrong = "receving" and right = "receiving"
-  or
-  wrong = "rechargable" and right = "rechargeable"
-  or
-  wrong = "reched" and right = "reached"
-  or
-  wrong = "recide" and right = "reside"
-  or
-  wrong = "recided" and right = "resided"
-  or
-  wrong = "recident" and right = "resident"
-  or
-  wrong = "recidents" and right = "residents"
-  or
-  wrong = "reciding" and right = "residing"
-  or
-  wrong = "reciepents" and right = "recipients"
-  or
-  wrong = "reciept" and right = "receipt"
-  or
-  wrong = "recieve" and right = "receive"
-  or
-  wrong = "recieved" and right = "received"
-  or
-  wrong = "reciever" and right = "receiver"
-  or
-  wrong = "recievers" and right = "receivers"
-  or
-  wrong = "recieves" and right = "receives"
-  or
-  wrong = "recieving" and right = "receiving"
-  or
-  wrong = "recipiant" and right = "recipient"
-  or
-  wrong = "recipiants" and right = "recipients"
-  or
-  wrong = "recived" and right = "received"
-  or
-  wrong = "recivership" and right = "receivership"
-  or
-  wrong = "recogise" and right = "recognise"
-  or
-  wrong = "recogize" and right = "recognize"
-  or
-  wrong = "recomend" and right = "recommend"
-  or
-  wrong = "recomended" and right = "recommended"
-  or
-  wrong = "recomending" and right = "recommending"
-  or
-  wrong = "recomends" and right = "recommends"
-  or
-  wrong = "recommedations" and right = "recommendations"
-  or
-  wrong = "recompence" and right = "recompense"
-  or
-  wrong = "reconaissance" and right = "reconnaissance"
-  or
-  wrong = "reconcilation" and right = "reconciliation"
-  or
-  wrong = "reconized" and right = "recognized"
-  or
-  wrong = "reconnaisance" and right = "reconnaissance"
-  or
-  wrong = "reconnaissence" and right = "reconnaissance"
-  or
-  wrong = "recontructed" and right = "reconstructed"
-  or
-  wrong = "recquired" and right = "required"
-  or
-  wrong = "recrational" and right = "recreational"
-  or
-  wrong = "recrod" and right = "record"
-  or
-  wrong = "recuiting" and right = "recruiting"
-  or
-  wrong = "recuring" and right = "recurring"
-  or
-  wrong = "recurrance" and right = "recurrence"
-  or
-  wrong = "rediculous" and right = "ridiculous"
-  or
-  wrong = "reedeming" and right = "redeeming"
-  or
-  wrong = "reenforced" and right = "reinforced"
-  or
-  wrong = "refect" and right = "reflect"
-  or
-  wrong = "refedendum" and right = "referendum"
-  or
-  wrong = "referal" and right = "referral"
-  or
-  wrong = "referece" and right = "reference"
-  or
-  wrong = "refereces" and right = "references"
-  or
-  wrong = "refered" and right = "referred"
-  or
-  wrong = "referemce" and right = "reference"
-  or
-  wrong = "referemces" and right = "references"
-  or
-  wrong = "referencs" and right = "references"
-  or
-  wrong = "referenece" and right = "reference"
-  or
-  wrong = "refereneced" and right = "referenced"
-  or
-  wrong = "refereneces" and right = "references"
-  or
-  wrong = "referiang" and right = "referring"
-  or
-  wrong = "refering" and right = "referring"
-  or
-  wrong = "refernce" and right = "reference"
-  or
-  wrong = "refernce" and right = "references"
-  or
-  wrong = "refernces" and right = "references"
-  or
-  wrong = "referrence" and right = "reference"
-  or
-  wrong = "referrences" and right = "references"
-  or
-  wrong = "referrs" and right = "refers"
-  or
-  wrong = "reffered" and right = "referred"
-  or
-  wrong = "refference" and right = "reference"
-  or
-  wrong = "reffering" and right = "referring"
-  or
-  wrong = "refrence" and right = "reference"
-  or
-  wrong = "refrences" and right = "references"
-  or
-  wrong = "refrers" and right = "refers"
-  or
-  wrong = "refridgeration" and right = "refrigeration"
-  or
-  wrong = "refridgerator" and right = "refrigerator"
-  or
-  wrong = "refromist" and right = "reformist"
-  or
-  wrong = "refusla" and right = "refusal"
-  or
-  wrong = "regardes" and right = "regards"
-  or
-  wrong = "regluar" and right = "regular"
-  or
-  wrong = "reguarly" and right = "regularly"
-  or
-  wrong = "regulaion" and right = "regulation"
-  or
-  wrong = "regulaotrs" and right = "regulators"
-  or
-  wrong = "regularily" and right = "regularly"
-  or
-  wrong = "rehersal" and right = "rehearsal"
-  or
-  wrong = "reicarnation" and right = "reincarnation"
-  or
-  wrong = "reigining" and right = "reigning"
-  or
-  wrong = "reknown" and right = "renown"
-  or
-  wrong = "reknowned" and right = "renowned"
-  or
-  wrong = "rela" and right = "real"
-  or
-  wrong = "relaly" and right = "really"
-  or
-  wrong = "relatiopnship" and right = "relationship"
-  or
-  wrong = "relativly" and right = "relatively"
-  or
-  wrong = "relected" and right = "reelected"
-  or
-  wrong = "releive" and right = "relieve"
-  or
-  wrong = "releived" and right = "relieved"
-  or
-  wrong = "releiver" and right = "reliever"
-  or
-  wrong = "releses" and right = "releases"
-  or
-  wrong = "relevence" and right = "relevance"
-  or
-  wrong = "relevent" and right = "relevant"
-  or
-  wrong = "reliablity" and right = "reliability"
-  or
-  wrong = "relient" and right = "reliant"
-  or
-  wrong = "religeous" and right = "religious"
-  or
-  wrong = "religous" and right = "religious"
-  or
-  wrong = "religously" and right = "religiously"
-  or
-  wrong = "relinqushment" and right = "relinquishment"
-  or
-  wrong = "relitavely" and right = "relatively"
-  or
-  wrong = "relized" and right = "realised"
-  or
-  wrong = "relized" and right = "realized"
-  or
-  wrong = "relpacement" and right = "replacement"
-  or
-  wrong = "remaing" and right = "remaining"
-  or
-  wrong = "remeber" and right = "remember"
-  or
-  wrong = "rememberable" and right = "memorable"
-  or
-  wrong = "rememberance" and right = "remembrance"
-  or
-  wrong = "remembrence" and right = "remembrance"
-  or
-  wrong = "remenant" and right = "remnant"
-  or
-  wrong = "remenicent" and right = "reminiscent"
-  or
-  wrong = "reminent" and right = "remnant"
-  or
-  wrong = "reminescent" and right = "reminiscent"
-  or
-  wrong = "reminscent" and right = "reminiscent"
-  or
-  wrong = "reminsicent" and right = "reminiscent"
-  or
-  wrong = "rendevous" and right = "rendezvous"
-  or
-  wrong = "rendezous" and right = "rendezvous"
-  or
-  wrong = "renedered" and right = "rende"
-  or
-  wrong = "renewl" and right = "renewal"
-  or
-  wrong = "rennovate" and right = "renovate"
-  or
-  wrong = "rennovated" and right = "renovated"
-  or
-  wrong = "rennovating" and right = "renovating"
-  or
-  wrong = "rennovation" and right = "renovation"
-  or
-  wrong = "rentors" and right = "renters"
-  or
-  wrong = "reoccurrence" and right = "recurrence"
-  or
-  wrong = "reorganision" and right = "reorganisation"
-  or
-  wrong = "repatition" and right = "repartition"
-  or
-  wrong = "repatition" and right = "repetition"
-  or
-  wrong = "repblic" and right = "republic"
-  or
-  wrong = "repblican" and right = "republican"
-  or
-  wrong = "repblicans" and right = "republicans"
-  or
-  wrong = "repblics" and right = "republics"
-  or
-  wrong = "repectively" and right = "respectively"
-  or
-  wrong = "repeition" and right = "repetition"
-  or
-  wrong = "repentence" and right = "repentance"
-  or
-  wrong = "repentent" and right = "repentant"
-  or
-  wrong = "repeteadly" and right = "repeatedly"
-  or
-  wrong = "repetion" and right = "repetition"
-  or
-  wrong = "repid" and right = "rapid"
-  or
-  wrong = "reponse" and right = "response"
-  or
-  wrong = "reponsible" and right = "responsible"
-  or
-  wrong = "reportadly" and right = "reportedly"
-  or
-  wrong = "represantative" and right = "representative"
-  or
-  wrong = "representive" and right = "representative"
-  or
-  wrong = "representives" and right = "representatives"
-  or
-  wrong = "reproducable" and right = "reproducible"
-  or
-  wrong = "reprtoire" and right = "repertoire"
-  or
-  wrong = "repsectively" and right = "respectively"
-  or
-  wrong = "reptition" and right = "repetition"
-  or
-  wrong = "repubic" and right = "republic"
-  or
-  wrong = "repubican" and right = "republican"
-  or
-  wrong = "repubicans" and right = "republicans"
-  or
-  wrong = "repubics" and right = "republics"
-  or
-  wrong = "republi" and right = "republic"
-  or
-  wrong = "republian" and right = "republican"
-  or
-  wrong = "republians" and right = "republicans"
-  or
-  wrong = "republis" and right = "republics"
-  or
-  wrong = "repulic" and right = "republic"
-  or
-  wrong = "repulican" and right = "republican"
-  or
-  wrong = "repulicans" and right = "republicans"
-  or
-  wrong = "repulics" and right = "republics"
-  or
-  wrong = "requirment" and right = "requirement"
-  or
-  wrong = "requred" and right = "required"
-  or
-  wrong = "resaurant" and right = "restaurant"
-  or
-  wrong = "resembelance" and right = "resemblance"
-  or
-  wrong = "resembes" and right = "resembles"
-  or
-  wrong = "resemblence" and right = "resemblance"
-  or
-  wrong = "resevoir" and right = "reservoir"
-  or
-  wrong = "residental" and right = "residential"
-  or
-  wrong = "resignement" and right = "resignment"
-  or
-  wrong = "resistable" and right = "resistible"
-  or
-  wrong = "resistence" and right = "resistance"
-  or
-  wrong = "resistent" and right = "resistant"
-  or
-  wrong = "respectivly" and right = "respectively"
-  or
-  wrong = "responce" and right = "response"
-  or
-  wrong = "responibilities" and right = "responsibilities"
-  or
-  wrong = "responisble" and right = "responsible"
-  or
-  wrong = "responnsibilty" and right = "responsibility"
-  or
-  wrong = "responsability" and right = "responsibility"
-  or
-  wrong = "responsibile" and right = "responsible"
-  or
-  wrong = "responsibilites" and right = "responsibilities"
-  or
-  wrong = "responsiblities" and right = "responsibilities"
-  or
-  wrong = "responsiblity" and right = "responsibility"
-  or
-  wrong = "ressemblance" and right = "resemblance"
-  or
-  wrong = "ressemble" and right = "resemble"
-  or
-  wrong = "ressembled" and right = "resembled"
-  or
-  wrong = "ressemblence" and right = "resemblance"
-  or
-  wrong = "ressembling" and right = "resembling"
-  or
-  wrong = "resssurecting" and right = "resurrecting"
-  or
-  wrong = "ressurect" and right = "resurrect"
-  or
-  wrong = "ressurected" and right = "resurrected"
-  or
-  wrong = "ressurection" and right = "resurrection"
-  or
-  wrong = "ressurrection" and right = "resurrection"
-  or
-  wrong = "restarant" and right = "restaurant"
-  or
-  wrong = "restarants" and right = "restaurants"
-  or
-  wrong = "restaraunt" and right = "restaurant"
-  or
-  wrong = "restaraunteur" and right = "restaurateur"
-  or
-  wrong = "restaraunteurs" and right = "restaurateurs"
-  or
-  wrong = "restaraunts" and right = "restaurants"
-  or
-  wrong = "restauranteurs" and right = "restaurateurs"
-  or
-  wrong = "restauration" and right = "restoration"
-  or
-  wrong = "restauraunt" and right = "restaurant"
-  or
-  wrong = "resteraunt" and right = "restaurant"
-  or
-  wrong = "resteraunts" and right = "restaurants"
-  or
-  wrong = "resticted" and right = "restricted"
-  or
-  wrong = "restraunt" and right = "restaurant"
-  or
-  wrong = "restraunt" and right = "restraint"
-  or
-  wrong = "resturant" and right = "restaurant"
-  or
-  wrong = "resturants" and right = "restaurants"
-  or
-  wrong = "resturaunt" and right = "restaurant"
-  or
-  wrong = "resturaunts" and right = "restaurants"
-  or
-  wrong = "resurecting" and right = "resurrecting"
-  or
-  wrong = "retalitated" and right = "retaliated"
-  or
-  wrong = "retalitation" and right = "retaliation"
-  or
-  wrong = "retreive" and right = "retrieve"
-  or
-  wrong = "retrive" and right = "retrieve"
-  or
-  wrong = "returnd" and right = "returned"
-  or
-  wrong = "revaluated" and right = "reevaluated"
-  or
-  wrong = "reveiw" and right = "review"
-  or
-  wrong = "reveral" and right = "reversal"
-  or
-  wrong = "reversable" and right = "reversible"
-  or
-  wrong = "revolutionar" and right = "revolutionary"
-  or
-  wrong = "rewitten" and right = "rewritten"
-  or
-  wrong = "rewriet" and right = "rewrite"
-  or
-  wrong = "rference" and right = "reference"
-  or
-  wrong = "rferences" and right = "references"
-  or
-  wrong = "rhymme" and right = "rhyme"
-  or
-  wrong = "rhythem" and right = "rhythm"
-  or
-  wrong = "rhythim" and right = "rhythm"
-  or
-  wrong = "rhytmic" and right = "rhythmic"
-  or
-  wrong = "rigeur" and right = "rigor"
-  or
-  wrong = "rigeur" and right = "rigour"
-  or
-  wrong = "rigeur" and right = "rigueur"
-  or
-  wrong = "rigourous" and right = "rigorous"
-  or
-  wrong = "rininging" and right = "ringing"
-  or
-  wrong = "rised" and right = "raised"
-  or
-  wrong = "rised" and right = "rose"
-  or
-  wrong = "rockerfeller" and right = "rockefeller"
-  or
-  wrong = "rococco" and right = "rococo"
-  or
-  wrong = "rocord" and right = "record"
-  or
-  wrong = "roomate" and right = "roommate"
-  or
-  wrong = "rougly" and right = "roughly"
-  or
-  wrong = "rucuperate" and right = "recuperate"
-  or
-  wrong = "rudimentatry" and right = "rudimentary"
-  or
-  wrong = "rulle" and right = "rule"
-  or
-  wrong = "runing" and right = "running"
-  or
-  wrong = "runnung" and right = "running"
-  or
-  wrong = "russina" and right = "russian"
-  or
-  wrong = "russion" and right = "russian"
-  or
-  wrong = "rwite" and right = "write"
-  or
-  wrong = "rythem" and right = "rhythm"
-  or
-  wrong = "rythim" and right = "rhythm"
-  or
-  wrong = "rythm" and right = "rhythm"
-  or
-  wrong = "rythmic" and right = "rhythmic"
-  or
-  wrong = "rythyms" and right = "rhythms"
-  or
-  wrong = "sacrafice" and right = "sacrifice"
-  or
-  wrong = "sacreligious" and right = "sacrilegious"
-  or
-  wrong = "sacremento" and right = "sacramento"
-  or
-  wrong = "sacrifical" and right = "sacrificial"
-  or
-  wrong = "saftey" and right = "safety"
-  or
-  wrong = "safty" and right = "safety"
-  or
-  wrong = "salery" and right = "salary"
-  or
-  wrong = "sanctionning" and right = "sanctioning"
-  or
-  wrong = "sandwhich" and right = "sandwich"
-  or
-  wrong = "sanhedrim" and right = "sanhedrin"
-  or
-  wrong = "santioned" and right = "sanctioned"
-  or
-  wrong = "sargant" and right = "sergeant"
-  or
-  wrong = "sargeant" and right = "sergeant"
-  or
-  wrong = "sasy" and right = "sassy"
-  or
-  wrong = "sasy" and right = "says"
-  or
-  wrong = "satelite" and right = "satellite"
-  or
-  wrong = "satelites" and right = "satellites"
-  or
-  wrong = "saterday" and right = "saturday"
-  or
-  wrong = "saterdays" and right = "saturdays"
-  or
-  wrong = "satisfactority" and right = "satisfactorily"
-  or
-  wrong = "satric" and right = "satiric"
-  or
-  wrong = "satrical" and right = "satirical"
-  or
-  wrong = "satrically" and right = "satirically"
-  or
-  wrong = "sattelite" and right = "satellite"
-  or
-  wrong = "sattelites" and right = "satellites"
-  or
-  wrong = "saught" and right = "sought"
-  or
-  wrong = "saveing" and right = "saving"
-  or
-  wrong = "saxaphone" and right = "saxophone"
-  or
-  wrong = "scaleable" and right = "scalable"
-  or
-  wrong = "scandanavia" and right = "scandinavia"
-  or
-  wrong = "scaricity" and right = "scarcity"
-  or
-  wrong = "scavanged" and right = "scavenged"
-  or
-  wrong = "schedual" and right = "schedule"
-  or
-  wrong = "scholarhip" and right = "scholarship"
-  or
-  wrong = "scholarstic" and right = "scholarly"
-  or
-  wrong = "scholarstic" and right = "scholastic"
-  or
-  wrong = "scientfic" and right = "scientific"
-  or
-  wrong = "scientifc" and right = "scientific"
-  or
-  wrong = "scientis" and right = "scientist"
-  or
-  wrong = "scince" and right = "science"
-  or
-  wrong = "scinece" and right = "science"
-  or
-  wrong = "scirpt" and right = "script"
-  or
-  wrong = "scoll" and right = "scroll"
-  or
-  wrong = "screenwrighter" and right = "screenwriter"
-  or
-  wrong = "scrutinity" and right = "scrutiny"
-  or
-  wrong = "scuptures" and right = "sculptures"
-  or
-  wrong = "seach" and right = "search"
-  or
-  wrong = "seached" and right = "searched"
-  or
-  wrong = "seaches" and right = "searches"
-  or
-  wrong = "secceeded" and right = "seceded"
-  or
-  wrong = "secceeded" and right = "succeeded"
-  or
-  wrong = "seceed" and right = "secede"
-  or
-  wrong = "seceed" and right = "succeed"
-  or
-  wrong = "seceeded" and right = "seceded"
-  or
-  wrong = "seceeded" and right = "succeeded"
-  or
-  wrong = "secratary" and right = "secretary"
-  or
-  wrong = "secretery" and right = "secretary"
-  or
-  wrong = "sedereal" and right = "sidereal"
-  or
-  wrong = "seeked" and right = "sought"
-  or
-  wrong = "segementation" and right = "segmentation"
-  or
-  wrong = "seguoys" and right = "segues"
-  or
-  wrong = "seige" and right = "siege"
-  or
-  wrong = "seing" and right = "seeing"
-  or
-  wrong = "seinor" and right = "senior"
-  or
-  wrong = "seldomly" and right = "seldom"
-  or
-  wrong = "senarios" and right = "scenarios"
-  or
-  wrong = "sence" and right = "sense"
-  or
-  wrong = "sence" and right = "since"
-  or
-  wrong = "senstive" and right = "sensitive"
-  or
-  wrong = "sensure" and right = "censure"
-  or
-  wrong = "seperate" and right = "separate"
-  or
-  wrong = "seperated" and right = "separated"
-  or
-  wrong = "seperately" and right = "separately"
-  or
-  wrong = "seperates" and right = "separates"
-  or
-  wrong = "seperating" and right = "separating"
-  or
-  wrong = "seperation" and right = "separation"
-  or
-  wrong = "seperatism" and right = "separatism"
-  or
-  wrong = "seperatist" and right = "separatist"
-  or
-  wrong = "seperator" and right = "separator"
-  or
-  wrong = "sepina" and right = "subpoena"
-  or
-  wrong = "sepulchure" and right = "sepulcher"
-  or
-  wrong = "sepulchure" and right = "sepulchre"
-  or
-  wrong = "sepulcre" and right = "sepulcher"
-  or
-  wrong = "sepulcre" and right = "sepulchre"
-  or
-  wrong = "sergent" and right = "sergeant"
-  or
-  wrong = "settelement" and right = "settlement"
-  or
-  wrong = "settlment" and right = "settlement"
-  or
-  wrong = "settting" and right = "setting"
-  or
-  wrong = "severeal" and right = "several"
-  or
-  wrong = "severley" and right = "severely"
-  or
-  wrong = "severly" and right = "severely"
-  or
-  wrong = "sevice" and right = "service"
-  or
-  wrong = "shadasloo" and right = "shadaloo"
-  or
-  wrong = "shaddow" and right = "shadow"
-  or
-  wrong = "shadoloo" and right = "shadaloo"
-  or
-  wrong = "shamen" and right = "shaman"
-  or
-  wrong = "shamen" and right = "shamans"
-  or
-  wrong = "sheat" and right = "cheat"
-  or
-  wrong = "sheat" and right = "sheath"
-  or
-  wrong = "sheat" and right = "sheet"
-  or
-  wrong = "sheild" and right = "shield"
-  or
-  wrong = "sherif" and right = "sheriff"
-  or
-  wrong = "shineing" and right = "shining"
-  or
-  wrong = "shiped" and right = "shipped"
-  or
-  wrong = "shiping" and right = "shipping"
-  or
-  wrong = "shopkeeepers" and right = "shopkeepers"
-  or
-  wrong = "shorly" and right = "shortly"
-  or
-  wrong = "shoudl" and right = "should"
-  or
-  wrong = "shoudln" and right = "should"
-  or
-  wrong = "shreak" and right = "shriek"
-  or
-  wrong = "shrinked" and right = "shrunk"
-  or
-  wrong = "sicne" and right = "since"
-  or
-  wrong = "sideral" and right = "sidereal"
-  or
-  wrong = "sieze" and right = "seize"
-  or
-  wrong = "sieze" and right = "size"
-  or
-  wrong = "siezed" and right = "seized"
-  or
-  wrong = "siezed" and right = "sized"
-  or
-  wrong = "siezing" and right = "seizing"
-  or
-  wrong = "siezing" and right = "sizing"
-  or
-  wrong = "siezure" and right = "seizure"
-  or
-  wrong = "siezures" and right = "seizures"
-  or
-  wrong = "siginificant" and right = "significant"
-  or
-  wrong = "signficant" and right = "significant"
-  or
-  wrong = "signficiant" and right = "significant"
-  or
-  wrong = "signfies" and right = "signifies"
-  or
-  wrong = "signifantly" and right = "significantly"
-  or
-  wrong = "significently" and right = "significantly"
-  or
-  wrong = "signifigant" and right = "significant"
-  or
-  wrong = "signifigantly" and right = "significantly"
-  or
-  wrong = "signitories" and right = "signatories"
-  or
-  wrong = "signitory" and right = "signatory"
-  or
-  wrong = "similarily" and right = "similarly"
-  or
-  wrong = "similiar" and right = "similar"
-  or
-  wrong = "similiarity" and right = "similarity"
-  or
-  wrong = "similiarly" and right = "similarly"
-  or
-  wrong = "simmilar" and right = "similar"
-  or
-  wrong = "simpley" and right = "simply"
-  or
-  wrong = "simplier" and right = "simpler"
-  or
-  wrong = "simultanous" and right = "simultaneous"
-  or
-  wrong = "simultanously" and right = "simultaneously"
-  or
-  wrong = "sincerley" and right = "sincerely"
-  or
-  wrong = "singsog" and right = "singsong"
-  or
-  wrong = "sinse" and right = "since"
-  or
-  wrong = "sinse" and right = "sines"
-  or
-  wrong = "sionist" and right = "zionist"
-  or
-  wrong = "sionists" and right = "zionists"
-  or
-  wrong = "sixtin" and right = "sistine"
-  or
-  wrong = "skagerak" and right = "skagerrak"
-  or
-  wrong = "skateing" and right = "skating"
-  or
-  wrong = "slaugterhouses" and right = "slaughterhouses"
-  or
-  wrong = "slighly" and right = "slightly"
-  or
-  wrong = "slippy" and right = "slippery"
-  or
-  wrong = "slowy" and right = "slowly"
-  or
-  wrong = "smae" and right = "same"
-  or
-  wrong = "smealting" and right = "smelting"
-  or
-  wrong = "smoe" and right = "some"
-  or
-  wrong = "sneeks" and right = "sneaks"
-  or
-  wrong = "snese" and right = "sneeze"
-  or
-  wrong = "socalism" and right = "socialism"
-  or
-  wrong = "socities" and right = "societies"
-  or
-  wrong = "soem" and right = "some"
-  or
-  wrong = "sofware" and right = "software"
-  or
-  wrong = "sohw" and right = "show"
-  or
-  wrong = "soilders" and right = "soldiers"
-  or
-  wrong = "solatary" and right = "solitary"
-  or
-  wrong = "soley" and right = "solely"
-  or
-  wrong = "soliders" and right = "soldiers"
-  or
-  wrong = "soliliquy" and right = "soliloquy"
-  or
-  wrong = "soluable" and right = "soluble"
-  or
-  wrong = "somene" and right = "someone"
-  or
-  wrong = "somtimes" and right = "sometimes"
-  or
-  wrong = "somwhere" and right = "somewhere"
-  or
-  wrong = "sophicated" and right = "sophisticated"
-  or
-  wrong = "sophmore" and right = "sophomore"
-  or
-  wrong = "sorceror" and right = "sorcerer"
-  or
-  wrong = "sorrounding" and right = "surrounding"
-  or
-  wrong = "sotry" and right = "story"
-  or
-  wrong = "sotyr" and right = "satyr"
-  or
-  wrong = "sotyr" and right = "story"
-  or
-  wrong = "soudn" and right = "sound"
-  or
-  wrong = "soudns" and right = "sounds"
-  or
-  wrong = "sould" and right = "could"
-  or
-  wrong = "sould" and right = "should"
-  or
-  wrong = "sould" and right = "sold"
-  or
-  wrong = "sould" and right = "soul"
-  or
-  wrong = "sountrack" and right = "soundtrack"
-  or
-  wrong = "sourth" and right = "south"
-  or
-  wrong = "sourthern" and right = "southern"
-  or
-  wrong = "souvenier" and right = "souvenir"
-  or
-  wrong = "souveniers" and right = "souvenirs"
-  or
-  wrong = "soveits" and right = "soviets"
-  or
-  wrong = "sovereignity" and right = "sovereignty"
-  or
-  wrong = "soverign" and right = "sovereign"
-  or
-  wrong = "soverignity" and right = "sovereignty"
-  or
-  wrong = "soverignty" and right = "sovereignty"
-  or
-  wrong = "spainish" and right = "spanish"
-  or
-  wrong = "speach" and right = "speech"
-  or
-  wrong = "specfic" and right = "specific"
-  or
-  wrong = "speciallized" and right = "specialised"
-  or
-  wrong = "speciallized" and right = "specialized"
-  or
-  wrong = "specif" and right = "specific"
-  or
-  wrong = "specif" and right = "specify"
-  or
-  wrong = "specifiying" and right = "specifying"
-  or
-  wrong = "speciman" and right = "specimen"
-  or
-  wrong = "spectauclar" and right = "spectacular"
-  or
-  wrong = "spectaulars" and right = "spectaculars"
-  or
-  wrong = "spects" and right = "aspects"
-  or
-  wrong = "spects" and right = "expects"
-  or
-  wrong = "spectum" and right = "spectrum"
-  or
-  wrong = "speices" and right = "species"
-  or
-  wrong = "spendour" and right = "splendour"
-  or
-  wrong = "spermatozoan" and right = "spermatozoon"
-  or
-  wrong = "spoace" and right = "space"
-  or
-  wrong = "sponser" and right = "sponsor"
-  or
-  wrong = "sponsered" and right = "sponsored"
-  or
-  wrong = "spontanous" and right = "spontaneous"
-  or
-  wrong = "sponzored" and right = "sponsored"
-  or
-  wrong = "spoonfulls" and right = "spoonfuls"
-  or
-  wrong = "sppeches" and right = "speeches"
-  or
-  wrong = "spreaded" and right = "spread"
-  or
-  wrong = "sprech" and right = "speech"
-  or
-  wrong = "spred" and right = "spread"
-  or
-  wrong = "spriritual" and right = "spiritual"
-  or
-  wrong = "spritual" and right = "spiritual"
-  or
-  wrong = "sqaure" and right = "square"
-  or
-  wrong = "sring" and right = "string"
-  or
-  wrong = "stablility" and right = "stability"
-  or
-  wrong = "stainlees" and right = "stainless"
-  or
-  wrong = "staion" and right = "station"
-  or
-  wrong = "standars" and right = "standards"
-  or
-  wrong = "stange" and right = "strange"
-  or
-  wrong = "startegic" and right = "strategic"
-  or
-  wrong = "startegies" and right = "strategies"
-  or
-  wrong = "startegy" and right = "strategy"
-  or
-  wrong = "stateman" and right = "statesman"
-  or
-  wrong = "statememts" and right = "statements"
-  or
-  wrong = "statment" and right = "statement"
-  or
-  wrong = "steriods" and right = "steroids"
-  or
-  wrong = "sterotypes" and right = "stereotypes"
-  or
-  wrong = "stilus" and right = "stylus"
-  or
-  wrong = "stingent" and right = "stringent"
-  or
-  wrong = "stiring" and right = "stirring"
-  or
-  wrong = "stirrs" and right = "stirs"
-  or
-  wrong = "stlye" and right = "style"
-  or
-  wrong = "stomache" and right = "stomach"
-  or
-  wrong = "stong" and right = "strong"
-  or
-  wrong = "stopry" and right = "story"
-  or
-  wrong = "storeis" and right = "stories"
-  or
-  wrong = "storise" and right = "stories"
-  or
-  wrong = "stornegst" and right = "strongest"
-  or
-  wrong = "stoyr" and right = "story"
-  or
-  wrong = "stpo" and right = "stop"
-  or
-  wrong = "stradegies" and right = "strategies"
-  or
-  wrong = "stradegy" and right = "strategy"
-  or
-  wrong = "strat" and right = "start"
-  or
-  wrong = "strat" and right = "strata"
-  or
-  wrong = "stratagically" and right = "strategically"
-  or
-  wrong = "streemlining" and right = "streamlining"
-  or
-  wrong = "stregth" and right = "strength"
-  or
-  wrong = "strenghen" and right = "strengthen"
-  or
-  wrong = "strenghened" and right = "strengthened"
-  or
-  wrong = "strenghening" and right = "strengthening"
-  or
-  wrong = "strenght" and right = "strength"
-  or
-  wrong = "strenghten" and right = "strengthen"
-  or
-  wrong = "strenghtened" and right = "strengthened"
-  or
-  wrong = "strenghtening" and right = "strengthening"
-  or
-  wrong = "strengtened" and right = "strengthened"
-  or
-  wrong = "strenous" and right = "strenuous"
-  or
-  wrong = "strictist" and right = "strictest"
-  or
-  wrong = "strikely" and right = "strikingly"
-  or
-  wrong = "strnad" and right = "strand"
-  or
-  wrong = "stroy" and right = "destroy"
-  or
-  wrong = "stroy" and right = "story"
-  or
-  wrong = "structual" and right = "structural"
-  or
-  wrong = "stubborness" and right = "stubbornness"
-  or
-  wrong = "stucture" and right = "structure"
-  or
-  wrong = "stuctured" and right = "structured"
-  or
-  wrong = "studdy" and right = "study"
-  or
-  wrong = "studing" and right = "studying"
-  or
-  wrong = "stuggling" and right = "struggling"
-  or
-  wrong = "sturcture" and right = "structure"
-  or
-  wrong = "subcatagories" and right = "subcategories"
-  or
-  wrong = "subcatagory" and right = "subcategory"
-  or
-  wrong = "subconsiously" and right = "subconsciously"
-  or
-  wrong = "subjudgation" and right = "subjugation"
-  or
-  wrong = "submachne" and right = "submachine"
-  or
-  wrong = "subpecies" and right = "subspecies"
-  or
-  wrong = "subsidary" and right = "subsidiary"
-  or
-  wrong = "subsiduary" and right = "subsidiary"
-  or
-  wrong = "subsquent" and right = "subsequent"
-  or
-  wrong = "subsquently" and right = "subsequently"
-  or
-  wrong = "substace" and right = "substance"
-  or
-  wrong = "substancial" and right = "substantial"
-  or
-  wrong = "substatial" and right = "substantial"
-  or
-  wrong = "substituded" and right = "substituted"
-  or
-  wrong = "substract" and right = "subtract"
-  or
-  wrong = "substracted" and right = "subtracted"
-  or
-  wrong = "substracting" and right = "subtracting"
-  or
-  wrong = "substraction" and right = "subtraction"
-  or
-  wrong = "substracts" and right = "subtracts"
-  or
-  wrong = "subtances" and right = "substances"
-  or
-  wrong = "subterranian" and right = "subterranean"
-  or
-  wrong = "suburburban" and right = "suburban"
-  or
-  wrong = "succceeded" and right = "succeeded"
-  or
-  wrong = "succcesses" and right = "successes"
-  or
-  wrong = "succedded" and right = "succeeded"
-  or
-  wrong = "succeded" and right = "succeeded"
-  or
-  wrong = "succeds" and right = "succeeds"
-  or
-  wrong = "succesful" and right = "successful"
-  or
-  wrong = "succesfully" and right = "successfully"
-  or
-  wrong = "succesfuly" and right = "successfully"
-  or
-  wrong = "succesion" and right = "succession"
-  or
-  wrong = "succesive" and right = "successive"
-  or
-  wrong = "successfull" and right = "successful"
-  or
-  wrong = "successully" and right = "successfully"
-  or
-  wrong = "succsess" and right = "success"
-  or
-  wrong = "succsessfull" and right = "successful"
-  or
-  wrong = "suceed" and right = "succeed"
-  or
-  wrong = "suceeded" and right = "succeeded"
-  or
-  wrong = "suceeding" and right = "succeeding"
-  or
-  wrong = "suceeds" and right = "succeeds"
-  or
-  wrong = "sucesful" and right = "successful"
-  or
-  wrong = "sucesfully" and right = "successfully"
-  or
-  wrong = "sucesfuly" and right = "successfully"
-  or
-  wrong = "sucesion" and right = "succession"
-  or
-  wrong = "sucess" and right = "success"
-  or
-  wrong = "sucesses" and right = "successes"
-  or
-  wrong = "sucessful" and right = "successful"
-  or
-  wrong = "sucessfull" and right = "successful"
-  or
-  wrong = "sucessfully" and right = "successfully"
-  or
-  wrong = "sucessfuly" and right = "successfully"
-  or
-  wrong = "sucession" and right = "succession"
-  or
-  wrong = "sucessive" and right = "successive"
-  or
-  wrong = "sucessor" and right = "successor"
-  or
-  wrong = "sucessot" and right = "successor"
-  or
-  wrong = "sucide" and right = "suicide"
-  or
-  wrong = "sucidial" and right = "suicidal"
-  or
-  wrong = "sudent" and right = "student"
-  or
-  wrong = "sudents" and right = "students"
-  or
-  wrong = "sufferage" and right = "suffrage"
-  or
-  wrong = "sufferred" and right = "suffered"
-  or
-  wrong = "sufferring" and right = "suffering"
-  or
-  wrong = "sufficent" and right = "sufficient"
-  or
-  wrong = "sufficently" and right = "sufficiently"
-  or
-  wrong = "sumary" and right = "summary"
-  or
-  wrong = "sunglases" and right = "sunglasses"
-  or
-  wrong = "suop" and right = "soup"
-  or
-  wrong = "superceeded" and right = "superseded"
-  or
-  wrong = "superintendant" and right = "superintendent"
-  or
-  wrong = "suphisticated" and right = "sophisticated"
-  or
-  wrong = "suplimented" and right = "supplemented"
-  or
-  wrong = "suported" and right = "supported"
-  or
-  wrong = "supose" and right = "suppose"
-  or
-  wrong = "suposed" and right = "supposed"
-  or
-  wrong = "suposedly" and right = "supposedly"
-  or
-  wrong = "suposes" and right = "supposes"
-  or
-  wrong = "suposing" and right = "supposing"
-  or
-  wrong = "supplamented" and right = "supplemented"
-  or
-  wrong = "suppliementing" and right = "supplementing"
-  or
-  wrong = "suppoed" and right = "supposed"
-  or
-  wrong = "supposingly" and right = "supposedly"
-  or
-  wrong = "suppy" and right = "supply"
-  or
-  wrong = "suprassing" and right = "surpassing"
-  or
-  wrong = "supress" and right = "suppress"
-  or
-  wrong = "supressed" and right = "suppressed"
-  or
-  wrong = "supresses" and right = "suppresses"
-  or
-  wrong = "supressing" and right = "suppressing"
-  or
-  wrong = "suprise" and right = "surprise"
-  or
-  wrong = "suprised" and right = "surprised"
-  or
-  wrong = "suprising" and right = "surprising"
-  or
-  wrong = "suprisingly" and right = "surprisingly"
-  or
-  wrong = "suprize" and right = "surprise"
-  or
-  wrong = "suprized" and right = "surprised"
-  or
-  wrong = "suprizing" and right = "surprising"
-  or
-  wrong = "suprizingly" and right = "surprisingly"
-  or
-  wrong = "surfce" and right = "surface"
-  or
-  wrong = "surley" and right = "surely"
-  or
-  wrong = "surley" and right = "surly"
-  or
-  wrong = "suround" and right = "surround"
-  or
-  wrong = "surounded" and right = "surrounded"
-  or
-  wrong = "surounding" and right = "surrounding"
-  or
-  wrong = "suroundings" and right = "surroundings"
-  or
-  wrong = "surounds" and right = "surrounds"
-  or
-  wrong = "surplanted" and right = "supplanted"
-  or
-  wrong = "surpress" and right = "suppress"
-  or
-  wrong = "surpressed" and right = "suppressed"
-  or
-  wrong = "surprize" and right = "surprise"
-  or
-  wrong = "surprized" and right = "surprised"
-  or
-  wrong = "surprizing" and right = "surprising"
-  or
-  wrong = "surprizingly" and right = "surprisingly"
-  or
-  wrong = "surrended" and right = "surrendered"
-  or
-  wrong = "surrended" and right = "surrounded"
-  or
-  wrong = "surrepetitious" and right = "surreptitious"
-  or
-  wrong = "surrepetitiously" and right = "surreptitiously"
-  or
-  wrong = "surreptious" and right = "surreptitious"
-  or
-  wrong = "surreptiously" and right = "surreptitiously"
-  or
-  wrong = "surronded" and right = "surrounded"
-  or
-  wrong = "surrouded" and right = "surrounded"
-  or
-  wrong = "surrouding" and right = "surrounding"
-  or
-  wrong = "surrundering" and right = "surrendering"
-  or
-  wrong = "surveilence" and right = "surveillance"
-  or
-  wrong = "surveill" and right = "surveil"
-  or
-  wrong = "surveyer" and right = "surveyor"
-  or
-  wrong = "surviver" and right = "survivor"
-  or
-  wrong = "survivers" and right = "survivors"
-  or
-  wrong = "survivied" and right = "survived"
-  or
-  wrong = "suseptable" and right = "susceptible"
-  or
-  wrong = "suseptible" and right = "susceptible"
-  or
-  wrong = "suspention" and right = "suspension"
-  or
-  wrong = "swaer" and right = "swear"
-  or
-  wrong = "swaers" and right = "swears"
-  or
-  wrong = "swepth" and right = "swept"
-  or
-  wrong = "swiming" and right = "swimming"
-  or
-  wrong = "syas" and right = "says"
-  or
-  wrong = "symetrical" and right = "symmetrical"
-  or
-  wrong = "symetrically" and right = "symmetrically"
-  or
-  wrong = "symetry" and right = "symmetry"
-  or
-  wrong = "symettric" and right = "symmetric"
-  or
-  wrong = "symmetral" and right = "symmetric"
-  or
-  wrong = "symmetricaly" and right = "symmetrically"
-  or
-  wrong = "synagouge" and right = "synagogue"
-  or
-  wrong = "syncronization" and right = "synchronization"
-  or
-  wrong = "synonomous" and right = "synonymous"
-  or
-  wrong = "synonymns" and right = "synonyms"
-  or
-  wrong = "synphony" and right = "symphony"
-  or
-  wrong = "syphyllis" and right = "syphilis"
-  or
-  wrong = "sypmtoms" and right = "symptoms"
-  or
-  wrong = "syrap" and right = "syrup"
-  or
-  wrong = "sysmatically" and right = "systematically"
-  or
-  wrong = "sytem" and right = "system"
-  or
-  wrong = "sytle" and right = "style"
-  or
-  wrong = "tabacco" and right = "tobacco"
-  or
-  wrong = "tahn" and right = "than"
-  or
-  wrong = "taht" and right = "that"
-  or
-  wrong = "talekd" and right = "talked"
-  or
-  wrong = "targetted" and right = "targeted"
-  or
-  wrong = "targetting" and right = "targeting"
-  or
-  wrong = "tast" and right = "taste"
-  or
-  wrong = "tath" and right = "that"
-  or
-  wrong = "tatoo" and right = "tattoo"
-  or
-  wrong = "tattooes" and right = "tattoos"
-  or
-  wrong = "taxanomic" and right = "taxonomic"
-  or
-  wrong = "taxanomy" and right = "taxonomy"
-  or
-  wrong = "teached" and right = "taught"
-  or
-  wrong = "techician" and right = "technician"
-  or
-  wrong = "techicians" and right = "technicians"
-  or
-  wrong = "techiniques" and right = "techniques"
-  or
-  wrong = "technitian" and right = "technician"
-  or
-  wrong = "technnology" and right = "technology"
-  or
-  wrong = "technolgy" and right = "technology"
-  or
-  wrong = "teh" and right = "the"
-  or
-  wrong = "tehy" and right = "they"
-  or
-  wrong = "telelevision" and right = "television"
-  or
-  wrong = "televsion" and right = "television"
-  or
-  wrong = "telphony" and right = "telephony"
-  or
-  wrong = "temerature" and right = "temperature"
-  or
-  wrong = "tempalte" and right = "template"
-  or
-  wrong = "tempaltes" and right = "templates"
-  or
-  wrong = "temparate" and right = "temperate"
-  or
-  wrong = "temperarily" and right = "temporarily"
-  or
-  wrong = "temperment" and right = "temperament"
-  or
-  wrong = "tempertaure" and right = "temperature"
-  or
-  wrong = "temperture" and right = "temperature"
-  or
-  wrong = "temprary" and right = "temporary"
-  or
-  wrong = "tenacle" and right = "tentacle"
-  or
-  wrong = "tenacles" and right = "tentacles"
-  or
-  wrong = "tendacy" and right = "tendency"
-  or
-  wrong = "tendancies" and right = "tendencies"
-  or
-  wrong = "tendancy" and right = "tendency"
-  or
-  wrong = "tepmorarily" and right = "temporarily"
-  or
-  wrong = "terrestial" and right = "terrestrial"
-  or
-  wrong = "terriories" and right = "territories"
-  or
-  wrong = "terriory" and right = "territory"
-  or
-  wrong = "territorist" and right = "terrorist"
-  or
-  wrong = "territoy" and right = "territory"
-  or
-  wrong = "terroist" and right = "terrorist"
-  or
-  wrong = "testiclular" and right = "testicular"
-  or
-  wrong = "testomony" and right = "testimony"
-  or
-  wrong = "tghe" and right = "the"
-  or
-  wrong = "thast" and right = "that"
-  or
-  wrong = "theather" and right = "theater"
-  or
-  wrong = "theese" and right = "these"
-  or
-  wrong = "theif" and right = "thief"
-  or
-  wrong = "theives" and right = "thieves"
-  or
-  wrong = "themselfs" and right = "themselves"
-  or
-  wrong = "themslves" and right = "themselves"
-  or
-  wrong = "ther" and right = "the"
-  or
-  wrong = "ther" and right = "their"
-  or
-  wrong = "ther" and right = "there"
-  or
-  wrong = "therafter" and right = "thereafter"
-  or
-  wrong = "therby" and right = "thereby"
-  or
-  wrong = "theri" and right = "their"
-  or
-  wrong = "thgat" and right = "that"
-  or
-  wrong = "thge" and right = "the"
-  or
-  wrong = "thier" and right = "their"
-  or
-  wrong = "thign" and right = "thing"
-  or
-  wrong = "thigns" and right = "things"
-  or
-  wrong = "thigsn" and right = "things"
-  or
-  wrong = "thikn" and right = "think"
-  or
-  wrong = "thikning" and right = "thickening"
-  or
-  wrong = "thikning" and right = "thinking"
-  or
-  wrong = "thikns" and right = "thinks"
-  or
-  wrong = "thiunk" and right = "think"
-  or
-  wrong = "thn" and right = "then"
-  or
-  wrong = "thna" and right = "than"
-  or
-  wrong = "thne" and right = "then"
-  or
-  wrong = "thnig" and right = "thing"
-  or
-  wrong = "thnigs" and right = "things"
-  or
-  wrong = "thoughout" and right = "throughout"
-  or
-  wrong = "threatend" and right = "threatened"
-  or
-  wrong = "threatning" and right = "threatening"
-  or
-  wrong = "threee" and right = "three"
-  or
-  wrong = "threshhold" and right = "threshold"
-  or
-  wrong = "thrid" and right = "third"
-  or
-  wrong = "throrough" and right = "thorough"
-  or
-  wrong = "throughly" and right = "thoroughly"
-  or
-  wrong = "throught" and right = "thought"
-  or
-  wrong = "throught" and right = "through"
-  or
-  wrong = "throught" and right = "throughout"
-  or
-  wrong = "througout" and right = "throughout"
-  or
-  wrong = "thru" and right = "through"
-  or
-  wrong = "thsi" and right = "this"
-  or
-  wrong = "thsoe" and right = "those"
-  or
-  wrong = "thta" and right = "that"
-  or
-  wrong = "thyat" and right = "that"
-  or
-  wrong = "tiem" and right = "tim"
-  or
-  wrong = "tiem" and right = "time"
-  or
-  wrong = "tihkn" and right = "think"
-  or
-  wrong = "tihs" and right = "this"
-  or
-  wrong = "timne" and right = "time"
-  or
-  wrong = "tiome" and right = "time"
-  or
-  wrong = "tiome" and right = "tome"
-  or
-  wrong = "tje" and right = "the"
-  or
-  wrong = "tjhe" and right = "the"
-  or
-  wrong = "tjpanishad" and right = "upanishad"
-  or
-  wrong = "tkae" and right = "take"
-  or
-  wrong = "tkaes" and right = "takes"
-  or
-  wrong = "tkaing" and right = "taking"
-  or
-  wrong = "tlaking" and right = "talking"
-  or
-  wrong = "tobbaco" and right = "tobacco"
-  or
-  wrong = "todya" and right = "today"
-  or
-  wrong = "toghether" and right = "together"
-  or
-  wrong = "toke" and right = "took"
-  or
-  wrong = "tolerence" and right = "tolerance"
-  or
-  wrong = "tolkein" and right = "tolkien"
-  or
-  wrong = "tomatos" and right = "tomatoes"
-  or
-  wrong = "tommorow" and right = "tomorrow"
-  or
-  wrong = "tommorrow" and right = "tomorrow"
-  or
-  wrong = "tongiht" and right = "tonight"
-  or
-  wrong = "toriodal" and right = "toroidal"
-  or
-  wrong = "tormenters" and right = "tormentors"
-  or
-  wrong = "tornadoe" and right = "tornado"
-  or
-  wrong = "torpeados" and right = "torpedoes"
-  or
-  wrong = "torpedos" and right = "torpedoes"
-  or
-  wrong = "tortise" and right = "tortoise"
-  or
-  wrong = "toubles" and right = "troubles"
-  or
-  wrong = "tounge" and right = "tongue"
-  or
-  wrong = "tourch" and right = "torch"
-  or
-  wrong = "tourch" and right = "touch"
-  or
-  wrong = "towords" and right = "towards"
-  or
-  wrong = "towrad" and right = "toward"
-  or
-  wrong = "tradionally" and right = "traditionally"
-  or
-  wrong = "traditionaly" and right = "traditionally"
-  or
-  wrong = "traditionnal" and right = "traditional"
-  or
-  wrong = "traditition" and right = "tradition"
-  or
-  wrong = "tradtionally" and right = "traditionally"
-  or
-  wrong = "trafficed" and right = "trafficked"
-  or
-  wrong = "trafficing" and right = "trafficking"
-  or
-  wrong = "trafic" and right = "traffic"
-  or
-  wrong = "trancendent" and right = "transcendent"
-  or
-  wrong = "trancending" and right = "transcending"
-  or
-  wrong = "tranform" and right = "transform"
-  or
-  wrong = "tranformed" and right = "transformed"
-  or
-  wrong = "transcendance" and right = "transcendence"
-  or
-  wrong = "transcendant" and right = "transcendent"
-  or
-  wrong = "transcendentational" and right = "transcendental"
-  or
-  wrong = "transcripting" and right = "transcribing"
-  or
-  wrong = "transcripting" and right = "transcription"
-  or
-  wrong = "transending" and right = "transcending"
-  or
-  wrong = "transesxuals" and right = "transsexuals"
-  or
-  wrong = "transfered" and right = "transferred"
-  or
-  wrong = "transfering" and right = "transferring"
-  or
-  wrong = "transformaton" and right = "transformation"
-  or
-  wrong = "transistion" and right = "transition"
-  or
-  wrong = "translater" and right = "translator"
-  or
-  wrong = "translaters" and right = "translators"
-  or
-  wrong = "transmissable" and right = "transmissible"
-  or
-  wrong = "transporation" and right = "transportation"
-  or
-  wrong = "tremelo" and right = "tremolo"
-  or
-  wrong = "tremelos" and right = "tremolos"
-  or
-  wrong = "treshold" and right = "threshold"
-  or
-  wrong = "triguered" and right = "triggered"
-  or
-  wrong = "triology" and right = "trilogy"
-  or
-  wrong = "troling" and right = "trolling"
-  or
-  wrong = "troup" and right = "troupe"
-  or
-  wrong = "troups" and right = "troops"
-  or
-  wrong = "troups" and right = "troupes"
-  or
-  wrong = "truely" and right = "truly"
-  or
-  wrong = "trustworthyness" and right = "trustworthiness"
-  or
-  wrong = "turnk" and right = "trunk"
-  or
-  wrong = "turnk" and right = "turnkey"
-  or
-  wrong = "tuscon" and right = "tucson"
-  or
-  wrong = "tust" and right = "trust"
-  or
-  wrong = "twelth" and right = "twelfth"
-  or
-  wrong = "twon" and right = "town"
-  or
-  wrong = "twpo" and right = "two"
-  or
-  wrong = "tyhat" and right = "that"
-  or
-  wrong = "tyhe" and right = "they"
-  or
-  wrong = "typcial" and right = "typical"
-  or
-  wrong = "typicaly" and right = "typically"
-  or
-  wrong = "tyranies" and right = "tyrannies"
-  or
-  wrong = "tyrany" and right = "tyranny"
-  or
-  wrong = "tyrranies" and right = "tyrannies"
-  or
-  wrong = "tyrrany" and right = "tyranny"
-  or
-  wrong = "ubiquitious" and right = "ubiquitous"
-  or
-  wrong = "ublisher" and right = "publisher"
-  or
-  wrong = "udpate" and right = "update"
-  or
-  wrong = "uise" and right = "use"
-  or
-  wrong = "ukranian" and right = "ukrainian"
-  or
-  wrong = "ultimely" and right = "ultimately"
-  or
-  wrong = "unacompanied" and right = "unaccompanied"
-  or
-  wrong = "unahppy" and right = "unhappy"
-  or
-  wrong = "unanymous" and right = "unanimous"
-  or
-  wrong = "unathorised" and right = "unauthorised"
-  or
-  wrong = "unavailible" and right = "unavailable"
-  or
-  wrong = "unballance" and right = "unbalance"
-  or
-  wrong = "unbeknowst" and right = "unbeknownst"
-  or
-  wrong = "unbeleivable" and right = "unbelievable"
-  or
-  wrong = "uncertainity" and right = "uncertainty"
-  or
-  wrong = "unchallengable" and right = "unchallengeable"
-  or
-  wrong = "unchangable" and right = "unchangeable"
-  or
-  wrong = "uncompetive" and right = "uncompetitive"
-  or
-  wrong = "unconcious" and right = "unconscious"
-  or
-  wrong = "unconciousness" and right = "unconsciousness"
-  or
-  wrong = "unconfortability" and right = "discomfort"
-  or
-  wrong = "uncontitutional" and right = "unconstitutional"
-  or
-  wrong = "unconvential" and right = "unconventional"
-  or
-  wrong = "undecideable" and right = "undecidable"
-  or
-  wrong = "understoon" and right = "understood"
-  or
-  wrong = "undesireable" and right = "undesirable"
-  or
-  wrong = "undetecable" and right = "undetectable"
-  or
-  wrong = "undoubtely" and right = "undoubtedly"
-  or
-  wrong = "undreground" and right = "underground"
-  or
-  wrong = "uneccesary" and right = "unnecessary"
-  or
-  wrong = "unecessary" and right = "unnecessary"
-  or
-  wrong = "unequalities" and right = "inequalities"
-  or
-  wrong = "unforetunately" and right = "unfortunately"
-  or
-  wrong = "unforgetable" and right = "unforgettable"
-  or
-  wrong = "unforgiveable" and right = "unforgivable"
-  or
-  wrong = "unforseen" and right = "unforeseen"
-  or
-  wrong = "unfortunatley" and right = "unfortunately"
-  or
-  wrong = "unfortunatly" and right = "unfortunately"
-  or
-  wrong = "unfourtunately" and right = "unfortunately"
-  or
-  wrong = "unihabited" and right = "uninhabited"
-  or
-  wrong = "unilateraly" and right = "unilaterally"
-  or
-  wrong = "unilatreal" and right = "unilateral"
-  or
-  wrong = "unilatreally" and right = "unilaterally"
-  or
-  wrong = "uninterruped" and right = "uninterrupted"
-  or
-  wrong = "uninterupted" and right = "uninterrupted"
-  or
-  wrong = "unintialized" and right = "uninitialized"
-  or
-  wrong = "unitesstates" and right = "unitedstates"
-  or
-  wrong = "univeral" and right = "universal"
-  or
-  wrong = "univeristies" and right = "universities"
-  or
-  wrong = "univeristy" and right = "university"
-  or
-  wrong = "univerity" and right = "university"
-  or
-  wrong = "universtiy" and right = "university"
-  or
-  wrong = "univesities" and right = "universities"
-  or
-  wrong = "univesity" and right = "university"
-  or
-  wrong = "unkown" and right = "unknown"
-  or
-  wrong = "unlikey" and right = "unlikely"
-  or
-  wrong = "unmanouverable" and right = "unmaneuverable"
-  or
-  wrong = "unmanouverable" and right = "unmanoeuvrable"
-  or
-  wrong = "unmistakeably" and right = "unmistakably"
-  or
-  wrong = "unneccesarily" and right = "unnecessarily"
-  or
-  wrong = "unneccesary" and right = "unnecessary"
-  or
-  wrong = "unneccessarily" and right = "unnecessarily"
-  or
-  wrong = "unneccessary" and right = "unnecessary"
-  or
-  wrong = "unnecesarily" and right = "unnecessarily"
-  or
-  wrong = "unnecesary" and right = "unnecessary"
-  or
-  wrong = "unoffical" and right = "unofficial"
-  or
-  wrong = "unoperational" and right = "nonoperational"
-  or
-  wrong = "unoticeable" and right = "unnoticeable"
-  or
-  wrong = "unplease" and right = "displease"
-  or
-  wrong = "unplesant" and right = "unpleasant"
-  or
-  wrong = "unprecendented" and right = "unprecedented"
-  or
-  wrong = "unprecidented" and right = "unprecedented"
-  or
-  wrong = "unrepentent" and right = "unrepentant"
-  or
-  wrong = "unrepetant" and right = "unrepentant"
-  or
-  wrong = "unrepetent" and right = "unrepentant"
-  or
-  wrong = "unsed" and right = "unsaid"
-  or
-  wrong = "unsed" and right = "unused"
-  or
-  wrong = "unsed" and right = "used"
-  or
-  wrong = "unsubstanciated" and right = "unsubstantiated"
-  or
-  wrong = "unsuccesful" and right = "unsuccessful"
-  or
-  wrong = "unsuccesfully" and right = "unsuccessfully"
-  or
-  wrong = "unsuccessfull" and right = "unsuccessful"
-  or
-  wrong = "unsucesful" and right = "unsuccessful"
-  or
-  wrong = "unsucesfuly" and right = "unsuccessfully"
-  or
-  wrong = "unsucessful" and right = "unsuccessful"
-  or
-  wrong = "unsucessfull" and right = "unsuccessful"
-  or
-  wrong = "unsucessfully" and right = "unsuccessfully"
-  or
-  wrong = "unsuprised" and right = "unsurprised"
-  or
-  wrong = "unsuprising" and right = "unsurprising"
-  or
-  wrong = "unsuprisingly" and right = "unsurprisingly"
-  or
-  wrong = "unsuprized" and right = "unsurprised"
-  or
-  wrong = "unsuprizing" and right = "unsurprising"
-  or
-  wrong = "unsuprizingly" and right = "unsurprisingly"
-  or
-  wrong = "unsurprized" and right = "unsurprised"
-  or
-  wrong = "unsurprizing" and right = "unsurprising"
-  or
-  wrong = "unsurprizingly" and right = "unsurprisingly"
-  or
-  wrong = "untill" and right = "until"
-  or
-  wrong = "untranslateable" and right = "untranslatable"
-  or
-  wrong = "unuseable" and right = "unusable"
-  or
-  wrong = "unusuable" and right = "unusable"
-  or
-  wrong = "unviersity" and right = "university"
-  or
-  wrong = "unwarrented" and right = "unwarranted"
-  or
-  wrong = "unweildly" and right = "unwieldy"
-  or
-  wrong = "unwieldly" and right = "unwieldy"
-  or
-  wrong = "upcomming" and right = "upcoming"
-  or
-  wrong = "upgradded" and right = "upgraded"
-  or
-  wrong = "usally" and right = "usually"
-  or
-  wrong = "useage" and right = "usage"
-  or
-  wrong = "usefull" and right = "useful"
-  or
-  wrong = "usefuly" and right = "usefully"
-  or
-  wrong = "useing" and right = "using"
-  or
-  wrong = "usualy" and right = "usually"
-  or
-  wrong = "ususally" and right = "usually"
-  or
-  wrong = "vaccum" and right = "vacuum"
-  or
-  wrong = "vaccume" and right = "vacuum"
-  or
-  wrong = "vacinity" and right = "vicinity"
-  or
-  wrong = "vaguaries" and right = "vagaries"
-  or
-  wrong = "vaieties" and right = "varieties"
-  or
-  wrong = "vailidty" and right = "validity"
-  or
-  wrong = "valetta" and right = "valletta"
-  or
-  wrong = "valuble" and right = "valuable"
-  or
-  wrong = "valueable" and right = "valuable"
-  or
-  wrong = "varations" and right = "variations"
-  or
-  wrong = "varient" and right = "variant"
-  or
-  wrong = "variey" and right = "variety"
-  or
-  wrong = "varing" and right = "varying"
-  or
-  wrong = "varities" and right = "varieties"
-  or
-  wrong = "varity" and right = "variety"
-  or
-  wrong = "vasall" and right = "vassal"
-  or
-  wrong = "vasalls" and right = "vassals"
-  or
-  wrong = "vaule" and right = "value"
-  or
-  wrong = "vegatarian" and right = "vegetarian"
-  or
-  wrong = "vegitable" and right = "vegetable"
-  or
-  wrong = "vegitables" and right = "vegetables"
-  or
-  wrong = "vegtable" and right = "vegetable"
-  or
-  wrong = "vehicule" and right = "vehicle"
-  or
-  wrong = "vell" and right = "well"
-  or
-  wrong = "venemous" and right = "venomous"
-  or
-  wrong = "vengance" and right = "vengeance"
-  or
-  wrong = "vengence" and right = "vengeance"
-  or
-  wrong = "verfication" and right = "verification"
-  or
-  wrong = "verison" and right = "version"
-  or
-  wrong = "verisons" and right = "versions"
-  or
-  wrong = "vermillion" and right = "vermilion"
-  or
-  wrong = "versitilaty" and right = "versatility"
-  or
-  wrong = "versitlity" and right = "versatility"
-  or
-  wrong = "vetween" and right = "between"
-  or
-  wrong = "veyr" and right = "very"
-  or
-  wrong = "vigeur" and right = "vigor"
-  or
-  wrong = "vigeur" and right = "vigour"
-  or
-  wrong = "vigeur" and right = "vigueur"
-  or
-  wrong = "vigilence" and right = "vigilance"
-  or
-  wrong = "vigourous" and right = "vigorous"
-  or
-  wrong = "villian" and right = "villain"
-  or
-  wrong = "villification" and right = "vilification"
-  or
-  wrong = "villify" and right = "vilify"
-  or
-  wrong = "villin" and right = "villain"
-  or
-  wrong = "villin" and right = "villein"
-  or
-  wrong = "villin" and right = "villi"
-  or
-  wrong = "vincinity" and right = "vicinity"
-  or
-  wrong = "violentce" and right = "violence"
-  or
-  wrong = "virtualy" and right = "virtually"
-  or
-  wrong = "virutal" and right = "virtual"
-  or
-  wrong = "virutally" and right = "virtually"
-  or
-  wrong = "visable" and right = "visible"
-  or
-  wrong = "visably" and right = "visibly"
-  or
-  wrong = "visting" and right = "visiting"
-  or
-  wrong = "vistors" and right = "visitors"
-  or
-  wrong = "vitories" and right = "victories"
-  or
-  wrong = "volcanoe" and right = "volcano"
-  or
-  wrong = "voleyball" and right = "volleyball"
-  or
-  wrong = "volontary" and right = "voluntary"
-  or
-  wrong = "volonteer" and right = "volunteer"
-  or
-  wrong = "volonteered" and right = "volunteered"
-  or
-  wrong = "volonteering" and right = "volunteering"
-  or
-  wrong = "volonteers" and right = "volunteers"
-  or
-  wrong = "volounteer" and right = "volunteer"
-  or
-  wrong = "volounteered" and right = "volunteered"
-  or
-  wrong = "volounteering" and right = "volunteering"
-  or
-  wrong = "volounteers" and right = "volunteers"
-  or
-  wrong = "volumne" and right = "volume"
-  or
-  wrong = "vreity" and right = "variety"
-  or
-  wrong = "vrey" and right = "very"
-  or
-  wrong = "vriety" and right = "variety"
-  or
-  wrong = "vulnerablility" and right = "vulnerability"
-  or
-  wrong = "vyer" and right = "very"
-  or
-  wrong = "vyre" and right = "very"
-  or
-  wrong = "waht" and right = "what"
-  or
-  wrong = "warantee" and right = "warranty"
-  or
-  wrong = "wardobe" and right = "wardrobe"
-  or
-  wrong = "warrent" and right = "warrant"
-  or
-  wrong = "warrriors" and right = "warriors"
-  or
-  wrong = "wass" and right = "was"
-  or
-  wrong = "watn" and right = "want"
-  or
-  wrong = "wayword" and right = "wayward"
-  or
-  wrong = "weaponary" and right = "weaponry"
-  or
-  wrong = "weas" and right = "was"
-  or
-  wrong = "wehn" and right = "when"
-  or
-  wrong = "weild" and right = "wield"
-  or
-  wrong = "weild" and right = "wild"
-  or
-  wrong = "weilded" and right = "wielded"
-  or
-  wrong = "wendsay" and right = "wednesday"
-  or
-  wrong = "wensday" and right = "wednesday"
-  or
-  wrong = "wereabouts" and right = "whereabouts"
-  or
-  wrong = "whant" and right = "want"
-  or
-  wrong = "whants" and right = "wants"
-  or
-  wrong = "whcih" and right = "which"
-  or
-  wrong = "wheras" and right = "whereas"
-  or
-  wrong = "wherease" and right = "whereas"
-  or
-  wrong = "whereever" and right = "wherever"
-  or
-  wrong = "whic" and right = "which"
-  or
-  wrong = "whihc" and right = "which"
-  or
-  wrong = "whith" and right = "with"
-  or
-  wrong = "whlch" and right = "which"
-  or
-  wrong = "whn" and right = "when"
-  or
-  wrong = "wholey" and right = "wholly"
-  or
-  wrong = "wholy" and right = "holy"
-  or
-  wrong = "wholy" and right = "wholly"
-  or
-  wrong = "whta" and right = "what"
-  or
-  wrong = "whther" and right = "whether"
-  or
-  wrong = "wich" and right = "which"
-  or
-  wrong = "wich" and right = "witch"
-  or
-  wrong = "widesread" and right = "widespread"
-  or
-  wrong = "wief" and right = "wife"
-  or
-  wrong = "wierd" and right = "weird"
-  or
-  wrong = "wiew" and right = "view"
-  or
-  wrong = "wih" and right = "with"
-  or
-  wrong = "wiht" and right = "with"
-  or
-  wrong = "wille" and right = "will"
-  or
-  wrong = "willingless" and right = "willingness"
-  or
-  wrong = "willk" and right = "will"
-  or
-  wrong = "wirting" and right = "writing"
-  or
-  wrong = "withdrawl" and right = "withdraw"
-  or
-  wrong = "withdrawl" and right = "withdrawal"
-  or
-  wrong = "witheld" and right = "withheld"
-  or
-  wrong = "withh" and right = "with"
-  or
-  wrong = "withing" and right = "within"
-  or
-  wrong = "withold" and right = "withhold"
-  or
-  wrong = "witht" and right = "with"
-  or
-  wrong = "witn" and right = "with"
-  or
-  wrong = "wiull" and right = "will"
-  or
-  wrong = "wnat" and right = "want"
-  or
-  wrong = "wnated" and right = "wanted"
-  or
-  wrong = "wnats" and right = "wants"
-  or
-  wrong = "wohle" and right = "whole"
-  or
-  wrong = "wokr" and right = "work"
-  or
-  wrong = "wokring" and right = "working"
-  or
-  wrong = "wonderfull" and right = "wonderful"
-  or
-  wrong = "wordlwide" and right = "worldwide"
-  or
-  wrong = "workststion" and right = "workstation"
-  or
-  wrong = "worls" and right = "world"
-  or
-  wrong = "worstened" and right = "worsened"
-  or
-  wrong = "woudl" and right = "would"
-  or
-  wrong = "wresters" and right = "wrestlers"
-  or
-  wrong = "wriet" and right = "write"
-  or
-  wrong = "writen" and right = "written"
-  or
-  wrong = "wroet" and right = "wrote"
-  or
-  wrong = "wrok" and right = "work"
-  or
-  wrong = "wroking" and right = "working"
-  or
-  wrong = "wtih" and right = "with"
-  or
-  wrong = "wupport" and right = "support"
-  or
-  wrong = "xenophoby" and right = "xenophobia"
-  or
-  wrong = "yaching" and right = "yachting"
-  or
-  wrong = "yaer" and right = "year"
-  or
-  wrong = "yaerly" and right = "yearly"
-  or
-  wrong = "yaers" and right = "years"
-  or
-  wrong = "yatch" and right = "yacht"
-  or
-  wrong = "yearm" and right = "year"
-  or
-  wrong = "yeasr" and right = "years"
-  or
-  wrong = "yeild" and right = "yield"
-  or
-  wrong = "yeilding" and right = "yielding"
-  or
-  wrong = "yementite" and right = "yemeni"
-  or
-  wrong = "yementite" and right = "yemenite"
-  or
-  wrong = "yera" and right = "year"
-  or
-  wrong = "yeras" and right = "years"
-  or
-  wrong = "yersa" and right = "years"
-  or
-  wrong = "yotube" and right = "youtube"
-  or
-  wrong = "youseff" and right = "yousef"
-  or
-  wrong = "youself" and right = "yourself"
-  or
-  wrong = "yrea" and right = "year"
-  or
-  wrong = "ytou" and right = "you"
-  or
-  wrong = "yuo" and right = "you"
-  or
-  wrong = "zeebra" and right = "zebra"
-}
+import codeql.typos.TypoDatabase as DB
+
+/** DEPRECATED: Use the `codeql/typos` pack instead. */
+deprecated predicate typos = DB::typos/2;
diff --git a/ql/ql/src/qlpack.yml b/ql/ql/src/qlpack.yml
index 9ae2cb13787..26450f8d718 100644
--- a/ql/ql/src/qlpack.yml
+++ b/ql/ql/src/qlpack.yml
@@ -5,3 +5,5 @@ dbscheme: ql.dbscheme
 suites: codeql-suites
 defaultSuiteFile: codeql-suites/ql-code-scanning.qls
 extractor: ql
+dependencies:
+  codeql/typos: 0.0.1-dev
diff --git a/ql/ql/src/queries/bugs/MissingSanitizerGuardCase.ql b/ql/ql/src/queries/bugs/MissingSanitizerGuardCase.ql
new file mode 100644
index 00000000000..325d2877cb3
--- /dev/null
+++ b/ql/ql/src/queries/bugs/MissingSanitizerGuardCase.ql
@@ -0,0 +1,28 @@
+/**
+ * @name Unmentioned guard class
+ * @description A sanitizer guard should be included in the `isSanitizerGuard` predicate.
+ * @kind problem
+ * @problem.severity warning
+ * @id ql/unmentioned-guard
+ * @tags correctness
+ *       maintainability
+ * @precision medium
+ */
+
+import ql
+
+class SanGuard extends Class {
+  SanGuard() {
+    exists(Class sup |
+      sup = this.getASuperType().getResolvedType().(ClassType).getDeclaration() and
+      sup.getName() = ["SanitizerGuardNode", "SanitizerGuard", "BarrierGuardNode", "BarrierGuard"] and
+      sup.getLocation().getFile() != this.getLocation().getFile()
+    )
+  }
+}
+
+from SanGuard guard
+where
+  not exists(TypeExpr t | t.getResolvedType().(ClassType).getDeclaration() = guard) and
+  not guard.hasAnnotation("deprecated")
+select guard, "Guard class is not mentioned anywhere"
diff --git a/ql/ql/src/queries/style/AlertMessage.ql b/ql/ql/src/queries/style/AlertMessage.ql
new file mode 100644
index 00000000000..8be6f0f2d99
--- /dev/null
+++ b/ql/ql/src/queries/style/AlertMessage.ql
@@ -0,0 +1,198 @@
+/**
+ * @name Alert message style violation
+ * @description An alert message that doesn't follow the style guide is harder for end users to digest.
+ *              See the style guide here: https://github.com/github/codeql/blob/main/docs/query-metadata-style-guide.md#alert-messages
+ * @kind problem
+ * @problem.severity warning
+ * @id ql/alert-message-style-violation
+ * @precision high
+ */
+
+import ql
+
+/** Gets the `index`th part of the select statement. */
+private AstNode getSelectPart(Select sel, int index) {
+  result =
+    rank[index](AstNode n, Location loc |
+      (
+        n.getParent*() = sel.getExpr(_) and loc = n.getLocation()
+        or
+        // the strings are behind a predicate call.
+        exists(Call c, Predicate target |
+          c.getParent*() = sel.getExpr(_) and loc = c.getLocation()
+        |
+          c.getTarget() = target and
+          (
+            target.getBody().(ComparisonFormula).getAnOperand() = n
+            or
+            exists(ClassPredicate sub | sub.overrides(target) |
+              sub.getBody().(ComparisonFormula).getAnOperand() = n
+            )
+          )
+        )
+      )
+    |
+      n
+      order by
+        loc.getStartLine(), loc.getStartColumn(), loc.getEndLine(), loc.getEndColumn(),
+        loc.getFile().getRelativePath()
+    )
+}
+
+/**
+ * Gets a string element that is the last part of the message, that doesn't end with a period.
+ *
+ * For example:
+ * ```CodeQL
+ * select foo(), "This is a description" // <- bad
+ *
+ * select foo(), "This is a description." // <- good
+ * ```
+ */
+String shouldHaveFullStop(Select sel) {
+  result =
+    max(AstNode str, int i |
+      str.getParent+() = sel.getExpr(1) and str = getSelectPart(sel, i)
+    |
+      str order by i
+    ) and
+  not result.getValue().matches("%.") and
+  not result.getValue().matches("%?")
+}
+
+/**
+ * Gets a string element that is the first part of the message, that starts with a lower case letter.
+ *
+ * For example:
+ * ```CodeQL
+ * select foo(), "this is a description." // <- bad
+ *
+ * select foo(), "This is a description." // <- good
+ * ```
+ */
+String shouldStartCapital(Select sel) {
+  result =
+    min(AstNode str, int i |
+      str.getParent+() = sel.getExpr(1) and str = getSelectPart(sel, i)
+    |
+      str order by i
+    ) and
+  result.getValue().regexpMatch("^[a-z].*")
+}
+
+/**
+ * Gets a string element that is used in a message that contains "here" or "this location".
+ *
+ * For example:
+ * ```CodeQL
+ * select foo(), "XSS happens here from using a unsafe value." // <- bad
+ *
+ * select foo(), "XSS from using a unsafe value." // <- good
+ * ```
+ */
+String avoidHere(string part) {
+  part = ["here", "this location"] and
+  (
+    result.getValue().regexpMatch(".*\\b" + part + "\\b.*") and
+    result = getSelectPart(_, _)
+  )
+}
+
+/**
+ * Avoid using an indefinite article ("a" or "an") in a link text.
+ *
+ * For example:
+ * ```CodeQL
+ * select foo(), "XSS from $@", val, "an unsafe value." // <- bad
+ *
+ * select foo(), "XSS from a $@", val, "unsafe value." // <- good
+ * ```
+ *
+ * See https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-in-context.html for the W3C guideline on link text. a
+ */
+String avoidArticleInLinkText(Select sel) {
+  result = sel.getExpr((any(int i | i > 1))) and
+  result = getSelectPart(sel, _) and
+  result.getValue().regexpMatch("a|an .*")
+}
+
+/**
+ * Don't quote substitutions in a message.
+ *
+ * For example:
+ * ```CodeQL
+ * select foo(), "XSS from '$@'", val, "an unsafe value." // <- bad
+ *
+ * select foo(), "XSS from $@", val, "an unsafe value." // <- good
+ * ```
+ */
+String dontQuoteSubstitutions(Select sel) {
+  result = getSelectPart(sel, _) and
+  result.getValue().matches(["%'$@'%", "%\"$@\"%"])
+}
+
+/**
+ * Gets the kind of the path-query represented by `sel`.
+ * Either "data" for a dataflow query or "taint" for a taint-tracking query.
+ */
+private string getQueryKind(Select sel) {
+  exists(TypeExpr sup |
+    sup = sel.getVarDecl(_).getType().(ClassType).getDeclaration().getASuperType() and
+    sup.getResolvedType().(ClassType).getName() = "Configuration"
+  |
+    result = "data" and
+    sup.getModule().getName() = "DataFlow"
+    or
+    result = "taint" and
+    sup.getModule().getName() = "TaintTracking"
+  )
+}
+
+/**
+ * Gets a string element from a message that uses the wrong phrase for a path query.
+ * A dataflow query should use "flows to" and a taint-tracking query should use "depends on".
+ */
+String wrongFlowsPhrase(Select sel, string kind) {
+  result = getSelectPart(sel, _) and
+  kind = getQueryKind(sel) and
+  (
+    kind = "data" and
+    result.getValue().matches(["% depends %", "% depend %"])
+    or
+    kind = "taint" and
+    result.getValue().matches(["% flows to %", "% flow to %"])
+  )
+}
+
+from AstNode node, string msg
+where
+  not node.getLocation().getFile().getAbsolutePath().matches("%/test/%") and
+  (
+    node = shouldHaveFullStop(_) and
+    msg = "Alert message should end with a full stop."
+    or
+    node = shouldStartCapital(_) and
+    msg = "Alert message should start with a capital letter."
+    or
+    exists(string part | node = avoidHere(part) |
+      part = "here" and
+      msg =
+        "Try to use a descriptive phrase instead of \"here\". Use \"this location\" if you can't get around mentioning the current location."
+      or
+      part = "this location" and
+      msg = "Try to more descriptive phrase instead of \"this location\" if possible."
+    )
+    or
+    node = avoidArticleInLinkText(_) and
+    msg = "Avoid starting a link text with an indefinite article."
+    or
+    node = dontQuoteSubstitutions(_) and
+    msg = "Don't quote substitutions in alert messages."
+    or
+    node = wrongFlowsPhrase(_, "data") and
+    msg = "Use \"flows to\" instead of \"depends on\" in data flow queries."
+    or
+    node = wrongFlowsPhrase(_, "taint") and
+    msg = "Use \"depends on\" instead of \"flows to\" in taint tracking queries."
+  )
+select node, msg
diff --git a/ql/ql/src/queries/style/ConsistentCasing.ql b/ql/ql/src/queries/style/ConsistentCasing.ql
new file mode 100644
index 00000000000..f46c9826651
--- /dev/null
+++ b/ql/ql/src/queries/style/ConsistentCasing.ql
@@ -0,0 +1,63 @@
+/**
+ * @name Names only differing by case
+ * @description Names only differing by case can cause confusion.
+ * @kind problem
+ * @problem.severity warning
+ * @id ql/names-only-differing-by-case
+ * @tags correctness
+ *       maintainability
+ * @precision high
+ */
+
+import ql
+import codeql_ql.style.AcronymsShouldBeCamelCaseQuery as Acronyms
+private import codeql_ql.style.NodeName as NodeName
+
+string getName(AstNode node, string kind, YAML::QLPack pack) {
+  result = NodeName::getName(node, kind) and
+  node.getLocation().getFile() = pack.getAFileInPack() and
+  not node.hasAnnotation("deprecated") and // deprecated nodes are not interesting
+  not node.getLocation().getFile().getBaseName() = "TreeSitter.qll" and // auto-generated, is sometimes bad.
+  not node.getLocation().getFile().getExtension() = "ql" // .ql files cannot be imported, so no risk of conflict
+}
+
+// get better join-order by getting all the relevant information in a single utility predicate
+pragma[nomagic]
+string getNameAndPack(AstNode node, string kind, string lower, YAML::QLPack pack) {
+  result = getName(node, kind, pack) and lower = result.toLowerCase()
+}
+
+predicate problem(string name1, AstNode node1, string name2, string kind) {
+  exists(string lower, YAML::QLPack pack1, YAML::QLPack pack2 |
+    name1 = getNameAndPack(node1, kind, lower, pack1) and
+    name1.length() >= 2 and
+    pack2 = pack1.getADependency*() and
+    name2 = getNameAndPack(_, kind, lower, pack2) and // TODO: Get if it's a dependency pack in the alert-message.
+    name1 != name2 and
+    kind != "variable" // these are benign, and plentyful...
+  )
+}
+
+string prettyPluralKind(string kind) {
+  kind = "class" and result = "classes"
+  or
+  kind = "classlessPredicate" and result = "predicates"
+  or
+  kind = "classPredicate" and result = "class predicates"
+  or
+  kind = "newtypeBranch" and result = "newtype branches"
+  or
+  kind = "newtype" and result = "newtypes"
+  or
+  kind = "variable" and result = "variables"
+  or
+  kind = "field" and result = "fields"
+  or
+  kind = "module" and result = "modules"
+}
+
+from string name1, AstNode node, string name2, string kind
+where problem(name1, node, name2, kind) and not name1.toLowerCase() = "geturl"
+select node,
+  name1 + " is only different by casing from " + name2 + " that is used elsewhere for " +
+    prettyPluralKind(kind) + "."
diff --git a/ql/ql/test/queries/style/Misspelling/Misspelling.expected b/ql/ql/test/queries/style/Misspelling/Misspelling.expected
index 59d2204d953..8116e2b5afa 100644
--- a/ql/ql/test/queries/style/Misspelling/Misspelling.expected
+++ b/ql/ql/test/queries/style/Misspelling/Misspelling.expected
@@ -1,6 +1,6 @@
 | Test.qll:1:1:3:3 | QLDoc | This comment contains the common misspelling 'mispelled', which should instead be 'misspelled'. |
 | Test.qll:4:7:4:26 | Class PublicallyAccessible | This class name contains the common misspelling 'publically', which should instead be 'publicly'. |
 | Test.qll:5:3:5:20 | FieldDecl | This field name contains the common misspelling 'occurences', which should instead be 'occurrences'. |
-| Test.qll:10:13:10:23 | ClassPredicate hasAgrument | This classPredicate name contains the common misspelling 'agrument', which should instead be 'argument'. |
+| Test.qll:10:13:10:23 | ClassPredicate hasAgrument | This predicate name contains the common misspelling 'agrument', which should instead be 'argument'. |
 | Test.qll:13:1:16:3 | QLDoc | This comment contains the non-US spelling 'colour', which should instead be 'color'. |
 | Test.qll:17:7:17:17 | Class AnalysedInt | This class name contains the non-US spelling 'analysed', which should instead be 'analyzed'. |
diff --git a/ruby/Cargo.lock b/ruby/Cargo.lock
index 2e2f205ce02..ed1b9e2bd3b 100644
Binary files a/ruby/Cargo.lock and b/ruby/Cargo.lock differ
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/old.dbscheme b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/old.dbscheme
new file mode 100644
index 00000000000..3595c826de6
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/old.dbscheme
@@ -0,0 +1,1435 @@
+// CodeQL database schema for Ruby
+// Automatically generated from the tree-sitter grammar; do not edit
+
+@location = @location_default
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int start_line: int ref,
+  int start_column: int ref,
+  int end_line: int ref,
+  int end_column: int ref
+);
+
+files(
+  unique int id: @file,
+  string name: string ref
+);
+
+folders(
+  unique int id: @folder,
+  string name: string ref
+);
+
+@container = @file | @folder
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref
+);
+
+sourceLocationPrefix(
+  string prefix: string ref
+);
+
+diagnostics(
+  unique int id: @diagnostic,
+  int severity: int ref,
+  string error_tag: string ref,
+  string error_message: string ref,
+  string full_error_message: string ref,
+  int location: @location_default ref
+);
+
+case @diagnostic.severity of
+  10 = @diagnostic_debug
+| 20 = @diagnostic_info
+| 30 = @diagnostic_warning
+| 40 = @diagnostic_error
+;
+
+
+@ruby_underscore_arg = @ruby_assignment | @ruby_binary | @ruby_conditional | @ruby_operator_assignment | @ruby_range | @ruby_unary | @ruby_underscore_primary
+
+@ruby_underscore_call_operator = @ruby_reserved_word
+
+@ruby_underscore_expression = @ruby_assignment | @ruby_binary | @ruby_break | @ruby_call | @ruby_next | @ruby_operator_assignment | @ruby_return | @ruby_unary | @ruby_underscore_arg | @ruby_yield
+
+@ruby_underscore_lhs = @ruby_call | @ruby_element_reference | @ruby_scope_resolution | @ruby_token_false | @ruby_token_nil | @ruby_token_true | @ruby_underscore_variable
+
+@ruby_underscore_method_name = @ruby_delimited_symbol | @ruby_setter | @ruby_token_constant | @ruby_token_identifier | @ruby_token_operator | @ruby_token_simple_symbol | @ruby_underscore_nonlocal_variable
+
+@ruby_underscore_nonlocal_variable = @ruby_token_class_variable | @ruby_token_global_variable | @ruby_token_instance_variable
+
+@ruby_underscore_pattern_constant = @ruby_scope_resolution | @ruby_token_constant
+
+@ruby_underscore_pattern_expr = @ruby_alternative_pattern | @ruby_as_pattern | @ruby_underscore_pattern_expr_basic
+
+@ruby_underscore_pattern_expr_basic = @ruby_array_pattern | @ruby_expression_reference_pattern | @ruby_find_pattern | @ruby_hash_pattern | @ruby_parenthesized_pattern | @ruby_range | @ruby_token_identifier | @ruby_underscore_pattern_constant | @ruby_underscore_pattern_primitive | @ruby_variable_reference_pattern
+
+@ruby_underscore_pattern_primitive = @ruby_delimited_symbol | @ruby_lambda | @ruby_regex | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_symbol_array | @ruby_token_encoding | @ruby_token_false | @ruby_token_file | @ruby_token_heredoc_beginning | @ruby_token_line | @ruby_token_nil | @ruby_token_self | @ruby_token_simple_symbol | @ruby_token_true | @ruby_unary | @ruby_underscore_simple_numeric
+
+@ruby_underscore_pattern_top_expr_body = @ruby_array_pattern | @ruby_find_pattern | @ruby_hash_pattern | @ruby_underscore_pattern_expr
+
+@ruby_underscore_primary = @ruby_array | @ruby_begin | @ruby_break | @ruby_call | @ruby_case__ | @ruby_case_match | @ruby_chained_string | @ruby_class | @ruby_delimited_symbol | @ruby_for | @ruby_hash | @ruby_if | @ruby_lambda | @ruby_method | @ruby_module | @ruby_next | @ruby_parenthesized_statements | @ruby_redo | @ruby_regex | @ruby_retry | @ruby_return | @ruby_singleton_class | @ruby_singleton_method | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_symbol_array | @ruby_token_character | @ruby_token_heredoc_beginning | @ruby_token_simple_symbol | @ruby_unary | @ruby_underscore_lhs | @ruby_underscore_simple_numeric | @ruby_unless | @ruby_until | @ruby_while | @ruby_yield
+
+@ruby_underscore_simple_numeric = @ruby_complex | @ruby_rational | @ruby_token_float | @ruby_token_integer
+
+@ruby_underscore_statement = @ruby_alias | @ruby_begin_block | @ruby_end_block | @ruby_if_modifier | @ruby_rescue_modifier | @ruby_undef | @ruby_underscore_expression | @ruby_unless_modifier | @ruby_until_modifier | @ruby_while_modifier
+
+@ruby_underscore_variable = @ruby_token_constant | @ruby_token_identifier | @ruby_token_self | @ruby_token_super | @ruby_underscore_nonlocal_variable
+
+ruby_alias_def(
+  unique int id: @ruby_alias,
+  int alias: @ruby_underscore_method_name ref,
+  int name: @ruby_underscore_method_name ref
+);
+
+#keyset[ruby_alternative_pattern, index]
+ruby_alternative_pattern_alternatives(
+  int ruby_alternative_pattern: @ruby_alternative_pattern ref,
+  int index: int ref,
+  unique int alternatives: @ruby_underscore_pattern_expr_basic ref
+);
+
+ruby_alternative_pattern_def(
+  unique int id: @ruby_alternative_pattern
+);
+
+@ruby_argument_list_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_argument_list, index]
+ruby_argument_list_child(
+  int ruby_argument_list: @ruby_argument_list ref,
+  int index: int ref,
+  unique int child: @ruby_argument_list_child_type ref
+);
+
+ruby_argument_list_def(
+  unique int id: @ruby_argument_list
+);
+
+@ruby_array_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_array, index]
+ruby_array_child(
+  int ruby_array: @ruby_array ref,
+  int index: int ref,
+  unique int child: @ruby_array_child_type ref
+);
+
+ruby_array_def(
+  unique int id: @ruby_array
+);
+
+ruby_array_pattern_class(
+  unique int ruby_array_pattern: @ruby_array_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_array_pattern_child_type = @ruby_splat_parameter | @ruby_underscore_pattern_expr
+
+#keyset[ruby_array_pattern, index]
+ruby_array_pattern_child(
+  int ruby_array_pattern: @ruby_array_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_array_pattern_child_type ref
+);
+
+ruby_array_pattern_def(
+  unique int id: @ruby_array_pattern
+);
+
+ruby_as_pattern_def(
+  unique int id: @ruby_as_pattern,
+  int name: @ruby_token_identifier ref,
+  int value: @ruby_underscore_pattern_expr ref
+);
+
+@ruby_assignment_left_type = @ruby_left_assignment_list | @ruby_underscore_lhs
+
+@ruby_assignment_right_type = @ruby_rescue_modifier | @ruby_right_assignment_list | @ruby_splat_argument | @ruby_underscore_expression
+
+ruby_assignment_def(
+  unique int id: @ruby_assignment,
+  int left: @ruby_assignment_left_type ref,
+  int right: @ruby_assignment_right_type ref
+);
+
+@ruby_bare_string_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_bare_string, index]
+ruby_bare_string_child(
+  int ruby_bare_string: @ruby_bare_string ref,
+  int index: int ref,
+  unique int child: @ruby_bare_string_child_type ref
+);
+
+ruby_bare_string_def(
+  unique int id: @ruby_bare_string
+);
+
+@ruby_bare_symbol_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_bare_symbol, index]
+ruby_bare_symbol_child(
+  int ruby_bare_symbol: @ruby_bare_symbol ref,
+  int index: int ref,
+  unique int child: @ruby_bare_symbol_child_type ref
+);
+
+ruby_bare_symbol_def(
+  unique int id: @ruby_bare_symbol
+);
+
+@ruby_begin_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_begin, index]
+ruby_begin_child(
+  int ruby_begin: @ruby_begin ref,
+  int index: int ref,
+  unique int child: @ruby_begin_child_type ref
+);
+
+ruby_begin_def(
+  unique int id: @ruby_begin
+);
+
+@ruby_begin_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_begin_block, index]
+ruby_begin_block_child(
+  int ruby_begin_block: @ruby_begin_block ref,
+  int index: int ref,
+  unique int child: @ruby_begin_block_child_type ref
+);
+
+ruby_begin_block_def(
+  unique int id: @ruby_begin_block
+);
+
+@ruby_binary_left_type = @ruby_underscore_expression | @ruby_underscore_simple_numeric
+
+case @ruby_binary.operator of
+  0 = @ruby_binary_bangequal
+| 1 = @ruby_binary_bangtilde
+| 2 = @ruby_binary_percent
+| 3 = @ruby_binary_ampersand
+| 4 = @ruby_binary_ampersandampersand
+| 5 = @ruby_binary_star
+| 6 = @ruby_binary_starstar
+| 7 = @ruby_binary_plus
+| 8 = @ruby_binary_minus
+| 9 = @ruby_binary_slash
+| 10 = @ruby_binary_langle
+| 11 = @ruby_binary_langlelangle
+| 12 = @ruby_binary_langleequal
+| 13 = @ruby_binary_langleequalrangle
+| 14 = @ruby_binary_equalequal
+| 15 = @ruby_binary_equalequalequal
+| 16 = @ruby_binary_equaltilde
+| 17 = @ruby_binary_rangle
+| 18 = @ruby_binary_rangleequal
+| 19 = @ruby_binary_ranglerangle
+| 20 = @ruby_binary_caret
+| 21 = @ruby_binary_and
+| 22 = @ruby_binary_or
+| 23 = @ruby_binary_pipe
+| 24 = @ruby_binary_pipepipe
+;
+
+
+ruby_binary_def(
+  unique int id: @ruby_binary,
+  int left: @ruby_binary_left_type ref,
+  int operator: int ref,
+  int right: @ruby_underscore_expression ref
+);
+
+ruby_block_body(
+  unique int ruby_block: @ruby_block ref,
+  unique int body: @ruby_block_body ref
+);
+
+ruby_block_parameters(
+  unique int ruby_block: @ruby_block ref,
+  unique int parameters: @ruby_block_parameters ref
+);
+
+ruby_block_def(
+  unique int id: @ruby_block
+);
+
+ruby_block_argument_child(
+  unique int ruby_block_argument: @ruby_block_argument ref,
+  unique int child: @ruby_underscore_arg ref
+);
+
+ruby_block_argument_def(
+  unique int id: @ruby_block_argument
+);
+
+@ruby_block_body_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_block_body, index]
+ruby_block_body_child(
+  int ruby_block_body: @ruby_block_body ref,
+  int index: int ref,
+  unique int child: @ruby_block_body_child_type ref
+);
+
+ruby_block_body_def(
+  unique int id: @ruby_block_body
+);
+
+ruby_block_parameter_name(
+  unique int ruby_block_parameter: @ruby_block_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_block_parameter_def(
+  unique int id: @ruby_block_parameter
+);
+
+#keyset[ruby_block_parameters, index]
+ruby_block_parameters_locals(
+  int ruby_block_parameters: @ruby_block_parameters ref,
+  int index: int ref,
+  unique int locals: @ruby_token_identifier ref
+);
+
+@ruby_block_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_block_parameters, index]
+ruby_block_parameters_child(
+  int ruby_block_parameters: @ruby_block_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_block_parameters_child_type ref
+);
+
+ruby_block_parameters_def(
+  unique int id: @ruby_block_parameters
+);
+
+@ruby_body_statement_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_body_statement, index]
+ruby_body_statement_child(
+  int ruby_body_statement: @ruby_body_statement ref,
+  int index: int ref,
+  unique int child: @ruby_body_statement_child_type ref
+);
+
+ruby_body_statement_def(
+  unique int id: @ruby_body_statement
+);
+
+ruby_break_child(
+  unique int ruby_break: @ruby_break ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_break_def(
+  unique int id: @ruby_break
+);
+
+ruby_call_arguments(
+  unique int ruby_call: @ruby_call ref,
+  unique int arguments: @ruby_argument_list ref
+);
+
+@ruby_call_block_type = @ruby_block | @ruby_do_block
+
+ruby_call_block(
+  unique int ruby_call: @ruby_call ref,
+  unique int block: @ruby_call_block_type ref
+);
+
+@ruby_call_method_type = @ruby_token_operator | @ruby_underscore_variable
+
+ruby_call_method(
+  unique int ruby_call: @ruby_call ref,
+  unique int method: @ruby_call_method_type ref
+);
+
+ruby_call_operator(
+  unique int ruby_call: @ruby_call ref,
+  unique int operator: @ruby_underscore_call_operator ref
+);
+
+ruby_call_receiver(
+  unique int ruby_call: @ruby_call ref,
+  unique int receiver: @ruby_underscore_primary ref
+);
+
+ruby_call_def(
+  unique int id: @ruby_call
+);
+
+ruby_case_value(
+  unique int ruby_case__: @ruby_case__ ref,
+  unique int value: @ruby_underscore_statement ref
+);
+
+@ruby_case_child_type = @ruby_else | @ruby_when
+
+#keyset[ruby_case__, index]
+ruby_case_child(
+  int ruby_case__: @ruby_case__ ref,
+  int index: int ref,
+  unique int child: @ruby_case_child_type ref
+);
+
+ruby_case_def(
+  unique int id: @ruby_case__
+);
+
+#keyset[ruby_case_match, index]
+ruby_case_match_clauses(
+  int ruby_case_match: @ruby_case_match ref,
+  int index: int ref,
+  unique int clauses: @ruby_in_clause ref
+);
+
+ruby_case_match_else(
+  unique int ruby_case_match: @ruby_case_match ref,
+  unique int else: @ruby_else ref
+);
+
+ruby_case_match_def(
+  unique int id: @ruby_case_match,
+  int value: @ruby_underscore_statement ref
+);
+
+#keyset[ruby_chained_string, index]
+ruby_chained_string_child(
+  int ruby_chained_string: @ruby_chained_string ref,
+  int index: int ref,
+  unique int child: @ruby_string__ ref
+);
+
+ruby_chained_string_def(
+  unique int id: @ruby_chained_string
+);
+
+ruby_class_body(
+  unique int ruby_class: @ruby_class ref,
+  unique int body: @ruby_body_statement ref
+);
+
+@ruby_class_name_type = @ruby_scope_resolution | @ruby_token_constant
+
+ruby_class_superclass(
+  unique int ruby_class: @ruby_class ref,
+  unique int superclass: @ruby_superclass ref
+);
+
+ruby_class_def(
+  unique int id: @ruby_class,
+  int name: @ruby_class_name_type ref
+);
+
+@ruby_complex_child_type = @ruby_rational | @ruby_token_float | @ruby_token_integer
+
+ruby_complex_def(
+  unique int id: @ruby_complex,
+  int child: @ruby_complex_child_type ref
+);
+
+ruby_conditional_def(
+  unique int id: @ruby_conditional,
+  int alternative: @ruby_underscore_arg ref,
+  int condition: @ruby_underscore_arg ref,
+  int consequence: @ruby_underscore_arg ref
+);
+
+@ruby_delimited_symbol_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_delimited_symbol, index]
+ruby_delimited_symbol_child(
+  int ruby_delimited_symbol: @ruby_delimited_symbol ref,
+  int index: int ref,
+  unique int child: @ruby_delimited_symbol_child_type ref
+);
+
+ruby_delimited_symbol_def(
+  unique int id: @ruby_delimited_symbol
+);
+
+@ruby_destructured_left_assignment_child_type = @ruby_destructured_left_assignment | @ruby_rest_assignment | @ruby_underscore_lhs
+
+#keyset[ruby_destructured_left_assignment, index]
+ruby_destructured_left_assignment_child(
+  int ruby_destructured_left_assignment: @ruby_destructured_left_assignment ref,
+  int index: int ref,
+  unique int child: @ruby_destructured_left_assignment_child_type ref
+);
+
+ruby_destructured_left_assignment_def(
+  unique int id: @ruby_destructured_left_assignment
+);
+
+@ruby_destructured_parameter_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_destructured_parameter, index]
+ruby_destructured_parameter_child(
+  int ruby_destructured_parameter: @ruby_destructured_parameter ref,
+  int index: int ref,
+  unique int child: @ruby_destructured_parameter_child_type ref
+);
+
+ruby_destructured_parameter_def(
+  unique int id: @ruby_destructured_parameter
+);
+
+@ruby_do_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_do, index]
+ruby_do_child(
+  int ruby_do: @ruby_do ref,
+  int index: int ref,
+  unique int child: @ruby_do_child_type ref
+);
+
+ruby_do_def(
+  unique int id: @ruby_do
+);
+
+ruby_do_block_body(
+  unique int ruby_do_block: @ruby_do_block ref,
+  unique int body: @ruby_body_statement ref
+);
+
+ruby_do_block_parameters(
+  unique int ruby_do_block: @ruby_do_block ref,
+  unique int parameters: @ruby_block_parameters ref
+);
+
+ruby_do_block_def(
+  unique int id: @ruby_do_block
+);
+
+@ruby_element_reference_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_element_reference, index]
+ruby_element_reference_child(
+  int ruby_element_reference: @ruby_element_reference ref,
+  int index: int ref,
+  unique int child: @ruby_element_reference_child_type ref
+);
+
+ruby_element_reference_def(
+  unique int id: @ruby_element_reference,
+  int object: @ruby_underscore_primary ref
+);
+
+@ruby_else_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_else, index]
+ruby_else_child(
+  int ruby_else: @ruby_else ref,
+  int index: int ref,
+  unique int child: @ruby_else_child_type ref
+);
+
+ruby_else_def(
+  unique int id: @ruby_else
+);
+
+@ruby_elsif_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_elsif_alternative(
+  unique int ruby_elsif: @ruby_elsif ref,
+  unique int alternative: @ruby_elsif_alternative_type ref
+);
+
+ruby_elsif_consequence(
+  unique int ruby_elsif: @ruby_elsif ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_elsif_def(
+  unique int id: @ruby_elsif,
+  int condition: @ruby_underscore_statement ref
+);
+
+@ruby_end_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_end_block, index]
+ruby_end_block_child(
+  int ruby_end_block: @ruby_end_block ref,
+  int index: int ref,
+  unique int child: @ruby_end_block_child_type ref
+);
+
+ruby_end_block_def(
+  unique int id: @ruby_end_block
+);
+
+@ruby_ensure_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_ensure, index]
+ruby_ensure_child(
+  int ruby_ensure: @ruby_ensure ref,
+  int index: int ref,
+  unique int child: @ruby_ensure_child_type ref
+);
+
+ruby_ensure_def(
+  unique int id: @ruby_ensure
+);
+
+ruby_exception_variable_def(
+  unique int id: @ruby_exception_variable,
+  int child: @ruby_underscore_lhs ref
+);
+
+@ruby_exceptions_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+#keyset[ruby_exceptions, index]
+ruby_exceptions_child(
+  int ruby_exceptions: @ruby_exceptions ref,
+  int index: int ref,
+  unique int child: @ruby_exceptions_child_type ref
+);
+
+ruby_exceptions_def(
+  unique int id: @ruby_exceptions
+);
+
+ruby_expression_reference_pattern_def(
+  unique int id: @ruby_expression_reference_pattern,
+  int value: @ruby_underscore_expression ref
+);
+
+ruby_find_pattern_class(
+  unique int ruby_find_pattern: @ruby_find_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_find_pattern_child_type = @ruby_splat_parameter | @ruby_underscore_pattern_expr
+
+#keyset[ruby_find_pattern, index]
+ruby_find_pattern_child(
+  int ruby_find_pattern: @ruby_find_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_find_pattern_child_type ref
+);
+
+ruby_find_pattern_def(
+  unique int id: @ruby_find_pattern
+);
+
+@ruby_for_pattern_type = @ruby_left_assignment_list | @ruby_underscore_lhs
+
+ruby_for_def(
+  unique int id: @ruby_for,
+  int body: @ruby_do ref,
+  int pattern: @ruby_for_pattern_type ref,
+  int value: @ruby_in ref
+);
+
+@ruby_hash_child_type = @ruby_hash_splat_argument | @ruby_pair
+
+#keyset[ruby_hash, index]
+ruby_hash_child(
+  int ruby_hash: @ruby_hash ref,
+  int index: int ref,
+  unique int child: @ruby_hash_child_type ref
+);
+
+ruby_hash_def(
+  unique int id: @ruby_hash
+);
+
+ruby_hash_pattern_class(
+  unique int ruby_hash_pattern: @ruby_hash_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_hash_pattern_child_type = @ruby_hash_splat_parameter | @ruby_keyword_pattern | @ruby_token_hash_splat_nil
+
+#keyset[ruby_hash_pattern, index]
+ruby_hash_pattern_child(
+  int ruby_hash_pattern: @ruby_hash_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_hash_pattern_child_type ref
+);
+
+ruby_hash_pattern_def(
+  unique int id: @ruby_hash_pattern
+);
+
+ruby_hash_splat_argument_def(
+  unique int id: @ruby_hash_splat_argument,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_hash_splat_parameter_name(
+  unique int ruby_hash_splat_parameter: @ruby_hash_splat_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_hash_splat_parameter_def(
+  unique int id: @ruby_hash_splat_parameter
+);
+
+@ruby_heredoc_body_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_heredoc_content | @ruby_token_heredoc_end
+
+#keyset[ruby_heredoc_body, index]
+ruby_heredoc_body_child(
+  int ruby_heredoc_body: @ruby_heredoc_body ref,
+  int index: int ref,
+  unique int child: @ruby_heredoc_body_child_type ref
+);
+
+ruby_heredoc_body_def(
+  unique int id: @ruby_heredoc_body
+);
+
+@ruby_if_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_if_alternative(
+  unique int ruby_if: @ruby_if ref,
+  unique int alternative: @ruby_if_alternative_type ref
+);
+
+ruby_if_consequence(
+  unique int ruby_if: @ruby_if ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_if_def(
+  unique int id: @ruby_if,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_if_guard_def(
+  unique int id: @ruby_if_guard,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_if_modifier_def(
+  unique int id: @ruby_if_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_in_def(
+  unique int id: @ruby_in,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_in_clause_body(
+  unique int ruby_in_clause: @ruby_in_clause ref,
+  unique int body: @ruby_then ref
+);
+
+@ruby_in_clause_guard_type = @ruby_if_guard | @ruby_unless_guard
+
+ruby_in_clause_guard(
+  unique int ruby_in_clause: @ruby_in_clause ref,
+  unique int guard: @ruby_in_clause_guard_type ref
+);
+
+ruby_in_clause_def(
+  unique int id: @ruby_in_clause,
+  int pattern: @ruby_underscore_pattern_top_expr_body ref
+);
+
+@ruby_interpolation_child_type = @ruby_token_empty_statement | @ruby_underscore_nonlocal_variable | @ruby_underscore_statement
+
+#keyset[ruby_interpolation, index]
+ruby_interpolation_child(
+  int ruby_interpolation: @ruby_interpolation ref,
+  int index: int ref,
+  unique int child: @ruby_interpolation_child_type ref
+);
+
+ruby_interpolation_def(
+  unique int id: @ruby_interpolation
+);
+
+ruby_keyword_parameter_value(
+  unique int ruby_keyword_parameter: @ruby_keyword_parameter ref,
+  unique int value: @ruby_underscore_arg ref
+);
+
+ruby_keyword_parameter_def(
+  unique int id: @ruby_keyword_parameter,
+  int name: @ruby_token_identifier ref
+);
+
+@ruby_keyword_pattern_key_type = @ruby_string__ | @ruby_token_hash_key_symbol
+
+ruby_keyword_pattern_value(
+  unique int ruby_keyword_pattern: @ruby_keyword_pattern ref,
+  unique int value: @ruby_underscore_pattern_expr ref
+);
+
+ruby_keyword_pattern_def(
+  unique int id: @ruby_keyword_pattern,
+  int key__: @ruby_keyword_pattern_key_type ref
+);
+
+@ruby_lambda_body_type = @ruby_block | @ruby_do_block
+
+ruby_lambda_parameters(
+  unique int ruby_lambda: @ruby_lambda ref,
+  unique int parameters: @ruby_lambda_parameters ref
+);
+
+ruby_lambda_def(
+  unique int id: @ruby_lambda,
+  int body: @ruby_lambda_body_type ref
+);
+
+@ruby_lambda_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_lambda_parameters, index]
+ruby_lambda_parameters_child(
+  int ruby_lambda_parameters: @ruby_lambda_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_lambda_parameters_child_type ref
+);
+
+ruby_lambda_parameters_def(
+  unique int id: @ruby_lambda_parameters
+);
+
+@ruby_left_assignment_list_child_type = @ruby_destructured_left_assignment | @ruby_rest_assignment | @ruby_underscore_lhs
+
+#keyset[ruby_left_assignment_list, index]
+ruby_left_assignment_list_child(
+  int ruby_left_assignment_list: @ruby_left_assignment_list ref,
+  int index: int ref,
+  unique int child: @ruby_left_assignment_list_child_type ref
+);
+
+ruby_left_assignment_list_def(
+  unique int id: @ruby_left_assignment_list
+);
+
+@ruby_method_body_type = @ruby_body_statement | @ruby_rescue_modifier | @ruby_underscore_arg
+
+ruby_method_body(
+  unique int ruby_method: @ruby_method ref,
+  unique int body: @ruby_method_body_type ref
+);
+
+ruby_method_parameters(
+  unique int ruby_method: @ruby_method ref,
+  unique int parameters: @ruby_method_parameters ref
+);
+
+ruby_method_def(
+  unique int id: @ruby_method,
+  int name: @ruby_underscore_method_name ref
+);
+
+@ruby_method_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_method_parameters, index]
+ruby_method_parameters_child(
+  int ruby_method_parameters: @ruby_method_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_method_parameters_child_type ref
+);
+
+ruby_method_parameters_def(
+  unique int id: @ruby_method_parameters
+);
+
+ruby_module_body(
+  unique int ruby_module: @ruby_module ref,
+  unique int body: @ruby_body_statement ref
+);
+
+@ruby_module_name_type = @ruby_scope_resolution | @ruby_token_constant
+
+ruby_module_def(
+  unique int id: @ruby_module,
+  int name: @ruby_module_name_type ref
+);
+
+ruby_next_child(
+  unique int ruby_next: @ruby_next ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_next_def(
+  unique int id: @ruby_next
+);
+
+case @ruby_operator_assignment.operator of
+  0 = @ruby_operator_assignment_percentequal
+| 1 = @ruby_operator_assignment_ampersandampersandequal
+| 2 = @ruby_operator_assignment_ampersandequal
+| 3 = @ruby_operator_assignment_starstarequal
+| 4 = @ruby_operator_assignment_starequal
+| 5 = @ruby_operator_assignment_plusequal
+| 6 = @ruby_operator_assignment_minusequal
+| 7 = @ruby_operator_assignment_slashequal
+| 8 = @ruby_operator_assignment_langlelangleequal
+| 9 = @ruby_operator_assignment_ranglerangleequal
+| 10 = @ruby_operator_assignment_caretequal
+| 11 = @ruby_operator_assignment_pipeequal
+| 12 = @ruby_operator_assignment_pipepipeequal
+;
+
+
+@ruby_operator_assignment_right_type = @ruby_rescue_modifier | @ruby_underscore_expression
+
+ruby_operator_assignment_def(
+  unique int id: @ruby_operator_assignment,
+  int left: @ruby_underscore_lhs ref,
+  int operator: int ref,
+  int right: @ruby_operator_assignment_right_type ref
+);
+
+ruby_optional_parameter_def(
+  unique int id: @ruby_optional_parameter,
+  int name: @ruby_token_identifier ref,
+  int value: @ruby_underscore_arg ref
+);
+
+@ruby_pair_key_type = @ruby_string__ | @ruby_token_hash_key_symbol | @ruby_underscore_arg
+
+ruby_pair_value(
+  unique int ruby_pair: @ruby_pair ref,
+  unique int value: @ruby_underscore_arg ref
+);
+
+ruby_pair_def(
+  unique int id: @ruby_pair,
+  int key__: @ruby_pair_key_type ref
+);
+
+ruby_parenthesized_pattern_def(
+  unique int id: @ruby_parenthesized_pattern,
+  int child: @ruby_underscore_pattern_expr ref
+);
+
+@ruby_parenthesized_statements_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_parenthesized_statements, index]
+ruby_parenthesized_statements_child(
+  int ruby_parenthesized_statements: @ruby_parenthesized_statements ref,
+  int index: int ref,
+  unique int child: @ruby_parenthesized_statements_child_type ref
+);
+
+ruby_parenthesized_statements_def(
+  unique int id: @ruby_parenthesized_statements
+);
+
+@ruby_pattern_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+ruby_pattern_def(
+  unique int id: @ruby_pattern,
+  int child: @ruby_pattern_child_type ref
+);
+
+@ruby_program_child_type = @ruby_token_empty_statement | @ruby_token_uninterpreted | @ruby_underscore_statement
+
+#keyset[ruby_program, index]
+ruby_program_child(
+  int ruby_program: @ruby_program ref,
+  int index: int ref,
+  unique int child: @ruby_program_child_type ref
+);
+
+ruby_program_def(
+  unique int id: @ruby_program
+);
+
+@ruby_range_begin_type = @ruby_underscore_arg | @ruby_underscore_pattern_primitive
+
+ruby_range_begin(
+  unique int ruby_range: @ruby_range ref,
+  unique int begin: @ruby_range_begin_type ref
+);
+
+@ruby_range_end_type = @ruby_underscore_arg | @ruby_underscore_pattern_primitive
+
+ruby_range_end(
+  unique int ruby_range: @ruby_range ref,
+  unique int end: @ruby_range_end_type ref
+);
+
+case @ruby_range.operator of
+  0 = @ruby_range_dotdot
+| 1 = @ruby_range_dotdotdot
+;
+
+
+ruby_range_def(
+  unique int id: @ruby_range,
+  int operator: int ref
+);
+
+@ruby_rational_child_type = @ruby_token_float | @ruby_token_integer
+
+ruby_rational_def(
+  unique int id: @ruby_rational,
+  int child: @ruby_rational_child_type ref
+);
+
+ruby_redo_child(
+  unique int ruby_redo: @ruby_redo ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_redo_def(
+  unique int id: @ruby_redo
+);
+
+@ruby_regex_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_regex, index]
+ruby_regex_child(
+  int ruby_regex: @ruby_regex ref,
+  int index: int ref,
+  unique int child: @ruby_regex_child_type ref
+);
+
+ruby_regex_def(
+  unique int id: @ruby_regex
+);
+
+ruby_rescue_body(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int body: @ruby_then ref
+);
+
+ruby_rescue_exceptions(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int exceptions: @ruby_exceptions ref
+);
+
+ruby_rescue_variable(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int variable: @ruby_exception_variable ref
+);
+
+ruby_rescue_def(
+  unique int id: @ruby_rescue
+);
+
+@ruby_rescue_modifier_body_type = @ruby_underscore_arg | @ruby_underscore_statement
+
+ruby_rescue_modifier_def(
+  unique int id: @ruby_rescue_modifier,
+  int body: @ruby_rescue_modifier_body_type ref,
+  int handler: @ruby_underscore_expression ref
+);
+
+ruby_rest_assignment_child(
+  unique int ruby_rest_assignment: @ruby_rest_assignment ref,
+  unique int child: @ruby_underscore_lhs ref
+);
+
+ruby_rest_assignment_def(
+  unique int id: @ruby_rest_assignment
+);
+
+ruby_retry_child(
+  unique int ruby_retry: @ruby_retry ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_retry_def(
+  unique int id: @ruby_retry
+);
+
+ruby_return_child(
+  unique int ruby_return: @ruby_return ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_return_def(
+  unique int id: @ruby_return
+);
+
+@ruby_right_assignment_list_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+#keyset[ruby_right_assignment_list, index]
+ruby_right_assignment_list_child(
+  int ruby_right_assignment_list: @ruby_right_assignment_list ref,
+  int index: int ref,
+  unique int child: @ruby_right_assignment_list_child_type ref
+);
+
+ruby_right_assignment_list_def(
+  unique int id: @ruby_right_assignment_list
+);
+
+@ruby_scope_resolution_scope_type = @ruby_underscore_pattern_constant | @ruby_underscore_primary
+
+ruby_scope_resolution_scope(
+  unique int ruby_scope_resolution: @ruby_scope_resolution ref,
+  unique int scope: @ruby_scope_resolution_scope_type ref
+);
+
+ruby_scope_resolution_def(
+  unique int id: @ruby_scope_resolution,
+  int name: @ruby_token_constant ref
+);
+
+ruby_setter_def(
+  unique int id: @ruby_setter,
+  int name: @ruby_token_identifier ref
+);
+
+ruby_singleton_class_body(
+  unique int ruby_singleton_class: @ruby_singleton_class ref,
+  unique int body: @ruby_body_statement ref
+);
+
+ruby_singleton_class_def(
+  unique int id: @ruby_singleton_class,
+  int value: @ruby_underscore_arg ref
+);
+
+@ruby_singleton_method_body_type = @ruby_body_statement | @ruby_rescue_modifier | @ruby_underscore_arg
+
+ruby_singleton_method_body(
+  unique int ruby_singleton_method: @ruby_singleton_method ref,
+  unique int body: @ruby_singleton_method_body_type ref
+);
+
+@ruby_singleton_method_object_type = @ruby_underscore_arg | @ruby_underscore_variable
+
+ruby_singleton_method_parameters(
+  unique int ruby_singleton_method: @ruby_singleton_method ref,
+  unique int parameters: @ruby_method_parameters ref
+);
+
+ruby_singleton_method_def(
+  unique int id: @ruby_singleton_method,
+  int name: @ruby_underscore_method_name ref,
+  int object: @ruby_singleton_method_object_type ref
+);
+
+ruby_splat_argument_def(
+  unique int id: @ruby_splat_argument,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_splat_parameter_name(
+  unique int ruby_splat_parameter: @ruby_splat_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_splat_parameter_def(
+  unique int id: @ruby_splat_parameter
+);
+
+@ruby_string_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_string__, index]
+ruby_string_child(
+  int ruby_string__: @ruby_string__ ref,
+  int index: int ref,
+  unique int child: @ruby_string_child_type ref
+);
+
+ruby_string_def(
+  unique int id: @ruby_string__
+);
+
+#keyset[ruby_string_array, index]
+ruby_string_array_child(
+  int ruby_string_array: @ruby_string_array ref,
+  int index: int ref,
+  unique int child: @ruby_bare_string ref
+);
+
+ruby_string_array_def(
+  unique int id: @ruby_string_array
+);
+
+@ruby_subshell_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_subshell, index]
+ruby_subshell_child(
+  int ruby_subshell: @ruby_subshell ref,
+  int index: int ref,
+  unique int child: @ruby_subshell_child_type ref
+);
+
+ruby_subshell_def(
+  unique int id: @ruby_subshell
+);
+
+ruby_superclass_def(
+  unique int id: @ruby_superclass,
+  int child: @ruby_underscore_expression ref
+);
+
+#keyset[ruby_symbol_array, index]
+ruby_symbol_array_child(
+  int ruby_symbol_array: @ruby_symbol_array ref,
+  int index: int ref,
+  unique int child: @ruby_bare_symbol ref
+);
+
+ruby_symbol_array_def(
+  unique int id: @ruby_symbol_array
+);
+
+@ruby_then_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_then, index]
+ruby_then_child(
+  int ruby_then: @ruby_then ref,
+  int index: int ref,
+  unique int child: @ruby_then_child_type ref
+);
+
+ruby_then_def(
+  unique int id: @ruby_then
+);
+
+@ruby_unary_operand_type = @ruby_parenthesized_statements | @ruby_underscore_expression | @ruby_underscore_simple_numeric
+
+case @ruby_unary.operator of
+  0 = @ruby_unary_bang
+| 1 = @ruby_unary_plus
+| 2 = @ruby_unary_minus
+| 3 = @ruby_unary_definedquestion
+| 4 = @ruby_unary_not
+| 5 = @ruby_unary_tilde
+;
+
+
+ruby_unary_def(
+  unique int id: @ruby_unary,
+  int operand: @ruby_unary_operand_type ref,
+  int operator: int ref
+);
+
+#keyset[ruby_undef, index]
+ruby_undef_child(
+  int ruby_undef: @ruby_undef ref,
+  int index: int ref,
+  unique int child: @ruby_underscore_method_name ref
+);
+
+ruby_undef_def(
+  unique int id: @ruby_undef
+);
+
+@ruby_unless_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_unless_alternative(
+  unique int ruby_unless: @ruby_unless ref,
+  unique int alternative: @ruby_unless_alternative_type ref
+);
+
+ruby_unless_consequence(
+  unique int ruby_unless: @ruby_unless ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_unless_def(
+  unique int id: @ruby_unless,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_unless_guard_def(
+  unique int id: @ruby_unless_guard,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_unless_modifier_def(
+  unique int id: @ruby_unless_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_until_def(
+  unique int id: @ruby_until,
+  int body: @ruby_do ref,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_until_modifier_def(
+  unique int id: @ruby_until_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+@ruby_variable_reference_pattern_name_type = @ruby_token_identifier | @ruby_underscore_nonlocal_variable
+
+ruby_variable_reference_pattern_def(
+  unique int id: @ruby_variable_reference_pattern,
+  int name: @ruby_variable_reference_pattern_name_type ref
+);
+
+ruby_when_body(
+  unique int ruby_when: @ruby_when ref,
+  unique int body: @ruby_then ref
+);
+
+#keyset[ruby_when, index]
+ruby_when_pattern(
+  int ruby_when: @ruby_when ref,
+  int index: int ref,
+  unique int pattern: @ruby_pattern ref
+);
+
+ruby_when_def(
+  unique int id: @ruby_when
+);
+
+ruby_while_def(
+  unique int id: @ruby_while,
+  int body: @ruby_do ref,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_while_modifier_def(
+  unique int id: @ruby_while_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_yield_child(
+  unique int ruby_yield: @ruby_yield ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_yield_def(
+  unique int id: @ruby_yield
+);
+
+ruby_tokeninfo(
+  unique int id: @ruby_token,
+  int kind: int ref,
+  string value: string ref
+);
+
+case @ruby_token.kind of
+  0 = @ruby_reserved_word
+| 1 = @ruby_token_character
+| 2 = @ruby_token_class_variable
+| 3 = @ruby_token_comment
+| 4 = @ruby_token_constant
+| 5 = @ruby_token_empty_statement
+| 6 = @ruby_token_encoding
+| 7 = @ruby_token_escape_sequence
+| 8 = @ruby_token_false
+| 9 = @ruby_token_file
+| 10 = @ruby_token_float
+| 11 = @ruby_token_forward_argument
+| 12 = @ruby_token_forward_parameter
+| 13 = @ruby_token_global_variable
+| 14 = @ruby_token_hash_key_symbol
+| 15 = @ruby_token_hash_splat_nil
+| 16 = @ruby_token_heredoc_beginning
+| 17 = @ruby_token_heredoc_content
+| 18 = @ruby_token_heredoc_end
+| 19 = @ruby_token_identifier
+| 20 = @ruby_token_instance_variable
+| 21 = @ruby_token_integer
+| 22 = @ruby_token_line
+| 23 = @ruby_token_nil
+| 24 = @ruby_token_operator
+| 25 = @ruby_token_self
+| 26 = @ruby_token_simple_symbol
+| 27 = @ruby_token_string_content
+| 28 = @ruby_token_super
+| 29 = @ruby_token_true
+| 30 = @ruby_token_uninterpreted
+;
+
+
+@ruby_ast_node = @ruby_alias | @ruby_alternative_pattern | @ruby_argument_list | @ruby_array | @ruby_array_pattern | @ruby_as_pattern | @ruby_assignment | @ruby_bare_string | @ruby_bare_symbol | @ruby_begin | @ruby_begin_block | @ruby_binary | @ruby_block | @ruby_block_argument | @ruby_block_body | @ruby_block_parameter | @ruby_block_parameters | @ruby_body_statement | @ruby_break | @ruby_call | @ruby_case__ | @ruby_case_match | @ruby_chained_string | @ruby_class | @ruby_complex | @ruby_conditional | @ruby_delimited_symbol | @ruby_destructured_left_assignment | @ruby_destructured_parameter | @ruby_do | @ruby_do_block | @ruby_element_reference | @ruby_else | @ruby_elsif | @ruby_end_block | @ruby_ensure | @ruby_exception_variable | @ruby_exceptions | @ruby_expression_reference_pattern | @ruby_find_pattern | @ruby_for | @ruby_hash | @ruby_hash_pattern | @ruby_hash_splat_argument | @ruby_hash_splat_parameter | @ruby_heredoc_body | @ruby_if | @ruby_if_guard | @ruby_if_modifier | @ruby_in | @ruby_in_clause | @ruby_interpolation | @ruby_keyword_parameter | @ruby_keyword_pattern | @ruby_lambda | @ruby_lambda_parameters | @ruby_left_assignment_list | @ruby_method | @ruby_method_parameters | @ruby_module | @ruby_next | @ruby_operator_assignment | @ruby_optional_parameter | @ruby_pair | @ruby_parenthesized_pattern | @ruby_parenthesized_statements | @ruby_pattern | @ruby_program | @ruby_range | @ruby_rational | @ruby_redo | @ruby_regex | @ruby_rescue | @ruby_rescue_modifier | @ruby_rest_assignment | @ruby_retry | @ruby_return | @ruby_right_assignment_list | @ruby_scope_resolution | @ruby_setter | @ruby_singleton_class | @ruby_singleton_method | @ruby_splat_argument | @ruby_splat_parameter | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_superclass | @ruby_symbol_array | @ruby_then | @ruby_token | @ruby_unary | @ruby_undef | @ruby_unless | @ruby_unless_guard | @ruby_unless_modifier | @ruby_until | @ruby_until_modifier | @ruby_variable_reference_pattern | @ruby_when | @ruby_while | @ruby_while_modifier | @ruby_yield
+
+@ruby_ast_node_parent = @file | @ruby_ast_node
+
+#keyset[parent, parent_index]
+ruby_ast_node_info(
+  unique int node: @ruby_ast_node ref,
+  int parent: @ruby_ast_node_parent ref,
+  int parent_index: int ref,
+  int loc: @location ref
+);
+
+erb_comment_directive_child(
+  unique int erb_comment_directive: @erb_comment_directive ref,
+  unique int child: @erb_token_comment ref
+);
+
+erb_comment_directive_def(
+  unique int id: @erb_comment_directive
+);
+
+erb_directive_child(
+  unique int erb_directive: @erb_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_directive_def(
+  unique int id: @erb_directive
+);
+
+erb_graphql_directive_child(
+  unique int erb_graphql_directive: @erb_graphql_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_graphql_directive_def(
+  unique int id: @erb_graphql_directive
+);
+
+erb_output_directive_child(
+  unique int erb_output_directive: @erb_output_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_output_directive_def(
+  unique int id: @erb_output_directive
+);
+
+@erb_template_child_type = @erb_comment_directive | @erb_directive | @erb_graphql_directive | @erb_output_directive | @erb_token_content
+
+#keyset[erb_template, index]
+erb_template_child(
+  int erb_template: @erb_template ref,
+  int index: int ref,
+  unique int child: @erb_template_child_type ref
+);
+
+erb_template_def(
+  unique int id: @erb_template
+);
+
+erb_tokeninfo(
+  unique int id: @erb_token,
+  int kind: int ref,
+  string value: string ref
+);
+
+case @erb_token.kind of
+  0 = @erb_reserved_word
+| 1 = @erb_token_code
+| 2 = @erb_token_comment
+| 3 = @erb_token_content
+;
+
+
+@erb_ast_node = @erb_comment_directive | @erb_directive | @erb_graphql_directive | @erb_output_directive | @erb_template | @erb_token
+
+@erb_ast_node_parent = @erb_ast_node | @file
+
+#keyset[parent, parent_index]
+erb_ast_node_info(
+  unique int node: @erb_ast_node ref,
+  int parent: @erb_ast_node_parent ref,
+  int parent_index: int ref,
+  int loc: @location ref
+);
+
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby.dbscheme b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby.dbscheme
new file mode 100644
index 00000000000..4ba51641799
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby.dbscheme
@@ -0,0 +1,1433 @@
+// CodeQL database schema for Ruby
+// Automatically generated from the tree-sitter grammar; do not edit
+
+@location = @location_default
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int start_line: int ref,
+  int start_column: int ref,
+  int end_line: int ref,
+  int end_column: int ref
+);
+
+files(
+  unique int id: @file,
+  string name: string ref
+);
+
+folders(
+  unique int id: @folder,
+  string name: string ref
+);
+
+@container = @file | @folder
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref
+);
+
+sourceLocationPrefix(
+  string prefix: string ref
+);
+
+diagnostics(
+  unique int id: @diagnostic,
+  int severity: int ref,
+  string error_tag: string ref,
+  string error_message: string ref,
+  string full_error_message: string ref,
+  int location: @location_default ref
+);
+
+case @diagnostic.severity of
+  10 = @diagnostic_debug
+| 20 = @diagnostic_info
+| 30 = @diagnostic_warning
+| 40 = @diagnostic_error
+;
+
+
+@ruby_underscore_arg = @ruby_assignment | @ruby_binary | @ruby_conditional | @ruby_operator_assignment | @ruby_range | @ruby_unary | @ruby_underscore_primary
+
+@ruby_underscore_call_operator = @ruby_reserved_word
+
+@ruby_underscore_expression = @ruby_assignment | @ruby_binary | @ruby_break | @ruby_call | @ruby_next | @ruby_operator_assignment | @ruby_return | @ruby_unary | @ruby_underscore_arg | @ruby_yield
+
+@ruby_underscore_lhs = @ruby_call | @ruby_element_reference | @ruby_scope_resolution | @ruby_token_false | @ruby_token_nil | @ruby_token_true | @ruby_underscore_variable
+
+@ruby_underscore_method_name = @ruby_delimited_symbol | @ruby_setter | @ruby_token_constant | @ruby_token_identifier | @ruby_token_operator | @ruby_token_simple_symbol | @ruby_underscore_nonlocal_variable
+
+@ruby_underscore_nonlocal_variable = @ruby_token_class_variable | @ruby_token_global_variable | @ruby_token_instance_variable
+
+@ruby_underscore_pattern_constant = @ruby_scope_resolution | @ruby_token_constant
+
+@ruby_underscore_pattern_expr = @ruby_alternative_pattern | @ruby_as_pattern | @ruby_underscore_pattern_expr_basic
+
+@ruby_underscore_pattern_expr_basic = @ruby_array_pattern | @ruby_expression_reference_pattern | @ruby_find_pattern | @ruby_hash_pattern | @ruby_parenthesized_pattern | @ruby_range | @ruby_token_identifier | @ruby_underscore_pattern_constant | @ruby_underscore_pattern_primitive | @ruby_variable_reference_pattern
+
+@ruby_underscore_pattern_primitive = @ruby_delimited_symbol | @ruby_lambda | @ruby_regex | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_symbol_array | @ruby_token_encoding | @ruby_token_false | @ruby_token_file | @ruby_token_heredoc_beginning | @ruby_token_line | @ruby_token_nil | @ruby_token_self | @ruby_token_simple_symbol | @ruby_token_true | @ruby_unary | @ruby_underscore_simple_numeric
+
+@ruby_underscore_pattern_top_expr_body = @ruby_array_pattern | @ruby_find_pattern | @ruby_hash_pattern | @ruby_underscore_pattern_expr
+
+@ruby_underscore_primary = @ruby_array | @ruby_begin | @ruby_break | @ruby_call | @ruby_case__ | @ruby_case_match | @ruby_chained_string | @ruby_class | @ruby_delimited_symbol | @ruby_for | @ruby_hash | @ruby_if | @ruby_lambda | @ruby_method | @ruby_module | @ruby_next | @ruby_parenthesized_statements | @ruby_redo | @ruby_regex | @ruby_retry | @ruby_return | @ruby_singleton_class | @ruby_singleton_method | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_symbol_array | @ruby_token_character | @ruby_token_heredoc_beginning | @ruby_token_simple_symbol | @ruby_unary | @ruby_underscore_lhs | @ruby_underscore_simple_numeric | @ruby_unless | @ruby_until | @ruby_while | @ruby_yield
+
+@ruby_underscore_simple_numeric = @ruby_complex | @ruby_rational | @ruby_token_float | @ruby_token_integer
+
+@ruby_underscore_statement = @ruby_alias | @ruby_begin_block | @ruby_end_block | @ruby_if_modifier | @ruby_rescue_modifier | @ruby_undef | @ruby_underscore_expression | @ruby_unless_modifier | @ruby_until_modifier | @ruby_while_modifier
+
+@ruby_underscore_variable = @ruby_token_constant | @ruby_token_identifier | @ruby_token_self | @ruby_token_super | @ruby_underscore_nonlocal_variable
+
+ruby_alias_def(
+  unique int id: @ruby_alias,
+  int alias: @ruby_underscore_method_name ref,
+  int name: @ruby_underscore_method_name ref
+);
+
+#keyset[ruby_alternative_pattern, index]
+ruby_alternative_pattern_alternatives(
+  int ruby_alternative_pattern: @ruby_alternative_pattern ref,
+  int index: int ref,
+  unique int alternatives: @ruby_underscore_pattern_expr_basic ref
+);
+
+ruby_alternative_pattern_def(
+  unique int id: @ruby_alternative_pattern
+);
+
+@ruby_argument_list_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_argument_list, index]
+ruby_argument_list_child(
+  int ruby_argument_list: @ruby_argument_list ref,
+  int index: int ref,
+  unique int child: @ruby_argument_list_child_type ref
+);
+
+ruby_argument_list_def(
+  unique int id: @ruby_argument_list
+);
+
+@ruby_array_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_array, index]
+ruby_array_child(
+  int ruby_array: @ruby_array ref,
+  int index: int ref,
+  unique int child: @ruby_array_child_type ref
+);
+
+ruby_array_def(
+  unique int id: @ruby_array
+);
+
+ruby_array_pattern_class(
+  unique int ruby_array_pattern: @ruby_array_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_array_pattern_child_type = @ruby_splat_parameter | @ruby_underscore_pattern_expr
+
+#keyset[ruby_array_pattern, index]
+ruby_array_pattern_child(
+  int ruby_array_pattern: @ruby_array_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_array_pattern_child_type ref
+);
+
+ruby_array_pattern_def(
+  unique int id: @ruby_array_pattern
+);
+
+ruby_as_pattern_def(
+  unique int id: @ruby_as_pattern,
+  int name: @ruby_token_identifier ref,
+  int value: @ruby_underscore_pattern_expr ref
+);
+
+@ruby_assignment_left_type = @ruby_left_assignment_list | @ruby_underscore_lhs
+
+@ruby_assignment_right_type = @ruby_rescue_modifier | @ruby_right_assignment_list | @ruby_splat_argument | @ruby_underscore_expression
+
+ruby_assignment_def(
+  unique int id: @ruby_assignment,
+  int left: @ruby_assignment_left_type ref,
+  int right: @ruby_assignment_right_type ref
+);
+
+@ruby_bare_string_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_bare_string, index]
+ruby_bare_string_child(
+  int ruby_bare_string: @ruby_bare_string ref,
+  int index: int ref,
+  unique int child: @ruby_bare_string_child_type ref
+);
+
+ruby_bare_string_def(
+  unique int id: @ruby_bare_string
+);
+
+@ruby_bare_symbol_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_bare_symbol, index]
+ruby_bare_symbol_child(
+  int ruby_bare_symbol: @ruby_bare_symbol ref,
+  int index: int ref,
+  unique int child: @ruby_bare_symbol_child_type ref
+);
+
+ruby_bare_symbol_def(
+  unique int id: @ruby_bare_symbol
+);
+
+@ruby_begin_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_begin, index]
+ruby_begin_child(
+  int ruby_begin: @ruby_begin ref,
+  int index: int ref,
+  unique int child: @ruby_begin_child_type ref
+);
+
+ruby_begin_def(
+  unique int id: @ruby_begin
+);
+
+@ruby_begin_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_begin_block, index]
+ruby_begin_block_child(
+  int ruby_begin_block: @ruby_begin_block ref,
+  int index: int ref,
+  unique int child: @ruby_begin_block_child_type ref
+);
+
+ruby_begin_block_def(
+  unique int id: @ruby_begin_block
+);
+
+@ruby_binary_left_type = @ruby_underscore_expression | @ruby_underscore_simple_numeric
+
+case @ruby_binary.operator of
+  0 = @ruby_binary_bangequal
+| 1 = @ruby_binary_bangtilde
+| 2 = @ruby_binary_percent
+| 3 = @ruby_binary_ampersand
+| 4 = @ruby_binary_ampersandampersand
+| 5 = @ruby_binary_star
+| 6 = @ruby_binary_starstar
+| 7 = @ruby_binary_plus
+| 8 = @ruby_binary_minus
+| 9 = @ruby_binary_slash
+| 10 = @ruby_binary_langle
+| 11 = @ruby_binary_langlelangle
+| 12 = @ruby_binary_langleequal
+| 13 = @ruby_binary_langleequalrangle
+| 14 = @ruby_binary_equalequal
+| 15 = @ruby_binary_equalequalequal
+| 16 = @ruby_binary_equaltilde
+| 17 = @ruby_binary_rangle
+| 18 = @ruby_binary_rangleequal
+| 19 = @ruby_binary_ranglerangle
+| 20 = @ruby_binary_caret
+| 21 = @ruby_binary_and
+| 22 = @ruby_binary_or
+| 23 = @ruby_binary_pipe
+| 24 = @ruby_binary_pipepipe
+;
+
+
+ruby_binary_def(
+  unique int id: @ruby_binary,
+  int left: @ruby_binary_left_type ref,
+  int operator: int ref,
+  int right: @ruby_underscore_expression ref
+);
+
+ruby_block_parameters(
+  unique int ruby_block: @ruby_block ref,
+  unique int parameters: @ruby_block_parameters ref
+);
+
+@ruby_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_block, index]
+ruby_block_child(
+  int ruby_block: @ruby_block ref,
+  int index: int ref,
+  unique int child: @ruby_block_child_type ref
+);
+
+ruby_block_def(
+  unique int id: @ruby_block
+);
+
+ruby_block_argument_child(
+  unique int ruby_block_argument: @ruby_block_argument ref,
+  unique int child: @ruby_underscore_arg ref
+);
+
+ruby_block_argument_def(
+  unique int id: @ruby_block_argument
+);
+
+ruby_block_parameter_name(
+  unique int ruby_block_parameter: @ruby_block_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_block_parameter_def(
+  unique int id: @ruby_block_parameter
+);
+
+#keyset[ruby_block_parameters, index]
+ruby_block_parameters_locals(
+  int ruby_block_parameters: @ruby_block_parameters ref,
+  int index: int ref,
+  unique int locals: @ruby_token_identifier ref
+);
+
+@ruby_block_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_block_parameters, index]
+ruby_block_parameters_child(
+  int ruby_block_parameters: @ruby_block_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_block_parameters_child_type ref
+);
+
+ruby_block_parameters_def(
+  unique int id: @ruby_block_parameters
+);
+
+ruby_break_child(
+  unique int ruby_break: @ruby_break ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_break_def(
+  unique int id: @ruby_break
+);
+
+ruby_call_arguments(
+  unique int ruby_call: @ruby_call ref,
+  unique int arguments: @ruby_argument_list ref
+);
+
+@ruby_call_block_type = @ruby_block | @ruby_do_block
+
+ruby_call_block(
+  unique int ruby_call: @ruby_call ref,
+  unique int block: @ruby_call_block_type ref
+);
+
+@ruby_call_method_type = @ruby_token_operator | @ruby_underscore_variable
+
+ruby_call_method(
+  unique int ruby_call: @ruby_call ref,
+  unique int method: @ruby_call_method_type ref
+);
+
+ruby_call_operator(
+  unique int ruby_call: @ruby_call ref,
+  unique int operator: @ruby_underscore_call_operator ref
+);
+
+ruby_call_receiver(
+  unique int ruby_call: @ruby_call ref,
+  unique int receiver: @ruby_underscore_primary ref
+);
+
+ruby_call_def(
+  unique int id: @ruby_call
+);
+
+ruby_case_value(
+  unique int ruby_case__: @ruby_case__ ref,
+  unique int value: @ruby_underscore_statement ref
+);
+
+@ruby_case_child_type = @ruby_else | @ruby_when
+
+#keyset[ruby_case__, index]
+ruby_case_child(
+  int ruby_case__: @ruby_case__ ref,
+  int index: int ref,
+  unique int child: @ruby_case_child_type ref
+);
+
+ruby_case_def(
+  unique int id: @ruby_case__
+);
+
+#keyset[ruby_case_match, index]
+ruby_case_match_clauses(
+  int ruby_case_match: @ruby_case_match ref,
+  int index: int ref,
+  unique int clauses: @ruby_in_clause ref
+);
+
+ruby_case_match_else(
+  unique int ruby_case_match: @ruby_case_match ref,
+  unique int else: @ruby_else ref
+);
+
+ruby_case_match_def(
+  unique int id: @ruby_case_match,
+  int value: @ruby_underscore_statement ref
+);
+
+#keyset[ruby_chained_string, index]
+ruby_chained_string_child(
+  int ruby_chained_string: @ruby_chained_string ref,
+  int index: int ref,
+  unique int child: @ruby_string__ ref
+);
+
+ruby_chained_string_def(
+  unique int id: @ruby_chained_string
+);
+
+@ruby_class_name_type = @ruby_scope_resolution | @ruby_token_constant
+
+ruby_class_superclass(
+  unique int ruby_class: @ruby_class ref,
+  unique int superclass: @ruby_superclass ref
+);
+
+@ruby_class_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_class, index]
+ruby_class_child(
+  int ruby_class: @ruby_class ref,
+  int index: int ref,
+  unique int child: @ruby_class_child_type ref
+);
+
+ruby_class_def(
+  unique int id: @ruby_class,
+  int name: @ruby_class_name_type ref
+);
+
+@ruby_complex_child_type = @ruby_rational | @ruby_token_float | @ruby_token_integer
+
+ruby_complex_def(
+  unique int id: @ruby_complex,
+  int child: @ruby_complex_child_type ref
+);
+
+ruby_conditional_def(
+  unique int id: @ruby_conditional,
+  int alternative: @ruby_underscore_arg ref,
+  int condition: @ruby_underscore_arg ref,
+  int consequence: @ruby_underscore_arg ref
+);
+
+@ruby_delimited_symbol_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_delimited_symbol, index]
+ruby_delimited_symbol_child(
+  int ruby_delimited_symbol: @ruby_delimited_symbol ref,
+  int index: int ref,
+  unique int child: @ruby_delimited_symbol_child_type ref
+);
+
+ruby_delimited_symbol_def(
+  unique int id: @ruby_delimited_symbol
+);
+
+@ruby_destructured_left_assignment_child_type = @ruby_destructured_left_assignment | @ruby_rest_assignment | @ruby_underscore_lhs
+
+#keyset[ruby_destructured_left_assignment, index]
+ruby_destructured_left_assignment_child(
+  int ruby_destructured_left_assignment: @ruby_destructured_left_assignment ref,
+  int index: int ref,
+  unique int child: @ruby_destructured_left_assignment_child_type ref
+);
+
+ruby_destructured_left_assignment_def(
+  unique int id: @ruby_destructured_left_assignment
+);
+
+@ruby_destructured_parameter_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_destructured_parameter, index]
+ruby_destructured_parameter_child(
+  int ruby_destructured_parameter: @ruby_destructured_parameter ref,
+  int index: int ref,
+  unique int child: @ruby_destructured_parameter_child_type ref
+);
+
+ruby_destructured_parameter_def(
+  unique int id: @ruby_destructured_parameter
+);
+
+@ruby_do_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_do, index]
+ruby_do_child(
+  int ruby_do: @ruby_do ref,
+  int index: int ref,
+  unique int child: @ruby_do_child_type ref
+);
+
+ruby_do_def(
+  unique int id: @ruby_do
+);
+
+ruby_do_block_parameters(
+  unique int ruby_do_block: @ruby_do_block ref,
+  unique int parameters: @ruby_block_parameters ref
+);
+
+@ruby_do_block_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_do_block, index]
+ruby_do_block_child(
+  int ruby_do_block: @ruby_do_block ref,
+  int index: int ref,
+  unique int child: @ruby_do_block_child_type ref
+);
+
+ruby_do_block_def(
+  unique int id: @ruby_do_block
+);
+
+@ruby_element_reference_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_element_reference, index]
+ruby_element_reference_child(
+  int ruby_element_reference: @ruby_element_reference ref,
+  int index: int ref,
+  unique int child: @ruby_element_reference_child_type ref
+);
+
+ruby_element_reference_def(
+  unique int id: @ruby_element_reference,
+  int object: @ruby_underscore_primary ref
+);
+
+@ruby_else_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_else, index]
+ruby_else_child(
+  int ruby_else: @ruby_else ref,
+  int index: int ref,
+  unique int child: @ruby_else_child_type ref
+);
+
+ruby_else_def(
+  unique int id: @ruby_else
+);
+
+@ruby_elsif_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_elsif_alternative(
+  unique int ruby_elsif: @ruby_elsif ref,
+  unique int alternative: @ruby_elsif_alternative_type ref
+);
+
+ruby_elsif_consequence(
+  unique int ruby_elsif: @ruby_elsif ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_elsif_def(
+  unique int id: @ruby_elsif,
+  int condition: @ruby_underscore_statement ref
+);
+
+@ruby_end_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_end_block, index]
+ruby_end_block_child(
+  int ruby_end_block: @ruby_end_block ref,
+  int index: int ref,
+  unique int child: @ruby_end_block_child_type ref
+);
+
+ruby_end_block_def(
+  unique int id: @ruby_end_block
+);
+
+@ruby_ensure_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_ensure, index]
+ruby_ensure_child(
+  int ruby_ensure: @ruby_ensure ref,
+  int index: int ref,
+  unique int child: @ruby_ensure_child_type ref
+);
+
+ruby_ensure_def(
+  unique int id: @ruby_ensure
+);
+
+ruby_exception_variable_def(
+  unique int id: @ruby_exception_variable,
+  int child: @ruby_underscore_lhs ref
+);
+
+@ruby_exceptions_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+#keyset[ruby_exceptions, index]
+ruby_exceptions_child(
+  int ruby_exceptions: @ruby_exceptions ref,
+  int index: int ref,
+  unique int child: @ruby_exceptions_child_type ref
+);
+
+ruby_exceptions_def(
+  unique int id: @ruby_exceptions
+);
+
+ruby_expression_reference_pattern_def(
+  unique int id: @ruby_expression_reference_pattern,
+  int value: @ruby_underscore_expression ref
+);
+
+ruby_find_pattern_class(
+  unique int ruby_find_pattern: @ruby_find_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_find_pattern_child_type = @ruby_splat_parameter | @ruby_underscore_pattern_expr
+
+#keyset[ruby_find_pattern, index]
+ruby_find_pattern_child(
+  int ruby_find_pattern: @ruby_find_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_find_pattern_child_type ref
+);
+
+ruby_find_pattern_def(
+  unique int id: @ruby_find_pattern
+);
+
+@ruby_for_pattern_type = @ruby_left_assignment_list | @ruby_underscore_lhs
+
+ruby_for_def(
+  unique int id: @ruby_for,
+  int body: @ruby_do ref,
+  int pattern: @ruby_for_pattern_type ref,
+  int value: @ruby_in ref
+);
+
+@ruby_hash_child_type = @ruby_hash_splat_argument | @ruby_pair
+
+#keyset[ruby_hash, index]
+ruby_hash_child(
+  int ruby_hash: @ruby_hash ref,
+  int index: int ref,
+  unique int child: @ruby_hash_child_type ref
+);
+
+ruby_hash_def(
+  unique int id: @ruby_hash
+);
+
+ruby_hash_pattern_class(
+  unique int ruby_hash_pattern: @ruby_hash_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_hash_pattern_child_type = @ruby_hash_splat_parameter | @ruby_keyword_pattern | @ruby_token_hash_splat_nil
+
+#keyset[ruby_hash_pattern, index]
+ruby_hash_pattern_child(
+  int ruby_hash_pattern: @ruby_hash_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_hash_pattern_child_type ref
+);
+
+ruby_hash_pattern_def(
+  unique int id: @ruby_hash_pattern
+);
+
+ruby_hash_splat_argument_def(
+  unique int id: @ruby_hash_splat_argument,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_hash_splat_parameter_name(
+  unique int ruby_hash_splat_parameter: @ruby_hash_splat_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_hash_splat_parameter_def(
+  unique int id: @ruby_hash_splat_parameter
+);
+
+@ruby_heredoc_body_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_heredoc_content | @ruby_token_heredoc_end
+
+#keyset[ruby_heredoc_body, index]
+ruby_heredoc_body_child(
+  int ruby_heredoc_body: @ruby_heredoc_body ref,
+  int index: int ref,
+  unique int child: @ruby_heredoc_body_child_type ref
+);
+
+ruby_heredoc_body_def(
+  unique int id: @ruby_heredoc_body
+);
+
+@ruby_if_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_if_alternative(
+  unique int ruby_if: @ruby_if ref,
+  unique int alternative: @ruby_if_alternative_type ref
+);
+
+ruby_if_consequence(
+  unique int ruby_if: @ruby_if ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_if_def(
+  unique int id: @ruby_if,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_if_guard_def(
+  unique int id: @ruby_if_guard,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_if_modifier_def(
+  unique int id: @ruby_if_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_in_def(
+  unique int id: @ruby_in,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_in_clause_body(
+  unique int ruby_in_clause: @ruby_in_clause ref,
+  unique int body: @ruby_then ref
+);
+
+@ruby_in_clause_guard_type = @ruby_if_guard | @ruby_unless_guard
+
+ruby_in_clause_guard(
+  unique int ruby_in_clause: @ruby_in_clause ref,
+  unique int guard: @ruby_in_clause_guard_type ref
+);
+
+ruby_in_clause_def(
+  unique int id: @ruby_in_clause,
+  int pattern: @ruby_underscore_pattern_top_expr_body ref
+);
+
+@ruby_interpolation_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_interpolation, index]
+ruby_interpolation_child(
+  int ruby_interpolation: @ruby_interpolation ref,
+  int index: int ref,
+  unique int child: @ruby_interpolation_child_type ref
+);
+
+ruby_interpolation_def(
+  unique int id: @ruby_interpolation
+);
+
+ruby_keyword_parameter_value(
+  unique int ruby_keyword_parameter: @ruby_keyword_parameter ref,
+  unique int value: @ruby_underscore_arg ref
+);
+
+ruby_keyword_parameter_def(
+  unique int id: @ruby_keyword_parameter,
+  int name: @ruby_token_identifier ref
+);
+
+@ruby_keyword_pattern_key_type = @ruby_string__ | @ruby_token_hash_key_symbol
+
+ruby_keyword_pattern_value(
+  unique int ruby_keyword_pattern: @ruby_keyword_pattern ref,
+  unique int value: @ruby_underscore_pattern_expr ref
+);
+
+ruby_keyword_pattern_def(
+  unique int id: @ruby_keyword_pattern,
+  int key__: @ruby_keyword_pattern_key_type ref
+);
+
+@ruby_lambda_body_type = @ruby_block | @ruby_do_block
+
+ruby_lambda_parameters(
+  unique int ruby_lambda: @ruby_lambda ref,
+  unique int parameters: @ruby_lambda_parameters ref
+);
+
+ruby_lambda_def(
+  unique int id: @ruby_lambda,
+  int body: @ruby_lambda_body_type ref
+);
+
+@ruby_lambda_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_lambda_parameters, index]
+ruby_lambda_parameters_child(
+  int ruby_lambda_parameters: @ruby_lambda_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_lambda_parameters_child_type ref
+);
+
+ruby_lambda_parameters_def(
+  unique int id: @ruby_lambda_parameters
+);
+
+@ruby_left_assignment_list_child_type = @ruby_destructured_left_assignment | @ruby_rest_assignment | @ruby_underscore_lhs
+
+#keyset[ruby_left_assignment_list, index]
+ruby_left_assignment_list_child(
+  int ruby_left_assignment_list: @ruby_left_assignment_list ref,
+  int index: int ref,
+  unique int child: @ruby_left_assignment_list_child_type ref
+);
+
+ruby_left_assignment_list_def(
+  unique int id: @ruby_left_assignment_list
+);
+
+ruby_method_parameters(
+  unique int ruby_method: @ruby_method ref,
+  unique int parameters: @ruby_method_parameters ref
+);
+
+@ruby_method_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_arg | @ruby_underscore_statement
+
+#keyset[ruby_method, index]
+ruby_method_child(
+  int ruby_method: @ruby_method ref,
+  int index: int ref,
+  unique int child: @ruby_method_child_type ref
+);
+
+ruby_method_def(
+  unique int id: @ruby_method,
+  int name: @ruby_underscore_method_name ref
+);
+
+@ruby_method_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_method_parameters, index]
+ruby_method_parameters_child(
+  int ruby_method_parameters: @ruby_method_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_method_parameters_child_type ref
+);
+
+ruby_method_parameters_def(
+  unique int id: @ruby_method_parameters
+);
+
+@ruby_module_name_type = @ruby_scope_resolution | @ruby_token_constant
+
+@ruby_module_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_module, index]
+ruby_module_child(
+  int ruby_module: @ruby_module ref,
+  int index: int ref,
+  unique int child: @ruby_module_child_type ref
+);
+
+ruby_module_def(
+  unique int id: @ruby_module,
+  int name: @ruby_module_name_type ref
+);
+
+ruby_next_child(
+  unique int ruby_next: @ruby_next ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_next_def(
+  unique int id: @ruby_next
+);
+
+case @ruby_operator_assignment.operator of
+  0 = @ruby_operator_assignment_percentequal
+| 1 = @ruby_operator_assignment_ampersandampersandequal
+| 2 = @ruby_operator_assignment_ampersandequal
+| 3 = @ruby_operator_assignment_starstarequal
+| 4 = @ruby_operator_assignment_starequal
+| 5 = @ruby_operator_assignment_plusequal
+| 6 = @ruby_operator_assignment_minusequal
+| 7 = @ruby_operator_assignment_slashequal
+| 8 = @ruby_operator_assignment_langlelangleequal
+| 9 = @ruby_operator_assignment_ranglerangleequal
+| 10 = @ruby_operator_assignment_caretequal
+| 11 = @ruby_operator_assignment_pipeequal
+| 12 = @ruby_operator_assignment_pipepipeequal
+;
+
+
+@ruby_operator_assignment_right_type = @ruby_rescue_modifier | @ruby_underscore_expression
+
+ruby_operator_assignment_def(
+  unique int id: @ruby_operator_assignment,
+  int left: @ruby_underscore_lhs ref,
+  int operator: int ref,
+  int right: @ruby_operator_assignment_right_type ref
+);
+
+ruby_optional_parameter_def(
+  unique int id: @ruby_optional_parameter,
+  int name: @ruby_token_identifier ref,
+  int value: @ruby_underscore_arg ref
+);
+
+@ruby_pair_key_type = @ruby_string__ | @ruby_token_hash_key_symbol | @ruby_underscore_arg
+
+ruby_pair_value(
+  unique int ruby_pair: @ruby_pair ref,
+  unique int value: @ruby_underscore_arg ref
+);
+
+ruby_pair_def(
+  unique int id: @ruby_pair,
+  int key__: @ruby_pair_key_type ref
+);
+
+ruby_parenthesized_pattern_def(
+  unique int id: @ruby_parenthesized_pattern,
+  int child: @ruby_underscore_pattern_expr ref
+);
+
+@ruby_parenthesized_statements_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_parenthesized_statements, index]
+ruby_parenthesized_statements_child(
+  int ruby_parenthesized_statements: @ruby_parenthesized_statements ref,
+  int index: int ref,
+  unique int child: @ruby_parenthesized_statements_child_type ref
+);
+
+ruby_parenthesized_statements_def(
+  unique int id: @ruby_parenthesized_statements
+);
+
+@ruby_pattern_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+ruby_pattern_def(
+  unique int id: @ruby_pattern,
+  int child: @ruby_pattern_child_type ref
+);
+
+@ruby_program_child_type = @ruby_token_empty_statement | @ruby_token_uninterpreted | @ruby_underscore_statement
+
+#keyset[ruby_program, index]
+ruby_program_child(
+  int ruby_program: @ruby_program ref,
+  int index: int ref,
+  unique int child: @ruby_program_child_type ref
+);
+
+ruby_program_def(
+  unique int id: @ruby_program
+);
+
+@ruby_range_begin_type = @ruby_underscore_arg | @ruby_underscore_pattern_primitive
+
+ruby_range_begin(
+  unique int ruby_range: @ruby_range ref,
+  unique int begin: @ruby_range_begin_type ref
+);
+
+@ruby_range_end_type = @ruby_underscore_arg | @ruby_underscore_pattern_primitive
+
+ruby_range_end(
+  unique int ruby_range: @ruby_range ref,
+  unique int end: @ruby_range_end_type ref
+);
+
+case @ruby_range.operator of
+  0 = @ruby_range_dotdot
+| 1 = @ruby_range_dotdotdot
+;
+
+
+ruby_range_def(
+  unique int id: @ruby_range,
+  int operator: int ref
+);
+
+@ruby_rational_child_type = @ruby_token_float | @ruby_token_integer
+
+ruby_rational_def(
+  unique int id: @ruby_rational,
+  int child: @ruby_rational_child_type ref
+);
+
+ruby_redo_child(
+  unique int ruby_redo: @ruby_redo ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_redo_def(
+  unique int id: @ruby_redo
+);
+
+@ruby_regex_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_regex, index]
+ruby_regex_child(
+  int ruby_regex: @ruby_regex ref,
+  int index: int ref,
+  unique int child: @ruby_regex_child_type ref
+);
+
+ruby_regex_def(
+  unique int id: @ruby_regex
+);
+
+ruby_rescue_body(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int body: @ruby_then ref
+);
+
+ruby_rescue_exceptions(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int exceptions: @ruby_exceptions ref
+);
+
+ruby_rescue_variable(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int variable: @ruby_exception_variable ref
+);
+
+ruby_rescue_def(
+  unique int id: @ruby_rescue
+);
+
+@ruby_rescue_modifier_body_type = @ruby_underscore_arg | @ruby_underscore_statement
+
+ruby_rescue_modifier_def(
+  unique int id: @ruby_rescue_modifier,
+  int body: @ruby_rescue_modifier_body_type ref,
+  int handler: @ruby_underscore_expression ref
+);
+
+ruby_rest_assignment_child(
+  unique int ruby_rest_assignment: @ruby_rest_assignment ref,
+  unique int child: @ruby_underscore_lhs ref
+);
+
+ruby_rest_assignment_def(
+  unique int id: @ruby_rest_assignment
+);
+
+ruby_retry_child(
+  unique int ruby_retry: @ruby_retry ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_retry_def(
+  unique int id: @ruby_retry
+);
+
+ruby_return_child(
+  unique int ruby_return: @ruby_return ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_return_def(
+  unique int id: @ruby_return
+);
+
+@ruby_right_assignment_list_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+#keyset[ruby_right_assignment_list, index]
+ruby_right_assignment_list_child(
+  int ruby_right_assignment_list: @ruby_right_assignment_list ref,
+  int index: int ref,
+  unique int child: @ruby_right_assignment_list_child_type ref
+);
+
+ruby_right_assignment_list_def(
+  unique int id: @ruby_right_assignment_list
+);
+
+@ruby_scope_resolution_scope_type = @ruby_underscore_pattern_constant | @ruby_underscore_primary
+
+ruby_scope_resolution_scope(
+  unique int ruby_scope_resolution: @ruby_scope_resolution ref,
+  unique int scope: @ruby_scope_resolution_scope_type ref
+);
+
+ruby_scope_resolution_def(
+  unique int id: @ruby_scope_resolution,
+  int name: @ruby_token_constant ref
+);
+
+ruby_setter_def(
+  unique int id: @ruby_setter,
+  int name: @ruby_token_identifier ref
+);
+
+@ruby_singleton_class_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_singleton_class, index]
+ruby_singleton_class_child(
+  int ruby_singleton_class: @ruby_singleton_class ref,
+  int index: int ref,
+  unique int child: @ruby_singleton_class_child_type ref
+);
+
+ruby_singleton_class_def(
+  unique int id: @ruby_singleton_class,
+  int value: @ruby_underscore_arg ref
+);
+
+@ruby_singleton_method_object_type = @ruby_underscore_arg | @ruby_underscore_variable
+
+ruby_singleton_method_parameters(
+  unique int ruby_singleton_method: @ruby_singleton_method ref,
+  unique int parameters: @ruby_method_parameters ref
+);
+
+@ruby_singleton_method_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_arg | @ruby_underscore_statement
+
+#keyset[ruby_singleton_method, index]
+ruby_singleton_method_child(
+  int ruby_singleton_method: @ruby_singleton_method ref,
+  int index: int ref,
+  unique int child: @ruby_singleton_method_child_type ref
+);
+
+ruby_singleton_method_def(
+  unique int id: @ruby_singleton_method,
+  int name: @ruby_underscore_method_name ref,
+  int object: @ruby_singleton_method_object_type ref
+);
+
+ruby_splat_argument_def(
+  unique int id: @ruby_splat_argument,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_splat_parameter_name(
+  unique int ruby_splat_parameter: @ruby_splat_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_splat_parameter_def(
+  unique int id: @ruby_splat_parameter
+);
+
+@ruby_string_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_string__, index]
+ruby_string_child(
+  int ruby_string__: @ruby_string__ ref,
+  int index: int ref,
+  unique int child: @ruby_string_child_type ref
+);
+
+ruby_string_def(
+  unique int id: @ruby_string__
+);
+
+#keyset[ruby_string_array, index]
+ruby_string_array_child(
+  int ruby_string_array: @ruby_string_array ref,
+  int index: int ref,
+  unique int child: @ruby_bare_string ref
+);
+
+ruby_string_array_def(
+  unique int id: @ruby_string_array
+);
+
+@ruby_subshell_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_subshell, index]
+ruby_subshell_child(
+  int ruby_subshell: @ruby_subshell ref,
+  int index: int ref,
+  unique int child: @ruby_subshell_child_type ref
+);
+
+ruby_subshell_def(
+  unique int id: @ruby_subshell
+);
+
+ruby_superclass_def(
+  unique int id: @ruby_superclass,
+  int child: @ruby_underscore_expression ref
+);
+
+#keyset[ruby_symbol_array, index]
+ruby_symbol_array_child(
+  int ruby_symbol_array: @ruby_symbol_array ref,
+  int index: int ref,
+  unique int child: @ruby_bare_symbol ref
+);
+
+ruby_symbol_array_def(
+  unique int id: @ruby_symbol_array
+);
+
+@ruby_then_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_then, index]
+ruby_then_child(
+  int ruby_then: @ruby_then ref,
+  int index: int ref,
+  unique int child: @ruby_then_child_type ref
+);
+
+ruby_then_def(
+  unique int id: @ruby_then
+);
+
+@ruby_unary_operand_type = @ruby_parenthesized_statements | @ruby_underscore_expression | @ruby_underscore_simple_numeric
+
+case @ruby_unary.operator of
+  0 = @ruby_unary_bang
+| 1 = @ruby_unary_plus
+| 2 = @ruby_unary_minus
+| 3 = @ruby_unary_definedquestion
+| 4 = @ruby_unary_not
+| 5 = @ruby_unary_tilde
+;
+
+
+ruby_unary_def(
+  unique int id: @ruby_unary,
+  int operand: @ruby_unary_operand_type ref,
+  int operator: int ref
+);
+
+#keyset[ruby_undef, index]
+ruby_undef_child(
+  int ruby_undef: @ruby_undef ref,
+  int index: int ref,
+  unique int child: @ruby_underscore_method_name ref
+);
+
+ruby_undef_def(
+  unique int id: @ruby_undef
+);
+
+@ruby_unless_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_unless_alternative(
+  unique int ruby_unless: @ruby_unless ref,
+  unique int alternative: @ruby_unless_alternative_type ref
+);
+
+ruby_unless_consequence(
+  unique int ruby_unless: @ruby_unless ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_unless_def(
+  unique int id: @ruby_unless,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_unless_guard_def(
+  unique int id: @ruby_unless_guard,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_unless_modifier_def(
+  unique int id: @ruby_unless_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_until_def(
+  unique int id: @ruby_until,
+  int body: @ruby_do ref,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_until_modifier_def(
+  unique int id: @ruby_until_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+@ruby_variable_reference_pattern_name_type = @ruby_token_identifier | @ruby_underscore_nonlocal_variable
+
+ruby_variable_reference_pattern_def(
+  unique int id: @ruby_variable_reference_pattern,
+  int name: @ruby_variable_reference_pattern_name_type ref
+);
+
+ruby_when_body(
+  unique int ruby_when: @ruby_when ref,
+  unique int body: @ruby_then ref
+);
+
+#keyset[ruby_when, index]
+ruby_when_pattern(
+  int ruby_when: @ruby_when ref,
+  int index: int ref,
+  unique int pattern: @ruby_pattern ref
+);
+
+ruby_when_def(
+  unique int id: @ruby_when
+);
+
+ruby_while_def(
+  unique int id: @ruby_while,
+  int body: @ruby_do ref,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_while_modifier_def(
+  unique int id: @ruby_while_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_yield_child(
+  unique int ruby_yield: @ruby_yield ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_yield_def(
+  unique int id: @ruby_yield
+);
+
+ruby_tokeninfo(
+  unique int id: @ruby_token,
+  int kind: int ref,
+  string value: string ref
+);
+
+case @ruby_token.kind of
+  0 = @ruby_reserved_word
+| 1 = @ruby_token_character
+| 2 = @ruby_token_class_variable
+| 3 = @ruby_token_comment
+| 4 = @ruby_token_constant
+| 5 = @ruby_token_empty_statement
+| 6 = @ruby_token_encoding
+| 7 = @ruby_token_escape_sequence
+| 8 = @ruby_token_false
+| 9 = @ruby_token_file
+| 10 = @ruby_token_float
+| 11 = @ruby_token_forward_argument
+| 12 = @ruby_token_forward_parameter
+| 13 = @ruby_token_global_variable
+| 14 = @ruby_token_hash_key_symbol
+| 15 = @ruby_token_hash_splat_nil
+| 16 = @ruby_token_heredoc_beginning
+| 17 = @ruby_token_heredoc_content
+| 18 = @ruby_token_heredoc_end
+| 19 = @ruby_token_identifier
+| 20 = @ruby_token_instance_variable
+| 21 = @ruby_token_integer
+| 22 = @ruby_token_line
+| 23 = @ruby_token_nil
+| 24 = @ruby_token_operator
+| 25 = @ruby_token_self
+| 26 = @ruby_token_simple_symbol
+| 27 = @ruby_token_string_content
+| 28 = @ruby_token_super
+| 29 = @ruby_token_true
+| 30 = @ruby_token_uninterpreted
+;
+
+
+@ruby_ast_node = @ruby_alias | @ruby_alternative_pattern | @ruby_argument_list | @ruby_array | @ruby_array_pattern | @ruby_as_pattern | @ruby_assignment | @ruby_bare_string | @ruby_bare_symbol | @ruby_begin | @ruby_begin_block | @ruby_binary | @ruby_block | @ruby_block_argument | @ruby_block_parameter | @ruby_block_parameters | @ruby_break | @ruby_call | @ruby_case__ | @ruby_case_match | @ruby_chained_string | @ruby_class | @ruby_complex | @ruby_conditional | @ruby_delimited_symbol | @ruby_destructured_left_assignment | @ruby_destructured_parameter | @ruby_do | @ruby_do_block | @ruby_element_reference | @ruby_else | @ruby_elsif | @ruby_end_block | @ruby_ensure | @ruby_exception_variable | @ruby_exceptions | @ruby_expression_reference_pattern | @ruby_find_pattern | @ruby_for | @ruby_hash | @ruby_hash_pattern | @ruby_hash_splat_argument | @ruby_hash_splat_parameter | @ruby_heredoc_body | @ruby_if | @ruby_if_guard | @ruby_if_modifier | @ruby_in | @ruby_in_clause | @ruby_interpolation | @ruby_keyword_parameter | @ruby_keyword_pattern | @ruby_lambda | @ruby_lambda_parameters | @ruby_left_assignment_list | @ruby_method | @ruby_method_parameters | @ruby_module | @ruby_next | @ruby_operator_assignment | @ruby_optional_parameter | @ruby_pair | @ruby_parenthesized_pattern | @ruby_parenthesized_statements | @ruby_pattern | @ruby_program | @ruby_range | @ruby_rational | @ruby_redo | @ruby_regex | @ruby_rescue | @ruby_rescue_modifier | @ruby_rest_assignment | @ruby_retry | @ruby_return | @ruby_right_assignment_list | @ruby_scope_resolution | @ruby_setter | @ruby_singleton_class | @ruby_singleton_method | @ruby_splat_argument | @ruby_splat_parameter | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_superclass | @ruby_symbol_array | @ruby_then | @ruby_token | @ruby_unary | @ruby_undef | @ruby_unless | @ruby_unless_guard | @ruby_unless_modifier | @ruby_until | @ruby_until_modifier | @ruby_variable_reference_pattern | @ruby_when | @ruby_while | @ruby_while_modifier | @ruby_yield
+
+@ruby_ast_node_parent = @file | @ruby_ast_node
+
+#keyset[parent, parent_index]
+ruby_ast_node_info(
+  unique int node: @ruby_ast_node ref,
+  int parent: @ruby_ast_node_parent ref,
+  int parent_index: int ref,
+  int loc: @location ref
+);
+
+erb_comment_directive_child(
+  unique int erb_comment_directive: @erb_comment_directive ref,
+  unique int child: @erb_token_comment ref
+);
+
+erb_comment_directive_def(
+  unique int id: @erb_comment_directive
+);
+
+erb_directive_child(
+  unique int erb_directive: @erb_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_directive_def(
+  unique int id: @erb_directive
+);
+
+erb_graphql_directive_child(
+  unique int erb_graphql_directive: @erb_graphql_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_graphql_directive_def(
+  unique int id: @erb_graphql_directive
+);
+
+erb_output_directive_child(
+  unique int erb_output_directive: @erb_output_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_output_directive_def(
+  unique int id: @erb_output_directive
+);
+
+@erb_template_child_type = @erb_comment_directive | @erb_directive | @erb_graphql_directive | @erb_output_directive | @erb_token_content
+
+#keyset[erb_template, index]
+erb_template_child(
+  int erb_template: @erb_template ref,
+  int index: int ref,
+  unique int child: @erb_template_child_type ref
+);
+
+erb_template_def(
+  unique int id: @erb_template
+);
+
+erb_tokeninfo(
+  unique int id: @erb_token,
+  int kind: int ref,
+  string value: string ref
+);
+
+case @erb_token.kind of
+  0 = @erb_reserved_word
+| 1 = @erb_token_code
+| 2 = @erb_token_comment
+| 3 = @erb_token_content
+;
+
+
+@erb_ast_node = @erb_comment_directive | @erb_directive | @erb_graphql_directive | @erb_output_directive | @erb_template | @erb_token
+
+@erb_ast_node_parent = @erb_ast_node | @file
+
+#keyset[parent, parent_index]
+erb_ast_node_info(
+  unique int node: @erb_ast_node ref,
+  int parent: @erb_ast_node_parent ref,
+  int parent_index: int ref,
+  int loc: @location ref
+);
+
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_ast_node_info.ql b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_ast_node_info.ql
new file mode 100644
index 00000000000..c418da98507
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_ast_node_info.ql
@@ -0,0 +1,28 @@
+class AstNode extends @ruby_ast_node_parent {
+  string toString() { none() }
+}
+
+class Location extends @location {
+  string toString() { none() }
+}
+
+class Wrapper = @ruby_body_statement or @ruby_block_body;
+
+predicate astNodeInfo(AstNode child, AstNode parent, int primaryIndex, int secondaryIndex) {
+  not parent instanceof Wrapper and
+  exists(AstNode node, Location l |
+    ruby_ast_node_info(node, parent, primaryIndex, _) and
+    (
+      not node instanceof Wrapper and secondaryIndex = 0 and child = node
+      or
+      node instanceof Wrapper and ruby_ast_node_info(child, node, secondaryIndex, _)
+    )
+  )
+}
+
+from AstNode node, AstNode parent, int parent_index, Location loc
+where
+  node =
+    rank[parent_index + 1](AstNode n, int i, int j | astNodeInfo(n, parent, i, j) | n order by i, j) and
+  ruby_ast_node_info(node, _, _, loc)
+select node, parent, parent_index, loc
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_block_child.ql b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_block_child.ql
new file mode 100644
index 00000000000..f12816e6f44
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_block_child.ql
@@ -0,0 +1,7 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode ruby_block, AstNode body, int index, AstNode child
+where ruby_block_body(ruby_block, body) and ruby_block_body_child(body, index, child)
+select ruby_block, index, child
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_class_child.ql b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_class_child.ql
new file mode 100644
index 00000000000..bba0cc7ec3a
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_class_child.ql
@@ -0,0 +1,7 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode ruby_class, AstNode body, int index, AstNode child
+where ruby_class_body(ruby_class, body) and ruby_body_statement_child(body, index, child)
+select ruby_class, index, child
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_do_block_child.ql b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_do_block_child.ql
new file mode 100644
index 00000000000..d08bb83a41c
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_do_block_child.ql
@@ -0,0 +1,8 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode ruby_do_block, AstNode body, int index, AstNode child
+where ruby_do_block_body(ruby_do_block, body) and ruby_body_statement_child(body, index, child)
+select ruby_do_block, index, child
+
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_method_child.ql b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_method_child.ql
new file mode 100644
index 00000000000..fffa33ea4c7
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_method_child.ql
@@ -0,0 +1,14 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode ruby_method, int index, AstNode child
+where
+  exists(AstNode body |
+    ruby_method_body(ruby_method, body) and ruby_body_statement_child(body, index, child)
+  )
+  or
+  ruby_method_body(ruby_method, child) and
+  not child instanceof @ruby_body_statement and
+  index = 0
+select ruby_method, index, child
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_module_child.ql b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_module_child.ql
new file mode 100644
index 00000000000..c7ea0dcdadf
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_module_child.ql
@@ -0,0 +1,8 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode ruby_module, AstNode body, int index, AstNode child
+where ruby_module_body(ruby_module, body) and ruby_body_statement_child(body, index, child)
+select ruby_module, index, child
+
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_singleton_class_child.ql b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_singleton_class_child.ql
new file mode 100644
index 00000000000..3d2e45d0ec6
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_singleton_class_child.ql
@@ -0,0 +1,8 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode ruby_singleton_class, AstNode body, int index, AstNode child
+where ruby_singleton_class_body(ruby_singleton_class, body) and ruby_body_statement_child(body, index, child)
+select ruby_singleton_class, index, child
+
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_singleton_method_child.ql b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_singleton_method_child.ql
new file mode 100644
index 00000000000..cc76fecefeb
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/ruby_singleton_method_child.ql
@@ -0,0 +1,15 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode ruby_singleton_method, int index, AstNode child
+where
+  exists(AstNode body |
+    ruby_singleton_method_body(ruby_singleton_method, body) and
+    ruby_body_statement_child(body, index, child)
+  )
+  or
+  ruby_singleton_method_body(ruby_singleton_method, child) and
+  not child instanceof @ruby_body_statement and
+  index = 0
+select ruby_singleton_method, index, child
diff --git a/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/upgrade.properties b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/upgrade.properties
new file mode 100644
index 00000000000..6d90aac9b38
--- /dev/null
+++ b/ruby/downgrades/3595c826de6db850f16b9da265a54dbf24dd3126/upgrade.properties
@@ -0,0 +1,30 @@
+description: Wrap class, module, method, and block bodies in a named node
+compatibility: full
+
+ruby_block_body.rel: delete
+ruby_block_body_def.rel: delete
+ruby_block_body_child.rel: delete
+ruby_block_child.rel: run ruby_block_child.qlo
+
+ruby_body_statement_child.rel: delete
+ruby_body_statement_def.rel: delete
+
+ruby_class_body.rel: delete
+ruby_class_child.rel: run ruby_class_child.qlo
+
+ruby_do_block_body.rel: delete
+ruby_do_block_child.rel: run ruby_do_block_child.qlo
+
+ruby_method_body.rel: delete
+ruby_method_child.rel: run ruby_method_child.qlo
+
+ruby_module_body.rel: delete
+ruby_module_child.rel: run ruby_module_child.qlo
+
+ruby_singleton_class_body.rel: delete
+ruby_singleton_class_child.rel: run ruby_singleton_class_child.qlo
+
+ruby_singleton_method_body.rel: delete
+ruby_singleton_method_child.rel: run ruby_singleton_method_child.qlo
+
+ruby_ast_node_info.rel: run ruby_ast_node_info.qlo
\ No newline at end of file
diff --git a/ruby/extractor/Cargo.toml b/ruby/extractor/Cargo.toml
index c1a7c4424b9..a5c753b6398 100644
--- a/ruby/extractor/Cargo.toml
+++ b/ruby/extractor/Cargo.toml
@@ -11,7 +11,7 @@ flate2 = "1.0"
 node-types = { path = "../node-types" }
 tree-sitter = "0.19"
 tree-sitter-embedded-template = { git = "https://github.com/tree-sitter/tree-sitter-embedded-template.git", rev = "1a538da253d73f896b9f6c0c7d79cda58791ac5c" }
-tree-sitter-ruby = { git = "https://github.com/tree-sitter/tree-sitter-ruby.git", rev = "e75d04404c9dd71ad68850d5c672b226d5e694f3" }
+tree-sitter-ruby = { git = "https://github.com/tree-sitter/tree-sitter-ruby.git", rev = "ad1043283b1f9daf4aad381b6a81f18a5a27fe7e" }
 clap = "3.0"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3.3", features = ["env-filter"] }
diff --git a/ruby/generator/Cargo.toml b/ruby/generator/Cargo.toml
index 5a70c43d7b3..493557e03d4 100644
--- a/ruby/generator/Cargo.toml
+++ b/ruby/generator/Cargo.toml
@@ -12,4 +12,4 @@ node-types = { path = "../node-types" }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3.3", features = ["env-filter"] }
 tree-sitter-embedded-template = { git = "https://github.com/tree-sitter/tree-sitter-embedded-template.git", rev = "1a538da253d73f896b9f6c0c7d79cda58791ac5c" }
-tree-sitter-ruby = { git = "https://github.com/tree-sitter/tree-sitter-ruby.git", rev = "e75d04404c9dd71ad68850d5c672b226d5e694f3" }
+tree-sitter-ruby = { git = "https://github.com/tree-sitter/tree-sitter-ruby.git", rev = "ad1043283b1f9daf4aad381b6a81f18a5a27fe7e" }
diff --git a/ruby/ql/consistency-queries/DataFlowConsistency.ql b/ruby/ql/consistency-queries/DataFlowConsistency.ql
index 80eb90913d0..87fb4650b0d 100644
--- a/ruby/ql/consistency-queries/DataFlowConsistency.ql
+++ b/ruby/ql/consistency-queries/DataFlowConsistency.ql
@@ -1,3 +1,4 @@
+import codeql.ruby.AST
 import codeql.ruby.DataFlow::DataFlow
 import codeql.ruby.dataflow.internal.DataFlowPrivate
 import codeql.ruby.dataflow.internal.DataFlowImplConsistency::Consistency
@@ -11,5 +12,7 @@ private class MyConsistencyConfiguration extends ConsistencyConfiguration {
     n instanceof SummaryNode
     or
     n instanceof SynthHashSplatArgumentNode
+    or
+    not isNonConstantExpr(n.asExpr())
   }
 }
diff --git a/ruby/ql/consistency-queries/SsaConsistency.ql b/ruby/ql/consistency-queries/SsaConsistency.ql
index b1725ef3e85..54c1b149ab2 100644
--- a/ruby/ql/consistency-queries/SsaConsistency.ql
+++ b/ruby/ql/consistency-queries/SsaConsistency.ql
@@ -1,10 +1,18 @@
 import codeql.ruby.dataflow.SSA
-import codeql.ruby.dataflow.internal.SsaImplCommon::Consistency
+import codeql.ruby.dataflow.internal.SsaImpl::Consistency as Consistency
 
-class MyRelevantDefinition extends RelevantDefinition, Ssa::Definition {
+class MyRelevantDefinition extends Consistency::RelevantDefinition, Ssa::Definition {
   override predicate hasLocationInfo(
     string filepath, int startline, int startcolumn, int endline, int endcolumn
   ) {
     this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
   }
 }
+
+query predicate nonUniqueDef = Consistency::nonUniqueDef/4;
+
+query predicate readWithoutDef = Consistency::readWithoutDef/3;
+
+query predicate deadDef = Consistency::deadDef/2;
+
+query predicate notDominatedByDef = Consistency::notDominatedByDef/4;
diff --git a/ruby/ql/lib/change-notes/2022-08-16-active-resource.md b/ruby/ql/lib/change-notes/2022-08-16-active-resource.md
new file mode 100644
index 00000000000..dbe29d679de
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2022-08-16-active-resource.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Accesses of ActiveResource models are now recognized as HTTP requests.
diff --git a/ruby/ql/lib/change-notes/2022-08-18-change-http-client-request.md b/ruby/ql/lib/change-notes/2022-08-18-change-http-client-request.md
new file mode 100644
index 00000000000..7766f83af15
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2022-08-18-change-http-client-request.md
@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* Changed the `HTTP::Client::Request` concept from using `MethodCall` as base class, to using `DataFlow::Node` as base class. Any class that extends `HTTP::Client::Request::Range` must be changed, but if you only use the member predicates of `HTTP::Client::Request`, no changes are required.
diff --git a/ruby/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md b/ruby/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md
new file mode 100644
index 00000000000..efdaf85f2ed
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2022-09-08-implicit-read-flowstates.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed an issue in the taint tracking analysis where implicit reads were not allowed by default in sinks or additional taint steps that used flow states.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2022-09-12-uppercase.md b/ruby/ql/lib/change-notes/2022-09-12-uppercase.md
new file mode 100644
index 00000000000..996861f1c2c
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2022-09-12-uppercase.md
@@ -0,0 +1,5 @@
+---
+category: deprecated
+---
+* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
+  The old name still exists as a deprecated alias.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2022-09-13-filesystemresolver.md b/ruby/ql/lib/change-notes/2022-09-13-filesystemresolver.md
new file mode 100644
index 00000000000..36101e5f1e9
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2022-09-13-filesystemresolver.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Uses of `ActionView::FileSystemResolver` are now recognized as filesystem accesses.
diff --git a/ruby/ql/lib/codeql/ruby/AST.qll b/ruby/ql/lib/codeql/ruby/AST.qll
index 49edd048301..a9f8f8b5f9f 100644
--- a/ruby/ql/lib/codeql/ruby/AST.qll
+++ b/ruby/ql/lib/codeql/ruby/AST.qll
@@ -60,10 +60,10 @@ class AstNode extends TAstNode {
   final string getPrimaryQlClasses() { result = concat(this.getAPrimaryQlClass(), ",") }
 
   /** Gets the enclosing module, if any. */
-  ModuleBase getEnclosingModule() { result = getEnclosingModule(scopeOfInclSynth(this)) }
+  final ModuleBase getEnclosingModule() { result = getEnclosingModule(scopeOfInclSynth(this)) }
 
   /** Gets the enclosing method, if any. */
-  MethodBase getEnclosingMethod() { result = getEnclosingMethod(scopeOfInclSynth(this)) }
+  final MethodBase getEnclosingMethod() { result = getEnclosingMethod(scopeOfInclSynth(this)) }
 
   /** Gets a textual representation of this node. */
   cached
diff --git a/ruby/ql/lib/codeql/ruby/ApiGraphs.qll b/ruby/ql/lib/codeql/ruby/ApiGraphs.qll
index 798a35d1169..8cec5f0d190 100644
--- a/ruby/ql/lib/codeql/ruby/ApiGraphs.qll
+++ b/ruby/ql/lib/codeql/ruby/ApiGraphs.qll
@@ -33,7 +33,7 @@ module API {
    * 3. Map the resulting API graph nodes to data-flow nodes, using `asSource` or `asSink`.
    *
    * For example, a simplified way to get arguments to `Foo.bar` would be
-   * ```codeql
+   * ```ql
    * API::getTopLevelMember("Foo").getMethod("bar").getParameter(0).asSink()
    * ```
    *
@@ -97,6 +97,7 @@ module API {
      * This is similar to `asSource()` but additionally includes nodes that are transitively reachable by data flow.
      * See `asSource()` for examples.
      */
+    pragma[inline]
     DataFlow::Node getAValueReachableFromSource() {
       exists(DataFlow::LocalSourceNode src | Impl::use(this, src) |
         Impl::trackUseNode(src).flowsTo(result)
@@ -382,11 +383,17 @@ module API {
     bindingset[this]
     EntryPoint() { any() }
 
+    /** DEPRECATED. This predicate has been renamed to `getASource`. */
+    deprecated DataFlow::LocalSourceNode getAUse() { none() }
+
+    /** DEPRECATED. This predicate has been renamed to `getASink`. */
+    deprecated DataFlow::Node getARhs() { none() }
+
     /** Gets a data-flow node corresponding to a use-node for this entry point. */
-    DataFlow::LocalSourceNode getAUse() { none() }
+    DataFlow::LocalSourceNode getASource() { none() }
 
     /** Gets a data-flow node corresponding to a def-node for this entry point. */
-    DataFlow::Node getARhs() { none() }
+    DataFlow::Node getASink() { none() }
 
     /** Gets a call corresponding to a method access node for this entry point. */
     DataFlow::CallNode getACall() { none() }
@@ -504,7 +511,7 @@ module API {
       or
       parameterStep(_, defCand(), nd)
       or
-      nd = any(EntryPoint entry).getAUse()
+      nd = any(EntryPoint entry).getASource()
       or
       nd = any(EntryPoint entry).getACall()
     }
@@ -553,7 +560,7 @@ module API {
       // If a call node is relevant as a use-node, treat its arguments as def-nodes
       argumentStep(_, useCandFwd(), rhs)
       or
-      rhs = any(EntryPoint entry).getARhs()
+      rhs = any(EntryPoint entry).getASink()
     }
 
     /** Gets a data flow node that flows to the RHS of a def-node. */
@@ -712,9 +719,9 @@ module API {
         pred = root() and
         lbl = Label::entryPoint(entry)
       |
-        succ = MkDef(entry.getARhs())
+        succ = MkDef(entry.getASink())
         or
-        succ = MkUse(entry.getAUse())
+        succ = MkUse(entry.getASource())
         or
         succ = MkMethodAccessNode(entry.getACall())
       )
@@ -832,7 +839,7 @@ module API {
 
         LabelEntryPoint() { this = MkLabelEntryPoint(name) }
 
-        override string toString() { result = name }
+        override string toString() { result = "entryPoint(\"" + name + "\")" }
 
         /** Gets the name of the entry point. */
         API::EntryPoint getName() { result = name }
diff --git a/ruby/ql/lib/codeql/ruby/Concepts.qll b/ruby/ql/lib/codeql/ruby/Concepts.qll
index 97d40154dbf..aab70b7ec07 100644
--- a/ruby/ql/lib/codeql/ruby/Concepts.qll
+++ b/ruby/ql/lib/codeql/ruby/Concepts.qll
@@ -222,7 +222,7 @@ class HtmlEscaping extends Escaping {
 }
 
 /** Provides classes for modeling HTTP-related APIs. */
-module HTTP {
+module Http {
   /** Provides classes for modeling HTTP servers. */
   module Server {
     /**
@@ -465,7 +465,7 @@ module HTTP {
        * Extend this class to model new APIs. If you want to refine existing API models,
        * extend `HttpResponse` instead.
        */
-      abstract class Range extends HTTP::Server::HttpResponse::Range {
+      abstract class Range extends Http::Server::HttpResponse::Range {
         /** Gets the data-flow node that specifies the location of this HTTP redirect response. */
         abstract DataFlow::Node getRedirectLocation();
       }
@@ -474,13 +474,15 @@ module HTTP {
 
   /** Provides classes for modeling HTTP clients. */
   module Client {
+    import codeql.ruby.internal.ConceptsShared::Http::Client as SC
+
     /**
      * A method call that makes an outgoing HTTP request.
      *
      * Extend this class to refine existing API models. If you want to model new APIs,
      * extend `Request::Range` instead.
      */
-    class Request extends MethodCall instanceof Request::Range {
+    class Request extends SC::Request instanceof Request::Range {
       /** Gets a node which returns the body of the response */
       DataFlow::Node getResponseBody() { result = super.getResponseBody() }
 
@@ -490,24 +492,19 @@ module HTTP {
        * Gets a node that contributes to the URL of the request.
        * Depending on the framework, a request may have multiple nodes which contribute to the URL.
        */
-      deprecated DataFlow::Node getURL() { result = super.getURL() or result = super.getAUrlPart() }
-
-      /**
-       * Gets a data-flow node that contributes to the URL of the request.
-       * Depending on the framework, a request may have multiple nodes which contribute to the URL.
-       */
-      DataFlow::Node getAUrlPart() { result = super.getAUrlPart() }
-
-      /** Gets a string that identifies the framework used for this request. */
-      string getFramework() { result = super.getFramework() }
+      deprecated DataFlow::Node getURL() {
+        result = super.getURL() or result = Request::Range.super.getAUrlPart()
+      }
 
       /**
        * Holds if this request is made using a mode that disables SSL/TLS
        * certificate validation, where `disablingNode` represents the point at
        * which the validation was disabled.
        */
-      predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
-        super.disablesCertificateValidation(disablingNode)
+      deprecated predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
+        Request::Range.super.disablesCertificateValidation(disablingNode, _)
+        or
+        Request::Range.super.disablesCertificateValidation(disablingNode)
       }
     }
 
@@ -519,7 +516,7 @@ module HTTP {
        * Extend this class to model new APIs. If you want to refine existing API models,
        * extend `Request` instead.
        */
-      abstract class Range extends MethodCall {
+      abstract class Range extends SC::Request::Range {
         /** Gets a node which returns the body of the response */
         abstract DataFlow::Node getResponseBody();
 
@@ -532,20 +529,13 @@ module HTTP {
         deprecated DataFlow::Node getURL() { none() }
 
         /**
-         * Gets a data-flow node that contributes to the URL of the request.
-         * Depending on the framework, a request may have multiple nodes which contribute to the URL.
-         */
-        abstract DataFlow::Node getAUrlPart();
-
-        /** Gets a string that identifies the framework used for this request. */
-        abstract string getFramework();
-
-        /**
+         * DEPRECATED: override `disablesCertificateValidation/2` instead.
+         *
          * Holds if this request is made using a mode that disables SSL/TLS
          * certificate validation, where `disablingNode` represents the point at
          * which the validation was disabled.
          */
-        abstract predicate disablesCertificateValidation(DataFlow::Node disablingNode);
+        deprecated predicate disablesCertificateValidation(DataFlow::Node disablingNode) { none() }
       }
     }
 
@@ -560,6 +550,9 @@ module HTTP {
   }
 }
 
+/** DEPRECATED: Alias for Http */
+deprecated module HTTP = Http;
+
 /**
  * A data flow node that executes an operating system command,
  * for instance by spawning a new process.
@@ -621,16 +614,12 @@ module CodeExecution {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `XmlParserCall::Range` instead.
  */
-class XmlParserCall extends DataFlow::Node {
-  XmlParserCall::Range range;
-
-  XmlParserCall() { this = range }
-
+class XmlParserCall extends DataFlow::Node instanceof XmlParserCall::Range {
   /** Gets the argument that specifies the XML content to be parsed. */
-  DataFlow::Node getInput() { result = range.getInput() }
+  DataFlow::Node getInput() { result = super.getInput() }
 
   /** Holds if this XML parser call is configured to process external entities */
-  predicate externalEntitiesEnabled() { range.externalEntitiesEnabled() }
+  predicate externalEntitiesEnabled() { super.externalEntitiesEnabled() }
 }
 
 /** Provides a class for modeling new XML parsing APIs. */
@@ -800,13 +789,9 @@ module CookieSecurityConfigurationSetting {
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `Logging::Range` instead.
  */
-class Logging extends DataFlow::Node {
-  Logging::Range range;
-
-  Logging() { this = range }
-
+class Logging extends DataFlow::Node instanceof Logging::Range {
   /** Gets an input that is logged. */
-  DataFlow::Node getAnInput() { result = range.getAnInput() }
+  DataFlow::Node getAnInput() { result = super.getAnInput() }
 }
 
 /** Provides a class for modeling new logging mechanisms. */
diff --git a/ruby/ql/lib/codeql/ruby/Frameworks.qll b/ruby/ql/lib/codeql/ruby/Frameworks.qll
index 69ba758a767..868489ad26b 100644
--- a/ruby/ql/lib/codeql/ruby/Frameworks.qll
+++ b/ruby/ql/lib/codeql/ruby/Frameworks.qll
@@ -6,6 +6,7 @@ private import codeql.ruby.frameworks.Core
 private import codeql.ruby.frameworks.ActionCable
 private import codeql.ruby.frameworks.ActionController
 private import codeql.ruby.frameworks.ActiveRecord
+private import codeql.ruby.frameworks.ActiveResource
 private import codeql.ruby.frameworks.ActiveStorage
 private import codeql.ruby.frameworks.ActionView
 private import codeql.ruby.frameworks.ActiveSupport
diff --git a/ruby/ql/lib/codeql/ruby/ast/internal/Expr.qll b/ruby/ql/lib/codeql/ruby/ast/internal/Expr.qll
index 167f5f90d1e..93cb8961f81 100644
--- a/ruby/ql/lib/codeql/ruby/ast/internal/Expr.qll
+++ b/ruby/ql/lib/codeql/ruby/ast/internal/Expr.qll
@@ -51,25 +51,35 @@ class Ensure extends StmtSequence, TEnsure {
 
 // Not defined by dispatch, as it should not be exposed
 Ruby::AstNode getBodyStmtChild(TBodyStmt b, int i) {
-  result = any(Ruby::Method g | b = TMethod(g)).getChild(i)
-  or
-  result = any(Ruby::SingletonMethod g | b = TSingletonMethod(g)).getChild(i)
-  or
-  exists(Ruby::Lambda g | b = TLambda(g) |
-    result = g.getBody().(Ruby::DoBlock).getChild(i) or
-    result = g.getBody().(Ruby::Block).getChild(i)
+  exists(Ruby::Method g, Ruby::AstNode body | b = TMethod(g) and body = g.getBody() |
+    result = body.(Ruby::BodyStatement).getChild(i)
+    or
+    i = 0 and result = body and not body instanceof Ruby::BodyStatement
   )
   or
-  result = any(Ruby::DoBlock g | b = TDoBlock(g)).getChild(i)
+  exists(Ruby::SingletonMethod g, Ruby::AstNode body |
+    b = TSingletonMethod(g) and body = g.getBody()
+  |
+    result = body.(Ruby::BodyStatement).getChild(i)
+    or
+    i = 0 and result = body and not body instanceof Ruby::BodyStatement
+  )
+  or
+  exists(Ruby::Lambda g | b = TLambda(g) |
+    result = g.getBody().(Ruby::DoBlock).getBody().getChild(i) or
+    result = g.getBody().(Ruby::Block).getBody().getChild(i)
+  )
+  or
+  result = any(Ruby::DoBlock g | b = TDoBlock(g)).getBody().getChild(i)
   or
   result = any(Ruby::Program g | b = TToplevel(g)).getChild(i) and
   not result instanceof Ruby::BeginBlock
   or
-  result = any(Ruby::Class g | b = TClassDeclaration(g)).getChild(i)
+  result = any(Ruby::Class g | b = TClassDeclaration(g)).getBody().getChild(i)
   or
-  result = any(Ruby::SingletonClass g | b = TSingletonClass(g)).getChild(i)
+  result = any(Ruby::SingletonClass g | b = TSingletonClass(g)).getBody().getChild(i)
   or
-  result = any(Ruby::Module g | b = TModuleDeclaration(g)).getChild(i)
+  result = any(Ruby::Module g | b = TModuleDeclaration(g)).getBody().getChild(i)
   or
   result = any(Ruby::Begin g | b = TBeginExpr(g)).getChild(i)
 }
diff --git a/ruby/ql/lib/codeql/ruby/ast/internal/Method.qll b/ruby/ql/lib/codeql/ruby/ast/internal/Method.qll
index 0b923056441..075ac5fb8fa 100644
--- a/ruby/ql/lib/codeql/ruby/ast/internal/Method.qll
+++ b/ruby/ql/lib/codeql/ruby/ast/internal/Method.qll
@@ -15,7 +15,7 @@ class BraceBlockReal extends BraceBlock, TBraceBlockReal {
     toGenerated(result) = g.getParameters().getChild(n)
   }
 
-  final override Stmt getStmt(int i) { toGenerated(result) = g.getChild(i) }
+  final override Stmt getStmt(int i) { toGenerated(result) = g.getBody().getChild(i) }
 }
 
 /**
diff --git a/ruby/ql/lib/codeql/ruby/ast/internal/Module.qll b/ruby/ql/lib/codeql/ruby/ast/internal/Module.qll
index eabc51a2125..b26dfc88bef 100644
--- a/ruby/ql/lib/codeql/ruby/ast/internal/Module.qll
+++ b/ruby/ql/lib/codeql/ruby/ast/internal/Module.qll
@@ -137,14 +137,7 @@ private module Cached {
   }
 
   cached
-  Method lookupMethod(Module m, string name) {
-    // The syntax_suggest library redefines Kernel.require/require_relative.
-    // Somehow this causes performance issues on ruby/ruby. As a workaround
-    // we exclude 'require' and 'require_relative'.
-    // TODO: find the actual cause of the slowdown and fix things properly.
-    not name = ["require", "require_relative"] and
-    TMethod(result) = lookupMethodOrConst(m, name)
-  }
+  Method lookupMethod(Module m, string name) { TMethod(result) = lookupMethodOrConst(m, name) }
 
   cached
   Expr lookupConst(Module m, string name) {
diff --git a/ruby/ql/lib/codeql/ruby/ast/internal/Scope.qll b/ruby/ql/lib/codeql/ruby/ast/internal/Scope.qll
index e8e601e911b..8f5bde5aeec 100644
--- a/ruby/ql/lib/codeql/ruby/ast/internal/Scope.qll
+++ b/ruby/ql/lib/codeql/ruby/ast/internal/Scope.qll
@@ -128,7 +128,7 @@ private AstNode specialParentOfInclSynth(AstNode n) {
   n =
     [
       result.(Namespace).getScopeExpr(), result.(ClassDeclaration).getSuperclassExpr(),
-      result.(SingletonMethod).getObject()
+      result.(SingletonMethod).getObject(), result.(SingletonClass).getValue()
     ]
 }
 
diff --git a/ruby/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll b/ruby/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
index 7a3b6ef43ef..7d76c3d701a 100644
--- a/ruby/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
+++ b/ruby/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
@@ -311,15 +311,15 @@ module Ruby {
     /** Gets the name of the primary QL class for this element. */
     final override string getAPrimaryQlClass() { result = "Block" }
 
+    /** Gets the node corresponding to the field `body`. */
+    final BlockBody getBody() { ruby_block_body(this, result) }
+
     /** Gets the node corresponding to the field `parameters`. */
     final BlockParameters getParameters() { ruby_block_parameters(this, result) }
 
-    /** Gets the `i`th child of this node. */
-    final AstNode getChild(int i) { ruby_block_child(this, i, result) }
-
     /** Gets a field or child node of this node. */
     final override AstNode getAFieldOrChild() {
-      ruby_block_parameters(this, result) or ruby_block_child(this, _, result)
+      ruby_block_body(this, result) or ruby_block_parameters(this, result)
     }
   }
 
@@ -335,6 +335,18 @@ module Ruby {
     final override AstNode getAFieldOrChild() { ruby_block_argument_child(this, result) }
   }
 
+  /** A class representing `block_body` nodes. */
+  class BlockBody extends @ruby_block_body, AstNode {
+    /** Gets the name of the primary QL class for this element. */
+    final override string getAPrimaryQlClass() { result = "BlockBody" }
+
+    /** Gets the `i`th child of this node. */
+    final AstNode getChild(int i) { ruby_block_body_child(this, i, result) }
+
+    /** Gets a field or child node of this node. */
+    final override AstNode getAFieldOrChild() { ruby_block_body_child(this, _, result) }
+  }
+
   /** A class representing `block_parameter` nodes. */
   class BlockParameter extends @ruby_block_parameter, AstNode {
     /** Gets the name of the primary QL class for this element. */
@@ -364,6 +376,18 @@ module Ruby {
     }
   }
 
+  /** A class representing `body_statement` nodes. */
+  class BodyStatement extends @ruby_body_statement, AstNode {
+    /** Gets the name of the primary QL class for this element. */
+    final override string getAPrimaryQlClass() { result = "BodyStatement" }
+
+    /** Gets the `i`th child of this node. */
+    final AstNode getChild(int i) { ruby_body_statement_child(this, i, result) }
+
+    /** Gets a field or child node of this node. */
+    final override AstNode getAFieldOrChild() { ruby_body_statement_child(this, _, result) }
+  }
+
   /** A class representing `break` nodes. */
   class Break extends @ruby_break, AstNode {
     /** Gets the name of the primary QL class for this element. */
@@ -468,20 +492,20 @@ module Ruby {
     /** Gets the name of the primary QL class for this element. */
     final override string getAPrimaryQlClass() { result = "Class" }
 
+    /** Gets the node corresponding to the field `body`. */
+    final BodyStatement getBody() { ruby_class_body(this, result) }
+
     /** Gets the node corresponding to the field `name`. */
     final AstNode getName() { ruby_class_def(this, result) }
 
     /** Gets the node corresponding to the field `superclass`. */
     final Superclass getSuperclass() { ruby_class_superclass(this, result) }
 
-    /** Gets the `i`th child of this node. */
-    final AstNode getChild(int i) { ruby_class_child(this, i, result) }
-
     /** Gets a field or child node of this node. */
     final override AstNode getAFieldOrChild() {
+      ruby_class_body(this, result) or
       ruby_class_def(this, result) or
-      ruby_class_superclass(this, result) or
-      ruby_class_child(this, _, result)
+      ruby_class_superclass(this, result)
     }
   }
 
@@ -592,15 +616,15 @@ module Ruby {
     /** Gets the name of the primary QL class for this element. */
     final override string getAPrimaryQlClass() { result = "DoBlock" }
 
+    /** Gets the node corresponding to the field `body`. */
+    final BodyStatement getBody() { ruby_do_block_body(this, result) }
+
     /** Gets the node corresponding to the field `parameters`. */
     final BlockParameters getParameters() { ruby_do_block_parameters(this, result) }
 
-    /** Gets the `i`th child of this node. */
-    final AstNode getChild(int i) { ruby_do_block_child(this, i, result) }
-
     /** Gets a field or child node of this node. */
     final override AstNode getAFieldOrChild() {
-      ruby_do_block_parameters(this, result) or ruby_do_block_child(this, _, result)
+      ruby_do_block_body(this, result) or ruby_do_block_parameters(this, result)
     }
   }
 
@@ -1106,20 +1130,20 @@ module Ruby {
     /** Gets the name of the primary QL class for this element. */
     final override string getAPrimaryQlClass() { result = "Method" }
 
+    /** Gets the node corresponding to the field `body`. */
+    final AstNode getBody() { ruby_method_body(this, result) }
+
     /** Gets the node corresponding to the field `name`. */
     final UnderscoreMethodName getName() { ruby_method_def(this, result) }
 
     /** Gets the node corresponding to the field `parameters`. */
     final MethodParameters getParameters() { ruby_method_parameters(this, result) }
 
-    /** Gets the `i`th child of this node. */
-    final AstNode getChild(int i) { ruby_method_child(this, i, result) }
-
     /** Gets a field or child node of this node. */
     final override AstNode getAFieldOrChild() {
+      ruby_method_body(this, result) or
       ruby_method_def(this, result) or
-      ruby_method_parameters(this, result) or
-      ruby_method_child(this, _, result)
+      ruby_method_parameters(this, result)
     }
   }
 
@@ -1140,15 +1164,15 @@ module Ruby {
     /** Gets the name of the primary QL class for this element. */
     final override string getAPrimaryQlClass() { result = "Module" }
 
+    /** Gets the node corresponding to the field `body`. */
+    final BodyStatement getBody() { ruby_module_body(this, result) }
+
     /** Gets the node corresponding to the field `name`. */
     final AstNode getName() { ruby_module_def(this, result) }
 
-    /** Gets the `i`th child of this node. */
-    final AstNode getChild(int i) { ruby_module_child(this, i, result) }
-
     /** Gets a field or child node of this node. */
     final override AstNode getAFieldOrChild() {
-      ruby_module_def(this, result) or ruby_module_child(this, _, result)
+      ruby_module_body(this, result) or ruby_module_def(this, result)
     }
   }
 
@@ -1504,15 +1528,15 @@ module Ruby {
     /** Gets the name of the primary QL class for this element. */
     final override string getAPrimaryQlClass() { result = "SingletonClass" }
 
+    /** Gets the node corresponding to the field `body`. */
+    final BodyStatement getBody() { ruby_singleton_class_body(this, result) }
+
     /** Gets the node corresponding to the field `value`. */
     final UnderscoreArg getValue() { ruby_singleton_class_def(this, result) }
 
-    /** Gets the `i`th child of this node. */
-    final AstNode getChild(int i) { ruby_singleton_class_child(this, i, result) }
-
     /** Gets a field or child node of this node. */
     final override AstNode getAFieldOrChild() {
-      ruby_singleton_class_def(this, result) or ruby_singleton_class_child(this, _, result)
+      ruby_singleton_class_body(this, result) or ruby_singleton_class_def(this, result)
     }
   }
 
@@ -1521,6 +1545,9 @@ module Ruby {
     /** Gets the name of the primary QL class for this element. */
     final override string getAPrimaryQlClass() { result = "SingletonMethod" }
 
+    /** Gets the node corresponding to the field `body`. */
+    final AstNode getBody() { ruby_singleton_method_body(this, result) }
+
     /** Gets the node corresponding to the field `name`. */
     final UnderscoreMethodName getName() { ruby_singleton_method_def(this, result, _) }
 
@@ -1530,15 +1557,12 @@ module Ruby {
     /** Gets the node corresponding to the field `parameters`. */
     final MethodParameters getParameters() { ruby_singleton_method_parameters(this, result) }
 
-    /** Gets the `i`th child of this node. */
-    final AstNode getChild(int i) { ruby_singleton_method_child(this, i, result) }
-
     /** Gets a field or child node of this node. */
     final override AstNode getAFieldOrChild() {
+      ruby_singleton_method_body(this, result) or
       ruby_singleton_method_def(this, result, _) or
       ruby_singleton_method_def(this, _, result) or
-      ruby_singleton_method_parameters(this, result) or
-      ruby_singleton_method_child(this, _, result)
+      ruby_singleton_method_parameters(this, result)
     }
   }
 
diff --git a/ruby/ql/lib/codeql/ruby/ast/internal/Variable.qll b/ruby/ql/lib/codeql/ruby/ast/internal/Variable.qll
index 64fcdbd669a..9e1e2c38de9 100644
--- a/ruby/ql/lib/codeql/ruby/ast/internal/Variable.qll
+++ b/ruby/ql/lib/codeql/ruby/ast/internal/Variable.qll
@@ -200,18 +200,18 @@ private module Cached {
     or
     i = any(Ruby::Binary x).getRight()
     or
-    i = any(Ruby::Block x).getChild(_)
-    or
     i = any(Ruby::BlockArgument x).getChild()
     or
+    i = any(Ruby::BlockBody x).getChild(_)
+    or
+    i = any(Ruby::BodyStatement x).getChild(_)
+    or
     i = any(Ruby::Call x).getReceiver()
     or
     i = any(Ruby::Case x).getValue()
     or
     i = any(Ruby::CaseMatch x).getValue()
     or
-    i = any(Ruby::Class x).getChild(_)
-    or
     i = any(Ruby::Conditional x).getCondition()
     or
     i = any(Ruby::Conditional x).getConsequence()
@@ -220,8 +220,6 @@ private module Cached {
     or
     i = any(Ruby::Do x).getChild(_)
     or
-    i = any(Ruby::DoBlock x).getChild(_)
-    or
     i = any(Ruby::ElementReference x).getChild(_)
     or
     i = any(Ruby::ElementReference x).getObject()
@@ -250,9 +248,7 @@ private module Cached {
     or
     i = any(Ruby::KeywordParameter x).getValue()
     or
-    i = any(Ruby::Method x).getChild(_)
-    or
-    i = any(Ruby::Module x).getChild(_)
+    i = any(Ruby::Method x).getBody()
     or
     i = any(Ruby::OperatorAssignment x).getRight()
     or
@@ -282,9 +278,7 @@ private module Cached {
     or
     i = any(Ruby::SingletonClass x).getValue()
     or
-    i = any(Ruby::SingletonClass x).getChild(_)
-    or
-    i = any(Ruby::SingletonMethod x).getChild(_)
+    i = any(Ruby::SingletonMethod x).getBody()
     or
     i = any(Ruby::SingletonMethod x).getObject()
     or
diff --git a/ruby/ql/lib/codeql/ruby/controlflow/BasicBlocks.qll b/ruby/ql/lib/codeql/ruby/controlflow/BasicBlocks.qll
index 5f22ed91cc0..cff386d8122 100644
--- a/ruby/ql/lib/codeql/ruby/controlflow/BasicBlocks.qll
+++ b/ruby/ql/lib/codeql/ruby/controlflow/BasicBlocks.qll
@@ -311,13 +311,13 @@ private module Cached {
   }
 
   cached
-  predicate immediatelyControls(ConditionBlock cb, BasicBlock succ, BooleanSuccessor s) {
+  predicate immediatelyControls(ConditionBlock cb, BasicBlock succ, ConditionalSuccessor s) {
     succ = cb.getASuccessor(s) and
     forall(BasicBlock pred | pred = succ.getAPredecessor() and pred != cb | succ.dominates(pred))
   }
 
   cached
-  predicate controls(ConditionBlock cb, BasicBlock controlled, BooleanSuccessor s) {
+  predicate controls(ConditionBlock cb, BasicBlock controlled, ConditionalSuccessor s) {
     exists(BasicBlock succ | cb.immediatelyControls(succ, s) | succ.dominates(controlled))
   }
 }
@@ -406,7 +406,7 @@ class ConditionBlock extends BasicBlock {
    * successor of this block, and `succ` can only be reached from
    * the callable entry point by going via the `s` edge out of this basic block.
    */
-  predicate immediatelyControls(BasicBlock succ, BooleanSuccessor s) {
+  predicate immediatelyControls(BasicBlock succ, ConditionalSuccessor s) {
     immediatelyControls(this, succ, s)
   }
 
@@ -415,5 +415,7 @@ class ConditionBlock extends BasicBlock {
    * conditional value `s`. That is, `controlled` can only be reached from
    * the callable entry point by going via the `s` edge out of this basic block.
    */
-  predicate controls(BasicBlock controlled, BooleanSuccessor s) { controls(this, controlled, s) }
+  predicate controls(BasicBlock controlled, ConditionalSuccessor s) {
+    controls(this, controlled, s)
+  }
 }
diff --git a/ruby/ql/lib/codeql/ruby/controlflow/CfgNodes.qll b/ruby/ql/lib/codeql/ruby/controlflow/CfgNodes.qll
index 526cc5adaf9..5cf68d31a5d 100644
--- a/ruby/ql/lib/codeql/ruby/controlflow/CfgNodes.qll
+++ b/ruby/ql/lib/codeql/ruby/controlflow/CfgNodes.qll
@@ -433,7 +433,7 @@ module ExprNodes {
   }
 
   private class WhenClauseChildMapping extends NonExprChildMapping, WhenClause {
-    override predicate relevantChild(AstNode e) { e = this.getBody() }
+    override predicate relevantChild(AstNode e) { e = [this.getBody(), this.getAPattern()] }
   }
 
   /** A control-flow node that wraps a `WhenClause` AST expression. */
@@ -444,6 +444,9 @@ module ExprNodes {
 
     /** Gets the body of this `when`-clause. */
     final ExprCfgNode getBody() { e.hasCfgChild(e.getBody(), this, result) }
+
+    /** Gets the `i`th pattern this `when`-clause. */
+    final ExprCfgNode getPattern(int i) { e.hasCfgChild(e.getPattern(i), this, result) }
   }
 
   /** A control-flow node that wraps a `CasePattern`. */
@@ -711,6 +714,19 @@ module ExprNodes {
     final CfgNode getReceiver() { e.hasCfgChild(e.getReceiver(), this, result) }
   }
 
+  private class SelfVariableAccessMapping extends ExprChildMapping, SelfVariableAccess {
+    override predicate relevantChild(AstNode n) { none() }
+  }
+
+  /** A control-flow node that wraps a `SelfVariableAccess` AST expression. */
+  class SelfVariableAccessCfgNode extends ExprCfgNode {
+    final override string getAPrimaryQlClass() { result = "SelfVariableAccessCfgNode" }
+
+    override SelfVariableAccessMapping e;
+
+    override SelfVariableAccess getExpr() { result = ExprCfgNode.super.getExpr() }
+  }
+
   /** A control-flow node that wraps a `VariableWriteAccess` AST expression. */
   class VariableWriteAccessCfgNode extends ExprCfgNode {
     override string getAPrimaryQlClass() { result = "VariableWriteAccessCfgNode" }
diff --git a/ruby/ql/lib/codeql/ruby/controlflow/ControlFlowGraph.qll b/ruby/ql/lib/codeql/ruby/controlflow/ControlFlowGraph.qll
index b6a59d46b50..4670bc692f5 100644
--- a/ruby/ql/lib/codeql/ruby/controlflow/ControlFlowGraph.qll
+++ b/ruby/ql/lib/codeql/ruby/controlflow/ControlFlowGraph.qll
@@ -44,7 +44,7 @@ class CfgNode extends TCfgNode {
   final File getFile() { result = this.getLocation().getFile() }
 
   /** Holds if this control flow node has conditional successors. */
-  final predicate isCondition() { exists(this.getASuccessor(any(BooleanSuccessor bs))) }
+  final predicate isCondition() { exists(this.getASuccessor(any(ConditionalSuccessor bs))) }
 
   /** Gets the scope of this node. */
   final CfgScope getScope() { result = getNodeCfgScope(this) }
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/RemoteFlowSources.qll b/ruby/ql/lib/codeql/ruby/dataflow/RemoteFlowSources.qll
index 617bfd8678e..de85af6b938 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/RemoteFlowSources.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/RemoteFlowSources.qll
@@ -13,13 +13,9 @@ private import codeql.ruby.Frameworks
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `RemoteFlowSource::Range` instead.
  */
-class RemoteFlowSource extends DataFlow::Node {
-  RemoteFlowSource::Range self;
-
-  RemoteFlowSource() { this = self }
-
+class RemoteFlowSource extends DataFlow::Node instanceof RemoteFlowSource::Range {
   /** Gets a string that describes the type of this remote flow source. */
-  string getSourceType() { result = self.getSourceType() }
+  string getSourceType() { result = super.getSourceType() }
 }
 
 /** Provides a class for modeling new sources of remote user input. */
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/SSA.qll b/ruby/ql/lib/codeql/ruby/dataflow/SSA.qll
index b8880b39829..efae79e8d29 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/SSA.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/SSA.qll
@@ -9,12 +9,11 @@ module Ssa {
   private import codeql.Locations
   private import codeql.ruby.CFG
   private import codeql.ruby.ast.Variable
-  private import internal.SsaImplCommon as SsaImplCommon
   private import internal.SsaImpl as SsaImpl
   private import CfgNodes::ExprNodes
 
   /** A static single assignment (SSA) definition. */
-  class Definition extends SsaImplCommon::Definition {
+  class Definition extends SsaImpl::Definition {
     /**
      * Gets the control flow node of this SSA definition, if any. Phi nodes are
      * examples of SSA definitions without a control flow node, as they are
@@ -190,7 +189,7 @@ module Ssa {
    * puts x
    * ```
    */
-  class WriteDefinition extends Definition, SsaImplCommon::WriteDefinition {
+  class WriteDefinition extends Definition, SsaImpl::WriteDefinition {
     private VariableWriteAccess write;
 
     WriteDefinition() {
@@ -223,7 +222,7 @@ module Ssa {
   /**
    * An SSA definition that corresponds to the value of `self` upon entry to a method, class or module.
    */
-  class SelfDefinition extends Definition, SsaImplCommon::WriteDefinition {
+  class SelfDefinition extends Definition, SsaImpl::WriteDefinition {
     private SelfVariable v;
 
     SelfDefinition() {
@@ -254,7 +253,7 @@ module Ssa {
    * since the assignment to `x` is conditional, an unitialized definition for
    * `x` is inserted at the start of `m`.
    */
-  class UninitializedDefinition extends Definition, SsaImplCommon::WriteDefinition {
+  class UninitializedDefinition extends Definition, SsaImpl::WriteDefinition {
     UninitializedDefinition() {
       exists(BasicBlock bb, int i, Variable v |
         this.definesAt(v, bb, i) and
@@ -283,7 +282,7 @@ module Ssa {
    *
    * an entry definition for `y` is inserted at the start of the `do` block.
    */
-  class CapturedEntryDefinition extends Definition, SsaImplCommon::WriteDefinition {
+  class CapturedEntryDefinition extends Definition, SsaImpl::WriteDefinition {
     CapturedEntryDefinition() {
       exists(BasicBlock bb, int i, Variable v |
         this.definesAt(v, bb, i) and
@@ -312,7 +311,7 @@ module Ssa {
    *
    * a definition for `y` is inserted at the call to `times`.
    */
-  class CapturedCallDefinition extends Definition, SsaImplCommon::UncertainWriteDefinition {
+  class CapturedCallDefinition extends Definition, SsaImpl::UncertainWriteDefinition {
     CapturedCallDefinition() {
       exists(Variable v, BasicBlock bb, int i |
         this.definesAt(v, bb, i) and
@@ -343,7 +342,7 @@ module Ssa {
    *
    * a phi node for `x` is inserted just before the call `puts x`.
    */
-  class PhiNode extends Definition, SsaImplCommon::PhiNode {
+  class PhiNode extends Definition, SsaImpl::PhiNode {
     /**
      * Gets an input of this phi node.
      *
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowDispatch.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowDispatch.qll
index 3ec315b5d9b..6c8696afd3e 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowDispatch.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowDispatch.qll
@@ -2,10 +2,12 @@ private import ruby
 private import codeql.ruby.CFG
 private import DataFlowPrivate
 private import codeql.ruby.typetracking.TypeTracker
+private import codeql.ruby.typetracking.TypeTrackerSpecific as TypeTrackerSpecific
 private import codeql.ruby.ast.internal.Module
 private import FlowSummaryImpl as FlowSummaryImpl
 private import FlowSummaryImplSpecific as FlowSummaryImplSpecific
 private import codeql.ruby.dataflow.FlowSummary
+private import codeql.ruby.dataflow.SSA
 
 newtype TReturnKind =
   TNormalReturnKind() or
@@ -148,12 +150,19 @@ private class NormalCall extends DataFlowCall, TNormalCall {
 
 pragma[nomagic]
 private predicate methodCall(
+  CfgNodes::ExprNodes::CallCfgNode call, DataFlow::Node receiver, string method
+) {
+  method = call.getExpr().(MethodCall).getMethodName() and
+  receiver.asExpr() = call.getReceiver()
+}
+
+pragma[nomagic]
+private predicate flowsToMethodCall(
   CfgNodes::ExprNodes::CallCfgNode call, DataFlow::LocalSourceNode sourceNode, string method
 ) {
-  exists(DataFlow::Node nodeTo |
-    method = call.getExpr().(MethodCall).getMethodName() and
-    nodeTo.asExpr() = call.getReceiver() and
-    sourceNode.flowsTo(nodeTo)
+  exists(DataFlow::Node receiver |
+    methodCall(call, receiver, method) and
+    sourceNode.flowsTo(receiver)
   )
 }
 
@@ -177,9 +186,94 @@ private predicate superCall(CfgNodes::ExprNodes::CallCfgNode call, Module superC
 
 pragma[nomagic]
 private predicate instanceMethodCall(CfgNodes::ExprNodes::CallCfgNode call, Module tp, string method) {
-  exists(DataFlow::LocalSourceNode sourceNode |
-    methodCall(call, sourceNode, method) and
-    sourceNode = trackInstance(tp)
+  exists(DataFlow::Node receiver, Module m, boolean exact |
+    methodCall(call, receiver, method) and
+    receiver = trackInstance(m, exact)
+  |
+    tp = m
+    or
+    // When we don't know the exact type, it could be any sub class
+    exact = false and
+    tp.getSuperClass+() = m
+  )
+}
+
+/** Holds if `self` belongs to module `m`. */
+pragma[nomagic]
+private predicate selfInModule(SelfVariable self, Module m) {
+  exists(Scope scope |
+    scope = self.getDeclaringScope() and
+    m = scope.(ModuleBase).getModule() and
+    not scope instanceof Toplevel
+  )
+}
+
+/** Holds if `self` belongs to method `method` inside module `m`. */
+pragma[nomagic]
+private predicate selfInMethod(SelfVariable self, MethodBase method, Module m) {
+  exists(ModuleBase encl |
+    method = self.getDeclaringScope() and
+    encl = method.getEnclosingModule() and
+    if encl instanceof SingletonClass
+    then m = encl.getEnclosingModule().getModule()
+    else m = encl.getModule()
+  )
+}
+
+/** Holds if `self` belongs to the top-level. */
+pragma[nomagic]
+private predicate selfInToplevel(SelfVariable self, Module m) {
+  self.getDeclaringScope() instanceof Toplevel and
+  m = TResolved("Object")
+}
+
+/**
+ * Holds if SSA definition `def` belongs to a variable introduced via pattern
+ * matching on type `m`. For example, in
+ *
+ * ```rb
+ * case object
+ *   in C => c then c.foo
+ * end
+ * ```
+ *
+ * the SSA definition for `c` is introduced by matching on `C`.
+ */
+private predicate asModulePattern(SsaDefinitionNode def, Module m) {
+  exists(AsPattern ap |
+    m = resolveConstantReadAccess(ap.getPattern()) and
+    def.getDefinition().(Ssa::WriteDefinition).getWriteAccess() = ap.getVariableAccess()
+  )
+}
+
+/**
+ * Holds if `read1` and `read2` are adjacent reads of SSA definition `def`,
+ * and `read2` is checked to have type `m`. For example, in
+ *
+ * ```rb
+ * case object
+ *   when C then object.foo
+ * end
+ * ```
+ *
+ * the two reads of `object` are adjacent, and the second is checked to have type `C`.
+ */
+private predicate hasAdjacentTypeCheckedReads(
+  Ssa::Definition def, CfgNodes::ExprCfgNode read1, CfgNodes::ExprCfgNode read2, Module m
+) {
+  exists(
+    CfgNodes::ExprCfgNode pattern, ConditionBlock cb, CfgNodes::ExprNodes::CaseExprCfgNode case
+  |
+    m = resolveConstantReadAccess(pattern.getExpr()) and
+    cb.getLastNode() = pattern and
+    cb.controls(read2.getBasicBlock(),
+      any(SuccessorTypes::MatchingSuccessor match | match.getValue() = true)) and
+    def.hasAdjacentReads(read1, read2) and
+    case.getValue() = read1
+  |
+    pattern = case.getBranch(_).(CfgNodes::ExprNodes::WhenClauseCfgNode).getPattern(_)
+    or
+    pattern = case.getBranch(_).(CfgNodes::ExprNodes::InClauseCfgNode).getPattern()
   )
 }
 
@@ -222,9 +316,45 @@ private module Cached {
           else any()
         )
         or
-        exists(DataFlow::LocalSourceNode sourceNode |
-          methodCall(call, sourceNode, method) and
-          sourceNode = trackSingletonMethod(result, method)
+        // singleton method defined on an instance, e.g.
+        // ```rb
+        // c = C.new
+        // def c.singleton; end # <- result
+        // c.singleton          # <- call
+        // ```
+        exists(DataFlow::Node receiver |
+          methodCall(call, receiver, method) and
+          receiver = trackSingletonMethodOnInstance(result, method)
+        )
+        or
+        // singleton method defined on a module
+        exists(DataFlow::Node sourceNode, Module m |
+          flowsToMethodCall(call, sourceNode, method) and
+          singletonMethodOnModule(result, method, m)
+        |
+          // ```rb
+          // def C.singleton; end # <- result
+          // C.singleton          # <- call
+          // ```
+          sourceNode = trackModuleAccess(m)
+          or
+          // ```rb
+          // class C
+          //   def self.singleton; end # <- result
+          //   self.singleton          # <- call
+          // end
+          // ```
+          selfInModule(sourceNode.(SsaSelfDefinitionNode).getVariable(), m)
+          or
+          // ```rb
+          // class C
+          //   def self.singleton; end # <- result
+          //   def self.other
+          //     self.singleton        # <- call
+          //   end
+          // end
+          // ```
+          selfInMethod(sourceNode.(SsaSelfDefinitionNode).getVariable(), _, m.getSuperClass*())
         )
       )
       or
@@ -293,73 +423,166 @@ private module Cached {
 
 import Cached
 
-private DataFlow::LocalSourceNode trackInstance(Module tp, TypeTracker t) {
-  t.start() and
-  (
-    result.asExpr().getExpr() instanceof NilLiteral and tp = TResolved("NilClass")
-    or
-    result.asExpr().getExpr().(BooleanLiteral).isFalse() and tp = TResolved("FalseClass")
-    or
-    result.asExpr().getExpr().(BooleanLiteral).isTrue() and tp = TResolved("TrueClass")
-    or
-    result.asExpr().getExpr() instanceof IntegerLiteral and tp = TResolved("Integer")
-    or
-    result.asExpr().getExpr() instanceof FloatLiteral and tp = TResolved("Float")
-    or
-    result.asExpr().getExpr() instanceof RationalLiteral and tp = TResolved("Rational")
-    or
-    result.asExpr().getExpr() instanceof ComplexLiteral and tp = TResolved("Complex")
-    or
-    result.asExpr().getExpr() instanceof StringlikeLiteral and tp = TResolved("String")
-    or
-    result.asExpr() instanceof CfgNodes::ExprNodes::ArrayLiteralCfgNode and tp = TResolved("Array")
-    or
-    result.asExpr() instanceof CfgNodes::ExprNodes::HashLiteralCfgNode and tp = TResolved("Hash")
-    or
-    result.asExpr().getExpr() instanceof MethodBase and tp = TResolved("Symbol")
-    or
-    result.asParameter() instanceof BlockParameter and tp = TResolved("Proc")
-    or
-    result.asExpr().getExpr() instanceof Lambda and tp = TResolved("Proc")
-    or
-    exists(CfgNodes::ExprNodes::CallCfgNode call, DataFlow::Node nodeTo |
-      call.getExpr().(MethodCall).getMethodName() = "new" and
-      nodeTo.asExpr() = call.getReceiver() and
-      trackModule(tp).flowsTo(nodeTo) and
-      result.asExpr() = call
-    )
-    or
-    // `self` in method
-    tp = result.(SsaSelfDefinitionNode).getSelfScope().(Method).getEnclosingModule().getModule()
-    or
-    // `self` in singleton method
-    flowsToSingletonMethodObject(trackInstance(tp), result.(SsaSelfDefinitionNode).getSelfScope())
-    or
-    // `self` in top-level
-    result.(SsaSelfDefinitionNode).getSelfScope() instanceof Toplevel and
-    tp = TResolved("Object")
-    or
-    // a module or class
-    exists(Module m |
-      result = trackModule(m) and
-      if m.isClass() then tp = TResolved("Class") else tp = TResolved("Module")
-    )
-  )
+pragma[nomagic]
+private DataFlow::LocalSourceNode trackModuleAccess(Module m, TypeTracker t) {
+  t.start() and m = resolveConstantReadAccess(result.asExpr().getExpr())
   or
   exists(TypeTracker t2, StepSummary summary |
-    result = trackInstanceRec(tp, t2, summary) and t = t2.append(summary)
+    result = trackModuleAccessRec(m, t2, summary) and t = t2.append(summary)
   )
 }
 
 pragma[nomagic]
-private DataFlow::LocalSourceNode trackInstanceRec(Module tp, TypeTracker t, StepSummary summary) {
-  StepSummary::step(trackInstance(tp, t), result, summary)
+private DataFlow::LocalSourceNode trackModuleAccessRec(Module m, TypeTracker t, StepSummary summary) {
+  StepSummary::step(trackModuleAccess(m, t), result, summary)
 }
 
-private DataFlow::LocalSourceNode trackInstance(Module tp) {
-  result = trackInstance(tp, TypeTracker::end())
+pragma[nomagic]
+private DataFlow::LocalSourceNode trackModuleAccess(Module m) {
+  result = trackModuleAccess(m, TypeTracker::end())
 }
 
+pragma[nomagic]
+private DataFlow::Node trackInstance(Module tp, boolean exact, TypeTracker t) {
+  t.start() and
+  (
+    result.asExpr().getExpr() instanceof NilLiteral and
+    tp = TResolved("NilClass") and
+    exact = true
+    or
+    result.asExpr().getExpr().(BooleanLiteral).isFalse() and
+    tp = TResolved("FalseClass") and
+    exact = true
+    or
+    result.asExpr().getExpr().(BooleanLiteral).isTrue() and
+    tp = TResolved("TrueClass") and
+    exact = true
+    or
+    result.asExpr().getExpr() instanceof IntegerLiteral and
+    tp = TResolved("Integer") and
+    exact = true
+    or
+    result.asExpr().getExpr() instanceof FloatLiteral and
+    tp = TResolved("Float") and
+    exact = true
+    or
+    result.asExpr().getExpr() instanceof RationalLiteral and
+    tp = TResolved("Rational") and
+    exact = true
+    or
+    result.asExpr().getExpr() instanceof ComplexLiteral and
+    tp = TResolved("Complex") and
+    exact = true
+    or
+    result.asExpr().getExpr() instanceof StringlikeLiteral and
+    tp = TResolved("String") and
+    exact = true
+    or
+    result.asExpr() instanceof CfgNodes::ExprNodes::ArrayLiteralCfgNode and
+    tp = TResolved("Array") and
+    exact = true
+    or
+    result.asExpr() instanceof CfgNodes::ExprNodes::HashLiteralCfgNode and
+    tp = TResolved("Hash") and
+    exact = true
+    or
+    result.asExpr().getExpr() instanceof MethodBase and
+    tp = TResolved("Symbol") and
+    exact = true
+    or
+    result.asParameter() instanceof BlockParameter and
+    tp = TResolved("Proc") and
+    exact = true
+    or
+    result.asExpr().getExpr() instanceof Lambda and
+    tp = TResolved("Proc") and
+    exact = true
+    or
+    exists(CfgNodes::ExprNodes::CallCfgNode call, DataFlow::LocalSourceNode sourceNode |
+      flowsToMethodCall(call, sourceNode, "new") and
+      exact = true and
+      result.asExpr() = call
+    |
+      // `C.new`
+      sourceNode = trackModuleAccess(tp)
+      or
+      // `self.new` inside a module
+      selfInModule(sourceNode.(SsaSelfDefinitionNode).getVariable(), tp)
+      or
+      // `self.new` inside a singleton method
+      selfInMethod(sourceNode.(SsaSelfDefinitionNode).getVariable(), any(SingletonMethod sm), tp)
+    )
+    or
+    // `self` reference in method or top-level (but not in module or singleton method,
+    // where instance methods cannot be called; only singleton methods)
+    result =
+      any(SsaSelfDefinitionNode self |
+        exists(MethodBase m |
+          selfInMethod(self.getVariable(), m, tp) and
+          not m instanceof SingletonMethod and
+          if m.getEnclosingModule() instanceof Toplevel then exact = true else exact = false
+        )
+        or
+        selfInToplevel(self.getVariable(), tp) and
+        exact = true
+      )
+    or
+    exists(Module m |
+      (if m.isClass() then tp = TResolved("Class") else tp = TResolved("Module")) and
+      exact = true
+    |
+      // needed for e.g. `C.new`
+      m = resolveConstantReadAccess(result.asExpr().getExpr())
+      or
+      // needed for e.g. `self.include`
+      selfInModule(result.(SsaSelfDefinitionNode).getVariable(), m)
+      or
+      // needed for e.g. `self.puts`
+      selfInMethod(result.(SsaSelfDefinitionNode).getVariable(), any(SingletonMethod sm), m)
+    )
+    or
+    // `in C => c then c.foo`
+    asModulePattern(result, tp) and
+    exact = false
+    or
+    // `case object when C then object.foo`
+    hasAdjacentTypeCheckedReads(_, _, result.asExpr(), tp) and
+    exact = false
+  )
+  or
+  exists(TypeTracker t2, StepSummary summary |
+    result = trackInstanceRec(tp, t2, exact, summary) and t = t2.append(summary)
+  )
+}
+
+private predicate localFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo, StepSummary summary) {
+  localFlowStepTypeTracker(nodeFrom, nodeTo) and
+  summary.toString() = "level"
+}
+
+/**
+ * We exclude steps into `self` parameters and type checked variables. For those,
+ * we instead rely on the type of the enclosing module resp. the type being checked
+ * against, and apply an open-world assumption when determining possible dispatch
+ * targets.
+ */
+pragma[nomagic]
+private DataFlow::Node trackInstanceRec(Module tp, TypeTracker t, boolean exact, StepSummary summary) {
+  exists(DataFlow::Node mid | mid = trackInstance(tp, exact, t) |
+    StepSummary::smallstep(mid, result, summary)
+    or
+    localFlowStep(mid, result, summary)
+  ) and
+  not result instanceof SelfParameterNode and
+  not hasAdjacentTypeCheckedReads(_, _, result.asExpr(), _)
+}
+
+pragma[nomagic]
+private DataFlow::Node trackInstance(Module tp, boolean exact) {
+  result = trackInstance(tp, exact, TypeTracker::end())
+}
+
+pragma[nomagic]
 private DataFlow::LocalSourceNode trackBlock(Block block, TypeTracker t) {
   t.start() and result.asExpr().getExpr() = block
   or
@@ -373,84 +596,190 @@ private DataFlow::LocalSourceNode trackBlockRec(Block block, TypeTracker t, Step
   StepSummary::step(trackBlock(block, t), result, summary)
 }
 
+pragma[nomagic]
 private DataFlow::LocalSourceNode trackBlock(Block block) {
   result = trackBlock(block, TypeTracker::end())
 }
 
-private predicate singletonMethod(MethodBase method, Expr object) {
-  object = method.(SingletonMethod).getObject()
-  or
-  exists(SingletonClass cls |
-    object = cls.getValue() and method instanceof Method and method = cls.getAMethod()
+/** Holds if `m` is a singleton method named `name`, defined on `object. */
+private predicate singletonMethod(MethodBase m, string name, Expr object) {
+  name = m.getName() and
+  (
+    object = m.(SingletonMethod).getObject()
+    or
+    m = any(SingletonClass cls | object = cls.getValue()).getAMethod().(Method)
   )
 }
 
 pragma[nomagic]
-private predicate flowsToSingletonMethodObject(DataFlow::LocalSourceNode nodeFrom, MethodBase method) {
+private predicate flowsToSingletonMethodObject(
+  DataFlow::LocalSourceNode nodeFrom, MethodBase m, string name
+) {
   exists(DataFlow::Node nodeTo |
     nodeFrom.flowsTo(nodeTo) and
-    singletonMethod(method, nodeTo.asExpr().getExpr())
+    singletonMethod(m, name, nodeTo.asExpr().getExpr())
   )
 }
 
+/**
+ * Holds if `method` is a singleton method named `name`, defined on module
+ * `m`:
+ *
+ * ```rb
+ * class C
+ *   def self.m1; end # included
+ *
+ *   class << self
+ *     def m2; end # included
+ *   end
+ * end
+ *
+ * def C.m3; end # included
+ *
+ * c_alias = C
+ * def c_alias.m4; end # included
+ *
+ * c = C.new
+ * def c.m5; end # not included
+ *
+ * class << c
+ *   def m6; end # not included
+ * end
+ * ```
+ */
 pragma[nomagic]
-private predicate moduleFlowsToSingletonMethodObject(Module m, MethodBase method) {
-  flowsToSingletonMethodObject(trackModule(m), method)
-}
-
-pragma[nomagic]
-private DataFlow::LocalSourceNode trackSingletonMethod0(MethodBase method, TypeTracker t) {
-  t.start() and
-  (
-    flowsToSingletonMethodObject(result, method)
-    or
-    exists(Module m | result = trackModule(m) and moduleFlowsToSingletonMethodObject(m, method))
+private predicate singletonMethodOnModule(MethodBase method, string name, Module m) {
+  exists(Expr object |
+    singletonMethod(method, name, object) and
+    selfInModule(object.(SelfVariableReadAccess).getVariable(), m)
   )
   or
-  exists(TypeTracker t2, StepSummary summary |
-    result = trackSingletonMethod0Rec(method, t2, summary) and t = t2.append(summary)
-  )
+  flowsToSingletonMethodObject(trackModuleAccess(m), method, name)
 }
 
+/**
+ * Holds if `method` is a singleton method named `name`, defined on expression
+ * `object`, where `object` is not likely to resolve to a module:
+ *
+ * ```rb
+ * class C
+ *   def self.m1; end # not included
+ *
+ *   class << self
+ *     def m2; end # not included
+ *   end
+ * end
+ *
+ * def C.m3; end # not included
+ *
+ * c_alias = C
+ * def c_alias.m4; end # included (due to negative recursion limitation)
+ *
+ * c = C.new
+ * def c.m5; end # included
+ *
+ * class << c
+ *   def m6; end # included
+ * end
+ * ```
+ */
 pragma[nomagic]
-private DataFlow::LocalSourceNode trackSingletonMethod0Rec(
-  MethodBase method, TypeTracker t, StepSummary summary
+predicate singletonMethodOnInstance(MethodBase method, string name, Expr object) {
+  singletonMethod(method, name, object) and
+  not selfInModule(object.(SelfVariableReadAccess).getVariable(), _) and
+  // cannot use `trackModuleAccess` because of negative recursion
+  not exists(resolveConstantReadAccess(object))
+}
+
+/**
+ * Holds if there is reverse flow from `nodeFrom` to `nodeTo` via a parameter.
+ *
+ * This is only used for tracking singleton methods, where we want to be able
+ * to handle cases like
+ *
+ * ```rb
+ * def add_singleton x
+ *   def x.foo; end
+ * end
+ *
+ * y = add_singleton C.new
+ * y.foo
+ * ```
+ *
+ * and
+ *
+ * ```rb
+ * class C
+ *   def add_singleton_to_self
+ *     def self.foo; end
+ *   end
+ * end
+ *
+ * y = C.new
+ * y.add_singleton_to_self
+ * y.foo
+ * ```
+ */
+pragma[nomagic]
+private predicate paramReturnFlow(
+  DataFlow::Node nodeFrom, DataFlow::PostUpdateNode nodeTo, StepSummary summary
 ) {
-  StepSummary::step(trackSingletonMethod0(method, t), result, summary)
+  exists(
+    CfgNodes::ExprNodes::CallCfgNode call, DataFlow::Node arg, DataFlow::ParameterNode p,
+    Expr nodeFromPreExpr
+  |
+    TypeTrackerSpecific::callStep(call, arg, p) and
+    nodeTo.getPreUpdateNode() = arg and
+    summary.toString() = "return" and
+    (
+      nodeFromPreExpr = nodeFrom.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr().getExpr()
+      or
+      nodeFromPreExpr = nodeFrom.asExpr().getExpr() and
+      singletonMethodOnInstance(_, _, nodeFromPreExpr)
+    )
+  |
+    nodeFromPreExpr = p.getParameter().(NamedParameter).getVariable().getAnAccess()
+    or
+    nodeFromPreExpr = p.(SelfParameterNode).getSelfVariable().getAnAccess()
+  )
 }
 
 pragma[nomagic]
-private DataFlow::LocalSourceNode trackSingletonMethod(MethodBase m, string name) {
-  result = trackSingletonMethod0(m, TypeTracker::end()) and
-  name = m.getName()
-}
-
-private SsaSelfDefinitionNode selfInModule(Module tp) {
-  tp = result.getSelfScope().(ModuleBase).getModule()
-}
-
-private DataFlow::LocalSourceNode trackModule(Module tp, TypeTracker t) {
+private DataFlow::Node trackSingletonMethodOnInstance(MethodBase method, string name, TypeTracker t) {
   t.start() and
-  (
-    // ConstantReadAccess to Module
-    resolveConstantReadAccess(result.asExpr().getExpr()) = tp
-    or
-    // `self` reference to Module
-    result = selfInModule(tp)
-  )
+  singletonMethodOnInstance(method, name, result.asExpr().getExpr())
   or
   exists(TypeTracker t2, StepSummary summary |
-    result = trackModuleRec(tp, t2, summary) and t = t2.append(summary)
+    result = trackSingletonMethodOnInstanceRec(method, name, t2, summary) and
+    t = t2.append(summary) and
+    // Stop flow at redefinitions.
+    //
+    // Example:
+    // ```rb
+    // def x.foo; end
+    // def x.foo; end
+    // x.foo # <- we want to resolve this call to the second definition only
+    // ```
+    not singletonMethodOnInstance(_, name, result.asExpr().getExpr())
   )
 }
 
 pragma[nomagic]
-private DataFlow::LocalSourceNode trackModuleRec(Module tp, TypeTracker t, StepSummary summary) {
-  StepSummary::step(trackModule(tp, t), result, summary)
+private DataFlow::Node trackSingletonMethodOnInstanceRec(
+  MethodBase method, string name, TypeTracker t, StepSummary summary
+) {
+  exists(DataFlow::Node mid | mid = trackSingletonMethodOnInstance(method, name, t) |
+    StepSummary::smallstep(mid, result, summary)
+    or
+    paramReturnFlow(mid, result, summary)
+    or
+    localFlowStep(mid, result, summary)
+  )
 }
 
-private DataFlow::LocalSourceNode trackModule(Module tp) {
-  result = trackModule(tp, TypeTracker::end())
+pragma[nomagic]
+private DataFlow::Node trackSingletonMethodOnInstance(MethodBase method, string name) {
+  result = trackSingletonMethodOnInstance(method, name, TypeTracker::end())
 }
 
 /**
@@ -565,6 +894,12 @@ class ArgumentPosition extends TArgumentPosition {
   }
 }
 
+pragma[nomagic]
+private predicate parameterPositionIsNotSelf(ParameterPosition ppos) { not ppos.isSelf() }
+
+pragma[nomagic]
+private predicate argumentPositionIsNotSelf(ArgumentPosition apos) { not apos.isSelf() }
+
 /** Holds if arguments at position `apos` match parameters at position `ppos`. */
 pragma[nomagic]
 predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) {
@@ -582,9 +917,9 @@ predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) {
   or
   ppos.isHashSplat() and apos.isHashSplat()
   or
-  ppos.isAny() and not apos.isSelf()
+  ppos.isAny() and argumentPositionIsNotSelf(apos)
   or
-  apos.isAny() and not ppos.isSelf()
+  apos.isAny() and parameterPositionIsNotSelf(ppos)
   or
   ppos.isAnyNamed() and apos.isKeyword(_)
   or
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForHttpClientLibraries.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForHttpClientLibraries.qll
new file mode 100644
index 00000000000..468f8640a78
--- /dev/null
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForHttpClientLibraries.qll
@@ -0,0 +1,4450 @@
+/**
+ * Provides an implementation of global (interprocedural) data flow. This file
+ * re-exports the local (intraprocedural) data flow analysis from
+ * `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
+ * through the `Configuration` class. This file exists in several identical
+ * copies, allowing queries to use multiple `Configuration` classes that depend
+ * on each other without introducing mutual recursion among those configurations.
+ */
+
+private import DataFlowImplCommon
+private import DataFlowImplSpecific::Private
+import DataFlowImplSpecific::Public
+import DataFlowImplCommonPublic
+
+/**
+ * A configuration of interprocedural data flow analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the global data flow library must define its own unique extension
+ * of this abstract class. To create a configuration, extend this class with
+ * a subclass whose characteristic predicate is a unique singleton string.
+ * For example, write
+ *
+ * ```ql
+ * class MyAnalysisConfiguration extends DataFlow::Configuration {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Optionally override `isBarrier`.
+ *   // Optionally override `isAdditionalFlowStep`.
+ * }
+ * ```
+ * Conceptually, this defines a graph where the nodes are `DataFlow::Node`s and
+ * the edges are those data-flow steps that preserve the value of the node
+ * along with any additional edges defined by `isAdditionalFlowStep`.
+ * Specifying nodes in `isBarrier` will remove those nodes from the graph, and
+ * specifying nodes in `isBarrierIn` and/or `isBarrierOut` will remove in-going
+ * and/or out-going edges from those nodes, respectively.
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```ql
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but two classes extending
+ * `DataFlow::Configuration` should never depend on each other. One of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`.
+ */
+abstract class Configuration extends string {
+  bindingset[this]
+  Configuration() { any() }
+
+  /**
+   * Holds if `source` is a relevant data flow source.
+   */
+  predicate isSource(Node source) { none() }
+
+  /**
+   * Holds if `source` is a relevant data flow source with the given initial
+   * `state`.
+   */
+  predicate isSource(Node source, FlowState state) { none() }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink.
+   */
+  predicate isSink(Node sink) { none() }
+
+  /**
+   * Holds if `sink` is a relevant data flow sink accepting `state`.
+   */
+  predicate isSink(Node source, FlowState state) { none() }
+
+  /**
+   * Holds if data flow through `node` is prohibited. This completely removes
+   * `node` from the data flow graph.
+   */
+  predicate isBarrier(Node node) { none() }
+
+  /**
+   * Holds if data flow through `node` is prohibited when the flow state is
+   * `state`.
+   */
+  predicate isBarrier(Node node, FlowState state) { none() }
+
+  /** Holds if data flow into `node` is prohibited. */
+  predicate isBarrierIn(Node node) { none() }
+
+  /** Holds if data flow out of `node` is prohibited. */
+  predicate isBarrierOut(Node node) { none() }
+
+  /**
+   * DEPRECATED: Use `isBarrier` and `BarrierGuard` module instead.
+   *
+   * Holds if data flow through nodes guarded by `guard` is prohibited.
+   */
+  deprecated predicate isBarrierGuard(BarrierGuard guard) { none() }
+
+  /**
+   * DEPRECATED: Use `isBarrier` and `BarrierGuard` module instead.
+   *
+   * Holds if data flow through nodes guarded by `guard` is prohibited when
+   * the flow state is `state`
+   */
+  deprecated predicate isBarrierGuard(BarrierGuard guard, FlowState state) { none() }
+
+  /**
+   * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
+   */
+  predicate isAdditionalFlowStep(Node node1, Node node2) { none() }
+
+  /**
+   * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps.
+   * This step is only applicable in `state1` and updates the flow state to `state2`.
+   */
+  predicate isAdditionalFlowStep(Node node1, FlowState state1, Node node2, FlowState state2) {
+    none()
+  }
+
+  /**
+   * Holds if an arbitrary number of implicit read steps of content `c` may be
+   * taken at `node`.
+   */
+  predicate allowImplicitRead(Node node, ContentSet c) { none() }
+
+  /**
+   * Gets the virtual dispatch branching limit when calculating field flow.
+   * This can be overridden to a smaller value to improve performance (a
+   * value of 0 disables field flow), or a larger value to get more results.
+   */
+  int fieldFlowBranchLimit() { result = 2 }
+
+  /**
+   * Gets a data flow configuration feature to add restrictions to the set of
+   * valid flow paths.
+   *
+   * - `FeatureHasSourceCallContext`:
+   *    Assume that sources have some existing call context to disallow
+   *    conflicting return-flow directly following the source.
+   * - `FeatureHasSinkCallContext`:
+   *    Assume that sinks have some existing call context to disallow
+   *    conflicting argument-to-parameter flow directly preceding the sink.
+   * - `FeatureEqualSourceSinkCallContext`:
+   *    Implies both of the above and additionally ensures that the entire flow
+   *    path preserves the call context.
+   */
+  FlowFeature getAFeature() { none() }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   */
+  predicate hasFlow(Node source, Node sink) { flowsTo(source, sink, this) }
+
+  /**
+   * Holds if data may flow from `source` to `sink` for this configuration.
+   *
+   * The corresponding paths are generated from the end-points and the graph
+   * included in the module `PathGraph`.
+   */
+  predicate hasFlowPath(PathNode source, PathNode sink) { flowsTo(source, sink, _, _, this) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowTo(Node sink) { this.hasFlow(_, sink) }
+
+  /**
+   * Holds if data may flow from some source to `sink` for this configuration.
+   */
+  predicate hasFlowToExpr(DataFlowExpr sink) { this.hasFlowTo(exprNode(sink)) }
+
+  /**
+   * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
+   * measured in approximate number of interprocedural steps.
+   */
+  int explorationLimit() { none() }
+
+  /**
+   * Holds if hidden nodes should be included in the data flow graph.
+   *
+   * This feature should only be used for debugging or when the data flow graph
+   * is not visualized (for example in a `path-problem` query).
+   */
+  predicate includeHiddenNodes() { none() }
+
+  /**
+   * Holds if there is a partial data flow path from `source` to `node`. The
+   * approximate distance between `node` and the closest source is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards sink definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sources is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   */
+  final predicate hasPartialFlow(PartialPathNode source, PartialPathNode node, int dist) {
+    partialFlow(source, node, this) and
+    dist = node.getSourceDistance()
+  }
+
+  /**
+   * Holds if there is a partial data flow path from `node` to `sink`. The
+   * approximate distance between `node` and the closest sink is `dist` and
+   * is restricted to be less than or equal to `explorationLimit()`. This
+   * predicate completely disregards source definitions.
+   *
+   * This predicate is intended for data-flow exploration and debugging and may
+   * perform poorly if the number of sinks is too big and/or the exploration
+   * limit is set too high without using barriers.
+   *
+   * This predicate is disabled (has no results) by default. Override
+   * `explorationLimit()` with a suitable number to enable this predicate.
+   *
+   * To use this in a `path-problem` query, import the module `PartialPathGraph`.
+   *
+   * Note that reverse flow has slightly lower precision than the corresponding
+   * forward flow, as reverse flow disregards type pruning among other features.
+   */
+  final predicate hasPartialFlowRev(PartialPathNode node, PartialPathNode sink, int dist) {
+    revPartialFlow(node, sink, this) and
+    dist = node.getSinkDistance()
+  }
+}
+
+/**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ */
+abstract private class ConfigurationRecursionPrevention extends Configuration {
+  bindingset[this]
+  ConfigurationRecursionPrevention() { any() }
+
+  override predicate hasFlow(Node source, Node sink) {
+    strictcount(Node n | this.isSource(n)) < 0
+    or
+    strictcount(Node n | this.isSource(n, _)) < 0
+    or
+    strictcount(Node n | this.isSink(n)) < 0
+    or
+    strictcount(Node n | this.isSink(n, _)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+    or
+    strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, _, n2, _)) < 0
+    or
+    super.hasFlow(source, sink)
+  }
+}
+
+private newtype TNodeEx =
+  TNodeNormal(Node n) or
+  TNodeImplicitRead(Node n, boolean hasRead) {
+    any(Configuration c).allowImplicitRead(n, _) and hasRead = [false, true]
+  }
+
+private class NodeEx extends TNodeEx {
+  string toString() {
+    result = this.asNode().toString()
+    or
+    exists(Node n | this.isImplicitReadNode(n, _) | result = n.toString() + " [Ext]")
+  }
+
+  Node asNode() { this = TNodeNormal(result) }
+
+  predicate isImplicitReadNode(Node n, boolean hasRead) { this = TNodeImplicitRead(n, hasRead) }
+
+  Node projectToNode() { this = TNodeNormal(result) or this = TNodeImplicitRead(result, _) }
+
+  pragma[nomagic]
+  private DataFlowCallable getEnclosingCallable0() {
+    nodeEnclosingCallable(this.projectToNode(), result)
+  }
+
+  pragma[inline]
+  DataFlowCallable getEnclosingCallable() {
+    pragma[only_bind_out](this).getEnclosingCallable0() = pragma[only_bind_into](result)
+  }
+
+  pragma[nomagic]
+  private DataFlowType getDataFlowType0() { nodeDataFlowType(this.asNode(), result) }
+
+  pragma[inline]
+  DataFlowType getDataFlowType() {
+    pragma[only_bind_out](this).getDataFlowType0() = pragma[only_bind_into](result)
+  }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.projectToNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+private class ArgNodeEx extends NodeEx {
+  ArgNodeEx() { this.asNode() instanceof ArgNode }
+}
+
+private class ParamNodeEx extends NodeEx {
+  ParamNodeEx() { this.asNode() instanceof ParamNode }
+
+  predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) {
+    this.asNode().(ParamNode).isParameterOf(c, pos)
+  }
+
+  ParameterPosition getPosition() { this.isParameterOf(_, result) }
+
+  predicate allowParameterReturnInSelf() { allowParameterReturnInSelfCached(this.asNode()) }
+}
+
+private class RetNodeEx extends NodeEx {
+  RetNodeEx() { this.asNode() instanceof ReturnNodeExt }
+
+  ReturnPosition getReturnPosition() { result = getReturnPosition(this.asNode()) }
+
+  ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
+}
+
+private predicate inBarrier(NodeEx node, Configuration config) {
+  exists(Node n |
+    node.asNode() = n and
+    config.isBarrierIn(n)
+  |
+    config.isSource(n) or config.isSource(n, _)
+  )
+}
+
+private predicate outBarrier(NodeEx node, Configuration config) {
+  exists(Node n |
+    node.asNode() = n and
+    config.isBarrierOut(n)
+  |
+    config.isSink(n) or config.isSink(n, _)
+  )
+}
+
+/** A bridge class to access the deprecated `isBarrierGuard`. */
+private class BarrierGuardGuardedNodeBridge extends Unit {
+  abstract predicate guardedNode(Node n, Configuration config);
+
+  abstract predicate guardedNode(Node n, FlowState state, Configuration config);
+}
+
+private class BarrierGuardGuardedNode extends BarrierGuardGuardedNodeBridge {
+  deprecated override predicate guardedNode(Node n, Configuration config) {
+    exists(BarrierGuard g |
+      config.isBarrierGuard(g) and
+      n = g.getAGuardedNode()
+    )
+  }
+
+  deprecated override predicate guardedNode(Node n, FlowState state, Configuration config) {
+    exists(BarrierGuard g |
+      config.isBarrierGuard(g, state) and
+      n = g.getAGuardedNode()
+    )
+  }
+}
+
+pragma[nomagic]
+private predicate fullBarrier(NodeEx node, Configuration config) {
+  exists(Node n | node.asNode() = n |
+    config.isBarrier(n)
+    or
+    config.isBarrierIn(n) and
+    not config.isSource(n) and
+    not config.isSource(n, _)
+    or
+    config.isBarrierOut(n) and
+    not config.isSink(n) and
+    not config.isSink(n, _)
+    or
+    any(BarrierGuardGuardedNodeBridge b).guardedNode(n, config)
+  )
+}
+
+pragma[nomagic]
+private predicate stateBarrier(NodeEx node, FlowState state, Configuration config) {
+  exists(Node n | node.asNode() = n |
+    config.isBarrier(n, state)
+    or
+    any(BarrierGuardGuardedNodeBridge b).guardedNode(n, state, config)
+  )
+}
+
+pragma[nomagic]
+private predicate sourceNode(NodeEx node, FlowState state, Configuration config) {
+  (
+    config.isSource(node.asNode()) and state instanceof FlowStateEmpty
+    or
+    config.isSource(node.asNode(), state)
+  ) and
+  not fullBarrier(node, config) and
+  not stateBarrier(node, state, config)
+}
+
+pragma[nomagic]
+private predicate sinkNode(NodeEx node, FlowState state, Configuration config) {
+  (
+    config.isSink(node.asNode()) and state instanceof FlowStateEmpty
+    or
+    config.isSink(node.asNode(), state)
+  ) and
+  not fullBarrier(node, config) and
+  not stateBarrier(node, state, config)
+}
+
+/** Provides the relevant barriers for a step from `node1` to `node2`. */
+pragma[inline]
+private predicate stepFilter(NodeEx node1, NodeEx node2, Configuration config) {
+  not outBarrier(node1, config) and
+  not inBarrier(node2, config) and
+  not fullBarrier(node1, config) and
+  not fullBarrier(node2, config)
+}
+
+/**
+ * Holds if data can flow in one local step from `node1` to `node2`.
+ */
+private predicate localFlowStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    simpleLocalFlowStepExt(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    stepFilter(node1, node2, config)
+  )
+  or
+  exists(Node n |
+    config.allowImplicitRead(n, _) and
+    node1.asNode() = n and
+    node2.isImplicitReadNode(n, false) and
+    not fullBarrier(node1, config)
+  )
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` does not jump between callables.
+ */
+private predicate additionalLocalFlowStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config)
+  )
+  or
+  exists(Node n |
+    config.allowImplicitRead(n, _) and
+    node1.isImplicitReadNode(n, true) and
+    node2.asNode() = n and
+    not fullBarrier(node2, config)
+  )
+}
+
+private predicate additionalLocalStateStep(
+  NodeEx node1, FlowState s1, NodeEx node2, FlowState s2, Configuration config
+) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), s1, pragma[only_bind_into](n2), s2) and
+    getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not stateBarrier(node1, s1, config) and
+    not stateBarrier(node2, s2, config)
+  )
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` in a way that discards call contexts.
+ */
+private predicate jumpStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    jumpStepCached(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    stepFilter(node1, node2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+/**
+ * Holds if the additional step from `node1` to `node2` jumps between callables.
+ */
+private predicate additionalJumpStep(NodeEx node1, NodeEx node2, Configuration config) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), pragma[only_bind_into](n2)) and
+    getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private predicate additionalJumpStateStep(
+  NodeEx node1, FlowState s1, NodeEx node2, FlowState s2, Configuration config
+) {
+  exists(Node n1, Node n2 |
+    node1.asNode() = n1 and
+    node2.asNode() = n2 and
+    config.isAdditionalFlowStep(pragma[only_bind_into](n1), s1, pragma[only_bind_into](n2), s2) and
+    getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
+    stepFilter(node1, node2, config) and
+    not stateBarrier(node1, s1, config) and
+    not stateBarrier(node2, s2, config) and
+    not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+pragma[nomagic]
+private predicate readSet(NodeEx node1, ContentSet c, NodeEx node2, Configuration config) {
+  readSet(pragma[only_bind_into](node1.asNode()), c, pragma[only_bind_into](node2.asNode())) and
+  stepFilter(node1, node2, config)
+  or
+  exists(Node n |
+    node2.isImplicitReadNode(n, true) and
+    node1.isImplicitReadNode(n, _) and
+    config.allowImplicitRead(n, c)
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate read(NodeEx node1, Content c, NodeEx node2, Configuration config) {
+  exists(ContentSet cs |
+    readSet(node1, cs, node2, config) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate clearsContentEx(NodeEx n, Content c) {
+  exists(ContentSet cs |
+    clearsContentCached(n.asNode(), cs) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+// inline to reduce fan-out via `getAReadContent`
+bindingset[c]
+private predicate expectsContentEx(NodeEx n, Content c) {
+  exists(ContentSet cs |
+    expectsContentCached(n.asNode(), cs) and
+    pragma[only_bind_out](c) = pragma[only_bind_into](cs).getAReadContent()
+  )
+}
+
+pragma[nomagic]
+private predicate notExpectsContent(NodeEx n) { not expectsContentCached(n.asNode(), _) }
+
+pragma[nomagic]
+private predicate store(
+  NodeEx node1, TypedContent tc, NodeEx node2, DataFlowType contentType, Configuration config
+) {
+  store(pragma[only_bind_into](node1.asNode()), tc, pragma[only_bind_into](node2.asNode()),
+    contentType) and
+  read(_, tc.getContent(), _, config) and
+  stepFilter(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutEx(DataFlowCall call, ReturnPosition pos, NodeEx out) {
+  viableReturnPosOut(call, pos, out.asNode())
+}
+
+pragma[nomagic]
+private predicate viableParamArgEx(DataFlowCall call, ParamNodeEx p, ArgNodeEx arg) {
+  viableParamArg(call, p.asNode(), arg.asNode())
+}
+
+/**
+ * Holds if field flow should be used for the given configuration.
+ */
+private predicate useFieldFlow(Configuration config) { config.fieldFlowBranchLimit() >= 1 }
+
+private predicate hasSourceCallCtx(Configuration config) {
+  exists(FlowFeature feature | feature = config.getAFeature() |
+    feature instanceof FeatureHasSourceCallContext or
+    feature instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private predicate hasSinkCallCtx(Configuration config) {
+  exists(FlowFeature feature | feature = config.getAFeature() |
+    feature instanceof FeatureHasSinkCallContext or
+    feature instanceof FeatureEqualSourceSinkCallContext
+  )
+}
+
+private module Stage1 implements StageSig {
+  class ApApprox = Unit;
+
+  class Ap = Unit;
+
+  class ApOption = Unit;
+
+  class Cc = boolean;
+
+  /* Begin: Stage 1 logic. */
+  /**
+   * Holds if `node` is reachable from a source in the configuration `config`.
+   *
+   * The Boolean `cc` records whether the node is reached through an
+   * argument in a call.
+   */
+  predicate fwdFlow(NodeEx node, Cc cc, Configuration config) {
+    sourceNode(node, _, config) and
+    if hasSourceCallCtx(config) then cc = true else cc = false
+    or
+    exists(NodeEx mid | fwdFlow(mid, cc, config) |
+      localFlowStep(mid, node, config) or
+      additionalLocalFlowStep(mid, node, config) or
+      additionalLocalStateStep(mid, _, node, _, config)
+    )
+    or
+    exists(NodeEx mid | fwdFlow(mid, _, config) and cc = false |
+      jumpStep(mid, node, config) or
+      additionalJumpStep(mid, node, config) or
+      additionalJumpStateStep(mid, _, node, _, config)
+    )
+    or
+    // store
+    exists(NodeEx mid |
+      useFieldFlow(config) and
+      fwdFlow(mid, cc, config) and
+      store(mid, _, node, _, config)
+    )
+    or
+    // read
+    exists(ContentSet c |
+      fwdFlowReadSet(c, node, cc, config) and
+      fwdFlowConsCandSet(c, _, config)
+    )
+    or
+    // flow into a callable
+    exists(NodeEx arg |
+      fwdFlow(arg, _, config) and
+      viableParamArgEx(_, node, arg) and
+      cc = true and
+      not fullBarrier(node, config)
+    )
+    or
+    // flow out of a callable
+    exists(DataFlowCall call |
+      fwdFlowOut(call, node, false, config) and
+      cc = false
+      or
+      fwdFlowOutFromArg(call, node, config) and
+      fwdFlowIsEntered(call, cc, config)
+    )
+  }
+
+  private predicate fwdFlow(NodeEx node, Configuration config) { fwdFlow(node, _, config) }
+
+  pragma[nomagic]
+  private predicate fwdFlowReadSet(ContentSet c, NodeEx node, Cc cc, Configuration config) {
+    exists(NodeEx mid |
+      fwdFlow(mid, cc, config) and
+      readSet(mid, c, node, config)
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a store in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCand(Content c, Configuration config) {
+    exists(NodeEx mid, NodeEx node, TypedContent tc |
+      not fullBarrier(node, config) and
+      useFieldFlow(config) and
+      fwdFlow(mid, _, config) and
+      store(mid, tc, node, _, config) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `cs` may be interpreted in a read as the target of some store
+   * into `c`, in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowConsCandSet(ContentSet cs, Content c, Configuration config) {
+    fwdFlowConsCand(c, config) and
+    c = cs.getAReadContent()
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowReturnPosition(ReturnPosition pos, Cc cc, Configuration config) {
+    exists(RetNodeEx ret |
+      fwdFlow(ret, cc, config) and
+      ret.getReturnPosition() = pos
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOut(DataFlowCall call, NodeEx out, Cc cc, Configuration config) {
+    exists(ReturnPosition pos |
+      fwdFlowReturnPosition(pos, cc, config) and
+      viableReturnPosOutEx(call, pos, out) and
+      not fullBarrier(out, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate fwdFlowOutFromArg(DataFlowCall call, NodeEx out, Configuration config) {
+    fwdFlowOut(call, out, true, config)
+  }
+
+  /**
+   * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`.
+   */
+  pragma[nomagic]
+  private predicate fwdFlowIsEntered(DataFlowCall call, Cc cc, Configuration config) {
+    exists(ArgNodeEx arg |
+      fwdFlow(arg, cc, config) and
+      viableParamArgEx(call, _, arg)
+    )
+  }
+
+  private predicate stateStepFwd(FlowState state1, FlowState state2, Configuration config) {
+    exists(NodeEx node1 |
+      additionalLocalStateStep(node1, state1, _, state2, config) or
+      additionalJumpStateStep(node1, state1, _, state2, config)
+    |
+      fwdFlow(node1, config)
+    )
+  }
+
+  private predicate fwdFlowState(FlowState state, Configuration config) {
+    sourceNode(_, state, config)
+    or
+    exists(FlowState state0 |
+      fwdFlowState(state0, config) and
+      stateStepFwd(state0, state, config)
+    )
+  }
+
+  /**
+   * Holds if `node` is part of a path from a source to a sink in the
+   * configuration `config`.
+   *
+   * The Boolean `toReturn` records whether the node must be returned from
+   * the enclosing callable in order to reach a sink.
+   */
+  pragma[nomagic]
+  predicate revFlow(NodeEx node, boolean toReturn, Configuration config) {
+    revFlow0(node, toReturn, config) and
+    fwdFlow(node, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlow0(NodeEx node, boolean toReturn, Configuration config) {
+    exists(FlowState state |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      sinkNode(node, state, config) and
+      fwdFlowState(state, pragma[only_bind_into](config)) and
+      if hasSinkCallCtx(config) then toReturn = true else toReturn = false
+    )
+    or
+    exists(NodeEx mid | revFlow(mid, toReturn, config) |
+      localFlowStep(node, mid, config) or
+      additionalLocalFlowStep(node, mid, config) or
+      additionalLocalStateStep(node, _, mid, _, config)
+    )
+    or
+    exists(NodeEx mid | revFlow(mid, _, config) and toReturn = false |
+      jumpStep(node, mid, config) or
+      additionalJumpStep(node, mid, config) or
+      additionalJumpStateStep(node, _, mid, _, config)
+    )
+    or
+    // store
+    exists(Content c |
+      revFlowStore(c, node, toReturn, config) and
+      revFlowConsCand(c, config)
+    )
+    or
+    // read
+    exists(NodeEx mid, ContentSet c |
+      readSet(node, c, mid, config) and
+      fwdFlowConsCandSet(c, _, pragma[only_bind_into](config)) and
+      revFlow(mid, toReturn, pragma[only_bind_into](config))
+    )
+    or
+    // flow into a callable
+    exists(DataFlowCall call |
+      revFlowIn(call, node, false, config) and
+      toReturn = false
+      or
+      revFlowInToReturn(call, node, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+    or
+    // flow out of a callable
+    exists(ReturnPosition pos |
+      revFlowOut(pos, config) and
+      node.(RetNodeEx).getReturnPosition() = pos and
+      toReturn = true
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of a read in the flow covered by `revFlow`.
+   */
+  pragma[nomagic]
+  private predicate revFlowConsCand(Content c, Configuration config) {
+    exists(NodeEx mid, NodeEx node, ContentSet cs |
+      fwdFlow(node, pragma[only_bind_into](config)) and
+      readSet(node, cs, mid, config) and
+      fwdFlowConsCandSet(cs, c, pragma[only_bind_into](config)) and
+      revFlow(pragma[only_bind_into](mid), _, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowStore(Content c, NodeEx node, boolean toReturn, Configuration config) {
+    exists(NodeEx mid, TypedContent tc |
+      revFlow(mid, toReturn, pragma[only_bind_into](config)) and
+      fwdFlowConsCand(c, pragma[only_bind_into](config)) and
+      store(node, tc, mid, _, config) and
+      c = tc.getContent()
+    )
+  }
+
+  /**
+   * Holds if `c` is the target of both a read and a store in the flow covered
+   * by `revFlow`.
+   */
+  pragma[nomagic]
+  predicate revFlowIsReadAndStored(Content c, Configuration conf) {
+    revFlowConsCand(c, conf) and
+    revFlowStore(c, _, _, conf)
+  }
+
+  pragma[nomagic]
+  predicate viableReturnPosOutNodeCandFwd1(
+    DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
+  ) {
+    fwdFlowReturnPosition(pos, _, config) and
+    viableReturnPosOutEx(call, pos, out)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
+    exists(DataFlowCall call, NodeEx out |
+      revFlow(out, _, config) and
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate viableParamArgNodeCandFwd1(
+    DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
+  ) {
+    viableParamArgEx(call, p, arg) and
+    fwdFlow(arg, config)
+  }
+
+  pragma[nomagic]
+  private predicate revFlowIn(
+    DataFlowCall call, ArgNodeEx arg, boolean toReturn, Configuration config
+  ) {
+    exists(ParamNodeEx p |
+      revFlow(p, toReturn, config) and
+      viableParamArgNodeCandFwd1(call, p, arg, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revFlowInToReturn(DataFlowCall call, ArgNodeEx arg, Configuration config) {
+    revFlowIn(call, arg, true, config)
+  }
+
+  /**
+   * Holds if an output from `call` is reached in the flow covered by `revFlow`
+   * and data might flow through the target callable resulting in reverse flow
+   * reaching an argument of `call`.
+   */
+  pragma[nomagic]
+  private predicate revFlowIsReturned(DataFlowCall call, boolean toReturn, Configuration config) {
+    exists(NodeEx out |
+      revFlow(out, toReturn, config) and
+      fwdFlowOutFromArg(call, out, config)
+    )
+  }
+
+  private predicate stateStepRev(FlowState state1, FlowState state2, Configuration config) {
+    exists(NodeEx node1, NodeEx node2 |
+      additionalLocalStateStep(node1, state1, node2, state2, config) or
+      additionalJumpStateStep(node1, state1, node2, state2, config)
+    |
+      revFlow(node1, _, pragma[only_bind_into](config)) and
+      revFlow(node2, _, pragma[only_bind_into](config)) and
+      fwdFlowState(state1, pragma[only_bind_into](config)) and
+      fwdFlowState(state2, pragma[only_bind_into](config))
+    )
+  }
+
+  predicate revFlowState(FlowState state, Configuration config) {
+    exists(NodeEx node |
+      sinkNode(node, state, config) and
+      revFlow(node, _, pragma[only_bind_into](config)) and
+      fwdFlowState(state, pragma[only_bind_into](config))
+    )
+    or
+    exists(FlowState state0 |
+      revFlowState(state0, config) and
+      stateStepRev(state, state0, config)
+    )
+  }
+
+  pragma[nomagic]
+  predicate storeStepCand(
+    NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+    Configuration config
+  ) {
+    exists(Content c |
+      revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      revFlow(node2, pragma[only_bind_into](config)) and
+      store(node1, tc, node2, contentType, config) and
+      c = tc.getContent() and
+      exists(ap1)
+    )
+  }
+
+  pragma[nomagic]
+  predicate readStepCand(NodeEx n1, Content c, NodeEx n2, Configuration config) {
+    revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+    read(n1, c, n2, pragma[only_bind_into](config)) and
+    revFlow(n2, pragma[only_bind_into](config))
+  }
+
+  pragma[nomagic]
+  predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, config) }
+
+  bindingset[node, state, config]
+  predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    revFlow(node, _, pragma[only_bind_into](config)) and
+    exists(state) and
+    exists(ap)
+  }
+
+  private predicate throughFlowNodeCand(NodeEx node, Configuration config) {
+    revFlow(node, true, config) and
+    fwdFlow(node, true, config) and
+    not inBarrier(node, config) and
+    not outBarrier(node, config)
+  }
+
+  /** Holds if flow may return from `callable`. */
+  pragma[nomagic]
+  private predicate returnFlowCallableNodeCand(
+    DataFlowCallable callable, ReturnKindExt kind, Configuration config
+  ) {
+    exists(RetNodeEx ret |
+      throughFlowNodeCand(ret, config) and
+      callable = ret.getEnclosingCallable() and
+      kind = ret.getKind()
+    )
+  }
+
+  /**
+   * Holds if flow may enter through `p` and reach a return node making `p` a
+   * candidate for the origin of a summary.
+   */
+  pragma[nomagic]
+  predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
+    exists(ReturnKindExt kind |
+      throughFlowNodeCand(p, config) and
+      returnFlowCallableNodeCand(c, kind, config) and
+      p.getEnclosingCallable() = c and
+      exists(ap) and
+      // we don't expect a parameter to return stored in itself, unless explicitly allowed
+      (
+        not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
+        or
+        p.allowParameterReturnInSelf()
+      )
+    )
+  }
+
+  pragma[nomagic]
+  predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
+    exists(ArgNodeEx arg, boolean toReturn |
+      revFlow(arg, toReturn, config) and
+      revFlowInToReturn(call, arg, config) and
+      revFlowIsReturned(call, toReturn, config)
+    )
+  }
+
+  predicate stats(
+    boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
+  ) {
+    fwd = true and
+    nodes = count(NodeEx node | fwdFlow(node, config)) and
+    fields = count(Content f0 | fwdFlowConsCand(f0, config)) and
+    conscand = -1 and
+    states = count(FlowState state | fwdFlowState(state, config)) and
+    tuples = count(NodeEx n, boolean b | fwdFlow(n, b, config))
+    or
+    fwd = false and
+    nodes = count(NodeEx node | revFlow(node, _, config)) and
+    fields = count(Content f0 | revFlowConsCand(f0, config)) and
+    conscand = -1 and
+    states = count(FlowState state | revFlowState(state, config)) and
+    tuples = count(NodeEx n, boolean b | revFlow(n, b, config))
+  }
+  /* End: Stage 1 logic. */
+}
+
+pragma[noinline]
+private predicate localFlowStepNodeCand1(NodeEx node1, NodeEx node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  localFlowStep(node1, node2, config)
+}
+
+pragma[noinline]
+private predicate additionalLocalFlowStepNodeCand1(NodeEx node1, NodeEx node2, Configuration config) {
+  Stage1::revFlow(node2, config) and
+  additionalLocalFlowStep(node1, node2, config)
+}
+
+pragma[nomagic]
+private predicate viableReturnPosOutNodeCand1(
+  DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
+) {
+  Stage1::revFlow(out, config) and
+  Stage1::viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, RetNodeEx ret, NodeEx out, Configuration config
+) {
+  viableReturnPosOutNodeCand1(call, ret.getReturnPosition(), out, config) and
+  Stage1::revFlow(ret, config) and
+  not outBarrier(ret, config) and
+  not inBarrier(out, config)
+}
+
+pragma[nomagic]
+private predicate viableParamArgNodeCand1(
+  DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
+) {
+  Stage1::viableParamArgNodeCandFwd1(call, p, arg, config) and
+  Stage1::revFlow(arg, config)
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, Configuration config
+) {
+  viableParamArgNodeCand1(call, p, arg, config) and
+  Stage1::revFlow(p, config) and
+  not outBarrier(arg, config) and
+  not inBarrier(p, config)
+}
+
+/**
+ * Gets the amount of forward branching on the origin of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int branch(NodeEx n1, Configuration conf) {
+  result =
+    strictcount(NodeEx n |
+      flowOutOfCallNodeCand1(_, n1, n, conf) or flowIntoCallNodeCand1(_, n1, n, conf)
+    )
+}
+
+/**
+ * Gets the amount of backward branching on the target of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+private int join(NodeEx n2, Configuration conf) {
+  result =
+    strictcount(NodeEx n |
+      flowOutOfCallNodeCand1(_, n, n2, conf) or flowIntoCallNodeCand1(_, n, n2, conf)
+    )
+}
+
+/**
+ * Holds if data can flow out of `call` from `ret` to `out`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink. The
+ * `allowsFieldFlow` flag indicates whether the branching is within the limit
+ * specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand1(
+  DataFlowCall call, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, ret, out, config) and
+  exists(int b, int j |
+    b = branch(ret, config) and
+    j = join(out, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+/**
+ * Holds if data can flow into `call` and that this step is part of a
+ * path from a source to a sink. The `allowsFieldFlow` flag indicates whether
+ * the branching is within the limit specified by the configuration.
+ */
+pragma[nomagic]
+private predicate flowIntoCallNodeCand1(
+  DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+) {
+  flowIntoCallNodeCand1(call, arg, p, config) and
+  exists(int b, int j |
+    b = branch(arg, config) and
+    j = join(p, config) and
+    if b.minimum(j) <= config.fieldFlowBranchLimit()
+    then allowsFieldFlow = true
+    else allowsFieldFlow = false
+  )
+}
+
+private signature module StageSig {
+  class Ap;
+
+  predicate revFlow(NodeEx node, Configuration config);
+
+  bindingset[node, state, config]
+  predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config);
+
+  predicate callMayFlowThroughRev(DataFlowCall call, Configuration config);
+
+  predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config);
+
+  predicate storeStepCand(
+    NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+    Configuration config
+  );
+
+  predicate readStepCand(NodeEx n1, Content c, NodeEx n2, Configuration config);
+}
+
+private module MkStage<StageSig PrevStage> {
+  class ApApprox = PrevStage::Ap;
+
+  signature module StageParam {
+    class Ap;
+
+    class ApNil extends Ap;
+
+    bindingset[result, ap]
+    ApApprox getApprox(Ap ap);
+
+    ApNil getApNil(NodeEx node);
+
+    bindingset[tc, tail]
+    Ap apCons(TypedContent tc, Ap tail);
+
+    Content getHeadContent(Ap ap);
+
+    class ApOption;
+
+    ApOption apNone();
+
+    ApOption apSome(Ap ap);
+
+    class Cc;
+
+    class CcCall extends Cc;
+
+    // TODO: member predicate on CcCall
+    predicate matchesCall(CcCall cc, DataFlowCall call);
+
+    class CcNoCall extends Cc;
+
+    Cc ccNone();
+
+    CcCall ccSomeCall();
+
+    class LocalCc;
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc);
+
+    bindingset[call, c, innercc]
+    CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc);
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc);
+
+    bindingset[node1, state1, config]
+    bindingset[node2, state2, config]
+    predicate localStep(
+      NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+      ApNil ap, Configuration config, LocalCc lcc
+    );
+
+    predicate flowOutOfCall(
+      DataFlowCall call, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow, Configuration config
+    );
+
+    predicate flowIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+    );
+
+    bindingset[node, state, ap, config]
+    predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config);
+
+    bindingset[ap, contentType]
+    predicate typecheckStore(Ap ap, DataFlowType contentType);
+  }
+
+  module Stage<StageParam Param> implements StageSig {
+    import Param
+
+    /* Begin: Stage logic. */
+    bindingset[result, apa]
+    private ApApprox unbindApa(ApApprox apa) {
+      pragma[only_bind_out](apa) = pragma[only_bind_out](result)
+    }
+
+    pragma[nomagic]
+    private predicate flowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      Configuration config
+    ) {
+      flowOutOfCall(call, ret, out, allowsFieldFlow, pragma[only_bind_into](config)) and
+      PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(_, ret.getEnclosingCallable(), _,
+        pragma[only_bind_into](config)) and
+      matchesCall(ccc, call)
+    }
+
+    /**
+     * Holds if `node` is reachable with access path `ap` from a source in the
+     * configuration `config`.
+     *
+     * The call context `cc` records whether the node is reached through an
+     * argument in a call, and if so, `argAp` records the access path of that
+     * argument.
+     */
+    pragma[nomagic]
+    predicate fwdFlow(
+      NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      fwdFlow0(node, state, cc, argAp, ap, config) and
+      PrevStage::revFlow(node, state, unbindApa(getApprox(ap)), config) and
+      filter(node, state, ap, config)
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlow0(
+      NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      sourceNode(node, state, config) and
+      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
+      argAp = apNone() and
+      ap = getApNil(node)
+      or
+      exists(NodeEx mid, FlowState state0, Ap ap0, LocalCc localCc |
+        fwdFlow(mid, state0, cc, argAp, ap0, config) and
+        localCc = getLocalCc(mid, cc)
+      |
+        localStep(mid, state0, node, state, true, _, config, localCc) and
+        ap = ap0
+        or
+        localStep(mid, state0, node, state, false, ap, config, localCc) and
+        ap0 instanceof ApNil
+      )
+      or
+      exists(NodeEx mid |
+        fwdFlow(mid, pragma[only_bind_into](state), _, _, ap, pragma[only_bind_into](config)) and
+        jumpStep(mid, node, config) and
+        cc = ccNone() and
+        argAp = apNone()
+      )
+      or
+      exists(NodeEx mid, ApNil nil |
+        fwdFlow(mid, state, _, _, nil, pragma[only_bind_into](config)) and
+        additionalJumpStep(mid, node, config) and
+        cc = ccNone() and
+        argAp = apNone() and
+        ap = getApNil(node)
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(mid, state0, _, _, nil, pragma[only_bind_into](config)) and
+        additionalJumpStateStep(mid, state0, node, state, config) and
+        cc = ccNone() and
+        argAp = apNone() and
+        ap = getApNil(node)
+      )
+      or
+      // store
+      exists(TypedContent tc, Ap ap0 |
+        fwdFlowStore(_, ap0, tc, node, state, cc, argAp, config) and
+        ap = apCons(tc, ap0)
+      )
+      or
+      // read
+      exists(Ap ap0, Content c |
+        fwdFlowRead(ap0, c, _, node, state, cc, argAp, config) and
+        fwdFlowConsCand(ap0, c, ap, config)
+      )
+      or
+      // flow into a callable
+      exists(ApApprox apa |
+        fwdFlowIn(_, node, state, _, cc, _, ap, config) and
+        apa = getApprox(ap) and
+        if PrevStage::parameterMayFlowThrough(node, _, apa, config)
+        then argAp = apSome(ap)
+        else argAp = apNone()
+      )
+      or
+      // flow out of a callable
+      fwdFlowOutNotFromArg(node, state, cc, argAp, ap, config)
+      or
+      exists(DataFlowCall call, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, argAp0, ap, config) and
+        fwdFlowIsEntered(call, cc, argAp, argAp0, config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowStore(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc, ApOption argAp,
+      Configuration config
+    ) {
+      exists(DataFlowType contentType |
+        fwdFlow(node1, state, cc, argAp, ap1, config) and
+        PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
+        typecheckStore(ap1, contentType)
+      )
+    }
+
+    /**
+     * Holds if forward flow with access path `tail` reaches a store of `c`
+     * resulting in access path `cons`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+      exists(TypedContent tc |
+        fwdFlowStore(_, tail, tc, _, _, _, _, config) and
+        tc.getContent() = c and
+        cons = apCons(tc, tail)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowRead(
+      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc, ApOption argAp,
+      Configuration config
+    ) {
+      fwdFlow(node1, state, cc, argAp, ap, config) and
+      PrevStage::readStepCand(node1, c, node2, config) and
+      getHeadContent(ap) = c
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowIn(
+      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, Cc innercc, ApOption argAp,
+      Ap ap, Configuration config
+    ) {
+      exists(ArgNodeEx arg, boolean allowsFieldFlow |
+        fwdFlow(arg, state, outercc, argAp, ap, config) and
+        flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+        innercc = getCallContextCall(call, p.getEnclosingCallable(), outercc) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowOutNotFromArg(
+      NodeEx out, FlowState state, Cc ccOut, ApOption argAp, Ap ap, Configuration config
+    ) {
+      exists(
+        DataFlowCall call, RetNodeEx ret, boolean allowsFieldFlow, CcNoCall innercc,
+        DataFlowCallable inner
+      |
+        fwdFlow(ret, state, innercc, argAp, ap, config) and
+        flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+        inner = ret.getEnclosingCallable() and
+        ccOut = getCallContextReturn(inner, call, innercc) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, Ap argAp, Ap ap, Configuration config
+    ) {
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc |
+        fwdFlow(ret, state, ccc, apSome(argAp), ap, config) and
+        flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    /**
+     * Holds if an argument to `call` is reached in the flow covered by `fwdFlow`
+     * and data might flow through the target callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowIsEntered(
+      DataFlowCall call, Cc cc, ApOption argAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p |
+        fwdFlowIn(call, p, _, cc, _, argAp, ap, config) and
+        PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate storeStepFwd(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, Ap ap2, Configuration config
+    ) {
+      fwdFlowStore(node1, ap1, tc, node2, _, _, _, config) and
+      ap2 = apCons(tc, ap1) and
+      fwdFlowRead(ap2, tc.getContent(), _, _, _, _, _, config)
+    }
+
+    private predicate readStepFwd(
+      NodeEx n1, Ap ap1, Content c, NodeEx n2, Ap ap2, Configuration config
+    ) {
+      fwdFlowRead(ap1, c, n1, n2, _, _, _, config) and
+      fwdFlowConsCand(ap1, c, ap2, config)
+    }
+
+    pragma[nomagic]
+    private predicate callMayFlowThroughFwd(DataFlowCall call, Configuration config) {
+      exists(Ap argAp0, NodeEx out, FlowState state, Cc cc, ApOption argAp, Ap ap |
+        fwdFlow(out, state, pragma[only_bind_into](cc), pragma[only_bind_into](argAp), ap,
+          pragma[only_bind_into](config)) and
+        fwdFlowOutFromArg(call, out, state, argAp0, ap, config) and
+        fwdFlowIsEntered(pragma[only_bind_into](call), pragma[only_bind_into](cc),
+          pragma[only_bind_into](argAp), pragma[only_bind_into](argAp0),
+          pragma[only_bind_into](config))
+      )
+    }
+
+    pragma[nomagic]
+    private predicate flowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Configuration config
+    ) {
+      flowIntoCall(call, arg, p, allowsFieldFlow, config) and
+      fwdFlow(arg, _, _, _, _, pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(p, _, _, pragma[only_bind_into](config)) and
+      callMayFlowThroughFwd(call, pragma[only_bind_into](config))
+    }
+
+    pragma[nomagic]
+    private predicate returnNodeMayFlowThrough(
+      RetNodeEx ret, FlowState state, Ap ap, Configuration config
+    ) {
+      fwdFlow(ret, state, any(CcCall ccc), apSome(_), ap, config)
+    }
+
+    /**
+     * Holds if `node` with access path `ap` is part of a path from a source to a
+     * sink in the configuration `config`.
+     *
+     * The Boolean `toReturn` records whether the node must be returned from the
+     * enclosing callable in order to reach a sink, and if so, `returnAp` records
+     * the access path of the returned value.
+     */
+    pragma[nomagic]
+    predicate revFlow(
+      NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      revFlow0(node, state, toReturn, returnAp, ap, config) and
+      fwdFlow(node, state, _, _, ap, config)
+    }
+
+    pragma[nomagic]
+    private predicate revFlow0(
+      NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      fwdFlow(node, state, _, _, ap, config) and
+      sinkNode(node, state, config) and
+      (if hasSinkCallCtx(config) then toReturn = true else toReturn = false) and
+      returnAp = apNone() and
+      ap instanceof ApNil
+      or
+      exists(NodeEx mid, FlowState state0 |
+        localStep(node, state, mid, state0, true, _, config, _) and
+        revFlow(mid, state0, toReturn, returnAp, ap, config)
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(node, pragma[only_bind_into](state), _, _, ap, pragma[only_bind_into](config)) and
+        localStep(node, pragma[only_bind_into](state), mid, state0, false, _, config, _) and
+        revFlow(mid, state0, toReturn, returnAp, nil, pragma[only_bind_into](config)) and
+        ap instanceof ApNil
+      )
+      or
+      exists(NodeEx mid |
+        jumpStep(node, mid, config) and
+        revFlow(mid, state, _, _, ap, config) and
+        toReturn = false and
+        returnAp = apNone()
+      )
+      or
+      exists(NodeEx mid, ApNil nil |
+        fwdFlow(node, _, _, _, ap, pragma[only_bind_into](config)) and
+        additionalJumpStep(node, mid, config) and
+        revFlow(pragma[only_bind_into](mid), state, _, _, nil, pragma[only_bind_into](config)) and
+        toReturn = false and
+        returnAp = apNone() and
+        ap instanceof ApNil
+      )
+      or
+      exists(NodeEx mid, FlowState state0, ApNil nil |
+        fwdFlow(node, _, _, _, ap, pragma[only_bind_into](config)) and
+        additionalJumpStateStep(node, state, mid, state0, config) and
+        revFlow(pragma[only_bind_into](mid), pragma[only_bind_into](state0), _, _, nil,
+          pragma[only_bind_into](config)) and
+        toReturn = false and
+        returnAp = apNone() and
+        ap instanceof ApNil
+      )
+      or
+      // store
+      exists(Ap ap0, Content c |
+        revFlowStore(ap0, c, ap, node, state, _, _, toReturn, returnAp, config) and
+        revFlowConsCand(ap0, c, ap, config)
+      )
+      or
+      // read
+      exists(NodeEx mid, Ap ap0 |
+        revFlow(mid, state, toReturn, returnAp, ap0, config) and
+        readStepFwd(node, ap, _, mid, ap0, config)
+      )
+      or
+      // flow into a callable
+      revFlowInNotToReturn(node, state, returnAp, ap, config) and
+      toReturn = false
+      or
+      exists(DataFlowCall call, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+      or
+      // flow out of a callable
+      revFlowOut(_, node, state, _, _, ap, config) and
+      toReturn = true and
+      if returnNodeMayFlowThrough(node, state, ap, config)
+      then returnAp = apSome(ap)
+      else returnAp = apNone()
+    }
+
+    pragma[nomagic]
+    private predicate revFlowStore(
+      Ap ap0, Content c, Ap ap, NodeEx node, FlowState state, TypedContent tc, NodeEx mid,
+      boolean toReturn, ApOption returnAp, Configuration config
+    ) {
+      revFlow(mid, state, toReturn, returnAp, ap0, config) and
+      storeStepFwd(node, ap, tc, mid, ap0, config) and
+      tc.getContent() = c
+    }
+
+    /**
+     * Holds if reverse flow with access path `tail` reaches a read of `c`
+     * resulting in access path `cons`.
+     */
+    pragma[nomagic]
+    private predicate revFlowConsCand(Ap cons, Content c, Ap tail, Configuration config) {
+      exists(NodeEx mid, Ap tail0 |
+        revFlow(mid, _, _, _, tail, config) and
+        tail = pragma[only_bind_into](tail0) and
+        readStepFwd(_, cons, c, mid, tail0, config)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowOut(
+      DataFlowCall call, RetNodeEx ret, FlowState state, boolean toReturn, ApOption returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(NodeEx out, boolean allowsFieldFlow |
+        revFlow(out, state, toReturn, returnAp, ap, config) and
+        flowOutOfCall(call, ret, out, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInNotToReturn(
+      ArgNodeEx arg, FlowState state, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlow(p, state, false, returnAp, ap, config) and
+        flowIntoCall(_, arg, p, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, Ap returnAp, Ap ap, Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlow(p, state, true, apSome(returnAp), ap, config) and
+        flowThroughIntoCall(call, arg, p, allowsFieldFlow, config) and
+        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      )
+    }
+
+    /**
+     * Holds if an output from `call` is reached in the flow covered by `revFlow`
+     * and data might flow through the target callable resulting in reverse flow
+     * reaching an argument of `call`.
+     */
+    pragma[nomagic]
+    private predicate revFlowIsReturned(
+      DataFlowCall call, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
+    ) {
+      exists(RetNodeEx ret, FlowState state, CcCall ccc |
+        revFlowOut(call, ret, state, toReturn, returnAp, ap, config) and
+        fwdFlow(ret, state, ccc, apSome(_), ap, config) and
+        matchesCall(ccc, call)
+      )
+    }
+
+    pragma[nomagic]
+    predicate storeStepCand(
+      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, DataFlowType contentType,
+      Configuration config
+    ) {
+      exists(Ap ap2, Content c |
+        PrevStage::storeStepCand(node1, _, tc, node2, contentType, config) and
+        revFlowStore(ap2, c, ap1, node1, _, tc, node2, _, _, config) and
+        revFlowConsCand(ap2, c, ap1, config)
+      )
+    }
+
+    predicate readStepCand(NodeEx node1, Content c, NodeEx node2, Configuration config) {
+      exists(Ap ap1, Ap ap2 |
+        revFlow(node2, _, _, _, pragma[only_bind_into](ap2), pragma[only_bind_into](config)) and
+        readStepFwd(node1, ap1, c, node2, ap2, config) and
+        revFlowStore(ap1, c, pragma[only_bind_into](ap2), _, _, _, _, _, _,
+          pragma[only_bind_into](config))
+      )
+    }
+
+    predicate revFlow(NodeEx node, FlowState state, Configuration config) {
+      revFlow(node, state, _, _, _, config)
+    }
+
+    predicate revFlow(NodeEx node, FlowState state, Ap ap, Configuration config) {
+      revFlow(node, state, _, _, ap, config)
+    }
+
+    pragma[nomagic]
+    predicate revFlow(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
+
+    // use an alias as a workaround for bad functionality-induced joins
+    pragma[nomagic]
+    predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
+
+    // use an alias as a workaround for bad functionality-induced joins
+    pragma[nomagic]
+    predicate revFlowAlias(NodeEx node, FlowState state, Ap ap, Configuration config) {
+      revFlow(node, state, ap, config)
+    }
+
+    private predicate fwdConsCand(TypedContent tc, Ap ap, Configuration config) {
+      storeStepFwd(_, ap, tc, _, _, config)
+    }
+
+    private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
+      storeStepCand(_, ap, tc, _, _, config)
+    }
+
+    private predicate validAp(Ap ap, Configuration config) {
+      revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
+      or
+      exists(TypedContent head, Ap tail |
+        consCand(head, tail, config) and
+        ap = apCons(head, tail)
+      )
+    }
+
+    predicate consCand(TypedContent tc, Ap ap, Configuration config) {
+      revConsCand(tc, ap, config) and
+      validAp(ap, config)
+    }
+
+    pragma[noinline]
+    private predicate parameterFlow(
+      ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
+    ) {
+      revFlow(p, _, true, apSome(ap0), ap, config) and
+      c = p.getEnclosingCallable()
+    }
+
+    predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
+      exists(RetNodeEx ret, FlowState state, Ap ap0, ReturnKindExt kind, ParameterPosition pos |
+        parameterFlow(p, ap, ap0, c, config) and
+        c = ret.getEnclosingCallable() and
+        revFlow(pragma[only_bind_into](ret), pragma[only_bind_into](state), true, apSome(_),
+          pragma[only_bind_into](ap0), pragma[only_bind_into](config)) and
+        fwdFlow(ret, state, any(CcCall ccc), apSome(ap), ap0, config) and
+        kind = ret.getKind() and
+        p.getPosition() = pos and
+        // we don't expect a parameter to return stored in itself, unless explicitly allowed
+        (
+          not kind.(ParamUpdateReturnKind).getPosition() = pos
+          or
+          p.allowParameterReturnInSelf()
+        )
+      )
+    }
+
+    pragma[nomagic]
+    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
+      exists(
+        Ap returnAp0, ArgNodeEx arg, FlowState state, boolean toReturn, ApOption returnAp, Ap ap
+      |
+        revFlow(arg, state, toReturn, returnAp, ap, config) and
+        revFlowInToReturn(call, arg, state, returnAp0, ap, config) and
+        revFlowIsReturned(call, toReturn, returnAp, returnAp0, config)
+      )
+    }
+
+    predicate stats(
+      boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
+    ) {
+      fwd = true and
+      nodes = count(NodeEx node | fwdFlow(node, _, _, _, _, config)) and
+      fields = count(TypedContent f0 | fwdConsCand(f0, _, config)) and
+      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
+      states = count(FlowState state | fwdFlow(_, state, _, _, _, config)) and
+      tuples =
+        count(NodeEx n, FlowState state, Cc cc, ApOption argAp, Ap ap |
+          fwdFlow(n, state, cc, argAp, ap, config)
+        )
+      or
+      fwd = false and
+      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
+      fields = count(TypedContent f0 | consCand(f0, _, config)) and
+      conscand = count(TypedContent f0, Ap ap | consCand(f0, ap, config)) and
+      states = count(FlowState state | revFlow(_, state, _, _, _, config)) and
+      tuples =
+        count(NodeEx n, FlowState state, boolean b, ApOption retAp, Ap ap |
+          revFlow(n, state, b, retAp, ap, config)
+        )
+    }
+    /* End: Stage logic. */
+  }
+}
+
+private module BooleanCallContext {
+  class Cc extends boolean {
+    Cc() { this in [true, false] }
+  }
+
+  class CcCall extends Cc {
+    CcCall() { this = true }
+  }
+
+  /** Holds if the call context may be `call`. */
+  predicate matchesCall(CcCall cc, DataFlowCall call) { any() }
+
+  class CcNoCall extends Cc {
+    CcNoCall() { this = false }
+  }
+
+  Cc ccNone() { result = false }
+
+  CcCall ccSomeCall() { result = true }
+
+  class LocalCc = Unit;
+
+  bindingset[node, cc]
+  LocalCc getLocalCc(NodeEx node, Cc cc) { any() }
+
+  bindingset[call, c, outercc]
+  CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) { any() }
+
+  bindingset[call, c, innercc]
+  CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) { any() }
+}
+
+private module Level1CallContext {
+  class Cc = CallContext;
+
+  class CcCall = CallContextCall;
+
+  pragma[inline]
+  predicate matchesCall(CcCall cc, DataFlowCall call) { cc.matchesCall(call) }
+
+  class CcNoCall = CallContextNoCall;
+
+  Cc ccNone() { result instanceof CallContextAny }
+
+  CcCall ccSomeCall() { result instanceof CallContextSomeCall }
+
+  module NoLocalCallContext {
+    class LocalCc = Unit;
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc) { any() }
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+      checkCallContextCall(outercc, call, c) and
+      if recordDataFlowCallSiteDispatch(call, c)
+      then result = TSpecificCall(call)
+      else result = TSomeCall()
+    }
+  }
+
+  module LocalCallContext {
+    class LocalCc = LocalCallContext;
+
+    bindingset[node, cc]
+    LocalCc getLocalCc(NodeEx node, Cc cc) {
+      result =
+        getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
+          node.getEnclosingCallable())
+    }
+
+    bindingset[call, c, outercc]
+    CcCall getCallContextCall(DataFlowCall call, DataFlowCallable c, Cc outercc) {
+      checkCallContextCall(outercc, call, c) and
+      if recordDataFlowCallSite(call, c) then result = TSpecificCall(call) else result = TSomeCall()
+    }
+  }
+
+  bindingset[call, c, innercc]
+  CcNoCall getCallContextReturn(DataFlowCallable c, DataFlowCall call, Cc innercc) {
+    checkCallContextReturn(innercc, c, call) and
+    if reducedViableImplInReturn(c, call) then result = TReturn(c, call) else result = ccNone()
+  }
+}
+
+private module Stage2Param implements MkStage<Stage1>::StageParam {
+  private module PrevStage = Stage1;
+
+  class Ap extends boolean {
+    Ap() { this in [true, false] }
+  }
+
+  class ApNil extends Ap {
+    ApNil() { this = false }
+  }
+
+  bindingset[result, ap]
+  PrevStage::Ap getApprox(Ap ap) { any() }
+
+  ApNil getApNil(NodeEx node) { Stage1::revFlow(node, _) and exists(result) }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result = true and exists(tc) and exists(tail) }
+
+  pragma[inline]
+  Content getHeadContent(Ap ap) { exists(result) and ap = true }
+
+  class ApOption = BooleanOption;
+
+  ApOption apNone() { result = TBooleanNone() }
+
+  ApOption apSome(Ap ap) { result = TBooleanSome(ap) }
+
+  import Level1CallContext
+  import NoLocalCallContext
+
+  bindingset[node1, state1, config]
+  bindingset[node2, state2, config]
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    (
+      preservesValue = true and
+      localFlowStepNodeCand1(node1, node2, config) and
+      state1 = state2
+      or
+      preservesValue = false and
+      additionalLocalFlowStepNodeCand1(node1, node2, config) and
+      state1 = state2
+      or
+      preservesValue = false and
+      additionalLocalStateStep(node1, state1, node2, state2, config)
+    ) and
+    exists(ap) and
+    exists(lcc)
+  }
+
+  predicate flowOutOfCall = flowOutOfCallNodeCand1/5;
+
+  predicate flowIntoCall = flowIntoCallNodeCand1/5;
+
+  pragma[nomagic]
+  private predicate expectsContentCand(NodeEx node, Configuration config) {
+    exists(Content c |
+      PrevStage::revFlow(node, pragma[only_bind_into](config)) and
+      PrevStage::revFlowIsReadAndStored(c, pragma[only_bind_into](config)) and
+      expectsContentEx(node, c)
+    )
+  }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    PrevStage::revFlowState(state, pragma[only_bind_into](config)) and
+    exists(ap) and
+    not stateBarrier(node, state, config) and
+    (
+      notExpectsContent(node)
+      or
+      ap = true and
+      expectsContentCand(node, config)
+    )
+  }
+
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+}
+
+private module Stage2 implements StageSig {
+  import MkStage<Stage1>::Stage<Stage2Param>
+}
+
+pragma[nomagic]
+private predicate flowOutOfCallNodeCand2(
+  DataFlowCall call, RetNodeEx node1, NodeEx node2, boolean allowsFieldFlow, Configuration config
+) {
+  flowOutOfCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlowAlias(node1, pragma[only_bind_into](config))
+}
+
+pragma[nomagic]
+private predicate flowIntoCallNodeCand2(
+  DataFlowCall call, ArgNodeEx node1, ParamNodeEx node2, boolean allowsFieldFlow,
+  Configuration config
+) {
+  flowIntoCallNodeCand1(call, node1, node2, allowsFieldFlow, config) and
+  Stage2::revFlow(node2, pragma[only_bind_into](config)) and
+  Stage2::revFlowAlias(node1, pragma[only_bind_into](config))
+}
+
+private module LocalFlowBigStep {
+  /**
+   * A node where some checking is required, and hence the big-step relation
+   * is not allowed to step over.
+   */
+  private class FlowCheckNode extends NodeEx {
+    FlowCheckNode() {
+      castNode(this.asNode()) or
+      clearsContentCached(this.asNode(), _) or
+      expectsContentCached(this.asNode(), _)
+    }
+  }
+
+  /**
+   * Holds if `node` can be the first node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowEntry(NodeEx node, FlowState state, Configuration config) {
+    Stage2::revFlow(node, state, config) and
+    (
+      sourceNode(node, state, config)
+      or
+      jumpStep(_, node, config)
+      or
+      additionalJumpStep(_, node, config)
+      or
+      additionalJumpStateStep(_, _, node, state, config)
+      or
+      node instanceof ParamNodeEx
+      or
+      node.asNode() instanceof OutNodeExt
+      or
+      Stage2::storeStepCand(_, _, _, node, _, config)
+      or
+      Stage2::readStepCand(_, _, node, config)
+      or
+      node instanceof FlowCheckNode
+      or
+      exists(FlowState s |
+        additionalLocalStateStep(_, s, node, state, config) and
+        s != state
+      )
+    )
+  }
+
+  /**
+   * Holds if `node` can be the last node in a maximal subsequence of local
+   * flow steps in a dataflow path.
+   */
+  private predicate localFlowExit(NodeEx node, FlowState state, Configuration config) {
+    exists(NodeEx next | Stage2::revFlow(next, state, config) |
+      jumpStep(node, next, config) or
+      additionalJumpStep(node, next, config) or
+      flowIntoCallNodeCand1(_, node, next, config) or
+      flowOutOfCallNodeCand1(_, node, next, config) or
+      Stage2::storeStepCand(node, _, _, next, _, config) or
+      Stage2::readStepCand(node, _, next, config)
+    )
+    or
+    exists(NodeEx next, FlowState s | Stage2::revFlow(next, s, config) |
+      additionalJumpStateStep(node, state, next, s, config)
+      or
+      additionalLocalStateStep(node, state, next, s, config) and
+      s != state
+    )
+    or
+    Stage2::revFlow(node, state, config) and
+    node instanceof FlowCheckNode
+    or
+    sinkNode(node, state, config)
+  }
+
+  pragma[noinline]
+  private predicate additionalLocalFlowStepNodeCand2(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, Configuration config
+  ) {
+    additionalLocalFlowStepNodeCand1(node1, node2, config) and
+    state1 = state2 and
+    Stage2::revFlow(node1, pragma[only_bind_into](state1), false, pragma[only_bind_into](config)) and
+    Stage2::revFlowAlias(node2, pragma[only_bind_into](state2), false,
+      pragma[only_bind_into](config))
+    or
+    additionalLocalStateStep(node1, state1, node2, state2, config) and
+    Stage2::revFlow(node1, state1, false, pragma[only_bind_into](config)) and
+    Stage2::revFlowAlias(node2, state2, false, pragma[only_bind_into](config))
+  }
+
+  /**
+   * Holds if the local path from `node1` to `node2` is a prefix of a maximal
+   * subsequence of local flow steps in a dataflow path.
+   *
+   * This is the transitive closure of `[additional]localFlowStep` beginning
+   * at `localFlowEntry`.
+   */
+  pragma[nomagic]
+  private predicate localFlowStepPlus(
+    NodeEx node1, FlowState state, NodeEx node2, boolean preservesValue, DataFlowType t,
+    Configuration config, LocalCallContext cc
+  ) {
+    not isUnreachableInCallCached(node2.asNode(), cc.(LocalCallContextSpecificCall).getCall()) and
+    (
+      localFlowEntry(node1, pragma[only_bind_into](state), pragma[only_bind_into](config)) and
+      (
+        localFlowStepNodeCand1(node1, node2, config) and
+        preservesValue = true and
+        t = node1.getDataFlowType() and // irrelevant dummy value
+        Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
+        or
+        additionalLocalFlowStepNodeCand2(node1, state, node2, state, config) and
+        preservesValue = false and
+        t = node2.getDataFlowType()
+      ) and
+      node1 != node2 and
+      cc.relevantFor(node1.getEnclosingCallable()) and
+      not isUnreachableInCallCached(node1.asNode(), cc.(LocalCallContextSpecificCall).getCall())
+      or
+      exists(NodeEx mid |
+        localFlowStepPlus(node1, pragma[only_bind_into](state), mid, preservesValue, t,
+          pragma[only_bind_into](config), cc) and
+        localFlowStepNodeCand1(mid, node2, config) and
+        not mid instanceof FlowCheckNode and
+        Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
+      )
+      or
+      exists(NodeEx mid |
+        localFlowStepPlus(node1, state, mid, _, _, pragma[only_bind_into](config), cc) and
+        additionalLocalFlowStepNodeCand2(mid, state, node2, state, config) and
+        not mid instanceof FlowCheckNode and
+        preservesValue = false and
+        t = node2.getDataFlowType()
+      )
+    )
+  }
+
+  /**
+   * Holds if `node1` can step to `node2` in one or more local steps and this
+   * path can occur as a maximal subsequence of local steps in a dataflow path.
+   */
+  pragma[nomagic]
+  predicate localFlowBigStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    AccessPathFrontNil apf, Configuration config, LocalCallContext callContext
+  ) {
+    localFlowStepPlus(node1, state1, node2, preservesValue, apf.getType(), config, callContext) and
+    localFlowExit(node2, state1, config) and
+    state1 = state2
+    or
+    additionalLocalFlowStepNodeCand2(node1, state1, node2, state2, config) and
+    state1 != state2 and
+    preservesValue = false and
+    apf = TFrontNil(node2.getDataFlowType()) and
+    callContext.relevantFor(node1.getEnclosingCallable()) and
+    not exists(DataFlowCall call | call = callContext.(LocalCallContextSpecificCall).getCall() |
+      isUnreachableInCallCached(node1.asNode(), call) or
+      isUnreachableInCallCached(node2.asNode(), call)
+    )
+  }
+}
+
+private import LocalFlowBigStep
+
+private module Stage3Param implements MkStage<Stage2>::StageParam {
+  private module PrevStage = Stage2;
+
+  class Ap = AccessPathFront;
+
+  class ApNil = AccessPathFrontNil;
+
+  PrevStage::Ap getApprox(Ap ap) { result = ap.toBoolNonEmpty() }
+
+  ApNil getApNil(NodeEx node) {
+    PrevStage::revFlow(node, _) and result = TFrontNil(node.getDataFlowType())
+  }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result.getHead() = tc and exists(tail) }
+
+  pragma[noinline]
+  Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathFrontOption;
+
+  ApOption apNone() { result = TAccessPathFrontNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathFrontSome(ap) }
+
+  import BooleanCallContext
+
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, state1, node2, state2, preservesValue, ap, config, _) and exists(lcc)
+  }
+
+  predicate flowOutOfCall = flowOutOfCallNodeCand2/5;
+
+  predicate flowIntoCall = flowIntoCallNodeCand2/5;
+
+  pragma[nomagic]
+  private predicate clearSet(NodeEx node, ContentSet c, Configuration config) {
+    PrevStage::revFlow(node, config) and
+    clearsContentCached(node.asNode(), c)
+  }
+
+  pragma[nomagic]
+  private predicate clearContent(NodeEx node, Content c, Configuration config) {
+    exists(ContentSet cs |
+      PrevStage::readStepCand(_, pragma[only_bind_into](c), _, pragma[only_bind_into](config)) and
+      c = cs.getAReadContent() and
+      clearSet(node, cs, pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  private predicate clear(NodeEx node, Ap ap, Configuration config) {
+    clearContent(node, ap.getHead().getContent(), config)
+  }
+
+  pragma[nomagic]
+  private predicate expectsContentCand(NodeEx node, Ap ap, Configuration config) {
+    exists(Content c |
+      PrevStage::revFlow(node, pragma[only_bind_into](config)) and
+      PrevStage::readStepCand(_, c, _, pragma[only_bind_into](config)) and
+      expectsContentEx(node, c) and
+      c = ap.getHead().getContent()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate castingNodeEx(NodeEx node) { node.asNode() instanceof CastingNode }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) {
+    exists(state) and
+    exists(config) and
+    not clear(node, ap, config) and
+    (if castingNodeEx(node) then compatibleTypes(node.getDataFlowType(), ap.getType()) else any()) and
+    (
+      notExpectsContent(node)
+      or
+      expectsContentCand(node, ap, config)
+    )
+  }
+
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) {
+    // We need to typecheck stores here, since reverse flow through a getter
+    // might have a different type here compared to inside the getter.
+    compatibleTypes(ap.getType(), contentType)
+  }
+}
+
+private module Stage3 implements StageSig {
+  import MkStage<Stage2>::Stage<Stage3Param>
+}
+
+/**
+ * Holds if `argApf` is recorded as the summary context for flow reaching `node`
+ * and remains relevant for the following pruning stage.
+ */
+private predicate flowCandSummaryCtx(
+  NodeEx node, FlowState state, AccessPathFront argApf, Configuration config
+) {
+  exists(AccessPathFront apf |
+    Stage3::revFlow(node, state, true, _, apf, config) and
+    Stage3::fwdFlow(node, state, any(Stage3::CcCall ccc), TAccessPathFrontSome(argApf), apf, config)
+  )
+}
+
+/**
+ * Holds if a length 2 access path approximation with the head `tc` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen2unfolding(TypedContent tc, Configuration config) {
+  exists(int tails, int nodes, int apLimit, int tupleLimit |
+    tails = strictcount(AccessPathFront apf | Stage3::consCand(tc, apf, config)) and
+    nodes =
+      strictcount(NodeEx n, FlowState state |
+        Stage3::revFlow(n, state, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+        or
+        flowCandSummaryCtx(n, state, any(AccessPathFrontHead apf | apf.getHead() = tc), config)
+      ) and
+    accessPathApproxCostLimits(apLimit, tupleLimit) and
+    apLimit < tails and
+    tupleLimit < (tails - 1) * nodes and
+    not tc.forceHighPrecision()
+  )
+}
+
+private newtype TAccessPathApprox =
+  TNil(DataFlowType t) or
+  TConsNil(TypedContent tc, DataFlowType t) {
+    Stage3::consCand(tc, TFrontNil(t), _) and
+    not expensiveLen2unfolding(tc, _)
+  } or
+  TConsCons(TypedContent tc1, TypedContent tc2, int len) {
+    Stage3::consCand(tc1, TFrontHead(tc2), _) and
+    len in [2 .. accessPathLimit()] and
+    not expensiveLen2unfolding(tc1, _)
+  } or
+  TCons1(TypedContent tc, int len) {
+    len in [1 .. accessPathLimit()] and
+    expensiveLen2unfolding(tc, _)
+  }
+
+/**
+ * Conceptually a list of `TypedContent`s followed by a `DataFlowType`, but only
+ * the first two elements of the list and its length are tracked. If data flows
+ * from a source to a given node with a given `AccessPathApprox`, this indicates
+ * the sequence of dereference operations needed to get from the value in the node
+ * to the tracked object. The final type indicates the type of the tracked object.
+ */
+abstract private class AccessPathApprox extends TAccessPathApprox {
+  abstract string toString();
+
+  abstract TypedContent getHead();
+
+  abstract int len();
+
+  abstract DataFlowType getType();
+
+  abstract AccessPathFront getFront();
+
+  /** Gets the access path obtained by popping `head` from this path, if any. */
+  abstract AccessPathApprox pop(TypedContent head);
+}
+
+private class AccessPathApproxNil extends AccessPathApprox, TNil {
+  private DataFlowType t;
+
+  AccessPathApproxNil() { this = TNil(t) }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+
+  override TypedContent getHead() { none() }
+
+  override int len() { result = 0 }
+
+  override DataFlowType getType() { result = t }
+
+  override AccessPathFront getFront() { result = TFrontNil(t) }
+
+  override AccessPathApprox pop(TypedContent head) { none() }
+}
+
+abstract private class AccessPathApproxCons extends AccessPathApprox { }
+
+private class AccessPathApproxConsNil extends AccessPathApproxCons, TConsNil {
+  private TypedContent tc;
+  private DataFlowType t;
+
+  AccessPathApproxConsNil() { this = TConsNil(tc, t) }
+
+  override string toString() {
+    // The `concat` becomes "" if `ppReprType` has no result.
+    result = "[" + tc.toString() + "]" + concat(" : " + ppReprType(t))
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = 1 }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) { head = tc and result = TNil(t) }
+}
+
+private class AccessPathApproxConsCons extends AccessPathApproxCons, TConsCons {
+  private TypedContent tc1;
+  private TypedContent tc2;
+  private int len;
+
+  AccessPathApproxConsCons() { this = TConsCons(tc1, tc2, len) }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + tc1.toString() + ", " + tc2.toString() + "]"
+    else result = "[" + tc1.toString() + ", " + tc2.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc1 }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc1.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc1) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc1 and
+    (
+      result = TConsCons(tc2, _, len - 1)
+      or
+      len = 2 and
+      result = TConsNil(tc2, _)
+      or
+      result = TCons1(tc2, len - 1)
+    )
+  }
+}
+
+private class AccessPathApproxCons1 extends AccessPathApproxCons, TCons1 {
+  private TypedContent tc;
+  private int len;
+
+  AccessPathApproxCons1() { this = TCons1(tc, len) }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + tc.toString() + "]"
+    else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+  }
+
+  override TypedContent getHead() { result = tc }
+
+  override int len() { result = len }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override AccessPathFront getFront() { result = TFrontHead(tc) }
+
+  override AccessPathApprox pop(TypedContent head) {
+    head = tc and
+    (
+      exists(TypedContent tc2 | Stage3::consCand(tc, TFrontHead(tc2), _) |
+        result = TConsCons(tc2, _, len - 1)
+        or
+        len = 2 and
+        result = TConsNil(tc2, _)
+        or
+        result = TCons1(tc2, len - 1)
+      )
+      or
+      exists(DataFlowType t |
+        len = 1 and
+        Stage3::consCand(tc, TFrontNil(t), _) and
+        result = TNil(t)
+      )
+    )
+  }
+}
+
+/** Gets the access path obtained by popping `tc` from `ap`, if any. */
+private AccessPathApprox pop(TypedContent tc, AccessPathApprox apa) { result = apa.pop(tc) }
+
+/** Gets the access path obtained by pushing `tc` onto `ap`. */
+private AccessPathApprox push(TypedContent tc, AccessPathApprox apa) { apa = pop(tc, result) }
+
+private newtype TAccessPathApproxOption =
+  TAccessPathApproxNone() or
+  TAccessPathApproxSome(AccessPathApprox apa)
+
+private class AccessPathApproxOption extends TAccessPathApproxOption {
+  string toString() {
+    this = TAccessPathApproxNone() and result = "<none>"
+    or
+    this = TAccessPathApproxSome(any(AccessPathApprox apa | result = apa.toString()))
+  }
+}
+
+private module Stage4Param implements MkStage<Stage3>::StageParam {
+  private module PrevStage = Stage3;
+
+  class Ap = AccessPathApprox;
+
+  class ApNil = AccessPathApproxNil;
+
+  PrevStage::Ap getApprox(Ap ap) { result = ap.getFront() }
+
+  ApNil getApNil(NodeEx node) {
+    PrevStage::revFlow(node, _) and result = TNil(node.getDataFlowType())
+  }
+
+  bindingset[tc, tail]
+  Ap apCons(TypedContent tc, Ap tail) { result = push(tc, tail) }
+
+  pragma[noinline]
+  Content getHeadContent(Ap ap) { result = ap.getHead().getContent() }
+
+  class ApOption = AccessPathApproxOption;
+
+  ApOption apNone() { result = TAccessPathApproxNone() }
+
+  ApOption apSome(Ap ap) { result = TAccessPathApproxSome(ap) }
+
+  import Level1CallContext
+  import LocalCallContext
+
+  predicate localStep(
+    NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
+    ApNil ap, Configuration config, LocalCc lcc
+  ) {
+    localFlowBigStep(node1, state1, node2, state2, preservesValue, ap.getFront(), config, lcc)
+  }
+
+  pragma[nomagic]
+  predicate flowOutOfCall(
+    DataFlowCall call, RetNodeEx node1, NodeEx node2, boolean allowsFieldFlow, Configuration config
+  ) {
+    exists(FlowState state |
+      flowOutOfCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+      PrevStage::revFlow(node2, pragma[only_bind_into](state), _, pragma[only_bind_into](config)) and
+      PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  pragma[nomagic]
+  predicate flowIntoCall(
+    DataFlowCall call, ArgNodeEx node1, ParamNodeEx node2, boolean allowsFieldFlow,
+    Configuration config
+  ) {
+    exists(FlowState state |
+      flowIntoCallNodeCand2(call, node1, node2, allowsFieldFlow, config) and
+      PrevStage::revFlow(node2, pragma[only_bind_into](state), _, pragma[only_bind_into](config)) and
+      PrevStage::revFlowAlias(node1, pragma[only_bind_into](state), _,
+        pragma[only_bind_into](config))
+    )
+  }
+
+  bindingset[node, state, ap, config]
+  predicate filter(NodeEx node, FlowState state, Ap ap, Configuration config) { any() }
+
+  // Type checking is not necessary here as it has already been done in stage 3.
+  bindingset[ap, contentType]
+  predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
+}
+
+private module Stage4 = MkStage<Stage3>::Stage<Stage4Param>;
+
+bindingset[conf, result]
+private Configuration unbindConf(Configuration conf) {
+  exists(Configuration c | result = pragma[only_bind_into](c) and conf = pragma[only_bind_into](c))
+}
+
+pragma[nomagic]
+private predicate nodeMayUseSummary0(
+  NodeEx n, DataFlowCallable c, FlowState state, AccessPathApprox apa, Configuration config
+) {
+  exists(AccessPathApprox apa0 |
+    Stage4::parameterMayFlowThrough(_, c, _, _) and
+    Stage4::revFlow(n, state, true, _, apa0, config) and
+    Stage4::fwdFlow(n, state, any(CallContextCall ccc), TAccessPathApproxSome(apa), apa0, config) and
+    n.getEnclosingCallable() = c
+  )
+}
+
+pragma[nomagic]
+private predicate nodeMayUseSummary(
+  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
+) {
+  exists(DataFlowCallable c |
+    Stage4::parameterMayFlowThrough(_, c, apa, config) and
+    nodeMayUseSummary0(n, c, state, apa, config)
+  )
+}
+
+private newtype TSummaryCtx =
+  TSummaryCtxNone() or
+  TSummaryCtxSome(ParamNodeEx p, FlowState state, AccessPath ap) {
+    exists(Configuration config |
+      Stage4::parameterMayFlowThrough(p, _, ap.getApprox(), config) and
+      Stage4::revFlow(p, state, _, config)
+    )
+  }
+
+/**
+ * A context for generating flow summaries. This represents flow entry through
+ * a specific parameter with an access path of a specific shape.
+ *
+ * Summaries are only created for parameters that may flow through.
+ */
+abstract private class SummaryCtx extends TSummaryCtx {
+  abstract string toString();
+}
+
+/** A summary context from which no flow summary can be generated. */
+private class SummaryCtxNone extends SummaryCtx, TSummaryCtxNone {
+  override string toString() { result = "<none>" }
+}
+
+/** A summary context from which a flow summary can be generated. */
+private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
+  private ParamNodeEx p;
+  private FlowState s;
+  private AccessPath ap;
+
+  SummaryCtxSome() { this = TSummaryCtxSome(p, s, ap) }
+
+  ParameterPosition getParameterPos() { p.isParameterOf(_, result) }
+
+  ParamNodeEx getParamNode() { result = p }
+
+  override string toString() { result = p + ": " + ap }
+
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    p.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/**
+ * Gets the number of length 2 access path approximations that correspond to `apa`.
+ */
+private int count1to2unfold(AccessPathApproxCons1 apa, Configuration config) {
+  exists(TypedContent tc, int len |
+    tc = apa.getHead() and
+    len = apa.len() and
+    result =
+      strictcount(AccessPathFront apf |
+        Stage4::consCand(tc, any(AccessPathApprox ap | ap.getFront() = apf and ap.len() = len - 1),
+          config)
+      )
+  )
+}
+
+private int countNodesUsingAccessPath(AccessPathApprox apa, Configuration config) {
+  result =
+    strictcount(NodeEx n, FlowState state |
+      Stage4::revFlow(n, state, apa, config) or nodeMayUseSummary(n, state, apa, config)
+    )
+}
+
+/**
+ * Holds if a length 2 access path approximation matching `apa` is expected
+ * to be expensive.
+ */
+private predicate expensiveLen1to2unfolding(AccessPathApproxCons1 apa, Configuration config) {
+  exists(int aps, int nodes, int apLimit, int tupleLimit |
+    aps = count1to2unfold(apa, config) and
+    nodes = countNodesUsingAccessPath(apa, config) and
+    accessPathCostLimits(apLimit, tupleLimit) and
+    apLimit < aps and
+    tupleLimit < (aps - 1) * nodes
+  )
+}
+
+private AccessPathApprox getATail(AccessPathApprox apa, Configuration config) {
+  exists(TypedContent head |
+    apa.pop(head) = result and
+    Stage4::consCand(head, result, config)
+  )
+}
+
+/**
+ * Holds with `unfold = false` if a precise head-tail representation of `apa` is
+ * expected to be expensive. Holds with `unfold = true` otherwise.
+ */
+private predicate evalUnfold(AccessPathApprox apa, boolean unfold, Configuration config) {
+  if apa.getHead().forceHighPrecision()
+  then unfold = true
+  else
+    exists(int aps, int nodes, int apLimit, int tupleLimit |
+      aps = countPotentialAps(apa, config) and
+      nodes = countNodesUsingAccessPath(apa, config) and
+      accessPathCostLimits(apLimit, tupleLimit) and
+      if apLimit < aps and tupleLimit < (aps - 1) * nodes then unfold = false else unfold = true
+    )
+}
+
+/**
+ * Gets the number of `AccessPath`s that correspond to `apa`.
+ */
+private int countAps(AccessPathApprox apa, Configuration config) {
+  evalUnfold(apa, false, config) and
+  result = 1 and
+  (not apa instanceof AccessPathApproxCons1 or expensiveLen1to2unfolding(apa, config))
+  or
+  evalUnfold(apa, false, config) and
+  result = count1to2unfold(apa, config) and
+  not expensiveLen1to2unfolding(apa, config)
+  or
+  evalUnfold(apa, true, config) and
+  result = countPotentialAps(apa, config)
+}
+
+/**
+ * Gets the number of `AccessPath`s that would correspond to `apa` assuming
+ * that it is expanded to a precise head-tail representation.
+ */
+language[monotonicAggregates]
+private int countPotentialAps(AccessPathApprox apa, Configuration config) {
+  apa instanceof AccessPathApproxNil and result = 1
+  or
+  result = strictsum(AccessPathApprox tail | tail = getATail(apa, config) | countAps(tail, config))
+}
+
+private newtype TAccessPath =
+  TAccessPathNil(DataFlowType t) or
+  TAccessPathCons(TypedContent head, AccessPath tail) {
+    exists(AccessPathApproxCons apa |
+      not evalUnfold(apa, false, _) and
+      head = apa.getHead() and
+      tail.getApprox() = getATail(apa, _)
+    )
+  } or
+  TAccessPathCons2(TypedContent head1, TypedContent head2, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      not expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head1 = apa.getHead() and
+      head2 = getATail(apa, _).getHead()
+    )
+  } or
+  TAccessPathCons1(TypedContent head, int len) {
+    exists(AccessPathApproxCons apa |
+      evalUnfold(apa, false, _) and
+      expensiveLen1to2unfolding(apa, _) and
+      apa.len() = len and
+      head = apa.getHead()
+    )
+  }
+
+private newtype TPathNode =
+  TPathNodeMid(
+    NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap, Configuration config
+  ) {
+    // A PathNode is introduced by a source ...
+    Stage4::revFlow(node, state, config) and
+    sourceNode(node, state, config) and
+    (
+      if hasSourceCallCtx(config)
+      then cc instanceof CallContextSomeCall
+      else cc instanceof CallContextAny
+    ) and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(node.getDataFlowType())
+    or
+    // ... or a step from an existing PathNode to another node.
+    exists(PathNodeMid mid |
+      pathStep(mid, node, state, cc, sc, ap) and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      Stage4::revFlow(node, state, ap.getApprox(), pragma[only_bind_into](config))
+    )
+  } or
+  TPathNodeSink(NodeEx node, FlowState state, Configuration config) {
+    exists(PathNodeMid sink |
+      sink.isAtSink() and
+      node = sink.getNodeEx() and
+      state = sink.getState() and
+      config = sink.getConfiguration()
+    )
+  }
+
+/**
+ * A list of `TypedContent`s followed by a `DataFlowType`. If data flows from a
+ * source to a given node with a given `AccessPath`, this indicates the sequence
+ * of dereference operations needed to get from the value in the node to the
+ * tracked object. The final type indicates the type of the tracked object.
+ */
+private class AccessPath extends TAccessPath {
+  /** Gets the head of this access path, if any. */
+  abstract TypedContent getHead();
+
+  /** Gets the tail of this access path, if any. */
+  abstract AccessPath getTail();
+
+  /** Gets the front of this access path. */
+  abstract AccessPathFront getFront();
+
+  /** Gets the approximation of this access path. */
+  abstract AccessPathApprox getApprox();
+
+  /** Gets the length of this access path. */
+  abstract int length();
+
+  /** Gets a textual representation of this access path. */
+  abstract string toString();
+
+  /** Gets the access path obtained by popping `tc` from this access path, if any. */
+  final AccessPath pop(TypedContent tc) {
+    result = this.getTail() and
+    tc = this.getHead()
+  }
+
+  /** Gets the access path obtained by pushing `tc` onto this access path. */
+  final AccessPath push(TypedContent tc) { this = result.pop(tc) }
+}
+
+private class AccessPathNil extends AccessPath, TAccessPathNil {
+  private DataFlowType t;
+
+  AccessPathNil() { this = TAccessPathNil(t) }
+
+  DataFlowType getType() { result = t }
+
+  override TypedContent getHead() { none() }
+
+  override AccessPath getTail() { none() }
+
+  override AccessPathFrontNil getFront() { result = TFrontNil(t) }
+
+  override AccessPathApproxNil getApprox() { result = TNil(t) }
+
+  override int length() { result = 0 }
+
+  override string toString() { result = concat(": " + ppReprType(t)) }
+}
+
+private class AccessPathCons extends AccessPath, TAccessPathCons {
+  private TypedContent head;
+  private AccessPath tail;
+
+  AccessPathCons() { this = TAccessPathCons(head, tail) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() { result = tail }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsNil(head, tail.(AccessPathNil).getType())
+    or
+    result = TConsCons(head, tail.getHead(), this.length())
+    or
+    result = TCons1(head, this.length())
+  }
+
+  override int length() { result = 1 + tail.length() }
+
+  private string toStringImpl(boolean needsSuffix) {
+    exists(DataFlowType t |
+      tail = TAccessPathNil(t) and
+      needsSuffix = false and
+      result = head.toString() + "]" + concat(" : " + ppReprType(t))
+    )
+    or
+    result = head + ", " + tail.(AccessPathCons).toStringImpl(needsSuffix)
+    or
+    exists(TypedContent tc2, TypedContent tc3, int len | tail = TAccessPathCons2(tc2, tc3, len) |
+      result = head + ", " + tc2 + ", " + tc3 + ", ... (" and len > 2 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + ", " + tc3 + "]" and len = 2 and needsSuffix = false
+    )
+    or
+    exists(TypedContent tc2, int len | tail = TAccessPathCons1(tc2, len) |
+      result = head + ", " + tc2 + ", ... (" and len > 1 and needsSuffix = true
+      or
+      result = head + ", " + tc2 + "]" and len = 1 and needsSuffix = false
+    )
+  }
+
+  override string toString() {
+    result = "[" + this.toStringImpl(true) + this.length().toString() + ")]"
+    or
+    result = "[" + this.toStringImpl(false)
+  }
+}
+
+private class AccessPathCons2 extends AccessPath, TAccessPathCons2 {
+  private TypedContent head1;
+  private TypedContent head2;
+  private int len;
+
+  AccessPathCons2() { this = TAccessPathCons2(head1, head2, len) }
+
+  override TypedContent getHead() { result = head1 }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head1, result.getApprox(), _) and
+    result.getHead() = head2 and
+    result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head1) }
+
+  override AccessPathApproxCons getApprox() {
+    result = TConsCons(head1, head2, len) or
+    result = TCons1(head1, len)
+  }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 2
+    then result = "[" + head1.toString() + ", " + head2.toString() + "]"
+    else
+      result = "[" + head1.toString() + ", " + head2.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+private class AccessPathCons1 extends AccessPath, TAccessPathCons1 {
+  private TypedContent head;
+  private int len;
+
+  AccessPathCons1() { this = TAccessPathCons1(head, len) }
+
+  override TypedContent getHead() { result = head }
+
+  override AccessPath getTail() {
+    Stage4::consCand(head, result.getApprox(), _) and result.length() = len - 1
+  }
+
+  override AccessPathFrontHead getFront() { result = TFrontHead(head) }
+
+  override AccessPathApproxCons getApprox() { result = TCons1(head, len) }
+
+  override int length() { result = len }
+
+  override string toString() {
+    if len = 1
+    then result = "[" + head.toString() + "]"
+    else result = "[" + head.toString() + ", ... (" + len.toString() + ")]"
+  }
+}
+
+/**
+ * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
+ * Only those `PathNode`s that are reachable from a source are generated.
+ */
+class PathNode extends TPathNode {
+  /** Gets a textual representation of this element. */
+  string toString() { none() }
+
+  /**
+   * Gets a textual representation of this element, including a textual
+   * representation of the call context.
+   */
+  string toStringWithContext() { none() }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    none()
+  }
+
+  /** Gets the underlying `Node`. */
+  final Node getNode() { this.(PathNodeImpl).getNodeEx().projectToNode() = result }
+
+  /** Gets the `FlowState` of this node. */
+  FlowState getState() { none() }
+
+  /** Gets the associated configuration. */
+  Configuration getConfiguration() { none() }
+
+  /** Gets a successor of this node, if any. */
+  final PathNode getASuccessor() {
+    result = this.(PathNodeImpl).getANonHiddenSuccessor() and
+    reach(this) and
+    reach(result)
+  }
+
+  /** Holds if this node is a source. */
+  predicate isSource() { none() }
+}
+
+abstract private class PathNodeImpl extends PathNode {
+  abstract PathNodeImpl getASuccessorImpl();
+
+  private PathNodeImpl getASuccessorIfHidden() {
+    this.isHidden() and
+    result = this.getASuccessorImpl()
+  }
+
+  final PathNodeImpl getANonHiddenSuccessor() {
+    result = this.getASuccessorImpl().getASuccessorIfHidden*() and
+    not this.isHidden() and
+    not result.isHidden()
+  }
+
+  abstract NodeEx getNodeEx();
+
+  predicate isHidden() {
+    not this.getConfiguration().includeHiddenNodes() and
+    (
+      hiddenNode(this.getNodeEx().asNode()) and
+      not this.isSource() and
+      not this instanceof PathNodeSink
+      or
+      this.getNodeEx() instanceof TNodeImplicitRead
+    )
+  }
+
+  private string ppAp() {
+    this instanceof PathNodeSink and result = ""
+    or
+    exists(string s | s = this.(PathNodeMid).getAp().toString() |
+      if s = "" then result = "" else result = " " + s
+    )
+  }
+
+  private string ppCtx() {
+    this instanceof PathNodeSink and result = ""
+    or
+    result = " <" + this.(PathNodeMid).getCallContext().toString() + ">"
+  }
+
+  override string toString() { result = this.getNodeEx().toString() + this.ppAp() }
+
+  override string toStringWithContext() {
+    result = this.getNodeEx().toString() + this.ppAp() + this.ppCtx()
+  }
+
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+/** Holds if `n` can reach a sink. */
+private predicate directReach(PathNodeImpl n) {
+  n instanceof PathNodeSink or directReach(n.getANonHiddenSuccessor())
+}
+
+/** Holds if `n` can reach a sink or is used in a subpath that can reach a sink. */
+private predicate reach(PathNode n) { directReach(n) or Subpaths::retReach(n) }
+
+/** Holds if `n1.getASuccessor() = n2` and `n2` can reach a sink. */
+private predicate pathSucc(PathNodeImpl n1, PathNode n2) {
+  n1.getANonHiddenSuccessor() = n2 and directReach(n2)
+}
+
+private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
+
+/**
+ * Provides the query predicates needed to include a graph in a path-problem query.
+ */
+module PathGraph {
+  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+  query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }
+
+  /** Holds if `n` is a node in the graph of data flow path explanations. */
+  query predicate nodes(PathNode n, string key, string val) {
+    reach(n) and key = "semmle.label" and val = n.toString()
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {
+    Subpaths::subpaths(arg, par, ret, out) and
+    reach(arg) and
+    reach(par) and
+    reach(ret) and
+    reach(out)
+  }
+}
+
+/**
+ * An intermediate flow graph node. This is a triple consisting of a `Node`,
+ * a `CallContext`, and a `Configuration`.
+ */
+private class PathNodeMid extends PathNodeImpl, TPathNodeMid {
+  NodeEx node;
+  FlowState state;
+  CallContext cc;
+  SummaryCtx sc;
+  AccessPath ap;
+  Configuration config;
+
+  PathNodeMid() { this = TPathNodeMid(node, state, cc, sc, ap, config) }
+
+  override NodeEx getNodeEx() { result = node }
+
+  override FlowState getState() { result = state }
+
+  CallContext getCallContext() { result = cc }
+
+  SummaryCtx getSummaryCtx() { result = sc }
+
+  AccessPath getAp() { result = ap }
+
+  override Configuration getConfiguration() { result = config }
+
+  private PathNodeMid getSuccMid() {
+    pathStep(this, result.getNodeEx(), result.getState(), result.getCallContext(),
+      result.getSummaryCtx(), result.getAp()) and
+    result.getConfiguration() = unbindConf(this.getConfiguration())
+  }
+
+  override PathNodeImpl getASuccessorImpl() {
+    // an intermediate step to another intermediate node
+    result = this.getSuccMid()
+    or
+    // a final step to a sink
+    result = this.getSuccMid().projectToSink()
+  }
+
+  override predicate isSource() {
+    sourceNode(node, state, config) and
+    (
+      if hasSourceCallCtx(config)
+      then cc instanceof CallContextSomeCall
+      else cc instanceof CallContextAny
+    ) and
+    sc instanceof SummaryCtxNone and
+    ap = TAccessPathNil(node.getDataFlowType())
+  }
+
+  predicate isAtSink() {
+    sinkNode(node, state, config) and
+    ap instanceof AccessPathNil and
+    if hasSinkCallCtx(config)
+    then
+      // For `FeatureHasSinkCallContext` the condition `cc instanceof CallContextNoCall`
+      // is exactly what we need to check. This also implies
+      // `sc instanceof SummaryCtxNone`.
+      // For `FeatureEqualSourceSinkCallContext` the initial call context was
+      // set to `CallContextSomeCall` and jumps are disallowed, so
+      // `cc instanceof CallContextNoCall` never holds. On the other hand,
+      // in this case there's never any need to enter a call except to identify
+      // a summary, so the condition in `pathIntoCallable` enforces this, which
+      // means that `sc instanceof SummaryCtxNone` holds if and only if we are
+      // in the call context of the source.
+      sc instanceof SummaryCtxNone or
+      cc instanceof CallContextNoCall
+    else any()
+  }
+
+  PathNodeSink projectToSink() {
+    this.isAtSink() and
+    result.getNodeEx() = node and
+    result.getState() = state and
+    result.getConfiguration() = unbindConf(config)
+  }
+}
+
+/**
+ * A flow graph node corresponding to a sink. This is disjoint from the
+ * intermediate nodes in order to uniquely correspond to a given sink by
+ * excluding the `CallContext`.
+ */
+private class PathNodeSink extends PathNodeImpl, TPathNodeSink {
+  NodeEx node;
+  FlowState state;
+  Configuration config;
+
+  PathNodeSink() { this = TPathNodeSink(node, state, config) }
+
+  override NodeEx getNodeEx() { result = node }
+
+  override FlowState getState() { result = state }
+
+  override Configuration getConfiguration() { result = config }
+
+  override PathNodeImpl getASuccessorImpl() { none() }
+
+  override predicate isSource() { sourceNode(node, state, config) }
+}
+
+private predicate pathNode(
+  PathNodeMid mid, NodeEx midnode, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap,
+  Configuration conf, LocalCallContext localCC
+) {
+  midnode = mid.getNodeEx() and
+  state = mid.getState() and
+  conf = mid.getConfiguration() and
+  cc = mid.getCallContext() and
+  sc = mid.getSummaryCtx() and
+  localCC =
+    getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
+      midnode.getEnclosingCallable()) and
+  ap = mid.getAp()
+}
+
+/**
+ * Holds if data may flow from `mid` to `node`. The last step in or out of
+ * a callable is recorded by `cc`.
+ */
+pragma[nomagic]
+private predicate pathStep(
+  PathNodeMid mid, NodeEx node, FlowState state, CallContext cc, SummaryCtx sc, AccessPath ap
+) {
+  exists(NodeEx midnode, FlowState state0, Configuration conf, LocalCallContext localCC |
+    pathNode(mid, midnode, state0, cc, sc, ap, conf, localCC) and
+    localFlowBigStep(midnode, state0, node, state, true, _, conf, localCC)
+  )
+  or
+  exists(
+    AccessPath ap0, NodeEx midnode, FlowState state0, Configuration conf, LocalCallContext localCC
+  |
+    pathNode(mid, midnode, state0, cc, sc, ap0, conf, localCC) and
+    localFlowBigStep(midnode, state0, node, state, false, ap.getFront(), conf, localCC) and
+    ap0 instanceof AccessPathNil
+  )
+  or
+  jumpStep(mid.getNodeEx(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  ap = mid.getAp()
+  or
+  additionalJumpStep(mid.getNodeEx(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(node.getDataFlowType())
+  or
+  additionalJumpStateStep(mid.getNodeEx(), mid.getState(), node, state, mid.getConfiguration()) and
+  cc instanceof CallContextAny and
+  sc instanceof SummaryCtxNone and
+  mid.getAp() instanceof AccessPathNil and
+  ap = TAccessPathNil(node.getDataFlowType())
+  or
+  exists(TypedContent tc | pathStoreStep(mid, node, state, ap.pop(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  exists(TypedContent tc | pathReadStep(mid, node, state, ap.push(tc), tc, cc)) and
+  sc = mid.getSummaryCtx()
+  or
+  pathIntoCallable(mid, node, state, _, cc, sc, _, _) and ap = mid.getAp()
+  or
+  pathOutOfCallable(mid, node, state, cc) and ap = mid.getAp() and sc instanceof SummaryCtxNone
+  or
+  pathThroughCallable(mid, node, state, cc, ap) and sc = mid.getSummaryCtx()
+}
+
+pragma[nomagic]
+private predicate pathReadStep(
+  PathNodeMid mid, NodeEx node, FlowState state, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  tc = ap0.getHead() and
+  Stage4::readStepCand(mid.getNodeEx(), tc.getContent(), node, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc = mid.getCallContext()
+}
+
+pragma[nomagic]
+private predicate pathStoreStep(
+  PathNodeMid mid, NodeEx node, FlowState state, AccessPath ap0, TypedContent tc, CallContext cc
+) {
+  ap0 = mid.getAp() and
+  Stage4::storeStepCand(mid.getNodeEx(), _, tc, node, _, mid.getConfiguration()) and
+  state = mid.getState() and
+  cc = mid.getCallContext()
+}
+
+private predicate pathOutOfCallable0(
+  PathNodeMid mid, ReturnPosition pos, FlowState state, CallContext innercc, AccessPathApprox apa,
+  Configuration config
+) {
+  pos = mid.getNodeEx().(RetNodeEx).getReturnPosition() and
+  state = mid.getState() and
+  innercc = mid.getCallContext() and
+  innercc instanceof CallContextNoCall and
+  apa = mid.getAp().getApprox() and
+  config = mid.getConfiguration()
+}
+
+pragma[nomagic]
+private predicate pathOutOfCallable1(
+  PathNodeMid mid, DataFlowCall call, ReturnKindExt kind, FlowState state, CallContext cc,
+  AccessPathApprox apa, Configuration config
+) {
+  exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+    pathOutOfCallable0(mid, pos, state, innercc, apa, config) and
+    c = pos.getCallable() and
+    kind = pos.getKind() and
+    resolveReturn(innercc, c, call)
+  |
+    if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+  )
+}
+
+pragma[noinline]
+private NodeEx getAnOutNodeFlow(
+  ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config
+) {
+  result.asNode() = kind.getAnOutNode(call) and
+  Stage4::revFlow(result, _, apa, config)
+}
+
+/**
+ * Holds if data may flow from `mid` to `out`. The last step of this path
+ * is a return from a callable and is recorded by `cc`, if needed.
+ */
+pragma[noinline]
+private predicate pathOutOfCallable(PathNodeMid mid, NodeEx out, FlowState state, CallContext cc) {
+  exists(ReturnKindExt kind, DataFlowCall call, AccessPathApprox apa, Configuration config |
+    pathOutOfCallable1(mid, call, kind, state, cc, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
+ */
+pragma[noinline]
+private predicate pathIntoArg(
+  PathNodeMid mid, ParameterPosition ppos, FlowState state, CallContext cc, DataFlowCall call,
+  AccessPath ap, AccessPathApprox apa, Configuration config
+) {
+  exists(ArgNodeEx arg, ArgumentPosition apos |
+    pathNode(mid, arg, state, cc, _, ap, config, _) and
+    arg.asNode().(ArgNode).argumentOf(call, apos) and
+    apa = ap.getApprox() and
+    parameterMatch(ppos, apos)
+  )
+}
+
+pragma[nomagic]
+private predicate parameterCand(
+  DataFlowCallable callable, ParameterPosition pos, AccessPathApprox apa, Configuration config
+) {
+  exists(ParamNodeEx p |
+    Stage4::revFlow(p, _, apa, config) and
+    p.isParameterOf(callable, pos)
+  )
+}
+
+pragma[nomagic]
+private predicate pathIntoCallable0(
+  PathNodeMid mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+  CallContext outercc, DataFlowCall call, AccessPath ap, Configuration config
+) {
+  exists(AccessPathApprox apa |
+    pathIntoArg(mid, pragma[only_bind_into](pos), state, outercc, call, ap,
+      pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+    callable = resolveCall(call, outercc) and
+    parameterCand(callable, pragma[only_bind_into](pos), pragma[only_bind_into](apa),
+      pragma[only_bind_into](config))
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` to `p` through `call`. The contexts
+ * before and after entering the callable are `outercc` and `innercc`,
+ * respectively.
+ */
+pragma[nomagic]
+private predicate pathIntoCallable(
+  PathNodeMid mid, ParamNodeEx p, FlowState state, CallContext outercc, CallContextCall innercc,
+  SummaryCtx sc, DataFlowCall call, Configuration config
+) {
+  exists(ParameterPosition pos, DataFlowCallable callable, AccessPath ap |
+    pathIntoCallable0(mid, callable, pos, state, outercc, call, ap, config) and
+    p.isParameterOf(callable, pos) and
+    (
+      sc = TSummaryCtxSome(p, state, ap)
+      or
+      not exists(TSummaryCtxSome(p, state, ap)) and
+      sc = TSummaryCtxNone() and
+      // When the call contexts of source and sink needs to match then there's
+      // never any reason to enter a callable except to find a summary. See also
+      // the comment in `PathNodeMid::isAtSink`.
+      not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
+    )
+  |
+    if recordDataFlowCallSite(call, callable)
+    then innercc = TSpecificCall(call)
+    else innercc = TSomeCall()
+  )
+}
+
+/** Holds if data may flow from a parameter given by `sc` to a return of kind `kind`. */
+pragma[nomagic]
+private predicate paramFlowsThrough(
+  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
+  AccessPathApprox apa, Configuration config
+) {
+  exists(PathNodeMid mid, RetNodeEx ret, ParameterPosition pos |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    kind = ret.getKind() and
+    apa = ap.getApprox() and
+    pos = sc.getParameterPos() and
+    // we don't expect a parameter to return stored in itself, unless explicitly allowed
+    (
+      not kind.(ParamUpdateReturnKind).getPosition() = pos
+      or
+      sc.getParamNode().allowParameterReturnInSelf()
+    )
+  )
+}
+
+pragma[nomagic]
+private predicate pathThroughCallable0(
+  DataFlowCall call, PathNodeMid mid, ReturnKindExt kind, FlowState state, CallContext cc,
+  AccessPath ap, AccessPathApprox apa, Configuration config
+) {
+  exists(CallContext innercc, SummaryCtx sc |
+    pathIntoCallable(mid, _, _, cc, innercc, sc, call, config) and
+    paramFlowsThrough(kind, state, innercc, sc, ap, apa, config)
+  )
+}
+
+/**
+ * Holds if data may flow from `mid` through a callable to the node `out`.
+ * The context `cc` is restored to its value prior to entering the callable.
+ */
+pragma[noinline]
+private predicate pathThroughCallable(
+  PathNodeMid mid, NodeEx out, FlowState state, CallContext cc, AccessPath ap
+) {
+  exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa, Configuration config |
+    pathThroughCallable0(call, mid, kind, state, cc, ap, apa, config) and
+    out = getAnOutNodeFlow(kind, call, apa, config)
+  )
+}
+
+private module Subpaths {
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple and `ret` is determined by
+   * `kind`, `sc`, `apout`, and `innercc`.
+   */
+  pragma[nomagic]
+  private predicate subpaths01(
+    PathNodeImpl arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
+    NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    exists(Configuration config |
+      pathThroughCallable(arg, out, pragma[only_bind_into](sout), _, pragma[only_bind_into](apout)) and
+      pathIntoCallable(arg, par, _, _, innercc, sc, _, config) and
+      paramFlowsThrough(kind, pragma[only_bind_into](sout), innercc, sc,
+        pragma[only_bind_into](apout), _, unbindConf(config)) and
+      not arg.isHidden()
+    )
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple and `ret` is determined by
+   * `kind`, `sc`, `sout`, `apout`, and `innercc`.
+   */
+  pragma[nomagic]
+  private predicate subpaths02(
+    PathNode arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
+    NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    subpaths01(arg, par, sc, innercc, kind, out, sout, apout) and
+    out.asNode() = kind.getAnOutNode(_)
+  }
+
+  pragma[nomagic]
+  private Configuration getPathNodeConf(PathNode n) { result = n.getConfiguration() }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple.
+   */
+  pragma[nomagic]
+  private predicate subpaths03(
+    PathNode arg, ParamNodeEx par, PathNodeMid ret, NodeEx out, FlowState sout, AccessPath apout
+  ) {
+    exists(SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind, RetNodeEx retnode |
+      subpaths02(arg, par, sc, innercc, kind, out, sout, apout) and
+      pathNode(ret, retnode, sout, innercc, sc, apout, unbindConf(getPathNodeConf(arg)), _) and
+      kind = retnode.getKind()
+    )
+  }
+
+  private PathNodeImpl localStepToHidden(PathNodeImpl n) {
+    n.getASuccessorImpl() = result and
+    result.isHidden() and
+    exists(NodeEx n1, NodeEx n2 | n1 = n.getNodeEx() and n2 = result.getNodeEx() |
+      localFlowBigStep(n1, _, n2, _, _, _, _, _) or
+      store(n1, _, n2, _, _) or
+      readSet(n1, _, n2, _)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate hasSuccessor(PathNodeImpl pred, PathNodeMid succ, NodeEx succNode) {
+    succ = pred.getANonHiddenSuccessor() and
+    succNode = succ.getNodeEx()
+  }
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  predicate subpaths(PathNodeImpl arg, PathNodeImpl par, PathNodeImpl ret, PathNode out) {
+    exists(ParamNodeEx p, NodeEx o, FlowState sout, AccessPath apout, PathNodeMid out0 |
+      pragma[only_bind_into](arg).getANonHiddenSuccessor() = pragma[only_bind_into](out0) and
+      subpaths03(pragma[only_bind_into](arg), p, localStepToHidden*(ret), o, sout, apout) and
+      hasSuccessor(pragma[only_bind_into](arg), par, p) and
+      not ret.isHidden() and
+      pathNode(out0, o, sout, _, _, apout, _, _)
+    |
+      out = out0 or out = out0.projectToSink()
+    )
+  }
+
+  /**
+   * Holds if `n` can reach a return node in a summarized subpath that can reach a sink.
+   */
+  predicate retReach(PathNodeImpl n) {
+    exists(PathNode out | subpaths(_, _, n, out) | directReach(out) or retReach(out))
+    or
+    exists(PathNodeImpl mid |
+      retReach(mid) and
+      n.getANonHiddenSuccessor() = mid and
+      not subpaths(_, mid, _, _)
+    )
+  }
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+private predicate flowsTo(
+  PathNode flowsource, PathNodeSink flowsink, Node source, Node sink, Configuration configuration
+) {
+  flowsource.isSource() and
+  flowsource.getConfiguration() = configuration and
+  flowsource.(PathNodeImpl).getNodeEx().asNode() = source and
+  (flowsource = flowsink or pathSuccPlus(flowsource, flowsink)) and
+  flowsink.getNodeEx().asNode() = sink
+}
+
+/**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+predicate flowsTo(Node source, Node sink, Configuration configuration) {
+  flowsTo(_, _, source, sink, configuration)
+}
+
+private predicate finalStats(
+  boolean fwd, int nodes, int fields, int conscand, int states, int tuples
+) {
+  fwd = true and
+  nodes = count(NodeEx n0 | exists(PathNodeImpl pn | pn.getNodeEx() = n0)) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0)) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap)) and
+  states = count(FlowState state | exists(PathNodeMid pn | pn.getState() = state)) and
+  tuples = count(PathNode pn)
+  or
+  fwd = false and
+  nodes = count(NodeEx n0 | exists(PathNodeImpl pn | pn.getNodeEx() = n0 and reach(pn))) and
+  fields = count(TypedContent f0 | exists(PathNodeMid pn | pn.getAp().getHead() = f0 and reach(pn))) and
+  conscand = count(AccessPath ap | exists(PathNodeMid pn | pn.getAp() = ap and reach(pn))) and
+  states = count(FlowState state | exists(PathNodeMid pn | pn.getState() = state and reach(pn))) and
+  tuples = count(PathNode pn | reach(pn))
+}
+
+/**
+ * INTERNAL: Only for debugging.
+ *
+ * Calculates per-stage metrics for data flow.
+ */
+predicate stageStats(
+  int n, string stage, int nodes, int fields, int conscand, int states, int tuples,
+  Configuration config
+) {
+  stage = "1 Fwd" and
+  n = 10 and
+  Stage1::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "1 Rev" and
+  n = 15 and
+  Stage1::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "2 Fwd" and
+  n = 20 and
+  Stage2::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "2 Rev" and
+  n = 25 and
+  Stage2::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "3 Fwd" and
+  n = 30 and
+  Stage3::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "3 Rev" and
+  n = 35 and
+  Stage3::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "4 Fwd" and
+  n = 40 and
+  Stage4::stats(true, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "4 Rev" and
+  n = 45 and
+  Stage4::stats(false, nodes, fields, conscand, states, tuples, config)
+  or
+  stage = "5 Fwd" and n = 50 and finalStats(true, nodes, fields, conscand, states, tuples)
+  or
+  stage = "5 Rev" and n = 55 and finalStats(false, nodes, fields, conscand, states, tuples)
+}
+
+private module FlowExploration {
+  private predicate callableStep(DataFlowCallable c1, DataFlowCallable c2, Configuration config) {
+    exists(NodeEx node1, NodeEx node2 |
+      jumpStep(node1, node2, config)
+      or
+      additionalJumpStep(node1, node2, config)
+      or
+      additionalJumpStateStep(node1, _, node2, _, config)
+      or
+      // flow into callable
+      viableParamArgEx(_, node2, node1)
+      or
+      // flow out of a callable
+      viableReturnPosOutEx(_, node1.(RetNodeEx).getReturnPosition(), node2)
+    |
+      c1 = node1.getEnclosingCallable() and
+      c2 = node2.getEnclosingCallable() and
+      c1 != c2
+    )
+  }
+
+  private predicate interestingCallableSrc(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSource(n) or config.isSource(n, _) | c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSrc(mid, config) and callableStep(mid, c, config)
+    )
+  }
+
+  private predicate interestingCallableSink(DataFlowCallable c, Configuration config) {
+    exists(Node n | config.isSink(n) or config.isSink(n, _) | c = getNodeEnclosingCallable(n))
+    or
+    exists(DataFlowCallable mid |
+      interestingCallableSink(mid, config) and callableStep(c, mid, config)
+    )
+  }
+
+  private newtype TCallableExt =
+    TCallable(DataFlowCallable c, Configuration config) {
+      interestingCallableSrc(c, config) or
+      interestingCallableSink(c, config)
+    } or
+    TCallableSrc() or
+    TCallableSink()
+
+  private predicate callableExtSrc(TCallableSrc src) { any() }
+
+  private predicate callableExtSink(TCallableSink sink) { any() }
+
+  private predicate callableExtStepFwd(TCallableExt ce1, TCallableExt ce2) {
+    exists(DataFlowCallable c1, DataFlowCallable c2, Configuration config |
+      callableStep(c1, c2, config) and
+      ce1 = TCallable(c1, pragma[only_bind_into](config)) and
+      ce2 = TCallable(c2, pragma[only_bind_into](config))
+    )
+    or
+    exists(Node n, Configuration config |
+      ce1 = TCallableSrc() and
+      (config.isSource(n) or config.isSource(n, _)) and
+      ce2 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+    or
+    exists(Node n, Configuration config |
+      ce2 = TCallableSink() and
+      (config.isSink(n) or config.isSink(n, _)) and
+      ce1 = TCallable(getNodeEnclosingCallable(n), config)
+    )
+  }
+
+  private predicate callableExtStepRev(TCallableExt ce1, TCallableExt ce2) {
+    callableExtStepFwd(ce2, ce1)
+  }
+
+  private int distSrcExt(TCallableExt c) =
+    shortestDistances(callableExtSrc/1, callableExtStepFwd/2)(_, c, result)
+
+  private int distSinkExt(TCallableExt c) =
+    shortestDistances(callableExtSink/1, callableExtStepRev/2)(_, c, result)
+
+  private int distSrc(DataFlowCallable c, Configuration config) {
+    result = distSrcExt(TCallable(c, config)) - 1
+  }
+
+  private int distSink(DataFlowCallable c, Configuration config) {
+    result = distSinkExt(TCallable(c, config)) - 1
+  }
+
+  private newtype TPartialAccessPath =
+    TPartialNil(DataFlowType t) or
+    TPartialCons(TypedContent tc, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `TypedContent`s followed by a `Type`, but only the first
+   * element of the list and its length are tracked. If data flows from a source to
+   * a given node with a given `AccessPath`, this indicates the sequence of
+   * dereference operations needed to get from the value in the node to the
+   * tracked object. The final type indicates the type of the tracked object.
+   */
+  private class PartialAccessPath extends TPartialAccessPath {
+    abstract string toString();
+
+    TypedContent getHead() { this = TPartialCons(result, _) }
+
+    int len() {
+      this = TPartialNil(_) and result = 0
+      or
+      this = TPartialCons(_, result)
+    }
+
+    DataFlowType getType() {
+      this = TPartialNil(result)
+      or
+      exists(TypedContent head | this = TPartialCons(head, _) | result = head.getContainerType())
+    }
+  }
+
+  private class PartialAccessPathNil extends PartialAccessPath, TPartialNil {
+    override string toString() {
+      exists(DataFlowType t | this = TPartialNil(t) | result = concat(": " + ppReprType(t)))
+    }
+  }
+
+  private class PartialAccessPathCons extends PartialAccessPath, TPartialCons {
+    override string toString() {
+      exists(TypedContent tc, int len | this = TPartialCons(tc, len) |
+        if len = 1
+        then result = "[" + tc.toString() + "]"
+        else result = "[" + tc.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private newtype TRevPartialAccessPath =
+    TRevPartialNil() or
+    TRevPartialCons(Content c, int len) { len in [1 .. accessPathLimit()] }
+
+  /**
+   * Conceptually a list of `Content`s, but only the first
+   * element of the list and its length are tracked.
+   */
+  private class RevPartialAccessPath extends TRevPartialAccessPath {
+    abstract string toString();
+
+    Content getHead() { this = TRevPartialCons(result, _) }
+
+    int len() {
+      this = TRevPartialNil() and result = 0
+      or
+      this = TRevPartialCons(_, result)
+    }
+  }
+
+  private class RevPartialAccessPathNil extends RevPartialAccessPath, TRevPartialNil {
+    override string toString() { result = "" }
+  }
+
+  private class RevPartialAccessPathCons extends RevPartialAccessPath, TRevPartialCons {
+    override string toString() {
+      exists(Content c, int len | this = TRevPartialCons(c, len) |
+        if len = 1
+        then result = "[" + c.toString() + "]"
+        else result = "[" + c.toString() + ", ... (" + len.toString() + ")]"
+      )
+    }
+  }
+
+  private predicate relevantState(FlowState state) {
+    sourceNode(_, state, _) or
+    sinkNode(_, state, _) or
+    additionalLocalStateStep(_, state, _, _, _) or
+    additionalLocalStateStep(_, _, _, state, _) or
+    additionalJumpStateStep(_, state, _, _, _) or
+    additionalJumpStateStep(_, _, _, state, _)
+  }
+
+  private newtype TSummaryCtx1 =
+    TSummaryCtx1None() or
+    TSummaryCtx1Param(ParamNodeEx p)
+
+  private newtype TSummaryCtx2 =
+    TSummaryCtx2None() or
+    TSummaryCtx2Some(FlowState s) { relevantState(s) }
+
+  private newtype TSummaryCtx3 =
+    TSummaryCtx3None() or
+    TSummaryCtx3Some(PartialAccessPath ap)
+
+  private newtype TRevSummaryCtx1 =
+    TRevSummaryCtx1None() or
+    TRevSummaryCtx1Some(ReturnPosition pos)
+
+  private newtype TRevSummaryCtx2 =
+    TRevSummaryCtx2None() or
+    TRevSummaryCtx2Some(FlowState s) { relevantState(s) }
+
+  private newtype TRevSummaryCtx3 =
+    TRevSummaryCtx3None() or
+    TRevSummaryCtx3Some(RevPartialAccessPath ap)
+
+  private newtype TPartialPathNode =
+    TPartialPathNodeFwd(
+      NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+      TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+    ) {
+      sourceNode(node, state, config) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      sc3 = TSummaryCtx3None() and
+      ap = TPartialNil(node.getDataFlowType()) and
+      exists(config.explorationLimit())
+      or
+      partialPathNodeMk0(node, state, cc, sc1, sc2, sc3, ap, config) and
+      distSrc(node.getEnclosingCallable(), config) <= config.explorationLimit()
+    } or
+    TPartialPathNodeRev(
+      NodeEx node, FlowState state, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2, TRevSummaryCtx3 sc3,
+      RevPartialAccessPath ap, Configuration config
+    ) {
+      sinkNode(node, state, config) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = TRevPartialNil() and
+      exists(config.explorationLimit())
+      or
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
+    }
+
+  pragma[nomagic]
+  private predicate partialPathNodeMk0(
+    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
+  }
+
+  /**
+   * A `Node` augmented with a call context, an access path, and a configuration.
+   */
+  class PartialPathNode extends TPartialPathNode {
+    /** Gets a textual representation of this element. */
+    string toString() { result = this.getNodeEx().toString() + this.ppAp() }
+
+    /**
+     * Gets a textual representation of this element, including a textual
+     * representation of the call context.
+     */
+    string toStringWithContext() {
+      result = this.getNodeEx().toString() + this.ppAp() + this.ppCtx()
+    }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+
+    /** Gets the underlying `Node`. */
+    final Node getNode() { this.getNodeEx().projectToNode() = result }
+
+    FlowState getState() { none() }
+
+    private NodeEx getNodeEx() {
+      result = this.(PartialPathNodeFwd).getNodeEx() or
+      result = this.(PartialPathNodeRev).getNodeEx()
+    }
+
+    /** Gets the associated configuration. */
+    Configuration getConfiguration() { none() }
+
+    /** Gets a successor of this node, if any. */
+    PartialPathNode getASuccessor() { none() }
+
+    /**
+     * Gets the approximate distance to the nearest source measured in number
+     * of interprocedural steps.
+     */
+    int getSourceDistance() {
+      result = distSrc(this.getNodeEx().getEnclosingCallable(), this.getConfiguration())
+    }
+
+    /**
+     * Gets the approximate distance to the nearest sink measured in number
+     * of interprocedural steps.
+     */
+    int getSinkDistance() {
+      result = distSink(this.getNodeEx().getEnclosingCallable(), this.getConfiguration())
+    }
+
+    private string ppAp() {
+      exists(string s |
+        s = this.(PartialPathNodeFwd).getAp().toString() or
+        s = this.(PartialPathNodeRev).getAp().toString()
+      |
+        if s = "" then result = "" else result = " " + s
+      )
+    }
+
+    private string ppCtx() {
+      result = " <" + this.(PartialPathNodeFwd).getCallContext().toString() + ">"
+    }
+
+    /** Holds if this is a source in a forward-flow path. */
+    predicate isFwdSource() { this.(PartialPathNodeFwd).isSource() }
+
+    /** Holds if this is a sink in a reverse-flow path. */
+    predicate isRevSink() { this.(PartialPathNodeRev).isSink() }
+  }
+
+  /**
+   * Provides the query predicates needed to include a graph in a path-problem query.
+   */
+  module PartialPathGraph {
+    /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+    query predicate edges(PartialPathNode a, PartialPathNode b) { a.getASuccessor() = b }
+  }
+
+  private class PartialPathNodeFwd extends PartialPathNode, TPartialPathNodeFwd {
+    NodeEx node;
+    FlowState state;
+    CallContext cc;
+    TSummaryCtx1 sc1;
+    TSummaryCtx2 sc2;
+    TSummaryCtx3 sc3;
+    PartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeFwd() { this = TPartialPathNodeFwd(node, state, cc, sc1, sc2, sc3, ap, config) }
+
+    NodeEx getNodeEx() { result = node }
+
+    override FlowState getState() { result = state }
+
+    CallContext getCallContext() { result = cc }
+
+    TSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    TSummaryCtx3 getSummaryCtx3() { result = sc3 }
+
+    PartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeFwd getASuccessor() {
+      partialPathStep(this, result.getNodeEx(), result.getState(), result.getCallContext(),
+        result.getSummaryCtx1(), result.getSummaryCtx2(), result.getSummaryCtx3(), result.getAp(),
+        result.getConfiguration())
+    }
+
+    predicate isSource() {
+      sourceNode(node, state, config) and
+      cc instanceof CallContextAny and
+      sc1 = TSummaryCtx1None() and
+      sc2 = TSummaryCtx2None() and
+      sc3 = TSummaryCtx3None() and
+      ap instanceof TPartialNil
+    }
+  }
+
+  private class PartialPathNodeRev extends PartialPathNode, TPartialPathNodeRev {
+    NodeEx node;
+    FlowState state;
+    TRevSummaryCtx1 sc1;
+    TRevSummaryCtx2 sc2;
+    TRevSummaryCtx3 sc3;
+    RevPartialAccessPath ap;
+    Configuration config;
+
+    PartialPathNodeRev() { this = TPartialPathNodeRev(node, state, sc1, sc2, sc3, ap, config) }
+
+    NodeEx getNodeEx() { result = node }
+
+    override FlowState getState() { result = state }
+
+    TRevSummaryCtx1 getSummaryCtx1() { result = sc1 }
+
+    TRevSummaryCtx2 getSummaryCtx2() { result = sc2 }
+
+    TRevSummaryCtx3 getSummaryCtx3() { result = sc3 }
+
+    RevPartialAccessPath getAp() { result = ap }
+
+    override Configuration getConfiguration() { result = config }
+
+    override PartialPathNodeRev getASuccessor() {
+      revPartialPathStep(result, this.getNodeEx(), this.getState(), this.getSummaryCtx1(),
+        this.getSummaryCtx2(), this.getSummaryCtx3(), this.getAp(), this.getConfiguration())
+    }
+
+    predicate isSink() {
+      sinkNode(node, state, config) and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = TRevPartialNil()
+    }
+  }
+
+  private predicate partialPathStep(
+    PartialPathNodeFwd mid, NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1,
+    TSummaryCtx2 sc2, TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    not isUnreachableInCallCached(node.asNode(), cc.(CallContextSpecificCall).getCall()) and
+    (
+      localFlowStep(mid.getNodeEx(), node, config) and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+      or
+      additionalLocalFlowStep(mid.getNodeEx(), node, config) and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(node.getDataFlowType()) and
+      config = mid.getConfiguration()
+      or
+      additionalLocalStateStep(mid.getNodeEx(), mid.getState(), node, state, config) and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      mid.getAp() instanceof PartialAccessPathNil and
+      ap = TPartialNil(node.getDataFlowType()) and
+      config = mid.getConfiguration()
+    )
+    or
+    jumpStep(mid.getNodeEx(), node, config) and
+    state = mid.getState() and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(mid.getNodeEx(), node, config) and
+    state = mid.getState() and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(node.getDataFlowType()) and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStateStep(mid.getNodeEx(), mid.getState(), node, state, config) and
+    cc instanceof CallContextAny and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None() and
+    mid.getAp() instanceof PartialAccessPathNil and
+    ap = TPartialNil(node.getDataFlowType()) and
+    config = mid.getConfiguration()
+    or
+    partialPathStoreStep(mid, _, _, node, ap) and
+    state = mid.getState() and
+    cc = mid.getCallContext() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    config = mid.getConfiguration()
+    or
+    exists(PartialAccessPath ap0, TypedContent tc |
+      partialPathReadStep(mid, ap0, tc, node, cc, config) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      apConsFwd(ap, tc, ap0, config)
+    )
+    or
+    partialPathIntoCallable(mid, node, state, _, cc, sc1, sc2, sc3, _, ap, config)
+    or
+    partialPathOutOfCallable(mid, node, state, cc, ap, config) and
+    sc1 = TSummaryCtx1None() and
+    sc2 = TSummaryCtx2None() and
+    sc3 = TSummaryCtx3None()
+    or
+    partialPathThroughCallable(mid, node, state, cc, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3()
+  }
+
+  bindingset[result, i]
+  private int unbindInt(int i) { pragma[only_bind_out](i) = pragma[only_bind_out](result) }
+
+  pragma[inline]
+  private predicate partialPathStoreStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap1, TypedContent tc, NodeEx node,
+    PartialAccessPath ap2
+  ) {
+    exists(NodeEx midNode, DataFlowType contentType |
+      midNode = mid.getNodeEx() and
+      ap1 = mid.getAp() and
+      store(midNode, tc, node, contentType, mid.getConfiguration()) and
+      ap2.getHead() = tc and
+      ap2.len() = unbindInt(ap1.len() + 1) and
+      compatibleTypes(ap1.getType(), contentType)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsFwd(
+    PartialAccessPath ap1, TypedContent tc, PartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid |
+      partialPathStoreStep(mid, ap1, tc, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathReadStep(
+    PartialPathNodeFwd mid, PartialAccessPath ap, TypedContent tc, NodeEx node, CallContext cc,
+    Configuration config
+  ) {
+    exists(NodeEx midNode |
+      midNode = mid.getNodeEx() and
+      ap = mid.getAp() and
+      read(midNode, tc.getContent(), node, pragma[only_bind_into](config)) and
+      ap.getHead() = tc and
+      pragma[only_bind_into](config) = mid.getConfiguration() and
+      cc = mid.getCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable0(
+    PartialPathNodeFwd mid, ReturnPosition pos, FlowState state, CallContext innercc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    pos = mid.getNodeEx().(RetNodeEx).getReturnPosition() and
+    state = mid.getState() and
+    innercc = mid.getCallContext() and
+    innercc instanceof CallContextNoCall and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+  }
+
+  pragma[nomagic]
+  private predicate partialPathOutOfCallable1(
+    PartialPathNodeFwd mid, DataFlowCall call, ReturnKindExt kind, FlowState state, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(ReturnPosition pos, DataFlowCallable c, CallContext innercc |
+      partialPathOutOfCallable0(mid, pos, state, innercc, ap, config) and
+      c = pos.getCallable() and
+      kind = pos.getKind() and
+      resolveReturn(innercc, c, call)
+    |
+      if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
+    )
+  }
+
+  private predicate partialPathOutOfCallable(
+    PartialPathNodeFwd mid, NodeEx out, FlowState state, CallContext cc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(ReturnKindExt kind, DataFlowCall call |
+      partialPathOutOfCallable1(mid, call, kind, state, cc, ap, config)
+    |
+      out.asNode() = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathIntoArg(
+    PartialPathNodeFwd mid, ParameterPosition ppos, FlowState state, CallContext cc,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ArgNode arg, ArgumentPosition apos |
+      arg = mid.getNodeEx().asNode() and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      arg.argumentOf(call, apos) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration() and
+      parameterMatch(ppos, apos)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate partialPathIntoCallable0(
+    PartialPathNodeFwd mid, DataFlowCallable callable, ParameterPosition pos, FlowState state,
+    CallContext outercc, DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    partialPathIntoArg(mid, pos, state, outercc, call, ap, config) and
+    callable = resolveCall(call, outercc)
+  }
+
+  private predicate partialPathIntoCallable(
+    PartialPathNodeFwd mid, ParamNodeEx p, FlowState state, CallContext outercc,
+    CallContextCall innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3,
+    DataFlowCall call, PartialAccessPath ap, Configuration config
+  ) {
+    exists(ParameterPosition pos, DataFlowCallable callable |
+      partialPathIntoCallable0(mid, callable, pos, state, outercc, call, ap, config) and
+      p.isParameterOf(callable, pos) and
+      sc1 = TSummaryCtx1Param(p) and
+      sc2 = TSummaryCtx2Some(state) and
+      sc3 = TSummaryCtx3Some(ap)
+    |
+      if recordDataFlowCallSite(call, callable)
+      then innercc = TSpecificCall(call)
+      else innercc = TSomeCall()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate paramFlowsThroughInPartialPath(
+    ReturnKindExt kind, FlowState state, CallContextCall cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
+    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeFwd mid, RetNodeEx ret |
+      mid.getNodeEx() = ret and
+      kind = ret.getKind() and
+      state = mid.getState() and
+      cc = mid.getCallContext() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      config = mid.getConfiguration() and
+      ap = mid.getAp()
+    )
+  }
+
+  pragma[noinline]
+  private predicate partialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeFwd mid, ReturnKindExt kind, FlowState state, CallContext cc,
+    PartialAccessPath ap, Configuration config
+  ) {
+    exists(CallContext innercc, TSummaryCtx1 sc1, TSummaryCtx2 sc2, TSummaryCtx3 sc3 |
+      partialPathIntoCallable(mid, _, _, cc, innercc, sc1, sc2, sc3, call, _, config) and
+      paramFlowsThroughInPartialPath(kind, state, innercc, sc1, sc2, sc3, ap, config)
+    )
+  }
+
+  private predicate partialPathThroughCallable(
+    PartialPathNodeFwd mid, NodeEx out, FlowState state, CallContext cc, PartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(DataFlowCall call, ReturnKindExt kind |
+      partialPathThroughCallable0(call, mid, kind, state, cc, ap, config) and
+      out.asNode() = kind.getAnOutNode(call)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStep(
+    PartialPathNodeRev mid, NodeEx node, FlowState state, TRevSummaryCtx1 sc1, TRevSummaryCtx2 sc2,
+    TRevSummaryCtx3 sc3, RevPartialAccessPath ap, Configuration config
+  ) {
+    localFlowStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalFlowStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    additionalLocalStateStep(node, state, mid.getNodeEx(), mid.getState(), config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    jumpStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    ap = mid.getAp() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStep(node, mid.getNodeEx(), config) and
+    state = mid.getState() and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    additionalJumpStateStep(node, state, mid.getNodeEx(), mid.getState(), config) and
+    sc1 = TRevSummaryCtx1None() and
+    sc2 = TRevSummaryCtx2None() and
+    sc3 = TRevSummaryCtx3None() and
+    mid.getAp() instanceof RevPartialAccessPathNil and
+    ap = TRevPartialNil() and
+    config = mid.getConfiguration()
+    or
+    revPartialPathReadStep(mid, _, _, node, ap) and
+    state = mid.getState() and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3() and
+    config = mid.getConfiguration()
+    or
+    exists(RevPartialAccessPath ap0, Content c |
+      revPartialPathStoreStep(mid, ap0, c, node, config) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      apConsRev(ap, c, ap0, config)
+    )
+    or
+    exists(ParamNodeEx p |
+      mid.getNodeEx() = p and
+      viableParamArgEx(_, p, node) and
+      state = mid.getState() and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      sc1 = TRevSummaryCtx1None() and
+      sc2 = TRevSummaryCtx2None() and
+      sc3 = TRevSummaryCtx3None() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+    or
+    exists(ReturnPosition pos |
+      revPartialPathIntoReturn(mid, pos, state, sc1, sc2, sc3, _, ap, config) and
+      pos = getReturnPosition(node.asNode())
+    )
+    or
+    revPartialPathThroughCallable(mid, node, state, ap, config) and
+    sc1 = mid.getSummaryCtx1() and
+    sc2 = mid.getSummaryCtx2() and
+    sc3 = mid.getSummaryCtx3()
+  }
+
+  pragma[inline]
+  private predicate revPartialPathReadStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap1, Content c, NodeEx node,
+    RevPartialAccessPath ap2
+  ) {
+    exists(NodeEx midNode |
+      midNode = mid.getNodeEx() and
+      ap1 = mid.getAp() and
+      read(node, c, midNode, mid.getConfiguration()) and
+      ap2.getHead() = c and
+      ap2.len() = unbindInt(ap1.len() + 1)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate apConsRev(
+    RevPartialAccessPath ap1, Content c, RevPartialAccessPath ap2, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid |
+      revPartialPathReadStep(mid, ap1, c, _, ap2) and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathStoreStep(
+    PartialPathNodeRev mid, RevPartialAccessPath ap, Content c, NodeEx node, Configuration config
+  ) {
+    exists(NodeEx midNode, TypedContent tc |
+      midNode = mid.getNodeEx() and
+      ap = mid.getAp() and
+      store(node, tc, midNode, _, config) and
+      ap.getHead() = c and
+      config = mid.getConfiguration() and
+      tc.getContent() = c
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathIntoReturn(
+    PartialPathNodeRev mid, ReturnPosition pos, FlowState state, TRevSummaryCtx1Some sc1,
+    TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3, DataFlowCall call, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(NodeEx out |
+      mid.getNodeEx() = out and
+      mid.getState() = state and
+      viableReturnPosOutEx(call, pos, out) and
+      sc1 = TRevSummaryCtx1Some(pos) and
+      sc2 = TRevSummaryCtx2Some(state) and
+      sc3 = TRevSummaryCtx3Some(ap) and
+      ap = mid.getAp() and
+      config = mid.getConfiguration()
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathFlowsThrough(
+    ArgumentPosition apos, FlowState state, TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2,
+    TRevSummaryCtx3Some sc3, RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(PartialPathNodeRev mid, ParamNodeEx p, ParameterPosition ppos |
+      mid.getNodeEx() = p and
+      mid.getState() = state and
+      p.getPosition() = ppos and
+      sc1 = mid.getSummaryCtx1() and
+      sc2 = mid.getSummaryCtx2() and
+      sc3 = mid.getSummaryCtx3() and
+      ap = mid.getAp() and
+      config = mid.getConfiguration() and
+      parameterMatch(ppos, apos)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable0(
+    DataFlowCall call, PartialPathNodeRev mid, ArgumentPosition pos, FlowState state,
+    RevPartialAccessPath ap, Configuration config
+  ) {
+    exists(TRevSummaryCtx1Some sc1, TRevSummaryCtx2Some sc2, TRevSummaryCtx3Some sc3 |
+      revPartialPathIntoReturn(mid, _, _, sc1, sc2, sc3, call, _, config) and
+      revPartialPathFlowsThrough(pos, state, sc1, sc2, sc3, ap, config)
+    )
+  }
+
+  pragma[nomagic]
+  private predicate revPartialPathThroughCallable(
+    PartialPathNodeRev mid, ArgNodeEx node, FlowState state, RevPartialAccessPath ap,
+    Configuration config
+  ) {
+    exists(DataFlowCall call, ArgumentPosition pos |
+      revPartialPathThroughCallable0(call, mid, pos, state, ap, config) and
+      node.asNode().(ArgNode).argumentOf(call, pos)
+    )
+  }
+}
+
+import FlowExploration
+
+private predicate partialFlow(
+  PartialPathNode source, PartialPathNode node, Configuration configuration
+) {
+  source.getConfiguration() = configuration and
+  source.isFwdSource() and
+  node = source.getASuccessor+()
+}
+
+private predicate revPartialFlow(
+  PartialPathNode node, PartialPathNode sink, Configuration configuration
+) {
+  sink.getConfiguration() = configuration and
+  sink.isRevSink() and
+  node.getASuccessor+() = sink
+}
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll
index acca30eb219..34d737e8c97 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll
@@ -203,6 +203,12 @@ private class Argument extends CfgNodes::ExprCfgNode {
   }
 }
 
+/** Holds if `n` is not a constant expression. */
+predicate isNonConstantExpr(CfgNodes::ExprCfgNode n) {
+  not exists(n.getConstantValue()) and
+  not n.getExpr() instanceof ConstantAccess
+}
+
 /** A collection of cached types and predicates to be evaluated in the same stage. */
 cached
 private module Cached {
@@ -232,8 +238,12 @@ private module Cached {
       isParameterNode(_, c, any(ParameterPosition p | p.isKeyword(_)))
     } or
     TExprPostUpdateNode(CfgNodes::ExprCfgNode n) {
-      n instanceof Argument or
-      n = any(CfgNodes::ExprNodes::InstanceVariableAccessCfgNode v).getReceiver()
+      // filter out nodes that clearly don't need post-update nodes
+      isNonConstantExpr(n) and
+      (
+        n instanceof Argument or
+        n = any(CfgNodes::ExprNodes::InstanceVariableAccessCfgNode v).getReceiver()
+      )
     } or
     TSummaryNode(
       FlowSummaryImpl::Public::SummarizedCallable c,
@@ -438,6 +448,9 @@ class SsaDefinitionNode extends NodeImpl, TSsaDefinitionNode {
   /** Gets the underlying SSA definition. */
   Ssa::Definition getDefinition() { result = def }
 
+  /** Gets the underlying variable. */
+  Variable getVariable() { result = def.getSourceVariable() }
+
   override CfgScope getCfgScope() { result = def.getBasicBlock().getScope() }
 
   override Location getLocationImpl() { result = def.getLocation() }
@@ -539,6 +552,9 @@ private module ParameterNodes {
 
     final MethodBase getMethod() { result = method }
 
+    /** Gets the underlying `self` variable. */
+    final SelfVariable getSelfVariable() { result.getDeclaringScope() = method }
+
     override Parameter getParameter() { none() }
 
     override predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) {
@@ -613,7 +629,7 @@ private module ParameterNodes {
    * where direct keyword matching is possible, since we construct a synthesized hash
    * splat argument (`SynthHashSplatArgumentNode`) at the call site, which means that
    * `taint(1)` will flow into `p1` both via normal keyword matching and via the synthesized
-   * nodes (and similarly for `p2`). However, this redunancy is OK since
+   * nodes (and similarly for `p2`). However, this redundancy is OK since
    *  (a) it means that type-tracking through keyword arguments also works in most cases,
    *  (b) read/store steps can be avoided when direct keyword matching is possible, and
    *      hence access path limits are not a concern, and
@@ -1036,7 +1052,8 @@ predicate readStep(Node node1, ContentSet c, Node node2) {
   // (instance variable assignment or setter method call).
   node2.asExpr() =
     any(CfgNodes::ExprNodes::MethodCallCfgNode call |
-      node1.asExpr() = call.getReceiver() and
+      node1.asExpr() =
+        any(CfgNodes::ExprCfgNode e | e = call.getReceiver() and isNonConstantExpr(e)) and
       call.getNumberOfArguments() = 0 and
       c.isSingleton(any(Content::FieldContent ct |
           ct.getName() = "@" + call.getExpr().getMethodName()
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll
index e35a85de8e2..5c99237193f 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll
@@ -87,6 +87,41 @@ class CallNode extends LocalSourceNode, ExprNode {
 
   /** Gets the block of this call. */
   Node getBlock() { result.asExpr() = node.getBlock() }
+
+  /**
+   * Gets the data-flow node corresponding to the named argument of the call
+   * corresponding to this data-flow node, also including values passed with (pre Ruby
+   * 2.0) hash arguments.
+   *
+   * Such hash arguments are tracked back to their source location within functions, but
+   * no inter-procedural analysis occurs.
+   *
+   * This means all 3 variants below will be handled by this predicate:
+   *
+   * ```ruby
+   * foo(..., some_option: 42)
+   * foo(..., { some_option: 42 })
+   * options = { some_option: 42 }
+   * foo(..., options)
+   * ```
+   */
+  Node getKeywordArgumentIncludeHashArgument(string name) {
+    // to reduce number of computed tuples, I have put bindingset on both this and name,
+    // meaning we only do the local backwards tracking for known calls and known names.
+    // (not because a performance problem was seen, it just seemed right).
+    result = this.getKeywordArgument(name)
+    or
+    exists(CfgNodes::ExprNodes::PairCfgNode pair |
+      pair =
+        this.getArgument(_)
+            .getALocalSource()
+            .asExpr()
+            .(CfgNodes::ExprNodes::HashLiteralCfgNode)
+            .getAKeyValuePair() and
+      pair.getKey().getConstantValue().isStringlikeValue(name) and
+      result.asExpr() = pair.getValue()
+    )
+  }
 }
 
 /**
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll
index e00fc952e1c..d857cdaa359 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll
@@ -226,15 +226,6 @@ module Public {
       none()
     }
 
-    /**
-     * Holds if values stored inside `content` are cleared on objects passed as
-     * arguments at position `pos` to this callable.
-     *
-     * TODO: Remove once all languages support `WithoutContent` tokens.
-     */
-    pragma[nomagic]
-    predicate clearsContent(ParameterPosition pos, ContentSet content) { none() }
-
     /**
      * Holds if the summary is auto generated.
      */
@@ -328,23 +319,6 @@ module Private {
           SummaryComponentStack::singleton(TArgumentSummaryComponent(_))) and
       preservesValue = preservesValue1.booleanAnd(preservesValue2)
     )
-    or
-    exists(ParameterPosition ppos, ContentSet cs |
-      c.clearsContent(ppos, cs) and
-      input = SummaryComponentStack::push(SummaryComponent::withoutContent(cs), output) and
-      output = SummaryComponentStack::argument(ppos) and
-      preservesValue = true
-    )
-  }
-
-  private class MkClearStack extends RequiredSummaryComponentStack {
-    override predicate required(SummaryComponent head, SummaryComponentStack tail) {
-      exists(SummarizedCallable sc, ParameterPosition ppos, ContentSet cs |
-        sc.clearsContent(ppos, cs) and
-        head = SummaryComponent::withoutContent(cs) and
-        tail = SummaryComponentStack::argument(ppos)
-      )
-    }
   }
 
   /**
@@ -945,8 +919,7 @@ module Private {
         AccessPath inSpec, AccessPath outSpec, string kind
       ) {
         summaryElement(this, inSpec, outSpec, kind, true) and
-        not summaryElement(this, _, _, _, false) and
-        not this.clearsContent(_, _)
+        not summaryElement(this, _, _, _, false)
       }
 
       private predicate relevantSummaryElement(AccessPath inSpec, AccessPath outSpec, string kind) {
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImpl.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImpl.qll
index ac0e9f79838..0e8282f49a2 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImpl.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImpl.qll
@@ -1,19 +1,72 @@
-private import SsaImplCommon
-private import SsaImplSpecific as SsaImplSpecific
+private import codeql.ssa.Ssa as SsaImplCommon
 private import codeql.ruby.AST
-private import codeql.ruby.CFG
+private import codeql.ruby.CFG as CFG
 private import codeql.ruby.ast.Variable
-private import CfgNodes::ExprNodes
+private import CFG::CfgNodes::ExprNodes
+
+private module SsaInput implements SsaImplCommon::InputSig {
+  private import codeql.ruby.controlflow.BasicBlocks as BasicBlocks
+
+  class BasicBlock = BasicBlocks::BasicBlock;
+
+  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
+
+  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+  class ExitBasicBlock = BasicBlocks::ExitBasicBlock;
+
+  class SourceVariable = LocalVariable;
+
+  /**
+   * Holds if the statement at index `i` of basic block `bb` contains a write to variable `v`.
+   * `certain` is true if the write definitely occurs.
+   */
+  predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    (
+      exists(Scope scope | scope = v.(SelfVariable).getDeclaringScope() |
+        // We consider the `self` variable to have a single write at the entry to a method block...
+        scope = bb.(BasicBlocks::EntryBasicBlock).getScope() and
+        i = 0
+        or
+        // ...or a class or module block.
+        bb.getNode(i).getNode() = scope.(ModuleBase).getAControlFlowEntryNode()
+      )
+      or
+      uninitializedWrite(bb, i, v)
+      or
+      capturedEntryWrite(bb, i, v)
+      or
+      variableWriteActual(bb, i, v, _)
+    ) and
+    certain = true
+    or
+    capturedCallWrite(_, bb, i, v) and
+    certain = false
+  }
+
+  predicate variableRead(BasicBlock bb, int i, LocalVariable v, boolean certain) {
+    variableReadActual(bb, i, v) and
+    certain = true
+    or
+    capturedCallRead(_, bb, i, v) and
+    certain = false
+    or
+    capturedExitRead(bb, i, v) and
+    certain = false
+  }
+}
+
+import SsaImplCommon::Make<SsaInput>
 
 /** Holds if `v` is uninitialized at index `i` in entry block `bb`. */
-predicate uninitializedWrite(EntryBasicBlock bb, int i, LocalVariable v) {
+predicate uninitializedWrite(CFG::EntryBasicBlock bb, int i, LocalVariable v) {
   v.getDeclaringScope() = bb.getScope() and
   i = -1
 }
 
 /** Holds if `bb` contains a caputured read of variable `v`. */
 pragma[noinline]
-private predicate hasCapturedVariableRead(BasicBlock bb, LocalVariable v) {
+private predicate hasCapturedVariableRead(CFG::BasicBlock bb, LocalVariable v) {
   exists(LocalVariableReadAccess read |
     read = bb.getANode().getNode() and
     read.isCapturedAccess() and
@@ -23,7 +76,7 @@ private predicate hasCapturedVariableRead(BasicBlock bb, LocalVariable v) {
 
 /** Holds if `bb` contains a caputured write to variable `v`. */
 pragma[noinline]
-private predicate writesCapturedVariable(BasicBlock bb, LocalVariable v) {
+private predicate writesCapturedVariable(CFG::BasicBlock bb, LocalVariable v) {
   exists(LocalVariableWriteAccess write |
     write = bb.getANode().getNode() and
     write.isCapturedAccess() and
@@ -35,7 +88,7 @@ private predicate writesCapturedVariable(BasicBlock bb, LocalVariable v) {
  * Holds if a pseudo read of captured variable `v` should be inserted
  * at index `i` in exit block `bb`.
  */
-private predicate capturedExitRead(AnnotatedExitBasicBlock bb, int i, LocalVariable v) {
+private predicate capturedExitRead(CFG::AnnotatedExitBasicBlock bb, int i, LocalVariable v) {
   bb.isNormal() and
   writesCapturedVariable(bb.getAPredecessor*(), v) and
   i = bb.length()
@@ -46,7 +99,7 @@ private predicate capturedExitRead(AnnotatedExitBasicBlock bb, int i, LocalVaria
  * or inside a (transitively) nested scope of `scope`.
  */
 pragma[noinline]
-private predicate hasCapturedRead(Variable v, CfgScope scope) {
+private predicate hasCapturedRead(Variable v, CFG::CfgScope scope) {
   any(LocalVariableReadAccess read |
     read.getVariable() = v and scope = read.getCfgScope().getOuterCfgScope*()
   ).isCapturedAccess()
@@ -57,13 +110,15 @@ private predicate hasCapturedRead(Variable v, CfgScope scope) {
  * outer scope of `scope`.
  */
 pragma[noinline]
-private predicate variableWriteInOuterScope(BasicBlock bb, LocalVariable v, CfgScope scope) {
-  SsaImplSpecific::variableWrite(bb, _, v, _) and
+private predicate variableWriteInOuterScope(CFG::BasicBlock bb, LocalVariable v, CFG::CfgScope scope) {
+  SsaInput::variableWrite(bb, _, v, _) and
   scope.getOuterCfgScope() = bb.getScope()
 }
 
 pragma[noinline]
-private predicate hasVariableWriteWithCapturedRead(BasicBlock bb, LocalVariable v, CfgScope scope) {
+private predicate hasVariableWriteWithCapturedRead(
+  CFG::BasicBlock bb, LocalVariable v, CFG::CfgScope scope
+) {
   hasCapturedRead(v, scope) and
   variableWriteInOuterScope(bb, v, scope)
 }
@@ -72,10 +127,8 @@ private predicate hasVariableWriteWithCapturedRead(BasicBlock bb, LocalVariable
  * Holds if the call `call` at index `i` in basic block `bb` may reach
  * a callable that reads captured variable `v`.
  */
-private predicate capturedCallRead(
-  CfgNodes::ExprNodes::CallCfgNode call, BasicBlock bb, int i, LocalVariable v
-) {
-  exists(CfgScope scope |
+private predicate capturedCallRead(CallCfgNode call, CFG::BasicBlock bb, int i, LocalVariable v) {
+  exists(CFG::CfgScope scope |
     hasVariableWriteWithCapturedRead(bb.getAPredecessor*(), v, scope) and
     call = bb.getNode(i)
   |
@@ -88,30 +141,19 @@ private predicate capturedCallRead(
 }
 
 /** Holds if `v` is read at index `i` in basic block `bb`. */
-private predicate variableReadActual(BasicBlock bb, int i, LocalVariable v) {
+private predicate variableReadActual(CFG::BasicBlock bb, int i, LocalVariable v) {
   exists(VariableReadAccess read |
     read.getVariable() = v and
     read = bb.getNode(i).getNode()
   )
 }
 
-predicate variableRead(BasicBlock bb, int i, LocalVariable v, boolean certain) {
-  variableReadActual(bb, i, v) and
-  certain = true
-  or
-  capturedCallRead(_, bb, i, v) and
-  certain = false
-  or
-  capturedExitRead(bb, i, v) and
-  certain = false
-}
-
 /**
  * Holds if captured variable `v` is written directly inside `scope`,
  * or inside a (transitively) nested scope of `scope`.
  */
 pragma[noinline]
-private predicate hasCapturedWrite(Variable v, CfgScope scope) {
+private predicate hasCapturedWrite(Variable v, CFG::CfgScope scope) {
   any(LocalVariableWriteAccess write |
     write.getVariable() = v and scope = write.getCfgScope().getOuterCfgScope*()
   ).isCapturedAccess()
@@ -122,13 +164,17 @@ private predicate hasCapturedWrite(Variable v, CfgScope scope) {
  * outer scope of `scope`.
  */
 pragma[noinline]
-private predicate variableReadActualInOuterScope(BasicBlock bb, LocalVariable v, CfgScope scope) {
+private predicate variableReadActualInOuterScope(
+  CFG::BasicBlock bb, LocalVariable v, CFG::CfgScope scope
+) {
   variableReadActual(bb, _, v) and
   bb.getScope() = scope.getOuterCfgScope()
 }
 
 pragma[noinline]
-private predicate hasVariableReadWithCapturedWrite(BasicBlock bb, LocalVariable v, CfgScope scope) {
+private predicate hasVariableReadWithCapturedWrite(
+  CFG::BasicBlock bb, LocalVariable v, CFG::CfgScope scope
+) {
   hasCapturedWrite(v, scope) and
   variableReadActualInOuterScope(bb, v, scope)
 }
@@ -140,7 +186,7 @@ private module Cached {
    * `i` in entry block `bb`.
    */
   cached
-  predicate capturedEntryWrite(EntryBasicBlock bb, int i, LocalVariable v) {
+  predicate capturedEntryWrite(CFG::EntryBasicBlock bb, int i, LocalVariable v) {
     hasCapturedVariableRead(bb.getASuccessor*(), v) and
     i = -1
   }
@@ -150,10 +196,8 @@ private module Cached {
    * that writes captured variable `v`.
    */
   cached
-  predicate capturedCallWrite(
-    CfgNodes::ExprNodes::CallCfgNode call, BasicBlock bb, int i, LocalVariable v
-  ) {
-    exists(CfgScope scope |
+  predicate capturedCallWrite(CallCfgNode call, CFG::BasicBlock bb, int i, LocalVariable v) {
+    exists(CFG::CfgScope scope |
       hasVariableReadWithCapturedWrite(bb.getASuccessor*(), v, scope) and
       call = bb.getNode(i)
     |
@@ -170,7 +214,9 @@ private module Cached {
    * AST write access is `write`.
    */
   cached
-  predicate variableWriteActual(BasicBlock bb, int i, LocalVariable v, VariableWriteAccess write) {
+  predicate variableWriteActual(
+    CFG::BasicBlock bb, int i, LocalVariable v, VariableWriteAccess write
+  ) {
     exists(AstNode n |
       write.getVariable() = v and
       n = bb.getNode(i).getNode()
@@ -184,7 +230,7 @@ private module Cached {
 
   cached
   VariableReadAccessCfgNode getARead(Definition def) {
-    exists(LocalVariable v, BasicBlock bb, int i |
+    exists(LocalVariable v, CFG::BasicBlock bb, int i |
       ssaDefReachesRead(v, def, bb, i) and
       variableReadActual(bb, i, v) and
       result = bb.getNode(i)
@@ -193,9 +239,9 @@ private module Cached {
 
   pragma[noinline]
   private predicate defReachesCallReadInOuterScope(
-    Definition def, CfgNodes::ExprNodes::CallCfgNode call, LocalVariable v, CfgScope scope
+    Definition def, CallCfgNode call, LocalVariable v, CFG::CfgScope scope
   ) {
-    exists(BasicBlock bb, int i |
+    exists(CFG::BasicBlock bb, int i |
       ssaDefReachesRead(v, def, bb, i) and
       capturedCallRead(call, bb, i, v) and
       scope.getOuterCfgScope() = bb.getScope()
@@ -203,8 +249,8 @@ private module Cached {
   }
 
   pragma[noinline]
-  private predicate hasCapturedEntryWrite(Definition entry, LocalVariable v, CfgScope scope) {
-    exists(BasicBlock bb, int i |
+  private predicate hasCapturedEntryWrite(Definition entry, LocalVariable v, CFG::CfgScope scope) {
+    exists(CFG::BasicBlock bb, int i |
       capturedEntryWrite(bb, i, v) and
       entry.definesAt(v, bb, i) and
       bb.getScope().getOuterCfgScope*() = scope
@@ -221,8 +267,8 @@ private module Cached {
    * ```
    */
   cached
-  predicate captureFlowIn(CfgNodes::ExprNodes::CallCfgNode call, Definition def, Definition entry) {
-    exists(LocalVariable v, CfgScope scope |
+  predicate captureFlowIn(CallCfgNode call, Definition def, Definition entry) {
+    exists(LocalVariable v, CFG::CfgScope scope |
       defReachesCallReadInOuterScope(def, call, v, scope) and
       hasCapturedEntryWrite(entry, v, scope)
     |
@@ -237,8 +283,10 @@ private module Cached {
   private import codeql.ruby.dataflow.SSA
 
   pragma[noinline]
-  private predicate defReachesExitReadInInnerScope(Definition def, LocalVariable v, CfgScope scope) {
-    exists(BasicBlock bb, int i |
+  private predicate defReachesExitReadInInnerScope(
+    Definition def, LocalVariable v, CFG::CfgScope scope
+  ) {
+    exists(CFG::BasicBlock bb, int i |
       ssaDefReachesRead(v, def, bb, i) and
       capturedExitRead(bb, i, v) and
       scope = bb.getScope().getOuterCfgScope*()
@@ -247,9 +295,9 @@ private module Cached {
 
   pragma[noinline]
   private predicate hasCapturedExitRead(
-    Definition exit, CfgNodes::ExprNodes::CallCfgNode call, LocalVariable v, CfgScope scope
+    Definition exit, CallCfgNode call, LocalVariable v, CFG::CfgScope scope
   ) {
-    exists(BasicBlock bb, int i |
+    exists(CFG::BasicBlock bb, int i |
       capturedCallWrite(call, bb, i, v) and
       exit.definesAt(v, bb, i) and
       bb.getScope() = scope.getOuterCfgScope()
@@ -267,8 +315,8 @@ private module Cached {
    * ```
    */
   cached
-  predicate captureFlowOut(CfgNodes::ExprNodes::CallCfgNode call, Definition def, Definition exit) {
-    exists(LocalVariable v, CfgScope scope |
+  predicate captureFlowOut(CallCfgNode call, Definition def, Definition exit) {
+    exists(LocalVariable v, CFG::CfgScope scope |
       defReachesExitReadInInnerScope(def, v, scope) and
       hasCapturedExitRead(exit, call, v, _)
     |
@@ -281,7 +329,7 @@ private module Cached {
   }
 
   cached
-  Definition phiHasInputFromBlock(PhiNode phi, BasicBlock bb) {
+  Definition phiHasInputFromBlock(PhiNode phi, CFG::BasicBlock bb) {
     phiHasInputFromBlock(phi, result, bb)
   }
 
@@ -291,7 +339,7 @@ private module Cached {
    */
   cached
   predicate firstRead(Definition def, VariableReadAccessCfgNode read) {
-    exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
+    exists(CFG::BasicBlock bb1, int i1, CFG::BasicBlock bb2, int i2 |
       def.definesAt(_, bb1, i1) and
       adjacentDefNoUncertainReads(def, bb1, i1, bb2, i2) and
       read = bb2.getNode(i2)
@@ -307,7 +355,7 @@ private module Cached {
   predicate adjacentReadPair(
     Definition def, VariableReadAccessCfgNode read1, VariableReadAccessCfgNode read2
   ) {
-    exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
+    exists(CFG::BasicBlock bb1, int i1, CFG::BasicBlock bb2, int i2 |
       read1 = bb1.getNode(i1) and
       variableReadActual(bb1, i1, _) and
       adjacentDefNoUncertainReads(def, bb1, i1, bb2, i2) and
@@ -322,7 +370,7 @@ private module Cached {
    */
   cached
   predicate lastRead(Definition def, VariableReadAccessCfgNode read) {
-    exists(BasicBlock bb, int i |
+    exists(CFG::BasicBlock bb, int i |
       lastRefNoUncertainReads(def, bb, i) and
       variableReadActual(bb, i, _) and
       read = bb.getNode(i)
@@ -337,7 +385,7 @@ private module Cached {
    * The reference is either a read of `def` or `def` itself.
    */
   cached
-  predicate lastRefBeforeRedef(Definition def, BasicBlock bb, int i, Definition next) {
+  predicate lastRefBeforeRedef(Definition def, CFG::BasicBlock bb, int i, Definition next) {
     lastRefRedefNoUncertainReads(def, bb, i, next)
   }
 
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll
deleted file mode 100644
index 659940def50..00000000000
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll
+++ /dev/null
@@ -1,795 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
-    maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaActualRead() or
-    SsaPhiRead() or
-    SsaDef()
-
-  class SsaRead = SsaActualRead or SsaPhiRead;
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaActualRead() and
-      result = "SsaActualRead"
-      or
-      this = SsaPhiRead() and
-      result = "SsaPhiRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this instanceof SsaRead and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if `bb` is in the dominance frontier of a block containing a
-   * read of `v`.
-   */
-  pragma[nomagic]
-  private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
-    exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
-      lastRefIsRead(readbb, v)
-      or
-      phiRead(readbb, v)
-    )
-  }
-
-  /**
-   * Holds if a phi-read node should be inserted for variable `v` at the beginning
-   * of basic block `bb`.
-   *
-   * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
-   * instead of writes, and only if the dominance-frontier block does not already
-   * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
-   * an internal implementation detail that is not exposed.
-   *
-   * The motivation for adding phi-reads is to improve performance of the use-use
-   * calculation in cases where there is a large number of reads that can reach the
-   * same join-point, and from there reach a large number of basic blocks. Example:
-   *
-   * ```cs
-   * if (a)
-   *   use(x);
-   * else if (b)
-   *   use(x);
-   * else if (c)
-   *   use(x);
-   * else if (d)
-   *   use(x);
-   * // many more ifs ...
-   *
-   * // phi-read for `x` inserted here
-   *
-   * // program not mentioning `x`, with large basic block graph
-   *
-   * use(x);
-   * ```
-   *
-   * Without phi-reads, the analysis has to replicate reachability for each of
-   * the guarded uses of `x`. However, with phi-reads, the analysis will limit
-   * each conditional use of `x` to reach the basic block containing the phi-read
-   * node for `x`, and only that basic block will have to compute reachability
-   * through the remainder of the large program.
-   *
-   * Like normal reads, each phi-read node `phi-read` can be reached from exactly
-   * one SSA definition (without passing through another definition): Assume, for
-   * the sake of contradiction, that there are two reaching definitions `def1` and
-   * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
-   * dominating definition will prevent the other from reaching `phi-read`. So, at
-   * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
-   * Then `def1` must go through one of its dominance-frontier blocks in order to
-   * reach `phi-read`. However, such a block will always start with a (normal) phi
-   * node, which contradicts reachability.
-   *
-   * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
-   * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
-   * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
-   * which contradicts reachability.
-   */
-  pragma[nomagic]
-  predicate phiRead(BasicBlock bb, SourceVariable v) {
-    inReadDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v) and
-    // only if there are no other references to `v` inside `bb`
-    not ref(bb, _, v, _) and
-    not exists(Definition def | def.definesAt(v, bb, _))
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  pragma[nomagic]
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaActualRead()
-    or
-    phiRead(bb, v) and
-    i = -1 and
-    k = SsaPhiRead()
-    or
-    any(Definition def).definesAt(v, bb, i) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, any(SsaRead k))
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, any(SsaRead k))
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
-    exists(ssaDefRank(def, v, bb, _, k))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable(), _)
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
-   * predecessor of `bb2`, and the underlying variable for `def` is neither read
-   * nor written in any block on the path between `bb1` and `bb2`.
-   *
-   * Phi reads are considered as normal reads for this predicate.
-   */
-  pragma[nomagic]
-  private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReachesInclPhiRead(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(def, bb1, bb2) and
-    defOccursInBlock(def, bb2, v, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
-    ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExclPhiRead(def, mid, bb2) and
-      phiReadStep(def, _, bb1, mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * the underlying variable `v` of `def` is accessed in basic block `bb2`
-   * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
-   * `v` is neither read nor written in any block on the path between `bb1`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesExclPhiRead(def, bb1, bb2) and
-    not defOccursInBlock(def, bb1, _, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb` (either a read or a write),
-   * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
-   * and `v` is neither read nor written in any block on the path between `bb`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReachesExit(Definition def, BasicBlock bb) {
-    exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExit(def, mid) and
-      phiReadStep(def, _, bb, mid)
-    )
-  }
-}
-
-predicate phiReadExposedForTesting = phiRead/2;
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last |
-    last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  ssaRef(bb, i, v, any(SsaRead k)) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  // Can reach another definition
-  lastRefRedef(def, bb, i, _)
-  or
-  exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    varBlockReachesExit(def, bb)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-
-  query predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
-      ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      (bb != bbDef or i < iDef)
-      or
-      ssaDefReachesRead(v, def, bb, i) and
-      not ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
-    )
-  }
-}
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplSpecific.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplSpecific.qll
deleted file mode 100644
index 0e8af2a3f35..00000000000
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplSpecific.qll
+++ /dev/null
@@ -1,45 +0,0 @@
-/** Provides the Ruby specific parameters for `SsaImplCommon.qll`. */
-
-private import SsaImpl as SsaImpl
-private import codeql.ruby.AST
-private import codeql.ruby.controlflow.BasicBlocks as BasicBlocks
-private import codeql.ruby.controlflow.ControlFlowGraph
-
-class BasicBlock = BasicBlocks::BasicBlock;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock = BasicBlocks::ExitBasicBlock;
-
-class SourceVariable = LocalVariable;
-
-/**
- * Holds if the statement at index `i` of basic block `bb` contains a write to variable `v`.
- * `certain` is true if the write definitely occurs.
- */
-predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  (
-    exists(Scope scope | scope = v.(SelfVariable).getDeclaringScope() |
-      // We consider the `self` variable to have a single write at the entry to a method block...
-      scope = bb.(BasicBlocks::EntryBasicBlock).getScope() and
-      i = 0
-      or
-      // ...or a class or module block.
-      bb.getNode(i).getNode() = scope.(ModuleBase).getAControlFlowEntryNode()
-    )
-    or
-    SsaImpl::uninitializedWrite(bb, i, v)
-    or
-    SsaImpl::capturedEntryWrite(bb, i, v)
-    or
-    SsaImpl::variableWriteActual(bb, i, v, _)
-  ) and
-  certain = true
-  or
-  SsaImpl::capturedCallWrite(_, bb, i, v) and
-  certain = false
-}
-
-predicate variableRead = SsaImpl::variableRead/4;
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/tainttrackingforlibraries/TaintTrackingImpl.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/tainttrackingforlibraries/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/tainttrackingforlibraries/TaintTrackingImpl.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/tainttrackingforlibraries/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
index d607612364f..bda04932cb1 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
@@ -46,7 +46,7 @@ class ActionControllerControllerClass extends ClassDeclaration {
  * A public instance method defined within an `ActionController` controller class.
  * This may be the target of a route handler, if such a route is defined.
  */
-class ActionControllerActionMethod extends Method, HTTP::Server::RequestHandler::Range {
+class ActionControllerActionMethod extends Method, Http::Server::RequestHandler::Range {
   private ActionControllerControllerClass controllerClass;
 
   ActionControllerActionMethod() { this = controllerClass.getAMethod() and not this.isPrivate() }
@@ -126,7 +126,7 @@ abstract class ParamsCall extends MethodCall {
  * A `RemoteFlowSource::Range` to represent accessing the
  * ActionController parameters available via the `params` method.
  */
-class ParamsSource extends HTTP::Server::RequestInputAccess::Range {
+class ParamsSource extends Http::Server::RequestInputAccess::Range {
   ParamsSource() { this.asExpr().getExpr() instanceof ParamsCall }
 
   override string getSourceType() { result = "ActionController::Metal#params" }
@@ -143,7 +143,7 @@ abstract class CookiesCall extends MethodCall {
  * A `RemoteFlowSource::Range` to represent accessing the
  * ActionController parameters available via the `cookies` method.
  */
-class CookiesSource extends HTTP::Server::RequestInputAccess::Range {
+class CookiesSource extends Http::Server::RequestInputAccess::Range {
   CookiesSource() { this.asExpr().getExpr() instanceof CookiesCall }
 
   override string getSourceType() { result = "ActionController::Metal#cookies" }
@@ -211,7 +211,7 @@ class RedirectToCall extends ActionControllerContextCall {
 /**
  * A call to the `redirect_to` method, as an `HttpRedirectResponse`.
  */
-class ActionControllerRedirectResponse extends HTTP::Server::HttpRedirectResponse::Range {
+class ActionControllerRedirectResponse extends Http::Server::HttpRedirectResponse::Range {
   RedirectToCall redirectToCall;
 
   ActionControllerRedirectResponse() { this.asExpr().getExpr() = redirectToCall }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActionView.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActionView.qll
index fade252ce84..ef5b0a0204e 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/ActionView.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActionView.qll
@@ -3,6 +3,7 @@
  */
 
 private import codeql.ruby.AST
+private import codeql.ruby.ApiGraphs
 private import codeql.ruby.Concepts
 private import codeql.ruby.controlflow.CfgNodes
 private import codeql.ruby.DataFlow
@@ -127,7 +128,7 @@ abstract class RenderCall extends MethodCall {
  * A call to `render`, `render_to_body` or `render_to_string`, seen as an
  * `HttpResponse`.
  */
-private class RenderCallAsHttpResponse extends DataFlow::CallNode, HTTP::Server::HttpResponse::Range {
+private class RenderCallAsHttpResponse extends DataFlow::CallNode, Http::Server::HttpResponse::Range {
   RenderCallAsHttpResponse() {
     this.asExpr().getExpr() instanceof RenderCall or
     this.asExpr().getExpr() instanceof RenderToCall
@@ -204,4 +205,15 @@ class LinkToCall extends ActionViewContextCall {
     not exists(this.getBlock()) and result = this.getArgument(1)
   }
 }
+
+/**
+ * An instantiation of `ActionView::FileSystemResolver`, considered as a `FileSystemAccess`.
+ */
+class FileSystemResolverAccess extends DataFlow::CallNode, FileSystemAccess::Range {
+  FileSystemResolverAccess() {
+    this = API::getTopLevelMember("ActionView").getMember("FileSystemResolver").getAnInstantiation()
+  }
+
+  override DataFlow::Node getAPathArgument() { result = this.getArgument(0) }
+}
 // TODO: model flow in/out of template files properly,
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActiveResource.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActiveResource.qll
new file mode 100644
index 00000000000..b212f420fc6
--- /dev/null
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActiveResource.qll
@@ -0,0 +1,298 @@
+/**
+ * Provides modeling for the `ActiveResource` library.
+ * Version: 6.0.0.
+ */
+
+private import ruby
+private import codeql.ruby.Concepts
+private import codeql.ruby.controlflow.CfgNodes
+private import codeql.ruby.ast.internal.Module
+private import codeql.ruby.DataFlow
+private import codeql.ruby.ApiGraphs
+
+/**
+ * Provides modeling for the `ActiveResource` library.
+ * Version: 6.0.0.
+ */
+module ActiveResource {
+  /**
+   * An ActiveResource model class. This is any (transitive) subclass of ActiveResource.
+   */
+  private API::Node modelApiNode() {
+    result = API::getTopLevelMember("ActiveResource").getMember("Base").getASubclass+()
+  }
+
+  /**
+   * An ActiveResource class.
+   *
+   * ```rb
+   * class Person < ActiveResource::Base
+   * end
+   * ```
+   */
+  class ModelClass extends ClassDeclaration {
+    API::Node model;
+
+    ModelClass() {
+      model = modelApiNode() and
+      this.getSuperclassExpr() = model.getAValueReachableFromSource().asExpr().getExpr()
+    }
+
+    /** Gets the API node for this model */
+    API::Node getModelApiNode() { result = model }
+
+    /** Gets a call to `site=`, which sets the base URL for this model. */
+    SiteAssignCall getASiteAssignment() { result.getModelClass() = this }
+
+    /** Holds if `c` sets a base URL which does not use HTTPS. */
+    predicate disablesCertificateValidation(SiteAssignCall c) {
+      c = this.getASiteAssignment() and
+      c.disablesCertificateValidation()
+    }
+  }
+
+  /**
+   * A call to a class method on an ActiveResource model class.
+   *
+   * ```rb
+   * class Person < ActiveResource::Base
+   * end
+   *
+   * Person.find(1)
+   * ```
+   */
+  class ModelClassMethodCall extends DataFlow::CallNode {
+    API::Node model;
+
+    ModelClassMethodCall() {
+      model = modelApiNode() and
+      this = classMethodCall(model, _)
+    }
+
+    /** Gets the model class for this call. */
+    ModelClass getModelClass() { result.getModelApiNode() = model }
+  }
+
+  /**
+   * A call to `site=` on an ActiveResource model class.
+   * This sets the base URL for all HTTP requests made by this class.
+   */
+  private class SiteAssignCall extends DataFlow::CallNode {
+    API::Node model;
+
+    SiteAssignCall() { model = modelApiNode() and this = classMethodCall(model, "site=") }
+
+    /**
+     * Gets a node that contributes to the URLs used for HTTP requests by the parent
+     * class.
+     */
+    DataFlow::Node getAUrlPart() { result = this.getArgument(0) }
+
+    /** Gets the model class for this call. */
+    ModelClass getModelClass() { result.getModelApiNode() = model }
+
+    /** Holds if this site value specifies HTTP rather than HTTPS. */
+    predicate disablesCertificateValidation() {
+      this.getAUrlPart()
+          .asExpr()
+          .(ExprNodes::AssignExprCfgNode)
+          .getRhs()
+          .getConstantValue()
+          .getString()
+          .regexpMatch("^http[^s].+")
+    }
+  }
+
+  /**
+   * A call to the `find` class method, which returns an ActiveResource model
+   * object.
+   *
+   * ```rb
+   * alice = Person.find(1)
+   * ```
+   */
+  class FindCall extends ModelClassMethodCall {
+    FindCall() { this.getMethodName() = "find" }
+  }
+
+  /**
+   * A call to the `create(!)` class method, which returns an ActiveResource model
+   * object.
+   *
+   * ```rb
+   * alice = Person.create(name: "alice")
+   * ```
+   */
+  class CreateCall extends ModelClassMethodCall {
+    CreateCall() { this.getMethodName() = ["create", "create!"] }
+  }
+
+  /**
+   * A call to a method that sends a custom HTTP request outside of the
+   * ActiveResource conventions. This typically returns an ActiveResource model
+   * object. It may return a collection, but we don't currently model that.
+   *
+   * ```rb
+   * alice = Person.get(:active)
+   * ```
+   */
+  class CustomHttpCall extends ModelClassMethodCall {
+    CustomHttpCall() { this.getMethodName() = ["get", "post", "put", "patch", "delete"] }
+  }
+
+  /**
+   * An ActiveResource model object.
+   */
+  class ModelInstance extends DataFlow::Node {
+    ModelClass cls;
+
+    ModelInstance() {
+      exists(API::Node model | model = modelApiNode() |
+        this = model.getInstance().getAValueReachableFromSource() and
+        cls.getModelApiNode() = model
+      )
+      or
+      exists(FindCall call | call.flowsTo(this) | cls = call.getModelClass())
+      or
+      exists(CreateCall call | call.flowsTo(this) | cls = call.getModelClass())
+      or
+      exists(CustomHttpCall call | call.flowsTo(this) | cls = call.getModelClass())
+      or
+      exists(CollectionCall call |
+        call.getMethodName() = ["first", "last"] and
+        call.flowsTo(this)
+      |
+        cls = call.getCollection().getModelClass()
+      )
+    }
+
+    /** Gets the model class for this instance. */
+    ModelClass getModelClass() { result = cls }
+  }
+
+  /**
+   * A call to a method on an ActiveResource model object.
+   */
+  class ModelInstanceMethodCall extends DataFlow::CallNode {
+    ModelInstance i;
+
+    ModelInstanceMethodCall() { this.getReceiver() = i }
+
+    /** Gets the model instance for this call. */
+    ModelInstance getInstance() { result = i }
+
+    /** Gets the model class for this call. */
+    ModelClass getModelClass() { result = i.getModelClass() }
+  }
+
+  /**
+   * A collection of ActiveResource model objects.
+   */
+  class Collection extends DataFlow::Node {
+    ModelClassMethodCall classMethodCall;
+
+    Collection() {
+      classMethodCall.flowsTo(this) and
+      (
+        classMethodCall.getMethodName() = "all"
+        or
+        classMethodCall.getMethodName() = "find" and
+        classMethodCall.getArgument(0).asExpr().getConstantValue().isStringlikeValue("all")
+      )
+    }
+
+    /** Gets the model class for this collection. */
+    ModelClass getModelClass() { result = classMethodCall.getModelClass() }
+  }
+
+  /**
+   * A method call on a collection.
+   */
+  class CollectionCall extends DataFlow::CallNode {
+    CollectionCall() { this.getReceiver() instanceof Collection }
+
+    /** Gets the collection for this call. */
+    Collection getCollection() { result = this.getReceiver() }
+  }
+
+  private class ModelClassMethodCallAsHttpRequest extends Http::Client::Request::Range,
+    ModelClassMethodCall {
+    ModelClass cls;
+
+    ModelClassMethodCallAsHttpRequest() {
+      this.getModelClass() = cls and
+      this.getMethodName() = ["all", "build", "create", "create!", "find", "first", "last"]
+    }
+
+    override string getFramework() { result = "ActiveResource" }
+
+    override predicate disablesCertificateValidation(
+      DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+    ) {
+      cls.disablesCertificateValidation(disablingNode) and
+      // TODO: highlight real argument origin
+      argumentOrigin = disablingNode
+    }
+
+    override DataFlow::Node getAUrlPart() { result = cls.getASiteAssignment().getAUrlPart() }
+
+    override DataFlow::Node getResponseBody() { result = this }
+  }
+
+  private class ModelInstanceMethodCallAsHttpRequest extends Http::Client::Request::Range,
+    ModelInstanceMethodCall {
+    ModelClass cls;
+
+    ModelInstanceMethodCallAsHttpRequest() {
+      this.getModelClass() = cls and
+      this.getMethodName() =
+        [
+          "exists?", "reload", "save", "save!", "destroy", "delete", "get", "patch", "post", "put",
+          "update_attribute", "update_attributes"
+        ]
+    }
+
+    override string getFramework() { result = "ActiveResource" }
+
+    override predicate disablesCertificateValidation(
+      DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+    ) {
+      cls.disablesCertificateValidation(disablingNode) and
+      // TODO: highlight real argument origin
+      argumentOrigin = disablingNode
+    }
+
+    override DataFlow::Node getAUrlPart() { result = cls.getASiteAssignment().getAUrlPart() }
+
+    override DataFlow::Node getResponseBody() { result = this }
+  }
+
+  /**
+   * A call to a class method.
+   *
+   * TODO: is this general enough to be useful elsewhere?
+   *
+   * Examples:
+   * ```rb
+   * class A
+   *   def self.m; end
+   *
+   *   m # call
+   * end
+   *
+   * A.m # call
+   * ```
+   */
+  private DataFlow::CallNode classMethodCall(API::Node classNode, string methodName) {
+    // A.m
+    result = classNode.getAMethodCall(methodName)
+    or
+    // class A
+    //   A.m
+    //  end
+    result.getReceiver().asExpr() instanceof ExprNodes::SelfVariableAccessCfgNode and
+    result.asExpr().getExpr().getEnclosingModule().(ClassDeclaration).getSuperclassExpr() =
+      classNode.getAValueReachableFromSource().asExpr().getExpr() and
+    result.getMethodName() = methodName
+  }
+}
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/GraphQL.qll b/ruby/ql/lib/codeql/ruby/frameworks/GraphQL.qll
index ede99069213..8815242a723 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/GraphQL.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/GraphQL.qll
@@ -164,7 +164,7 @@ private class GraphqlResolvableClass extends ClassDeclaration {
  * end
  * ```
  */
-class GraphqlResolveMethod extends Method, HTTP::Server::RequestHandler::Range {
+class GraphqlResolveMethod extends Method, Http::Server::RequestHandler::Range {
   private GraphqlResolvableClass resolvableClass;
 
   GraphqlResolveMethod() { this = resolvableClass.getMethod("resolve") }
@@ -208,7 +208,7 @@ class GraphqlResolveMethod extends Method, HTTP::Server::RequestHandler::Range {
  * end
  * ```
  */
-class GraphqlLoadMethod extends Method, HTTP::Server::RequestHandler::Range {
+class GraphqlLoadMethod extends Method, Http::Server::RequestHandler::Range {
   private GraphqlResolvableClass resolvableClass;
 
   GraphqlLoadMethod() {
@@ -340,7 +340,7 @@ private class GraphqlFieldArgumentDefinitionMethodCall extends GraphqlSchemaObje
  * end
  * ```
  */
-class GraphqlFieldResolutionMethod extends Method, HTTP::Server::RequestHandler::Range {
+class GraphqlFieldResolutionMethod extends Method, Http::Server::RequestHandler::Range {
   private GraphqlSchemaObjectClass schemaObjectClass;
 
   GraphqlFieldResolutionMethod() {
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/XmlParsing.qll b/ruby/ql/lib/codeql/ruby/frameworks/XmlParsing.qll
index 8113bb537e2..51fa3d5f76b 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/XmlParsing.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/XmlParsing.qll
@@ -97,13 +97,13 @@ class Feature extends TFeature {
   abstract string getConstantName();
 }
 
-private class FeatureNOENT extends Feature, TNOENT {
+private class FeatureNoent extends Feature, TNOENT {
   override int getValue() { result = 2 }
 
   override string getConstantName() { result = "NOENT" }
 }
 
-private class FeatureNONET extends Feature, TNONET {
+private class FeatureNonet extends Feature, TNONET {
   override int getValue() { result = 2048 }
 
   override string getConstantName() { result = "NONET" }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
index 69563a3eab4..fb5ac61cc91 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
@@ -72,6 +72,8 @@ private class Unit = Specific::Unit;
 
 private module API = Specific::API;
 
+private module DataFlow = Specific::DataFlow;
+
 private import Specific::AccessPathSyntax
 
 /** Module containing hooks for providing input data to be interpreted as a model. */
@@ -155,6 +157,38 @@ module ModelInput {
      */
     abstract predicate row(string row);
   }
+
+  /**
+   * A unit class for adding additional type model rows from CodeQL models.
+   */
+  class TypeModel extends Unit {
+    /**
+     * Gets a data-flow node that is a source of the type `package;type`.
+     */
+    DataFlow::Node getASource(string package, string type) { none() }
+
+    /**
+     * Gets a data flow node that is a sink of the type `package;type`,
+     * usually because it is an argument passed to a parameter of that type.
+     */
+    DataFlow::Node getASink(string package, string type) { none() }
+  }
+
+  /**
+   * A unit class for adding additional type variable model rows.
+   */
+  class TypeVariableModelCsv extends Unit {
+    /**
+     * Holds if `row` specifies a path through a type variable.
+     *
+     * A row of form,
+     * ```
+     * name;path
+     * ```
+     * means `path` can be substituted for a token `TypeVar[name]`.
+     */
+    abstract predicate row(string row);
+  }
 }
 
 private import ModelInput
@@ -182,6 +216,8 @@ private predicate summaryModel(string row) { any(SummaryModelCsv s).row(inverseP
 
 private predicate typeModel(string row) { any(TypeModelCsv s).row(inversePad(row)) }
 
+private predicate typeVariableModel(string row) { any(TypeVariableModelCsv s).row(inversePad(row)) }
+
 /** Holds if a source model exists for the given parameters. */
 predicate sourceModel(string package, string type, string path, string kind) {
   exists(string row |
@@ -219,7 +255,7 @@ private predicate summaryModel(
   )
 }
 
-/** Holds if an type model exists for the given parameters. */
+/** Holds if a type model exists for the given parameters. */
 private predicate typeModel(
   string package1, string type1, string package2, string type2, string path
 ) {
@@ -233,6 +269,15 @@ private predicate typeModel(
   )
 }
 
+/** Holds if a type variable model exists for the given parameters. */
+private predicate typeVariableModel(string name, string path) {
+  exists(string row |
+    typeVariableModel(row) and
+    row.splitAt(";", 0) = name and
+    row.splitAt(";", 1) = path
+  )
+}
+
 /**
  * Gets a package that should be seen as an alias for the given other `package`,
  * or the `package` itself.
@@ -253,7 +298,7 @@ private predicate isRelevantPackage(string package) {
     sourceModel(package, _, _, _) or
     sinkModel(package, _, _, _) or
     summaryModel(package, _, _, _, _, _) or
-    typeModel(package, _, _, _, _)
+    typeModel(_, _, package, _, _)
   ) and
   (
     Specific::isPackageUsed(package)
@@ -290,6 +335,8 @@ private class AccessPathRange extends AccessPath::Range {
       summaryModel(package, _, _, this, _, _) or
       summaryModel(package, _, _, _, this, _)
     )
+    or
+    typeVariableModel(_, this)
   }
 }
 
@@ -339,6 +386,57 @@ private predicate invocationMatchesCallSiteFilter(Specific::InvokeNode invoke, A
   Specific::invocationMatchesExtraCallSiteFilter(invoke, token)
 }
 
+private class TypeModelUseEntry extends API::EntryPoint {
+  private string package;
+  private string type;
+
+  TypeModelUseEntry() {
+    exists(any(TypeModel tm).getASource(package, type)) and
+    this = "TypeModelUseEntry;" + package + ";" + type
+  }
+
+  override DataFlow::LocalSourceNode getASource() {
+    result = any(TypeModel tm).getASource(package, type)
+  }
+
+  API::Node getNodeForType(string package_, string type_) {
+    package = package_ and type = type_ and result = this.getANode()
+  }
+}
+
+private class TypeModelDefEntry extends API::EntryPoint {
+  private string package;
+  private string type;
+
+  TypeModelDefEntry() {
+    exists(any(TypeModel tm).getASink(package, type)) and
+    this = "TypeModelDefEntry;" + package + ";" + type
+  }
+
+  override DataFlow::Node getASink() { result = any(TypeModel tm).getASink(package, type) }
+
+  API::Node getNodeForType(string package_, string type_) {
+    package = package_ and type = type_ and result = this.getANode()
+  }
+}
+
+/**
+ * Gets an API node identified by the given `(package,type)` pair.
+ */
+pragma[nomagic]
+private API::Node getNodeFromType(string package, string type) {
+  exists(string package2, string type2, AccessPath path2 |
+    typeModel(package, type, package2, type2, path2) and
+    result = getNodeFromPath(package2, type2, path2)
+  )
+  or
+  result = any(TypeModelUseEntry e).getNodeForType(package, type)
+  or
+  result = any(TypeModelDefEntry e).getNodeForType(package, type)
+  or
+  result = Specific::getExtraNodeFromType(package, type)
+}
+
 /**
  * Gets the API node identified by the first `n` tokens of `path` in the given `(package, type, path)` tuple.
  */
@@ -347,12 +445,8 @@ private API::Node getNodeFromPath(string package, string type, AccessPath path,
   isRelevantFullPath(package, type, path) and
   (
     n = 0 and
-    exists(string package2, string type2, AccessPath path2 |
-      typeModel(package, type, package2, type2, path2) and
-      result = getNodeFromPath(package2, type2, path2, path2.getNumToken())
-    )
+    result = getNodeFromType(package, type)
     or
-    // Language-specific cases, such as handling of global variables
     result = Specific::getExtraNodeFromPath(package, type, path, n)
   )
   or
@@ -361,6 +455,72 @@ private API::Node getNodeFromPath(string package, string type, AccessPath path,
   // Similar to the other recursive case, but where the path may have stepped through one or more call-site filters
   result =
     getSuccessorFromInvoke(getInvocationFromPath(package, type, path, n - 1), path.getToken(n - 1))
+  or
+  // Apply a subpath
+  result =
+    getNodeFromSubPath(getNodeFromPath(package, type, path, n - 1), getSubPathAt(path, n - 1))
+  or
+  // Apply a type step
+  typeStep(getNodeFromPath(package, type, path, n), result)
+}
+
+/**
+ * Gets a subpath for the `TypeVar` token found at the `n`th token of `path`.
+ */
+pragma[nomagic]
+private AccessPath getSubPathAt(AccessPath path, int n) {
+  exists(string typeVarName |
+    path.getToken(n).getAnArgument("TypeVar") = typeVarName and
+    typeVariableModel(typeVarName, result)
+  )
+}
+
+/**
+ * Gets a node that is found by evaluating the first `n` tokens of `subPath` starting at `base`.
+ */
+pragma[nomagic]
+private API::Node getNodeFromSubPath(API::Node base, AccessPath subPath, int n) {
+  exists(AccessPath path, int k |
+    base = [getNodeFromPath(_, _, path, k), getNodeFromSubPath(_, path, k)] and
+    subPath = getSubPathAt(path, k) and
+    result = base and
+    n = 0
+  )
+  or
+  exists(string package, string type, AccessPath basePath |
+    typeStepModel(package, type, basePath, subPath) and
+    base = getNodeFromPath(package, type, basePath) and
+    result = base and
+    n = 0
+  )
+  or
+  result = getSuccessorFromNode(getNodeFromSubPath(base, subPath, n - 1), subPath.getToken(n - 1))
+  or
+  result =
+    getSuccessorFromInvoke(getInvocationFromSubPath(base, subPath, n - 1), subPath.getToken(n - 1))
+  or
+  result =
+    getNodeFromSubPath(getNodeFromSubPath(base, subPath, n - 1), getSubPathAt(subPath, n - 1))
+  or
+  typeStep(getNodeFromSubPath(base, subPath, n), result)
+}
+
+/**
+ * Gets a call site that is found by evaluating the first `n` tokens of `subPath` starting at `base`.
+ */
+private Specific::InvokeNode getInvocationFromSubPath(API::Node base, AccessPath subPath, int n) {
+  result = Specific::getAnInvocationOf(getNodeFromSubPath(base, subPath, n))
+  or
+  result = getInvocationFromSubPath(base, subPath, n - 1) and
+  invocationMatchesCallSiteFilter(result, subPath.getToken(n - 1))
+}
+
+/**
+ * Gets a node that is found by evaluating `subPath` starting at `base`.
+ */
+pragma[nomagic]
+private API::Node getNodeFromSubPath(API::Node base, AccessPath subPath) {
+  result = getNodeFromSubPath(base, subPath, subPath.getNumToken())
 }
 
 /** Gets the node identified by the given `(package, type, path)` tuple. */
@@ -368,6 +528,20 @@ API::Node getNodeFromPath(string package, string type, AccessPath path) {
   result = getNodeFromPath(package, type, path, path.getNumToken())
 }
 
+pragma[nomagic]
+private predicate typeStepModel(string package, string type, AccessPath basePath, AccessPath output) {
+  summaryModel(package, type, basePath, "", output, "type")
+}
+
+pragma[nomagic]
+private predicate typeStep(API::Node pred, API::Node succ) {
+  exists(string package, string type, AccessPath basePath, AccessPath output |
+    typeStepModel(package, type, basePath, output) and
+    pred = getNodeFromPath(package, type, basePath) and
+    succ = getNodeFromSubPath(pred, output)
+  )
+}
+
 /**
  * Gets an invocation identified by the given `(package, type, path)` tuple.
  *
@@ -390,7 +564,7 @@ Specific::InvokeNode getInvocationFromPath(string package, string type, AccessPa
  */
 bindingset[name]
 predicate isValidTokenNameInIdentifyingAccessPath(string name) {
-  name = ["Argument", "Parameter", "ReturnValue", "WithArity"]
+  name = ["Argument", "Parameter", "ReturnValue", "WithArity", "TypeVar"]
   or
   Specific::isExtraValidTokenNameInIdentifyingAccessPath(name)
 }
@@ -418,6 +592,9 @@ predicate isValidTokenArgumentInIdentifyingAccessPath(string name, string argume
   name = "WithArity" and
   argument.regexpMatch("\\d+(\\.\\.(\\d+)?)?")
   or
+  name = "TypeVar" and
+  exists(argument)
+  or
   Specific::isExtraValidTokenArgumentInIdentifyingAccessPath(name, argument)
 }
 
@@ -469,12 +646,7 @@ module ModelOutput {
    * Holds if `node` is seen as an instance of `(package,type)` due to a type definition
    * contributed by a CSV model.
    */
-  API::Node getATypeNode(string package, string type) {
-    exists(string package2, string type2, AccessPath path |
-      typeModel(package, type, package2, type2, path) and
-      result = getNodeFromPath(package2, type2, path)
-    )
-  }
+  API::Node getATypeNode(string package, string type) { result = getNodeFromType(package, type) }
 
   /**
    * Gets an error message relating to an invalid CSV row in a model.
@@ -489,6 +661,8 @@ module ModelOutput {
       any(SummaryModelCsv csv).row(row) and kind = "summary" and expectedArity = 6
       or
       any(TypeModelCsv csv).row(row) and kind = "type" and expectedArity = 5
+      or
+      any(TypeVariableModelCsv csv).row(row) and kind = "type-variable" and expectedArity = 2
     |
       actualArity = count(row.indexOf(";")) + 1 and
       actualArity != expectedArity and
@@ -499,7 +673,7 @@ module ModelOutput {
     or
     // Check names and arguments of access path tokens
     exists(AccessPath path, AccessPathToken token |
-      isRelevantFullPath(_, _, path) and
+      (isRelevantFullPath(_, _, path) or typeVariableModel(_, path)) and
       token = path.getToken(_)
     |
       not isValidTokenNameInIdentifyingAccessPath(token.getName()) and
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsSpecific.qll b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsSpecific.qll
index af99bec76dc..b3a0fab20fd 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsSpecific.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsSpecific.qll
@@ -20,7 +20,6 @@
  */
 
 private import ruby
-private import codeql.ruby.DataFlow
 private import codeql.ruby.dataflow.internal.DataFlowPrivate as DataFlowPrivate
 private import ApiGraphModels
 
@@ -29,6 +28,7 @@ class Unit = DataFlowPrivate::Unit;
 // Re-export libraries needed by ApiGraphModels.qll
 import codeql.ruby.ApiGraphs
 import codeql.ruby.dataflow.internal.AccessPathSyntax as AccessPathSyntax
+import codeql.ruby.DataFlow::DataFlow as DataFlow
 private import AccessPathSyntax
 private import codeql.ruby.dataflow.internal.FlowSummaryImplSpecific as FlowSummaryImplSpecific
 private import codeql.ruby.dataflow.internal.DataFlowDispatch as DataFlowDispatch
@@ -55,12 +55,6 @@ predicate isPackageUsed(string package) {
 /** Gets a Ruby-specific interpretation of the `(package, type, path)` tuple after resolving the first `n` access path tokens. */
 bindingset[package, type, path]
 API::Node getExtraNodeFromPath(string package, string type, AccessPath path, int n) {
-  isRelevantFullPath(package, type, path) and
-  exists(package) and // Allow any package name, see `isPackageUsed`.
-  type = "" and
-  n = 0 and
-  result = API::root()
-  or
   // A row of form `;any;Method[foo]` should match any method named `foo`.
   exists(package) and
   type = "any" and
@@ -71,6 +65,13 @@ API::Node getExtraNodeFromPath(string package, string type, AccessPath path, int
   )
 }
 
+/** Gets a Ruby-specific interpretation of the `(package, type)` tuple. */
+API::Node getExtraNodeFromType(string package, string type) {
+  isRelevantFullPath(package, type, _) and // Allow any package name, see `isPackageUsed`.
+  type = "" and
+  result = API::root()
+}
+
 /**
  * Holds if `path` occurs in a CSV row with type `any`, meaning it can start
  * matching anywhere, and the path begins with `Method[methodName]`.
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Excon.qll b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Excon.qll
index fdfd1f92096..0cca7e268dc 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Excon.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Excon.qll
@@ -7,6 +7,7 @@ private import codeql.ruby.CFG
 private import codeql.ruby.Concepts
 private import codeql.ruby.ApiGraphs
 private import codeql.ruby.DataFlow
+private import codeql.ruby.dataflow.internal.DataFlowImplForHttpClientLibraries as DataFlowImplForHttpClientLibraries
 
 /**
  * A call that makes an HTTP request using `Excon`.
@@ -23,14 +24,13 @@ private import codeql.ruby.DataFlow
  * TODO: pipelining, streaming responses
  * https://github.com/excon/excon/blob/master/README.md
  */
-class ExconHttpRequest extends HTTP::Client::Request::Range {
-  DataFlow::CallNode requestUse;
+class ExconHttpRequest extends Http::Client::Request::Range, DataFlow::CallNode {
   API::Node requestNode;
   API::Node connectionNode;
   DataFlow::Node connectionUse;
 
   ExconHttpRequest() {
-    requestUse = requestNode.asSource() and
+    this = requestNode.asSource() and
     connectionUse = connectionNode.asSource() and
     connectionNode =
       [
@@ -46,8 +46,7 @@ class ExconHttpRequest extends HTTP::Client::Request::Range {
               // Excon#request exists but Excon.request doesn't.
               // This shouldn't be a problem - in real code the latter would raise NoMethodError anyway.
               "get", "head", "delete", "options", "post", "put", "patch", "trace", "request"
-            ]) and
-    this = requestUse.asExpr().getExpr()
+            ])
   }
 
   override DataFlow::Node getResponseBody() { result = requestNode.getAMethodCall("body") }
@@ -56,96 +55,76 @@ class ExconHttpRequest extends HTTP::Client::Request::Range {
     // For one-off requests, the URL is in the first argument of the request method call.
     // For connection re-use, the URL is split between the first argument of the `new` call
     // and the `path` keyword argument of the request method call.
-    result = requestUse.getArgument(0) and not result.asExpr().getExpr() instanceof Pair
+    result = this.getArgument(0) and not result.asExpr().getExpr() instanceof Pair
     or
-    result = requestUse.getKeywordArgument("path")
+    result = this.getKeywordArgument("path")
     or
     result = connectionUse.(DataFlow::CallNode).getArgument(0)
   }
 
-  override predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
-    // Check for `ssl_verify_peer: false` in the options hash.
-    exists(DataFlow::Node arg, int i |
-      i > 0 and
-      arg = connectionNode.getAValueReachableFromSource().(DataFlow::CallNode).getArgument(i)
-    |
-      argSetsVerifyPeer(arg, false, disablingNode)
+  /** Gets the value that controls certificate validation, if any. */
+  DataFlow::Node getCertificateValidationControllingValue() {
+    exists(DataFlow::CallNode newCall | newCall = connectionNode.getAValueReachableFromSource() |
+      // Check for `ssl_verify_peer: false`
+      result = newCall.getKeywordArgumentIncludeHashArgument("ssl_verify_peer")
     )
+  }
+
+  override predicate disablesCertificateValidation(
+    DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+  ) {
+    any(ExconDisablesCertificateValidationConfiguration config)
+        .hasFlow(argumentOrigin, disablingNode) and
+    disablingNode = this.getCertificateValidationControllingValue()
     or
-    // Or we see a call to `Excon.defaults[:ssl_verify_peer] = false` before the
-    // request, and no `ssl_verify_peer: true` in the explicit options hash for
-    // the request call.
-    exists(DataFlow::CallNode disableCall |
-      setsDefaultVerification(disableCall, false) and
-      disableCall.asExpr().getASuccessor+() = requestUse.asExpr() and
-      disablingNode = disableCall and
-      not exists(DataFlow::Node arg, int i |
-        i > 0 and
-        arg = connectionNode.getAValueReachableFromSource().(DataFlow::CallNode).getArgument(i)
-      |
-        argSetsVerifyPeer(arg, true, _)
-      )
+    // We set `Excon.defaults[:ssl_verify_peer]` or `Excon.ssl_verify_peer` = false`
+    // before the request, and no `ssl_verify_peer: true` in the explicit options hash
+    // for the request call.
+    exists(DataFlow::CallNode disableCall, BooleanLiteral value |
+      // Excon.defaults[:ssl_verify_peer]
+      disableCall = API::getTopLevelMember("Excon").getReturn("defaults").getAMethodCall("[]=") and
+      disableCall
+          .getArgument(0)
+          .getALocalSource()
+          .asExpr()
+          .getConstantValue()
+          .isStringlikeValue("ssl_verify_peer") and
+      disablingNode = disableCall.getArgument(1) and
+      argumentOrigin = disablingNode.getALocalSource() and
+      value = argumentOrigin.asExpr().getExpr()
+      or
+      // Excon.ssl_verify_peer
+      disableCall = API::getTopLevelMember("Excon").getAMethodCall("ssl_verify_peer=") and
+      disablingNode = disableCall.getArgument(0) and
+      argumentOrigin = disablingNode.getALocalSource() and
+      value = argumentOrigin.asExpr().getExpr()
+    |
+      value.getValue() = false and
+      disableCall.asExpr().getASuccessor+() = this.asExpr() and
+      // no `ssl_verify_peer: true` in the request call.
+      not this.getCertificateValidationControllingValue()
+          .getALocalSource()
+          .asExpr()
+          .getExpr()
+          .(BooleanLiteral)
+          .getValue() = true
     )
   }
 
   override string getFramework() { result = "Excon" }
 }
 
-/**
- * Holds if `arg` represents an options hash that contains the key
- * `:ssl_verify_peer` with `value`, where `kvNode` is the data-flow node for
- * this key-value pair.
- */
-predicate argSetsVerifyPeer(DataFlow::Node arg, boolean value, DataFlow::Node kvNode) {
-  // Either passed as an individual key:value argument, e.g.:
-  // Excon.get(..., ssl_verify_peer: false)
-  isSslVerifyPeerPair(arg.asExpr(), value) and
-  kvNode = arg
-  or
-  // Or as a single hash argument, e.g.:
-  // Excon.get(..., { ssl_verify_peer: false, ... })
-  exists(DataFlow::LocalSourceNode optionsNode, CfgNodes::ExprNodes::PairCfgNode p |
-    p = optionsNode.asExpr().(CfgNodes::ExprNodes::HashLiteralCfgNode).getAKeyValuePair() and
-    isSslVerifyPeerPair(p, value) and
-    optionsNode.flowsTo(arg) and
-    kvNode.asExpr() = p
-  )
-}
+/** A configuration to track values that can disable certificate validation for Excon. */
+private class ExconDisablesCertificateValidationConfiguration extends DataFlowImplForHttpClientLibraries::Configuration {
+  ExconDisablesCertificateValidationConfiguration() {
+    this = "ExconDisablesCertificateValidationConfiguration"
+  }
 
-/**
- * Holds if `callNode` sets `Excon.defaults[:ssl_verify_peer]` or
- * `Excon.ssl_verify_peer` to `value`.
- */
-private predicate setsDefaultVerification(DataFlow::CallNode callNode, boolean value) {
-  callNode = API::getTopLevelMember("Excon").getReturn("defaults").getAMethodCall("[]=") and
-  isSslVerifyPeerLiteral(callNode.getArgument(0)) and
-  hasBooleanValue(callNode.getArgument(1), value)
-  or
-  callNode = API::getTopLevelMember("Excon").getAMethodCall("ssl_verify_peer=") and
-  hasBooleanValue(callNode.getArgument(0), value)
-}
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr().getExpr().(BooleanLiteral).isFalse()
+  }
 
-private predicate isSslVerifyPeerLiteral(DataFlow::Node node) {
-  exists(DataFlow::LocalSourceNode literal |
-    literal.asExpr().getExpr().getConstantValue().isStringlikeValue("ssl_verify_peer") and
-    literal.flowsTo(node)
-  )
-}
-
-/** Holds if `node` can contain `value`. */
-private predicate hasBooleanValue(DataFlow::Node node, boolean value) {
-  exists(DataFlow::LocalSourceNode literal |
-    literal.asExpr().getExpr().(BooleanLiteral).getValue() = value and
-    literal.flowsTo(node)
-  )
-}
-
-/** Holds if `p` is the pair `ssl_verify_peer: <value>`. */
-private predicate isSslVerifyPeerPair(CfgNodes::ExprNodes::PairCfgNode p, boolean value) {
-  exists(DataFlow::Node key, DataFlow::Node valueNode |
-    key.asExpr() = p.getKey() and
-    valueNode.asExpr() = p.getValue() and
-    isSslVerifyPeerLiteral(key) and
-    hasBooleanValue(valueNode, value)
-  )
+  override predicate isSink(DataFlow::Node sink) {
+    sink = any(ExconHttpRequest req).getCertificateValidationControllingValue()
+  }
 }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll
index 59d2e33dad5..049998ce8f3 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Faraday.qll
@@ -7,6 +7,7 @@ private import codeql.ruby.CFG
 private import codeql.ruby.Concepts
 private import codeql.ruby.ApiGraphs
 private import codeql.ruby.DataFlow
+private import codeql.ruby.dataflow.internal.DataFlowImplForHttpClientLibraries as DataFlowImplForHttpClientLibraries
 
 /**
  * A call that makes an HTTP request using `Faraday`.
@@ -22,11 +23,10 @@ private import codeql.ruby.DataFlow
  * connection.get("/").body
  * ```
  */
-class FaradayHttpRequest extends HTTP::Client::Request::Range {
+class FaradayHttpRequest extends Http::Client::Request::Range, DataFlow::CallNode {
   API::Node requestNode;
   API::Node connectionNode;
   DataFlow::Node connectionUse;
-  DataFlow::CallNode requestUse;
 
   FaradayHttpRequest() {
     connectionNode =
@@ -38,125 +38,67 @@ class FaradayHttpRequest extends HTTP::Client::Request::Range {
       ] and
     requestNode =
       connectionNode.getReturn(["get", "head", "delete", "post", "put", "patch", "trace"]) and
-    requestUse = requestNode.asSource() and
-    connectionUse = connectionNode.asSource() and
-    this = requestUse.asExpr().getExpr()
+    this = requestNode.asSource() and
+    connectionUse = connectionNode.asSource()
   }
 
   override DataFlow::Node getResponseBody() { result = requestNode.getAMethodCall("body") }
 
   override DataFlow::Node getAUrlPart() {
-    result = requestUse.getArgument(0) or
+    result = this.getArgument(0) or
     result = connectionUse.(DataFlow::CallNode).getArgument(0) or
     result = connectionUse.(DataFlow::CallNode).getKeywordArgument("url")
   }
 
-  override predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
+  /** Gets the value that controls certificate validation, if any, with argument name `name`. */
+  DataFlow::Node getCertificateValidationControllingValue(string argName) {
     // `Faraday::new` takes an options hash as its second argument, and we're
     // looking for
     // `{ ssl: { verify: false } }`
     // or
     // `{ ssl: { verify_mode: OpenSSL::SSL::VERIFY_NONE } }`
-    exists(DataFlow::Node arg, int i |
-      i > 0 and
-      arg = connectionNode.getAValueReachableFromSource().(DataFlow::CallNode).getArgument(i)
+    argName in ["verify", "verify_mode"] and
+    exists(DataFlow::Node sslValue, DataFlow::CallNode newCall |
+      newCall = connectionNode.getAValueReachableFromSource() and
+      sslValue = newCall.getKeywordArgumentIncludeHashArgument("ssl")
     |
-      // Either passed as an individual key:value argument, e.g.:
-      // Faraday.new(..., ssl: {...})
-      isSslOptionsPairDisablingValidation(arg.asExpr()) and
-      disablingNode = arg
-      or
-      // Or as a single hash argument, e.g.:
-      // Faraday.new(..., { ssl: {...} })
-      exists(DataFlow::LocalSourceNode optionsNode, CfgNodes::ExprNodes::PairCfgNode p |
-        p = optionsNode.asExpr().(CfgNodes::ExprNodes::HashLiteralCfgNode).getAKeyValuePair() and
-        isSslOptionsPairDisablingValidation(p) and
-        optionsNode.flowsTo(arg) and
-        disablingNode.asExpr() = p
+      exists(CfgNodes::ExprNodes::PairCfgNode p, DataFlow::Node key |
+        p = sslValue.asExpr().(CfgNodes::ExprNodes::HashLiteralCfgNode).getAKeyValuePair() and
+        key.asExpr() = p.getKey() and
+        key.getALocalSource().asExpr().getConstantValue().isStringlikeValue(argName) and
+        result.asExpr() = p.getValue()
       )
     )
   }
 
+  override predicate disablesCertificateValidation(
+    DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+  ) {
+    any(FaradayDisablesCertificateValidationConfiguration config)
+        .hasFlow(argumentOrigin, disablingNode) and
+    disablingNode = this.getCertificateValidationControllingValue(_)
+  }
+
   override string getFramework() { result = "Faraday" }
 }
 
-/**
- * Holds if the pair `p` contains the key `:ssl` for which the value is a hash
- * containing either `verify: false` or
- * `verify_mode: OpenSSL::SSL::VERIFY_NONE`.
- */
-private predicate isSslOptionsPairDisablingValidation(CfgNodes::ExprNodes::PairCfgNode p) {
-  exists(DataFlow::Node key, DataFlow::Node value |
-    key.asExpr() = p.getKey() and
-    value.asExpr() = p.getValue() and
-    isSymbolLiteral(key, "ssl") and
-    (isHashWithVerifyFalse(value) or isHashWithVerifyModeNone(value))
-  )
-}
+/** A configuration to track values that can disable certificate validation for Faraday. */
+private class FaradayDisablesCertificateValidationConfiguration extends DataFlowImplForHttpClientLibraries::Configuration {
+  FaradayDisablesCertificateValidationConfiguration() {
+    this = "FaradayDisablesCertificateValidationConfiguration"
+  }
 
-/** Holds if `node` represents the symbol literal with the given `valueText`. */
-private predicate isSymbolLiteral(DataFlow::Node node, string valueText) {
-  exists(DataFlow::LocalSourceNode literal |
-    literal.asExpr().getExpr().getConstantValue().isStringlikeValue(valueText) and
-    literal.flowsTo(node)
-  )
-}
+  override predicate isSource(
+    DataFlow::Node source, DataFlowImplForHttpClientLibraries::FlowState state
+  ) {
+    source.asExpr().getExpr().(BooleanLiteral).isFalse() and
+    state = "verify"
+    or
+    source = API::getTopLevelMember("OpenSSL").getMember("SSL").getMember("VERIFY_NONE").asSource() and
+    state = "verify_mode"
+  }
 
-/**
- * Holds if `node` represents a hash containing the key-value pair
- * `verify: false`.
- */
-private predicate isHashWithVerifyFalse(DataFlow::Node node) {
-  exists(DataFlow::LocalSourceNode hash |
-    isVerifyFalsePair(hash.asExpr().(CfgNodes::ExprNodes::HashLiteralCfgNode).getAKeyValuePair()) and
-    hash.flowsTo(node)
-  )
-}
-
-/**
- * Holds if `node` represents a hash containing the key-value pair
- * `verify_mode: OpenSSL::SSL::VERIFY_NONE`.
- */
-private predicate isHashWithVerifyModeNone(DataFlow::Node node) {
-  exists(DataFlow::LocalSourceNode hash |
-    isVerifyModeNonePair(hash.asExpr().(CfgNodes::ExprNodes::HashLiteralCfgNode).getAKeyValuePair()) and
-    hash.flowsTo(node)
-  )
-}
-
-/**
- * Holds if the pair `p` has the key `:verify_mode` and the value
- * `OpenSSL::SSL::VERIFY_NONE`.
- */
-private predicate isVerifyModeNonePair(CfgNodes::ExprNodes::PairCfgNode p) {
-  exists(DataFlow::Node key, DataFlow::Node value |
-    key.asExpr() = p.getKey() and
-    value.asExpr() = p.getValue() and
-    isSymbolLiteral(key, "verify_mode") and
-    value =
-      API::getTopLevelMember("OpenSSL")
-          .getMember("SSL")
-          .getMember("VERIFY_NONE")
-          .getAValueReachableFromSource()
-  )
-}
-
-/**
- * Holds if the pair `p` has the key `:verify` and the value `false`.
- */
-private predicate isVerifyFalsePair(CfgNodes::ExprNodes::PairCfgNode p) {
-  exists(DataFlow::Node key, DataFlow::Node value |
-    key.asExpr() = p.getKey() and
-    value.asExpr() = p.getValue() and
-    isSymbolLiteral(key, "verify") and
-    isFalse(value)
-  )
-}
-
-/** Holds if `node` can contain the Boolean value `false`. */
-private predicate isFalse(DataFlow::Node node) {
-  exists(DataFlow::LocalSourceNode literal |
-    literal.asExpr().getExpr().(BooleanLiteral).isFalse() and
-    literal.flowsTo(node)
-  )
+  override predicate isSink(DataFlow::Node sink, DataFlowImplForHttpClientLibraries::FlowState state) {
+    sink = any(FaradayHttpRequest req).getCertificateValidationControllingValue(state)
+  }
 }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/HttpClient.qll b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/HttpClient.qll
index 2f63fd96005..255ff0277bc 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/HttpClient.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/HttpClient.qll
@@ -6,6 +6,7 @@ private import ruby
 private import codeql.ruby.Concepts
 private import codeql.ruby.ApiGraphs
 private import codeql.ruby.DataFlow
+private import codeql.ruby.dataflow.internal.DataFlowImplForHttpClientLibraries as DataFlowImplForHttpClientLibraries
 
 /**
  * A call that makes an HTTP request using `HTTPClient`.
@@ -14,10 +15,9 @@ private import codeql.ruby.DataFlow
  * HTTPClient.get_content("http://example.com")
  * ```
  */
-class HttpClientRequest extends HTTP::Client::Request::Range {
+class HttpClientRequest extends Http::Client::Request::Range, DataFlow::CallNode {
   API::Node requestNode;
   API::Node connectionNode;
-  DataFlow::CallNode requestUse;
   string method;
 
   HttpClientRequest() {
@@ -29,36 +29,60 @@ class HttpClientRequest extends HTTP::Client::Request::Range {
         API::getTopLevelMember("HTTPClient").getInstance()
       ] and
     requestNode = connectionNode.getReturn(method) and
-    requestUse = requestNode.asSource() and
+    this = requestNode.asSource() and
     method in [
         "get", "head", "delete", "options", "post", "put", "trace", "get_content", "post_content"
-      ] and
-    this = requestUse.asExpr().getExpr()
+      ]
   }
 
-  override DataFlow::Node getAUrlPart() { result = requestUse.getArgument(0) }
+  override DataFlow::Node getAUrlPart() { result = this.getArgument(0) }
 
   override DataFlow::Node getResponseBody() {
     // The `get_content` and `post_content` methods return the response body as
     // a string. The other methods return a `HTTPClient::Message` object which
     // has various methods that return the response body.
-    method in ["get_content", "post_content"] and result = requestUse
+    method in ["get_content", "post_content"] and result = this
     or
     not method in ["get_content", "put_content"] and
     result = requestNode.getAMethodCall(["body", "http_body", "content", "dump"])
   }
 
-  override predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
+  /** Gets the value that controls certificate validation, if any. */
+  DataFlow::Node getCertificateValidationControllingValue() {
     // Look for calls to set
     // `c.ssl_config.verify_mode = OpenSSL::SSL::VERIFY_NONE`
     // on an HTTPClient connection object `c`.
-    disablingNode = connectionNode.getReturn("ssl_config").getReturn("verify_mode=").asSource() and
-    disablingNode.(DataFlow::CallNode).getArgument(0) =
-      API::getTopLevelMember("OpenSSL")
-          .getMember("SSL")
-          .getMember("VERIFY_NONE")
-          .getAValueReachableFromSource()
+    result =
+      connectionNode
+          .getReturn("ssl_config")
+          .getReturn("verify_mode=")
+          .asSource()
+          .(DataFlow::CallNode)
+          .getArgument(0)
+  }
+
+  override predicate disablesCertificateValidation(
+    DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+  ) {
+    any(HttpClientDisablesCertificateValidationConfiguration config)
+        .hasFlow(argumentOrigin, disablingNode) and
+    disablingNode = this.getCertificateValidationControllingValue()
   }
 
   override string getFramework() { result = "HTTPClient" }
 }
+
+/** A configuration to track values that can disable certificate validation for HttpClient. */
+private class HttpClientDisablesCertificateValidationConfiguration extends DataFlowImplForHttpClientLibraries::Configuration {
+  HttpClientDisablesCertificateValidationConfiguration() {
+    this = "HttpClientDisablesCertificateValidationConfiguration"
+  }
+
+  override predicate isSource(DataFlow::Node source) {
+    source = API::getTopLevelMember("OpenSSL").getMember("SSL").getMember("VERIFY_NONE").asSource()
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink = any(HttpClientRequest req).getCertificateValidationControllingValue()
+  }
+}
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Httparty.qll b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Httparty.qll
index f92010c03cf..99fd9e00f18 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Httparty.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Httparty.qll
@@ -7,6 +7,7 @@ private import codeql.ruby.CFG
 private import codeql.ruby.Concepts
 private import codeql.ruby.ApiGraphs
 private import codeql.ruby.DataFlow
+private import codeql.ruby.dataflow.internal.DataFlowImplForHttpClientLibraries as DataFlowImplForHttpClientLibraries
 
 /**
  * A call that makes an HTTP request using `HTTParty`.
@@ -23,19 +24,17 @@ private import codeql.ruby.DataFlow
  * MyClass.new("http://example.com")
  * ```
  */
-class HttpartyRequest extends HTTP::Client::Request::Range {
+class HttpartyRequest extends Http::Client::Request::Range, DataFlow::CallNode {
   API::Node requestNode;
-  DataFlow::CallNode requestUse;
 
   HttpartyRequest() {
-    requestUse = requestNode.asSource() and
+    this = requestNode.asSource() and
     requestNode =
       API::getTopLevelMember("HTTParty")
-          .getReturn(["get", "head", "delete", "options", "post", "put", "patch"]) and
-    this = requestUse.asExpr().getExpr()
+          .getReturn(["get", "head", "delete", "options", "post", "put", "patch"])
   }
 
-  override DataFlow::Node getAUrlPart() { result = requestUse.getArgument(0) }
+  override DataFlow::Node getAUrlPart() { result = this.getArgument(0) }
 
   override DataFlow::Node getResponseBody() {
     // If HTTParty can recognise the response type, it will parse and return it
@@ -46,60 +45,36 @@ class HttpartyRequest extends HTTP::Client::Request::Range {
     or
     // Otherwise, treat the response as the response body.
     not exists(requestNode.getAMethodCall("body")) and
-    result = requestUse
+    result = this
   }
 
-  override predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
-    // The various request methods take an options hash as their second
-    // argument, and we're looking for `{ verify: false }` or
-    // `{ verify_peer: false }`.
-    exists(DataFlow::Node arg, int i |
-      i > 0 and
-      arg.asExpr() = requestUse.asExpr().(CfgNodes::ExprNodes::MethodCallCfgNode).getArgument(i)
-    |
-      // Either passed as an individual key:value argument, e.g.:
-      // HTTParty.get(..., verify: false)
-      isVerifyFalsePair(arg.asExpr()) and
-      disablingNode = arg
-      or
-      // Or as a single hash argument, e.g.:
-      // HTTParty.get(..., { verify: false, ... })
-      exists(DataFlow::LocalSourceNode optionsNode, CfgNodes::ExprNodes::PairCfgNode p |
-        p = optionsNode.asExpr().(CfgNodes::ExprNodes::HashLiteralCfgNode).getAKeyValuePair() and
-        isVerifyFalsePair(p) and
-        optionsNode.flowsTo(arg) and
-        disablingNode.asExpr() = p
-      )
-    )
+  /** Gets the value that controls certificate validation, if any. */
+  DataFlow::Node getCertificateValidationControllingValue() {
+    result = this.getKeywordArgumentIncludeHashArgument(["verify", "verify_peer"])
+  }
+
+  override predicate disablesCertificateValidation(
+    DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+  ) {
+    any(HttpartyDisablesCertificateValidationConfiguration config)
+        .hasFlow(argumentOrigin, disablingNode) and
+    disablingNode = this.getCertificateValidationControllingValue()
   }
 
   override string getFramework() { result = "HTTParty" }
 }
 
-/** Holds if `node` represents the symbol literal `verify` or `verify_peer`. */
-private predicate isVerifyLiteral(DataFlow::Node node) {
-  exists(DataFlow::LocalSourceNode literal |
-    literal.asExpr().getExpr().getConstantValue().isStringlikeValue(["verify", "verify_peer"]) and
-    literal.flowsTo(node)
-  )
-}
+/** A configuration to track values that can disable certificate validation for Httparty. */
+private class HttpartyDisablesCertificateValidationConfiguration extends DataFlowImplForHttpClientLibraries::Configuration {
+  HttpartyDisablesCertificateValidationConfiguration() {
+    this = "HttpartyDisablesCertificateValidationConfiguration"
+  }
 
-/** Holds if `node` can contain the Boolean value `false`. */
-private predicate isFalse(DataFlow::Node node) {
-  exists(DataFlow::LocalSourceNode literal |
-    literal.asExpr().getExpr().(BooleanLiteral).isFalse() and
-    literal.flowsTo(node)
-  )
-}
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr().getExpr().(BooleanLiteral).isFalse()
+  }
 
-/**
- * Holds if `p` is the pair `verify: false` or `verify_peer: false`.
- */
-private predicate isVerifyFalsePair(CfgNodes::ExprNodes::PairCfgNode p) {
-  exists(DataFlow::Node key, DataFlow::Node value |
-    key.asExpr() = p.getKey() and
-    value.asExpr() = p.getValue() and
-    isVerifyLiteral(key) and
-    isFalse(value)
-  )
+  override predicate isSink(DataFlow::Node sink) {
+    sink = any(HttpartyRequest req).getCertificateValidationControllingValue()
+  }
 }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/NetHttp.qll b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/NetHttp.qll
index 3396ede11da..f12f6fa8e30 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/NetHttp.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/NetHttp.qll
@@ -8,6 +8,7 @@ private import codeql.ruby.dataflow.RemoteFlowSources
 private import codeql.ruby.ApiGraphs
 private import codeql.ruby.dataflow.internal.DataFlowPublic
 private import codeql.ruby.DataFlow
+private import codeql.ruby.dataflow.internal.DataFlowImplForHttpClientLibraries as DataFlowImplForHttpClientLibraries
 
 /**
  * A `Net::HTTP` call which initiates an HTTP request.
@@ -18,7 +19,7 @@ private import codeql.ruby.DataFlow
  * response = req.get("/")
  * ```
  */
-class NetHttpRequest extends HTTP::Client::Request::Range {
+class NetHttpRequest extends Http::Client::Request::Range, DataFlow::CallNode {
   private DataFlow::CallNode request;
   private DataFlow::Node responseBody;
   private API::Node requestNode;
@@ -26,7 +27,7 @@ class NetHttpRequest extends HTTP::Client::Request::Range {
   NetHttpRequest() {
     exists(string method |
       request = requestNode.asSource() and
-      this = request.asExpr().getExpr()
+      this = request
     |
       // Net::HTTP.get(...)
       method = "get" and
@@ -65,23 +66,42 @@ class NetHttpRequest extends HTTP::Client::Request::Range {
 
   override DataFlow::Node getResponseBody() { result = responseBody }
 
-  override predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
+  /** Gets the value that controls certificate validation, if any. */
+  DataFlow::Node getCertificateValidationControllingValue() {
     // A Net::HTTP request bypasses certificate validation if we see a setter
     // call like this:
     //   foo.verify_mode = OpenSSL::SSL::VERIFY_NONE
     // and then the receiver of that call flows to the receiver in the request:
     //   foo.request(...)
     exists(DataFlow::CallNode setter |
-      disablingNode =
-        API::getTopLevelMember("OpenSSL")
-            .getMember("SSL")
-            .getMember("VERIFY_NONE")
-            .getAValueReachableFromSource() and
       setter.asExpr().getExpr().(SetterMethodCall).getMethodName() = "verify_mode=" and
-      disablingNode = setter.getArgument(0) and
+      result = setter.getArgument(0) and
       localFlow(setter.getReceiver(), request.getReceiver())
     )
   }
 
+  override predicate disablesCertificateValidation(
+    DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+  ) {
+    any(NetHttpDisablesCertificateValidationConfiguration config)
+        .hasFlow(argumentOrigin, disablingNode) and
+    disablingNode = this.getCertificateValidationControllingValue()
+  }
+
   override string getFramework() { result = "Net::HTTP" }
 }
+
+/** A configuration to track values that can disable certificate validation for NetHttp. */
+private class NetHttpDisablesCertificateValidationConfiguration extends DataFlowImplForHttpClientLibraries::Configuration {
+  NetHttpDisablesCertificateValidationConfiguration() {
+    this = "NetHttpDisablesCertificateValidationConfiguration"
+  }
+
+  override predicate isSource(DataFlow::Node source) {
+    source = API::getTopLevelMember("OpenSSL").getMember("SSL").getMember("VERIFY_NONE").asSource()
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink = any(NetHttpRequest req).getCertificateValidationControllingValue()
+  }
+}
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/OpenURI.qll b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/OpenURI.qll
index 565ac2e85ca..557c75f77ec 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/OpenURI.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/OpenURI.qll
@@ -8,6 +8,7 @@ private import codeql.ruby.Concepts
 private import codeql.ruby.ApiGraphs
 private import codeql.ruby.DataFlow
 private import codeql.ruby.frameworks.Core
+private import codeql.ruby.dataflow.internal.DataFlowImplForHttpClientLibraries as DataFlowImplForHttpClientLibraries
 
 /**
  * A call that makes an HTTP request using `OpenURI` via `URI.open` or
@@ -18,9 +19,8 @@ private import codeql.ruby.frameworks.Core
  * URI.parse("http://example.com").open.read
  * ```
  */
-class OpenUriRequest extends HTTP::Client::Request::Range {
+class OpenUriRequest extends Http::Client::Request::Range, DataFlow::CallNode {
   API::Node requestNode;
-  DataFlow::CallNode requestUse;
 
   OpenUriRequest() {
     requestNode =
@@ -28,21 +28,26 @@ class OpenUriRequest extends HTTP::Client::Request::Range {
         [API::getTopLevelMember("URI"), API::getTopLevelMember("URI").getReturn("parse")]
             .getReturn("open"), API::getTopLevelMember("OpenURI").getReturn("open_uri")
       ] and
-    requestUse = requestNode.asSource() and
-    this = requestUse.asExpr().getExpr()
+    this = requestNode.asSource()
   }
 
-  override DataFlow::Node getAUrlPart() { result = requestUse.getArgument(0) }
+  override DataFlow::Node getAUrlPart() { result = this.getArgument(0) }
 
   override DataFlow::Node getResponseBody() {
     result = requestNode.getAMethodCall(["read", "readlines"])
   }
 
-  override predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
-    exists(DataFlow::Node arg |
-      arg.asExpr() = requestUse.asExpr().(CfgNodes::ExprNodes::MethodCallCfgNode).getAnArgument() and
-      argumentDisablesValidation(arg, disablingNode)
-    )
+  /** Gets the value that controls certificate validation, if any. */
+  DataFlow::Node getCertificateValidationControllingValue() {
+    result = this.getKeywordArgumentIncludeHashArgument("ssl_verify_mode")
+  }
+
+  override predicate disablesCertificateValidation(
+    DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+  ) {
+    any(OpenUriDisablesCertificateValidationConfiguration config)
+        .hasFlow(argumentOrigin, disablingNode) and
+    disablingNode = this.getCertificateValidationControllingValue()
   }
 
   override string getFramework() { result = "OpenURI" }
@@ -56,72 +61,60 @@ class OpenUriRequest extends HTTP::Client::Request::Range {
  * Kernel.open("http://example.com").read
  * ```
  */
-class OpenUriKernelOpenRequest extends HTTP::Client::Request::Range {
-  DataFlow::CallNode requestUse;
-
+class OpenUriKernelOpenRequest extends Http::Client::Request::Range, DataFlow::CallNode {
   OpenUriKernelOpenRequest() {
-    requestUse instanceof KernelMethodCall and
-    this.getMethodName() = "open" and
-    this = requestUse.asExpr().getExpr()
+    this instanceof KernelMethodCall and
+    this.getMethodName() = "open"
   }
 
-  override DataFlow::Node getAUrlPart() { result = requestUse.getArgument(0) }
+  override DataFlow::Node getAUrlPart() { result = this.getArgument(0) }
 
   override DataFlow::CallNode getResponseBody() {
     result.asExpr().getExpr().(MethodCall).getMethodName() in ["read", "readlines"] and
-    requestUse.(DataFlow::LocalSourceNode).flowsTo(result.getReceiver())
+    this.(DataFlow::LocalSourceNode).flowsTo(result.getReceiver())
   }
 
-  override predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
-    exists(DataFlow::Node arg, int i |
-      i > 0 and
-      arg.asExpr() = requestUse.asExpr().(CfgNodes::ExprNodes::MethodCallCfgNode).getArgument(i) and
-      argumentDisablesValidation(arg, disablingNode)
+  /** Gets the value that controls certificate validation, if any. */
+  DataFlow::Node getCertificateValidationControllingValue() {
+    result = this.getKeywordArgument("ssl_verify_mode")
+    or
+    // using a hashliteral
+    exists(
+      DataFlow::LocalSourceNode optionsNode, CfgNodes::ExprNodes::PairCfgNode p, DataFlow::Node key
+    |
+      // can't flow to argument 0, since that's the URL
+      optionsNode.flowsTo(this.getArgument(any(int i | i > 0))) and
+      p = optionsNode.asExpr().(CfgNodes::ExprNodes::HashLiteralCfgNode).getAKeyValuePair() and
+      key.asExpr() = p.getKey() and
+      key.getALocalSource().asExpr().getConstantValue().isStringlikeValue("ssl_verify_mode") and
+      result.asExpr() = p.getValue()
     )
   }
 
+  override predicate disablesCertificateValidation(
+    DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+  ) {
+    any(OpenUriDisablesCertificateValidationConfiguration config)
+        .hasFlow(argumentOrigin, disablingNode) and
+    disablingNode = this.getCertificateValidationControllingValue()
+  }
+
   override string getFramework() { result = "OpenURI" }
 }
 
-/**
- * Holds if the argument `arg` is an options hash that disables certificate
- * validation, and `disablingNode` is the specific node representing the
- * `ssl_verify_mode: OpenSSL::SSL_VERIFY_NONE` pair.
- */
-private predicate argumentDisablesValidation(DataFlow::Node arg, DataFlow::Node disablingNode) {
-  // Either passed as an individual key:value argument, e.g.:
-  // URI.open(..., ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE)
-  isSslVerifyModeNonePair(arg.asExpr()) and
-  disablingNode = arg
-  or
-  // Or as a single hash argument, e.g.:
-  // URI.open(..., { ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE, ... })
-  exists(DataFlow::LocalSourceNode optionsNode, CfgNodes::ExprNodes::PairCfgNode p |
-    p = optionsNode.asExpr().(CfgNodes::ExprNodes::HashLiteralCfgNode).getAKeyValuePair() and
-    isSslVerifyModeNonePair(p) and
-    optionsNode.flowsTo(arg) and
-    disablingNode.asExpr() = p
-  )
-}
+/** A configuration to track values that can disable certificate validation for OpenURI. */
+private class OpenUriDisablesCertificateValidationConfiguration extends DataFlowImplForHttpClientLibraries::Configuration {
+  OpenUriDisablesCertificateValidationConfiguration() {
+    this = "OpenUriDisablesCertificateValidationConfiguration"
+  }
 
-/** Holds if `p` is the pair `ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE`. */
-private predicate isSslVerifyModeNonePair(CfgNodes::ExprNodes::PairCfgNode p) {
-  exists(DataFlow::Node key, DataFlow::Node value |
-    key.asExpr() = p.getKey() and
-    value.asExpr() = p.getValue() and
-    isSslVerifyModeLiteral(key) and
-    value =
-      API::getTopLevelMember("OpenSSL")
-          .getMember("SSL")
-          .getMember("VERIFY_NONE")
-          .getAValueReachableFromSource()
-  )
-}
+  override predicate isSource(DataFlow::Node source) {
+    source = API::getTopLevelMember("OpenSSL").getMember("SSL").getMember("VERIFY_NONE").asSource()
+  }
 
-/** Holds if `node` can represent the symbol literal `:ssl_verify_mode`. */
-private predicate isSslVerifyModeLiteral(DataFlow::Node node) {
-  exists(DataFlow::LocalSourceNode literal |
-    literal.asExpr().getExpr().getConstantValue().isStringlikeValue("ssl_verify_mode") and
-    literal.flowsTo(node)
-  )
+  override predicate isSink(DataFlow::Node sink) {
+    sink = any(OpenUriRequest req).getCertificateValidationControllingValue()
+    or
+    sink = any(OpenUriKernelOpenRequest req).getCertificateValidationControllingValue()
+  }
 }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/RestClient.qll b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/RestClient.qll
index 41e4c1fbcd2..6693f94585a 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/RestClient.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/RestClient.qll
@@ -7,6 +7,7 @@ private import codeql.ruby.CFG
 private import codeql.ruby.Concepts
 private import codeql.ruby.ApiGraphs
 private import codeql.ruby.DataFlow
+private import codeql.ruby.dataflow.internal.DataFlowImplForHttpClientLibraries as DataFlowImplForHttpClientLibraries
 
 /**
  * A call that makes an HTTP request using `RestClient`.
@@ -16,14 +17,12 @@ private import codeql.ruby.DataFlow
  * RestClient::Request.execute(url: "http://example.com").body
  * ```
  */
-class RestClientHttpRequest extends HTTP::Client::Request::Range {
-  DataFlow::CallNode requestUse;
+class RestClientHttpRequest extends Http::Client::Request::Range, DataFlow::CallNode {
   API::Node requestNode;
   API::Node connectionNode;
 
   RestClientHttpRequest() {
-    requestUse = requestNode.asSource() and
-    this = requestUse.asExpr().getExpr() and
+    this = requestNode.asSource() and
     (
       connectionNode =
         [
@@ -39,59 +38,44 @@ class RestClientHttpRequest extends HTTP::Client::Request::Range {
   }
 
   override DataFlow::Node getAUrlPart() {
-    result = requestUse.getKeywordArgument("url")
+    result = this.getKeywordArgument("url")
     or
-    result = requestUse.getArgument(0) and
+    result = this.getArgument(0) and
     // this rules out the alternative above
     not result.asExpr().getExpr() instanceof Pair
   }
 
   override DataFlow::Node getResponseBody() { result = requestNode.getAMethodCall("body") }
 
-  override predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
-    // `RestClient::Resource::new` takes an options hash argument, and we're
-    // looking for `{ verify_ssl: OpenSSL::SSL::VERIFY_NONE }`.
-    exists(DataFlow::Node arg, int i |
-      i > 0 and
-      arg = connectionNode.getAValueReachableFromSource().(DataFlow::CallNode).getArgument(i)
-    |
-      // Either passed as an individual key:value argument, e.g.:
-      // RestClient::Resource.new(..., verify_ssl: OpenSSL::SSL::VERIFY_NONE)
-      isVerifySslNonePair(arg.asExpr()) and
-      disablingNode = arg
-      or
-      // Or as a single hash argument, e.g.:
-      // RestClient::Resource.new(..., { verify_ssl: OpenSSL::SSL::VERIFY_NONE })
-      exists(DataFlow::LocalSourceNode optionsNode, CfgNodes::ExprNodes::PairCfgNode p |
-        p = optionsNode.asExpr().(CfgNodes::ExprNodes::HashLiteralCfgNode).getAKeyValuePair() and
-        isVerifySslNonePair(p) and
-        optionsNode.flowsTo(arg) and
-        disablingNode.asExpr() = p
-      )
+  /** Gets the value that controls certificate validation, if any. */
+  DataFlow::Node getCertificateValidationControllingValue() {
+    exists(DataFlow::CallNode newCall | newCall = connectionNode.getAValueReachableFromSource() |
+      result = newCall.getKeywordArgumentIncludeHashArgument("verify_ssl")
     )
   }
 
+  override predicate disablesCertificateValidation(
+    DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+  ) {
+    any(RestClientDisablesCertificateValidationConfiguration config)
+        .hasFlow(argumentOrigin, disablingNode) and
+    disablingNode = this.getCertificateValidationControllingValue()
+  }
+
   override string getFramework() { result = "RestClient" }
 }
 
-/** Holds if `p` is the pair `verify_ssl: OpenSSL::SSL::VERIFY_NONE`. */
-private predicate isVerifySslNonePair(CfgNodes::ExprNodes::PairCfgNode p) {
-  exists(DataFlow::Node key, DataFlow::Node value |
-    key.asExpr() = p.getKey() and
-    value.asExpr() = p.getValue() and
-    isSslVerifyModeLiteral(key) and
-    value =
-      API::getTopLevelMember("OpenSSL")
-          .getMember("SSL")
-          .getMember("VERIFY_NONE")
-          .getAValueReachableFromSource()
-  )
-}
+/** A configuration to track values that can disable certificate validation for RestClient. */
+private class RestClientDisablesCertificateValidationConfiguration extends DataFlowImplForHttpClientLibraries::Configuration {
+  RestClientDisablesCertificateValidationConfiguration() {
+    this = "RestClientDisablesCertificateValidationConfiguration"
+  }
 
-/** Holds if `node` can represent the symbol literal `:verify_ssl`. */
-private predicate isSslVerifyModeLiteral(DataFlow::Node node) {
-  exists(DataFlow::LocalSourceNode literal |
-    literal.asExpr().getExpr().getConstantValue().isStringlikeValue("verify_ssl") and
-    literal.flowsTo(node)
-  )
+  override predicate isSource(DataFlow::Node source) {
+    source = API::getTopLevelMember("OpenSSL").getMember("SSL").getMember("VERIFY_NONE").asSource()
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink = any(RestClientHttpRequest req).getCertificateValidationControllingValue()
+  }
 }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Typhoeus.qll b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Typhoeus.qll
index 2102e255ce9..f9dcc29a266 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Typhoeus.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/http_clients/Typhoeus.qll
@@ -7,6 +7,7 @@ private import codeql.ruby.CFG
 private import codeql.ruby.Concepts
 private import codeql.ruby.ApiGraphs
 private import codeql.ruby.DataFlow
+private import codeql.ruby.dataflow.internal.DataFlowImplForHttpClientLibraries as DataFlowImplForHttpClientLibraries
 
 /**
  * A call that makes an HTTP request using `Typhoeus`.
@@ -14,68 +15,47 @@ private import codeql.ruby.DataFlow
  * Typhoeus.get("http://example.com").body
  * ```
  */
-class TyphoeusHttpRequest extends HTTP::Client::Request::Range {
-  DataFlow::CallNode requestUse;
+class TyphoeusHttpRequest extends Http::Client::Request::Range, DataFlow::CallNode {
   API::Node requestNode;
 
   TyphoeusHttpRequest() {
-    requestUse = requestNode.asSource() and
+    this = requestNode.asSource() and
     requestNode =
       API::getTopLevelMember("Typhoeus")
-          .getReturn(["get", "head", "delete", "options", "post", "put", "patch"]) and
-    this = requestUse.asExpr().getExpr()
+          .getReturn(["get", "head", "delete", "options", "post", "put", "patch"])
   }
 
-  override DataFlow::Node getAUrlPart() { result = requestUse.getArgument(0) }
+  override DataFlow::Node getAUrlPart() { result = this.getArgument(0) }
 
   override DataFlow::Node getResponseBody() { result = requestNode.getAMethodCall("body") }
 
-  override predicate disablesCertificateValidation(DataFlow::Node disablingNode) {
-    // Check for `ssl_verifypeer: false` in the options hash.
-    exists(DataFlow::Node arg, int i |
-      i > 0 and arg.asExpr().getExpr() = requestUse.asExpr().getExpr().(MethodCall).getArgument(i)
-    |
-      // Either passed as an individual key:value argument, e.g.:
-      // Typhoeus.get(..., ssl_verifypeer: false)
-      isSslVerifyPeerFalsePair(arg.asExpr()) and
-      disablingNode = arg
-      or
-      // Or as a single hash argument, e.g.:
-      // Typhoeus.get(..., { ssl_verifypeer: false, ... })
-      exists(DataFlow::LocalSourceNode optionsNode, CfgNodes::ExprNodes::PairCfgNode p |
-        p = optionsNode.asExpr().(CfgNodes::ExprNodes::HashLiteralCfgNode).getAKeyValuePair() and
-        isSslVerifyPeerFalsePair(p) and
-        optionsNode.flowsTo(arg) and
-        disablingNode.asExpr() = p
-      )
-    )
+  /** Gets the value that controls certificate validation, if any. */
+  DataFlow::Node getCertificateValidationControllingValue() {
+    result = this.getKeywordArgumentIncludeHashArgument("ssl_verifypeer")
+  }
+
+  override predicate disablesCertificateValidation(
+    DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+  ) {
+    any(TyphoeusDisablesCertificateValidationConfiguration config)
+        .hasFlow(argumentOrigin, disablingNode) and
+    disablingNode = this.getCertificateValidationControllingValue()
   }
 
   override string getFramework() { result = "Typhoeus" }
 }
 
-/** Holds if `p` is the pair `ssl_verifypeer: false`. */
-private predicate isSslVerifyPeerFalsePair(CfgNodes::ExprNodes::PairCfgNode p) {
-  exists(DataFlow::Node key, DataFlow::Node value |
-    key.asExpr() = p.getKey() and
-    value.asExpr() = p.getValue() and
-    isSslVerifyPeerLiteral(key) and
-    isFalse(value)
-  )
-}
+/** A configuration to track values that can disable certificate validation for Typhoeus. */
+private class TyphoeusDisablesCertificateValidationConfiguration extends DataFlowImplForHttpClientLibraries::Configuration {
+  TyphoeusDisablesCertificateValidationConfiguration() {
+    this = "TyphoeusDisablesCertificateValidationConfiguration"
+  }
 
-/** Holds if `node` represents the symbol literal `verify` or `verify_peer`. */
-private predicate isSslVerifyPeerLiteral(DataFlow::Node node) {
-  exists(DataFlow::LocalSourceNode literal |
-    literal.asExpr().getExpr().getConstantValue().isStringlikeValue("ssl_verifypeer") and
-    literal.flowsTo(node)
-  )
-}
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr().getExpr().(BooleanLiteral).isFalse()
+  }
 
-/** Holds if `node` can contain the Boolean value `false`. */
-private predicate isFalse(DataFlow::Node node) {
-  exists(DataFlow::LocalSourceNode literal |
-    literal.asExpr().getExpr().(BooleanLiteral).isFalse() and
-    literal.flowsTo(node)
-  )
+  override predicate isSink(DataFlow::Node sink) {
+    sink = any(TyphoeusHttpRequest req).getCertificateValidationControllingValue()
+  }
 }
diff --git a/ruby/ql/lib/codeql/ruby/internal/ConceptsShared.qll b/ruby/ql/lib/codeql/ruby/internal/ConceptsShared.qll
index 027e587d9d3..2f6c8bb8b29 100644
--- a/ruby/ql/lib/codeql/ruby/internal/ConceptsShared.qll
+++ b/ruby/ql/lib/codeql/ruby/internal/ConceptsShared.qll
@@ -87,3 +87,70 @@ module Cryptography {
     predicate isWeak() { this = "ECB" }
   }
 }
+
+/** Provides classes for modeling HTTP-related APIs. */
+module Http {
+  /** Provides classes for modeling HTTP clients. */
+  module Client {
+    /**
+     * A data-flow node that makes an outgoing HTTP request.
+     *
+     * Extend this class to refine existing API models. If you want to model new APIs,
+     * extend `Http::Client::Request::Range` instead.
+     */
+    class Request extends DataFlow::Node instanceof Request::Range {
+      /**
+       * Gets a data-flow node that contributes to the URL of the request.
+       * Depending on the framework, a request may have multiple nodes which contribute to the URL.
+       */
+      DataFlow::Node getAUrlPart() { result = super.getAUrlPart() }
+
+      /** Gets a string that identifies the framework used for this request. */
+      string getFramework() { result = super.getFramework() }
+
+      /**
+       * Holds if this request is made using a mode that disables SSL/TLS
+       * certificate validation, where `disablingNode` represents the point at
+       * which the validation was disabled, and `argumentOrigin` represents the origin
+       * of the argument that disabled the validation (which could be the same node as
+       * `disablingNode`).
+       */
+      predicate disablesCertificateValidation(
+        DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+      ) {
+        super.disablesCertificateValidation(disablingNode, argumentOrigin)
+      }
+    }
+
+    /** Provides a class for modeling new HTTP requests. */
+    module Request {
+      /**
+       * A data-flow node that makes an outgoing HTTP request.
+       *
+       * Extend this class to model new APIs. If you want to refine existing API models,
+       * extend `Http::Client::Request` instead.
+       */
+      abstract class Range extends DataFlow::Node {
+        /**
+         * Gets a data-flow node that contributes to the URL of the request.
+         * Depending on the framework, a request may have multiple nodes which contribute to the URL.
+         */
+        abstract DataFlow::Node getAUrlPart();
+
+        /** Gets a string that identifies the framework used for this request. */
+        abstract string getFramework();
+
+        /**
+         * Holds if this request is made using a mode that disables SSL/TLS
+         * certificate validation, where `disablingNode` represents the point at
+         * which the validation was disabled, and `argumentOrigin` represents the origin
+         * of the argument that disabled the validation (which could be the same node as
+         * `disablingNode`).
+         */
+        abstract predicate disablesCertificateValidation(
+          DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
+        );
+      }
+    }
+  }
+}
diff --git a/ruby/ql/lib/codeql/ruby/security/HardcodedDataInterpretedAsCodeCustomizations.qll b/ruby/ql/lib/codeql/ruby/security/HardcodedDataInterpretedAsCodeCustomizations.qll
new file mode 100644
index 00000000000..d5774dca1dd
--- /dev/null
+++ b/ruby/ql/lib/codeql/ruby/security/HardcodedDataInterpretedAsCodeCustomizations.qll
@@ -0,0 +1,111 @@
+/**
+ * Provides default sources, sinks and sanitizers for reasoning about hard-coded
+ * data being interpreted as code, as well as extension points for adding your
+ * own.
+ */
+
+private import codeql.ruby.DataFlow
+private import codeql.ruby.security.CodeInjectionCustomizations
+private import codeql.ruby.AST as AST
+private import codeql.ruby.controlflow.CfgNodes
+
+/**
+ * Provides default sources, sinks and sanitizers for reasoning about hard-coded
+ * data being interpreted as code, as well as extension points for adding your
+ * own.
+ */
+module HardcodedDataInterpretedAsCode {
+  /**
+   * Flow states used to distinguish value-preserving flow from taint flow.
+   */
+  module FlowState {
+    /** Flow state used to track value-preserving flow. */
+    DataFlow::FlowState data() { result = "data" }
+
+    /** Flow state used to tainted data (non-value preserving flow). */
+    DataFlow::FlowState taint() { result = "taint" }
+  }
+
+  /**
+   * A data flow source for hard-coded data.
+   */
+  abstract class Source extends DataFlow::Node {
+    /** Gets a flow label for which this is a source. */
+    DataFlow::FlowState getLabel() { result = FlowState::data() }
+  }
+
+  /**
+   * A data flow sink for code injection.
+   */
+  abstract class Sink extends DataFlow::Node {
+    /** Gets a description of what kind of sink this is. */
+    abstract string getKind();
+
+    /** Gets a flow label for which this is a sink. */
+    DataFlow::FlowState getLabel() {
+      // We want to ignore value-flow and only consider taint-flow, since the
+      // source is just a hex string, and evaluating that directly will just
+      // cause a syntax error.
+      result = FlowState::taint()
+    }
+  }
+
+  /** A sanitizer for hard-coded data. */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A constant string consisting of eight or more hexadecimal characters (including at
+   * least one digit), viewed as a source of hard-coded data that should not be
+   * interpreted as code.
+   */
+  private class HexStringSource extends Source {
+    HexStringSource() {
+      exists(string val |
+        this.asExpr().(ExprNodes::StringLiteralCfgNode).getConstantValue().isString(val)
+      |
+        val.regexpMatch("[0-9a-fA-F]{8,}") and
+        val.regexpMatch(".*[0-9].*")
+      )
+    }
+  }
+
+  /**
+   * A string literal whose raw text is made up entirely of `\x` escape
+   * sequences, viewed as a source of hard-coded data that should not be
+   * interpreted as code.
+   */
+  private class HexEscapedStringSource extends Source {
+    HexEscapedStringSource() {
+      forex(StringComponentCfgNode c |
+        c = this.asExpr().(ExprNodes::StringlikeLiteralCfgNode).getAComponent()
+      |
+        c.getNode().(AST::StringEscapeSequenceComponent).getRawText().matches("\\x%")
+      )
+    }
+  }
+
+  /**
+   * A code injection sink; hard-coded data should not flow here.
+   */
+  private class DefaultCodeInjectionSink extends Sink {
+    DefaultCodeInjectionSink() { this instanceof CodeInjection::Sink }
+
+    override string getKind() { result = "code" }
+  }
+
+  /**
+   * An argument to `require` path; hard-coded data should not flow here.
+   */
+  private class RequireArgumentSink extends Sink {
+    RequireArgumentSink() {
+      exists(DataFlow::CallNode require |
+        require.getReceiver().getExprNode().getExpr() instanceof AST::SelfVariableAccess and
+        require.getMethodName() = "require"
+      |
+        this = require.getArgument(0)
+      )
+    }
+
+    override string getKind() { result = "an import path" }
+  }
+}
diff --git a/ruby/ql/lib/codeql/ruby/security/HardcodedDataInterpretedAsCodeQuery.qll b/ruby/ql/lib/codeql/ruby/security/HardcodedDataInterpretedAsCodeQuery.qll
new file mode 100644
index 00000000000..98fb0542815
--- /dev/null
+++ b/ruby/ql/lib/codeql/ruby/security/HardcodedDataInterpretedAsCodeQuery.qll
@@ -0,0 +1,48 @@
+/**
+ * Provides a taint-tracking configuration for reasoning about hard-coded data
+ * being interpreted as code.
+ *
+ * Note, for performance reasons: only import this file if
+ * `HardcodedDataInterpretedAsCode::Configuration` is needed, otherwise
+ * `HardcodedDataInterpretedAsCodeCustomizations` should be imported instead.
+ */
+
+private import codeql.ruby.DataFlow
+private import codeql.ruby.TaintTracking
+private import codeql.ruby.dataflow.internal.TaintTrackingPrivate
+import HardcodedDataInterpretedAsCodeCustomizations::HardcodedDataInterpretedAsCode
+
+/**
+ * A taint-tracking configuration for reasoning about hard-coded data
+ * being interpreted as code.
+ *
+ * We extend `DataFlow::Configuration` rather than
+ * `TaintTracking::Configuration`, so that we can set the flow state to
+ * `"taint"` on a taint step.
+ */
+class Configuration extends DataFlow::Configuration {
+  Configuration() { this = "HardcodedDataInterpretedAsCode" }
+
+  override predicate isSource(DataFlow::Node source, DataFlow::FlowState label) {
+    source.(Source).getLabel() = label
+  }
+
+  override predicate isSink(DataFlow::Node sink, DataFlow::FlowState label) {
+    sink.(Sink).getLabel() = label
+  }
+
+  override predicate isBarrier(DataFlow::Node node) {
+    super.isBarrier(node) or
+    node instanceof Sanitizer
+  }
+
+  override predicate isAdditionalFlowStep(
+    DataFlow::Node nodeFrom, DataFlow::FlowState stateFrom, DataFlow::Node nodeTo,
+    DataFlow::FlowState stateTo
+  ) {
+    defaultAdditionalTaintStep(nodeFrom, nodeTo) and
+    // This is a taint step, so the flow state becomes `taint`.
+    stateFrom = [FlowState::data(), FlowState::taint()] and
+    stateTo = FlowState::taint()
+  }
+}
diff --git a/ruby/ql/lib/codeql/ruby/security/HttpToFileAccessSpecific.qll b/ruby/ql/lib/codeql/ruby/security/HttpToFileAccessSpecific.qll
index 1c1ce3437b9..3cbf144d398 100644
--- a/ruby/ql/lib/codeql/ruby/security/HttpToFileAccessSpecific.qll
+++ b/ruby/ql/lib/codeql/ruby/security/HttpToFileAccessSpecific.qll
@@ -12,10 +12,10 @@ private import HttpToFileAccessCustomizations::HttpToFileAccess
 /**
  * An access to a user-controlled HTTP request input, considered as a flow source for writing user-controlled data to files
  */
-private class RequestInputAccessAsSource extends Source instanceof HTTP::Server::RequestInputAccess {
+private class RequestInputAccessAsSource extends Source instanceof Http::Server::RequestInputAccess {
 }
 
 /** A response from an outgoing HTTP request, considered as a flow source for writing user-controlled data to files. */
 private class HttpResponseAsSource extends Source {
-  HttpResponseAsSource() { this = any(HTTP::Client::Request r).getResponseBody() }
+  HttpResponseAsSource() { this = any(Http::Client::Request r).getResponseBody() }
 }
diff --git a/ruby/ql/lib/codeql/ruby/security/InsecureDownloadCustomizations.qll b/ruby/ql/lib/codeql/ruby/security/InsecureDownloadCustomizations.qll
index 045c34f8917..3c718655722 100644
--- a/ruby/ql/lib/codeql/ruby/security/InsecureDownloadCustomizations.qll
+++ b/ruby/ql/lib/codeql/ruby/security/InsecureDownloadCustomizations.qll
@@ -135,7 +135,7 @@ module InsecureDownload {
    * In other words, if the URL is HTTP and the extension is in `unsafeExtension()`.
    */
   private class HttpResponseAsSink extends Sink {
-    private HTTP::Client::Request req;
+    private Http::Client::Request req;
 
     HttpResponseAsSink() {
       this = req.getAUrlPart() and
@@ -143,7 +143,7 @@ module InsecureDownload {
       hasUnsafeExtension(req.getAUrlPart().asExpr().getConstantValue().getString())
     }
 
-    override DataFlow::Node getDownloadCall() { result.asExpr().getExpr() = req }
+    override DataFlow::Node getDownloadCall() { result = req }
 
     override DataFlow::FlowState getALabel() {
       result instanceof Label::SensitiveInsecure
@@ -155,7 +155,7 @@ module InsecureDownload {
   /**
    * Gets a node for the response from `request`, type-tracked using `t`.
    */
-  DataFlow::LocalSourceNode clientRequestResponse(TypeTracker t, HTTP::Client::Request request) {
+  DataFlow::LocalSourceNode clientRequestResponse(TypeTracker t, Http::Client::Request request) {
     t.start() and
     result = request.getResponseBody()
     or
@@ -166,7 +166,7 @@ module InsecureDownload {
    * A url that is downloaded through an insecure connection, where the result ends up being saved to a sensitive location.
    */
   class FileWriteSink extends Sink {
-    HTTP::Client::Request request;
+    Http::Client::Request request;
 
     FileWriteSink() {
       // For example, in:
@@ -193,6 +193,6 @@ module InsecureDownload {
 
     override DataFlow::FlowState getALabel() { result instanceof Label::Insecure }
 
-    override DataFlow::Node getDownloadCall() { result.asExpr().getExpr() = request }
+    override DataFlow::Node getDownloadCall() { result = request }
   }
 }
diff --git a/ruby/ql/lib/codeql/ruby/security/OverlyLargeRangeQuery.qll b/ruby/ql/lib/codeql/ruby/security/OverlyLargeRangeQuery.qll
index f83a6411618..65e662f0bc5 100644
--- a/ruby/ql/lib/codeql/ruby/security/OverlyLargeRangeQuery.qll
+++ b/ruby/ql/lib/codeql/ruby/security/OverlyLargeRangeQuery.qll
@@ -96,7 +96,10 @@ class OverlyWideRange extends RegExpCharacterRange {
       toCodePoint("A") <= high
       or
       // a non-alphanumeric char as part of the range boundaries
-      exists(int bound | bound = [low, high] | not isAlphanumeric(bound.toUnicode()))
+      exists(int bound | bound = [low, high] | not isAlphanumeric(bound.toUnicode())) and
+      // while still being ascii
+      low < 128 and
+      high < 128
     ) and
     // allowlist for known ranges
     not this = allowedWideRanges()
@@ -173,7 +176,7 @@ module RangePrinter {
   }
 
   /** Gets the number of parts we should print for a given `range`. */
-  private int parts(OverlyWideRange range) { result = 1 + strictcount(cutoff(range, _)) }
+  private int parts(OverlyWideRange range) { result = 1 + count(cutoff(range, _)) }
 
   /** Holds if the given part of a range should span from `low` to `high`. */
   private predicate part(OverlyWideRange range, int part, string low, string high) {
diff --git a/ruby/ql/lib/codeql/ruby/security/ServerSideRequestForgeryCustomizations.qll b/ruby/ql/lib/codeql/ruby/security/ServerSideRequestForgeryCustomizations.qll
index 840ced98fc5..30ccee6d986 100644
--- a/ruby/ql/lib/codeql/ruby/security/ServerSideRequestForgeryCustomizations.qll
+++ b/ruby/ql/lib/codeql/ruby/security/ServerSideRequestForgeryCustomizations.qll
@@ -45,7 +45,7 @@ module ServerSideRequestForgery {
 
   /** The URL of an HTTP request, considered as a sink. */
   class HttpRequestAsSink extends Sink {
-    HttpRequestAsSink() { exists(HTTP::Client::Request req | req.getAUrlPart() = this) }
+    HttpRequestAsSink() { exists(Http::Client::Request req | req.getAUrlPart() = this) }
   }
 
   /** A string interpolation with a fixed prefix, considered as a flow sanitizer. */
diff --git a/ruby/ql/lib/codeql/ruby/security/UrlRedirectCustomizations.qll b/ruby/ql/lib/codeql/ruby/security/UrlRedirectCustomizations.qll
index 8fb8ada584e..998bb0ff110 100644
--- a/ruby/ql/lib/codeql/ruby/security/UrlRedirectCustomizations.qll
+++ b/ruby/ql/lib/codeql/ruby/security/UrlRedirectCustomizations.qll
@@ -57,7 +57,7 @@ module UrlRedirect {
    */
   class RedirectLocationAsSink extends Sink {
     RedirectLocationAsSink() {
-      exists(HTTP::Server::HttpRedirectResponse e, MethodBase method |
+      exists(Http::Server::HttpRedirectResponse e, MethodBase method |
         this = e.getRedirectLocation() and
         // We only want handlers for GET requests.
         // Handlers for other HTTP methods are not as vulnerable to URL
diff --git a/ruby/ql/lib/codeql/ruby/security/regexp/ExponentialBackTracking.qll b/ruby/ql/lib/codeql/ruby/security/regexp/ExponentialBackTracking.qll
index 000c247fc71..d006837466b 100644
--- a/ruby/ql/lib/codeql/ruby/security/regexp/ExponentialBackTracking.qll
+++ b/ruby/ql/lib/codeql/ruby/security/regexp/ExponentialBackTracking.qll
@@ -115,6 +115,7 @@ private newtype TStatePair =
 private int rankState(State state) {
   state =
     rank[result](State s, Location l |
+      stateInsideBacktracking(s) and
       l = s.getRepr().getLocation()
     |
       s order by l.getStartLine(), l.getStartColumn(), s.toString()
diff --git a/ruby/ql/lib/codeql/ruby/security/regexp/NfaUtils.qll b/ruby/ql/lib/codeql/ruby/security/regexp/NfaUtils.qll
index fdcb10c2f85..5112bdad11e 100644
--- a/ruby/ql/lib/codeql/ruby/security/regexp/NfaUtils.qll
+++ b/ruby/ql/lib/codeql/ruby/security/regexp/NfaUtils.qll
@@ -93,8 +93,6 @@ class RegExpRoot extends RegExpTerm {
    * Holds if this root term is relevant to the ReDoS analysis.
    */
   predicate isRelevant() {
-    // there is at least one repetition
-    getRoot(any(InfiniteRepetitionQuantifier q)) = this and
     // is actually used as a RegExp
     this.isUsedAsRegExp() and
     // not excluded for library specific reasons
@@ -877,6 +875,107 @@ predicate isStartState(State state) {
  */
 signature predicate isCandidateSig(State state, string pump);
 
+/**
+ * Holds if `state` is a candidate for ReDoS.
+ */
+signature predicate isCandidateSig(State state);
+
+/**
+ * Predicates for constructing a prefix string that leads to a given state.
+ */
+module PrefixConstruction<isCandidateSig/1 isCandidate> {
+  /**
+   * Holds if `state` is the textually last start state for the regular expression.
+   */
+  private predicate lastStartState(RelevantState state) {
+    exists(RegExpRoot root |
+      state =
+        max(RelevantState s, Location l |
+          isStartState(s) and
+          getRoot(s.getRepr()) = root and
+          l = s.getRepr().getLocation()
+        |
+          s
+          order by
+            l.getStartLine(), l.getStartColumn(), s.getRepr().toString(), l.getEndColumn(),
+            l.getEndLine()
+        )
+    )
+  }
+
+  /**
+   * Holds if there exists any transition (Epsilon() or other) from `a` to `b`.
+   */
+  private predicate existsTransition(State a, State b) { delta(a, _, b) }
+
+  /**
+   * Gets the minimum number of transitions it takes to reach `state` from the `start` state.
+   */
+  int prefixLength(State start, State state) =
+    shortestDistances(lastStartState/1, existsTransition/2)(start, state, result)
+
+  /**
+   * Gets the minimum number of transitions it takes to reach `state` from the start state.
+   */
+  private int lengthFromStart(State state) { result = prefixLength(_, state) }
+
+  /**
+   * Gets a string for which the regular expression will reach `state`.
+   *
+   * Has at most one result for any given `state`.
+   * This predicate will not always have a result even if there is a ReDoS issue in
+   * the regular expression.
+   */
+  string prefix(State state) {
+    lastStartState(state) and
+    result = ""
+    or
+    // the search stops past the last redos candidate state.
+    lengthFromStart(state) <= max(lengthFromStart(any(State s | isCandidate(s)))) and
+    exists(State prev |
+      // select a unique predecessor (by an arbitrary measure)
+      prev =
+        min(State s, Location loc |
+          lengthFromStart(s) = lengthFromStart(state) - 1 and
+          loc = s.getRepr().getLocation() and
+          delta(s, _, state)
+        |
+          s
+          order by
+            loc.getStartLine(), loc.getStartColumn(), loc.getEndLine(), loc.getEndColumn(),
+            s.getRepr().toString()
+        )
+    |
+      // greedy search for the shortest prefix
+      result = prefix(prev) and delta(prev, Epsilon(), state)
+      or
+      not delta(prev, Epsilon(), state) and
+      result = prefix(prev) + getCanonicalEdgeChar(prev, state)
+    )
+  }
+
+  /**
+   * Gets a canonical char for which there exists a transition from `prev` to `next` in the NFA.
+   */
+  private string getCanonicalEdgeChar(State prev, State next) {
+    result =
+      min(string c | delta(prev, any(InputSymbol symbol | c = intersect(Any(), symbol)), next))
+  }
+
+  /** A state within a regular expression that contains a candidate state. */
+  class RelevantState instanceof State {
+    RelevantState() {
+      exists(State s | isCandidate(s) | getRoot(s.getRepr()) = getRoot(this.getRepr()))
+    }
+
+    /** Gets a string representation for this state in a regular expression. */
+    string toString() { result = State.super.toString() }
+
+    /** Gets the term represented by this state. */
+    RegExpTerm getRepr() { result = State.super.getRepr() }
+  }
+}
+
 /**
  * A module for pruning candidate ReDoS states.
  * The candidates are specified by the `isCandidate` signature predicate.
@@ -910,95 +1009,11 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
   /** Gets a state that can reach the `accept-any` state using only epsilon steps. */
   private State acceptsAnySuffix() { epsilonSucc*(result) = AcceptAnySuffix(_) }
 
-  /**
-   * Predicates for constructing a prefix string that leads to a given state.
-   */
-  private module PrefixConstruction {
-    /**
-     * Holds if `state` is the textually last start state for the regular expression.
-     */
-    private predicate lastStartState(State state) {
-      exists(RegExpRoot root |
-        state =
-          max(State s, Location l |
-            s = stateInPumpableRegexp() and
-            isStartState(s) and
-            getRoot(s.getRepr()) = root and
-            l = s.getRepr().getLocation()
-          |
-            s
-            order by
-              l.getStartLine(), l.getStartColumn(), s.getRepr().toString(), l.getEndColumn(),
-              l.getEndLine()
-          )
-      )
-    }
+  predicate isCandidateState(State s) { isReDoSCandidate(s, _) }
 
-    /**
-     * Holds if there exists any transition (Epsilon() or other) from `a` to `b`.
-     */
-    private predicate existsTransition(State a, State b) { delta(a, _, b) }
+  import PrefixConstruction<isCandidateState/1> as Prefix
 
-    /**
-     * Gets the minimum number of transitions it takes to reach `state` from the `start` state.
-     */
-    int prefixLength(State start, State state) =
-      shortestDistances(lastStartState/1, existsTransition/2)(start, state, result)
-
-    /**
-     * Gets the minimum number of transitions it takes to reach `state` from the start state.
-     */
-    private int lengthFromStart(State state) { result = prefixLength(_, state) }
-
-    /**
-     * Gets a string for which the regular expression will reach `state`.
-     *
-     * Has at most one result for any given `state`.
-     * This predicate will not always have a result even if there is a ReDoS issue in
-     * the regular expression.
-     */
-    string prefix(State state) {
-      lastStartState(state) and
-      result = ""
-      or
-      // the search stops past the last redos candidate state.
-      lengthFromStart(state) <= max(lengthFromStart(any(State s | isReDoSCandidate(s, _)))) and
-      exists(State prev |
-        // select a unique predecessor (by an arbitrary measure)
-        prev =
-          min(State s, Location loc |
-            lengthFromStart(s) = lengthFromStart(state) - 1 and
-            loc = s.getRepr().getLocation() and
-            delta(s, _, state)
-          |
-            s
-            order by
-              loc.getStartLine(), loc.getStartColumn(), loc.getEndLine(), loc.getEndColumn(),
-              s.getRepr().toString()
-          )
-      |
-        // greedy search for the shortest prefix
-        result = prefix(prev) and delta(prev, Epsilon(), state)
-        or
-        not delta(prev, Epsilon(), state) and
-        result = prefix(prev) + getCanonicalEdgeChar(prev, state)
-      )
-    }
-
-    /**
-     * Gets a canonical char for which there exists a transition from `prev` to `next` in the NFA.
-     */
-    private string getCanonicalEdgeChar(State prev, State next) {
-      result =
-        min(string c | delta(prev, any(InputSymbol symbol | c = intersect(Any(), symbol)), next))
-    }
-
-    /** Gets a state within a regular expression that has a pumpable state. */
-    pragma[noinline]
-    State stateInPumpableRegexp() {
-      exists(State s | isReDoSCandidate(s, _) | getRoot(s.getRepr()) = getRoot(result.getRepr()))
-    }
-  }
+  class RelevantState = Prefix::RelevantState;
 
   /**
    * Predicates for testing the presence of a rejecting suffix.
@@ -1018,8 +1033,6 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
    * using epsilon transitions. But any attempt at repeating `w` will end in a state that accepts all suffixes.
    */
   private module SuffixConstruction {
-    import PrefixConstruction
-
     /**
      * Holds if all states reachable from `fork` by repeating `w`
      * are likely rejectable by appending some suffix.
@@ -1035,32 +1048,26 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * This predicate might find impossible suffixes when searching for suffixes of length > 1, which can cause FPs.
      */
     pragma[noinline]
-    private predicate isLikelyRejectable(State s) {
-      s = stateInPumpableRegexp() and
-      (
-        // exists a reject edge with some char.
-        hasRejectEdge(s)
-        or
-        hasEdgeToLikelyRejectable(s)
-        or
-        // stopping here is rejection
-        isRejectState(s)
-      )
+    private predicate isLikelyRejectable(RelevantState s) {
+      // exists a reject edge with some char.
+      hasRejectEdge(s)
+      or
+      hasEdgeToLikelyRejectable(s)
+      or
+      // stopping here is rejection
+      isRejectState(s)
     }
 
     /**
      * Holds if `s` is not an accept state, and there is no epsilon transition to an accept state.
      */
-    predicate isRejectState(State s) {
-      s = stateInPumpableRegexp() and not epsilonSucc*(s) = Accept(_)
-    }
+    predicate isRejectState(RelevantState s) { not epsilonSucc*(s) = Accept(_) }
 
     /**
      * Holds if there is likely a non-empty suffix leading to rejection starting in `s`.
      */
     pragma[noopt]
-    predicate hasEdgeToLikelyRejectable(State s) {
-      s = stateInPumpableRegexp() and
+    predicate hasEdgeToLikelyRejectable(RelevantState s) {
       // all edges (at least one) with some char leads to another state that is rejectable.
       // the `next` states might not share a common suffix, which can cause FPs.
       exists(string char | char = hasEdgeToLikelyRejectableHelper(s) |
@@ -1075,8 +1082,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * and `s` has not been found to be rejectable by `hasRejectEdge` or `isRejectState`.
      */
     pragma[noinline]
-    private string hasEdgeToLikelyRejectableHelper(State s) {
-      s = stateInPumpableRegexp() and
+    private string hasEdgeToLikelyRejectableHelper(RelevantState s) {
       not hasRejectEdge(s) and
       not isRejectState(s) and
       deltaClosedChar(s, result, _)
@@ -1087,9 +1093,7 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
      * along epsilon edges, such that there is a transition from
      * `prev` to `next` that the character symbol `char`.
      */
-    predicate deltaClosedChar(State prev, string char, State next) {
-      prev = stateInPumpableRegexp() and
-      next = stateInPumpableRegexp() and
+    predicate deltaClosedChar(RelevantState prev, string char, RelevantState next) {
       deltaClosed(prev, getAnInputSymbolMatchingRelevant(char), next)
     }
 
@@ -1099,18 +1103,28 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
       result = getAnInputSymbolMatching(char)
     }
 
+    pragma[noinline]
+    RegExpRoot relevantRoot() {
+      exists(RegExpTerm term, State s |
+        s.getRepr() = term and isCandidateState(s) and result = term.getRootTerm()
+      )
+    }
+
     /**
      * Gets a char used for finding possible suffixes inside `root`.
      */
     pragma[noinline]
     private string relevant(RegExpRoot root) {
-      exists(ascii(result)) and exists(root)
-      or
-      exists(InputSymbol s | belongsTo(s, root) | result = intersect(s, _))
-      or
-      // The characters from `hasSimpleRejectEdge`. Only `\n` is really needed (as `\n` is not in the `ascii` relation).
-      // The three chars must be kept in sync with `hasSimpleRejectEdge`.
-      result = ["|", "\n", "Z"] and exists(root)
+      root = relevantRoot() and
+      (
+        exists(ascii(result)) and exists(root)
+        or
+        exists(InputSymbol s | belongsTo(s, root) | result = intersect(s, _))
+        or
+        // The characters from `hasSimpleRejectEdge`. Only `\n` is really needed (as `\n` is not in the `ascii` relation).
+        // The three chars must be kept in sync with `hasSimpleRejectEdge`.
+        result = ["|", "\n", "Z"] and exists(root)
+      )
     }
 
     /**
@@ -1208,12 +1222,12 @@ module ReDoSPruning<isCandidateSig/2 isCandidate> {
   predicate hasReDoSResult(RegExpTerm t, string pump, State s, string prefixMsg) {
     isReDoSAttackable(t, pump, s) and
     (
-      prefixMsg = "starting with '" + escape(PrefixConstruction::prefix(s)) + "' and " and
-      not PrefixConstruction::prefix(s) = ""
+      prefixMsg = "starting with '" + escape(Prefix::prefix(s)) + "' and " and
+      not Prefix::prefix(s) = ""
       or
-      PrefixConstruction::prefix(s) = "" and prefixMsg = ""
+      Prefix::prefix(s) = "" and prefixMsg = ""
       or
-      not exists(PrefixConstruction::prefix(s)) and prefixMsg = ""
+      not exists(Prefix::prefix(s)) and prefixMsg = ""
     )
   }
 
diff --git a/ruby/ql/lib/codeql/ruby/security/regexp/NfaUtilsSpecific.qll b/ruby/ql/lib/codeql/ruby/security/regexp/NfaUtilsSpecific.qll
index a882faa4838..6392d0f9cd2 100644
--- a/ruby/ql/lib/codeql/ruby/security/regexp/NfaUtilsSpecific.qll
+++ b/ruby/ql/lib/codeql/ruby/security/regexp/NfaUtilsSpecific.qll
@@ -63,14 +63,6 @@ module RegExpFlags {
     root.getLiteral().isIgnoreCase()
   }
 
-  /**
-   * Gets the flags for `root`, or the empty string if `root` has no flags.
-   */
-  string getFlags(RegExpTerm root) {
-    root.isRootTerm() and
-    result = root.getLiteral().getFlags()
-  }
-
   /**
    * Holds if `root` has the `s` flag for multi-line matching.
    */
diff --git a/ruby/ql/lib/codeql/ruby/typetracking/TypeTrackerSpecific.qll b/ruby/ql/lib/codeql/ruby/typetracking/TypeTrackerSpecific.qll
index f7fa8d1189b..148bcc3ad5c 100644
--- a/ruby/ql/lib/codeql/ruby/typetracking/TypeTrackerSpecific.qll
+++ b/ruby/ql/lib/codeql/ruby/typetracking/TypeTrackerSpecific.qll
@@ -67,10 +67,12 @@ private predicate viableParam(
   )
 }
 
-private predicate callStep(ExprNodes::CallCfgNode call, Node nodeFrom, Node nodeTo) {
+/** Holds if there is flow from `arg` to `p` via the call `call`. */
+pragma[nomagic]
+predicate callStep(ExprNodes::CallCfgNode call, Node arg, DataFlowPrivate::ParameterNodeImpl p) {
   exists(DataFlowDispatch::ParameterPosition pos |
-    argumentPositionMatch(call, nodeFrom, pos) and
-    viableParam(call, nodeTo, pos)
+    argumentPositionMatch(call, arg, pos) and
+    viableParam(call, p, pos)
   )
 }
 
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 0645e09464b..eca5abbc407 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -5,3 +5,5 @@ extractor: ruby
 dbscheme: ruby.dbscheme
 upgrades: upgrades
 library: true
+dependencies:
+  codeql/ssa: 0.0.1
diff --git a/ruby/ql/lib/ruby.dbscheme b/ruby/ql/lib/ruby.dbscheme
index 4ba51641799..3595c826de6 100644
--- a/ruby/ql/lib/ruby.dbscheme
+++ b/ruby/ql/lib/ruby.dbscheme
@@ -247,20 +247,16 @@ ruby_binary_def(
   int right: @ruby_underscore_expression ref
 );
 
+ruby_block_body(
+  unique int ruby_block: @ruby_block ref,
+  unique int body: @ruby_block_body ref
+);
+
 ruby_block_parameters(
   unique int ruby_block: @ruby_block ref,
   unique int parameters: @ruby_block_parameters ref
 );
 
-@ruby_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
-
-#keyset[ruby_block, index]
-ruby_block_child(
-  int ruby_block: @ruby_block ref,
-  int index: int ref,
-  unique int child: @ruby_block_child_type ref
-);
-
 ruby_block_def(
   unique int id: @ruby_block
 );
@@ -274,6 +270,19 @@ ruby_block_argument_def(
   unique int id: @ruby_block_argument
 );
 
+@ruby_block_body_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_block_body, index]
+ruby_block_body_child(
+  int ruby_block_body: @ruby_block_body ref,
+  int index: int ref,
+  unique int child: @ruby_block_body_child_type ref
+);
+
+ruby_block_body_def(
+  unique int id: @ruby_block_body
+);
+
 ruby_block_parameter_name(
   unique int ruby_block_parameter: @ruby_block_parameter ref,
   unique int name: @ruby_token_identifier ref
@@ -303,6 +312,19 @@ ruby_block_parameters_def(
   unique int id: @ruby_block_parameters
 );
 
+@ruby_body_statement_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_body_statement, index]
+ruby_body_statement_child(
+  int ruby_body_statement: @ruby_body_statement ref,
+  int index: int ref,
+  unique int child: @ruby_body_statement_child_type ref
+);
+
+ruby_body_statement_def(
+  unique int id: @ruby_body_statement
+);
+
 ruby_break_child(
   unique int ruby_break: @ruby_break ref,
   unique int child: @ruby_argument_list ref
@@ -391,6 +413,11 @@ ruby_chained_string_def(
   unique int id: @ruby_chained_string
 );
 
+ruby_class_body(
+  unique int ruby_class: @ruby_class ref,
+  unique int body: @ruby_body_statement ref
+);
+
 @ruby_class_name_type = @ruby_scope_resolution | @ruby_token_constant
 
 ruby_class_superclass(
@@ -398,15 +425,6 @@ ruby_class_superclass(
   unique int superclass: @ruby_superclass ref
 );
 
-@ruby_class_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
-
-#keyset[ruby_class, index]
-ruby_class_child(
-  int ruby_class: @ruby_class ref,
-  int index: int ref,
-  unique int child: @ruby_class_child_type ref
-);
-
 ruby_class_def(
   unique int id: @ruby_class,
   int name: @ruby_class_name_type ref
@@ -478,20 +496,16 @@ ruby_do_def(
   unique int id: @ruby_do
 );
 
+ruby_do_block_body(
+  unique int ruby_do_block: @ruby_do_block ref,
+  unique int body: @ruby_body_statement ref
+);
+
 ruby_do_block_parameters(
   unique int ruby_do_block: @ruby_do_block ref,
   unique int parameters: @ruby_block_parameters ref
 );
 
-@ruby_do_block_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
-
-#keyset[ruby_do_block, index]
-ruby_do_block_child(
-  int ruby_do_block: @ruby_do_block ref,
-  int index: int ref,
-  unique int child: @ruby_do_block_child_type ref
-);
-
 ruby_do_block_def(
   unique int id: @ruby_do_block
 );
@@ -724,7 +738,7 @@ ruby_in_clause_def(
   int pattern: @ruby_underscore_pattern_top_expr_body ref
 );
 
-@ruby_interpolation_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+@ruby_interpolation_child_type = @ruby_token_empty_statement | @ruby_underscore_nonlocal_variable | @ruby_underscore_statement
 
 #keyset[ruby_interpolation, index]
 ruby_interpolation_child(
@@ -797,20 +811,18 @@ ruby_left_assignment_list_def(
   unique int id: @ruby_left_assignment_list
 );
 
+@ruby_method_body_type = @ruby_body_statement | @ruby_rescue_modifier | @ruby_underscore_arg
+
+ruby_method_body(
+  unique int ruby_method: @ruby_method ref,
+  unique int body: @ruby_method_body_type ref
+);
+
 ruby_method_parameters(
   unique int ruby_method: @ruby_method ref,
   unique int parameters: @ruby_method_parameters ref
 );
 
-@ruby_method_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_arg | @ruby_underscore_statement
-
-#keyset[ruby_method, index]
-ruby_method_child(
-  int ruby_method: @ruby_method ref,
-  int index: int ref,
-  unique int child: @ruby_method_child_type ref
-);
-
 ruby_method_def(
   unique int id: @ruby_method,
   int name: @ruby_underscore_method_name ref
@@ -829,17 +841,13 @@ ruby_method_parameters_def(
   unique int id: @ruby_method_parameters
 );
 
-@ruby_module_name_type = @ruby_scope_resolution | @ruby_token_constant
-
-@ruby_module_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
-
-#keyset[ruby_module, index]
-ruby_module_child(
-  int ruby_module: @ruby_module ref,
-  int index: int ref,
-  unique int child: @ruby_module_child_type ref
+ruby_module_body(
+  unique int ruby_module: @ruby_module ref,
+  unique int body: @ruby_body_statement ref
 );
 
+@ruby_module_name_type = @ruby_scope_resolution | @ruby_token_constant
+
 ruby_module_def(
   unique int id: @ruby_module,
   int name: @ruby_module_name_type ref
@@ -1074,13 +1082,9 @@ ruby_setter_def(
   int name: @ruby_token_identifier ref
 );
 
-@ruby_singleton_class_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
-
-#keyset[ruby_singleton_class, index]
-ruby_singleton_class_child(
-  int ruby_singleton_class: @ruby_singleton_class ref,
-  int index: int ref,
-  unique int child: @ruby_singleton_class_child_type ref
+ruby_singleton_class_body(
+  unique int ruby_singleton_class: @ruby_singleton_class ref,
+  unique int body: @ruby_body_statement ref
 );
 
 ruby_singleton_class_def(
@@ -1088,6 +1092,13 @@ ruby_singleton_class_def(
   int value: @ruby_underscore_arg ref
 );
 
+@ruby_singleton_method_body_type = @ruby_body_statement | @ruby_rescue_modifier | @ruby_underscore_arg
+
+ruby_singleton_method_body(
+  unique int ruby_singleton_method: @ruby_singleton_method ref,
+  unique int body: @ruby_singleton_method_body_type ref
+);
+
 @ruby_singleton_method_object_type = @ruby_underscore_arg | @ruby_underscore_variable
 
 ruby_singleton_method_parameters(
@@ -1095,15 +1106,6 @@ ruby_singleton_method_parameters(
   unique int parameters: @ruby_method_parameters ref
 );
 
-@ruby_singleton_method_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_arg | @ruby_underscore_statement
-
-#keyset[ruby_singleton_method, index]
-ruby_singleton_method_child(
-  int ruby_singleton_method: @ruby_singleton_method ref,
-  int index: int ref,
-  unique int child: @ruby_singleton_method_child_type ref
-);
-
 ruby_singleton_method_def(
   unique int id: @ruby_singleton_method,
   int name: @ruby_underscore_method_name ref,
@@ -1344,7 +1346,7 @@ case @ruby_token.kind of
 ;
 
 
-@ruby_ast_node = @ruby_alias | @ruby_alternative_pattern | @ruby_argument_list | @ruby_array | @ruby_array_pattern | @ruby_as_pattern | @ruby_assignment | @ruby_bare_string | @ruby_bare_symbol | @ruby_begin | @ruby_begin_block | @ruby_binary | @ruby_block | @ruby_block_argument | @ruby_block_parameter | @ruby_block_parameters | @ruby_break | @ruby_call | @ruby_case__ | @ruby_case_match | @ruby_chained_string | @ruby_class | @ruby_complex | @ruby_conditional | @ruby_delimited_symbol | @ruby_destructured_left_assignment | @ruby_destructured_parameter | @ruby_do | @ruby_do_block | @ruby_element_reference | @ruby_else | @ruby_elsif | @ruby_end_block | @ruby_ensure | @ruby_exception_variable | @ruby_exceptions | @ruby_expression_reference_pattern | @ruby_find_pattern | @ruby_for | @ruby_hash | @ruby_hash_pattern | @ruby_hash_splat_argument | @ruby_hash_splat_parameter | @ruby_heredoc_body | @ruby_if | @ruby_if_guard | @ruby_if_modifier | @ruby_in | @ruby_in_clause | @ruby_interpolation | @ruby_keyword_parameter | @ruby_keyword_pattern | @ruby_lambda | @ruby_lambda_parameters | @ruby_left_assignment_list | @ruby_method | @ruby_method_parameters | @ruby_module | @ruby_next | @ruby_operator_assignment | @ruby_optional_parameter | @ruby_pair | @ruby_parenthesized_pattern | @ruby_parenthesized_statements | @ruby_pattern | @ruby_program | @ruby_range | @ruby_rational | @ruby_redo | @ruby_regex | @ruby_rescue | @ruby_rescue_modifier | @ruby_rest_assignment | @ruby_retry | @ruby_return | @ruby_right_assignment_list | @ruby_scope_resolution | @ruby_setter | @ruby_singleton_class | @ruby_singleton_method | @ruby_splat_argument | @ruby_splat_parameter | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_superclass | @ruby_symbol_array | @ruby_then | @ruby_token | @ruby_unary | @ruby_undef | @ruby_unless | @ruby_unless_guard | @ruby_unless_modifier | @ruby_until | @ruby_until_modifier | @ruby_variable_reference_pattern | @ruby_when | @ruby_while | @ruby_while_modifier | @ruby_yield
+@ruby_ast_node = @ruby_alias | @ruby_alternative_pattern | @ruby_argument_list | @ruby_array | @ruby_array_pattern | @ruby_as_pattern | @ruby_assignment | @ruby_bare_string | @ruby_bare_symbol | @ruby_begin | @ruby_begin_block | @ruby_binary | @ruby_block | @ruby_block_argument | @ruby_block_body | @ruby_block_parameter | @ruby_block_parameters | @ruby_body_statement | @ruby_break | @ruby_call | @ruby_case__ | @ruby_case_match | @ruby_chained_string | @ruby_class | @ruby_complex | @ruby_conditional | @ruby_delimited_symbol | @ruby_destructured_left_assignment | @ruby_destructured_parameter | @ruby_do | @ruby_do_block | @ruby_element_reference | @ruby_else | @ruby_elsif | @ruby_end_block | @ruby_ensure | @ruby_exception_variable | @ruby_exceptions | @ruby_expression_reference_pattern | @ruby_find_pattern | @ruby_for | @ruby_hash | @ruby_hash_pattern | @ruby_hash_splat_argument | @ruby_hash_splat_parameter | @ruby_heredoc_body | @ruby_if | @ruby_if_guard | @ruby_if_modifier | @ruby_in | @ruby_in_clause | @ruby_interpolation | @ruby_keyword_parameter | @ruby_keyword_pattern | @ruby_lambda | @ruby_lambda_parameters | @ruby_left_assignment_list | @ruby_method | @ruby_method_parameters | @ruby_module | @ruby_next | @ruby_operator_assignment | @ruby_optional_parameter | @ruby_pair | @ruby_parenthesized_pattern | @ruby_parenthesized_statements | @ruby_pattern | @ruby_program | @ruby_range | @ruby_rational | @ruby_redo | @ruby_regex | @ruby_rescue | @ruby_rescue_modifier | @ruby_rest_assignment | @ruby_retry | @ruby_return | @ruby_right_assignment_list | @ruby_scope_resolution | @ruby_setter | @ruby_singleton_class | @ruby_singleton_method | @ruby_splat_argument | @ruby_splat_parameter | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_superclass | @ruby_symbol_array | @ruby_then | @ruby_token | @ruby_unary | @ruby_undef | @ruby_unless | @ruby_unless_guard | @ruby_unless_modifier | @ruby_until | @ruby_until_modifier | @ruby_variable_reference_pattern | @ruby_when | @ruby_while | @ruby_while_modifier | @ruby_yield
 
 @ruby_ast_node_parent = @file | @ruby_ast_node
 
diff --git a/ruby/ql/lib/ruby.dbscheme.stats b/ruby/ql/lib/ruby.dbscheme.stats
index 782ae4db56b..4a594923a20 100644
--- a/ruby/ql/lib/ruby.dbscheme.stats
+++ b/ruby/ql/lib/ruby.dbscheme.stats
@@ -5,7 +5,7 @@
         </e>
         <e>
             <k>@diagnostic_error</k>
-            <v>155</v>
+            <v>130</v>
         </e>
         <e>
             <k>@diagnostic_info</k>
@@ -21,7 +21,7 @@
         </e>
         <e>
             <k>@erb_directive</k>
-            <v>1414</v>
+            <v>1400</v>
         </e>
         <e>
             <k>@erb_graphql_directive</k>
@@ -29,19 +29,19 @@
         </e>
         <e>
             <k>@erb_output_directive</k>
-            <v>3806</v>
+            <v>3859</v>
         </e>
         <e>
             <k>@erb_reserved_word</k>
-            <v>10441</v>
+            <v>10520</v>
         </e>
         <e>
             <k>@erb_template</k>
-            <v>1563</v>
+            <v>1540</v>
         </e>
         <e>
             <k>@erb_token_code</k>
-            <v>5220</v>
+            <v>5260</v>
         </e>
         <e>
             <k>@erb_token_comment</k>
@@ -49,23 +49,23 @@
         </e>
         <e>
             <k>@erb_token_content</k>
-            <v>3761</v>
+            <v>5478</v>
         </e>
         <e>
             <k>@file</k>
-            <v>17168</v>
+            <v>17206</v>
         </e>
         <e>
             <k>@folder</k>
-            <v>4792</v>
+            <v>4799</v>
         </e>
         <e>
             <k>@location_default</k>
-            <v>8508604</v>
+            <v>8706731</v>
         </e>
-    <e>
+        <e>
             <k>@ruby_alias</k>
-            <v>1244</v>
+            <v>1264</v>
         </e>
         <e>
             <k>@ruby_alternative_pattern</k>
@@ -73,11 +73,11 @@
         </e>
         <e>
             <k>@ruby_argument_list</k>
-            <v>664517</v>
+            <v>670202</v>
         </e>
         <e>
             <k>@ruby_array</k>
-            <v>245561</v>
+            <v>246221</v>
         </e>
         <e>
             <k>@ruby_array_pattern</k>
@@ -89,19 +89,19 @@
         </e>
         <e>
             <k>@ruby_assignment</k>
-            <v>130246</v>
+            <v>131940</v>
         </e>
         <e>
             <k>@ruby_bare_string</k>
-            <v>11487</v>
+            <v>11622</v>
         </e>
         <e>
             <k>@ruby_bare_symbol</k>
-            <v>2106</v>
+            <v>2085</v>
         </e>
         <e>
             <k>@ruby_begin</k>
-            <v>2523</v>
+            <v>2549</v>
         </e>
         <e>
             <k>@ruby_begin_block</k>
@@ -109,87 +109,87 @@
         </e>
         <e>
             <k>@ruby_binary_ampersand</k>
-            <v>474</v>
+            <v>491</v>
         </e>
         <e>
             <k>@ruby_binary_ampersandampersand</k>
-            <v>8700</v>
+            <v>8705</v>
         </e>
         <e>
             <k>@ruby_binary_and</k>
-            <v>1348</v>
+            <v>1182</v>
         </e>
         <e>
             <k>@ruby_binary_bangequal</k>
-            <v>1586</v>
+            <v>1584</v>
         </e>
         <e>
             <k>@ruby_binary_bangtilde</k>
-            <v>178</v>
+            <v>177</v>
         </e>
         <e>
             <k>@ruby_binary_caret</k>
-            <v>155</v>
+            <v>157</v>
         </e>
         <e>
             <k>@ruby_binary_equalequal</k>
-            <v>31159</v>
+            <v>31539</v>
         </e>
         <e>
             <k>@ruby_binary_equalequalequal</k>
-            <v>603</v>
+            <v>631</v>
         </e>
         <e>
             <k>@ruby_binary_equaltilde</k>
-            <v>1820</v>
+            <v>1804</v>
         </e>
         <e>
             <k>@ruby_binary_langle</k>
-            <v>1334</v>
+            <v>1327</v>
         </e>
         <e>
             <k>@ruby_binary_langleequal</k>
-            <v>368</v>
+            <v>377</v>
         </e>
         <e>
             <k>@ruby_binary_langleequalrangle</k>
-            <v>749</v>
+            <v>758</v>
         </e>
         <e>
             <k>@ruby_binary_langlelangle</k>
-            <v>10368</v>
+            <v>10536</v>
         </e>
         <e>
             <k>@ruby_binary_minus</k>
-            <v>2381</v>
+            <v>2409</v>
         </e>
         <e>
             <k>@ruby_binary_or</k>
-            <v>665</v>
+            <v>622</v>
         </e>
         <e>
             <k>@ruby_binary_percent</k>
-            <v>1009</v>
+            <v>1017</v>
         </e>
         <e>
             <k>@ruby_binary_pipe</k>
-            <v>968</v>
+            <v>969</v>
         </e>
         <e>
             <k>@ruby_binary_pipepipe</k>
-            <v>8001</v>
+            <v>7935</v>
         </e>
         <e>
             <k>@ruby_binary_plus</k>
-            <v>6116</v>
+            <v>6173</v>
         </e>
         <e>
             <k>@ruby_binary_rangle</k>
-            <v>2400</v>
+            <v>2374</v>
         </e>
         <e>
             <k>@ruby_binary_rangleequal</k>
-            <v>558</v>
+            <v>575</v>
         </e>
         <e>
             <k>@ruby_binary_ranglerangle</k>
@@ -197,43 +197,51 @@
         </e>
         <e>
             <k>@ruby_binary_slash</k>
-            <v>1248</v>
+            <v>1257</v>
         </e>
         <e>
             <k>@ruby_binary_star</k>
-            <v>3286</v>
+            <v>3328</v>
         </e>
         <e>
             <k>@ruby_binary_starstar</k>
-            <v>1316</v>
+            <v>1332</v>
         </e>
         <e>
             <k>@ruby_block</k>
-            <v>97359</v>
+            <v>98296</v>
         </e>
         <e>
             <k>@ruby_block_argument</k>
-            <v>6050</v>
+            <v>6115</v>
+        </e>
+        <e>
+            <k>@ruby_block_body</k>
+            <v>97983</v>
         </e>
         <e>
             <k>@ruby_block_parameter</k>
-            <v>2410</v>
+            <v>2442</v>
         </e>
         <e>
             <k>@ruby_block_parameters</k>
-            <v>23336</v>
+            <v>23772</v>
+        </e>
+        <e>
+            <k>@ruby_body_statement</k>
+            <v>201560</v>
         </e>
         <e>
             <k>@ruby_break</k>
-            <v>3338</v>
+            <v>3355</v>
         </e>
         <e>
             <k>@ruby_call</k>
-            <v>965401</v>
+            <v>974897</v>
         </e>
         <e>
             <k>@ruby_case__</k>
-            <v>1219</v>
+            <v>1224</v>
         </e>
         <e>
             <k>@ruby_case_match</k>
@@ -241,11 +249,11 @@
         </e>
         <e>
             <k>@ruby_chained_string</k>
-            <v>885</v>
+            <v>877</v>
         </e>
         <e>
             <k>@ruby_class</k>
-            <v>16841</v>
+            <v>16946</v>
         </e>
         <e>
             <k>@ruby_complex</k>
@@ -253,11 +261,11 @@
         </e>
         <e>
             <k>@ruby_conditional</k>
-            <v>3464</v>
+            <v>3495</v>
         </e>
         <e>
             <k>@ruby_delimited_symbol</k>
-            <v>1257</v>
+            <v>1264</v>
         </e>
         <e>
             <k>@ruby_destructured_left_assignment</k>
@@ -269,23 +277,23 @@
         </e>
         <e>
             <k>@ruby_do</k>
-            <v>1610</v>
+            <v>1632</v>
         </e>
         <e>
             <k>@ruby_do_block</k>
-            <v>137435</v>
+            <v>138119</v>
         </e>
         <e>
             <k>@ruby_element_reference</k>
-            <v>82234</v>
+            <v>82869</v>
         </e>
         <e>
             <k>@ruby_else</k>
-            <v>6933</v>
+            <v>7138</v>
         </e>
         <e>
             <k>@ruby_elsif</k>
-            <v>1595</v>
+            <v>1578</v>
         </e>
         <e>
             <k>@ruby_end_block</k>
@@ -293,15 +301,15 @@
         </e>
         <e>
             <k>@ruby_ensure</k>
-            <v>3718</v>
+            <v>3803</v>
         </e>
         <e>
             <k>@ruby_exception_variable</k>
-            <v>1001</v>
+            <v>991</v>
         </e>
         <e>
             <k>@ruby_exceptions</k>
-            <v>1639</v>
+            <v>1654</v>
         </e>
         <e>
             <k>@ruby_expression_reference_pattern</k>
@@ -317,7 +325,7 @@
         </e>
         <e>
             <k>@ruby_hash</k>
-            <v>39413</v>
+            <v>39640</v>
         </e>
         <e>
             <k>@ruby_hash_pattern</k>
@@ -325,19 +333,19 @@
         </e>
         <e>
             <k>@ruby_hash_splat_argument</k>
-            <v>1856</v>
+            <v>1857</v>
         </e>
         <e>
             <k>@ruby_hash_splat_parameter</k>
-            <v>1355</v>
+            <v>1447</v>
         </e>
         <e>
             <k>@ruby_heredoc_body</k>
-            <v>5575</v>
+            <v>5789</v>
         </e>
         <e>
             <k>@ruby_if</k>
-            <v>18392</v>
+            <v>18341</v>
         </e>
         <e>
             <k>@ruby_if_guard</k>
@@ -345,7 +353,7 @@
         </e>
         <e>
             <k>@ruby_if_modifier</k>
-            <v>13620</v>
+            <v>13708</v>
         </e>
         <e>
             <k>@ruby_in</k>
@@ -357,11 +365,11 @@
         </e>
         <e>
             <k>@ruby_interpolation</k>
-            <v>38208</v>
+            <v>38051</v>
         </e>
         <e>
             <k>@ruby_keyword_parameter</k>
-            <v>3794</v>
+            <v>3939</v>
         </e>
         <e>
             <k>@ruby_keyword_pattern</k>
@@ -369,31 +377,31 @@
         </e>
         <e>
             <k>@ruby_lambda</k>
-            <v>7472</v>
+            <v>7557</v>
         </e>
         <e>
             <k>@ruby_lambda_parameters</k>
-            <v>1664</v>
+            <v>1665</v>
         </e>
         <e>
             <k>@ruby_left_assignment_list</k>
-            <v>2873</v>
+            <v>2910</v>
         </e>
         <e>
             <k>@ruby_method</k>
-            <v>98356</v>
+            <v>99525</v>
         </e>
         <e>
             <k>@ruby_method_parameters</k>
-            <v>28861</v>
+            <v>29417</v>
         </e>
         <e>
             <k>@ruby_module</k>
-            <v>21557</v>
+            <v>21589</v>
         </e>
         <e>
             <k>@ruby_next</k>
-            <v>2005</v>
+            <v>2021</v>
         </e>
         <e>
             <k>@ruby_operator_assignment_ampersandampersandequal</k>
@@ -401,7 +409,7 @@
         </e>
         <e>
             <k>@ruby_operator_assignment_ampersandequal</k>
-            <v>16</v>
+            <v>17</v>
         </e>
         <e>
             <k>@ruby_operator_assignment_caretequal</k>
@@ -413,23 +421,23 @@
         </e>
         <e>
             <k>@ruby_operator_assignment_minusequal</k>
-            <v>292</v>
+            <v>294</v>
         </e>
         <e>
             <k>@ruby_operator_assignment_percentequal</k>
-            <v>25</v>
+            <v>26</v>
         </e>
         <e>
             <k>@ruby_operator_assignment_pipeequal</k>
-            <v>138</v>
+            <v>142</v>
         </e>
         <e>
             <k>@ruby_operator_assignment_pipepipeequal</k>
-            <v>4611</v>
+            <v>4545</v>
         </e>
         <e>
             <k>@ruby_operator_assignment_plusequal</k>
-            <v>1759</v>
+            <v>1732</v>
         </e>
         <e>
             <k>@ruby_operator_assignment_ranglerangleequal</k>
@@ -437,11 +445,11 @@
         </e>
         <e>
             <k>@ruby_operator_assignment_slashequal</k>
-            <v>12</v>
+            <v>13</v>
         </e>
         <e>
             <k>@ruby_operator_assignment_starequal</k>
-            <v>49</v>
+            <v>50</v>
         </e>
         <e>
             <k>@ruby_operator_assignment_starstarequal</k>
@@ -449,11 +457,11 @@
         </e>
         <e>
             <k>@ruby_optional_parameter</k>
-            <v>6435</v>
+            <v>6540</v>
         </e>
         <e>
             <k>@ruby_pair</k>
-            <v>235158</v>
+            <v>237637</v>
         </e>
         <e>
             <k>@ruby_parenthesized_pattern</k>
@@ -461,27 +469,27 @@
         </e>
         <e>
             <k>@ruby_parenthesized_statements</k>
-            <v>10247</v>
+            <v>10510</v>
         </e>
         <e>
             <k>@ruby_pattern</k>
-            <v>3895</v>
+            <v>3918</v>
         </e>
         <e>
             <k>@ruby_program</k>
-            <v>17142</v>
+            <v>17193</v>
         </e>
         <e>
             <k>@ruby_range_dotdot</k>
-            <v>2831</v>
+            <v>2976</v>
         </e>
         <e>
             <k>@ruby_range_dotdotdot</k>
-            <v>1356</v>
+            <v>1459</v>
         </e>
         <e>
             <k>@ruby_rational</k>
-            <v>123</v>
+            <v>124</v>
         </e>
         <e>
             <k>@ruby_redo</k>
@@ -489,99 +497,99 @@
         </e>
         <e>
             <k>@ruby_regex</k>
-            <v>12854</v>
+            <v>13096</v>
         </e>
         <e>
             <k>@ruby_rescue</k>
-            <v>2061</v>
+            <v>2085</v>
         </e>
         <e>
             <k>@ruby_rescue_modifier</k>
-            <v>525</v>
+            <v>519</v>
         </e>
         <e>
             <k>@ruby_reserved_word</k>
-            <v>3667249</v>
+            <v>3700878</v>
         </e>
         <e>
             <k>@ruby_rest_assignment</k>
-            <v>398</v>
+            <v>399</v>
         </e>
         <e>
             <k>@ruby_retry</k>
-            <v>56</v>
+            <v>59</v>
         </e>
         <e>
             <k>@ruby_return</k>
-            <v>8495</v>
+            <v>8486</v>
         </e>
         <e>
             <k>@ruby_right_assignment_list</k>
-            <v>1288</v>
+            <v>1274</v>
         </e>
         <e>
             <k>@ruby_scope_resolution</k>
-            <v>80009</v>
+            <v>81024</v>
         </e>
         <e>
             <k>@ruby_setter</k>
-            <v>598</v>
+            <v>601</v>
         </e>
         <e>
             <k>@ruby_singleton_class</k>
-            <v>620</v>
+            <v>635</v>
         </e>
         <e>
             <k>@ruby_singleton_method</k>
-            <v>6539</v>
+            <v>6692</v>
         </e>
         <e>
             <k>@ruby_splat_argument</k>
-            <v>3046</v>
+            <v>3093</v>
         </e>
         <e>
             <k>@ruby_splat_parameter</k>
-            <v>2905</v>
+            <v>2978</v>
         </e>
         <e>
             <k>@ruby_string__</k>
-            <v>473533</v>
+            <v>476418</v>
         </e>
         <e>
             <k>@ruby_string_array</k>
-            <v>3840</v>
+            <v>3913</v>
         </e>
         <e>
             <k>@ruby_subshell</k>
-            <v>403</v>
+            <v>393</v>
         </e>
         <e>
             <k>@ruby_superclass</k>
-            <v>13318</v>
+            <v>13378</v>
         </e>
         <e>
             <k>@ruby_symbol_array</k>
-            <v>463</v>
+            <v>460</v>
         </e>
         <e>
             <k>@ruby_then</k>
-            <v>24329</v>
+            <v>24194</v>
         </e>
         <e>
             <k>@ruby_token_character</k>
-            <v>437</v>
+            <v>439</v>
         </e>
         <e>
             <k>@ruby_token_class_variable</k>
-            <v>857</v>
+            <v>858</v>
         </e>
         <e>
             <k>@ruby_token_comment</k>
-            <v>180978</v>
+            <v>182145</v>
         </e>
         <e>
             <k>@ruby_token_constant</k>
-            <v>283898</v>
+            <v>285989</v>
         </e>
         <e>
             <k>@ruby_token_empty_statement</k>
@@ -593,11 +601,11 @@
         </e>
         <e>
             <k>@ruby_token_escape_sequence</k>
-            <v>75715</v>
+            <v>76101</v>
         </e>
         <e>
             <k>@ruby_token_false</k>
-            <v>16909</v>
+            <v>17332</v>
         </e>
         <e>
             <k>@ruby_token_file</k>
@@ -605,23 +613,23 @@
         </e>
         <e>
             <k>@ruby_token_float</k>
-            <v>7830</v>
+            <v>7894</v>
         </e>
         <e>
             <k>@ruby_token_forward_argument</k>
-            <v>72</v>
+            <v>71</v>
         </e>
         <e>
             <k>@ruby_token_forward_parameter</k>
-            <v>94</v>
+            <v>111</v>
         </e>
         <e>
             <k>@ruby_token_global_variable</k>
-            <v>7057</v>
+            <v>7235</v>
         </e>
         <e>
             <k>@ruby_token_hash_key_symbol</k>
-            <v>228509</v>
+            <v>231030</v>
         </e>
         <e>
             <k>@ruby_token_hash_splat_nil</k>
@@ -629,27 +637,27 @@
         </e>
         <e>
             <k>@ruby_token_heredoc_beginning</k>
-            <v>5600</v>
+            <v>5789</v>
         </e>
         <e>
             <k>@ruby_token_heredoc_content</k>
-            <v>12542</v>
+            <v>12722</v>
         </e>
         <e>
             <k>@ruby_token_heredoc_end</k>
-            <v>5575</v>
+            <v>5789</v>
         </e>
         <e>
             <k>@ruby_token_identifier</k>
-            <v>1483080</v>
+            <v>1498233</v>
         </e>
         <e>
             <k>@ruby_token_instance_variable</k>
-            <v>81049</v>
+            <v>84088</v>
         </e>
         <e>
             <k>@ruby_token_integer</k>
-            <v>298658</v>
+            <v>300415</v>
         </e>
         <e>
             <k>@ruby_token_line</k>
@@ -657,31 +665,31 @@
         </e>
         <e>
             <k>@ruby_token_nil</k>
-            <v>17920</v>
+            <v>18114</v>
         </e>
         <e>
             <k>@ruby_token_operator</k>
-            <v>781</v>
+            <v>803</v>
         </e>
         <e>
             <k>@ruby_token_self</k>
-            <v>12958</v>
+            <v>13236</v>
         </e>
         <e>
             <k>@ruby_token_simple_symbol</k>
-            <v>249119</v>
+            <v>252789</v>
         </e>
         <e>
             <k>@ruby_token_string_content</k>
-            <v>488016</v>
+            <v>491238</v>
         </e>
         <e>
             <k>@ruby_token_super</k>
-            <v>5058</v>
+            <v>5049</v>
         </e>
         <e>
             <k>@ruby_token_true</k>
-            <v>23298</v>
+            <v>23791</v>
         </e>
         <e>
             <k>@ruby_token_uninterpreted</k>
@@ -689,35 +697,35 @@
         </e>
         <e>
             <k>@ruby_unary_bang</k>
-            <v>5788</v>
+            <v>5826</v>
         </e>
         <e>
             <k>@ruby_unary_definedquestion</k>
-            <v>1312</v>
+            <v>1320</v>
         </e>
         <e>
             <k>@ruby_unary_minus</k>
-            <v>9122</v>
+            <v>9472</v>
         </e>
         <e>
             <k>@ruby_unary_not</k>
-            <v>236</v>
+            <v>190</v>
         </e>
         <e>
             <k>@ruby_unary_plus</k>
-            <v>1386</v>
+            <v>1416</v>
         </e>
         <e>
             <k>@ruby_unary_tilde</k>
-            <v>88</v>
+            <v>89</v>
         </e>
         <e>
             <k>@ruby_undef</k>
-            <v>180</v>
+            <v>181</v>
         </e>
         <e>
             <k>@ruby_unless</k>
-            <v>2578</v>
+            <v>2594</v>
         </e>
         <e>
             <k>@ruby_unless_guard</k>
@@ -725,15 +733,15 @@
         </e>
         <e>
             <k>@ruby_unless_modifier</k>
-            <v>4207</v>
+            <v>4163</v>
         </e>
         <e>
             <k>@ruby_until</k>
-            <v>113</v>
+            <v>121</v>
         </e>
         <e>
             <k>@ruby_until_modifier</k>
-            <v>206</v>
+            <v>223</v>
         </e>
         <e>
             <k>@ruby_variable_reference_pattern</k>
@@ -741,32 +749,32 @@
         </e>
         <e>
             <k>@ruby_when</k>
-            <v>3239</v>
+            <v>3248</v>
         </e>
         <e>
             <k>@ruby_while</k>
-            <v>1335</v>
+            <v>1349</v>
         </e>
         <e>
             <k>@ruby_while_modifier</k>
-            <v>179</v>
+            <v>190</v>
         </e>
         <e>
             <k>@ruby_yield</k>
-            <v>2385</v>
+            <v>2389</v>
         </e>
         </typesizes>
   <stats><relation>
             <name>containerparent</name>
-            <cardinality>21934</cardinality>
+            <cardinality>21979</cardinality>
             <columnsizes>
                 <e>
                     <k>parent</k>
-                    <v>4792</v>
+                    <v>4799</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>21934</v>
+                    <v>21979</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -780,37 +788,37 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2142</v>
+                                    <v>2145</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>909</v>
+                                    <v>910</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>441</v>
+                                    <v>442</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>298</v>
+                                    <v>299</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>7</b>
-                                    <v>376</v>
+                                    <v>377</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>13</b>
-                                    <v>389</v>
+                                    <v>390</v>
                                 </b>
                                 <b>
                                     <a>13</a>
                                     <b>124</b>
-                                    <v>233</v>
+                                    <v>234</v>
                                 </b>
                             </bs>
                         </hist>
@@ -826,7 +834,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>21934</v>
+                                    <v>21979</v>
                                 </b>
                             </bs>
                         </hist>
@@ -836,31 +844,31 @@
         </relation>
         <relation>
             <name>diagnostics</name>
-            <cardinality>155</cardinality>
+            <cardinality>130</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>155</v>
+                    <v>130</v>
                 </e>
                 <e>
                     <k>severity</k>
-                    <v>12</v>
+                    <v>13</v>
                 </e>
                 <e>
                     <k>error_tag</k>
-                    <v>12</v>
+                    <v>13</v>
                 </e>
                 <e>
                     <k>error_message</k>
-                    <v>25</v>
+                    <v>26</v>
                 </e>
                 <e>
                     <k>full_error_message</k>
-                    <v>129</v>
+                    <v>104</v>
                 </e>
                 <e>
                     <k>location</k>
-                    <v>155</v>
+                    <v>130</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -874,7 +882,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>155</v>
+                                    <v>130</v>
                                 </b>
                             </bs>
                         </hist>
@@ -890,7 +898,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>155</v>
+                                    <v>130</v>
                                 </b>
                             </bs>
                         </hist>
@@ -906,7 +914,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>155</v>
+                                    <v>130</v>
                                 </b>
                             </bs>
                         </hist>
@@ -922,7 +930,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>155</v>
+                                    <v>130</v>
                                 </b>
                             </bs>
                         </hist>
@@ -938,7 +946,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>155</v>
+                                    <v>130</v>
                                 </b>
                             </bs>
                         </hist>
@@ -952,9 +960,9 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>12</a>
-                                    <b>13</b>
-                                    <v>12</v>
+                                    <a>10</a>
+                                    <b>11</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -970,7 +978,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>12</v>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -986,7 +994,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>12</v>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1000,9 +1008,9 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>10</a>
-                                    <b>11</b>
-                                    <v>12</v>
+                                    <a>8</a>
+                                    <b>9</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1016,9 +1024,9 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>12</a>
-                                    <b>13</b>
-                                    <v>12</v>
+                                    <a>10</a>
+                                    <b>11</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1032,9 +1040,9 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>12</a>
-                                    <b>13</b>
-                                    <v>12</v>
+                                    <a>10</a>
+                                    <b>11</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1050,7 +1058,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>12</v>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1066,7 +1074,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>12</v>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1080,9 +1088,9 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>10</a>
-                                    <b>11</b>
-                                    <v>12</v>
+                                    <a>8</a>
+                                    <b>9</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1096,9 +1104,9 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>12</a>
-                                    <b>13</b>
-                                    <v>12</v>
+                                    <a>10</a>
+                                    <b>11</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1114,65 +1122,65 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>12</v>
-                                </b>
-                                <b>
-                                    <a>11</a>
-                                    <b>12</b>
-                                    <v>12</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>error_message</src>
-                    <trg>severity</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>25</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>error_message</src>
-                    <trg>error_tag</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>25</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>error_message</src>
-                    <trg>full_error_message</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>12</v>
+                                    <v>13</v>
                                 </b>
                                 <b>
                                     <a>9</a>
                                     <b>10</b>
-                                    <v>12</v>
+                                    <v>13</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>error_message</src>
+                    <trg>severity</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>26</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>error_message</src>
+                    <trg>error_tag</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>26</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>error_message</src>
+                    <trg>full_error_message</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>13</v>
+                                </b>
+                                <b>
+                                    <a>7</a>
+                                    <b>8</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1188,12 +1196,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>12</v>
+                                    <v>13</v>
                                 </b>
                                 <b>
-                                    <a>11</a>
-                                    <b>12</b>
-                                    <v>12</v>
+                                    <a>9</a>
+                                    <b>10</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1209,12 +1217,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>103</v>
+                                    <v>78</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>25</v>
+                                    <v>26</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1230,7 +1238,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>129</v>
+                                    <v>104</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1246,7 +1254,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>129</v>
+                                    <v>104</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1262,7 +1270,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>129</v>
+                                    <v>104</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1278,12 +1286,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>103</v>
+                                    <v>78</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>25</v>
+                                    <v>26</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1299,7 +1307,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>155</v>
+                                    <v>130</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1315,7 +1323,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>155</v>
+                                    <v>130</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1331,7 +1339,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>155</v>
+                                    <v>130</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1347,7 +1355,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>155</v>
+                                    <v>130</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1363,7 +1371,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>155</v>
+                                    <v>130</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1373,23 +1381,23 @@
         </relation>
         <relation>
             <name>erb_ast_node_info</name>
-            <cardinality>25078</cardinality>
+            <cardinality>26945</cardinality>
             <columnsizes>
                 <e>
                     <k>node</k>
-                    <v>25078</v>
+                    <v>26945</v>
                 </e>
                 <e>
                     <k>parent</k>
-                    <v>6088</v>
+                    <v>6111</v>
                 </e>
                 <e>
                     <k>parent_index</k>
-                    <v>668</v>
+                    <v>688</v>
                 </e>
                 <e>
                     <k>loc</k>
-                    <v>25075</v>
+                    <v>26942</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -1403,7 +1411,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25078</v>
+                                    <v>26945</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1419,7 +1427,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25078</v>
+                                    <v>26945</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1435,7 +1443,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25078</v>
+                                    <v>26945</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1451,17 +1459,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>3</b>
-                                    <v>460</v>
+                                    <v>446</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>5360</v>
+                                    <v>5403</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>226</b>
-                                    <v>267</v>
+                                    <b>237</b>
+                                    <v>262</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1477,17 +1485,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>3</b>
-                                    <v>460</v>
+                                    <v>446</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>5360</v>
+                                    <v>5403</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>226</b>
-                                    <v>267</v>
+                                    <b>237</b>
+                                    <v>262</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1503,17 +1511,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>3</b>
-                                    <v>460</v>
+                                    <v>446</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>5360</v>
+                                    <v>5403</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>226</b>
-                                    <v>267</v>
+                                    <b>237</b>
+                                    <v>262</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1529,57 +1537,62 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>86</v>
+                                    <v>2</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>106</v>
+                                    <v>134</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>121</v>
+                                    <v>43</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>5</v>
+                                    <v>75</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>65</v>
+                                    <v>61</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>7</b>
-                                    <v>50</v>
+                                    <v>70</v>
                                 </b>
                                 <b>
                                     <a>7</a>
-                                    <b>11</b>
-                                    <v>50</v>
+                                    <b>9</b>
+                                    <v>61</v>
                                 </b>
                                 <b>
-                                    <a>11</a>
-                                    <b>19</b>
-                                    <v>53</v>
+                                    <a>10</a>
+                                    <b>16</b>
+                                    <v>55</v>
                                 </b>
                                 <b>
-                                    <a>19</a>
-                                    <b>38</b>
-                                    <v>53</v>
+                                    <a>16</a>
+                                    <b>23</b>
+                                    <v>52</v>
                                 </b>
                                 <b>
-                                    <a>39</a>
-                                    <b>72</b>
-                                    <v>50</v>
+                                    <a>23</a>
+                                    <b>43</b>
+                                    <v>52</v>
                                 </b>
                                 <b>
-                                    <a>74</a>
-                                    <b>2050</b>
-                                    <v>23</v>
+                                    <a>45</a>
+                                    <b>71</b>
+                                    <v>52</v>
+                                </b>
+                                <b>
+                                    <a>73</a>
+                                    <b>2096</b>
+                                    <v>26</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1595,57 +1608,62 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>86</v>
+                                    <v>2</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>106</v>
+                                    <v>134</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>121</v>
+                                    <v>43</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>5</v>
+                                    <v>75</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>65</v>
+                                    <v>61</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>7</b>
-                                    <v>50</v>
+                                    <v>70</v>
                                 </b>
                                 <b>
                                     <a>7</a>
-                                    <b>11</b>
-                                    <v>50</v>
+                                    <b>9</b>
+                                    <v>61</v>
                                 </b>
                                 <b>
-                                    <a>11</a>
-                                    <b>19</b>
-                                    <v>53</v>
+                                    <a>10</a>
+                                    <b>16</b>
+                                    <v>55</v>
                                 </b>
                                 <b>
-                                    <a>19</a>
-                                    <b>38</b>
-                                    <v>53</v>
+                                    <a>16</a>
+                                    <b>23</b>
+                                    <v>52</v>
                                 </b>
                                 <b>
-                                    <a>39</a>
-                                    <b>72</b>
-                                    <v>50</v>
+                                    <a>23</a>
+                                    <b>43</b>
+                                    <v>52</v>
                                 </b>
                                 <b>
-                                    <a>74</a>
-                                    <b>2050</b>
-                                    <v>23</v>
+                                    <a>45</a>
+                                    <b>71</b>
+                                    <v>52</v>
+                                </b>
+                                <b>
+                                    <a>73</a>
+                                    <b>2096</b>
+                                    <v>26</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1661,57 +1679,62 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>86</v>
+                                    <v>2</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>106</v>
+                                    <v>134</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>121</v>
+                                    <v>43</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>5</v>
+                                    <v>75</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>65</v>
+                                    <v>61</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>7</b>
-                                    <v>50</v>
+                                    <v>70</v>
                                 </b>
                                 <b>
                                     <a>7</a>
-                                    <b>11</b>
-                                    <v>50</v>
+                                    <b>9</b>
+                                    <v>61</v>
                                 </b>
                                 <b>
-                                    <a>11</a>
-                                    <b>19</b>
-                                    <v>53</v>
+                                    <a>10</a>
+                                    <b>16</b>
+                                    <v>55</v>
                                 </b>
                                 <b>
-                                    <a>19</a>
-                                    <b>38</b>
-                                    <v>53</v>
+                                    <a>16</a>
+                                    <b>23</b>
+                                    <v>52</v>
                                 </b>
                                 <b>
-                                    <a>39</a>
-                                    <b>72</b>
-                                    <v>50</v>
+                                    <a>23</a>
+                                    <b>43</b>
+                                    <v>52</v>
                                 </b>
                                 <b>
-                                    <a>74</a>
-                                    <b>2049</b>
-                                    <v>23</v>
+                                    <a>45</a>
+                                    <b>71</b>
+                                    <v>52</v>
+                                </b>
+                                <b>
+                                    <a>73</a>
+                                    <b>2095</b>
+                                    <v>26</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1727,7 +1750,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25072</v>
+                                    <v>26939</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -1748,7 +1771,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25072</v>
+                                    <v>26939</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -1769,7 +1792,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25075</v>
+                                    <v>26942</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1778,11 +1801,11 @@
             </dependencies>
         </relation>
     <relation>
-            <name>erb_comment_directive_def</name>
+            <name>erb_comment_directive_child</name>
             <cardinality>40</cardinality>
             <columnsizes>
                 <e>
-                    <k>id</k>
+                    <k>erb_comment_directive</k>
                     <v>40</v>
                 </e>
                 <e>
@@ -1792,7 +1815,7 @@
             </columnsizes>
             <dependencies>
                 <dep>
-                    <src>id</src>
+                    <src>erb_comment_directive</src>
                     <trg>child</trg>
                     <val>
                         <hist>
@@ -1809,7 +1832,7 @@
                 </dep>
                 <dep>
                     <src>child</src>
-                    <trg>id</trg>
+                    <trg>erb_comment_directive</trg>
                     <val>
                         <hist>
                             <budget>12</budget>
@@ -1826,21 +1849,32 @@
             </dependencies>
         </relation>
         <relation>
-            <name>erb_directive_def</name>
-            <cardinality>1414</cardinality>
+            <name>erb_comment_directive_def</name>
+            <cardinality>40</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1414</v>
+                    <v>40</v>
+                </e>
+            </columnsizes>
+            <dependencies/>
+        </relation>
+        <relation>
+            <name>erb_directive_child</name>
+            <cardinality>1400</cardinality>
+            <columnsizes>
+                <e>
+                    <k>erb_directive</k>
+                    <v>1400</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>1414</v>
+                    <v>1400</v>
                 </e>
             </columnsizes>
             <dependencies>
                 <dep>
-                    <src>id</src>
+                    <src>erb_directive</src>
                     <trg>child</trg>
                     <val>
                         <hist>
@@ -1849,7 +1883,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1414</v>
+                                    <v>1400</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1857,7 +1891,7 @@
                 </dep>
                 <dep>
                     <src>child</src>
-                    <trg>id</trg>
+                    <trg>erb_directive</trg>
                     <val>
                         <hist>
                             <budget>12</budget>
@@ -1865,7 +1899,66 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1414</v>
+                                    <v>1400</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+            </dependencies>
+        </relation>
+        <relation>
+            <name>erb_directive_def</name>
+            <cardinality>1400</cardinality>
+            <columnsizes>
+                <e>
+                    <k>id</k>
+                    <v>1400</v>
+                </e>
+            </columnsizes>
+            <dependencies/>
+        </relation>
+        <relation>
+            <name>erb_graphql_directive_child</name>
+            <cardinality>0</cardinality>
+            <columnsizes>
+                <e>
+                    <k>erb_graphql_directive</k>
+                    <v>0</v>
+                </e>
+                <e>
+                    <k>child</k>
+                    <v>0</v>
+                </e>
+            </columnsizes>
+            <dependencies>
+                <dep>
+                    <src>erb_graphql_directive</src>
+                    <trg>child</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>2</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>child</src>
+                    <trg>erb_graphql_directive</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>2</v>
                                 </b>
                             </bs>
                         </hist>
@@ -1881,14 +1974,291 @@
                     <k>id</k>
                     <v>0</v>
                 </e>
+            </columnsizes>
+            <dependencies/>
+        </relation>
+        <relation>
+            <name>erb_output_directive_child</name>
+            <cardinality>3859</cardinality>
+            <columnsizes>
+                <e>
+                    <k>erb_output_directive</k>
+                    <v>3859</v>
+                </e>
                 <e>
                     <k>child</k>
-                    <v>0</v>
+                    <v>3859</v>
                 </e>
             </columnsizes>
             <dependencies>
                 <dep>
-                    <src>id</src>
+                    <src>erb_output_directive</src>
+                    <trg>child</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>3859</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>child</src>
+                    <trg>erb_output_directive</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>3859</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+            </dependencies>
+        </relation>
+        <relation>
+            <name>erb_output_directive_def</name>
+            <cardinality>3859</cardinality>
+            <columnsizes>
+                <e>
+                    <k>id</k>
+                    <v>3859</v>
+                </e>
+            </columnsizes>
+            <dependencies/>
+        </relation>
+        <relation>
+            <name>erb_template_child</name>
+            <cardinality>10739</cardinality>
+            <columnsizes>
+                <e>
+                    <k>erb_template</k>
+                    <v>425</v>
+                </e>
+                <e>
+                    <k>index</k>
+                    <v>688</v>
+                </e>
+                <e>
+                    <k>child</k>
+                    <v>10739</v>
+                </e>
+            </columnsizes>
+            <dependencies>
+                <dep>
+                    <src>erb_template</src>
+                    <trg>index</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>3</b>
+                                    <v>20</v>
+                                </b>
+                                <b>
+                                    <a>3</a>
+                                    <b>4</b>
+                                    <v>142</v>
+                                </b>
+                                <b>
+                                    <a>4</a>
+                                    <b>7</b>
+                                    <v>26</v>
+                                </b>
+                                <b>
+                                    <a>7</a>
+                                    <b>10</b>
+                                    <v>32</v>
+                                </b>
+                                <b>
+                                    <a>10</a>
+                                    <b>14</b>
+                                    <v>32</v>
+                                </b>
+                                <b>
+                                    <a>14</a>
+                                    <b>24</b>
+                                    <v>32</v>
+                                </b>
+                                <b>
+                                    <a>24</a>
+                                    <b>32</b>
+                                    <v>35</v>
+                                </b>
+                                <b>
+                                    <a>33</a>
+                                    <b>42</b>
+                                    <v>35</v>
+                                </b>
+                                <b>
+                                    <a>43</a>
+                                    <b>68</b>
+                                    <v>32</v>
+                                </b>
+                                <b>
+                                    <a>70</a>
+                                    <b>190</b>
+                                    <v>32</v>
+                                </b>
+                                <b>
+                                    <a>235</a>
+                                    <b>237</b>
+                                    <v>5</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>erb_template</src>
+                    <trg>child</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>3</b>
+                                    <v>20</v>
+                                </b>
+                                <b>
+                                    <a>3</a>
+                                    <b>4</b>
+                                    <v>142</v>
+                                </b>
+                                <b>
+                                    <a>4</a>
+                                    <b>7</b>
+                                    <v>26</v>
+                                </b>
+                                <b>
+                                    <a>7</a>
+                                    <b>10</b>
+                                    <v>32</v>
+                                </b>
+                                <b>
+                                    <a>10</a>
+                                    <b>14</b>
+                                    <v>32</v>
+                                </b>
+                                <b>
+                                    <a>14</a>
+                                    <b>24</b>
+                                    <v>32</v>
+                                </b>
+                                <b>
+                                    <a>24</a>
+                                    <b>32</b>
+                                    <v>35</v>
+                                </b>
+                                <b>
+                                    <a>33</a>
+                                    <b>42</b>
+                                    <v>35</v>
+                                </b>
+                                <b>
+                                    <a>43</a>
+                                    <b>68</b>
+                                    <v>32</v>
+                                </b>
+                                <b>
+                                    <a>70</a>
+                                    <b>190</b>
+                                    <v>32</v>
+                                </b>
+                                <b>
+                                    <a>235</a>
+                                    <b>237</b>
+                                    <v>5</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>index</src>
+                    <trg>erb_template</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>2</v>
+                                </b>
+                                <b>
+                                    <a>2</a>
+                                    <b>3</b>
+                                    <v>134</v>
+                                </b>
+                                <b>
+                                    <a>3</a>
+                                    <b>4</b>
+                                    <v>43</v>
+                                </b>
+                                <b>
+                                    <a>4</a>
+                                    <b>5</b>
+                                    <v>75</v>
+                                </b>
+                                <b>
+                                    <a>5</a>
+                                    <b>6</b>
+                                    <v>61</v>
+                                </b>
+                                <b>
+                                    <a>6</a>
+                                    <b>7</b>
+                                    <v>70</v>
+                                </b>
+                                <b>
+                                    <a>7</a>
+                                    <b>9</b>
+                                    <v>61</v>
+                                </b>
+                                <b>
+                                    <a>10</a>
+                                    <b>16</b>
+                                    <v>55</v>
+                                </b>
+                                <b>
+                                    <a>16</a>
+                                    <b>23</b>
+                                    <v>52</v>
+                                </b>
+                                <b>
+                                    <a>23</a>
+                                    <b>43</b>
+                                    <v>52</v>
+                                </b>
+                                <b>
+                                    <a>45</a>
+                                    <b>71</b>
+                                    <v>52</v>
+                                </b>
+                                <b>
+                                    <a>73</a>
+                                    <b>147</b>
+                                    <v>26</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>index</src>
                     <trg>child</trg>
                     <val>
                         <hist>
@@ -1899,337 +2269,60 @@
                                     <b>2</b>
                                     <v>2</v>
                                 </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>id</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs/>
-                        </hist>
-                    </val>
-                </dep>
-            </dependencies>
-        </relation>
-        <relation>
-            <name>erb_output_directive_def</name>
-            <cardinality>3806</cardinality>
-            <columnsizes>
-                <e>
-                    <k>id</k>
-                    <v>3806</v>
-                </e>
-                <e>
-                    <k>child</k>
-                    <v>3806</v>
-                </e>
-            </columnsizes>
-            <dependencies>
-                <dep>
-                    <src>id</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>3806</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>id</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>3806</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-            </dependencies>
-        </relation>
-        <relation>
-            <name>erb_template_child</name>
-            <cardinality>8982</cardinality>
-            <columnsizes>
-                <e>
-                    <k>erb_template</k>
-                    <v>433</v>
-                </e>
-                <e>
-                    <k>index</k>
-                    <v>668</v>
-                </e>
-                <e>
-                    <k>child</k>
-                    <v>8982</v>
-                </e>
-            </columnsizes>
-            <dependencies>
-                <dep>
-                    <src>erb_template</src>
-                    <trg>index</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>3</b>
-                                    <v>26</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>139</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>7</b>
-                                    <v>26</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>9</b>
-                                    <v>29</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>12</b>
-                                    <v>35</v>
-                                </b>
-                                <b>
-                                    <a>12</a>
-                                    <b>17</b>
-                                    <v>38</v>
-                                </b>
-                                <b>
-                                    <a>17</a>
-                                    <b>29</b>
-                                    <v>32</v>
-                                </b>
-                                <b>
-                                    <a>29</a>
-                                    <b>35</b>
-                                    <v>35</v>
-                                </b>
-                                <b>
-                                    <a>35</a>
-                                    <b>56</b>
-                                    <v>35</v>
-                                </b>
-                                <b>
-                                    <a>61</a>
-                                    <b>226</b>
-                                    <v>32</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>erb_template</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>3</b>
-                                    <v>26</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>139</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>7</b>
-                                    <v>26</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>9</b>
-                                    <v>29</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>12</b>
-                                    <v>35</v>
-                                </b>
-                                <b>
-                                    <a>12</a>
-                                    <b>17</b>
-                                    <v>38</v>
-                                </b>
-                                <b>
-                                    <a>17</a>
-                                    <b>29</b>
-                                    <v>32</v>
-                                </b>
-                                <b>
-                                    <a>29</a>
-                                    <b>35</b>
-                                    <v>35</v>
-                                </b>
-                                <b>
-                                    <a>35</a>
-                                    <b>56</b>
-                                    <v>35</v>
-                                </b>
-                                <b>
-                                    <a>61</a>
-                                    <b>226</b>
-                                    <v>32</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
-                    <trg>erb_template</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>86</v>
-                                </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>106</v>
+                                    <v>134</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>121</v>
+                                    <v>43</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>5</v>
+                                    <v>75</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>65</v>
+                                    <v>61</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>7</b>
-                                    <v>50</v>
+                                    <v>70</v>
                                 </b>
                                 <b>
                                     <a>7</a>
-                                    <b>11</b>
-                                    <v>50</v>
+                                    <b>9</b>
+                                    <v>61</v>
                                 </b>
                                 <b>
-                                    <a>11</a>
-                                    <b>19</b>
-                                    <v>53</v>
+                                    <a>10</a>
+                                    <b>16</b>
+                                    <v>55</v>
                                 </b>
                                 <b>
-                                    <a>19</a>
-                                    <b>38</b>
-                                    <v>53</v>
+                                    <a>16</a>
+                                    <b>23</b>
+                                    <v>52</v>
                                 </b>
                                 <b>
-                                    <a>39</a>
-                                    <b>72</b>
-                                    <v>50</v>
+                                    <a>23</a>
+                                    <b>43</b>
+                                    <v>52</v>
                                 </b>
                                 <b>
-                                    <a>74</a>
+                                    <a>45</a>
+                                    <b>71</b>
+                                    <v>52</v>
+                                </b>
+                                <b>
+                                    <a>73</a>
                                     <b>147</b>
-                                    <v>23</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>86</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>106</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>121</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>65</v>
-                                </b>
-                                <b>
-                                    <a>6</a>
-                                    <b>7</b>
-                                    <v>50</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>11</b>
-                                    <v>50</v>
-                                </b>
-                                <b>
-                                    <a>11</a>
-                                    <b>19</b>
-                                    <v>53</v>
-                                </b>
-                                <b>
-                                    <a>19</a>
-                                    <b>38</b>
-                                    <v>53</v>
-                                </b>
-                                <b>
-                                    <a>39</a>
-                                    <b>72</b>
-                                    <v>50</v>
-                                </b>
-                                <b>
-                                    <a>74</a>
-                                    <b>147</b>
-                                    <v>23</v>
+                                    <v>26</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2245,7 +2338,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8982</v>
+                                    <v>10739</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2261,7 +2354,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8982</v>
+                                    <v>10739</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2271,22 +2364,22 @@
         </relation>
         <relation>
             <name>erb_template_def</name>
-            <cardinality>1563</cardinality>
+            <cardinality>1540</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1563</v>
+                    <v>1540</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>erb_tokeninfo</name>
-            <cardinality>19423</cardinality>
+            <cardinality>21259</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>19423</v>
+                    <v>21259</v>
                 </e>
                 <e>
                     <k>kind</k>
@@ -2294,7 +2387,7 @@
                 </e>
                 <e>
                     <k>value</k>
-                    <v>5800</v>
+                    <v>5773</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -2308,7 +2401,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>19423</v>
+                                    <v>21259</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2324,7 +2417,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>19423</v>
+                                    <v>21259</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2338,18 +2431,18 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>1266</a>
-                                    <b>1267</b>
+                                    <a>1803</a>
+                                    <b>1804</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1757</a>
-                                    <b>1758</b>
+                                    <a>1878</a>
+                                    <b>1879</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>3514</a>
-                                    <b>3515</b>
+                                    <a>3606</a>
+                                    <b>3607</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -2364,18 +2457,18 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>52</a>
-                                    <b>53</b>
+                                    <a>5</a>
+                                    <b>6</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>884</a>
-                                    <b>885</b>
+                                    <a>932</a>
+                                    <b>933</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1016</a>
-                                    <b>1017</b>
+                                    <a>1042</a>
+                                    <b>1043</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -2392,22 +2485,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4662</v>
+                                    <v>4667</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>659</v>
+                                    <v>679</v>
                                 </b>
                                 <b>
                                     <a>3</a>
-                                    <b>23</b>
-                                    <v>436</v>
-                                </b>
-                                <b>
-                                    <a>32</a>
-                                    <b>1696</b>
-                                    <v>41</v>
+                                    <b>1742</b>
+                                    <v>425</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2423,7 +2511,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5800</v>
+                                    <v>5773</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2433,15 +2521,15 @@
         </relation>
         <relation>
             <name>files</name>
-            <cardinality>17168</cardinality>
+            <cardinality>17206</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>17168</v>
+                    <v>17206</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>17168</v>
+                    <v>17206</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -2455,7 +2543,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>17168</v>
+                                    <v>17206</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2471,7 +2559,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>17168</v>
+                                    <v>17206</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2481,15 +2569,15 @@
         </relation>
         <relation>
             <name>folders</name>
-            <cardinality>4792</cardinality>
+            <cardinality>4799</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4792</v>
+                    <v>4799</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>4792</v>
+                    <v>4799</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -2503,7 +2591,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4792</v>
+                                    <v>4799</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2519,7 +2607,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4792</v>
+                                    <v>4799</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2529,31 +2617,31 @@
         </relation>
         <relation>
             <name>locations_default</name>
-            <cardinality>8508604</cardinality>
+            <cardinality>8706731</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>8508604</v>
+                    <v>8706731</v>
                 </e>
                 <e>
                     <k>file</k>
-                    <v>17168</v>
+                    <v>17206</v>
                 </e>
                 <e>
                     <k>start_line</k>
-                    <v>30674</v>
+                    <v>30719</v>
                 </e>
                 <e>
                     <k>start_column</k>
-                    <v>5064</v>
+                    <v>5072</v>
                 </e>
                 <e>
                     <k>end_line</k>
-                    <v>30674</v>
+                    <v>30719</v>
                 </e>
                 <e>
                     <k>end_column</k>
-                    <v>5129</v>
+                    <v>5163</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -2567,7 +2655,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8508604</v>
+                                    <v>8706731</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2583,7 +2671,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8508604</v>
+                                    <v>8706731</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2599,7 +2687,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8508604</v>
+                                    <v>8706731</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2615,7 +2703,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8508604</v>
+                                    <v>8706731</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2631,7 +2719,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8508604</v>
+                                    <v>8706731</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2647,67 +2735,67 @@
                                 <b>
                                     <a>1</a>
                                     <b>32</b>
-                                    <v>1337</v>
+                                    <v>1300</v>
                                 </b>
                                 <b>
                                     <a>32</a>
-                                    <b>48</b>
-                                    <v>1311</v>
+                                    <b>49</b>
+                                    <v>1339</v>
                                 </b>
                                 <b>
-                                    <a>48</a>
-                                    <b>72</b>
-                                    <v>1376</v>
+                                    <a>49</a>
+                                    <b>73</b>
+                                    <v>1482</v>
                                 </b>
                                 <b>
-                                    <a>72</a>
-                                    <b>94</b>
-                                    <v>1493</v>
+                                    <a>73</a>
+                                    <b>95</b>
+                                    <v>1352</v>
                                 </b>
                                 <b>
-                                    <a>94</a>
-                                    <b>127</b>
-                                    <v>1298</v>
+                                    <a>95</a>
+                                    <b>126</b>
+                                    <v>1313</v>
                                 </b>
                                 <b>
                                     <a>127</a>
-                                    <b>169</b>
-                                    <v>1311</v>
+                                    <b>170</b>
+                                    <v>1313</v>
                                 </b>
                                 <b>
-                                    <a>169</a>
-                                    <b>216</b>
-                                    <v>1298</v>
+                                    <a>170</a>
+                                    <b>218</b>
+                                    <v>1339</v>
                                 </b>
                                 <b>
-                                    <a>216</a>
-                                    <b>271</b>
-                                    <v>1298</v>
+                                    <a>218</a>
+                                    <b>277</b>
+                                    <v>1326</v>
                                 </b>
                                 <b>
-                                    <a>271</a>
-                                    <b>353</b>
-                                    <v>1311</v>
+                                    <a>277</a>
+                                    <b>359</b>
+                                    <v>1300</v>
                                 </b>
                                 <b>
-                                    <a>353</a>
-                                    <b>475</b>
-                                    <v>1298</v>
+                                    <a>361</a>
+                                    <b>489</b>
+                                    <v>1300</v>
                                 </b>
                                 <b>
-                                    <a>476</a>
-                                    <b>721</b>
-                                    <v>1298</v>
+                                    <a>492</a>
+                                    <b>736</b>
+                                    <v>1313</v>
                                 </b>
                                 <b>
-                                    <a>724</a>
-                                    <b>1480</b>
-                                    <v>1298</v>
+                                    <a>741</a>
+                                    <b>1508</b>
+                                    <v>1300</v>
                                 </b>
                                 <b>
-                                    <a>1481</a>
-                                    <b>22817</b>
-                                    <v>1233</v>
+                                    <a>1509</a>
+                                    <b>22819</b>
+                                    <v>1222</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2716,158 +2804,6 @@
                 <dep>
                     <src>file</src>
                     <trg>start_line</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>7</b>
-                                    <v>1116</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>10</b>
-                                    <v>1545</v>
-                                </b>
-                                <b>
-                                    <a>10</a>
-                                    <b>13</b>
-                                    <v>1389</v>
-                                </b>
-                                <b>
-                                    <a>13</a>
-                                    <b>16</b>
-                                    <v>1493</v>
-                                </b>
-                                <b>
-                                    <a>16</a>
-                                    <b>20</b>
-                                    <v>1571</v>
-                                </b>
-                                <b>
-                                    <a>20</a>
-                                    <b>25</b>
-                                    <v>1363</v>
-                                </b>
-                                <b>
-                                    <a>25</a>
-                                    <b>31</b>
-                                    <v>1441</v>
-                                </b>
-                                <b>
-                                    <a>31</a>
-                                    <b>38</b>
-                                    <v>1350</v>
-                                </b>
-                                <b>
-                                    <a>38</a>
-                                    <b>49</b>
-                                    <v>1441</v>
-                                </b>
-                                <b>
-                                    <a>49</a>
-                                    <b>69</b>
-                                    <v>1324</v>
-                                </b>
-                                <b>
-                                    <a>69</a>
-                                    <b>117</b>
-                                    <v>1298</v>
-                                </b>
-                                <b>
-                                    <a>119</a>
-                                    <b>257</b>
-                                    <v>1298</v>
-                                </b>
-                                <b>
-                                    <a>260</a>
-                                    <b>2337</b>
-                                    <v>532</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>file</src>
-                    <trg>start_column</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>16</b>
-                                    <v>1415</v>
-                                </b>
-                                <b>
-                                    <a>16</a>
-                                    <b>25</b>
-                                    <v>1428</v>
-                                </b>
-                                <b>
-                                    <a>25</a>
-                                    <b>32</b>
-                                    <v>1363</v>
-                                </b>
-                                <b>
-                                    <a>32</a>
-                                    <b>41</b>
-                                    <v>1376</v>
-                                </b>
-                                <b>
-                                    <a>41</a>
-                                    <b>47</b>
-                                    <v>1506</v>
-                                </b>
-                                <b>
-                                    <a>47</a>
-                                    <b>54</b>
-                                    <v>1532</v>
-                                </b>
-                                <b>
-                                    <a>54</a>
-                                    <b>62</b>
-                                    <v>1363</v>
-                                </b>
-                                <b>
-                                    <a>62</a>
-                                    <b>69</b>
-                                    <v>1402</v>
-                                </b>
-                                <b>
-                                    <a>69</a>
-                                    <b>77</b>
-                                    <v>1428</v>
-                                </b>
-                                <b>
-                                    <a>77</a>
-                                    <b>87</b>
-                                    <v>1350</v>
-                                </b>
-                                <b>
-                                    <a>87</a>
-                                    <b>101</b>
-                                    <v>1324</v>
-                                </b>
-                                <b>
-                                    <a>101</a>
-                                    <b>130</b>
-                                    <v>1298</v>
-                                </b>
-                                <b>
-                                    <a>130</a>
-                                    <b>357</b>
-                                    <v>376</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>file</src>
-                    <trg>end_line</trg>
                     <val>
                         <hist>
                             <budget>12</budget>
@@ -2875,67 +2811,219 @@
                                 <b>
                                     <a>1</a>
                                     <b>8</b>
-                                    <v>1558</v>
+                                    <v>1586</v>
                                 </b>
                                 <b>
                                     <a>8</a>
                                     <b>11</b>
-                                    <v>1467</v>
+                                    <v>1443</v>
                                 </b>
                                 <b>
                                     <a>11</a>
                                     <b>14</b>
-                                    <v>1506</v>
+                                    <v>1521</v>
                                 </b>
                                 <b>
                                     <a>14</a>
                                     <b>17</b>
-                                    <v>1415</v>
+                                    <v>1430</v>
                                 </b>
                                 <b>
                                     <a>17</a>
                                     <b>21</b>
-                                    <v>1467</v>
+                                    <v>1417</v>
                                 </b>
                                 <b>
                                     <a>21</a>
                                     <b>26</b>
-                                    <v>1337</v>
+                                    <v>1352</v>
                                 </b>
                                 <b>
                                     <a>26</a>
                                     <b>32</b>
-                                    <v>1363</v>
+                                    <v>1378</v>
                                 </b>
                                 <b>
                                     <a>32</a>
                                     <b>39</b>
-                                    <v>1415</v>
+                                    <v>1378</v>
                                 </b>
                                 <b>
                                     <a>39</a>
                                     <b>51</b>
-                                    <v>1402</v>
+                                    <v>1417</v>
                                 </b>
                                 <b>
                                     <a>51</a>
                                     <b>75</b>
-                                    <v>1298</v>
+                                    <v>1326</v>
                                 </b>
                                 <b>
                                     <a>75</a>
                                     <b>126</b>
-                                    <v>1311</v>
+                                    <v>1313</v>
                                 </b>
                                 <b>
                                     <a>126</a>
                                     <b>343</b>
-                                    <v>1298</v>
+                                    <v>1300</v>
                                 </b>
                                 <b>
                                     <a>354</a>
                                     <b>2337</b>
-                                    <v>324</v>
+                                    <v>338</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>file</src>
+                    <trg>start_column</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>16</b>
+                                    <v>1404</v>
+                                </b>
+                                <b>
+                                    <a>16</a>
+                                    <b>25</b>
+                                    <v>1417</v>
+                                </b>
+                                <b>
+                                    <a>25</a>
+                                    <b>32</b>
+                                    <v>1378</v>
+                                </b>
+                                <b>
+                                    <a>32</a>
+                                    <b>41</b>
+                                    <v>1391</v>
+                                </b>
+                                <b>
+                                    <a>41</a>
+                                    <b>47</b>
+                                    <v>1495</v>
+                                </b>
+                                <b>
+                                    <a>47</a>
+                                    <b>54</b>
+                                    <v>1547</v>
+                                </b>
+                                <b>
+                                    <a>54</a>
+                                    <b>62</b>
+                                    <v>1339</v>
+                                </b>
+                                <b>
+                                    <a>62</a>
+                                    <b>69</b>
+                                    <v>1391</v>
+                                </b>
+                                <b>
+                                    <a>69</a>
+                                    <b>77</b>
+                                    <v>1443</v>
+                                </b>
+                                <b>
+                                    <a>77</a>
+                                    <b>87</b>
+                                    <v>1365</v>
+                                </b>
+                                <b>
+                                    <a>87</a>
+                                    <b>101</b>
+                                    <v>1326</v>
+                                </b>
+                                <b>
+                                    <a>101</a>
+                                    <b>129</b>
+                                    <v>1313</v>
+                                </b>
+                                <b>
+                                    <a>129</a>
+                                    <b>357</b>
+                                    <v>390</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>file</src>
+                    <trg>end_line</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>8</b>
+                                    <v>1547</v>
+                                </b>
+                                <b>
+                                    <a>8</a>
+                                    <b>11</b>
+                                    <v>1430</v>
+                                </b>
+                                <b>
+                                    <a>11</a>
+                                    <b>14</b>
+                                    <v>1547</v>
+                                </b>
+                                <b>
+                                    <a>14</a>
+                                    <b>17</b>
+                                    <v>1430</v>
+                                </b>
+                                <b>
+                                    <a>17</a>
+                                    <b>21</b>
+                                    <v>1430</v>
+                                </b>
+                                <b>
+                                    <a>21</a>
+                                    <b>26</b>
+                                    <v>1365</v>
+                                </b>
+                                <b>
+                                    <a>26</a>
+                                    <b>32</b>
+                                    <v>1378</v>
+                                </b>
+                                <b>
+                                    <a>32</a>
+                                    <b>39</b>
+                                    <v>1378</v>
+                                </b>
+                                <b>
+                                    <a>39</a>
+                                    <b>51</b>
+                                    <v>1417</v>
+                                </b>
+                                <b>
+                                    <a>51</a>
+                                    <b>75</b>
+                                    <v>1326</v>
+                                </b>
+                                <b>
+                                    <a>75</a>
+                                    <b>126</b>
+                                    <v>1313</v>
+                                </b>
+                                <b>
+                                    <a>126</a>
+                                    <b>343</b>
+                                    <v>1300</v>
+                                </b>
+                                <b>
+                                    <a>354</a>
+                                    <b>2337</b>
+                                    <v>338</v>
                                 </b>
                             </bs>
                         </hist>
@@ -2951,67 +3039,67 @@
                                 <b>
                                     <a>1</a>
                                     <b>20</b>
-                                    <v>1441</v>
+                                    <v>1430</v>
                                 </b>
                                 <b>
                                     <a>20</a>
                                     <b>28</b>
-                                    <v>1298</v>
+                                    <v>1300</v>
                                 </b>
                                 <b>
                                     <a>28</a>
                                     <b>36</b>
-                                    <v>1389</v>
+                                    <v>1404</v>
                                 </b>
                                 <b>
                                     <a>36</a>
                                     <b>45</b>
-                                    <v>1363</v>
+                                    <v>1365</v>
                                 </b>
                                 <b>
                                     <a>45</a>
                                     <b>50</b>
-                                    <v>1311</v>
+                                    <v>1313</v>
                                 </b>
                                 <b>
                                     <a>50</a>
                                     <b>57</b>
-                                    <v>1350</v>
+                                    <v>1352</v>
                                 </b>
                                 <b>
                                     <a>57</a>
                                     <b>64</b>
-                                    <v>1376</v>
+                                    <v>1339</v>
                                 </b>
                                 <b>
                                     <a>64</a>
                                     <b>71</b>
-                                    <v>1298</v>
+                                    <v>1300</v>
                                 </b>
                                 <b>
                                     <a>71</a>
                                     <b>78</b>
-                                    <v>1376</v>
+                                    <v>1391</v>
                                 </b>
                                 <b>
                                     <a>78</a>
                                     <b>87</b>
-                                    <v>1428</v>
+                                    <v>1443</v>
                                 </b>
                                 <b>
                                     <a>87</a>
                                     <b>99</b>
-                                    <v>1402</v>
+                                    <v>1417</v>
                                 </b>
                                 <b>
                                     <a>99</a>
                                     <b>120</b>
-                                    <v>1363</v>
+                                    <v>1365</v>
                                 </b>
                                 <b>
                                     <a>120</a>
                                     <b>367</b>
-                                    <v>766</v>
+                                    <v>780</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3027,67 +3115,72 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1519</v>
+                                    <v>1430</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>4</b>
-                                    <v>1753</v>
+                                    <v>1716</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>3545</v>
+                                    <v>3316</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>10</b>
-                                    <v>2454</v>
+                                    <v>2523</v>
                                 </b>
                                 <b>
                                     <a>10</a>
-                                    <b>17</b>
-                                    <v>2805</v>
+                                    <b>16</b>
+                                    <v>2367</v>
                                 </b>
                                 <b>
-                                    <a>17</a>
-                                    <b>24</b>
-                                    <v>2441</v>
+                                    <a>16</a>
+                                    <b>22</b>
+                                    <v>2562</v>
                                 </b>
                                 <b>
-                                    <a>24</a>
-                                    <b>42</b>
-                                    <v>2350</v>
+                                    <a>22</a>
+                                    <b>37</b>
+                                    <v>2327</v>
                                 </b>
                                 <b>
-                                    <a>42</a>
-                                    <b>78</b>
-                                    <v>2337</v>
+                                    <a>37</a>
+                                    <b>68</b>
+                                    <v>2341</v>
                                 </b>
                                 <b>
-                                    <a>78</a>
-                                    <b>119</b>
-                                    <v>2311</v>
+                                    <a>68</a>
+                                    <b>110</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>119</a>
-                                    <b>173</b>
-                                    <v>2324</v>
+                                    <a>110</a>
+                                    <b>161</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>173</a>
-                                    <b>279</b>
-                                    <v>2311</v>
+                                    <a>161</a>
+                                    <b>249</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>281</a>
-                                    <b>866</b>
-                                    <v>2311</v>
+                                    <a>250</a>
+                                    <b>596</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>866</a>
-                                    <b>10012</b>
-                                    <v>2207</v>
+                                    <a>601</a>
+                                    <b>3089</b>
+                                    <v>2314</v>
+                                </b>
+                                <b>
+                                    <a>3257</a>
+                                    <b>10293</b>
+                                    <v>559</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3103,47 +3196,47 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10713</v>
+                                    <v>9884</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>4753</v>
+                                    <v>5605</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>6</b>
-                                    <v>2337</v>
+                                    <v>2341</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>9</b>
-                                    <v>2363</v>
+                                    <v>2341</v>
                                 </b>
                                 <b>
                                     <a>9</a>
                                     <b>14</b>
-                                    <v>2792</v>
+                                    <v>2419</v>
                                 </b>
                                 <b>
                                     <a>14</a>
                                     <b>22</b>
-                                    <v>2324</v>
+                                    <v>2484</v>
                                 </b>
                                 <b>
                                     <a>22</a>
-                                    <b>57</b>
-                                    <v>2311</v>
+                                    <b>49</b>
+                                    <v>2327</v>
                                 </b>
                                 <b>
-                                    <a>57</a>
-                                    <b>287</b>
-                                    <v>2311</v>
+                                    <a>49</a>
+                                    <b>220</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>291</a>
-                                    <b>1322</b>
-                                    <v>766</v>
+                                    <a>223</a>
+                                    <b>1323</b>
+                                    <v>1001</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3159,72 +3252,72 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1519</v>
+                                    <v>1430</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1584</v>
+                                    <v>1495</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>2558</v>
+                                    <v>2510</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>2441</v>
+                                    <v>2419</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>8</b>
-                                    <v>1584</v>
+                                    <v>1573</v>
                                 </b>
                                 <b>
                                     <a>8</a>
-                                    <b>13</b>
-                                    <v>2818</v>
+                                    <b>12</b>
+                                    <v>2393</v>
                                 </b>
                                 <b>
-                                    <a>13</a>
-                                    <b>18</b>
-                                    <v>2610</v>
+                                    <a>12</a>
+                                    <b>16</b>
+                                    <v>2432</v>
                                 </b>
                                 <b>
-                                    <a>18</a>
-                                    <b>30</b>
-                                    <v>2506</v>
+                                    <a>16</a>
+                                    <b>25</b>
+                                    <v>2549</v>
                                 </b>
                                 <b>
-                                    <a>30</a>
-                                    <b>43</b>
-                                    <v>2363</v>
+                                    <a>25</a>
+                                    <b>39</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>43</a>
-                                    <b>57</b>
-                                    <v>2428</v>
+                                    <a>39</a>
+                                    <b>53</b>
+                                    <v>2406</v>
                                 </b>
                                 <b>
-                                    <a>57</a>
-                                    <b>70</b>
-                                    <v>2324</v>
+                                    <a>53</a>
+                                    <b>66</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>70</a>
-                                    <b>89</b>
-                                    <v>2350</v>
+                                    <a>66</a>
+                                    <b>81</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>89</a>
-                                    <b>116</b>
-                                    <v>2311</v>
+                                    <a>81</a>
+                                    <b>104</b>
+                                    <v>2341</v>
                                 </b>
                                 <b>
-                                    <a>116</a>
-                                    <b>203</b>
-                                    <v>1272</v>
+                                    <a>104</a>
+                                    <b>205</b>
+                                    <v>2223</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3240,42 +3333,42 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>12648</v>
+                                    <v>11106</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>6714</v>
+                                    <v>6294</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>2363</v>
+                                    <v>2275</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>1792</v>
+                                    <v>1547</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>7</b>
-                                    <v>2324</v>
+                                    <v>2653</v>
                                 </b>
                                 <b>
                                     <a>7</a>
-                                    <b>12</b>
-                                    <v>2337</v>
+                                    <b>10</b>
+                                    <v>2432</v>
                                 </b>
                                 <b>
-                                    <a>12</a>
-                                    <b>34</b>
-                                    <v>2311</v>
+                                    <a>10</a>
+                                    <b>18</b>
+                                    <v>2536</v>
                                 </b>
                                 <b>
-                                    <a>40</a>
+                                    <a>18</a>
                                     <b>241</b>
-                                    <v>181</v>
+                                    <v>1872</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3291,67 +3384,67 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1519</v>
+                                    <v>1430</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>4</b>
-                                    <v>1766</v>
+                                    <v>1742</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>3636</v>
+                                    <v>3407</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>8</b>
-                                    <v>2662</v>
+                                    <v>2757</v>
                                 </b>
                                 <b>
                                     <a>8</a>
                                     <b>13</b>
-                                    <v>2792</v>
+                                    <v>2822</v>
                                 </b>
                                 <b>
                                     <a>13</a>
-                                    <b>17</b>
-                                    <v>2311</v>
+                                    <b>18</b>
+                                    <v>2562</v>
                                 </b>
                                 <b>
-                                    <a>17</a>
+                                    <a>18</a>
                                     <b>28</b>
-                                    <v>2376</v>
+                                    <v>2445</v>
                                 </b>
                                 <b>
                                     <a>28</a>
-                                    <b>42</b>
-                                    <v>2428</v>
+                                    <b>44</b>
+                                    <v>2367</v>
                                 </b>
                                 <b>
-                                    <a>42</a>
-                                    <b>57</b>
-                                    <v>2415</v>
+                                    <a>44</a>
+                                    <b>59</b>
+                                    <v>2419</v>
                                 </b>
                                 <b>
-                                    <a>57</a>
-                                    <b>71</b>
-                                    <v>2389</v>
+                                    <a>59</a>
+                                    <b>72</b>
+                                    <v>2367</v>
                                 </b>
                                 <b>
-                                    <a>71</a>
+                                    <a>72</a>
                                     <b>88</b>
-                                    <v>2363</v>
+                                    <v>2341</v>
                                 </b>
                                 <b>
                                     <a>88</a>
-                                    <b>113</b>
-                                    <v>2311</v>
+                                    <b>114</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>113</a>
-                                    <b>203</b>
-                                    <v>1701</v>
+                                    <a>114</a>
+                                    <b>208</b>
+                                    <v>1742</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3367,72 +3460,72 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>441</v>
+                                    <v>442</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>623</v>
+                                    <v>585</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>233</v>
+                                    <v>247</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>272</v>
+                                    <v>247</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>246</v>
+                                    <v>273</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>9</b>
-                                    <v>467</v>
+                                    <v>455</v>
                                 </b>
                                 <b>
                                     <a>9</a>
-                                    <b>16</b>
-                                    <v>415</v>
+                                    <b>15</b>
+                                    <v>403</v>
                                 </b>
                                 <b>
-                                    <a>16</a>
-                                    <b>41</b>
-                                    <v>389</v>
+                                    <a>15</a>
+                                    <b>37</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>46</a>
-                                    <b>172</b>
-                                    <v>389</v>
+                                    <a>37</a>
+                                    <b>159</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>181</a>
-                                    <b>773</b>
-                                    <v>389</v>
+                                    <a>159</a>
+                                    <b>700</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>791</a>
-                                    <b>2919</b>
-                                    <v>389</v>
+                                    <a>723</a>
+                                    <b>2453</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>2920</a>
-                                    <b>8125</b>
-                                    <v>389</v>
+                                    <a>2462</a>
+                                    <b>7702</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>8227</a>
-                                    <b>25706</b>
-                                    <v>389</v>
+                                    <a>7795</a>
+                                    <b>14906</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>33875</a>
-                                    <b>34983</b>
-                                    <v>25</v>
+                                    <a>16424</a>
+                                    <b>38206</b>
+                                    <v>78</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3448,52 +3541,52 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1506</v>
+                                    <v>1456</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>545</v>
+                                    <v>481</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>428</v>
+                                    <v>481</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>10</b>
-                                    <v>389</v>
+                                    <b>9</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>10</a>
-                                    <b>39</b>
-                                    <v>389</v>
+                                    <a>9</a>
+                                    <b>33</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>39</a>
-                                    <b>139</b>
-                                    <v>389</v>
+                                    <a>34</a>
+                                    <b>109</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>147</a>
-                                    <b>387</b>
-                                    <v>389</v>
+                                    <a>112</a>
+                                    <b>353</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>397</a>
-                                    <b>748</b>
-                                    <v>389</v>
+                                    <a>358</a>
+                                    <b>696</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>769</a>
-                                    <b>963</b>
-                                    <v>389</v>
+                                    <a>698</a>
+                                    <b>950</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>964</a>
-                                    <b>1322</b>
-                                    <v>246</v>
+                                    <a>950</a>
+                                    <b>1323</b>
+                                    <v>312</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3509,62 +3602,62 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>545</v>
+                                    <v>533</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>675</v>
+                                    <v>637</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>337</v>
+                                    <v>351</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>402</v>
+                                    <v>416</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>9</b>
-                                    <v>467</v>
+                                    <v>455</v>
                                 </b>
                                 <b>
                                     <a>9</a>
-                                    <b>19</b>
-                                    <v>389</v>
+                                    <b>17</b>
+                                    <v>403</v>
                                 </b>
                                 <b>
-                                    <a>19</a>
-                                    <b>64</b>
-                                    <v>389</v>
+                                    <a>18</a>
+                                    <b>63</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>66</a>
-                                    <b>184</b>
-                                    <v>402</v>
+                                    <a>64</a>
+                                    <b>158</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>201</a>
-                                    <b>390</b>
-                                    <v>389</v>
+                                    <a>171</a>
+                                    <b>379</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>418</a>
-                                    <b>742</b>
-                                    <v>389</v>
+                                    <a>380</a>
+                                    <b>735</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>752</a>
-                                    <b>1025</b>
-                                    <v>389</v>
+                                    <a>735</a>
+                                    <b>1008</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>1028</a>
-                                    <b>1382</b>
-                                    <v>285</v>
+                                    <a>1010</a>
+                                    <b>1392</b>
+                                    <v>325</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3580,62 +3673,62 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>545</v>
+                                    <v>533</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>675</v>
+                                    <v>637</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>337</v>
+                                    <v>351</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>402</v>
+                                    <v>416</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>9</b>
-                                    <v>467</v>
+                                    <v>455</v>
                                 </b>
                                 <b>
                                     <a>9</a>
-                                    <b>19</b>
-                                    <v>389</v>
+                                    <b>17</b>
+                                    <v>403</v>
                                 </b>
                                 <b>
-                                    <a>19</a>
+                                    <a>18</a>
                                     <b>64</b>
-                                    <v>389</v>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>66</a>
-                                    <b>184</b>
-                                    <v>389</v>
+                                    <a>64</a>
+                                    <b>159</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>184</a>
+                                    <a>171</a>
                                     <b>381</b>
-                                    <v>389</v>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>396</a>
-                                    <b>752</b>
-                                    <v>389</v>
+                                    <a>385</a>
+                                    <b>749</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>753</a>
-                                    <b>1034</b>
-                                    <v>402</v>
+                                    <a>750</a>
+                                    <b>1026</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>1050</a>
-                                    <b>1386</b>
-                                    <v>285</v>
+                                    <a>1027</a>
+                                    <b>1399</b>
+                                    <v>325</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3651,52 +3744,52 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1285</v>
+                                    <v>1274</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>727</v>
+                                    <v>728</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>441</v>
+                                    <v>403</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>415</v>
+                                    <v>429</v>
                                 </b>
                                 <b>
                                     <a>6</a>
-                                    <b>16</b>
-                                    <v>389</v>
+                                    <b>14</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>16</a>
-                                    <b>37</b>
-                                    <v>389</v>
+                                    <a>14</a>
+                                    <b>35</b>
+                                    <v>403</v>
                                 </b>
                                 <b>
-                                    <a>37</a>
-                                    <b>67</b>
-                                    <v>402</v>
+                                    <a>35</a>
+                                    <b>66</b>
+                                    <v>429</v>
                                 </b>
                                 <b>
                                     <a>67</a>
-                                    <b>103</b>
-                                    <v>389</v>
+                                    <b>104</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
                                     <a>104</a>
                                     <b>127</b>
-                                    <v>402</v>
+                                    <v>403</v>
                                 </b>
                                 <b>
-                                    <a>127</a>
-                                    <b>177</b>
-                                    <v>220</v>
+                                    <a>128</a>
+                                    <b>178</b>
+                                    <v>221</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3712,72 +3805,72 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>311</v>
+                                    <v>286</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>3532</v>
+                                    <v>3316</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>2636</v>
+                                    <v>2458</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>9</b>
-                                    <v>2415</v>
+                                    <v>2497</v>
                                 </b>
                                 <b>
                                     <a>9</a>
                                     <b>14</b>
-                                    <v>2350</v>
+                                    <v>2471</v>
                                 </b>
                                 <b>
                                     <a>14</a>
                                     <b>21</b>
-                                    <v>2467</v>
+                                    <v>2393</v>
                                 </b>
                                 <b>
                                     <a>21</a>
-                                    <b>34</b>
-                                    <v>2324</v>
+                                    <b>32</b>
+                                    <v>2341</v>
                                 </b>
                                 <b>
-                                    <a>34</a>
-                                    <b>64</b>
-                                    <v>2311</v>
+                                    <a>32</a>
+                                    <b>60</b>
+                                    <v>2367</v>
                                 </b>
                                 <b>
-                                    <a>64</a>
-                                    <b>103</b>
-                                    <v>2337</v>
+                                    <a>60</a>
+                                    <b>101</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>103</a>
+                                    <a>101</a>
                                     <b>152</b>
-                                    <v>2311</v>
+                                    <v>2354</v>
                                 </b>
                                 <b>
                                     <a>152</a>
                                     <b>230</b>
-                                    <v>2311</v>
+                                    <v>2341</v>
                                 </b>
                                 <b>
                                     <a>230</a>
-                                    <b>525</b>
-                                    <v>2311</v>
+                                    <b>480</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>528</a>
-                                    <b>2539</b>
-                                    <v>2311</v>
+                                    <a>482</a>
+                                    <b>2152</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>2543</a>
-                                    <b>9864</b>
-                                    <v>740</v>
+                                    <a>2200</a>
+                                    <b>9921</b>
+                                    <v>949</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3793,47 +3886,47 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10713</v>
+                                    <v>9884</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>4753</v>
+                                    <v>5605</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>6</b>
-                                    <v>2337</v>
+                                    <v>2341</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>9</b>
-                                    <v>2363</v>
+                                    <v>2341</v>
                                 </b>
                                 <b>
                                     <a>9</a>
                                     <b>14</b>
-                                    <v>2792</v>
+                                    <v>2419</v>
                                 </b>
                                 <b>
                                     <a>14</a>
                                     <b>22</b>
-                                    <v>2324</v>
+                                    <v>2484</v>
                                 </b>
                                 <b>
                                     <a>22</a>
-                                    <b>57</b>
-                                    <v>2311</v>
+                                    <b>49</b>
+                                    <v>2327</v>
                                 </b>
                                 <b>
-                                    <a>57</a>
-                                    <b>287</b>
-                                    <v>2311</v>
+                                    <a>49</a>
+                                    <b>220</b>
+                                    <v>2314</v>
                                 </b>
                                 <b>
-                                    <a>291</a>
-                                    <b>1306</b>
-                                    <v>766</v>
+                                    <a>223</a>
+                                    <b>1307</b>
+                                    <v>1001</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3849,42 +3942,42 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>12428</v>
+                                    <v>11327</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>6532</v>
+                                    <v>5839</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>2532</v>
+                                    <v>2197</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>5</b>
-                                    <v>1753</v>
+                                    <b>6</b>
+                                    <v>2835</v>
                                 </b>
                                 <b>
-                                    <a>5</a>
-                                    <b>7</b>
-                                    <v>2207</v>
+                                    <a>6</a>
+                                    <b>8</b>
+                                    <v>2132</v>
                                 </b>
                                 <b>
-                                    <a>7</a>
+                                    <a>8</a>
                                     <b>12</b>
-                                    <v>2441</v>
+                                    <v>2419</v>
                                 </b>
                                 <b>
                                     <a>12</a>
-                                    <b>27</b>
-                                    <v>2363</v>
+                                    <b>24</b>
+                                    <v>2445</v>
                                 </b>
                                 <b>
-                                    <a>27</a>
-                                    <b>36</b>
-                                    <v>415</v>
+                                    <a>24</a>
+                                    <b>42</b>
+                                    <v>1521</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3900,67 +3993,67 @@
                                 <b>
                                     <a>1</a>
                                     <b>3</b>
-                                    <v>1519</v>
+                                    <v>1430</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>3688</v>
+                                    <v>3446</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>2714</v>
+                                    <v>2757</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>8</b>
-                                    <v>1649</v>
+                                    <v>1729</v>
                                 </b>
                                 <b>
                                     <a>8</a>
-                                    <b>13</b>
-                                    <v>2766</v>
+                                    <b>12</b>
+                                    <v>2354</v>
                                 </b>
                                 <b>
-                                    <a>13</a>
-                                    <b>17</b>
-                                    <v>2363</v>
+                                    <a>12</a>
+                                    <b>16</b>
+                                    <v>2354</v>
                                 </b>
                                 <b>
-                                    <a>17</a>
-                                    <b>28</b>
-                                    <v>2415</v>
+                                    <a>16</a>
+                                    <b>24</b>
+                                    <v>2406</v>
                                 </b>
                                 <b>
-                                    <a>28</a>
-                                    <b>42</b>
-                                    <v>2415</v>
+                                    <a>24</a>
+                                    <b>39</b>
+                                    <v>2458</v>
                                 </b>
                                 <b>
-                                    <a>42</a>
-                                    <b>55</b>
-                                    <v>2337</v>
+                                    <a>39</a>
+                                    <b>53</b>
+                                    <v>2445</v>
                                 </b>
                                 <b>
-                                    <a>55</a>
-                                    <b>69</b>
-                                    <v>2441</v>
+                                    <a>53</a>
+                                    <b>67</b>
+                                    <v>2432</v>
                                 </b>
                                 <b>
-                                    <a>69</a>
-                                    <b>86</b>
-                                    <v>2415</v>
+                                    <a>67</a>
+                                    <b>82</b>
+                                    <v>2393</v>
                                 </b>
                                 <b>
-                                    <a>86</a>
-                                    <b>112</b>
-                                    <v>2376</v>
+                                    <a>82</a>
+                                    <b>105</b>
+                                    <v>2327</v>
                                 </b>
                                 <b>
-                                    <a>112</a>
-                                    <b>200</b>
-                                    <v>1571</v>
+                                    <a>105</a>
+                                    <b>204</b>
+                                    <v>2184</v>
                                 </b>
                             </bs>
                         </hist>
@@ -3976,72 +4069,72 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1506</v>
+                                    <v>1417</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1623</v>
+                                    <v>1534</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>2558</v>
+                                    <v>2510</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>2402</v>
+                                    <v>2367</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>8</b>
-                                    <v>1649</v>
+                                    <v>1690</v>
                                 </b>
                                 <b>
                                     <a>8</a>
                                     <b>13</b>
-                                    <v>2688</v>
+                                    <v>2783</v>
                                 </b>
                                 <b>
                                     <a>13</a>
                                     <b>18</b>
-                                    <v>2636</v>
+                                    <v>2549</v>
                                 </b>
                                 <b>
                                     <a>18</a>
-                                    <b>30</b>
-                                    <v>2402</v>
+                                    <b>28</b>
+                                    <v>2432</v>
                                 </b>
                                 <b>
-                                    <a>30</a>
+                                    <a>28</a>
                                     <b>44</b>
-                                    <v>2389</v>
+                                    <v>2445</v>
                                 </b>
                                 <b>
                                     <a>44</a>
-                                    <b>58</b>
-                                    <v>2337</v>
+                                    <b>59</b>
+                                    <v>2393</v>
                                 </b>
                                 <b>
-                                    <a>58</a>
+                                    <a>59</a>
                                     <b>72</b>
-                                    <v>2324</v>
+                                    <v>2419</v>
                                 </b>
                                 <b>
                                     <a>72</a>
                                     <b>90</b>
-                                    <v>2389</v>
+                                    <v>2354</v>
                                 </b>
                                 <b>
                                     <a>90</a>
                                     <b>117</b>
-                                    <v>2311</v>
+                                    <v>2327</v>
                                 </b>
                                 <b>
                                     <a>117</a>
-                                    <b>202</b>
-                                    <v>1454</v>
+                                    <b>208</b>
+                                    <v>1495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4057,72 +4150,67 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>350</v>
+                                    <v>338</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>480</v>
+                                    <v>468</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>5</b>
-                                    <v>402</v>
+                                    <v>455</v>
                                 </b>
                                 <b>
                                     <a>5</a>
-                                    <b>6</b>
-                                    <v>194</v>
+                                    <b>7</b>
+                                    <v>455</v>
                                 </b>
                                 <b>
-                                    <a>6</a>
-                                    <b>8</b>
-                                    <v>467</v>
+                                    <a>7</a>
+                                    <b>10</b>
+                                    <v>403</v>
                                 </b>
                                 <b>
-                                    <a>8</a>
-                                    <b>14</b>
-                                    <v>389</v>
+                                    <a>10</a>
+                                    <b>19</b>
+                                    <v>442</v>
                                 </b>
                                 <b>
-                                    <a>14</a>
-                                    <b>28</b>
-                                    <v>389</v>
+                                    <a>19</a>
+                                    <b>50</b>
+                                    <v>403</v>
                                 </b>
                                 <b>
-                                    <a>28</a>
-                                    <b>68</b>
-                                    <v>389</v>
+                                    <a>53</a>
+                                    <b>168</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>69</a>
-                                    <b>258</b>
-                                    <v>389</v>
+                                    <a>169</a>
+                                    <b>691</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>264</a>
-                                    <b>1063</b>
-                                    <v>389</v>
+                                    <a>806</a>
+                                    <b>2495</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>1113</a>
-                                    <b>3378</b>
-                                    <v>389</v>
+                                    <a>2618</a>
+                                    <b>6562</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>3687</a>
-                                    <b>8035</b>
-                                    <v>389</v>
+                                    <a>6710</a>
+                                    <b>9993</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>8096</a>
-                                    <b>10367</b>
-                                    <v>389</v>
-                                </b>
-                                <b>
-                                    <a>10416</a>
-                                    <b>17990</b>
-                                    <v>116</v>
+                                    <a>10241</a>
+                                    <b>19364</b>
+                                    <v>247</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4138,52 +4226,52 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1441</v>
+                                    <v>1404</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>610</v>
+                                    <v>585</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>428</v>
+                                    <v>429</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>9</b>
-                                    <v>402</v>
+                                    <b>7</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
-                                    <b>41</b>
-                                    <v>389</v>
+                                    <a>7</a>
+                                    <b>24</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>42</a>
-                                    <b>123</b>
-                                    <v>389</v>
+                                    <a>24</a>
+                                    <b>94</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>143</a>
-                                    <b>406</b>
-                                    <v>389</v>
+                                    <a>95</a>
+                                    <b>314</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>406</a>
-                                    <b>760</b>
-                                    <v>389</v>
+                                    <a>325</a>
+                                    <b>676</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>771</a>
-                                    <b>994</b>
-                                    <v>389</v>
+                                    <a>688</a>
+                                    <b>977</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>1006</a>
-                                    <b>1289</b>
-                                    <v>298</v>
+                                    <a>979</a>
+                                    <b>1290</b>
+                                    <v>403</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4199,67 +4287,67 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>519</v>
+                                    <v>507</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>675</v>
+                                    <v>650</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>298</v>
+                                    <v>338</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>402</v>
+                                    <v>429</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>9</b>
-                                    <v>454</v>
+                                    <v>429</v>
                                 </b>
                                 <b>
                                     <a>9</a>
-                                    <b>16</b>
-                                    <v>415</v>
+                                    <b>15</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
                                     <a>16</a>
                                     <b>39</b>
-                                    <v>389</v>
+                                    <v>429</v>
                                 </b>
                                 <b>
-                                    <a>39</a>
-                                    <b>136</b>
-                                    <v>389</v>
+                                    <a>40</a>
+                                    <b>138</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>136</a>
-                                    <b>344</b>
-                                    <v>389</v>
+                                    <a>141</a>
+                                    <b>332</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>353</a>
-                                    <b>637</b>
-                                    <v>389</v>
+                                    <a>352</a>
+                                    <b>653</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>675</a>
-                                    <b>1011</b>
-                                    <v>389</v>
+                                    <a>657</a>
+                                    <b>998</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
                                     <a>1011</a>
-                                    <b>1272</b>
-                                    <v>389</v>
+                                    <b>1264</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>1284</a>
-                                    <b>1387</b>
-                                    <v>25</v>
+                                    <a>1281</a>
+                                    <b>1401</b>
+                                    <v>39</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4275,62 +4363,62 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>896</v>
+                                    <v>884</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>311</v>
+                                    <v>338</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>506</v>
+                                    <v>520</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>350</v>
+                                    <v>325</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>8</b>
-                                    <v>441</v>
+                                    <v>416</v>
                                 </b>
                                 <b>
                                     <a>8</a>
-                                    <b>18</b>
-                                    <v>389</v>
+                                    <b>17</b>
+                                    <v>403</v>
                                 </b>
                                 <b>
-                                    <a>19</a>
+                                    <a>17</a>
                                     <b>33</b>
-                                    <v>389</v>
+                                    <v>429</v>
                                 </b>
                                 <b>
                                     <a>33</a>
                                     <b>49</b>
-                                    <v>389</v>
+                                    <v>390</v>
                                 </b>
                                 <b>
                                     <a>49</a>
                                     <b>64</b>
-                                    <v>402</v>
+                                    <v>390</v>
                                 </b>
                                 <b>
                                     <a>64</a>
-                                    <b>82</b>
-                                    <v>428</v>
+                                    <b>81</b>
+                                    <v>403</v>
                                 </b>
                                 <b>
-                                    <a>82</a>
+                                    <a>81</a>
                                     <b>95</b>
-                                    <v>402</v>
+                                    <v>429</v>
                                 </b>
                                 <b>
                                     <a>95</a>
-                                    <b>112</b>
-                                    <v>220</v>
+                                    <b>108</b>
+                                    <v>234</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4346,67 +4434,67 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>519</v>
+                                    <v>507</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>675</v>
+                                    <v>663</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>298</v>
+                                    <v>338</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>402</v>
+                                    <v>416</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>9</b>
-                                    <v>454</v>
+                                    <v>429</v>
                                 </b>
                                 <b>
                                     <a>9</a>
-                                    <b>16</b>
-                                    <v>415</v>
+                                    <b>15</b>
+                                    <v>403</v>
                                 </b>
                                 <b>
-                                    <a>16</a>
-                                    <b>39</b>
-                                    <v>402</v>
+                                    <a>15</a>
+                                    <b>36</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>48</a>
-                                    <b>141</b>
-                                    <v>389</v>
+                                    <a>37</a>
+                                    <b>131</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>142</a>
-                                    <b>352</b>
-                                    <v>389</v>
+                                    <a>133</a>
+                                    <b>314</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>359</a>
-                                    <b>637</b>
-                                    <v>389</v>
+                                    <a>314</a>
+                                    <b>632</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>674</a>
-                                    <b>999</b>
-                                    <v>389</v>
+                                    <a>637</a>
+                                    <b>969</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>1010</a>
-                                    <b>1283</b>
-                                    <v>389</v>
+                                    <a>970</a>
+                                    <b>1181</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>1381</a>
-                                    <b>1382</b>
-                                    <v>12</v>
+                                    <a>1211</a>
+                                    <b>1394</b>
+                                    <v>65</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4416,19 +4504,19 @@
         </relation>
         <relation>
             <name>ruby_alias_def</name>
-            <cardinality>1244</cardinality>
+            <cardinality>1264</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1244</v>
+                    <v>1264</v>
                 </e>
                 <e>
                     <k>alias</k>
-                    <v>1244</v>
+                    <v>1264</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>1244</v>
+                    <v>1264</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -4442,7 +4530,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1244</v>
+                                    <v>1264</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4458,7 +4546,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1244</v>
+                                    <v>1264</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4474,7 +4562,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1244</v>
+                                    <v>1264</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4490,7 +4578,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1244</v>
+                                    <v>1264</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4506,7 +4594,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1244</v>
+                                    <v>1264</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4522,7 +4610,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1244</v>
+                                    <v>1264</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4635,19 +4723,19 @@
         </relation>
         <relation>
             <name>ruby_argument_list_child</name>
-            <cardinality>823783</cardinality>
+            <cardinality>832018</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_argument_list</k>
-                    <v>664257</v>
+                    <v>669942</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>428</v>
+                    <v>429</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>823783</v>
+                    <v>832018</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -4661,17 +4749,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>562976</v>
+                                    <v>567211</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>64088</v>
+                                    <v>64884</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>34</b>
-                                    <v>37193</v>
+                                    <v>37846</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4687,17 +4775,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>562976</v>
+                                    <v>567211</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>64088</v>
+                                    <v>64884</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>34</b>
-                                    <v>37193</v>
+                                    <v>37846</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4713,47 +4801,47 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>142</v>
+                                    <v>143</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>38</v>
+                                    <v>39</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>7</b>
-                                    <v>38</v>
+                                    <v>39</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>11</b>
-                                    <v>38</v>
+                                    <v>39</v>
                                 </b>
                                 <b>
                                     <a>11</a>
-                                    <b>20</b>
-                                    <v>38</v>
+                                    <b>21</b>
+                                    <v>39</v>
                                 </b>
                                 <b>
-                                    <a>22</a>
-                                    <b>42</b>
-                                    <v>38</v>
+                                    <a>23</a>
+                                    <b>43</b>
+                                    <v>39</v>
                                 </b>
                                 <b>
-                                    <a>55</a>
-                                    <b>372</b>
-                                    <v>38</v>
+                                    <a>56</a>
+                                    <b>378</b>
+                                    <v>39</v>
                                 </b>
                                 <b>
-                                    <a>900</a>
-                                    <b>7800</b>
-                                    <v>38</v>
+                                    <a>919</a>
+                                    <b>7900</b>
+                                    <v>39</v>
                                 </b>
                                 <b>
-                                    <a>51150</a>
-                                    <b>51151</b>
-                                    <v>12</v>
+                                    <a>51512</a>
+                                    <b>51513</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4769,47 +4857,47 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>142</v>
+                                    <v>143</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>38</v>
+                                    <v>39</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>7</b>
-                                    <v>38</v>
+                                    <v>39</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>11</b>
-                                    <v>38</v>
+                                    <v>39</v>
                                 </b>
                                 <b>
                                     <a>11</a>
-                                    <b>20</b>
-                                    <v>38</v>
+                                    <b>21</b>
+                                    <v>39</v>
                                 </b>
                                 <b>
-                                    <a>22</a>
-                                    <b>42</b>
-                                    <v>38</v>
+                                    <a>23</a>
+                                    <b>43</b>
+                                    <v>39</v>
                                 </b>
                                 <b>
-                                    <a>55</a>
-                                    <b>372</b>
-                                    <v>38</v>
+                                    <a>56</a>
+                                    <b>378</b>
+                                    <v>39</v>
                                 </b>
                                 <b>
-                                    <a>900</a>
-                                    <b>7800</b>
-                                    <v>38</v>
+                                    <a>919</a>
+                                    <b>7900</b>
+                                    <v>39</v>
                                 </b>
                                 <b>
-                                    <a>51150</a>
-                                    <b>51151</b>
-                                    <v>12</v>
+                                    <a>51512</a>
+                                    <b>51513</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4825,7 +4913,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>823783</v>
+                                    <v>832018</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4841,7 +4929,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>823783</v>
+                                    <v>832018</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4851,22 +4939,22 @@
         </relation>
         <relation>
             <name>ruby_argument_list_def</name>
-            <cardinality>664517</cardinality>
+            <cardinality>670202</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>664517</v>
+                    <v>670202</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_array_child</name>
-            <cardinality>699082</cardinality>
+            <cardinality>700387</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_array</k>
-                    <v>237416</v>
+                    <v>237942</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -4874,7 +4962,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>699082</v>
+                    <v>700387</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -4888,17 +4976,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>11987</v>
+                                    <v>12128</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>212081</v>
+                                    <v>212308</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>63361</b>
-                                    <v>13348</v>
+                                    <v>13506</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4914,17 +5002,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>11987</v>
+                                    <v>12128</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>212081</v>
+                                    <v>212308</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>63361</b>
-                                    <v>13348</v>
+                                    <v>13506</v>
                                 </b>
                             </bs>
                         </hist>
@@ -4964,7 +5052,7 @@
                                 </b>
                                 <b>
                                     <a>11</a>
-                                    <b>237417</b>
+                                    <b>237943</b>
                                     <v>1294</v>
                                 </b>
                             </bs>
@@ -5005,7 +5093,7 @@
                                 </b>
                                 <b>
                                     <a>11</a>
-                                    <b>237417</b>
+                                    <b>237943</b>
                                     <v>1294</v>
                                 </b>
                             </bs>
@@ -5022,7 +5110,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>699082</v>
+                                    <v>700387</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5038,7 +5126,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>699082</v>
+                                    <v>700387</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5048,11 +5136,11 @@
         </relation>
         <relation>
             <name>ruby_array_def</name>
-            <cardinality>245561</cardinality>
+            <cardinality>246221</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>245561</v>
+                    <v>246221</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -5302,19 +5390,19 @@
         </relation>
         <relation>
             <name>ruby_assignment_def</name>
-            <cardinality>130246</cardinality>
+            <cardinality>131940</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>130246</v>
+                    <v>131940</v>
                 </e>
                 <e>
                     <k>left</k>
-                    <v>130246</v>
+                    <v>131940</v>
                 </e>
                 <e>
                     <k>right</k>
-                    <v>130246</v>
+                    <v>131940</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -5328,7 +5416,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>130246</v>
+                                    <v>131940</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5344,7 +5432,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>130246</v>
+                                    <v>131940</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5360,7 +5448,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>130246</v>
+                                    <v>131940</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5376,7 +5464,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>130246</v>
+                                    <v>131940</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5392,7 +5480,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>130246</v>
+                                    <v>131940</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5408,7 +5496,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>130246</v>
+                                    <v>131940</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5418,23 +5506,23 @@
         </relation>
         <relation>
             <name>ruby_ast_node_info</name>
-            <cardinality>8791047</cardinality>
+            <cardinality>9180290</cardinality>
             <columnsizes>
                 <e>
                     <k>node</k>
-                    <v>8791047</v>
+                    <v>9180290</v>
                 </e>
                 <e>
                     <k>parent</k>
-                    <v>2884450</v>
+                    <v>3212205</v>
                 </e>
                 <e>
                     <k>parent_index</k>
-                    <v>2792</v>
+                    <v>2796</v>
                 </e>
                 <e>
                     <k>loc</k>
-                    <v>8496293</v>
+                    <v>8693375</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -5448,7 +5536,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8791047</v>
+                                    <v>9180290</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5464,7 +5552,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8791047</v>
+                                    <v>9180290</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5480,7 +5568,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8791047</v>
+                                    <v>9180290</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5496,27 +5584,27 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>325272</v>
+                                    <v>517803</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>393074</v>
+                                    <v>442358</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1608542</v>
+                                    <v>1733980</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>344466</v>
+                                    <v>339055</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>216</b>
-                                    <v>213094</v>
+                                    <v>179008</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5532,27 +5620,27 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>325272</v>
+                                    <v>517803</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>393074</v>
+                                    <v>442358</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1608542</v>
+                                    <v>1733980</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>344466</v>
+                                    <v>339055</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>216</b>
-                                    <v>213094</v>
+                                    <v>179008</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5568,27 +5656,27 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>325272</v>
+                                    <v>517803</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>393074</v>
+                                    <v>442358</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1608542</v>
+                                    <v>1733980</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>344466</v>
+                                    <v>339055</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>216</b>
-                                    <v>213094</v>
+                                    <v>179008</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5604,52 +5692,57 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>649</v>
+                                    <v>455</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>389</v>
+                                    <v>195</v>
                                 </b>
                                 <b>
                                     <a>3</a>
-                                    <b>5</b>
-                                    <v>233</v>
+                                    <b>4</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>5</a>
+                                    <a>4</a>
                                     <b>6</b>
-                                    <v>233</v>
+                                    <v>234</v>
                                 </b>
                                 <b>
                                     <a>6</a>
-                                    <b>9</b>
-                                    <v>233</v>
+                                    <b>7</b>
+                                    <v>234</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
+                                    <a>7</a>
+                                    <b>10</b>
+                                    <v>234</v>
+                                </b>
+                                <b>
+                                    <a>10</a>
                                     <b>21</b>
-                                    <v>246</v>
+                                    <v>208</v>
                                 </b>
                                 <b>
                                     <a>21</a>
-                                    <b>48</b>
-                                    <v>220</v>
+                                    <b>42</b>
+                                    <v>221</v>
                                 </b>
                                 <b>
-                                    <a>48</a>
-                                    <b>127</b>
-                                    <v>220</v>
+                                    <a>43</a>
+                                    <b>95</b>
+                                    <v>221</v>
                                 </b>
                                 <b>
-                                    <a>130</a>
-                                    <b>946</b>
-                                    <v>220</v>
+                                    <a>99</a>
+                                    <b>491</b>
+                                    <v>221</v>
                                 </b>
                                 <b>
-                                    <a>1416</a>
-                                    <b>222113</b>
-                                    <v>142</v>
+                                    <a>524</a>
+                                    <b>246988</b>
+                                    <v>182</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5665,52 +5758,57 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>649</v>
+                                    <v>455</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>389</v>
+                                    <v>195</v>
                                 </b>
                                 <b>
                                     <a>3</a>
-                                    <b>5</b>
-                                    <v>233</v>
+                                    <b>4</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>5</a>
+                                    <a>4</a>
                                     <b>6</b>
-                                    <v>233</v>
+                                    <v>234</v>
                                 </b>
                                 <b>
                                     <a>6</a>
-                                    <b>9</b>
-                                    <v>233</v>
+                                    <b>7</b>
+                                    <v>234</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
+                                    <a>7</a>
+                                    <b>10</b>
+                                    <v>234</v>
+                                </b>
+                                <b>
+                                    <a>10</a>
                                     <b>21</b>
-                                    <v>246</v>
+                                    <v>208</v>
                                 </b>
                                 <b>
                                     <a>21</a>
-                                    <b>48</b>
-                                    <v>220</v>
+                                    <b>42</b>
+                                    <v>221</v>
                                 </b>
                                 <b>
-                                    <a>48</a>
-                                    <b>127</b>
-                                    <v>220</v>
+                                    <a>43</a>
+                                    <b>95</b>
+                                    <v>221</v>
                                 </b>
                                 <b>
-                                    <a>130</a>
-                                    <b>946</b>
-                                    <v>220</v>
+                                    <a>99</a>
+                                    <b>491</b>
+                                    <v>221</v>
                                 </b>
                                 <b>
-                                    <a>1416</a>
-                                    <b>222113</b>
-                                    <v>142</v>
+                                    <a>524</a>
+                                    <b>246988</b>
+                                    <v>182</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5726,52 +5824,57 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>649</v>
+                                    <v>455</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>389</v>
+                                    <v>195</v>
                                 </b>
                                 <b>
                                     <a>3</a>
-                                    <b>5</b>
-                                    <v>233</v>
+                                    <b>4</b>
+                                    <v>390</v>
                                 </b>
                                 <b>
-                                    <a>5</a>
+                                    <a>4</a>
                                     <b>6</b>
-                                    <v>233</v>
+                                    <v>234</v>
                                 </b>
                                 <b>
                                     <a>6</a>
-                                    <b>9</b>
-                                    <v>233</v>
+                                    <b>7</b>
+                                    <v>234</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
+                                    <a>7</a>
+                                    <b>10</b>
+                                    <v>234</v>
+                                </b>
+                                <b>
+                                    <a>10</a>
                                     <b>21</b>
-                                    <v>246</v>
+                                    <v>208</v>
                                 </b>
                                 <b>
                                     <a>21</a>
-                                    <b>48</b>
-                                    <v>220</v>
+                                    <b>42</b>
+                                    <v>221</v>
                                 </b>
                                 <b>
-                                    <a>48</a>
-                                    <b>127</b>
-                                    <v>220</v>
+                                    <a>43</a>
+                                    <b>95</b>
+                                    <v>221</v>
                                 </b>
                                 <b>
-                                    <a>130</a>
-                                    <b>946</b>
-                                    <v>220</v>
+                                    <a>99</a>
+                                    <b>491</b>
+                                    <v>221</v>
                                 </b>
                                 <b>
-                                    <a>1416</a>
-                                    <b>221838</b>
-                                    <v>142</v>
+                                    <a>524</a>
+                                    <b>246621</b>
+                                    <v>182</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5787,12 +5890,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8202149</v>
+                                    <v>8208085</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>4</b>
-                                    <v>294143</v>
+                                    <v>485289</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5808,12 +5911,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8202149</v>
+                                    <v>8208085</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>4</b>
-                                    <v>294143</v>
+                                    <v>485289</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5829,12 +5932,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8205110</v>
+                                    <v>8211232</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>291182</v>
+                                    <v>482142</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5844,11 +5947,11 @@
         </relation>
         <relation>
             <name>ruby_bare_string_child</name>
-            <cardinality>14936</cardinality>
+            <cardinality>15074</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_bare_string</k>
-                    <v>11487</v>
+                    <v>11622</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -5856,7 +5959,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>14936</v>
+                    <v>15074</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -5870,12 +5973,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>11159</v>
+                                    <v>11291</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>2233</b>
-                                    <v>328</v>
+                                    <v>331</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5891,12 +5994,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>11159</v>
+                                    <v>11291</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>2233</b>
-                                    <v>328</v>
+                                    <v>331</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5926,7 +6029,7 @@
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>11488</b>
+                                    <b>11623</b>
                                     <v>19</v>
                                 </b>
                             </bs>
@@ -5957,7 +6060,7 @@
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>11488</b>
+                                    <b>11623</b>
                                     <v>19</v>
                                 </b>
                             </bs>
@@ -5974,7 +6077,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>14936</v>
+                                    <v>15074</v>
                                 </b>
                             </bs>
                         </hist>
@@ -5990,7 +6093,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>14936</v>
+                                    <v>15074</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6000,22 +6103,22 @@
         </relation>
         <relation>
             <name>ruby_bare_string_def</name>
-            <cardinality>11487</cardinality>
+            <cardinality>11622</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>11487</v>
+                    <v>11622</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_bare_symbol_child</name>
-            <cardinality>2106</cardinality>
+            <cardinality>2085</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_bare_symbol</k>
-                    <v>2106</v>
+                    <v>2085</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -6023,7 +6126,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>2106</v>
+                    <v>2085</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -6037,7 +6140,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2106</v>
+                                    <v>2085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6053,7 +6156,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2106</v>
+                                    <v>2085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6067,8 +6170,8 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>709</a>
-                                    <b>710</b>
+                                    <a>715</a>
+                                    <b>716</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -6083,8 +6186,8 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>709</a>
-                                    <b>710</b>
+                                    <a>715</a>
+                                    <b>716</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -6101,7 +6204,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2106</v>
+                                    <v>2085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6117,7 +6220,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2106</v>
+                                    <v>2085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6127,11 +6230,11 @@
         </relation>
         <relation>
             <name>ruby_bare_symbol_def</name>
-            <cardinality>2106</cardinality>
+            <cardinality>2085</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2106</v>
+                    <v>2085</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -6365,11 +6468,11 @@
         </relation>
         <relation>
             <name>ruby_begin_child</name>
-            <cardinality>7535</cardinality>
+            <cardinality>7615</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_begin</k>
-                    <v>2523</v>
+                    <v>2549</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -6377,7 +6480,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>7535</v>
+                    <v>7615</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -6391,17 +6494,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>164</v>
+                                    <v>160</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1317</v>
+                                    <v>1328</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>516</v>
+                                    <v>531</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -6411,7 +6514,7 @@
                                 <b>
                                     <a>5</a>
                                     <b>8</b>
-                                    <v>230</v>
+                                    <v>234</v>
                                 </b>
                                 <b>
                                     <a>8</a>
@@ -6432,17 +6535,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>164</v>
+                                    <v>160</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1317</v>
+                                    <v>1328</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>516</v>
+                                    <v>531</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -6452,7 +6555,7 @@
                                 <b>
                                     <a>5</a>
                                     <b>8</b>
-                                    <v>230</v>
+                                    <v>234</v>
                                 </b>
                                 <b>
                                     <a>8</a>
@@ -6502,11 +6605,11 @@
                                 </b>
                                 <b>
                                     <a>24</a>
-                                    <b>35</b>
+                                    <b>34</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>40</a>
+                                    <a>39</a>
                                     <b>63</b>
                                     <v>3</v>
                                 </b>
@@ -6516,13 +6619,13 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>314</a>
-                                    <b>1043</b>
+                                    <a>318</a>
+                                    <b>1062</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>2359</a>
-                                    <b>2524</b>
+                                    <a>2389</a>
+                                    <b>2550</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -6568,11 +6671,11 @@
                                 </b>
                                 <b>
                                     <a>24</a>
-                                    <b>35</b>
+                                    <b>34</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>40</a>
+                                    <a>39</a>
                                     <b>63</b>
                                     <v>3</v>
                                 </b>
@@ -6582,13 +6685,13 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>314</a>
-                                    <b>1043</b>
+                                    <a>318</a>
+                                    <b>1062</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>2359</a>
-                                    <b>2524</b>
+                                    <a>2389</a>
+                                    <b>2550</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -6605,7 +6708,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7535</v>
+                                    <v>7615</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6621,7 +6724,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7535</v>
+                                    <v>7615</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6631,26 +6734,26 @@
         </relation>
         <relation>
             <name>ruby_begin_def</name>
-            <cardinality>2523</cardinality>
+            <cardinality>2549</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2523</v>
+                    <v>2549</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_binary_def</name>
-            <cardinality>67730</cardinality>
+            <cardinality>68619</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>67730</v>
+                    <v>68619</v>
                 </e>
                 <e>
                     <k>left</k>
-                    <v>67730</v>
+                    <v>68619</v>
                 </e>
                 <e>
                     <k>operator</k>
@@ -6658,7 +6761,7 @@
                 </e>
                 <e>
                     <k>right</k>
-                    <v>67730</v>
+                    <v>68619</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -6672,7 +6775,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>67730</v>
+                                    <v>68619</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6688,7 +6791,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>67730</v>
+                                    <v>68619</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6704,7 +6807,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>67730</v>
+                                    <v>68619</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6720,7 +6823,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>67730</v>
+                                    <v>68619</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6736,7 +6839,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>67730</v>
+                                    <v>68619</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6752,7 +6855,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>67730</v>
+                                    <v>68619</v>
                                 </b>
                             </bs>
                         </hist>
@@ -6766,68 +6869,68 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>155</a>
-                                    <b>179</b>
+                                    <a>157</a>
+                                    <b>178</b>
                                     <v>2</v>
                                 </b>
                                 <b>
                                     <a>231</a>
-                                    <b>369</b>
+                                    <b>378</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>474</a>
-                                    <b>559</b>
+                                    <a>491</a>
+                                    <b>576</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>603</a>
-                                    <b>666</b>
+                                    <a>622</a>
+                                    <b>632</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>749</a>
-                                    <b>813</b>
+                                    <a>758</a>
+                                    <b>836</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>949</a>
-                                    <b>969</b>
+                                    <a>956</a>
+                                    <b>970</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1000</a>
-                                    <b>1010</b>
+                                    <a>1011</a>
+                                    <b>1018</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1248</a>
-                                    <b>1317</b>
+                                    <a>1182</a>
+                                    <b>1258</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1348</a>
-                                    <b>1633</b>
+                                    <a>1332</a>
+                                    <b>1732</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1820</a>
-                                    <b>1968</b>
+                                    <a>1804</a>
+                                    <b>2211</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>2381</a>
-                                    <b>3287</b>
+                                    <a>2409</a>
+                                    <b>3329</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>6116</a>
-                                    <b>6739</b>
+                                    <a>6173</a>
+                                    <b>6848</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>31159</a>
-                                    <b>31160</b>
+                                    <a>31539</a>
+                                    <b>31540</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -6842,68 +6945,68 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>155</a>
-                                    <b>179</b>
+                                    <a>157</a>
+                                    <b>178</b>
                                     <v>2</v>
                                 </b>
                                 <b>
                                     <a>231</a>
-                                    <b>369</b>
+                                    <b>378</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>474</a>
-                                    <b>559</b>
+                                    <a>491</a>
+                                    <b>576</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>603</a>
-                                    <b>666</b>
+                                    <a>622</a>
+                                    <b>632</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>749</a>
-                                    <b>813</b>
+                                    <a>758</a>
+                                    <b>836</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>949</a>
-                                    <b>969</b>
+                                    <a>956</a>
+                                    <b>970</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1000</a>
-                                    <b>1010</b>
+                                    <a>1011</a>
+                                    <b>1018</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1248</a>
-                                    <b>1317</b>
+                                    <a>1182</a>
+                                    <b>1258</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1348</a>
-                                    <b>1633</b>
+                                    <a>1332</a>
+                                    <b>1732</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1820</a>
-                                    <b>1968</b>
+                                    <a>1804</a>
+                                    <b>2211</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>2381</a>
-                                    <b>3287</b>
+                                    <a>2409</a>
+                                    <b>3329</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>6116</a>
-                                    <b>6739</b>
+                                    <a>6173</a>
+                                    <b>6848</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>31159</a>
-                                    <b>31160</b>
+                                    <a>31539</a>
+                                    <b>31540</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -6918,68 +7021,68 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>155</a>
-                                    <b>179</b>
+                                    <a>157</a>
+                                    <b>178</b>
                                     <v>2</v>
                                 </b>
                                 <b>
                                     <a>231</a>
-                                    <b>369</b>
+                                    <b>378</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>474</a>
-                                    <b>559</b>
+                                    <a>491</a>
+                                    <b>576</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>603</a>
-                                    <b>666</b>
+                                    <a>622</a>
+                                    <b>632</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>749</a>
-                                    <b>813</b>
+                                    <a>758</a>
+                                    <b>836</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>949</a>
-                                    <b>969</b>
+                                    <a>956</a>
+                                    <b>970</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1000</a>
-                                    <b>1010</b>
+                                    <a>1011</a>
+                                    <b>1018</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1248</a>
-                                    <b>1317</b>
+                                    <a>1182</a>
+                                    <b>1258</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1348</a>
-                                    <b>1633</b>
+                                    <a>1332</a>
+                                    <b>1732</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1820</a>
-                                    <b>1968</b>
+                                    <a>1804</a>
+                                    <b>2211</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>2381</a>
-                                    <b>3287</b>
+                                    <a>2409</a>
+                                    <b>3329</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>6116</a>
-                                    <b>6739</b>
+                                    <a>6173</a>
+                                    <b>6848</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>31159</a>
-                                    <b>31160</b>
+                                    <a>31539</a>
+                                    <b>31540</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -6996,7 +7099,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>67730</v>
+                                    <v>68619</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7012,7 +7115,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>67730</v>
+                                    <v>68619</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7028,7 +7131,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>67730</v>
+                                    <v>68619</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7038,15 +7141,15 @@
         </relation>
         <relation>
             <name>ruby_block_argument_child</name>
-            <cardinality>6050</cardinality>
+            <cardinality>6115</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_block_argument</k>
-                    <v>6050</v>
+                    <v>6115</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>6050</v>
+                    <v>6115</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -7060,7 +7163,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6050</v>
+                                    <v>6115</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7076,7 +7179,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6050</v>
+                                    <v>6115</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7086,36 +7189,32 @@
         </relation>
         <relation>
             <name>ruby_block_argument_def</name>
-            <cardinality>6050</cardinality>
+            <cardinality>6115</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>6050</v>
+                    <v>6115</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
-            <name>ruby_block_child</name>
-            <cardinality>97203</cardinality>
+            <name>ruby_block_body</name>
+            <cardinality>97983</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_block</k>
-                    <v>97060</v>
+                    <v>97983</v>
                 </e>
                 <e>
-                    <k>index</k>
-                    <v>51</v>
-                </e>
-                <e>
-                    <k>child</k>
-                    <v>97203</v>
+                    <k>body</k>
+                    <v>97983</v>
                 </e>
             </columnsizes>
             <dependencies>
                 <dep>
                     <src>ruby_block</src>
-                    <trg>index</trg>
+                    <trg>body</trg>
                     <val>
                         <hist>
                             <budget>12</budget>
@@ -7123,92 +7222,14 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>96969</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>5</b>
-                                    <v>90</v>
+                                    <v>97983</v>
                                 </b>
                             </bs>
                         </hist>
                     </val>
                 </dep>
                 <dep>
-                    <src>ruby_block</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>96969</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>5</b>
-                                    <v>90</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
-                    <trg>ruby_block</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>25</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>8</b>
-                                    <v>12</v>
-                                </b>
-                                <b>
-                                    <a>7474</a>
-                                    <b>7475</b>
-                                    <v>12</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>25</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>8</b>
-                                    <v>12</v>
-                                </b>
-                                <b>
-                                    <a>7474</a>
-                                    <b>7475</b>
-                                    <v>12</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
+                    <src>body</src>
                     <trg>ruby_block</trg>
                     <val>
                         <hist>
@@ -7217,23 +7238,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>97203</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>index</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>97203</v>
+                                    <v>97983</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7242,38 +7247,195 @@
             </dependencies>
         </relation>
         <relation>
-            <name>ruby_block_def</name>
-            <cardinality>97359</cardinality>
+            <name>ruby_block_body_child</name>
+            <cardinality>98126</cardinality>
+            <columnsizes>
+                <e>
+                    <k>ruby_block_body</k>
+                    <v>97983</v>
+                </e>
+                <e>
+                    <k>index</k>
+                    <v>52</v>
+                </e>
+                <e>
+                    <k>child</k>
+                    <v>98126</v>
+                </e>
+            </columnsizes>
+            <dependencies>
+                <dep>
+                    <src>ruby_block_body</src>
+                    <trg>index</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>97892</v>
+                                </b>
+                                <b>
+                                    <a>2</a>
+                                    <b>5</b>
+                                    <v>91</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>ruby_block_body</src>
+                    <trg>child</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>97892</v>
+                                </b>
+                                <b>
+                                    <a>2</a>
+                                    <b>5</b>
+                                    <v>91</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>index</src>
+                    <trg>ruby_block_body</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>2</a>
+                                    <b>3</b>
+                                    <v>26</v>
+                                </b>
+                                <b>
+                                    <a>7</a>
+                                    <b>8</b>
+                                    <v>13</v>
+                                </b>
+                                <b>
+                                    <a>7534</a>
+                                    <b>7535</b>
+                                    <v>13</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>index</src>
+                    <trg>child</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>2</a>
+                                    <b>3</b>
+                                    <v>26</v>
+                                </b>
+                                <b>
+                                    <a>7</a>
+                                    <b>8</b>
+                                    <v>13</v>
+                                </b>
+                                <b>
+                                    <a>7534</a>
+                                    <b>7535</b>
+                                    <v>13</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>child</src>
+                    <trg>ruby_block_body</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>98126</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>child</src>
+                    <trg>index</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>98126</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+            </dependencies>
+        </relation>
+        <relation>
+            <name>ruby_block_body_def</name>
+            <cardinality>97983</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>97359</v>
+                    <v>97983</v>
+                </e>
+            </columnsizes>
+            <dependencies/>
+        </relation>
+        <relation>
+            <name>ruby_block_def</name>
+            <cardinality>98296</cardinality>
+            <columnsizes>
+                <e>
+                    <k>id</k>
+                    <v>98296</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_block_parameter_def</name>
-            <cardinality>2410</cardinality>
+            <cardinality>2442</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2410</v>
+                    <v>2442</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_block_parameter_name</name>
-            <cardinality>2410</cardinality>
+            <cardinality>2442</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_block_parameter</k>
-                    <v>2410</v>
+                    <v>2442</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>2410</v>
+                    <v>2442</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -7287,7 +7449,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2410</v>
+                                    <v>2442</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7303,7 +7465,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2410</v>
+                                    <v>2442</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7313,15 +7475,15 @@
         </relation>
         <relation>
             <name>ruby_block_parameters</name>
-            <cardinality>10459</cardinality>
+            <cardinality>10539</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_block</k>
-                    <v>10459</v>
+                    <v>10539</v>
                 </e>
                 <e>
                     <k>parameters</k>
-                    <v>10459</v>
+                    <v>10539</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -7335,7 +7497,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10459</v>
+                                    <v>10539</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7351,7 +7513,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10459</v>
+                                    <v>10539</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7361,11 +7523,11 @@
         </relation>
         <relation>
             <name>ruby_block_parameters_child</name>
-            <cardinality>27190</cardinality>
+            <cardinality>27656</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_block_parameters</k>
-                    <v>23336</v>
+                    <v>23772</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -7373,7 +7535,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>27190</v>
+                    <v>27656</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -7387,17 +7549,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>19964</v>
+                                    <v>20371</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>3022</v>
+                                    <v>3053</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>6</b>
-                                    <v>349</v>
+                                    <v>347</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7413,17 +7575,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>19964</v>
+                                    <v>20371</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>3022</v>
+                                    <v>3053</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>6</b>
-                                    <v>349</v>
+                                    <v>347</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7437,28 +7599,28 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>9</a>
-                                    <b>10</b>
+                                    <a>10</a>
+                                    <b>11</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>33</a>
-                                    <b>34</b>
+                                    <a>34</a>
+                                    <b>35</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>111</a>
-                                    <b>112</b>
+                                    <a>112</a>
+                                    <b>113</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>1070</a>
-                                    <b>1071</b>
+                                    <a>1097</a>
+                                    <b>1098</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>7405</a>
-                                    <b>7406</b>
+                                    <a>7669</a>
+                                    <b>7670</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -7473,28 +7635,28 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>9</a>
-                                    <b>10</b>
+                                    <a>10</a>
+                                    <b>11</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>33</a>
-                                    <b>34</b>
+                                    <a>34</a>
+                                    <b>35</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>111</a>
-                                    <b>112</b>
+                                    <a>112</a>
+                                    <b>113</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>1070</a>
-                                    <b>1071</b>
+                                    <a>1097</a>
+                                    <b>1098</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>7405</a>
-                                    <b>7406</b>
+                                    <a>7669</a>
+                                    <b>7670</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -7511,7 +7673,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>27190</v>
+                                    <v>27656</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7527,7 +7689,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>27190</v>
+                                    <v>27656</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7537,11 +7699,11 @@
         </relation>
         <relation>
             <name>ruby_block_parameters_def</name>
-            <cardinality>23336</cardinality>
+            <cardinality>23772</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>23336</v>
+                    <v>23772</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -7683,16 +7845,323 @@
             </dependencies>
         </relation>
         <relation>
-            <name>ruby_break_child</name>
-            <cardinality>350</cardinality>
+            <name>ruby_body_statement_child</name>
+            <cardinality>606175</cardinality>
             <columnsizes>
                 <e>
-                    <k>ruby_break</k>
-                    <v>350</v>
+                    <k>ruby_body_statement</k>
+                    <v>195703</v>
+                </e>
+                <e>
+                    <k>index</k>
+                    <v>1103</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>350</v>
+                    <v>606175</v>
+                </e>
+            </columnsizes>
+            <dependencies>
+                <dep>
+                    <src>ruby_body_statement</src>
+                    <trg>index</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>89956</v>
+                                </b>
+                                <b>
+                                    <a>2</a>
+                                    <b>3</b>
+                                    <v>35812</v>
+                                </b>
+                                <b>
+                                    <a>3</a>
+                                    <b>4</b>
+                                    <v>23304</v>
+                                </b>
+                                <b>
+                                    <a>4</a>
+                                    <b>5</b>
+                                    <v>14659</v>
+                                </b>
+                                <b>
+                                    <a>5</a>
+                                    <b>7</b>
+                                    <v>15433</v>
+                                </b>
+                                <b>
+                                    <a>7</a>
+                                    <b>22</b>
+                                    <v>14696</v>
+                                </b>
+                                <b>
+                                    <a>22</a>
+                                    <b>357</b>
+                                    <v>1841</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>ruby_body_statement</src>
+                    <trg>child</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>89956</v>
+                                </b>
+                                <b>
+                                    <a>2</a>
+                                    <b>3</b>
+                                    <v>35812</v>
+                                </b>
+                                <b>
+                                    <a>3</a>
+                                    <b>4</b>
+                                    <v>23304</v>
+                                </b>
+                                <b>
+                                    <a>4</a>
+                                    <b>5</b>
+                                    <v>14659</v>
+                                </b>
+                                <b>
+                                    <a>5</a>
+                                    <b>7</b>
+                                    <v>15433</v>
+                                </b>
+                                <b>
+                                    <a>7</a>
+                                    <b>22</b>
+                                    <v>14696</v>
+                                </b>
+                                <b>
+                                    <a>22</a>
+                                    <b>357</b>
+                                    <v>1841</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>index</src>
+                    <trg>ruby_body_statement</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>61</v>
+                                </b>
+                                <b>
+                                    <a>2</a>
+                                    <b>3</b>
+                                    <v>102</v>
+                                </b>
+                                <b>
+                                    <a>3</a>
+                                    <b>4</b>
+                                    <v>77</v>
+                                </b>
+                                <b>
+                                    <a>4</a>
+                                    <b>5</b>
+                                    <v>111</v>
+                                </b>
+                                <b>
+                                    <a>5</a>
+                                    <b>7</b>
+                                    <v>83</v>
+                                </b>
+                                <b>
+                                    <a>7</a>
+                                    <b>10</b>
+                                    <v>74</v>
+                                </b>
+                                <b>
+                                    <a>10</a>
+                                    <b>13</b>
+                                    <v>92</v>
+                                </b>
+                                <b>
+                                    <a>13</a>
+                                    <b>22</b>
+                                    <v>86</v>
+                                </b>
+                                <b>
+                                    <a>22</a>
+                                    <b>39</b>
+                                    <v>83</v>
+                                </b>
+                                <b>
+                                    <a>40</a>
+                                    <b>66</b>
+                                    <v>83</v>
+                                </b>
+                                <b>
+                                    <a>68</a>
+                                    <b>128</b>
+                                    <v>83</v>
+                                </b>
+                                <b>
+                                    <a>130</a>
+                                    <b>418</b>
+                                    <v>83</v>
+                                </b>
+                                <b>
+                                    <a>456</a>
+                                    <b>63135</b>
+                                    <v>77</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>index</src>
+                    <trg>child</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>61</v>
+                                </b>
+                                <b>
+                                    <a>2</a>
+                                    <b>3</b>
+                                    <v>102</v>
+                                </b>
+                                <b>
+                                    <a>3</a>
+                                    <b>4</b>
+                                    <v>77</v>
+                                </b>
+                                <b>
+                                    <a>4</a>
+                                    <b>5</b>
+                                    <v>111</v>
+                                </b>
+                                <b>
+                                    <a>5</a>
+                                    <b>7</b>
+                                    <v>83</v>
+                                </b>
+                                <b>
+                                    <a>7</a>
+                                    <b>10</b>
+                                    <v>74</v>
+                                </b>
+                                <b>
+                                    <a>10</a>
+                                    <b>13</b>
+                                    <v>92</v>
+                                </b>
+                                <b>
+                                    <a>13</a>
+                                    <b>22</b>
+                                    <v>86</v>
+                                </b>
+                                <b>
+                                    <a>22</a>
+                                    <b>39</b>
+                                    <v>83</v>
+                                </b>
+                                <b>
+                                    <a>40</a>
+                                    <b>66</b>
+                                    <v>83</v>
+                                </b>
+                                <b>
+                                    <a>68</a>
+                                    <b>128</b>
+                                    <v>83</v>
+                                </b>
+                                <b>
+                                    <a>130</a>
+                                    <b>418</b>
+                                    <v>83</v>
+                                </b>
+                                <b>
+                                    <a>456</a>
+                                    <b>63135</b>
+                                    <v>77</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>child</src>
+                    <trg>ruby_body_statement</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>606175</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+                <dep>
+                    <src>child</src>
+                    <trg>index</trg>
+                    <val>
+                        <hist>
+                            <budget>12</budget>
+                            <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>606175</v>
+                                </b>
+                            </bs>
+                        </hist>
+                    </val>
+                </dep>
+            </dependencies>
+        </relation>
+        <relation>
+            <name>ruby_body_statement_def</name>
+            <cardinality>201560</cardinality>
+            <columnsizes>
+                <e>
+                    <k>id</k>
+                    <v>201560</v>
+                </e>
+            </columnsizes>
+            <dependencies/>
+        </relation>
+        <relation>
+            <name>ruby_break_child</name>
+            <cardinality>354</cardinality>
+            <columnsizes>
+                <e>
+                    <k>ruby_break</k>
+                    <v>354</v>
+                </e>
+                <e>
+                    <k>child</k>
+                    <v>354</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -7706,7 +8175,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>350</v>
+                                    <v>354</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7722,7 +8191,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>350</v>
+                                    <v>354</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7732,26 +8201,26 @@
         </relation>
         <relation>
             <name>ruby_break_def</name>
-            <cardinality>3338</cardinality>
+            <cardinality>3355</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3338</v>
+                    <v>3355</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_call_arguments</name>
-            <cardinality>661504</cardinality>
+            <cardinality>667146</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_call</k>
-                    <v>661504</v>
+                    <v>667146</v>
                 </e>
                 <e>
                     <k>arguments</k>
-                    <v>661504</v>
+                    <v>667146</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -7765,7 +8234,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>661504</v>
+                                    <v>667146</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7781,7 +8250,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>661504</v>
+                                    <v>667146</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7791,15 +8260,15 @@
         </relation>
         <relation>
             <name>ruby_call_block</name>
-            <cardinality>232457</cardinality>
+            <cardinality>233892</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_call</k>
-                    <v>232457</v>
+                    <v>233892</v>
                 </e>
                 <e>
                     <k>block</k>
-                    <v>232457</v>
+                    <v>233892</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -7813,7 +8282,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>232457</v>
+                                    <v>233892</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7829,7 +8298,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>232457</v>
+                                    <v>233892</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7839,26 +8308,26 @@
         </relation>
         <relation>
             <name>ruby_call_def</name>
-            <cardinality>965401</cardinality>
+            <cardinality>974897</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>965401</v>
+                    <v>974897</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_call_method</name>
-            <cardinality>965401</cardinality>
+            <cardinality>974897</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_call</k>
-                    <v>965401</v>
+                    <v>974897</v>
                 </e>
                 <e>
                     <k>method</k>
-                    <v>965401</v>
+                    <v>974897</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -7872,7 +8341,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>965401</v>
+                                    <v>974897</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7888,7 +8357,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>965401</v>
+                                    <v>974897</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7898,15 +8367,15 @@
         </relation>
         <relation>
             <name>ruby_call_operator</name>
-            <cardinality>540944</cardinality>
+            <cardinality>548273</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_call</k>
-                    <v>540944</v>
+                    <v>548273</v>
                 </e>
                 <e>
                     <k>operator</k>
-                    <v>540944</v>
+                    <v>548273</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -7920,7 +8389,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>540944</v>
+                                    <v>548273</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7936,7 +8405,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>540944</v>
+                                    <v>548273</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7946,15 +8415,15 @@
         </relation>
         <relation>
             <name>ruby_call_receiver</name>
-            <cardinality>540944</cardinality>
+            <cardinality>548273</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_call</k>
-                    <v>540944</v>
+                    <v>548273</v>
                 </e>
                 <e>
                     <k>receiver</k>
-                    <v>540944</v>
+                    <v>548273</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -7968,7 +8437,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>540944</v>
+                                    <v>548273</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7984,7 +8453,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>540944</v>
+                                    <v>548273</v>
                                 </b>
                             </bs>
                         </hist>
@@ -7994,19 +8463,19 @@
         </relation>
         <relation>
             <name>ruby_case_child</name>
-            <cardinality>4141</cardinality>
+            <cardinality>4153</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_case__</k>
-                    <v>1219</v>
+                    <v>1224</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>69</v>
+                    <v>68</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>4141</v>
+                    <v>4153</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -8025,12 +8494,12 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>315</v>
+                                    <v>316</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>504</v>
+                                    <v>511</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -8040,12 +8509,12 @@
                                 <b>
                                     <a>5</a>
                                     <b>7</b>
-                                    <v>107</v>
+                                    <v>105</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>23</b>
-                                    <v>66</v>
+                                    <v>65</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8066,12 +8535,12 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>315</v>
+                                    <v>316</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>504</v>
+                                    <v>511</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -8081,12 +8550,12 @@
                                 <b>
                                     <a>5</a>
                                     <b>7</b>
-                                    <v>107</v>
+                                    <v>105</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>23</b>
-                                    <v>66</v>
+                                    <v>65</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8102,12 +8571,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25</v>
+                                    <v>21</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>6</v>
+                                    <v>9</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -8125,18 +8594,18 @@
                                     <v>6</v>
                                 </b>
                                 <b>
-                                    <a>32</a>
+                                    <a>34</a>
                                     <b>56</b>
                                     <v>6</v>
                                 </b>
                                 <b>
-                                    <a>115</a>
-                                    <b>276</b>
+                                    <a>116</a>
+                                    <b>282</b>
                                     <v>6</v>
                                 </b>
                                 <b>
-                                    <a>375</a>
-                                    <b>388</b>
+                                    <a>383</a>
+                                    <b>396</b>
                                     <v>6</v>
                                 </b>
                             </bs>
@@ -8153,12 +8622,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25</v>
+                                    <v>21</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>6</v>
+                                    <v>9</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -8176,18 +8645,18 @@
                                     <v>6</v>
                                 </b>
                                 <b>
-                                    <a>32</a>
+                                    <a>34</a>
                                     <b>56</b>
                                     <v>6</v>
                                 </b>
                                 <b>
-                                    <a>115</a>
-                                    <b>276</b>
+                                    <a>116</a>
+                                    <b>282</b>
                                     <v>6</v>
                                 </b>
                                 <b>
-                                    <a>375</a>
-                                    <b>388</b>
+                                    <a>383</a>
+                                    <b>396</b>
                                     <v>6</v>
                                 </b>
                             </bs>
@@ -8204,7 +8673,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4141</v>
+                                    <v>4153</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8220,7 +8689,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4141</v>
+                                    <v>4153</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8230,11 +8699,11 @@
         </relation>
         <relation>
             <name>ruby_case_def</name>
-            <cardinality>1219</cardinality>
+            <cardinality>1224</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1219</v>
+                    <v>1224</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -8423,15 +8892,15 @@
         </relation>
         <relation>
             <name>ruby_case_value</name>
-            <cardinality>1178</cardinality>
+            <cardinality>1184</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_case__</k>
-                    <v>1178</v>
+                    <v>1184</v>
                 </e>
                 <e>
                     <k>value</k>
-                    <v>1178</v>
+                    <v>1184</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -8445,7 +8914,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1178</v>
+                                    <v>1184</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8461,7 +8930,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1178</v>
+                                    <v>1184</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8471,11 +8940,11 @@
         </relation>
         <relation>
             <name>ruby_chained_string_child</name>
-            <cardinality>3353</cardinality>
+            <cardinality>3329</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_chained_string</k>
-                    <v>885</v>
+                    <v>877</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -8483,7 +8952,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>3353</v>
+                    <v>3329</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -8497,32 +8966,32 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>302</v>
+                                    <v>291</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>195</v>
+                                    <v>201</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>135</v>
+                                    <v>133</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>122</v>
+                                    <v>123</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>8</b>
-                                    <v>66</v>
+                                    <v>65</v>
                                 </b>
                                 <b>
                                     <a>8</a>
                                     <b>13</b>
-                                    <v>63</v>
+                                    <v>61</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8538,32 +9007,32 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>302</v>
+                                    <v>291</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>195</v>
+                                    <v>201</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>135</v>
+                                    <v>133</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>122</v>
+                                    <v>123</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>8</b>
-                                    <v>66</v>
+                                    <v>65</v>
                                 </b>
                                 <b>
                                     <a>8</a>
                                     <b>13</b>
-                                    <v>63</v>
+                                    <v>61</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8612,23 +9081,23 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>80</a>
-                                    <b>81</b>
+                                    <a>81</a>
+                                    <b>82</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>123</a>
-                                    <b>124</b>
+                                    <a>124</a>
+                                    <b>125</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>185</a>
-                                    <b>186</b>
+                                    <a>189</a>
+                                    <b>190</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>281</a>
-                                    <b>282</b>
+                                    <a>283</a>
+                                    <b>284</b>
                                     <v>6</v>
                                 </b>
                             </bs>
@@ -8678,23 +9147,23 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>80</a>
-                                    <b>81</b>
+                                    <a>81</a>
+                                    <b>82</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>123</a>
-                                    <b>124</b>
+                                    <a>124</a>
+                                    <b>125</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>185</a>
-                                    <b>186</b>
+                                    <a>189</a>
+                                    <b>190</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>281</a>
-                                    <b>282</b>
+                                    <a>283</a>
+                                    <b>284</b>
                                     <v>6</v>
                                 </b>
                             </bs>
@@ -8711,7 +9180,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3353</v>
+                                    <v>3329</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8727,7 +9196,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3353</v>
+                                    <v>3329</v>
                                 </b>
                             </bs>
                         </hist>
@@ -8737,36 +9206,32 @@
         </relation>
         <relation>
             <name>ruby_chained_string_def</name>
-            <cardinality>885</cardinality>
+            <cardinality>877</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>885</v>
+                    <v>877</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
-            <name>ruby_class_child</name>
-            <cardinality>130958</cardinality>
+            <name>ruby_class_body</name>
+            <cardinality>15291</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_class</k>
-                    <v>15183</v>
+                    <v>15291</v>
                 </e>
                 <e>
-                    <k>index</k>
-                    <v>1055</v>
-                </e>
-                <e>
-                    <k>child</k>
-                    <v>130958</v>
+                    <k>body</k>
+                    <v>15291</v>
                 </e>
             </columnsizes>
             <dependencies>
                 <dep>
                     <src>ruby_class</src>
-                    <trg>index</trg>
+                    <trg>body</trg>
                     <val>
                         <hist>
                             <budget>12</budget>
@@ -8774,130 +9239,14 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3290</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>2407</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>1556</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>1263</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>961</v>
-                                </b>
-                                <b>
-                                    <a>6</a>
-                                    <b>7</b>
-                                    <v>838</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>9</b>
-                                    <v>1118</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>13</b>
-                                    <v>1266</v>
-                                </b>
-                                <b>
-                                    <a>13</a>
-                                    <b>21</b>
-                                    <v>1169</v>
-                                </b>
-                                <b>
-                                    <a>21</a>
-                                    <b>84</b>
-                                    <v>1143</v>
-                                </b>
-                                <b>
-                                    <a>85</a>
-                                    <b>336</b>
-                                    <v>167</v>
+                                    <v>15291</v>
                                 </b>
                             </bs>
                         </hist>
                     </val>
                 </dep>
                 <dep>
-                    <src>ruby_class</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>3290</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>2407</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>1556</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>1263</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>961</v>
-                                </b>
-                                <b>
-                                    <a>6</a>
-                                    <b>7</b>
-                                    <v>838</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>9</b>
-                                    <v>1118</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>13</b>
-                                    <v>1266</v>
-                                </b>
-                                <b>
-                                    <a>13</a>
-                                    <b>21</b>
-                                    <v>1169</v>
-                                </b>
-                                <b>
-                                    <a>21</a>
-                                    <b>84</b>
-                                    <v>1143</v>
-                                </b>
-                                <b>
-                                    <a>85</a>
-                                    <b>336</b>
-                                    <v>167</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
+                    <src>body</src>
                     <trg>ruby_class</trg>
                     <val>
                         <hist>
@@ -8906,185 +9255,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>37</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>63</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>113</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>7</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>9</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>12</b>
-                                    <v>88</v>
-                                </b>
-                                <b>
-                                    <a>12</a>
-                                    <b>19</b>
-                                    <v>85</v>
-                                </b>
-                                <b>
-                                    <a>19</a>
-                                    <b>29</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>30</a>
-                                    <b>56</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>56</a>
-                                    <b>94</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>96</a>
-                                    <b>228</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>237</a>
-                                    <b>2116</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>2516</a>
-                                    <b>4819</b>
-                                    <v>12</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>37</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>63</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>113</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>7</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>9</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>12</b>
-                                    <v>88</v>
-                                </b>
-                                <b>
-                                    <a>12</a>
-                                    <b>19</b>
-                                    <v>85</v>
-                                </b>
-                                <b>
-                                    <a>19</a>
-                                    <b>29</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>30</a>
-                                    <b>56</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>56</a>
-                                    <b>94</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>96</a>
-                                    <b>228</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>237</a>
-                                    <b>2116</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>2516</a>
-                                    <b>4819</b>
-                                    <v>12</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>ruby_class</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>130958</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>index</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>130958</v>
+                                    <v>15291</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9094,15 +9265,15 @@
         </relation>
         <relation>
             <name>ruby_class_def</name>
-            <cardinality>16841</cardinality>
+            <cardinality>16946</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>16841</v>
+                    <v>16946</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>16841</v>
+                    <v>16946</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -9116,7 +9287,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>16841</v>
+                                    <v>16946</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9132,7 +9303,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>16841</v>
+                                    <v>16946</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9142,15 +9313,15 @@
         </relation>
         <relation>
             <name>ruby_class_superclass</name>
-            <cardinality>13314</cardinality>
+            <cardinality>13378</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_class</k>
-                    <v>13314</v>
+                    <v>13378</v>
                 </e>
                 <e>
                     <k>superclass</k>
-                    <v>13314</v>
+                    <v>13378</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -9164,7 +9335,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13314</v>
+                                    <v>13378</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9180,7 +9351,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13314</v>
+                                    <v>13378</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9238,23 +9409,23 @@
         </relation>
         <relation>
             <name>ruby_conditional_def</name>
-            <cardinality>3464</cardinality>
+            <cardinality>3495</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3464</v>
+                    <v>3495</v>
                 </e>
                 <e>
                     <k>alternative</k>
-                    <v>3464</v>
+                    <v>3495</v>
                 </e>
                 <e>
                     <k>condition</k>
-                    <v>3464</v>
+                    <v>3495</v>
                 </e>
                 <e>
                     <k>consequence</k>
-                    <v>3464</v>
+                    <v>3495</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -9268,7 +9439,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9284,7 +9455,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9300,7 +9471,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9316,7 +9487,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9332,7 +9503,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9348,7 +9519,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9364,7 +9535,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9380,7 +9551,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9396,7 +9567,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9412,7 +9583,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9428,7 +9599,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9444,7 +9615,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3464</v>
+                                    <v>3495</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9454,19 +9625,19 @@
         </relation>
         <relation>
             <name>ruby_delimited_symbol_child</name>
-            <cardinality>1739</cardinality>
+            <cardinality>1757</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_delimited_symbol</k>
-                    <v>1257</v>
+                    <v>1264</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>25</v>
+                    <v>24</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>1739</v>
+                    <v>1757</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -9480,17 +9651,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>939</v>
+                                    <v>936</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>245</v>
+                                    <v>254</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>9</b>
-                                    <v>72</v>
+                                    <v>74</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9506,17 +9677,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>939</v>
+                                    <v>936</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>245</v>
+                                    <v>254</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>9</b>
-                                    <v>72</v>
+                                    <v>74</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9555,18 +9726,18 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>23</a>
-                                    <b>24</b>
+                                    <a>24</a>
+                                    <b>25</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>101</a>
-                                    <b>102</b>
+                                    <a>106</a>
+                                    <b>107</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>399</a>
-                                    <b>400</b>
+                                    <a>408</a>
+                                    <b>409</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -9606,18 +9777,18 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>23</a>
-                                    <b>24</b>
+                                    <a>24</a>
+                                    <b>25</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>101</a>
-                                    <b>102</b>
+                                    <a>106</a>
+                                    <b>107</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>399</a>
-                                    <b>400</b>
+                                    <a>408</a>
+                                    <b>409</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -9634,7 +9805,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1739</v>
+                                    <v>1757</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9650,7 +9821,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1739</v>
+                                    <v>1757</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9660,11 +9831,11 @@
         </relation>
         <relation>
             <name>ruby_delimited_symbol_def</name>
-            <cardinality>1257</cardinality>
+            <cardinality>1264</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1257</v>
+                    <v>1264</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -9858,19 +10029,19 @@
         </relation>
         <relation>
             <name>ruby_destructured_parameter_child</name>
-            <cardinality>406</cardinality>
+            <cardinality>412</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_destructured_parameter</k>
-                    <v>198</v>
+                    <v>188</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>12</v>
+                    <v>11</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>406</v>
+                    <v>412</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -9884,17 +10055,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>9</v>
+                                    <v>15</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>173</v>
+                                    <v>146</v>
                                 </b>
                                 <b>
                                     <a>3</a>
-                                    <b>5</b>
-                                    <v>15</v>
+                                    <b>4</b>
+                                    <v>18</v>
+                                </b>
+                                <b>
+                                    <a>4</a>
+                                    <b>12</b>
+                                    <v>9</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9910,17 +10086,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>9</v>
+                                    <v>15</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>173</v>
+                                    <v>146</v>
                                 </b>
                                 <b>
                                     <a>3</a>
-                                    <b>5</b>
-                                    <v>15</v>
+                                    <b>4</b>
+                                    <v>18</v>
+                                </b>
+                                <b>
+                                    <a>4</a>
+                                    <b>12</b>
+                                    <v>9</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9936,22 +10117,37 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3</v>
+                                    <v>1</v>
                                 </b>
                                 <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>3</v>
+                                    <a>2</a>
+                                    <b>3</b>
+                                    <v>5</v>
                                 </b>
                                 <b>
-                                    <a>60</a>
-                                    <b>61</b>
-                                    <v>3</v>
+                                    <a>4</a>
+                                    <b>5</b>
+                                    <v>1</v>
                                 </b>
                                 <b>
-                                    <a>63</a>
-                                    <b>64</b>
-                                    <v>3</v>
+                                    <a>9</a>
+                                    <b>10</b>
+                                    <v>1</v>
+                                </b>
+                                <b>
+                                    <a>27</a>
+                                    <b>28</b>
+                                    <v>1</v>
+                                </b>
+                                <b>
+                                    <a>173</a>
+                                    <b>174</b>
+                                    <v>1</v>
+                                </b>
+                                <b>
+                                    <a>188</a>
+                                    <b>189</b>
+                                    <v>1</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9967,22 +10163,37 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3</v>
+                                    <v>1</v>
                                 </b>
                                 <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>3</v>
+                                    <a>2</a>
+                                    <b>3</b>
+                                    <v>5</v>
                                 </b>
                                 <b>
-                                    <a>60</a>
-                                    <b>61</b>
-                                    <v>3</v>
+                                    <a>4</a>
+                                    <b>5</b>
+                                    <v>1</v>
                                 </b>
                                 <b>
-                                    <a>63</a>
-                                    <b>64</b>
-                                    <v>3</v>
+                                    <a>9</a>
+                                    <b>10</b>
+                                    <v>1</v>
+                                </b>
+                                <b>
+                                    <a>27</a>
+                                    <b>28</b>
+                                    <v>1</v>
+                                </b>
+                                <b>
+                                    <a>173</a>
+                                    <b>174</b>
+                                    <v>1</v>
+                                </b>
+                                <b>
+                                    <a>188</a>
+                                    <b>189</b>
+                                    <v>1</v>
                                 </b>
                             </bs>
                         </hist>
@@ -9998,7 +10209,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>406</v>
+                                    <v>412</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10014,7 +10225,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>406</v>
+                                    <v>412</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10034,26 +10245,22 @@
             <dependencies/>
         </relation>
         <relation>
-            <name>ruby_do_block_child</name>
-            <cardinality>395009</cardinality>
+            <name>ruby_do_block_body</name>
+            <cardinality>137963</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_do_block</k>
-                    <v>137279</v>
+                    <v>137963</v>
                 </e>
                 <e>
-                    <k>index</k>
-                    <v>935</v>
-                </e>
-                <e>
-                    <k>child</k>
-                    <v>395009</v>
+                    <k>body</k>
+                    <v>137963</v>
                 </e>
             </columnsizes>
             <dependencies>
                 <dep>
                     <src>ruby_do_block</src>
-                    <trg>index</trg>
+                    <trg>body</trg>
                     <val>
                         <hist>
                             <budget>12</budget>
@@ -10061,80 +10268,14 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>48036</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>36712</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>21583</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>10506</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>7</b>
-                                    <v>10583</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>73</b>
-                                    <v>9856</v>
+                                    <v>137963</v>
                                 </b>
                             </bs>
                         </hist>
                     </val>
                 </dep>
                 <dep>
-                    <src>ruby_do_block</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>48036</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>36712</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>21583</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>10506</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>7</b>
-                                    <v>10583</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>73</b>
-                                    <v>9856</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
+                    <src>body</src>
                     <trg>ruby_do_block</trg>
                     <val>
                         <hist>
@@ -10143,165 +10284,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>51</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>220</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>7</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>8</b>
-                                    <v>51</v>
-                                </b>
-                                <b>
-                                    <a>8</a>
-                                    <b>11</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>11</a>
-                                    <b>14</b>
-                                    <v>51</v>
-                                </b>
-                                <b>
-                                    <a>14</a>
-                                    <b>18</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>21</a>
-                                    <b>54</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>62</a>
-                                    <b>142</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>175</a>
-                                    <b>592</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>759</a>
-                                    <b>6873</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>10571</a>
-                                    <b>10572</b>
-                                    <v>12</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>51</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>220</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>7</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>8</b>
-                                    <v>51</v>
-                                </b>
-                                <b>
-                                    <a>8</a>
-                                    <b>11</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>11</a>
-                                    <b>14</b>
-                                    <v>51</v>
-                                </b>
-                                <b>
-                                    <a>14</a>
-                                    <b>18</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>21</a>
-                                    <b>54</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>62</a>
-                                    <b>142</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>175</a>
-                                    <b>592</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>759</a>
-                                    <b>6873</b>
-                                    <v>77</v>
-                                </b>
-                                <b>
-                                    <a>10571</a>
-                                    <b>10572</b>
-                                    <v>12</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>ruby_do_block</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>395009</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>index</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>395009</v>
+                                    <v>137963</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10311,26 +10294,26 @@
         </relation>
         <relation>
             <name>ruby_do_block_def</name>
-            <cardinality>137435</cardinality>
+            <cardinality>138119</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>137435</v>
+                    <v>138119</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_do_block_parameters</name>
-            <cardinality>15073</cardinality>
+            <cardinality>15269</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_do_block</k>
-                    <v>15073</v>
+                    <v>15269</v>
                 </e>
                 <e>
                     <k>parameters</k>
-                    <v>15073</v>
+                    <v>15269</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -10344,7 +10327,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>15073</v>
+                                    <v>15269</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10360,7 +10343,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>15073</v>
+                                    <v>15269</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10370,11 +10353,11 @@
         </relation>
         <relation>
             <name>ruby_do_child</name>
-            <cardinality>9177</cardinality>
+            <cardinality>9244</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_do</k>
-                    <v>1588</v>
+                    <v>1608</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -10382,7 +10365,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>9177</v>
+                    <v>9244</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -10396,27 +10379,27 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>324</v>
+                                    <v>331</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>273</v>
+                                    <v>279</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>191</v>
+                                    <v>194</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>77</v>
+                                    <v>78</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>7</b>
-                                    <v>104</v>
+                                    <v>106</v>
                                 </b>
                                 <b>
                                     <a>7</a>
@@ -10431,12 +10414,12 @@
                                 <b>
                                     <a>9</a>
                                     <b>14</b>
-                                    <v>117</v>
+                                    <v>115</v>
                                 </b>
                                 <b>
                                     <a>14</a>
                                     <b>18</b>
-                                    <v>121</v>
+                                    <v>124</v>
                                 </b>
                                 <b>
                                     <a>18</a>
@@ -10457,27 +10440,27 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>324</v>
+                                    <v>331</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>273</v>
+                                    <v>279</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>191</v>
+                                    <v>194</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>77</v>
+                                    <v>78</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>7</b>
-                                    <v>104</v>
+                                    <v>106</v>
                                 </b>
                                 <b>
                                     <a>7</a>
@@ -10492,12 +10475,12 @@
                                 <b>
                                     <a>9</a>
                                     <b>14</b>
-                                    <v>117</v>
+                                    <v>115</v>
                                 </b>
                                 <b>
                                     <a>14</a>
                                     <b>18</b>
-                                    <v>121</v>
+                                    <v>124</v>
                                 </b>
                                 <b>
                                     <a>18</a>
@@ -10537,12 +10520,12 @@
                                 </b>
                                 <b>
                                     <a>6</a>
-                                    <b>59</b>
+                                    <b>61</b>
                                     <v>16</v>
                                 </b>
                                 <b>
-                                    <a>112</a>
-                                    <b>1589</b>
+                                    <a>114</a>
+                                    <b>1609</b>
                                     <v>15</v>
                                 </b>
                             </bs>
@@ -10578,12 +10561,12 @@
                                 </b>
                                 <b>
                                     <a>6</a>
-                                    <b>59</b>
+                                    <b>61</b>
                                     <v>16</v>
                                 </b>
                                 <b>
-                                    <a>112</a>
-                                    <b>1589</b>
+                                    <a>114</a>
+                                    <b>1609</b>
                                     <v>15</v>
                                 </b>
                             </bs>
@@ -10600,7 +10583,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>9177</v>
+                                    <v>9244</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10616,7 +10599,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>9177</v>
+                                    <v>9244</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10626,22 +10609,22 @@
         </relation>
         <relation>
             <name>ruby_do_def</name>
-            <cardinality>1610</cardinality>
+            <cardinality>1632</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1610</v>
+                    <v>1632</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_element_reference_child</name>
-            <cardinality>82398</cardinality>
+            <cardinality>83029</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_element_reference</k>
-                    <v>82228</v>
+                    <v>82863</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -10649,7 +10632,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>82398</v>
+                    <v>83029</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -10663,12 +10646,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>82059</v>
+                                    <v>82697</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>169</v>
+                                    <v>166</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10684,12 +10667,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>82059</v>
+                                    <v>82697</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>169</v>
+                                    <v>166</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10708,8 +10691,8 @@
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>27674</a>
-                                    <b>27675</b>
+                                    <a>28403</a>
+                                    <b>28404</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -10729,8 +10712,8 @@
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>27674</a>
-                                    <b>27675</b>
+                                    <a>28403</a>
+                                    <b>28404</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -10747,7 +10730,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>82398</v>
+                                    <v>83029</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10763,7 +10746,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>82398</v>
+                                    <v>83029</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10773,15 +10756,15 @@
         </relation>
         <relation>
             <name>ruby_element_reference_def</name>
-            <cardinality>82234</cardinality>
+            <cardinality>82869</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>82234</v>
+                    <v>82869</v>
                 </e>
                 <e>
                     <k>object</k>
-                    <v>82234</v>
+                    <v>82869</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -10795,7 +10778,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>82234</v>
+                                    <v>82869</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10811,7 +10794,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>82234</v>
+                                    <v>82869</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10821,11 +10804,11 @@
         </relation>
         <relation>
             <name>ruby_else_child</name>
-            <cardinality>8802</cardinality>
+            <cardinality>9054</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_else</k>
-                    <v>6923</v>
+                    <v>7126</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -10833,7 +10816,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>8802</v>
+                    <v>9054</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -10847,17 +10830,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5833</v>
+                                    <v>6004</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>687</v>
+                                    <v>703</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>12</b>
-                                    <v>403</v>
+                                    <v>418</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10873,17 +10856,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5833</v>
+                                    <v>6004</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>687</v>
+                                    <v>703</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>12</b>
-                                    <v>403</v>
+                                    <v>418</v>
                                 </b>
                             </bs>
                         </hist>
@@ -10927,28 +10910,28 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>29</a>
-                                    <b>30</b>
+                                    <a>28</a>
+                                    <b>29</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>55</a>
-                                    <b>56</b>
+                                    <a>59</a>
+                                    <b>60</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>128</a>
-                                    <b>129</b>
+                                    <a>135</a>
+                                    <b>136</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>346</a>
-                                    <b>347</b>
+                                    <a>362</a>
+                                    <b>363</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>2197</a>
-                                    <b>2198</b>
+                                    <a>2299</a>
+                                    <b>2300</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -10993,28 +10976,28 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>29</a>
-                                    <b>30</b>
+                                    <a>28</a>
+                                    <b>29</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>55</a>
-                                    <b>56</b>
+                                    <a>59</a>
+                                    <b>60</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>128</a>
-                                    <b>129</b>
+                                    <a>135</a>
+                                    <b>136</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>346</a>
-                                    <b>347</b>
+                                    <a>362</a>
+                                    <b>363</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>2197</a>
-                                    <b>2198</b>
+                                    <a>2299</a>
+                                    <b>2300</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -11031,7 +11014,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8802</v>
+                                    <v>9054</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11047,7 +11030,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>8802</v>
+                                    <v>9054</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11057,26 +11040,26 @@
         </relation>
         <relation>
             <name>ruby_else_def</name>
-            <cardinality>6933</cardinality>
+            <cardinality>7138</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>6933</v>
+                    <v>7138</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_elsif_alternative</name>
-            <cardinality>903</cardinality>
+            <cardinality>936</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_elsif</k>
-                    <v>903</v>
+                    <v>936</v>
                 </e>
                 <e>
                     <k>alternative</k>
-                    <v>903</v>
+                    <v>936</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -11090,7 +11073,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>903</v>
+                                    <v>936</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11106,7 +11089,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>903</v>
+                                    <v>936</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11116,15 +11099,15 @@
         </relation>
         <relation>
             <name>ruby_elsif_consequence</name>
-            <cardinality>1589</cardinality>
+            <cardinality>1572</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_elsif</k>
-                    <v>1589</v>
+                    <v>1572</v>
                 </e>
                 <e>
                     <k>consequence</k>
-                    <v>1589</v>
+                    <v>1572</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -11138,7 +11121,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1589</v>
+                                    <v>1572</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11154,7 +11137,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1589</v>
+                                    <v>1572</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11164,15 +11147,15 @@
         </relation>
         <relation>
             <name>ruby_elsif_def</name>
-            <cardinality>1595</cardinality>
+            <cardinality>1578</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1595</v>
+                    <v>1578</v>
                 </e>
                 <e>
                     <k>condition</k>
-                    <v>1595</v>
+                    <v>1578</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -11186,7 +11169,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1595</v>
+                                    <v>1578</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11202,7 +11185,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1595</v>
+                                    <v>1578</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11399,19 +11382,19 @@
         </relation>
         <relation>
             <name>ruby_ensure_child</name>
-            <cardinality>4834</cardinality>
+            <cardinality>4925</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_ensure</k>
-                    <v>3718</v>
+                    <v>3803</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>50</v>
+                    <v>49</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>4834</v>
+                    <v>4925</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -11425,17 +11408,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2956</v>
+                                    <v>3034</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>516</v>
+                                    <v>526</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>17</b>
-                                    <v>245</v>
+                                    <v>241</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11451,17 +11434,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2956</v>
+                                    <v>3034</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>516</v>
+                                    <v>526</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>17</b>
-                                    <v>245</v>
+                                    <v>241</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11477,7 +11460,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25</v>
+                                    <v>24</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -11490,8 +11473,8 @@
                                     <v>6</v>
                                 </b>
                                 <b>
-                                    <a>12</a>
-                                    <b>13</b>
+                                    <a>14</a>
+                                    <b>15</b>
                                     <v>3</v>
                                 </b>
                                 <b>
@@ -11500,13 +11483,13 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>242</a>
-                                    <b>243</b>
+                                    <a>248</a>
+                                    <b>249</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>1180</a>
-                                    <b>1181</b>
+                                    <a>1227</a>
+                                    <b>1228</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -11523,7 +11506,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25</v>
+                                    <v>24</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -11536,8 +11519,8 @@
                                     <v>6</v>
                                 </b>
                                 <b>
-                                    <a>12</a>
-                                    <b>13</b>
+                                    <a>14</a>
+                                    <b>15</b>
                                     <v>3</v>
                                 </b>
                                 <b>
@@ -11546,13 +11529,13 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>242</a>
-                                    <b>243</b>
+                                    <a>248</a>
+                                    <b>249</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>1180</a>
-                                    <b>1181</b>
+                                    <a>1227</a>
+                                    <b>1228</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -11569,7 +11552,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4834</v>
+                                    <v>4925</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11585,7 +11568,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4834</v>
+                                    <v>4925</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11595,26 +11578,26 @@
         </relation>
         <relation>
             <name>ruby_ensure_def</name>
-            <cardinality>3718</cardinality>
+            <cardinality>3803</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3718</v>
+                    <v>3803</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_exception_variable_def</name>
-            <cardinality>1001</cardinality>
+            <cardinality>991</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1001</v>
+                    <v>991</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>1001</v>
+                    <v>991</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -11628,7 +11611,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1001</v>
+                                    <v>991</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11644,7 +11627,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1001</v>
+                                    <v>991</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11654,11 +11637,11 @@
         </relation>
         <relation>
             <name>ruby_exceptions_child</name>
-            <cardinality>1849</cardinality>
+            <cardinality>1873</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_exceptions</k>
-                    <v>1639</v>
+                    <v>1654</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -11666,7 +11649,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>1849</v>
+                    <v>1873</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -11680,17 +11663,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1497</v>
+                                    <v>1509</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>4</b>
-                                    <v>129</v>
+                                    <v>131</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>10</b>
-                                    <v>13</v>
+                                    <v>14</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11706,17 +11689,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1497</v>
+                                    <v>1509</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>4</b>
-                                    <v>129</v>
+                                    <v>131</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>10</b>
-                                    <v>13</v>
+                                    <v>14</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11745,28 +11728,28 @@
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>8</a>
-                                    <b>9</b>
+                                    <a>9</a>
+                                    <b>10</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>13</a>
-                                    <b>14</b>
+                                    <a>14</a>
+                                    <b>15</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>38</a>
-                                    <b>39</b>
+                                    <a>42</a>
+                                    <b>43</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>142</a>
-                                    <b>143</b>
+                                    <a>145</a>
+                                    <b>146</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>1639</a>
-                                    <b>1640</b>
+                                    <a>1654</a>
+                                    <b>1655</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -11796,28 +11779,28 @@
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>8</a>
-                                    <b>9</b>
+                                    <a>9</a>
+                                    <b>10</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>13</a>
-                                    <b>14</b>
+                                    <a>14</a>
+                                    <b>15</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>38</a>
-                                    <b>39</b>
+                                    <a>42</a>
+                                    <b>43</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>142</a>
-                                    <b>143</b>
+                                    <a>145</a>
+                                    <b>146</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>1639</a>
-                                    <b>1640</b>
+                                    <a>1654</a>
+                                    <b>1655</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -11834,7 +11817,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1849</v>
+                                    <v>1873</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11850,7 +11833,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1849</v>
+                                    <v>1873</v>
                                 </b>
                             </bs>
                         </hist>
@@ -11860,11 +11843,11 @@
         </relation>
         <relation>
             <name>ruby_exceptions_def</name>
-            <cardinality>1639</cardinality>
+            <cardinality>1654</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1639</v>
+                    <v>1654</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -12280,19 +12263,19 @@
         </relation>
         <relation>
             <name>ruby_hash_child</name>
-            <cardinality>88983</cardinality>
+            <cardinality>89413</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_hash</k>
-                    <v>35712</v>
+                    <v>35882</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>1389</v>
+                    <v>1391</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>88983</v>
+                    <v>89413</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -12306,32 +12289,32 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>14778</v>
+                                    <v>14813</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>9960</v>
+                                    <v>10040</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>3960</v>
+                                    <v>3992</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>4142</v>
+                                    <v>4161</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>19</b>
-                                    <v>2688</v>
+                                    <v>2692</v>
                                 </b>
                                 <b>
                                     <a>19</a>
                                     <b>108</b>
-                                    <v>181</v>
+                                    <v>182</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12347,32 +12330,32 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>14778</v>
+                                    <v>14813</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>9960</v>
+                                    <v>10040</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>3960</v>
+                                    <v>3992</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>4142</v>
+                                    <v>4161</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>19</b>
-                                    <v>2688</v>
+                                    <v>2692</v>
                                 </b>
                                 <b>
                                     <a>19</a>
                                     <b>108</b>
-                                    <v>181</v>
+                                    <v>182</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12388,32 +12371,32 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>922</v>
+                                    <v>923</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>103</v>
+                                    <v>104</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>11</b>
-                                    <v>116</v>
+                                    <v>117</v>
                                 </b>
                                 <b>
                                     <a>14</a>
                                     <b>51</b>
-                                    <v>116</v>
+                                    <v>117</v>
                                 </b>
                                 <b>
                                     <a>57</a>
-                                    <b>1613</b>
-                                    <v>116</v>
+                                    <b>1621</b>
+                                    <v>117</v>
                                 </b>
                                 <b>
-                                    <a>2750</a>
-                                    <b>2751</b>
-                                    <v>12</v>
+                                    <a>2759</a>
+                                    <b>2760</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12429,32 +12412,32 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>922</v>
+                                    <v>923</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>103</v>
+                                    <v>104</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>11</b>
-                                    <v>116</v>
+                                    <v>117</v>
                                 </b>
                                 <b>
                                     <a>14</a>
                                     <b>51</b>
-                                    <v>116</v>
+                                    <v>117</v>
                                 </b>
                                 <b>
                                     <a>57</a>
-                                    <b>1613</b>
-                                    <v>116</v>
+                                    <b>1621</b>
+                                    <v>117</v>
                                 </b>
                                 <b>
-                                    <a>2750</a>
-                                    <b>2751</b>
-                                    <v>12</v>
+                                    <a>2759</a>
+                                    <b>2760</b>
+                                    <v>13</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12470,7 +12453,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>88983</v>
+                                    <v>89413</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12486,7 +12469,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>88983</v>
+                                    <v>89413</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12496,11 +12479,11 @@
         </relation>
         <relation>
             <name>ruby_hash_def</name>
-            <cardinality>39413</cardinality>
+            <cardinality>39640</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>39413</v>
+                    <v>39640</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -12658,15 +12641,15 @@
         </relation>
         <relation>
             <name>ruby_hash_splat_argument_def</name>
-            <cardinality>1856</cardinality>
+            <cardinality>1857</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1856</v>
+                    <v>1857</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>1856</v>
+                    <v>1857</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -12680,7 +12663,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1856</v>
+                                    <v>1857</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12696,7 +12679,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1856</v>
+                                    <v>1857</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12706,26 +12689,26 @@
         </relation>
         <relation>
             <name>ruby_hash_splat_parameter_def</name>
-            <cardinality>1355</cardinality>
+            <cardinality>1447</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1355</v>
+                    <v>1447</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_hash_splat_parameter_name</name>
-            <cardinality>1134</cardinality>
+            <cardinality>1218</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_hash_splat_parameter</k>
-                    <v>1134</v>
+                    <v>1218</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>1134</v>
+                    <v>1218</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -12739,7 +12722,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1134</v>
+                                    <v>1218</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12755,7 +12738,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1134</v>
+                                    <v>1218</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12765,19 +12748,19 @@
         </relation>
         <relation>
             <name>ruby_heredoc_body_child</name>
-            <cardinality>25318</cardinality>
+            <cardinality>25699</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_heredoc_body</k>
-                    <v>5363</v>
+                    <v>5519</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>264</v>
+                    <v>259</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>25318</v>
+                    <v>25699</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -12791,12 +12774,12 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>2929</v>
+                                    <v>3080</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>692</v>
+                                    <v>685</v>
                                 </b>
                                 <b>
                                     <a>5</a>
@@ -12806,22 +12789,22 @@
                                 <b>
                                     <a>6</a>
                                     <b>7</b>
-                                    <v>781</v>
+                                    <v>787</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>9</b>
-                                    <v>341</v>
+                                    <v>335</v>
                                 </b>
                                 <b>
                                     <a>10</a>
                                     <b>15</b>
-                                    <v>421</v>
+                                    <v>440</v>
                                 </b>
                                 <b>
                                     <a>16</a>
                                     <b>90</b>
-                                    <v>193</v>
+                                    <v>186</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12837,12 +12820,12 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>2929</v>
+                                    <v>3080</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>692</v>
+                                    <v>685</v>
                                 </b>
                                 <b>
                                     <a>5</a>
@@ -12852,22 +12835,22 @@
                                 <b>
                                     <a>6</a>
                                     <b>7</b>
-                                    <v>781</v>
+                                    <v>787</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>9</b>
-                                    <v>341</v>
+                                    <v>335</v>
                                 </b>
                                 <b>
                                     <a>10</a>
                                     <b>15</b>
-                                    <v>421</v>
+                                    <v>440</v>
                                 </b>
                                 <b>
                                     <a>16</a>
                                     <b>90</b>
-                                    <v>193</v>
+                                    <v>186</v>
                                 </b>
                             </bs>
                         </hist>
@@ -12883,12 +12866,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>50</v>
+                                    <v>49</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>83</v>
+                                    <v>46</v>
+                                </b>
+                                <b>
+                                    <a>3</a>
+                                    <b>4</b>
+                                    <v>35</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -12897,11 +12885,11 @@
                                 </b>
                                 <b>
                                     <a>8</a>
-                                    <b>12</b>
+                                    <b>13</b>
                                     <v>23</v>
                                 </b>
                                 <b>
-                                    <a>12</a>
+                                    <a>13</a>
                                     <b>26</b>
                                     <v>23</v>
                                 </b>
@@ -12912,12 +12900,12 @@
                                 </b>
                                 <b>
                                     <a>96</a>
-                                    <b>323</b>
+                                    <b>331</b>
                                     <v>20</v>
                                 </b>
                                 <b>
-                                    <a>585</a>
-                                    <b>1806</b>
+                                    <a>600</a>
+                                    <b>1893</b>
                                     <v>17</v>
                                 </b>
                             </bs>
@@ -12934,12 +12922,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>50</v>
+                                    <v>49</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>83</v>
+                                    <v>46</v>
+                                </b>
+                                <b>
+                                    <a>3</a>
+                                    <b>4</b>
+                                    <v>35</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -12948,11 +12941,11 @@
                                 </b>
                                 <b>
                                     <a>8</a>
-                                    <b>12</b>
+                                    <b>13</b>
                                     <v>23</v>
                                 </b>
                                 <b>
-                                    <a>12</a>
+                                    <a>13</a>
                                     <b>26</b>
                                     <v>23</v>
                                 </b>
@@ -12963,12 +12956,12 @@
                                 </b>
                                 <b>
                                     <a>96</a>
-                                    <b>323</b>
+                                    <b>331</b>
                                     <v>20</v>
                                 </b>
                                 <b>
-                                    <a>585</a>
-                                    <b>1806</b>
+                                    <a>600</a>
+                                    <b>1893</b>
                                     <v>17</v>
                                 </b>
                             </bs>
@@ -12985,7 +12978,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25318</v>
+                                    <v>25699</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13001,7 +12994,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>25318</v>
+                                    <v>25699</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13011,26 +13004,26 @@
         </relation>
         <relation>
             <name>ruby_heredoc_body_def</name>
-            <cardinality>5575</cardinality>
+            <cardinality>5789</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>5575</v>
+                    <v>5789</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_if_alternative</name>
-            <cardinality>6454</cardinality>
+            <cardinality>6667</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_if</k>
-                    <v>6454</v>
+                    <v>6667</v>
                 </e>
                 <e>
                     <k>alternative</k>
-                    <v>6454</v>
+                    <v>6667</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13044,7 +13037,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6454</v>
+                                    <v>6667</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13060,7 +13053,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6454</v>
+                                    <v>6667</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13070,15 +13063,15 @@
         </relation>
         <relation>
             <name>ruby_if_consequence</name>
-            <cardinality>18324</cardinality>
+            <cardinality>18280</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_if</k>
-                    <v>18324</v>
+                    <v>18280</v>
                 </e>
                 <e>
                     <k>consequence</k>
-                    <v>18324</v>
+                    <v>18280</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13092,7 +13085,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>18324</v>
+                                    <v>18280</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13108,7 +13101,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>18324</v>
+                                    <v>18280</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13118,15 +13111,15 @@
         </relation>
         <relation>
             <name>ruby_if_def</name>
-            <cardinality>18392</cardinality>
+            <cardinality>18341</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>18392</v>
+                    <v>18341</v>
                 </e>
                 <e>
                     <k>condition</k>
-                    <v>18392</v>
+                    <v>18341</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13140,7 +13133,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>18392</v>
+                                    <v>18341</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13156,7 +13149,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>18392</v>
+                                    <v>18341</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13208,19 +13201,19 @@
         </relation>
         <relation>
             <name>ruby_if_modifier_def</name>
-            <cardinality>13620</cardinality>
+            <cardinality>13708</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>13620</v>
+                    <v>13708</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>13620</v>
+                    <v>13708</v>
                 </e>
                 <e>
                     <k>condition</k>
-                    <v>13620</v>
+                    <v>13708</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13234,7 +13227,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13620</v>
+                                    <v>13708</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13250,7 +13243,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13620</v>
+                                    <v>13708</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13266,7 +13259,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13620</v>
+                                    <v>13708</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13282,7 +13275,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13620</v>
+                                    <v>13708</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13298,7 +13291,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13620</v>
+                                    <v>13708</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13314,7 +13307,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13620</v>
+                                    <v>13708</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13510,11 +13503,11 @@
         </relation>
         <relation>
             <name>ruby_interpolation_child</name>
-            <cardinality>38208</cardinality>
+            <cardinality>38051</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_interpolation</k>
-                    <v>38208</v>
+                    <v>38051</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -13522,7 +13515,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>38208</v>
+                    <v>38051</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13536,7 +13529,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>38208</v>
+                                    <v>38051</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13552,7 +13545,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>38208</v>
+                                    <v>38051</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13566,8 +13559,8 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>12859</a>
-                                    <b>12860</b>
+                                    <a>13043</a>
+                                    <b>13044</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -13582,8 +13575,8 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>12859</a>
-                                    <b>12860</b>
+                                    <a>13043</a>
+                                    <b>13044</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -13600,7 +13593,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>38208</v>
+                                    <v>38051</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13616,7 +13609,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>38208</v>
+                                    <v>38051</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13626,26 +13619,26 @@
         </relation>
         <relation>
             <name>ruby_interpolation_def</name>
-            <cardinality>38208</cardinality>
+            <cardinality>38051</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>38208</v>
+                    <v>38051</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_keyword_parameter_def</name>
-            <cardinality>3794</cardinality>
+            <cardinality>3939</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3794</v>
+                    <v>3939</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>3794</v>
+                    <v>3939</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13659,7 +13652,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3794</v>
+                                    <v>3939</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13675,7 +13668,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3794</v>
+                                    <v>3939</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13685,15 +13678,15 @@
         </relation>
         <relation>
             <name>ruby_keyword_parameter_value</name>
-            <cardinality>2874</cardinality>
+            <cardinality>2985</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_keyword_parameter</k>
-                    <v>2874</v>
+                    <v>2985</v>
                 </e>
                 <e>
                     <k>value</k>
-                    <v>2874</v>
+                    <v>2985</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13707,7 +13700,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2874</v>
+                                    <v>2985</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13723,7 +13716,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2874</v>
+                                    <v>2985</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13823,15 +13816,15 @@
         </relation>
         <relation>
             <name>ruby_lambda_def</name>
-            <cardinality>7472</cardinality>
+            <cardinality>7557</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>7472</v>
+                    <v>7557</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>7472</v>
+                    <v>7557</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13845,7 +13838,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7472</v>
+                                    <v>7557</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13861,7 +13854,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7472</v>
+                                    <v>7557</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13871,15 +13864,15 @@
         </relation>
         <relation>
             <name>ruby_lambda_parameters</name>
-            <cardinality>1664</cardinality>
+            <cardinality>1665</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_lambda</k>
-                    <v>1664</v>
+                    <v>1665</v>
                 </e>
                 <e>
                     <k>parameters</k>
-                    <v>1664</v>
+                    <v>1665</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13893,7 +13886,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1664</v>
+                                    <v>1665</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13909,7 +13902,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1664</v>
+                                    <v>1665</v>
                                 </b>
                             </bs>
                         </hist>
@@ -13919,11 +13912,11 @@
         </relation>
         <relation>
             <name>ruby_lambda_parameters_child</name>
-            <cardinality>1905</cardinality>
+            <cardinality>1907</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_lambda_parameters</k>
-                    <v>1655</v>
+                    <v>1656</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -13931,7 +13924,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>1905</v>
+                    <v>1907</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -13950,7 +13943,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>144</v>
+                                    <v>145</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -13976,7 +13969,7 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>144</v>
+                                    <v>145</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -14020,13 +14013,13 @@
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>183</a>
-                                    <b>184</b>
+                                    <a>184</a>
+                                    <b>185</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>1655</a>
-                                    <b>1656</b>
+                                    <a>1656</a>
+                                    <b>1657</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -14066,13 +14059,13 @@
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>183</a>
-                                    <b>184</b>
+                                    <a>184</a>
+                                    <b>185</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>1655</a>
-                                    <b>1656</b>
+                                    <a>1656</a>
+                                    <b>1657</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -14089,7 +14082,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1905</v>
+                                    <v>1907</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14105,7 +14098,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1905</v>
+                                    <v>1907</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14115,22 +14108,22 @@
         </relation>
         <relation>
             <name>ruby_lambda_parameters_def</name>
-            <cardinality>1664</cardinality>
+            <cardinality>1665</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1664</v>
+                    <v>1665</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_left_assignment_list_child</name>
-            <cardinality>6358</cardinality>
+            <cardinality>6436</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_left_assignment_list</k>
-                    <v>2873</v>
+                    <v>2910</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -14138,7 +14131,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>6358</v>
+                    <v>6436</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -14152,17 +14145,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>360</v>
+                                    <v>361</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1861</v>
+                                    <v>1892</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>489</v>
+                                    <v>494</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -14183,17 +14176,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>360</v>
+                                    <v>361</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1861</v>
+                                    <v>1892</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>489</v>
+                                    <v>494</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -14257,18 +14250,18 @@
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>652</a>
-                                    <b>653</b>
+                                    <a>657</a>
+                                    <b>658</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>2513</a>
-                                    <b>2514</b>
+                                    <a>2549</a>
+                                    <b>2550</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>2873</a>
-                                    <b>2874</b>
+                                    <a>2910</a>
+                                    <b>2911</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -14328,18 +14321,18 @@
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>652</a>
-                                    <b>653</b>
+                                    <a>657</a>
+                                    <b>658</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>2513</a>
-                                    <b>2514</b>
+                                    <a>2549</a>
+                                    <b>2550</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>2873</a>
-                                    <b>2874</b>
+                                    <a>2910</a>
+                                    <b>2911</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -14356,7 +14349,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6358</v>
+                                    <v>6436</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14372,7 +14365,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6358</v>
+                                    <v>6436</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14382,36 +14375,32 @@
         </relation>
         <relation>
             <name>ruby_left_assignment_list_def</name>
-            <cardinality>2873</cardinality>
+            <cardinality>2910</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2873</v>
+                    <v>2910</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
-            <name>ruby_method_child</name>
-            <cardinality>264218</cardinality>
+            <name>ruby_method_body</name>
+            <cardinality>98487</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_method</k>
-                    <v>97351</v>
+                    <v>98487</v>
                 </e>
                 <e>
-                    <k>index</k>
-                    <v>239</v>
-                </e>
-                <e>
-                    <k>child</k>
-                    <v>264218</v>
+                    <k>body</k>
+                    <v>98487</v>
                 </e>
             </columnsizes>
             <dependencies>
                 <dep>
                     <src>ruby_method</src>
-                    <trg>index</trg>
+                    <trg>body</trg>
                     <val>
                         <hist>
                             <budget>12</budget>
@@ -14419,80 +14408,14 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>43682</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>18007</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>12772</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>7790</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>7</b>
-                                    <v>8159</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>77</b>
-                                    <v>6939</v>
+                                    <v>98487</v>
                                 </b>
                             </bs>
                         </hist>
                     </val>
                 </dep>
                 <dep>
-                    <src>ruby_method</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>43682</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>18007</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>12772</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>7790</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>7</b>
-                                    <v>8159</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>77</b>
-                                    <v>6939</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
+                    <src>body</src>
                     <trg>ruby_method</trg>
                     <val>
                         <hist>
@@ -14501,165 +14424,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>22</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>4</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>28</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>6</a>
-                                    <b>7</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>13</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>14</a>
-                                    <b>20</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>21</a>
-                                    <b>41</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>49</a>
-                                    <b>115</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>150</a>
-                                    <b>400</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>511</a>
-                                    <b>2203</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>3217</a>
-                                    <b>30892</b>
-                                    <v>18</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>22</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>4</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>28</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>6</a>
-                                    <b>7</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>13</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>14</a>
-                                    <b>20</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>21</a>
-                                    <b>41</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>49</a>
-                                    <b>115</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>150</a>
-                                    <b>400</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>511</a>
-                                    <b>2203</b>
-                                    <v>18</v>
-                                </b>
-                                <b>
-                                    <a>3217</a>
-                                    <b>30892</b>
-                                    <v>18</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>ruby_method</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>264218</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>index</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>264218</v>
+                                    <v>98487</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14669,15 +14434,15 @@
         </relation>
         <relation>
             <name>ruby_method_def</name>
-            <cardinality>98356</cardinality>
+            <cardinality>99525</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>98356</v>
+                    <v>99525</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>98356</v>
+                    <v>99525</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -14691,7 +14456,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>98356</v>
+                                    <v>99525</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14707,7 +14472,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>98356</v>
+                                    <v>99525</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14717,15 +14482,15 @@
         </relation>
         <relation>
             <name>ruby_method_parameters</name>
-            <cardinality>27238</cardinality>
+            <cardinality>27765</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_method</k>
-                    <v>27238</v>
+                    <v>27765</v>
                 </e>
                 <e>
                     <k>parameters</k>
-                    <v>27238</v>
+                    <v>27765</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -14739,7 +14504,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>27238</v>
+                                    <v>27765</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14755,7 +14520,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>27238</v>
+                                    <v>27765</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14765,19 +14530,19 @@
         </relation>
         <relation>
             <name>ruby_method_parameters_child</name>
-            <cardinality>47287</cardinality>
+            <cardinality>48416</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_method_parameters</k>
-                    <v>28643</v>
+                    <v>29203</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>34</v>
+                    <v>37</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>47287</v>
+                    <v>48416</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -14791,22 +14556,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>17310</v>
+                                    <v>17656</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>7021</v>
+                                    <v>7064</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>2678</v>
+                                    <v>2765</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>12</b>
-                                    <v>1632</v>
+                                    <b>13</b>
+                                    <v>1717</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14822,22 +14587,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>17310</v>
+                                    <v>17656</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>7021</v>
+                                    <v>7064</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>2678</v>
+                                    <v>2765</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>12</b>
-                                    <v>1632</v>
+                                    <b>13</b>
+                                    <v>1717</v>
                                 </b>
                             </bs>
                         </hist>
@@ -14850,6 +14615,11 @@
                         <hist>
                             <budget>12</budget>
                             <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>3</v>
+                                </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
@@ -14861,48 +14631,48 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
-                                    <b>10</b>
+                                    <a>11</a>
+                                    <b>12</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>28</a>
-                                    <b>29</b>
+                                    <a>29</a>
+                                    <b>30</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>48</a>
-                                    <b>49</b>
+                                    <a>53</a>
+                                    <b>54</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>115</a>
-                                    <b>116</b>
+                                    <a>125</a>
+                                    <b>126</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>226</a>
-                                    <b>227</b>
+                                    <a>246</a>
+                                    <b>247</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>518</a>
-                                    <b>519</b>
+                                    <a>554</a>
+                                    <b>555</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>1368</a>
-                                    <b>1369</b>
+                                    <a>1446</a>
+                                    <b>1447</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>3596</a>
-                                    <b>3597</b>
+                                    <a>3725</a>
+                                    <b>3726</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>9089</a>
-                                    <b>9090</b>
+                                    <a>9421</a>
+                                    <b>9422</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -14916,6 +14686,11 @@
                         <hist>
                             <budget>12</budget>
                             <bs>
+                                <b>
+                                    <a>1</a>
+                                    <b>2</b>
+                                    <v>3</v>
+                                </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
@@ -14927,48 +14702,48 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
-                                    <b>10</b>
+                                    <a>11</a>
+                                    <b>12</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>28</a>
-                                    <b>29</b>
+                                    <a>29</a>
+                                    <b>30</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>48</a>
-                                    <b>49</b>
+                                    <a>53</a>
+                                    <b>54</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>115</a>
-                                    <b>116</b>
+                                    <a>125</a>
+                                    <b>126</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>226</a>
-                                    <b>227</b>
+                                    <a>246</a>
+                                    <b>247</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>518</a>
-                                    <b>519</b>
+                                    <a>554</a>
+                                    <b>555</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>1368</a>
-                                    <b>1369</b>
+                                    <a>1446</a>
+                                    <b>1447</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>3596</a>
-                                    <b>3597</b>
+                                    <a>3725</a>
+                                    <b>3726</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>9089</a>
-                                    <b>9090</b>
+                                    <a>9421</a>
+                                    <b>9422</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -14985,7 +14760,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>47287</v>
+                                    <v>48416</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15001,7 +14776,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>47287</v>
+                                    <v>48416</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15011,36 +14786,32 @@
         </relation>
         <relation>
             <name>ruby_method_parameters_def</name>
-            <cardinality>28861</cardinality>
+            <cardinality>29417</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>28861</v>
+                    <v>29417</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
-            <name>ruby_module_child</name>
-            <cardinality>31303</cardinality>
+            <name>ruby_module_body</name>
+            <cardinality>21511</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_module</k>
-                    <v>10513</v>
+                    <v>21511</v>
                 </e>
                 <e>
-                    <k>index</k>
-                    <v>393</v>
-                </e>
-                <e>
-                    <k>child</k>
-                    <v>31303</v>
+                    <k>body</k>
+                    <v>21511</v>
                 </e>
             </columnsizes>
             <dependencies>
                 <dep>
                     <src>ruby_module</src>
-                    <trg>index</trg>
+                    <trg>body</trg>
                     <val>
                         <hist>
                             <budget>12</budget>
@@ -15048,70 +14819,14 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>7443</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>863</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>5</b>
-                                    <v>772</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>10</b>
-                                    <v>794</v>
-                                </b>
-                                <b>
-                                    <a>10</a>
-                                    <b>126</b>
-                                    <v>639</v>
+                                    <v>21511</v>
                                 </b>
                             </bs>
                         </hist>
                     </val>
                 </dep>
                 <dep>
-                    <src>ruby_module</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>7443</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>863</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>5</b>
-                                    <v>772</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>10</b>
-                                    <v>794</v>
-                                </b>
-                                <b>
-                                    <a>10</a>
-                                    <b>126</b>
-                                    <v>639</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
+                    <src>body</src>
                     <trg>ruby_module</trg>
                     <val>
                         <hist>
@@ -15120,165 +14835,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>37</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>9</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>72</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>8</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>8</a>
-                                    <b>10</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>10</a>
-                                    <b>17</b>
-                                    <v>34</v>
-                                </b>
-                                <b>
-                                    <a>17</a>
-                                    <b>25</b>
-                                    <v>34</v>
-                                </b>
-                                <b>
-                                    <a>27</a>
-                                    <b>49</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>52</a>
-                                    <b>109</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>122</a>
-                                    <b>376</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>455</a>
-                                    <b>3337</b>
-                                    <v>15</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>37</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>9</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>72</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>8</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>8</a>
-                                    <b>10</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>10</a>
-                                    <b>17</b>
-                                    <v>34</v>
-                                </b>
-                                <b>
-                                    <a>17</a>
-                                    <b>25</b>
-                                    <v>34</v>
-                                </b>
-                                <b>
-                                    <a>27</a>
-                                    <b>49</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>52</a>
-                                    <b>109</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>122</a>
-                                    <b>376</b>
-                                    <v>31</v>
-                                </b>
-                                <b>
-                                    <a>455</a>
-                                    <b>3337</b>
-                                    <v>15</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>ruby_module</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>31303</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>index</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>31303</v>
+                                    <v>21511</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15288,15 +14845,15 @@
         </relation>
         <relation>
             <name>ruby_module_def</name>
-            <cardinality>21557</cardinality>
+            <cardinality>21589</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>21557</v>
+                    <v>21589</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>21557</v>
+                    <v>21589</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -15310,7 +14867,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>21557</v>
+                                    <v>21589</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15326,7 +14883,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>21557</v>
+                                    <v>21589</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15336,15 +14893,15 @@
         </relation>
         <relation>
             <name>ruby_next_child</name>
-            <cardinality>240</cardinality>
+            <cardinality>245</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_next</k>
-                    <v>240</v>
+                    <v>245</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>240</v>
+                    <v>245</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -15358,7 +14915,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>240</v>
+                                    <v>245</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15374,7 +14931,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>240</v>
+                                    <v>245</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15384,26 +14941,26 @@
         </relation>
         <relation>
             <name>ruby_next_def</name>
-            <cardinality>2005</cardinality>
+            <cardinality>2021</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2005</v>
+                    <v>2021</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_operator_assignment_def</name>
-            <cardinality>6596</cardinality>
+            <cardinality>6502</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>6596</v>
+                    <v>6502</v>
                 </e>
                 <e>
                     <k>left</k>
-                    <v>6596</v>
+                    <v>6502</v>
                 </e>
                 <e>
                     <k>operator</k>
@@ -15411,7 +14968,7 @@
                 </e>
                 <e>
                     <k>right</k>
-                    <v>6596</v>
+                    <v>6502</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -15425,7 +14982,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6596</v>
+                                    <v>6502</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15441,7 +14998,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6596</v>
+                                    <v>6502</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15457,7 +15014,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6596</v>
+                                    <v>6502</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15473,7 +15030,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6596</v>
+                                    <v>6502</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15489,7 +15046,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6596</v>
+                                    <v>6502</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15505,7 +15062,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6596</v>
+                                    <v>6502</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15534,18 +15091,18 @@
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>61</a>
-                                    <b>62</b>
+                                    <a>62</a>
+                                    <b>63</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>592</a>
-                                    <b>593</b>
+                                    <a>594</a>
+                                    <b>595</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1552</a>
-                                    <b>1553</b>
+                                    <a>1558</a>
+                                    <b>1559</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -15575,18 +15132,18 @@
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>61</a>
-                                    <b>62</b>
+                                    <a>62</a>
+                                    <b>63</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>592</a>
-                                    <b>593</b>
+                                    <a>594</a>
+                                    <b>595</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1552</a>
-                                    <b>1553</b>
+                                    <a>1558</a>
+                                    <b>1559</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -15616,18 +15173,18 @@
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>61</a>
-                                    <b>62</b>
+                                    <a>62</a>
+                                    <b>63</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>592</a>
-                                    <b>593</b>
+                                    <a>594</a>
+                                    <b>595</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1552</a>
-                                    <b>1553</b>
+                                    <a>1558</a>
+                                    <b>1559</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -15644,7 +15201,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6596</v>
+                                    <v>6502</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15660,7 +15217,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6596</v>
+                                    <v>6502</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15676,7 +15233,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6596</v>
+                                    <v>6502</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15686,19 +15243,19 @@
         </relation>
         <relation>
             <name>ruby_optional_parameter_def</name>
-            <cardinality>6435</cardinality>
+            <cardinality>6540</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>6435</v>
+                    <v>6540</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>6435</v>
+                    <v>6540</v>
                 </e>
                 <e>
                     <k>value</k>
-                    <v>6435</v>
+                    <v>6540</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -15712,7 +15269,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6435</v>
+                                    <v>6540</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15728,7 +15285,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6435</v>
+                                    <v>6540</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15744,7 +15301,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6435</v>
+                                    <v>6540</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15760,7 +15317,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6435</v>
+                                    <v>6540</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15776,7 +15333,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6435</v>
+                                    <v>6540</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15792,7 +15349,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6435</v>
+                                    <v>6540</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15802,15 +15359,15 @@
         </relation>
         <relation>
             <name>ruby_pair_def</name>
-            <cardinality>235158</cardinality>
+            <cardinality>237637</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>235158</v>
+                    <v>237637</v>
                 </e>
                 <e>
                     <k>key__</k>
-                    <v>235158</v>
+                    <v>237637</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -15824,7 +15381,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>235158</v>
+                                    <v>237637</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15840,7 +15397,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>235158</v>
+                                    <v>237637</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15850,15 +15407,15 @@
         </relation>
         <relation>
             <name>ruby_pair_value</name>
-            <cardinality>235158</cardinality>
+            <cardinality>237637</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_pair</k>
-                    <v>235158</v>
+                    <v>237637</v>
                 </e>
                 <e>
                     <k>value</k>
-                    <v>235158</v>
+                    <v>237637</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -15872,7 +15429,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>235158</v>
+                                    <v>237637</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15888,7 +15445,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>235158</v>
+                                    <v>237637</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15940,11 +15497,11 @@
         </relation>
         <relation>
             <name>ruby_parenthesized_statements_child</name>
-            <cardinality>10272</cardinality>
+            <cardinality>10537</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_parenthesized_statements</k>
-                    <v>10208</v>
+                    <v>10471</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -15952,7 +15509,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>10272</v>
+                    <v>10537</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -15966,12 +15523,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10152</v>
+                                    <v>10413</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>5</b>
-                                    <v>56</v>
+                                    <v>58</v>
                                 </b>
                             </bs>
                         </hist>
@@ -15987,12 +15544,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10152</v>
+                                    <v>10413</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>5</b>
-                                    <v>56</v>
+                                    <v>58</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16016,13 +15573,13 @@
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>56</a>
-                                    <b>57</b>
+                                    <a>58</a>
+                                    <b>59</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>10208</a>
-                                    <b>10209</b>
+                                    <a>10471</a>
+                                    <b>10472</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -16047,13 +15604,13 @@
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>56</a>
-                                    <b>57</b>
+                                    <a>58</a>
+                                    <b>59</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>10208</a>
-                                    <b>10209</b>
+                                    <a>10471</a>
+                                    <b>10472</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -16070,7 +15627,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10272</v>
+                                    <v>10537</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16086,7 +15643,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>10272</v>
+                                    <v>10537</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16096,26 +15653,26 @@
         </relation>
         <relation>
             <name>ruby_parenthesized_statements_def</name>
-            <cardinality>10247</cardinality>
+            <cardinality>10510</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>10247</v>
+                    <v>10510</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_pattern_def</name>
-            <cardinality>3895</cardinality>
+            <cardinality>3918</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3895</v>
+                    <v>3918</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>3895</v>
+                    <v>3918</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -16129,7 +15686,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3895</v>
+                                    <v>3918</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16145,7 +15702,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3895</v>
+                                    <v>3918</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16155,19 +15712,19 @@
         </relation>
         <relation>
             <name>ruby_program_child</name>
-            <cardinality>33147</cardinality>
+            <cardinality>33068</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_program</k>
-                    <v>10456</v>
+                    <v>10393</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>236</v>
+                    <v>235</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>33147</v>
+                    <v>33068</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -16181,32 +15738,32 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3857</v>
+                                    <v>3809</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>2527</v>
+                                    <v>2513</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1660</v>
+                                    <v>1661</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>791</v>
+                                    <v>796</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>8</b>
-                                    <v>910</v>
+                                    <v>895</v>
                                 </b>
                                 <b>
                                     <a>8</a>
-                                    <b>76</b>
-                                    <v>709</v>
+                                    <b>77</b>
+                                    <v>716</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16222,32 +15779,32 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3857</v>
+                                    <v>3809</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>2527</v>
+                                    <v>2513</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1660</v>
+                                    <v>1661</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>791</v>
+                                    <v>796</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>8</b>
-                                    <v>910</v>
+                                    <v>895</v>
                                 </b>
                                 <b>
                                     <a>8</a>
-                                    <b>76</b>
-                                    <v>709</v>
+                                    <b>77</b>
+                                    <v>716</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16263,7 +15820,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>50</v>
+                                    <v>52</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -16272,16 +15829,16 @@
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>9</b>
+                                    <b>10</b>
                                     <v>18</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
-                                    <b>15</b>
+                                    <a>11</a>
+                                    <b>16</b>
                                     <v>18</v>
                                 </b>
                                 <b>
-                                    <a>15</a>
+                                    <a>16</a>
                                     <b>23</b>
                                     <v>18</v>
                                 </b>
@@ -16291,23 +15848,23 @@
                                     <v>18</v>
                                 </b>
                                 <b>
-                                    <a>38</a>
-                                    <b>63</b>
+                                    <a>39</a>
+                                    <b>64</b>
                                     <v>18</v>
                                 </b>
                                 <b>
                                     <a>68</a>
-                                    <b>139</b>
+                                    <b>141</b>
                                     <v>18</v>
                                 </b>
                                 <b>
-                                    <a>157</a>
-                                    <b>515</b>
+                                    <a>159</a>
+                                    <b>521</b>
                                     <v>18</v>
                                 </b>
                                 <b>
-                                    <a>765</a>
-                                    <b>3319</b>
+                                    <a>777</a>
+                                    <b>3354</b>
                                     <v>12</v>
                                 </b>
                             </bs>
@@ -16324,7 +15881,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>50</v>
+                                    <v>52</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -16333,16 +15890,16 @@
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>9</b>
+                                    <b>10</b>
                                     <v>18</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
-                                    <b>15</b>
+                                    <a>11</a>
+                                    <b>16</b>
                                     <v>18</v>
                                 </b>
                                 <b>
-                                    <a>15</a>
+                                    <a>16</a>
                                     <b>23</b>
                                     <v>18</v>
                                 </b>
@@ -16352,23 +15909,23 @@
                                     <v>18</v>
                                 </b>
                                 <b>
-                                    <a>38</a>
-                                    <b>63</b>
+                                    <a>39</a>
+                                    <b>64</b>
                                     <v>18</v>
                                 </b>
                                 <b>
                                     <a>68</a>
-                                    <b>139</b>
+                                    <b>141</b>
                                     <v>18</v>
                                 </b>
                                 <b>
-                                    <a>157</a>
-                                    <b>515</b>
+                                    <a>159</a>
+                                    <b>521</b>
                                     <v>18</v>
                                 </b>
                                 <b>
-                                    <a>765</a>
-                                    <b>3319</b>
+                                    <a>777</a>
+                                    <b>3354</b>
                                     <v>12</v>
                                 </b>
                             </bs>
@@ -16385,7 +15942,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>33147</v>
+                                    <v>33068</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16401,7 +15958,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>33147</v>
+                                    <v>33068</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16411,26 +15968,26 @@
         </relation>
         <relation>
             <name>ruby_program_def</name>
-            <cardinality>17142</cardinality>
+            <cardinality>17193</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>17142</v>
+                    <v>17193</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_range_begin</name>
-            <cardinality>3997</cardinality>
+            <cardinality>4174</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_range</k>
-                    <v>3997</v>
+                    <v>4174</v>
                 </e>
                 <e>
                     <k>begin</k>
-                    <v>3997</v>
+                    <v>4174</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -16444,7 +16001,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3997</v>
+                                    <v>4174</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16460,7 +16017,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3997</v>
+                                    <v>4174</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16470,11 +16027,11 @@
         </relation>
         <relation>
             <name>ruby_range_def</name>
-            <cardinality>4187</cardinality>
+            <cardinality>4435</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4187</v>
+                    <v>4435</v>
                 </e>
                 <e>
                     <k>operator</k>
@@ -16492,7 +16049,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4187</v>
+                                    <v>4435</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16506,13 +16063,13 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>1356</a>
-                                    <b>1357</b>
+                                    <a>1459</a>
+                                    <b>1460</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>2831</a>
-                                    <b>2832</b>
+                                    <a>2976</a>
+                                    <b>2977</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -16523,15 +16080,15 @@
         </relation>
         <relation>
             <name>ruby_range_end</name>
-            <cardinality>4070</cardinality>
+            <cardinality>4268</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_range</k>
-                    <v>4070</v>
+                    <v>4268</v>
                 </e>
                 <e>
                     <k>end</k>
-                    <v>4070</v>
+                    <v>4268</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -16545,7 +16102,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4070</v>
+                                    <v>4268</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16561,7 +16118,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4070</v>
+                                    <v>4268</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16571,15 +16128,15 @@
         </relation>
         <relation>
             <name>ruby_rational_def</name>
-            <cardinality>123</cardinality>
+            <cardinality>124</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>123</v>
+                    <v>124</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>123</v>
+                    <v>124</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -16593,7 +16150,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>123</v>
+                                    <v>124</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16609,7 +16166,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>123</v>
+                                    <v>124</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16678,19 +16235,19 @@
         </relation>
         <relation>
             <name>ruby_regex_child</name>
-            <cardinality>43301</cardinality>
+            <cardinality>43722</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_regex</k>
-                    <v>12839</v>
+                    <v>13081</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>154</v>
+                    <v>151</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>43301</v>
+                    <v>43722</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -16704,42 +16261,42 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6577</v>
+                                    <v>6732</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>696</v>
+                                    <v>712</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1723</v>
+                                    <v>1745</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>466</v>
+                                    <v>492</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>1087</v>
+                                    <v>1094</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>8</b>
-                                    <v>1002</v>
+                                    <v>1016</v>
                                 </b>
                                 <b>
                                     <a>8</a>
                                     <b>15</b>
-                                    <v>986</v>
+                                    <v>995</v>
                                 </b>
                                 <b>
                                     <a>15</a>
                                     <b>50</b>
-                                    <v>299</v>
+                                    <v>291</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16755,42 +16312,42 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6577</v>
+                                    <v>6732</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>696</v>
+                                    <v>712</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>1723</v>
+                                    <v>1745</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>466</v>
+                                    <v>492</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>6</b>
-                                    <v>1087</v>
+                                    <v>1094</v>
                                 </b>
                                 <b>
                                     <a>6</a>
                                     <b>8</b>
-                                    <v>1002</v>
+                                    <v>1016</v>
                                 </b>
                                 <b>
                                     <a>8</a>
                                     <b>15</b>
-                                    <v>986</v>
+                                    <v>995</v>
                                 </b>
                                 <b>
                                     <a>15</a>
                                     <b>50</b>
-                                    <v>299</v>
+                                    <v>291</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16830,17 +16387,17 @@
                                 </b>
                                 <b>
                                     <a>15</a>
-                                    <b>18</b>
+                                    <b>19</b>
                                     <v>12</v>
                                 </b>
                                 <b>
-                                    <a>18</a>
-                                    <b>22</b>
+                                    <a>19</a>
+                                    <b>23</b>
                                     <v>9</v>
                                 </b>
                                 <b>
-                                    <a>22</a>
-                                    <b>30</b>
+                                    <a>23</a>
+                                    <b>31</b>
                                     <v>12</v>
                                 </b>
                                 <b>
@@ -16849,23 +16406,23 @@
                                     <v>12</v>
                                 </b>
                                 <b>
-                                    <a>95</a>
+                                    <a>94</a>
                                     <b>165</b>
                                     <v>12</v>
                                 </b>
                                 <b>
-                                    <a>230</a>
-                                    <b>409</b>
+                                    <a>229</a>
+                                    <b>416</b>
                                     <v>12</v>
                                 </b>
                                 <b>
-                                    <a>645</a>
-                                    <b>1220</b>
+                                    <a>658</a>
+                                    <b>1256</b>
                                     <v>12</v>
                                 </b>
                                 <b>
-                                    <a>1766</a>
-                                    <b>4075</b>
+                                    <a>1818</a>
+                                    <b>4221</b>
                                     <v>9</v>
                                 </b>
                             </bs>
@@ -16906,17 +16463,17 @@
                                 </b>
                                 <b>
                                     <a>15</a>
-                                    <b>18</b>
+                                    <b>19</b>
                                     <v>12</v>
                                 </b>
                                 <b>
-                                    <a>18</a>
-                                    <b>22</b>
+                                    <a>19</a>
+                                    <b>23</b>
                                     <v>9</v>
                                 </b>
                                 <b>
-                                    <a>22</a>
-                                    <b>30</b>
+                                    <a>23</a>
+                                    <b>31</b>
                                     <v>12</v>
                                 </b>
                                 <b>
@@ -16925,23 +16482,23 @@
                                     <v>12</v>
                                 </b>
                                 <b>
-                                    <a>95</a>
+                                    <a>94</a>
                                     <b>165</b>
                                     <v>12</v>
                                 </b>
                                 <b>
-                                    <a>230</a>
-                                    <b>409</b>
+                                    <a>229</a>
+                                    <b>416</b>
                                     <v>12</v>
                                 </b>
                                 <b>
-                                    <a>645</a>
-                                    <b>1220</b>
+                                    <a>658</a>
+                                    <b>1256</b>
                                     <v>12</v>
                                 </b>
                                 <b>
-                                    <a>1766</a>
-                                    <b>4075</b>
+                                    <a>1818</a>
+                                    <b>4221</b>
                                     <v>9</v>
                                 </b>
                             </bs>
@@ -16958,7 +16515,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>43301</v>
+                                    <v>43722</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16974,7 +16531,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>43301</v>
+                                    <v>43722</v>
                                 </b>
                             </bs>
                         </hist>
@@ -16984,26 +16541,26 @@
         </relation>
         <relation>
             <name>ruby_regex_def</name>
-            <cardinality>12854</cardinality>
+            <cardinality>13096</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>12854</v>
+                    <v>13096</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_rescue_body</name>
-            <cardinality>1767</cardinality>
+            <cardinality>1762</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_rescue</k>
-                    <v>1767</v>
+                    <v>1762</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>1767</v>
+                    <v>1762</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17017,7 +16574,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1767</v>
+                                    <v>1762</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17033,7 +16590,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1767</v>
+                                    <v>1762</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17043,26 +16600,26 @@
         </relation>
         <relation>
             <name>ruby_rescue_def</name>
-            <cardinality>2061</cardinality>
+            <cardinality>2085</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2061</v>
+                    <v>2085</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_rescue_exceptions</name>
-            <cardinality>1639</cardinality>
+            <cardinality>1654</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_rescue</k>
-                    <v>1639</v>
+                    <v>1654</v>
                 </e>
                 <e>
                     <k>exceptions</k>
-                    <v>1639</v>
+                    <v>1654</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17076,7 +16633,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1639</v>
+                                    <v>1654</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17092,7 +16649,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1639</v>
+                                    <v>1654</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17102,19 +16659,19 @@
         </relation>
         <relation>
             <name>ruby_rescue_modifier_def</name>
-            <cardinality>525</cardinality>
+            <cardinality>519</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>525</v>
+                    <v>519</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>525</v>
+                    <v>519</v>
                 </e>
                 <e>
                     <k>handler</k>
-                    <v>525</v>
+                    <v>519</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17128,7 +16685,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>525</v>
+                                    <v>519</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17144,7 +16701,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>525</v>
+                                    <v>519</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17160,7 +16717,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>525</v>
+                                    <v>519</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17176,7 +16733,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>525</v>
+                                    <v>519</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17192,7 +16749,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>525</v>
+                                    <v>519</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17208,7 +16765,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>525</v>
+                                    <v>519</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17218,15 +16775,15 @@
         </relation>
         <relation>
             <name>ruby_rescue_variable</name>
-            <cardinality>1001</cardinality>
+            <cardinality>991</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_rescue</k>
-                    <v>1001</v>
+                    <v>991</v>
                 </e>
                 <e>
                     <k>variable</k>
-                    <v>1001</v>
+                    <v>991</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17240,7 +16797,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1001</v>
+                                    <v>991</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17256,7 +16813,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1001</v>
+                                    <v>991</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17314,11 +16871,11 @@
         </relation>
         <relation>
             <name>ruby_rest_assignment_def</name>
-            <cardinality>398</cardinality>
+            <cardinality>399</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>398</v>
+                    <v>399</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -17373,26 +16930,26 @@
         </relation>
         <relation>
             <name>ruby_retry_def</name>
-            <cardinality>56</cardinality>
+            <cardinality>59</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>56</v>
+                    <v>59</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_return_child</name>
-            <cardinality>5336</cardinality>
+            <cardinality>5330</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_return</k>
-                    <v>5336</v>
+                    <v>5330</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>5336</v>
+                    <v>5330</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17406,7 +16963,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5336</v>
+                                    <v>5330</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17422,7 +16979,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5336</v>
+                                    <v>5330</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17432,22 +16989,22 @@
         </relation>
         <relation>
             <name>ruby_return_def</name>
-            <cardinality>8495</cardinality>
+            <cardinality>8486</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>8495</v>
+                    <v>8486</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_right_assignment_list_child</name>
-            <cardinality>2757</cardinality>
+            <cardinality>2721</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_right_assignment_list</k>
-                    <v>1288</v>
+                    <v>1274</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -17455,7 +17012,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>2757</v>
+                    <v>2721</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17469,17 +17026,17 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1147</v>
+                                    <v>1134</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>110</v>
+                                    <v>111</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>31</v>
+                                    <v>27</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17495,17 +17052,17 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1147</v>
+                                    <v>1134</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>110</v>
+                                    <v>111</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>6</b>
-                                    <v>31</v>
+                                    <v>27</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17524,8 +17081,8 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>10</a>
-                                    <b>11</b>
+                                    <a>9</a>
+                                    <b>10</b>
                                     <v>3</v>
                                 </b>
                                 <b>
@@ -17534,8 +17091,8 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>409</a>
-                                    <b>410</b>
+                                    <a>411</a>
+                                    <b>412</b>
                                     <v>6</v>
                                 </b>
                             </bs>
@@ -17555,8 +17112,8 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>10</a>
-                                    <b>11</b>
+                                    <a>9</a>
+                                    <b>10</b>
                                     <v>3</v>
                                 </b>
                                 <b>
@@ -17565,8 +17122,8 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>409</a>
-                                    <b>410</b>
+                                    <a>411</a>
+                                    <b>412</b>
                                     <v>6</v>
                                 </b>
                             </bs>
@@ -17583,7 +17140,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2757</v>
+                                    <v>2721</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17599,7 +17156,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2757</v>
+                                    <v>2721</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17609,26 +17166,26 @@
         </relation>
         <relation>
             <name>ruby_right_assignment_list_def</name>
-            <cardinality>1288</cardinality>
+            <cardinality>1274</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1288</v>
+                    <v>1274</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_scope_resolution_def</name>
-            <cardinality>80009</cardinality>
+            <cardinality>81024</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>80009</v>
+                    <v>81024</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>80009</v>
+                    <v>81024</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17642,7 +17199,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>80009</v>
+                                    <v>81024</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17658,7 +17215,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>80009</v>
+                                    <v>81024</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17668,15 +17225,15 @@
         </relation>
         <relation>
             <name>ruby_scope_resolution_scope</name>
-            <cardinality>78256</cardinality>
+            <cardinality>79203</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_scope_resolution</k>
-                    <v>78256</v>
+                    <v>79203</v>
                 </e>
                 <e>
                     <k>scope</k>
-                    <v>78256</v>
+                    <v>79203</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17690,7 +17247,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>78256</v>
+                                    <v>79203</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17706,7 +17263,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>78256</v>
+                                    <v>79203</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17716,15 +17273,15 @@
         </relation>
         <relation>
             <name>ruby_setter_def</name>
-            <cardinality>598</cardinality>
+            <cardinality>601</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>598</v>
+                    <v>601</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>598</v>
+                    <v>601</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -17738,7 +17295,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>598</v>
+                                    <v>601</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17754,7 +17311,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>598</v>
+                                    <v>601</v>
                                 </b>
                             </bs>
                         </hist>
@@ -17763,26 +17320,22 @@
             </dependencies>
         </relation>
         <relation>
-            <name>ruby_singleton_class_child</name>
-            <cardinality>2322</cardinality>
+            <name>ruby_singleton_class_body</name>
+            <cardinality>635</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_singleton_class</k>
-                    <v>620</v>
+                    <v>635</v>
                 </e>
                 <e>
-                    <k>index</k>
-                    <v>72</v>
-                </e>
-                <e>
-                    <k>child</k>
-                    <v>2322</v>
+                    <k>body</k>
+                    <v>635</v>
                 </e>
             </columnsizes>
             <dependencies>
                 <dep>
                     <src>ruby_singleton_class</src>
-                    <trg>index</trg>
+                    <trg>body</trg>
                     <val>
                         <hist>
                             <budget>12</budget>
@@ -17790,100 +17343,14 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>283</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>40</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>40</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>40</v>
-                                </b>
-                                <b>
-                                    <a>6</a>
-                                    <b>8</b>
-                                    <v>44</v>
-                                </b>
-                                <b>
-                                    <a>8</a>
-                                    <b>13</b>
-                                    <v>53</v>
-                                </b>
-                                <b>
-                                    <a>13</a>
-                                    <b>24</b>
-                                    <v>34</v>
+                                    <v>635</v>
                                 </b>
                             </bs>
                         </hist>
                     </val>
                 </dep>
                 <dep>
-                    <src>ruby_singleton_class</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>283</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>81</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>40</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>40</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>40</v>
-                                </b>
-                                <b>
-                                    <a>6</a>
-                                    <b>8</b>
-                                    <v>44</v>
-                                </b>
-                                <b>
-                                    <a>8</a>
-                                    <b>13</b>
-                                    <v>53</v>
-                                </b>
-                                <b>
-                                    <a>13</a>
-                                    <b>24</b>
-                                    <v>34</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
+                    <src>body</src>
                     <trg>ruby_singleton_class</trg>
                     <val>
                         <hist>
@@ -17892,155 +17359,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>9</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>9</v>
-                                </b>
-                                <b>
-                                    <a>6</a>
-                                    <b>8</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>12</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>16</a>
-                                    <b>20</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>21</a>
-                                    <b>23</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>28</a>
-                                    <b>33</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>42</a>
-                                    <b>56</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>68</a>
-                                    <b>82</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>107</a>
-                                    <b>198</b>
-                                    <v>6</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>3</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>9</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>9</v>
-                                </b>
-                                <b>
-                                    <a>6</a>
-                                    <b>8</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>12</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>16</a>
-                                    <b>20</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>21</a>
-                                    <b>23</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>28</a>
-                                    <b>33</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>42</a>
-                                    <b>56</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>68</a>
-                                    <b>82</b>
-                                    <v>6</v>
-                                </b>
-                                <b>
-                                    <a>107</a>
-                                    <b>198</b>
-                                    <v>6</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>ruby_singleton_class</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>2322</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>index</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>2322</v>
+                                    <v>635</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18050,15 +17369,15 @@
         </relation>
         <relation>
             <name>ruby_singleton_class_def</name>
-            <cardinality>620</cardinality>
+            <cardinality>635</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>620</v>
+                    <v>635</v>
                 </e>
                 <e>
                     <k>value</k>
-                    <v>620</v>
+                    <v>635</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -18072,7 +17391,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>620</v>
+                                    <v>635</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18088,7 +17407,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>620</v>
+                                    <v>635</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18097,26 +17416,22 @@
             </dependencies>
         </relation>
         <relation>
-            <name>ruby_singleton_method_child</name>
-            <cardinality>16018</cardinality>
+            <name>ruby_singleton_method_body</name>
+            <cardinality>6677</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_singleton_method</k>
-                    <v>6539</v>
+                    <v>6677</v>
                 </e>
                 <e>
-                    <k>index</k>
-                    <v>89</v>
-                </e>
-                <e>
-                    <k>child</k>
-                    <v>16018</v>
+                    <k>body</k>
+                    <v>6677</v>
                 </e>
             </columnsizes>
             <dependencies>
                 <dep>
                     <src>ruby_singleton_method</src>
-                    <trg>index</trg>
+                    <trg>body</trg>
                     <val>
                         <hist>
                             <budget>12</budget>
@@ -18124,80 +17439,14 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3714</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>965</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>612</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>374</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>8</b>
-                                    <v>505</v>
-                                </b>
-                                <b>
-                                    <a>8</a>
-                                    <b>31</b>
-                                    <v>368</v>
+                                    <v>6677</v>
                                 </b>
                             </bs>
                         </hist>
                     </val>
                 </dep>
                 <dep>
-                    <src>ruby_singleton_method</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>3714</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>965</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>612</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>374</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>8</b>
-                                    <v>505</v>
-                                </b>
-                                <b>
-                                    <a>8</a>
-                                    <b>31</b>
-                                    <v>368</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
+                    <src>body</src>
                     <trg>ruby_singleton_method</trg>
                     <val>
                         <hist>
@@ -18206,195 +17455,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>11</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>2</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>8</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>10</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>12</a>
-                                    <b>17</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>23</a>
-                                    <b>28</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>32</a>
-                                    <b>41</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>51</a>
-                                    <b>66</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>93</a>
-                                    <b>125</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>155</a>
-                                    <b>210</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>294</a>
-                                    <b>421</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>626</a>
-                                    <b>952</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>2201</a>
-                                    <b>2202</b>
-                                    <v>2</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>index</src>
-                    <trg>child</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>2</v>
-                                </b>
-                                <b>
-                                    <a>2</a>
-                                    <b>3</b>
-                                    <v>11</v>
-                                </b>
-                                <b>
-                                    <a>3</a>
-                                    <b>4</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>4</a>
-                                    <b>5</b>
-                                    <v>2</v>
-                                </b>
-                                <b>
-                                    <a>5</a>
-                                    <b>6</b>
-                                    <v>8</v>
-                                </b>
-                                <b>
-                                    <a>9</a>
-                                    <b>10</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>12</a>
-                                    <b>17</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>23</a>
-                                    <b>28</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>32</a>
-                                    <b>41</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>51</a>
-                                    <b>66</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>93</a>
-                                    <b>125</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>155</a>
-                                    <b>210</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>294</a>
-                                    <b>421</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>626</a>
-                                    <b>952</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>2201</a>
-                                    <b>2202</b>
-                                    <v>2</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>ruby_singleton_method</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>16018</v>
-                                </b>
-                            </bs>
-                        </hist>
-                    </val>
-                </dep>
-                <dep>
-                    <src>child</src>
-                    <trg>index</trg>
-                    <val>
-                        <hist>
-                            <budget>12</budget>
-                            <bs>
-                                <b>
-                                    <a>1</a>
-                                    <b>2</b>
-                                    <v>16018</v>
+                                    <v>6677</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18404,19 +17465,19 @@
         </relation>
         <relation>
             <name>ruby_singleton_method_def</name>
-            <cardinality>6539</cardinality>
+            <cardinality>6692</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>6539</v>
+                    <v>6692</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>6539</v>
+                    <v>6692</v>
                 </e>
                 <e>
                     <k>object</k>
-                    <v>6539</v>
+                    <v>6692</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -18430,7 +17491,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6539</v>
+                                    <v>6692</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18446,7 +17507,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6539</v>
+                                    <v>6692</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18462,7 +17523,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6539</v>
+                                    <v>6692</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18478,7 +17539,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6539</v>
+                                    <v>6692</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18494,7 +17555,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6539</v>
+                                    <v>6692</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18510,7 +17571,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>6539</v>
+                                    <v>6692</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18520,15 +17581,15 @@
         </relation>
         <relation>
             <name>ruby_singleton_method_parameters</name>
-            <cardinality>4082</cardinality>
+            <cardinality>4183</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_singleton_method</k>
-                    <v>4082</v>
+                    <v>4183</v>
                 </e>
                 <e>
                     <k>parameters</k>
-                    <v>4082</v>
+                    <v>4183</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -18542,7 +17603,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4082</v>
+                                    <v>4183</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18558,7 +17619,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4082</v>
+                                    <v>4183</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18568,15 +17629,15 @@
         </relation>
         <relation>
             <name>ruby_splat_argument_def</name>
-            <cardinality>3046</cardinality>
+            <cardinality>3093</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3046</v>
+                    <v>3093</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>3046</v>
+                    <v>3093</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -18590,7 +17651,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3046</v>
+                                    <v>3093</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18606,7 +17667,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3046</v>
+                                    <v>3093</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18616,26 +17677,26 @@
         </relation>
         <relation>
             <name>ruby_splat_parameter_def</name>
-            <cardinality>2905</cardinality>
+            <cardinality>2978</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2905</v>
+                    <v>2978</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_splat_parameter_name</name>
-            <cardinality>2354</cardinality>
+            <cardinality>2383</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_splat_parameter</k>
-                    <v>2354</v>
+                    <v>2383</v>
                 </e>
                 <e>
                     <k>name</k>
-                    <v>2354</v>
+                    <v>2383</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -18649,7 +17710,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2354</v>
+                                    <v>2383</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18665,7 +17726,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2354</v>
+                                    <v>2383</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18675,11 +17736,11 @@
         </relation>
         <relation>
             <name>ruby_string_array_child</name>
-            <cardinality>11487</cardinality>
+            <cardinality>11622</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_string_array</k>
-                    <v>3704</v>
+                    <v>3773</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -18687,7 +17748,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>11487</v>
+                    <v>11622</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -18701,27 +17762,27 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1200</v>
+                                    <v>1222</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1218</v>
+                                    <v>1256</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>576</v>
+                                    <v>581</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>294</v>
+                                    <v>296</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>10</b>
-                                    <v>282</v>
+                                    <v>284</v>
                                 </b>
                                 <b>
                                     <a>10</a>
@@ -18742,27 +17803,27 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1200</v>
+                                    <v>1222</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>1218</v>
+                                    <v>1256</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>576</v>
+                                    <v>581</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>5</b>
-                                    <v>294</v>
+                                    <v>296</v>
                                 </b>
                                 <b>
                                     <a>5</a>
                                     <b>10</b>
-                                    <v>282</v>
+                                    <v>284</v>
                                 </b>
                                 <b>
                                     <a>10</a>
@@ -18792,12 +17853,12 @@
                                 </b>
                                 <b>
                                     <a>17</a>
-                                    <b>417</b>
+                                    <b>419</b>
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>710</a>
-                                    <b>3705</b>
+                                    <a>714</a>
+                                    <b>3774</b>
                                     <v>4</v>
                                 </b>
                             </bs>
@@ -18823,12 +17884,12 @@
                                 </b>
                                 <b>
                                     <a>17</a>
-                                    <b>417</b>
+                                    <b>419</b>
                                     <v>35</v>
                                 </b>
                                 <b>
-                                    <a>710</a>
-                                    <b>3705</b>
+                                    <a>714</a>
+                                    <b>3774</b>
                                     <v>4</v>
                                 </b>
                             </bs>
@@ -18845,7 +17906,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>11487</v>
+                                    <v>11622</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18861,7 +17922,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>11487</v>
+                                    <v>11622</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18871,22 +17932,22 @@
         </relation>
         <relation>
             <name>ruby_string_array_def</name>
-            <cardinality>3840</cardinality>
+            <cardinality>3913</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3840</v>
+                    <v>3913</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_string_child</name>
-            <cardinality>534498</cardinality>
+            <cardinality>538306</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_string__</k>
-                    <v>466613</v>
+                    <v>469399</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -18894,7 +17955,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>534498</v>
+                    <v>538306</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -18908,12 +17969,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>439982</v>
+                                    <v>442362</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>282</b>
-                                    <v>26631</v>
+                                    <v>27037</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18929,12 +17990,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>439982</v>
+                                    <v>442362</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>282</b>
-                                    <v>26631</v>
+                                    <v>27037</v>
                                 </b>
                             </bs>
                         </hist>
@@ -18974,7 +18035,7 @@
                                 </b>
                                 <b>
                                     <a>102</a>
-                                    <b>466614</b>
+                                    <b>469400</b>
                                     <v>22</v>
                                 </b>
                             </bs>
@@ -19015,7 +18076,7 @@
                                 </b>
                                 <b>
                                     <a>102</a>
-                                    <b>466614</b>
+                                    <b>469400</b>
                                     <v>22</v>
                                 </b>
                             </bs>
@@ -19032,7 +18093,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>534498</v>
+                                    <v>538306</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19048,7 +18109,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>534498</v>
+                                    <v>538306</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19058,22 +18119,22 @@
         </relation>
         <relation>
             <name>ruby_string_def</name>
-            <cardinality>473533</cardinality>
+            <cardinality>476418</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>473533</v>
+                    <v>476418</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_subshell_child</name>
-            <cardinality>620</cardinality>
+            <cardinality>604</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_subshell</k>
-                    <v>403</v>
+                    <v>393</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -19081,7 +18142,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>620</v>
+                    <v>604</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -19095,22 +18156,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>296</v>
+                                    <v>288</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>59</v>
+                                    <v>58</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>18</v>
+                                    <v>21</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>12</b>
-                                    <v>28</v>
+                                    <v>24</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19126,22 +18187,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>296</v>
+                                    <v>288</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>59</v>
+                                    <v>58</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>18</v>
+                                    <v>21</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>12</b>
-                                    <v>28</v>
+                                    <v>24</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19170,8 +18231,8 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
-                                    <b>10</b>
+                                    <a>8</a>
+                                    <b>9</b>
                                     <v>3</v>
                                 </b>
                                 <b>
@@ -19185,8 +18246,8 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>128</a>
-                                    <b>129</b>
+                                    <a>127</a>
+                                    <b>128</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -19216,8 +18277,8 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>9</a>
-                                    <b>10</b>
+                                    <a>8</a>
+                                    <b>9</b>
                                     <v>3</v>
                                 </b>
                                 <b>
@@ -19231,8 +18292,8 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>128</a>
-                                    <b>129</b>
+                                    <a>127</a>
+                                    <b>128</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -19249,7 +18310,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>620</v>
+                                    <v>604</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19265,7 +18326,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>620</v>
+                                    <v>604</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19275,26 +18336,26 @@
         </relation>
         <relation>
             <name>ruby_subshell_def</name>
-            <cardinality>403</cardinality>
+            <cardinality>393</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>403</v>
+                    <v>393</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_superclass_def</name>
-            <cardinality>13318</cardinality>
+            <cardinality>13378</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>13318</v>
+                    <v>13378</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>13318</v>
+                    <v>13378</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -19308,7 +18369,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13318</v>
+                                    <v>13378</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19324,7 +18385,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13318</v>
+                                    <v>13378</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19334,19 +18395,19 @@
         </relation>
         <relation>
             <name>ruby_symbol_array_child</name>
-            <cardinality>2106</cardinality>
+            <cardinality>2085</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_symbol_array</k>
-                    <v>463</v>
+                    <v>460</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>98</v>
+                    <v>96</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>2106</v>
+                    <v>2085</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -19360,17 +18421,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>184</v>
+                                    <v>180</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>92</v>
+                                    <v>93</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>38</v>
+                                    <v>40</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -19385,12 +18446,12 @@
                                 <b>
                                     <a>8</a>
                                     <b>13</b>
-                                    <v>38</v>
+                                    <v>37</v>
                                 </b>
                                 <b>
                                     <a>13</a>
                                     <b>22</b>
-                                    <v>38</v>
+                                    <v>37</v>
                                 </b>
                                 <b>
                                     <a>27</a>
@@ -19411,17 +18472,17 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>184</v>
+                                    <v>180</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>92</v>
+                                    <v>93</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>38</v>
+                                    <v>40</v>
                                 </b>
                                 <b>
                                     <a>4</a>
@@ -19436,12 +18497,12 @@
                                 <b>
                                     <a>8</a>
                                     <b>13</b>
-                                    <v>38</v>
+                                    <v>37</v>
                                 </b>
                                 <b>
                                     <a>13</a>
                                     <b>22</b>
-                                    <v>38</v>
+                                    <v>37</v>
                                 </b>
                                 <b>
                                     <a>27</a>
@@ -19462,12 +18523,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>11</v>
+                                    <v>8</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>5</v>
+                                    <v>8</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -19505,8 +18566,8 @@
                                     <v>8</v>
                                 </b>
                                 <b>
-                                    <a>63</a>
-                                    <b>157</b>
+                                    <a>64</a>
+                                    <b>159</b>
                                     <v>8</v>
                                 </b>
                             </bs>
@@ -19523,12 +18584,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>11</v>
+                                    <v>8</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>5</v>
+                                    <v>8</v>
                                 </b>
                                 <b>
                                     <a>3</a>
@@ -19566,8 +18627,8 @@
                                     <v>8</v>
                                 </b>
                                 <b>
-                                    <a>63</a>
-                                    <b>157</b>
+                                    <a>64</a>
+                                    <b>159</b>
                                     <v>8</v>
                                 </b>
                             </bs>
@@ -19584,7 +18645,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2106</v>
+                                    <v>2085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19600,7 +18661,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2106</v>
+                                    <v>2085</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19610,30 +18671,30 @@
         </relation>
         <relation>
             <name>ruby_symbol_array_def</name>
-            <cardinality>463</cardinality>
+            <cardinality>460</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>463</v>
+                    <v>460</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_then_child</name>
-            <cardinality>41375</cardinality>
+            <cardinality>40747</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_then</k>
-                    <v>24329</v>
+                    <v>24194</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>288</v>
+                    <v>105</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>41375</v>
+                    <v>40747</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -19647,22 +18708,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>15210</v>
+                                    <v>15103</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>5479</v>
+                                    <v>5505</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>2011</v>
+                                    <v>1954</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>98</b>
-                                    <v>1628</v>
+                                    <b>37</b>
+                                    <v>1630</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19678,22 +18739,22 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>15210</v>
+                                    <v>15103</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>5479</v>
+                                    <v>5505</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>2011</v>
+                                    <v>1954</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>98</b>
-                                    <v>1628</v>
+                                    <b>37</b>
+                                    <v>1630</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19709,33 +18770,48 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>184</v>
+                                    <v>35</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>4</b>
-                                    <v>20</v>
+                                    <v>8</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>7</b>
-                                    <v>20</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>12</b>
-                                    <v>23</v>
-                                </b>
-                                <b>
-                                    <a>12</a>
-                                    <b>157</b>
-                                    <v>23</v>
-                                </b>
-                                <b>
-                                    <a>292</a>
-                                    <b>8189</b>
+                                    <b>5</b>
                                     <v>14</v>
                                 </b>
+                                <b>
+                                    <a>6</a>
+                                    <b>10</b>
+                                    <v>8</v>
+                                </b>
+                                <b>
+                                    <a>10</a>
+                                    <b>20</b>
+                                    <v>8</v>
+                                </b>
+                                <b>
+                                    <a>30</a>
+                                    <b>59</b>
+                                    <v>8</v>
+                                </b>
+                                <b>
+                                    <a>91</a>
+                                    <b>293</b>
+                                    <v>8</v>
+                                </b>
+                                <b>
+                                    <a>559</a>
+                                    <b>3117</b>
+                                    <v>8</v>
+                                </b>
+                                <b>
+                                    <a>8293</a>
+                                    <b>8294</b>
+                                    <v>2</v>
+                                </b>
                             </bs>
                         </hist>
                     </val>
@@ -19750,33 +18826,48 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>184</v>
+                                    <v>35</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>4</b>
-                                    <v>20</v>
+                                    <v>8</v>
                                 </b>
                                 <b>
                                     <a>4</a>
-                                    <b>7</b>
-                                    <v>20</v>
-                                </b>
-                                <b>
-                                    <a>7</a>
-                                    <b>12</b>
-                                    <v>23</v>
-                                </b>
-                                <b>
-                                    <a>12</a>
-                                    <b>157</b>
-                                    <v>23</v>
-                                </b>
-                                <b>
-                                    <a>292</a>
-                                    <b>8189</b>
+                                    <b>5</b>
                                     <v>14</v>
                                 </b>
+                                <b>
+                                    <a>6</a>
+                                    <b>10</b>
+                                    <v>8</v>
+                                </b>
+                                <b>
+                                    <a>10</a>
+                                    <b>20</b>
+                                    <v>8</v>
+                                </b>
+                                <b>
+                                    <a>30</a>
+                                    <b>59</b>
+                                    <v>8</v>
+                                </b>
+                                <b>
+                                    <a>91</a>
+                                    <b>293</b>
+                                    <v>8</v>
+                                </b>
+                                <b>
+                                    <a>559</a>
+                                    <b>3117</b>
+                                    <v>8</v>
+                                </b>
+                                <b>
+                                    <a>8293</a>
+                                    <b>8294</b>
+                                    <v>2</v>
+                                </b>
                             </bs>
                         </hist>
                     </val>
@@ -19791,7 +18882,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>41375</v>
+                                    <v>40747</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19807,7 +18898,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>41375</v>
+                                    <v>40747</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19817,30 +18908,30 @@
         </relation>
         <relation>
             <name>ruby_then_def</name>
-            <cardinality>24329</cardinality>
+            <cardinality>24194</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>24329</v>
+                    <v>24194</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_tokeninfo</name>
-            <cardinality>5932219</cardinality>
+            <cardinality>5993849</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>5932219</v>
+                    <v>5993849</v>
                 </e>
                 <e>
                     <k>kind</k>
-                    <v>65</v>
+                    <v>64</v>
                 </e>
                 <e>
                     <k>value</k>
-                    <v>268924</v>
+                    <v>272090</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -19854,7 +18945,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5932219</v>
+                                    <v>5993849</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19870,7 +18961,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>5932219</v>
+                                    <v>5993849</v>
                                 </b>
                             </bs>
                         </hist>
@@ -19884,65 +18975,65 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>36</a>
-                                    <b>154</b>
+                                    <a>38</a>
+                                    <b>162</b>
                                     <v>5</v>
                                 </b>
                                 <b>
-                                    <a>218</a>
+                                    <a>229</a>
                                     <b>427</b>
                                     <v>5</v>
                                 </b>
                                 <b>
-                                    <a>1610</a>
-                                    <b>1611</b>
+                                    <a>1651</a>
+                                    <b>1652</b>
                                     <v>2</v>
                                 </b>
                                 <b>
-                                    <a>1805</a>
-                                    <b>1806</b>
+                                    <a>1892</a>
+                                    <b>1893</b>
                                     <v>5</v>
                                 </b>
                                 <b>
-                                    <a>3990</a>
-                                    <b>4222</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>4225</a>
-                                    <b>5692</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>7841</a>
-                                    <b>9805</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>13552</a>
-                                    <b>17172</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>25328</a>
-                                    <b>54391</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>55573</a>
-                                    <b>79435</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>95059</a>
-                                    <b>499129</b>
-                                    <v>5</v>
-                                </b>
-                                <b>
-                                    <a>1115017</a>
-                                    <b>1115018</b>
+                                    <a>4175</a>
+                                    <b>4176</b>
                                     <v>2</v>
                                 </b>
+                                <b>
+                                    <a>4361</a>
+                                    <b>4362</b>
+                                    <v>5</v>
+                                </b>
+                                <b>
+                                    <a>5941</a>
+                                    <b>8156</b>
+                                    <v>5</v>
+                                </b>
+                                <b>
+                                    <a>9961</a>
+                                    <b>13707</b>
+                                    <v>5</v>
+                                </b>
+                                <b>
+                                    <a>17937</a>
+                                    <b>25691</b>
+                                    <v>5</v>
+                                </b>
+                                <b>
+                                    <a>55821</a>
+                                    <b>57168</b>
+                                    <v>5</v>
+                                </b>
+                                <b>
+                                    <a>82456</a>
+                                    <b>97584</b>
+                                    <v>5</v>
+                                </b>
+                                <b>
+                                    <a>513548</a>
+                                    <b>1147355</b>
+                                    <v>5</v>
+                                </b>
                             </bs>
                         </hist>
                     </val>
@@ -19961,47 +19052,47 @@
                                 </b>
                                 <b>
                                     <a>5</a>
-                                    <b>22</b>
+                                    <b>24</b>
                                     <v>5</v>
                                 </b>
                                 <b>
                                     <a>25</a>
-                                    <b>30</b>
+                                    <b>32</b>
                                     <v>5</v>
                                 </b>
                                 <b>
-                                    <a>69</a>
-                                    <b>123</b>
+                                    <a>71</a>
+                                    <b>122</b>
                                     <v>5</v>
                                 </b>
                                 <b>
-                                    <a>123</a>
+                                    <a>124</a>
                                     <b>148</b>
                                     <v>5</v>
                                 </b>
                                 <b>
-                                    <a>1480</a>
-                                    <b>1754</b>
+                                    <a>1483</a>
+                                    <b>1800</b>
                                     <v>5</v>
                                 </b>
                                 <b>
-                                    <a>3052</a>
-                                    <b>3730</b>
+                                    <a>3157</a>
+                                    <b>3799</b>
                                     <v>5</v>
                                 </b>
                                 <b>
-                                    <a>4632</a>
-                                    <b>7672</b>
+                                    <a>4735</a>
+                                    <b>7872</b>
                                     <v>5</v>
                                 </b>
                                 <b>
-                                    <a>10019</a>
-                                    <b>18637</b>
+                                    <a>10529</a>
+                                    <b>19137</b>
                                     <v>5</v>
                                 </b>
                                 <b>
-                                    <a>44586</a>
-                                    <b>44587</b>
+                                    <a>45798</a>
+                                    <b>45799</b>
                                     <v>2</v>
                                 </b>
                             </bs>
@@ -20018,32 +19109,32 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>159668</v>
+                                    <v>162126</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>39566</v>
+                                    <v>39738</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>4</b>
-                                    <v>18844</v>
+                                    <v>18995</v>
                                 </b>
                                 <b>
                                     <a>4</a>
                                     <b>7</b>
-                                    <v>22228</v>
+                                    <v>22513</v>
                                 </b>
                                 <b>
                                     <a>7</a>
                                     <b>27</b>
-                                    <v>20374</v>
+                                    <v>20459</v>
                                 </b>
                                 <b>
                                     <a>27</a>
-                                    <b>183191</b>
-                                    <v>8242</v>
+                                    <b>189123</b>
+                                    <v>8256</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20059,12 +19150,12 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>255594</v>
+                                    <v>259066</v>
                                 </b>
                                 <b>
                                     <a>2</a>
                                     <b>5</b>
-                                    <v>13329</v>
+                                    <v>13023</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20074,15 +19165,15 @@
         </relation>
         <relation>
             <name>ruby_unary_def</name>
-            <cardinality>13057</cardinality>
+            <cardinality>13450</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>13057</v>
+                    <v>13450</v>
                 </e>
                 <e>
                     <k>operand</k>
-                    <v>13057</v>
+                    <v>13450</v>
                 </e>
                 <e>
                     <k>operator</k>
@@ -20100,7 +19191,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13057</v>
+                                    <v>13450</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20116,7 +19207,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13057</v>
+                                    <v>13450</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20132,7 +19223,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13057</v>
+                                    <v>13450</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20148,7 +19239,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>13057</v>
+                                    <v>13450</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20162,33 +19253,33 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>88</a>
-                                    <b>89</b>
+                                    <a>89</a>
+                                    <b>90</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>236</a>
-                                    <b>237</b>
+                                    <a>190</a>
+                                    <b>191</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>557</a>
-                                    <b>558</b>
+                                    <a>559</a>
+                                    <b>560</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>1312</a>
-                                    <b>1313</b>
+                                    <a>1320</a>
+                                    <b>1321</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>1742</a>
-                                    <b>1743</b>
+                                    <a>1820</a>
+                                    <b>1821</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>9122</a>
-                                    <b>9123</b>
+                                    <a>9472</a>
+                                    <b>9473</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -20203,33 +19294,33 @@
                             <budget>12</budget>
                             <bs>
                                 <b>
-                                    <a>88</a>
-                                    <b>89</b>
+                                    <a>89</a>
+                                    <b>90</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>236</a>
-                                    <b>237</b>
+                                    <a>190</a>
+                                    <b>191</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>557</a>
-                                    <b>558</b>
+                                    <a>559</a>
+                                    <b>560</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>1312</a>
-                                    <b>1313</b>
+                                    <a>1320</a>
+                                    <b>1321</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>1742</a>
-                                    <b>1743</b>
+                                    <a>1820</a>
+                                    <b>1821</b>
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>9122</a>
-                                    <b>9123</b>
+                                    <a>9472</a>
+                                    <b>9473</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -20240,11 +19331,11 @@
         </relation>
         <relation>
             <name>ruby_undef_child</name>
-            <cardinality>181</cardinality>
+            <cardinality>182</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_undef</k>
-                    <v>180</v>
+                    <v>181</v>
                 </e>
                 <e>
                     <k>index</k>
@@ -20252,7 +19343,7 @@
                 </e>
                 <e>
                     <k>child</k>
-                    <v>181</v>
+                    <v>182</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -20266,7 +19357,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>179</v>
+                                    <v>180</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -20287,7 +19378,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>179</v>
+                                    <v>180</v>
                                 </b>
                                 <b>
                                     <a>2</a>
@@ -20311,8 +19402,8 @@
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>180</a>
-                                    <b>181</b>
+                                    <a>181</a>
+                                    <b>182</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -20332,8 +19423,8 @@
                                     <v>1</v>
                                 </b>
                                 <b>
-                                    <a>180</a>
-                                    <b>181</b>
+                                    <a>181</a>
+                                    <b>182</b>
                                     <v>1</v>
                                 </b>
                             </bs>
@@ -20350,7 +19441,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>181</v>
+                                    <v>182</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20366,7 +19457,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>181</v>
+                                    <v>182</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20376,11 +19467,11 @@
         </relation>
         <relation>
             <name>ruby_undef_def</name>
-            <cardinality>180</cardinality>
+            <cardinality>181</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>180</v>
+                    <v>181</v>
                 </e>
             </columnsizes>
             <dependencies/>
@@ -20435,15 +19526,15 @@
         </relation>
         <relation>
             <name>ruby_unless_consequence</name>
-            <cardinality>2575</cardinality>
+            <cardinality>2593</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_unless</k>
-                    <v>2575</v>
+                    <v>2593</v>
                 </e>
                 <e>
                     <k>consequence</k>
-                    <v>2575</v>
+                    <v>2593</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -20457,7 +19548,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2575</v>
+                                    <v>2593</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20473,7 +19564,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2575</v>
+                                    <v>2593</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20483,15 +19574,15 @@
         </relation>
         <relation>
             <name>ruby_unless_def</name>
-            <cardinality>2578</cardinality>
+            <cardinality>2594</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2578</v>
+                    <v>2594</v>
                 </e>
                 <e>
                     <k>condition</k>
-                    <v>2578</v>
+                    <v>2594</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -20505,7 +19596,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2578</v>
+                                    <v>2594</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20521,7 +19612,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>2578</v>
+                                    <v>2594</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20573,19 +19664,19 @@
         </relation>
         <relation>
             <name>ruby_unless_modifier_def</name>
-            <cardinality>4207</cardinality>
+            <cardinality>4163</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>4207</v>
+                    <v>4163</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>4207</v>
+                    <v>4163</v>
                 </e>
                 <e>
                     <k>condition</k>
-                    <v>4207</v>
+                    <v>4163</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -20599,7 +19690,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4207</v>
+                                    <v>4163</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20615,7 +19706,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4207</v>
+                                    <v>4163</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20631,7 +19722,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4207</v>
+                                    <v>4163</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20647,7 +19738,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4207</v>
+                                    <v>4163</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20663,7 +19754,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4207</v>
+                                    <v>4163</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20679,7 +19770,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>4207</v>
+                                    <v>4163</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20689,19 +19780,19 @@
         </relation>
         <relation>
             <name>ruby_until_def</name>
-            <cardinality>113</cardinality>
+            <cardinality>121</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>113</v>
+                    <v>121</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>113</v>
+                    <v>121</v>
                 </e>
                 <e>
                     <k>condition</k>
-                    <v>113</v>
+                    <v>121</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -20715,7 +19806,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>113</v>
+                                    <v>121</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20731,7 +19822,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>113</v>
+                                    <v>121</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20747,7 +19838,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>113</v>
+                                    <v>121</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20763,7 +19854,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>113</v>
+                                    <v>121</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20779,7 +19870,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>113</v>
+                                    <v>121</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20795,7 +19886,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>113</v>
+                                    <v>121</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20805,19 +19896,19 @@
         </relation>
         <relation>
             <name>ruby_until_modifier_def</name>
-            <cardinality>206</cardinality>
+            <cardinality>223</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>206</v>
+                    <v>223</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>206</v>
+                    <v>223</v>
                 </e>
                 <e>
                     <k>condition</k>
-                    <v>206</v>
+                    <v>223</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -20831,7 +19922,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>206</v>
+                                    <v>223</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20847,7 +19938,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>206</v>
+                                    <v>223</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20863,7 +19954,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>206</v>
+                                    <v>223</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20879,7 +19970,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>206</v>
+                                    <v>223</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20895,7 +19986,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>206</v>
+                                    <v>223</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20911,7 +20002,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>206</v>
+                                    <v>223</v>
                                 </b>
                             </bs>
                         </hist>
@@ -20963,15 +20054,15 @@
         </relation>
         <relation>
             <name>ruby_when_body</name>
-            <cardinality>3208</cardinality>
+            <cardinality>3211</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_when</k>
-                    <v>3208</v>
+                    <v>3211</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>3208</v>
+                    <v>3211</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -20985,7 +20076,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3208</v>
+                                    <v>3211</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21001,7 +20092,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3208</v>
+                                    <v>3211</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21011,30 +20102,30 @@
         </relation>
         <relation>
             <name>ruby_when_def</name>
-            <cardinality>3239</cardinality>
+            <cardinality>3248</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>3239</v>
+                    <v>3248</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>ruby_when_pattern</name>
-            <cardinality>3895</cardinality>
+            <cardinality>3918</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_when</k>
-                    <v>3239</v>
+                    <v>3248</v>
                 </e>
                 <e>
                     <k>index</k>
-                    <v>44</v>
+                    <v>43</v>
                 </e>
                 <e>
                     <k>pattern</k>
-                    <v>3895</v>
+                    <v>3918</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -21053,12 +20144,12 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>305</v>
+                                    <v>309</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>15</b>
-                                    <v>103</v>
+                                    <v>108</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21079,12 +20170,12 @@
                                 <b>
                                     <a>2</a>
                                     <b>3</b>
-                                    <v>305</v>
+                                    <v>309</v>
                                 </b>
                                 <b>
                                     <a>3</a>
                                     <b>15</b>
-                                    <v>103</v>
+                                    <v>108</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21118,23 +20209,23 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>12</a>
-                                    <b>13</b>
+                                    <a>13</a>
+                                    <b>14</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>33</a>
-                                    <b>34</b>
+                                    <a>35</a>
+                                    <b>36</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>130</a>
-                                    <b>131</b>
+                                    <a>135</a>
+                                    <b>136</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>1028</a>
-                                    <b>1029</b>
+                                    <a>1048</a>
+                                    <b>1049</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -21169,23 +20260,23 @@
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>12</a>
-                                    <b>13</b>
+                                    <a>13</a>
+                                    <b>14</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>33</a>
-                                    <b>34</b>
+                                    <a>35</a>
+                                    <b>36</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>130</a>
-                                    <b>131</b>
+                                    <a>135</a>
+                                    <b>136</b>
                                     <v>3</v>
                                 </b>
                                 <b>
-                                    <a>1028</a>
-                                    <b>1029</b>
+                                    <a>1048</a>
+                                    <b>1049</b>
                                     <v>3</v>
                                 </b>
                             </bs>
@@ -21202,7 +20293,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3895</v>
+                                    <v>3918</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21218,7 +20309,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>3895</v>
+                                    <v>3918</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21228,19 +20319,19 @@
         </relation>
         <relation>
             <name>ruby_while_def</name>
-            <cardinality>1335</cardinality>
+            <cardinality>1349</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>1335</v>
+                    <v>1349</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>1335</v>
+                    <v>1349</v>
                 </e>
                 <e>
                     <k>condition</k>
-                    <v>1335</v>
+                    <v>1349</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -21254,7 +20345,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1335</v>
+                                    <v>1349</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21270,7 +20361,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1335</v>
+                                    <v>1349</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21286,7 +20377,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1335</v>
+                                    <v>1349</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21302,7 +20393,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1335</v>
+                                    <v>1349</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21318,7 +20409,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1335</v>
+                                    <v>1349</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21334,7 +20425,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1335</v>
+                                    <v>1349</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21344,19 +20435,19 @@
         </relation>
         <relation>
             <name>ruby_while_modifier_def</name>
-            <cardinality>179</cardinality>
+            <cardinality>190</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>179</v>
+                    <v>190</v>
                 </e>
                 <e>
                     <k>body</k>
-                    <v>179</v>
+                    <v>190</v>
                 </e>
                 <e>
                     <k>condition</k>
-                    <v>179</v>
+                    <v>190</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -21370,7 +20461,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>179</v>
+                                    <v>190</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21386,7 +20477,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>179</v>
+                                    <v>190</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21402,7 +20493,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>179</v>
+                                    <v>190</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21418,7 +20509,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>179</v>
+                                    <v>190</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21434,7 +20525,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>179</v>
+                                    <v>190</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21450,7 +20541,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>179</v>
+                                    <v>190</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21460,15 +20551,15 @@
         </relation>
         <relation>
             <name>ruby_yield_child</name>
-            <cardinality>1112</cardinality>
+            <cardinality>1097</cardinality>
             <columnsizes>
                 <e>
                     <k>ruby_yield</k>
-                    <v>1112</v>
+                    <v>1097</v>
                 </e>
                 <e>
                     <k>child</k>
-                    <v>1112</v>
+                    <v>1097</v>
                 </e>
             </columnsizes>
             <dependencies>
@@ -21482,7 +20573,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1112</v>
+                                    <v>1097</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21498,7 +20589,7 @@
                                 <b>
                                     <a>1</a>
                                     <b>2</b>
-                                    <v>1112</v>
+                                    <v>1097</v>
                                 </b>
                             </bs>
                         </hist>
@@ -21508,22 +20599,22 @@
         </relation>
         <relation>
             <name>ruby_yield_def</name>
-            <cardinality>2385</cardinality>
+            <cardinality>2389</cardinality>
             <columnsizes>
                 <e>
                     <k>id</k>
-                    <v>2385</v>
+                    <v>2389</v>
                 </e>
             </columnsizes>
             <dependencies/>
         </relation>
         <relation>
             <name>sourceLocationPrefix</name>
-            <cardinality>12</cardinality>
+            <cardinality>13</cardinality>
             <columnsizes>
                 <e>
                     <k>prefix</k>
-                    <v>12</v>
+                    <v>13</v>
                 </e>
             </columnsizes>
             <dependencies/>
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/locations_default.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/locations_default.ql
new file mode 100644
index 00000000000..e98f74d7bf1
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/locations_default.ql
@@ -0,0 +1,68 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+class Location extends @location {
+  string toString() { none() }
+}
+
+class File extends @file {
+  string toString() { none() }
+}
+
+private predicate body_statement(AstNode body, int index, Location loc) {
+  exists(AstNode node, AstNode child | ruby_ast_node_info(child, _, _, loc) |
+    ruby_class_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_class_child(node, index, child)
+    or
+    ruby_do_block_def(node) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_do_block_child(node, index, child)
+    or
+    ruby_method_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_method_child(node, index, child)
+    or
+    ruby_module_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_module_child(node, index, child)
+    or
+    ruby_singleton_class_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_singleton_class_child(node, index, child)
+    or
+    ruby_singleton_method_def(node, _, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_singleton_method_child(node, index, child)
+    or
+    ruby_block_def(node) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "}") and
+    ruby_block_child(node, index, child)
+  )
+}
+
+from Location loc, File file, int start_line, int start_column, int end_line, int end_column
+where
+  locations_default(loc, file, start_line, start_column, end_line, end_column) and
+  not exists(AstNode node | ruby_ast_node_info(node, _, _, loc) and body_statement(node, _, _))
+  or
+  exists(AstNode node |
+    ruby_ast_node_info(node, _, _, loc) and
+    exists(Location first |
+      body_statement(node, 0, first) and
+      locations_default(first, pragma[only_bind_into](file), start_line, start_column, _, _)
+    ) and
+    exists(Location last |
+      last = max(Location l, int i | body_statement(node, i, l) | l order by i) and
+      locations_default(last, pragma[only_bind_into](file), _, _, end_line, end_column)
+    )
+  )
+select loc, file, start_line, start_column, end_line, end_column
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/old.dbscheme b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/old.dbscheme
new file mode 100644
index 00000000000..4ba51641799
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/old.dbscheme
@@ -0,0 +1,1433 @@
+// CodeQL database schema for Ruby
+// Automatically generated from the tree-sitter grammar; do not edit
+
+@location = @location_default
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int start_line: int ref,
+  int start_column: int ref,
+  int end_line: int ref,
+  int end_column: int ref
+);
+
+files(
+  unique int id: @file,
+  string name: string ref
+);
+
+folders(
+  unique int id: @folder,
+  string name: string ref
+);
+
+@container = @file | @folder
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref
+);
+
+sourceLocationPrefix(
+  string prefix: string ref
+);
+
+diagnostics(
+  unique int id: @diagnostic,
+  int severity: int ref,
+  string error_tag: string ref,
+  string error_message: string ref,
+  string full_error_message: string ref,
+  int location: @location_default ref
+);
+
+case @diagnostic.severity of
+  10 = @diagnostic_debug
+| 20 = @diagnostic_info
+| 30 = @diagnostic_warning
+| 40 = @diagnostic_error
+;
+
+
+@ruby_underscore_arg = @ruby_assignment | @ruby_binary | @ruby_conditional | @ruby_operator_assignment | @ruby_range | @ruby_unary | @ruby_underscore_primary
+
+@ruby_underscore_call_operator = @ruby_reserved_word
+
+@ruby_underscore_expression = @ruby_assignment | @ruby_binary | @ruby_break | @ruby_call | @ruby_next | @ruby_operator_assignment | @ruby_return | @ruby_unary | @ruby_underscore_arg | @ruby_yield
+
+@ruby_underscore_lhs = @ruby_call | @ruby_element_reference | @ruby_scope_resolution | @ruby_token_false | @ruby_token_nil | @ruby_token_true | @ruby_underscore_variable
+
+@ruby_underscore_method_name = @ruby_delimited_symbol | @ruby_setter | @ruby_token_constant | @ruby_token_identifier | @ruby_token_operator | @ruby_token_simple_symbol | @ruby_underscore_nonlocal_variable
+
+@ruby_underscore_nonlocal_variable = @ruby_token_class_variable | @ruby_token_global_variable | @ruby_token_instance_variable
+
+@ruby_underscore_pattern_constant = @ruby_scope_resolution | @ruby_token_constant
+
+@ruby_underscore_pattern_expr = @ruby_alternative_pattern | @ruby_as_pattern | @ruby_underscore_pattern_expr_basic
+
+@ruby_underscore_pattern_expr_basic = @ruby_array_pattern | @ruby_expression_reference_pattern | @ruby_find_pattern | @ruby_hash_pattern | @ruby_parenthesized_pattern | @ruby_range | @ruby_token_identifier | @ruby_underscore_pattern_constant | @ruby_underscore_pattern_primitive | @ruby_variable_reference_pattern
+
+@ruby_underscore_pattern_primitive = @ruby_delimited_symbol | @ruby_lambda | @ruby_regex | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_symbol_array | @ruby_token_encoding | @ruby_token_false | @ruby_token_file | @ruby_token_heredoc_beginning | @ruby_token_line | @ruby_token_nil | @ruby_token_self | @ruby_token_simple_symbol | @ruby_token_true | @ruby_unary | @ruby_underscore_simple_numeric
+
+@ruby_underscore_pattern_top_expr_body = @ruby_array_pattern | @ruby_find_pattern | @ruby_hash_pattern | @ruby_underscore_pattern_expr
+
+@ruby_underscore_primary = @ruby_array | @ruby_begin | @ruby_break | @ruby_call | @ruby_case__ | @ruby_case_match | @ruby_chained_string | @ruby_class | @ruby_delimited_symbol | @ruby_for | @ruby_hash | @ruby_if | @ruby_lambda | @ruby_method | @ruby_module | @ruby_next | @ruby_parenthesized_statements | @ruby_redo | @ruby_regex | @ruby_retry | @ruby_return | @ruby_singleton_class | @ruby_singleton_method | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_symbol_array | @ruby_token_character | @ruby_token_heredoc_beginning | @ruby_token_simple_symbol | @ruby_unary | @ruby_underscore_lhs | @ruby_underscore_simple_numeric | @ruby_unless | @ruby_until | @ruby_while | @ruby_yield
+
+@ruby_underscore_simple_numeric = @ruby_complex | @ruby_rational | @ruby_token_float | @ruby_token_integer
+
+@ruby_underscore_statement = @ruby_alias | @ruby_begin_block | @ruby_end_block | @ruby_if_modifier | @ruby_rescue_modifier | @ruby_undef | @ruby_underscore_expression | @ruby_unless_modifier | @ruby_until_modifier | @ruby_while_modifier
+
+@ruby_underscore_variable = @ruby_token_constant | @ruby_token_identifier | @ruby_token_self | @ruby_token_super | @ruby_underscore_nonlocal_variable
+
+ruby_alias_def(
+  unique int id: @ruby_alias,
+  int alias: @ruby_underscore_method_name ref,
+  int name: @ruby_underscore_method_name ref
+);
+
+#keyset[ruby_alternative_pattern, index]
+ruby_alternative_pattern_alternatives(
+  int ruby_alternative_pattern: @ruby_alternative_pattern ref,
+  int index: int ref,
+  unique int alternatives: @ruby_underscore_pattern_expr_basic ref
+);
+
+ruby_alternative_pattern_def(
+  unique int id: @ruby_alternative_pattern
+);
+
+@ruby_argument_list_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_argument_list, index]
+ruby_argument_list_child(
+  int ruby_argument_list: @ruby_argument_list ref,
+  int index: int ref,
+  unique int child: @ruby_argument_list_child_type ref
+);
+
+ruby_argument_list_def(
+  unique int id: @ruby_argument_list
+);
+
+@ruby_array_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_array, index]
+ruby_array_child(
+  int ruby_array: @ruby_array ref,
+  int index: int ref,
+  unique int child: @ruby_array_child_type ref
+);
+
+ruby_array_def(
+  unique int id: @ruby_array
+);
+
+ruby_array_pattern_class(
+  unique int ruby_array_pattern: @ruby_array_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_array_pattern_child_type = @ruby_splat_parameter | @ruby_underscore_pattern_expr
+
+#keyset[ruby_array_pattern, index]
+ruby_array_pattern_child(
+  int ruby_array_pattern: @ruby_array_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_array_pattern_child_type ref
+);
+
+ruby_array_pattern_def(
+  unique int id: @ruby_array_pattern
+);
+
+ruby_as_pattern_def(
+  unique int id: @ruby_as_pattern,
+  int name: @ruby_token_identifier ref,
+  int value: @ruby_underscore_pattern_expr ref
+);
+
+@ruby_assignment_left_type = @ruby_left_assignment_list | @ruby_underscore_lhs
+
+@ruby_assignment_right_type = @ruby_rescue_modifier | @ruby_right_assignment_list | @ruby_splat_argument | @ruby_underscore_expression
+
+ruby_assignment_def(
+  unique int id: @ruby_assignment,
+  int left: @ruby_assignment_left_type ref,
+  int right: @ruby_assignment_right_type ref
+);
+
+@ruby_bare_string_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_bare_string, index]
+ruby_bare_string_child(
+  int ruby_bare_string: @ruby_bare_string ref,
+  int index: int ref,
+  unique int child: @ruby_bare_string_child_type ref
+);
+
+ruby_bare_string_def(
+  unique int id: @ruby_bare_string
+);
+
+@ruby_bare_symbol_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_bare_symbol, index]
+ruby_bare_symbol_child(
+  int ruby_bare_symbol: @ruby_bare_symbol ref,
+  int index: int ref,
+  unique int child: @ruby_bare_symbol_child_type ref
+);
+
+ruby_bare_symbol_def(
+  unique int id: @ruby_bare_symbol
+);
+
+@ruby_begin_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_begin, index]
+ruby_begin_child(
+  int ruby_begin: @ruby_begin ref,
+  int index: int ref,
+  unique int child: @ruby_begin_child_type ref
+);
+
+ruby_begin_def(
+  unique int id: @ruby_begin
+);
+
+@ruby_begin_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_begin_block, index]
+ruby_begin_block_child(
+  int ruby_begin_block: @ruby_begin_block ref,
+  int index: int ref,
+  unique int child: @ruby_begin_block_child_type ref
+);
+
+ruby_begin_block_def(
+  unique int id: @ruby_begin_block
+);
+
+@ruby_binary_left_type = @ruby_underscore_expression | @ruby_underscore_simple_numeric
+
+case @ruby_binary.operator of
+  0 = @ruby_binary_bangequal
+| 1 = @ruby_binary_bangtilde
+| 2 = @ruby_binary_percent
+| 3 = @ruby_binary_ampersand
+| 4 = @ruby_binary_ampersandampersand
+| 5 = @ruby_binary_star
+| 6 = @ruby_binary_starstar
+| 7 = @ruby_binary_plus
+| 8 = @ruby_binary_minus
+| 9 = @ruby_binary_slash
+| 10 = @ruby_binary_langle
+| 11 = @ruby_binary_langlelangle
+| 12 = @ruby_binary_langleequal
+| 13 = @ruby_binary_langleequalrangle
+| 14 = @ruby_binary_equalequal
+| 15 = @ruby_binary_equalequalequal
+| 16 = @ruby_binary_equaltilde
+| 17 = @ruby_binary_rangle
+| 18 = @ruby_binary_rangleequal
+| 19 = @ruby_binary_ranglerangle
+| 20 = @ruby_binary_caret
+| 21 = @ruby_binary_and
+| 22 = @ruby_binary_or
+| 23 = @ruby_binary_pipe
+| 24 = @ruby_binary_pipepipe
+;
+
+
+ruby_binary_def(
+  unique int id: @ruby_binary,
+  int left: @ruby_binary_left_type ref,
+  int operator: int ref,
+  int right: @ruby_underscore_expression ref
+);
+
+ruby_block_parameters(
+  unique int ruby_block: @ruby_block ref,
+  unique int parameters: @ruby_block_parameters ref
+);
+
+@ruby_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_block, index]
+ruby_block_child(
+  int ruby_block: @ruby_block ref,
+  int index: int ref,
+  unique int child: @ruby_block_child_type ref
+);
+
+ruby_block_def(
+  unique int id: @ruby_block
+);
+
+ruby_block_argument_child(
+  unique int ruby_block_argument: @ruby_block_argument ref,
+  unique int child: @ruby_underscore_arg ref
+);
+
+ruby_block_argument_def(
+  unique int id: @ruby_block_argument
+);
+
+ruby_block_parameter_name(
+  unique int ruby_block_parameter: @ruby_block_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_block_parameter_def(
+  unique int id: @ruby_block_parameter
+);
+
+#keyset[ruby_block_parameters, index]
+ruby_block_parameters_locals(
+  int ruby_block_parameters: @ruby_block_parameters ref,
+  int index: int ref,
+  unique int locals: @ruby_token_identifier ref
+);
+
+@ruby_block_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_block_parameters, index]
+ruby_block_parameters_child(
+  int ruby_block_parameters: @ruby_block_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_block_parameters_child_type ref
+);
+
+ruby_block_parameters_def(
+  unique int id: @ruby_block_parameters
+);
+
+ruby_break_child(
+  unique int ruby_break: @ruby_break ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_break_def(
+  unique int id: @ruby_break
+);
+
+ruby_call_arguments(
+  unique int ruby_call: @ruby_call ref,
+  unique int arguments: @ruby_argument_list ref
+);
+
+@ruby_call_block_type = @ruby_block | @ruby_do_block
+
+ruby_call_block(
+  unique int ruby_call: @ruby_call ref,
+  unique int block: @ruby_call_block_type ref
+);
+
+@ruby_call_method_type = @ruby_token_operator | @ruby_underscore_variable
+
+ruby_call_method(
+  unique int ruby_call: @ruby_call ref,
+  unique int method: @ruby_call_method_type ref
+);
+
+ruby_call_operator(
+  unique int ruby_call: @ruby_call ref,
+  unique int operator: @ruby_underscore_call_operator ref
+);
+
+ruby_call_receiver(
+  unique int ruby_call: @ruby_call ref,
+  unique int receiver: @ruby_underscore_primary ref
+);
+
+ruby_call_def(
+  unique int id: @ruby_call
+);
+
+ruby_case_value(
+  unique int ruby_case__: @ruby_case__ ref,
+  unique int value: @ruby_underscore_statement ref
+);
+
+@ruby_case_child_type = @ruby_else | @ruby_when
+
+#keyset[ruby_case__, index]
+ruby_case_child(
+  int ruby_case__: @ruby_case__ ref,
+  int index: int ref,
+  unique int child: @ruby_case_child_type ref
+);
+
+ruby_case_def(
+  unique int id: @ruby_case__
+);
+
+#keyset[ruby_case_match, index]
+ruby_case_match_clauses(
+  int ruby_case_match: @ruby_case_match ref,
+  int index: int ref,
+  unique int clauses: @ruby_in_clause ref
+);
+
+ruby_case_match_else(
+  unique int ruby_case_match: @ruby_case_match ref,
+  unique int else: @ruby_else ref
+);
+
+ruby_case_match_def(
+  unique int id: @ruby_case_match,
+  int value: @ruby_underscore_statement ref
+);
+
+#keyset[ruby_chained_string, index]
+ruby_chained_string_child(
+  int ruby_chained_string: @ruby_chained_string ref,
+  int index: int ref,
+  unique int child: @ruby_string__ ref
+);
+
+ruby_chained_string_def(
+  unique int id: @ruby_chained_string
+);
+
+@ruby_class_name_type = @ruby_scope_resolution | @ruby_token_constant
+
+ruby_class_superclass(
+  unique int ruby_class: @ruby_class ref,
+  unique int superclass: @ruby_superclass ref
+);
+
+@ruby_class_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_class, index]
+ruby_class_child(
+  int ruby_class: @ruby_class ref,
+  int index: int ref,
+  unique int child: @ruby_class_child_type ref
+);
+
+ruby_class_def(
+  unique int id: @ruby_class,
+  int name: @ruby_class_name_type ref
+);
+
+@ruby_complex_child_type = @ruby_rational | @ruby_token_float | @ruby_token_integer
+
+ruby_complex_def(
+  unique int id: @ruby_complex,
+  int child: @ruby_complex_child_type ref
+);
+
+ruby_conditional_def(
+  unique int id: @ruby_conditional,
+  int alternative: @ruby_underscore_arg ref,
+  int condition: @ruby_underscore_arg ref,
+  int consequence: @ruby_underscore_arg ref
+);
+
+@ruby_delimited_symbol_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_delimited_symbol, index]
+ruby_delimited_symbol_child(
+  int ruby_delimited_symbol: @ruby_delimited_symbol ref,
+  int index: int ref,
+  unique int child: @ruby_delimited_symbol_child_type ref
+);
+
+ruby_delimited_symbol_def(
+  unique int id: @ruby_delimited_symbol
+);
+
+@ruby_destructured_left_assignment_child_type = @ruby_destructured_left_assignment | @ruby_rest_assignment | @ruby_underscore_lhs
+
+#keyset[ruby_destructured_left_assignment, index]
+ruby_destructured_left_assignment_child(
+  int ruby_destructured_left_assignment: @ruby_destructured_left_assignment ref,
+  int index: int ref,
+  unique int child: @ruby_destructured_left_assignment_child_type ref
+);
+
+ruby_destructured_left_assignment_def(
+  unique int id: @ruby_destructured_left_assignment
+);
+
+@ruby_destructured_parameter_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_destructured_parameter, index]
+ruby_destructured_parameter_child(
+  int ruby_destructured_parameter: @ruby_destructured_parameter ref,
+  int index: int ref,
+  unique int child: @ruby_destructured_parameter_child_type ref
+);
+
+ruby_destructured_parameter_def(
+  unique int id: @ruby_destructured_parameter
+);
+
+@ruby_do_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_do, index]
+ruby_do_child(
+  int ruby_do: @ruby_do ref,
+  int index: int ref,
+  unique int child: @ruby_do_child_type ref
+);
+
+ruby_do_def(
+  unique int id: @ruby_do
+);
+
+ruby_do_block_parameters(
+  unique int ruby_do_block: @ruby_do_block ref,
+  unique int parameters: @ruby_block_parameters ref
+);
+
+@ruby_do_block_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_do_block, index]
+ruby_do_block_child(
+  int ruby_do_block: @ruby_do_block ref,
+  int index: int ref,
+  unique int child: @ruby_do_block_child_type ref
+);
+
+ruby_do_block_def(
+  unique int id: @ruby_do_block
+);
+
+@ruby_element_reference_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_element_reference, index]
+ruby_element_reference_child(
+  int ruby_element_reference: @ruby_element_reference ref,
+  int index: int ref,
+  unique int child: @ruby_element_reference_child_type ref
+);
+
+ruby_element_reference_def(
+  unique int id: @ruby_element_reference,
+  int object: @ruby_underscore_primary ref
+);
+
+@ruby_else_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_else, index]
+ruby_else_child(
+  int ruby_else: @ruby_else ref,
+  int index: int ref,
+  unique int child: @ruby_else_child_type ref
+);
+
+ruby_else_def(
+  unique int id: @ruby_else
+);
+
+@ruby_elsif_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_elsif_alternative(
+  unique int ruby_elsif: @ruby_elsif ref,
+  unique int alternative: @ruby_elsif_alternative_type ref
+);
+
+ruby_elsif_consequence(
+  unique int ruby_elsif: @ruby_elsif ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_elsif_def(
+  unique int id: @ruby_elsif,
+  int condition: @ruby_underscore_statement ref
+);
+
+@ruby_end_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_end_block, index]
+ruby_end_block_child(
+  int ruby_end_block: @ruby_end_block ref,
+  int index: int ref,
+  unique int child: @ruby_end_block_child_type ref
+);
+
+ruby_end_block_def(
+  unique int id: @ruby_end_block
+);
+
+@ruby_ensure_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_ensure, index]
+ruby_ensure_child(
+  int ruby_ensure: @ruby_ensure ref,
+  int index: int ref,
+  unique int child: @ruby_ensure_child_type ref
+);
+
+ruby_ensure_def(
+  unique int id: @ruby_ensure
+);
+
+ruby_exception_variable_def(
+  unique int id: @ruby_exception_variable,
+  int child: @ruby_underscore_lhs ref
+);
+
+@ruby_exceptions_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+#keyset[ruby_exceptions, index]
+ruby_exceptions_child(
+  int ruby_exceptions: @ruby_exceptions ref,
+  int index: int ref,
+  unique int child: @ruby_exceptions_child_type ref
+);
+
+ruby_exceptions_def(
+  unique int id: @ruby_exceptions
+);
+
+ruby_expression_reference_pattern_def(
+  unique int id: @ruby_expression_reference_pattern,
+  int value: @ruby_underscore_expression ref
+);
+
+ruby_find_pattern_class(
+  unique int ruby_find_pattern: @ruby_find_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_find_pattern_child_type = @ruby_splat_parameter | @ruby_underscore_pattern_expr
+
+#keyset[ruby_find_pattern, index]
+ruby_find_pattern_child(
+  int ruby_find_pattern: @ruby_find_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_find_pattern_child_type ref
+);
+
+ruby_find_pattern_def(
+  unique int id: @ruby_find_pattern
+);
+
+@ruby_for_pattern_type = @ruby_left_assignment_list | @ruby_underscore_lhs
+
+ruby_for_def(
+  unique int id: @ruby_for,
+  int body: @ruby_do ref,
+  int pattern: @ruby_for_pattern_type ref,
+  int value: @ruby_in ref
+);
+
+@ruby_hash_child_type = @ruby_hash_splat_argument | @ruby_pair
+
+#keyset[ruby_hash, index]
+ruby_hash_child(
+  int ruby_hash: @ruby_hash ref,
+  int index: int ref,
+  unique int child: @ruby_hash_child_type ref
+);
+
+ruby_hash_def(
+  unique int id: @ruby_hash
+);
+
+ruby_hash_pattern_class(
+  unique int ruby_hash_pattern: @ruby_hash_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_hash_pattern_child_type = @ruby_hash_splat_parameter | @ruby_keyword_pattern | @ruby_token_hash_splat_nil
+
+#keyset[ruby_hash_pattern, index]
+ruby_hash_pattern_child(
+  int ruby_hash_pattern: @ruby_hash_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_hash_pattern_child_type ref
+);
+
+ruby_hash_pattern_def(
+  unique int id: @ruby_hash_pattern
+);
+
+ruby_hash_splat_argument_def(
+  unique int id: @ruby_hash_splat_argument,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_hash_splat_parameter_name(
+  unique int ruby_hash_splat_parameter: @ruby_hash_splat_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_hash_splat_parameter_def(
+  unique int id: @ruby_hash_splat_parameter
+);
+
+@ruby_heredoc_body_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_heredoc_content | @ruby_token_heredoc_end
+
+#keyset[ruby_heredoc_body, index]
+ruby_heredoc_body_child(
+  int ruby_heredoc_body: @ruby_heredoc_body ref,
+  int index: int ref,
+  unique int child: @ruby_heredoc_body_child_type ref
+);
+
+ruby_heredoc_body_def(
+  unique int id: @ruby_heredoc_body
+);
+
+@ruby_if_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_if_alternative(
+  unique int ruby_if: @ruby_if ref,
+  unique int alternative: @ruby_if_alternative_type ref
+);
+
+ruby_if_consequence(
+  unique int ruby_if: @ruby_if ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_if_def(
+  unique int id: @ruby_if,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_if_guard_def(
+  unique int id: @ruby_if_guard,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_if_modifier_def(
+  unique int id: @ruby_if_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_in_def(
+  unique int id: @ruby_in,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_in_clause_body(
+  unique int ruby_in_clause: @ruby_in_clause ref,
+  unique int body: @ruby_then ref
+);
+
+@ruby_in_clause_guard_type = @ruby_if_guard | @ruby_unless_guard
+
+ruby_in_clause_guard(
+  unique int ruby_in_clause: @ruby_in_clause ref,
+  unique int guard: @ruby_in_clause_guard_type ref
+);
+
+ruby_in_clause_def(
+  unique int id: @ruby_in_clause,
+  int pattern: @ruby_underscore_pattern_top_expr_body ref
+);
+
+@ruby_interpolation_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_interpolation, index]
+ruby_interpolation_child(
+  int ruby_interpolation: @ruby_interpolation ref,
+  int index: int ref,
+  unique int child: @ruby_interpolation_child_type ref
+);
+
+ruby_interpolation_def(
+  unique int id: @ruby_interpolation
+);
+
+ruby_keyword_parameter_value(
+  unique int ruby_keyword_parameter: @ruby_keyword_parameter ref,
+  unique int value: @ruby_underscore_arg ref
+);
+
+ruby_keyword_parameter_def(
+  unique int id: @ruby_keyword_parameter,
+  int name: @ruby_token_identifier ref
+);
+
+@ruby_keyword_pattern_key_type = @ruby_string__ | @ruby_token_hash_key_symbol
+
+ruby_keyword_pattern_value(
+  unique int ruby_keyword_pattern: @ruby_keyword_pattern ref,
+  unique int value: @ruby_underscore_pattern_expr ref
+);
+
+ruby_keyword_pattern_def(
+  unique int id: @ruby_keyword_pattern,
+  int key__: @ruby_keyword_pattern_key_type ref
+);
+
+@ruby_lambda_body_type = @ruby_block | @ruby_do_block
+
+ruby_lambda_parameters(
+  unique int ruby_lambda: @ruby_lambda ref,
+  unique int parameters: @ruby_lambda_parameters ref
+);
+
+ruby_lambda_def(
+  unique int id: @ruby_lambda,
+  int body: @ruby_lambda_body_type ref
+);
+
+@ruby_lambda_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_lambda_parameters, index]
+ruby_lambda_parameters_child(
+  int ruby_lambda_parameters: @ruby_lambda_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_lambda_parameters_child_type ref
+);
+
+ruby_lambda_parameters_def(
+  unique int id: @ruby_lambda_parameters
+);
+
+@ruby_left_assignment_list_child_type = @ruby_destructured_left_assignment | @ruby_rest_assignment | @ruby_underscore_lhs
+
+#keyset[ruby_left_assignment_list, index]
+ruby_left_assignment_list_child(
+  int ruby_left_assignment_list: @ruby_left_assignment_list ref,
+  int index: int ref,
+  unique int child: @ruby_left_assignment_list_child_type ref
+);
+
+ruby_left_assignment_list_def(
+  unique int id: @ruby_left_assignment_list
+);
+
+ruby_method_parameters(
+  unique int ruby_method: @ruby_method ref,
+  unique int parameters: @ruby_method_parameters ref
+);
+
+@ruby_method_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_arg | @ruby_underscore_statement
+
+#keyset[ruby_method, index]
+ruby_method_child(
+  int ruby_method: @ruby_method ref,
+  int index: int ref,
+  unique int child: @ruby_method_child_type ref
+);
+
+ruby_method_def(
+  unique int id: @ruby_method,
+  int name: @ruby_underscore_method_name ref
+);
+
+@ruby_method_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_method_parameters, index]
+ruby_method_parameters_child(
+  int ruby_method_parameters: @ruby_method_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_method_parameters_child_type ref
+);
+
+ruby_method_parameters_def(
+  unique int id: @ruby_method_parameters
+);
+
+@ruby_module_name_type = @ruby_scope_resolution | @ruby_token_constant
+
+@ruby_module_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_module, index]
+ruby_module_child(
+  int ruby_module: @ruby_module ref,
+  int index: int ref,
+  unique int child: @ruby_module_child_type ref
+);
+
+ruby_module_def(
+  unique int id: @ruby_module,
+  int name: @ruby_module_name_type ref
+);
+
+ruby_next_child(
+  unique int ruby_next: @ruby_next ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_next_def(
+  unique int id: @ruby_next
+);
+
+case @ruby_operator_assignment.operator of
+  0 = @ruby_operator_assignment_percentequal
+| 1 = @ruby_operator_assignment_ampersandampersandequal
+| 2 = @ruby_operator_assignment_ampersandequal
+| 3 = @ruby_operator_assignment_starstarequal
+| 4 = @ruby_operator_assignment_starequal
+| 5 = @ruby_operator_assignment_plusequal
+| 6 = @ruby_operator_assignment_minusequal
+| 7 = @ruby_operator_assignment_slashequal
+| 8 = @ruby_operator_assignment_langlelangleequal
+| 9 = @ruby_operator_assignment_ranglerangleequal
+| 10 = @ruby_operator_assignment_caretequal
+| 11 = @ruby_operator_assignment_pipeequal
+| 12 = @ruby_operator_assignment_pipepipeequal
+;
+
+
+@ruby_operator_assignment_right_type = @ruby_rescue_modifier | @ruby_underscore_expression
+
+ruby_operator_assignment_def(
+  unique int id: @ruby_operator_assignment,
+  int left: @ruby_underscore_lhs ref,
+  int operator: int ref,
+  int right: @ruby_operator_assignment_right_type ref
+);
+
+ruby_optional_parameter_def(
+  unique int id: @ruby_optional_parameter,
+  int name: @ruby_token_identifier ref,
+  int value: @ruby_underscore_arg ref
+);
+
+@ruby_pair_key_type = @ruby_string__ | @ruby_token_hash_key_symbol | @ruby_underscore_arg
+
+ruby_pair_value(
+  unique int ruby_pair: @ruby_pair ref,
+  unique int value: @ruby_underscore_arg ref
+);
+
+ruby_pair_def(
+  unique int id: @ruby_pair,
+  int key__: @ruby_pair_key_type ref
+);
+
+ruby_parenthesized_pattern_def(
+  unique int id: @ruby_parenthesized_pattern,
+  int child: @ruby_underscore_pattern_expr ref
+);
+
+@ruby_parenthesized_statements_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_parenthesized_statements, index]
+ruby_parenthesized_statements_child(
+  int ruby_parenthesized_statements: @ruby_parenthesized_statements ref,
+  int index: int ref,
+  unique int child: @ruby_parenthesized_statements_child_type ref
+);
+
+ruby_parenthesized_statements_def(
+  unique int id: @ruby_parenthesized_statements
+);
+
+@ruby_pattern_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+ruby_pattern_def(
+  unique int id: @ruby_pattern,
+  int child: @ruby_pattern_child_type ref
+);
+
+@ruby_program_child_type = @ruby_token_empty_statement | @ruby_token_uninterpreted | @ruby_underscore_statement
+
+#keyset[ruby_program, index]
+ruby_program_child(
+  int ruby_program: @ruby_program ref,
+  int index: int ref,
+  unique int child: @ruby_program_child_type ref
+);
+
+ruby_program_def(
+  unique int id: @ruby_program
+);
+
+@ruby_range_begin_type = @ruby_underscore_arg | @ruby_underscore_pattern_primitive
+
+ruby_range_begin(
+  unique int ruby_range: @ruby_range ref,
+  unique int begin: @ruby_range_begin_type ref
+);
+
+@ruby_range_end_type = @ruby_underscore_arg | @ruby_underscore_pattern_primitive
+
+ruby_range_end(
+  unique int ruby_range: @ruby_range ref,
+  unique int end: @ruby_range_end_type ref
+);
+
+case @ruby_range.operator of
+  0 = @ruby_range_dotdot
+| 1 = @ruby_range_dotdotdot
+;
+
+
+ruby_range_def(
+  unique int id: @ruby_range,
+  int operator: int ref
+);
+
+@ruby_rational_child_type = @ruby_token_float | @ruby_token_integer
+
+ruby_rational_def(
+  unique int id: @ruby_rational,
+  int child: @ruby_rational_child_type ref
+);
+
+ruby_redo_child(
+  unique int ruby_redo: @ruby_redo ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_redo_def(
+  unique int id: @ruby_redo
+);
+
+@ruby_regex_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_regex, index]
+ruby_regex_child(
+  int ruby_regex: @ruby_regex ref,
+  int index: int ref,
+  unique int child: @ruby_regex_child_type ref
+);
+
+ruby_regex_def(
+  unique int id: @ruby_regex
+);
+
+ruby_rescue_body(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int body: @ruby_then ref
+);
+
+ruby_rescue_exceptions(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int exceptions: @ruby_exceptions ref
+);
+
+ruby_rescue_variable(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int variable: @ruby_exception_variable ref
+);
+
+ruby_rescue_def(
+  unique int id: @ruby_rescue
+);
+
+@ruby_rescue_modifier_body_type = @ruby_underscore_arg | @ruby_underscore_statement
+
+ruby_rescue_modifier_def(
+  unique int id: @ruby_rescue_modifier,
+  int body: @ruby_rescue_modifier_body_type ref,
+  int handler: @ruby_underscore_expression ref
+);
+
+ruby_rest_assignment_child(
+  unique int ruby_rest_assignment: @ruby_rest_assignment ref,
+  unique int child: @ruby_underscore_lhs ref
+);
+
+ruby_rest_assignment_def(
+  unique int id: @ruby_rest_assignment
+);
+
+ruby_retry_child(
+  unique int ruby_retry: @ruby_retry ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_retry_def(
+  unique int id: @ruby_retry
+);
+
+ruby_return_child(
+  unique int ruby_return: @ruby_return ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_return_def(
+  unique int id: @ruby_return
+);
+
+@ruby_right_assignment_list_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+#keyset[ruby_right_assignment_list, index]
+ruby_right_assignment_list_child(
+  int ruby_right_assignment_list: @ruby_right_assignment_list ref,
+  int index: int ref,
+  unique int child: @ruby_right_assignment_list_child_type ref
+);
+
+ruby_right_assignment_list_def(
+  unique int id: @ruby_right_assignment_list
+);
+
+@ruby_scope_resolution_scope_type = @ruby_underscore_pattern_constant | @ruby_underscore_primary
+
+ruby_scope_resolution_scope(
+  unique int ruby_scope_resolution: @ruby_scope_resolution ref,
+  unique int scope: @ruby_scope_resolution_scope_type ref
+);
+
+ruby_scope_resolution_def(
+  unique int id: @ruby_scope_resolution,
+  int name: @ruby_token_constant ref
+);
+
+ruby_setter_def(
+  unique int id: @ruby_setter,
+  int name: @ruby_token_identifier ref
+);
+
+@ruby_singleton_class_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_singleton_class, index]
+ruby_singleton_class_child(
+  int ruby_singleton_class: @ruby_singleton_class ref,
+  int index: int ref,
+  unique int child: @ruby_singleton_class_child_type ref
+);
+
+ruby_singleton_class_def(
+  unique int id: @ruby_singleton_class,
+  int value: @ruby_underscore_arg ref
+);
+
+@ruby_singleton_method_object_type = @ruby_underscore_arg | @ruby_underscore_variable
+
+ruby_singleton_method_parameters(
+  unique int ruby_singleton_method: @ruby_singleton_method ref,
+  unique int parameters: @ruby_method_parameters ref
+);
+
+@ruby_singleton_method_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_arg | @ruby_underscore_statement
+
+#keyset[ruby_singleton_method, index]
+ruby_singleton_method_child(
+  int ruby_singleton_method: @ruby_singleton_method ref,
+  int index: int ref,
+  unique int child: @ruby_singleton_method_child_type ref
+);
+
+ruby_singleton_method_def(
+  unique int id: @ruby_singleton_method,
+  int name: @ruby_underscore_method_name ref,
+  int object: @ruby_singleton_method_object_type ref
+);
+
+ruby_splat_argument_def(
+  unique int id: @ruby_splat_argument,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_splat_parameter_name(
+  unique int ruby_splat_parameter: @ruby_splat_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_splat_parameter_def(
+  unique int id: @ruby_splat_parameter
+);
+
+@ruby_string_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_string__, index]
+ruby_string_child(
+  int ruby_string__: @ruby_string__ ref,
+  int index: int ref,
+  unique int child: @ruby_string_child_type ref
+);
+
+ruby_string_def(
+  unique int id: @ruby_string__
+);
+
+#keyset[ruby_string_array, index]
+ruby_string_array_child(
+  int ruby_string_array: @ruby_string_array ref,
+  int index: int ref,
+  unique int child: @ruby_bare_string ref
+);
+
+ruby_string_array_def(
+  unique int id: @ruby_string_array
+);
+
+@ruby_subshell_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_subshell, index]
+ruby_subshell_child(
+  int ruby_subshell: @ruby_subshell ref,
+  int index: int ref,
+  unique int child: @ruby_subshell_child_type ref
+);
+
+ruby_subshell_def(
+  unique int id: @ruby_subshell
+);
+
+ruby_superclass_def(
+  unique int id: @ruby_superclass,
+  int child: @ruby_underscore_expression ref
+);
+
+#keyset[ruby_symbol_array, index]
+ruby_symbol_array_child(
+  int ruby_symbol_array: @ruby_symbol_array ref,
+  int index: int ref,
+  unique int child: @ruby_bare_symbol ref
+);
+
+ruby_symbol_array_def(
+  unique int id: @ruby_symbol_array
+);
+
+@ruby_then_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_then, index]
+ruby_then_child(
+  int ruby_then: @ruby_then ref,
+  int index: int ref,
+  unique int child: @ruby_then_child_type ref
+);
+
+ruby_then_def(
+  unique int id: @ruby_then
+);
+
+@ruby_unary_operand_type = @ruby_parenthesized_statements | @ruby_underscore_expression | @ruby_underscore_simple_numeric
+
+case @ruby_unary.operator of
+  0 = @ruby_unary_bang
+| 1 = @ruby_unary_plus
+| 2 = @ruby_unary_minus
+| 3 = @ruby_unary_definedquestion
+| 4 = @ruby_unary_not
+| 5 = @ruby_unary_tilde
+;
+
+
+ruby_unary_def(
+  unique int id: @ruby_unary,
+  int operand: @ruby_unary_operand_type ref,
+  int operator: int ref
+);
+
+#keyset[ruby_undef, index]
+ruby_undef_child(
+  int ruby_undef: @ruby_undef ref,
+  int index: int ref,
+  unique int child: @ruby_underscore_method_name ref
+);
+
+ruby_undef_def(
+  unique int id: @ruby_undef
+);
+
+@ruby_unless_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_unless_alternative(
+  unique int ruby_unless: @ruby_unless ref,
+  unique int alternative: @ruby_unless_alternative_type ref
+);
+
+ruby_unless_consequence(
+  unique int ruby_unless: @ruby_unless ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_unless_def(
+  unique int id: @ruby_unless,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_unless_guard_def(
+  unique int id: @ruby_unless_guard,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_unless_modifier_def(
+  unique int id: @ruby_unless_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_until_def(
+  unique int id: @ruby_until,
+  int body: @ruby_do ref,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_until_modifier_def(
+  unique int id: @ruby_until_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+@ruby_variable_reference_pattern_name_type = @ruby_token_identifier | @ruby_underscore_nonlocal_variable
+
+ruby_variable_reference_pattern_def(
+  unique int id: @ruby_variable_reference_pattern,
+  int name: @ruby_variable_reference_pattern_name_type ref
+);
+
+ruby_when_body(
+  unique int ruby_when: @ruby_when ref,
+  unique int body: @ruby_then ref
+);
+
+#keyset[ruby_when, index]
+ruby_when_pattern(
+  int ruby_when: @ruby_when ref,
+  int index: int ref,
+  unique int pattern: @ruby_pattern ref
+);
+
+ruby_when_def(
+  unique int id: @ruby_when
+);
+
+ruby_while_def(
+  unique int id: @ruby_while,
+  int body: @ruby_do ref,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_while_modifier_def(
+  unique int id: @ruby_while_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_yield_child(
+  unique int ruby_yield: @ruby_yield ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_yield_def(
+  unique int id: @ruby_yield
+);
+
+ruby_tokeninfo(
+  unique int id: @ruby_token,
+  int kind: int ref,
+  string value: string ref
+);
+
+case @ruby_token.kind of
+  0 = @ruby_reserved_word
+| 1 = @ruby_token_character
+| 2 = @ruby_token_class_variable
+| 3 = @ruby_token_comment
+| 4 = @ruby_token_constant
+| 5 = @ruby_token_empty_statement
+| 6 = @ruby_token_encoding
+| 7 = @ruby_token_escape_sequence
+| 8 = @ruby_token_false
+| 9 = @ruby_token_file
+| 10 = @ruby_token_float
+| 11 = @ruby_token_forward_argument
+| 12 = @ruby_token_forward_parameter
+| 13 = @ruby_token_global_variable
+| 14 = @ruby_token_hash_key_symbol
+| 15 = @ruby_token_hash_splat_nil
+| 16 = @ruby_token_heredoc_beginning
+| 17 = @ruby_token_heredoc_content
+| 18 = @ruby_token_heredoc_end
+| 19 = @ruby_token_identifier
+| 20 = @ruby_token_instance_variable
+| 21 = @ruby_token_integer
+| 22 = @ruby_token_line
+| 23 = @ruby_token_nil
+| 24 = @ruby_token_operator
+| 25 = @ruby_token_self
+| 26 = @ruby_token_simple_symbol
+| 27 = @ruby_token_string_content
+| 28 = @ruby_token_super
+| 29 = @ruby_token_true
+| 30 = @ruby_token_uninterpreted
+;
+
+
+@ruby_ast_node = @ruby_alias | @ruby_alternative_pattern | @ruby_argument_list | @ruby_array | @ruby_array_pattern | @ruby_as_pattern | @ruby_assignment | @ruby_bare_string | @ruby_bare_symbol | @ruby_begin | @ruby_begin_block | @ruby_binary | @ruby_block | @ruby_block_argument | @ruby_block_parameter | @ruby_block_parameters | @ruby_break | @ruby_call | @ruby_case__ | @ruby_case_match | @ruby_chained_string | @ruby_class | @ruby_complex | @ruby_conditional | @ruby_delimited_symbol | @ruby_destructured_left_assignment | @ruby_destructured_parameter | @ruby_do | @ruby_do_block | @ruby_element_reference | @ruby_else | @ruby_elsif | @ruby_end_block | @ruby_ensure | @ruby_exception_variable | @ruby_exceptions | @ruby_expression_reference_pattern | @ruby_find_pattern | @ruby_for | @ruby_hash | @ruby_hash_pattern | @ruby_hash_splat_argument | @ruby_hash_splat_parameter | @ruby_heredoc_body | @ruby_if | @ruby_if_guard | @ruby_if_modifier | @ruby_in | @ruby_in_clause | @ruby_interpolation | @ruby_keyword_parameter | @ruby_keyword_pattern | @ruby_lambda | @ruby_lambda_parameters | @ruby_left_assignment_list | @ruby_method | @ruby_method_parameters | @ruby_module | @ruby_next | @ruby_operator_assignment | @ruby_optional_parameter | @ruby_pair | @ruby_parenthesized_pattern | @ruby_parenthesized_statements | @ruby_pattern | @ruby_program | @ruby_range | @ruby_rational | @ruby_redo | @ruby_regex | @ruby_rescue | @ruby_rescue_modifier | @ruby_rest_assignment | @ruby_retry | @ruby_return | @ruby_right_assignment_list | @ruby_scope_resolution | @ruby_setter | @ruby_singleton_class | @ruby_singleton_method | @ruby_splat_argument | @ruby_splat_parameter | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_superclass | @ruby_symbol_array | @ruby_then | @ruby_token | @ruby_unary | @ruby_undef | @ruby_unless | @ruby_unless_guard | @ruby_unless_modifier | @ruby_until | @ruby_until_modifier | @ruby_variable_reference_pattern | @ruby_when | @ruby_while | @ruby_while_modifier | @ruby_yield
+
+@ruby_ast_node_parent = @file | @ruby_ast_node
+
+#keyset[parent, parent_index]
+ruby_ast_node_info(
+  unique int node: @ruby_ast_node ref,
+  int parent: @ruby_ast_node_parent ref,
+  int parent_index: int ref,
+  int loc: @location ref
+);
+
+erb_comment_directive_child(
+  unique int erb_comment_directive: @erb_comment_directive ref,
+  unique int child: @erb_token_comment ref
+);
+
+erb_comment_directive_def(
+  unique int id: @erb_comment_directive
+);
+
+erb_directive_child(
+  unique int erb_directive: @erb_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_directive_def(
+  unique int id: @erb_directive
+);
+
+erb_graphql_directive_child(
+  unique int erb_graphql_directive: @erb_graphql_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_graphql_directive_def(
+  unique int id: @erb_graphql_directive
+);
+
+erb_output_directive_child(
+  unique int erb_output_directive: @erb_output_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_output_directive_def(
+  unique int id: @erb_output_directive
+);
+
+@erb_template_child_type = @erb_comment_directive | @erb_directive | @erb_graphql_directive | @erb_output_directive | @erb_token_content
+
+#keyset[erb_template, index]
+erb_template_child(
+  int erb_template: @erb_template ref,
+  int index: int ref,
+  unique int child: @erb_template_child_type ref
+);
+
+erb_template_def(
+  unique int id: @erb_template
+);
+
+erb_tokeninfo(
+  unique int id: @erb_token,
+  int kind: int ref,
+  string value: string ref
+);
+
+case @erb_token.kind of
+  0 = @erb_reserved_word
+| 1 = @erb_token_code
+| 2 = @erb_token_comment
+| 3 = @erb_token_content
+;
+
+
+@erb_ast_node = @erb_comment_directive | @erb_directive | @erb_graphql_directive | @erb_output_directive | @erb_template | @erb_token
+
+@erb_ast_node_parent = @erb_ast_node | @file
+
+#keyset[parent, parent_index]
+erb_ast_node_info(
+  unique int node: @erb_ast_node ref,
+  int parent: @erb_ast_node_parent ref,
+  int parent_index: int ref,
+  int loc: @location ref
+);
+
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby.dbscheme b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby.dbscheme
new file mode 100644
index 00000000000..3595c826de6
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby.dbscheme
@@ -0,0 +1,1435 @@
+// CodeQL database schema for Ruby
+// Automatically generated from the tree-sitter grammar; do not edit
+
+@location = @location_default
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int start_line: int ref,
+  int start_column: int ref,
+  int end_line: int ref,
+  int end_column: int ref
+);
+
+files(
+  unique int id: @file,
+  string name: string ref
+);
+
+folders(
+  unique int id: @folder,
+  string name: string ref
+);
+
+@container = @file | @folder
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref
+);
+
+sourceLocationPrefix(
+  string prefix: string ref
+);
+
+diagnostics(
+  unique int id: @diagnostic,
+  int severity: int ref,
+  string error_tag: string ref,
+  string error_message: string ref,
+  string full_error_message: string ref,
+  int location: @location_default ref
+);
+
+case @diagnostic.severity of
+  10 = @diagnostic_debug
+| 20 = @diagnostic_info
+| 30 = @diagnostic_warning
+| 40 = @diagnostic_error
+;
+
+
+@ruby_underscore_arg = @ruby_assignment | @ruby_binary | @ruby_conditional | @ruby_operator_assignment | @ruby_range | @ruby_unary | @ruby_underscore_primary
+
+@ruby_underscore_call_operator = @ruby_reserved_word
+
+@ruby_underscore_expression = @ruby_assignment | @ruby_binary | @ruby_break | @ruby_call | @ruby_next | @ruby_operator_assignment | @ruby_return | @ruby_unary | @ruby_underscore_arg | @ruby_yield
+
+@ruby_underscore_lhs = @ruby_call | @ruby_element_reference | @ruby_scope_resolution | @ruby_token_false | @ruby_token_nil | @ruby_token_true | @ruby_underscore_variable
+
+@ruby_underscore_method_name = @ruby_delimited_symbol | @ruby_setter | @ruby_token_constant | @ruby_token_identifier | @ruby_token_operator | @ruby_token_simple_symbol | @ruby_underscore_nonlocal_variable
+
+@ruby_underscore_nonlocal_variable = @ruby_token_class_variable | @ruby_token_global_variable | @ruby_token_instance_variable
+
+@ruby_underscore_pattern_constant = @ruby_scope_resolution | @ruby_token_constant
+
+@ruby_underscore_pattern_expr = @ruby_alternative_pattern | @ruby_as_pattern | @ruby_underscore_pattern_expr_basic
+
+@ruby_underscore_pattern_expr_basic = @ruby_array_pattern | @ruby_expression_reference_pattern | @ruby_find_pattern | @ruby_hash_pattern | @ruby_parenthesized_pattern | @ruby_range | @ruby_token_identifier | @ruby_underscore_pattern_constant | @ruby_underscore_pattern_primitive | @ruby_variable_reference_pattern
+
+@ruby_underscore_pattern_primitive = @ruby_delimited_symbol | @ruby_lambda | @ruby_regex | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_symbol_array | @ruby_token_encoding | @ruby_token_false | @ruby_token_file | @ruby_token_heredoc_beginning | @ruby_token_line | @ruby_token_nil | @ruby_token_self | @ruby_token_simple_symbol | @ruby_token_true | @ruby_unary | @ruby_underscore_simple_numeric
+
+@ruby_underscore_pattern_top_expr_body = @ruby_array_pattern | @ruby_find_pattern | @ruby_hash_pattern | @ruby_underscore_pattern_expr
+
+@ruby_underscore_primary = @ruby_array | @ruby_begin | @ruby_break | @ruby_call | @ruby_case__ | @ruby_case_match | @ruby_chained_string | @ruby_class | @ruby_delimited_symbol | @ruby_for | @ruby_hash | @ruby_if | @ruby_lambda | @ruby_method | @ruby_module | @ruby_next | @ruby_parenthesized_statements | @ruby_redo | @ruby_regex | @ruby_retry | @ruby_return | @ruby_singleton_class | @ruby_singleton_method | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_symbol_array | @ruby_token_character | @ruby_token_heredoc_beginning | @ruby_token_simple_symbol | @ruby_unary | @ruby_underscore_lhs | @ruby_underscore_simple_numeric | @ruby_unless | @ruby_until | @ruby_while | @ruby_yield
+
+@ruby_underscore_simple_numeric = @ruby_complex | @ruby_rational | @ruby_token_float | @ruby_token_integer
+
+@ruby_underscore_statement = @ruby_alias | @ruby_begin_block | @ruby_end_block | @ruby_if_modifier | @ruby_rescue_modifier | @ruby_undef | @ruby_underscore_expression | @ruby_unless_modifier | @ruby_until_modifier | @ruby_while_modifier
+
+@ruby_underscore_variable = @ruby_token_constant | @ruby_token_identifier | @ruby_token_self | @ruby_token_super | @ruby_underscore_nonlocal_variable
+
+ruby_alias_def(
+  unique int id: @ruby_alias,
+  int alias: @ruby_underscore_method_name ref,
+  int name: @ruby_underscore_method_name ref
+);
+
+#keyset[ruby_alternative_pattern, index]
+ruby_alternative_pattern_alternatives(
+  int ruby_alternative_pattern: @ruby_alternative_pattern ref,
+  int index: int ref,
+  unique int alternatives: @ruby_underscore_pattern_expr_basic ref
+);
+
+ruby_alternative_pattern_def(
+  unique int id: @ruby_alternative_pattern
+);
+
+@ruby_argument_list_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_argument_list, index]
+ruby_argument_list_child(
+  int ruby_argument_list: @ruby_argument_list ref,
+  int index: int ref,
+  unique int child: @ruby_argument_list_child_type ref
+);
+
+ruby_argument_list_def(
+  unique int id: @ruby_argument_list
+);
+
+@ruby_array_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_array, index]
+ruby_array_child(
+  int ruby_array: @ruby_array ref,
+  int index: int ref,
+  unique int child: @ruby_array_child_type ref
+);
+
+ruby_array_def(
+  unique int id: @ruby_array
+);
+
+ruby_array_pattern_class(
+  unique int ruby_array_pattern: @ruby_array_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_array_pattern_child_type = @ruby_splat_parameter | @ruby_underscore_pattern_expr
+
+#keyset[ruby_array_pattern, index]
+ruby_array_pattern_child(
+  int ruby_array_pattern: @ruby_array_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_array_pattern_child_type ref
+);
+
+ruby_array_pattern_def(
+  unique int id: @ruby_array_pattern
+);
+
+ruby_as_pattern_def(
+  unique int id: @ruby_as_pattern,
+  int name: @ruby_token_identifier ref,
+  int value: @ruby_underscore_pattern_expr ref
+);
+
+@ruby_assignment_left_type = @ruby_left_assignment_list | @ruby_underscore_lhs
+
+@ruby_assignment_right_type = @ruby_rescue_modifier | @ruby_right_assignment_list | @ruby_splat_argument | @ruby_underscore_expression
+
+ruby_assignment_def(
+  unique int id: @ruby_assignment,
+  int left: @ruby_assignment_left_type ref,
+  int right: @ruby_assignment_right_type ref
+);
+
+@ruby_bare_string_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_bare_string, index]
+ruby_bare_string_child(
+  int ruby_bare_string: @ruby_bare_string ref,
+  int index: int ref,
+  unique int child: @ruby_bare_string_child_type ref
+);
+
+ruby_bare_string_def(
+  unique int id: @ruby_bare_string
+);
+
+@ruby_bare_symbol_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_bare_symbol, index]
+ruby_bare_symbol_child(
+  int ruby_bare_symbol: @ruby_bare_symbol ref,
+  int index: int ref,
+  unique int child: @ruby_bare_symbol_child_type ref
+);
+
+ruby_bare_symbol_def(
+  unique int id: @ruby_bare_symbol
+);
+
+@ruby_begin_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_begin, index]
+ruby_begin_child(
+  int ruby_begin: @ruby_begin ref,
+  int index: int ref,
+  unique int child: @ruby_begin_child_type ref
+);
+
+ruby_begin_def(
+  unique int id: @ruby_begin
+);
+
+@ruby_begin_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_begin_block, index]
+ruby_begin_block_child(
+  int ruby_begin_block: @ruby_begin_block ref,
+  int index: int ref,
+  unique int child: @ruby_begin_block_child_type ref
+);
+
+ruby_begin_block_def(
+  unique int id: @ruby_begin_block
+);
+
+@ruby_binary_left_type = @ruby_underscore_expression | @ruby_underscore_simple_numeric
+
+case @ruby_binary.operator of
+  0 = @ruby_binary_bangequal
+| 1 = @ruby_binary_bangtilde
+| 2 = @ruby_binary_percent
+| 3 = @ruby_binary_ampersand
+| 4 = @ruby_binary_ampersandampersand
+| 5 = @ruby_binary_star
+| 6 = @ruby_binary_starstar
+| 7 = @ruby_binary_plus
+| 8 = @ruby_binary_minus
+| 9 = @ruby_binary_slash
+| 10 = @ruby_binary_langle
+| 11 = @ruby_binary_langlelangle
+| 12 = @ruby_binary_langleequal
+| 13 = @ruby_binary_langleequalrangle
+| 14 = @ruby_binary_equalequal
+| 15 = @ruby_binary_equalequalequal
+| 16 = @ruby_binary_equaltilde
+| 17 = @ruby_binary_rangle
+| 18 = @ruby_binary_rangleequal
+| 19 = @ruby_binary_ranglerangle
+| 20 = @ruby_binary_caret
+| 21 = @ruby_binary_and
+| 22 = @ruby_binary_or
+| 23 = @ruby_binary_pipe
+| 24 = @ruby_binary_pipepipe
+;
+
+
+ruby_binary_def(
+  unique int id: @ruby_binary,
+  int left: @ruby_binary_left_type ref,
+  int operator: int ref,
+  int right: @ruby_underscore_expression ref
+);
+
+ruby_block_body(
+  unique int ruby_block: @ruby_block ref,
+  unique int body: @ruby_block_body ref
+);
+
+ruby_block_parameters(
+  unique int ruby_block: @ruby_block ref,
+  unique int parameters: @ruby_block_parameters ref
+);
+
+ruby_block_def(
+  unique int id: @ruby_block
+);
+
+ruby_block_argument_child(
+  unique int ruby_block_argument: @ruby_block_argument ref,
+  unique int child: @ruby_underscore_arg ref
+);
+
+ruby_block_argument_def(
+  unique int id: @ruby_block_argument
+);
+
+@ruby_block_body_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_block_body, index]
+ruby_block_body_child(
+  int ruby_block_body: @ruby_block_body ref,
+  int index: int ref,
+  unique int child: @ruby_block_body_child_type ref
+);
+
+ruby_block_body_def(
+  unique int id: @ruby_block_body
+);
+
+ruby_block_parameter_name(
+  unique int ruby_block_parameter: @ruby_block_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_block_parameter_def(
+  unique int id: @ruby_block_parameter
+);
+
+#keyset[ruby_block_parameters, index]
+ruby_block_parameters_locals(
+  int ruby_block_parameters: @ruby_block_parameters ref,
+  int index: int ref,
+  unique int locals: @ruby_token_identifier ref
+);
+
+@ruby_block_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_block_parameters, index]
+ruby_block_parameters_child(
+  int ruby_block_parameters: @ruby_block_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_block_parameters_child_type ref
+);
+
+ruby_block_parameters_def(
+  unique int id: @ruby_block_parameters
+);
+
+@ruby_body_statement_child_type = @ruby_else | @ruby_ensure | @ruby_rescue | @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_body_statement, index]
+ruby_body_statement_child(
+  int ruby_body_statement: @ruby_body_statement ref,
+  int index: int ref,
+  unique int child: @ruby_body_statement_child_type ref
+);
+
+ruby_body_statement_def(
+  unique int id: @ruby_body_statement
+);
+
+ruby_break_child(
+  unique int ruby_break: @ruby_break ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_break_def(
+  unique int id: @ruby_break
+);
+
+ruby_call_arguments(
+  unique int ruby_call: @ruby_call ref,
+  unique int arguments: @ruby_argument_list ref
+);
+
+@ruby_call_block_type = @ruby_block | @ruby_do_block
+
+ruby_call_block(
+  unique int ruby_call: @ruby_call ref,
+  unique int block: @ruby_call_block_type ref
+);
+
+@ruby_call_method_type = @ruby_token_operator | @ruby_underscore_variable
+
+ruby_call_method(
+  unique int ruby_call: @ruby_call ref,
+  unique int method: @ruby_call_method_type ref
+);
+
+ruby_call_operator(
+  unique int ruby_call: @ruby_call ref,
+  unique int operator: @ruby_underscore_call_operator ref
+);
+
+ruby_call_receiver(
+  unique int ruby_call: @ruby_call ref,
+  unique int receiver: @ruby_underscore_primary ref
+);
+
+ruby_call_def(
+  unique int id: @ruby_call
+);
+
+ruby_case_value(
+  unique int ruby_case__: @ruby_case__ ref,
+  unique int value: @ruby_underscore_statement ref
+);
+
+@ruby_case_child_type = @ruby_else | @ruby_when
+
+#keyset[ruby_case__, index]
+ruby_case_child(
+  int ruby_case__: @ruby_case__ ref,
+  int index: int ref,
+  unique int child: @ruby_case_child_type ref
+);
+
+ruby_case_def(
+  unique int id: @ruby_case__
+);
+
+#keyset[ruby_case_match, index]
+ruby_case_match_clauses(
+  int ruby_case_match: @ruby_case_match ref,
+  int index: int ref,
+  unique int clauses: @ruby_in_clause ref
+);
+
+ruby_case_match_else(
+  unique int ruby_case_match: @ruby_case_match ref,
+  unique int else: @ruby_else ref
+);
+
+ruby_case_match_def(
+  unique int id: @ruby_case_match,
+  int value: @ruby_underscore_statement ref
+);
+
+#keyset[ruby_chained_string, index]
+ruby_chained_string_child(
+  int ruby_chained_string: @ruby_chained_string ref,
+  int index: int ref,
+  unique int child: @ruby_string__ ref
+);
+
+ruby_chained_string_def(
+  unique int id: @ruby_chained_string
+);
+
+ruby_class_body(
+  unique int ruby_class: @ruby_class ref,
+  unique int body: @ruby_body_statement ref
+);
+
+@ruby_class_name_type = @ruby_scope_resolution | @ruby_token_constant
+
+ruby_class_superclass(
+  unique int ruby_class: @ruby_class ref,
+  unique int superclass: @ruby_superclass ref
+);
+
+ruby_class_def(
+  unique int id: @ruby_class,
+  int name: @ruby_class_name_type ref
+);
+
+@ruby_complex_child_type = @ruby_rational | @ruby_token_float | @ruby_token_integer
+
+ruby_complex_def(
+  unique int id: @ruby_complex,
+  int child: @ruby_complex_child_type ref
+);
+
+ruby_conditional_def(
+  unique int id: @ruby_conditional,
+  int alternative: @ruby_underscore_arg ref,
+  int condition: @ruby_underscore_arg ref,
+  int consequence: @ruby_underscore_arg ref
+);
+
+@ruby_delimited_symbol_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_delimited_symbol, index]
+ruby_delimited_symbol_child(
+  int ruby_delimited_symbol: @ruby_delimited_symbol ref,
+  int index: int ref,
+  unique int child: @ruby_delimited_symbol_child_type ref
+);
+
+ruby_delimited_symbol_def(
+  unique int id: @ruby_delimited_symbol
+);
+
+@ruby_destructured_left_assignment_child_type = @ruby_destructured_left_assignment | @ruby_rest_assignment | @ruby_underscore_lhs
+
+#keyset[ruby_destructured_left_assignment, index]
+ruby_destructured_left_assignment_child(
+  int ruby_destructured_left_assignment: @ruby_destructured_left_assignment ref,
+  int index: int ref,
+  unique int child: @ruby_destructured_left_assignment_child_type ref
+);
+
+ruby_destructured_left_assignment_def(
+  unique int id: @ruby_destructured_left_assignment
+);
+
+@ruby_destructured_parameter_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_destructured_parameter, index]
+ruby_destructured_parameter_child(
+  int ruby_destructured_parameter: @ruby_destructured_parameter ref,
+  int index: int ref,
+  unique int child: @ruby_destructured_parameter_child_type ref
+);
+
+ruby_destructured_parameter_def(
+  unique int id: @ruby_destructured_parameter
+);
+
+@ruby_do_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_do, index]
+ruby_do_child(
+  int ruby_do: @ruby_do ref,
+  int index: int ref,
+  unique int child: @ruby_do_child_type ref
+);
+
+ruby_do_def(
+  unique int id: @ruby_do
+);
+
+ruby_do_block_body(
+  unique int ruby_do_block: @ruby_do_block ref,
+  unique int body: @ruby_body_statement ref
+);
+
+ruby_do_block_parameters(
+  unique int ruby_do_block: @ruby_do_block ref,
+  unique int parameters: @ruby_block_parameters ref
+);
+
+ruby_do_block_def(
+  unique int id: @ruby_do_block
+);
+
+@ruby_element_reference_child_type = @ruby_block_argument | @ruby_hash_splat_argument | @ruby_pair | @ruby_splat_argument | @ruby_token_forward_argument | @ruby_underscore_expression
+
+#keyset[ruby_element_reference, index]
+ruby_element_reference_child(
+  int ruby_element_reference: @ruby_element_reference ref,
+  int index: int ref,
+  unique int child: @ruby_element_reference_child_type ref
+);
+
+ruby_element_reference_def(
+  unique int id: @ruby_element_reference,
+  int object: @ruby_underscore_primary ref
+);
+
+@ruby_else_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_else, index]
+ruby_else_child(
+  int ruby_else: @ruby_else ref,
+  int index: int ref,
+  unique int child: @ruby_else_child_type ref
+);
+
+ruby_else_def(
+  unique int id: @ruby_else
+);
+
+@ruby_elsif_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_elsif_alternative(
+  unique int ruby_elsif: @ruby_elsif ref,
+  unique int alternative: @ruby_elsif_alternative_type ref
+);
+
+ruby_elsif_consequence(
+  unique int ruby_elsif: @ruby_elsif ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_elsif_def(
+  unique int id: @ruby_elsif,
+  int condition: @ruby_underscore_statement ref
+);
+
+@ruby_end_block_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_end_block, index]
+ruby_end_block_child(
+  int ruby_end_block: @ruby_end_block ref,
+  int index: int ref,
+  unique int child: @ruby_end_block_child_type ref
+);
+
+ruby_end_block_def(
+  unique int id: @ruby_end_block
+);
+
+@ruby_ensure_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_ensure, index]
+ruby_ensure_child(
+  int ruby_ensure: @ruby_ensure ref,
+  int index: int ref,
+  unique int child: @ruby_ensure_child_type ref
+);
+
+ruby_ensure_def(
+  unique int id: @ruby_ensure
+);
+
+ruby_exception_variable_def(
+  unique int id: @ruby_exception_variable,
+  int child: @ruby_underscore_lhs ref
+);
+
+@ruby_exceptions_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+#keyset[ruby_exceptions, index]
+ruby_exceptions_child(
+  int ruby_exceptions: @ruby_exceptions ref,
+  int index: int ref,
+  unique int child: @ruby_exceptions_child_type ref
+);
+
+ruby_exceptions_def(
+  unique int id: @ruby_exceptions
+);
+
+ruby_expression_reference_pattern_def(
+  unique int id: @ruby_expression_reference_pattern,
+  int value: @ruby_underscore_expression ref
+);
+
+ruby_find_pattern_class(
+  unique int ruby_find_pattern: @ruby_find_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_find_pattern_child_type = @ruby_splat_parameter | @ruby_underscore_pattern_expr
+
+#keyset[ruby_find_pattern, index]
+ruby_find_pattern_child(
+  int ruby_find_pattern: @ruby_find_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_find_pattern_child_type ref
+);
+
+ruby_find_pattern_def(
+  unique int id: @ruby_find_pattern
+);
+
+@ruby_for_pattern_type = @ruby_left_assignment_list | @ruby_underscore_lhs
+
+ruby_for_def(
+  unique int id: @ruby_for,
+  int body: @ruby_do ref,
+  int pattern: @ruby_for_pattern_type ref,
+  int value: @ruby_in ref
+);
+
+@ruby_hash_child_type = @ruby_hash_splat_argument | @ruby_pair
+
+#keyset[ruby_hash, index]
+ruby_hash_child(
+  int ruby_hash: @ruby_hash ref,
+  int index: int ref,
+  unique int child: @ruby_hash_child_type ref
+);
+
+ruby_hash_def(
+  unique int id: @ruby_hash
+);
+
+ruby_hash_pattern_class(
+  unique int ruby_hash_pattern: @ruby_hash_pattern ref,
+  unique int class: @ruby_underscore_pattern_constant ref
+);
+
+@ruby_hash_pattern_child_type = @ruby_hash_splat_parameter | @ruby_keyword_pattern | @ruby_token_hash_splat_nil
+
+#keyset[ruby_hash_pattern, index]
+ruby_hash_pattern_child(
+  int ruby_hash_pattern: @ruby_hash_pattern ref,
+  int index: int ref,
+  unique int child: @ruby_hash_pattern_child_type ref
+);
+
+ruby_hash_pattern_def(
+  unique int id: @ruby_hash_pattern
+);
+
+ruby_hash_splat_argument_def(
+  unique int id: @ruby_hash_splat_argument,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_hash_splat_parameter_name(
+  unique int ruby_hash_splat_parameter: @ruby_hash_splat_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_hash_splat_parameter_def(
+  unique int id: @ruby_hash_splat_parameter
+);
+
+@ruby_heredoc_body_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_heredoc_content | @ruby_token_heredoc_end
+
+#keyset[ruby_heredoc_body, index]
+ruby_heredoc_body_child(
+  int ruby_heredoc_body: @ruby_heredoc_body ref,
+  int index: int ref,
+  unique int child: @ruby_heredoc_body_child_type ref
+);
+
+ruby_heredoc_body_def(
+  unique int id: @ruby_heredoc_body
+);
+
+@ruby_if_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_if_alternative(
+  unique int ruby_if: @ruby_if ref,
+  unique int alternative: @ruby_if_alternative_type ref
+);
+
+ruby_if_consequence(
+  unique int ruby_if: @ruby_if ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_if_def(
+  unique int id: @ruby_if,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_if_guard_def(
+  unique int id: @ruby_if_guard,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_if_modifier_def(
+  unique int id: @ruby_if_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_in_def(
+  unique int id: @ruby_in,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_in_clause_body(
+  unique int ruby_in_clause: @ruby_in_clause ref,
+  unique int body: @ruby_then ref
+);
+
+@ruby_in_clause_guard_type = @ruby_if_guard | @ruby_unless_guard
+
+ruby_in_clause_guard(
+  unique int ruby_in_clause: @ruby_in_clause ref,
+  unique int guard: @ruby_in_clause_guard_type ref
+);
+
+ruby_in_clause_def(
+  unique int id: @ruby_in_clause,
+  int pattern: @ruby_underscore_pattern_top_expr_body ref
+);
+
+@ruby_interpolation_child_type = @ruby_token_empty_statement | @ruby_underscore_nonlocal_variable | @ruby_underscore_statement
+
+#keyset[ruby_interpolation, index]
+ruby_interpolation_child(
+  int ruby_interpolation: @ruby_interpolation ref,
+  int index: int ref,
+  unique int child: @ruby_interpolation_child_type ref
+);
+
+ruby_interpolation_def(
+  unique int id: @ruby_interpolation
+);
+
+ruby_keyword_parameter_value(
+  unique int ruby_keyword_parameter: @ruby_keyword_parameter ref,
+  unique int value: @ruby_underscore_arg ref
+);
+
+ruby_keyword_parameter_def(
+  unique int id: @ruby_keyword_parameter,
+  int name: @ruby_token_identifier ref
+);
+
+@ruby_keyword_pattern_key_type = @ruby_string__ | @ruby_token_hash_key_symbol
+
+ruby_keyword_pattern_value(
+  unique int ruby_keyword_pattern: @ruby_keyword_pattern ref,
+  unique int value: @ruby_underscore_pattern_expr ref
+);
+
+ruby_keyword_pattern_def(
+  unique int id: @ruby_keyword_pattern,
+  int key__: @ruby_keyword_pattern_key_type ref
+);
+
+@ruby_lambda_body_type = @ruby_block | @ruby_do_block
+
+ruby_lambda_parameters(
+  unique int ruby_lambda: @ruby_lambda ref,
+  unique int parameters: @ruby_lambda_parameters ref
+);
+
+ruby_lambda_def(
+  unique int id: @ruby_lambda,
+  int body: @ruby_lambda_body_type ref
+);
+
+@ruby_lambda_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_lambda_parameters, index]
+ruby_lambda_parameters_child(
+  int ruby_lambda_parameters: @ruby_lambda_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_lambda_parameters_child_type ref
+);
+
+ruby_lambda_parameters_def(
+  unique int id: @ruby_lambda_parameters
+);
+
+@ruby_left_assignment_list_child_type = @ruby_destructured_left_assignment | @ruby_rest_assignment | @ruby_underscore_lhs
+
+#keyset[ruby_left_assignment_list, index]
+ruby_left_assignment_list_child(
+  int ruby_left_assignment_list: @ruby_left_assignment_list ref,
+  int index: int ref,
+  unique int child: @ruby_left_assignment_list_child_type ref
+);
+
+ruby_left_assignment_list_def(
+  unique int id: @ruby_left_assignment_list
+);
+
+@ruby_method_body_type = @ruby_body_statement | @ruby_rescue_modifier | @ruby_underscore_arg
+
+ruby_method_body(
+  unique int ruby_method: @ruby_method ref,
+  unique int body: @ruby_method_body_type ref
+);
+
+ruby_method_parameters(
+  unique int ruby_method: @ruby_method ref,
+  unique int parameters: @ruby_method_parameters ref
+);
+
+ruby_method_def(
+  unique int id: @ruby_method,
+  int name: @ruby_underscore_method_name ref
+);
+
+@ruby_method_parameters_child_type = @ruby_block_parameter | @ruby_destructured_parameter | @ruby_hash_splat_parameter | @ruby_keyword_parameter | @ruby_optional_parameter | @ruby_splat_parameter | @ruby_token_forward_parameter | @ruby_token_hash_splat_nil | @ruby_token_identifier
+
+#keyset[ruby_method_parameters, index]
+ruby_method_parameters_child(
+  int ruby_method_parameters: @ruby_method_parameters ref,
+  int index: int ref,
+  unique int child: @ruby_method_parameters_child_type ref
+);
+
+ruby_method_parameters_def(
+  unique int id: @ruby_method_parameters
+);
+
+ruby_module_body(
+  unique int ruby_module: @ruby_module ref,
+  unique int body: @ruby_body_statement ref
+);
+
+@ruby_module_name_type = @ruby_scope_resolution | @ruby_token_constant
+
+ruby_module_def(
+  unique int id: @ruby_module,
+  int name: @ruby_module_name_type ref
+);
+
+ruby_next_child(
+  unique int ruby_next: @ruby_next ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_next_def(
+  unique int id: @ruby_next
+);
+
+case @ruby_operator_assignment.operator of
+  0 = @ruby_operator_assignment_percentequal
+| 1 = @ruby_operator_assignment_ampersandampersandequal
+| 2 = @ruby_operator_assignment_ampersandequal
+| 3 = @ruby_operator_assignment_starstarequal
+| 4 = @ruby_operator_assignment_starequal
+| 5 = @ruby_operator_assignment_plusequal
+| 6 = @ruby_operator_assignment_minusequal
+| 7 = @ruby_operator_assignment_slashequal
+| 8 = @ruby_operator_assignment_langlelangleequal
+| 9 = @ruby_operator_assignment_ranglerangleequal
+| 10 = @ruby_operator_assignment_caretequal
+| 11 = @ruby_operator_assignment_pipeequal
+| 12 = @ruby_operator_assignment_pipepipeequal
+;
+
+
+@ruby_operator_assignment_right_type = @ruby_rescue_modifier | @ruby_underscore_expression
+
+ruby_operator_assignment_def(
+  unique int id: @ruby_operator_assignment,
+  int left: @ruby_underscore_lhs ref,
+  int operator: int ref,
+  int right: @ruby_operator_assignment_right_type ref
+);
+
+ruby_optional_parameter_def(
+  unique int id: @ruby_optional_parameter,
+  int name: @ruby_token_identifier ref,
+  int value: @ruby_underscore_arg ref
+);
+
+@ruby_pair_key_type = @ruby_string__ | @ruby_token_hash_key_symbol | @ruby_underscore_arg
+
+ruby_pair_value(
+  unique int ruby_pair: @ruby_pair ref,
+  unique int value: @ruby_underscore_arg ref
+);
+
+ruby_pair_def(
+  unique int id: @ruby_pair,
+  int key__: @ruby_pair_key_type ref
+);
+
+ruby_parenthesized_pattern_def(
+  unique int id: @ruby_parenthesized_pattern,
+  int child: @ruby_underscore_pattern_expr ref
+);
+
+@ruby_parenthesized_statements_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_parenthesized_statements, index]
+ruby_parenthesized_statements_child(
+  int ruby_parenthesized_statements: @ruby_parenthesized_statements ref,
+  int index: int ref,
+  unique int child: @ruby_parenthesized_statements_child_type ref
+);
+
+ruby_parenthesized_statements_def(
+  unique int id: @ruby_parenthesized_statements
+);
+
+@ruby_pattern_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+ruby_pattern_def(
+  unique int id: @ruby_pattern,
+  int child: @ruby_pattern_child_type ref
+);
+
+@ruby_program_child_type = @ruby_token_empty_statement | @ruby_token_uninterpreted | @ruby_underscore_statement
+
+#keyset[ruby_program, index]
+ruby_program_child(
+  int ruby_program: @ruby_program ref,
+  int index: int ref,
+  unique int child: @ruby_program_child_type ref
+);
+
+ruby_program_def(
+  unique int id: @ruby_program
+);
+
+@ruby_range_begin_type = @ruby_underscore_arg | @ruby_underscore_pattern_primitive
+
+ruby_range_begin(
+  unique int ruby_range: @ruby_range ref,
+  unique int begin: @ruby_range_begin_type ref
+);
+
+@ruby_range_end_type = @ruby_underscore_arg | @ruby_underscore_pattern_primitive
+
+ruby_range_end(
+  unique int ruby_range: @ruby_range ref,
+  unique int end: @ruby_range_end_type ref
+);
+
+case @ruby_range.operator of
+  0 = @ruby_range_dotdot
+| 1 = @ruby_range_dotdotdot
+;
+
+
+ruby_range_def(
+  unique int id: @ruby_range,
+  int operator: int ref
+);
+
+@ruby_rational_child_type = @ruby_token_float | @ruby_token_integer
+
+ruby_rational_def(
+  unique int id: @ruby_rational,
+  int child: @ruby_rational_child_type ref
+);
+
+ruby_redo_child(
+  unique int ruby_redo: @ruby_redo ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_redo_def(
+  unique int id: @ruby_redo
+);
+
+@ruby_regex_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_regex, index]
+ruby_regex_child(
+  int ruby_regex: @ruby_regex ref,
+  int index: int ref,
+  unique int child: @ruby_regex_child_type ref
+);
+
+ruby_regex_def(
+  unique int id: @ruby_regex
+);
+
+ruby_rescue_body(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int body: @ruby_then ref
+);
+
+ruby_rescue_exceptions(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int exceptions: @ruby_exceptions ref
+);
+
+ruby_rescue_variable(
+  unique int ruby_rescue: @ruby_rescue ref,
+  unique int variable: @ruby_exception_variable ref
+);
+
+ruby_rescue_def(
+  unique int id: @ruby_rescue
+);
+
+@ruby_rescue_modifier_body_type = @ruby_underscore_arg | @ruby_underscore_statement
+
+ruby_rescue_modifier_def(
+  unique int id: @ruby_rescue_modifier,
+  int body: @ruby_rescue_modifier_body_type ref,
+  int handler: @ruby_underscore_expression ref
+);
+
+ruby_rest_assignment_child(
+  unique int ruby_rest_assignment: @ruby_rest_assignment ref,
+  unique int child: @ruby_underscore_lhs ref
+);
+
+ruby_rest_assignment_def(
+  unique int id: @ruby_rest_assignment
+);
+
+ruby_retry_child(
+  unique int ruby_retry: @ruby_retry ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_retry_def(
+  unique int id: @ruby_retry
+);
+
+ruby_return_child(
+  unique int ruby_return: @ruby_return ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_return_def(
+  unique int id: @ruby_return
+);
+
+@ruby_right_assignment_list_child_type = @ruby_splat_argument | @ruby_underscore_arg
+
+#keyset[ruby_right_assignment_list, index]
+ruby_right_assignment_list_child(
+  int ruby_right_assignment_list: @ruby_right_assignment_list ref,
+  int index: int ref,
+  unique int child: @ruby_right_assignment_list_child_type ref
+);
+
+ruby_right_assignment_list_def(
+  unique int id: @ruby_right_assignment_list
+);
+
+@ruby_scope_resolution_scope_type = @ruby_underscore_pattern_constant | @ruby_underscore_primary
+
+ruby_scope_resolution_scope(
+  unique int ruby_scope_resolution: @ruby_scope_resolution ref,
+  unique int scope: @ruby_scope_resolution_scope_type ref
+);
+
+ruby_scope_resolution_def(
+  unique int id: @ruby_scope_resolution,
+  int name: @ruby_token_constant ref
+);
+
+ruby_setter_def(
+  unique int id: @ruby_setter,
+  int name: @ruby_token_identifier ref
+);
+
+ruby_singleton_class_body(
+  unique int ruby_singleton_class: @ruby_singleton_class ref,
+  unique int body: @ruby_body_statement ref
+);
+
+ruby_singleton_class_def(
+  unique int id: @ruby_singleton_class,
+  int value: @ruby_underscore_arg ref
+);
+
+@ruby_singleton_method_body_type = @ruby_body_statement | @ruby_rescue_modifier | @ruby_underscore_arg
+
+ruby_singleton_method_body(
+  unique int ruby_singleton_method: @ruby_singleton_method ref,
+  unique int body: @ruby_singleton_method_body_type ref
+);
+
+@ruby_singleton_method_object_type = @ruby_underscore_arg | @ruby_underscore_variable
+
+ruby_singleton_method_parameters(
+  unique int ruby_singleton_method: @ruby_singleton_method ref,
+  unique int parameters: @ruby_method_parameters ref
+);
+
+ruby_singleton_method_def(
+  unique int id: @ruby_singleton_method,
+  int name: @ruby_underscore_method_name ref,
+  int object: @ruby_singleton_method_object_type ref
+);
+
+ruby_splat_argument_def(
+  unique int id: @ruby_splat_argument,
+  int child: @ruby_underscore_arg ref
+);
+
+ruby_splat_parameter_name(
+  unique int ruby_splat_parameter: @ruby_splat_parameter ref,
+  unique int name: @ruby_token_identifier ref
+);
+
+ruby_splat_parameter_def(
+  unique int id: @ruby_splat_parameter
+);
+
+@ruby_string_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_string__, index]
+ruby_string_child(
+  int ruby_string__: @ruby_string__ ref,
+  int index: int ref,
+  unique int child: @ruby_string_child_type ref
+);
+
+ruby_string_def(
+  unique int id: @ruby_string__
+);
+
+#keyset[ruby_string_array, index]
+ruby_string_array_child(
+  int ruby_string_array: @ruby_string_array ref,
+  int index: int ref,
+  unique int child: @ruby_bare_string ref
+);
+
+ruby_string_array_def(
+  unique int id: @ruby_string_array
+);
+
+@ruby_subshell_child_type = @ruby_interpolation | @ruby_token_escape_sequence | @ruby_token_string_content
+
+#keyset[ruby_subshell, index]
+ruby_subshell_child(
+  int ruby_subshell: @ruby_subshell ref,
+  int index: int ref,
+  unique int child: @ruby_subshell_child_type ref
+);
+
+ruby_subshell_def(
+  unique int id: @ruby_subshell
+);
+
+ruby_superclass_def(
+  unique int id: @ruby_superclass,
+  int child: @ruby_underscore_expression ref
+);
+
+#keyset[ruby_symbol_array, index]
+ruby_symbol_array_child(
+  int ruby_symbol_array: @ruby_symbol_array ref,
+  int index: int ref,
+  unique int child: @ruby_bare_symbol ref
+);
+
+ruby_symbol_array_def(
+  unique int id: @ruby_symbol_array
+);
+
+@ruby_then_child_type = @ruby_token_empty_statement | @ruby_underscore_statement
+
+#keyset[ruby_then, index]
+ruby_then_child(
+  int ruby_then: @ruby_then ref,
+  int index: int ref,
+  unique int child: @ruby_then_child_type ref
+);
+
+ruby_then_def(
+  unique int id: @ruby_then
+);
+
+@ruby_unary_operand_type = @ruby_parenthesized_statements | @ruby_underscore_expression | @ruby_underscore_simple_numeric
+
+case @ruby_unary.operator of
+  0 = @ruby_unary_bang
+| 1 = @ruby_unary_plus
+| 2 = @ruby_unary_minus
+| 3 = @ruby_unary_definedquestion
+| 4 = @ruby_unary_not
+| 5 = @ruby_unary_tilde
+;
+
+
+ruby_unary_def(
+  unique int id: @ruby_unary,
+  int operand: @ruby_unary_operand_type ref,
+  int operator: int ref
+);
+
+#keyset[ruby_undef, index]
+ruby_undef_child(
+  int ruby_undef: @ruby_undef ref,
+  int index: int ref,
+  unique int child: @ruby_underscore_method_name ref
+);
+
+ruby_undef_def(
+  unique int id: @ruby_undef
+);
+
+@ruby_unless_alternative_type = @ruby_else | @ruby_elsif
+
+ruby_unless_alternative(
+  unique int ruby_unless: @ruby_unless ref,
+  unique int alternative: @ruby_unless_alternative_type ref
+);
+
+ruby_unless_consequence(
+  unique int ruby_unless: @ruby_unless ref,
+  unique int consequence: @ruby_then ref
+);
+
+ruby_unless_def(
+  unique int id: @ruby_unless,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_unless_guard_def(
+  unique int id: @ruby_unless_guard,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_unless_modifier_def(
+  unique int id: @ruby_unless_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_until_def(
+  unique int id: @ruby_until,
+  int body: @ruby_do ref,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_until_modifier_def(
+  unique int id: @ruby_until_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+@ruby_variable_reference_pattern_name_type = @ruby_token_identifier | @ruby_underscore_nonlocal_variable
+
+ruby_variable_reference_pattern_def(
+  unique int id: @ruby_variable_reference_pattern,
+  int name: @ruby_variable_reference_pattern_name_type ref
+);
+
+ruby_when_body(
+  unique int ruby_when: @ruby_when ref,
+  unique int body: @ruby_then ref
+);
+
+#keyset[ruby_when, index]
+ruby_when_pattern(
+  int ruby_when: @ruby_when ref,
+  int index: int ref,
+  unique int pattern: @ruby_pattern ref
+);
+
+ruby_when_def(
+  unique int id: @ruby_when
+);
+
+ruby_while_def(
+  unique int id: @ruby_while,
+  int body: @ruby_do ref,
+  int condition: @ruby_underscore_statement ref
+);
+
+ruby_while_modifier_def(
+  unique int id: @ruby_while_modifier,
+  int body: @ruby_underscore_statement ref,
+  int condition: @ruby_underscore_expression ref
+);
+
+ruby_yield_child(
+  unique int ruby_yield: @ruby_yield ref,
+  unique int child: @ruby_argument_list ref
+);
+
+ruby_yield_def(
+  unique int id: @ruby_yield
+);
+
+ruby_tokeninfo(
+  unique int id: @ruby_token,
+  int kind: int ref,
+  string value: string ref
+);
+
+case @ruby_token.kind of
+  0 = @ruby_reserved_word
+| 1 = @ruby_token_character
+| 2 = @ruby_token_class_variable
+| 3 = @ruby_token_comment
+| 4 = @ruby_token_constant
+| 5 = @ruby_token_empty_statement
+| 6 = @ruby_token_encoding
+| 7 = @ruby_token_escape_sequence
+| 8 = @ruby_token_false
+| 9 = @ruby_token_file
+| 10 = @ruby_token_float
+| 11 = @ruby_token_forward_argument
+| 12 = @ruby_token_forward_parameter
+| 13 = @ruby_token_global_variable
+| 14 = @ruby_token_hash_key_symbol
+| 15 = @ruby_token_hash_splat_nil
+| 16 = @ruby_token_heredoc_beginning
+| 17 = @ruby_token_heredoc_content
+| 18 = @ruby_token_heredoc_end
+| 19 = @ruby_token_identifier
+| 20 = @ruby_token_instance_variable
+| 21 = @ruby_token_integer
+| 22 = @ruby_token_line
+| 23 = @ruby_token_nil
+| 24 = @ruby_token_operator
+| 25 = @ruby_token_self
+| 26 = @ruby_token_simple_symbol
+| 27 = @ruby_token_string_content
+| 28 = @ruby_token_super
+| 29 = @ruby_token_true
+| 30 = @ruby_token_uninterpreted
+;
+
+
+@ruby_ast_node = @ruby_alias | @ruby_alternative_pattern | @ruby_argument_list | @ruby_array | @ruby_array_pattern | @ruby_as_pattern | @ruby_assignment | @ruby_bare_string | @ruby_bare_symbol | @ruby_begin | @ruby_begin_block | @ruby_binary | @ruby_block | @ruby_block_argument | @ruby_block_body | @ruby_block_parameter | @ruby_block_parameters | @ruby_body_statement | @ruby_break | @ruby_call | @ruby_case__ | @ruby_case_match | @ruby_chained_string | @ruby_class | @ruby_complex | @ruby_conditional | @ruby_delimited_symbol | @ruby_destructured_left_assignment | @ruby_destructured_parameter | @ruby_do | @ruby_do_block | @ruby_element_reference | @ruby_else | @ruby_elsif | @ruby_end_block | @ruby_ensure | @ruby_exception_variable | @ruby_exceptions | @ruby_expression_reference_pattern | @ruby_find_pattern | @ruby_for | @ruby_hash | @ruby_hash_pattern | @ruby_hash_splat_argument | @ruby_hash_splat_parameter | @ruby_heredoc_body | @ruby_if | @ruby_if_guard | @ruby_if_modifier | @ruby_in | @ruby_in_clause | @ruby_interpolation | @ruby_keyword_parameter | @ruby_keyword_pattern | @ruby_lambda | @ruby_lambda_parameters | @ruby_left_assignment_list | @ruby_method | @ruby_method_parameters | @ruby_module | @ruby_next | @ruby_operator_assignment | @ruby_optional_parameter | @ruby_pair | @ruby_parenthesized_pattern | @ruby_parenthesized_statements | @ruby_pattern | @ruby_program | @ruby_range | @ruby_rational | @ruby_redo | @ruby_regex | @ruby_rescue | @ruby_rescue_modifier | @ruby_rest_assignment | @ruby_retry | @ruby_return | @ruby_right_assignment_list | @ruby_scope_resolution | @ruby_setter | @ruby_singleton_class | @ruby_singleton_method | @ruby_splat_argument | @ruby_splat_parameter | @ruby_string__ | @ruby_string_array | @ruby_subshell | @ruby_superclass | @ruby_symbol_array | @ruby_then | @ruby_token | @ruby_unary | @ruby_undef | @ruby_unless | @ruby_unless_guard | @ruby_unless_modifier | @ruby_until | @ruby_until_modifier | @ruby_variable_reference_pattern | @ruby_when | @ruby_while | @ruby_while_modifier | @ruby_yield
+
+@ruby_ast_node_parent = @file | @ruby_ast_node
+
+#keyset[parent, parent_index]
+ruby_ast_node_info(
+  unique int node: @ruby_ast_node ref,
+  int parent: @ruby_ast_node_parent ref,
+  int parent_index: int ref,
+  int loc: @location ref
+);
+
+erb_comment_directive_child(
+  unique int erb_comment_directive: @erb_comment_directive ref,
+  unique int child: @erb_token_comment ref
+);
+
+erb_comment_directive_def(
+  unique int id: @erb_comment_directive
+);
+
+erb_directive_child(
+  unique int erb_directive: @erb_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_directive_def(
+  unique int id: @erb_directive
+);
+
+erb_graphql_directive_child(
+  unique int erb_graphql_directive: @erb_graphql_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_graphql_directive_def(
+  unique int id: @erb_graphql_directive
+);
+
+erb_output_directive_child(
+  unique int erb_output_directive: @erb_output_directive ref,
+  unique int child: @erb_token_code ref
+);
+
+erb_output_directive_def(
+  unique int id: @erb_output_directive
+);
+
+@erb_template_child_type = @erb_comment_directive | @erb_directive | @erb_graphql_directive | @erb_output_directive | @erb_token_content
+
+#keyset[erb_template, index]
+erb_template_child(
+  int erb_template: @erb_template ref,
+  int index: int ref,
+  unique int child: @erb_template_child_type ref
+);
+
+erb_template_def(
+  unique int id: @erb_template
+);
+
+erb_tokeninfo(
+  unique int id: @erb_token,
+  int kind: int ref,
+  string value: string ref
+);
+
+case @erb_token.kind of
+  0 = @erb_reserved_word
+| 1 = @erb_token_code
+| 2 = @erb_token_comment
+| 3 = @erb_token_content
+;
+
+
+@erb_ast_node = @erb_comment_directive | @erb_directive | @erb_graphql_directive | @erb_output_directive | @erb_template | @erb_token
+
+@erb_ast_node_parent = @erb_ast_node | @file
+
+#keyset[parent, parent_index]
+erb_ast_node_info(
+  unique int node: @erb_ast_node ref,
+  int parent: @erb_ast_node_parent ref,
+  int parent_index: int ref,
+  int loc: @location ref
+);
+
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_ast_node_info.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_ast_node_info.ql
new file mode 100644
index 00000000000..abc6f7bf144
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_ast_node_info.ql
@@ -0,0 +1,76 @@
+class AstNode extends @ruby_ast_node_parent {
+  string toString() { none() }
+}
+
+class Location extends @location {
+  string toString() { none() }
+}
+
+private predicate body_statement(AstNode body, AstNode firstChild) {
+  exists(AstNode node |
+    ruby_class_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_class_child(node, 0, firstChild)
+    or
+    ruby_do_block_def(node) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_do_block_child(node, 0, firstChild)
+    or
+    ruby_method_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_method_child(node, 0, firstChild)
+    or
+    ruby_module_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_module_child(node, 0, firstChild)
+    or
+    ruby_singleton_class_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_singleton_class_child(node, 0, firstChild)
+    or
+    ruby_singleton_method_def(node, _, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_singleton_method_child(node, 0, firstChild)
+    or
+    ruby_block_def(node) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "}") and
+    ruby_block_child(node, 0, firstChild)
+  )
+}
+
+private predicate body_statement_child(AstNode body, int index, AstNode child) {
+  exists(AstNode parent, AstNode firstChild, int firstChildIndex |
+    body_statement(body, firstChild) and
+    ruby_ast_node_info(firstChild, parent, firstChildIndex, _) and
+    child =
+      rank[index + 1](AstNode c, int i |
+        ruby_ast_node_info(c, parent, i, _) and i >= firstChildIndex and c != body
+      |
+        c order by i
+      )
+  )
+}
+
+private predicate astNodeInfo(AstNode node, AstNode parent, int parent_index, Location loc) {
+  ruby_ast_node_info(node, parent, parent_index, loc) and
+  not body_statement(node, _) and
+  not body_statement_child(_, _, node)
+}
+
+from AstNode node, AstNode parent, int parent_index, Location loc
+where
+  astNodeInfo(node, parent, parent_index, loc)
+  or
+  body_statement_child(parent, parent_index, node) and ruby_ast_node_info(node, _, _, loc)
+  or
+  body_statement(node, _) and
+  ruby_ast_node_info(node, parent, _, loc) and
+  parent_index = count(AstNode n | astNodeInfo(n, parent, _, _))
+select node, parent, parent_index, loc
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_block_body.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_block_body.ql
new file mode 100644
index 00000000000..51d629755a8
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_block_body.ql
@@ -0,0 +1,11 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode ruby_block, AstNode body
+where
+  ruby_block_def(ruby_block) and
+  ruby_ast_node_info(body, ruby_block, _, _) and
+  ruby_tokeninfo(body, _, "}") and
+  ruby_block_child(ruby_block, _, _)
+select ruby_block, body
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_block_body_child.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_block_body_child.ql
new file mode 100644
index 00000000000..d0743a7a340
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_block_body_child.ql
@@ -0,0 +1,11 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode ruby_block, AstNode body, int index, AstNode child
+where
+  ruby_block_def(ruby_block) and
+  ruby_ast_node_info(body, ruby_block, _, _) and
+  ruby_tokeninfo(body, _, "}") and
+  ruby_block_child(ruby_block, index, child)
+select body, index, child
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_block_body_def.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_block_body_def.ql
new file mode 100644
index 00000000000..78204867e6f
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_block_body_def.ql
@@ -0,0 +1,18 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+/*
+ * It's not possible to generate fresh IDs for the new ruby_block_body nodes,
+ * therefore we re-purpose the "}"-token that closes the block and use its ID instead.
+ * As a result the AST will be missing the "}" tokens, but those are unlikely to be used
+ * for anything.
+ */
+
+from AstNode ruby_block, AstNode body
+where
+  ruby_block_def(ruby_block) and
+  ruby_ast_node_info(body, ruby_block, _, _) and
+  ruby_tokeninfo(body, _, "}") and
+  ruby_block_child(ruby_block, _, _)
+select body
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_body_statement_child.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_body_statement_child.ql
new file mode 100644
index 00000000000..682c124cb49
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_body_statement_child.ql
@@ -0,0 +1,36 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode node, AstNode body, int index, AstNode child
+where
+  ruby_class_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_class_child(node, index, child)
+  or
+  ruby_do_block_def(node) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_do_block_child(node, index, child)
+  or
+  ruby_method_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_method_child(node, index, child)
+  or
+  ruby_module_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_module_child(node, index, child)
+  or
+  ruby_singleton_class_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_singleton_class_child(node, index, child)
+  or
+  ruby_singleton_method_def(node, _, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_singleton_method_child(node, index, child)
+select body, index, child
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_body_statement_def.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_body_statement_def.ql
new file mode 100644
index 00000000000..603b5d13215
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_body_statement_def.ql
@@ -0,0 +1,43 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+/*
+ * It's not possible to generate fresh IDs for the new ruby_body_statement nodes,
+ * therefore we re-purpose the "end"-token that closes the block and use its ID instead.
+ * As a result the AST will be missing the "end" tokens, but those are unlikely to be used
+ * for anything.
+ */
+
+from AstNode node, AstNode body
+where
+  ruby_class_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_class_child(node, _, _)
+  or
+  ruby_do_block_def(node) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_do_block_child(node, _, _)
+  or
+  ruby_method_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_method_child(node, _, _)
+  or
+  ruby_module_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_module_child(node, _, _)
+  or
+  ruby_singleton_class_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_singleton_class_child(node, _, _)
+  or
+  ruby_singleton_method_def(node, _, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_singleton_method_child(node, _, _)
+select body
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_class_body.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_class_body.ql
new file mode 100644
index 00000000000..0a5a7acbc4d
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_class_body.ql
@@ -0,0 +1,11 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode node, AstNode body
+where
+  ruby_class_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_class_child(node, _, _)
+select node, body
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_do_block_body.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_do_block_body.ql
new file mode 100644
index 00000000000..dee41a91532
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_do_block_body.ql
@@ -0,0 +1,11 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode node, AstNode body
+where
+  ruby_do_block_def(node) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_do_block_child(node, _, _)
+select node, body
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_method_body.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_method_body.ql
new file mode 100644
index 00000000000..88889a382a4
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_method_body.ql
@@ -0,0 +1,20 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode node, AstNode body
+where
+  ruby_method_def(node, _) and
+  (
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_method_child(node, _, _)
+    or
+    ruby_method_child(node, 0, body) and
+    not exists(AstNode n |
+      ruby_ast_node_info(n, node, _, _) and
+      ruby_tokeninfo(n, _, "end")
+    )
+  )
+// TODO : handle end-less methods
+select node, body
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_module_body.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_module_body.ql
new file mode 100644
index 00000000000..514dffc45fb
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_module_body.ql
@@ -0,0 +1,11 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode node, AstNode body
+where
+  ruby_module_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_module_child(node, _, _)
+select node, body
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_singleton_class_body.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_singleton_class_body.ql
new file mode 100644
index 00000000000..db90c1ded79
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_singleton_class_body.ql
@@ -0,0 +1,11 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode node, AstNode body
+where
+  ruby_singleton_class_def(node, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_singleton_class_child(node, _, _)
+select node, body
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_singleton_method_body.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_singleton_method_body.ql
new file mode 100644
index 00000000000..9d714fad0b8
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_singleton_method_body.ql
@@ -0,0 +1,17 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+from AstNode node, AstNode body
+where
+  ruby_singleton_method_def(node, _, _) and
+  ruby_ast_node_info(body, node, _, _) and
+  ruby_tokeninfo(body, _, "end") and
+  ruby_singleton_method_child(node, _, _)
+  or
+  ruby_singleton_method_child(node, 0, body) and
+  not exists(AstNode n |
+    ruby_ast_node_info(n, node, _, _) and
+    ruby_tokeninfo(n, _, "end")
+  )
+select node, body
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_tokeninfo.ql b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_tokeninfo.ql
new file mode 100644
index 00000000000..358445c4204
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/ruby_tokeninfo.ql
@@ -0,0 +1,46 @@
+class AstNode extends @ruby_ast_node {
+  string toString() { none() }
+}
+
+private predicate body_statement(AstNode body) {
+  exists(AstNode node |
+    ruby_class_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_class_child(node, _, _)
+    or
+    ruby_do_block_def(node) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_do_block_child(node, _, _)
+    or
+    ruby_method_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_method_child(node, _, _)
+    or
+    ruby_module_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_module_child(node, _, _)
+    or
+    ruby_singleton_class_def(node, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_singleton_class_child(node, _, _)
+    or
+    ruby_singleton_method_def(node, _, _) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "end") and
+    ruby_singleton_method_child(node, _, _)
+    or
+    ruby_block_def(node) and
+    ruby_ast_node_info(body, node, _, _) and
+    ruby_tokeninfo(body, _, "}") and
+    ruby_block_child(node, _, _)
+  )
+}
+
+from AstNode token, int kind, string value
+where ruby_tokeninfo(token, kind, value) and not body_statement(token)
+select token, kind, value
diff --git a/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/upgrade.properties b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/upgrade.properties
new file mode 100644
index 00000000000..6793ae3c109
--- /dev/null
+++ b/ruby/ql/lib/upgrades/4ba51641799d2aaa315c7323931e2dd2a94c9f9d/upgrade.properties
@@ -0,0 +1,33 @@
+description: Wrap class, module, method, and block bodies in a named node
+compatibility: partial
+
+ruby_block_body.rel: run ruby_block_body.qlo
+ruby_block_body_def.rel: run ruby_block_body_def.qlo
+ruby_block_body_child.rel: run ruby_block_body_child.qlo
+ruby_block_child.rel: delete
+
+ruby_body_statement_child.rel: run ruby_body_statement_child.qlo
+ruby_body_statement_def.rel: run ruby_body_statement_def.qlo
+
+ruby_class_body.rel: run ruby_class_body.qlo
+ruby_class_child.rel: delete
+
+ruby_do_block_body.rel: run ruby_do_block_body.qlo
+ruby_do_block_child.rel: delete
+
+ruby_method_body.rel: run ruby_method_body.qlo
+ruby_method_child.rel: delete
+
+ruby_module_body.rel: run ruby_module_body.qlo
+ruby_module_child.rel: delete
+
+ruby_singleton_class_body.rel: run ruby_singleton_class_body.qlo
+ruby_singleton_class_child.rel: delete
+
+ruby_singleton_method_body.rel: run ruby_singleton_method_body.qlo
+ruby_singleton_method_child.rel: delete
+
+ruby_ast_node_info.rel: run ruby_ast_node_info.qlo
+ruby_tokeninfo.rel: run ruby_tokeninfo.qlo
+
+locations_default.rel: run locations_default.qlo
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/2022-07-26-hardcoded-data.md b/ruby/ql/src/change-notes/2022-07-26-hardcoded-data.md
new file mode 100644
index 00000000000..4878b51992f
--- /dev/null
+++ b/ruby/ql/src/change-notes/2022-07-26-hardcoded-data.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query, `rb/hardcoded-data-interpreted-as-code`, to detect cases where hardcoded data is executed as code, a technique associated with backdoors.
diff --git a/ruby/ql/src/change-notes/2022-08-23-alert-messages.md b/ruby/ql/src/change-notes/2022-08-23-alert-messages.md
new file mode 100644
index 00000000000..22f4c5c6682
--- /dev/null
+++ b/ruby/ql/src/change-notes/2022-08-23-alert-messages.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The alert message of many queries have been changed to make the message consistent with other languages.
\ No newline at end of file
diff --git a/ruby/ql/src/queries/security/cwe-022/PathInjection.ql b/ruby/ql/src/queries/security/cwe-022/PathInjection.ql
index eb52f8e4531..027cf0a33f7 100644
--- a/ruby/ql/src/queries/security/cwe-022/PathInjection.ql
+++ b/ruby/ql/src/queries/security/cwe-022/PathInjection.ql
@@ -22,5 +22,5 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "This path depends on $@.", source.getNode(),
-  "a user-provided value"
+select sink.getNode(), source, sink, "$@ flows to here and is used in a path.", source.getNode(),
+  "User-provided value"
diff --git a/ruby/ql/src/queries/security/cwe-079/ReflectedXSS.ql b/ruby/ql/src/queries/security/cwe-079/ReflectedXSS.ql
index 818dee88fe6..2e8d4949b20 100644
--- a/ruby/ql/src/queries/security/cwe-079/ReflectedXSS.ql
+++ b/ruby/ql/src/queries/security/cwe-079/ReflectedXSS.ql
@@ -20,4 +20,4 @@ import DataFlow::PathGraph
 from ReflectedXss::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@.",
-  source.getNode(), "a user-provided value"
+  source.getNode(), "user-provided value"
diff --git a/ruby/ql/src/queries/security/cwe-079/StoredXSS.ql b/ruby/ql/src/queries/security/cwe-079/StoredXSS.ql
index 0ff8236dee7..4061a7743ec 100644
--- a/ruby/ql/src/queries/security/cwe-079/StoredXSS.ql
+++ b/ruby/ql/src/queries/security/cwe-079/StoredXSS.ql
@@ -18,5 +18,5 @@ import DataFlow::PathGraph
 
 from StoredXss::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@",
+select sink.getNode(), source, sink, "Stored cross-site scripting vulnerability due to $@.",
   source.getNode(), "stored value"
diff --git a/ruby/ql/src/queries/security/cwe-094/CodeInjection.ql b/ruby/ql/src/queries/security/cwe-094/CodeInjection.ql
index c3b52409710..66074c408c2 100644
--- a/ruby/ql/src/queries/security/cwe-094/CodeInjection.ql
+++ b/ruby/ql/src/queries/security/cwe-094/CodeInjection.ql
@@ -22,5 +22,5 @@ from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink, S
 where
   config.hasFlowPath(source, sink) and
   sourceNode = source.getNode()
-select sink.getNode(), source, sink, "This code execution depends on $@.", sourceNode,
-  "a user-provided value"
+select sink.getNode(), source, sink, "$@ flows to here and is interpreted as code.",
+  source.getNode(), "User-provided value"
diff --git a/ruby/ql/src/queries/security/cwe-295/RequestWithoutValidation.ql b/ruby/ql/src/queries/security/cwe-295/RequestWithoutValidation.ql
index e9b236897bc..137bfc94163 100644
--- a/ruby/ql/src/queries/security/cwe-295/RequestWithoutValidation.ql
+++ b/ruby/ql/src/queries/security/cwe-295/RequestWithoutValidation.ql
@@ -15,6 +15,20 @@ import ruby
 import codeql.ruby.Concepts
 import codeql.ruby.DataFlow
 
-from HTTP::Client::Request request, DataFlow::Node disablingNode
-where request.disablesCertificateValidation(disablingNode)
-select request, "This request may run with $@.", disablingNode, "certificate validation disabled"
+from
+  Http::Client::Request request, DataFlow::Node disablingNode, DataFlow::Node origin, string ending
+where
+  request.disablesCertificateValidation(disablingNode, origin) and
+  // Showing the origin is only useful when it's a different node than the one disabling
+  // certificate validation, for example in `requests.get(..., verify=arg)`, `arg` would
+  // be the `disablingNode`, and the `origin` would be the place were `arg` got its
+  // value from.
+  //
+  // NOTE: We compare the locations instead of DataFlow::Nodes directly, since for
+  // snippet `Excon.defaults[:ssl_verify_peer] = false`, `disablingNode = argumentNode`
+  // does NOT hold.
+  if disablingNode.getLocation() = origin.getLocation()
+  then ending = "."
+  else ending = " by the value from $@."
+select request, "This request may run without certificate validation because it is $@" + ending,
+  disablingNode, "disabled here", origin, "here"
diff --git a/ruby/ql/src/queries/security/cwe-506/HardcodedDataInterpretedAsCode.qhelp b/ruby/ql/src/queries/security/cwe-506/HardcodedDataInterpretedAsCode.qhelp
new file mode 100644
index 00000000000..236cadc1742
--- /dev/null
+++ b/ruby/ql/src/queries/security/cwe-506/HardcodedDataInterpretedAsCode.qhelp
@@ -0,0 +1,47 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>
+Interpreting hard-coded data (such as string literals containing hexadecimal numbers)
+as code or as an import path is typical of malicious backdoor code that has been
+implanted into an otherwise trusted code base and is trying to hide its true purpose
+from casual readers or automated scanning tools.
+</p>
+</overview>
+
+<recommendation>
+<p>
+Examine the code in question carefully to ascertain its provenance and its true purpose.
+If the code is benign, it should always be possible to rewrite it without relying
+on dynamically interpreting data as code, improving both clarity and safety.
+</p>
+</recommendation>
+
+<example>
+<p>
+As an example of malicious code using this obfuscation technique, consider the
+following simplified Ruby version of a snippet of backdoor code that was
+discovered in a dependency of the popular JavaScript <code>event-stream</code>
+npm package:
+</p>
+<sample src="examples/HardcodedDataInterpretedAsCode.rb"/>
+<p>
+While this shows only the first few lines of code, it already looks very suspicious
+since it takes a hard-coded string literal, hex-decodes it and then uses it as an
+import path. The only reason to do so is to hide the name of the file being imported.
+</p>
+</example>
+
+<references>
+<li>
+OWASP:
+<a href="https://www.owasp.org/index.php/Trojan_Horse">Trojan Horse</a>.
+</li>
+<li>
+The npm Blog:
+<a href="https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident">Details about the event-stream incident</a>.
+</li>
+</references>
+
+</qhelp>
diff --git a/ruby/ql/src/queries/security/cwe-506/HardcodedDataInterpretedAsCode.ql b/ruby/ql/src/queries/security/cwe-506/HardcodedDataInterpretedAsCode.ql
new file mode 100644
index 00000000000..ead7dbeda08
--- /dev/null
+++ b/ruby/ql/src/queries/security/cwe-506/HardcodedDataInterpretedAsCode.ql
@@ -0,0 +1,23 @@
+/**
+ * @name Hard-coded data interpreted as code
+ * @description Transforming hard-coded data (such as hexadecimal constants) into code
+ *              to be executed is a technique often associated with backdoors and should
+ *              be avoided.
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 9.1
+ * @precision medium
+ * @id rb/hardcoded-data-interpreted-as-code
+ * @tags security
+ *       external/cwe/cwe-506
+ */
+
+import codeql.ruby.security.HardcodedDataInterpretedAsCodeQuery
+import codeql.ruby.DataFlow
+import DataFlow::PathGraph
+
+from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
+where cfg.hasFlowPath(source, sink)
+select sink.getNode(), source, sink,
+  "Hard-coded data from $@ is interpreted as " + sink.getNode().(Sink).getKind() + ".",
+  source.getNode(), "here"
diff --git a/ruby/ql/src/queries/security/cwe-506/examples/HardcodedDataInterpretedAsCode.rb b/ruby/ql/src/queries/security/cwe-506/examples/HardcodedDataInterpretedAsCode.rb
new file mode 100644
index 00000000000..96f82a6ff1f
--- /dev/null
+++ b/ruby/ql/src/queries/security/cwe-506/examples/HardcodedDataInterpretedAsCode.rb
@@ -0,0 +1,6 @@
+def e(r)
+  [r].pack 'H*'
+end
+
+# BAD: hexadecimal constant decoded and interpreted as import path
+require e("2e2f746573742f64617461")
diff --git a/ruby/ql/src/queries/security/cwe-611/Xxe.ql b/ruby/ql/src/queries/security/cwe-611/Xxe.ql
index c7eae21333e..8b4edfbee14 100644
--- a/ruby/ql/src/queries/security/cwe-611/Xxe.ql
+++ b/ruby/ql/src/queries/security/cwe-611/Xxe.ql
@@ -39,5 +39,6 @@ class XxeConfig extends TaintTracking::Configuration {
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, XxeConfig conf
 where conf.hasFlowPath(source, sink)
-select sink.getNode(), source, sink, "Unsafe parsing of XML file from $@.", source.getNode(),
-  "user input"
+select sink.getNode(), source, sink,
+  "A $@ is parsed as XML without guarding against external entity expansion.", source.getNode(),
+  "user-provided value"
diff --git a/ruby/ql/src/queries/variables/UnusedParameter.ql b/ruby/ql/src/queries/variables/UnusedParameter.ql
index 1aa1a6bc462..381d2c77a33 100644
--- a/ruby/ql/src/queries/variables/UnusedParameter.ql
+++ b/ruby/ql/src/queries/variables/UnusedParameter.ql
@@ -24,4 +24,4 @@ class RelevantParameterVariable extends LocalVariable {
 
 from RelevantParameterVariable v
 where not exists(Ssa::WriteDefinition def | def.getWriteAccess() = v.getDefiningAccess())
-select v, "Unused parameter."
+select v, "The parameter '" + v.getName() + "' is never used."
diff --git a/ruby/ql/test/library-tests/ast/Ast.expected b/ruby/ql/test/library-tests/ast/Ast.expected
index 4cb29e0f033..33229c64393 100644
--- a/ruby/ql/test/library-tests/ast/Ast.expected
+++ b/ruby/ql/test/library-tests/ast/Ast.expected
@@ -2260,12 +2260,8 @@ literals/literals.rb:
 #  189|     getAnOperand/getLeftOperand: [LocalVariableAccess] query
 #  189|     getAnOperand/getRightOperand: [HereDoc] <<'DOC'
 #  189|       getComponent: [StringTextComponent] 
-#  189|        text without 
-#  190|       getComponent: [StringInterpolationComponent] #{...}
-#  190|         getStmt: [MethodCall] call to interpolation
-#  190|           getReceiver: [SelfVariableAccess] self
-#  190|       getComponent: [StringTextComponent]  !
-#  190|       
+#  189|        text without #{ interpolation } !
+#  189|       
 #  193|   getStmt: [AssignExpr] ... = ...
 #  193|     getAnOperand/getLeftOperand: [LocalVariableAccess] output
 #  193|     getAnOperand/getRightOperand: [HereDoc] <<`SCRIPT`
@@ -2293,6 +2289,17 @@ literals/literals.rb:
 #  199|       getKey: [SymbolLiteral] :Z
 #  199|         getComponent: [StringTextComponent] Z
 #  199|       getValue: [ConstantReadAccess] Z
+#  201|   getStmt: [StringLiteral] "@foo: #{...} @@bar: #{...} $_..."
+#  201|     getComponent: [StringTextComponent] @foo: 
+#  201|     getComponent: [StringInterpolationComponent] #{...}
+#  201|       getStmt: [InstanceVariableAccess] @foo
+#  201|         getReceiver: [SelfVariableAccess] self
+#  201|     getComponent: [StringTextComponent]  @@bar: 
+#  201|     getComponent: [StringInterpolationComponent] #{...}
+#  201|       getStmt: [ClassVariableAccess] @@bar
+#  201|     getComponent: [StringTextComponent]  $_: 
+#  201|     getComponent: [StringInterpolationComponent] #{...}
+#  201|       getStmt: [GlobalVariableAccess] $_
 control/loops.rb:
 #    1| [Toplevel] loops.rb
 #    2|   getStmt: [AssignExpr] ... = ...
diff --git a/ruby/ql/test/library-tests/ast/TreeSitter.expected b/ruby/ql/test/library-tests/ast/TreeSitter.expected
index cb5a17ebebb..839ad55fb38 100644
--- a/ruby/ql/test/library-tests/ast/TreeSitter.expected
+++ b/ruby/ql/test/library-tests/ast/TreeSitter.expected
@@ -37,10 +37,11 @@ calls/calls.rb:
 #   17|         0: [ReservedWord] |
 #   17|         1: [Identifier] x
 #   17|         2: [ReservedWord] |
-#   17|       2: [Binary] Binary
-#   17|         0: [Identifier] x
-#   17|         1: [ReservedWord] +
-#   17|         2: [Integer] 1
+#   17|       2: [BlockBody] BlockBody
+#   17|         0: [Binary] Binary
+#   17|           0: [Identifier] x
+#   17|           1: [ReservedWord] +
+#   17|           2: [Integer] 1
 #   17|       3: [ReservedWord] }
 #   20|   6: [Call] Call
 #   20|     0: [Identifier] foo
@@ -50,10 +51,11 @@ calls/calls.rb:
 #   20|         0: [ReservedWord] |
 #   20|         1: [Identifier] x
 #   20|         2: [ReservedWord] |
-#   21|       2: [Binary] Binary
-#   21|         0: [Identifier] x
-#   21|         1: [ReservedWord] +
-#   21|         2: [Integer] 1
+#   21|       2: [BodyStatement] BodyStatement
+#   21|         0: [Binary] Binary
+#   21|           0: [Identifier] x
+#   21|           1: [ReservedWord] +
+#   21|           2: [Integer] 1
 #   22|       3: [ReservedWord] end
 #   25|   7: [Call] Call
 #   25|     0: [Integer] 123
@@ -72,26 +74,29 @@ calls/calls.rb:
 #   25|         0: [ReservedWord] |
 #   25|         1: [Identifier] x
 #   25|         2: [ReservedWord] |
-#   26|       2: [Binary] Binary
-#   26|         0: [Identifier] x
-#   26|         1: [ReservedWord] +
-#   26|         2: [Integer] 1
+#   26|       2: [BodyStatement] BodyStatement
+#   26|         0: [Binary] Binary
+#   26|           0: [Identifier] x
+#   26|           1: [ReservedWord] +
+#   26|           2: [Integer] 1
 #   27|       3: [ReservedWord] end
 #   30|   8: [Method] Method
 #   30|     0: [ReservedWord] def
 #   30|     1: [Identifier] method_that_yields
-#   31|     2: [Yield] Yield
-#   31|       0: [ReservedWord] yield
+#   31|     2: [BodyStatement] BodyStatement
+#   31|       0: [Yield] Yield
+#   31|         0: [ReservedWord] yield
 #   32|     3: [ReservedWord] end
 #   35|   9: [Method] Method
 #   35|     0: [ReservedWord] def
 #   35|     1: [Identifier] another_method_that_yields
-#   36|     2: [Yield] Yield
-#   36|       0: [ReservedWord] yield
-#   36|       1: [ArgumentList] ArgumentList
-#   36|         0: [Integer] 100
-#   36|         1: [ReservedWord] ,
-#   36|         2: [Integer] 200
+#   36|     2: [BodyStatement] BodyStatement
+#   36|       0: [Yield] Yield
+#   36|         0: [ReservedWord] yield
+#   36|         1: [ArgumentList] ArgumentList
+#   36|           0: [Integer] 100
+#   36|           1: [ReservedWord] ,
+#   36|           2: [Integer] 200
 #   37|     3: [ReservedWord] end
 #   46|   10: [Identifier] foo
 #   47|   11: [Call] Call
@@ -218,13 +223,14 @@ calls/calls.rb:
 #   92|       1: [ReservedWord] )
 #   92|     2: [Block] Block
 #   92|       0: [ReservedWord] {
-#   92|       1: [Identifier] bar
-#   92|       2: [ReservedWord] ;
-#   92|       3: [Call] Call
-#   92|         0: [Constant] X
-#   92|         1: [ReservedWord] ::
-#   92|         2: [Identifier] baz
-#   92|       4: [ReservedWord] }
+#   92|       1: [BlockBody] BlockBody
+#   92|         0: [Identifier] bar
+#   92|         1: [ReservedWord] ;
+#   92|         2: [Call] Call
+#   92|           0: [Constant] X
+#   92|           1: [ReservedWord] ::
+#   92|           2: [Identifier] baz
+#   92|       2: [ReservedWord] }
 #   95|   30: [Call] Call
 #   95|     0: [Identifier] foo
 #   95|     1: [ArgumentList] ArgumentList
@@ -232,12 +238,13 @@ calls/calls.rb:
 #   95|       1: [ReservedWord] )
 #   95|     2: [DoBlock] DoBlock
 #   95|       0: [ReservedWord] do
-#   96|       1: [Identifier] bar
-#   97|       2: [Call] Call
-#   97|         0: [Constant] X
-#   97|         1: [ReservedWord] ::
-#   97|         2: [Identifier] baz
-#   98|       3: [ReservedWord] end
+#   96|       1: [BodyStatement] BodyStatement
+#   96|         0: [Identifier] bar
+#   97|         1: [Call] Call
+#   97|           0: [Constant] X
+#   97|           1: [ReservedWord] ::
+#   97|           2: [Identifier] baz
+#   98|       2: [ReservedWord] end
 #  101|   31: [Call] Call
 #  101|     0: [Identifier] foo
 #  101|     1: [ReservedWord] .
@@ -284,12 +291,13 @@ calls/calls.rb:
 #  116|   35: [Class] Class
 #  116|     0: [ReservedWord] class
 #  116|     1: [Constant] MyClass
-#  117|     2: [Identifier] foo
-#  118|     3: [Call] Call
-#  118|       0: [Constant] X
-#  118|       1: [ReservedWord] ::
-#  118|       2: [Identifier] bar
-#  119|     4: [ReservedWord] end
+#  117|     2: [BodyStatement] BodyStatement
+#  117|       0: [Identifier] foo
+#  118|       1: [Call] Call
+#  118|         0: [Constant] X
+#  118|         1: [ReservedWord] ::
+#  118|         2: [Identifier] bar
+#  119|     3: [ReservedWord] end
 #  122|   36: [Class] Class
 #  122|     0: [ReservedWord] class
 #  122|     1: [Constant] MyClass
@@ -311,7 +319,8 @@ calls/calls.rb:
 #  128|     0: [ReservedWord] class
 #  128|     1: [ReservedWord] <<
 #  128|     2: [Identifier] foo
-#  129|     3: [Identifier] bar
+#  129|     3: [BodyStatement] BodyStatement
+#  129|       0: [Identifier] bar
 #  130|     4: [ReservedWord] end
 #  131|   39: [SingletonClass] SingletonClass
 #  131|     0: [ReservedWord] class
@@ -320,31 +329,34 @@ calls/calls.rb:
 #  131|       0: [Constant] X
 #  131|       1: [ReservedWord] ::
 #  131|       2: [Identifier] foo
-#  132|     3: [Call] Call
-#  132|       0: [Constant] X
-#  132|       1: [ReservedWord] ::
-#  132|       2: [Identifier] bar
+#  132|     3: [BodyStatement] BodyStatement
+#  132|       0: [Call] Call
+#  132|         0: [Constant] X
+#  132|         1: [ReservedWord] ::
+#  132|         2: [Identifier] bar
 #  133|     4: [ReservedWord] end
 #  136|   40: [Method] Method
 #  136|     0: [ReservedWord] def
 #  136|     1: [Identifier] some_method
-#  137|     2: [Identifier] foo
-#  138|     3: [Call] Call
-#  138|       0: [Constant] X
-#  138|       1: [ReservedWord] ::
-#  138|       2: [Identifier] bar
-#  139|     4: [ReservedWord] end
+#  137|     2: [BodyStatement] BodyStatement
+#  137|       0: [Identifier] foo
+#  138|       1: [Call] Call
+#  138|         0: [Constant] X
+#  138|         1: [ReservedWord] ::
+#  138|         2: [Identifier] bar
+#  139|     3: [ReservedWord] end
 #  142|   41: [SingletonMethod] SingletonMethod
 #  142|     0: [ReservedWord] def
 #  142|     1: [Identifier] foo
 #  142|     2: [ReservedWord] .
 #  142|     3: [Identifier] some_method
-#  143|     4: [Identifier] bar
-#  144|     5: [Call] Call
-#  144|       0: [Constant] X
-#  144|       1: [ReservedWord] ::
-#  144|       2: [Identifier] baz
-#  145|     6: [ReservedWord] end
+#  143|     4: [BodyStatement] BodyStatement
+#  143|       0: [Identifier] bar
+#  144|       1: [Call] Call
+#  144|         0: [Constant] X
+#  144|         1: [ReservedWord] ::
+#  144|         2: [Identifier] baz
+#  145|     5: [ReservedWord] end
 #  148|   42: [Method] Method
 #  148|     0: [ReservedWord] def
 #  148|     1: [Identifier] method_with_keyword_param
@@ -398,12 +410,13 @@ calls/calls.rb:
 #  160|   46: [Module] Module
 #  160|     0: [ReservedWord] module
 #  160|     1: [Constant] SomeModule
-#  161|     2: [Identifier] foo
-#  162|     3: [Call] Call
-#  162|       0: [Constant] X
-#  162|       1: [ReservedWord] ::
-#  162|       2: [Identifier] bar
-#  163|     4: [ReservedWord] end
+#  161|     2: [BodyStatement] BodyStatement
+#  161|       0: [Identifier] foo
+#  162|       1: [Call] Call
+#  162|         0: [Constant] X
+#  162|         1: [ReservedWord] ::
+#  162|         2: [Identifier] bar
+#  163|     3: [ReservedWord] end
 #  166|   47: [Conditional] Conditional
 #  166|     0: [Identifier] foo
 #  166|     1: [ReservedWord] ?
@@ -809,111 +822,119 @@ calls/calls.rb:
 #  284|   88: [Class] Class
 #  284|     0: [ReservedWord] class
 #  284|     1: [Constant] MyClass
-#  285|     2: [Method] Method
-#  285|       0: [ReservedWord] def
-#  285|       1: [Identifier] my_method
-#  286|       2: [Super] super
-#  287|       3: [Call] Call
-#  287|         0: [Super] super
-#  287|         1: [ArgumentList] ArgumentList
-#  287|           0: [ReservedWord] (
-#  287|           1: [ReservedWord] )
-#  288|       4: [Call] Call
-#  288|         0: [Super] super
-#  288|         1: [ArgumentList] ArgumentList
-#  288|           0: [String] String
-#  288|             0: [ReservedWord] '
-#  288|             1: [StringContent] blah
-#  288|             2: [ReservedWord] '
-#  289|       5: [Call] Call
-#  289|         0: [Super] super
-#  289|         1: [ArgumentList] ArgumentList
-#  289|           0: [Integer] 1
-#  289|           1: [ReservedWord] ,
-#  289|           2: [Integer] 2
-#  289|           3: [ReservedWord] ,
-#  289|           4: [Integer] 3
-#  290|       6: [Call] Call
-#  290|         0: [Super] super
-#  290|         1: [Block] Block
-#  290|           0: [ReservedWord] {
-#  290|           1: [BlockParameters] BlockParameters
-#  290|             0: [ReservedWord] |
-#  290|             1: [Identifier] x
-#  290|             2: [ReservedWord] |
-#  290|           2: [Binary] Binary
-#  290|             0: [Identifier] x
-#  290|             1: [ReservedWord] +
-#  290|             2: [Integer] 1
-#  290|           3: [ReservedWord] }
-#  291|       7: [Call] Call
-#  291|         0: [Super] super
-#  291|         1: [DoBlock] DoBlock
-#  291|           0: [ReservedWord] do
-#  291|           1: [BlockParameters] BlockParameters
-#  291|             0: [ReservedWord] |
-#  291|             1: [Identifier] x
-#  291|             2: [ReservedWord] |
-#  291|           2: [Binary] Binary
-#  291|             0: [Identifier] x
-#  291|             1: [ReservedWord] *
-#  291|             2: [Integer] 2
-#  291|           3: [ReservedWord] end
-#  292|       8: [Call] Call
-#  292|         0: [Super] super
-#  292|         1: [ArgumentList] ArgumentList
-#  292|           0: [Integer] 4
-#  292|           1: [ReservedWord] ,
-#  292|           2: [Integer] 5
-#  292|         2: [Block] Block
-#  292|           0: [ReservedWord] {
-#  292|           1: [BlockParameters] BlockParameters
-#  292|             0: [ReservedWord] |
-#  292|             1: [Identifier] x
-#  292|             2: [ReservedWord] |
-#  292|           2: [Binary] Binary
-#  292|             0: [Identifier] x
-#  292|             1: [ReservedWord] +
-#  292|             2: [Integer] 100
-#  292|           3: [ReservedWord] }
-#  293|       9: [Call] Call
-#  293|         0: [Super] super
-#  293|         1: [ArgumentList] ArgumentList
-#  293|           0: [Integer] 6
-#  293|           1: [ReservedWord] ,
-#  293|           2: [Integer] 7
-#  293|         2: [DoBlock] DoBlock
-#  293|           0: [ReservedWord] do
-#  293|           1: [BlockParameters] BlockParameters
-#  293|             0: [ReservedWord] |
-#  293|             1: [Identifier] x
-#  293|             2: [ReservedWord] |
-#  293|           2: [Binary] Binary
-#  293|             0: [Identifier] x
-#  293|             1: [ReservedWord] +
-#  293|             2: [Integer] 200
-#  293|           3: [ReservedWord] end
-#  294|       10: [ReservedWord] end
+#  285|     2: [BodyStatement] BodyStatement
+#  285|       0: [Method] Method
+#  285|         0: [ReservedWord] def
+#  285|         1: [Identifier] my_method
+#  286|         2: [BodyStatement] BodyStatement
+#  286|           0: [Super] super
+#  287|           1: [Call] Call
+#  287|             0: [Super] super
+#  287|             1: [ArgumentList] ArgumentList
+#  287|               0: [ReservedWord] (
+#  287|               1: [ReservedWord] )
+#  288|           2: [Call] Call
+#  288|             0: [Super] super
+#  288|             1: [ArgumentList] ArgumentList
+#  288|               0: [String] String
+#  288|                 0: [ReservedWord] '
+#  288|                 1: [StringContent] blah
+#  288|                 2: [ReservedWord] '
+#  289|           3: [Call] Call
+#  289|             0: [Super] super
+#  289|             1: [ArgumentList] ArgumentList
+#  289|               0: [Integer] 1
+#  289|               1: [ReservedWord] ,
+#  289|               2: [Integer] 2
+#  289|               3: [ReservedWord] ,
+#  289|               4: [Integer] 3
+#  290|           4: [Call] Call
+#  290|             0: [Super] super
+#  290|             1: [Block] Block
+#  290|               0: [ReservedWord] {
+#  290|               1: [BlockParameters] BlockParameters
+#  290|                 0: [ReservedWord] |
+#  290|                 1: [Identifier] x
+#  290|                 2: [ReservedWord] |
+#  290|               2: [BlockBody] BlockBody
+#  290|                 0: [Binary] Binary
+#  290|                   0: [Identifier] x
+#  290|                   1: [ReservedWord] +
+#  290|                   2: [Integer] 1
+#  290|               3: [ReservedWord] }
+#  291|           5: [Call] Call
+#  291|             0: [Super] super
+#  291|             1: [DoBlock] DoBlock
+#  291|               0: [ReservedWord] do
+#  291|               1: [BlockParameters] BlockParameters
+#  291|                 0: [ReservedWord] |
+#  291|                 1: [Identifier] x
+#  291|                 2: [ReservedWord] |
+#  291|               2: [BodyStatement] BodyStatement
+#  291|                 0: [Binary] Binary
+#  291|                   0: [Identifier] x
+#  291|                   1: [ReservedWord] *
+#  291|                   2: [Integer] 2
+#  291|               3: [ReservedWord] end
+#  292|           6: [Call] Call
+#  292|             0: [Super] super
+#  292|             1: [ArgumentList] ArgumentList
+#  292|               0: [Integer] 4
+#  292|               1: [ReservedWord] ,
+#  292|               2: [Integer] 5
+#  292|             2: [Block] Block
+#  292|               0: [ReservedWord] {
+#  292|               1: [BlockParameters] BlockParameters
+#  292|                 0: [ReservedWord] |
+#  292|                 1: [Identifier] x
+#  292|                 2: [ReservedWord] |
+#  292|               2: [BlockBody] BlockBody
+#  292|                 0: [Binary] Binary
+#  292|                   0: [Identifier] x
+#  292|                   1: [ReservedWord] +
+#  292|                   2: [Integer] 100
+#  292|               3: [ReservedWord] }
+#  293|           7: [Call] Call
+#  293|             0: [Super] super
+#  293|             1: [ArgumentList] ArgumentList
+#  293|               0: [Integer] 6
+#  293|               1: [ReservedWord] ,
+#  293|               2: [Integer] 7
+#  293|             2: [DoBlock] DoBlock
+#  293|               0: [ReservedWord] do
+#  293|               1: [BlockParameters] BlockParameters
+#  293|                 0: [ReservedWord] |
+#  293|                 1: [Identifier] x
+#  293|                 2: [ReservedWord] |
+#  293|               2: [BodyStatement] BodyStatement
+#  293|                 0: [Binary] Binary
+#  293|                   0: [Identifier] x
+#  293|                   1: [ReservedWord] +
+#  293|                   2: [Integer] 200
+#  293|               3: [ReservedWord] end
+#  294|         3: [ReservedWord] end
 #  295|     3: [ReservedWord] end
 #  301|   89: [Class] Class
 #  301|     0: [ReservedWord] class
 #  301|     1: [Constant] AnotherClass
-#  302|     2: [Method] Method
-#  302|       0: [ReservedWord] def
-#  302|       1: [Identifier] another_method
-#  303|       2: [Call] Call
-#  303|         0: [Identifier] foo
-#  303|         1: [ReservedWord] .
-#  303|         2: [Identifier] super
-#  304|       3: [Call] Call
-#  304|         0: [Self] self
-#  304|         1: [ReservedWord] .
-#  304|         2: [Identifier] super
-#  305|       4: [Call] Call
-#  305|         0: [Super] super
-#  305|         1: [ReservedWord] .
-#  305|         2: [Identifier] super
-#  306|       5: [ReservedWord] end
+#  302|     2: [BodyStatement] BodyStatement
+#  302|       0: [Method] Method
+#  302|         0: [ReservedWord] def
+#  302|         1: [Identifier] another_method
+#  303|         2: [BodyStatement] BodyStatement
+#  303|           0: [Call] Call
+#  303|             0: [Identifier] foo
+#  303|             1: [ReservedWord] .
+#  303|             2: [Identifier] super
+#  304|           1: [Call] Call
+#  304|             0: [Self] self
+#  304|             1: [ReservedWord] .
+#  304|             2: [Identifier] super
+#  305|           2: [Call] Call
+#  305|             0: [Super] super
+#  305|             1: [ReservedWord] .
+#  305|             2: [Identifier] super
+#  306|         3: [ReservedWord] end
 #  307|     3: [ReservedWord] end
 #  310|   90: [Call] Call
 #  310|     0: [Identifier] foo
@@ -1100,13 +1121,14 @@ calls/calls.rb:
 #  331|       1: [ForwardParameter] ...
 #  331|         0: [ReservedWord] ...
 #  331|       2: [ReservedWord] )
-#  332|     3: [Call] Call
-#  332|       0: [Super] super
-#  332|       1: [ArgumentList] ArgumentList
-#  332|         0: [ReservedWord] (
-#  332|         1: [ForwardArgument] ...
-#  332|           0: [ReservedWord] ...
-#  332|         2: [ReservedWord] )
+#  332|     3: [BodyStatement] BodyStatement
+#  332|       0: [Call] Call
+#  332|         0: [Super] super
+#  332|         1: [ArgumentList] ArgumentList
+#  332|           0: [ReservedWord] (
+#  332|           1: [ForwardArgument] ...
+#  332|             0: [ReservedWord] ...
+#  332|           2: [ReservedWord] )
 #  333|     4: [ReservedWord] end
 #  335|   106: [Method] Method
 #  335|     0: [ReservedWord] def
@@ -1120,15 +1142,16 @@ calls/calls.rb:
 #  335|       5: [ForwardParameter] ...
 #  335|         0: [ReservedWord] ...
 #  335|       6: [ReservedWord] )
-#  336|     3: [Call] Call
-#  336|       0: [Identifier] bar
-#  336|       1: [ArgumentList] ArgumentList
-#  336|         0: [ReservedWord] (
-#  336|         1: [Identifier] b
-#  336|         2: [ReservedWord] ,
-#  336|         3: [ForwardArgument] ...
-#  336|           0: [ReservedWord] ...
-#  336|         4: [ReservedWord] )
+#  336|     3: [BodyStatement] BodyStatement
+#  336|       0: [Call] Call
+#  336|         0: [Identifier] bar
+#  336|         1: [ArgumentList] ArgumentList
+#  336|           0: [ReservedWord] (
+#  336|           1: [Identifier] b
+#  336|           2: [ReservedWord] ,
+#  336|           3: [ForwardArgument] ...
+#  336|             0: [ReservedWord] ...
+#  336|           4: [ReservedWord] )
 #  337|     4: [ReservedWord] end
 #  340|   107: [For] For
 #  340|     0: [ReservedWord] for
@@ -1223,7 +1246,8 @@ calls/calls.rb:
 #  351|         2: [ReservedWord] )
 #  351|       2: [Block] Block
 #  351|         0: [ReservedWord] {
-#  351|         1: [Identifier] y
+#  351|         1: [BlockBody] BlockBody
+#  351|           0: [Identifier] y
 #  351|         2: [ReservedWord] }
 #  352|   114: [Assignment] Assignment
 #  352|     0: [Identifier] f
@@ -1236,10 +1260,11 @@ calls/calls.rb:
 #  352|         2: [ReservedWord] )
 #  352|       2: [Block] Block
 #  352|         0: [ReservedWord] {
-#  352|         1: [Call] Call
-#  352|           0: [Identifier] foo
-#  352|           1: [ArgumentList] ArgumentList
-#  352|             0: [Identifier] x
+#  352|         1: [BlockBody] BlockBody
+#  352|           0: [Call] Call
+#  352|             0: [Identifier] foo
+#  352|             1: [ArgumentList] ArgumentList
+#  352|               0: [Identifier] x
 #  352|         2: [ReservedWord] }
 #  353|   115: [Assignment] Assignment
 #  353|     0: [Identifier] g
@@ -1252,7 +1277,8 @@ calls/calls.rb:
 #  353|         2: [ReservedWord] )
 #  353|       2: [Block] Block
 #  353|         0: [ReservedWord] {
-#  353|         1: [Identifier] unknown_call
+#  353|         1: [BlockBody] BlockBody
+#  353|           0: [Identifier] unknown_call
 #  353|         2: [ReservedWord] }
 #  354|   116: [Assignment] Assignment
 #  354|     0: [Identifier] h
@@ -1265,10 +1291,11 @@ calls/calls.rb:
 #  354|         2: [ReservedWord] )
 #  354|       2: [DoBlock] DoBlock
 #  354|         0: [ReservedWord] do
-#  355|         1: [Identifier] x
-#  356|         2: [Identifier] y
-#  357|         3: [Identifier] unknown_call
-#  358|         4: [ReservedWord] end
+#  355|         1: [BodyStatement] BodyStatement
+#  355|           0: [Identifier] x
+#  356|           1: [Identifier] y
+#  357|           2: [Identifier] unknown_call
+#  358|         2: [ReservedWord] end
 #  361|   117: [Call] Call
 #  361|     0: [Identifier] list
 #  361|     1: [ReservedWord] .
@@ -1297,7 +1324,8 @@ calls/calls.rb:
 #  364|         0: [ReservedWord] |
 #  364|         1: [Identifier] x
 #  364|         2: [ReservedWord] |
-#  364|       2: [Identifier] x
+#  364|       2: [BlockBody] BlockBody
+#  364|         0: [Identifier] x
 #  364|       3: [ReservedWord] }
 #    1| [Comment] # call with no receiver, arguments, or block
 #    4| [Comment] # call whose name is a scope resolution
@@ -1378,49 +1406,52 @@ constants/constants.rb:
 #    1|   0: [Module] Module
 #    1|     0: [ReservedWord] module
 #    1|     1: [Constant] ModuleA
-#    2|     2: [Class] Class
-#    2|       0: [ReservedWord] class
-#    2|       1: [Constant] ClassA
-#    3|       2: [Assignment] Assignment
-#    3|         0: [Constant] CONST_A
-#    3|         1: [ReservedWord] =
-#    3|         2: [String] String
-#    3|           0: [ReservedWord] "
-#    3|           1: [StringContent] const_a
-#    3|           2: [ReservedWord] "
-#    4|       3: [ReservedWord] end
-#    6|     3: [Assignment] Assignment
-#    6|       0: [Constant] CONST_B
-#    6|       1: [ReservedWord] =
-#    6|       2: [String] String
-#    6|         0: [ReservedWord] "
-#    6|         1: [StringContent] const_b
-#    6|         2: [ReservedWord] "
-#    8|     4: [Module] Module
-#    8|       0: [ReservedWord] module
-#    8|       1: [Constant] ModuleB
-#    9|       2: [Class] Class
-#    9|         0: [ReservedWord] class
-#    9|         1: [Constant] ClassB
-#    9|         2: [Superclass] Superclass
-#    9|           0: [ReservedWord] <
-#    9|           1: [Constant] Base
-#   10|         3: [ReservedWord] end
-#   12|       3: [Class] Class
-#   12|         0: [ReservedWord] class
-#   12|         1: [Constant] ClassC
-#   12|         2: [Superclass] Superclass
-#   12|           0: [ReservedWord] <
-#   12|           1: [ScopeResolution] ScopeResolution
-#   12|             0: [ScopeResolution] ScopeResolution
-#   12|               0: [Constant] X
-#   12|               1: [ReservedWord] ::
-#   12|               2: [Constant] Y
-#   12|             1: [ReservedWord] ::
-#   12|             2: [Constant] Z
-#   13|         3: [ReservedWord] end
-#   14|       4: [ReservedWord] end
-#   15|     5: [ReservedWord] end
+#    2|     2: [BodyStatement] BodyStatement
+#    2|       0: [Class] Class
+#    2|         0: [ReservedWord] class
+#    2|         1: [Constant] ClassA
+#    3|         2: [BodyStatement] BodyStatement
+#    3|           0: [Assignment] Assignment
+#    3|             0: [Constant] CONST_A
+#    3|             1: [ReservedWord] =
+#    3|             2: [String] String
+#    3|               0: [ReservedWord] "
+#    3|               1: [StringContent] const_a
+#    3|               2: [ReservedWord] "
+#    4|         3: [ReservedWord] end
+#    6|       1: [Assignment] Assignment
+#    6|         0: [Constant] CONST_B
+#    6|         1: [ReservedWord] =
+#    6|         2: [String] String
+#    6|           0: [ReservedWord] "
+#    6|           1: [StringContent] const_b
+#    6|           2: [ReservedWord] "
+#    8|       2: [Module] Module
+#    8|         0: [ReservedWord] module
+#    8|         1: [Constant] ModuleB
+#    9|         2: [BodyStatement] BodyStatement
+#    9|           0: [Class] Class
+#    9|             0: [ReservedWord] class
+#    9|             1: [Constant] ClassB
+#    9|             2: [Superclass] Superclass
+#    9|               0: [ReservedWord] <
+#    9|               1: [Constant] Base
+#   10|             3: [ReservedWord] end
+#   12|           1: [Class] Class
+#   12|             0: [ReservedWord] class
+#   12|             1: [Constant] ClassC
+#   12|             2: [Superclass] Superclass
+#   12|               0: [ReservedWord] <
+#   12|               1: [ScopeResolution] ScopeResolution
+#   12|                 0: [ScopeResolution] ScopeResolution
+#   12|                   0: [Constant] X
+#   12|                   1: [ReservedWord] ::
+#   12|                   2: [Constant] Y
+#   12|                 1: [ReservedWord] ::
+#   12|                 2: [Constant] Z
+#   13|             3: [ReservedWord] end
+#   14|         3: [ReservedWord] end
+#   15|     3: [ReservedWord] end
 #   17|   1: [Assignment] Assignment
 #   17|     0: [Constant] GREETING
 #   17|     1: [ReservedWord] =
@@ -1446,62 +1477,64 @@ constants/constants.rb:
 #   19|   2: [Method] Method
 #   19|     0: [ReservedWord] def
 #   19|     1: [Identifier] foo
-#   20|     2: [Assignment] Assignment
-#   20|       0: [Constant] Names
-#   20|       1: [ReservedWord] =
-#   20|       2: [Array] Array
-#   20|         0: [ReservedWord] [
-#   20|         1: [String] String
-#   20|           0: [ReservedWord] '
-#   20|           1: [StringContent] Vera
-#   20|           2: [ReservedWord] '
-#   20|         2: [ReservedWord] ,
-#   20|         3: [String] String
-#   20|           0: [ReservedWord] '
-#   20|           1: [StringContent] Chuck
-#   20|           2: [ReservedWord] '
-#   20|         4: [ReservedWord] ,
-#   20|         5: [String] String
-#   20|           0: [ReservedWord] '
-#   20|           1: [StringContent] Dave
-#   20|           2: [ReservedWord] '
-#   20|         6: [ReservedWord] ]
-#   22|     3: [Call] Call
-#   22|       0: [Constant] Names
-#   22|       1: [ReservedWord] .
-#   22|       2: [Identifier] each
-#   22|       3: [DoBlock] DoBlock
-#   22|         0: [ReservedWord] do
-#   22|         1: [BlockParameters] BlockParameters
-#   22|           0: [ReservedWord] |
-#   22|           1: [Identifier] name
-#   22|           2: [ReservedWord] |
-#   23|         2: [Call] Call
-#   23|           0: [Identifier] puts
-#   23|           1: [ArgumentList] ArgumentList
-#   23|             0: [String] String
-#   23|               0: [ReservedWord] "
-#   23|               1: [Interpolation] Interpolation
-#   23|                 0: [ReservedWord] #{
-#   23|                 1: [Constant] GREETING
-#   23|                 2: [ReservedWord] }
-#   23|               2: [StringContent]  
-#   23|               3: [Interpolation] Interpolation
-#   23|                 0: [ReservedWord] #{
-#   23|                 1: [Identifier] name
-#   23|                 2: [ReservedWord] }
-#   23|               4: [ReservedWord] "
-#   24|         3: [ReservedWord] end
-#   28|     4: [Call] Call
-#   28|       0: [Constant] Array
-#   28|       1: [ArgumentList] ArgumentList
-#   28|         0: [ReservedWord] (
-#   28|         1: [String] String
-#   28|           0: [ReservedWord] '
-#   28|           1: [StringContent] foo
-#   28|           2: [ReservedWord] '
-#   28|         2: [ReservedWord] )
-#   29|     5: [ReservedWord] end
+#   20|     2: [BodyStatement] BodyStatement
+#   20|       0: [Assignment] Assignment
+#   20|         0: [Constant] Names
+#   20|         1: [ReservedWord] =
+#   20|         2: [Array] Array
+#   20|           0: [ReservedWord] [
+#   20|           1: [String] String
+#   20|             0: [ReservedWord] '
+#   20|             1: [StringContent] Vera
+#   20|             2: [ReservedWord] '
+#   20|           2: [ReservedWord] ,
+#   20|           3: [String] String
+#   20|             0: [ReservedWord] '
+#   20|             1: [StringContent] Chuck
+#   20|             2: [ReservedWord] '
+#   20|           4: [ReservedWord] ,
+#   20|           5: [String] String
+#   20|             0: [ReservedWord] '
+#   20|             1: [StringContent] Dave
+#   20|             2: [ReservedWord] '
+#   20|           6: [ReservedWord] ]
+#   22|       1: [Call] Call
+#   22|         0: [Constant] Names
+#   22|         1: [ReservedWord] .
+#   22|         2: [Identifier] each
+#   22|         3: [DoBlock] DoBlock
+#   22|           0: [ReservedWord] do
+#   22|           1: [BlockParameters] BlockParameters
+#   22|             0: [ReservedWord] |
+#   22|             1: [Identifier] name
+#   22|             2: [ReservedWord] |
+#   23|           2: [BodyStatement] BodyStatement
+#   23|             0: [Call] Call
+#   23|               0: [Identifier] puts
+#   23|               1: [ArgumentList] ArgumentList
+#   23|                 0: [String] String
+#   23|                   0: [ReservedWord] "
+#   23|                   1: [Interpolation] Interpolation
+#   23|                     0: [ReservedWord] #{
+#   23|                     1: [Constant] GREETING
+#   23|                     2: [ReservedWord] }
+#   23|                   2: [StringContent]  
+#   23|                   3: [Interpolation] Interpolation
+#   23|                     0: [ReservedWord] #{
+#   23|                     1: [Identifier] name
+#   23|                     2: [ReservedWord] }
+#   23|                   4: [ReservedWord] "
+#   24|           3: [ReservedWord] end
+#   28|       2: [Call] Call
+#   28|         0: [Constant] Array
+#   28|         1: [ArgumentList] ArgumentList
+#   28|           0: [ReservedWord] (
+#   28|           1: [String] String
+#   28|             0: [ReservedWord] '
+#   28|             1: [StringContent] foo
+#   28|             2: [ReservedWord] '
+#   28|           2: [ReservedWord] )
+#   29|     3: [ReservedWord] end
 #   31|   3: [Class] Class
 #   31|     0: [ReservedWord] class
 #   31|     1: [ScopeResolution] ScopeResolution
@@ -1514,10 +1547,11 @@ constants/constants.rb:
 #   31|         0: [Constant] ModuleA
 #   31|         1: [ReservedWord] ::
 #   31|         2: [Constant] ClassA
-#   32|     3: [Assignment] Assignment
-#   32|       0: [Constant] FOURTY_TWO
-#   32|       1: [ReservedWord] =
-#   32|       2: [Integer] 42
+#   32|     3: [BodyStatement] BodyStatement
+#   32|       0: [Assignment] Assignment
+#   32|         0: [Constant] FOURTY_TWO
+#   32|         1: [ReservedWord] =
+#   32|         2: [Integer] 42
 #   33|     4: [ReservedWord] end
 #   35|   4: [Module] Module
 #   35|     0: [ReservedWord] module
@@ -1525,10 +1559,11 @@ constants/constants.rb:
 #   35|       0: [Constant] ModuleA
 #   35|       1: [ReservedWord] ::
 #   35|       2: [Constant] ModuleC
-#   36|     2: [Assignment] Assignment
-#   36|       0: [Constant] FOURTY_THREE
-#   36|       1: [ReservedWord] =
-#   36|       2: [Integer] 43
+#   36|     2: [BodyStatement] BodyStatement
+#   36|       0: [Assignment] Assignment
+#   36|         0: [Constant] FOURTY_THREE
+#   36|         1: [ReservedWord] =
+#   36|         2: [Integer] 43
 #   37|     3: [ReservedWord] end
 #   39|   5: [Assignment] Assignment
 #   39|     0: [ScopeResolution] ScopeResolution
@@ -1566,96 +1601,104 @@ constants/constants.rb:
 #   46|       0: [Constant] ModuleA
 #   46|       1: [ReservedWord] ::
 #   46|       2: [Constant] ModuleB
-#   47|     2: [Class] Class
-#   47|       0: [ReservedWord] class
-#   47|       1: [Constant] ClassB
-#   47|       2: [Superclass] Superclass
-#   47|         0: [ReservedWord] <
-#   47|         1: [Constant] Base
-#   48|       3: [Assignment] Assignment
-#   48|         0: [Constant] FOURTY_ONE
-#   48|         1: [ReservedWord] =
-#   48|         2: [Integer] 41
-#   49|       4: [ReservedWord] end
+#   47|     2: [BodyStatement] BodyStatement
+#   47|       0: [Class] Class
+#   47|         0: [ReservedWord] class
+#   47|         1: [Constant] ClassB
+#   47|         2: [Superclass] Superclass
+#   47|           0: [ReservedWord] <
+#   47|           1: [Constant] Base
+#   48|         3: [BodyStatement] BodyStatement
+#   48|           0: [Assignment] Assignment
+#   48|             0: [Constant] FOURTY_ONE
+#   48|             1: [ReservedWord] =
+#   48|             2: [Integer] 41
+#   49|         4: [ReservedWord] end
 #   50|     3: [ReservedWord] end
 #   52|   10: [Module] Module
 #   52|     0: [ReservedWord] module
 #   52|     1: [Constant] ModuleA
-#   53|     2: [Assignment] Assignment
-#   53|       0: [Constant] FOURTY_FOUR
-#   53|       1: [ReservedWord] =
-#   53|       2: [String] String
-#   53|         0: [ReservedWord] "
-#   53|         1: [StringContent] fourty-four
-#   53|         2: [ReservedWord] "
-#   54|     3: [Class] Class
-#   54|       0: [ReservedWord] class
-#   54|       1: [ScopeResolution] ScopeResolution
-#   54|         0: [Constant] ModuleB
-#   54|         1: [ReservedWord] ::
-#   54|         2: [Constant] ClassB
-#   54|       2: [Superclass] Superclass
-#   54|         0: [ReservedWord] <
-#   54|         1: [Constant] Base
-#   55|       3: [Assignment] Assignment
-#   55|         0: [ClassVariable] @@fourty_four
-#   55|         1: [ReservedWord] =
-#   55|         2: [Constant] FOURTY_FOUR
-#   56|       4: [Assignment] Assignment
-#   56|         0: [Constant] FOURTY_FOUR
-#   56|         1: [ReservedWord] =
-#   56|         2: [Integer] 44
-#   57|       5: [Assignment] Assignment
-#   57|         0: [ClassVariable] @@fourty_four
-#   57|         1: [ReservedWord] =
-#   57|         2: [Constant] FOURTY_FOUR
-#   58|       6: [ReservedWord] end
-#   59|     4: [ReservedWord] end
+#   53|     2: [BodyStatement] BodyStatement
+#   53|       0: [Assignment] Assignment
+#   53|         0: [Constant] FOURTY_FOUR
+#   53|         1: [ReservedWord] =
+#   53|         2: [String] String
+#   53|           0: [ReservedWord] "
+#   53|           1: [StringContent] fourty-four
+#   53|           2: [ReservedWord] "
+#   54|       1: [Class] Class
+#   54|         0: [ReservedWord] class
+#   54|         1: [ScopeResolution] ScopeResolution
+#   54|           0: [Constant] ModuleB
+#   54|           1: [ReservedWord] ::
+#   54|           2: [Constant] ClassB
+#   54|         2: [Superclass] Superclass
+#   54|           0: [ReservedWord] <
+#   54|           1: [Constant] Base
+#   55|         3: [BodyStatement] BodyStatement
+#   55|           0: [Assignment] Assignment
+#   55|             0: [ClassVariable] @@fourty_four
+#   55|             1: [ReservedWord] =
+#   55|             2: [Constant] FOURTY_FOUR
+#   56|           1: [Assignment] Assignment
+#   56|             0: [Constant] FOURTY_FOUR
+#   56|             1: [ReservedWord] =
+#   56|             2: [Integer] 44
+#   57|           2: [Assignment] Assignment
+#   57|             0: [ClassVariable] @@fourty_four
+#   57|             1: [ReservedWord] =
+#   57|             2: [Constant] FOURTY_FOUR
+#   58|         4: [ReservedWord] end
+#   59|     3: [ReservedWord] end
 #   61|   11: [Module] Module
 #   61|     0: [ReservedWord] module
 #   61|     1: [Constant] Mod1
-#   62|     2: [Module] Module
-#   62|       0: [ReservedWord] module
-#   62|       1: [Constant] Mod3
-#   63|       2: [Assignment] Assignment
-#   63|         0: [Constant] FOURTY_FIVE
-#   63|         1: [ReservedWord] =
-#   63|         2: [Integer] 45
-#   64|       3: [ReservedWord] end
-#   65|     3: [Assignment] Assignment
-#   65|       0: [ClassVariable] @@fourty_five
-#   65|       1: [ReservedWord] =
-#   65|       2: [ScopeResolution] ScopeResolution
-#   65|         0: [Constant] Mod3
-#   65|         1: [ReservedWord] ::
-#   65|         2: [Constant] FOURTY_FIVE
-#   66|     4: [ReservedWord] end
+#   62|     2: [BodyStatement] BodyStatement
+#   62|       0: [Module] Module
+#   62|         0: [ReservedWord] module
+#   62|         1: [Constant] Mod3
+#   63|         2: [BodyStatement] BodyStatement
+#   63|           0: [Assignment] Assignment
+#   63|             0: [Constant] FOURTY_FIVE
+#   63|             1: [ReservedWord] =
+#   63|             2: [Integer] 45
+#   64|         3: [ReservedWord] end
+#   65|       1: [Assignment] Assignment
+#   65|         0: [ClassVariable] @@fourty_five
+#   65|         1: [ReservedWord] =
+#   65|         2: [ScopeResolution] ScopeResolution
+#   65|           0: [Constant] Mod3
+#   65|           1: [ReservedWord] ::
+#   65|           2: [Constant] FOURTY_FIVE
+#   66|     3: [ReservedWord] end
 #   68|   12: [Module] Module
 #   68|     0: [ReservedWord] module
 #   68|     1: [Constant] Mod4
-#   69|     2: [Call] Call
-#   69|       0: [Identifier] include
-#   69|       1: [ArgumentList] ArgumentList
-#   69|         0: [Constant] Mod1
-#   70|     3: [Module] Module
-#   70|       0: [ReservedWord] module
-#   70|       1: [ScopeResolution] ScopeResolution
-#   70|         0: [Constant] Mod3
-#   70|         1: [ReservedWord] ::
-#   70|         2: [Constant] Mod5
-#   71|       2: [Assignment] Assignment
-#   71|         0: [Constant] FOURTY_SIX
-#   71|         1: [ReservedWord] =
-#   71|         2: [Integer] 46
-#   72|       3: [ReservedWord] end
-#   73|     4: [Assignment] Assignment
-#   73|       0: [ClassVariable] @@fourty_six
-#   73|       1: [ReservedWord] =
-#   73|       2: [ScopeResolution] ScopeResolution
-#   73|         0: [Constant] Mod3
-#   73|         1: [ReservedWord] ::
-#   73|         2: [Constant] FOURTY_SIX
-#   74|     5: [ReservedWord] end
+#   69|     2: [BodyStatement] BodyStatement
+#   69|       0: [Call] Call
+#   69|         0: [Identifier] include
+#   69|         1: [ArgumentList] ArgumentList
+#   69|           0: [Constant] Mod1
+#   70|       1: [Module] Module
+#   70|         0: [ReservedWord] module
+#   70|         1: [ScopeResolution] ScopeResolution
+#   70|           0: [Constant] Mod3
+#   70|           1: [ReservedWord] ::
+#   70|           2: [Constant] Mod5
+#   71|         2: [BodyStatement] BodyStatement
+#   71|           0: [Assignment] Assignment
+#   71|             0: [Constant] FOURTY_SIX
+#   71|             1: [ReservedWord] =
+#   71|             2: [Integer] 46
+#   72|         3: [ReservedWord] end
+#   73|       2: [Assignment] Assignment
+#   73|         0: [ClassVariable] @@fourty_six
+#   73|         1: [ReservedWord] =
+#   73|         2: [ScopeResolution] ScopeResolution
+#   73|           0: [Constant] Mod3
+#   73|           1: [ReservedWord] ::
+#   73|           2: [Constant] FOURTY_SIX
+#   74|     3: [ReservedWord] end
 #   78|   13: [Assignment] Assignment
 #   78|     0: [Identifier] a
 #   78|     1: [ReservedWord] =
@@ -2318,10 +2361,11 @@ control/cases.rb:
 #  101|           0: [Identifier] x
 #  101|         2: [Block] Block
 #  101|           0: [ReservedWord] {
-#  101|           1: [Binary] Binary
-#  101|             0: [Identifier] x
-#  101|             1: [ReservedWord] ==
-#  101|             2: [Integer] 10
+#  101|           1: [BlockBody] BlockBody
+#  101|             0: [Binary] Binary
+#  101|               0: [Identifier] x
+#  101|               1: [ReservedWord] ==
+#  101|               2: [Integer] 10
 #  101|           2: [ReservedWord] }
 #  102|     17: [InClause] InClause
 #  102|       0: [ReservedWord] in
@@ -3582,49 +3626,52 @@ gems/Gemfile:
 #    5|         2: [ReservedWord] '
 #    5|     2: [DoBlock] DoBlock
 #    5|       0: [ReservedWord] do
-#    6|       1: [Call] Call
-#    6|         0: [Identifier] gem
-#    6|         1: [ArgumentList] ArgumentList
-#    6|           0: [String] String
-#    6|             0: [ReservedWord] '
-#    6|             1: [StringContent] my_gem
-#    6|             2: [ReservedWord] '
-#    6|           1: [ReservedWord] ,
-#    6|           2: [String] String
-#    6|             0: [ReservedWord] '
-#    6|             1: [StringContent] 1.0
-#    6|             2: [ReservedWord] '
-#    7|       2: [Call] Call
-#    7|         0: [Identifier] gem
-#    7|         1: [ArgumentList] ArgumentList
-#    7|           0: [String] String
-#    7|             0: [ReservedWord] '
-#    7|             1: [StringContent] another_gem
-#    7|             2: [ReservedWord] '
-#    7|           1: [ReservedWord] ,
-#    7|           2: [String] String
-#    7|             0: [ReservedWord] '
-#    7|             1: [StringContent] 3.1.4
-#    7|             2: [ReservedWord] '
-#    8|       3: [ReservedWord] end
+#    6|       1: [BodyStatement] BodyStatement
+#    6|         0: [Call] Call
+#    6|           0: [Identifier] gem
+#    6|           1: [ArgumentList] ArgumentList
+#    6|             0: [String] String
+#    6|               0: [ReservedWord] '
+#    6|               1: [StringContent] my_gem
+#    6|               2: [ReservedWord] '
+#    6|             1: [ReservedWord] ,
+#    6|             2: [String] String
+#    6|               0: [ReservedWord] '
+#    6|               1: [StringContent] 1.0
+#    6|               2: [ReservedWord] '
+#    7|         1: [Call] Call
+#    7|           0: [Identifier] gem
+#    7|           1: [ArgumentList] ArgumentList
+#    7|             0: [String] String
+#    7|               0: [ReservedWord] '
+#    7|               1: [StringContent] another_gem
+#    7|               2: [ReservedWord] '
+#    7|             1: [ReservedWord] ,
+#    7|             2: [String] String
+#    7|               0: [ReservedWord] '
+#    7|               1: [StringContent] 3.1.4
+#    7|               2: [ReservedWord] '
+#    8|       2: [ReservedWord] end
 gems/lib/test.rb:
 #    1| [Program] Program
 #    1|   0: [Class] Class
 #    1|     0: [ReservedWord] class
 #    1|     1: [Constant] Foo
-#    2|     2: [SingletonMethod] SingletonMethod
-#    2|       0: [ReservedWord] def
-#    2|       1: [Self] self
-#    2|       2: [ReservedWord] .
-#    2|       3: [Identifier] greet
-#    3|       4: [Call] Call
-#    3|         0: [Identifier] puts
-#    3|         1: [ArgumentList] ArgumentList
-#    3|           0: [String] String
-#    3|             0: [ReservedWord] "
-#    3|             1: [StringContent] Hello
-#    3|             2: [ReservedWord] "
-#    4|       5: [ReservedWord] end
+#    2|     2: [BodyStatement] BodyStatement
+#    2|       0: [SingletonMethod] SingletonMethod
+#    2|         0: [ReservedWord] def
+#    2|         1: [Self] self
+#    2|         2: [ReservedWord] .
+#    2|         3: [Identifier] greet
+#    3|         4: [BodyStatement] BodyStatement
+#    3|           0: [Call] Call
+#    3|             0: [Identifier] puts
+#    3|             1: [ArgumentList] ArgumentList
+#    3|               0: [String] String
+#    3|                 0: [ReservedWord] "
+#    3|                 1: [StringContent] Hello
+#    3|                 2: [ReservedWord] "
+#    4|         5: [ReservedWord] end
 #    5|     3: [ReservedWord] end
 gems/test.gemspec:
 #    1| [Program] Program
@@ -3641,93 +3688,94 @@ gems/test.gemspec:
 #    1|         0: [ReservedWord] |
 #    1|         1: [Identifier] s
 #    1|         2: [ReservedWord] |
-#    2|       2: [Assignment] Assignment
-#    2|         0: [Call] Call
-#    2|           0: [Identifier] s
-#    2|           1: [ReservedWord] .
-#    2|           2: [Identifier] name
-#    2|         1: [ReservedWord] =
-#    2|         2: [String] String
-#    2|           0: [ReservedWord] '
-#    2|           1: [StringContent] test
-#    2|           2: [ReservedWord] '
-#    3|       3: [Assignment] Assignment
-#    3|         0: [Call] Call
-#    3|           0: [Identifier] s
-#    3|           1: [ReservedWord] .
-#    3|           2: [Identifier] version
-#    3|         1: [ReservedWord] =
-#    3|         2: [String] String
-#    3|           0: [ReservedWord] '
-#    3|           1: [StringContent] 0.0.0
-#    3|           2: [ReservedWord] '
-#    4|       4: [Assignment] Assignment
-#    4|         0: [Call] Call
-#    4|           0: [Identifier] s
-#    4|           1: [ReservedWord] .
-#    4|           2: [Identifier] summary
-#    4|         1: [ReservedWord] =
-#    4|         2: [String] String
-#    4|           0: [ReservedWord] "
-#    4|           1: [StringContent] foo!
-#    4|           2: [ReservedWord] "
-#    5|       5: [Assignment] Assignment
-#    5|         0: [Call] Call
-#    5|           0: [Identifier] s
-#    5|           1: [ReservedWord] .
-#    5|           2: [Identifier] description
-#    5|         1: [ReservedWord] =
-#    5|         2: [String] String
-#    5|           0: [ReservedWord] "
-#    5|           1: [StringContent] A test
-#    5|           2: [ReservedWord] "
-#    6|       6: [Assignment] Assignment
-#    6|         0: [Call] Call
-#    6|           0: [Identifier] s
-#    6|           1: [ReservedWord] .
-#    6|           2: [Identifier] authors
-#    6|         1: [ReservedWord] =
-#    6|         2: [Array] Array
-#    6|           0: [ReservedWord] [
-#    6|           1: [String] String
-#    6|             0: [ReservedWord] "
-#    6|             1: [StringContent] Mona Lisa
-#    6|             2: [ReservedWord] "
-#    6|           2: [ReservedWord] ]
-#    7|       7: [Assignment] Assignment
-#    7|         0: [Call] Call
-#    7|           0: [Identifier] s
-#    7|           1: [ReservedWord] .
-#    7|           2: [Identifier] email
-#    7|         1: [ReservedWord] =
-#    7|         2: [String] String
-#    7|           0: [ReservedWord] '
-#    7|           1: [StringContent] mona@example.com
-#    7|           2: [ReservedWord] '
-#    8|       8: [Assignment] Assignment
-#    8|         0: [Call] Call
-#    8|           0: [Identifier] s
-#    8|           1: [ReservedWord] .
-#    8|           2: [Identifier] files
-#    8|         1: [ReservedWord] =
-#    8|         2: [Array] Array
-#    8|           0: [ReservedWord] [
-#    8|           1: [String] String
-#    8|             0: [ReservedWord] "
-#    8|             1: [StringContent] lib/test.rb
-#    8|             2: [ReservedWord] "
-#    8|           2: [ReservedWord] ]
-#    9|       9: [Assignment] Assignment
-#    9|         0: [Call] Call
-#    9|           0: [Identifier] s
-#    9|           1: [ReservedWord] .
-#    9|           2: [Identifier] homepage
-#    9|         1: [ReservedWord] =
-#    9|         2: [String] String
-#    9|           0: [ReservedWord] '
-#    9|           1: [StringContent] https://github.com/github/codeql-ruby
-#    9|           2: [ReservedWord] '
-#   10|       10: [ReservedWord] end
+#    2|       2: [BodyStatement] BodyStatement
+#    2|         0: [Assignment] Assignment
+#    2|           0: [Call] Call
+#    2|             0: [Identifier] s
+#    2|             1: [ReservedWord] .
+#    2|             2: [Identifier] name
+#    2|           1: [ReservedWord] =
+#    2|           2: [String] String
+#    2|             0: [ReservedWord] '
+#    2|             1: [StringContent] test
+#    2|             2: [ReservedWord] '
+#    3|         1: [Assignment] Assignment
+#    3|           0: [Call] Call
+#    3|             0: [Identifier] s
+#    3|             1: [ReservedWord] .
+#    3|             2: [Identifier] version
+#    3|           1: [ReservedWord] =
+#    3|           2: [String] String
+#    3|             0: [ReservedWord] '
+#    3|             1: [StringContent] 0.0.0
+#    3|             2: [ReservedWord] '
+#    4|         2: [Assignment] Assignment
+#    4|           0: [Call] Call
+#    4|             0: [Identifier] s
+#    4|             1: [ReservedWord] .
+#    4|             2: [Identifier] summary
+#    4|           1: [ReservedWord] =
+#    4|           2: [String] String
+#    4|             0: [ReservedWord] "
+#    4|             1: [StringContent] foo!
+#    4|             2: [ReservedWord] "
+#    5|         3: [Assignment] Assignment
+#    5|           0: [Call] Call
+#    5|             0: [Identifier] s
+#    5|             1: [ReservedWord] .
+#    5|             2: [Identifier] description
+#    5|           1: [ReservedWord] =
+#    5|           2: [String] String
+#    5|             0: [ReservedWord] "
+#    5|             1: [StringContent] A test
+#    5|             2: [ReservedWord] "
+#    6|         4: [Assignment] Assignment
+#    6|           0: [Call] Call
+#    6|             0: [Identifier] s
+#    6|             1: [ReservedWord] .
+#    6|             2: [Identifier] authors
+#    6|           1: [ReservedWord] =
+#    6|           2: [Array] Array
+#    6|             0: [ReservedWord] [
+#    6|             1: [String] String
+#    6|               0: [ReservedWord] "
+#    6|               1: [StringContent] Mona Lisa
+#    6|               2: [ReservedWord] "
+#    6|             2: [ReservedWord] ]
+#    7|         5: [Assignment] Assignment
+#    7|           0: [Call] Call
+#    7|             0: [Identifier] s
+#    7|             1: [ReservedWord] .
+#    7|             2: [Identifier] email
+#    7|           1: [ReservedWord] =
+#    7|           2: [String] String
+#    7|             0: [ReservedWord] '
+#    7|             1: [StringContent] mona@example.com
+#    7|             2: [ReservedWord] '
+#    8|         6: [Assignment] Assignment
+#    8|           0: [Call] Call
+#    8|             0: [Identifier] s
+#    8|             1: [ReservedWord] .
+#    8|             2: [Identifier] files
+#    8|           1: [ReservedWord] =
+#    8|           2: [Array] Array
+#    8|             0: [ReservedWord] [
+#    8|             1: [String] String
+#    8|               0: [ReservedWord] "
+#    8|               1: [StringContent] lib/test.rb
+#    8|               2: [ReservedWord] "
+#    8|             2: [ReservedWord] ]
+#    9|         7: [Assignment] Assignment
+#    9|           0: [Call] Call
+#    9|             0: [Identifier] s
+#    9|             1: [ReservedWord] .
+#    9|             2: [Identifier] homepage
+#    9|           1: [ReservedWord] =
+#    9|           2: [String] String
+#    9|             0: [ReservedWord] '
+#    9|             1: [StringContent] https://github.com/github/codeql-ruby
+#    9|             2: [ReservedWord] '
+#   10|       3: [ReservedWord] end
 literals/literals.rb:
 #    1| [Program] Program
 #    2|   0: [Nil] nil
@@ -4444,10 +4492,11 @@ literals/literals.rb:
 #  174|   127: [Method] Method
 #  174|     0: [ReservedWord] def
 #  174|     1: [Identifier] m
-#  175|     2: [Assignment] Assignment
-#  175|       0: [Identifier] query
-#  175|       1: [ReservedWord] =
-#  175|       2: [HeredocBeginning] <<-BLA
+#  175|     2: [BodyStatement] BodyStatement
+#  175|       0: [Assignment] Assignment
+#  175|         0: [Identifier] query
+#  175|         1: [ReservedWord] =
+#  175|         2: [HeredocBeginning] <<-BLA
 #  178|     3: [ReservedWord] end
 #  180|   128: [Assignment] Assignment
 #  180|     0: [Identifier] query
@@ -4490,6 +4539,18 @@ literals/literals.rb:
 #  199|       0: [HashKeySymbol] Z
 #  199|       1: [ReservedWord] :
 #  199|     4: [ReservedWord] }
+#  201|   135: [String] String
+#  201|     0: [ReservedWord] "
+#  201|     1: [StringContent] @foo: 
+#  201|     2: [Interpolation] Interpolation
+#  201|       0: [InstanceVariable] @foo
+#  201|     3: [StringContent]  @@bar: 
+#  201|     4: [Interpolation] Interpolation
+#  201|       0: [ClassVariable] @@bar
+#  201|     5: [StringContent]  $_: 
+#  201|     6: [Interpolation] Interpolation
+#  201|       0: [GlobalVariable] $_
+#  201|     7: [ReservedWord] "
 #    1| [Comment] # boolean values and nil
 #    9| [Comment] # decimal integers
 #   14| [Comment] # max value representable by QL's int type
@@ -4591,14 +4652,9 @@ literals/literals.rb:
 #  188| [Comment] # TODO: the parser currently does not handle single quoted heredocs correctly
 #  189| [HeredocBody] HeredocBody
 #  189|   0: [HeredocContent] 
-#  189|    text without 
-#  190|   1: [Interpolation] Interpolation
-#  190|     0: [ReservedWord] #{
-#  190|     1: [Identifier] interpolation
-#  190|     2: [ReservedWord] }
-#  190|   2: [HeredocContent]  !
-#  190|   
-#  191|   3: [HeredocEnd] DOC
+#  189|    text without #{ interpolation } !
+#  189|   
+#  191|   1: [HeredocEnd] DOC
 #  193| [HeredocBody] HeredocBody
 #  193|   0: [HeredocContent] 
 #  193|    cat file.txt
@@ -4740,46 +4796,49 @@ modules/classes.rb:
 #   20|   5: [Class] Class
 #   20|     0: [ReservedWord] class
 #   20|     1: [Constant] Wibble
-#   21|     2: [Method] Method
-#   21|       0: [ReservedWord] def
-#   21|       1: [Identifier] method_a
-#   22|       2: [Call] Call
-#   22|         0: [Identifier] puts
-#   22|         1: [ArgumentList] ArgumentList
-#   22|           0: [String] String
-#   22|             0: [ReservedWord] '
-#   22|             1: [StringContent] a
-#   22|             2: [ReservedWord] '
-#   23|       3: [ReservedWord] end
-#   25|     3: [Method] Method
-#   25|       0: [ReservedWord] def
-#   25|       1: [Identifier] method_b
-#   26|       2: [Call] Call
-#   26|         0: [Identifier] puts
-#   26|         1: [ArgumentList] ArgumentList
-#   26|           0: [String] String
-#   26|             0: [ReservedWord] '
-#   26|             1: [StringContent] b
-#   26|             2: [ReservedWord] '
-#   27|       3: [ReservedWord] end
-#   29|     4: [Call] Call
-#   29|       0: [Identifier] some_method_call
-#   29|       1: [ArgumentList] ArgumentList
-#   29|         0: [ReservedWord] (
-#   29|         1: [ReservedWord] )
-#   30|     5: [Assignment] Assignment
-#   30|       0: [GlobalVariable] $global_var
-#   30|       1: [ReservedWord] =
-#   30|       2: [Integer] 123
-#   32|     6: [Class] Class
-#   32|       0: [ReservedWord] class
-#   32|       1: [Constant] ClassInWibble
-#   33|       2: [ReservedWord] end
-#   35|     7: [Module] Module
-#   35|       0: [ReservedWord] module
-#   35|       1: [Constant] ModuleInWibble
-#   36|       2: [ReservedWord] end
-#   37|     8: [ReservedWord] end
+#   21|     2: [BodyStatement] BodyStatement
+#   21|       0: [Method] Method
+#   21|         0: [ReservedWord] def
+#   21|         1: [Identifier] method_a
+#   22|         2: [BodyStatement] BodyStatement
+#   22|           0: [Call] Call
+#   22|             0: [Identifier] puts
+#   22|             1: [ArgumentList] ArgumentList
+#   22|               0: [String] String
+#   22|                 0: [ReservedWord] '
+#   22|                 1: [StringContent] a
+#   22|                 2: [ReservedWord] '
+#   23|         3: [ReservedWord] end
+#   25|       1: [Method] Method
+#   25|         0: [ReservedWord] def
+#   25|         1: [Identifier] method_b
+#   26|         2: [BodyStatement] BodyStatement
+#   26|           0: [Call] Call
+#   26|             0: [Identifier] puts
+#   26|             1: [ArgumentList] ArgumentList
+#   26|               0: [String] String
+#   26|                 0: [ReservedWord] '
+#   26|                 1: [StringContent] b
+#   26|                 2: [ReservedWord] '
+#   27|         3: [ReservedWord] end
+#   29|       2: [Call] Call
+#   29|         0: [Identifier] some_method_call
+#   29|         1: [ArgumentList] ArgumentList
+#   29|           0: [ReservedWord] (
+#   29|           1: [ReservedWord] )
+#   30|       3: [Assignment] Assignment
+#   30|         0: [GlobalVariable] $global_var
+#   30|         1: [ReservedWord] =
+#   30|         2: [Integer] 123
+#   32|       4: [Class] Class
+#   32|         0: [ReservedWord] class
+#   32|         1: [Constant] ClassInWibble
+#   33|         2: [ReservedWord] end
+#   35|       5: [Module] Module
+#   35|         0: [ReservedWord] module
+#   35|         1: [Constant] ModuleInWibble
+#   36|         2: [ReservedWord] end
+#   37|     3: [ReservedWord] end
 #   40|   6: [Assignment] Assignment
 #   40|     0: [Identifier] x
 #   40|     1: [ReservedWord] =
@@ -4791,31 +4850,34 @@ modules/classes.rb:
 #   41|     0: [ReservedWord] class
 #   41|     1: [ReservedWord] <<
 #   41|     2: [Identifier] x
-#   42|     3: [Method] Method
-#   42|       0: [ReservedWord] def
-#   42|       1: [Identifier] length
-#   43|       2: [Binary] Binary
-#   43|         0: [Integer] 100
-#   43|         1: [ReservedWord] *
-#   43|         2: [Super] super
-#   44|       3: [ReservedWord] end
-#   46|     4: [Method] Method
-#   46|       0: [ReservedWord] def
-#   46|       1: [Identifier] wibble
-#   47|       2: [Call] Call
-#   47|         0: [Identifier] puts
-#   47|         1: [ArgumentList] ArgumentList
-#   47|           0: [String] String
-#   47|             0: [ReservedWord] '
-#   47|             1: [StringContent] wibble
-#   47|             2: [ReservedWord] '
-#   48|       3: [ReservedWord] end
-#   50|     5: [Identifier] another_method_call
-#   51|     6: [Assignment] Assignment
-#   51|       0: [GlobalVariable] $global_var2
-#   51|       1: [ReservedWord] =
-#   51|       2: [Integer] 456
-#   52|     7: [ReservedWord] end
+#   42|     3: [BodyStatement] BodyStatement
+#   42|       0: [Method] Method
+#   42|         0: [ReservedWord] def
+#   42|         1: [Identifier] length
+#   43|         2: [BodyStatement] BodyStatement
+#   43|           0: [Binary] Binary
+#   43|             0: [Integer] 100
+#   43|             1: [ReservedWord] *
+#   43|             2: [Super] super
+#   44|         3: [ReservedWord] end
+#   46|       1: [Method] Method
+#   46|         0: [ReservedWord] def
+#   46|         1: [Identifier] wibble
+#   47|         2: [BodyStatement] BodyStatement
+#   47|           0: [Call] Call
+#   47|             0: [Identifier] puts
+#   47|             1: [ArgumentList] ArgumentList
+#   47|               0: [String] String
+#   47|                 0: [ReservedWord] '
+#   47|                 1: [StringContent] wibble
+#   47|                 2: [ReservedWord] '
+#   48|         3: [ReservedWord] end
+#   50|       2: [Identifier] another_method_call
+#   51|       3: [Assignment] Assignment
+#   51|         0: [GlobalVariable] $global_var2
+#   51|         1: [ReservedWord] =
+#   51|         2: [Integer] 456
+#   52|     4: [ReservedWord] end
 #   55|   8: [Class] Class
 #   55|     0: [ReservedWord] class
 #   55|     1: [ScopeResolution] ScopeResolution
@@ -4838,121 +4900,126 @@ modules/modules.rb:
 #    4|   1: [Module] Module
 #    4|     0: [ReservedWord] module
 #    4|     1: [Constant] Foo
-#    5|     2: [Module] Module
-#    5|       0: [ReservedWord] module
-#    5|       1: [Constant] Bar
-#    6|       2: [Class] Class
-#    6|         0: [ReservedWord] class
-#    6|         1: [Constant] ClassInFooBar
-#    7|         2: [ReservedWord] end
-#    9|       3: [Method] Method
-#    9|         0: [ReservedWord] def
-#    9|         1: [Identifier] method_in_foo_bar
-#   10|         2: [ReservedWord] end
-#   12|       4: [Call] Call
-#   12|         0: [Identifier] puts
-#   12|         1: [ArgumentList] ArgumentList
-#   12|           0: [String] String
-#   12|             0: [ReservedWord] '
-#   12|             1: [StringContent] module Foo::Bar
-#   12|             2: [ReservedWord] '
-#   13|       5: [Assignment] Assignment
-#   13|         0: [GlobalVariable] $global_var
-#   13|         1: [ReservedWord] =
-#   13|         2: [Integer] 0
-#   14|       6: [ReservedWord] end
-#   16|     3: [Method] Method
-#   16|       0: [ReservedWord] def
-#   16|       1: [Identifier] method_in_foo
-#   17|       2: [ReservedWord] end
-#   19|     4: [Class] Class
-#   19|       0: [ReservedWord] class
-#   19|       1: [Constant] ClassInFoo
-#   20|       2: [ReservedWord] end
-#   22|     5: [Call] Call
-#   22|       0: [Identifier] puts
-#   22|       1: [ArgumentList] ArgumentList
-#   22|         0: [String] String
-#   22|           0: [ReservedWord] '
-#   22|           1: [StringContent] module Foo
-#   22|           2: [ReservedWord] '
-#   23|     6: [Assignment] Assignment
-#   23|       0: [GlobalVariable] $global_var
-#   23|       1: [ReservedWord] =
-#   23|       2: [Integer] 1
-#   24|     7: [ReservedWord] end
+#    5|     2: [BodyStatement] BodyStatement
+#    5|       0: [Module] Module
+#    5|         0: [ReservedWord] module
+#    5|         1: [Constant] Bar
+#    6|         2: [BodyStatement] BodyStatement
+#    6|           0: [Class] Class
+#    6|             0: [ReservedWord] class
+#    6|             1: [Constant] ClassInFooBar
+#    7|             2: [ReservedWord] end
+#    9|           1: [Method] Method
+#    9|             0: [ReservedWord] def
+#    9|             1: [Identifier] method_in_foo_bar
+#   10|             2: [ReservedWord] end
+#   12|           2: [Call] Call
+#   12|             0: [Identifier] puts
+#   12|             1: [ArgumentList] ArgumentList
+#   12|               0: [String] String
+#   12|                 0: [ReservedWord] '
+#   12|                 1: [StringContent] module Foo::Bar
+#   12|                 2: [ReservedWord] '
+#   13|           3: [Assignment] Assignment
+#   13|             0: [GlobalVariable] $global_var
+#   13|             1: [ReservedWord] =
+#   13|             2: [Integer] 0
+#   14|         3: [ReservedWord] end
+#   16|       1: [Method] Method
+#   16|         0: [ReservedWord] def
+#   16|         1: [Identifier] method_in_foo
+#   17|         2: [ReservedWord] end
+#   19|       2: [Class] Class
+#   19|         0: [ReservedWord] class
+#   19|         1: [Constant] ClassInFoo
+#   20|         2: [ReservedWord] end
+#   22|       3: [Call] Call
+#   22|         0: [Identifier] puts
+#   22|         1: [ArgumentList] ArgumentList
+#   22|           0: [String] String
+#   22|             0: [ReservedWord] '
+#   22|             1: [StringContent] module Foo
+#   22|             2: [ReservedWord] '
+#   23|       4: [Assignment] Assignment
+#   23|         0: [GlobalVariable] $global_var
+#   23|         1: [ReservedWord] =
+#   23|         2: [Integer] 1
+#   24|     3: [ReservedWord] end
 #   26|   2: [Module] Module
 #   26|     0: [ReservedWord] module
 #   26|     1: [Constant] Foo
-#   27|     2: [Method] Method
-#   27|       0: [ReservedWord] def
-#   27|       1: [Identifier] method_in_another_definition_of_foo
-#   28|       2: [ReservedWord] end
-#   30|     3: [Class] Class
-#   30|       0: [ReservedWord] class
-#   30|       1: [Constant] ClassInAnotherDefinitionOfFoo
-#   31|       2: [ReservedWord] end
-#   33|     4: [Call] Call
-#   33|       0: [Identifier] puts
-#   33|       1: [ArgumentList] ArgumentList
-#   33|         0: [String] String
-#   33|           0: [ReservedWord] '
-#   33|           1: [StringContent] module Foo again
-#   33|           2: [ReservedWord] '
-#   34|     5: [Assignment] Assignment
-#   34|       0: [GlobalVariable] $global_var
-#   34|       1: [ReservedWord] =
-#   34|       2: [Integer] 2
-#   35|     6: [ReservedWord] end
+#   27|     2: [BodyStatement] BodyStatement
+#   27|       0: [Method] Method
+#   27|         0: [ReservedWord] def
+#   27|         1: [Identifier] method_in_another_definition_of_foo
+#   28|         2: [ReservedWord] end
+#   30|       1: [Class] Class
+#   30|         0: [ReservedWord] class
+#   30|         1: [Constant] ClassInAnotherDefinitionOfFoo
+#   31|         2: [ReservedWord] end
+#   33|       2: [Call] Call
+#   33|         0: [Identifier] puts
+#   33|         1: [ArgumentList] ArgumentList
+#   33|           0: [String] String
+#   33|             0: [ReservedWord] '
+#   33|             1: [StringContent] module Foo again
+#   33|             2: [ReservedWord] '
+#   34|       3: [Assignment] Assignment
+#   34|         0: [GlobalVariable] $global_var
+#   34|         1: [ReservedWord] =
+#   34|         2: [Integer] 2
+#   35|     3: [ReservedWord] end
 #   37|   3: [Module] Module
 #   37|     0: [ReservedWord] module
 #   37|     1: [Constant] Bar
-#   38|     2: [Method] Method
-#   38|       0: [ReservedWord] def
-#   38|       1: [Identifier] method_a
-#   39|       2: [ReservedWord] end
-#   41|     3: [Method] Method
-#   41|       0: [ReservedWord] def
-#   41|       1: [Identifier] method_b
-#   42|       2: [ReservedWord] end
-#   44|     4: [Call] Call
-#   44|       0: [Identifier] puts
-#   44|       1: [ArgumentList] ArgumentList
-#   44|         0: [String] String
-#   44|           0: [ReservedWord] '
-#   44|           1: [StringContent] module Bar
-#   44|           2: [ReservedWord] '
-#   45|     5: [Assignment] Assignment
-#   45|       0: [GlobalVariable] $global_var
-#   45|       1: [ReservedWord] =
-#   45|       2: [Integer] 3
-#   46|     6: [ReservedWord] end
+#   38|     2: [BodyStatement] BodyStatement
+#   38|       0: [Method] Method
+#   38|         0: [ReservedWord] def
+#   38|         1: [Identifier] method_a
+#   39|         2: [ReservedWord] end
+#   41|       1: [Method] Method
+#   41|         0: [ReservedWord] def
+#   41|         1: [Identifier] method_b
+#   42|         2: [ReservedWord] end
+#   44|       2: [Call] Call
+#   44|         0: [Identifier] puts
+#   44|         1: [ArgumentList] ArgumentList
+#   44|           0: [String] String
+#   44|             0: [ReservedWord] '
+#   44|             1: [StringContent] module Bar
+#   44|             2: [ReservedWord] '
+#   45|       3: [Assignment] Assignment
+#   45|         0: [GlobalVariable] $global_var
+#   45|         1: [ReservedWord] =
+#   45|         2: [Integer] 3
+#   46|     3: [ReservedWord] end
 #   48|   4: [Module] Module
 #   48|     0: [ReservedWord] module
 #   48|     1: [ScopeResolution] ScopeResolution
 #   48|       0: [Constant] Foo
 #   48|       1: [ReservedWord] ::
 #   48|       2: [Constant] Bar
-#   49|     2: [Class] Class
-#   49|       0: [ReservedWord] class
-#   49|       1: [Constant] ClassInAnotherDefinitionOfFooBar
-#   50|       2: [ReservedWord] end
-#   52|     3: [Method] Method
-#   52|       0: [ReservedWord] def
-#   52|       1: [Identifier] method_in_another_definition_of_foo_bar
-#   53|       2: [ReservedWord] end
-#   55|     4: [Call] Call
-#   55|       0: [Identifier] puts
-#   55|       1: [ArgumentList] ArgumentList
-#   55|         0: [String] String
-#   55|           0: [ReservedWord] '
-#   55|           1: [StringContent] module Foo::Bar again
-#   55|           2: [ReservedWord] '
-#   56|     5: [Assignment] Assignment
-#   56|       0: [GlobalVariable] $global_var
-#   56|       1: [ReservedWord] =
-#   56|       2: [Integer] 4
-#   57|     6: [ReservedWord] end
+#   49|     2: [BodyStatement] BodyStatement
+#   49|       0: [Class] Class
+#   49|         0: [ReservedWord] class
+#   49|         1: [Constant] ClassInAnotherDefinitionOfFooBar
+#   50|         2: [ReservedWord] end
+#   52|       1: [Method] Method
+#   52|         0: [ReservedWord] def
+#   52|         1: [Identifier] method_in_another_definition_of_foo_bar
+#   53|         2: [ReservedWord] end
+#   55|       2: [Call] Call
+#   55|         0: [Identifier] puts
+#   55|         1: [ArgumentList] ArgumentList
+#   55|           0: [String] String
+#   55|             0: [ReservedWord] '
+#   55|             1: [StringContent] module Foo::Bar again
+#   55|             2: [ReservedWord] '
+#   56|       3: [Assignment] Assignment
+#   56|         0: [GlobalVariable] $global_var
+#   56|         1: [ReservedWord] =
+#   56|         2: [Integer] 4
+#   57|     3: [ReservedWord] end
 #   60|   5: [Module] Module
 #   60|     0: [ReservedWord] module
 #   60|     1: [ScopeResolution] ScopeResolution
@@ -4962,126 +5029,136 @@ modules/modules.rb:
 #   63|   6: [Module] Module
 #   63|     0: [ReservedWord] module
 #   63|     1: [Constant] Test
-#   65|     2: [Module] Module
-#   65|       0: [ReservedWord] module
-#   65|       1: [Constant] Foo1
-#   66|       2: [Class] Class
-#   66|         0: [ReservedWord] class
-#   66|         1: [ScopeResolution] ScopeResolution
-#   66|           0: [Constant] Foo1
-#   66|           1: [ReservedWord] ::
-#   66|           2: [Constant] Bar
-#   67|         2: [ReservedWord] end
-#   68|       3: [ReservedWord] end
-#   70|     3: [Module] Module
-#   70|       0: [ReservedWord] module
-#   70|       1: [Constant] Foo2
-#   71|       2: [Module] Module
-#   71|         0: [ReservedWord] module
-#   71|         1: [Constant] Foo2
-#   71|         2: [ReservedWord] end
-#   72|       3: [Class] Class
-#   72|         0: [ReservedWord] class
-#   72|         1: [ScopeResolution] ScopeResolution
-#   72|           0: [Constant] Foo2
-#   72|           1: [ReservedWord] ::
-#   72|           2: [Constant] Bar
-#   73|         2: [ReservedWord] end
-#   74|       4: [ReservedWord] end
-#   76|     4: [Module] Module
-#   76|       0: [ReservedWord] module
-#   76|       1: [Constant] Foo3
-#   77|       2: [Assignment] Assignment
-#   77|         0: [Constant] Foo3
-#   77|         1: [ReservedWord] =
-#   77|         2: [Constant] Object
-#   78|       3: [Class] Class
-#   78|         0: [ReservedWord] class
-#   78|         1: [ScopeResolution] ScopeResolution
-#   78|           0: [Constant] Foo3
-#   78|           1: [ReservedWord] ::
-#   78|           2: [Constant] Bar
-#   79|         2: [ReservedWord] end
-#   80|       4: [ReservedWord] end
-#   81|     5: [ReservedWord] end
+#   65|     2: [BodyStatement] BodyStatement
+#   65|       0: [Module] Module
+#   65|         0: [ReservedWord] module
+#   65|         1: [Constant] Foo1
+#   66|         2: [BodyStatement] BodyStatement
+#   66|           0: [Class] Class
+#   66|             0: [ReservedWord] class
+#   66|             1: [ScopeResolution] ScopeResolution
+#   66|               0: [Constant] Foo1
+#   66|               1: [ReservedWord] ::
+#   66|               2: [Constant] Bar
+#   67|             2: [ReservedWord] end
+#   68|         3: [ReservedWord] end
+#   70|       1: [Module] Module
+#   70|         0: [ReservedWord] module
+#   70|         1: [Constant] Foo2
+#   71|         2: [BodyStatement] BodyStatement
+#   71|           0: [Module] Module
+#   71|             0: [ReservedWord] module
+#   71|             1: [Constant] Foo2
+#   71|             2: [ReservedWord] end
+#   72|           1: [Class] Class
+#   72|             0: [ReservedWord] class
+#   72|             1: [ScopeResolution] ScopeResolution
+#   72|               0: [Constant] Foo2
+#   72|               1: [ReservedWord] ::
+#   72|               2: [Constant] Bar
+#   73|             2: [ReservedWord] end
+#   74|         3: [ReservedWord] end
+#   76|       2: [Module] Module
+#   76|         0: [ReservedWord] module
+#   76|         1: [Constant] Foo3
+#   77|         2: [BodyStatement] BodyStatement
+#   77|           0: [Assignment] Assignment
+#   77|             0: [Constant] Foo3
+#   77|             1: [ReservedWord] =
+#   77|             2: [Constant] Object
+#   78|           1: [Class] Class
+#   78|             0: [ReservedWord] class
+#   78|             1: [ScopeResolution] ScopeResolution
+#   78|               0: [Constant] Foo3
+#   78|               1: [ReservedWord] ::
+#   78|               2: [Constant] Bar
+#   79|             2: [ReservedWord] end
+#   80|         3: [ReservedWord] end
+#   81|     3: [ReservedWord] end
 #   83|   7: [Module] Module
 #   83|     0: [ReservedWord] module
 #   83|     1: [Constant] Other
-#   84|     2: [Module] Module
-#   84|       0: [ReservedWord] module
-#   84|       1: [Constant] Foo1
-#   85|       2: [ReservedWord] end
+#   84|     2: [BodyStatement] BodyStatement
+#   84|       0: [Module] Module
+#   84|         0: [ReservedWord] module
+#   84|         1: [Constant] Foo1
+#   85|         2: [ReservedWord] end
 #   86|     3: [ReservedWord] end
 #   88|   8: [Module] Module
 #   88|     0: [ReservedWord] module
 #   88|     1: [Constant] IncludeTest
-#   89|     2: [Call] Call
-#   89|       0: [Identifier] include
-#   89|       1: [ArgumentList] ArgumentList
-#   89|         0: [ScopeResolution] ScopeResolution
-#   89|           0: [ReservedWord] ::
-#   89|           1: [Constant] Test
-#   90|     3: [Call] Call
-#   90|       0: [Constant] Object
-#   90|       1: [ReservedWord] .
-#   90|       2: [Identifier] module_eval
-#   90|       3: [Block] Block
-#   90|         0: [ReservedWord] {
-#   90|         1: [Call] Call
-#   90|           0: [Identifier] prepend
-#   90|           1: [ArgumentList] ArgumentList
-#   90|             0: [Constant] Other
-#   90|         2: [ReservedWord] }
-#   91|     4: [Module] Module
-#   91|       0: [ReservedWord] module
-#   91|       1: [ScopeResolution] ScopeResolution
-#   91|         0: [Constant] Foo1
-#   91|         1: [ReservedWord] ::
-#   91|         2: [Constant] Y
-#   92|       2: [ReservedWord] end
-#   93|     5: [ReservedWord] end
+#   89|     2: [BodyStatement] BodyStatement
+#   89|       0: [Call] Call
+#   89|         0: [Identifier] include
+#   89|         1: [ArgumentList] ArgumentList
+#   89|           0: [ScopeResolution] ScopeResolution
+#   89|             0: [ReservedWord] ::
+#   89|             1: [Constant] Test
+#   90|       1: [Call] Call
+#   90|         0: [Constant] Object
+#   90|         1: [ReservedWord] .
+#   90|         2: [Identifier] module_eval
+#   90|         3: [Block] Block
+#   90|           0: [ReservedWord] {
+#   90|           1: [BlockBody] BlockBody
+#   90|             0: [Call] Call
+#   90|               0: [Identifier] prepend
+#   90|               1: [ArgumentList] ArgumentList
+#   90|                 0: [Constant] Other
+#   90|           2: [ReservedWord] }
+#   91|       2: [Module] Module
+#   91|         0: [ReservedWord] module
+#   91|         1: [ScopeResolution] ScopeResolution
+#   91|           0: [Constant] Foo1
+#   91|           1: [ReservedWord] ::
+#   91|           2: [Constant] Y
+#   92|         2: [ReservedWord] end
+#   93|     3: [ReservedWord] end
 #   95|   9: [Module] Module
 #   95|     0: [ReservedWord] module
 #   95|     1: [Constant] IncludeTest2
-#   96|     2: [Call] Call
-#   96|       0: [Identifier] include
-#   96|       1: [ArgumentList] ArgumentList
-#   96|         0: [Constant] Test
-#   97|     3: [Module] Module
-#   97|       0: [ReservedWord] module
-#   97|       1: [ScopeResolution] ScopeResolution
-#   97|         0: [Constant] Foo1
-#   97|         1: [ReservedWord] ::
-#   97|         2: [Constant] Z
-#   98|       2: [ReservedWord] end
-#   99|     4: [ReservedWord] end
+#   96|     2: [BodyStatement] BodyStatement
+#   96|       0: [Call] Call
+#   96|         0: [Identifier] include
+#   96|         1: [ArgumentList] ArgumentList
+#   96|           0: [Constant] Test
+#   97|       1: [Module] Module
+#   97|         0: [ReservedWord] module
+#   97|         1: [ScopeResolution] ScopeResolution
+#   97|           0: [Constant] Foo1
+#   97|           1: [ReservedWord] ::
+#   97|           2: [Constant] Z
+#   98|         2: [ReservedWord] end
+#   99|     3: [ReservedWord] end
 #  101|   10: [Module] Module
 #  101|     0: [ReservedWord] module
 #  101|     1: [Constant] PrependTest
-#  102|     2: [Call] Call
-#  102|       0: [Identifier] prepend
-#  102|       1: [ArgumentList] ArgumentList
-#  102|         0: [ScopeResolution] ScopeResolution
-#  102|           0: [ReservedWord] ::
-#  102|           1: [Constant] Test
-#  103|     3: [Module] Module
-#  103|       0: [ReservedWord] module
-#  103|       1: [ScopeResolution] ScopeResolution
-#  103|         0: [Constant] Foo2
-#  103|         1: [ReservedWord] ::
-#  103|         2: [Constant] Y
-#  104|       2: [ReservedWord] end
-#  105|     4: [ReservedWord] end
+#  102|     2: [BodyStatement] BodyStatement
+#  102|       0: [Call] Call
+#  102|         0: [Identifier] prepend
+#  102|         1: [ArgumentList] ArgumentList
+#  102|           0: [ScopeResolution] ScopeResolution
+#  102|             0: [ReservedWord] ::
+#  102|             1: [Constant] Test
+#  103|       1: [Module] Module
+#  103|         0: [ReservedWord] module
+#  103|         1: [ScopeResolution] ScopeResolution
+#  103|           0: [Constant] Foo2
+#  103|           1: [ReservedWord] ::
+#  103|           2: [Constant] Y
+#  104|         2: [ReservedWord] end
+#  105|     3: [ReservedWord] end
 #  107|   11: [Module] Module
 #  107|     0: [ReservedWord] module
 #  107|     1: [Constant] MM
-#  108|     2: [Module] Module
-#  108|       0: [ReservedWord] module
-#  108|       1: [ScopeResolution] ScopeResolution
-#  108|         0: [Constant] MM
-#  108|         1: [ReservedWord] ::
-#  108|         2: [Constant] MM
-#  109|       2: [ReservedWord] end
+#  108|     2: [BodyStatement] BodyStatement
+#  108|       0: [Module] Module
+#  108|         0: [ReservedWord] module
+#  108|         1: [ScopeResolution] ScopeResolution
+#  108|           0: [Constant] MM
+#  108|           1: [ReservedWord] ::
+#  108|           2: [Constant] MM
+#  109|         2: [ReservedWord] end
 #  110|     3: [ReservedWord] end
 #  112|   12: [Class] Class
 #  112|     0: [ReservedWord] class
@@ -5090,13 +5167,14 @@ modules/modules.rb:
 #  115|   13: [Module] Module
 #  115|     0: [ReservedWord] module
 #  115|     1: [Constant] XX
-#  116|     2: [Class] Class
-#  116|       0: [ReservedWord] class
-#  116|       1: [Constant] YY
-#  116|       2: [Superclass] Superclass
-#  116|         0: [ReservedWord] <
+#  116|     2: [BodyStatement] BodyStatement
+#  116|       0: [Class] Class
+#  116|         0: [ReservedWord] class
 #  116|         1: [Constant] YY
-#  117|       3: [ReservedWord] end
+#  116|         2: [Superclass] Superclass
+#  116|           0: [ReservedWord] <
+#  116|           1: [Constant] YY
+#  117|         3: [ReservedWord] end
 #  118|     3: [ReservedWord] end
 #  120|   14: [Module] Module
 #  120|     0: [ReservedWord] module
@@ -5239,37 +5317,38 @@ operations/operations.rb:
 #   29|     0: [ReservedWord] def
 #   29|     1: [Identifier] foo
 #   29|     2: [ReservedWord] ;
-#   29|     3: [Return] Return
-#   29|       0: [ReservedWord] return
-#   29|       1: [ArgumentList] ArgumentList
-#   29|         0: [Integer] 1
-#   29|         1: [ReservedWord] ,
-#   29|         2: [SplatArgument] SplatArgument
-#   29|           0: [ReservedWord] *
-#   29|           1: [Array] Array
-#   29|             0: [ReservedWord] [
-#   29|             1: [Integer] 2
-#   29|             2: [ReservedWord] ]
-#   29|         3: [ReservedWord] ,
-#   29|         4: [Pair] Pair
-#   29|           0: [HashKeySymbol] a
-#   29|           1: [ReservedWord] :
-#   29|           2: [Integer] 3
-#   29|         5: [ReservedWord] ,
-#   29|         6: [HashSplatArgument] HashSplatArgument
-#   29|           0: [ReservedWord] **
-#   29|           1: [Hash] Hash
-#   29|             0: [ReservedWord] {
-#   29|             1: [Pair] Pair
-#   29|               0: [HashKeySymbol] b
-#   29|               1: [ReservedWord] :
-#   29|               2: [Integer] 4
-#   29|             2: [ReservedWord] ,
-#   29|             3: [Pair] Pair
-#   29|               0: [HashKeySymbol] c
-#   29|               1: [ReservedWord] :
-#   29|               2: [Integer] 5
-#   29|             4: [ReservedWord] }
+#   29|     3: [BodyStatement] BodyStatement
+#   29|       0: [Return] Return
+#   29|         0: [ReservedWord] return
+#   29|         1: [ArgumentList] ArgumentList
+#   29|           0: [Integer] 1
+#   29|           1: [ReservedWord] ,
+#   29|           2: [SplatArgument] SplatArgument
+#   29|             0: [ReservedWord] *
+#   29|             1: [Array] Array
+#   29|               0: [ReservedWord] [
+#   29|               1: [Integer] 2
+#   29|               2: [ReservedWord] ]
+#   29|           3: [ReservedWord] ,
+#   29|           4: [Pair] Pair
+#   29|             0: [HashKeySymbol] a
+#   29|             1: [ReservedWord] :
+#   29|             2: [Integer] 3
+#   29|           5: [ReservedWord] ,
+#   29|           6: [HashSplatArgument] HashSplatArgument
+#   29|             0: [ReservedWord] **
+#   29|             1: [Hash] Hash
+#   29|               0: [ReservedWord] {
+#   29|               1: [Pair] Pair
+#   29|                 0: [HashKeySymbol] b
+#   29|                 1: [ReservedWord] :
+#   29|                 2: [Integer] 4
+#   29|               2: [ReservedWord] ,
+#   29|               3: [Pair] Pair
+#   29|                 0: [HashKeySymbol] c
+#   29|                 1: [ReservedWord] :
+#   29|                 2: [Integer] 5
+#   29|               4: [ReservedWord] }
 #   29|     4: [ReservedWord] end
 #   32|   25: [Binary] Binary
 #   32|     0: [Identifier] w
@@ -5432,23 +5511,24 @@ operations/operations.rb:
 #   87|   63: [Class] Class
 #   87|     0: [ReservedWord] class
 #   87|     1: [Constant] X
-#   88|     2: [Assignment] Assignment
-#   88|       0: [InstanceVariable] @x
-#   88|       1: [ReservedWord] =
-#   88|       2: [Integer] 1
-#   89|     3: [OperatorAssignment] OperatorAssignment
-#   89|       0: [InstanceVariable] @x
-#   89|       1: [ReservedWord] +=
-#   89|       2: [Integer] 2
-#   91|     4: [Assignment] Assignment
-#   91|       0: [ClassVariable] @@y
-#   91|       1: [ReservedWord] =
-#   91|       2: [Integer] 3
-#   92|     5: [OperatorAssignment] OperatorAssignment
-#   92|       0: [ClassVariable] @@y
-#   92|       1: [ReservedWord] /=
-#   92|       2: [Integer] 4
-#   93|     6: [ReservedWord] end
+#   88|     2: [BodyStatement] BodyStatement
+#   88|       0: [Assignment] Assignment
+#   88|         0: [InstanceVariable] @x
+#   88|         1: [ReservedWord] =
+#   88|         2: [Integer] 1
+#   89|       1: [OperatorAssignment] OperatorAssignment
+#   89|         0: [InstanceVariable] @x
+#   89|         1: [ReservedWord] +=
+#   89|         2: [Integer] 2
+#   91|       2: [Assignment] Assignment
+#   91|         0: [ClassVariable] @@y
+#   91|         1: [ReservedWord] =
+#   91|         2: [Integer] 3
+#   92|       3: [OperatorAssignment] OperatorAssignment
+#   92|         0: [ClassVariable] @@y
+#   92|         1: [ReservedWord] /=
+#   92|         2: [Integer] 4
+#   93|     3: [ReservedWord] end
 #   95|   64: [Assignment] Assignment
 #   95|     0: [GlobalVariable] $global_var
 #   95|     1: [ReservedWord] =
@@ -5501,21 +5581,22 @@ params/params.rb:
 #    9|         2: [ReservedWord] ,
 #    9|         3: [Identifier] value
 #    9|         4: [ReservedWord] |
-#   10|       2: [Call] Call
-#   10|         0: [Identifier] puts
-#   10|         1: [ArgumentList] ArgumentList
-#   10|           0: [String] String
-#   10|             0: [ReservedWord] "
-#   10|             1: [Interpolation] Interpolation
-#   10|               0: [ReservedWord] #{
-#   10|               1: [Identifier] key
-#   10|               2: [ReservedWord] }
-#   10|             2: [StringContent]  -> 
-#   10|             3: [Interpolation] Interpolation
-#   10|               0: [ReservedWord] #{
-#   10|               1: [Identifier] value
-#   10|               2: [ReservedWord] }
-#   10|             4: [ReservedWord] "
+#   10|       2: [BodyStatement] BodyStatement
+#   10|         0: [Call] Call
+#   10|           0: [Identifier] puts
+#   10|           1: [ArgumentList] ArgumentList
+#   10|             0: [String] String
+#   10|               0: [ReservedWord] "
+#   10|               1: [Interpolation] Interpolation
+#   10|                 0: [ReservedWord] #{
+#   10|                 1: [Identifier] key
+#   10|                 2: [ReservedWord] }
+#   10|               2: [StringContent]  -> 
+#   10|               3: [Interpolation] Interpolation
+#   10|                 0: [ReservedWord] #{
+#   10|                 1: [Identifier] value
+#   10|                 2: [ReservedWord] }
+#   10|               4: [ReservedWord] "
 #   11|       3: [ReservedWord] end
 #   14|   3: [Assignment] Assignment
 #   14|     0: [Identifier] sum
@@ -5530,10 +5611,11 @@ params/params.rb:
 #   14|         4: [ReservedWord] )
 #   14|       2: [Block] Block
 #   14|         0: [ReservedWord] {
-#   14|         1: [Binary] Binary
-#   14|           0: [Identifier] foo
-#   14|           1: [ReservedWord] +
-#   14|           2: [Identifier] bar
+#   14|         1: [BlockBody] BlockBody
+#   14|           0: [Binary] Binary
+#   14|             0: [Identifier] foo
+#   14|             1: [ReservedWord] +
+#   14|             2: [Identifier] bar
 #   14|         2: [ReservedWord] }
 #   17|   4: [Method] Method
 #   17|     0: [ReservedWord] def
@@ -5571,13 +5653,14 @@ params/params.rb:
 #   22|           3: [Identifier] b
 #   22|           4: [ReservedWord] )
 #   22|         2: [ReservedWord] |
-#   22|       2: [Call] Call
-#   22|         0: [Identifier] puts
-#   22|         1: [ArgumentList] ArgumentList
-#   22|           0: [Binary] Binary
-#   22|             0: [Identifier] a
-#   22|             1: [ReservedWord] +
-#   22|             2: [Identifier] b
+#   22|       2: [BlockBody] BlockBody
+#   22|         0: [Call] Call
+#   22|           0: [Identifier] puts
+#   22|           1: [ArgumentList] ArgumentList
+#   22|             0: [Binary] Binary
+#   22|               0: [Identifier] a
+#   22|               1: [ReservedWord] +
+#   22|               2: [Identifier] b
 #   22|       3: [ReservedWord] }
 #   25|   7: [Assignment] Assignment
 #   25|     0: [Identifier] sum_four_values
@@ -5602,16 +5685,17 @@ params/params.rb:
 #   25|         4: [ReservedWord] )
 #   25|       2: [Block] Block
 #   25|         0: [ReservedWord] {
-#   26|         1: [Binary] Binary
+#   26|         1: [BlockBody] BlockBody
 #   26|           0: [Binary] Binary
 #   26|             0: [Binary] Binary
-#   26|               0: [Identifier] first
+#   26|               0: [Binary] Binary
+#   26|                 0: [Identifier] first
+#   26|                 1: [ReservedWord] +
+#   26|                 2: [Identifier] second
 #   26|               1: [ReservedWord] +
-#   26|               2: [Identifier] second
+#   26|               2: [Identifier] third
 #   26|             1: [ReservedWord] +
-#   26|             2: [Identifier] third
-#   26|           1: [ReservedWord] +
-#   26|           2: [Identifier] fourth
+#   26|             2: [Identifier] fourth
 #   27|         2: [ReservedWord] }
 #   30|   8: [Method] Method
 #   30|     0: [ReservedWord] def
@@ -5684,13 +5768,14 @@ params/params.rb:
 #   41|         1: [ReservedWord] :
 #   41|         2: [Integer] 7
 #   41|       6: [ReservedWord] )
-#   42|     3: [Binary] Binary
+#   42|     3: [BodyStatement] BodyStatement
 #   42|       0: [Binary] Binary
-#   42|         0: [Identifier] x
+#   42|         0: [Binary] Binary
+#   42|           0: [Identifier] x
+#   42|           1: [ReservedWord] +
+#   42|           2: [Identifier] foo
 #   42|         1: [ReservedWord] +
-#   42|         2: [Identifier] foo
-#   42|       1: [ReservedWord] +
-#   42|       2: [Identifier] bar
+#   42|         2: [Identifier] bar
 #   43|     4: [ReservedWord] end
 #   46|   12: [Method] Method
 #   46|     0: [ReservedWord] def
@@ -5701,25 +5786,26 @@ params/params.rb:
 #   46|         0: [ReservedWord] &
 #   46|         1: [Identifier] block
 #   46|       2: [ReservedWord] )
-#   47|     3: [Call] Call
-#   47|       0: [Identifier] puts
-#   47|       1: [ArgumentList] ArgumentList
-#   47|         0: [ReservedWord] (
-#   47|         1: [Call] Call
-#   47|           0: [Identifier] block
-#   47|           1: [ReservedWord] .
-#   47|           2: [Identifier] call
-#   47|           3: [ArgumentList] ArgumentList
-#   47|             0: [Pair] Pair
-#   47|               0: [HashKeySymbol] bar
-#   47|               1: [ReservedWord] :
-#   47|               2: [Integer] 2
-#   47|             1: [ReservedWord] ,
-#   47|             2: [Pair] Pair
-#   47|               0: [HashKeySymbol] foo
-#   47|               1: [ReservedWord] :
-#   47|               2: [Integer] 3
-#   47|         2: [ReservedWord] )
+#   47|     3: [BodyStatement] BodyStatement
+#   47|       0: [Call] Call
+#   47|         0: [Identifier] puts
+#   47|         1: [ArgumentList] ArgumentList
+#   47|           0: [ReservedWord] (
+#   47|           1: [Call] Call
+#   47|             0: [Identifier] block
+#   47|             1: [ReservedWord] .
+#   47|             2: [Identifier] call
+#   47|             3: [ArgumentList] ArgumentList
+#   47|               0: [Pair] Pair
+#   47|                 0: [HashKeySymbol] bar
+#   47|                 1: [ReservedWord] :
+#   47|                 2: [Integer] 2
+#   47|               1: [ReservedWord] ,
+#   47|               2: [Pair] Pair
+#   47|                 0: [HashKeySymbol] foo
+#   47|                 1: [ReservedWord] :
+#   47|                 2: [Integer] 3
+#   47|           2: [ReservedWord] )
 #   48|     4: [ReservedWord] end
 #   49|   13: [Call] Call
 #   49|     0: [Identifier] use_block_with_keyword
@@ -5736,10 +5822,11 @@ params/params.rb:
 #   49|           1: [ReservedWord] :
 #   49|           2: [Integer] 100
 #   49|         4: [ReservedWord] |
-#   50|       2: [Binary] Binary
-#   50|         0: [Identifier] xx
-#   50|         1: [ReservedWord] +
-#   50|         2: [Identifier] yy
+#   50|       2: [BodyStatement] BodyStatement
+#   50|         0: [Binary] Binary
+#   50|           0: [Identifier] xx
+#   50|           1: [ReservedWord] +
+#   50|           2: [Identifier] yy
 #   51|       3: [ReservedWord] end
 #   53|   14: [Assignment] Assignment
 #   53|     0: [Identifier] lambda_with_keyword_params
@@ -5761,13 +5848,14 @@ params/params.rb:
 #   53|         6: [ReservedWord] )
 #   53|       2: [Block] Block
 #   53|         0: [ReservedWord] {
-#   54|         1: [Binary] Binary
+#   54|         1: [BlockBody] BlockBody
 #   54|           0: [Binary] Binary
-#   54|             0: [Identifier] x
+#   54|             0: [Binary] Binary
+#   54|               0: [Identifier] x
+#   54|               1: [ReservedWord] +
+#   54|               2: [Identifier] y
 #   54|             1: [ReservedWord] +
-#   54|             2: [Identifier] y
-#   54|           1: [ReservedWord] +
-#   54|           2: [Identifier] z
+#   54|             2: [Identifier] z
 #   55|         2: [ReservedWord] }
 #   58|   15: [Method] Method
 #   58|     0: [ReservedWord] def
@@ -5796,15 +5884,16 @@ params/params.rb:
 #   62|         0: [ReservedWord] &
 #   62|         1: [Identifier] block
 #   62|       2: [ReservedWord] )
-#   63|     3: [Call] Call
-#   63|       0: [Identifier] block
-#   63|       1: [ReservedWord] .
-#   63|       2: [Identifier] call
-#   63|       3: [ArgumentList] ArgumentList
-#   63|         0: [String] String
-#   63|           0: [ReservedWord] '
-#   63|           1: [StringContent] Zeus
-#   63|           2: [ReservedWord] '
+#   63|     3: [BodyStatement] BodyStatement
+#   63|       0: [Call] Call
+#   63|         0: [Identifier] block
+#   63|         1: [ReservedWord] .
+#   63|         2: [Identifier] call
+#   63|         3: [ArgumentList] ArgumentList
+#   63|           0: [String] String
+#   63|             0: [ReservedWord] '
+#   63|             1: [StringContent] Zeus
+#   63|             2: [ReservedWord] '
 #   64|     4: [ReservedWord] end
 #   65|   17: [Call] Call
 #   65|     0: [Identifier] use_block_with_optional
@@ -5819,22 +5908,23 @@ params/params.rb:
 #   65|           1: [ReservedWord] =
 #   65|           2: [Integer] 99
 #   65|         4: [ReservedWord] |
-#   66|       2: [Call] Call
-#   66|         0: [Identifier] puts
-#   66|         1: [ArgumentList] ArgumentList
-#   66|           0: [String] String
-#   66|             0: [ReservedWord] "
-#   66|             1: [Interpolation] Interpolation
-#   66|               0: [ReservedWord] #{
-#   66|               1: [Identifier] name
-#   66|               2: [ReservedWord] }
-#   66|             2: [StringContent]  is 
-#   66|             3: [Interpolation] Interpolation
-#   66|               0: [ReservedWord] #{
-#   66|               1: [Identifier] age
-#   66|               2: [ReservedWord] }
-#   66|             4: [StringContent]  years old
-#   66|             5: [ReservedWord] "
+#   66|       2: [BodyStatement] BodyStatement
+#   66|         0: [Call] Call
+#   66|           0: [Identifier] puts
+#   66|           1: [ArgumentList] ArgumentList
+#   66|             0: [String] String
+#   66|               0: [ReservedWord] "
+#   66|               1: [Interpolation] Interpolation
+#   66|                 0: [ReservedWord] #{
+#   66|                 1: [Identifier] name
+#   66|                 2: [ReservedWord] }
+#   66|               2: [StringContent]  is 
+#   66|               3: [Interpolation] Interpolation
+#   66|                 0: [ReservedWord] #{
+#   66|                 1: [Identifier] age
+#   66|                 2: [ReservedWord] }
+#   66|               4: [StringContent]  years old
+#   66|               5: [ReservedWord] "
 #   67|       3: [ReservedWord] end
 #   70|   18: [Assignment] Assignment
 #   70|     0: [Identifier] lambda_with_optional_params
@@ -5857,13 +5947,14 @@ params/params.rb:
 #   70|         6: [ReservedWord] )
 #   70|       2: [Block] Block
 #   70|         0: [ReservedWord] {
-#   70|         1: [Binary] Binary
+#   70|         1: [BlockBody] BlockBody
 #   70|           0: [Binary] Binary
-#   70|             0: [Identifier] a
+#   70|             0: [Binary] Binary
+#   70|               0: [Identifier] a
+#   70|               1: [ReservedWord] +
+#   70|               2: [Identifier] b
 #   70|             1: [ReservedWord] +
-#   70|             2: [Identifier] b
-#   70|           1: [ReservedWord] +
-#   70|           2: [Identifier] c
+#   70|             2: [Identifier] c
 #   70|         2: [ReservedWord] }
 #   73|   19: [Method] Method
 #   73|     0: [ReservedWord] def
@@ -5902,23 +5993,24 @@ params/params.rb:
 #   81|       3: [BlockParameter] BlockParameter
 #   81|         0: [ReservedWord] &
 #   81|       4: [ReservedWord] )
-#   82|     3: [Call] Call
-#   82|       0: [Identifier] proc
-#   82|       1: [ArgumentList] ArgumentList
-#   82|         0: [ReservedWord] (
-#   82|         1: [BlockArgument] BlockArgument
-#   82|           0: [ReservedWord] &
-#   82|         2: [ReservedWord] )
-#   83|     4: [Call] Call
-#   83|       0: [Identifier] array
-#   83|       1: [ReservedWord] .
-#   83|       2: [Identifier] each
-#   83|       3: [ArgumentList] ArgumentList
-#   83|         0: [ReservedWord] (
-#   83|         1: [BlockArgument] BlockArgument
-#   83|           0: [ReservedWord] &
-#   83|         2: [ReservedWord] )
-#   84|     5: [ReservedWord] end
+#   82|     3: [BodyStatement] BodyStatement
+#   82|       0: [Call] Call
+#   82|         0: [Identifier] proc
+#   82|         1: [ArgumentList] ArgumentList
+#   82|           0: [ReservedWord] (
+#   82|           1: [BlockArgument] BlockArgument
+#   82|             0: [ReservedWord] &
+#   82|           2: [ReservedWord] )
+#   83|       1: [Call] Call
+#   83|         0: [Identifier] array
+#   83|         1: [ReservedWord] .
+#   83|         2: [Identifier] each
+#   83|         3: [ArgumentList] ArgumentList
+#   83|           0: [ReservedWord] (
+#   83|           1: [BlockArgument] BlockArgument
+#   83|             0: [ReservedWord] &
+#   83|           2: [ReservedWord] )
+#   84|     4: [ReservedWord] end
 #   86|   22: [Call] Call
 #   86|     0: [Identifier] run_block
 #   86|     1: [Block] Block
@@ -5931,10 +6023,11 @@ params/params.rb:
 #   86|         4: [ReservedWord] ,
 #   86|         5: [Identifier] z
 #   86|         6: [ReservedWord] |
-#   86|       2: [Call] Call
-#   86|         0: [Identifier] puts
-#   86|         1: [ArgumentList] ArgumentList
-#   86|           0: [Identifier] x
+#   86|       2: [BlockBody] BlockBody
+#   86|         0: [Call] Call
+#   86|           0: [Identifier] puts
+#   86|           1: [ArgumentList] ArgumentList
+#   86|             0: [Identifier] x
 #   86|       3: [ReservedWord] }
 #    1| [Comment] # Tests for the different kinds and contexts of parameters.
 #    3| [Comment] # Method containing identifier parameters
diff --git a/ruby/ql/test/library-tests/ast/ValueText.expected b/ruby/ql/test/library-tests/ast/ValueText.expected
index e66838fbe2c..1492d619e33 100644
--- a/ruby/ql/test/library-tests/ast/ValueText.expected
+++ b/ruby/ql/test/library-tests/ast/ValueText.expected
@@ -709,6 +709,7 @@ exprValue
 | literals/literals.rb:168:9:168:13 | <<SQL | \nselect * from table\n | string |
 | literals/literals.rb:175:11:175:16 | <<-BLA | \nsome text\nand some more\n   | string |
 | literals/literals.rb:180:9:180:19 | <<~SQUIGGLY | \n   indented stuff\n | string |
+| literals/literals.rb:189:9:189:15 | <<'DOC' | \n text without #{ interpolation } !\n | string |
 | literals/literals.rb:193:10:193:19 | <<`SCRIPT` | \n cat file.txt\n | string |
 | literals/literals.rb:197:5:197:6 | 42 | 42 | int |
 | literals/literals.rb:198:2:198:2 | :x | :x | symbol |
@@ -1585,6 +1586,7 @@ exprCfgNodeValue
 | literals/literals.rb:168:9:168:13 | <<SQL | \nselect * from table\n | string |
 | literals/literals.rb:175:11:175:16 | <<-BLA | \nsome text\nand some more\n   | string |
 | literals/literals.rb:180:9:180:19 | <<~SQUIGGLY | \n   indented stuff\n | string |
+| literals/literals.rb:189:9:189:15 | <<'DOC' | \n text without #{ interpolation } !\n | string |
 | literals/literals.rb:193:10:193:19 | <<`SCRIPT` | \n cat file.txt\n | string |
 | literals/literals.rb:197:5:197:6 | 42 | 42 | int |
 | literals/literals.rb:198:2:198:2 | :x | :x | symbol |
diff --git a/ruby/ql/test/library-tests/ast/literals/literals.expected b/ruby/ql/test/library-tests/ast/literals/literals.expected
index a11e5338d9b..b5fe30e46ac 100644
--- a/ruby/ql/test/library-tests/ast/literals/literals.expected
+++ b/ruby/ql/test/library-tests/ast/literals/literals.expected
@@ -227,7 +227,7 @@ allLiterals
 | literals.rb:175:11:175:16 | <<-BLA | HereDoc | \nsome text\nand some more\n   |
 | literals.rb:180:9:180:19 | <<~SQUIGGLY | HereDoc | \n   indented stuff\n |
 | literals.rb:184:9:184:15 | <<"DOC" | HereDoc | <none> |
-| literals.rb:189:9:189:15 | <<'DOC' | HereDoc | <none> |
+| literals.rb:189:9:189:15 | <<'DOC' | HereDoc | \n text without #{ interpolation } !\n |
 | literals.rb:193:10:193:19 | <<`SCRIPT` | HereDoc | \n cat file.txt\n |
 | literals.rb:197:5:197:6 | 42 | IntegerLiteral | 42 |
 | literals.rb:198:1:198:9 | {...} | HashLiteral | <none> |
@@ -237,6 +237,7 @@ allLiterals
 | literals.rb:199:1:199:9 | {...} | HashLiteral | <none> |
 | literals.rb:199:2:199:2 | :y | SymbolLiteral | :y |
 | literals.rb:199:7:199:7 | :Z | SymbolLiteral | :Z |
+| literals.rb:201:1:201:35 | "@foo: #{...} @@bar: #{...} $_..." | StringLiteral | <none> |
 stringlikeLiterals
 | literals.rb:59:1:59:2 | "" |  |
 | literals.rb:60:1:60:2 | "" |  |
@@ -345,12 +346,13 @@ stringlikeLiterals
 | literals.rb:175:11:175:16 | <<-BLA | \nsome text\nand some more\n   |
 | literals.rb:180:9:180:19 | <<~SQUIGGLY | \n   indented stuff\n |
 | literals.rb:184:9:184:15 | <<"DOC" | <none> |
-| literals.rb:189:9:189:15 | <<'DOC' | <none> |
+| literals.rb:189:9:189:15 | <<'DOC' | \n text without #{ interpolation } !\n |
 | literals.rb:193:10:193:19 | <<`SCRIPT` | \n cat file.txt\n |
 | literals.rb:198:2:198:2 | :x | :x |
 | literals.rb:198:6:198:6 | :y | :y |
 | literals.rb:199:2:199:2 | :y | :y |
 | literals.rb:199:7:199:7 | :Z | :Z |
+| literals.rb:201:1:201:35 | "@foo: #{...} @@bar: #{...} $_..." | <none> |
 stringLiterals
 | literals.rb:59:1:59:2 | "" |  |
 | literals.rb:60:1:60:2 | "" |  |
@@ -405,6 +407,7 @@ stringLiterals
 | literals.rb:163:1:163:34 | "abcdefghijklmnopqrstuvwxyzabcdef" | abcdefghijklmnopqrstuvwxyzabcdef |
 | literals.rb:164:1:164:35 | "foobarfoobarfoobarfoobarfooba..." | foobarfoobarfoobarfoobarfoobarfoo |
 | literals.rb:165:1:165:40 | "foobar\\\\foobar\\\\foobar\\\\fooba..." | foobar\\foobar\\foobar\\foobar\\foobar |
+| literals.rb:201:1:201:35 | "@foo: #{...} @@bar: #{...} $_..." | <none> |
 regExpLiterals
 | literals.rb:149:1:149:2 | // |  |  |
 | literals.rb:150:1:150:5 | /foo/ | foo |  |
@@ -626,14 +629,18 @@ stringComponents
 | literals.rb:184:9:184:15 | <<"DOC" | HereDoc | 0 | literals.rb:184:16:185:11 | \n text with  | StringTextComponent |
 | literals.rb:184:9:184:15 | <<"DOC" | HereDoc | 1 | literals.rb:185:12:185:29 | #{...} | StringInterpolationComponent |
 | literals.rb:184:9:184:15 | <<"DOC" | HereDoc | 2 | literals.rb:185:30:185:32 |  !\n | StringTextComponent |
-| literals.rb:189:9:189:15 | <<'DOC' | HereDoc | 0 | literals.rb:189:16:190:14 | \n text without  | StringTextComponent |
-| literals.rb:189:9:189:15 | <<'DOC' | HereDoc | 1 | literals.rb:190:15:190:32 | #{...} | StringInterpolationComponent |
-| literals.rb:189:9:189:15 | <<'DOC' | HereDoc | 2 | literals.rb:190:33:190:35 |  !\n | StringTextComponent |
+| literals.rb:189:9:189:15 | <<'DOC' | HereDoc | 0 | literals.rb:189:16:190:35 | \n text without #{ interpolation } !\n | StringTextComponent |
 | literals.rb:193:10:193:19 | <<`SCRIPT` | HereDoc | 0 | literals.rb:193:20:194:14 | \n cat file.txt\n | StringTextComponent |
 | literals.rb:198:2:198:2 | :x | SymbolLiteral | 0 | literals.rb:198:2:198:2 | x | StringTextComponent |
 | literals.rb:198:6:198:6 | :y | SymbolLiteral | 0 | literals.rb:198:6:198:6 | y | StringTextComponent |
 | literals.rb:199:2:199:2 | :y | SymbolLiteral | 0 | literals.rb:199:2:199:2 | y | StringTextComponent |
 | literals.rb:199:7:199:7 | :Z | SymbolLiteral | 0 | literals.rb:199:7:199:7 | Z | StringTextComponent |
+| literals.rb:201:1:201:35 | "@foo: #{...} @@bar: #{...} $_..." | StringLiteral | 0 | literals.rb:201:2:201:7 | @foo:  | StringTextComponent |
+| literals.rb:201:1:201:35 | "@foo: #{...} @@bar: #{...} $_..." | StringLiteral | 1 | literals.rb:201:8:201:12 | #{...} | StringInterpolationComponent |
+| literals.rb:201:1:201:35 | "@foo: #{...} @@bar: #{...} $_..." | StringLiteral | 2 | literals.rb:201:13:201:20 |  @@bar:  | StringTextComponent |
+| literals.rb:201:1:201:35 | "@foo: #{...} @@bar: #{...} $_..." | StringLiteral | 3 | literals.rb:201:21:201:26 | #{...} | StringInterpolationComponent |
+| literals.rb:201:1:201:35 | "@foo: #{...} @@bar: #{...} $_..." | StringLiteral | 4 | literals.rb:201:27:201:31 |  $_:  | StringTextComponent |
+| literals.rb:201:1:201:35 | "@foo: #{...} @@bar: #{...} $_..." | StringLiteral | 5 | literals.rb:201:32:201:34 | #{...} | StringInterpolationComponent |
 stringInterpolations
 | literals.rb:71:10:71:19 | #{...} | 0 | literals.rb:71:13:71:17 | ... + ... | AddExpr |
 | literals.rb:72:12:72:21 | #{...} | 0 | literals.rb:72:15:72:19 | ... + ... | AddExpr |
@@ -659,7 +666,9 @@ stringInterpolations
 | literals.rb:146:10:146:19 | #{...} | 0 | literals.rb:146:13:146:17 | ... - ... | SubExpr |
 | literals.rb:171:14:171:22 | #{...} | 0 | literals.rb:171:17:171:20 | call to name | MethodCall |
 | literals.rb:185:12:185:29 | #{...} | 0 | literals.rb:185:15:185:27 | call to interpolation | MethodCall |
-| literals.rb:190:15:190:32 | #{...} | 0 | literals.rb:190:18:190:30 | call to interpolation | MethodCall |
+| literals.rb:201:8:201:12 | #{...} | 0 | literals.rb:201:9:201:12 | @foo | InstanceVariableAccess |
+| literals.rb:201:21:201:26 | #{...} | 0 | literals.rb:201:22:201:26 | @@bar | ClassVariableAccess |
+| literals.rb:201:32:201:34 | #{...} | 0 | literals.rb:201:33:201:34 | $_ | GlobalVariableAccess |
 concatenatedStrings
 | literals.rb:75:1:75:17 | "..." "..." | foobarbaz | 0 | literals.rb:75:1:75:5 | "foo" |
 | literals.rb:75:1:75:17 | "..." "..." | foobarbaz | 1 | literals.rb:75:7:75:11 | "bar" |
diff --git a/ruby/ql/test/library-tests/ast/literals/literals.rb b/ruby/ql/test/library-tests/ast/literals/literals.rb
index 6ddfc74e88f..e3f13c6bfea 100644
--- a/ruby/ql/test/library-tests/ast/literals/literals.rb
+++ b/ruby/ql/test/library-tests/ast/literals/literals.rb
@@ -196,4 +196,6 @@ SCRIPT
 
 x = 42
 {x:, y:5}
-{y: , Z:}
\ No newline at end of file
+{y: , Z:}
+
+"@foo: #@foo @@bar: #@@bar $_: #$_"
\ No newline at end of file
diff --git a/ruby/ql/test/library-tests/dataflow/api-graphs/test1.rb b/ruby/ql/test/library-tests/dataflow/api-graphs/test1.rb
index 65e5ba914e7..daea2a4e6bb 100644
--- a/ruby/ql/test/library-tests/dataflow/api-graphs/test1.rb
+++ b/ruby/ql/test/library-tests/dataflow/api-graphs/test1.rb
@@ -46,7 +46,7 @@ end
 module M2
     class C3 < M1::C1 #$ use=getMember("M1").getMember("C1")
     end
-    
+
     class C4 < C2 #$ use=getMember("C2")
     end
 end
@@ -65,6 +65,6 @@ Foo.foo(a,b:c) #$ use=getMember("Foo").getMethod("foo").getReturn() def=getMembe
 
 def userDefinedFunction(x, y)
     x.noApiGraph(y)
-    x.customEntryPointCall(y) #$ call=CustomEntryPointCall use=CustomEntryPointCall.getReturn() rhs=CustomEntryPointCall.getParameter(0)
-    x.customEntryPointUse(y) #$ use=CustomEntryPointUse
+    x.customEntryPointCall(y) #$ call=entryPoint("CustomEntryPointCall") use=entryPoint("CustomEntryPointCall").getReturn() rhs=entryPoint("CustomEntryPointCall").getParameter(0)
+    x.customEntryPointUse(y) #$ use=entryPoint("CustomEntryPointUse")
 end
diff --git a/ruby/ql/test/library-tests/dataflow/api-graphs/use.ql b/ruby/ql/test/library-tests/dataflow/api-graphs/use.ql
index c47939a8405..f1c93158c42 100644
--- a/ruby/ql/test/library-tests/dataflow/api-graphs/use.ql
+++ b/ruby/ql/test/library-tests/dataflow/api-graphs/use.ql
@@ -12,7 +12,7 @@ class CustomEntryPointCall extends API::EntryPoint {
 class CustomEntryPointUse extends API::EntryPoint {
   CustomEntryPointUse() { this = "CustomEntryPointUse" }
 
-  override DataFlow::LocalSourceNode getAUse() {
+  override DataFlow::LocalSourceNode getASource() {
     result.(DataFlow::CallNode).getMethodName() = "customEntryPointUse"
   }
 }
diff --git a/ruby/ql/test/library-tests/dataflow/call-sensitivity/call-sensitivity.expected b/ruby/ql/test/library-tests/dataflow/call-sensitivity/call-sensitivity.expected
index 04b63c7cf4e..d20b5eff7af 100644
--- a/ruby/ql/test/library-tests/dataflow/call-sensitivity/call-sensitivity.expected
+++ b/ruby/ql/test/library-tests/dataflow/call-sensitivity/call-sensitivity.expected
@@ -1,46 +1,92 @@
+failures
 edges
-| call_sensitivity.rb:7:13:7:13 | x :  | call_sensitivity.rb:8:11:8:11 | x :  |
-| call_sensitivity.rb:8:11:8:11 | x :  | call_sensitivity.rb:15:20:15:20 | x :  |
-| call_sensitivity.rb:15:9:15:15 | "taint" :  | call_sensitivity.rb:7:13:7:13 | x :  |
-| call_sensitivity.rb:15:20:15:20 | x :  | call_sensitivity.rb:15:28:15:28 | x |
-| call_sensitivity.rb:17:27:17:27 | x :  | call_sensitivity.rb:18:17:18:17 | x :  |
-| call_sensitivity.rb:17:27:17:27 | x :  | call_sensitivity.rb:18:17:18:17 | x :  |
-| call_sensitivity.rb:17:27:17:27 | x :  | call_sensitivity.rb:18:17:18:17 | x :  |
-| call_sensitivity.rb:18:17:18:17 | x :  | call_sensitivity.rb:27:17:27:17 | x :  |
-| call_sensitivity.rb:18:17:18:17 | x :  | call_sensitivity.rb:36:23:36:23 | x :  |
-| call_sensitivity.rb:18:17:18:17 | x :  | call_sensitivity.rb:39:24:39:24 | x :  |
-| call_sensitivity.rb:27:17:27:17 | x :  | call_sensitivity.rb:27:27:27:27 | x |
-| call_sensitivity.rb:28:25:28:31 | "taint" :  | call_sensitivity.rb:17:27:17:27 | x :  |
-| call_sensitivity.rb:36:23:36:23 | x :  | call_sensitivity.rb:36:31:36:31 | x |
-| call_sensitivity.rb:37:25:37:31 | "taint" :  | call_sensitivity.rb:17:27:17:27 | x :  |
-| call_sensitivity.rb:39:24:39:24 | x :  | call_sensitivity.rb:39:32:39:32 | x |
-| call_sensitivity.rb:40:26:40:32 | "taint" :  | call_sensitivity.rb:17:27:17:27 | x :  |
+| call_sensitivity.rb:9:7:9:13 | call to taint :  | call_sensitivity.rb:9:6:9:14 | ( ... ) |
+| call_sensitivity.rb:9:7:9:13 | call to taint :  | call_sensitivity.rb:9:6:9:14 | ( ... ) |
+| call_sensitivity.rb:11:13:11:13 | x :  | call_sensitivity.rb:12:11:12:11 | x :  |
+| call_sensitivity.rb:11:13:11:13 | x :  | call_sensitivity.rb:12:11:12:11 | x :  |
+| call_sensitivity.rb:12:11:12:11 | x :  | call_sensitivity.rb:19:22:19:22 | x :  |
+| call_sensitivity.rb:12:11:12:11 | x :  | call_sensitivity.rb:19:22:19:22 | x :  |
+| call_sensitivity.rb:19:9:19:17 | ( ... ) :  | call_sensitivity.rb:11:13:11:13 | x :  |
+| call_sensitivity.rb:19:9:19:17 | ( ... ) :  | call_sensitivity.rb:11:13:11:13 | x :  |
+| call_sensitivity.rb:19:10:19:16 | call to taint :  | call_sensitivity.rb:19:9:19:17 | ( ... ) :  |
+| call_sensitivity.rb:19:10:19:16 | call to taint :  | call_sensitivity.rb:19:9:19:17 | ( ... ) :  |
+| call_sensitivity.rb:19:22:19:22 | x :  | call_sensitivity.rb:19:30:19:30 | x |
+| call_sensitivity.rb:19:22:19:22 | x :  | call_sensitivity.rb:19:30:19:30 | x |
+| call_sensitivity.rb:21:27:21:27 | x :  | call_sensitivity.rb:22:17:22:17 | x :  |
+| call_sensitivity.rb:21:27:21:27 | x :  | call_sensitivity.rb:22:17:22:17 | x :  |
+| call_sensitivity.rb:21:27:21:27 | x :  | call_sensitivity.rb:22:17:22:17 | x :  |
+| call_sensitivity.rb:21:27:21:27 | x :  | call_sensitivity.rb:22:17:22:17 | x :  |
+| call_sensitivity.rb:21:27:21:27 | x :  | call_sensitivity.rb:22:17:22:17 | x :  |
+| call_sensitivity.rb:21:27:21:27 | x :  | call_sensitivity.rb:22:17:22:17 | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | call_sensitivity.rb:31:17:31:17 | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | call_sensitivity.rb:31:17:31:17 | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | call_sensitivity.rb:40:23:40:23 | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | call_sensitivity.rb:40:23:40:23 | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | call_sensitivity.rb:43:24:43:24 | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | call_sensitivity.rb:43:24:43:24 | x :  |
+| call_sensitivity.rb:31:17:31:17 | x :  | call_sensitivity.rb:31:27:31:27 | x |
+| call_sensitivity.rb:31:17:31:17 | x :  | call_sensitivity.rb:31:27:31:27 | x |
+| call_sensitivity.rb:32:25:32:32 | call to taint :  | call_sensitivity.rb:21:27:21:27 | x :  |
+| call_sensitivity.rb:32:25:32:32 | call to taint :  | call_sensitivity.rb:21:27:21:27 | x :  |
+| call_sensitivity.rb:40:23:40:23 | x :  | call_sensitivity.rb:40:31:40:31 | x |
+| call_sensitivity.rb:40:23:40:23 | x :  | call_sensitivity.rb:40:31:40:31 | x |
+| call_sensitivity.rb:41:25:41:32 | call to taint :  | call_sensitivity.rb:21:27:21:27 | x :  |
+| call_sensitivity.rb:41:25:41:32 | call to taint :  | call_sensitivity.rb:21:27:21:27 | x :  |
+| call_sensitivity.rb:43:24:43:24 | x :  | call_sensitivity.rb:43:32:43:32 | x |
+| call_sensitivity.rb:43:24:43:24 | x :  | call_sensitivity.rb:43:32:43:32 | x |
+| call_sensitivity.rb:44:26:44:33 | call to taint :  | call_sensitivity.rb:21:27:21:27 | x :  |
+| call_sensitivity.rb:44:26:44:33 | call to taint :  | call_sensitivity.rb:21:27:21:27 | x :  |
 nodes
-| call_sensitivity.rb:5:6:5:12 | "taint" | semmle.label | "taint" |
-| call_sensitivity.rb:7:13:7:13 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:8:11:8:11 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:15:9:15:15 | "taint" :  | semmle.label | "taint" :  |
-| call_sensitivity.rb:15:20:15:20 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:15:28:15:28 | x | semmle.label | x |
-| call_sensitivity.rb:17:27:17:27 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:17:27:17:27 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:17:27:17:27 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:18:17:18:17 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:18:17:18:17 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:18:17:18:17 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:27:17:27:17 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:27:27:27:27 | x | semmle.label | x |
-| call_sensitivity.rb:28:25:28:31 | "taint" :  | semmle.label | "taint" :  |
-| call_sensitivity.rb:36:23:36:23 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:36:31:36:31 | x | semmle.label | x |
-| call_sensitivity.rb:37:25:37:31 | "taint" :  | semmle.label | "taint" :  |
-| call_sensitivity.rb:39:24:39:24 | x :  | semmle.label | x :  |
-| call_sensitivity.rb:39:32:39:32 | x | semmle.label | x |
-| call_sensitivity.rb:40:26:40:32 | "taint" :  | semmle.label | "taint" :  |
+| call_sensitivity.rb:9:6:9:14 | ( ... ) | semmle.label | ( ... ) |
+| call_sensitivity.rb:9:6:9:14 | ( ... ) | semmle.label | ( ... ) |
+| call_sensitivity.rb:9:7:9:13 | call to taint :  | semmle.label | call to taint :  |
+| call_sensitivity.rb:9:7:9:13 | call to taint :  | semmle.label | call to taint :  |
+| call_sensitivity.rb:11:13:11:13 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:11:13:11:13 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:12:11:12:11 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:12:11:12:11 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:19:9:19:17 | ( ... ) :  | semmle.label | ( ... ) :  |
+| call_sensitivity.rb:19:9:19:17 | ( ... ) :  | semmle.label | ( ... ) :  |
+| call_sensitivity.rb:19:10:19:16 | call to taint :  | semmle.label | call to taint :  |
+| call_sensitivity.rb:19:10:19:16 | call to taint :  | semmle.label | call to taint :  |
+| call_sensitivity.rb:19:22:19:22 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:19:22:19:22 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:19:30:19:30 | x | semmle.label | x |
+| call_sensitivity.rb:19:30:19:30 | x | semmle.label | x |
+| call_sensitivity.rb:21:27:21:27 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:21:27:21:27 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:21:27:21:27 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:21:27:21:27 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:21:27:21:27 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:21:27:21:27 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:22:17:22:17 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:31:17:31:17 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:31:17:31:17 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:31:27:31:27 | x | semmle.label | x |
+| call_sensitivity.rb:31:27:31:27 | x | semmle.label | x |
+| call_sensitivity.rb:32:25:32:32 | call to taint :  | semmle.label | call to taint :  |
+| call_sensitivity.rb:32:25:32:32 | call to taint :  | semmle.label | call to taint :  |
+| call_sensitivity.rb:40:23:40:23 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:40:23:40:23 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:40:31:40:31 | x | semmle.label | x |
+| call_sensitivity.rb:40:31:40:31 | x | semmle.label | x |
+| call_sensitivity.rb:41:25:41:32 | call to taint :  | semmle.label | call to taint :  |
+| call_sensitivity.rb:41:25:41:32 | call to taint :  | semmle.label | call to taint :  |
+| call_sensitivity.rb:43:24:43:24 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:43:24:43:24 | x :  | semmle.label | x :  |
+| call_sensitivity.rb:43:32:43:32 | x | semmle.label | x |
+| call_sensitivity.rb:43:32:43:32 | x | semmle.label | x |
+| call_sensitivity.rb:44:26:44:33 | call to taint :  | semmle.label | call to taint :  |
+| call_sensitivity.rb:44:26:44:33 | call to taint :  | semmle.label | call to taint :  |
 subpaths
 #select
-| call_sensitivity.rb:5:6:5:12 | "taint" | call_sensitivity.rb:5:6:5:12 | "taint" | call_sensitivity.rb:5:6:5:12 | "taint" | $@ | call_sensitivity.rb:5:6:5:12 | "taint" | "taint" |
-| call_sensitivity.rb:15:28:15:28 | x | call_sensitivity.rb:15:9:15:15 | "taint" :  | call_sensitivity.rb:15:28:15:28 | x | $@ | call_sensitivity.rb:15:9:15:15 | "taint" :  | "taint" :  |
-| call_sensitivity.rb:27:27:27:27 | x | call_sensitivity.rb:28:25:28:31 | "taint" :  | call_sensitivity.rb:27:27:27:27 | x | $@ | call_sensitivity.rb:28:25:28:31 | "taint" :  | "taint" :  |
-| call_sensitivity.rb:36:31:36:31 | x | call_sensitivity.rb:37:25:37:31 | "taint" :  | call_sensitivity.rb:36:31:36:31 | x | $@ | call_sensitivity.rb:37:25:37:31 | "taint" :  | "taint" :  |
-| call_sensitivity.rb:39:32:39:32 | x | call_sensitivity.rb:40:26:40:32 | "taint" :  | call_sensitivity.rb:39:32:39:32 | x | $@ | call_sensitivity.rb:40:26:40:32 | "taint" :  | "taint" :  |
+| call_sensitivity.rb:9:6:9:14 | ( ... ) | call_sensitivity.rb:9:7:9:13 | call to taint :  | call_sensitivity.rb:9:6:9:14 | ( ... ) | $@ | call_sensitivity.rb:9:7:9:13 | call to taint :  | call to taint :  |
+| call_sensitivity.rb:19:30:19:30 | x | call_sensitivity.rb:19:10:19:16 | call to taint :  | call_sensitivity.rb:19:30:19:30 | x | $@ | call_sensitivity.rb:19:10:19:16 | call to taint :  | call to taint :  |
+| call_sensitivity.rb:31:27:31:27 | x | call_sensitivity.rb:32:25:32:32 | call to taint :  | call_sensitivity.rb:31:27:31:27 | x | $@ | call_sensitivity.rb:32:25:32:32 | call to taint :  | call to taint :  |
+| call_sensitivity.rb:40:31:40:31 | x | call_sensitivity.rb:41:25:41:32 | call to taint :  | call_sensitivity.rb:40:31:40:31 | x | $@ | call_sensitivity.rb:41:25:41:32 | call to taint :  | call to taint :  |
+| call_sensitivity.rb:43:32:43:32 | x | call_sensitivity.rb:44:26:44:33 | call to taint :  | call_sensitivity.rb:43:32:43:32 | x | $@ | call_sensitivity.rb:44:26:44:33 | call to taint :  | call to taint :  |
diff --git a/ruby/ql/test/library-tests/dataflow/call-sensitivity/call-sensitivity.ql b/ruby/ql/test/library-tests/dataflow/call-sensitivity/call-sensitivity.ql
index 50ab230609a..fc212a8e4a0 100644
--- a/ruby/ql/test/library-tests/dataflow/call-sensitivity/call-sensitivity.ql
+++ b/ruby/ql/test/library-tests/dataflow/call-sensitivity/call-sensitivity.ql
@@ -4,23 +4,9 @@
 
 import ruby
 import codeql.ruby.DataFlow
+import TestUtilities.InlineFlowTest
 import DataFlow::PathGraph
 
-class Conf extends DataFlow::Configuration {
-  Conf() { this = "Conf" }
-
-  override predicate isSource(DataFlow::Node src) {
-    src.asExpr().getExpr().(StringLiteral).getConstantValue().isString("taint")
-  }
-
-  override predicate isSink(DataFlow::Node sink) {
-    exists(MethodCall mc |
-      mc.getMethodName() = "sink" and
-      mc.getAnArgument() = sink.asExpr().getExpr()
-    )
-  }
-}
-
-from DataFlow::PathNode source, DataFlow::PathNode sink, Conf conf
+from DataFlow::PathNode source, DataFlow::PathNode sink, DefaultTaintFlowConf conf
 where conf.hasFlowPath(source, sink)
 select sink, source, sink, "$@", source, source.toString()
diff --git a/ruby/ql/test/library-tests/dataflow/call-sensitivity/call_sensitivity.rb b/ruby/ql/test/library-tests/dataflow/call-sensitivity/call_sensitivity.rb
index 0d08ef22f55..89a77cff994 100644
--- a/ruby/ql/test/library-tests/dataflow/call-sensitivity/call_sensitivity.rb
+++ b/ruby/ql/test/library-tests/dataflow/call-sensitivity/call_sensitivity.rb
@@ -1,43 +1,47 @@
-def sink s
-    puts s
+def taint x
+    x
 end
 
-sink "taint"
+def sink x
+    puts "SINK: #{x}"
+end
+
+sink (taint 1) # $ hasValueFlow=1
 
 def yielder x
     yield x
 end
 
-yielder "no taint" { |x| sink x } # no flow
+yielder ("no taint") { |x| sink x }
 
-yielder "taint" { |x| puts x } # no flow
+yielder (taint 2) { |x| puts x }
 
-yielder "taint" { |x| sink x } # flow
+yielder (taint 3) { |x| sink x } # $ hasValueFlow=3
 
 def apply_lambda (lambda, x)
     lambda.call(x)
 end
 
 my_lambda = -> (x) { sink x }
-apply_lambda(my_lambda, "no taint") # no flow
+apply_lambda(my_lambda, "no taint")
 
 my_lambda = -> (x) { puts x }
-apply_lambda(my_lambda, "taint") # no flow
+apply_lambda(my_lambda, taint(4))
 
-my_lambda = -> (x) { sink x }
-apply_lambda(my_lambda, "taint") # flow
+my_lambda = -> (x) { sink x } # $ hasValueFlow=5
+apply_lambda(my_lambda, taint(5))
 
 my_lambda = lambda { |x| sink x }
-apply_lambda(my_lambda, "no taint") # no flow
+apply_lambda(my_lambda, "no taint")
 
 my_lambda = lambda { |x| puts x }
-apply_lambda(my_lambda, "taint") # no flow
+apply_lambda(my_lambda, taint(6))
 
-my_lambda = lambda { |x| sink x }
-apply_lambda(my_lambda, "taint") # flow
+my_lambda = lambda { |x| sink x } # $ hasValueFlow=7
+apply_lambda(my_lambda, taint(7))
 
-MY_LAMBDA1 = lambda { |x| sink x }
-apply_lambda(MY_LAMBDA1, "taint") # flow
+MY_LAMBDA1 = lambda { |x| sink x } # $ hasValueFlow=8
+apply_lambda(MY_LAMBDA1, taint(8))
 
 MY_LAMBDA2 = lambda { |x| puts x }
-apply_lambda(MY_LAMBDA2, "taint") # no flow
+apply_lambda(MY_LAMBDA2, taint(9))
diff --git a/ruby/ql/test/library-tests/dataflow/global/Flow.expected b/ruby/ql/test/library-tests/dataflow/global/Flow.expected
index 9ee03271537..52d23cdaa65 100644
--- a/ruby/ql/test/library-tests/dataflow/global/Flow.expected
+++ b/ruby/ql/test/library-tests/dataflow/global/Flow.expected
@@ -55,12 +55,6 @@ edges
 | instance_variables.rb:32:16:32:25 | call to source :  | instance_variables.rb:32:1:32:4 | [post] foo3 [@field] :  |
 | instance_variables.rb:33:6:33:9 | foo3 [@field] :  | instance_variables.rb:33:6:33:15 | call to field |
 | instance_variables.rb:33:6:33:9 | foo3 [@field] :  | instance_variables.rb:33:6:33:15 | call to field |
-| instance_variables.rb:36:1:36:4 | [post] foo4 [@other] :  | instance_variables.rb:37:6:37:9 | foo4 [@other] :  |
-| instance_variables.rb:36:1:36:4 | [post] foo4 [@other] :  | instance_variables.rb:37:6:37:9 | foo4 [@other] :  |
-| instance_variables.rb:36:14:36:23 | call to source :  | instance_variables.rb:36:1:36:4 | [post] foo4 [@other] :  |
-| instance_variables.rb:36:14:36:23 | call to source :  | instance_variables.rb:36:1:36:4 | [post] foo4 [@other] :  |
-| instance_variables.rb:37:6:37:9 | foo4 [@other] :  | instance_variables.rb:37:6:37:15 | call to other |
-| instance_variables.rb:37:6:37:9 | foo4 [@other] :  | instance_variables.rb:37:6:37:15 | call to other |
 nodes
 | instance_variables.rb:2:19:2:19 | x :  | semmle.label | x :  |
 | instance_variables.rb:2:19:2:19 | x :  | semmle.label | x :  |
@@ -122,14 +116,6 @@ nodes
 | instance_variables.rb:33:6:33:9 | foo3 [@field] :  | semmle.label | foo3 [@field] :  |
 | instance_variables.rb:33:6:33:15 | call to field | semmle.label | call to field |
 | instance_variables.rb:33:6:33:15 | call to field | semmle.label | call to field |
-| instance_variables.rb:36:1:36:4 | [post] foo4 [@other] :  | semmle.label | [post] foo4 [@other] :  |
-| instance_variables.rb:36:1:36:4 | [post] foo4 [@other] :  | semmle.label | [post] foo4 [@other] :  |
-| instance_variables.rb:36:14:36:23 | call to source :  | semmle.label | call to source :  |
-| instance_variables.rb:36:14:36:23 | call to source :  | semmle.label | call to source :  |
-| instance_variables.rb:37:6:37:9 | foo4 [@other] :  | semmle.label | foo4 [@other] :  |
-| instance_variables.rb:37:6:37:9 | foo4 [@other] :  | semmle.label | foo4 [@other] :  |
-| instance_variables.rb:37:6:37:15 | call to other | semmle.label | call to other |
-| instance_variables.rb:37:6:37:15 | call to other | semmle.label | call to other |
 subpaths
 | instance_variables.rb:16:15:16:24 | call to source :  | instance_variables.rb:2:19:2:19 | x :  | instance_variables.rb:3:9:3:14 | [post] self [@field] :  | instance_variables.rb:16:1:16:3 | [post] foo [@field] :  |
 | instance_variables.rb:16:15:16:24 | call to source :  | instance_variables.rb:2:19:2:19 | x :  | instance_variables.rb:3:9:3:14 | [post] self [@field] :  | instance_variables.rb:16:1:16:3 | [post] foo [@field] :  |
@@ -149,4 +135,3 @@ subpaths
 | instance_variables.rb:25:6:25:15 | call to field | instance_variables.rb:24:14:24:23 | call to source :  | instance_variables.rb:25:6:25:15 | call to field | $@ | instance_variables.rb:24:14:24:23 | call to source :  | call to source :  |
 | instance_variables.rb:29:6:29:19 | call to get_field | instance_variables.rb:28:14:28:23 | call to source :  | instance_variables.rb:29:6:29:19 | call to get_field | $@ | instance_variables.rb:28:14:28:23 | call to source :  | call to source :  |
 | instance_variables.rb:33:6:33:15 | call to field | instance_variables.rb:32:16:32:25 | call to source :  | instance_variables.rb:33:6:33:15 | call to field | $@ | instance_variables.rb:32:16:32:25 | call to source :  | call to source :  |
-| instance_variables.rb:37:6:37:15 | call to other | instance_variables.rb:36:14:36:23 | call to source :  | instance_variables.rb:37:6:37:15 | call to other | $@ | instance_variables.rb:36:14:36:23 | call to source :  | call to source :  |
diff --git a/ruby/ql/test/library-tests/dataflow/global/instance_variables.rb b/ruby/ql/test/library-tests/dataflow/global/instance_variables.rb
index 93bdf207be2..056fe98a7b7 100644
--- a/ruby/ql/test/library-tests/dataflow/global/instance_variables.rb
+++ b/ruby/ql/test/library-tests/dataflow/global/instance_variables.rb
@@ -34,4 +34,4 @@ sink(foo3.field) # $ hasValueFlow=22
 
 foo4 = "hello"
 foo4.other = source(23)
-sink(foo4.other) # $ hasValueFlow=23
+sink(foo4.other) # no field flow for constants
diff --git a/ruby/ql/test/library-tests/dataflow/summaries/Summaries.expected b/ruby/ql/test/library-tests/dataflow/summaries/Summaries.expected
index 1669a6b07fa..43b76952015 100644
--- a/ruby/ql/test/library-tests/dataflow/summaries/Summaries.expected
+++ b/ruby/ql/test/library-tests/dataflow/summaries/Summaries.expected
@@ -32,6 +32,8 @@ edges
 | summaries.rb:1:11:1:36 | call to identity :  | summaries.rb:114:21:114:27 | tainted |
 | summaries.rb:1:11:1:36 | call to identity :  | summaries.rb:117:26:117:32 | tainted |
 | summaries.rb:1:11:1:36 | call to identity :  | summaries.rb:117:26:117:32 | tainted |
+| summaries.rb:1:11:1:36 | call to identity :  | summaries.rb:119:23:119:29 | tainted |
+| summaries.rb:1:11:1:36 | call to identity :  | summaries.rb:119:23:119:29 | tainted |
 | summaries.rb:1:20:1:36 | call to source :  | summaries.rb:1:11:1:36 | call to identity :  |
 | summaries.rb:1:20:1:36 | call to source :  | summaries.rb:1:11:1:36 | call to identity :  |
 | summaries.rb:4:12:7:3 | call to apply_block :  | summaries.rb:9:6:9:13 | tainted2 |
@@ -109,6 +111,7 @@ edges
 | summaries.rb:104:16:104:22 | [post] tainted :  | summaries.rb:113:16:113:22 | tainted |
 | summaries.rb:104:16:104:22 | [post] tainted :  | summaries.rb:114:21:114:27 | tainted |
 | summaries.rb:104:16:104:22 | [post] tainted :  | summaries.rb:117:26:117:32 | tainted |
+| summaries.rb:104:16:104:22 | [post] tainted :  | summaries.rb:119:23:119:29 | tainted |
 | summaries.rb:104:16:104:22 | tainted :  | summaries.rb:104:16:104:22 | [post] tainted :  |
 | summaries.rb:104:16:104:22 | tainted :  | summaries.rb:104:25:104:25 | [post] y :  |
 | summaries.rb:104:16:104:22 | tainted :  | summaries.rb:104:33:104:33 | [post] z :  |
@@ -242,6 +245,8 @@ nodes
 | summaries.rb:114:21:114:27 | tainted | semmle.label | tainted |
 | summaries.rb:117:26:117:32 | tainted | semmle.label | tainted |
 | summaries.rb:117:26:117:32 | tainted | semmle.label | tainted |
+| summaries.rb:119:23:119:29 | tainted | semmle.label | tainted |
+| summaries.rb:119:23:119:29 | tainted | semmle.label | tainted |
 subpaths
 invalidSpecComponent
 #select
@@ -299,6 +304,8 @@ invalidSpecComponent
 | summaries.rb:114:21:114:27 | tainted | summaries.rb:1:20:1:36 | call to source :  | summaries.rb:114:21:114:27 | tainted | $@ | summaries.rb:1:20:1:36 | call to source :  | call to source :  |
 | summaries.rb:117:26:117:32 | tainted | summaries.rb:1:20:1:36 | call to source :  | summaries.rb:117:26:117:32 | tainted | $@ | summaries.rb:1:20:1:36 | call to source :  | call to source :  |
 | summaries.rb:117:26:117:32 | tainted | summaries.rb:1:20:1:36 | call to source :  | summaries.rb:117:26:117:32 | tainted | $@ | summaries.rb:1:20:1:36 | call to source :  | call to source :  |
+| summaries.rb:119:23:119:29 | tainted | summaries.rb:1:20:1:36 | call to source :  | summaries.rb:119:23:119:29 | tainted | $@ | summaries.rb:1:20:1:36 | call to source :  | call to source :  |
+| summaries.rb:119:23:119:29 | tainted | summaries.rb:1:20:1:36 | call to source :  | summaries.rb:119:23:119:29 | tainted | $@ | summaries.rb:1:20:1:36 | call to source :  | call to source :  |
 warning
 | CSV type row should have 5 columns but has 2: test;TooFewColumns |
 | CSV type row should have 5 columns but has 8: test;TooManyColumns;;;Member[Foo].Instance;too;many;columns |
diff --git a/ruby/ql/test/library-tests/dataflow/summaries/Summaries.ql b/ruby/ql/test/library-tests/dataflow/summaries/Summaries.ql
index c81af2546e7..023ba452851 100644
--- a/ruby/ql/test/library-tests/dataflow/summaries/Summaries.ql
+++ b/ruby/ql/test/library-tests/dataflow/summaries/Summaries.ql
@@ -102,6 +102,14 @@ private class TypeFromModel extends ModelInput::TypeModelCsv {
   }
 }
 
+private class TypeFromCodeQL extends ModelInput::TypeModel {
+  override DataFlow::Node getASource(string package, string type) {
+    package = "test" and
+    type = "FooOrBar" and
+    result.asExpr().getExpr().getConstantValue().getString() = "magic_string"
+  }
+}
+
 private class InvalidTypeModel extends ModelInput::TypeModelCsv {
   override predicate row(string row) {
     row =
diff --git a/ruby/ql/test/library-tests/dataflow/summaries/summaries.rb b/ruby/ql/test/library-tests/dataflow/summaries/summaries.rb
index cf92b7948e7..51587ab050d 100644
--- a/ruby/ql/test/library-tests/dataflow/summaries/summaries.rb
+++ b/ruby/ql/test/library-tests/dataflow/summaries/summaries.rb
@@ -115,3 +115,6 @@ Foo.sinkAnyArg(key: tainted) # $ hasValueFlow=tainted
 
 Foo.sinkAnyNamedArg(tainted)
 Foo.sinkAnyNamedArg(key: tainted) # $ hasValueFlow=tainted
+
+"magic_string".method(tainted) # $ hasValueFlow=tainted
+"magic_string2".method(tainted)
diff --git a/ruby/ql/test/library-tests/frameworks/ActionView.ql b/ruby/ql/test/library-tests/frameworks/ActionView.ql
index da9381087fd..da5f03467a1 100644
--- a/ruby/ql/test/library-tests/frameworks/ActionView.ql
+++ b/ruby/ql/test/library-tests/frameworks/ActionView.ql
@@ -13,6 +13,6 @@ query predicate renderToCalls(RenderToCall c) { any() }
 
 query predicate linkToCalls(LinkToCall c) { any() }
 
-query predicate httpResponses(HTTP::Server::HttpResponse r, DataFlow::Node body, string mimeType) {
+query predicate httpResponses(Http::Server::HttpResponse r, DataFlow::Node body, string mimeType) {
   r.getBody() = body and r.getMimetype() = mimeType
 }
diff --git a/ruby/ql/test/library-tests/frameworks/action_view/ActionView.expected b/ruby/ql/test/library-tests/frameworks/action_view/ActionView.expected
new file mode 100644
index 00000000000..6b228de4219
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/action_view/ActionView.expected
@@ -0,0 +1 @@
+| ActionView.rb:5:39:5:92 | call to new | ActionView.rb:5:74:5:82 | view_path |
diff --git a/ruby/ql/test/library-tests/frameworks/action_view/ActionView.ql b/ruby/ql/test/library-tests/frameworks/action_view/ActionView.ql
new file mode 100644
index 00000000000..578f975b8e2
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/action_view/ActionView.ql
@@ -0,0 +1,6 @@
+import codeql.ruby.Concepts
+import codeql.ruby.DataFlow
+
+query predicate fileSystemResolverAccesses(FileSystemAccess a, DataFlow::Node path) {
+  a.getAPathArgument() = path
+}
diff --git a/ruby/ql/test/library-tests/frameworks/action_view/ActionView.rb b/ruby/ql/test/library-tests/frameworks/action_view/ActionView.rb
new file mode 100644
index 00000000000..d6d6c794c40
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/action_view/ActionView.rb
@@ -0,0 +1,6 @@
+
+def setup_view_paths
+  view_path =  Rails.root.join("/path/to/views")
+  pattern = ":prefix/:action{.:formats,}"
+  ActionController::Base.view_paths = ActionView::FileSystemResolver.new(view_path, pattern)
+end
\ No newline at end of file
diff --git a/ruby/ql/test/library-tests/frameworks/active_resource/ActiveResource.expected b/ruby/ql/test/library-tests/frameworks/active_resource/ActiveResource.expected
new file mode 100644
index 00000000000..3cb31c4c12c
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/active_resource/ActiveResource.expected
@@ -0,0 +1,52 @@
+modelClasses
+| active_resource.rb:1:1:3:3 | Person | active_resource.rb:2:3:2:11 | call to site= | false |
+| active_resource.rb:29:1:31:3 | Post | active_resource.rb:30:3:30:11 | call to site= | true |
+modelClassMethodCalls
+| active_resource.rb:2:3:2:11 | call to site= |
+| active_resource.rb:5:9:5:33 | call to new |
+| active_resource.rb:8:9:8:22 | call to find |
+| active_resource.rb:16:1:16:23 | call to new |
+| active_resource.rb:18:1:18:22 | call to get |
+| active_resource.rb:23:10:23:19 | call to all |
+| active_resource.rb:24:10:24:26 | call to find |
+| active_resource.rb:30:3:30:11 | call to site= |
+modelInstances
+| active_resource.rb:5:1:5:33 | ... = ... |
+| active_resource.rb:5:1:5:33 | ... = ... |
+| active_resource.rb:5:9:5:33 | call to new |
+| active_resource.rb:6:1:6:5 | alice |
+| active_resource.rb:8:1:8:22 | ... = ... |
+| active_resource.rb:8:1:8:22 | ... = ... |
+| active_resource.rb:8:9:8:22 | call to find |
+| active_resource.rb:9:1:9:5 | alice |
+| active_resource.rb:10:1:10:5 | alice |
+| active_resource.rb:12:1:12:5 | alice |
+| active_resource.rb:16:1:16:23 | call to new |
+| active_resource.rb:17:1:17:5 | alice |
+| active_resource.rb:18:1:18:22 | call to get |
+| active_resource.rb:19:1:19:5 | alice |
+| active_resource.rb:24:1:24:26 | ... = ... |
+| active_resource.rb:24:1:24:26 | ... = ... |
+| active_resource.rb:24:10:24:26 | call to find |
+| active_resource.rb:26:1:26:20 | ... = ... |
+| active_resource.rb:26:1:26:20 | ... = ... |
+| active_resource.rb:26:9:26:14 | people |
+| active_resource.rb:26:9:26:20 | call to first |
+| active_resource.rb:27:1:27:5 | alice |
+modelInstanceMethodCalls
+| active_resource.rb:6:1:6:10 | call to save |
+| active_resource.rb:9:1:9:13 | call to address= |
+| active_resource.rb:10:1:10:10 | call to save |
+| active_resource.rb:12:1:12:13 | call to destroy |
+| active_resource.rb:16:1:16:39 | call to post |
+| active_resource.rb:17:1:17:19 | call to put |
+| active_resource.rb:19:1:19:19 | call to delete |
+| active_resource.rb:26:9:26:20 | call to first |
+| active_resource.rb:27:1:27:10 | call to save |
+collections
+| active_resource.rb:23:1:23:19 | ... = ... |
+| active_resource.rb:23:10:23:19 | call to all |
+| active_resource.rb:24:1:24:26 | ... = ... |
+| active_resource.rb:24:1:24:26 | ... = ... |
+| active_resource.rb:24:10:24:26 | call to find |
+| active_resource.rb:26:9:26:14 | people |
diff --git a/ruby/ql/test/library-tests/frameworks/active_resource/ActiveResource.ql b/ruby/ql/test/library-tests/frameworks/active_resource/ActiveResource.ql
new file mode 100644
index 00000000000..18ae5ac9301
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/active_resource/ActiveResource.ql
@@ -0,0 +1,20 @@
+import ruby
+import codeql.ruby.DataFlow
+import codeql.ruby.frameworks.ActiveResource
+
+query predicate modelClasses(
+  ActiveResource::ModelClass c, DataFlow::Node siteAssignCall, boolean disablesCertificateValidation
+) {
+  c.getASiteAssignment() = siteAssignCall and
+  if c.disablesCertificateValidation(siteAssignCall)
+  then disablesCertificateValidation = true
+  else disablesCertificateValidation = false
+}
+
+query predicate modelClassMethodCalls(ActiveResource::ModelClassMethodCall c) { any() }
+
+query predicate modelInstances(ActiveResource::ModelInstance c) { any() }
+
+query predicate modelInstanceMethodCalls(ActiveResource::ModelInstanceMethodCall c) { any() }
+
+query predicate collections(ActiveResource::Collection c) { any() }
diff --git a/ruby/ql/test/library-tests/frameworks/active_resource/active_resource.rb b/ruby/ql/test/library-tests/frameworks/active_resource/active_resource.rb
new file mode 100644
index 00000000000..eb7e84d37f5
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/active_resource/active_resource.rb
@@ -0,0 +1,31 @@
+class Person < ActiveResource::Base
+  self.site = "https://api.example.com"
+end
+
+alice = Person.new(name: "Alice")
+alice.save
+
+alice = Person.find(1)
+alice.address = "123 Main Street"
+alice.save
+
+alice.destroy
+
+# Custom REST methods
+
+Person.new(name: "Bob").post(:register)
+alice.put(:promote)
+Person.get(:positions)
+alice.delete(:fire)
+
+# Collections
+
+people = Person.all
+people = Person.find(:all)
+
+alice = people.first
+alice.save
+
+class Post < ActiveResource::Base
+  self.site = "http://api.insecure.com"
+end
diff --git a/ruby/ql/test/library-tests/frameworks/http_clients/HttpClients.ql b/ruby/ql/test/library-tests/frameworks/http_clients/HttpClients.ql
index 17f328ad2ed..0bcc883c364 100644
--- a/ruby/ql/test/library-tests/frameworks/http_clients/HttpClients.ql
+++ b/ruby/ql/test/library-tests/frameworks/http_clients/HttpClients.ql
@@ -2,7 +2,7 @@ import codeql.ruby.Concepts
 import codeql.ruby.DataFlow
 
 query predicate httpRequests(
-  HTTP::Client::Request r, string framework, DataFlow::Node urlPart, DataFlow::Node responseBody
+  Http::Client::Request r, string framework, DataFlow::Node urlPart, DataFlow::Node responseBody
 ) {
   r.getFramework() = framework and
   r.getAUrlPart() = urlPart and
diff --git a/ruby/ql/test/library-tests/modules/ancestors.expected b/ruby/ql/test/library-tests/modules/ancestors.expected
index 8ed2f446ed1..d9ca6ed14b3 100644
--- a/ruby/ql/test/library-tests/modules/ancestors.expected
+++ b/ruby/ql/test/library-tests/modules/ancestors.expected
@@ -29,48 +29,69 @@
 #-----| super -> Object
 
 calls.rb:
-#   15| M
+#   21| M
 
-#   29| C
+#   43| C
 #-----| include -> M
 #-----| super -> Object
 
-#   51| D
+#   65| D
 #-----| super -> C
 
-#   77| Integer
+#   91| Integer
 #-----| super -> Numeric
 
-#   82| String
+#   96| String
 #-----| super -> Object
 
-#   86| Kernel
+#  100| Kernel
 
-#   90| Module
+#  105| Module
 #-----| super -> Object
 
-#   97| Object
+#  112| Object
 #-----| super -> BasicObject
 #-----| include -> Kernel
 #-----| prepend -> A
 
-#  102| Hash
+#  117| Hash
 #-----| super -> Object
 
-#  106| Array
+#  122| Array
 #-----| super -> Object
 
-#  144| S
+#  162| S
 #-----| super -> Object
 
-#  150| A
+#  168| A
 #-----| super -> S
 #-----| super -> B
 #-----| prepend -> A::B
 
-#  155| B
+#  173| B
 #-----| super -> S
 
+#  187| Singletons
+#-----| super -> Object
+
+#  307| SelfNew
+#-----| super -> Object
+
+#  322| C1
+#-----| super -> Object
+
+#  328| C2
+#-----| super -> C1
+
+#  334| C3
+#-----| super -> C2
+
+#  374| SingletonOverride1
+#-----| super -> Object
+
+#  399| SingletonOverride2
+#-----| super -> SingletonOverride1
+
 hello.rb:
 #    1| EnglishWords
 
@@ -152,7 +173,7 @@ modules.rb:
 #  116| XX::YY
 #-----| super -> YY
 
-#  120| Test::Foo1::Bar::Baz
+#  123| Test::Foo1::Bar::Baz
 
 modules_rec.rb:
 #    1| B::A
diff --git a/ruby/ql/test/library-tests/modules/callgraph.expected b/ruby/ql/test/library-tests/modules/callgraph.expected
index c345dc89784..8d23ec1b74b 100644
--- a/ruby/ql/test/library-tests/modules/callgraph.expected
+++ b/ruby/ql/test/library-tests/modules/callgraph.expected
@@ -1,120 +1,229 @@
 getTarget
-| calls.rb:2:5:2:14 | call to puts | calls.rb:87:5:87:17 | puts |
+| calls.rb:2:5:2:14 | call to puts | calls.rb:102:5:102:30 | puts |
 | calls.rb:5:1:5:3 | call to foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:5:1:5:3 | call to foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:8:5:8:14 | call to puts | calls.rb:87:5:87:17 | puts |
+| calls.rb:5:1:5:3 | call to foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:8:5:8:15 | call to puts | calls.rb:102:5:102:30 | puts |
 | calls.rb:11:1:11:8 | call to bar | calls.rb:7:1:9:3 | bar |
-| calls.rb:13:1:13:8 | call to foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:13:1:13:8 | call to foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:22:5:22:15 | call to singleton_m | calls.rb:17:5:17:29 | singleton_m |
-| calls.rb:23:5:23:20 | call to singleton_m | calls.rb:17:5:17:29 | singleton_m |
-| calls.rb:27:1:27:13 | call to singleton_m | calls.rb:17:5:17:29 | singleton_m |
-| calls.rb:30:5:30:13 | call to include | calls.rb:92:5:92:20 | include |
-| calls.rb:38:9:38:18 | call to instance_m | calls.rb:16:5:16:23 | instance_m |
-| calls.rb:39:9:39:23 | call to instance_m | calls.rb:16:5:16:23 | instance_m |
-| calls.rb:46:5:46:9 | call to new | calls.rb:99:5:99:16 | new |
-| calls.rb:47:1:47:5 | call to baz | calls.rb:37:5:43:7 | baz |
-| calls.rb:49:1:49:12 | call to instance_m | calls.rb:16:5:16:23 | instance_m |
-| calls.rb:53:9:53:13 | call to super | calls.rb:37:5:43:7 | baz |
-| calls.rb:57:5:57:9 | call to new | calls.rb:99:5:99:16 | new |
-| calls.rb:58:1:58:5 | call to baz | calls.rb:52:5:54:7 | baz |
-| calls.rb:60:1:60:12 | call to instance_m | calls.rb:16:5:16:23 | instance_m |
-| calls.rb:63:5:63:16 | call to bit_length | calls.rb:78:5:78:23 | bit_length |
-| calls.rb:64:5:64:16 | call to bit_length | calls.rb:78:5:78:23 | bit_length |
-| calls.rb:68:5:68:11 | yield ... | calls.rb:74:16:74:29 | { ... } |
-| calls.rb:68:5:68:11 | yield ... | calls.rb:141:10:141:28 | { ... } |
-| calls.rb:72:11:72:18 | call to new | calls.rb:99:5:99:16 | new |
-| calls.rb:73:5:73:10 | ...[...] | calls.rb:103:5:103:15 | [] |
-| calls.rb:74:5:74:29 | call to call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:74:22:74:27 | ...[...] | calls.rb:103:5:103:15 | [] |
-| calls.rb:98:5:98:18 | call to include | calls.rb:92:5:92:20 | include |
-| calls.rb:112:15:112:25 | call to length | calls.rb:108:3:108:17 | length |
-| calls.rb:113:9:113:24 | yield ... | calls.rb:129:23:129:62 | { ... } |
-| calls.rb:113:9:113:24 | yield ... | calls.rb:131:17:131:35 | { ... } |
-| calls.rb:113:9:113:24 | yield ... | calls.rb:133:17:133:40 | { ... } |
-| calls.rb:113:9:113:24 | yield ... | calls.rb:135:18:135:37 | { ... } |
-| calls.rb:113:18:113:24 | ...[...] | calls.rb:107:3:107:13 | [] |
-| calls.rb:120:5:120:20 | yield ... | calls.rb:123:7:123:30 | { ... } |
-| calls.rb:123:1:123:30 | call to funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:123:13:123:29 | call to puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:123:18:123:29 | call to capitalize | calls.rb:83:5:83:23 | capitalize |
-| calls.rb:125:1:125:14 | call to capitalize | calls.rb:83:5:83:23 | capitalize |
-| calls.rb:126:1:126:12 | call to bit_length | calls.rb:78:5:78:23 | bit_length |
-| calls.rb:127:1:127:5 | call to abs | calls.rb:79:5:79:16 | abs |
-| calls.rb:129:1:129:62 | call to foreach | calls.rb:110:3:116:5 | foreach |
-| calls.rb:129:32:129:61 | call to puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:131:1:131:35 | call to foreach | calls.rb:110:3:116:5 | foreach |
-| calls.rb:131:23:131:34 | call to bit_length | calls.rb:78:5:78:23 | bit_length |
-| calls.rb:133:1:133:40 | call to foreach | calls.rb:110:3:116:5 | foreach |
-| calls.rb:133:23:133:39 | call to puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:135:1:135:37 | call to foreach | calls.rb:110:3:116:5 | foreach |
-| calls.rb:135:27:135:36 | call to puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:138:5:138:17 | call to call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:141:1:141:28 | call to indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:141:16:141:27 | call to bit_length | calls.rb:78:5:78:23 | bit_length |
-| calls.rb:146:9:146:17 | call to to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:146:9:146:17 | call to to_s | calls.rb:156:5:157:7 | to_s |
-| calls.rb:160:1:160:5 | call to new | calls.rb:99:5:99:16 | new |
-| calls.rb:160:1:160:14 | call to s_method | calls.rb:145:5:147:7 | s_method |
-| calls.rb:161:1:161:5 | call to new | calls.rb:99:5:99:16 | new |
-| calls.rb:161:1:161:14 | call to s_method | calls.rb:145:5:147:7 | s_method |
-| calls.rb:162:1:162:5 | call to new | calls.rb:99:5:99:16 | new |
-| calls.rb:162:1:162:14 | call to s_method | calls.rb:145:5:147:7 | s_method |
-| calls.rb:167:1:167:15 | call to private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| hello.rb:12:5:12:24 | call to include | calls.rb:92:5:92:20 | include |
+| calls.rb:14:5:14:15 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:17:1:17:8 | call to bar | calls.rb:13:1:15:3 | bar |
+| calls.rb:19:1:19:8 | call to foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:19:1:19:8 | call to foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:23:9:23:19 | call to singleton_m | calls.rb:25:5:27:7 | singleton_m |
+| calls.rb:32:5:32:15 | call to singleton_m | calls.rb:25:5:27:7 | singleton_m |
+| calls.rb:33:5:33:20 | call to singleton_m | calls.rb:25:5:27:7 | singleton_m |
+| calls.rb:37:1:37:13 | call to singleton_m | calls.rb:25:5:27:7 | singleton_m |
+| calls.rb:44:5:44:13 | call to include | calls.rb:107:5:107:20 | include |
+| calls.rb:52:9:52:18 | call to instance_m | calls.rb:22:5:24:7 | instance_m |
+| calls.rb:53:9:53:23 | call to instance_m | calls.rb:22:5:24:7 | instance_m |
+| calls.rb:60:5:60:9 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:61:1:61:5 | call to baz | calls.rb:51:5:57:7 | baz |
+| calls.rb:63:1:63:12 | call to instance_m | calls.rb:22:5:24:7 | instance_m |
+| calls.rb:67:9:67:13 | call to super | calls.rb:51:5:57:7 | baz |
+| calls.rb:71:5:71:9 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:72:1:72:5 | call to baz | calls.rb:66:5:68:7 | baz |
+| calls.rb:74:1:74:12 | call to instance_m | calls.rb:22:5:24:7 | instance_m |
+| calls.rb:77:5:77:16 | call to bit_length | calls.rb:92:5:92:23 | bit_length |
+| calls.rb:78:5:78:16 | call to bit_length | calls.rb:92:5:92:23 | bit_length |
+| calls.rb:82:5:82:11 | yield ... | calls.rb:88:16:88:29 | { ... } |
+| calls.rb:82:5:82:11 | yield ... | calls.rb:159:10:159:28 | { ... } |
+| calls.rb:86:11:86:18 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:87:5:87:10 | ...[...] | calls.rb:119:5:119:31 | [] |
+| calls.rb:88:5:88:29 | call to call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:88:22:88:27 | ...[...] | calls.rb:119:5:119:31 | [] |
+| calls.rb:113:5:113:18 | call to include | calls.rb:107:5:107:20 | include |
+| calls.rb:130:15:130:25 | call to length | calls.rb:126:3:126:17 | length |
+| calls.rb:131:9:131:24 | yield ... | calls.rb:147:23:147:62 | { ... } |
+| calls.rb:131:9:131:24 | yield ... | calls.rb:149:17:149:35 | { ... } |
+| calls.rb:131:9:131:24 | yield ... | calls.rb:151:17:151:40 | { ... } |
+| calls.rb:131:9:131:24 | yield ... | calls.rb:153:18:153:37 | { ... } |
+| calls.rb:131:18:131:24 | ...[...] | calls.rb:124:3:124:29 | [] |
+| calls.rb:138:5:138:20 | yield ... | calls.rb:141:7:141:30 | { ... } |
+| calls.rb:141:1:141:30 | call to funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:141:13:141:29 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:141:18:141:29 | call to capitalize | calls.rb:97:5:97:23 | capitalize |
+| calls.rb:143:1:143:14 | call to capitalize | calls.rb:97:5:97:23 | capitalize |
+| calls.rb:144:1:144:12 | call to bit_length | calls.rb:92:5:92:23 | bit_length |
+| calls.rb:145:1:145:5 | call to abs | calls.rb:93:5:93:16 | abs |
+| calls.rb:147:1:147:62 | call to foreach | calls.rb:128:3:134:5 | foreach |
+| calls.rb:147:32:147:61 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:149:1:149:35 | call to foreach | calls.rb:128:3:134:5 | foreach |
+| calls.rb:149:23:149:34 | call to bit_length | calls.rb:92:5:92:23 | bit_length |
+| calls.rb:151:1:151:40 | call to foreach | calls.rb:128:3:134:5 | foreach |
+| calls.rb:151:23:151:39 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:153:1:153:37 | call to foreach | calls.rb:128:3:134:5 | foreach |
+| calls.rb:153:27:153:36 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:156:5:156:17 | call to call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:159:1:159:28 | call to indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:159:16:159:27 | call to bit_length | calls.rb:92:5:92:23 | bit_length |
+| calls.rb:164:9:164:17 | call to to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:164:9:164:17 | call to to_s | calls.rb:174:5:175:7 | to_s |
+| calls.rb:178:1:178:5 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:178:1:178:14 | call to s_method | calls.rb:163:5:165:7 | s_method |
+| calls.rb:179:1:179:5 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:179:1:179:14 | call to s_method | calls.rb:163:5:165:7 | s_method |
+| calls.rb:180:1:180:5 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:180:1:180:14 | call to s_method | calls.rb:163:5:165:7 | s_method |
+| calls.rb:185:1:185:15 | call to private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:189:9:189:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:190:9:190:24 | call to singleton_b | calls.rb:193:5:196:7 | singleton_b |
+| calls.rb:194:9:194:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:195:9:195:24 | call to singleton_c | calls.rb:198:5:200:7 | singleton_c |
+| calls.rb:199:9:199:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:203:9:203:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:204:9:204:24 | call to singleton_a | calls.rb:188:5:191:7 | singleton_a |
+| calls.rb:209:13:209:30 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:211:9:211:19 | call to singleton_e | calls.rb:208:9:210:11 | singleton_e |
+| calls.rb:216:13:216:30 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:221:9:221:24 | call to singleton_g | calls.rb:233:1:235:3 | singleton_g |
+| calls.rb:221:9:221:24 | call to singleton_g | calls.rb:240:1:242:3 | singleton_g |
+| calls.rb:221:9:221:24 | call to singleton_g | calls.rb:248:5:250:7 | singleton_g |
+| calls.rb:221:9:221:24 | call to singleton_g | calls.rb:264:1:266:3 | singleton_g |
+| calls.rb:225:1:225:22 | call to singleton_a | calls.rb:188:5:191:7 | singleton_a |
+| calls.rb:226:1:226:22 | call to singleton_f | calls.rb:215:9:217:11 | singleton_f |
+| calls.rb:228:6:228:19 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:230:1:230:11 | call to instance | calls.rb:207:5:212:7 | instance |
+| calls.rb:231:1:231:14 | call to singleton_e | calls.rb:208:9:210:11 | singleton_e |
+| calls.rb:234:5:234:24 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:237:1:237:14 | call to singleton_g | calls.rb:233:1:235:3 | singleton_g |
+| calls.rb:238:1:238:19 | call to call_singleton_g | calls.rb:220:5:222:7 | call_singleton_g |
+| calls.rb:241:5:241:24 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:244:1:244:14 | call to singleton_g | calls.rb:240:1:242:3 | singleton_g |
+| calls.rb:245:1:245:19 | call to call_singleton_g | calls.rb:220:5:222:7 | call_singleton_g |
+| calls.rb:249:9:249:28 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:253:1:253:14 | call to singleton_g | calls.rb:248:5:250:7 | singleton_g |
+| calls.rb:254:1:254:19 | call to call_singleton_g | calls.rb:220:5:222:7 | call_singleton_g |
+| calls.rb:256:6:256:19 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:260:1:260:8 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:262:1:262:16 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:265:5:265:22 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:268:1:268:22 | call to singleton_g | calls.rb:264:1:266:3 | singleton_g |
+| calls.rb:269:1:269:14 | call to singleton_g | calls.rb:248:5:250:7 | singleton_g |
+| calls.rb:270:1:270:19 | call to call_singleton_g | calls.rb:220:5:222:7 | call_singleton_g |
+| calls.rb:272:6:272:19 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:276:5:276:12 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:276:5:276:21 | call to instance | calls.rb:207:5:212:7 | instance |
+| calls.rb:279:9:279:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:282:5:282:20 | call to singleton_h | calls.rb:278:5:280:7 | singleton_h |
+| calls.rb:285:1:285:17 | call to create | calls.rb:275:1:283:3 | create |
+| calls.rb:286:1:286:22 | call to singleton_h | calls.rb:278:5:280:7 | singleton_h |
+| calls.rb:292:9:292:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:296:1:296:13 | call to singleton_i | calls.rb:291:5:293:7 | singleton_i |
+| calls.rb:297:1:297:22 | call to singleton_i | calls.rb:291:5:293:7 | singleton_i |
+| calls.rb:301:9:301:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:305:1:305:22 | call to singleton_j | calls.rb:300:5:302:7 | singleton_j |
+| calls.rb:309:9:309:31 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:310:9:310:11 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:314:9:314:11 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:314:9:314:20 | call to instance | calls.rb:308:5:311:7 | instance |
+| calls.rb:317:5:317:7 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:317:5:317:16 | call to instance | calls.rb:308:5:311:7 | instance |
+| calls.rb:320:1:320:17 | call to singleton | calls.rb:313:5:315:7 | singleton |
+| calls.rb:324:9:324:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:330:9:330:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:336:9:336:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:343:9:343:18 | call to instance | calls.rb:335:5:337:7 | instance |
+| calls.rb:345:9:345:18 | call to instance | calls.rb:329:5:331:7 | instance |
+| calls.rb:345:9:345:18 | call to instance | calls.rb:335:5:337:7 | instance |
+| calls.rb:347:9:347:18 | call to instance | calls.rb:323:5:325:7 | instance |
+| calls.rb:347:9:347:18 | call to instance | calls.rb:329:5:331:7 | instance |
+| calls.rb:347:9:347:18 | call to instance | calls.rb:335:5:337:7 | instance |
+| calls.rb:352:20:352:29 | call to instance | calls.rb:335:5:337:7 | instance |
+| calls.rb:353:26:353:36 | call to instance | calls.rb:329:5:331:7 | instance |
+| calls.rb:353:26:353:36 | call to instance | calls.rb:335:5:337:7 | instance |
+| calls.rb:354:26:354:36 | call to instance | calls.rb:323:5:325:7 | instance |
+| calls.rb:354:26:354:36 | call to instance | calls.rb:329:5:331:7 | instance |
+| calls.rb:354:26:354:36 | call to instance | calls.rb:335:5:337:7 | instance |
+| calls.rb:358:6:358:11 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:359:1:359:11 | call to instance | calls.rb:323:5:325:7 | instance |
+| calls.rb:360:1:360:25 | call to pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:360:19:360:24 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:361:1:361:25 | call to pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:361:19:361:24 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:362:1:362:25 | call to pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:362:19:362:24 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:366:9:366:28 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:370:6:370:11 | call to new | calls.rb:114:5:114:16 | new |
+| calls.rb:371:1:371:16 | call to add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:372:1:372:11 | call to instance | calls.rb:323:5:325:7 | instance |
+| calls.rb:372:1:372:11 | call to instance | calls.rb:365:5:367:7 | instance |
+| calls.rb:377:13:377:48 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:381:13:381:22 | call to singleton1 | calls.rb:376:9:378:11 | singleton1 |
+| calls.rb:381:13:381:22 | call to singleton1 | calls.rb:401:9:403:11 | singleton1 |
+| calls.rb:386:9:386:44 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:390:9:390:18 | call to singleton2 | calls.rb:385:5:387:7 | singleton2 |
+| calls.rb:390:9:390:18 | call to singleton2 | calls.rb:406:5:408:7 | singleton2 |
+| calls.rb:393:5:393:14 | call to singleton2 | calls.rb:385:5:387:7 | singleton2 |
+| calls.rb:396:1:396:34 | call to call_singleton1 | calls.rb:380:9:382:11 | call_singleton1 |
+| calls.rb:397:1:397:34 | call to call_singleton2 | calls.rb:389:5:391:7 | call_singleton2 |
+| calls.rb:402:13:402:48 | call to puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:407:9:407:44 | call to puts | calls.rb:102:5:102:30 | puts |
+| hello.rb:12:5:12:24 | call to include | calls.rb:107:5:107:20 | include |
 | hello.rb:14:16:14:20 | call to hello | hello.rb:2:5:4:7 | hello |
 | hello.rb:20:16:20:20 | call to super | hello.rb:13:5:15:7 | message |
 | hello.rb:20:30:20:34 | call to world | hello.rb:5:5:7:7 | world |
-| modules.rb:12:5:12:26 | call to puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:22:3:22:19 | call to puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:33:3:33:25 | call to puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:44:3:44:19 | call to puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:55:3:55:30 | call to puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:89:3:89:16 | call to include | calls.rb:92:5:92:20 | include |
-| modules.rb:90:3:90:38 | call to module_eval | calls.rb:91:5:91:24 | module_eval |
-| modules.rb:90:24:90:36 | call to prepend | calls.rb:93:5:93:20 | prepend |
-| modules.rb:96:3:96:14 | call to include | calls.rb:92:5:92:20 | include |
-| modules.rb:102:3:102:16 | call to prepend | calls.rb:93:5:93:20 | prepend |
-| modules_rec.rb:8:3:8:11 | call to prepend | calls.rb:93:5:93:20 | prepend |
-| modules_rec.rb:11:1:11:9 | call to prepend | calls.rb:93:5:93:20 | prepend |
-| private.rb:2:3:3:5 | call to private | calls.rb:94:5:94:20 | private |
-| private.rb:10:3:10:19 | call to private | calls.rb:94:5:94:20 | private |
-| private.rb:12:3:12:9 | call to private | calls.rb:94:5:94:20 | private |
-| private.rb:34:1:34:5 | call to new | calls.rb:99:5:99:16 | new |
-| private.rb:35:1:35:5 | call to new | calls.rb:99:5:99:16 | new |
-| private.rb:36:1:36:5 | call to new | calls.rb:99:5:99:16 | new |
-| private.rb:37:1:37:5 | call to new | calls.rb:99:5:99:16 | new |
-| private.rb:38:1:38:5 | call to new | calls.rb:99:5:99:16 | new |
+| modules.rb:12:5:12:26 | call to puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:22:3:22:19 | call to puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:33:3:33:25 | call to puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:44:3:44:19 | call to puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:55:3:55:30 | call to puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:89:3:89:16 | call to include | calls.rb:107:5:107:20 | include |
+| modules.rb:90:3:90:38 | call to module_eval | calls.rb:106:5:106:24 | module_eval |
+| modules.rb:90:24:90:36 | call to prepend | calls.rb:108:5:108:20 | prepend |
+| modules.rb:96:3:96:14 | call to include | calls.rb:107:5:107:20 | include |
+| modules.rb:102:3:102:16 | call to prepend | calls.rb:108:5:108:20 | prepend |
+| modules.rb:126:6:126:11 | call to new | calls.rb:114:5:114:16 | new |
+| modules_rec.rb:8:3:8:11 | call to prepend | calls.rb:108:5:108:20 | prepend |
+| private.rb:2:3:3:5 | call to private | calls.rb:109:5:109:20 | private |
+| private.rb:10:3:10:19 | call to private | calls.rb:109:5:109:20 | private |
+| private.rb:12:3:12:9 | call to private | calls.rb:109:5:109:20 | private |
+| private.rb:34:1:34:5 | call to new | calls.rb:114:5:114:16 | new |
+| private.rb:35:1:35:5 | call to new | calls.rb:114:5:114:16 | new |
+| private.rb:36:1:36:5 | call to new | calls.rb:114:5:114:16 | new |
+| private.rb:37:1:37:5 | call to new | calls.rb:114:5:114:16 | new |
+| private.rb:38:1:38:5 | call to new | calls.rb:114:5:114:16 | new |
 | private.rb:38:1:38:12 | call to public | private.rb:5:3:6:5 | public |
 | private.rb:40:1:40:15 | call to private_on_main | private.rb:31:1:32:3 | private_on_main |
-| private.rb:43:3:44:5 | call to private | calls.rb:94:5:94:20 | private |
-| private.rb:51:3:51:19 | call to private | calls.rb:94:5:94:20 | private |
-| private.rb:53:3:53:9 | call to private | calls.rb:94:5:94:20 | private |
+| private.rb:43:3:44:5 | call to private | calls.rb:109:5:109:20 | private |
+| private.rb:51:3:51:19 | call to private | calls.rb:109:5:109:20 | private |
+| private.rb:53:3:53:9 | call to private | calls.rb:109:5:109:20 | private |
 unresolvedCall
-| calls.rb:19:5:19:14 | call to instance_m |
-| calls.rb:20:5:20:19 | call to instance_m |
-| calls.rb:26:1:26:12 | call to instance_m |
-| calls.rb:31:5:31:14 | call to instance_m |
-| calls.rb:32:5:32:19 | call to instance_m |
-| calls.rb:34:5:34:15 | call to singleton_m |
-| calls.rb:35:5:35:20 | call to singleton_m |
-| calls.rb:41:9:41:19 | call to singleton_m |
-| calls.rb:42:9:42:24 | call to singleton_m |
-| calls.rb:48:1:48:13 | call to singleton_m |
-| calls.rb:59:1:59:13 | call to singleton_m |
-| calls.rb:112:11:112:25 | ... < ... |
-| calls.rb:114:11:114:12 | ... + ... |
-| calls.rb:129:1:129:13 | call to [] |
-| calls.rb:129:48:129:59 | call to capitalize |
-| calls.rb:131:1:131:7 | call to [] |
-| calls.rb:133:1:133:7 | call to [] |
-| calls.rb:133:28:133:39 | call to capitalize |
-| calls.rb:135:1:135:8 | call to [] |
-| calls.rb:135:4:135:5 | - ... |
-| calls.rb:135:32:135:36 | call to abs |
+| calls.rb:26:9:26:18 | call to instance_m |
+| calls.rb:29:5:29:14 | call to instance_m |
+| calls.rb:30:5:30:19 | call to instance_m |
+| calls.rb:36:1:36:12 | call to instance_m |
+| calls.rb:40:5:40:14 | call to instance_m |
+| calls.rb:45:5:45:14 | call to instance_m |
+| calls.rb:46:5:46:19 | call to instance_m |
+| calls.rb:48:5:48:15 | call to singleton_m |
+| calls.rb:49:5:49:20 | call to singleton_m |
+| calls.rb:55:9:55:19 | call to singleton_m |
+| calls.rb:56:9:56:24 | call to singleton_m |
+| calls.rb:62:1:62:13 | call to singleton_m |
+| calls.rb:73:1:73:13 | call to singleton_m |
+| calls.rb:102:17:102:26 | call to old_puts |
+| calls.rb:119:15:119:27 | call to old_lookup |
+| calls.rb:124:13:124:25 | call to old_lookup |
+| calls.rb:130:11:130:25 | ... < ... |
+| calls.rb:132:11:132:12 | ... + ... |
+| calls.rb:147:1:147:13 | call to [] |
+| calls.rb:147:48:147:59 | call to capitalize |
+| calls.rb:149:1:149:7 | call to [] |
+| calls.rb:151:1:151:7 | call to [] |
+| calls.rb:151:28:151:39 | call to capitalize |
+| calls.rb:153:1:153:8 | call to [] |
+| calls.rb:153:4:153:5 | - ... |
+| calls.rb:153:32:153:36 | call to abs |
+| calls.rb:257:1:257:14 | call to singleton_e |
+| calls.rb:258:1:258:14 | call to singleton_g |
+| calls.rb:271:1:271:14 | call to singleton_g |
+| calls.rb:273:1:273:14 | call to singleton_g |
+| calls.rb:310:9:310:20 | call to instance |
+| calls.rb:411:1:411:34 | call to call_singleton1 |
+| calls.rb:412:1:412:34 | call to call_singleton2 |
 | hello.rb:20:16:20:26 | ... + ... |
 | hello.rb:20:16:20:34 | ... + ... |
 | hello.rb:20:16:20:40 | ... + ... |
+| modules_rec.rb:11:1:11:9 | call to prepend |
 | private.rb:23:3:24:5 | call to private_class_method |
 | private.rb:28:3:28:32 | call to private_class_method |
 | private.rb:34:1:34:14 | call to private1 |
@@ -123,12 +232,16 @@ unresolvedCall
 | private.rb:37:1:37:14 | call to private4 |
 privateMethod
 | calls.rb:1:1:3:3 | foo |
-| calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:67:1:69:3 | call_block |
-| calls.rb:71:1:75:3 | foo |
-| calls.rb:119:1:121:3 | funny |
-| calls.rb:137:1:139:3 | indirect |
-| calls.rb:164:1:165:3 | private_on_main |
+| calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:81:1:83:3 | call_block |
+| calls.rb:85:1:89:3 | foo |
+| calls.rb:137:1:139:3 | funny |
+| calls.rb:155:1:157:3 | indirect |
+| calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:275:1:283:3 | create |
+| calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:364:1:368:3 | add_singleton |
 | private.rb:2:11:3:5 | private1 |
 | private.rb:8:3:9:5 | private2 |
 | private.rb:14:3:15:5 | private3 |
diff --git a/ruby/ql/test/library-tests/modules/calls.rb b/ruby/ql/test/library-tests/modules/calls.rb
index d5c9c774f06..61a7f58e664 100644
--- a/ruby/ql/test/library-tests/modules/calls.rb
+++ b/ruby/ql/test/library-tests/modules/calls.rb
@@ -5,7 +5,13 @@ end
 foo
 
 def self.bar
-    puts "bar"
+    puts "bar1"
+end
+
+self.bar
+
+def self.bar
+    puts "bar2"
 end
 
 self.bar
@@ -13,8 +19,12 @@ self.bar
 self.foo
 
 module M
-    def instance_m; end
-    def self.singleton_m; end
+    def instance_m
+        singleton_m # NoMethodError
+    end
+    def self.singleton_m
+        instance_m # NoMethodError
+    end
 
     instance_m # NoMethodError
     self.instance_m # NoMethodError
@@ -26,6 +36,10 @@ end
 M.instance_m # NoMethodError
 M.singleton_m
 
+def call_instance_m
+    instance_m # NoMethodError
+end
+
 class C
     include M
     instance_m # NoMethodError
@@ -34,7 +48,7 @@ class C
     singleton_m # NoMethodError
     self.singleton_m # NoMethodError
 
-    def baz 
+    def baz
         instance_m 
         self.instance_m 
         
@@ -84,7 +98,8 @@ class String
 end
 
 module Kernel
-    def puts; end
+    alias :old_puts :puts
+    def puts x; old_puts x end
 end
 
 class Module
@@ -100,11 +115,14 @@ class Object < Module
 end
 
 class Hash
-    def []; end
+    alias :old_lookup :[]
+    def [] x; old_lookup(x) end
 end
 
 class Array
-  def []; end
+  alias :old_lookup :[]
+  def [] x; old_lookup(x) end
+
   def length; end
 
   def foreach &body
@@ -165,3 +183,230 @@ def private_on_main
 end
 
 private_on_main
+
+class Singletons
+    def self.singleton_a
+        puts "singleton_a"
+        self.singleton_b
+    end
+    
+    def self.singleton_b
+        puts "singleton_b"
+        self.singleton_c
+    end
+    
+    def self.singleton_c
+        puts "singleton_c"
+    end
+    
+    def self.singleton_d
+        puts "singleton_d"
+        self.singleton_a
+    end
+
+    def instance
+        def self.singleton_e
+            puts "singleton_e"
+        end
+        singleton_e
+    end
+
+    class << self
+        def singleton_f
+            puts "singleton_f"
+        end
+    end
+
+    def call_singleton_g
+        self.singleton_g
+    end
+end
+  
+Singletons.singleton_a
+Singletons.singleton_f
+
+c1 = Singletons.new
+
+c1.instance
+c1.singleton_e
+
+def c1.singleton_g;
+    puts "singleton_g_1"
+end
+
+c1.singleton_g
+c1.call_singleton_g
+
+def c1.singleton_g;
+    puts "singleton_g_2"
+end
+
+c1.singleton_g
+c1.call_singleton_g
+
+class << c1
+    def singleton_g;
+        puts "singleton_g_3"
+    end
+end
+
+c1.singleton_g
+c1.call_singleton_g
+
+c2 = Singletons.new
+c2.singleton_e # NoMethodError
+c2.singleton_g # NoMethodError
+
+self.new # NoMethodError
+
+puts "top-level"
+
+def Singletons.singleton_g
+    puts "singleton_g"
+end
+
+Singletons.singleton_g
+c1.singleton_g
+c1.call_singleton_g
+c2.singleton_g # NoMethodError
+c3 = Singletons.new
+c3.singleton_g # NoMethodError
+
+def create(type)
+    type.new.instance
+
+    def type.singleton_h
+        puts "singleton_h"
+    end
+
+    type.singleton_h
+end
+
+create Singletons
+Singletons.singleton_h
+
+x = Singletons
+
+class << x
+    def singleton_i
+        puts "singleton_i"
+    end
+end
+
+x.singleton_i
+Singletons.singleton_i
+
+class << Singletons
+    def singleton_j
+        puts "singleton_j"
+    end
+end
+
+Singletons.singleton_j
+
+class SelfNew
+    def instance
+        puts "SelfNew#instance"
+        new.instance # NoMethodError
+    end
+
+    def self.singleton
+        new.instance
+    end
+
+    new.instance
+end
+
+SelfNew.singleton
+
+class C1
+    def instance
+        puts "C1#instance"
+    end
+end
+
+class C2 < C1
+    def instance
+        puts "C2#instance"
+    end
+end
+
+class C3 < C2
+    def instance
+        puts "C3#instance"
+    end
+end
+
+def pattern_dispatch x
+    case x
+    when C3
+        x.instance
+    when C2
+        x.instance
+    when C1
+        x.instance
+    else
+    end
+
+    case x
+        in C3 then x.instance
+        in C2 => c2 then c2.instance
+        in C1 => c1 then c1.instance
+    end
+end
+
+c1 = C1.new
+c1.instance
+pattern_dispatch (C1.new)
+pattern_dispatch (C2.new)
+pattern_dispatch (C3.new)
+
+def add_singleton x
+    def x.instance
+        puts "instance_on x"
+    end
+end
+
+c3 = C1.new
+add_singleton c3
+c3.instance
+
+class SingletonOverride1
+    class << self
+        def singleton1
+            puts "SingletonOverride1#singleton1"
+        end
+
+        def call_singleton1
+            singleton1
+        end
+    end
+
+    def self.singleton2
+        puts "SingletonOverride1#singleton2"
+    end
+
+    def self.call_singleton2
+        singleton2
+    end
+
+    singleton2
+end
+
+SingletonOverride1.call_singleton1
+SingletonOverride1.call_singleton2
+
+class SingletonOverride2 < SingletonOverride1
+    class << self
+        def singleton1
+            puts "SingletonOverride2#singleton1"
+        end
+    end
+
+    def self.singleton2
+        puts "SingletonOverride2#singleton2"
+    end
+end
+
+SingletonOverride2.call_singleton1
+SingletonOverride2.call_singleton2
diff --git a/ruby/ql/test/library-tests/modules/methods.expected b/ruby/ql/test/library-tests/modules/methods.expected
index dc0f3e67987..93cdd80a22b 100644
--- a/ruby/ql/test/library-tests/modules/methods.expected
+++ b/ruby/ql/test/library-tests/modules/methods.expected
@@ -1,31 +1,41 @@
 getMethod
-| calls.rb:15:1:24:3 | M | instance_m | calls.rb:16:5:16:23 | instance_m |
-| calls.rb:29:1:44:3 | C | baz | calls.rb:37:5:43:7 | baz |
-| calls.rb:51:1:55:3 | D | baz | calls.rb:52:5:54:7 | baz |
-| calls.rb:77:1:80:3 | Integer | abs | calls.rb:79:5:79:16 | abs |
-| calls.rb:77:1:80:3 | Integer | bit_length | calls.rb:78:5:78:23 | bit_length |
-| calls.rb:82:1:84:3 | String | capitalize | calls.rb:83:5:83:23 | capitalize |
-| calls.rb:86:1:88:3 | Kernel | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:90:1:95:3 | Module | include | calls.rb:92:5:92:20 | include |
-| calls.rb:90:1:95:3 | Module | module_eval | calls.rb:91:5:91:24 | module_eval |
-| calls.rb:90:1:95:3 | Module | prepend | calls.rb:93:5:93:20 | prepend |
-| calls.rb:90:1:95:3 | Module | private | calls.rb:94:5:94:20 | private |
-| calls.rb:97:1:100:3 | Object | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:97:1:100:3 | Object | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:97:1:100:3 | Object | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:97:1:100:3 | Object | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:97:1:100:3 | Object | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:97:1:100:3 | Object | new | calls.rb:99:5:99:16 | new |
-| calls.rb:97:1:100:3 | Object | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:97:1:100:3 | Object | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:97:1:100:3 | Object | private_on_main | private.rb:31:1:32:3 | private_on_main |
-| calls.rb:102:1:104:3 | Hash | [] | calls.rb:103:5:103:15 | [] |
-| calls.rb:106:1:117:3 | Array | [] | calls.rb:107:3:107:13 | [] |
-| calls.rb:106:1:117:3 | Array | foreach | calls.rb:110:3:116:5 | foreach |
-| calls.rb:106:1:117:3 | Array | length | calls.rb:108:3:108:17 | length |
-| calls.rb:144:1:148:3 | S | s_method | calls.rb:145:5:147:7 | s_method |
-| calls.rb:150:1:153:3 | A | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:155:1:158:3 | B | to_s | calls.rb:156:5:157:7 | to_s |
+| calls.rb:21:1:34:3 | M | instance_m | calls.rb:22:5:24:7 | instance_m |
+| calls.rb:43:1:58:3 | C | baz | calls.rb:51:5:57:7 | baz |
+| calls.rb:65:1:69:3 | D | baz | calls.rb:66:5:68:7 | baz |
+| calls.rb:91:1:94:3 | Integer | abs | calls.rb:93:5:93:16 | abs |
+| calls.rb:91:1:94:3 | Integer | bit_length | calls.rb:92:5:92:23 | bit_length |
+| calls.rb:96:1:98:3 | String | capitalize | calls.rb:97:5:97:23 | capitalize |
+| calls.rb:100:1:103:3 | Kernel | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:105:1:110:3 | Module | include | calls.rb:107:5:107:20 | include |
+| calls.rb:105:1:110:3 | Module | module_eval | calls.rb:106:5:106:24 | module_eval |
+| calls.rb:105:1:110:3 | Module | prepend | calls.rb:108:5:108:20 | prepend |
+| calls.rb:105:1:110:3 | Module | private | calls.rb:109:5:109:20 | private |
+| calls.rb:112:1:115:3 | Object | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:112:1:115:3 | Object | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:112:1:115:3 | Object | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:112:1:115:3 | Object | create | calls.rb:275:1:283:3 | create |
+| calls.rb:112:1:115:3 | Object | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:112:1:115:3 | Object | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:112:1:115:3 | Object | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:112:1:115:3 | Object | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:112:1:115:3 | Object | new | calls.rb:114:5:114:16 | new |
+| calls.rb:112:1:115:3 | Object | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:112:1:115:3 | Object | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:112:1:115:3 | Object | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:112:1:115:3 | Object | private_on_main | private.rb:31:1:32:3 | private_on_main |
+| calls.rb:117:1:120:3 | Hash | [] | calls.rb:119:5:119:31 | [] |
+| calls.rb:122:1:135:3 | Array | [] | calls.rb:124:3:124:29 | [] |
+| calls.rb:122:1:135:3 | Array | foreach | calls.rb:128:3:134:5 | foreach |
+| calls.rb:122:1:135:3 | Array | length | calls.rb:126:3:126:17 | length |
+| calls.rb:162:1:166:3 | S | s_method | calls.rb:163:5:165:7 | s_method |
+| calls.rb:168:1:171:3 | A | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:173:1:176:3 | B | to_s | calls.rb:174:5:175:7 | to_s |
+| calls.rb:187:1:223:3 | Singletons | call_singleton_g | calls.rb:220:5:222:7 | call_singleton_g |
+| calls.rb:187:1:223:3 | Singletons | instance | calls.rb:207:5:212:7 | instance |
+| calls.rb:307:1:318:3 | SelfNew | instance | calls.rb:308:5:311:7 | instance |
+| calls.rb:322:1:326:3 | C1 | instance | calls.rb:323:5:325:7 | instance |
+| calls.rb:328:1:332:3 | C2 | instance | calls.rb:329:5:331:7 | instance |
+| calls.rb:334:1:338:3 | C3 | instance | calls.rb:335:5:337:7 | instance |
 | hello.rb:1:1:8:3 | EnglishWords | hello | hello.rb:2:5:4:7 | hello |
 | hello.rb:1:1:8:3 | EnglishWords | world | hello.rb:5:5:7:7 | world |
 | hello.rb:11:1:16:3 | Greeting | message | hello.rb:13:5:15:7 | message |
@@ -45,220 +55,651 @@ getMethod
 | private.rb:42:1:60:3 | F | private4 | private.rb:58:3:59:5 | private4 |
 | private.rb:42:1:60:3 | F | public | private.rb:46:3:47:5 | public |
 lookupMethod
-| calls.rb:15:1:24:3 | M | instance_m | calls.rb:16:5:16:23 | instance_m |
-| calls.rb:29:1:44:3 | C | baz | calls.rb:37:5:43:7 | baz |
-| calls.rb:29:1:44:3 | C | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:29:1:44:3 | C | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:29:1:44:3 | C | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:29:1:44:3 | C | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:29:1:44:3 | C | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:29:1:44:3 | C | instance_m | calls.rb:16:5:16:23 | instance_m |
-| calls.rb:29:1:44:3 | C | new | calls.rb:99:5:99:16 | new |
-| calls.rb:29:1:44:3 | C | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:29:1:44:3 | C | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:29:1:44:3 | C | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:29:1:44:3 | C | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:51:1:55:3 | D | baz | calls.rb:52:5:54:7 | baz |
-| calls.rb:51:1:55:3 | D | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:51:1:55:3 | D | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:51:1:55:3 | D | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:51:1:55:3 | D | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:51:1:55:3 | D | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:51:1:55:3 | D | instance_m | calls.rb:16:5:16:23 | instance_m |
-| calls.rb:51:1:55:3 | D | new | calls.rb:99:5:99:16 | new |
-| calls.rb:51:1:55:3 | D | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:51:1:55:3 | D | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:51:1:55:3 | D | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:51:1:55:3 | D | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:77:1:80:3 | Integer | abs | calls.rb:79:5:79:16 | abs |
-| calls.rb:77:1:80:3 | Integer | bit_length | calls.rb:78:5:78:23 | bit_length |
-| calls.rb:77:1:80:3 | Integer | new | calls.rb:99:5:99:16 | new |
-| calls.rb:77:1:80:3 | Integer | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:77:1:80:3 | Integer | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:82:1:84:3 | String | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:82:1:84:3 | String | capitalize | calls.rb:83:5:83:23 | capitalize |
-| calls.rb:82:1:84:3 | String | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:82:1:84:3 | String | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:82:1:84:3 | String | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:82:1:84:3 | String | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:82:1:84:3 | String | new | calls.rb:99:5:99:16 | new |
-| calls.rb:82:1:84:3 | String | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:82:1:84:3 | String | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:82:1:84:3 | String | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:82:1:84:3 | String | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:86:1:88:3 | Kernel | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:90:1:95:3 | Module | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:90:1:95:3 | Module | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:90:1:95:3 | Module | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:90:1:95:3 | Module | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:90:1:95:3 | Module | include | calls.rb:92:5:92:20 | include |
-| calls.rb:90:1:95:3 | Module | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:90:1:95:3 | Module | module_eval | calls.rb:91:5:91:24 | module_eval |
-| calls.rb:90:1:95:3 | Module | new | calls.rb:99:5:99:16 | new |
-| calls.rb:90:1:95:3 | Module | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:90:1:95:3 | Module | prepend | calls.rb:93:5:93:20 | prepend |
-| calls.rb:90:1:95:3 | Module | private | calls.rb:94:5:94:20 | private |
-| calls.rb:90:1:95:3 | Module | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:90:1:95:3 | Module | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:90:1:95:3 | Module | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:97:1:100:3 | Object | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:97:1:100:3 | Object | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:97:1:100:3 | Object | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:97:1:100:3 | Object | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:97:1:100:3 | Object | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:97:1:100:3 | Object | new | calls.rb:99:5:99:16 | new |
-| calls.rb:97:1:100:3 | Object | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:97:1:100:3 | Object | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:97:1:100:3 | Object | private_on_main | private.rb:31:1:32:3 | private_on_main |
-| calls.rb:97:1:100:3 | Object | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:97:1:100:3 | Object | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:102:1:104:3 | Hash | [] | calls.rb:103:5:103:15 | [] |
-| calls.rb:102:1:104:3 | Hash | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:102:1:104:3 | Hash | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:102:1:104:3 | Hash | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:102:1:104:3 | Hash | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:102:1:104:3 | Hash | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:102:1:104:3 | Hash | new | calls.rb:99:5:99:16 | new |
-| calls.rb:102:1:104:3 | Hash | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:102:1:104:3 | Hash | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:102:1:104:3 | Hash | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:102:1:104:3 | Hash | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:106:1:117:3 | Array | [] | calls.rb:107:3:107:13 | [] |
-| calls.rb:106:1:117:3 | Array | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:106:1:117:3 | Array | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:106:1:117:3 | Array | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:106:1:117:3 | Array | foreach | calls.rb:110:3:116:5 | foreach |
-| calls.rb:106:1:117:3 | Array | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:106:1:117:3 | Array | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:106:1:117:3 | Array | length | calls.rb:108:3:108:17 | length |
-| calls.rb:106:1:117:3 | Array | new | calls.rb:99:5:99:16 | new |
-| calls.rb:106:1:117:3 | Array | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:106:1:117:3 | Array | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:106:1:117:3 | Array | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:106:1:117:3 | Array | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:144:1:148:3 | S | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:144:1:148:3 | S | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:144:1:148:3 | S | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:144:1:148:3 | S | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:144:1:148:3 | S | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:144:1:148:3 | S | new | calls.rb:99:5:99:16 | new |
-| calls.rb:144:1:148:3 | S | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:144:1:148:3 | S | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:144:1:148:3 | S | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:144:1:148:3 | S | s_method | calls.rb:145:5:147:7 | s_method |
-| calls.rb:144:1:148:3 | S | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:150:1:153:3 | A | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:150:1:153:3 | A | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:150:1:153:3 | A | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:150:1:153:3 | A | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:150:1:153:3 | A | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:150:1:153:3 | A | new | calls.rb:99:5:99:16 | new |
-| calls.rb:150:1:153:3 | A | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:150:1:153:3 | A | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:150:1:153:3 | A | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:150:1:153:3 | A | s_method | calls.rb:145:5:147:7 | s_method |
-| calls.rb:150:1:153:3 | A | to_s | calls.rb:151:5:152:7 | to_s |
-| calls.rb:155:1:158:3 | B | call_block | calls.rb:67:1:69:3 | call_block |
-| calls.rb:155:1:158:3 | B | foo | calls.rb:1:1:3:3 | foo |
-| calls.rb:155:1:158:3 | B | foo | calls.rb:71:1:75:3 | foo |
-| calls.rb:155:1:158:3 | B | funny | calls.rb:119:1:121:3 | funny |
-| calls.rb:155:1:158:3 | B | indirect | calls.rb:137:1:139:3 | indirect |
-| calls.rb:155:1:158:3 | B | new | calls.rb:99:5:99:16 | new |
-| calls.rb:155:1:158:3 | B | optional_arg | calls.rb:62:1:65:3 | optional_arg |
-| calls.rb:155:1:158:3 | B | private_on_main | calls.rb:164:1:165:3 | private_on_main |
-| calls.rb:155:1:158:3 | B | puts | calls.rb:87:5:87:17 | puts |
-| calls.rb:155:1:158:3 | B | s_method | calls.rb:145:5:147:7 | s_method |
-| calls.rb:155:1:158:3 | B | to_s | calls.rb:156:5:157:7 | to_s |
-| file://:0:0:0:0 | Class | include | calls.rb:92:5:92:20 | include |
-| file://:0:0:0:0 | Class | module_eval | calls.rb:91:5:91:24 | module_eval |
-| file://:0:0:0:0 | Class | new | calls.rb:99:5:99:16 | new |
-| file://:0:0:0:0 | Class | prepend | calls.rb:93:5:93:20 | prepend |
-| file://:0:0:0:0 | Class | private | calls.rb:94:5:94:20 | private |
-| file://:0:0:0:0 | Class | puts | calls.rb:87:5:87:17 | puts |
-| file://:0:0:0:0 | Class | to_s | calls.rb:151:5:152:7 | to_s |
-| file://:0:0:0:0 | Complex | new | calls.rb:99:5:99:16 | new |
-| file://:0:0:0:0 | Complex | puts | calls.rb:87:5:87:17 | puts |
-| file://:0:0:0:0 | Complex | to_s | calls.rb:151:5:152:7 | to_s |
-| file://:0:0:0:0 | FalseClass | new | calls.rb:99:5:99:16 | new |
-| file://:0:0:0:0 | FalseClass | puts | calls.rb:87:5:87:17 | puts |
-| file://:0:0:0:0 | FalseClass | to_s | calls.rb:151:5:152:7 | to_s |
-| file://:0:0:0:0 | Float | new | calls.rb:99:5:99:16 | new |
-| file://:0:0:0:0 | Float | puts | calls.rb:87:5:87:17 | puts |
-| file://:0:0:0:0 | Float | to_s | calls.rb:151:5:152:7 | to_s |
-| file://:0:0:0:0 | NilClass | new | calls.rb:99:5:99:16 | new |
-| file://:0:0:0:0 | NilClass | puts | calls.rb:87:5:87:17 | puts |
-| file://:0:0:0:0 | NilClass | to_s | calls.rb:151:5:152:7 | to_s |
-| file://:0:0:0:0 | Numeric | new | calls.rb:99:5:99:16 | new |
-| file://:0:0:0:0 | Numeric | puts | calls.rb:87:5:87:17 | puts |
-| file://:0:0:0:0 | Numeric | to_s | calls.rb:151:5:152:7 | to_s |
-| file://:0:0:0:0 | Rational | new | calls.rb:99:5:99:16 | new |
-| file://:0:0:0:0 | Rational | puts | calls.rb:87:5:87:17 | puts |
-| file://:0:0:0:0 | Rational | to_s | calls.rb:151:5:152:7 | to_s |
-| file://:0:0:0:0 | TrueClass | new | calls.rb:99:5:99:16 | new |
-| file://:0:0:0:0 | TrueClass | puts | calls.rb:87:5:87:17 | puts |
-| file://:0:0:0:0 | TrueClass | to_s | calls.rb:151:5:152:7 | to_s |
+| calls.rb:21:1:34:3 | M | instance_m | calls.rb:22:5:24:7 | instance_m |
+| calls.rb:43:1:58:3 | C | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:43:1:58:3 | C | baz | calls.rb:51:5:57:7 | baz |
+| calls.rb:43:1:58:3 | C | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:43:1:58:3 | C | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:43:1:58:3 | C | create | calls.rb:275:1:283:3 | create |
+| calls.rb:43:1:58:3 | C | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:43:1:58:3 | C | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:43:1:58:3 | C | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:43:1:58:3 | C | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:43:1:58:3 | C | instance_m | calls.rb:22:5:24:7 | instance_m |
+| calls.rb:43:1:58:3 | C | new | calls.rb:114:5:114:16 | new |
+| calls.rb:43:1:58:3 | C | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:43:1:58:3 | C | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:43:1:58:3 | C | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:43:1:58:3 | C | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:43:1:58:3 | C | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:65:1:69:3 | D | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:65:1:69:3 | D | baz | calls.rb:66:5:68:7 | baz |
+| calls.rb:65:1:69:3 | D | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:65:1:69:3 | D | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:65:1:69:3 | D | create | calls.rb:275:1:283:3 | create |
+| calls.rb:65:1:69:3 | D | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:65:1:69:3 | D | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:65:1:69:3 | D | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:65:1:69:3 | D | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:65:1:69:3 | D | instance_m | calls.rb:22:5:24:7 | instance_m |
+| calls.rb:65:1:69:3 | D | new | calls.rb:114:5:114:16 | new |
+| calls.rb:65:1:69:3 | D | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:65:1:69:3 | D | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:65:1:69:3 | D | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:65:1:69:3 | D | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:65:1:69:3 | D | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:91:1:94:3 | Integer | abs | calls.rb:93:5:93:16 | abs |
+| calls.rb:91:1:94:3 | Integer | bit_length | calls.rb:92:5:92:23 | bit_length |
+| calls.rb:91:1:94:3 | Integer | new | calls.rb:114:5:114:16 | new |
+| calls.rb:91:1:94:3 | Integer | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:91:1:94:3 | Integer | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:96:1:98:3 | String | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:96:1:98:3 | String | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:96:1:98:3 | String | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:96:1:98:3 | String | capitalize | calls.rb:97:5:97:23 | capitalize |
+| calls.rb:96:1:98:3 | String | create | calls.rb:275:1:283:3 | create |
+| calls.rb:96:1:98:3 | String | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:96:1:98:3 | String | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:96:1:98:3 | String | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:96:1:98:3 | String | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:96:1:98:3 | String | new | calls.rb:114:5:114:16 | new |
+| calls.rb:96:1:98:3 | String | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:96:1:98:3 | String | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:96:1:98:3 | String | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:96:1:98:3 | String | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:96:1:98:3 | String | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:100:1:103:3 | Kernel | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:105:1:110:3 | Module | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:105:1:110:3 | Module | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:105:1:110:3 | Module | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:105:1:110:3 | Module | create | calls.rb:275:1:283:3 | create |
+| calls.rb:105:1:110:3 | Module | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:105:1:110:3 | Module | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:105:1:110:3 | Module | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:105:1:110:3 | Module | include | calls.rb:107:5:107:20 | include |
+| calls.rb:105:1:110:3 | Module | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:105:1:110:3 | Module | module_eval | calls.rb:106:5:106:24 | module_eval |
+| calls.rb:105:1:110:3 | Module | new | calls.rb:114:5:114:16 | new |
+| calls.rb:105:1:110:3 | Module | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:105:1:110:3 | Module | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:105:1:110:3 | Module | prepend | calls.rb:108:5:108:20 | prepend |
+| calls.rb:105:1:110:3 | Module | private | calls.rb:109:5:109:20 | private |
+| calls.rb:105:1:110:3 | Module | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:105:1:110:3 | Module | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:105:1:110:3 | Module | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:112:1:115:3 | Object | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:112:1:115:3 | Object | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:112:1:115:3 | Object | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:112:1:115:3 | Object | create | calls.rb:275:1:283:3 | create |
+| calls.rb:112:1:115:3 | Object | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:112:1:115:3 | Object | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:112:1:115:3 | Object | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:112:1:115:3 | Object | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:112:1:115:3 | Object | new | calls.rb:114:5:114:16 | new |
+| calls.rb:112:1:115:3 | Object | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:112:1:115:3 | Object | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:112:1:115:3 | Object | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:112:1:115:3 | Object | private_on_main | private.rb:31:1:32:3 | private_on_main |
+| calls.rb:112:1:115:3 | Object | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:112:1:115:3 | Object | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:117:1:120:3 | Hash | [] | calls.rb:119:5:119:31 | [] |
+| calls.rb:117:1:120:3 | Hash | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:117:1:120:3 | Hash | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:117:1:120:3 | Hash | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:117:1:120:3 | Hash | create | calls.rb:275:1:283:3 | create |
+| calls.rb:117:1:120:3 | Hash | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:117:1:120:3 | Hash | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:117:1:120:3 | Hash | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:117:1:120:3 | Hash | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:117:1:120:3 | Hash | new | calls.rb:114:5:114:16 | new |
+| calls.rb:117:1:120:3 | Hash | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:117:1:120:3 | Hash | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:117:1:120:3 | Hash | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:117:1:120:3 | Hash | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:117:1:120:3 | Hash | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:122:1:135:3 | Array | [] | calls.rb:124:3:124:29 | [] |
+| calls.rb:122:1:135:3 | Array | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:122:1:135:3 | Array | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:122:1:135:3 | Array | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:122:1:135:3 | Array | create | calls.rb:275:1:283:3 | create |
+| calls.rb:122:1:135:3 | Array | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:122:1:135:3 | Array | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:122:1:135:3 | Array | foreach | calls.rb:128:3:134:5 | foreach |
+| calls.rb:122:1:135:3 | Array | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:122:1:135:3 | Array | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:122:1:135:3 | Array | length | calls.rb:126:3:126:17 | length |
+| calls.rb:122:1:135:3 | Array | new | calls.rb:114:5:114:16 | new |
+| calls.rb:122:1:135:3 | Array | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:122:1:135:3 | Array | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:122:1:135:3 | Array | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:122:1:135:3 | Array | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:122:1:135:3 | Array | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:162:1:166:3 | S | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:162:1:166:3 | S | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:162:1:166:3 | S | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:162:1:166:3 | S | create | calls.rb:275:1:283:3 | create |
+| calls.rb:162:1:166:3 | S | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:162:1:166:3 | S | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:162:1:166:3 | S | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:162:1:166:3 | S | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:162:1:166:3 | S | new | calls.rb:114:5:114:16 | new |
+| calls.rb:162:1:166:3 | S | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:162:1:166:3 | S | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:162:1:166:3 | S | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:162:1:166:3 | S | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:162:1:166:3 | S | s_method | calls.rb:163:5:165:7 | s_method |
+| calls.rb:162:1:166:3 | S | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:168:1:171:3 | A | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:168:1:171:3 | A | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:168:1:171:3 | A | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:168:1:171:3 | A | create | calls.rb:275:1:283:3 | create |
+| calls.rb:168:1:171:3 | A | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:168:1:171:3 | A | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:168:1:171:3 | A | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:168:1:171:3 | A | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:168:1:171:3 | A | new | calls.rb:114:5:114:16 | new |
+| calls.rb:168:1:171:3 | A | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:168:1:171:3 | A | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:168:1:171:3 | A | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:168:1:171:3 | A | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:168:1:171:3 | A | s_method | calls.rb:163:5:165:7 | s_method |
+| calls.rb:168:1:171:3 | A | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:173:1:176:3 | B | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:173:1:176:3 | B | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:173:1:176:3 | B | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:173:1:176:3 | B | create | calls.rb:275:1:283:3 | create |
+| calls.rb:173:1:176:3 | B | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:173:1:176:3 | B | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:173:1:176:3 | B | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:173:1:176:3 | B | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:173:1:176:3 | B | new | calls.rb:114:5:114:16 | new |
+| calls.rb:173:1:176:3 | B | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:173:1:176:3 | B | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:173:1:176:3 | B | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:173:1:176:3 | B | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:173:1:176:3 | B | s_method | calls.rb:163:5:165:7 | s_method |
+| calls.rb:173:1:176:3 | B | to_s | calls.rb:174:5:175:7 | to_s |
+| calls.rb:187:1:223:3 | Singletons | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:187:1:223:3 | Singletons | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:187:1:223:3 | Singletons | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:187:1:223:3 | Singletons | call_singleton_g | calls.rb:220:5:222:7 | call_singleton_g |
+| calls.rb:187:1:223:3 | Singletons | create | calls.rb:275:1:283:3 | create |
+| calls.rb:187:1:223:3 | Singletons | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:187:1:223:3 | Singletons | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:187:1:223:3 | Singletons | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:187:1:223:3 | Singletons | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:187:1:223:3 | Singletons | instance | calls.rb:207:5:212:7 | instance |
+| calls.rb:187:1:223:3 | Singletons | new | calls.rb:114:5:114:16 | new |
+| calls.rb:187:1:223:3 | Singletons | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:187:1:223:3 | Singletons | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:187:1:223:3 | Singletons | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:187:1:223:3 | Singletons | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:187:1:223:3 | Singletons | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:307:1:318:3 | SelfNew | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:307:1:318:3 | SelfNew | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:307:1:318:3 | SelfNew | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:307:1:318:3 | SelfNew | create | calls.rb:275:1:283:3 | create |
+| calls.rb:307:1:318:3 | SelfNew | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:307:1:318:3 | SelfNew | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:307:1:318:3 | SelfNew | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:307:1:318:3 | SelfNew | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:307:1:318:3 | SelfNew | instance | calls.rb:308:5:311:7 | instance |
+| calls.rb:307:1:318:3 | SelfNew | new | calls.rb:114:5:114:16 | new |
+| calls.rb:307:1:318:3 | SelfNew | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:307:1:318:3 | SelfNew | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:307:1:318:3 | SelfNew | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:307:1:318:3 | SelfNew | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:307:1:318:3 | SelfNew | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:322:1:326:3 | C1 | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:322:1:326:3 | C1 | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:322:1:326:3 | C1 | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:322:1:326:3 | C1 | create | calls.rb:275:1:283:3 | create |
+| calls.rb:322:1:326:3 | C1 | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:322:1:326:3 | C1 | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:322:1:326:3 | C1 | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:322:1:326:3 | C1 | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:322:1:326:3 | C1 | instance | calls.rb:323:5:325:7 | instance |
+| calls.rb:322:1:326:3 | C1 | new | calls.rb:114:5:114:16 | new |
+| calls.rb:322:1:326:3 | C1 | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:322:1:326:3 | C1 | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:322:1:326:3 | C1 | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:322:1:326:3 | C1 | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:322:1:326:3 | C1 | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:328:1:332:3 | C2 | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:328:1:332:3 | C2 | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:328:1:332:3 | C2 | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:328:1:332:3 | C2 | create | calls.rb:275:1:283:3 | create |
+| calls.rb:328:1:332:3 | C2 | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:328:1:332:3 | C2 | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:328:1:332:3 | C2 | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:328:1:332:3 | C2 | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:328:1:332:3 | C2 | instance | calls.rb:329:5:331:7 | instance |
+| calls.rb:328:1:332:3 | C2 | new | calls.rb:114:5:114:16 | new |
+| calls.rb:328:1:332:3 | C2 | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:328:1:332:3 | C2 | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:328:1:332:3 | C2 | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:328:1:332:3 | C2 | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:328:1:332:3 | C2 | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:334:1:338:3 | C3 | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:334:1:338:3 | C3 | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:334:1:338:3 | C3 | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:334:1:338:3 | C3 | create | calls.rb:275:1:283:3 | create |
+| calls.rb:334:1:338:3 | C3 | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:334:1:338:3 | C3 | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:334:1:338:3 | C3 | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:334:1:338:3 | C3 | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:334:1:338:3 | C3 | instance | calls.rb:335:5:337:7 | instance |
+| calls.rb:334:1:338:3 | C3 | new | calls.rb:114:5:114:16 | new |
+| calls.rb:334:1:338:3 | C3 | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:334:1:338:3 | C3 | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:334:1:338:3 | C3 | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:334:1:338:3 | C3 | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:334:1:338:3 | C3 | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:374:1:394:3 | SingletonOverride1 | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:374:1:394:3 | SingletonOverride1 | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:374:1:394:3 | SingletonOverride1 | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:374:1:394:3 | SingletonOverride1 | create | calls.rb:275:1:283:3 | create |
+| calls.rb:374:1:394:3 | SingletonOverride1 | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:374:1:394:3 | SingletonOverride1 | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:374:1:394:3 | SingletonOverride1 | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:374:1:394:3 | SingletonOverride1 | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:374:1:394:3 | SingletonOverride1 | new | calls.rb:114:5:114:16 | new |
+| calls.rb:374:1:394:3 | SingletonOverride1 | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:374:1:394:3 | SingletonOverride1 | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:374:1:394:3 | SingletonOverride1 | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:374:1:394:3 | SingletonOverride1 | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:374:1:394:3 | SingletonOverride1 | to_s | calls.rb:169:5:170:7 | to_s |
+| calls.rb:399:1:409:3 | SingletonOverride2 | add_singleton | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:399:1:409:3 | SingletonOverride2 | call_block | calls.rb:81:1:83:3 | call_block |
+| calls.rb:399:1:409:3 | SingletonOverride2 | call_instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:399:1:409:3 | SingletonOverride2 | create | calls.rb:275:1:283:3 | create |
+| calls.rb:399:1:409:3 | SingletonOverride2 | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:399:1:409:3 | SingletonOverride2 | foo | calls.rb:85:1:89:3 | foo |
+| calls.rb:399:1:409:3 | SingletonOverride2 | funny | calls.rb:137:1:139:3 | funny |
+| calls.rb:399:1:409:3 | SingletonOverride2 | indirect | calls.rb:155:1:157:3 | indirect |
+| calls.rb:399:1:409:3 | SingletonOverride2 | new | calls.rb:114:5:114:16 | new |
+| calls.rb:399:1:409:3 | SingletonOverride2 | optional_arg | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:399:1:409:3 | SingletonOverride2 | pattern_dispatch | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:399:1:409:3 | SingletonOverride2 | private_on_main | calls.rb:182:1:183:3 | private_on_main |
+| calls.rb:399:1:409:3 | SingletonOverride2 | puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:399:1:409:3 | SingletonOverride2 | to_s | calls.rb:169:5:170:7 | to_s |
+| file://:0:0:0:0 | Class | include | calls.rb:107:5:107:20 | include |
+| file://:0:0:0:0 | Class | module_eval | calls.rb:106:5:106:24 | module_eval |
+| file://:0:0:0:0 | Class | new | calls.rb:114:5:114:16 | new |
+| file://:0:0:0:0 | Class | prepend | calls.rb:108:5:108:20 | prepend |
+| file://:0:0:0:0 | Class | private | calls.rb:109:5:109:20 | private |
+| file://:0:0:0:0 | Class | puts | calls.rb:102:5:102:30 | puts |
+| file://:0:0:0:0 | Class | to_s | calls.rb:169:5:170:7 | to_s |
+| file://:0:0:0:0 | Complex | new | calls.rb:114:5:114:16 | new |
+| file://:0:0:0:0 | Complex | puts | calls.rb:102:5:102:30 | puts |
+| file://:0:0:0:0 | Complex | to_s | calls.rb:169:5:170:7 | to_s |
+| file://:0:0:0:0 | FalseClass | new | calls.rb:114:5:114:16 | new |
+| file://:0:0:0:0 | FalseClass | puts | calls.rb:102:5:102:30 | puts |
+| file://:0:0:0:0 | FalseClass | to_s | calls.rb:169:5:170:7 | to_s |
+| file://:0:0:0:0 | Float | new | calls.rb:114:5:114:16 | new |
+| file://:0:0:0:0 | Float | puts | calls.rb:102:5:102:30 | puts |
+| file://:0:0:0:0 | Float | to_s | calls.rb:169:5:170:7 | to_s |
+| file://:0:0:0:0 | NilClass | new | calls.rb:114:5:114:16 | new |
+| file://:0:0:0:0 | NilClass | puts | calls.rb:102:5:102:30 | puts |
+| file://:0:0:0:0 | NilClass | to_s | calls.rb:169:5:170:7 | to_s |
+| file://:0:0:0:0 | Numeric | new | calls.rb:114:5:114:16 | new |
+| file://:0:0:0:0 | Numeric | puts | calls.rb:102:5:102:30 | puts |
+| file://:0:0:0:0 | Numeric | to_s | calls.rb:169:5:170:7 | to_s |
+| file://:0:0:0:0 | Rational | new | calls.rb:114:5:114:16 | new |
+| file://:0:0:0:0 | Rational | puts | calls.rb:102:5:102:30 | puts |
+| file://:0:0:0:0 | Rational | to_s | calls.rb:169:5:170:7 | to_s |
+| file://:0:0:0:0 | TrueClass | new | calls.rb:114:5:114:16 | new |
+| file://:0:0:0:0 | TrueClass | puts | calls.rb:102:5:102:30 | puts |
+| file://:0:0:0:0 | TrueClass | to_s | calls.rb:169:5:170:7 | to_s |
 | hello.rb:1:1:8:3 | EnglishWords | hello | hello.rb:2:5:4:7 | hello |
 | hello.rb:1:1:8:3 | EnglishWords | world | hello.rb:5:5:7:7 | world |
 | hello.rb:11:1:16:3 | Greeting | hello | hello.rb:2:5:4:7 | hello |
 | hello.rb:11:1:16:3 | Greeting | message | hello.rb:13:5:15:7 | message |
-| hello.rb:11:1:16:3 | Greeting | new | calls.rb:99:5:99:16 | new |
-| hello.rb:11:1:16:3 | Greeting | puts | calls.rb:87:5:87:17 | puts |
-| hello.rb:11:1:16:3 | Greeting | to_s | calls.rb:151:5:152:7 | to_s |
+| hello.rb:11:1:16:3 | Greeting | new | calls.rb:114:5:114:16 | new |
+| hello.rb:11:1:16:3 | Greeting | puts | calls.rb:102:5:102:30 | puts |
+| hello.rb:11:1:16:3 | Greeting | to_s | calls.rb:169:5:170:7 | to_s |
 | hello.rb:11:1:16:3 | Greeting | world | hello.rb:5:5:7:7 | world |
 | hello.rb:18:1:22:3 | HelloWorld | hello | hello.rb:2:5:4:7 | hello |
 | hello.rb:18:1:22:3 | HelloWorld | message | hello.rb:19:5:21:7 | message |
-| hello.rb:18:1:22:3 | HelloWorld | new | calls.rb:99:5:99:16 | new |
-| hello.rb:18:1:22:3 | HelloWorld | puts | calls.rb:87:5:87:17 | puts |
-| hello.rb:18:1:22:3 | HelloWorld | to_s | calls.rb:151:5:152:7 | to_s |
+| hello.rb:18:1:22:3 | HelloWorld | new | calls.rb:114:5:114:16 | new |
+| hello.rb:18:1:22:3 | HelloWorld | puts | calls.rb:102:5:102:30 | puts |
+| hello.rb:18:1:22:3 | HelloWorld | to_s | calls.rb:169:5:170:7 | to_s |
 | hello.rb:18:1:22:3 | HelloWorld | world | hello.rb:5:5:7:7 | world |
 | modules.rb:4:1:24:3 | Foo | method_in_another_definition_of_foo | modules.rb:27:3:28:5 | method_in_another_definition_of_foo |
 | modules.rb:4:1:24:3 | Foo | method_in_foo | modules.rb:16:3:17:5 | method_in_foo |
 | modules.rb:5:3:14:5 | Foo::Bar | method_in_another_definition_of_foo_bar | modules.rb:52:3:53:5 | method_in_another_definition_of_foo_bar |
 | modules.rb:5:3:14:5 | Foo::Bar | method_in_foo_bar | modules.rb:9:5:10:7 | method_in_foo_bar |
-| modules.rb:6:5:7:7 | Foo::Bar::ClassInFooBar | new | calls.rb:99:5:99:16 | new |
-| modules.rb:6:5:7:7 | Foo::Bar::ClassInFooBar | puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:6:5:7:7 | Foo::Bar::ClassInFooBar | to_s | calls.rb:151:5:152:7 | to_s |
-| modules.rb:19:3:20:5 | Foo::ClassInFoo | new | calls.rb:99:5:99:16 | new |
-| modules.rb:19:3:20:5 | Foo::ClassInFoo | puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:19:3:20:5 | Foo::ClassInFoo | to_s | calls.rb:151:5:152:7 | to_s |
-| modules.rb:30:3:31:5 | Foo::ClassInAnotherDefinitionOfFoo | new | calls.rb:99:5:99:16 | new |
-| modules.rb:30:3:31:5 | Foo::ClassInAnotherDefinitionOfFoo | puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:30:3:31:5 | Foo::ClassInAnotherDefinitionOfFoo | to_s | calls.rb:151:5:152:7 | to_s |
+| modules.rb:6:5:7:7 | Foo::Bar::ClassInFooBar | new | calls.rb:114:5:114:16 | new |
+| modules.rb:6:5:7:7 | Foo::Bar::ClassInFooBar | puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:6:5:7:7 | Foo::Bar::ClassInFooBar | to_s | calls.rb:169:5:170:7 | to_s |
+| modules.rb:19:3:20:5 | Foo::ClassInFoo | new | calls.rb:114:5:114:16 | new |
+| modules.rb:19:3:20:5 | Foo::ClassInFoo | puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:19:3:20:5 | Foo::ClassInFoo | to_s | calls.rb:169:5:170:7 | to_s |
+| modules.rb:30:3:31:5 | Foo::ClassInAnotherDefinitionOfFoo | new | calls.rb:114:5:114:16 | new |
+| modules.rb:30:3:31:5 | Foo::ClassInAnotherDefinitionOfFoo | puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:30:3:31:5 | Foo::ClassInAnotherDefinitionOfFoo | to_s | calls.rb:169:5:170:7 | to_s |
 | modules.rb:37:1:46:3 | Bar | method_a | modules.rb:38:3:39:5 | method_a |
 | modules.rb:37:1:46:3 | Bar | method_b | modules.rb:41:3:42:5 | method_b |
-| modules.rb:37:1:46:3 | Bar | new | calls.rb:99:5:99:16 | new |
-| modules.rb:37:1:46:3 | Bar | puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:37:1:46:3 | Bar | to_s | calls.rb:151:5:152:7 | to_s |
-| modules.rb:49:3:50:5 | Foo::Bar::ClassInAnotherDefinitionOfFooBar | new | calls.rb:99:5:99:16 | new |
-| modules.rb:49:3:50:5 | Foo::Bar::ClassInAnotherDefinitionOfFooBar | puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:49:3:50:5 | Foo::Bar::ClassInAnotherDefinitionOfFooBar | to_s | calls.rb:151:5:152:7 | to_s |
-| modules.rb:66:5:67:7 | Test::Foo1::Bar | new | calls.rb:99:5:99:16 | new |
-| modules.rb:66:5:67:7 | Test::Foo1::Bar | puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:66:5:67:7 | Test::Foo1::Bar | to_s | calls.rb:151:5:152:7 | to_s |
-| modules.rb:72:5:73:7 | Test::Foo2::Foo2::Bar | new | calls.rb:99:5:99:16 | new |
-| modules.rb:72:5:73:7 | Test::Foo2::Foo2::Bar | puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:72:5:73:7 | Test::Foo2::Foo2::Bar | to_s | calls.rb:151:5:152:7 | to_s |
-| modules.rb:112:1:113:3 | YY | new | calls.rb:99:5:99:16 | new |
-| modules.rb:112:1:113:3 | YY | puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:112:1:113:3 | YY | to_s | calls.rb:151:5:152:7 | to_s |
-| modules.rb:116:7:117:9 | XX::YY | new | calls.rb:99:5:99:16 | new |
-| modules.rb:116:7:117:9 | XX::YY | puts | calls.rb:87:5:87:17 | puts |
-| modules.rb:116:7:117:9 | XX::YY | to_s | calls.rb:151:5:152:7 | to_s |
-| modules_rec.rb:1:1:2:3 | B::A | new | calls.rb:99:5:99:16 | new |
-| modules_rec.rb:1:1:2:3 | B::A | puts | calls.rb:87:5:87:17 | puts |
-| modules_rec.rb:1:1:2:3 | B::A | to_s | calls.rb:151:5:152:7 | to_s |
-| modules_rec.rb:4:1:5:3 | A::B | new | calls.rb:99:5:99:16 | new |
-| modules_rec.rb:4:1:5:3 | A::B | puts | calls.rb:87:5:87:17 | puts |
-| modules_rec.rb:4:1:5:3 | A::B | to_s | calls.rb:151:5:152:7 | to_s |
-| private.rb:1:1:29:3 | E | new | calls.rb:99:5:99:16 | new |
+| modules.rb:37:1:46:3 | Bar | new | calls.rb:114:5:114:16 | new |
+| modules.rb:37:1:46:3 | Bar | puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:37:1:46:3 | Bar | to_s | calls.rb:169:5:170:7 | to_s |
+| modules.rb:49:3:50:5 | Foo::Bar::ClassInAnotherDefinitionOfFooBar | new | calls.rb:114:5:114:16 | new |
+| modules.rb:49:3:50:5 | Foo::Bar::ClassInAnotherDefinitionOfFooBar | puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:49:3:50:5 | Foo::Bar::ClassInAnotherDefinitionOfFooBar | to_s | calls.rb:169:5:170:7 | to_s |
+| modules.rb:66:5:67:7 | Test::Foo1::Bar | new | calls.rb:114:5:114:16 | new |
+| modules.rb:66:5:67:7 | Test::Foo1::Bar | puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:66:5:67:7 | Test::Foo1::Bar | to_s | calls.rb:169:5:170:7 | to_s |
+| modules.rb:72:5:73:7 | Test::Foo2::Foo2::Bar | new | calls.rb:114:5:114:16 | new |
+| modules.rb:72:5:73:7 | Test::Foo2::Foo2::Bar | puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:72:5:73:7 | Test::Foo2::Foo2::Bar | to_s | calls.rb:169:5:170:7 | to_s |
+| modules.rb:112:1:113:3 | YY | new | calls.rb:114:5:114:16 | new |
+| modules.rb:112:1:113:3 | YY | puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:112:1:113:3 | YY | to_s | calls.rb:169:5:170:7 | to_s |
+| modules.rb:116:7:117:9 | XX::YY | new | calls.rb:114:5:114:16 | new |
+| modules.rb:116:7:117:9 | XX::YY | puts | calls.rb:102:5:102:30 | puts |
+| modules.rb:116:7:117:9 | XX::YY | to_s | calls.rb:169:5:170:7 | to_s |
+| modules_rec.rb:1:1:2:3 | B::A | new | calls.rb:114:5:114:16 | new |
+| modules_rec.rb:1:1:2:3 | B::A | puts | calls.rb:102:5:102:30 | puts |
+| modules_rec.rb:1:1:2:3 | B::A | to_s | calls.rb:169:5:170:7 | to_s |
+| modules_rec.rb:4:1:5:3 | A::B | new | calls.rb:114:5:114:16 | new |
+| modules_rec.rb:4:1:5:3 | A::B | puts | calls.rb:102:5:102:30 | puts |
+| modules_rec.rb:4:1:5:3 | A::B | to_s | calls.rb:169:5:170:7 | to_s |
+| private.rb:1:1:29:3 | E | new | calls.rb:114:5:114:16 | new |
 | private.rb:1:1:29:3 | E | private2 | private.rb:8:3:9:5 | private2 |
 | private.rb:1:1:29:3 | E | private3 | private.rb:14:3:15:5 | private3 |
 | private.rb:1:1:29:3 | E | private4 | private.rb:17:3:18:5 | private4 |
 | private.rb:1:1:29:3 | E | private_on_main | private.rb:31:1:32:3 | private_on_main |
 | private.rb:1:1:29:3 | E | public | private.rb:5:3:6:5 | public |
-| private.rb:1:1:29:3 | E | puts | calls.rb:87:5:87:17 | puts |
-| private.rb:1:1:29:3 | E | to_s | calls.rb:151:5:152:7 | to_s |
+| private.rb:1:1:29:3 | E | puts | calls.rb:102:5:102:30 | puts |
+| private.rb:1:1:29:3 | E | to_s | calls.rb:169:5:170:7 | to_s |
 | private.rb:42:1:60:3 | F | private2 | private.rb:49:3:50:5 | private2 |
 | private.rb:42:1:60:3 | F | private3 | private.rb:55:3:56:5 | private3 |
 | private.rb:42:1:60:3 | F | private4 | private.rb:58:3:59:5 | private4 |
 | private.rb:42:1:60:3 | F | public | private.rb:46:3:47:5 | public |
+enclosingMethod
+| calls.rb:2:5:2:14 | call to puts | calls.rb:1:1:3:3 | foo |
+| calls.rb:2:5:2:14 | self | calls.rb:1:1:3:3 | foo |
+| calls.rb:2:10:2:14 | "foo" | calls.rb:1:1:3:3 | foo |
+| calls.rb:2:11:2:13 | foo | calls.rb:1:1:3:3 | foo |
+| calls.rb:8:5:8:15 | call to puts | calls.rb:7:1:9:3 | bar |
+| calls.rb:8:5:8:15 | self | calls.rb:7:1:9:3 | bar |
+| calls.rb:8:10:8:15 | "bar1" | calls.rb:7:1:9:3 | bar |
+| calls.rb:8:11:8:14 | bar1 | calls.rb:7:1:9:3 | bar |
+| calls.rb:14:5:14:15 | call to puts | calls.rb:13:1:15:3 | bar |
+| calls.rb:14:5:14:15 | self | calls.rb:13:1:15:3 | bar |
+| calls.rb:14:10:14:15 | "bar2" | calls.rb:13:1:15:3 | bar |
+| calls.rb:14:11:14:14 | bar2 | calls.rb:13:1:15:3 | bar |
+| calls.rb:23:9:23:19 | call to singleton_m | calls.rb:22:5:24:7 | instance_m |
+| calls.rb:23:9:23:19 | self | calls.rb:22:5:24:7 | instance_m |
+| calls.rb:26:9:26:18 | call to instance_m | calls.rb:25:5:27:7 | singleton_m |
+| calls.rb:26:9:26:18 | self | calls.rb:25:5:27:7 | singleton_m |
+| calls.rb:40:5:40:14 | call to instance_m | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:40:5:40:14 | self | calls.rb:39:1:41:3 | call_instance_m |
+| calls.rb:52:9:52:18 | call to instance_m | calls.rb:51:5:57:7 | baz |
+| calls.rb:52:9:52:18 | self | calls.rb:51:5:57:7 | baz |
+| calls.rb:53:9:53:12 | self | calls.rb:51:5:57:7 | baz |
+| calls.rb:53:9:53:23 | call to instance_m | calls.rb:51:5:57:7 | baz |
+| calls.rb:55:9:55:19 | call to singleton_m | calls.rb:51:5:57:7 | baz |
+| calls.rb:55:9:55:19 | self | calls.rb:51:5:57:7 | baz |
+| calls.rb:56:9:56:12 | self | calls.rb:51:5:57:7 | baz |
+| calls.rb:56:9:56:24 | call to singleton_m | calls.rb:51:5:57:7 | baz |
+| calls.rb:67:9:67:13 | call to super | calls.rb:66:5:68:7 | baz |
+| calls.rb:76:18:76:18 | a | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:76:18:76:18 | a | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:76:22:76:22 | 4 | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:76:25:76:25 | b | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:76:25:76:25 | b | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:76:28:76:28 | 5 | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:77:5:77:5 | a | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:77:5:77:16 | call to bit_length | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:78:5:78:5 | b | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:78:5:78:16 | call to bit_length | calls.rb:76:1:79:3 | optional_arg |
+| calls.rb:82:5:82:11 | yield ... | calls.rb:81:1:83:3 | call_block |
+| calls.rb:82:11:82:11 | 1 | calls.rb:81:1:83:3 | call_block |
+| calls.rb:86:5:86:7 | var | calls.rb:85:1:89:3 | foo |
+| calls.rb:86:5:86:18 | ... = ... | calls.rb:85:1:89:3 | foo |
+| calls.rb:86:11:86:14 | Hash | calls.rb:85:1:89:3 | foo |
+| calls.rb:86:11:86:18 | call to new | calls.rb:85:1:89:3 | foo |
+| calls.rb:87:5:87:7 | var | calls.rb:85:1:89:3 | foo |
+| calls.rb:87:5:87:10 | ...[...] | calls.rb:85:1:89:3 | foo |
+| calls.rb:87:9:87:9 | 1 | calls.rb:85:1:89:3 | foo |
+| calls.rb:88:5:88:29 | call to call_block | calls.rb:85:1:89:3 | foo |
+| calls.rb:88:5:88:29 | self | calls.rb:85:1:89:3 | foo |
+| calls.rb:88:16:88:29 | { ... } | calls.rb:85:1:89:3 | foo |
+| calls.rb:88:19:88:19 | x | calls.rb:85:1:89:3 | foo |
+| calls.rb:88:19:88:19 | x | calls.rb:85:1:89:3 | foo |
+| calls.rb:88:22:88:24 | var | calls.rb:85:1:89:3 | foo |
+| calls.rb:88:22:88:27 | ...[...] | calls.rb:85:1:89:3 | foo |
+| calls.rb:88:26:88:26 | x | calls.rb:85:1:89:3 | foo |
+| calls.rb:102:14:102:14 | x | calls.rb:102:5:102:30 | puts |
+| calls.rb:102:14:102:14 | x | calls.rb:102:5:102:30 | puts |
+| calls.rb:102:17:102:26 | call to old_puts | calls.rb:102:5:102:30 | puts |
+| calls.rb:102:17:102:26 | self | calls.rb:102:5:102:30 | puts |
+| calls.rb:102:26:102:26 | x | calls.rb:102:5:102:30 | puts |
+| calls.rb:119:12:119:12 | x | calls.rb:119:5:119:31 | [] |
+| calls.rb:119:12:119:12 | x | calls.rb:119:5:119:31 | [] |
+| calls.rb:119:15:119:27 | call to old_lookup | calls.rb:119:5:119:31 | [] |
+| calls.rb:119:15:119:27 | self | calls.rb:119:5:119:31 | [] |
+| calls.rb:119:26:119:26 | x | calls.rb:119:5:119:31 | [] |
+| calls.rb:124:10:124:10 | x | calls.rb:124:3:124:29 | [] |
+| calls.rb:124:10:124:10 | x | calls.rb:124:3:124:29 | [] |
+| calls.rb:124:13:124:25 | call to old_lookup | calls.rb:124:3:124:29 | [] |
+| calls.rb:124:13:124:25 | self | calls.rb:124:3:124:29 | [] |
+| calls.rb:124:24:124:24 | x | calls.rb:124:3:124:29 | [] |
+| calls.rb:128:15:128:19 | &body | calls.rb:128:3:134:5 | foreach |
+| calls.rb:128:16:128:19 | body | calls.rb:128:3:134:5 | foreach |
+| calls.rb:129:5:129:5 | x | calls.rb:128:3:134:5 | foreach |
+| calls.rb:129:5:129:9 | ... = ... | calls.rb:128:3:134:5 | foreach |
+| calls.rb:129:9:129:9 | 0 | calls.rb:128:3:134:5 | foreach |
+| calls.rb:130:5:133:7 | while ... | calls.rb:128:3:134:5 | foreach |
+| calls.rb:130:11:130:11 | x | calls.rb:128:3:134:5 | foreach |
+| calls.rb:130:11:130:25 | ... < ... | calls.rb:128:3:134:5 | foreach |
+| calls.rb:130:15:130:18 | self | calls.rb:128:3:134:5 | foreach |
+| calls.rb:130:15:130:25 | call to length | calls.rb:128:3:134:5 | foreach |
+| calls.rb:130:26:133:7 | do ... | calls.rb:128:3:134:5 | foreach |
+| calls.rb:131:9:131:24 | yield ... | calls.rb:128:3:134:5 | foreach |
+| calls.rb:131:15:131:15 | x | calls.rb:128:3:134:5 | foreach |
+| calls.rb:131:18:131:21 | self | calls.rb:128:3:134:5 | foreach |
+| calls.rb:131:18:131:24 | ...[...] | calls.rb:128:3:134:5 | foreach |
+| calls.rb:131:23:131:23 | x | calls.rb:128:3:134:5 | foreach |
+| calls.rb:132:9:132:9 | x | calls.rb:128:3:134:5 | foreach |
+| calls.rb:132:9:132:9 | x | calls.rb:128:3:134:5 | foreach |
+| calls.rb:132:9:132:14 | ... += ... | calls.rb:128:3:134:5 | foreach |
+| calls.rb:132:9:132:14 | ... = ... | calls.rb:128:3:134:5 | foreach |
+| calls.rb:132:11:132:12 | ... + ... | calls.rb:128:3:134:5 | foreach |
+| calls.rb:132:14:132:14 | 1 | calls.rb:128:3:134:5 | foreach |
+| calls.rb:138:5:138:20 | yield ... | calls.rb:137:1:139:3 | funny |
+| calls.rb:138:11:138:20 | "prefix: " | calls.rb:137:1:139:3 | funny |
+| calls.rb:138:12:138:19 | prefix:  | calls.rb:137:1:139:3 | funny |
+| calls.rb:155:14:155:15 | &b | calls.rb:155:1:157:3 | indirect |
+| calls.rb:155:15:155:15 | b | calls.rb:155:1:157:3 | indirect |
+| calls.rb:156:5:156:17 | call to call_block | calls.rb:155:1:157:3 | indirect |
+| calls.rb:156:5:156:17 | self | calls.rb:155:1:157:3 | indirect |
+| calls.rb:156:16:156:17 | &... | calls.rb:155:1:157:3 | indirect |
+| calls.rb:156:17:156:17 | b | calls.rb:155:1:157:3 | indirect |
+| calls.rb:164:9:164:12 | self | calls.rb:163:5:165:7 | s_method |
+| calls.rb:164:9:164:17 | call to to_s | calls.rb:163:5:165:7 | s_method |
+| calls.rb:189:9:189:26 | call to puts | calls.rb:188:5:191:7 | singleton_a |
+| calls.rb:189:9:189:26 | self | calls.rb:188:5:191:7 | singleton_a |
+| calls.rb:189:14:189:26 | "singleton_a" | calls.rb:188:5:191:7 | singleton_a |
+| calls.rb:189:15:189:25 | singleton_a | calls.rb:188:5:191:7 | singleton_a |
+| calls.rb:190:9:190:12 | self | calls.rb:188:5:191:7 | singleton_a |
+| calls.rb:190:9:190:24 | call to singleton_b | calls.rb:188:5:191:7 | singleton_a |
+| calls.rb:194:9:194:26 | call to puts | calls.rb:193:5:196:7 | singleton_b |
+| calls.rb:194:9:194:26 | self | calls.rb:193:5:196:7 | singleton_b |
+| calls.rb:194:14:194:26 | "singleton_b" | calls.rb:193:5:196:7 | singleton_b |
+| calls.rb:194:15:194:25 | singleton_b | calls.rb:193:5:196:7 | singleton_b |
+| calls.rb:195:9:195:12 | self | calls.rb:193:5:196:7 | singleton_b |
+| calls.rb:195:9:195:24 | call to singleton_c | calls.rb:193:5:196:7 | singleton_b |
+| calls.rb:199:9:199:26 | call to puts | calls.rb:198:5:200:7 | singleton_c |
+| calls.rb:199:9:199:26 | self | calls.rb:198:5:200:7 | singleton_c |
+| calls.rb:199:14:199:26 | "singleton_c" | calls.rb:198:5:200:7 | singleton_c |
+| calls.rb:199:15:199:25 | singleton_c | calls.rb:198:5:200:7 | singleton_c |
+| calls.rb:203:9:203:26 | call to puts | calls.rb:202:5:205:7 | singleton_d |
+| calls.rb:203:9:203:26 | self | calls.rb:202:5:205:7 | singleton_d |
+| calls.rb:203:14:203:26 | "singleton_d" | calls.rb:202:5:205:7 | singleton_d |
+| calls.rb:203:15:203:25 | singleton_d | calls.rb:202:5:205:7 | singleton_d |
+| calls.rb:204:9:204:12 | self | calls.rb:202:5:205:7 | singleton_d |
+| calls.rb:204:9:204:24 | call to singleton_a | calls.rb:202:5:205:7 | singleton_d |
+| calls.rb:208:9:210:11 | singleton_e | calls.rb:207:5:212:7 | instance |
+| calls.rb:208:13:208:16 | self | calls.rb:207:5:212:7 | instance |
+| calls.rb:209:13:209:30 | call to puts | calls.rb:208:9:210:11 | singleton_e |
+| calls.rb:209:13:209:30 | self | calls.rb:208:9:210:11 | singleton_e |
+| calls.rb:209:18:209:30 | "singleton_e" | calls.rb:208:9:210:11 | singleton_e |
+| calls.rb:209:19:209:29 | singleton_e | calls.rb:208:9:210:11 | singleton_e |
+| calls.rb:211:9:211:19 | call to singleton_e | calls.rb:207:5:212:7 | instance |
+| calls.rb:211:9:211:19 | self | calls.rb:207:5:212:7 | instance |
+| calls.rb:216:13:216:30 | call to puts | calls.rb:215:9:217:11 | singleton_f |
+| calls.rb:216:13:216:30 | self | calls.rb:215:9:217:11 | singleton_f |
+| calls.rb:216:18:216:30 | "singleton_f" | calls.rb:215:9:217:11 | singleton_f |
+| calls.rb:216:19:216:29 | singleton_f | calls.rb:215:9:217:11 | singleton_f |
+| calls.rb:221:9:221:12 | self | calls.rb:220:5:222:7 | call_singleton_g |
+| calls.rb:221:9:221:24 | call to singleton_g | calls.rb:220:5:222:7 | call_singleton_g |
+| calls.rb:234:5:234:24 | call to puts | calls.rb:233:1:235:3 | singleton_g |
+| calls.rb:234:5:234:24 | self | calls.rb:233:1:235:3 | singleton_g |
+| calls.rb:234:10:234:24 | "singleton_g_1" | calls.rb:233:1:235:3 | singleton_g |
+| calls.rb:234:11:234:23 | singleton_g_1 | calls.rb:233:1:235:3 | singleton_g |
+| calls.rb:241:5:241:24 | call to puts | calls.rb:240:1:242:3 | singleton_g |
+| calls.rb:241:5:241:24 | self | calls.rb:240:1:242:3 | singleton_g |
+| calls.rb:241:10:241:24 | "singleton_g_2" | calls.rb:240:1:242:3 | singleton_g |
+| calls.rb:241:11:241:23 | singleton_g_2 | calls.rb:240:1:242:3 | singleton_g |
+| calls.rb:249:9:249:28 | call to puts | calls.rb:248:5:250:7 | singleton_g |
+| calls.rb:249:9:249:28 | self | calls.rb:248:5:250:7 | singleton_g |
+| calls.rb:249:14:249:28 | "singleton_g_3" | calls.rb:248:5:250:7 | singleton_g |
+| calls.rb:249:15:249:27 | singleton_g_3 | calls.rb:248:5:250:7 | singleton_g |
+| calls.rb:265:5:265:22 | call to puts | calls.rb:264:1:266:3 | singleton_g |
+| calls.rb:265:5:265:22 | self | calls.rb:264:1:266:3 | singleton_g |
+| calls.rb:265:10:265:22 | "singleton_g" | calls.rb:264:1:266:3 | singleton_g |
+| calls.rb:265:11:265:21 | singleton_g | calls.rb:264:1:266:3 | singleton_g |
+| calls.rb:275:12:275:15 | type | calls.rb:275:1:283:3 | create |
+| calls.rb:275:12:275:15 | type | calls.rb:275:1:283:3 | create |
+| calls.rb:276:5:276:8 | type | calls.rb:275:1:283:3 | create |
+| calls.rb:276:5:276:12 | call to new | calls.rb:275:1:283:3 | create |
+| calls.rb:276:5:276:21 | call to instance | calls.rb:275:1:283:3 | create |
+| calls.rb:278:5:280:7 | singleton_h | calls.rb:275:1:283:3 | create |
+| calls.rb:278:9:278:12 | type | calls.rb:275:1:283:3 | create |
+| calls.rb:279:9:279:26 | call to puts | calls.rb:278:5:280:7 | singleton_h |
+| calls.rb:279:9:279:26 | self | calls.rb:278:5:280:7 | singleton_h |
+| calls.rb:279:14:279:26 | "singleton_h" | calls.rb:278:5:280:7 | singleton_h |
+| calls.rb:279:15:279:25 | singleton_h | calls.rb:278:5:280:7 | singleton_h |
+| calls.rb:282:5:282:8 | type | calls.rb:275:1:283:3 | create |
+| calls.rb:282:5:282:20 | call to singleton_h | calls.rb:275:1:283:3 | create |
+| calls.rb:292:9:292:26 | call to puts | calls.rb:291:5:293:7 | singleton_i |
+| calls.rb:292:9:292:26 | self | calls.rb:291:5:293:7 | singleton_i |
+| calls.rb:292:14:292:26 | "singleton_i" | calls.rb:291:5:293:7 | singleton_i |
+| calls.rb:292:15:292:25 | singleton_i | calls.rb:291:5:293:7 | singleton_i |
+| calls.rb:301:9:301:26 | call to puts | calls.rb:300:5:302:7 | singleton_j |
+| calls.rb:301:9:301:26 | self | calls.rb:300:5:302:7 | singleton_j |
+| calls.rb:301:14:301:26 | "singleton_j" | calls.rb:300:5:302:7 | singleton_j |
+| calls.rb:301:15:301:25 | singleton_j | calls.rb:300:5:302:7 | singleton_j |
+| calls.rb:309:9:309:31 | call to puts | calls.rb:308:5:311:7 | instance |
+| calls.rb:309:9:309:31 | self | calls.rb:308:5:311:7 | instance |
+| calls.rb:309:14:309:31 | "SelfNew#instance" | calls.rb:308:5:311:7 | instance |
+| calls.rb:309:15:309:30 | SelfNew#instance | calls.rb:308:5:311:7 | instance |
+| calls.rb:310:9:310:11 | call to new | calls.rb:308:5:311:7 | instance |
+| calls.rb:310:9:310:11 | self | calls.rb:308:5:311:7 | instance |
+| calls.rb:310:9:310:20 | call to instance | calls.rb:308:5:311:7 | instance |
+| calls.rb:314:9:314:11 | call to new | calls.rb:313:5:315:7 | singleton |
+| calls.rb:314:9:314:11 | self | calls.rb:313:5:315:7 | singleton |
+| calls.rb:314:9:314:20 | call to instance | calls.rb:313:5:315:7 | singleton |
+| calls.rb:324:9:324:26 | call to puts | calls.rb:323:5:325:7 | instance |
+| calls.rb:324:9:324:26 | self | calls.rb:323:5:325:7 | instance |
+| calls.rb:324:14:324:26 | "C1#instance" | calls.rb:323:5:325:7 | instance |
+| calls.rb:324:15:324:25 | C1#instance | calls.rb:323:5:325:7 | instance |
+| calls.rb:330:9:330:26 | call to puts | calls.rb:329:5:331:7 | instance |
+| calls.rb:330:9:330:26 | self | calls.rb:329:5:331:7 | instance |
+| calls.rb:330:14:330:26 | "C2#instance" | calls.rb:329:5:331:7 | instance |
+| calls.rb:330:15:330:25 | C2#instance | calls.rb:329:5:331:7 | instance |
+| calls.rb:336:9:336:26 | call to puts | calls.rb:335:5:337:7 | instance |
+| calls.rb:336:9:336:26 | self | calls.rb:335:5:337:7 | instance |
+| calls.rb:336:14:336:26 | "C3#instance" | calls.rb:335:5:337:7 | instance |
+| calls.rb:336:15:336:25 | C3#instance | calls.rb:335:5:337:7 | instance |
+| calls.rb:340:22:340:22 | x | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:340:22:340:22 | x | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:341:5:349:7 | case ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:341:10:341:10 | x | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:342:5:343:18 | when ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:342:10:342:11 | C3 | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:342:12:343:18 | then ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:343:9:343:9 | x | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:343:9:343:18 | call to instance | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:344:5:345:18 | when ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:344:10:344:11 | C2 | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:344:12:345:18 | then ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:345:9:345:9 | x | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:345:9:345:18 | call to instance | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:346:5:347:18 | when ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:346:10:346:11 | C1 | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:346:12:347:18 | then ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:347:9:347:9 | x | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:347:9:347:18 | call to instance | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:348:5:348:8 | else ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:351:5:355:7 | case ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:351:10:351:10 | x | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:352:9:352:29 | in ... then ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:352:12:352:13 | C3 | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:352:15:352:29 | then ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:352:20:352:20 | x | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:352:20:352:29 | call to instance | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:353:9:353:36 | in ... then ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:353:12:353:13 | C2 | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:353:12:353:19 | ... => ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:353:18:353:19 | c2 | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:353:21:353:36 | then ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:353:26:353:27 | c2 | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:353:26:353:36 | call to instance | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:354:9:354:36 | in ... then ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:354:12:354:13 | C1 | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:354:12:354:19 | ... => ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:354:18:354:19 | c1 | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:354:21:354:36 | then ... | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:354:26:354:27 | c1 | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:354:26:354:36 | call to instance | calls.rb:340:1:356:3 | pattern_dispatch |
+| calls.rb:364:19:364:19 | x | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:364:19:364:19 | x | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:365:5:367:7 | instance | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:365:9:365:9 | x | calls.rb:364:1:368:3 | add_singleton |
+| calls.rb:366:9:366:28 | call to puts | calls.rb:365:5:367:7 | instance |
+| calls.rb:366:9:366:28 | self | calls.rb:365:5:367:7 | instance |
+| calls.rb:366:14:366:28 | "instance_on x" | calls.rb:365:5:367:7 | instance |
+| calls.rb:366:15:366:27 | instance_on x | calls.rb:365:5:367:7 | instance |
+| calls.rb:377:13:377:48 | call to puts | calls.rb:376:9:378:11 | singleton1 |
+| calls.rb:377:13:377:48 | self | calls.rb:376:9:378:11 | singleton1 |
+| calls.rb:377:18:377:48 | "SingletonOverride1#singleton1" | calls.rb:376:9:378:11 | singleton1 |
+| calls.rb:377:19:377:47 | SingletonOverride1#singleton1 | calls.rb:376:9:378:11 | singleton1 |
+| calls.rb:381:13:381:22 | call to singleton1 | calls.rb:380:9:382:11 | call_singleton1 |
+| calls.rb:381:13:381:22 | self | calls.rb:380:9:382:11 | call_singleton1 |
+| calls.rb:386:9:386:44 | call to puts | calls.rb:385:5:387:7 | singleton2 |
+| calls.rb:386:9:386:44 | self | calls.rb:385:5:387:7 | singleton2 |
+| calls.rb:386:14:386:44 | "SingletonOverride1#singleton2" | calls.rb:385:5:387:7 | singleton2 |
+| calls.rb:386:15:386:43 | SingletonOverride1#singleton2 | calls.rb:385:5:387:7 | singleton2 |
+| calls.rb:390:9:390:18 | call to singleton2 | calls.rb:389:5:391:7 | call_singleton2 |
+| calls.rb:390:9:390:18 | self | calls.rb:389:5:391:7 | call_singleton2 |
+| calls.rb:402:13:402:48 | call to puts | calls.rb:401:9:403:11 | singleton1 |
+| calls.rb:402:13:402:48 | self | calls.rb:401:9:403:11 | singleton1 |
+| calls.rb:402:18:402:48 | "SingletonOverride2#singleton1" | calls.rb:401:9:403:11 | singleton1 |
+| calls.rb:402:19:402:47 | SingletonOverride2#singleton1 | calls.rb:401:9:403:11 | singleton1 |
+| calls.rb:407:9:407:44 | call to puts | calls.rb:406:5:408:7 | singleton2 |
+| calls.rb:407:9:407:44 | self | calls.rb:406:5:408:7 | singleton2 |
+| calls.rb:407:14:407:44 | "SingletonOverride2#singleton2" | calls.rb:406:5:408:7 | singleton2 |
+| calls.rb:407:15:407:43 | SingletonOverride2#singleton2 | calls.rb:406:5:408:7 | singleton2 |
+| hello.rb:3:9:3:22 | return | hello.rb:2:5:4:7 | hello |
+| hello.rb:3:16:3:22 | "hello" | hello.rb:2:5:4:7 | hello |
+| hello.rb:3:17:3:21 | hello | hello.rb:2:5:4:7 | hello |
+| hello.rb:6:9:6:22 | return | hello.rb:5:5:7:7 | world |
+| hello.rb:6:16:6:22 | "world" | hello.rb:5:5:7:7 | world |
+| hello.rb:6:17:6:21 | world | hello.rb:5:5:7:7 | world |
+| hello.rb:14:9:14:20 | return | hello.rb:13:5:15:7 | message |
+| hello.rb:14:16:14:20 | call to hello | hello.rb:13:5:15:7 | message |
+| hello.rb:14:16:14:20 | self | hello.rb:13:5:15:7 | message |
+| hello.rb:20:9:20:40 | return | hello.rb:19:5:21:7 | message |
+| hello.rb:20:16:20:20 | call to super | hello.rb:19:5:21:7 | message |
+| hello.rb:20:16:20:26 | ... + ... | hello.rb:19:5:21:7 | message |
+| hello.rb:20:16:20:34 | ... + ... | hello.rb:19:5:21:7 | message |
+| hello.rb:20:16:20:40 | ... + ... | hello.rb:19:5:21:7 | message |
+| hello.rb:20:24:20:26 | " " | hello.rb:19:5:21:7 | message |
+| hello.rb:20:25:20:25 |   | hello.rb:19:5:21:7 | message |
+| hello.rb:20:30:20:34 | call to world | hello.rb:19:5:21:7 | message |
+| hello.rb:20:30:20:34 | self | hello.rb:19:5:21:7 | message |
+| hello.rb:20:38:20:40 | "!" | hello.rb:19:5:21:7 | message |
+| hello.rb:20:39:20:39 | ! | hello.rb:19:5:21:7 | message |
diff --git a/ruby/ql/test/library-tests/modules/methods.ql b/ruby/ql/test/library-tests/modules/methods.ql
index e92ce65e684..6442dfb9e51 100644
--- a/ruby/ql/test/library-tests/modules/methods.ql
+++ b/ruby/ql/test/library-tests/modules/methods.ql
@@ -6,3 +6,5 @@ query MethodBase getMethod(Module m, string name) {
 }
 
 query MethodBase lookupMethod(Module m, string name) { result = M::lookupMethod(m, name) }
+
+query predicate enclosingMethod(AstNode n, MethodBase m) { m = n.getEnclosingMethod() }
diff --git a/ruby/ql/test/library-tests/modules/modules.expected b/ruby/ql/test/library-tests/modules/modules.expected
index 61a11d1ddf1..81cedac492f 100644
--- a/ruby/ql/test/library-tests/modules/modules.expected
+++ b/ruby/ql/test/library-tests/modules/modules.expected
@@ -1,17 +1,24 @@
 getModule
-| calls.rb:15:1:24:3 | M |
-| calls.rb:29:1:44:3 | C |
-| calls.rb:51:1:55:3 | D |
-| calls.rb:77:1:80:3 | Integer |
-| calls.rb:82:1:84:3 | String |
-| calls.rb:86:1:88:3 | Kernel |
-| calls.rb:90:1:95:3 | Module |
-| calls.rb:97:1:100:3 | Object |
-| calls.rb:102:1:104:3 | Hash |
-| calls.rb:106:1:117:3 | Array |
-| calls.rb:144:1:148:3 | S |
-| calls.rb:150:1:153:3 | A |
-| calls.rb:155:1:158:3 | B |
+| calls.rb:21:1:34:3 | M |
+| calls.rb:43:1:58:3 | C |
+| calls.rb:65:1:69:3 | D |
+| calls.rb:91:1:94:3 | Integer |
+| calls.rb:96:1:98:3 | String |
+| calls.rb:100:1:103:3 | Kernel |
+| calls.rb:105:1:110:3 | Module |
+| calls.rb:112:1:115:3 | Object |
+| calls.rb:117:1:120:3 | Hash |
+| calls.rb:122:1:135:3 | Array |
+| calls.rb:162:1:166:3 | S |
+| calls.rb:168:1:171:3 | A |
+| calls.rb:173:1:176:3 | B |
+| calls.rb:187:1:223:3 | Singletons |
+| calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:322:1:326:3 | C1 |
+| calls.rb:328:1:332:3 | C2 |
+| calls.rb:334:1:338:3 | C3 |
+| calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:399:1:409:3 | SingletonOverride2 |
 | file://:0:0:0:0 | BasicObject |
 | file://:0:0:0:0 | Class |
 | file://:0:0:0:0 | Complex |
@@ -53,33 +60,40 @@ getModule
 | modules.rb:107:1:110:3 | MM |
 | modules.rb:108:3:109:5 | MM::MM |
 | modules.rb:112:1:113:3 | YY |
-| modules.rb:115:1:118:3 | XX |
+| modules.rb:115:1:121:3 | XX |
 | modules.rb:116:7:117:9 | XX::YY |
-| modules.rb:120:1:121:3 | Test::Foo1::Bar::Baz |
+| modules.rb:123:1:124:3 | Test::Foo1::Bar::Baz |
 | modules_rec.rb:1:1:2:3 | B::A |
 | modules_rec.rb:4:1:5:3 | A::B |
 | private.rb:1:1:29:3 | E |
 | private.rb:42:1:60:3 | F |
 getADeclaration
-| calls.rb:15:1:24:3 | M | calls.rb:15:1:24:3 | M |
-| calls.rb:29:1:44:3 | C | calls.rb:29:1:44:3 | C |
-| calls.rb:51:1:55:3 | D | calls.rb:51:1:55:3 | D |
-| calls.rb:77:1:80:3 | Integer | calls.rb:77:1:80:3 | Integer |
-| calls.rb:82:1:84:3 | String | calls.rb:82:1:84:3 | String |
-| calls.rb:86:1:88:3 | Kernel | calls.rb:86:1:88:3 | Kernel |
-| calls.rb:90:1:95:3 | Module | calls.rb:90:1:95:3 | Module |
-| calls.rb:97:1:100:3 | Object | calls.rb:1:1:167:16 | calls.rb |
-| calls.rb:97:1:100:3 | Object | calls.rb:97:1:100:3 | Object |
-| calls.rb:97:1:100:3 | Object | hello.rb:1:1:22:3 | hello.rb |
-| calls.rb:97:1:100:3 | Object | modules.rb:1:1:121:4 | modules.rb |
-| calls.rb:97:1:100:3 | Object | modules_rec.rb:1:1:11:10 | modules_rec.rb |
-| calls.rb:97:1:100:3 | Object | private.rb:1:1:60:3 | private.rb |
-| calls.rb:102:1:104:3 | Hash | calls.rb:102:1:104:3 | Hash |
-| calls.rb:106:1:117:3 | Array | calls.rb:106:1:117:3 | Array |
-| calls.rb:144:1:148:3 | S | calls.rb:144:1:148:3 | S |
-| calls.rb:150:1:153:3 | A | calls.rb:150:1:153:3 | A |
-| calls.rb:150:1:153:3 | A | modules_rec.rb:7:1:9:3 | A |
-| calls.rb:155:1:158:3 | B | calls.rb:155:1:158:3 | B |
+| calls.rb:21:1:34:3 | M | calls.rb:21:1:34:3 | M |
+| calls.rb:43:1:58:3 | C | calls.rb:43:1:58:3 | C |
+| calls.rb:65:1:69:3 | D | calls.rb:65:1:69:3 | D |
+| calls.rb:91:1:94:3 | Integer | calls.rb:91:1:94:3 | Integer |
+| calls.rb:96:1:98:3 | String | calls.rb:96:1:98:3 | String |
+| calls.rb:100:1:103:3 | Kernel | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:105:1:110:3 | Module | calls.rb:105:1:110:3 | Module |
+| calls.rb:112:1:115:3 | Object | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:112:1:115:3 | Object | calls.rb:112:1:115:3 | Object |
+| calls.rb:112:1:115:3 | Object | hello.rb:1:1:22:3 | hello.rb |
+| calls.rb:112:1:115:3 | Object | modules.rb:1:1:129:4 | modules.rb |
+| calls.rb:112:1:115:3 | Object | modules_rec.rb:1:1:11:26 | modules_rec.rb |
+| calls.rb:112:1:115:3 | Object | private.rb:1:1:60:3 | private.rb |
+| calls.rb:117:1:120:3 | Hash | calls.rb:117:1:120:3 | Hash |
+| calls.rb:122:1:135:3 | Array | calls.rb:122:1:135:3 | Array |
+| calls.rb:162:1:166:3 | S | calls.rb:162:1:166:3 | S |
+| calls.rb:168:1:171:3 | A | calls.rb:168:1:171:3 | A |
+| calls.rb:168:1:171:3 | A | modules_rec.rb:7:1:9:3 | A |
+| calls.rb:173:1:176:3 | B | calls.rb:173:1:176:3 | B |
+| calls.rb:187:1:223:3 | Singletons | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:307:1:318:3 | SelfNew | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:322:1:326:3 | C1 | calls.rb:322:1:326:3 | C1 |
+| calls.rb:328:1:332:3 | C2 | calls.rb:328:1:332:3 | C2 |
+| calls.rb:334:1:338:3 | C3 | calls.rb:334:1:338:3 | C3 |
+| calls.rb:374:1:394:3 | SingletonOverride1 | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:399:1:409:3 | SingletonOverride2 | calls.rb:399:1:409:3 | SingletonOverride2 |
 | hello.rb:1:1:8:3 | EnglishWords | hello.rb:1:1:8:3 | EnglishWords |
 | hello.rb:11:1:16:3 | Greeting | hello.rb:11:1:16:3 | Greeting |
 | hello.rb:18:1:22:3 | HelloWorld | hello.rb:18:1:22:3 | HelloWorld |
@@ -113,77 +127,116 @@ getADeclaration
 | modules.rb:107:1:110:3 | MM | modules.rb:107:1:110:3 | MM |
 | modules.rb:108:3:109:5 | MM::MM | modules.rb:108:3:109:5 | MM |
 | modules.rb:112:1:113:3 | YY | modules.rb:112:1:113:3 | YY |
-| modules.rb:115:1:118:3 | XX | modules.rb:115:1:118:3 | XX |
+| modules.rb:115:1:121:3 | XX | modules.rb:115:1:121:3 | XX |
 | modules.rb:116:7:117:9 | XX::YY | modules.rb:116:7:117:9 | YY |
-| modules.rb:120:1:121:3 | Test::Foo1::Bar::Baz | modules.rb:120:1:121:3 | Baz |
+| modules.rb:123:1:124:3 | Test::Foo1::Bar::Baz | modules.rb:123:1:124:3 | Baz |
 | modules_rec.rb:1:1:2:3 | B::A | modules_rec.rb:1:1:2:3 | A |
 | modules_rec.rb:4:1:5:3 | A::B | modules_rec.rb:4:1:5:3 | B |
 | private.rb:1:1:29:3 | E | private.rb:1:1:29:3 | E |
 | private.rb:42:1:60:3 | F | private.rb:42:1:60:3 | F |
 getSuperClass
-| calls.rb:29:1:44:3 | C | calls.rb:97:1:100:3 | Object |
-| calls.rb:51:1:55:3 | D | calls.rb:29:1:44:3 | C |
-| calls.rb:77:1:80:3 | Integer | file://:0:0:0:0 | Numeric |
-| calls.rb:82:1:84:3 | String | calls.rb:97:1:100:3 | Object |
-| calls.rb:90:1:95:3 | Module | calls.rb:97:1:100:3 | Object |
-| calls.rb:97:1:100:3 | Object | file://:0:0:0:0 | BasicObject |
-| calls.rb:102:1:104:3 | Hash | calls.rb:97:1:100:3 | Object |
-| calls.rb:106:1:117:3 | Array | calls.rb:97:1:100:3 | Object |
-| calls.rb:144:1:148:3 | S | calls.rb:97:1:100:3 | Object |
-| calls.rb:150:1:153:3 | A | calls.rb:144:1:148:3 | S |
-| calls.rb:150:1:153:3 | A | calls.rb:155:1:158:3 | B |
-| calls.rb:155:1:158:3 | B | calls.rb:144:1:148:3 | S |
-| file://:0:0:0:0 | Class | calls.rb:90:1:95:3 | Module |
+| calls.rb:43:1:58:3 | C | calls.rb:112:1:115:3 | Object |
+| calls.rb:65:1:69:3 | D | calls.rb:43:1:58:3 | C |
+| calls.rb:91:1:94:3 | Integer | file://:0:0:0:0 | Numeric |
+| calls.rb:96:1:98:3 | String | calls.rb:112:1:115:3 | Object |
+| calls.rb:105:1:110:3 | Module | calls.rb:112:1:115:3 | Object |
+| calls.rb:112:1:115:3 | Object | file://:0:0:0:0 | BasicObject |
+| calls.rb:117:1:120:3 | Hash | calls.rb:112:1:115:3 | Object |
+| calls.rb:122:1:135:3 | Array | calls.rb:112:1:115:3 | Object |
+| calls.rb:162:1:166:3 | S | calls.rb:112:1:115:3 | Object |
+| calls.rb:168:1:171:3 | A | calls.rb:162:1:166:3 | S |
+| calls.rb:168:1:171:3 | A | calls.rb:173:1:176:3 | B |
+| calls.rb:173:1:176:3 | B | calls.rb:162:1:166:3 | S |
+| calls.rb:187:1:223:3 | Singletons | calls.rb:112:1:115:3 | Object |
+| calls.rb:307:1:318:3 | SelfNew | calls.rb:112:1:115:3 | Object |
+| calls.rb:322:1:326:3 | C1 | calls.rb:112:1:115:3 | Object |
+| calls.rb:328:1:332:3 | C2 | calls.rb:322:1:326:3 | C1 |
+| calls.rb:334:1:338:3 | C3 | calls.rb:328:1:332:3 | C2 |
+| calls.rb:374:1:394:3 | SingletonOverride1 | calls.rb:112:1:115:3 | Object |
+| calls.rb:399:1:409:3 | SingletonOverride2 | calls.rb:374:1:394:3 | SingletonOverride1 |
+| file://:0:0:0:0 | Class | calls.rb:105:1:110:3 | Module |
 | file://:0:0:0:0 | Complex | file://:0:0:0:0 | Numeric |
-| file://:0:0:0:0 | FalseClass | calls.rb:97:1:100:3 | Object |
+| file://:0:0:0:0 | FalseClass | calls.rb:112:1:115:3 | Object |
 | file://:0:0:0:0 | Float | file://:0:0:0:0 | Numeric |
-| file://:0:0:0:0 | NilClass | calls.rb:97:1:100:3 | Object |
-| file://:0:0:0:0 | Numeric | calls.rb:97:1:100:3 | Object |
+| file://:0:0:0:0 | NilClass | calls.rb:112:1:115:3 | Object |
+| file://:0:0:0:0 | Numeric | calls.rb:112:1:115:3 | Object |
 | file://:0:0:0:0 | Rational | file://:0:0:0:0 | Numeric |
-| file://:0:0:0:0 | TrueClass | calls.rb:97:1:100:3 | Object |
-| hello.rb:11:1:16:3 | Greeting | calls.rb:97:1:100:3 | Object |
+| file://:0:0:0:0 | TrueClass | calls.rb:112:1:115:3 | Object |
+| hello.rb:11:1:16:3 | Greeting | calls.rb:112:1:115:3 | Object |
 | hello.rb:18:1:22:3 | HelloWorld | hello.rb:11:1:16:3 | Greeting |
-| modules.rb:6:5:7:7 | Foo::Bar::ClassInFooBar | calls.rb:97:1:100:3 | Object |
-| modules.rb:19:3:20:5 | Foo::ClassInFoo | calls.rb:97:1:100:3 | Object |
-| modules.rb:30:3:31:5 | Foo::ClassInAnotherDefinitionOfFoo | calls.rb:97:1:100:3 | Object |
-| modules.rb:37:1:46:3 | Bar | calls.rb:97:1:100:3 | Object |
-| modules.rb:49:3:50:5 | Foo::Bar::ClassInAnotherDefinitionOfFooBar | calls.rb:97:1:100:3 | Object |
-| modules.rb:66:5:67:7 | Test::Foo1::Bar | calls.rb:97:1:100:3 | Object |
-| modules.rb:72:5:73:7 | Test::Foo2::Foo2::Bar | calls.rb:97:1:100:3 | Object |
-| modules.rb:112:1:113:3 | YY | calls.rb:97:1:100:3 | Object |
+| modules.rb:6:5:7:7 | Foo::Bar::ClassInFooBar | calls.rb:112:1:115:3 | Object |
+| modules.rb:19:3:20:5 | Foo::ClassInFoo | calls.rb:112:1:115:3 | Object |
+| modules.rb:30:3:31:5 | Foo::ClassInAnotherDefinitionOfFoo | calls.rb:112:1:115:3 | Object |
+| modules.rb:37:1:46:3 | Bar | calls.rb:112:1:115:3 | Object |
+| modules.rb:49:3:50:5 | Foo::Bar::ClassInAnotherDefinitionOfFooBar | calls.rb:112:1:115:3 | Object |
+| modules.rb:66:5:67:7 | Test::Foo1::Bar | calls.rb:112:1:115:3 | Object |
+| modules.rb:72:5:73:7 | Test::Foo2::Foo2::Bar | calls.rb:112:1:115:3 | Object |
+| modules.rb:112:1:113:3 | YY | calls.rb:112:1:115:3 | Object |
 | modules.rb:116:7:117:9 | XX::YY | modules.rb:112:1:113:3 | YY |
-| modules_rec.rb:1:1:2:3 | B::A | calls.rb:97:1:100:3 | Object |
-| modules_rec.rb:4:1:5:3 | A::B | calls.rb:97:1:100:3 | Object |
-| private.rb:1:1:29:3 | E | calls.rb:97:1:100:3 | Object |
+| modules_rec.rb:1:1:2:3 | B::A | calls.rb:112:1:115:3 | Object |
+| modules_rec.rb:4:1:5:3 | A::B | calls.rb:112:1:115:3 | Object |
+| private.rb:1:1:29:3 | E | calls.rb:112:1:115:3 | Object |
 getAPrependedModule
-| calls.rb:97:1:100:3 | Object | calls.rb:150:1:153:3 | A |
-| calls.rb:150:1:153:3 | A | modules_rec.rb:4:1:5:3 | A::B |
+| calls.rb:112:1:115:3 | Object | calls.rb:168:1:171:3 | A |
+| calls.rb:168:1:171:3 | A | modules_rec.rb:4:1:5:3 | A::B |
 | modules.rb:101:1:105:3 | PrependTest | modules.rb:63:1:81:3 | Test |
 getAnIncludedModule
-| calls.rb:29:1:44:3 | C | calls.rb:15:1:24:3 | M |
-| calls.rb:97:1:100:3 | Object | calls.rb:86:1:88:3 | Kernel |
+| calls.rb:43:1:58:3 | C | calls.rb:21:1:34:3 | M |
+| calls.rb:112:1:115:3 | Object | calls.rb:100:1:103:3 | Kernel |
 | hello.rb:11:1:16:3 | Greeting | hello.rb:1:1:8:3 | EnglishWords |
 | modules.rb:88:1:93:3 | IncludeTest | modules.rb:63:1:81:3 | Test |
 | modules.rb:95:1:99:3 | IncludeTest2 | modules.rb:63:1:81:3 | Test |
 resolveConstantReadAccess
-| calls.rb:26:1:26:1 | M | M |
-| calls.rb:27:1:27:1 | M | M |
-| calls.rb:30:13:30:13 | M | M |
-| calls.rb:46:5:46:5 | C | C |
-| calls.rb:51:11:51:11 | C | C |
-| calls.rb:57:5:57:5 | D | D |
-| calls.rb:72:11:72:14 | Hash | Hash |
-| calls.rb:97:16:97:21 | Module | Module |
-| calls.rb:98:13:98:18 | Kernel | Kernel |
-| calls.rb:129:1:129:13 | Array | Array |
-| calls.rb:131:1:131:7 | Array | Array |
-| calls.rb:133:1:133:7 | Array | Array |
-| calls.rb:135:1:135:8 | Array | Array |
-| calls.rb:150:11:150:11 | S | S |
-| calls.rb:155:11:155:11 | S | S |
-| calls.rb:160:1:160:1 | S | S |
-| calls.rb:161:1:161:1 | A | A |
-| calls.rb:162:1:162:1 | B | B |
+| calls.rb:36:1:36:1 | M | M |
+| calls.rb:37:1:37:1 | M | M |
+| calls.rb:44:13:44:13 | M | M |
+| calls.rb:60:5:60:5 | C | C |
+| calls.rb:65:11:65:11 | C | C |
+| calls.rb:71:5:71:5 | D | D |
+| calls.rb:86:11:86:14 | Hash | Hash |
+| calls.rb:112:16:112:21 | Module | Module |
+| calls.rb:113:13:113:18 | Kernel | Kernel |
+| calls.rb:147:1:147:13 | Array | Array |
+| calls.rb:149:1:149:7 | Array | Array |
+| calls.rb:151:1:151:7 | Array | Array |
+| calls.rb:153:1:153:8 | Array | Array |
+| calls.rb:168:11:168:11 | S | S |
+| calls.rb:173:11:173:11 | S | S |
+| calls.rb:178:1:178:1 | S | S |
+| calls.rb:179:1:179:1 | A | A |
+| calls.rb:180:1:180:1 | B | B |
+| calls.rb:225:1:225:10 | Singletons | Singletons |
+| calls.rb:226:1:226:10 | Singletons | Singletons |
+| calls.rb:228:6:228:15 | Singletons | Singletons |
+| calls.rb:256:6:256:15 | Singletons | Singletons |
+| calls.rb:264:5:264:14 | Singletons | Singletons |
+| calls.rb:268:1:268:10 | Singletons | Singletons |
+| calls.rb:272:6:272:15 | Singletons | Singletons |
+| calls.rb:285:8:285:17 | Singletons | Singletons |
+| calls.rb:286:1:286:10 | Singletons | Singletons |
+| calls.rb:288:5:288:14 | Singletons | Singletons |
+| calls.rb:297:1:297:10 | Singletons | Singletons |
+| calls.rb:299:10:299:19 | Singletons | Singletons |
+| calls.rb:305:1:305:10 | Singletons | Singletons |
+| calls.rb:320:1:320:7 | SelfNew | SelfNew |
+| calls.rb:328:12:328:13 | C1 | C1 |
+| calls.rb:334:12:334:13 | C2 | C2 |
+| calls.rb:342:10:342:11 | C3 | C3 |
+| calls.rb:344:10:344:11 | C2 | C2 |
+| calls.rb:346:10:346:11 | C1 | C1 |
+| calls.rb:352:12:352:13 | C3 | C3 |
+| calls.rb:353:12:353:13 | C2 | C2 |
+| calls.rb:354:12:354:13 | C1 | C1 |
+| calls.rb:358:6:358:7 | C1 | C1 |
+| calls.rb:360:19:360:20 | C1 | C1 |
+| calls.rb:361:19:361:20 | C2 | C2 |
+| calls.rb:362:19:362:20 | C3 | C3 |
+| calls.rb:370:6:370:7 | C1 | C1 |
+| calls.rb:396:1:396:18 | SingletonOverride1 | SingletonOverride1 |
+| calls.rb:397:1:397:18 | SingletonOverride1 | SingletonOverride1 |
+| calls.rb:399:28:399:45 | SingletonOverride1 | SingletonOverride1 |
+| calls.rb:411:1:411:18 | SingletonOverride2 | SingletonOverride2 |
+| calls.rb:412:1:412:18 | SingletonOverride2 | SingletonOverride2 |
 | hello.rb:12:13:12:24 | EnglishWords | EnglishWords |
 | hello.rb:18:20:18:27 | Greeting | Greeting |
 | modules.rb:48:8:48:10 | Foo | Foo |
@@ -201,9 +254,10 @@ resolveConstantReadAccess
 | modules.rb:103:10:103:13 | Foo2 | Test::Foo2 |
 | modules.rb:108:10:108:11 | MM | MM |
 | modules.rb:116:18:116:19 | YY | YY |
-| modules.rb:120:8:120:11 | Test | Test |
-| modules.rb:120:8:120:17 | Foo1 | Test::Foo1 |
-| modules.rb:120:8:120:22 | Bar | Test::Foo1::Bar |
+| modules.rb:123:8:123:11 | Test | Test |
+| modules.rb:123:8:123:17 | Foo1 | Test::Foo1 |
+| modules.rb:123:8:123:22 | Bar | Test::Foo1::Bar |
+| modules.rb:126:6:126:7 | XX | XX |
 | modules_rec.rb:1:7:1:7 | B | B |
 | modules_rec.rb:4:7:4:7 | A | A |
 | modules_rec.rb:7:11:7:11 | B | B |
@@ -215,19 +269,26 @@ resolveConstantReadAccess
 | private.rb:37:1:37:1 | E | E |
 | private.rb:38:1:38:1 | E | E |
 resolveConstantWriteAccess
-| calls.rb:15:1:24:3 | M | M |
-| calls.rb:29:1:44:3 | C | C |
-| calls.rb:51:1:55:3 | D | D |
-| calls.rb:77:1:80:3 | Integer | Integer |
-| calls.rb:82:1:84:3 | String | String |
-| calls.rb:86:1:88:3 | Kernel | Kernel |
-| calls.rb:90:1:95:3 | Module | Module |
-| calls.rb:97:1:100:3 | Object | Object |
-| calls.rb:102:1:104:3 | Hash | Hash |
-| calls.rb:106:1:117:3 | Array | Array |
-| calls.rb:144:1:148:3 | S | S |
-| calls.rb:150:1:153:3 | A | A |
-| calls.rb:155:1:158:3 | B | B |
+| calls.rb:21:1:34:3 | M | M |
+| calls.rb:43:1:58:3 | C | C |
+| calls.rb:65:1:69:3 | D | D |
+| calls.rb:91:1:94:3 | Integer | Integer |
+| calls.rb:96:1:98:3 | String | String |
+| calls.rb:100:1:103:3 | Kernel | Kernel |
+| calls.rb:105:1:110:3 | Module | Module |
+| calls.rb:112:1:115:3 | Object | Object |
+| calls.rb:117:1:120:3 | Hash | Hash |
+| calls.rb:122:1:135:3 | Array | Array |
+| calls.rb:162:1:166:3 | S | S |
+| calls.rb:168:1:171:3 | A | A |
+| calls.rb:173:1:176:3 | B | B |
+| calls.rb:187:1:223:3 | Singletons | Singletons |
+| calls.rb:307:1:318:3 | SelfNew | SelfNew |
+| calls.rb:322:1:326:3 | C1 | C1 |
+| calls.rb:328:1:332:3 | C2 | C2 |
+| calls.rb:334:1:338:3 | C3 | C3 |
+| calls.rb:374:1:394:3 | SingletonOverride1 | SingletonOverride1 |
+| calls.rb:399:1:409:3 | SingletonOverride2 | SingletonOverride2 |
 | hello.rb:1:1:8:3 | EnglishWords | EnglishWords |
 | hello.rb:11:1:16:3 | Greeting | Greeting |
 | hello.rb:18:1:22:3 | HelloWorld | HelloWorld |
@@ -271,11 +332,882 @@ resolveConstantWriteAccess
 | modules.rb:108:3:109:5 | MM | MM::MM |
 | modules.rb:108:3:109:5 | MM | MM::MM::MM |
 | modules.rb:112:1:113:3 | YY | YY |
-| modules.rb:115:1:118:3 | XX | XX |
+| modules.rb:115:1:121:3 | XX | XX |
 | modules.rb:116:7:117:9 | YY | XX::YY |
-| modules.rb:120:1:121:3 | Baz | Test::Foo1::Bar::Baz |
+| modules.rb:123:1:124:3 | Baz | Test::Foo1::Bar::Baz |
 | modules_rec.rb:1:1:2:3 | A | B::A |
 | modules_rec.rb:4:1:5:3 | B | A::B |
 | modules_rec.rb:7:1:9:3 | A | A |
 | private.rb:1:1:29:3 | E | E |
 | private.rb:42:1:60:3 | F | F |
+enclosingModule
+| calls.rb:1:1:3:3 | foo | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:2:5:2:14 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:2:5:2:14 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:2:10:2:14 | "foo" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:2:11:2:13 | foo | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:5:1:5:3 | call to foo | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:5:1:5:3 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:7:1:9:3 | bar | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:7:5:7:8 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:8:5:8:15 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:8:5:8:15 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:8:10:8:15 | "bar1" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:8:11:8:14 | bar1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:11:1:11:4 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:11:1:11:8 | call to bar | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:13:1:15:3 | bar | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:13:5:13:8 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:14:5:14:15 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:14:5:14:15 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:14:10:14:15 | "bar2" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:14:11:14:14 | bar2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:17:1:17:4 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:17:1:17:8 | call to bar | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:19:1:19:4 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:19:1:19:8 | call to foo | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:21:1:34:3 | M | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:22:5:24:7 | instance_m | calls.rb:21:1:34:3 | M |
+| calls.rb:23:9:23:19 | call to singleton_m | calls.rb:21:1:34:3 | M |
+| calls.rb:23:9:23:19 | self | calls.rb:21:1:34:3 | M |
+| calls.rb:25:5:27:7 | singleton_m | calls.rb:21:1:34:3 | M |
+| calls.rb:25:9:25:12 | self | calls.rb:21:1:34:3 | M |
+| calls.rb:26:9:26:18 | call to instance_m | calls.rb:21:1:34:3 | M |
+| calls.rb:26:9:26:18 | self | calls.rb:21:1:34:3 | M |
+| calls.rb:29:5:29:14 | call to instance_m | calls.rb:21:1:34:3 | M |
+| calls.rb:29:5:29:14 | self | calls.rb:21:1:34:3 | M |
+| calls.rb:30:5:30:8 | self | calls.rb:21:1:34:3 | M |
+| calls.rb:30:5:30:19 | call to instance_m | calls.rb:21:1:34:3 | M |
+| calls.rb:32:5:32:15 | call to singleton_m | calls.rb:21:1:34:3 | M |
+| calls.rb:32:5:32:15 | self | calls.rb:21:1:34:3 | M |
+| calls.rb:33:5:33:8 | self | calls.rb:21:1:34:3 | M |
+| calls.rb:33:5:33:20 | call to singleton_m | calls.rb:21:1:34:3 | M |
+| calls.rb:36:1:36:1 | M | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:36:1:36:12 | call to instance_m | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:37:1:37:1 | M | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:37:1:37:13 | call to singleton_m | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:39:1:41:3 | call_instance_m | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:40:5:40:14 | call to instance_m | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:40:5:40:14 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:43:1:58:3 | C | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:44:5:44:13 | call to include | calls.rb:43:1:58:3 | C |
+| calls.rb:44:5:44:13 | self | calls.rb:43:1:58:3 | C |
+| calls.rb:44:13:44:13 | M | calls.rb:43:1:58:3 | C |
+| calls.rb:45:5:45:14 | call to instance_m | calls.rb:43:1:58:3 | C |
+| calls.rb:45:5:45:14 | self | calls.rb:43:1:58:3 | C |
+| calls.rb:46:5:46:8 | self | calls.rb:43:1:58:3 | C |
+| calls.rb:46:5:46:19 | call to instance_m | calls.rb:43:1:58:3 | C |
+| calls.rb:48:5:48:15 | call to singleton_m | calls.rb:43:1:58:3 | C |
+| calls.rb:48:5:48:15 | self | calls.rb:43:1:58:3 | C |
+| calls.rb:49:5:49:8 | self | calls.rb:43:1:58:3 | C |
+| calls.rb:49:5:49:20 | call to singleton_m | calls.rb:43:1:58:3 | C |
+| calls.rb:51:5:57:7 | baz | calls.rb:43:1:58:3 | C |
+| calls.rb:52:9:52:18 | call to instance_m | calls.rb:43:1:58:3 | C |
+| calls.rb:52:9:52:18 | self | calls.rb:43:1:58:3 | C |
+| calls.rb:53:9:53:12 | self | calls.rb:43:1:58:3 | C |
+| calls.rb:53:9:53:23 | call to instance_m | calls.rb:43:1:58:3 | C |
+| calls.rb:55:9:55:19 | call to singleton_m | calls.rb:43:1:58:3 | C |
+| calls.rb:55:9:55:19 | self | calls.rb:43:1:58:3 | C |
+| calls.rb:56:9:56:12 | self | calls.rb:43:1:58:3 | C |
+| calls.rb:56:9:56:24 | call to singleton_m | calls.rb:43:1:58:3 | C |
+| calls.rb:60:1:60:1 | c | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:60:1:60:9 | ... = ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:60:5:60:5 | C | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:60:5:60:9 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:61:1:61:1 | c | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:61:1:61:5 | call to baz | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:62:1:62:1 | c | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:62:1:62:13 | call to singleton_m | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:63:1:63:1 | c | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:63:1:63:12 | call to instance_m | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:65:1:69:3 | D | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:65:11:65:11 | C | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:66:5:68:7 | baz | calls.rb:65:1:69:3 | D |
+| calls.rb:67:9:67:13 | call to super | calls.rb:65:1:69:3 | D |
+| calls.rb:71:1:71:1 | d | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:71:1:71:9 | ... = ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:71:5:71:5 | D | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:71:5:71:9 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:72:1:72:1 | d | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:72:1:72:5 | call to baz | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:73:1:73:1 | d | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:73:1:73:13 | call to singleton_m | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:74:1:74:1 | d | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:74:1:74:12 | call to instance_m | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:76:1:79:3 | optional_arg | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:76:18:76:18 | a | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:76:18:76:18 | a | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:76:22:76:22 | 4 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:76:25:76:25 | b | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:76:25:76:25 | b | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:76:28:76:28 | 5 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:77:5:77:5 | a | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:77:5:77:16 | call to bit_length | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:78:5:78:5 | b | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:78:5:78:16 | call to bit_length | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:81:1:83:3 | call_block | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:82:5:82:11 | yield ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:82:11:82:11 | 1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:85:1:89:3 | foo | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:86:5:86:7 | var | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:86:5:86:18 | ... = ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:86:11:86:14 | Hash | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:86:11:86:18 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:87:5:87:7 | var | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:87:5:87:10 | ...[...] | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:87:9:87:9 | 1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:88:5:88:29 | call to call_block | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:88:5:88:29 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:88:16:88:29 | { ... } | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:88:19:88:19 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:88:19:88:19 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:88:22:88:24 | var | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:88:22:88:27 | ...[...] | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:88:26:88:26 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:91:1:94:3 | Integer | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:92:5:92:23 | bit_length | calls.rb:91:1:94:3 | Integer |
+| calls.rb:93:5:93:16 | abs | calls.rb:91:1:94:3 | Integer |
+| calls.rb:96:1:98:3 | String | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:97:5:97:23 | capitalize | calls.rb:96:1:98:3 | String |
+| calls.rb:100:1:103:3 | Kernel | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:101:5:101:25 | alias ... | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:101:11:101:19 | :old_puts | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:101:11:101:19 | old_puts | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:101:21:101:25 | :puts | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:101:21:101:25 | puts | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:102:5:102:30 | puts | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:102:14:102:14 | x | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:102:14:102:14 | x | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:102:17:102:26 | call to old_puts | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:102:17:102:26 | self | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:102:26:102:26 | x | calls.rb:100:1:103:3 | Kernel |
+| calls.rb:105:1:110:3 | Module | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:106:5:106:24 | module_eval | calls.rb:105:1:110:3 | Module |
+| calls.rb:107:5:107:20 | include | calls.rb:105:1:110:3 | Module |
+| calls.rb:108:5:108:20 | prepend | calls.rb:105:1:110:3 | Module |
+| calls.rb:109:5:109:20 | private | calls.rb:105:1:110:3 | Module |
+| calls.rb:112:1:115:3 | Object | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:112:16:112:21 | Module | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:113:5:113:18 | call to include | calls.rb:112:1:115:3 | Object |
+| calls.rb:113:5:113:18 | self | calls.rb:112:1:115:3 | Object |
+| calls.rb:113:13:113:18 | Kernel | calls.rb:112:1:115:3 | Object |
+| calls.rb:114:5:114:16 | new | calls.rb:112:1:115:3 | Object |
+| calls.rb:117:1:120:3 | Hash | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:118:5:118:25 | alias ... | calls.rb:117:1:120:3 | Hash |
+| calls.rb:118:11:118:21 | :old_lookup | calls.rb:117:1:120:3 | Hash |
+| calls.rb:118:11:118:21 | old_lookup | calls.rb:117:1:120:3 | Hash |
+| calls.rb:118:23:118:25 | :[] | calls.rb:117:1:120:3 | Hash |
+| calls.rb:118:23:118:25 | [] | calls.rb:117:1:120:3 | Hash |
+| calls.rb:119:5:119:31 | [] | calls.rb:117:1:120:3 | Hash |
+| calls.rb:119:12:119:12 | x | calls.rb:117:1:120:3 | Hash |
+| calls.rb:119:12:119:12 | x | calls.rb:117:1:120:3 | Hash |
+| calls.rb:119:15:119:27 | call to old_lookup | calls.rb:117:1:120:3 | Hash |
+| calls.rb:119:15:119:27 | self | calls.rb:117:1:120:3 | Hash |
+| calls.rb:119:26:119:26 | x | calls.rb:117:1:120:3 | Hash |
+| calls.rb:122:1:135:3 | Array | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:123:3:123:23 | alias ... | calls.rb:122:1:135:3 | Array |
+| calls.rb:123:9:123:19 | :old_lookup | calls.rb:122:1:135:3 | Array |
+| calls.rb:123:9:123:19 | old_lookup | calls.rb:122:1:135:3 | Array |
+| calls.rb:123:21:123:23 | :[] | calls.rb:122:1:135:3 | Array |
+| calls.rb:123:21:123:23 | [] | calls.rb:122:1:135:3 | Array |
+| calls.rb:124:3:124:29 | [] | calls.rb:122:1:135:3 | Array |
+| calls.rb:124:10:124:10 | x | calls.rb:122:1:135:3 | Array |
+| calls.rb:124:10:124:10 | x | calls.rb:122:1:135:3 | Array |
+| calls.rb:124:13:124:25 | call to old_lookup | calls.rb:122:1:135:3 | Array |
+| calls.rb:124:13:124:25 | self | calls.rb:122:1:135:3 | Array |
+| calls.rb:124:24:124:24 | x | calls.rb:122:1:135:3 | Array |
+| calls.rb:126:3:126:17 | length | calls.rb:122:1:135:3 | Array |
+| calls.rb:128:3:134:5 | foreach | calls.rb:122:1:135:3 | Array |
+| calls.rb:128:15:128:19 | &body | calls.rb:122:1:135:3 | Array |
+| calls.rb:128:16:128:19 | body | calls.rb:122:1:135:3 | Array |
+| calls.rb:129:5:129:5 | x | calls.rb:122:1:135:3 | Array |
+| calls.rb:129:5:129:9 | ... = ... | calls.rb:122:1:135:3 | Array |
+| calls.rb:129:9:129:9 | 0 | calls.rb:122:1:135:3 | Array |
+| calls.rb:130:5:133:7 | while ... | calls.rb:122:1:135:3 | Array |
+| calls.rb:130:11:130:11 | x | calls.rb:122:1:135:3 | Array |
+| calls.rb:130:11:130:25 | ... < ... | calls.rb:122:1:135:3 | Array |
+| calls.rb:130:15:130:18 | self | calls.rb:122:1:135:3 | Array |
+| calls.rb:130:15:130:25 | call to length | calls.rb:122:1:135:3 | Array |
+| calls.rb:130:26:133:7 | do ... | calls.rb:122:1:135:3 | Array |
+| calls.rb:131:9:131:24 | yield ... | calls.rb:122:1:135:3 | Array |
+| calls.rb:131:15:131:15 | x | calls.rb:122:1:135:3 | Array |
+| calls.rb:131:18:131:21 | self | calls.rb:122:1:135:3 | Array |
+| calls.rb:131:18:131:24 | ...[...] | calls.rb:122:1:135:3 | Array |
+| calls.rb:131:23:131:23 | x | calls.rb:122:1:135:3 | Array |
+| calls.rb:132:9:132:9 | x | calls.rb:122:1:135:3 | Array |
+| calls.rb:132:9:132:9 | x | calls.rb:122:1:135:3 | Array |
+| calls.rb:132:9:132:14 | ... += ... | calls.rb:122:1:135:3 | Array |
+| calls.rb:132:9:132:14 | ... = ... | calls.rb:122:1:135:3 | Array |
+| calls.rb:132:11:132:12 | ... + ... | calls.rb:122:1:135:3 | Array |
+| calls.rb:132:14:132:14 | 1 | calls.rb:122:1:135:3 | Array |
+| calls.rb:137:1:139:3 | funny | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:138:5:138:20 | yield ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:138:11:138:20 | "prefix: " | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:138:12:138:19 | prefix:  | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:141:1:141:30 | call to funny | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:141:1:141:30 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:141:7:141:30 | { ... } | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:141:10:141:10 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:141:10:141:10 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:141:13:141:29 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:141:13:141:29 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:141:18:141:18 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:141:18:141:29 | call to capitalize | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:143:1:143:3 | "a" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:143:1:143:14 | call to capitalize | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:143:2:143:2 | a | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:144:1:144:1 | 1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:144:1:144:12 | call to bit_length | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:145:1:145:1 | 1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:145:1:145:5 | call to abs | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:1:147:13 | Array | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:1:147:13 | [...] | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:1:147:13 | call to [] | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:1:147:62 | call to foreach | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:2:147:4 | "a" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:3:147:3 | a | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:6:147:8 | "b" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:7:147:7 | b | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:10:147:12 | "c" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:11:147:11 | c | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:23:147:62 | { ... } | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:26:147:26 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:26:147:26 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:29:147:29 | v | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:29:147:29 | v | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:32:147:61 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:32:147:61 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:37:147:61 | "#{...} -> #{...}" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:38:147:41 | #{...} | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:40:147:40 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:42:147:45 |  ->  | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:46:147:60 | #{...} | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:48:147:48 | v | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:147:48:147:59 | call to capitalize | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:1:149:7 | Array | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:1:149:7 | [...] | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:1:149:7 | call to [] | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:1:149:35 | call to foreach | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:2:149:2 | 1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:4:149:4 | 2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:6:149:6 | 3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:17:149:35 | { ... } | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:20:149:20 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:20:149:20 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:23:149:23 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:149:23:149:34 | call to bit_length | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:1:151:7 | Array | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:1:151:7 | [...] | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:1:151:7 | call to [] | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:1:151:40 | call to foreach | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:2:151:2 | 1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:4:151:4 | 2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:6:151:6 | 3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:17:151:40 | { ... } | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:20:151:20 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:20:151:20 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:23:151:39 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:23:151:39 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:28:151:28 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:151:28:151:39 | call to capitalize | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:1:153:8 | Array | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:1:153:8 | [...] | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:1:153:8 | call to [] | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:1:153:37 | call to foreach | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:2:153:2 | 1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:4:153:5 | - ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:5:153:5 | 2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:7:153:7 | 3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:18:153:37 | { ... } | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:21:153:21 | _ | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:21:153:21 | _ | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:24:153:24 | v | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:24:153:24 | v | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:27:153:36 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:27:153:36 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:32:153:32 | v | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:153:32:153:36 | call to abs | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:155:1:157:3 | indirect | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:155:14:155:15 | &b | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:155:15:155:15 | b | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:156:5:156:17 | call to call_block | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:156:5:156:17 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:156:16:156:17 | &... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:156:17:156:17 | b | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:159:1:159:28 | call to indirect | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:159:1:159:28 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:159:10:159:28 | { ... } | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:159:13:159:13 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:159:13:159:13 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:159:16:159:16 | i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:159:16:159:27 | call to bit_length | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:162:1:166:3 | S | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:163:5:165:7 | s_method | calls.rb:162:1:166:3 | S |
+| calls.rb:164:9:164:12 | self | calls.rb:162:1:166:3 | S |
+| calls.rb:164:9:164:17 | call to to_s | calls.rb:162:1:166:3 | S |
+| calls.rb:168:1:171:3 | A | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:168:11:168:11 | S | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:169:5:170:7 | to_s | calls.rb:168:1:171:3 | A |
+| calls.rb:173:1:176:3 | B | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:173:11:173:11 | S | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:174:5:175:7 | to_s | calls.rb:173:1:176:3 | B |
+| calls.rb:178:1:178:1 | S | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:178:1:178:5 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:178:1:178:14 | call to s_method | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:179:1:179:1 | A | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:179:1:179:5 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:179:1:179:14 | call to s_method | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:180:1:180:1 | B | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:180:1:180:5 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:180:1:180:14 | call to s_method | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:182:1:183:3 | private_on_main | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:185:1:185:15 | call to private_on_main | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:185:1:185:15 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:187:1:223:3 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:188:5:191:7 | singleton_a | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:188:9:188:12 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:189:9:189:26 | call to puts | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:189:9:189:26 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:189:14:189:26 | "singleton_a" | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:189:15:189:25 | singleton_a | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:190:9:190:12 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:190:9:190:24 | call to singleton_b | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:193:5:196:7 | singleton_b | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:193:9:193:12 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:194:9:194:26 | call to puts | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:194:9:194:26 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:194:14:194:26 | "singleton_b" | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:194:15:194:25 | singleton_b | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:195:9:195:12 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:195:9:195:24 | call to singleton_c | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:198:5:200:7 | singleton_c | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:198:9:198:12 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:199:9:199:26 | call to puts | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:199:9:199:26 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:199:14:199:26 | "singleton_c" | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:199:15:199:25 | singleton_c | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:202:5:205:7 | singleton_d | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:202:9:202:12 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:203:9:203:26 | call to puts | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:203:9:203:26 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:203:14:203:26 | "singleton_d" | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:203:15:203:25 | singleton_d | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:204:9:204:12 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:204:9:204:24 | call to singleton_a | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:207:5:212:7 | instance | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:208:9:210:11 | singleton_e | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:208:13:208:16 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:209:13:209:30 | call to puts | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:209:13:209:30 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:209:18:209:30 | "singleton_e" | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:209:19:209:29 | singleton_e | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:211:9:211:19 | call to singleton_e | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:211:9:211:19 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:214:5:218:7 | class << ... | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:214:14:214:17 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:215:9:217:11 | singleton_f | calls.rb:214:5:218:7 | class << ... |
+| calls.rb:216:13:216:30 | call to puts | calls.rb:214:5:218:7 | class << ... |
+| calls.rb:216:13:216:30 | self | calls.rb:214:5:218:7 | class << ... |
+| calls.rb:216:18:216:30 | "singleton_f" | calls.rb:214:5:218:7 | class << ... |
+| calls.rb:216:19:216:29 | singleton_f | calls.rb:214:5:218:7 | class << ... |
+| calls.rb:220:5:222:7 | call_singleton_g | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:221:9:221:12 | self | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:221:9:221:24 | call to singleton_g | calls.rb:187:1:223:3 | Singletons |
+| calls.rb:225:1:225:10 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:225:1:225:22 | call to singleton_a | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:226:1:226:10 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:226:1:226:22 | call to singleton_f | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:228:1:228:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:228:1:228:19 | ... = ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:228:6:228:15 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:228:6:228:19 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:230:1:230:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:230:1:230:11 | call to instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:231:1:231:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:231:1:231:14 | call to singleton_e | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:233:1:235:3 | singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:233:5:233:6 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:234:5:234:24 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:234:5:234:24 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:234:10:234:24 | "singleton_g_1" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:234:11:234:23 | singleton_g_1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:237:1:237:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:237:1:237:14 | call to singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:238:1:238:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:238:1:238:19 | call to call_singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:240:1:242:3 | singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:240:5:240:6 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:241:5:241:24 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:241:5:241:24 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:241:10:241:24 | "singleton_g_2" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:241:11:241:23 | singleton_g_2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:244:1:244:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:244:1:244:14 | call to singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:245:1:245:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:245:1:245:19 | call to call_singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:247:1:251:3 | class << ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:247:10:247:11 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:248:5:250:7 | singleton_g | calls.rb:247:1:251:3 | class << ... |
+| calls.rb:249:9:249:28 | call to puts | calls.rb:247:1:251:3 | class << ... |
+| calls.rb:249:9:249:28 | self | calls.rb:247:1:251:3 | class << ... |
+| calls.rb:249:14:249:28 | "singleton_g_3" | calls.rb:247:1:251:3 | class << ... |
+| calls.rb:249:15:249:27 | singleton_g_3 | calls.rb:247:1:251:3 | class << ... |
+| calls.rb:253:1:253:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:253:1:253:14 | call to singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:254:1:254:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:254:1:254:19 | call to call_singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:256:1:256:2 | c2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:256:1:256:19 | ... = ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:256:6:256:15 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:256:6:256:19 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:257:1:257:2 | c2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:257:1:257:14 | call to singleton_e | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:258:1:258:2 | c2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:258:1:258:14 | call to singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:260:1:260:4 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:260:1:260:8 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:262:1:262:16 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:262:1:262:16 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:262:6:262:16 | "top-level" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:262:7:262:15 | top-level | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:264:1:266:3 | singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:264:5:264:14 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:265:5:265:22 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:265:5:265:22 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:265:10:265:22 | "singleton_g" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:265:11:265:21 | singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:268:1:268:10 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:268:1:268:22 | call to singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:269:1:269:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:269:1:269:14 | call to singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:270:1:270:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:270:1:270:19 | call to call_singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:271:1:271:2 | c2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:271:1:271:14 | call to singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:272:1:272:2 | c3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:272:1:272:19 | ... = ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:272:6:272:15 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:272:6:272:19 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:273:1:273:2 | c3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:273:1:273:14 | call to singleton_g | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:275:1:283:3 | create | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:275:12:275:15 | type | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:275:12:275:15 | type | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:276:5:276:8 | type | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:276:5:276:12 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:276:5:276:21 | call to instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:278:5:280:7 | singleton_h | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:278:9:278:12 | type | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:279:9:279:26 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:279:9:279:26 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:279:14:279:26 | "singleton_h" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:279:15:279:25 | singleton_h | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:282:5:282:8 | type | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:282:5:282:20 | call to singleton_h | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:285:1:285:17 | call to create | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:285:1:285:17 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:285:8:285:17 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:286:1:286:10 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:286:1:286:22 | call to singleton_h | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:288:1:288:1 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:288:1:288:14 | ... = ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:288:5:288:14 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:290:1:294:3 | class << ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:290:10:290:10 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:291:5:293:7 | singleton_i | calls.rb:290:1:294:3 | class << ... |
+| calls.rb:292:9:292:26 | call to puts | calls.rb:290:1:294:3 | class << ... |
+| calls.rb:292:9:292:26 | self | calls.rb:290:1:294:3 | class << ... |
+| calls.rb:292:14:292:26 | "singleton_i" | calls.rb:290:1:294:3 | class << ... |
+| calls.rb:292:15:292:25 | singleton_i | calls.rb:290:1:294:3 | class << ... |
+| calls.rb:296:1:296:1 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:296:1:296:13 | call to singleton_i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:297:1:297:10 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:297:1:297:22 | call to singleton_i | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:299:1:303:3 | class << ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:299:10:299:19 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:300:5:302:7 | singleton_j | calls.rb:299:1:303:3 | class << ... |
+| calls.rb:301:9:301:26 | call to puts | calls.rb:299:1:303:3 | class << ... |
+| calls.rb:301:9:301:26 | self | calls.rb:299:1:303:3 | class << ... |
+| calls.rb:301:14:301:26 | "singleton_j" | calls.rb:299:1:303:3 | class << ... |
+| calls.rb:301:15:301:25 | singleton_j | calls.rb:299:1:303:3 | class << ... |
+| calls.rb:305:1:305:10 | Singletons | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:305:1:305:22 | call to singleton_j | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:307:1:318:3 | SelfNew | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:308:5:311:7 | instance | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:309:9:309:31 | call to puts | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:309:9:309:31 | self | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:309:14:309:31 | "SelfNew#instance" | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:309:15:309:30 | SelfNew#instance | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:310:9:310:11 | call to new | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:310:9:310:11 | self | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:310:9:310:20 | call to instance | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:313:5:315:7 | singleton | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:313:9:313:12 | self | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:314:9:314:11 | call to new | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:314:9:314:11 | self | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:314:9:314:20 | call to instance | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:317:5:317:7 | call to new | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:317:5:317:7 | self | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:317:5:317:16 | call to instance | calls.rb:307:1:318:3 | SelfNew |
+| calls.rb:320:1:320:7 | SelfNew | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:320:1:320:17 | call to singleton | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:322:1:326:3 | C1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:323:5:325:7 | instance | calls.rb:322:1:326:3 | C1 |
+| calls.rb:324:9:324:26 | call to puts | calls.rb:322:1:326:3 | C1 |
+| calls.rb:324:9:324:26 | self | calls.rb:322:1:326:3 | C1 |
+| calls.rb:324:14:324:26 | "C1#instance" | calls.rb:322:1:326:3 | C1 |
+| calls.rb:324:15:324:25 | C1#instance | calls.rb:322:1:326:3 | C1 |
+| calls.rb:328:1:332:3 | C2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:328:12:328:13 | C1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:329:5:331:7 | instance | calls.rb:328:1:332:3 | C2 |
+| calls.rb:330:9:330:26 | call to puts | calls.rb:328:1:332:3 | C2 |
+| calls.rb:330:9:330:26 | self | calls.rb:328:1:332:3 | C2 |
+| calls.rb:330:14:330:26 | "C2#instance" | calls.rb:328:1:332:3 | C2 |
+| calls.rb:330:15:330:25 | C2#instance | calls.rb:328:1:332:3 | C2 |
+| calls.rb:334:1:338:3 | C3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:334:12:334:13 | C2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:335:5:337:7 | instance | calls.rb:334:1:338:3 | C3 |
+| calls.rb:336:9:336:26 | call to puts | calls.rb:334:1:338:3 | C3 |
+| calls.rb:336:9:336:26 | self | calls.rb:334:1:338:3 | C3 |
+| calls.rb:336:14:336:26 | "C3#instance" | calls.rb:334:1:338:3 | C3 |
+| calls.rb:336:15:336:25 | C3#instance | calls.rb:334:1:338:3 | C3 |
+| calls.rb:340:1:356:3 | pattern_dispatch | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:340:22:340:22 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:340:22:340:22 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:341:5:349:7 | case ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:341:10:341:10 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:342:5:343:18 | when ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:342:10:342:11 | C3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:342:12:343:18 | then ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:343:9:343:9 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:343:9:343:18 | call to instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:344:5:345:18 | when ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:344:10:344:11 | C2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:344:12:345:18 | then ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:345:9:345:9 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:345:9:345:18 | call to instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:346:5:347:18 | when ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:346:10:346:11 | C1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:346:12:347:18 | then ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:347:9:347:9 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:347:9:347:18 | call to instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:348:5:348:8 | else ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:351:5:355:7 | case ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:351:10:351:10 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:352:9:352:29 | in ... then ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:352:12:352:13 | C3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:352:15:352:29 | then ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:352:20:352:20 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:352:20:352:29 | call to instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:353:9:353:36 | in ... then ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:353:12:353:13 | C2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:353:12:353:19 | ... => ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:353:18:353:19 | c2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:353:21:353:36 | then ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:353:26:353:27 | c2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:353:26:353:36 | call to instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:354:9:354:36 | in ... then ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:354:12:354:13 | C1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:354:12:354:19 | ... => ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:354:18:354:19 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:354:21:354:36 | then ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:354:26:354:27 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:354:26:354:36 | call to instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:358:1:358:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:358:1:358:11 | ... = ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:358:6:358:7 | C1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:358:6:358:11 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:359:1:359:2 | c1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:359:1:359:11 | call to instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:360:1:360:25 | call to pattern_dispatch | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:360:1:360:25 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:360:18:360:25 | ( ... ) | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:360:19:360:20 | C1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:360:19:360:24 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:361:1:361:25 | call to pattern_dispatch | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:361:1:361:25 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:361:18:361:25 | ( ... ) | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:361:19:361:20 | C2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:361:19:361:24 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:362:1:362:25 | call to pattern_dispatch | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:362:1:362:25 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:362:18:362:25 | ( ... ) | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:362:19:362:20 | C3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:362:19:362:24 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:364:1:368:3 | add_singleton | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:364:19:364:19 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:364:19:364:19 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:365:5:367:7 | instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:365:9:365:9 | x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:366:9:366:28 | call to puts | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:366:9:366:28 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:366:14:366:28 | "instance_on x" | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:366:15:366:27 | instance_on x | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:370:1:370:2 | c3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:370:1:370:11 | ... = ... | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:370:6:370:7 | C1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:370:6:370:11 | call to new | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:371:1:371:16 | call to add_singleton | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:371:1:371:16 | self | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:371:15:371:16 | c3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:372:1:372:2 | c3 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:372:1:372:11 | call to instance | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:374:1:394:3 | SingletonOverride1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:375:5:383:7 | class << ... | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:375:14:375:17 | self | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:376:9:378:11 | singleton1 | calls.rb:375:5:383:7 | class << ... |
+| calls.rb:377:13:377:48 | call to puts | calls.rb:375:5:383:7 | class << ... |
+| calls.rb:377:13:377:48 | self | calls.rb:375:5:383:7 | class << ... |
+| calls.rb:377:18:377:48 | "SingletonOverride1#singleton1" | calls.rb:375:5:383:7 | class << ... |
+| calls.rb:377:19:377:47 | SingletonOverride1#singleton1 | calls.rb:375:5:383:7 | class << ... |
+| calls.rb:380:9:382:11 | call_singleton1 | calls.rb:375:5:383:7 | class << ... |
+| calls.rb:381:13:381:22 | call to singleton1 | calls.rb:375:5:383:7 | class << ... |
+| calls.rb:381:13:381:22 | self | calls.rb:375:5:383:7 | class << ... |
+| calls.rb:385:5:387:7 | singleton2 | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:385:9:385:12 | self | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:386:9:386:44 | call to puts | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:386:9:386:44 | self | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:386:14:386:44 | "SingletonOverride1#singleton2" | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:386:15:386:43 | SingletonOverride1#singleton2 | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:389:5:391:7 | call_singleton2 | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:389:9:389:12 | self | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:390:9:390:18 | call to singleton2 | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:390:9:390:18 | self | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:393:5:393:14 | call to singleton2 | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:393:5:393:14 | self | calls.rb:374:1:394:3 | SingletonOverride1 |
+| calls.rb:396:1:396:18 | SingletonOverride1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:396:1:396:34 | call to call_singleton1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:397:1:397:18 | SingletonOverride1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:397:1:397:34 | call to call_singleton2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:399:1:409:3 | SingletonOverride2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:399:28:399:45 | SingletonOverride1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:400:5:404:7 | class << ... | calls.rb:399:1:409:3 | SingletonOverride2 |
+| calls.rb:400:14:400:17 | self | calls.rb:399:1:409:3 | SingletonOverride2 |
+| calls.rb:401:9:403:11 | singleton1 | calls.rb:400:5:404:7 | class << ... |
+| calls.rb:402:13:402:48 | call to puts | calls.rb:400:5:404:7 | class << ... |
+| calls.rb:402:13:402:48 | self | calls.rb:400:5:404:7 | class << ... |
+| calls.rb:402:18:402:48 | "SingletonOverride2#singleton1" | calls.rb:400:5:404:7 | class << ... |
+| calls.rb:402:19:402:47 | SingletonOverride2#singleton1 | calls.rb:400:5:404:7 | class << ... |
+| calls.rb:406:5:408:7 | singleton2 | calls.rb:399:1:409:3 | SingletonOverride2 |
+| calls.rb:406:9:406:12 | self | calls.rb:399:1:409:3 | SingletonOverride2 |
+| calls.rb:407:9:407:44 | call to puts | calls.rb:399:1:409:3 | SingletonOverride2 |
+| calls.rb:407:9:407:44 | self | calls.rb:399:1:409:3 | SingletonOverride2 |
+| calls.rb:407:14:407:44 | "SingletonOverride2#singleton2" | calls.rb:399:1:409:3 | SingletonOverride2 |
+| calls.rb:407:15:407:43 | SingletonOverride2#singleton2 | calls.rb:399:1:409:3 | SingletonOverride2 |
+| calls.rb:411:1:411:18 | SingletonOverride2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:411:1:411:34 | call to call_singleton1 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:412:1:412:18 | SingletonOverride2 | calls.rb:1:1:412:35 | calls.rb |
+| calls.rb:412:1:412:34 | call to call_singleton2 | calls.rb:1:1:412:35 | calls.rb |
+| hello.rb:1:1:8:3 | EnglishWords | hello.rb:1:1:22:3 | hello.rb |
+| hello.rb:2:5:4:7 | hello | hello.rb:1:1:8:3 | EnglishWords |
+| hello.rb:3:9:3:22 | return | hello.rb:1:1:8:3 | EnglishWords |
+| hello.rb:3:16:3:22 | "hello" | hello.rb:1:1:8:3 | EnglishWords |
+| hello.rb:3:17:3:21 | hello | hello.rb:1:1:8:3 | EnglishWords |
+| hello.rb:5:5:7:7 | world | hello.rb:1:1:8:3 | EnglishWords |
+| hello.rb:6:9:6:22 | return | hello.rb:1:1:8:3 | EnglishWords |
+| hello.rb:6:16:6:22 | "world" | hello.rb:1:1:8:3 | EnglishWords |
+| hello.rb:6:17:6:21 | world | hello.rb:1:1:8:3 | EnglishWords |
+| hello.rb:11:1:16:3 | Greeting | hello.rb:1:1:22:3 | hello.rb |
+| hello.rb:12:5:12:24 | call to include | hello.rb:11:1:16:3 | Greeting |
+| hello.rb:12:5:12:24 | self | hello.rb:11:1:16:3 | Greeting |
+| hello.rb:12:13:12:24 | EnglishWords | hello.rb:11:1:16:3 | Greeting |
+| hello.rb:13:5:15:7 | message | hello.rb:11:1:16:3 | Greeting |
+| hello.rb:14:9:14:20 | return | hello.rb:11:1:16:3 | Greeting |
+| hello.rb:14:16:14:20 | call to hello | hello.rb:11:1:16:3 | Greeting |
+| hello.rb:14:16:14:20 | self | hello.rb:11:1:16:3 | Greeting |
+| hello.rb:18:1:22:3 | HelloWorld | hello.rb:1:1:22:3 | hello.rb |
+| hello.rb:18:20:18:27 | Greeting | hello.rb:1:1:22:3 | hello.rb |
+| hello.rb:19:5:21:7 | message | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:9:20:40 | return | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:16:20:20 | call to super | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:16:20:26 | ... + ... | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:16:20:34 | ... + ... | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:16:20:40 | ... + ... | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:24:20:26 | " " | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:25:20:25 |   | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:30:20:34 | call to world | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:30:20:34 | self | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:38:20:40 | "!" | hello.rb:18:1:22:3 | HelloWorld |
+| hello.rb:20:39:20:39 | ! | hello.rb:18:1:22:3 | HelloWorld |
+| modules.rb:1:1:2:3 | Empty | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:4:1:24:3 | Foo | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:5:3:14:5 | Bar | modules.rb:4:1:24:3 | Foo |
+| modules.rb:6:5:7:7 | ClassInFooBar | modules.rb:5:3:14:5 | Bar |
+| modules.rb:9:5:10:7 | method_in_foo_bar | modules.rb:5:3:14:5 | Bar |
+| modules.rb:12:5:12:26 | call to puts | modules.rb:5:3:14:5 | Bar |
+| modules.rb:12:5:12:26 | self | modules.rb:5:3:14:5 | Bar |
+| modules.rb:12:10:12:26 | "module Foo::Bar" | modules.rb:5:3:14:5 | Bar |
+| modules.rb:12:11:12:25 | module Foo::Bar | modules.rb:5:3:14:5 | Bar |
+| modules.rb:13:5:13:15 | $global_var | modules.rb:5:3:14:5 | Bar |
+| modules.rb:13:5:13:19 | ... = ... | modules.rb:5:3:14:5 | Bar |
+| modules.rb:13:19:13:19 | 0 | modules.rb:5:3:14:5 | Bar |
+| modules.rb:16:3:17:5 | method_in_foo | modules.rb:4:1:24:3 | Foo |
+| modules.rb:19:3:20:5 | ClassInFoo | modules.rb:4:1:24:3 | Foo |
+| modules.rb:22:3:22:19 | call to puts | modules.rb:4:1:24:3 | Foo |
+| modules.rb:22:3:22:19 | self | modules.rb:4:1:24:3 | Foo |
+| modules.rb:22:8:22:19 | "module Foo" | modules.rb:4:1:24:3 | Foo |
+| modules.rb:22:9:22:18 | module Foo | modules.rb:4:1:24:3 | Foo |
+| modules.rb:23:3:23:13 | $global_var | modules.rb:4:1:24:3 | Foo |
+| modules.rb:23:3:23:17 | ... = ... | modules.rb:4:1:24:3 | Foo |
+| modules.rb:23:17:23:17 | 1 | modules.rb:4:1:24:3 | Foo |
+| modules.rb:26:1:35:3 | Foo | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:27:3:28:5 | method_in_another_definition_of_foo | modules.rb:26:1:35:3 | Foo |
+| modules.rb:30:3:31:5 | ClassInAnotherDefinitionOfFoo | modules.rb:26:1:35:3 | Foo |
+| modules.rb:33:3:33:25 | call to puts | modules.rb:26:1:35:3 | Foo |
+| modules.rb:33:3:33:25 | self | modules.rb:26:1:35:3 | Foo |
+| modules.rb:33:8:33:25 | "module Foo again" | modules.rb:26:1:35:3 | Foo |
+| modules.rb:33:9:33:24 | module Foo again | modules.rb:26:1:35:3 | Foo |
+| modules.rb:34:3:34:13 | $global_var | modules.rb:26:1:35:3 | Foo |
+| modules.rb:34:3:34:17 | ... = ... | modules.rb:26:1:35:3 | Foo |
+| modules.rb:34:17:34:17 | 2 | modules.rb:26:1:35:3 | Foo |
+| modules.rb:37:1:46:3 | Bar | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:38:3:39:5 | method_a | modules.rb:37:1:46:3 | Bar |
+| modules.rb:41:3:42:5 | method_b | modules.rb:37:1:46:3 | Bar |
+| modules.rb:44:3:44:19 | call to puts | modules.rb:37:1:46:3 | Bar |
+| modules.rb:44:3:44:19 | self | modules.rb:37:1:46:3 | Bar |
+| modules.rb:44:8:44:19 | "module Bar" | modules.rb:37:1:46:3 | Bar |
+| modules.rb:44:9:44:18 | module Bar | modules.rb:37:1:46:3 | Bar |
+| modules.rb:45:3:45:13 | $global_var | modules.rb:37:1:46:3 | Bar |
+| modules.rb:45:3:45:17 | ... = ... | modules.rb:37:1:46:3 | Bar |
+| modules.rb:45:17:45:17 | 3 | modules.rb:37:1:46:3 | Bar |
+| modules.rb:48:1:57:3 | Bar | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:48:8:48:10 | Foo | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:49:3:50:5 | ClassInAnotherDefinitionOfFooBar | modules.rb:48:1:57:3 | Bar |
+| modules.rb:52:3:53:5 | method_in_another_definition_of_foo_bar | modules.rb:48:1:57:3 | Bar |
+| modules.rb:55:3:55:30 | call to puts | modules.rb:48:1:57:3 | Bar |
+| modules.rb:55:3:55:30 | self | modules.rb:48:1:57:3 | Bar |
+| modules.rb:55:8:55:30 | "module Foo::Bar again" | modules.rb:48:1:57:3 | Bar |
+| modules.rb:55:9:55:29 | module Foo::Bar again | modules.rb:48:1:57:3 | Bar |
+| modules.rb:56:3:56:13 | $global_var | modules.rb:48:1:57:3 | Bar |
+| modules.rb:56:3:56:17 | ... = ... | modules.rb:48:1:57:3 | Bar |
+| modules.rb:56:17:56:17 | 4 | modules.rb:48:1:57:3 | Bar |
+| modules.rb:60:1:61:3 | MyModuleInGlobalScope | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:63:1:81:3 | Test | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:65:3:68:5 | Foo1 | modules.rb:63:1:81:3 | Test |
+| modules.rb:66:5:67:7 | Bar | modules.rb:65:3:68:5 | Foo1 |
+| modules.rb:66:11:66:14 | Foo1 | modules.rb:65:3:68:5 | Foo1 |
+| modules.rb:70:3:74:5 | Foo2 | modules.rb:63:1:81:3 | Test |
+| modules.rb:71:5:71:19 | Foo2 | modules.rb:70:3:74:5 | Foo2 |
+| modules.rb:72:5:73:7 | Bar | modules.rb:70:3:74:5 | Foo2 |
+| modules.rb:72:11:72:14 | Foo2 | modules.rb:70:3:74:5 | Foo2 |
+| modules.rb:76:3:80:5 | Foo3 | modules.rb:63:1:81:3 | Test |
+| modules.rb:77:5:77:8 | Foo3 | modules.rb:76:3:80:5 | Foo3 |
+| modules.rb:77:5:77:17 | ... = ... | modules.rb:76:3:80:5 | Foo3 |
+| modules.rb:77:12:77:17 | Object | modules.rb:76:3:80:5 | Foo3 |
+| modules.rb:78:5:79:7 | Bar | modules.rb:76:3:80:5 | Foo3 |
+| modules.rb:78:11:78:14 | Foo3 | modules.rb:76:3:80:5 | Foo3 |
+| modules.rb:83:1:86:3 | Other | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:84:3:85:5 | Foo1 | modules.rb:83:1:86:3 | Other |
+| modules.rb:88:1:93:3 | IncludeTest | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:89:3:89:16 | call to include | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:89:3:89:16 | self | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:89:11:89:16 | Test | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:90:3:90:8 | Object | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:90:3:90:38 | call to module_eval | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:90:22:90:38 | { ... } | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:90:24:90:36 | call to prepend | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:90:24:90:36 | self | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:90:32:90:36 | Other | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:91:3:92:5 | Y | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:91:10:91:13 | Foo1 | modules.rb:88:1:93:3 | IncludeTest |
+| modules.rb:95:1:99:3 | IncludeTest2 | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:96:3:96:14 | call to include | modules.rb:95:1:99:3 | IncludeTest2 |
+| modules.rb:96:3:96:14 | self | modules.rb:95:1:99:3 | IncludeTest2 |
+| modules.rb:96:11:96:14 | Test | modules.rb:95:1:99:3 | IncludeTest2 |
+| modules.rb:97:3:98:5 | Z | modules.rb:95:1:99:3 | IncludeTest2 |
+| modules.rb:97:10:97:13 | Foo1 | modules.rb:95:1:99:3 | IncludeTest2 |
+| modules.rb:101:1:105:3 | PrependTest | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:102:3:102:16 | call to prepend | modules.rb:101:1:105:3 | PrependTest |
+| modules.rb:102:3:102:16 | self | modules.rb:101:1:105:3 | PrependTest |
+| modules.rb:102:11:102:16 | Test | modules.rb:101:1:105:3 | PrependTest |
+| modules.rb:103:3:104:5 | Y | modules.rb:101:1:105:3 | PrependTest |
+| modules.rb:103:10:103:13 | Foo2 | modules.rb:101:1:105:3 | PrependTest |
+| modules.rb:107:1:110:3 | MM | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:108:3:109:5 | MM | modules.rb:107:1:110:3 | MM |
+| modules.rb:108:10:108:11 | MM | modules.rb:107:1:110:3 | MM |
+| modules.rb:112:1:113:3 | YY | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:115:1:121:3 | XX | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:116:7:117:9 | YY | modules.rb:115:1:121:3 | XX |
+| modules.rb:116:18:116:19 | YY | modules.rb:115:1:121:3 | XX |
+| modules.rb:119:7:120:9 | class << ... | modules.rb:115:1:121:3 | XX |
+| modules.rb:119:16:119:19 | self | modules.rb:115:1:121:3 | XX |
+| modules.rb:123:1:124:3 | Baz | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:123:8:123:11 | Test | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:123:8:123:17 | Foo1 | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:123:8:123:22 | Bar | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:126:1:126:2 | xx | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:126:1:126:11 | ... = ... | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:126:6:126:7 | XX | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:126:6:126:11 | call to new | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:128:1:129:3 | class << ... | modules.rb:1:1:129:4 | modules.rb |
+| modules.rb:128:10:128:11 | xx | modules.rb:1:1:129:4 | modules.rb |
+| modules_rec.rb:1:1:2:3 | A | modules_rec.rb:1:1:11:26 | modules_rec.rb |
+| modules_rec.rb:1:7:1:7 | B | modules_rec.rb:1:1:11:26 | modules_rec.rb |
+| modules_rec.rb:4:1:5:3 | B | modules_rec.rb:1:1:11:26 | modules_rec.rb |
+| modules_rec.rb:4:7:4:7 | A | modules_rec.rb:1:1:11:26 | modules_rec.rb |
+| modules_rec.rb:7:1:9:3 | A | modules_rec.rb:1:1:11:26 | modules_rec.rb |
+| modules_rec.rb:7:11:7:11 | B | modules_rec.rb:1:1:11:26 | modules_rec.rb |
+| modules_rec.rb:8:3:8:11 | call to prepend | modules_rec.rb:7:1:9:3 | A |
+| modules_rec.rb:8:3:8:11 | self | modules_rec.rb:7:1:9:3 | A |
+| modules_rec.rb:8:11:8:11 | B | modules_rec.rb:7:1:9:3 | A |
+| modules_rec.rb:11:1:11:9 | call to prepend | modules_rec.rb:1:1:11:26 | modules_rec.rb |
+| modules_rec.rb:11:1:11:9 | self | modules_rec.rb:1:1:11:26 | modules_rec.rb |
+| modules_rec.rb:11:9:11:9 | A | modules_rec.rb:1:1:11:26 | modules_rec.rb |
+| private.rb:1:1:29:3 | E | private.rb:1:1:60:3 | private.rb |
+| private.rb:2:3:3:5 | call to private | private.rb:1:1:29:3 | E |
+| private.rb:2:3:3:5 | self | private.rb:1:1:29:3 | E |
+| private.rb:2:11:3:5 | private1 | private.rb:1:1:29:3 | E |
+| private.rb:5:3:6:5 | public | private.rb:1:1:29:3 | E |
+| private.rb:8:3:9:5 | private2 | private.rb:1:1:29:3 | E |
+| private.rb:10:3:10:19 | call to private | private.rb:1:1:29:3 | E |
+| private.rb:10:3:10:19 | self | private.rb:1:1:29:3 | E |
+| private.rb:10:11:10:19 | :private2 | private.rb:1:1:29:3 | E |
+| private.rb:10:11:10:19 | private2 | private.rb:1:1:29:3 | E |
+| private.rb:12:3:12:9 | call to private | private.rb:1:1:29:3 | E |
+| private.rb:12:3:12:9 | self | private.rb:1:1:29:3 | E |
+| private.rb:14:3:15:5 | private3 | private.rb:1:1:29:3 | E |
+| private.rb:17:3:18:5 | private4 | private.rb:1:1:29:3 | E |
+| private.rb:20:3:21:5 | public2 | private.rb:1:1:29:3 | E |
+| private.rb:20:7:20:10 | self | private.rb:1:1:29:3 | E |
+| private.rb:23:3:24:5 | call to private_class_method | private.rb:1:1:29:3 | E |
+| private.rb:23:3:24:5 | self | private.rb:1:1:29:3 | E |
+| private.rb:23:24:24:5 | private5 | private.rb:1:1:29:3 | E |
+| private.rb:23:28:23:31 | self | private.rb:1:1:29:3 | E |
+| private.rb:26:3:27:5 | private6 | private.rb:1:1:29:3 | E |
+| private.rb:26:7:26:10 | self | private.rb:1:1:29:3 | E |
+| private.rb:28:3:28:32 | call to private_class_method | private.rb:1:1:29:3 | E |
+| private.rb:28:3:28:32 | self | private.rb:1:1:29:3 | E |
+| private.rb:28:24:28:32 | :private6 | private.rb:1:1:29:3 | E |
+| private.rb:28:24:28:32 | private6 | private.rb:1:1:29:3 | E |
+| private.rb:31:1:32:3 | private_on_main | private.rb:1:1:60:3 | private.rb |
+| private.rb:34:1:34:1 | E | private.rb:1:1:60:3 | private.rb |
+| private.rb:34:1:34:5 | call to new | private.rb:1:1:60:3 | private.rb |
+| private.rb:34:1:34:14 | call to private1 | private.rb:1:1:60:3 | private.rb |
+| private.rb:35:1:35:1 | E | private.rb:1:1:60:3 | private.rb |
+| private.rb:35:1:35:5 | call to new | private.rb:1:1:60:3 | private.rb |
+| private.rb:35:1:35:14 | call to private2 | private.rb:1:1:60:3 | private.rb |
+| private.rb:36:1:36:1 | E | private.rb:1:1:60:3 | private.rb |
+| private.rb:36:1:36:5 | call to new | private.rb:1:1:60:3 | private.rb |
+| private.rb:36:1:36:14 | call to private3 | private.rb:1:1:60:3 | private.rb |
+| private.rb:37:1:37:1 | E | private.rb:1:1:60:3 | private.rb |
+| private.rb:37:1:37:5 | call to new | private.rb:1:1:60:3 | private.rb |
+| private.rb:37:1:37:14 | call to private4 | private.rb:1:1:60:3 | private.rb |
+| private.rb:38:1:38:1 | E | private.rb:1:1:60:3 | private.rb |
+| private.rb:38:1:38:5 | call to new | private.rb:1:1:60:3 | private.rb |
+| private.rb:38:1:38:12 | call to public | private.rb:1:1:60:3 | private.rb |
+| private.rb:40:1:40:15 | call to private_on_main | private.rb:1:1:60:3 | private.rb |
+| private.rb:40:1:40:15 | self | private.rb:1:1:60:3 | private.rb |
+| private.rb:42:1:60:3 | F | private.rb:1:1:60:3 | private.rb |
+| private.rb:43:3:44:5 | call to private | private.rb:42:1:60:3 | F |
+| private.rb:43:3:44:5 | self | private.rb:42:1:60:3 | F |
+| private.rb:43:11:44:5 | private1 | private.rb:42:1:60:3 | F |
+| private.rb:46:3:47:5 | public | private.rb:42:1:60:3 | F |
+| private.rb:49:3:50:5 | private2 | private.rb:42:1:60:3 | F |
+| private.rb:51:3:51:19 | call to private | private.rb:42:1:60:3 | F |
+| private.rb:51:3:51:19 | self | private.rb:42:1:60:3 | F |
+| private.rb:51:11:51:19 | :private2 | private.rb:42:1:60:3 | F |
+| private.rb:51:11:51:19 | private2 | private.rb:42:1:60:3 | F |
+| private.rb:53:3:53:9 | call to private | private.rb:42:1:60:3 | F |
+| private.rb:53:3:53:9 | self | private.rb:42:1:60:3 | F |
+| private.rb:55:3:56:5 | private3 | private.rb:42:1:60:3 | F |
+| private.rb:58:3:59:5 | private4 | private.rb:42:1:60:3 | F |
diff --git a/ruby/ql/test/library-tests/modules/modules.ql b/ruby/ql/test/library-tests/modules/modules.ql
index d5c8207dc2c..792ace8ecd8 100644
--- a/ruby/ql/test/library-tests/modules/modules.ql
+++ b/ruby/ql/test/library-tests/modules/modules.ql
@@ -18,3 +18,5 @@ query predicate resolveConstantReadAccess(ConstantReadAccess a, string s) {
 query predicate resolveConstantWriteAccess(ConstantWriteAccess c, string s) {
   s = Internal::resolveConstantWriteAccess(c)
 }
+
+query predicate enclosingModule(AstNode n, ModuleBase m) { m = n.getEnclosingModule() }
diff --git a/ruby/ql/test/library-tests/modules/modules.rb b/ruby/ql/test/library-tests/modules/modules.rb
index 764ba455ba0..4c30e3b4596 100644
--- a/ruby/ql/test/library-tests/modules/modules.rb
+++ b/ruby/ql/test/library-tests/modules/modules.rb
@@ -115,7 +115,15 @@ end
 module XX
       class YY < YY
       end
+
+      class << self
+      end
 end
 
 module Test::Foo1::Bar::Baz
 end
+
+xx = XX.new
+
+class << xx
+end
diff --git a/ruby/ql/test/library-tests/modules/modules_rec.rb b/ruby/ql/test/library-tests/modules/modules_rec.rb
index ba448e22072..81589e64471 100644
--- a/ruby/ql/test/library-tests/modules/modules_rec.rb
+++ b/ruby/ql/test/library-tests/modules/modules_rec.rb
@@ -8,4 +8,4 @@ class A < B
   prepend B
 end
 
-prepend A
+prepend A # NoMethodError
diff --git a/ruby/ql/test/library-tests/modules/superclasses.expected b/ruby/ql/test/library-tests/modules/superclasses.expected
index 92b80e01690..39ef76cb376 100644
--- a/ruby/ql/test/library-tests/modules/superclasses.expected
+++ b/ruby/ql/test/library-tests/modules/superclasses.expected
@@ -29,44 +29,65 @@
 #-----|  -> Object
 
 calls.rb:
-#   15| M
+#   21| M
 
-#   29| C
+#   43| C
 #-----|  -> Object
 
-#   51| D
+#   65| D
 #-----|  -> C
 
-#   77| Integer
+#   91| Integer
 #-----|  -> Numeric
 
-#   82| String
+#   96| String
 #-----|  -> Object
 
-#   86| Kernel
+#  100| Kernel
 
-#   90| Module
+#  105| Module
 #-----|  -> Object
 
-#   97| Object
+#  112| Object
 #-----|  -> BasicObject
 
-#  102| Hash
+#  117| Hash
 #-----|  -> Object
 
-#  106| Array
+#  122| Array
 #-----|  -> Object
 
-#  144| S
+#  162| S
 #-----|  -> Object
 
-#  150| A
+#  168| A
 #-----|  -> B
 #-----|  -> S
 
-#  155| B
+#  173| B
 #-----|  -> S
 
+#  187| Singletons
+#-----|  -> Object
+
+#  307| SelfNew
+#-----|  -> Object
+
+#  322| C1
+#-----|  -> Object
+
+#  328| C2
+#-----|  -> C1
+
+#  334| C3
+#-----|  -> C2
+
+#  374| SingletonOverride1
+#-----|  -> Object
+
+#  399| SingletonOverride2
+#-----|  -> SingletonOverride1
+
 hello.rb:
 #    1| EnglishWords
 
@@ -144,7 +165,7 @@ modules.rb:
 #  116| XX::YY
 #-----|  -> YY
 
-#  120| Test::Foo1::Bar::Baz
+#  123| Test::Foo1::Bar::Baz
 
 modules_rec.rb:
 #    1| B::A
diff --git a/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/OverlyLargeRangeQuery.expected b/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/OverlyLargeRangeQuery.expected
index d91aaa90ec1..6eefe94f32a 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/OverlyLargeRangeQuery.expected
+++ b/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/OverlyLargeRangeQuery.expected
@@ -8,3 +8,4 @@
 | suspicous_regexp_range.rb:23:20:23:22 | 7-F | Suspicious character range that is equivalent to [7-9:;<=>?@A-F]. |
 | suspicous_regexp_range.rb:25:24:25:26 | 0-9 | Suspicious character range that overlaps with \\d in the same character class. |
 | suspicous_regexp_range.rb:27:27:27:29 | .-? | Suspicious character range that overlaps with \\w in the same character class, and is equivalent to [.\\/0-9:;<=>?]. |
+| suspicous_regexp_range.rb:33:28:33:30 | %-. | Suspicious character range that is equivalent to [%&'()*+,\\-.]. |
diff --git a/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/suspicous_regexp_range.rb b/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/suspicous_regexp_range.rb
index 9d21c323fa6..ed6ffe21b14 100644
--- a/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/suspicous_regexp_range.rb
+++ b/ruby/ql/test/query-tests/security/cwe-020/SuspiciousRegexpRange/suspicous_regexp_range.rb
@@ -29,3 +29,5 @@ overlapsWithClass2 = /[\w,.-?:*+]/ # NOT OK
 escapes = /[\000-\037\047\134\177-\377]/n # OK - they are escapes
 
 nested = /[a-z&&[^a-c]]/ # OK
+
+overlapsWithNothing = /[\w_%-.]/;
\ No newline at end of file
diff --git a/ruby/ql/test/query-tests/security/cwe-022/PathInjection.expected b/ruby/ql/test/query-tests/security/cwe-022/PathInjection.expected
index 77dc81423b2..1c33f59f3c3 100644
--- a/ruby/ql/test/query-tests/security/cwe-022/PathInjection.expected
+++ b/ruby/ql/test/query-tests/security/cwe-022/PathInjection.expected
@@ -88,15 +88,15 @@ nodes
 | tainted_path.rb:60:26:60:29 | path | semmle.label | path |
 subpaths
 #select
-| ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params :  | ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | This path depends on $@. | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params | a user-provided value |
-| ArchiveApiPathTraversal.rb:68:20:68:23 | file | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params :  | ArchiveApiPathTraversal.rb:68:20:68:23 | file | This path depends on $@. | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params | a user-provided value |
-| ArchiveApiPathTraversal.rb:76:19:76:26 | filename | ArchiveApiPathTraversal.rb:15:9:15:14 | call to params :  | ArchiveApiPathTraversal.rb:76:19:76:26 | filename | This path depends on $@. | ArchiveApiPathTraversal.rb:15:9:15:14 | call to params | a user-provided value |
-| tainted_path.rb:5:26:5:29 | path | tainted_path.rb:4:12:4:17 | call to params :  | tainted_path.rb:5:26:5:29 | path | This path depends on $@. | tainted_path.rb:4:12:4:17 | call to params | a user-provided value |
-| tainted_path.rb:11:26:11:29 | path | tainted_path.rb:10:31:10:36 | call to params :  | tainted_path.rb:11:26:11:29 | path | This path depends on $@. | tainted_path.rb:10:31:10:36 | call to params | a user-provided value |
-| tainted_path.rb:17:26:17:29 | path | tainted_path.rb:16:28:16:33 | call to params :  | tainted_path.rb:17:26:17:29 | path | This path depends on $@. | tainted_path.rb:16:28:16:33 | call to params | a user-provided value |
-| tainted_path.rb:23:26:23:29 | path | tainted_path.rb:22:29:22:34 | call to params :  | tainted_path.rb:23:26:23:29 | path | This path depends on $@. | tainted_path.rb:22:29:22:34 | call to params | a user-provided value |
-| tainted_path.rb:29:26:29:29 | path | tainted_path.rb:28:22:28:27 | call to params :  | tainted_path.rb:29:26:29:29 | path | This path depends on $@. | tainted_path.rb:28:22:28:27 | call to params | a user-provided value |
-| tainted_path.rb:35:26:35:29 | path | tainted_path.rb:34:29:34:34 | call to params :  | tainted_path.rb:35:26:35:29 | path | This path depends on $@. | tainted_path.rb:34:29:34:34 | call to params | a user-provided value |
-| tainted_path.rb:41:26:41:29 | path | tainted_path.rb:40:26:40:31 | call to params :  | tainted_path.rb:41:26:41:29 | path | This path depends on $@. | tainted_path.rb:40:26:40:31 | call to params | a user-provided value |
-| tainted_path.rb:48:26:48:29 | path | tainted_path.rb:47:43:47:48 | call to params :  | tainted_path.rb:48:26:48:29 | path | This path depends on $@. | tainted_path.rb:47:43:47:48 | call to params | a user-provided value |
-| tainted_path.rb:60:26:60:29 | path | tainted_path.rb:59:40:59:45 | call to params :  | tainted_path.rb:60:26:60:29 | path | This path depends on $@. | tainted_path.rb:59:40:59:45 | call to params | a user-provided value |
+| ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params :  | ArchiveApiPathTraversal.rb:59:21:59:36 | destination_file | $@ flows to here and is used in a path. | ArchiveApiPathTraversal.rb:5:26:5:31 | call to params | User-provided value |
+| ArchiveApiPathTraversal.rb:68:20:68:23 | file | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params :  | ArchiveApiPathTraversal.rb:68:20:68:23 | file | $@ flows to here and is used in a path. | ArchiveApiPathTraversal.rb:10:11:10:16 | call to params | User-provided value |
+| ArchiveApiPathTraversal.rb:76:19:76:26 | filename | ArchiveApiPathTraversal.rb:15:9:15:14 | call to params :  | ArchiveApiPathTraversal.rb:76:19:76:26 | filename | $@ flows to here and is used in a path. | ArchiveApiPathTraversal.rb:15:9:15:14 | call to params | User-provided value |
+| tainted_path.rb:5:26:5:29 | path | tainted_path.rb:4:12:4:17 | call to params :  | tainted_path.rb:5:26:5:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:4:12:4:17 | call to params | User-provided value |
+| tainted_path.rb:11:26:11:29 | path | tainted_path.rb:10:31:10:36 | call to params :  | tainted_path.rb:11:26:11:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:10:31:10:36 | call to params | User-provided value |
+| tainted_path.rb:17:26:17:29 | path | tainted_path.rb:16:28:16:33 | call to params :  | tainted_path.rb:17:26:17:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:16:28:16:33 | call to params | User-provided value |
+| tainted_path.rb:23:26:23:29 | path | tainted_path.rb:22:29:22:34 | call to params :  | tainted_path.rb:23:26:23:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:22:29:22:34 | call to params | User-provided value |
+| tainted_path.rb:29:26:29:29 | path | tainted_path.rb:28:22:28:27 | call to params :  | tainted_path.rb:29:26:29:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:28:22:28:27 | call to params | User-provided value |
+| tainted_path.rb:35:26:35:29 | path | tainted_path.rb:34:29:34:34 | call to params :  | tainted_path.rb:35:26:35:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:34:29:34:34 | call to params | User-provided value |
+| tainted_path.rb:41:26:41:29 | path | tainted_path.rb:40:26:40:31 | call to params :  | tainted_path.rb:41:26:41:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:40:26:40:31 | call to params | User-provided value |
+| tainted_path.rb:48:26:48:29 | path | tainted_path.rb:47:43:47:48 | call to params :  | tainted_path.rb:48:26:48:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:47:43:47:48 | call to params | User-provided value |
+| tainted_path.rb:60:26:60:29 | path | tainted_path.rb:59:40:59:45 | call to params :  | tainted_path.rb:60:26:60:29 | path | $@ flows to here and is used in a path. | tainted_path.rb:59:40:59:45 | call to params | User-provided value |
diff --git a/ruby/ql/test/query-tests/security/cwe-079/ReflectedXSS.expected b/ruby/ql/test/query-tests/security/cwe-079/ReflectedXSS.expected
index 8f2503c8884..13b94defb24 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/ReflectedXSS.expected
+++ b/ruby/ql/test/query-tests/security/cwe-079/ReflectedXSS.expected
@@ -52,15 +52,15 @@ nodes
 | app/views/foo/bars/show.html.erb:57:13:57:28 | ...[...] | semmle.label | ...[...] |
 subpaths
 #select
-| app/views/foo/bars/_widget.html.erb:5:9:5:20 | call to display_text | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/_widget.html.erb:5:9:5:20 | call to display_text | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | a user-provided value |
-| app/views/foo/bars/_widget.html.erb:8:9:8:36 | ...[...] | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/_widget.html.erb:8:9:8:36 | ...[...] | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | a user-provided value |
-| app/views/foo/bars/show.html.erb:2:18:2:30 | @user_website | app/controllers/foo/bars_controller.rb:17:21:17:26 | call to params :  | app/views/foo/bars/show.html.erb:2:18:2:30 | @user_website | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:17:21:17:26 | call to params | a user-provided value |
-| app/views/foo/bars/show.html.erb:5:9:5:20 | call to display_text | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/show.html.erb:5:9:5:20 | call to display_text | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | a user-provided value |
-| app/views/foo/bars/show.html.erb:8:9:8:36 | ...[...] | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/show.html.erb:8:9:8:36 | ...[...] | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | a user-provided value |
-| app/views/foo/bars/show.html.erb:12:9:12:26 | ...[...] | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/show.html.erb:12:9:12:26 | ...[...] | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | a user-provided value |
-| app/views/foo/bars/show.html.erb:36:3:36:14 | call to display_text | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/show.html.erb:36:3:36:14 | call to display_text | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | a user-provided value |
-| app/views/foo/bars/show.html.erb:41:3:41:16 | @instance_text | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/show.html.erb:41:3:41:16 | @instance_text | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | a user-provided value |
-| app/views/foo/bars/show.html.erb:47:5:47:13 | call to user_name | app/controllers/foo/bars_controller.rb:9:12:9:17 | call to params :  | app/views/foo/bars/show.html.erb:47:5:47:13 | call to user_name | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:9:12:9:17 | call to params | a user-provided value |
-| app/views/foo/bars/show.html.erb:51:5:51:18 | call to user_name_memo | app/controllers/foo/bars_controller.rb:13:20:13:25 | call to params :  | app/views/foo/bars/show.html.erb:51:5:51:18 | call to user_name_memo | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:13:20:13:25 | call to params | a user-provided value |
-| app/views/foo/bars/show.html.erb:54:29:54:44 | ...[...] | app/views/foo/bars/show.html.erb:54:29:54:34 | call to params :  | app/views/foo/bars/show.html.erb:54:29:54:44 | ...[...] | Cross-site scripting vulnerability due to $@. | app/views/foo/bars/show.html.erb:54:29:54:34 | call to params | a user-provided value |
-| app/views/foo/bars/show.html.erb:57:13:57:28 | ...[...] | app/views/foo/bars/show.html.erb:57:13:57:18 | call to params :  | app/views/foo/bars/show.html.erb:57:13:57:28 | ...[...] | Cross-site scripting vulnerability due to $@. | app/views/foo/bars/show.html.erb:57:13:57:18 | call to params | a user-provided value |
+| app/views/foo/bars/_widget.html.erb:5:9:5:20 | call to display_text | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/_widget.html.erb:5:9:5:20 | call to display_text | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | user-provided value |
+| app/views/foo/bars/_widget.html.erb:8:9:8:36 | ...[...] | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/_widget.html.erb:8:9:8:36 | ...[...] | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | user-provided value |
+| app/views/foo/bars/show.html.erb:2:18:2:30 | @user_website | app/controllers/foo/bars_controller.rb:17:21:17:26 | call to params :  | app/views/foo/bars/show.html.erb:2:18:2:30 | @user_website | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:17:21:17:26 | call to params | user-provided value |
+| app/views/foo/bars/show.html.erb:5:9:5:20 | call to display_text | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/show.html.erb:5:9:5:20 | call to display_text | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | user-provided value |
+| app/views/foo/bars/show.html.erb:8:9:8:36 | ...[...] | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/show.html.erb:8:9:8:36 | ...[...] | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | user-provided value |
+| app/views/foo/bars/show.html.erb:12:9:12:26 | ...[...] | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/show.html.erb:12:9:12:26 | ...[...] | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | user-provided value |
+| app/views/foo/bars/show.html.erb:36:3:36:14 | call to display_text | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/show.html.erb:36:3:36:14 | call to display_text | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | user-provided value |
+| app/views/foo/bars/show.html.erb:41:3:41:16 | @instance_text | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params :  | app/views/foo/bars/show.html.erb:41:3:41:16 | @instance_text | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:18:10:18:15 | call to params | user-provided value |
+| app/views/foo/bars/show.html.erb:47:5:47:13 | call to user_name | app/controllers/foo/bars_controller.rb:9:12:9:17 | call to params :  | app/views/foo/bars/show.html.erb:47:5:47:13 | call to user_name | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:9:12:9:17 | call to params | user-provided value |
+| app/views/foo/bars/show.html.erb:51:5:51:18 | call to user_name_memo | app/controllers/foo/bars_controller.rb:13:20:13:25 | call to params :  | app/views/foo/bars/show.html.erb:51:5:51:18 | call to user_name_memo | Cross-site scripting vulnerability due to $@. | app/controllers/foo/bars_controller.rb:13:20:13:25 | call to params | user-provided value |
+| app/views/foo/bars/show.html.erb:54:29:54:44 | ...[...] | app/views/foo/bars/show.html.erb:54:29:54:34 | call to params :  | app/views/foo/bars/show.html.erb:54:29:54:44 | ...[...] | Cross-site scripting vulnerability due to $@. | app/views/foo/bars/show.html.erb:54:29:54:34 | call to params | user-provided value |
+| app/views/foo/bars/show.html.erb:57:13:57:28 | ...[...] | app/views/foo/bars/show.html.erb:57:13:57:18 | call to params :  | app/views/foo/bars/show.html.erb:57:13:57:28 | ...[...] | Cross-site scripting vulnerability due to $@. | app/views/foo/bars/show.html.erb:57:13:57:18 | call to params | user-provided value |
diff --git a/ruby/ql/test/query-tests/security/cwe-079/StoredXSS.expected b/ruby/ql/test/query-tests/security/cwe-079/StoredXSS.expected
index 5d578d84776..fb229fa4bae 100644
--- a/ruby/ql/test/query-tests/security/cwe-079/StoredXSS.expected
+++ b/ruby/ql/test/query-tests/security/cwe-079/StoredXSS.expected
@@ -32,15 +32,15 @@ nodes
 | app/views/foo/stores/show.html.erb:84:5:84:24 | @other_user_raw_name | semmle.label | @other_user_raw_name |
 subpaths
 #select
-| app/views/foo/bars/_widget.html.erb:5:9:5:20 | call to display_text | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/bars/_widget.html.erb:5:9:5:20 | call to display_text | Cross-site scripting vulnerability due to $@ | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
-| app/views/foo/bars/_widget.html.erb:8:9:8:36 | ...[...] | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/bars/_widget.html.erb:8:9:8:36 | ...[...] | Cross-site scripting vulnerability due to $@ | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
-| app/views/foo/stores/show.html.erb:2:9:2:20 | call to display_text | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/stores/show.html.erb:2:9:2:20 | call to display_text | Cross-site scripting vulnerability due to $@ | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
-| app/views/foo/stores/show.html.erb:5:9:5:36 | ...[...] | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/stores/show.html.erb:5:9:5:36 | ...[...] | Cross-site scripting vulnerability due to $@ | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
-| app/views/foo/stores/show.html.erb:9:9:9:26 | ...[...] | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/stores/show.html.erb:9:9:9:26 | ...[...] | Cross-site scripting vulnerability due to $@ | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
-| app/views/foo/stores/show.html.erb:33:3:33:14 | call to display_text | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/stores/show.html.erb:33:3:33:14 | call to display_text | Cross-site scripting vulnerability due to $@ | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
-| app/views/foo/stores/show.html.erb:38:3:38:16 | @instance_text | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/stores/show.html.erb:38:3:38:16 | @instance_text | Cross-site scripting vulnerability due to $@ | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
-| app/views/foo/stores/show.html.erb:47:5:47:16 | call to handle | app/views/foo/stores/show.html.erb:47:5:47:16 | call to handle | app/views/foo/stores/show.html.erb:47:5:47:16 | call to handle | Cross-site scripting vulnerability due to $@ | app/views/foo/stores/show.html.erb:47:5:47:16 | call to handle | stored value |
-| app/views/foo/stores/show.html.erb:50:5:50:18 | call to raw_name | app/views/foo/stores/show.html.erb:50:5:50:18 | call to raw_name | app/views/foo/stores/show.html.erb:50:5:50:18 | call to raw_name | Cross-site scripting vulnerability due to $@ | app/views/foo/stores/show.html.erb:50:5:50:18 | call to raw_name | stored value |
-| app/views/foo/stores/show.html.erb:64:3:64:18 | call to handle | app/views/foo/stores/show.html.erb:64:3:64:18 | call to handle | app/views/foo/stores/show.html.erb:64:3:64:18 | call to handle | Cross-site scripting vulnerability due to $@ | app/views/foo/stores/show.html.erb:64:3:64:18 | call to handle | stored value |
-| app/views/foo/stores/show.html.erb:70:3:70:20 | call to raw_name | app/views/foo/stores/show.html.erb:70:3:70:20 | call to raw_name | app/views/foo/stores/show.html.erb:70:3:70:20 | call to raw_name | Cross-site scripting vulnerability due to $@ | app/views/foo/stores/show.html.erb:70:3:70:20 | call to raw_name | stored value |
-| app/views/foo/stores/show.html.erb:84:5:84:24 | @other_user_raw_name | app/controllers/foo/stores_controller.rb:12:28:12:48 | call to raw_name :  | app/views/foo/stores/show.html.erb:84:5:84:24 | @other_user_raw_name | Cross-site scripting vulnerability due to $@ | app/controllers/foo/stores_controller.rb:12:28:12:48 | call to raw_name | stored value |
+| app/views/foo/bars/_widget.html.erb:5:9:5:20 | call to display_text | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/bars/_widget.html.erb:5:9:5:20 | call to display_text | Stored cross-site scripting vulnerability due to $@. | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
+| app/views/foo/bars/_widget.html.erb:8:9:8:36 | ...[...] | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/bars/_widget.html.erb:8:9:8:36 | ...[...] | Stored cross-site scripting vulnerability due to $@. | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
+| app/views/foo/stores/show.html.erb:2:9:2:20 | call to display_text | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/stores/show.html.erb:2:9:2:20 | call to display_text | Stored cross-site scripting vulnerability due to $@. | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
+| app/views/foo/stores/show.html.erb:5:9:5:36 | ...[...] | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/stores/show.html.erb:5:9:5:36 | ...[...] | Stored cross-site scripting vulnerability due to $@. | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
+| app/views/foo/stores/show.html.erb:9:9:9:26 | ...[...] | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/stores/show.html.erb:9:9:9:26 | ...[...] | Stored cross-site scripting vulnerability due to $@. | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
+| app/views/foo/stores/show.html.erb:33:3:33:14 | call to display_text | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/stores/show.html.erb:33:3:33:14 | call to display_text | Stored cross-site scripting vulnerability due to $@. | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
+| app/views/foo/stores/show.html.erb:38:3:38:16 | @instance_text | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read :  | app/views/foo/stores/show.html.erb:38:3:38:16 | @instance_text | Stored cross-site scripting vulnerability due to $@. | app/controllers/foo/stores_controller.rb:8:10:8:29 | call to read | stored value |
+| app/views/foo/stores/show.html.erb:47:5:47:16 | call to handle | app/views/foo/stores/show.html.erb:47:5:47:16 | call to handle | app/views/foo/stores/show.html.erb:47:5:47:16 | call to handle | Stored cross-site scripting vulnerability due to $@. | app/views/foo/stores/show.html.erb:47:5:47:16 | call to handle | stored value |
+| app/views/foo/stores/show.html.erb:50:5:50:18 | call to raw_name | app/views/foo/stores/show.html.erb:50:5:50:18 | call to raw_name | app/views/foo/stores/show.html.erb:50:5:50:18 | call to raw_name | Stored cross-site scripting vulnerability due to $@. | app/views/foo/stores/show.html.erb:50:5:50:18 | call to raw_name | stored value |
+| app/views/foo/stores/show.html.erb:64:3:64:18 | call to handle | app/views/foo/stores/show.html.erb:64:3:64:18 | call to handle | app/views/foo/stores/show.html.erb:64:3:64:18 | call to handle | Stored cross-site scripting vulnerability due to $@. | app/views/foo/stores/show.html.erb:64:3:64:18 | call to handle | stored value |
+| app/views/foo/stores/show.html.erb:70:3:70:20 | call to raw_name | app/views/foo/stores/show.html.erb:70:3:70:20 | call to raw_name | app/views/foo/stores/show.html.erb:70:3:70:20 | call to raw_name | Stored cross-site scripting vulnerability due to $@. | app/views/foo/stores/show.html.erb:70:3:70:20 | call to raw_name | stored value |
+| app/views/foo/stores/show.html.erb:84:5:84:24 | @other_user_raw_name | app/controllers/foo/stores_controller.rb:12:28:12:48 | call to raw_name :  | app/views/foo/stores/show.html.erb:84:5:84:24 | @other_user_raw_name | Stored cross-site scripting vulnerability due to $@. | app/controllers/foo/stores_controller.rb:12:28:12:48 | call to raw_name | stored value |
diff --git a/ruby/ql/test/query-tests/security/cwe-094/CodeInjection.expected b/ruby/ql/test/query-tests/security/cwe-094/CodeInjection.expected
index 5e32af975dc..d48f34aaa22 100644
--- a/ruby/ql/test/query-tests/security/cwe-094/CodeInjection.expected
+++ b/ruby/ql/test/query-tests/security/cwe-094/CodeInjection.expected
@@ -20,10 +20,10 @@ nodes
 | CodeInjection.rb:36:24:36:27 | code :  | semmle.label | code :  |
 subpaths
 #select
-| CodeInjection.rb:6:10:6:13 | code | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:6:10:6:13 | code | This code execution depends on $@. | CodeInjection.rb:3:12:3:17 | call to params | a user-provided value |
-| CodeInjection.rb:9:10:9:15 | call to params | CodeInjection.rb:9:10:9:15 | call to params | CodeInjection.rb:9:10:9:15 | call to params | This code execution depends on $@. | CodeInjection.rb:9:10:9:15 | call to params | a user-provided value |
-| CodeInjection.rb:18:20:18:23 | code | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:18:20:18:23 | code | This code execution depends on $@. | CodeInjection.rb:3:12:3:17 | call to params | a user-provided value |
-| CodeInjection.rb:21:21:21:24 | code | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:21:21:21:24 | code | This code execution depends on $@. | CodeInjection.rb:3:12:3:17 | call to params | a user-provided value |
-| CodeInjection.rb:27:15:27:18 | code | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:27:15:27:18 | code | This code execution depends on $@. | CodeInjection.rb:3:12:3:17 | call to params | a user-provided value |
-| CodeInjection.rb:30:19:30:22 | code | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:30:19:30:22 | code | This code execution depends on $@. | CodeInjection.rb:3:12:3:17 | call to params | a user-provided value |
-| CodeInjection.rb:36:10:36:28 | call to escape | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:36:10:36:28 | call to escape | This code execution depends on $@. | CodeInjection.rb:3:12:3:17 | call to params | a user-provided value |
+| CodeInjection.rb:6:10:6:13 | code | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:6:10:6:13 | code | $@ flows to here and is interpreted as code. | CodeInjection.rb:3:12:3:17 | call to params | User-provided value |
+| CodeInjection.rb:9:10:9:15 | call to params | CodeInjection.rb:9:10:9:15 | call to params | CodeInjection.rb:9:10:9:15 | call to params | $@ flows to here and is interpreted as code. | CodeInjection.rb:9:10:9:15 | call to params | User-provided value |
+| CodeInjection.rb:18:20:18:23 | code | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:18:20:18:23 | code | $@ flows to here and is interpreted as code. | CodeInjection.rb:3:12:3:17 | call to params | User-provided value |
+| CodeInjection.rb:21:21:21:24 | code | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:21:21:21:24 | code | $@ flows to here and is interpreted as code. | CodeInjection.rb:3:12:3:17 | call to params | User-provided value |
+| CodeInjection.rb:27:15:27:18 | code | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:27:15:27:18 | code | $@ flows to here and is interpreted as code. | CodeInjection.rb:3:12:3:17 | call to params | User-provided value |
+| CodeInjection.rb:30:19:30:22 | code | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:30:19:30:22 | code | $@ flows to here and is interpreted as code. | CodeInjection.rb:3:12:3:17 | call to params | User-provided value |
+| CodeInjection.rb:36:10:36:28 | call to escape | CodeInjection.rb:3:12:3:17 | call to params :  | CodeInjection.rb:36:10:36:28 | call to escape | $@ flows to here and is interpreted as code. | CodeInjection.rb:3:12:3:17 | call to params | User-provided value |
diff --git a/ruby/ql/test/query-tests/security/cwe-295/Faraday.rb b/ruby/ql/test/query-tests/security/cwe-295/Faraday.rb
index fb66122ed6a..6c12db2c9e6 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/Faraday.rb
+++ b/ruby/ql/test/query-tests/security/cwe-295/Faraday.rb
@@ -26,3 +26,22 @@ response = connection.get("/")
 # GOOD
 connection = Faraday.new("http://example.com", ssl: { verify_mode: OpenSSL::SSL::VERIFY_PEER })
 response = connection.get("/")
+
+# -- example of passing verify as argument --
+
+def verify_as_arg(host, path, arg)
+    # BAD, due to the call below
+    connection = Faraday.new(host, ssl: { verify: arg })
+    response = connection.get(path)
+end
+
+verify_as_arg("http://example.com", "/", false)
+
+
+def verify_mode_as_arg(host, path, arg)
+    # BAD, due to the call below
+    connection = Faraday.new(host, ssl: { verify_mode: arg })
+    response = connection.get(path)
+end
+
+verify_mode_as_arg("http://example.com", "/", OpenSSL::SSL::VERIFY_NONE)
diff --git a/ruby/ql/test/query-tests/security/cwe-295/RequestWithoutValidation.expected b/ruby/ql/test/query-tests/security/cwe-295/RequestWithoutValidation.expected
index 9d9dc003a87..8a961d47eaa 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/RequestWithoutValidation.expected
+++ b/ruby/ql/test/query-tests/security/cwe-295/RequestWithoutValidation.expected
@@ -1,25 +1,28 @@
-| Excon.rb:6:3:6:34 | call to get | This request may run with $@. | Excon.rb:5:3:5:34 | call to []= | certificate validation disabled |
-| Excon.rb:12:3:12:34 | call to get | This request may run with $@. | Excon.rb:11:3:11:23 | call to ssl_verify_peer= | certificate validation disabled |
-| Excon.rb:18:3:18:34 | call to get | This request may run with $@. | Excon.rb:17:3:17:34 | call to []= | certificate validation disabled |
-| Excon.rb:24:3:24:10 | call to get | This request may run with $@. | Excon.rb:23:55:23:76 | Pair | certificate validation disabled |
-| Excon.rb:30:3:30:62 | call to get | This request may run with $@. | Excon.rb:30:36:30:57 | Pair | certificate validation disabled |
-| Faraday.rb:5:12:5:30 | call to get | This request may run with $@. | Faraday.rb:4:48:4:69 | Pair | certificate validation disabled |
-| Faraday.rb:9:12:9:30 | call to get | This request may run with $@. | Faraday.rb:8:48:8:94 | Pair | certificate validation disabled |
-| HttpClient.rb:6:1:6:33 | call to get | This request may run with $@. | HttpClient.rb:5:1:5:29 | call to verify_mode= | certificate validation disabled |
-| Httparty.rb:4:1:4:50 | call to get | This request may run with $@. | Httparty.rb:4:37:4:49 | Pair | certificate validation disabled |
-| Httparty.rb:7:1:7:55 | call to get | This request may run with $@. | Httparty.rb:7:37:7:54 | Pair | certificate validation disabled |
-| Httparty.rb:10:1:10:59 | call to get | This request may run with $@. | Httparty.rb:10:39:10:56 | Pair | certificate validation disabled |
-| Httparty.rb:13:1:13:70 | call to post | This request may run with $@. | Httparty.rb:13:57:13:69 | Pair | certificate validation disabled |
-| Httparty.rb:16:1:16:74 | call to post | This request may run with $@. | Httparty.rb:16:59:16:71 | Pair | certificate validation disabled |
-| NetHttp.rb:9:12:9:31 | call to request | This request may run with $@. | NetHttp.rb:7:20:7:44 | ... = ... | certificate validation disabled |
-| OpenURI.rb:4:1:4:78 | call to open | This request may run with $@. | OpenURI.rb:4:36:4:77 | Pair | certificate validation disabled |
-| OpenURI.rb:7:1:7:82 | call to open | This request may run with $@. | OpenURI.rb:7:38:7:79 | Pair | certificate validation disabled |
-| OpenURI.rb:11:1:11:43 | call to open | This request may run with $@. | OpenURI.rb:10:13:10:54 | Pair | certificate validation disabled |
-| OpenURI.rb:14:1:14:81 | call to open | This request may run with $@. | OpenURI.rb:14:39:14:80 | Pair | certificate validation disabled |
-| OpenURI.rb:17:1:17:85 | call to open | This request may run with $@. | OpenURI.rb:17:41:17:82 | Pair | certificate validation disabled |
-| OpenURI.rb:21:1:21:46 | call to open | This request may run with $@. | OpenURI.rb:20:13:20:54 | Pair | certificate validation disabled |
-| RestClient.rb:5:12:5:23 | call to get | This request may run with $@. | RestClient.rb:4:60:4:96 | Pair | certificate validation disabled |
-| RestClient.rb:9:12:9:23 | call to get | This request may run with $@. | RestClient.rb:8:62:8:98 | Pair | certificate validation disabled |
-| RestClient.rb:14:12:14:23 | call to get | This request may run with $@. | RestClient.rb:12:13:12:49 | Pair | certificate validation disabled |
-| Typhoeus.rb:4:1:4:62 | call to get | This request may run with $@. | Typhoeus.rb:4:41:4:61 | Pair | certificate validation disabled |
-| Typhoeus.rb:8:1:8:54 | call to post | This request may run with $@. | Typhoeus.rb:7:37:7:57 | Pair | certificate validation disabled |
+| Excon.rb:6:3:6:34 | call to get | This request may run without certificate validation because it is $@. | Excon.rb:5:38:5:42 | ... = ... | disabled here | Excon.rb:5:38:5:42 | false | here |
+| Excon.rb:12:3:12:34 | call to get | This request may run without certificate validation because it is $@. | Excon.rb:11:27:11:31 | ... = ... | disabled here | Excon.rb:11:27:11:31 | false | here |
+| Excon.rb:18:3:18:34 | call to get | This request may run without certificate validation because it is $@ by the value from $@. | Excon.rb:17:38:17:60 | ... = ... | disabled here | Excon.rb:17:55:17:59 | false | here |
+| Excon.rb:24:3:24:10 | call to get | This request may run without certificate validation because it is $@. | Excon.rb:23:72:23:76 | false | disabled here | Excon.rb:23:72:23:76 | false | here |
+| Excon.rb:30:3:30:62 | call to get | This request may run without certificate validation because it is $@. | Excon.rb:30:53:30:57 | false | disabled here | Excon.rb:30:53:30:57 | false | here |
+| Faraday.rb:5:12:5:30 | call to get | This request may run without certificate validation because it is $@. | Faraday.rb:4:63:4:67 | false | disabled here | Faraday.rb:4:63:4:67 | false | here |
+| Faraday.rb:9:12:9:30 | call to get | This request may run without certificate validation because it is $@. | Faraday.rb:8:68:8:92 | VERIFY_NONE | disabled here | Faraday.rb:8:68:8:92 | VERIFY_NONE | here |
+| Faraday.rb:35:16:35:35 | call to get | This request may run without certificate validation because it is $@ by the value from $@. | Faraday.rb:34:51:34:53 | arg | disabled here | Faraday.rb:38:42:38:46 | false | here |
+| Faraday.rb:44:16:44:35 | call to get | This request may run without certificate validation because it is $@ by the value from $@. | Faraday.rb:43:56:43:58 | arg | disabled here | Faraday.rb:47:47:47:71 | VERIFY_NONE | here |
+| HttpClient.rb:6:1:6:33 | call to get | This request may run without certificate validation because it is $@. | HttpClient.rb:5:33:5:57 | ... = ... | disabled here | HttpClient.rb:5:33:5:57 | VERIFY_NONE | here |
+| Httparty.rb:4:1:4:50 | call to get | This request may run without certificate validation because it is $@. | Httparty.rb:4:45:4:49 | false | disabled here | Httparty.rb:4:45:4:49 | false | here |
+| Httparty.rb:7:1:7:55 | call to get | This request may run without certificate validation because it is $@. | Httparty.rb:7:50:7:54 | false | disabled here | Httparty.rb:7:50:7:54 | false | here |
+| Httparty.rb:10:1:10:59 | call to get | This request may run without certificate validation because it is $@. | Httparty.rb:10:52:10:56 | false | disabled here | Httparty.rb:10:52:10:56 | false | here |
+| Httparty.rb:13:1:13:70 | call to post | This request may run without certificate validation because it is $@. | Httparty.rb:13:65:13:69 | false | disabled here | Httparty.rb:13:65:13:69 | false | here |
+| Httparty.rb:16:1:16:74 | call to post | This request may run without certificate validation because it is $@. | Httparty.rb:16:67:16:71 | false | disabled here | Httparty.rb:16:67:16:71 | false | here |
+| NetHttp.rb:9:12:9:31 | call to request | This request may run without certificate validation because it is $@. | NetHttp.rb:7:20:7:44 | ... = ... | disabled here | NetHttp.rb:7:20:7:44 | VERIFY_NONE | here |
+| OpenURI.rb:4:1:4:78 | call to open | This request may run without certificate validation because it is $@. | OpenURI.rb:4:53:4:77 | VERIFY_NONE | disabled here | OpenURI.rb:4:53:4:77 | VERIFY_NONE | here |
+| OpenURI.rb:7:1:7:82 | call to open | This request may run without certificate validation because it is $@. | OpenURI.rb:7:55:7:79 | VERIFY_NONE | disabled here | OpenURI.rb:7:55:7:79 | VERIFY_NONE | here |
+| OpenURI.rb:11:1:11:43 | call to open | This request may run without certificate validation because it is $@. | OpenURI.rb:10:30:10:54 | VERIFY_NONE | disabled here | OpenURI.rb:10:30:10:54 | VERIFY_NONE | here |
+| OpenURI.rb:14:1:14:81 | call to open | This request may run without certificate validation because it is $@. | OpenURI.rb:14:56:14:80 | VERIFY_NONE | disabled here | OpenURI.rb:14:56:14:80 | VERIFY_NONE | here |
+| OpenURI.rb:17:1:17:85 | call to open | This request may run without certificate validation because it is $@. | OpenURI.rb:17:58:17:82 | VERIFY_NONE | disabled here | OpenURI.rb:17:58:17:82 | VERIFY_NONE | here |
+| OpenURI.rb:21:1:21:46 | call to open | This request may run without certificate validation because it is $@. | OpenURI.rb:20:30:20:54 | VERIFY_NONE | disabled here | OpenURI.rb:20:30:20:54 | VERIFY_NONE | here |
+| RestClient.rb:5:12:5:23 | call to get | This request may run without certificate validation because it is $@. | RestClient.rb:4:72:4:96 | VERIFY_NONE | disabled here | RestClient.rb:4:72:4:96 | VERIFY_NONE | here |
+| RestClient.rb:9:12:9:23 | call to get | This request may run without certificate validation because it is $@. | RestClient.rb:8:74:8:98 | VERIFY_NONE | disabled here | RestClient.rb:8:74:8:98 | VERIFY_NONE | here |
+| RestClient.rb:14:12:14:23 | call to get | This request may run without certificate validation because it is $@. | RestClient.rb:12:25:12:49 | VERIFY_NONE | disabled here | RestClient.rb:12:25:12:49 | VERIFY_NONE | here |
+| RestClient.rb:19:12:19:23 | call to get | This request may run without certificate validation because it is $@ by the value from $@. | RestClient.rb:18:72:18:76 | value | disabled here | RestClient.rb:17:9:17:33 | VERIFY_NONE | here |
+| Typhoeus.rb:4:1:4:62 | call to get | This request may run without certificate validation because it is $@. | Typhoeus.rb:4:57:4:61 | false | disabled here | Typhoeus.rb:4:57:4:61 | false | here |
+| Typhoeus.rb:8:1:8:54 | call to post | This request may run without certificate validation because it is $@. | Typhoeus.rb:7:53:7:57 | false | disabled here | Typhoeus.rb:7:53:7:57 | false | here |
diff --git a/ruby/ql/test/query-tests/security/cwe-295/RestClient.rb b/ruby/ql/test/query-tests/security/cwe-295/RestClient.rb
index 4615c0acb80..a180ac0d74c 100644
--- a/ruby/ql/test/query-tests/security/cwe-295/RestClient.rb
+++ b/ruby/ql/test/query-tests/security/cwe-295/RestClient.rb
@@ -13,6 +13,11 @@ options = { verify_ssl: OpenSSL::SSL::VERIFY_NONE }
 resource = RestClient::Resource.new("https://example.com", options)
 response = resource.get
 
+# BAD
+value = OpenSSL::SSL::VERIFY_NONE
+resource = RestClient::Resource.new("https://example.com", verify_ssl: value)
+response = resource.get
+
 # GOOD
 RestClient.get("https://example.com")
 
@@ -23,11 +28,11 @@ response = resource.get
 # GOOD
 resource = RestClient::Resource.new("https://example.com", verify_ssl: OpenSSL::SSL::VERIFY_PEER)
 response = resource.get
-# BAD
+# GOOD
 resource = RestClient::Resource.new("https://example.com", { verify_ssl: OpenSSL::SSL::VERIFY_PEER })
 response = resource.get
 
 # GOOD
 options = { verify_ssl: OpenSSL::SSL::VERIFY_PEER }
 resource = RestClient::Resource.new("https://example.com", options)
-response = resource.get
\ No newline at end of file
+response = resource.get
diff --git a/ruby/ql/test/query-tests/security/cwe-506/HardcodedDataInterpretedAsCode.expected b/ruby/ql/test/query-tests/security/cwe-506/HardcodedDataInterpretedAsCode.expected
new file mode 100644
index 00000000000..0d74b778a18
--- /dev/null
+++ b/ruby/ql/test/query-tests/security/cwe-506/HardcodedDataInterpretedAsCode.expected
@@ -0,0 +1,29 @@
+edges
+| tst.rb:1:7:1:7 | r :  | tst.rb:2:4:2:4 | r :  |
+| tst.rb:2:4:2:4 | r :  | tst.rb:2:3:2:15 | call to pack :  |
+| tst.rb:5:27:5:72 | "707574732822636f646520696e6a6..." :  | tst.rb:7:8:7:30 | totally_harmless_string :  |
+| tst.rb:7:8:7:30 | totally_harmless_string :  | tst.rb:1:7:1:7 | r :  |
+| tst.rb:7:8:7:30 | totally_harmless_string :  | tst.rb:7:6:7:31 | call to e |
+| tst.rb:10:11:10:24 | "666f6f626172" :  | tst.rb:1:7:1:7 | r :  |
+| tst.rb:10:11:10:24 | "666f6f626172" :  | tst.rb:10:9:10:25 | call to e |
+| tst.rb:16:31:16:84 | "\\x70\\x75\\x74\\x73\\x28\\x27\\x68\\..." :  | tst.rb:17:6:17:32 | another_questionable_string :  |
+| tst.rb:17:6:17:32 | another_questionable_string :  | tst.rb:17:6:17:38 | call to strip |
+nodes
+| tst.rb:1:7:1:7 | r :  | semmle.label | r :  |
+| tst.rb:2:3:2:15 | call to pack :  | semmle.label | call to pack :  |
+| tst.rb:2:4:2:4 | r :  | semmle.label | r :  |
+| tst.rb:5:27:5:72 | "707574732822636f646520696e6a6..." :  | semmle.label | "707574732822636f646520696e6a6..." :  |
+| tst.rb:7:6:7:31 | call to e | semmle.label | call to e |
+| tst.rb:7:8:7:30 | totally_harmless_string :  | semmle.label | totally_harmless_string :  |
+| tst.rb:10:9:10:25 | call to e | semmle.label | call to e |
+| tst.rb:10:11:10:24 | "666f6f626172" :  | semmle.label | "666f6f626172" :  |
+| tst.rb:16:31:16:84 | "\\x70\\x75\\x74\\x73\\x28\\x27\\x68\\..." :  | semmle.label | "\\x70\\x75\\x74\\x73\\x28\\x27\\x68\\..." :  |
+| tst.rb:17:6:17:32 | another_questionable_string :  | semmle.label | another_questionable_string :  |
+| tst.rb:17:6:17:38 | call to strip | semmle.label | call to strip |
+subpaths
+| tst.rb:7:8:7:30 | totally_harmless_string :  | tst.rb:1:7:1:7 | r :  | tst.rb:2:3:2:15 | call to pack :  | tst.rb:7:6:7:31 | call to e |
+| tst.rb:10:11:10:24 | "666f6f626172" :  | tst.rb:1:7:1:7 | r :  | tst.rb:2:3:2:15 | call to pack :  | tst.rb:10:9:10:25 | call to e |
+#select
+| tst.rb:7:6:7:31 | call to e | tst.rb:5:27:5:72 | "707574732822636f646520696e6a6..." :  | tst.rb:7:6:7:31 | call to e | Hard-coded data from $@ is interpreted as code. | tst.rb:5:27:5:72 | "707574732822636f646520696e6a6..." | here |
+| tst.rb:10:9:10:25 | call to e | tst.rb:10:11:10:24 | "666f6f626172" :  | tst.rb:10:9:10:25 | call to e | Hard-coded data from $@ is interpreted as an import path. | tst.rb:10:11:10:24 | "666f6f626172" | here |
+| tst.rb:17:6:17:38 | call to strip | tst.rb:16:31:16:84 | "\\x70\\x75\\x74\\x73\\x28\\x27\\x68\\..." :  | tst.rb:17:6:17:38 | call to strip | Hard-coded data from $@ is interpreted as code. | tst.rb:16:31:16:84 | "\\x70\\x75\\x74\\x73\\x28\\x27\\x68\\..." | here |
diff --git a/ruby/ql/test/query-tests/security/cwe-506/HardcodedDataInterpretedAsCode.qlref b/ruby/ql/test/query-tests/security/cwe-506/HardcodedDataInterpretedAsCode.qlref
new file mode 100644
index 00000000000..afa4fec282c
--- /dev/null
+++ b/ruby/ql/test/query-tests/security/cwe-506/HardcodedDataInterpretedAsCode.qlref
@@ -0,0 +1 @@
+queries/security/cwe-506/HardcodedDataInterpretedAsCode.ql
diff --git a/ruby/ql/test/query-tests/security/cwe-506/tst.rb b/ruby/ql/test/query-tests/security/cwe-506/tst.rb
new file mode 100644
index 00000000000..67d117e95c4
--- /dev/null
+++ b/ruby/ql/test/query-tests/security/cwe-506/tst.rb
@@ -0,0 +1,18 @@
+def e(r)
+  [r].pack 'H*'
+end
+
+totally_harmless_string = '707574732822636f646520696e6a656374696f6e2229'
+
+eval(e(totally_harmless_string)) # NOT OK: eval("puts('hello'")
+eval(totally_harmless_string)    # OK: throws parse error
+
+require e('666f6f626172') # NOT OK: require 'foobar' 
+require '666f6f626172'    # OK: no taint step between source and sink
+
+x = 'deadbeef'
+require e(x) # OK: doesn't meet our criteria for being a source
+
+another_questionable_string = "\x70\x75\x74\x73\x28\x27\x68\x65\x6C\x6C\x6F\x27\x29"
+eval(another_questionable_string.strip) # NOT OK: eval("puts('hello'")
+eval(another_questionable_string)       # OK: no taint step between source and sink
diff --git a/ruby/ql/test/query-tests/security/cwe-611/Xxe.expected b/ruby/ql/test/query-tests/security/cwe-611/Xxe.expected
index 44732d9a7a7..014aaeef477 100644
--- a/ruby/ql/test/query-tests/security/cwe-611/Xxe.expected
+++ b/ruby/ql/test/query-tests/security/cwe-611/Xxe.expected
@@ -54,26 +54,26 @@ nodes
 | Nokogiri.rb:28:26:28:32 | content | semmle.label | content |
 subpaths
 #select
-| LibXmlRuby.rb:4:34:4:40 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:4:34:4:40 | content | Unsafe parsing of XML file from $@. | LibXmlRuby.rb:3:15:3:20 | call to params | user input |
-| LibXmlRuby.rb:5:32:5:38 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:5:32:5:38 | content | Unsafe parsing of XML file from $@. | LibXmlRuby.rb:3:15:3:20 | call to params | user input |
-| LibXmlRuby.rb:6:30:6:36 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:6:30:6:36 | content | Unsafe parsing of XML file from $@. | LibXmlRuby.rb:3:15:3:20 | call to params | user input |
-| LibXmlRuby.rb:7:32:7:38 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:7:32:7:38 | content | Unsafe parsing of XML file from $@. | LibXmlRuby.rb:3:15:3:20 | call to params | user input |
-| LibXmlRuby.rb:8:30:8:36 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:8:30:8:36 | content | Unsafe parsing of XML file from $@. | LibXmlRuby.rb:3:15:3:20 | call to params | user input |
-| LibXmlRuby.rb:9:28:9:34 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:9:28:9:34 | content | Unsafe parsing of XML file from $@. | LibXmlRuby.rb:3:15:3:20 | call to params | user input |
-| LibXmlRuby.rb:11:26:11:32 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:11:26:11:32 | content | Unsafe parsing of XML file from $@. | LibXmlRuby.rb:3:15:3:20 | call to params | user input |
-| LibXmlRuby.rb:12:24:12:30 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:12:24:12:30 | content | Unsafe parsing of XML file from $@. | LibXmlRuby.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:5:26:5:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:5:26:5:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:6:26:6:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:6:26:6:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:7:26:7:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:7:26:7:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:8:26:8:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:8:26:8:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:9:26:9:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:9:26:9:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:11:26:11:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:11:26:11:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:12:26:12:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:12:26:12:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:15:26:15:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:15:26:15:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:16:26:16:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:16:26:16:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:18:26:18:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:18:26:18:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:19:26:19:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:19:26:19:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:22:26:22:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:22:26:22:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:25:26:25:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:25:26:25:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:27:26:27:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:27:26:27:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
-| Nokogiri.rb:28:26:28:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:28:26:28:32 | content | Unsafe parsing of XML file from $@. | Nokogiri.rb:3:15:3:20 | call to params | user input |
+| LibXmlRuby.rb:4:34:4:40 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:4:34:4:40 | content | A $@ is parsed as XML without guarding against external entity expansion. | LibXmlRuby.rb:3:15:3:20 | call to params | user-provided value |
+| LibXmlRuby.rb:5:32:5:38 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:5:32:5:38 | content | A $@ is parsed as XML without guarding against external entity expansion. | LibXmlRuby.rb:3:15:3:20 | call to params | user-provided value |
+| LibXmlRuby.rb:6:30:6:36 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:6:30:6:36 | content | A $@ is parsed as XML without guarding against external entity expansion. | LibXmlRuby.rb:3:15:3:20 | call to params | user-provided value |
+| LibXmlRuby.rb:7:32:7:38 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:7:32:7:38 | content | A $@ is parsed as XML without guarding against external entity expansion. | LibXmlRuby.rb:3:15:3:20 | call to params | user-provided value |
+| LibXmlRuby.rb:8:30:8:36 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:8:30:8:36 | content | A $@ is parsed as XML without guarding against external entity expansion. | LibXmlRuby.rb:3:15:3:20 | call to params | user-provided value |
+| LibXmlRuby.rb:9:28:9:34 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:9:28:9:34 | content | A $@ is parsed as XML without guarding against external entity expansion. | LibXmlRuby.rb:3:15:3:20 | call to params | user-provided value |
+| LibXmlRuby.rb:11:26:11:32 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:11:26:11:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | LibXmlRuby.rb:3:15:3:20 | call to params | user-provided value |
+| LibXmlRuby.rb:12:24:12:30 | content | LibXmlRuby.rb:3:15:3:20 | call to params :  | LibXmlRuby.rb:12:24:12:30 | content | A $@ is parsed as XML without guarding against external entity expansion. | LibXmlRuby.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:5:26:5:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:5:26:5:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:6:26:6:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:6:26:6:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:7:26:7:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:7:26:7:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:8:26:8:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:8:26:8:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:9:26:9:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:9:26:9:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:11:26:11:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:11:26:11:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:12:26:12:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:12:26:12:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:15:26:15:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:15:26:15:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:16:26:16:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:16:26:16:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:18:26:18:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:18:26:18:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:19:26:19:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:19:26:19:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:22:26:22:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:22:26:22:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:25:26:25:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:25:26:25:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:27:26:27:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:27:26:27:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
+| Nokogiri.rb:28:26:28:32 | content | Nokogiri.rb:3:15:3:20 | call to params :  | Nokogiri.rb:28:26:28:32 | content | A $@ is parsed as XML without guarding against external entity expansion. | Nokogiri.rb:3:15:3:20 | call to params | user-provided value |
diff --git a/shared/README.md b/shared/README.md
new file mode 100644
index 00000000000..dc1db929bdb
--- /dev/null
+++ b/shared/README.md
@@ -0,0 +1,17 @@
+# CodeQL Shared Libraries
+
+This folder contains shared, language-agnostic CodeQL libraries.
+
+Libraries are organized into separate query packs, in order to allow for
+individual versioning. For example, the shared static single assignment (SSA)
+library exists in the `codeql/ssa` pack, which can be referenced by adding
+
+```
+dependencies:
+  codeql/ssa: 0.0.1
+```
+
+to `qlpack.yml`.
+
+All shared libraries will belong to a `codeql/<name>` pack, and live in the
+namespace `codeql.<name>`.
\ No newline at end of file
diff --git a/shared/ssa/codeql/ssa/Ssa.qll b/shared/ssa/codeql/ssa/Ssa.qll
new file mode 100644
index 00000000000..a18a8150dc1
--- /dev/null
+++ b/shared/ssa/codeql/ssa/Ssa.qll
@@ -0,0 +1,890 @@
+/**
+ * Provides a language-independent implementation of static single assignment
+ * (SSA) form.
+ */
+
+/** Provides the input specification of the SSA implementation. */
+signature module InputSig {
+  /**
+   * A basic block, that is, a maximal straight-line sequence of control flow nodes
+   * without branches or joins.
+   */
+  class BasicBlock;
+
+  /**
+   * Gets the basic block that immediately dominates basic block `bb`, if any.
+   *
+   * That is, all paths reaching `bb` from some entry point basic block must go
+   * through the result.
+   *
+   * Example:
+   *
+   * ```csharp
+   * int M(string s) {
+   *   if (s == null)
+   *     throw new ArgumentNullException(nameof(s));
+   *   return s.Length;
+   * }
+   * ```
+   *
+   * The basic block starting on line 2 is an immediate dominator of
+   * the basic block on line 4 (all paths from the entry point of `M`
+   * to `return s.Length;` must go through the null check.
+   */
+  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb);
+
+  /** Gets an immediate successor of basic block `bb`, if any. */
+  BasicBlock getABasicBlockSuccessor(BasicBlock bb);
+
+  /**
+   * An exit basic block, that is, a basic block whose last node is
+   * an exit node.
+   */
+  class ExitBasicBlock extends BasicBlock;
+
+  /** A variable that can be SSA converted. */
+  class SourceVariable;
+
+  /**
+   * Holds if the `i`th node of basic block `bb` is a (potential) write to source
+   * variable `v`. The Boolean `certain` indicates whether the write is certain.
+   *
+   * Examples of uncertain writes are `ref` arguments in C#, where it is the callee
+   * that may or may not update the argument.
+   */
+  predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain);
+
+  /**
+   * Holds if the `i`th node of basic block `bb` reads source variable `v`. The
+   * Boolean `certain` indicates whether the read is certain.
+   *
+   * Examples of uncertain reads are pseudo-reads inserted at the end of a C# method
+   * with a `ref` or `out` parameter, where it is the caller that may or may not read
+   * the argument.
+   */
+  predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain);
+}
+
+/**
+ * Provides an SSA implementation.
+ *
+ * The SSA construction is pruned based on liveness. That is, SSA definitions are only
+ * constructed for `Input::variableWrite`s when it is possible to reach an
+ * `Input::variableRead`, without going through a certain write (the same goes for `phi`
+ * nodes). Whenever a variable is both read and written at the same index in some basic
+ * block, the read is assumed to happen before the write.
+ *
+ * The result of invoking this parameterized module is not meant to be exposed directly;
+ * instead, one should define a language-specific layer on top, and make sure to cache
+ * all exposed predicates marked with
+ *
+ * ```
+ * NB: If this predicate is exposed, it should be cached.
+ * ```
+ */
+module Make<InputSig Input> {
+  private import Input
+
+  private BasicBlock getABasicBlockPredecessor(BasicBlock bb) {
+    getABasicBlockSuccessor(result) = bb
+  }
+
+  /**
+   * Liveness analysis (based on source variables) to restrict the size of the
+   * SSA representation.
+   */
+  private module Liveness {
+    /**
+     * A classification of variable references into reads (of a given kind) and
+     * (certain or uncertain) writes.
+     */
+    private newtype TRefKind =
+      Read(boolean certain) { certain in [false, true] } or
+      Write(boolean certain) { certain in [false, true] }
+
+    private class RefKind extends TRefKind {
+      string toString() {
+        exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
+        or
+        exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
+      }
+
+      int getOrder() {
+        this = Read(_) and
+        result = 0
+        or
+        this = Write(_) and
+        result = 1
+      }
+    }
+
+    /**
+     * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
+     */
+    predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
+      exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
+      or
+      exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
+    }
+
+    private newtype OrderedRefIndex =
+      MkOrderedRefIndex(int i, int tag) {
+        exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
+      }
+
+    private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
+      ref(bb, i, v, k) and
+      result = MkOrderedRefIndex(i, ord) and
+      ord = k.getOrder()
+    }
+
+    /**
+     * Gets the (1-based) rank of the reference to `v` at the `i`th node of
+     * basic block `bb`, which has the given reference kind `k`.
+     *
+     * Reads are considered before writes when they happen at the same index.
+     */
+    private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
+      refOrd(bb, i, v, k, _) =
+        rank[result](int j, int ord, OrderedRefIndex res |
+          res = refOrd(bb, j, v, _, ord)
+        |
+          res order by j, ord
+        )
+    }
+
+    private int maxRefRank(BasicBlock bb, SourceVariable v) {
+      result = refRank(bb, _, v, _) and
+      not result + 1 = refRank(bb, _, v, _)
+    }
+
+    predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
+      maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
+    }
+
+    /**
+     * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
+     * that is either a read or a certain write.
+     */
+    private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
+      result =
+        min(int r, RefKind k |
+          r = refRank(bb, _, v, k) and
+          k != Write(false)
+        |
+          r
+        )
+    }
+
+    /**
+     * Holds if source variable `v` is live at the beginning of basic block `bb`.
+     */
+    predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
+      // The first read or certain write to `v` inside `bb` is a read
+      refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
+      or
+      // There is no certain write to `v` inside `bb`, but `v` is live at entry
+      // to a successor basic block of `bb`
+      not exists(firstReadOrCertainWrite(bb, v)) and
+      liveAtExit(bb, v)
+    }
+
+    /**
+     * Holds if source variable `v` is live at the end of basic block `bb`.
+     */
+    predicate liveAtExit(BasicBlock bb, SourceVariable v) {
+      liveAtEntry(getABasicBlockSuccessor(bb), v)
+    }
+
+    /**
+     * Holds if variable `v` is live in basic block `bb` at index `i`.
+     * The rank of `i` is `rnk` as defined by `refRank()`.
+     */
+    private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
+      exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
+        rnk = maxRefRank(bb, v) and
+        liveAtExit(bb, v)
+        or
+        ref(bb, i, v, kind) and
+        kind = Read(_)
+        or
+        exists(RefKind nextKind |
+          liveAtRank(bb, _, v, rnk + 1) and
+          rnk + 1 = refRank(bb, _, v, nextKind) and
+          nextKind != Write(true)
+        )
+      )
+    }
+
+    /**
+     * Holds if variable `v` is live after the (certain or uncertain) write at
+     * index `i` inside basic block `bb`.
+     */
+    predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
+      exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
+    }
+  }
+
+  private import Liveness
+
+  /**
+   * Holds if `df` is in the dominance frontier of `bb`.
+   *
+   * This is equivalent to:
+   *
+   * ```ql
+   * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
+   * not bb = getImmediateBasicBlockDominator+(df)
+   * ```
+   */
+  private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
+    bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
+    or
+    exists(BasicBlock prev | inDominanceFrontier(prev, df) |
+      bb = getImmediateBasicBlockDominator(prev) and
+      not bb = getImmediateBasicBlockDominator(df)
+    )
+  }
+
+  /**
+   * Holds if `bb` is in the dominance frontier of a block containing a
+   * definition of `v`.
+   */
+  pragma[noinline]
+  private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
+    exists(BasicBlock defbb, Definition def |
+      def.definesAt(v, defbb, _) and
+      inDominanceFrontier(defbb, bb)
+    )
+  }
+
+  cached
+  newtype TDefinition =
+    TWriteDef(SourceVariable v, BasicBlock bb, int i) {
+      variableWrite(bb, i, v, _) and
+      liveAfterWrite(bb, i, v)
+    } or
+    TPhiNode(SourceVariable v, BasicBlock bb) {
+      inDefDominanceFrontier(bb, v) and
+      liveAtEntry(bb, v)
+    }
+
+  private module SsaDefReaches {
+    newtype TSsaRefKind =
+      SsaActualRead() or
+      SsaPhiRead() or
+      SsaDef()
+
+    class SsaRead = SsaActualRead or SsaPhiRead;
+
+    /**
+     * A classification of SSA variable references into reads and definitions.
+     */
+    class SsaRefKind extends TSsaRefKind {
+      string toString() {
+        this = SsaActualRead() and
+        result = "SsaActualRead"
+        or
+        this = SsaPhiRead() and
+        result = "SsaPhiRead"
+        or
+        this = SsaDef() and
+        result = "SsaDef"
+      }
+
+      int getOrder() {
+        this instanceof SsaRead and
+        result = 0
+        or
+        this = SsaDef() and
+        result = 1
+      }
+    }
+
+    /**
+     * Holds if `bb` is in the dominance frontier of a block containing a
+     * read of `v`.
+     */
+    pragma[nomagic]
+    private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
+      exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
+        lastRefIsRead(readbb, v)
+        or
+        phiRead(readbb, v)
+      )
+    }
+
+    /**
+     * Holds if a phi-read node should be inserted for variable `v` at the beginning
+     * of basic block `bb`.
+     *
+     * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
+     * instead of writes, and only if the dominance-frontier block does not already
+     * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
+     * an internal implementation detail that is not exposed.
+     *
+     * The motivation for adding phi-reads is to improve performance of the use-use
+     * calculation in cases where there is a large number of reads that can reach the
+     * same join-point, and from there reach a large number of basic blocks. Example:
+     *
+     * ```cs
+     * if (a)
+     *   use(x);
+     * else if (b)
+     *   use(x);
+     * else if (c)
+     *   use(x);
+     * else if (d)
+     *   use(x);
+     * // many more ifs ...
+     *
+     * // phi-read for `x` inserted here
+     *
+     * // program not mentioning `x`, with large basic block graph
+     *
+     * use(x);
+     * ```
+     *
+     * Without phi-reads, the analysis has to replicate reachability for each of
+     * the guarded uses of `x`. However, with phi-reads, the analysis will limit
+     * each conditional use of `x` to reach the basic block containing the phi-read
+     * node for `x`, and only that basic block will have to compute reachability
+     * through the remainder of the large program.
+     *
+     * Like normal reads, each phi-read node `phi-read` can be reached from exactly
+     * one SSA definition (without passing through another definition): Assume, for
+     * the sake of contradiction, that there are two reaching definitions `def1` and
+     * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
+     * dominating definition will prevent the other from reaching `phi-read`. So, at
+     * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
+     * Then `def1` must go through one of its dominance-frontier blocks in order to
+     * reach `phi-read`. However, such a block will always start with a (normal) phi
+     * node, which contradicts reachability.
+     *
+     * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
+     * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
+     * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
+     * which contradicts reachability.
+     */
+    pragma[nomagic]
+    predicate phiRead(BasicBlock bb, SourceVariable v) {
+      inReadDominanceFrontier(bb, v) and
+      liveAtEntry(bb, v) and
+      // only if there are no other references to `v` inside `bb`
+      not ref(bb, _, v, _) and
+      not exists(Definition def | def.definesAt(v, bb, _))
+    }
+
+    /**
+     * Holds if the `i`th node of basic block `bb` is a reference to `v`,
+     * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
+     * is `SsaDef()`).
+     *
+     * Unlike `Liveness::ref`, this includes `phi` nodes.
+     */
+    pragma[nomagic]
+    predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
+      variableRead(bb, i, v, _) and
+      k = SsaActualRead()
+      or
+      phiRead(bb, v) and
+      i = -1 and
+      k = SsaPhiRead()
+      or
+      any(Definition def).definesAt(v, bb, i) and
+      k = SsaDef()
+    }
+
+    private newtype OrderedSsaRefIndex =
+      MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
+
+    private OrderedSsaRefIndex ssaRefOrd(
+      BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord
+    ) {
+      ssaRef(bb, i, v, k) and
+      result = MkOrderedSsaRefIndex(i, k) and
+      ord = k.getOrder()
+    }
+
+    /**
+     * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
+     * block `bb`, which has the given reference kind `k`.
+     *
+     * For example, if `bb` is a basic block with a phi node for `v` (considered
+     * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
+     *
+     * ```ql
+     * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
+     * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
+     * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
+     * ```
+     *
+     * Reads are considered before writes when they happen at the same index.
+     */
+    int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
+      ssaRefOrd(bb, i, v, k, _) =
+        rank[result](int j, int ord, OrderedSsaRefIndex res |
+          res = ssaRefOrd(bb, j, v, _, ord)
+        |
+          res order by j, ord
+        )
+    }
+
+    int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
+      result = ssaRefRank(bb, _, v, _) and
+      not result + 1 = ssaRefRank(bb, _, v, _)
+    }
+
+    /**
+     * Holds if the SSA definition `def` reaches rank index `rnk` in its own
+     * basic block `bb`.
+     */
+    predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
+      exists(int i |
+        rnk = ssaRefRank(bb, i, v, SsaDef()) and
+        def.definesAt(v, bb, i)
+      )
+      or
+      ssaDefReachesRank(bb, def, rnk - 1, v) and
+      rnk = ssaRefRank(bb, _, v, any(SsaRead k))
+    }
+
+    /**
+     * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
+     * basic block `bb`, without crossing another SSA definition of `v`.
+     */
+    predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
+      exists(int rnk |
+        ssaDefReachesRank(bb, def, rnk, v) and
+        rnk = ssaRefRank(bb, i, v, any(SsaRead k))
+      )
+    }
+
+    /**
+     * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
+     */
+    int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
+      v = def.getSourceVariable() and
+      result = ssaRefRank(bb, i, v, k) and
+      (
+        ssaDefReachesRead(_, def, bb, i)
+        or
+        def.definesAt(_, bb, i)
+      )
+    }
+
+    /**
+     * Holds if the reference to `def` at index `i` in basic block `bb` is the
+     * last reference to `v` inside `bb`.
+     */
+    pragma[noinline]
+    predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
+      ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
+    }
+
+    predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
+      exists(ssaDefRank(def, v, bb, _, k))
+    }
+
+    pragma[noinline]
+    private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
+      ssaDefReachesEndOfBlock(bb, def, _) and
+      not defOccursInBlock(_, bb, def.getSourceVariable(), _)
+    }
+
+    /**
+     * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
+     * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
+     * predecessor of `bb2`, and the underlying variable for `def` is neither read
+     * nor written in any block on the path between `bb1` and `bb2`.
+     *
+     * Phi reads are considered as normal reads for this predicate.
+     */
+    pragma[nomagic]
+    private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
+      defOccursInBlock(def, bb1, _, _) and
+      bb2 = getABasicBlockSuccessor(bb1)
+      or
+      exists(BasicBlock mid |
+        varBlockReachesInclPhiRead(def, bb1, mid) and
+        ssaDefReachesThroughBlock(def, mid) and
+        bb2 = getABasicBlockSuccessor(mid)
+      )
+    }
+
+    pragma[nomagic]
+    private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
+      varBlockReachesInclPhiRead(def, bb1, bb2) and
+      defOccursInBlock(def, bb2, v, SsaPhiRead())
+    }
+
+    pragma[nomagic]
+    private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
+      varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
+      ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
+      or
+      exists(BasicBlock mid |
+        varBlockReachesExclPhiRead(def, mid, bb2) and
+        phiReadStep(def, _, bb1, mid)
+      )
+    }
+
+    /**
+     * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
+     * the underlying variable `v` of `def` is accessed in basic block `bb2`
+     * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
+     * `v` is neither read nor written in any block on the path between `bb1`
+     * and `bb2`.
+     */
+    pragma[nomagic]
+    predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
+      varBlockReachesExclPhiRead(def, bb1, bb2) and
+      not defOccursInBlock(def, bb1, _, SsaPhiRead())
+    }
+
+    pragma[nomagic]
+    predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
+      varBlockReaches(def, bb1, bb2) and
+      ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
+    }
+
+    /**
+     * Holds if `def` is accessed in basic block `bb` (either a read or a write),
+     * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
+     * and `v` is neither read nor written in any block on the path between `bb`
+     * and `bb2`.
+     */
+    pragma[nomagic]
+    predicate varBlockReachesExit(Definition def, BasicBlock bb) {
+      exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
+        not defOccursInBlock(def, bb2, _, _) and
+        not ssaDefReachesEndOfBlock(bb2, def, _)
+      )
+      or
+      exists(BasicBlock mid |
+        varBlockReachesExit(def, mid) and
+        phiReadStep(def, _, bb, mid)
+      )
+    }
+  }
+
+  predicate phiReadExposedForTesting = phiRead/2;
+
+  private import SsaDefReaches
+
+  pragma[nomagic]
+  private predicate liveThrough(BasicBlock bb, SourceVariable v) {
+    liveAtExit(bb, v) and
+    not ssaRef(bb, _, v, SsaDef())
+  }
+
+  /**
+   * NB: If this predicate is exposed, it should be cached.
+   *
+   * Holds if the SSA definition of `v` at `def` reaches the end of basic
+   * block `bb`, at which point it is still live, without crossing another
+   * SSA definition of `v`.
+   */
+  pragma[nomagic]
+  predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
+    exists(int last |
+      last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
+      ssaDefReachesRank(bb, def, last, v) and
+      liveAtExit(bb, v)
+    )
+    or
+    // The construction of SSA form ensures that each read of a variable is
+    // dominated by its definition. An SSA definition therefore reaches a
+    // control flow node if it is the _closest_ SSA definition that dominates
+    // the node. If two definitions dominate a node then one must dominate the
+    // other, so therefore the definition of _closest_ is given by the dominator
+    // tree. Thus, reaching definitions can be calculated in terms of dominance.
+    ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
+    liveThrough(bb, pragma[only_bind_into](v))
+  }
+
+  /**
+   * NB: If this predicate is exposed, it should be cached.
+   *
+   * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
+   */
+  pragma[nomagic]
+  predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
+    exists(SourceVariable v, BasicBlock bbDef |
+      phi.definesAt(v, bbDef, _) and
+      getABasicBlockPredecessor(bbDef) = bb and
+      ssaDefReachesEndOfBlock(bb, inp, v)
+    )
+  }
+
+  /**
+   * NB: If this predicate is exposed, it should be cached.
+   *
+   * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
+   * basic block `bb`, without crossing another SSA definition of `v`. The read
+   * is of kind `rk`.
+   */
+  pragma[nomagic]
+  predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
+    ssaDefReachesReadWithinBlock(v, def, bb, i)
+    or
+    ssaRef(bb, i, v, any(SsaRead k)) and
+    ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
+    not ssaDefReachesReadWithinBlock(v, _, bb, i)
+  }
+
+  /**
+   * NB: If this predicate is exposed, it should be cached.
+   *
+   * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
+   * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
+   * path between them without any read of `def`.
+   */
+  pragma[nomagic]
+  predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
+    exists(int rnk |
+      rnk = ssaDefRank(def, _, bb1, i1, _) and
+      rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
+      variableRead(bb1, i2, _, _) and
+      bb2 = bb1
+    )
+    or
+    lastSsaRef(def, _, bb1, i1) and
+    defAdjacentRead(def, bb1, bb2, i2)
+  }
+
+  pragma[noinline]
+  private predicate adjacentDefRead(
+    Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
+  ) {
+    adjacentDefRead(def, bb1, i1, bb2, i2) and
+    v = def.getSourceVariable()
+  }
+
+  private predicate adjacentDefReachesRead(
+    Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
+  ) {
+    exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
+      ssaRef(bb1, i1, v, SsaDef())
+      or
+      variableRead(bb1, i1, v, true)
+    )
+    or
+    exists(BasicBlock bb3, int i3 |
+      adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
+      variableRead(bb3, i3, _, false) and
+      adjacentDefRead(def, bb3, i3, bb2, i2)
+    )
+  }
+
+  /**
+   * NB: If this predicate is exposed, it should be cached.
+   *
+   * Same as `adjacentDefRead`, but ignores uncertain reads.
+   */
+  pragma[nomagic]
+  predicate adjacentDefNoUncertainReads(
+    Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
+  ) {
+    adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
+    variableRead(bb2, i2, _, true)
+  }
+
+  /**
+   * NB: If this predicate is exposed, it should be cached.
+   *
+   * Holds if the node at index `i` in `bb` is a last reference to SSA definition
+   * `def`. The reference is last because it can reach another write `next`,
+   * without passing through another read or write.
+   */
+  pragma[nomagic]
+  predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
+    exists(SourceVariable v |
+      // Next reference to `v` inside `bb` is a write
+      exists(int rnk, int j |
+        rnk = ssaDefRank(def, v, bb, i, _) and
+        next.definesAt(v, bb, j) and
+        rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+      )
+      or
+      // Can reach a write using one or more steps
+      lastSsaRef(def, v, bb, i) and
+      exists(BasicBlock bb2 |
+        varBlockReaches(def, bb, bb2) and
+        1 = ssaDefRank(next, v, bb2, _, SsaDef())
+      )
+    )
+  }
+
+  /**
+   * NB: If this predicate is exposed, it should be cached.
+   *
+   * Holds if `inp` is an immediately preceding definition of uncertain definition
+   * `def`. Since `def` is uncertain, the value from the preceding definition might
+   * still be valid.
+   */
+  pragma[nomagic]
+  predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
+    lastRefRedef(inp, _, _, def)
+  }
+
+  private predicate adjacentDefReachesUncertainRead(
+    Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
+  ) {
+    adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
+    variableRead(bb2, i2, _, false)
+  }
+
+  /**
+   * NB: If this predicate is exposed, it should be cached.
+   *
+   * Same as `lastRefRedef`, but ignores uncertain reads.
+   */
+  pragma[nomagic]
+  predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
+    lastRefRedef(def, bb, i, next) and
+    not variableRead(bb, i, def.getSourceVariable(), false)
+    or
+    exists(BasicBlock bb0, int i0 |
+      lastRefRedef(def, bb0, i0, next) and
+      adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
+    )
+  }
+
+  /**
+   * NB: If this predicate is exposed, it should be cached.
+   *
+   * Holds if the node at index `i` in `bb` is a last reference to SSA
+   * definition `def`.
+   *
+   * That is, the node can reach the end of the enclosing callable, or another
+   * SSA definition for the underlying source variable, without passing through
+   * another read.
+   */
+  pragma[nomagic]
+  predicate lastRef(Definition def, BasicBlock bb, int i) {
+    // Can reach another definition
+    lastRefRedef(def, bb, i, _)
+    or
+    exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
+      // Can reach exit directly
+      bb instanceof ExitBasicBlock
+      or
+      // Can reach a block using one or more steps, where `def` is no longer live
+      varBlockReachesExit(def, bb)
+    )
+  }
+
+  /**
+   * NB: If this predicate is exposed, it should be cached.
+   *
+   * Same as `lastRefRedef`, but ignores uncertain reads.
+   */
+  pragma[nomagic]
+  predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
+    lastRef(def, bb, i) and
+    not variableRead(bb, i, def.getSourceVariable(), false)
+    or
+    exists(BasicBlock bb0, int i0 |
+      lastRef(def, bb0, i0) and
+      adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
+    )
+  }
+
+  /** A static single assignment (SSA) definition. */
+  class Definition extends TDefinition {
+    /** Gets the source variable underlying this SSA definition. */
+    SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
+
+    /**
+     * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
+     * Phi nodes are considered to be at index `-1`, while normal variable writes
+     * are at the index of the control flow node they wrap.
+     */
+    final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
+      this = TWriteDef(v, bb, i)
+      or
+      this = TPhiNode(v, bb) and i = -1
+    }
+
+    /** Gets the basic block to which this SSA definition belongs. */
+    final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
+
+    /** Gets a textual representation of this SSA definition. */
+    string toString() { none() }
+  }
+
+  /** An SSA definition that corresponds to a write. */
+  class WriteDefinition extends Definition, TWriteDef {
+    private SourceVariable v;
+    private BasicBlock bb;
+    private int i;
+
+    WriteDefinition() { this = TWriteDef(v, bb, i) }
+
+    override string toString() { result = "WriteDef" }
+  }
+
+  /** A phi node. */
+  class PhiNode extends Definition, TPhiNode {
+    override string toString() { result = "Phi" }
+  }
+
+  /**
+   * An SSA definition that represents an uncertain update of the underlying
+   * source variable.
+   */
+  class UncertainWriteDefinition extends WriteDefinition {
+    UncertainWriteDefinition() {
+      exists(SourceVariable v, BasicBlock bb, int i |
+        this.definesAt(v, bb, i) and
+        variableWrite(bb, i, v, false)
+      )
+    }
+  }
+
+  /** Provides a set of consistency queries. */
+  // TODO: Make these `query` predicates once class signatures are supported
+  // (`SourceVariable` and `BasicBlock` must have `toString`)
+  module Consistency {
+    /** A definition that is relevant for the consistency queries. */
+    abstract class RelevantDefinition extends Definition {
+      /** Override this predicate to ensure locations in consistency results. */
+      abstract predicate hasLocationInfo(
+        string filepath, int startline, int startcolumn, int endline, int endcolumn
+      );
+    }
+
+    /** Holds if a read can be reached from multiple definitions. */
+    predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
+      ssaDefReachesRead(v, def, bb, i) and
+      not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
+    }
+
+    /** Holds if a read cannot be reached from a definition. */
+    predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
+      variableRead(bb, i, v, _) and
+      not ssaDefReachesRead(v, _, bb, i)
+    }
+
+    /** Holds if a definition cannot reach a read. */
+    predicate deadDef(RelevantDefinition def, SourceVariable v) {
+      v = def.getSourceVariable() and
+      not ssaDefReachesRead(_, def, _, _) and
+      not phiHasInputFromBlock(_, def, _) and
+      not uncertainWriteDefinitionInput(_, def)
+    }
+
+    /** Holds if a read is not dominated by a definition. */
+    predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
+      exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
+        ssaDefReachesReadWithinBlock(v, def, bb, i) and
+        (bb != bbDef or i < iDef)
+        or
+        ssaDefReachesRead(v, def, bb, i) and
+        not ssaDefReachesReadWithinBlock(v, def, bb, i) and
+        not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
+      )
+    }
+  }
+}
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
new file mode 100644
index 00000000000..d62242816da
--- /dev/null
+++ b/shared/ssa/qlpack.yml
@@ -0,0 +1,4 @@
+name: codeql/ssa
+version: 0.0.1-dev
+groups: shared
+library: true
diff --git a/shared/typos/codeql/typos/TypoDatabase.qll b/shared/typos/codeql/typos/TypoDatabase.qll
new file mode 100644
index 00000000000..a41f003a8c0
--- /dev/null
+++ b/shared/typos/codeql/typos/TypoDatabase.qll
@@ -0,0 +1,9035 @@
+/**
+ * Holds if `wrong` is a common misspelling of `right`.
+ *
+ * This predicate was automatically generated by
+ *     python buildutils-internal/scripts/generate-typos.py
+ * which uses http://en.wikipedia.org/wiki/Wikipedia:Lists_of_common_misspellings/For_machines (with custom additions) on 2018-01-19.
+ *
+ * This file is available under the Creative Commons Attribution-ShareAlike License
+ * (https://en.wikipedia.org/wiki/Wikipedia:Text_of_Creative_Commons_Attribution-ShareAlike_3.0_Unported_License).
+ */
+predicate typos(string wrong, string right) {
+  wrong = "abandonned" and right = "abandoned"
+  or
+  wrong = "abbout" and right = "about"
+  or
+  wrong = "aberation" and right = "aberration"
+  or
+  wrong = "abilityes" and right = "abilities"
+  or
+  wrong = "abilties" and right = "abilities"
+  or
+  wrong = "abilty" and right = "ability"
+  or
+  wrong = "abondon" and right = "abandon"
+  or
+  wrong = "abondoned" and right = "abandoned"
+  or
+  wrong = "abondoning" and right = "abandoning"
+  or
+  wrong = "abondons" and right = "abandons"
+  or
+  wrong = "aborigene" and right = "aborigine"
+  or
+  wrong = "abortificant" and right = "abortifacient"
+  or
+  wrong = "abotu" and right = "about"
+  or
+  wrong = "abreviate" and right = "abbreviate"
+  or
+  wrong = "abreviated" and right = "abbreviated"
+  or
+  wrong = "abreviation" and right = "abbreviation"
+  or
+  wrong = "abritrary" and right = "arbitrary"
+  or
+  wrong = "absail" and right = "abseil"
+  or
+  wrong = "absailing" and right = "abseiling"
+  or
+  wrong = "abscence" and right = "absence"
+  or
+  wrong = "absense" and right = "absence"
+  or
+  wrong = "absolutly" and right = "absolutely"
+  or
+  wrong = "absorbsion" and right = "absorption"
+  or
+  wrong = "absorbtion" and right = "absorption"
+  or
+  wrong = "abudance" and right = "abundance"
+  or
+  wrong = "abundacies" and right = "abundances"
+  or
+  wrong = "abundancies" and right = "abundances"
+  or
+  wrong = "abundunt" and right = "abundant"
+  or
+  wrong = "abutts" and right = "abuts"
+  or
+  wrong = "acadamy" and right = "academy"
+  or
+  wrong = "acadmic" and right = "academic"
+  or
+  wrong = "accademic" and right = "academic"
+  or
+  wrong = "accademy" and right = "academy"
+  or
+  wrong = "acccess" and right = "access"
+  or
+  wrong = "acccused" and right = "accused"
+  or
+  wrong = "accelleration" and right = "acceleration"
+  or
+  wrong = "accension" and right = "accession"
+  or
+  wrong = "accension" and right = "ascension"
+  or
+  wrong = "acceptence" and right = "acceptance"
+  or
+  wrong = "acceptible" and right = "acceptable"
+  or
+  wrong = "accesories" and right = "accessories"
+  or
+  wrong = "accessable" and right = "accessible"
+  or
+  wrong = "accidant" and right = "accident"
+  or
+  wrong = "accidentaly" and right = "accidentally"
+  or
+  wrong = "accidently" and right = "accidentally"
+  or
+  wrong = "acclimitization" and right = "acclimatization"
+  or
+  wrong = "accomadate" and right = "accommodate"
+  or
+  wrong = "accomadated" and right = "accommodated"
+  or
+  wrong = "accomadates" and right = "accommodates"
+  or
+  wrong = "accomadating" and right = "accommodating"
+  or
+  wrong = "accomadation" and right = "accommodation"
+  or
+  wrong = "accomadations" and right = "accommodations"
+  or
+  wrong = "accomdate" and right = "accommodate"
+  or
+  wrong = "accomodate" and right = "accommodate"
+  or
+  wrong = "accomodated" and right = "accommodated"
+  or
+  wrong = "accomodates" and right = "accommodates"
+  or
+  wrong = "accomodating" and right = "accommodating"
+  or
+  wrong = "accomodation" and right = "accommodation"
+  or
+  wrong = "accomodations" and right = "accommodations"
+  or
+  wrong = "accompanyed" and right = "accompanied"
+  or
+  wrong = "accordeon" and right = "accordion"
+  or
+  wrong = "accordian" and right = "accordion"
+  or
+  wrong = "accoring" and right = "according"
+  or
+  wrong = "accoustic" and right = "acoustic"
+  or
+  wrong = "accquainted" and right = "acquainted"
+  or
+  wrong = "accrediation" and right = "accreditation"
+  or
+  wrong = "accredidation" and right = "accreditation"
+  or
+  wrong = "accross" and right = "across"
+  or
+  wrong = "accussed" and right = "accused"
+  or
+  wrong = "acedemic" and right = "academic"
+  or
+  wrong = "acheive" and right = "achieve"
+  or
+  wrong = "acheived" and right = "achieved"
+  or
+  wrong = "acheivement" and right = "achievement"
+  or
+  wrong = "acheivements" and right = "achievements"
+  or
+  wrong = "acheives" and right = "achieves"
+  or
+  wrong = "acheiving" and right = "achieving"
+  or
+  wrong = "acheivment" and right = "achievement"
+  or
+  wrong = "acheivments" and right = "achievements"
+  or
+  wrong = "achievment" and right = "achievement"
+  or
+  wrong = "achievments" and right = "achievements"
+  or
+  wrong = "achive" and right = "achieve"
+  or
+  wrong = "achive" and right = "archive"
+  or
+  wrong = "achived" and right = "achieved"
+  or
+  wrong = "achived" and right = "archived"
+  or
+  wrong = "achivement" and right = "achievement"
+  or
+  wrong = "achivements" and right = "achievements"
+  or
+  wrong = "acident" and right = "accident"
+  or
+  wrong = "acknowldeged" and right = "acknowledged"
+  or
+  wrong = "acknowledgeing" and right = "acknowledging"
+  or
+  wrong = "ackward" and right = "awkward"
+  or
+  wrong = "ackward" and right = "backward"
+  or
+  wrong = "acommodate" and right = "accommodate"
+  or
+  wrong = "acomplish" and right = "accomplish"
+  or
+  wrong = "acomplished" and right = "accomplished"
+  or
+  wrong = "acomplishment" and right = "accomplishment"
+  or
+  wrong = "acomplishments" and right = "accomplishments"
+  or
+  wrong = "acording" and right = "according"
+  or
+  wrong = "acordingly" and right = "accordingly"
+  or
+  wrong = "acquaintence" and right = "acquaintance"
+  or
+  wrong = "acquaintences" and right = "acquaintances"
+  or
+  wrong = "acquiantence" and right = "acquaintance"
+  or
+  wrong = "acquiantences" and right = "acquaintances"
+  or
+  wrong = "acquited" and right = "acquitted"
+  or
+  wrong = "activites" and right = "activities"
+  or
+  wrong = "activly" and right = "actively"
+  or
+  wrong = "actualy" and right = "actually"
+  or
+  wrong = "acuracy" and right = "accuracy"
+  or
+  wrong = "acused" and right = "accused"
+  or
+  wrong = "acustom" and right = "accustom"
+  or
+  wrong = "acustommed" and right = "accustomed"
+  or
+  wrong = "adapater" and right = "adapter"
+  or
+  wrong = "adavanced" and right = "advanced"
+  or
+  wrong = "adbandon" and right = "abandon"
+  or
+  wrong = "addional" and right = "additional"
+  or
+  wrong = "addionally" and right = "additionally"
+  or
+  wrong = "additinally" and right = "additionally"
+  or
+  wrong = "additionaly" and right = "additionally"
+  or
+  wrong = "additonal" and right = "additional"
+  or
+  wrong = "additonally" and right = "additionally"
+  or
+  wrong = "addmission" and right = "admission"
+  or
+  wrong = "addopt" and right = "adopt"
+  or
+  wrong = "addopted" and right = "adopted"
+  or
+  wrong = "addoptive" and right = "adoptive"
+  or
+  wrong = "addres" and right = "adders"
+  or
+  wrong = "addres" and right = "address"
+  or
+  wrong = "addresable" and right = "addressable"
+  or
+  wrong = "addresed" and right = "addressed"
+  or
+  wrong = "addresing" and right = "addressing"
+  or
+  wrong = "addressess" and right = "addresses"
+  or
+  wrong = "addtion" and right = "addition"
+  or
+  wrong = "addtional" and right = "additional"
+  or
+  wrong = "adecuate" and right = "adequate"
+  or
+  wrong = "adequit" and right = "adequate"
+  or
+  wrong = "adhearing" and right = "adhering"
+  or
+  wrong = "adherance" and right = "adherence"
+  or
+  wrong = "admendment" and right = "amendment"
+  or
+  wrong = "admininistrative" and right = "administrative"
+  or
+  wrong = "adminstered" and right = "administered"
+  or
+  wrong = "adminstrate" and right = "administrate"
+  or
+  wrong = "adminstration" and right = "administration"
+  or
+  wrong = "adminstrative" and right = "administrative"
+  or
+  wrong = "adminstrator" and right = "administrator"
+  or
+  wrong = "admissability" and right = "admissibility"
+  or
+  wrong = "admissable" and right = "admissible"
+  or
+  wrong = "admited" and right = "admitted"
+  or
+  wrong = "admitedly" and right = "admittedly"
+  or
+  wrong = "adn" and right = "and"
+  or
+  wrong = "adolecent" and right = "adolescent"
+  or
+  wrong = "adquire" and right = "acquire"
+  or
+  wrong = "adquired" and right = "acquired"
+  or
+  wrong = "adquires" and right = "acquires"
+  or
+  wrong = "adquiring" and right = "acquiring"
+  or
+  wrong = "adres" and right = "address"
+  or
+  wrong = "adresable" and right = "addressable"
+  or
+  wrong = "adresing" and right = "addressing"
+  or
+  wrong = "adress" and right = "address"
+  or
+  wrong = "adressable" and right = "addressable"
+  or
+  wrong = "adressed" and right = "addressed"
+  or
+  wrong = "adressing" and right = "addressing"
+  or
+  wrong = "adressing" and right = "dressing"
+  or
+  wrong = "adventrous" and right = "adventurous"
+  or
+  wrong = "advertisment" and right = "advertisement"
+  or
+  wrong = "advertisments" and right = "advertisements"
+  or
+  wrong = "advesary" and right = "adversary"
+  or
+  wrong = "adviced" and right = "advised"
+  or
+  wrong = "aeriel" and right = "aerial"
+  or
+  wrong = "aeriels" and right = "aerials"
+  or
+  wrong = "afair" and right = "affair"
+  or
+  wrong = "afficianados" and right = "aficionados"
+  or
+  wrong = "afficionado" and right = "aficionado"
+  or
+  wrong = "afficionados" and right = "aficionados"
+  or
+  wrong = "affilate" and right = "affiliate"
+  or
+  wrong = "affilliate" and right = "affiliate"
+  or
+  wrong = "affort" and right = "afford"
+  or
+  wrong = "affort" and right = "effort"
+  or
+  wrong = "aforememtioned" and right = "aforementioned"
+  or
+  wrong = "againnst" and right = "against"
+  or
+  wrong = "agains" and right = "against"
+  or
+  wrong = "agaisnt" and right = "against"
+  or
+  wrong = "aganist" and right = "against"
+  or
+  wrong = "aggaravates" and right = "aggravates"
+  or
+  wrong = "aggreed" and right = "agreed"
+  or
+  wrong = "aggreement" and right = "agreement"
+  or
+  wrong = "aggregious" and right = "egregious"
+  or
+  wrong = "aggresive" and right = "aggressive"
+  or
+  wrong = "agian" and right = "again"
+  or
+  wrong = "agianst" and right = "against"
+  or
+  wrong = "agin" and right = "again"
+  or
+  wrong = "agina" and right = "again"
+  or
+  wrong = "agina" and right = "angina"
+  or
+  wrong = "aginst" and right = "against"
+  or
+  wrong = "agravate" and right = "aggravate"
+  or
+  wrong = "agre" and right = "agree"
+  or
+  wrong = "agred" and right = "agreed"
+  or
+  wrong = "agreeement" and right = "agreement"
+  or
+  wrong = "agreemnt" and right = "agreement"
+  or
+  wrong = "agregate" and right = "aggregate"
+  or
+  wrong = "agregates" and right = "aggregates"
+  or
+  wrong = "agreing" and right = "agreeing"
+  or
+  wrong = "agression" and right = "aggression"
+  or
+  wrong = "agressive" and right = "aggressive"
+  or
+  wrong = "agressively" and right = "aggressively"
+  or
+  wrong = "agressor" and right = "aggressor"
+  or
+  wrong = "agricultue" and right = "agriculture"
+  or
+  wrong = "agriculure" and right = "agriculture"
+  or
+  wrong = "agricuture" and right = "agriculture"
+  or
+  wrong = "agrieved" and right = "aggrieved"
+  or
+  wrong = "agrument" and right = "argument"
+  or
+  wrong = "agruments" and right = "arguments"
+  or
+  wrong = "ahev" and right = "have"
+  or
+  wrong = "ahppen" and right = "happen"
+  or
+  wrong = "ahve" and right = "have"
+  or
+  wrong = "aicraft" and right = "aircraft"
+  or
+  wrong = "aiport" and right = "airport"
+  or
+  wrong = "airbourne" and right = "airborne"
+  or
+  wrong = "aircaft" and right = "aircraft"
+  or
+  wrong = "aircrafts" and right = "aircraft"
+  or
+  wrong = "airporta" and right = "airports"
+  or
+  wrong = "airrcraft" and right = "aircraft"
+  or
+  wrong = "aisian" and right = "asian"
+  or
+  wrong = "albiet" and right = "albeit"
+  or
+  wrong = "alchohol" and right = "alcohol"
+  or
+  wrong = "alchoholic" and right = "alcoholic"
+  or
+  wrong = "alchol" and right = "alcohol"
+  or
+  wrong = "alcholic" and right = "alcoholic"
+  or
+  wrong = "alcohal" and right = "alcohol"
+  or
+  wrong = "alcoholical" and right = "alcoholic"
+  or
+  wrong = "aledge" and right = "allege"
+  or
+  wrong = "aledged" and right = "alleged"
+  or
+  wrong = "aledges" and right = "alleges"
+  or
+  wrong = "alege" and right = "allege"
+  or
+  wrong = "aleged" and right = "alleged"
+  or
+  wrong = "alegience" and right = "allegiance"
+  or
+  wrong = "algebraical" and right = "algebraic"
+  or
+  wrong = "algorhitms" and right = "algorithms"
+  or
+  wrong = "algoritm" and right = "algorithm"
+  or
+  wrong = "algoritms" and right = "algorithms"
+  or
+  wrong = "alientating" and right = "alienating"
+  or
+  wrong = "alledge" and right = "allege"
+  or
+  wrong = "alledged" and right = "alleged"
+  or
+  wrong = "alledgedly" and right = "allegedly"
+  or
+  wrong = "alledges" and right = "alleges"
+  or
+  wrong = "allegedely" and right = "allegedly"
+  or
+  wrong = "allegedy" and right = "allegedly"
+  or
+  wrong = "allegely" and right = "allegedly"
+  or
+  wrong = "allegence" and right = "allegiance"
+  or
+  wrong = "allegience" and right = "allegiance"
+  or
+  wrong = "allign" and right = "align"
+  or
+  wrong = "alligned" and right = "aligned"
+  or
+  wrong = "alliviate" and right = "alleviate"
+  or
+  wrong = "allopone" and right = "allophone"
+  or
+  wrong = "allopones" and right = "allophones"
+  or
+  wrong = "allready" and right = "already"
+  or
+  wrong = "allthough" and right = "although"
+  or
+  wrong = "alltogether" and right = "altogether"
+  or
+  wrong = "almsot" and right = "almost"
+  or
+  wrong = "alochol" and right = "alcohol"
+  or
+  wrong = "alomst" and right = "almost"
+  or
+  wrong = "alot" and right = "allot"
+  or
+  wrong = "alotted" and right = "allotted"
+  or
+  wrong = "alowed" and right = "allowed"
+  or
+  wrong = "alowing" and right = "allowing"
+  or
+  wrong = "alreayd" and right = "already"
+  or
+  wrong = "alse" and right = "else"
+  or
+  wrong = "alsot" and right = "also"
+  or
+  wrong = "alternitives" and right = "alternatives"
+  or
+  wrong = "altho" and right = "although"
+  or
+  wrong = "althought" and right = "although"
+  or
+  wrong = "altough" and right = "although"
+  or
+  wrong = "alusion" and right = "allusion"
+  or
+  wrong = "alusion" and right = "illusion"
+  or
+  wrong = "alwasy" and right = "always"
+  or
+  wrong = "alwyas" and right = "always"
+  or
+  wrong = "amalgomated" and right = "amalgamated"
+  or
+  wrong = "amatuer" and right = "amateur"
+  or
+  wrong = "amature" and right = "amateur"
+  or
+  wrong = "amature" and right = "armature"
+  or
+  wrong = "amendmant" and right = "amendment"
+  or
+  wrong = "amercia" and right = "america"
+  or
+  wrong = "amerliorate" and right = "ameliorate"
+  or
+  wrong = "amke" and right = "make"
+  or
+  wrong = "amking" and right = "making"
+  or
+  wrong = "ammend" and right = "amend"
+  or
+  wrong = "ammended" and right = "amended"
+  or
+  wrong = "ammendment" and right = "amendment"
+  or
+  wrong = "ammendments" and right = "amendments"
+  or
+  wrong = "ammount" and right = "amount"
+  or
+  wrong = "ammused" and right = "amused"
+  or
+  wrong = "amoung" and right = "among"
+  or
+  wrong = "amoungst" and right = "amongst"
+  or
+  wrong = "amung" and right = "among"
+  or
+  wrong = "amunition" and right = "ammunition"
+  or
+  wrong = "analagous" and right = "analogous"
+  or
+  wrong = "analitic" and right = "analytic"
+  or
+  wrong = "analogeous" and right = "analogous"
+  or
+  wrong = "anarchim" and right = "anarchism"
+  or
+  wrong = "anarchistm" and right = "anarchism"
+  or
+  wrong = "anbd" and right = "and"
+  or
+  wrong = "ancestory" and right = "ancestry"
+  or
+  wrong = "ancilliary" and right = "ancillary"
+  or
+  wrong = "andd" and right = "and"
+  or
+  wrong = "androgenous" and right = "androgynous"
+  or
+  wrong = "androgeny" and right = "androgyny"
+  or
+  wrong = "anihilation" and right = "annihilation"
+  or
+  wrong = "aniversary" and right = "anniversary"
+  or
+  wrong = "annoint" and right = "anoint"
+  or
+  wrong = "annointed" and right = "anointed"
+  or
+  wrong = "annointing" and right = "anointing"
+  or
+  wrong = "annoints" and right = "anoints"
+  or
+  wrong = "annouced" and right = "announced"
+  or
+  wrong = "annualy" and right = "annually"
+  or
+  wrong = "annuled" and right = "annulled"
+  or
+  wrong = "anohter" and right = "another"
+  or
+  wrong = "anomolies" and right = "anomalies"
+  or
+  wrong = "anomolous" and right = "anomalous"
+  or
+  wrong = "anomoly" and right = "anomaly"
+  or
+  wrong = "anonimity" and right = "anonymity"
+  or
+  wrong = "anounced" and right = "announced"
+  or
+  wrong = "anouncement" and right = "announcement"
+  or
+  wrong = "ansalisation" and right = "nasalisation"
+  or
+  wrong = "ansalization" and right = "nasalization"
+  or
+  wrong = "ansestors" and right = "ancestors"
+  or
+  wrong = "antartic" and right = "antarctic"
+  or
+  wrong = "anthromorphization" and right = "anthropomorphization"
+  or
+  wrong = "anthropolgist" and right = "anthropologist"
+  or
+  wrong = "anthropolgy" and right = "anthropology"
+  or
+  wrong = "anual" and right = "annual"
+  or
+  wrong = "anulled" and right = "annulled"
+  or
+  wrong = "anwsered" and right = "answered"
+  or
+  wrong = "anyhwere" and right = "anywhere"
+  or
+  wrong = "anytying" and right = "anything"
+  or
+  wrong = "aparent" and right = "apparent"
+  or
+  wrong = "aparment" and right = "apartment"
+  or
+  wrong = "apenines" and right = "apennines"
+  or
+  wrong = "aplication" and right = "application"
+  or
+  wrong = "aplied" and right = "applied"
+  or
+  wrong = "apolegetics" and right = "apologetics"
+  or
+  wrong = "apon" and right = "apron"
+  or
+  wrong = "apon" and right = "upon"
+  or
+  wrong = "apparant" and right = "apparent"
+  or
+  wrong = "apparantly" and right = "apparently"
+  or
+  wrong = "appart" and right = "apart"
+  or
+  wrong = "appartment" and right = "apartment"
+  or
+  wrong = "appartments" and right = "apartments"
+  or
+  wrong = "appealling" and right = "appalling"
+  or
+  wrong = "appealling" and right = "appealing"
+  or
+  wrong = "appeareance" and right = "appearance"
+  or
+  wrong = "appearence" and right = "appearance"
+  or
+  wrong = "appearences" and right = "appearances"
+  or
+  wrong = "appenines" and right = "apennines"
+  or
+  wrong = "apperance" and right = "appearance"
+  or
+  wrong = "apperances" and right = "appearances"
+  or
+  wrong = "appereance" and right = "appearance"
+  or
+  wrong = "appereances" and right = "appearances"
+  or
+  wrong = "applicaiton" and right = "application"
+  or
+  wrong = "applicaitons" and right = "applications"
+  or
+  wrong = "appologies" and right = "apologies"
+  or
+  wrong = "appology" and right = "apology"
+  or
+  wrong = "apprearance" and right = "appearance"
+  or
+  wrong = "apprieciate" and right = "appreciate"
+  or
+  wrong = "approachs" and right = "approaches"
+  or
+  wrong = "appropiate" and right = "appropriate"
+  or
+  wrong = "appropraite" and right = "appropriate"
+  or
+  wrong = "appropropiate" and right = "appropriate"
+  or
+  wrong = "approproximate" and right = "approximate"
+  or
+  wrong = "approxamately" and right = "approximately"
+  or
+  wrong = "approxiately" and right = "approximately"
+  or
+  wrong = "approximitely" and right = "approximately"
+  or
+  wrong = "aprehensive" and right = "apprehensive"
+  or
+  wrong = "apropriate" and right = "appropriate"
+  or
+  wrong = "aproval" and right = "approval"
+  or
+  wrong = "aproximate" and right = "approximate"
+  or
+  wrong = "aproximately" and right = "approximately"
+  or
+  wrong = "aquaduct" and right = "aqueduct"
+  or
+  wrong = "aquaintance" and right = "acquaintance"
+  or
+  wrong = "aquainted" and right = "acquainted"
+  or
+  wrong = "aquiantance" and right = "acquaintance"
+  or
+  wrong = "aquire" and right = "acquire"
+  or
+  wrong = "aquired" and right = "acquired"
+  or
+  wrong = "aquiring" and right = "acquiring"
+  or
+  wrong = "aquisition" and right = "acquisition"
+  or
+  wrong = "aquitted" and right = "acquitted"
+  or
+  wrong = "aranged" and right = "arranged"
+  or
+  wrong = "arangement" and right = "arrangement"
+  or
+  wrong = "arbitarily" and right = "arbitrarily"
+  or
+  wrong = "arbitary" and right = "arbitrary"
+  or
+  wrong = "archaelogical" and right = "archaeological"
+  or
+  wrong = "archaelogists" and right = "archaeologists"
+  or
+  wrong = "archaelogy" and right = "archaeology"
+  or
+  wrong = "archaoelogy" and right = "archaeology"
+  or
+  wrong = "archaoelogy" and right = "archeology"
+  or
+  wrong = "archaology" and right = "archaeology"
+  or
+  wrong = "archaology" and right = "archeology"
+  or
+  wrong = "archeaologist" and right = "archaeologist"
+  or
+  wrong = "archeaologist" and right = "archeologist"
+  or
+  wrong = "archeaologists" and right = "archaeologists"
+  or
+  wrong = "archeaologists" and right = "archeologists"
+  or
+  wrong = "archetect" and right = "architect"
+  or
+  wrong = "archetects" and right = "architects"
+  or
+  wrong = "archetectural" and right = "architectural"
+  or
+  wrong = "archetecturally" and right = "architecturally"
+  or
+  wrong = "archetecture" and right = "architecture"
+  or
+  wrong = "archiac" and right = "archaic"
+  or
+  wrong = "archictect" and right = "architect"
+  or
+  wrong = "archimedian" and right = "archimedean"
+  or
+  wrong = "architecht" and right = "architect"
+  or
+  wrong = "architechturally" and right = "architecturally"
+  or
+  wrong = "architechture" and right = "architecture"
+  or
+  wrong = "architechtures" and right = "architectures"
+  or
+  wrong = "architectual" and right = "architectural"
+  or
+  wrong = "archtype" and right = "archetype"
+  or
+  wrong = "archtypes" and right = "archetypes"
+  or
+  wrong = "aready" and right = "already"
+  or
+  wrong = "areodynamics" and right = "aerodynamics"
+  or
+  wrong = "argubly" and right = "arguably"
+  or
+  wrong = "arguement" and right = "argument"
+  or
+  wrong = "arguements" and right = "arguments"
+  or
+  wrong = "arised" and right = "arose"
+  or
+  wrong = "arival" and right = "arrival"
+  or
+  wrong = "armamant" and right = "armament"
+  or
+  wrong = "armistace" and right = "armistice"
+  or
+  wrong = "arogant" and right = "arrogant"
+  or
+  wrong = "arogent" and right = "arrogant"
+  or
+  wrong = "aroud" and right = "around"
+  or
+  wrong = "arrangment" and right = "arrangement"
+  or
+  wrong = "arrangments" and right = "arrangements"
+  or
+  wrong = "arrengement" and right = "arrangement"
+  or
+  wrong = "arrengements" and right = "arrangements"
+  or
+  wrong = "arround" and right = "around"
+  or
+  wrong = "artcile" and right = "article"
+  or
+  wrong = "artical" and right = "article"
+  or
+  wrong = "artice" and right = "article"
+  or
+  wrong = "articel" and right = "article"
+  or
+  wrong = "artifical" and right = "artificial"
+  or
+  wrong = "artifically" and right = "artificially"
+  or
+  wrong = "artillary" and right = "artillery"
+  or
+  wrong = "arund" and right = "around"
+  or
+  wrong = "asetic" and right = "ascetic"
+  or
+  wrong = "asign" and right = "assign"
+  or
+  wrong = "aslo" and right = "also"
+  or
+  wrong = "asnyc" and right = "async"
+  or
+  wrong = "asociated" and right = "associated"
+  or
+  wrong = "asorbed" and right = "absorbed"
+  or
+  wrong = "asphyxation" and right = "asphyxiation"
+  or
+  wrong = "assasin" and right = "assassin"
+  or
+  wrong = "assasinate" and right = "assassinate"
+  or
+  wrong = "assasinated" and right = "assassinated"
+  or
+  wrong = "assasinates" and right = "assassinates"
+  or
+  wrong = "assasination" and right = "assassination"
+  or
+  wrong = "assasinations" and right = "assassinations"
+  or
+  wrong = "assasined" and right = "assassinated"
+  or
+  wrong = "assasins" and right = "assassins"
+  or
+  wrong = "assassintation" and right = "assassination"
+  or
+  wrong = "assemple" and right = "assemble"
+  or
+  wrong = "assertation" and right = "assertion"
+  or
+  wrong = "asside" and right = "aside"
+  or
+  wrong = "assisnate" and right = "assassinate"
+  or
+  wrong = "assit" and right = "assist"
+  or
+  wrong = "assitant" and right = "assistant"
+  or
+  wrong = "assocation" and right = "association"
+  or
+  wrong = "assoicate" and right = "associate"
+  or
+  wrong = "assoicated" and right = "associated"
+  or
+  wrong = "assoicates" and right = "associates"
+  or
+  wrong = "assosication" and right = "assassination"
+  or
+  wrong = "asssassans" and right = "assassins"
+  or
+  wrong = "assualt" and right = "assault"
+  or
+  wrong = "assualted" and right = "assaulted"
+  or
+  wrong = "assymetric" and right = "asymmetric"
+  or
+  wrong = "assymetrical" and right = "asymmetrical"
+  or
+  wrong = "asteriod" and right = "asteroid"
+  or
+  wrong = "asthetic" and right = "aesthetic"
+  or
+  wrong = "asthetical" and right = "aesthetical"
+  or
+  wrong = "asthetically" and right = "aesthetically"
+  or
+  wrong = "asume" and right = "assume"
+  or
+  wrong = "atain" and right = "attain"
+  or
+  wrong = "atempting" and right = "attempting"
+  or
+  wrong = "atheistical" and right = "atheistic"
+  or
+  wrong = "athenean" and right = "athenian"
+  or
+  wrong = "atheneans" and right = "athenians"
+  or
+  wrong = "athiesm" and right = "atheism"
+  or
+  wrong = "athiest" and right = "atheist"
+  or
+  wrong = "atorney" and right = "attorney"
+  or
+  wrong = "atribute" and right = "attribute"
+  or
+  wrong = "atributed" and right = "attributed"
+  or
+  wrong = "atributes" and right = "attributes"
+  or
+  wrong = "attaindre" and right = "attainder"
+  or
+  wrong = "attaindre" and right = "attained"
+  or
+  wrong = "attemp" and right = "attempt"
+  or
+  wrong = "attemped" and right = "attempted"
+  or
+  wrong = "attemt" and right = "attempt"
+  or
+  wrong = "attemted" and right = "attempted"
+  or
+  wrong = "attemting" and right = "attempting"
+  or
+  wrong = "attemts" and right = "attempts"
+  or
+  wrong = "attendence" and right = "attendance"
+  or
+  wrong = "attendent" and right = "attendant"
+  or
+  wrong = "attendents" and right = "attendants"
+  or
+  wrong = "attened" and right = "attended"
+  or
+  wrong = "attension" and right = "attention"
+  or
+  wrong = "attitide" and right = "attitude"
+  or
+  wrong = "attributred" and right = "attributed"
+  or
+  wrong = "attrocities" and right = "atrocities"
+  or
+  wrong = "audeince" and right = "audience"
+  or
+  wrong = "auromated" and right = "automated"
+  or
+  wrong = "austrailia" and right = "australia"
+  or
+  wrong = "austrailian" and right = "australian"
+  or
+  wrong = "auther" and right = "author"
+  or
+  wrong = "authobiographic" and right = "autobiographic"
+  or
+  wrong = "authobiography" and right = "autobiography"
+  or
+  wrong = "authorative" and right = "authoritative"
+  or
+  wrong = "authorites" and right = "authorities"
+  or
+  wrong = "authorithy" and right = "authority"
+  or
+  wrong = "authoritiers" and right = "authorities"
+  or
+  wrong = "authoritive" and right = "authoritative"
+  or
+  wrong = "authrorities" and right = "authorities"
+  or
+  wrong = "autochtonous" and right = "autochthonous"
+  or
+  wrong = "autoctonous" and right = "autochthonous"
+  or
+  wrong = "automaticly" and right = "automatically"
+  or
+  wrong = "automibile" and right = "automobile"
+  or
+  wrong = "automonomous" and right = "autonomous"
+  or
+  wrong = "autor" and right = "author"
+  or
+  wrong = "autority" and right = "authority"
+  or
+  wrong = "auxilary" and right = "auxiliary"
+  or
+  wrong = "auxillaries" and right = "auxiliaries"
+  or
+  wrong = "auxillary" and right = "auxiliary"
+  or
+  wrong = "auxilliaries" and right = "auxiliaries"
+  or
+  wrong = "auxilliary" and right = "auxiliary"
+  or
+  wrong = "availabe" and right = "available"
+  or
+  wrong = "availablity" and right = "availability"
+  or
+  wrong = "availaible" and right = "available"
+  or
+  wrong = "availble" and right = "available"
+  or
+  wrong = "availiable" and right = "available"
+  or
+  wrong = "availible" and right = "available"
+  or
+  wrong = "avalable" and right = "available"
+  or
+  wrong = "avalance" and right = "avalanche"
+  or
+  wrong = "avaliable" and right = "available"
+  or
+  wrong = "avation" and right = "aviation"
+  or
+  wrong = "averageed" and right = "averaged"
+  or
+  wrong = "avilable" and right = "available"
+  or
+  wrong = "awared" and right = "awarded"
+  or
+  wrong = "awya" and right = "away"
+  or
+  wrong = "baceause" and right = "because"
+  or
+  wrong = "backgorund" and right = "background"
+  or
+  wrong = "backrounds" and right = "backgrounds"
+  or
+  wrong = "bakc" and right = "back"
+  or
+  wrong = "banannas" and right = "bananas"
+  or
+  wrong = "bandwith" and right = "bandwidth"
+  or
+  wrong = "bankrupcy" and right = "bankruptcy"
+  or
+  wrong = "banruptcy" and right = "bankruptcy"
+  or
+  wrong = "baout" and right = "about"
+  or
+  wrong = "baout" and right = "bout"
+  or
+  wrong = "basicaly" and right = "basically"
+  or
+  wrong = "basicly" and right = "basically"
+  or
+  wrong = "bcak" and right = "back"
+  or
+  wrong = "beachead" and right = "beachhead"
+  or
+  wrong = "beacuse" and right = "because"
+  or
+  wrong = "beastiality" and right = "bestiality"
+  or
+  wrong = "beatiful" and right = "beautiful"
+  or
+  wrong = "beaurocracy" and right = "bureaucracy"
+  or
+  wrong = "beaurocratic" and right = "bureaucratic"
+  or
+  wrong = "beautyfull" and right = "beautiful"
+  or
+  wrong = "becamae" and right = "became"
+  or
+  wrong = "becames" and right = "became"
+  or
+  wrong = "becames" and right = "becomes"
+  or
+  wrong = "becasue" and right = "because"
+  or
+  wrong = "beccause" and right = "because"
+  or
+  wrong = "becomeing" and right = "becoming"
+  or
+  wrong = "becomming" and right = "becoming"
+  or
+  wrong = "becouse" and right = "because"
+  or
+  wrong = "becuase" and right = "because"
+  or
+  wrong = "bedore" and right = "before"
+  or
+  wrong = "beeing" and right = "being"
+  or
+  wrong = "befoer" and right = "before"
+  or
+  wrong = "beggin" and right = "begging"
+  or
+  wrong = "beggin" and right = "begin"
+  or
+  wrong = "begginer" and right = "beginner"
+  or
+  wrong = "begginers" and right = "beginners"
+  or
+  wrong = "beggining" and right = "beginning"
+  or
+  wrong = "begginings" and right = "beginnings"
+  or
+  wrong = "beggins" and right = "begins"
+  or
+  wrong = "begining" and right = "beginning"
+  or
+  wrong = "beginnig" and right = "beginning"
+  or
+  wrong = "behavour" and right = "behavior"
+  or
+  wrong = "behavour" and right = "behaviour"
+  or
+  wrong = "beleagured" and right = "beleaguered"
+  or
+  wrong = "beleif" and right = "belief"
+  or
+  wrong = "beleive" and right = "believe"
+  or
+  wrong = "beleived" and right = "believed"
+  or
+  wrong = "beleives" and right = "believes"
+  or
+  wrong = "beleiving" and right = "believing"
+  or
+  wrong = "beligum" and right = "belgium"
+  or
+  wrong = "belive" and right = "believe"
+  or
+  wrong = "belived" and right = "believed"
+  or
+  wrong = "belived" and right = "beloved"
+  or
+  wrong = "belives" and right = "beliefs"
+  or
+  wrong = "belives" and right = "believes"
+  or
+  wrong = "belligerant" and right = "belligerent"
+  or
+  wrong = "bellweather" and right = "bellwether"
+  or
+  wrong = "bemusemnt" and right = "bemusement"
+  or
+  wrong = "beneficary" and right = "beneficiary"
+  or
+  wrong = "beng" and right = "being"
+  or
+  wrong = "benificial" and right = "beneficial"
+  or
+  wrong = "benifit" and right = "benefit"
+  or
+  wrong = "benifits" and right = "benefits"
+  or
+  wrong = "bergamont" and right = "bergamot"
+  or
+  wrong = "bernouilli" and right = "bernoulli"
+  or
+  wrong = "beseige" and right = "besiege"
+  or
+  wrong = "beseiged" and right = "besieged"
+  or
+  wrong = "beseiging" and right = "besieging"
+  or
+  wrong = "beteen" and right = "between"
+  or
+  wrong = "betwen" and right = "between"
+  or
+  wrong = "beween" and right = "between"
+  or
+  wrong = "bewteen" and right = "between"
+  or
+  wrong = "bigining" and right = "beginning"
+  or
+  wrong = "biginning" and right = "beginning"
+  or
+  wrong = "bilateraly" and right = "bilaterally"
+  or
+  wrong = "billingualism" and right = "bilingualism"
+  or
+  wrong = "binominal" and right = "binomial"
+  or
+  wrong = "bizzare" and right = "bizarre"
+  or
+  wrong = "blaim" and right = "blame"
+  or
+  wrong = "blaimed" and right = "blamed"
+  or
+  wrong = "blessure" and right = "blessing"
+  or
+  wrong = "blitzkreig" and right = "blitzkrieg"
+  or
+  wrong = "boaut" and right = "about"
+  or
+  wrong = "boaut" and right = "boat"
+  or
+  wrong = "boaut" and right = "bout"
+  or
+  wrong = "bodydbuilder" and right = "bodybuilder"
+  or
+  wrong = "bolean" and right = "boolean"
+  or
+  wrong = "bombardement" and right = "bombardment"
+  or
+  wrong = "bombarment" and right = "bombardment"
+  or
+  wrong = "bondary" and right = "boundary"
+  or
+  wrong = "bonnano" and right = "bonanno"
+  or
+  wrong = "boook" and right = "book"
+  or
+  wrong = "borke" and right = "broke"
+  or
+  wrong = "boundry" and right = "boundary"
+  or
+  wrong = "bouyancy" and right = "buoyancy"
+  or
+  wrong = "bouyant" and right = "buoyant"
+  or
+  wrong = "boyant" and right = "buoyant"
+  or
+  wrong = "bradcast" and right = "broadcast"
+  or
+  wrong = "brasillian" and right = "brazilian"
+  or
+  wrong = "breakthough" and right = "breakthrough"
+  or
+  wrong = "breakthroughts" and right = "breakthroughs"
+  or
+  wrong = "breif" and right = "brief"
+  or
+  wrong = "breifly" and right = "briefly"
+  or
+  wrong = "brethen" and right = "brethren"
+  or
+  wrong = "bretheren" and right = "brethren"
+  or
+  wrong = "briliant" and right = "brilliant"
+  or
+  wrong = "brillant" and right = "brilliant"
+  or
+  wrong = "brimestone" and right = "brimstone"
+  or
+  wrong = "britian" and right = "britain"
+  or
+  wrong = "brittish" and right = "british"
+  or
+  wrong = "broacasted" and right = "broadcast"
+  or
+  wrong = "broadacasting" and right = "broadcasting"
+  or
+  wrong = "broady" and right = "broadly"
+  or
+  wrong = "buddah" and right = "buddha"
+  or
+  wrong = "buddist" and right = "buddhist"
+  or
+  wrong = "buisness" and right = "business"
+  or
+  wrong = "buisnessman" and right = "businessman"
+  or
+  wrong = "buoancy" and right = "buoyancy"
+  or
+  wrong = "buring" and right = "burin"
+  or
+  wrong = "buring" and right = "burning"
+  or
+  wrong = "buring" and right = "burying"
+  or
+  wrong = "buring" and right = "during"
+  or
+  wrong = "burried" and right = "buried"
+  or
+  wrong = "busines" and right = "business"
+  or
+  wrong = "busineses" and right = "business"
+  or
+  wrong = "busineses" and right = "businesses"
+  or
+  wrong = "busness" and right = "business"
+  or
+  wrong = "bussiness" and right = "business"
+  or
+  wrong = "caculater" and right = "calculator"
+  or
+  wrong = "cacuses" and right = "caucuses"
+  or
+  wrong = "cahracters" and right = "characters"
+  or
+  wrong = "calaber" and right = "caliber"
+  or
+  wrong = "calander" and right = "calendar"
+  or
+  wrong = "calander" and right = "calender"
+  or
+  wrong = "calander" and right = "colander"
+  or
+  wrong = "calculater" and right = "calculator"
+  or
+  wrong = "calculs" and right = "calculus"
+  or
+  wrong = "calender" and right = "calendar"
+  or
+  wrong = "calenders" and right = "calendars"
+  or
+  wrong = "caligraphy" and right = "calligraphy"
+  or
+  wrong = "caluclate" and right = "calculate"
+  or
+  wrong = "caluclated" and right = "calculated"
+  or
+  wrong = "caluculate" and right = "calculate"
+  or
+  wrong = "caluculated" and right = "calculated"
+  or
+  wrong = "calulate" and right = "calculate"
+  or
+  wrong = "calulated" and right = "calculated"
+  or
+  wrong = "calulater" and right = "calculator"
+  or
+  wrong = "cambrige" and right = "cambridge"
+  or
+  wrong = "camoflage" and right = "camouflage"
+  or
+  wrong = "campagin" and right = "campaign"
+  or
+  wrong = "campain" and right = "campaign"
+  or
+  wrong = "campains" and right = "campaigns"
+  or
+  wrong = "candadate" and right = "candidate"
+  or
+  wrong = "candiate" and right = "candidate"
+  or
+  wrong = "candidiate" and right = "candidate"
+  or
+  wrong = "cannister" and right = "canister"
+  or
+  wrong = "cannisters" and right = "canisters"
+  or
+  wrong = "cannnot" and right = "cannot"
+  or
+  wrong = "cannonical" and right = "canonical"
+  or
+  wrong = "cannotation" and right = "connotation"
+  or
+  wrong = "cannotations" and right = "connotations"
+  or
+  wrong = "caost" and right = "coast"
+  or
+  wrong = "caperbility" and right = "capability"
+  or
+  wrong = "capible" and right = "capable"
+  or
+  wrong = "captial" and right = "capital"
+  or
+  wrong = "captued" and right = "captured"
+  or
+  wrong = "capturd" and right = "captured"
+  or
+  wrong = "carachter" and right = "character"
+  or
+  wrong = "caracterized" and right = "characterized"
+  or
+  wrong = "carcas" and right = "caracas"
+  or
+  wrong = "carcas" and right = "carcass"
+  or
+  wrong = "carefull" and right = "careful"
+  or
+  wrong = "careing" and right = "caring"
+  or
+  wrong = "carismatic" and right = "charismatic"
+  or
+  wrong = "carmalite" and right = "carmelite"
+  or
+  wrong = "carnagie" and right = "carnegie"
+  or
+  wrong = "carnege" and right = "carnage"
+  or
+  wrong = "carnege" and right = "carnegie"
+  or
+  wrong = "carnige" and right = "carnage"
+  or
+  wrong = "carnige" and right = "carnegie"
+  or
+  wrong = "carnigie" and right = "carnegie"
+  or
+  wrong = "carreer" and right = "career"
+  or
+  wrong = "carrers" and right = "careers"
+  or
+  wrong = "carribbean" and right = "caribbean"
+  or
+  wrong = "carribean" and right = "caribbean"
+  or
+  wrong = "carryng" and right = "carrying"
+  or
+  wrong = "cartdridge" and right = "cartridge"
+  or
+  wrong = "carthagian" and right = "carthaginian"
+  or
+  wrong = "carthographer" and right = "cartographer"
+  or
+  wrong = "cartilege" and right = "cartilage"
+  or
+  wrong = "cartilidge" and right = "cartilage"
+  or
+  wrong = "cartrige" and right = "cartridge"
+  or
+  wrong = "casette" and right = "cassette"
+  or
+  wrong = "casion" and right = "caisson"
+  or
+  wrong = "cassawory" and right = "cassowary"
+  or
+  wrong = "cassowarry" and right = "cassowary"
+  or
+  wrong = "casue" and right = "cause"
+  or
+  wrong = "casued" and right = "caused"
+  or
+  wrong = "casues" and right = "causes"
+  or
+  wrong = "casuing" and right = "causing"
+  or
+  wrong = "casulaties" and right = "casualties"
+  or
+  wrong = "casulaty" and right = "casualty"
+  or
+  wrong = "catagories" and right = "categories"
+  or
+  wrong = "catagorized" and right = "categorized"
+  or
+  wrong = "catagory" and right = "category"
+  or
+  wrong = "cataline" and right = "catalina"
+  or
+  wrong = "cataline" and right = "catiline"
+  or
+  wrong = "catapillar" and right = "caterpillar"
+  or
+  wrong = "catapillars" and right = "caterpillars"
+  or
+  wrong = "catapiller" and right = "caterpillar"
+  or
+  wrong = "catapillers" and right = "caterpillars"
+  or
+  wrong = "catepillar" and right = "caterpillar"
+  or
+  wrong = "catepillars" and right = "caterpillars"
+  or
+  wrong = "catergorize" and right = "categorize"
+  or
+  wrong = "catergorized" and right = "categorized"
+  or
+  wrong = "caterpilar" and right = "caterpillar"
+  or
+  wrong = "caterpilars" and right = "caterpillars"
+  or
+  wrong = "caterpiller" and right = "caterpillar"
+  or
+  wrong = "caterpillers" and right = "caterpillars"
+  or
+  wrong = "cathlic" and right = "catholic"
+  or
+  wrong = "catholocism" and right = "catholicism"
+  or
+  wrong = "catterpilar" and right = "caterpillar"
+  or
+  wrong = "catterpilars" and right = "caterpillars"
+  or
+  wrong = "catterpillar" and right = "caterpillar"
+  or
+  wrong = "catterpillars" and right = "caterpillars"
+  or
+  wrong = "cattleship" and right = "battleship"
+  or
+  wrong = "causalities" and right = "casualties"
+  or
+  wrong = "ceasar" and right = "caesar"
+  or
+  wrong = "celcius" and right = "celsius"
+  or
+  wrong = "cellpading" and right = "cellpadding"
+  or
+  wrong = "cementary" and right = "cemetery"
+  or
+  wrong = "cemetarey" and right = "cemetery"
+  or
+  wrong = "cemetaries" and right = "cemeteries"
+  or
+  wrong = "cemetary" and right = "cemetery"
+  or
+  wrong = "cencus" and right = "census"
+  or
+  wrong = "censur" and right = "censor"
+  or
+  wrong = "censur" and right = "censure"
+  or
+  wrong = "cententenial" and right = "centennial"
+  or
+  wrong = "centruies" and right = "centuries"
+  or
+  wrong = "centruy" and right = "century"
+  or
+  wrong = "centuties" and right = "centuries"
+  or
+  wrong = "centuty" and right = "century"
+  or
+  wrong = "ceratin" and right = "certain"
+  or
+  wrong = "ceratin" and right = "keratin"
+  or
+  wrong = "cerimonial" and right = "ceremonial"
+  or
+  wrong = "cerimonies" and right = "ceremonies"
+  or
+  wrong = "cerimonious" and right = "ceremonious"
+  or
+  wrong = "cerimony" and right = "ceremony"
+  or
+  wrong = "ceromony" and right = "ceremony"
+  or
+  wrong = "certainity" and right = "certainty"
+  or
+  wrong = "certian" and right = "certain"
+  or
+  wrong = "cervial" and right = "cervical"
+  or
+  wrong = "cervial" and right = "serval"
+  or
+  wrong = "cervial" and right = "servile"
+  or
+  wrong = "chalenging" and right = "challenging"
+  or
+  wrong = "challange" and right = "challenge"
+  or
+  wrong = "challanged" and right = "challenged"
+  or
+  wrong = "challege" and right = "challenge"
+  or
+  wrong = "champange" and right = "champagne"
+  or
+  wrong = "changable" and right = "changeable"
+  or
+  wrong = "charachter" and right = "character"
+  or
+  wrong = "charachters" and right = "characters"
+  or
+  wrong = "charactersistic" and right = "characteristic"
+  or
+  wrong = "charactor" and right = "character"
+  or
+  wrong = "charactors" and right = "characters"
+  or
+  wrong = "charasmatic" and right = "charismatic"
+  or
+  wrong = "charaterized" and right = "characterized"
+  or
+  wrong = "chariman" and right = "chairman"
+  or
+  wrong = "charistics" and right = "characteristics"
+  or
+  wrong = "chasr" and right = "chase"
+  or
+  wrong = "chasr" and right = "chaser"
+  or
+  wrong = "cheif" and right = "chief"
+  or
+  wrong = "cheifs" and right = "chiefs"
+  or
+  wrong = "chemcial" and right = "chemical"
+  or
+  wrong = "chemcially" and right = "chemically"
+  or
+  wrong = "chemestry" and right = "chemistry"
+  or
+  wrong = "chemicaly" and right = "chemically"
+  or
+  wrong = "childbird" and right = "childbirth"
+  or
+  wrong = "childen" and right = "children"
+  or
+  wrong = "choclate" and right = "chocolate"
+  or
+  wrong = "choosen" and right = "chosen"
+  or
+  wrong = "chracter" and right = "character"
+  or
+  wrong = "chuch" and right = "church"
+  or
+  wrong = "churchs" and right = "churches"
+  or
+  wrong = "cincinatti" and right = "cincinnati"
+  or
+  wrong = "cincinnatti" and right = "cincinnati"
+  or
+  wrong = "circulaton" and right = "circulation"
+  or
+  wrong = "circumsicion" and right = "circumcision"
+  or
+  wrong = "circut" and right = "circuit"
+  or
+  wrong = "ciricuit" and right = "circuit"
+  or
+  wrong = "ciriculum" and right = "curriculum"
+  or
+  wrong = "civillian" and right = "civilian"
+  or
+  wrong = "claer" and right = "clear"
+  or
+  wrong = "claerer" and right = "clearer"
+  or
+  wrong = "claerly" and right = "clearly"
+  or
+  wrong = "claimes" and right = "claims"
+  or
+  wrong = "clas" and right = "class"
+  or
+  wrong = "clasic" and right = "classic"
+  or
+  wrong = "clasical" and right = "classical"
+  or
+  wrong = "clasically" and right = "classically"
+  or
+  wrong = "cleareance" and right = "clearance"
+  or
+  wrong = "clera" and right = "clear"
+  or
+  wrong = "clera" and right = "sclera"
+  or
+  wrong = "clincial" and right = "clinical"
+  or
+  wrong = "clinicaly" and right = "clinically"
+  or
+  wrong = "cmo" and right = "com"
+  or
+  wrong = "cmoputer" and right = "computer"
+  or
+  wrong = "coctail" and right = "cocktail"
+  or
+  wrong = "coform" and right = "conform"
+  or
+  wrong = "cognizent" and right = "cognizant"
+  or
+  wrong = "coincedentally" and right = "coincidentally"
+  or
+  wrong = "colaborations" and right = "collaborations"
+  or
+  wrong = "colateral" and right = "collateral"
+  or
+  wrong = "colelctive" and right = "collective"
+  or
+  wrong = "collaberative" and right = "collaborative"
+  or
+  wrong = "collecton" and right = "collection"
+  or
+  wrong = "collegue" and right = "colleague"
+  or
+  wrong = "collegues" and right = "colleagues"
+  or
+  wrong = "collonade" and right = "colonnade"
+  or
+  wrong = "collonies" and right = "colonies"
+  or
+  wrong = "collony" and right = "colony"
+  or
+  wrong = "collosal" and right = "colossal"
+  or
+  wrong = "colonizators" and right = "colonizers"
+  or
+  wrong = "comander" and right = "commandeer"
+  or
+  wrong = "comander" and right = "commander"
+  or
+  wrong = "comando" and right = "commando"
+  or
+  wrong = "comandos" and right = "commandos"
+  or
+  wrong = "comany" and right = "company"
+  or
+  wrong = "comapany" and right = "company"
+  or
+  wrong = "comback" and right = "comeback"
+  or
+  wrong = "combanations" and right = "combinations"
+  or
+  wrong = "combinatins" and right = "combinations"
+  or
+  wrong = "combusion" and right = "combustion"
+  or
+  wrong = "comdemnation" and right = "condemnation"
+  or
+  wrong = "comemmorates" and right = "commemorates"
+  or
+  wrong = "comemoretion" and right = "commemoration"
+  or
+  wrong = "comision" and right = "commission"
+  or
+  wrong = "comisioned" and right = "commissioned"
+  or
+  wrong = "comisioner" and right = "commissioner"
+  or
+  wrong = "comisioning" and right = "commissioning"
+  or
+  wrong = "comisions" and right = "commissions"
+  or
+  wrong = "comission" and right = "commission"
+  or
+  wrong = "comissioned" and right = "commissioned"
+  or
+  wrong = "comissioner" and right = "commissioner"
+  or
+  wrong = "comissioning" and right = "commissioning"
+  or
+  wrong = "comissions" and right = "commissions"
+  or
+  wrong = "comited" and right = "committed"
+  or
+  wrong = "comiting" and right = "committing"
+  or
+  wrong = "comitted" and right = "committed"
+  or
+  wrong = "comittee" and right = "committee"
+  or
+  wrong = "comitting" and right = "committing"
+  or
+  wrong = "commandoes" and right = "commandos"
+  or
+  wrong = "commedic" and right = "comedic"
+  or
+  wrong = "commemerative" and right = "commemorative"
+  or
+  wrong = "commemmorate" and right = "commemorate"
+  or
+  wrong = "commemmorating" and right = "commemorating"
+  or
+  wrong = "commerical" and right = "commercial"
+  or
+  wrong = "commerically" and right = "commercially"
+  or
+  wrong = "commericial" and right = "commercial"
+  or
+  wrong = "commericially" and right = "commercially"
+  or
+  wrong = "commerorative" and right = "commemorative"
+  or
+  wrong = "comming" and right = "coming"
+  or
+  wrong = "comminication" and right = "communication"
+  or
+  wrong = "commision" and right = "commission"
+  or
+  wrong = "commisioned" and right = "commissioned"
+  or
+  wrong = "commisioner" and right = "commissioner"
+  or
+  wrong = "commisioning" and right = "commissioning"
+  or
+  wrong = "commisions" and right = "commissions"
+  or
+  wrong = "commited" and right = "committed"
+  or
+  wrong = "commitee" and right = "committee"
+  or
+  wrong = "commiting" and right = "committing"
+  or
+  wrong = "committe" and right = "committee"
+  or
+  wrong = "committment" and right = "commitment"
+  or
+  wrong = "committments" and right = "commitments"
+  or
+  wrong = "commmemorated" and right = "commemorated"
+  or
+  wrong = "commongly" and right = "commonly"
+  or
+  wrong = "commonweath" and right = "commonwealth"
+  or
+  wrong = "commuications" and right = "communications"
+  or
+  wrong = "commuinications" and right = "communications"
+  or
+  wrong = "communciation" and right = "communication"
+  or
+  wrong = "communiation" and right = "communication"
+  or
+  wrong = "communites" and right = "communities"
+  or
+  wrong = "compability" and right = "compatibility"
+  or
+  wrong = "comparision" and right = "comparison"
+  or
+  wrong = "comparisions" and right = "comparisons"
+  or
+  wrong = "comparitive" and right = "comparative"
+  or
+  wrong = "comparitively" and right = "comparatively"
+  or
+  wrong = "compatabilities" and right = "compatibilities"
+  or
+  wrong = "compatability" and right = "compatibility"
+  or
+  wrong = "compatable" and right = "compatible"
+  or
+  wrong = "compatablities" and right = "compatibilities"
+  or
+  wrong = "compatablity" and right = "compatibility"
+  or
+  wrong = "compatiable" and right = "compatible"
+  or
+  wrong = "compatiblities" and right = "compatibilities"
+  or
+  wrong = "compatiblity" and right = "compatibility"
+  or
+  wrong = "compeitions" and right = "competitions"
+  or
+  wrong = "compensantion" and right = "compensation"
+  or
+  wrong = "competance" and right = "competence"
+  or
+  wrong = "competant" and right = "competent"
+  or
+  wrong = "competative" and right = "competitive"
+  or
+  wrong = "competion" and right = "competition"
+  or
+  wrong = "competion" and right = "completion"
+  or
+  wrong = "competitiion" and right = "competition"
+  or
+  wrong = "competive" and right = "competitive"
+  or
+  wrong = "competiveness" and right = "competitiveness"
+  or
+  wrong = "comphrehensive" and right = "comprehensive"
+  or
+  wrong = "compitent" and right = "competent"
+  or
+  wrong = "completelyl" and right = "completely"
+  or
+  wrong = "completetion" and right = "completion"
+  or
+  wrong = "complier" and right = "compiler"
+  or
+  wrong = "componant" and right = "component"
+  or
+  wrong = "comprable" and right = "comparable"
+  or
+  wrong = "comprimise" and right = "compromise"
+  or
+  wrong = "compulsary" and right = "compulsory"
+  or
+  wrong = "compulsery" and right = "compulsory"
+  or
+  wrong = "computarized" and right = "computerized"
+  or
+  wrong = "concensus" and right = "consensus"
+  or
+  wrong = "concider" and right = "consider"
+  or
+  wrong = "concidered" and right = "considered"
+  or
+  wrong = "concidering" and right = "considering"
+  or
+  wrong = "conciders" and right = "considers"
+  or
+  wrong = "concieted" and right = "conceited"
+  or
+  wrong = "concieved" and right = "conceived"
+  or
+  wrong = "concious" and right = "conscious"
+  or
+  wrong = "conciously" and right = "consciously"
+  or
+  wrong = "conciousness" and right = "consciousness"
+  or
+  wrong = "condamned" and right = "condemned"
+  or
+  wrong = "condemmed" and right = "condemned"
+  or
+  wrong = "condidtion" and right = "condition"
+  or
+  wrong = "condidtions" and right = "conditions"
+  or
+  wrong = "conected" and right = "connected"
+  or
+  wrong = "conection" and right = "connection"
+  or
+  wrong = "conesencus" and right = "consensus"
+  or
+  wrong = "confidental" and right = "confidential"
+  or
+  wrong = "confidentally" and right = "confidentially"
+  or
+  wrong = "confids" and right = "confides"
+  or
+  wrong = "configureable" and right = "configurable"
+  or
+  wrong = "confortable" and right = "comfortable"
+  or
+  wrong = "congradulations" and right = "congratulations"
+  or
+  wrong = "congresional" and right = "congressional"
+  or
+  wrong = "conived" and right = "connived"
+  or
+  wrong = "conjecutre" and right = "conjecture"
+  or
+  wrong = "conjuction" and right = "conjunction"
+  or
+  wrong = "connectinos" and right = "connections"
+  or
+  wrong = "conneticut" and right = "connecticut"
+  or
+  wrong = "conotations" and right = "connotations"
+  or
+  wrong = "conquerd" and right = "conquered"
+  or
+  wrong = "conquerer" and right = "conqueror"
+  or
+  wrong = "conquerers" and right = "conquerors"
+  or
+  wrong = "conqured" and right = "conquered"
+  or
+  wrong = "conscent" and right = "consent"
+  or
+  wrong = "consciouness" and right = "consciousness"
+  or
+  wrong = "consdider" and right = "consider"
+  or
+  wrong = "consdidered" and right = "considered"
+  or
+  wrong = "consdiered" and right = "considered"
+  or
+  wrong = "consectutive" and right = "consecutive"
+  or
+  wrong = "consenquently" and right = "consequently"
+  or
+  wrong = "consentrate" and right = "concentrate"
+  or
+  wrong = "consentrated" and right = "concentrated"
+  or
+  wrong = "consentrates" and right = "concentrates"
+  or
+  wrong = "consept" and right = "concept"
+  or
+  wrong = "consequentually" and right = "consequently"
+  or
+  wrong = "consequeseces" and right = "consequences"
+  or
+  wrong = "consern" and right = "concern"
+  or
+  wrong = "conserned" and right = "concerned"
+  or
+  wrong = "conserning" and right = "concerning"
+  or
+  wrong = "conservitive" and right = "conservative"
+  or
+  wrong = "consiciousness" and right = "consciousness"
+  or
+  wrong = "consicousness" and right = "consciousness"
+  or
+  wrong = "considerd" and right = "considered"
+  or
+  wrong = "consideres" and right = "considered"
+  or
+  wrong = "consious" and right = "conscious"
+  or
+  wrong = "consistant" and right = "consistent"
+  or
+  wrong = "consistantly" and right = "consistently"
+  or
+  wrong = "consituencies" and right = "constituencies"
+  or
+  wrong = "consituency" and right = "constituency"
+  or
+  wrong = "consituted" and right = "constituted"
+  or
+  wrong = "consitution" and right = "constitution"
+  or
+  wrong = "consitutional" and right = "constitutional"
+  or
+  wrong = "consolodate" and right = "consolidate"
+  or
+  wrong = "consolodated" and right = "consolidated"
+  or
+  wrong = "consonent" and right = "consonant"
+  or
+  wrong = "consonents" and right = "consonants"
+  or
+  wrong = "consorcium" and right = "consortium"
+  or
+  wrong = "conspiracys" and right = "conspiracies"
+  or
+  wrong = "conspiriator" and right = "conspirator"
+  or
+  wrong = "consructor" and right = "constructor"
+  or
+  wrong = "constaints" and right = "constraints"
+  or
+  wrong = "constanly" and right = "constantly"
+  or
+  wrong = "constarnation" and right = "consternation"
+  or
+  wrong = "constatn" and right = "constant"
+  or
+  wrong = "constinually" and right = "continually"
+  or
+  wrong = "constituant" and right = "constituent"
+  or
+  wrong = "constituants" and right = "constituents"
+  or
+  wrong = "constituion" and right = "constitution"
+  or
+  wrong = "constituional" and right = "constitutional"
+  or
+  wrong = "consttruction" and right = "construction"
+  or
+  wrong = "constuction" and right = "construction"
+  or
+  wrong = "consulant" and right = "consultant"
+  or
+  wrong = "consumate" and right = "consummate"
+  or
+  wrong = "consumated" and right = "consummated"
+  or
+  wrong = "contaiminate" and right = "contaminate"
+  or
+  wrong = "containes" and right = "contains"
+  or
+  wrong = "contamporaries" and right = "contemporaries"
+  or
+  wrong = "contamporary" and right = "contemporary"
+  or
+  wrong = "contempoary" and right = "contemporary"
+  or
+  wrong = "contemporaneus" and right = "contemporaneous"
+  or
+  wrong = "contempory" and right = "contemporary"
+  or
+  wrong = "contendor" and right = "contender"
+  or
+  wrong = "contian" and right = "contain"
+  or
+  wrong = "contians" and right = "contains"
+  or
+  wrong = "contibute" and right = "contribute"
+  or
+  wrong = "contibuted" and right = "contributed"
+  or
+  wrong = "contibutes" and right = "contributes"
+  or
+  wrong = "contigent" and right = "contingent"
+  or
+  wrong = "contined" and right = "continued"
+  or
+  wrong = "continential" and right = "continental"
+  or
+  wrong = "continous" and right = "continuous"
+  or
+  wrong = "continously" and right = "continuously"
+  or
+  wrong = "continueing" and right = "continuing"
+  or
+  wrong = "contravercial" and right = "controversial"
+  or
+  wrong = "contraversy" and right = "controversy"
+  or
+  wrong = "contributer" and right = "contributor"
+  or
+  wrong = "contributers" and right = "contributors"
+  or
+  wrong = "contritutions" and right = "contributions"
+  or
+  wrong = "controled" and right = "controlled"
+  or
+  wrong = "controling" and right = "controlling"
+  or
+  wrong = "controll" and right = "control"
+  or
+  wrong = "controlls" and right = "controls"
+  or
+  wrong = "controvercial" and right = "controversial"
+  or
+  wrong = "controvercy" and right = "controversy"
+  or
+  wrong = "controveries" and right = "controversies"
+  or
+  wrong = "controversal" and right = "controversial"
+  or
+  wrong = "controversey" and right = "controversy"
+  or
+  wrong = "controvertial" and right = "controversial"
+  or
+  wrong = "controvery" and right = "controversy"
+  or
+  wrong = "contruction" and right = "construction"
+  or
+  wrong = "contructor" and right = "constructor"
+  or
+  wrong = "contstruction" and right = "construction"
+  or
+  wrong = "conveinent" and right = "convenient"
+  or
+  wrong = "convenant" and right = "covenant"
+  or
+  wrong = "convential" and right = "conventional"
+  or
+  wrong = "convertables" and right = "convertibles"
+  or
+  wrong = "convertion" and right = "conversion"
+  or
+  wrong = "conviced" and right = "convinced"
+  or
+  wrong = "convienient" and right = "convenient"
+  or
+  wrong = "coordiantion" and right = "coordination"
+  or
+  wrong = "coorperation" and right = "cooperation"
+  or
+  wrong = "coorperation" and right = "corporation"
+  or
+  wrong = "coorperations" and right = "corporations"
+  or
+  wrong = "copmetitors" and right = "competitors"
+  or
+  wrong = "coputer" and right = "computer"
+  or
+  wrong = "copywrite" and right = "copyright"
+  or
+  wrong = "coridal" and right = "cordial"
+  or
+  wrong = "cornmitted" and right = "committed"
+  or
+  wrong = "corosion" and right = "corrosion"
+  or
+  wrong = "corparate" and right = "corporate"
+  or
+  wrong = "corperations" and right = "corporations"
+  or
+  wrong = "correcters" and right = "correctors"
+  or
+  wrong = "correponding" and right = "corresponding"
+  or
+  wrong = "correposding" and right = "corresponding"
+  or
+  wrong = "correspondant" and right = "correspondent"
+  or
+  wrong = "correspondants" and right = "correspondents"
+  or
+  wrong = "corridoors" and right = "corridors"
+  or
+  wrong = "corrispond" and right = "correspond"
+  or
+  wrong = "corrispondant" and right = "correspondent"
+  or
+  wrong = "corrispondants" and right = "correspondents"
+  or
+  wrong = "corrisponded" and right = "corresponded"
+  or
+  wrong = "corrisponding" and right = "corresponding"
+  or
+  wrong = "corrisponds" and right = "corresponds"
+  or
+  wrong = "costitution" and right = "constitution"
+  or
+  wrong = "coucil" and right = "council"
+  or
+  wrong = "coudl" and right = "cloud"
+  or
+  wrong = "coudl" and right = "could"
+  or
+  wrong = "councellor" and right = "councillor"
+  or
+  wrong = "councellor" and right = "councilor"
+  or
+  wrong = "councellor" and right = "counselor"
+  or
+  wrong = "councellors" and right = "councillors"
+  or
+  wrong = "councellors" and right = "councilors"
+  or
+  wrong = "councellors" and right = "counselors"
+  or
+  wrong = "counries" and right = "countries"
+  or
+  wrong = "countains" and right = "contains"
+  or
+  wrong = "countires" and right = "countries"
+  or
+  wrong = "coururier" and right = "courier"
+  or
+  wrong = "coururier" and right = "couturier"
+  or
+  wrong = "coverted" and right = "converted"
+  or
+  wrong = "coverted" and right = "covered"
+  or
+  wrong = "coverted" and right = "coveted"
+  or
+  wrong = "cpoy" and right = "copy"
+  or
+  wrong = "cpoy" and right = "coy"
+  or
+  wrong = "creaeted" and right = "created"
+  or
+  wrong = "creedence" and right = "credence"
+  or
+  wrong = "critereon" and right = "criterion"
+  or
+  wrong = "criterias" and right = "criteria"
+  or
+  wrong = "criticists" and right = "critics"
+  or
+  wrong = "critising" and right = "criticising"
+  or
+  wrong = "critising" and right = "criticizing"
+  or
+  wrong = "critisising" and right = "criticising"
+  or
+  wrong = "critisism" and right = "criticism"
+  or
+  wrong = "critisisms" and right = "criticisms"
+  or
+  wrong = "critisize" and right = "criticise"
+  or
+  wrong = "critisize" and right = "criticize"
+  or
+  wrong = "critisized" and right = "criticised"
+  or
+  wrong = "critisized" and right = "criticized"
+  or
+  wrong = "critisizes" and right = "criticises"
+  or
+  wrong = "critisizes" and right = "criticizes"
+  or
+  wrong = "critisizing" and right = "criticising"
+  or
+  wrong = "critisizing" and right = "criticizing"
+  or
+  wrong = "critized" and right = "criticized"
+  or
+  wrong = "critizing" and right = "criticizing"
+  or
+  wrong = "crockodiles" and right = "crocodiles"
+  or
+  wrong = "crowm" and right = "crown"
+  or
+  wrong = "crtical" and right = "critical"
+  or
+  wrong = "crticised" and right = "criticised"
+  or
+  wrong = "crucifiction" and right = "crucifixion"
+  or
+  wrong = "crusies" and right = "cruises"
+  or
+  wrong = "crutial" and right = "crucial"
+  or
+  wrong = "crystalisation" and right = "crystallisation"
+  or
+  wrong = "culiminating" and right = "culminating"
+  or
+  wrong = "cumulatative" and right = "cumulative"
+  or
+  wrong = "curch" and right = "church"
+  or
+  wrong = "curcuit" and right = "circuit"
+  or
+  wrong = "currenly" and right = "currently"
+  or
+  wrong = "curriculem" and right = "curriculum"
+  or
+  wrong = "cxan" and right = "cyan"
+  or
+  wrong = "cyclinder" and right = "cylinder"
+  or
+  wrong = "dacquiri" and right = "daiquiri"
+  or
+  wrong = "daed" and right = "dead"
+  or
+  wrong = "dael" and right = "dahl"
+  or
+  wrong = "dael" and right = "deal"
+  or
+  wrong = "dael" and right = "dial"
+  or
+  wrong = "dalmation" and right = "dalmatian"
+  or
+  wrong = "damenor" and right = "demeanor"
+  or
+  wrong = "dammage" and right = "damage"
+  or
+  wrong = "dardenelles" and right = "dardanelles"
+  or
+  wrong = "daugher" and right = "daughter"
+  or
+  wrong = "deafult" and right = "default"
+  or
+  wrong = "debateable" and right = "debatable"
+  or
+  wrong = "decendant" and right = "descendant"
+  or
+  wrong = "decendants" and right = "descendants"
+  or
+  wrong = "decendent" and right = "descendant"
+  or
+  wrong = "decendents" and right = "descendants"
+  or
+  wrong = "decideable" and right = "decidable"
+  or
+  wrong = "decidely" and right = "decidedly"
+  or
+  wrong = "decieved" and right = "deceived"
+  or
+  wrong = "decison" and right = "decision"
+  or
+  wrong = "decomissioned" and right = "decommissioned"
+  or
+  wrong = "decomposit" and right = "decompose"
+  or
+  wrong = "decomposited" and right = "decomposed"
+  or
+  wrong = "decompositing" and right = "decomposing"
+  or
+  wrong = "decomposits" and right = "decomposes"
+  or
+  wrong = "decress" and right = "decrees"
+  or
+  wrong = "decribe" and right = "describe"
+  or
+  wrong = "decribed" and right = "described"
+  or
+  wrong = "decribes" and right = "describes"
+  or
+  wrong = "decribing" and right = "describing"
+  or
+  wrong = "dectect" and right = "detect"
+  or
+  wrong = "defendent" and right = "defendant"
+  or
+  wrong = "defendents" and right = "defendants"
+  or
+  wrong = "deffensively" and right = "defensively"
+  or
+  wrong = "deffine" and right = "define"
+  or
+  wrong = "deffined" and right = "defined"
+  or
+  wrong = "definance" and right = "defiance"
+  or
+  wrong = "definate" and right = "definite"
+  or
+  wrong = "definately" and right = "definitely"
+  or
+  wrong = "definatly" and right = "definitely"
+  or
+  wrong = "definetly" and right = "definitely"
+  or
+  wrong = "definining" and right = "defining"
+  or
+  wrong = "definit" and right = "definite"
+  or
+  wrong = "definitly" and right = "definitely"
+  or
+  wrong = "definiton" and right = "definition"
+  or
+  wrong = "defintion" and right = "definition"
+  or
+  wrong = "defualt" and right = "default"
+  or
+  wrong = "defult" and right = "default"
+  or
+  wrong = "degrate" and right = "degrade"
+  or
+  wrong = "delagates" and right = "delegates"
+  or
+  wrong = "delapidated" and right = "dilapidated"
+  or
+  wrong = "delerious" and right = "delirious"
+  or
+  wrong = "delevopment" and right = "development"
+  or
+  wrong = "deliberatly" and right = "deliberately"
+  or
+  wrong = "delusionally" and right = "delusively"
+  or
+  wrong = "demenor" and right = "demeanor"
+  or
+  wrong = "demographical" and right = "demographic"
+  or
+  wrong = "demolision" and right = "demolition"
+  or
+  wrong = "demorcracy" and right = "democracy"
+  or
+  wrong = "demostration" and right = "demonstration"
+  or
+  wrong = "denegrating" and right = "denigrating"
+  or
+  wrong = "densly" and right = "densely"
+  or
+  wrong = "deparment" and right = "department"
+  or
+  wrong = "deparmental" and right = "departmental"
+  or
+  wrong = "deparments" and right = "departments"
+  or
+  wrong = "dependance" and right = "dependence"
+  or
+  wrong = "dependancy" and right = "dependency"
+  or
+  wrong = "deram" and right = "dram"
+  or
+  wrong = "deram" and right = "dream"
+  or
+  wrong = "deriviated" and right = "derived"
+  or
+  wrong = "derivitive" and right = "derivative"
+  or
+  wrong = "derogitory" and right = "derogatory"
+  or
+  wrong = "descendands" and right = "descendants"
+  or
+  wrong = "descibed" and right = "described"
+  or
+  wrong = "desciptors" and right = "descriptors"
+  or
+  wrong = "descision" and right = "decision"
+  or
+  wrong = "descisions" and right = "decisions"
+  or
+  wrong = "descriibes" and right = "describes"
+  or
+  wrong = "descripters" and right = "descriptors"
+  or
+  wrong = "descripton" and right = "description"
+  or
+  wrong = "desctruction" and right = "destruction"
+  or
+  wrong = "descuss" and right = "discuss"
+  or
+  wrong = "desgined" and right = "designed"
+  or
+  wrong = "deside" and right = "decide"
+  or
+  wrong = "desigining" and right = "designing"
+  or
+  wrong = "desinations" and right = "destinations"
+  or
+  wrong = "desintegrated" and right = "disintegrated"
+  or
+  wrong = "desintegration" and right = "disintegration"
+  or
+  wrong = "desireable" and right = "desirable"
+  or
+  wrong = "desitned" and right = "destined"
+  or
+  wrong = "desktiop" and right = "desktop"
+  or
+  wrong = "desorder" and right = "disorder"
+  or
+  wrong = "desoriented" and right = "disoriented"
+  or
+  wrong = "desparate" and right = "desperate"
+  or
+  wrong = "desparate" and right = "disparate"
+  or
+  wrong = "despict" and right = "depict"
+  or
+  wrong = "despiration" and right = "desperation"
+  or
+  wrong = "dessicated" and right = "desiccated"
+  or
+  wrong = "dessigned" and right = "designed"
+  or
+  wrong = "destablized" and right = "destabilized"
+  or
+  wrong = "destory" and right = "destroy"
+  or
+  wrong = "desugered" and right = "desugared"
+  or
+  wrong = "detailled" and right = "detailed"
+  or
+  wrong = "detatched" and right = "detached"
+  or
+  wrong = "deteoriated" and right = "deteriorated"
+  or
+  wrong = "deteriate" and right = "deteriorate"
+  or
+  wrong = "deterioriating" and right = "deteriorating"
+  or
+  wrong = "determinining" and right = "determining"
+  or
+  wrong = "detremental" and right = "detrimental"
+  or
+  wrong = "devasted" and right = "devastated"
+  or
+  wrong = "develope" and right = "develop"
+  or
+  wrong = "developement" and right = "development"
+  or
+  wrong = "developped" and right = "developed"
+  or
+  wrong = "develpment" and right = "development"
+  or
+  wrong = "devels" and right = "delves"
+  or
+  wrong = "devestated" and right = "devastated"
+  or
+  wrong = "devestating" and right = "devastating"
+  or
+  wrong = "devide" and right = "divide"
+  or
+  wrong = "devided" and right = "divided"
+  or
+  wrong = "devistating" and right = "devastating"
+  or
+  wrong = "devolopement" and right = "development"
+  or
+  wrong = "diablical" and right = "diabolical"
+  or
+  wrong = "diamons" and right = "diamonds"
+  or
+  wrong = "diaster" and right = "disaster"
+  or
+  wrong = "dichtomy" and right = "dichotomy"
+  or
+  wrong = "diconnects" and right = "disconnects"
+  or
+  wrong = "dicover" and right = "discover"
+  or
+  wrong = "dicovered" and right = "discovered"
+  or
+  wrong = "dicovering" and right = "discovering"
+  or
+  wrong = "dicovers" and right = "discovers"
+  or
+  wrong = "dicovery" and right = "discovery"
+  or
+  wrong = "dictionarys" and right = "dictionaries"
+  or
+  wrong = "dicussed" and right = "discussed"
+  or
+  wrong = "diea" and right = "die"
+  or
+  wrong = "diea" and right = "idea"
+  or
+  wrong = "dieing" and right = "dyeing"
+  or
+  wrong = "dieing" and right = "dying"
+  or
+  wrong = "dieties" and right = "deities"
+  or
+  wrong = "diety" and right = "deity"
+  or
+  wrong = "diferent" and right = "different"
+  or
+  wrong = "diferrent" and right = "different"
+  or
+  wrong = "differentiatiations" and right = "differentiations"
+  or
+  wrong = "differnt" and right = "different"
+  or
+  wrong = "difficulity" and right = "difficulty"
+  or
+  wrong = "diffrent" and right = "different"
+  or
+  wrong = "dificulties" and right = "difficulties"
+  or
+  wrong = "dificulty" and right = "difficulty"
+  or
+  wrong = "dimenions" and right = "dimensions"
+  or
+  wrong = "dimention" and right = "dimension"
+  or
+  wrong = "dimentional" and right = "dimensional"
+  or
+  wrong = "dimentions" and right = "dimensions"
+  or
+  wrong = "dimesnional" and right = "dimensional"
+  or
+  wrong = "diminuitive" and right = "diminutive"
+  or
+  wrong = "dimunitive" and right = "diminutive"
+  or
+  wrong = "diosese" and right = "diocese"
+  or
+  wrong = "diphtong" and right = "diphthong"
+  or
+  wrong = "diphtongs" and right = "diphthongs"
+  or
+  wrong = "diplomancy" and right = "diplomacy"
+  or
+  wrong = "dipthong" and right = "diphthong"
+  or
+  wrong = "dipthongs" and right = "diphthongs"
+  or
+  wrong = "directoty" and right = "directory"
+  or
+  wrong = "dirived" and right = "derived"
+  or
+  wrong = "disagreeed" and right = "disagreed"
+  or
+  wrong = "disapeared" and right = "disappeared"
+  or
+  wrong = "disapointing" and right = "disappointing"
+  or
+  wrong = "disappearred" and right = "disappeared"
+  or
+  wrong = "disaproval" and right = "disapproval"
+  or
+  wrong = "disasterous" and right = "disastrous"
+  or
+  wrong = "disatisfaction" and right = "dissatisfaction"
+  or
+  wrong = "disatisfied" and right = "dissatisfied"
+  or
+  wrong = "disatrous" and right = "disastrous"
+  or
+  wrong = "discontentment" and right = "discontent"
+  or
+  wrong = "discribe" and right = "describe"
+  or
+  wrong = "discribed" and right = "described"
+  or
+  wrong = "discribes" and right = "describes"
+  or
+  wrong = "discribing" and right = "describing"
+  or
+  wrong = "disctinction" and right = "distinction"
+  or
+  wrong = "disctinctive" and right = "distinctive"
+  or
+  wrong = "disemination" and right = "dissemination"
+  or
+  wrong = "disenchanged" and right = "disenchanted"
+  or
+  wrong = "disiplined" and right = "disciplined"
+  or
+  wrong = "disobediance" and right = "disobedience"
+  or
+  wrong = "disobediant" and right = "disobedient"
+  or
+  wrong = "disolved" and right = "dissolved"
+  or
+  wrong = "disover" and right = "discover"
+  or
+  wrong = "dispair" and right = "despair"
+  or
+  wrong = "disparingly" and right = "disparagingly"
+  or
+  wrong = "dispence" and right = "dispense"
+  or
+  wrong = "dispenced" and right = "dispensed"
+  or
+  wrong = "dispencing" and right = "dispensing"
+  or
+  wrong = "dispicable" and right = "despicable"
+  or
+  wrong = "dispite" and right = "despite"
+  or
+  wrong = "dispostion" and right = "disposition"
+  or
+  wrong = "disproportiate" and right = "disproportionate"
+  or
+  wrong = "disputandem" and right = "disputandum"
+  or
+  wrong = "disricts" and right = "districts"
+  or
+  wrong = "dissagreement" and right = "disagreement"
+  or
+  wrong = "dissapear" and right = "disappear"
+  or
+  wrong = "dissapearance" and right = "disappearance"
+  or
+  wrong = "dissapeared" and right = "disappeared"
+  or
+  wrong = "dissapearing" and right = "disappearing"
+  or
+  wrong = "dissapears" and right = "disappears"
+  or
+  wrong = "dissappear" and right = "disappear"
+  or
+  wrong = "dissappears" and right = "disappears"
+  or
+  wrong = "dissappointed" and right = "disappointed"
+  or
+  wrong = "dissarray" and right = "disarray"
+  or
+  wrong = "dissobediance" and right = "disobedience"
+  or
+  wrong = "dissobediant" and right = "disobedient"
+  or
+  wrong = "dissobedience" and right = "disobedience"
+  or
+  wrong = "dissobedient" and right = "disobedient"
+  or
+  wrong = "distiction" and right = "distinction"
+  or
+  wrong = "distingish" and right = "distinguish"
+  or
+  wrong = "distingished" and right = "distinguished"
+  or
+  wrong = "distingishes" and right = "distinguishes"
+  or
+  wrong = "distingishing" and right = "distinguishing"
+  or
+  wrong = "distingquished" and right = "distinguished"
+  or
+  wrong = "distrubution" and right = "distribution"
+  or
+  wrong = "distruction" and right = "destruction"
+  or
+  wrong = "distructive" and right = "destructive"
+  or
+  wrong = "ditributed" and right = "distributed"
+  or
+  wrong = "diversed" and right = "diverged"
+  or
+  wrong = "diversed" and right = "diverse"
+  or
+  wrong = "divice" and right = "device"
+  or
+  wrong = "divinition" and right = "divination"
+  or
+  wrong = "divison" and right = "division"
+  or
+  wrong = "divisons" and right = "divisions"
+  or
+  wrong = "doccument" and right = "document"
+  or
+  wrong = "doccumented" and right = "documented"
+  or
+  wrong = "doccuments" and right = "documents"
+  or
+  wrong = "docrines" and right = "doctrines"
+  or
+  wrong = "doctines" and right = "doctrines"
+  or
+  wrong = "documenatry" and right = "documentary"
+  or
+  wrong = "doens" and right = "does"
+  or
+  wrong = "doign" and right = "doing"
+  or
+  wrong = "dominaton" and right = "domination"
+  or
+  wrong = "dominent" and right = "dominant"
+  or
+  wrong = "dominiant" and right = "dominant"
+  or
+  wrong = "donig" and right = "doing"
+  or
+  wrong = "doub" and right = "daub"
+  or
+  wrong = "doub" and right = "doubt"
+  or
+  wrong = "doulbe" and right = "double"
+  or
+  wrong = "dowloads" and right = "downloads"
+  or
+  wrong = "dramtic" and right = "dramatic"
+  or
+  wrong = "draughtman" and right = "draughtsman"
+  or
+  wrong = "dravadian" and right = "dravidian"
+  or
+  wrong = "dreasm" and right = "dreams"
+  or
+  wrong = "driectly" and right = "directly"
+  or
+  wrong = "drnik" and right = "drink"
+  or
+  wrong = "druming" and right = "drumming"
+  or
+  wrong = "drummless" and right = "drumless"
+  or
+  wrong = "dum" and right = "dumb"
+  or
+  wrong = "dupicate" and right = "duplicate"
+  or
+  wrong = "durig" and right = "during"
+  or
+  wrong = "durring" and right = "during"
+  or
+  wrong = "duting" and right = "during"
+  or
+  wrong = "dyas" and right = "dryas"
+  or
+  wrong = "eahc" and right = "each"
+  or
+  wrong = "ealier" and right = "earlier"
+  or
+  wrong = "earlies" and right = "earliest"
+  or
+  wrong = "earnt" and right = "earned"
+  or
+  wrong = "ecclectic" and right = "eclectic"
+  or
+  wrong = "eceonomy" and right = "economy"
+  or
+  wrong = "ecidious" and right = "deciduous"
+  or
+  wrong = "eclispe" and right = "eclipse"
+  or
+  wrong = "ecomonic" and right = "economic"
+  or
+  wrong = "ect" and right = "etc"
+  or
+  wrong = "editting" and right = "editing"
+  or
+  wrong = "eearly" and right = "early"
+  or
+  wrong = "efel" and right = "evil"
+  or
+  wrong = "effeciency" and right = "efficiency"
+  or
+  wrong = "effecient" and right = "efficient"
+  or
+  wrong = "effeciently" and right = "efficiently"
+  or
+  wrong = "efficency" and right = "efficiency"
+  or
+  wrong = "efficent" and right = "efficient"
+  or
+  wrong = "efficently" and right = "efficiently"
+  or
+  wrong = "efford" and right = "afford"
+  or
+  wrong = "efford" and right = "effort"
+  or
+  wrong = "effords" and right = "affords"
+  or
+  wrong = "effords" and right = "efforts"
+  or
+  wrong = "effulence" and right = "effluence"
+  or
+  wrong = "eigth" and right = "eight"
+  or
+  wrong = "eigth" and right = "eighth"
+  or
+  wrong = "eiter" and right = "either"
+  or
+  wrong = "elction" and right = "election"
+  or
+  wrong = "electic" and right = "eclectic"
+  or
+  wrong = "electic" and right = "electric"
+  or
+  wrong = "electon" and right = "election"
+  or
+  wrong = "electon" and right = "electron"
+  or
+  wrong = "electrial" and right = "electrical"
+  or
+  wrong = "electricly" and right = "electrically"
+  or
+  wrong = "electricty" and right = "electricity"
+  or
+  wrong = "elementay" and right = "elementary"
+  or
+  wrong = "eleminated" and right = "eliminated"
+  or
+  wrong = "eleminating" and right = "eliminating"
+  or
+  wrong = "eles" and right = "eels"
+  or
+  wrong = "eletricity" and right = "electricity"
+  or
+  wrong = "elicided" and right = "elicited"
+  or
+  wrong = "eligable" and right = "eligible"
+  or
+  wrong = "elimentary" and right = "elementary"
+  or
+  wrong = "ellected" and right = "elected"
+  or
+  wrong = "elphant" and right = "elephant"
+  or
+  wrong = "embarass" and right = "embarrass"
+  or
+  wrong = "embarassed" and right = "embarrassed"
+  or
+  wrong = "embarassing" and right = "embarrassing"
+  or
+  wrong = "embarassment" and right = "embarrassment"
+  or
+  wrong = "embargos" and right = "embargoes"
+  or
+  wrong = "embarras" and right = "embarrass"
+  or
+  wrong = "embarrased" and right = "embarrassed"
+  or
+  wrong = "embarrasing" and right = "embarrassing"
+  or
+  wrong = "embarrasment" and right = "embarrassment"
+  or
+  wrong = "embezelled" and right = "embezzled"
+  or
+  wrong = "emblamatic" and right = "emblematic"
+  or
+  wrong = "eminate" and right = "emanate"
+  or
+  wrong = "eminated" and right = "emanated"
+  or
+  wrong = "emision" and right = "emission"
+  or
+  wrong = "emited" and right = "emitted"
+  or
+  wrong = "emiting" and right = "emitting"
+  or
+  wrong = "emition" and right = "emission"
+  or
+  wrong = "emition" and right = "emotion"
+  or
+  wrong = "emmediately" and right = "immediately"
+  or
+  wrong = "emmigrated" and right = "emigrated"
+  or
+  wrong = "emmigrated" and right = "immigrated"
+  or
+  wrong = "emminent" and right = "eminent"
+  or
+  wrong = "emminent" and right = "imminent"
+  or
+  wrong = "emminently" and right = "eminently"
+  or
+  wrong = "emmisaries" and right = "emissaries"
+  or
+  wrong = "emmisarries" and right = "emissaries"
+  or
+  wrong = "emmisarry" and right = "emissary"
+  or
+  wrong = "emmisary" and right = "emissary"
+  or
+  wrong = "emmision" and right = "emission"
+  or
+  wrong = "emmisions" and right = "emissions"
+  or
+  wrong = "emmited" and right = "emitted"
+  or
+  wrong = "emmiting" and right = "emitting"
+  or
+  wrong = "emmitted" and right = "emitted"
+  or
+  wrong = "emmitting" and right = "emitting"
+  or
+  wrong = "emnity" and right = "enmity"
+  or
+  wrong = "emperical" and right = "empirical"
+  or
+  wrong = "emphaised" and right = "emphasised"
+  or
+  wrong = "emphsis" and right = "emphasis"
+  or
+  wrong = "emphysyma" and right = "emphysema"
+  or
+  wrong = "empirial" and right = "empirical"
+  or
+  wrong = "empirial" and right = "imperial"
+  or
+  wrong = "emporer" and right = "emperor"
+  or
+  wrong = "emprisoned" and right = "imprisoned"
+  or
+  wrong = "enameld" and right = "enameled"
+  or
+  wrong = "enchancement" and right = "enhancement"
+  or
+  wrong = "encouraing" and right = "encouraging"
+  or
+  wrong = "encryptiion" and right = "encryption"
+  or
+  wrong = "encylopedia" and right = "encyclopedia"
+  or
+  wrong = "endevors" and right = "endeavors"
+  or
+  wrong = "endevour" and right = "endeavour"
+  or
+  wrong = "endig" and right = "ending"
+  or
+  wrong = "endolithes" and right = "endoliths"
+  or
+  wrong = "enduce" and right = "induce"
+  or
+  wrong = "ened" and right = "need"
+  or
+  wrong = "enforceing" and right = "enforcing"
+  or
+  wrong = "engagment" and right = "engagement"
+  or
+  wrong = "engeneer" and right = "engineer"
+  or
+  wrong = "engeneering" and right = "engineering"
+  or
+  wrong = "engieneer" and right = "engineer"
+  or
+  wrong = "engieneers" and right = "engineers"
+  or
+  wrong = "enlargment" and right = "enlargement"
+  or
+  wrong = "enlargments" and right = "enlargements"
+  or
+  wrong = "enlish" and right = "english"
+  or
+  wrong = "enlish" and right = "enlist"
+  or
+  wrong = "enourmous" and right = "enormous"
+  or
+  wrong = "enourmously" and right = "enormously"
+  or
+  wrong = "ensconsed" and right = "ensconced"
+  or
+  wrong = "entaglements" and right = "entanglements"
+  or
+  wrong = "enteratinment" and right = "entertainment"
+  or
+  wrong = "enthusiatic" and right = "enthusiastic"
+  or
+  wrong = "entitity" and right = "entity"
+  or
+  wrong = "entitlied" and right = "entitled"
+  or
+  wrong = "entrepeneur" and right = "entrepreneur"
+  or
+  wrong = "entrepeneurs" and right = "entrepreneurs"
+  or
+  wrong = "enviorment" and right = "environment"
+  or
+  wrong = "enviormental" and right = "environmental"
+  or
+  wrong = "enviormentally" and right = "environmentally"
+  or
+  wrong = "enviorments" and right = "environments"
+  or
+  wrong = "enviornment" and right = "environment"
+  or
+  wrong = "enviornmental" and right = "environmental"
+  or
+  wrong = "enviornmentalist" and right = "environmentalist"
+  or
+  wrong = "enviornmentally" and right = "environmentally"
+  or
+  wrong = "enviornments" and right = "environments"
+  or
+  wrong = "enviroment" and right = "environment"
+  or
+  wrong = "enviromental" and right = "environmental"
+  or
+  wrong = "enviromentalist" and right = "environmentalist"
+  or
+  wrong = "enviromentally" and right = "environmentally"
+  or
+  wrong = "enviroments" and right = "environments"
+  or
+  wrong = "environemnt" and right = "environment"
+  or
+  wrong = "envolutionary" and right = "evolutionary"
+  or
+  wrong = "envrionments" and right = "environments"
+  or
+  wrong = "enxt" and right = "next"
+  or
+  wrong = "epidsodes" and right = "episodes"
+  or
+  wrong = "epsiode" and right = "episode"
+  or
+  wrong = "equialent" and right = "equivalent"
+  or
+  wrong = "equilibium" and right = "equilibrium"
+  or
+  wrong = "equilibrum" and right = "equilibrium"
+  or
+  wrong = "equiped" and right = "equipped"
+  or
+  wrong = "equippment" and right = "equipment"
+  or
+  wrong = "equitorial" and right = "equatorial"
+  or
+  wrong = "equivelant" and right = "equivalent"
+  or
+  wrong = "equivelent" and right = "equivalent"
+  or
+  wrong = "equivilant" and right = "equivalent"
+  or
+  wrong = "equivilent" and right = "equivalent"
+  or
+  wrong = "equivlalent" and right = "equivalent"
+  or
+  wrong = "erally" and right = "orally"
+  or
+  wrong = "erally" and right = "really"
+  or
+  wrong = "eratic" and right = "erratic"
+  or
+  wrong = "eratically" and right = "erratically"
+  or
+  wrong = "eraticly" and right = "erratically"
+  or
+  wrong = "erested" and right = "arrested"
+  or
+  wrong = "erested" and right = "erected"
+  or
+  wrong = "errupted" and right = "erupted"
+  or
+  wrong = "esential" and right = "essential"
+  or
+  wrong = "esitmated" and right = "estimated"
+  or
+  wrong = "esle" and right = "else"
+  or
+  wrong = "especialy" and right = "especially"
+  or
+  wrong = "essencial" and right = "essential"
+  or
+  wrong = "essense" and right = "essence"
+  or
+  wrong = "essentail" and right = "essential"
+  or
+  wrong = "essentialy" and right = "essentially"
+  or
+  wrong = "essentual" and right = "essential"
+  or
+  wrong = "essesital" and right = "essential"
+  or
+  wrong = "estabishes" and right = "establishes"
+  or
+  wrong = "establising" and right = "establishing"
+  or
+  wrong = "ethnocentricm" and right = "ethnocentrism"
+  or
+  wrong = "ethose" and right = "ethos"
+  or
+  wrong = "ethose" and right = "those"
+  or
+  wrong = "europian" and right = "european"
+  or
+  wrong = "europians" and right = "europeans"
+  or
+  wrong = "eurpean" and right = "european"
+  or
+  wrong = "eurpoean" and right = "european"
+  or
+  wrong = "evenhtually" and right = "eventually"
+  or
+  wrong = "eventally" and right = "eventually"
+  or
+  wrong = "eventially" and right = "eventually"
+  or
+  wrong = "eventualy" and right = "eventually"
+  or
+  wrong = "everthing" and right = "everything"
+  or
+  wrong = "everyting" and right = "everything"
+  or
+  wrong = "eveyr" and right = "every"
+  or
+  wrong = "evidentally" and right = "evidently"
+  or
+  wrong = "exagerate" and right = "exaggerate"
+  or
+  wrong = "exagerated" and right = "exaggerated"
+  or
+  wrong = "exagerates" and right = "exaggerates"
+  or
+  wrong = "exagerating" and right = "exaggerating"
+  or
+  wrong = "exagerrate" and right = "exaggerate"
+  or
+  wrong = "exagerrated" and right = "exaggerated"
+  or
+  wrong = "exagerrates" and right = "exaggerates"
+  or
+  wrong = "exagerrating" and right = "exaggerating"
+  or
+  wrong = "examinated" and right = "examined"
+  or
+  wrong = "exampt" and right = "exempt"
+  or
+  wrong = "exapansion" and right = "expansion"
+  or
+  wrong = "excact" and right = "exact"
+  or
+  wrong = "excange" and right = "exchange"
+  or
+  wrong = "excecute" and right = "execute"
+  or
+  wrong = "excecuted" and right = "executed"
+  or
+  wrong = "excecutes" and right = "executes"
+  or
+  wrong = "excecuting" and right = "executing"
+  or
+  wrong = "excecution" and right = "execution"
+  or
+  wrong = "excedded" and right = "exceeded"
+  or
+  wrong = "excelent" and right = "excellent"
+  or
+  wrong = "excell" and right = "excel"
+  or
+  wrong = "excellance" and right = "excellence"
+  or
+  wrong = "excellant" and right = "excellent"
+  or
+  wrong = "excells" and right = "excels"
+  or
+  wrong = "excercise" and right = "exercise"
+  or
+  wrong = "exchanching" and right = "exchanging"
+  or
+  wrong = "excisted" and right = "existed"
+  or
+  wrong = "exculsivly" and right = "exclusively"
+  or
+  wrong = "execising" and right = "exercising"
+  or
+  wrong = "exection" and right = "execution"
+  or
+  wrong = "exectued" and right = "executed"
+  or
+  wrong = "exeedingly" and right = "exceedingly"
+  or
+  wrong = "exelent" and right = "excellent"
+  or
+  wrong = "exellent" and right = "excellent"
+  or
+  wrong = "exemple" and right = "example"
+  or
+  wrong = "exept" and right = "except"
+  or
+  wrong = "exeptional" and right = "exceptional"
+  or
+  wrong = "exerbate" and right = "exacerbate"
+  or
+  wrong = "exerbated" and right = "exacerbated"
+  or
+  wrong = "exerciese" and right = "exercises"
+  or
+  wrong = "exerpt" and right = "excerpt"
+  or
+  wrong = "exerpts" and right = "excerpts"
+  or
+  wrong = "exersize" and right = "exercise"
+  or
+  wrong = "exerternal" and right = "external"
+  or
+  wrong = "exhalted" and right = "exalted"
+  or
+  wrong = "exhibtion" and right = "exhibition"
+  or
+  wrong = "exibition" and right = "exhibition"
+  or
+  wrong = "exibitions" and right = "exhibitions"
+  or
+  wrong = "exicting" and right = "exciting"
+  or
+  wrong = "exinct" and right = "extinct"
+  or
+  wrong = "existance" and right = "existence"
+  or
+  wrong = "existant" and right = "existent"
+  or
+  wrong = "existince" and right = "existence"
+  or
+  wrong = "exliled" and right = "exiled"
+  or
+  wrong = "exludes" and right = "excludes"
+  or
+  wrong = "exmaple" and right = "example"
+  or
+  wrong = "exonorate" and right = "exonerate"
+  or
+  wrong = "exoskelaton" and right = "exoskeleton"
+  or
+  wrong = "expalin" and right = "explain"
+  or
+  wrong = "expatriot" and right = "expatriate"
+  or
+  wrong = "expeced" and right = "expected"
+  or
+  wrong = "expecially" and right = "especially"
+  or
+  wrong = "expeditonary" and right = "expeditionary"
+  or
+  wrong = "expeiments" and right = "experiments"
+  or
+  wrong = "expell" and right = "expel"
+  or
+  wrong = "expells" and right = "expels"
+  or
+  wrong = "experiance" and right = "experience"
+  or
+  wrong = "experianced" and right = "experienced"
+  or
+  wrong = "expession" and right = "expression"
+  or
+  wrong = "expessions" and right = "expressions"
+  or
+  wrong = "expiditions" and right = "expeditions"
+  or
+  wrong = "expierence" and right = "experience"
+  or
+  wrong = "explaination" and right = "explanation"
+  or
+  wrong = "explaning" and right = "explaining"
+  or
+  wrong = "explictly" and right = "explicitly"
+  or
+  wrong = "exploititive" and right = "exploitative"
+  or
+  wrong = "explotation" and right = "exploitation"
+  or
+  wrong = "expropiated" and right = "expropriated"
+  or
+  wrong = "expropiation" and right = "expropriation"
+  or
+  wrong = "exressed" and right = "expressed"
+  or
+  wrong = "extemely" and right = "extremely"
+  or
+  wrong = "extened" and right = "extended"
+  or
+  wrong = "extention" and right = "extension"
+  or
+  wrong = "extentions" and right = "extensions"
+  or
+  wrong = "extered" and right = "exerted"
+  or
+  wrong = "extermist" and right = "extremist"
+  or
+  wrong = "extint" and right = "extant"
+  or
+  wrong = "extint" and right = "extinct"
+  or
+  wrong = "extracter" and right = "extractor"
+  or
+  wrong = "extradiction" and right = "extradition"
+  or
+  wrong = "extraterrestial" and right = "extraterrestrial"
+  or
+  wrong = "extraterrestials" and right = "extraterrestrials"
+  or
+  wrong = "extravagent" and right = "extravagant"
+  or
+  wrong = "extrememly" and right = "extremely"
+  or
+  wrong = "extremeophile" and right = "extremophile"
+  or
+  wrong = "extremly" and right = "extremely"
+  or
+  wrong = "extrordinarily" and right = "extraordinarily"
+  or
+  wrong = "extrordinary" and right = "extraordinary"
+  or
+  wrong = "eyar" and right = "eyas"
+  or
+  wrong = "eyar" and right = "year"
+  or
+  wrong = "eyars" and right = "eyas"
+  or
+  wrong = "eyars" and right = "years"
+  or
+  wrong = "eyasr" and right = "eyas"
+  or
+  wrong = "eyasr" and right = "years"
+  or
+  wrong = "faciliate" and right = "facilitate"
+  or
+  wrong = "faciliated" and right = "facilitated"
+  or
+  wrong = "faciliates" and right = "facilitates"
+  or
+  wrong = "facilites" and right = "facilities"
+  or
+  wrong = "facillitate" and right = "facilitate"
+  or
+  wrong = "facinated" and right = "fascinated"
+  or
+  wrong = "facist" and right = "fascist"
+  or
+  wrong = "familes" and right = "families"
+  or
+  wrong = "familliar" and right = "familiar"
+  or
+  wrong = "famoust" and right = "famous"
+  or
+  wrong = "fanatism" and right = "fanaticism"
+  or
+  wrong = "farenheit" and right = "fahrenheit"
+  or
+  wrong = "fatc" and right = "fact"
+  or
+  wrong = "faught" and right = "fought"
+  or
+  wrong = "favoutrable" and right = "favourable"
+  or
+  wrong = "feasable" and right = "feasible"
+  or
+  wrong = "febuary" and right = "february"
+  or
+  wrong = "feburary" and right = "february"
+  or
+  wrong = "fedreally" and right = "federally"
+  or
+  wrong = "femminist" and right = "feminist"
+  or
+  wrong = "feromone" and right = "pheromone"
+  or
+  wrong = "fertily" and right = "fertility"
+  or
+  wrong = "fianite" and right = "finite"
+  or
+  wrong = "fianlly" and right = "finally"
+  or
+  wrong = "ficticious" and right = "fictitious"
+  or
+  wrong = "fictious" and right = "fictitious"
+  or
+  wrong = "fidn" and right = "find"
+  or
+  wrong = "fiel" and right = "feel"
+  or
+  wrong = "fiel" and right = "field"
+  or
+  wrong = "fiel" and right = "file"
+  or
+  wrong = "fiel" and right = "phial"
+  or
+  wrong = "fiels" and right = "feels"
+  or
+  wrong = "fiels" and right = "fields"
+  or
+  wrong = "fiels" and right = "files"
+  or
+  wrong = "fiels" and right = "phials"
+  or
+  wrong = "fiercly" and right = "fiercely"
+  or
+  wrong = "fightings" and right = "fighting"
+  or
+  wrong = "filiament" and right = "filament"
+  or
+  wrong = "fimilies" and right = "families"
+  or
+  wrong = "finacial" and right = "financial"
+  or
+  wrong = "finaly" and right = "finally"
+  or
+  wrong = "financialy" and right = "financially"
+  or
+  wrong = "firends" and right = "friends"
+  or
+  wrong = "firts" and right = "first"
+  or
+  wrong = "firts" and right = "flirts"
+  or
+  wrong = "fisionable" and right = "fissionable"
+  or
+  wrong = "flamable" and right = "flammable"
+  or
+  wrong = "flawess" and right = "flawless"
+  or
+  wrong = "fleed" and right = "fled"
+  or
+  wrong = "fleed" and right = "freed"
+  or
+  wrong = "flemmish" and right = "flemish"
+  or
+  wrong = "florescent" and right = "fluorescent"
+  or
+  wrong = "flourescent" and right = "fluorescent"
+  or
+  wrong = "flourine" and right = "fluorine"
+  or
+  wrong = "flourishment" and right = "flourishing"
+  or
+  wrong = "fluorish" and right = "flourish"
+  or
+  wrong = "follwoing" and right = "following"
+  or
+  wrong = "folowing" and right = "following"
+  or
+  wrong = "fomed" and right = "formed"
+  or
+  wrong = "fomr" and right = "form"
+  or
+  wrong = "fomr" and right = "from"
+  or
+  wrong = "fonetic" and right = "phonetic"
+  or
+  wrong = "fontrier" and right = "fontier"
+  or
+  wrong = "foootball" and right = "football"
+  or
+  wrong = "forbad" and right = "forbade"
+  or
+  wrong = "forbiden" and right = "forbidden"
+  or
+  wrong = "foreward" and right = "foreword"
+  or
+  wrong = "forfiet" and right = "forfeit"
+  or
+  wrong = "forhead" and right = "forehead"
+  or
+  wrong = "foriegn" and right = "foreign"
+  or
+  wrong = "formalhaut" and right = "fomalhaut"
+  or
+  wrong = "formallize" and right = "formalize"
+  or
+  wrong = "formallized" and right = "formalized"
+  or
+  wrong = "formaly" and right = "formally"
+  or
+  wrong = "formaly" and right = "formerly"
+  or
+  wrong = "formelly" and right = "formerly"
+  or
+  wrong = "formidible" and right = "formidable"
+  or
+  wrong = "formost" and right = "foremost"
+  or
+  wrong = "forsaw" and right = "foresaw"
+  or
+  wrong = "forseeable" and right = "foreseeable"
+  or
+  wrong = "fortelling" and right = "foretelling"
+  or
+  wrong = "forunner" and right = "forerunner"
+  or
+  wrong = "foucs" and right = "focus"
+  or
+  wrong = "foudn" and right = "found"
+  or
+  wrong = "fougth" and right = "fought"
+  or
+  wrong = "foundaries" and right = "foundries"
+  or
+  wrong = "foundary" and right = "foundry"
+  or
+  wrong = "foundland" and right = "newfoundland"
+  or
+  wrong = "fourties" and right = "forties"
+  or
+  wrong = "fourty" and right = "forty"
+  or
+  wrong = "fouth" and right = "fourth"
+  or
+  wrong = "foward" and right = "forward"
+  or
+  wrong = "framwork" and right = "framework"
+  or
+  wrong = "fransiscan" and right = "franciscan"
+  or
+  wrong = "fransiscans" and right = "franciscans"
+  or
+  wrong = "freind" and right = "friend"
+  or
+  wrong = "freindly" and right = "friendly"
+  or
+  wrong = "frequentily" and right = "frequently"
+  or
+  wrong = "frome" and right = "from"
+  or
+  wrong = "fromed" and right = "formed"
+  or
+  wrong = "froniter" and right = "frontier"
+  or
+  wrong = "fucntion" and right = "function"
+  or
+  wrong = "fucntioning" and right = "functioning"
+  or
+  wrong = "fufill" and right = "fulfill"
+  or
+  wrong = "fufilled" and right = "fulfilled"
+  or
+  wrong = "fulfiled" and right = "fulfilled"
+  or
+  wrong = "fullfill" and right = "fulfill"
+  or
+  wrong = "fullfilled" and right = "fulfilled"
+  or
+  wrong = "funcion" and right = "function"
+  or
+  wrong = "fundametal" and right = "fundamental"
+  or
+  wrong = "fundametals" and right = "fundamentals"
+  or
+  wrong = "funguses" and right = "fungi"
+  or
+  wrong = "funtion" and right = "function"
+  or
+  wrong = "funtions" and right = "functions"
+  or
+  wrong = "furuther" and right = "further"
+  or
+  wrong = "futher" and right = "further"
+  or
+  wrong = "futhermore" and right = "furthermore"
+  or
+  wrong = "futhroc" and right = "futhark"
+  or
+  wrong = "futhroc" and right = "futhorc"
+  or
+  wrong = "gae" and right = "gael"
+  or
+  wrong = "gae" and right = "gale"
+  or
+  wrong = "gae" and right = "game"
+  or
+  wrong = "galatic" and right = "galactic"
+  or
+  wrong = "galations" and right = "galatians"
+  or
+  wrong = "gallaxies" and right = "galaxies"
+  or
+  wrong = "galvinized" and right = "galvanized"
+  or
+  wrong = "ganerate" and right = "generate"
+  or
+  wrong = "ganes" and right = "games"
+  or
+  wrong = "ganster" and right = "gangster"
+  or
+  wrong = "garantee" and right = "guarantee"
+  or
+  wrong = "garanteed" and right = "guaranteed"
+  or
+  wrong = "garantees" and right = "guarantees"
+  or
+  wrong = "garnison" and right = "garrison"
+  or
+  wrong = "gaurantee" and right = "guarantee"
+  or
+  wrong = "gauranteed" and right = "guaranteed"
+  or
+  wrong = "gaurantees" and right = "guarantees"
+  or
+  wrong = "gaurd" and right = "gourd"
+  or
+  wrong = "gaurd" and right = "guard"
+  or
+  wrong = "gaurentee" and right = "guarantee"
+  or
+  wrong = "gaurenteed" and right = "guaranteed"
+  or
+  wrong = "gaurentees" and right = "guarantees"
+  or
+  wrong = "geneological" and right = "genealogical"
+  or
+  wrong = "geneologies" and right = "genealogies"
+  or
+  wrong = "geneology" and right = "genealogy"
+  or
+  wrong = "generaly" and right = "generally"
+  or
+  wrong = "generatting" and right = "generating"
+  or
+  wrong = "genialia" and right = "genitalia"
+  or
+  wrong = "geographicial" and right = "geographical"
+  or
+  wrong = "geometrician" and right = "geometer"
+  or
+  wrong = "geometricians" and right = "geometers"
+  or
+  wrong = "gerat" and right = "great"
+  or
+  wrong = "ghandi" and right = "gandhi"
+  or
+  wrong = "glamourous" and right = "glamorous"
+  or
+  wrong = "glight" and right = "flight"
+  or
+  wrong = "gnawwed" and right = "gnawed"
+  or
+  wrong = "godess" and right = "goddess"
+  or
+  wrong = "godesses" and right = "goddesses"
+  or
+  wrong = "godounov" and right = "godunov"
+  or
+  wrong = "gogin" and right = "gauguin"
+  or
+  wrong = "gogin" and right = "going"
+  or
+  wrong = "goign" and right = "going"
+  or
+  wrong = "gonig" and right = "going"
+  or
+  wrong = "gothenberg" and right = "gothenburg"
+  or
+  wrong = "gottleib" and right = "gottlieb"
+  or
+  wrong = "gouvener" and right = "governor"
+  or
+  wrong = "govement" and right = "government"
+  or
+  wrong = "govenment" and right = "government"
+  or
+  wrong = "govenrment" and right = "government"
+  or
+  wrong = "goverance" and right = "governance"
+  or
+  wrong = "goverment" and right = "government"
+  or
+  wrong = "govermental" and right = "governmental"
+  or
+  wrong = "governer" and right = "governor"
+  or
+  wrong = "governmnet" and right = "government"
+  or
+  wrong = "govorment" and right = "government"
+  or
+  wrong = "govormental" and right = "governmental"
+  or
+  wrong = "govornment" and right = "government"
+  or
+  wrong = "gracefull" and right = "graceful"
+  or
+  wrong = "graet" and right = "great"
+  or
+  wrong = "grafitti" and right = "graffiti"
+  or
+  wrong = "gramatically" and right = "grammatically"
+  or
+  wrong = "grammaticaly" and right = "grammatically"
+  or
+  wrong = "grammer" and right = "grammar"
+  or
+  wrong = "grat" and right = "great"
+  or
+  wrong = "gratuitious" and right = "gratuitous"
+  or
+  wrong = "greatful" and right = "grateful"
+  or
+  wrong = "greatfully" and right = "gratefully"
+  or
+  wrong = "greif" and right = "grief"
+  or
+  wrong = "gridles" and right = "griddles"
+  or
+  wrong = "gropu" and right = "group"
+  or
+  wrong = "grwo" and right = "grow"
+  or
+  wrong = "guaduloupe" and right = "guadalupe"
+  or
+  wrong = "guaduloupe" and right = "guadeloupe"
+  or
+  wrong = "guadulupe" and right = "guadalupe"
+  or
+  wrong = "guadulupe" and right = "guadeloupe"
+  or
+  wrong = "guage" and right = "gauge"
+  or
+  wrong = "guarentee" and right = "guarantee"
+  or
+  wrong = "guarenteed" and right = "guaranteed"
+  or
+  wrong = "guarentees" and right = "guarantees"
+  or
+  wrong = "guatamala" and right = "guatemala"
+  or
+  wrong = "guatamalan" and right = "guatemalan"
+  or
+  wrong = "guerrila" and right = "guerrilla"
+  or
+  wrong = "guerrilas" and right = "guerrillas"
+  or
+  wrong = "guidence" and right = "guidance"
+  or
+  wrong = "guilia" and right = "giulia"
+  or
+  wrong = "guilio" and right = "giulio"
+  or
+  wrong = "guiness" and right = "guinness"
+  or
+  wrong = "guiseppe" and right = "giuseppe"
+  or
+  wrong = "gunanine" and right = "guanine"
+  or
+  wrong = "gurantee" and right = "guarantee"
+  or
+  wrong = "guranteed" and right = "guaranteed"
+  or
+  wrong = "gurantees" and right = "guarantees"
+  or
+  wrong = "guttaral" and right = "guttural"
+  or
+  wrong = "gutteral" and right = "guttural"
+  or
+  wrong = "habaeus" and right = "habeas"
+  or
+  wrong = "habeus" and right = "habeas"
+  or
+  wrong = "habsbourg" and right = "habsburg"
+  or
+  wrong = "haemorrage" and right = "haemorrhage"
+  or
+  wrong = "haev" and right = "have"
+  or
+  wrong = "haev" and right = "heave"
+  or
+  wrong = "halarious" and right = "hilarious"
+  or
+  wrong = "hallowean" and right = "halloween"
+  or
+  wrong = "halp" and right = "help"
+  or
+  wrong = "hander" and right = "handler"
+  or
+  wrong = "hapen" and right = "happen"
+  or
+  wrong = "hapened" and right = "happened"
+  or
+  wrong = "hapening" and right = "happening"
+  or
+  wrong = "happend" and right = "happened"
+  or
+  wrong = "happended" and right = "happened"
+  or
+  wrong = "happenned" and right = "happened"
+  or
+  wrong = "harased" and right = "harassed"
+  or
+  wrong = "harases" and right = "harasses"
+  or
+  wrong = "harasment" and right = "harassment"
+  or
+  wrong = "harasments" and right = "harassments"
+  or
+  wrong = "harassement" and right = "harassment"
+  or
+  wrong = "harras" and right = "harass"
+  or
+  wrong = "harrased" and right = "harassed"
+  or
+  wrong = "harrases" and right = "harasses"
+  or
+  wrong = "harrasing" and right = "harassing"
+  or
+  wrong = "harrasment" and right = "harassment"
+  or
+  wrong = "harrasments" and right = "harassments"
+  or
+  wrong = "harrassed" and right = "harassed"
+  or
+  wrong = "harrasses" and right = "harassed"
+  or
+  wrong = "harrassing" and right = "harassing"
+  or
+  wrong = "harrassment" and right = "harassment"
+  or
+  wrong = "harrassments" and right = "harassments"
+  or
+  wrong = "hatian" and right = "haitian"
+  or
+  wrong = "haviest" and right = "heaviest"
+  or
+  wrong = "headquarer" and right = "headquarter"
+  or
+  wrong = "headquater" and right = "headquarter"
+  or
+  wrong = "headquatered" and right = "headquartered"
+  or
+  wrong = "headquaters" and right = "headquarters"
+  or
+  wrong = "healthercare" and right = "healthcare"
+  or
+  wrong = "heared" and right = "heard"
+  or
+  wrong = "heathy" and right = "healthy"
+  or
+  wrong = "heidelburg" and right = "heidelberg"
+  or
+  wrong = "heigher" and right = "higher"
+  or
+  wrong = "heirarchy" and right = "hierarchy"
+  or
+  wrong = "heiroglyphics" and right = "hieroglyphics"
+  or
+  wrong = "helment" and right = "helmet"
+  or
+  wrong = "helpfull" and right = "helpful"
+  or
+  wrong = "helpped" and right = "helped"
+  or
+  wrong = "hemmorhage" and right = "hemorrhage"
+  or
+  wrong = "herad" and right = "heard"
+  or
+  wrong = "herad" and right = "hera"
+  or
+  wrong = "heridity" and right = "heredity"
+  or
+  wrong = "heroe" and right = "hero"
+  or
+  wrong = "heros" and right = "heroes"
+  or
+  wrong = "hertiage" and right = "heritage"
+  or
+  wrong = "hertzs" and right = "hertz"
+  or
+  wrong = "hesistant" and right = "hesitant"
+  or
+  wrong = "heterogenous" and right = "heterogeneous"
+  or
+  wrong = "hieght" and right = "height"
+  or
+  wrong = "hierachical" and right = "hierarchical"
+  or
+  wrong = "hierachies" and right = "hierarchies"
+  or
+  wrong = "hierachy" and right = "hierarchy"
+  or
+  wrong = "hierarcical" and right = "hierarchical"
+  or
+  wrong = "hierarcy" and right = "hierarchy"
+  or
+  wrong = "hieroglph" and right = "hieroglyph"
+  or
+  wrong = "hieroglphs" and right = "hieroglyphs"
+  or
+  wrong = "higer" and right = "higher"
+  or
+  wrong = "higest" and right = "highest"
+  or
+  wrong = "higway" and right = "highway"
+  or
+  wrong = "hillarious" and right = "hilarious"
+  or
+  wrong = "himselv" and right = "himself"
+  or
+  wrong = "hinderance" and right = "hindrance"
+  or
+  wrong = "hinderence" and right = "hindrance"
+  or
+  wrong = "hindrence" and right = "hindrance"
+  or
+  wrong = "hipopotamus" and right = "hippopotamus"
+  or
+  wrong = "hismelf" and right = "himself"
+  or
+  wrong = "histocompatability" and right = "histocompatibility"
+  or
+  wrong = "historicians" and right = "historians"
+  or
+  wrong = "holf" and right = "hold"
+  or
+  wrong = "holliday" and right = "holiday"
+  or
+  wrong = "homogeneize" and right = "homogenize"
+  or
+  wrong = "homogeneized" and right = "homogenized"
+  or
+  wrong = "honory" and right = "honorary"
+  or
+  wrong = "horrifing" and right = "horrifying"
+  or
+  wrong = "hosited" and right = "hoisted"
+  or
+  wrong = "hospitible" and right = "hospitable"
+  or
+  wrong = "hounour" and right = "honour"
+  or
+  wrong = "housr" and right = "hours"
+  or
+  wrong = "housr" and right = "house"
+  or
+  wrong = "howver" and right = "however"
+  or
+  wrong = "hsitorians" and right = "historians"
+  or
+  wrong = "hstory" and right = "history"
+  or
+  wrong = "hten" and right = "hen"
+  or
+  wrong = "hten" and right = "the"
+  or
+  wrong = "hten" and right = "then"
+  or
+  wrong = "htere" and right = "here"
+  or
+  wrong = "htere" and right = "there"
+  or
+  wrong = "htey" and right = "they"
+  or
+  wrong = "htikn" and right = "think"
+  or
+  wrong = "hting" and right = "thing"
+  or
+  wrong = "htink" and right = "think"
+  or
+  wrong = "htis" and right = "this"
+  or
+  wrong = "humer" and right = "humor"
+  or
+  wrong = "humer" and right = "humour"
+  or
+  wrong = "humerous" and right = "humerus"
+  or
+  wrong = "humerous" and right = "humorous"
+  or
+  wrong = "huminoid" and right = "humanoid"
+  or
+  wrong = "humoural" and right = "humoral"
+  or
+  wrong = "humurous" and right = "humorous"
+  or
+  wrong = "husban" and right = "husband"
+  or
+  wrong = "hvae" and right = "have"
+  or
+  wrong = "hvaing" and right = "having"
+  or
+  wrong = "hvea" and right = "have"
+  or
+  wrong = "hvea" and right = "heave"
+  or
+  wrong = "hwihc" and right = "which"
+  or
+  wrong = "hwile" and right = "while"
+  or
+  wrong = "hwole" and right = "whole"
+  or
+  wrong = "hydogen" and right = "hydrogen"
+  or
+  wrong = "hydropile" and right = "hydrophile"
+  or
+  wrong = "hydropilic" and right = "hydrophilic"
+  or
+  wrong = "hydropobe" and right = "hydrophobe"
+  or
+  wrong = "hydropobic" and right = "hydrophobic"
+  or
+  wrong = "hygeine" and right = "hygiene"
+  or
+  wrong = "hyjack" and right = "hijack"
+  or
+  wrong = "hyjacking" and right = "hijacking"
+  or
+  wrong = "hypocracy" and right = "hypocrisy"
+  or
+  wrong = "hypocrasy" and right = "hypocrisy"
+  or
+  wrong = "hypocricy" and right = "hypocrisy"
+  or
+  wrong = "hypocrit" and right = "hypocrite"
+  or
+  wrong = "hypocrits" and right = "hypocrites"
+  or
+  wrong = "iconclastic" and right = "iconoclastic"
+  or
+  wrong = "idaeidae" and right = "idea"
+  or
+  wrong = "idaes" and right = "ideas"
+  or
+  wrong = "idealogies" and right = "ideologies"
+  or
+  wrong = "idealogy" and right = "ideology"
+  or
+  wrong = "identicial" and right = "identical"
+  or
+  wrong = "identifers" and right = "identifiers"
+  or
+  wrong = "ideosyncratic" and right = "idiosyncratic"
+  or
+  wrong = "idesa" and right = "ideas"
+  or
+  wrong = "idesa" and right = "ides"
+  or
+  wrong = "idiosyncracy" and right = "idiosyncrasy"
+  or
+  wrong = "ihaca" and right = "ithaca"
+  or
+  wrong = "illegimacy" and right = "illegitimacy"
+  or
+  wrong = "illegitmate" and right = "illegitimate"
+  or
+  wrong = "illess" and right = "illness"
+  or
+  wrong = "illiegal" and right = "illegal"
+  or
+  wrong = "illution" and right = "illusion"
+  or
+  wrong = "ilness" and right = "illness"
+  or
+  wrong = "ilogical" and right = "illogical"
+  or
+  wrong = "imagenary" and right = "imaginary"
+  or
+  wrong = "imagin" and right = "imagine"
+  or
+  wrong = "imaginery" and right = "imagery"
+  or
+  wrong = "imaginery" and right = "imaginary"
+  or
+  wrong = "imanent" and right = "eminent"
+  or
+  wrong = "imanent" and right = "imminent"
+  or
+  wrong = "imcomplete" and right = "incomplete"
+  or
+  wrong = "imediately" and right = "immediately"
+  or
+  wrong = "imense" and right = "immense"
+  or
+  wrong = "imigrant" and right = "emigrant"
+  or
+  wrong = "imigrant" and right = "immigrant"
+  or
+  wrong = "imigrated" and right = "emigrated"
+  or
+  wrong = "imigrated" and right = "immigrated"
+  or
+  wrong = "imigration" and right = "emigration"
+  or
+  wrong = "imigration" and right = "immigration"
+  or
+  wrong = "iminent" and right = "eminent"
+  or
+  wrong = "iminent" and right = "immanent"
+  or
+  wrong = "iminent" and right = "imminent"
+  or
+  wrong = "immediatley" and right = "immediately"
+  or
+  wrong = "immediatly" and right = "immediately"
+  or
+  wrong = "immidately" and right = "immediately"
+  or
+  wrong = "immidiately" and right = "immediately"
+  or
+  wrong = "immitate" and right = "imitate"
+  or
+  wrong = "immitated" and right = "imitated"
+  or
+  wrong = "immitating" and right = "imitating"
+  or
+  wrong = "immitator" and right = "imitator"
+  or
+  wrong = "immunosupressant" and right = "immunosuppressant"
+  or
+  wrong = "impecabbly" and right = "impeccably"
+  or
+  wrong = "impedence" and right = "impedance"
+  or
+  wrong = "implamenting" and right = "implementing"
+  or
+  wrong = "impliment" and right = "implement"
+  or
+  wrong = "implimented" and right = "implemented"
+  or
+  wrong = "imploys" and right = "employs"
+  or
+  wrong = "importamt" and right = "important"
+  or
+  wrong = "impressario" and right = "impresario"
+  or
+  wrong = "imprioned" and right = "imprisoned"
+  or
+  wrong = "imprisonned" and right = "imprisoned"
+  or
+  wrong = "improvision" and right = "improvisation"
+  or
+  wrong = "improvments" and right = "improvements"
+  or
+  wrong = "inablility" and right = "inability"
+  or
+  wrong = "inaccessable" and right = "inaccessible"
+  or
+  wrong = "inadiquate" and right = "inadequate"
+  or
+  wrong = "inadquate" and right = "inadequate"
+  or
+  wrong = "inadvertant" and right = "inadvertent"
+  or
+  wrong = "inadvertantly" and right = "inadvertently"
+  or
+  wrong = "inagurated" and right = "inaugurated"
+  or
+  wrong = "inaguration" and right = "inauguration"
+  or
+  wrong = "inappropiate" and right = "inappropriate"
+  or
+  wrong = "inaugures" and right = "inaugurates"
+  or
+  wrong = "inbalance" and right = "imbalance"
+  or
+  wrong = "inbalanced" and right = "imbalanced"
+  or
+  wrong = "inbetween" and right = "between"
+  or
+  wrong = "incarcirated" and right = "incarcerated"
+  or
+  wrong = "incidentially" and right = "incidentally"
+  or
+  wrong = "incidently" and right = "incidentally"
+  or
+  wrong = "inclreased" and right = "increased"
+  or
+  wrong = "includ" and right = "include"
+  or
+  wrong = "includng" and right = "including"
+  or
+  wrong = "incompatabilities" and right = "incompatibilities"
+  or
+  wrong = "incompatability" and right = "incompatibility"
+  or
+  wrong = "incompatable" and right = "incompatible"
+  or
+  wrong = "incompatablities" and right = "incompatibilities"
+  or
+  wrong = "incompatablity" and right = "incompatibility"
+  or
+  wrong = "incompatiblities" and right = "incompatibilities"
+  or
+  wrong = "incompatiblity" and right = "incompatibility"
+  or
+  wrong = "incompetance" and right = "incompetence"
+  or
+  wrong = "incompetant" and right = "incompetent"
+  or
+  wrong = "incomptable" and right = "incompatible"
+  or
+  wrong = "incomptetent" and right = "incompetent"
+  or
+  wrong = "inconsistant" and right = "inconsistent"
+  or
+  wrong = "incoroporated" and right = "incorporated"
+  or
+  wrong = "incorperation" and right = "incorporation"
+  or
+  wrong = "incorportaed" and right = "incorporated"
+  or
+  wrong = "incorprates" and right = "incorporates"
+  or
+  wrong = "incorruptable" and right = "incorruptible"
+  or
+  wrong = "incramentally" and right = "incrementally"
+  or
+  wrong = "increadible" and right = "incredible"
+  or
+  wrong = "incredable" and right = "incredible"
+  or
+  wrong = "inctroduce" and right = "introduce"
+  or
+  wrong = "inctroduced" and right = "introduced"
+  or
+  wrong = "incuding" and right = "including"
+  or
+  wrong = "incunabla" and right = "incunabula"
+  or
+  wrong = "indefinately" and right = "indefinitely"
+  or
+  wrong = "indefineable" and right = "undefinable"
+  or
+  wrong = "indefinitly" and right = "indefinitely"
+  or
+  wrong = "indentical" and right = "identical"
+  or
+  wrong = "indepedantly" and right = "independently"
+  or
+  wrong = "indepedence" and right = "independence"
+  or
+  wrong = "independance" and right = "independence"
+  or
+  wrong = "independant" and right = "independent"
+  or
+  wrong = "independantly" and right = "independently"
+  or
+  wrong = "independece" and right = "independence"
+  or
+  wrong = "independendet" and right = "independent"
+  or
+  wrong = "indespensable" and right = "indispensable"
+  or
+  wrong = "indespensible" and right = "indispensable"
+  or
+  wrong = "indictement" and right = "indictment"
+  or
+  wrong = "indigineous" and right = "indigenous"
+  or
+  wrong = "indipendence" and right = "independence"
+  or
+  wrong = "indipendent" and right = "independent"
+  or
+  wrong = "indipendently" and right = "independently"
+  or
+  wrong = "indispensible" and right = "indispensable"
+  or
+  wrong = "indisputible" and right = "indisputable"
+  or
+  wrong = "indisputibly" and right = "indisputably"
+  or
+  wrong = "indite" and right = "indict"
+  or
+  wrong = "individualy" and right = "individually"
+  or
+  wrong = "indpendent" and right = "independent"
+  or
+  wrong = "indpendently" and right = "independently"
+  or
+  wrong = "indulgue" and right = "indulge"
+  or
+  wrong = "indutrial" and right = "industrial"
+  or
+  wrong = "indviduals" and right = "individuals"
+  or
+  wrong = "inefficienty" and right = "inefficiently"
+  or
+  wrong = "inevatible" and right = "inevitable"
+  or
+  wrong = "inevitible" and right = "inevitable"
+  or
+  wrong = "inevititably" and right = "inevitably"
+  or
+  wrong = "infalability" and right = "infallibility"
+  or
+  wrong = "infallable" and right = "infallible"
+  or
+  wrong = "infectuous" and right = "infectious"
+  or
+  wrong = "infered" and right = "inferred"
+  or
+  wrong = "infilitrate" and right = "infiltrate"
+  or
+  wrong = "infilitrated" and right = "infiltrated"
+  or
+  wrong = "infilitration" and right = "infiltration"
+  or
+  wrong = "infinit" and right = "infinite"
+  or
+  wrong = "inflamation" and right = "inflammation"
+  or
+  wrong = "influencial" and right = "influential"
+  or
+  wrong = "influented" and right = "influenced"
+  or
+  wrong = "infomation" and right = "information"
+  or
+  wrong = "informtion" and right = "information"
+  or
+  wrong = "infrantryman" and right = "infantryman"
+  or
+  wrong = "infrigement" and right = "infringement"
+  or
+  wrong = "ingenius" and right = "ingenious"
+  or
+  wrong = "ingreediants" and right = "ingredients"
+  or
+  wrong = "inhabitans" and right = "inhabitants"
+  or
+  wrong = "inherantly" and right = "inherently"
+  or
+  wrong = "inheritage" and right = "heritage"
+  or
+  wrong = "inheritage" and right = "inheritance"
+  or
+  wrong = "inheritence" and right = "inheritance"
+  or
+  wrong = "inital" and right = "initial"
+  or
+  wrong = "initalize" and right = "initialize"
+  or
+  wrong = "initally" and right = "initially"
+  or
+  wrong = "initation" and right = "initiation"
+  or
+  wrong = "initiaitive" and right = "initiative"
+  or
+  wrong = "inlcuding" and right = "including"
+  or
+  wrong = "inmigrant" and right = "immigrant"
+  or
+  wrong = "inmigrants" and right = "immigrants"
+  or
+  wrong = "innoculated" and right = "inoculated"
+  or
+  wrong = "inocence" and right = "innocence"
+  or
+  wrong = "inofficial" and right = "unofficial"
+  or
+  wrong = "inot" and right = "into"
+  or
+  wrong = "inpeach" and right = "impeach"
+  or
+  wrong = "inpending" and right = "impending"
+  or
+  wrong = "inpenetrable" and right = "impenetrable"
+  or
+  wrong = "inpolite" and right = "impolite"
+  or
+  wrong = "inprisonment" and right = "imprisonment"
+  or
+  wrong = "inproving" and right = "improving"
+  or
+  wrong = "insectiverous" and right = "insectivorous"
+  or
+  wrong = "insensative" and right = "insensitive"
+  or
+  wrong = "inseperable" and right = "inseparable"
+  or
+  wrong = "insistance" and right = "insistence"
+  or
+  wrong = "insitution" and right = "institution"
+  or
+  wrong = "insitutions" and right = "institutions"
+  or
+  wrong = "inspite" and right = "inspire"
+  or
+  wrong = "instade" and right = "instead"
+  or
+  wrong = "instatance" and right = "instance"
+  or
+  wrong = "institue" and right = "institute"
+  or
+  wrong = "instuction" and right = "instruction"
+  or
+  wrong = "instuments" and right = "instruments"
+  or
+  wrong = "instutionalized" and right = "institutionalized"
+  or
+  wrong = "instutions" and right = "intuitions"
+  or
+  wrong = "insurence" and right = "insurance"
+  or
+  wrong = "intelectual" and right = "intellectual"
+  or
+  wrong = "inteligence" and right = "intelligence"
+  or
+  wrong = "inteligent" and right = "intelligent"
+  or
+  wrong = "intenational" and right = "international"
+  or
+  wrong = "intented" and right = "indented"
+  or
+  wrong = "intented" and right = "intended"
+  or
+  wrong = "intepretation" and right = "interpretation"
+  or
+  wrong = "intepretator" and right = "interpretor"
+  or
+  wrong = "interational" and right = "international"
+  or
+  wrong = "interbread" and right = "interbred"
+  or
+  wrong = "interbread" and right = "interbreed"
+  or
+  wrong = "interchangable" and right = "interchangeable"
+  or
+  wrong = "interchangably" and right = "interchangeably"
+  or
+  wrong = "intercontinential" and right = "intercontinental"
+  or
+  wrong = "intercontinetal" and right = "intercontinental"
+  or
+  wrong = "intered" and right = "interned"
+  or
+  wrong = "intered" and right = "interred"
+  or
+  wrong = "interelated" and right = "interrelated"
+  or
+  wrong = "interferance" and right = "interference"
+  or
+  wrong = "interfereing" and right = "interfering"
+  or
+  wrong = "intergrated" and right = "integrated"
+  or
+  wrong = "intergration" and right = "integration"
+  or
+  wrong = "interm" and right = "interim"
+  or
+  wrong = "internation" and right = "international"
+  or
+  wrong = "interpet" and right = "interpret"
+  or
+  wrong = "interrim" and right = "interim"
+  or
+  wrong = "interrugum" and right = "interregnum"
+  or
+  wrong = "intertaining" and right = "entertaining"
+  or
+  wrong = "interupt" and right = "interrupt"
+  or
+  wrong = "intervines" and right = "intervenes"
+  or
+  wrong = "intevene" and right = "intervene"
+  or
+  wrong = "intial" and right = "initial"
+  or
+  wrong = "intialize" and right = "initialize"
+  or
+  wrong = "intialized" and right = "initialized"
+  or
+  wrong = "intially" and right = "initially"
+  or
+  wrong = "intrduced" and right = "introduced"
+  or
+  wrong = "intrest" and right = "interest"
+  or
+  wrong = "introdued" and right = "introduced"
+  or
+  wrong = "intruduced" and right = "introduced"
+  or
+  wrong = "intrument" and right = "instrument"
+  or
+  wrong = "intrumental" and right = "instrumental"
+  or
+  wrong = "intruments" and right = "instruments"
+  or
+  wrong = "intrusted" and right = "entrusted"
+  or
+  wrong = "intutive" and right = "intuitive"
+  or
+  wrong = "intutively" and right = "intuitively"
+  or
+  wrong = "inudstry" and right = "industry"
+  or
+  wrong = "inumerable" and right = "enumerable"
+  or
+  wrong = "inumerable" and right = "innumerable"
+  or
+  wrong = "inventer" and right = "inventor"
+  or
+  wrong = "invertibrates" and right = "invertebrates"
+  or
+  wrong = "investingate" and right = "investigate"
+  or
+  wrong = "involvment" and right = "involvement"
+  or
+  wrong = "irelevent" and right = "irrelevant"
+  or
+  wrong = "iresistable" and right = "irresistible"
+  or
+  wrong = "iresistably" and right = "irresistibly"
+  or
+  wrong = "iresistible" and right = "irresistible"
+  or
+  wrong = "iresistibly" and right = "irresistibly"
+  or
+  wrong = "iritable" and right = "irritable"
+  or
+  wrong = "iritated" and right = "irritated"
+  or
+  wrong = "ironicly" and right = "ironically"
+  or
+  wrong = "irregardless" and right = "regardless"
+  or
+  wrong = "irrelevent" and right = "irrelevant"
+  or
+  wrong = "irreplacable" and right = "irreplaceable"
+  or
+  wrong = "irresistable" and right = "irresistible"
+  or
+  wrong = "irresistably" and right = "irresistibly"
+  or
+  wrong = "israelies" and right = "israelis"
+  or
+  wrong = "issueing" and right = "issuing"
+  or
+  wrong = "itnroduced" and right = "introduced"
+  or
+  wrong = "iunior" and right = "junior"
+  or
+  wrong = "iwll" and right = "will"
+  or
+  wrong = "iwth" and right = "with"
+  or
+  wrong = "janurary" and right = "january"
+  or
+  wrong = "januray" and right = "january"
+  or
+  wrong = "japanes" and right = "japanese"
+  or
+  wrong = "jaques" and right = "jacques"
+  or
+  wrong = "jeapardy" and right = "jeopardy"
+  or
+  wrong = "jewllery" and right = "jewellery"
+  or
+  wrong = "johanine" and right = "johannine"
+  or
+  wrong = "jorunal" and right = "journal"
+  or
+  wrong = "jospeh" and right = "joseph"
+  or
+  wrong = "jouney" and right = "journey"
+  or
+  wrong = "journied" and right = "journeyed"
+  or
+  wrong = "journies" and right = "journeys"
+  or
+  wrong = "jstu" and right = "just"
+  or
+  wrong = "jsut" and right = "just"
+  or
+  wrong = "juadaism" and right = "judaism"
+  or
+  wrong = "juadism" and right = "judaism"
+  or
+  wrong = "judical" and right = "judicial"
+  or
+  wrong = "judisuary" and right = "judiciary"
+  or
+  wrong = "juducial" and right = "judicial"
+  or
+  wrong = "juristiction" and right = "jurisdiction"
+  or
+  wrong = "juristictions" and right = "jurisdictions"
+  or
+  wrong = "kindergarden" and right = "kindergarten"
+  or
+  wrong = "klenex" and right = "kleenex"
+  or
+  wrong = "knifes" and right = "knives"
+  or
+  wrong = "knive" and right = "knife"
+  or
+  wrong = "knowlege" and right = "knowledge"
+  or
+  wrong = "knowlegeable" and right = "knowledgeable"
+  or
+  wrong = "knwo" and right = "know"
+  or
+  wrong = "knwos" and right = "knows"
+  or
+  wrong = "konw" and right = "know"
+  or
+  wrong = "konws" and right = "knows"
+  or
+  wrong = "kwno" and right = "know"
+  or
+  wrong = "labatory" and right = "laboratory"
+  or
+  wrong = "labatory" and right = "lavatory"
+  or
+  wrong = "labled" and right = "labeled"
+  or
+  wrong = "labled" and right = "labelled"
+  or
+  wrong = "labratory" and right = "laboratory"
+  or
+  wrong = "laguage" and right = "language"
+  or
+  wrong = "laguages" and right = "languages"
+  or
+  wrong = "langage" and right = "language"
+  or
+  wrong = "langauge" and right = "language"
+  or
+  wrong = "larg" and right = "large"
+  or
+  wrong = "largst" and right = "largest"
+  or
+  wrong = "larrry" and right = "larry"
+  or
+  wrong = "lastr" and right = "last"
+  or
+  wrong = "lattitude" and right = "latitude"
+  or
+  wrong = "launchs" and right = "launch"
+  or
+  wrong = "launchs" and right = "launches"
+  or
+  wrong = "launhed" and right = "launched"
+  or
+  wrong = "lavae" and right = "larvae"
+  or
+  wrong = "layed" and right = "laid"
+  or
+  wrong = "lazyness" and right = "laziness"
+  or
+  wrong = "leage" and right = "league"
+  or
+  wrong = "leanr" and right = "lean"
+  or
+  wrong = "leanr" and right = "leaner"
+  or
+  wrong = "leanr" and right = "learn"
+  or
+  wrong = "leathal" and right = "lethal"
+  or
+  wrong = "lefted" and right = "left"
+  or
+  wrong = "legitamate" and right = "legitimate"
+  or
+  wrong = "legitmate" and right = "legitimate"
+  or
+  wrong = "leibnitz" and right = "leibniz"
+  or
+  wrong = "lengh" and right = "length"
+  or
+  wrong = "lenght" and right = "length"
+  or
+  wrong = "lengt" and right = "length"
+  or
+  wrong = "lenth" and right = "length"
+  or
+  wrong = "leran" and right = "learn"
+  or
+  wrong = "lerans" and right = "learns"
+  or
+  wrong = "leutenant" and right = "lieutenant"
+  or
+  wrong = "levetate" and right = "levitate"
+  or
+  wrong = "levetated" and right = "levitated"
+  or
+  wrong = "levetates" and right = "levitates"
+  or
+  wrong = "levetating" and right = "levitating"
+  or
+  wrong = "levle" and right = "level"
+  or
+  wrong = "liasion" and right = "liaison"
+  or
+  wrong = "liason" and right = "liaison"
+  or
+  wrong = "liasons" and right = "liaisons"
+  or
+  wrong = "libaries" and right = "libraries"
+  or
+  wrong = "libary" and right = "library"
+  or
+  wrong = "libell" and right = "libel"
+  or
+  wrong = "libguistic" and right = "linguistic"
+  or
+  wrong = "libguistics" and right = "linguistics"
+  or
+  wrong = "libitarianisn" and right = "libertarianism"
+  or
+  wrong = "lible" and right = "liable"
+  or
+  wrong = "lible" and right = "libel"
+  or
+  wrong = "lieing" and right = "lying"
+  or
+  wrong = "liek" and right = "like"
+  or
+  wrong = "liekd" and right = "liked"
+  or
+  wrong = "liesure" and right = "leisure"
+  or
+  wrong = "lieuenant" and right = "lieutenant"
+  or
+  wrong = "lieved" and right = "lived"
+  or
+  wrong = "liftime" and right = "lifetime"
+  or
+  wrong = "likelyhood" and right = "likelihood"
+  or
+  wrong = "linnaena" and right = "linnaean"
+  or
+  wrong = "lippizaner" and right = "lipizzaner"
+  or
+  wrong = "liquify" and right = "liquefy"
+  or
+  wrong = "liscense" and right = "licence"
+  or
+  wrong = "liscense" and right = "license"
+  or
+  wrong = "lisence" and right = "licence"
+  or
+  wrong = "lisence" and right = "license"
+  or
+  wrong = "lisense" and right = "licence"
+  or
+  wrong = "lisense" and right = "license"
+  or
+  wrong = "listners" and right = "listeners"
+  or
+  wrong = "litature" and right = "literature"
+  or
+  wrong = "literaly" and right = "literally"
+  or
+  wrong = "literture" and right = "literature"
+  or
+  wrong = "littel" and right = "little"
+  or
+  wrong = "litterally" and right = "literally"
+  or
+  wrong = "liuke" and right = "like"
+  or
+  wrong = "livley" and right = "lively"
+  or
+  wrong = "lmits" and right = "limits"
+  or
+  wrong = "loev" and right = "love"
+  or
+  wrong = "lonelyness" and right = "loneliness"
+  or
+  wrong = "longitudonal" and right = "longitudinal"
+  or
+  wrong = "lonley" and right = "lonely"
+  or
+  wrong = "lonly" and right = "lonely"
+  or
+  wrong = "lonly" and right = "only"
+  or
+  wrong = "loosing" and right = "losing"
+  or
+  wrong = "lotharingen" and right = "lothringen"
+  or
+  wrong = "lsat" and right = "last"
+  or
+  wrong = "lukid" and right = "likud"
+  or
+  wrong = "lveo" and right = "love"
+  or
+  wrong = "lvoe" and right = "love"
+  or
+  wrong = "lybia" and right = "libya"
+  or
+  wrong = "maching" and right = "machine"
+  or
+  wrong = "maching" and right = "marching"
+  or
+  wrong = "maching" and right = "matching"
+  or
+  wrong = "mackeral" and right = "mackerel"
+  or
+  wrong = "magasine" and right = "magazine"
+  or
+  wrong = "magincian" and right = "magician"
+  or
+  wrong = "magisine" and right = "magazine"
+  or
+  wrong = "magizine" and right = "magazine"
+  or
+  wrong = "magnificient" and right = "magnificent"
+  or
+  wrong = "magolia" and right = "magnolia"
+  or
+  wrong = "mailny" and right = "mainly"
+  or
+  wrong = "maintainance" and right = "maintenance"
+  or
+  wrong = "maintainence" and right = "maintenance"
+  or
+  wrong = "maintance" and right = "maintenance"
+  or
+  wrong = "maintenence" and right = "maintenance"
+  or
+  wrong = "maintinaing" and right = "maintaining"
+  or
+  wrong = "maintioned" and right = "mentioned"
+  or
+  wrong = "majoroty" and right = "majority"
+  or
+  wrong = "maked" and right = "made"
+  or
+  wrong = "maked" and right = "marked"
+  or
+  wrong = "makse" and right = "makes"
+  or
+  wrong = "malcom" and right = "malcolm"
+  or
+  wrong = "maltesian" and right = "maltese"
+  or
+  wrong = "mamal" and right = "mammal"
+  or
+  wrong = "mamalian" and right = "mammalian"
+  or
+  wrong = "managable" and right = "manageable"
+  or
+  wrong = "managable" and right = "manageably"
+  or
+  wrong = "managment" and right = "management"
+  or
+  wrong = "maneouvre" and right = "manoeuvre"
+  or
+  wrong = "maneouvred" and right = "manoeuvred"
+  or
+  wrong = "maneouvres" and right = "manoeuvres"
+  or
+  wrong = "maneouvring" and right = "manoeuvring"
+  or
+  wrong = "manisfestations" and right = "manifestations"
+  or
+  wrong = "manoeuverability" and right = "maneuverability"
+  or
+  wrong = "manouver" and right = "maneuver"
+  or
+  wrong = "manouver" and right = "manoeuvre"
+  or
+  wrong = "manouverability" and right = "maneuverability"
+  or
+  wrong = "manouverability" and right = "manoeuverability"
+  or
+  wrong = "manouverability" and right = "manoeuvrability"
+  or
+  wrong = "manouverable" and right = "maneuverable"
+  or
+  wrong = "manouverable" and right = "manoeuvrable"
+  or
+  wrong = "manouvers" and right = "maneuvers"
+  or
+  wrong = "manouvers" and right = "manoeuvres"
+  or
+  wrong = "mantained" and right = "maintained"
+  or
+  wrong = "manuever" and right = "maneuver"
+  or
+  wrong = "manuever" and right = "manoeuvre"
+  or
+  wrong = "manuevers" and right = "maneuvers"
+  or
+  wrong = "manuevers" and right = "manoeuvres"
+  or
+  wrong = "manufacturedd" and right = "manufactured"
+  or
+  wrong = "manufature" and right = "manufacture"
+  or
+  wrong = "manufatured" and right = "manufactured"
+  or
+  wrong = "manufaturing" and right = "manufacturing"
+  or
+  wrong = "manuver" and right = "maneuver"
+  or
+  wrong = "mariage" and right = "marriage"
+  or
+  wrong = "marjority" and right = "majority"
+  or
+  wrong = "markes" and right = "marks"
+  or
+  wrong = "marketting" and right = "marketing"
+  or
+  wrong = "marmelade" and right = "marmalade"
+  or
+  wrong = "marrage" and right = "marriage"
+  or
+  wrong = "marraige" and right = "marriage"
+  or
+  wrong = "marrtyred" and right = "martyred"
+  or
+  wrong = "marryied" and right = "married"
+  or
+  wrong = "massachussets" and right = "massachusetts"
+  or
+  wrong = "massachussetts" and right = "massachusetts"
+  or
+  wrong = "masterbation" and right = "masturbation"
+  or
+  wrong = "mataphysical" and right = "metaphysical"
+  or
+  wrong = "materalists" and right = "materialist"
+  or
+  wrong = "mathamatics" and right = "mathematics"
+  or
+  wrong = "mathematican" and right = "mathematician"
+  or
+  wrong = "mathematicas" and right = "mathematics"
+  or
+  wrong = "matheticians" and right = "mathematicians"
+  or
+  wrong = "mathmatically" and right = "mathematically"
+  or
+  wrong = "mathmatician" and right = "mathematician"
+  or
+  wrong = "mathmaticians" and right = "mathematicians"
+  or
+  wrong = "mccarthyst" and right = "mccarthyist"
+  or
+  wrong = "mchanics" and right = "mechanics"
+  or
+  wrong = "meaninng" and right = "meaning"
+  or
+  wrong = "mear" and right = "mare"
+  or
+  wrong = "mear" and right = "mere"
+  or
+  wrong = "mear" and right = "wear"
+  or
+  wrong = "mechandise" and right = "merchandise"
+  or
+  wrong = "medacine" and right = "medicine"
+  or
+  wrong = "medeival" and right = "medieval"
+  or
+  wrong = "medevial" and right = "medieval"
+  or
+  wrong = "mediciney" and right = "mediciny"
+  or
+  wrong = "medievel" and right = "medieval"
+  or
+  wrong = "mediterainnean" and right = "mediterranean"
+  or
+  wrong = "mediteranean" and right = "mediterranean"
+  or
+  wrong = "meerkrat" and right = "meerkat"
+  or
+  wrong = "melieux" and right = "milieux"
+  or
+  wrong = "membranaphone" and right = "membranophone"
+  or
+  wrong = "memeber" and right = "member"
+  or
+  wrong = "menally" and right = "mentally"
+  or
+  wrong = "meranda" and right = "miranda"
+  or
+  wrong = "meranda" and right = "veranda"
+  or
+  wrong = "mercentile" and right = "mercantile"
+  or
+  wrong = "mesage" and right = "message"
+  or
+  wrong = "messanger" and right = "messenger"
+  or
+  wrong = "messenging" and right = "messaging"
+  or
+  wrong = "messsage" and right = "message"
+  or
+  wrong = "metalic" and right = "metallic"
+  or
+  wrong = "metalurgic" and right = "metallurgic"
+  or
+  wrong = "metalurgical" and right = "metallurgical"
+  or
+  wrong = "metalurgy" and right = "metallurgy"
+  or
+  wrong = "metamorphysis" and right = "metamorphosis"
+  or
+  wrong = "metaphoricial" and right = "metaphorical"
+  or
+  wrong = "meterologist" and right = "meteorologist"
+  or
+  wrong = "meterology" and right = "meteorology"
+  or
+  wrong = "methaphor" and right = "metaphor"
+  or
+  wrong = "methaphors" and right = "metaphors"
+  or
+  wrong = "michagan" and right = "michigan"
+  or
+  wrong = "micoscopy" and right = "microscopy"
+  or
+  wrong = "midwifes" and right = "midwives"
+  or
+  wrong = "mileau" and right = "milieu"
+  or
+  wrong = "milennia" and right = "millennia"
+  or
+  wrong = "milennium" and right = "millennium"
+  or
+  wrong = "mileu" and right = "milieu"
+  or
+  wrong = "miliary" and right = "military"
+  or
+  wrong = "miligram" and right = "milligram"
+  or
+  wrong = "milion" and right = "million"
+  or
+  wrong = "miliraty" and right = "military"
+  or
+  wrong = "millenia" and right = "millennia"
+  or
+  wrong = "millenial" and right = "millennial"
+  or
+  wrong = "millenialism" and right = "millennialism"
+  or
+  wrong = "millenium" and right = "millennium"
+  or
+  wrong = "millepede" and right = "millipede"
+  or
+  wrong = "millioniare" and right = "millionaire"
+  or
+  wrong = "millitant" and right = "militant"
+  or
+  wrong = "millitary" and right = "military"
+  or
+  wrong = "millon" and right = "million"
+  or
+  wrong = "miltary" and right = "military"
+  or
+  wrong = "minature" and right = "miniature"
+  or
+  wrong = "minerial" and right = "mineral"
+  or
+  wrong = "ministery" and right = "ministry"
+  or
+  wrong = "minsitry" and right = "ministry"
+  or
+  wrong = "minstries" and right = "ministries"
+  or
+  wrong = "minstry" and right = "ministry"
+  or
+  wrong = "minumum" and right = "minimum"
+  or
+  wrong = "mirrorred" and right = "mirrored"
+  or
+  wrong = "miscelaneous" and right = "miscellaneous"
+  or
+  wrong = "miscellanious" and right = "miscellaneous"
+  or
+  wrong = "miscellanous" and right = "miscellaneous"
+  or
+  wrong = "mischeivous" and right = "mischievous"
+  or
+  wrong = "mischevious" and right = "mischievous"
+  or
+  wrong = "mischievious" and right = "mischievous"
+  or
+  wrong = "misdameanor" and right = "misdemeanor"
+  or
+  wrong = "misdameanors" and right = "misdemeanors"
+  or
+  wrong = "misdemenor" and right = "misdemeanor"
+  or
+  wrong = "misdemenors" and right = "misdemeanors"
+  or
+  wrong = "misfourtunes" and right = "misfortunes"
+  or
+  wrong = "misile" and right = "missile"
+  or
+  wrong = "misouri" and right = "missouri"
+  or
+  wrong = "mispell" and right = "misspell"
+  or
+  wrong = "mispelled" and right = "misspelled"
+  or
+  wrong = "mispelling" and right = "misspelling"
+  or
+  wrong = "missen" and right = "mizzen"
+  or
+  wrong = "missisipi" and right = "mississippi"
+  or
+  wrong = "missisippi" and right = "mississippi"
+  or
+  wrong = "missle" and right = "missile"
+  or
+  wrong = "missonary" and right = "missionary"
+  or
+  wrong = "misterious" and right = "mysterious"
+  or
+  wrong = "mistery" and right = "mystery"
+  or
+  wrong = "misteryous" and right = "mysterious"
+  or
+  wrong = "mkae" and right = "make"
+  or
+  wrong = "mkaes" and right = "makes"
+  or
+  wrong = "mkaing" and right = "making"
+  or
+  wrong = "mkea" and right = "make"
+  or
+  wrong = "moderm" and right = "modem"
+  or
+  wrong = "modle" and right = "model"
+  or
+  wrong = "moent" and right = "moment"
+  or
+  wrong = "moeny" and right = "money"
+  or
+  wrong = "mohammedans" and right = "muslims"
+  or
+  wrong = "moil" and right = "mohel"
+  or
+  wrong = "moil" and right = "soil"
+  or
+  wrong = "moleclues" and right = "molecules"
+  or
+  wrong = "momento" and right = "memento"
+  or
+  wrong = "monestaries" and right = "monasteries"
+  or
+  wrong = "monestary" and right = "monastery"
+  or
+  wrong = "monestary" and right = "monetary"
+  or
+  wrong = "monickers" and right = "monikers"
+  or
+  wrong = "monolite" and right = "monolithic"
+  or
+  wrong = "monserrat" and right = "montserrat"
+  or
+  wrong = "montains" and right = "mountains"
+  or
+  wrong = "montanous" and right = "mountainous"
+  or
+  wrong = "montnana" and right = "montana"
+  or
+  wrong = "monts" and right = "months"
+  or
+  wrong = "montypic" and right = "monotypic"
+  or
+  wrong = "moreso" and right = "more"
+  or
+  wrong = "morgage" and right = "mortgage"
+  or
+  wrong = "morisette" and right = "morissette"
+  or
+  wrong = "morrisette" and right = "morissette"
+  or
+  wrong = "morroccan" and right = "moroccan"
+  or
+  wrong = "morrocco" and right = "morocco"
+  or
+  wrong = "morroco" and right = "morocco"
+  or
+  wrong = "mortage" and right = "mortgage"
+  or
+  wrong = "mosture" and right = "moisture"
+  or
+  wrong = "motiviated" and right = "motivated"
+  or
+  wrong = "mounth" and right = "month"
+  or
+  wrong = "movei" and right = "movie"
+  or
+  wrong = "movment" and right = "movement"
+  or
+  wrong = "mroe" and right = "more"
+  or
+  wrong = "mucuous" and right = "mucous"
+  or
+  wrong = "muder" and right = "murder"
+  or
+  wrong = "mudering" and right = "murdering"
+  or
+  wrong = "muhammadan" and right = "muslim"
+  or
+  wrong = "multicultralism" and right = "multiculturalism"
+  or
+  wrong = "multipled" and right = "multiplied"
+  or
+  wrong = "multiplers" and right = "multipliers"
+  or
+  wrong = "munbers" and right = "numbers"
+  or
+  wrong = "muncipalities" and right = "municipalities"
+  or
+  wrong = "muncipality" and right = "municipality"
+  or
+  wrong = "munnicipality" and right = "municipality"
+  or
+  wrong = "muscels" and right = "muscles"
+  or
+  wrong = "muscels" and right = "mussels"
+  or
+  wrong = "muscial" and right = "musical"
+  or
+  wrong = "muscician" and right = "musician"
+  or
+  wrong = "muscicians" and right = "musicians"
+  or
+  wrong = "mutiliated" and right = "mutilated"
+  or
+  wrong = "mutiple" and right = "multiple"
+  or
+  wrong = "myraid" and right = "myriad"
+  or
+  wrong = "mysef" and right = "myself"
+  or
+  wrong = "mysogynist" and right = "misogynist"
+  or
+  wrong = "mysogyny" and right = "misogyny"
+  or
+  wrong = "mysterous" and right = "mysterious"
+  or
+  wrong = "mythraic" and right = "mithraic"
+  or
+  wrong = "naieve" and right = "naive"
+  or
+  wrong = "naploeon" and right = "napoleon"
+  or
+  wrong = "napolean" and right = "napoleon"
+  or
+  wrong = "napoleonian" and right = "napoleonic"
+  or
+  wrong = "naturaly" and right = "naturally"
+  or
+  wrong = "naturely" and right = "naturally"
+  or
+  wrong = "naturual" and right = "natural"
+  or
+  wrong = "naturually" and right = "naturally"
+  or
+  wrong = "nazereth" and right = "nazareth"
+  or
+  wrong = "neccesarily" and right = "necessarily"
+  or
+  wrong = "neccesary" and right = "necessary"
+  or
+  wrong = "neccessarily" and right = "necessarily"
+  or
+  wrong = "neccessary" and right = "necessary"
+  or
+  wrong = "neccessities" and right = "necessities"
+  or
+  wrong = "necesarily" and right = "necessarily"
+  or
+  wrong = "necesary" and right = "necessary"
+  or
+  wrong = "necessiate" and right = "necessitate"
+  or
+  wrong = "neglible" and right = "negligible"
+  or
+  wrong = "negligable" and right = "negligible"
+  or
+  wrong = "negociate" and right = "negotiate"
+  or
+  wrong = "negociation" and right = "negotiation"
+  or
+  wrong = "negociations" and right = "negotiations"
+  or
+  wrong = "negotation" and right = "negotiation"
+  or
+  wrong = "neice" and right = "nice"
+  or
+  wrong = "neice" and right = "niece"
+  or
+  wrong = "neigborhood" and right = "neighborhood"
+  or
+  wrong = "neigbour" and right = "neighbor"
+  or
+  wrong = "neigbour" and right = "neighbour"
+  or
+  wrong = "neigbourhood" and right = "neighbourhood"
+  or
+  wrong = "neigbouring" and right = "neighboring"
+  or
+  wrong = "neigbouring" and right = "neighbouring"
+  or
+  wrong = "neigbours" and right = "neighbors"
+  or
+  wrong = "neigbours" and right = "neighbours"
+  or
+  wrong = "neolitic" and right = "neolithic"
+  or
+  wrong = "nessasarily" and right = "necessarily"
+  or
+  wrong = "nessecary" and right = "necessary"
+  or
+  wrong = "nestin" and right = "nesting"
+  or
+  wrong = "neverthless" and right = "nevertheless"
+  or
+  wrong = "newletters" and right = "newsletters"
+  or
+  wrong = "nickle" and right = "nickel"
+  or
+  wrong = "nightime" and right = "nighttime"
+  or
+  wrong = "nineth" and right = "ninth"
+  or
+  wrong = "ninteenth" and right = "nineteenth"
+  or
+  wrong = "ninty" and right = "ninety"
+  or
+  wrong = "nkow" and right = "know"
+  or
+  wrong = "nkwo" and right = "know"
+  or
+  wrong = "nmae" and right = "name"
+  or
+  wrong = "noncombatents" and right = "noncombatants"
+  or
+  wrong = "nonsence" and right = "nonsense"
+  or
+  wrong = "nontheless" and right = "nonetheless"
+  or
+  wrong = "norhern" and right = "northern"
+  or
+  wrong = "northen" and right = "northern"
+  or
+  wrong = "northereastern" and right = "northeastern"
+  or
+  wrong = "notabley" and right = "notably"
+  or
+  wrong = "noteable" and right = "notable"
+  or
+  wrong = "noteably" and right = "notably"
+  or
+  wrong = "noteriety" and right = "notoriety"
+  or
+  wrong = "noth" and right = "north"
+  or
+  wrong = "nothern" and right = "northern"
+  or
+  wrong = "noticable" and right = "noticeable"
+  or
+  wrong = "noticably" and right = "noticeably"
+  or
+  wrong = "notications" and right = "notifications"
+  or
+  wrong = "noticeing" and right = "noticing"
+  or
+  wrong = "noticible" and right = "noticeable"
+  or
+  wrong = "notwhithstanding" and right = "notwithstanding"
+  or
+  wrong = "noveau" and right = "nouveau"
+  or
+  wrong = "novermber" and right = "november"
+  or
+  wrong = "nowdays" and right = "nowadays"
+  or
+  wrong = "nowe" and right = "now"
+  or
+  wrong = "nto" and right = "not"
+  or
+  wrong = "nubmer" and right = "number"
+  or
+  wrong = "nucular" and right = "nuclear"
+  or
+  wrong = "nuculear" and right = "nuclear"
+  or
+  wrong = "nuisanse" and right = "nuisance"
+  or
+  wrong = "nullabour" and right = "nullarbor"
+  or
+  wrong = "numberous" and right = "numerous"
+  or
+  wrong = "nuremburg" and right = "nuremberg"
+  or
+  wrong = "nusance" and right = "nuisance"
+  or
+  wrong = "nutritent" and right = "nutrient"
+  or
+  wrong = "nutritents" and right = "nutrients"
+  or
+  wrong = "nuturing" and right = "nurturing"
+  or
+  wrong = "obect" and right = "object"
+  or
+  wrong = "obediance" and right = "obedience"
+  or
+  wrong = "obediant" and right = "obedient"
+  or
+  wrong = "obejct" and right = "object"
+  or
+  wrong = "obession" and right = "obsession"
+  or
+  wrong = "obssessed" and right = "obsessed"
+  or
+  wrong = "obstacal" and right = "obstacle"
+  or
+  wrong = "obstancles" and right = "obstacles"
+  or
+  wrong = "obstruced" and right = "obstructed"
+  or
+  wrong = "ocasion" and right = "occasion"
+  or
+  wrong = "ocasional" and right = "occasional"
+  or
+  wrong = "ocasionally" and right = "occasionally"
+  or
+  wrong = "ocasionaly" and right = "occasionally"
+  or
+  wrong = "ocasioned" and right = "occasioned"
+  or
+  wrong = "ocasions" and right = "occasions"
+  or
+  wrong = "ocassion" and right = "occasion"
+  or
+  wrong = "ocassional" and right = "occasional"
+  or
+  wrong = "ocassionally" and right = "occasionally"
+  or
+  wrong = "ocassionaly" and right = "occasionally"
+  or
+  wrong = "ocassioned" and right = "occasioned"
+  or
+  wrong = "ocassions" and right = "occasions"
+  or
+  wrong = "occaison" and right = "occasion"
+  or
+  wrong = "occassion" and right = "occasion"
+  or
+  wrong = "occassional" and right = "occasional"
+  or
+  wrong = "occassionally" and right = "occasionally"
+  or
+  wrong = "occassionaly" and right = "occasionally"
+  or
+  wrong = "occassioned" and right = "occasioned"
+  or
+  wrong = "occassions" and right = "occasions"
+  or
+  wrong = "occationally" and right = "occasionally"
+  or
+  wrong = "occour" and right = "occur"
+  or
+  wrong = "occurance" and right = "occurrence"
+  or
+  wrong = "occurances" and right = "occurrences"
+  or
+  wrong = "occured" and right = "occurred"
+  or
+  wrong = "occurence" and right = "occurrence"
+  or
+  wrong = "occurences" and right = "occurrences"
+  or
+  wrong = "occuring" and right = "occurring"
+  or
+  wrong = "occurr" and right = "occur"
+  or
+  wrong = "occurrance" and right = "occurrence"
+  or
+  wrong = "occurrances" and right = "occurrences"
+  or
+  wrong = "octohedra" and right = "octahedra"
+  or
+  wrong = "octohedral" and right = "octahedral"
+  or
+  wrong = "octohedron" and right = "octahedron"
+  or
+  wrong = "ocuntries" and right = "countries"
+  or
+  wrong = "ocuntry" and right = "country"
+  or
+  wrong = "ocurr" and right = "occur"
+  or
+  wrong = "ocurrance" and right = "occurrence"
+  or
+  wrong = "ocurred" and right = "occurred"
+  or
+  wrong = "ocurrence" and right = "occurrence"
+  or
+  wrong = "offcers" and right = "officers"
+  or
+  wrong = "offcially" and right = "officially"
+  or
+  wrong = "offereings" and right = "offerings"
+  or
+  wrong = "offical" and right = "official"
+  or
+  wrong = "offically" and right = "officially"
+  or
+  wrong = "officals" and right = "officials"
+  or
+  wrong = "officaly" and right = "officially"
+  or
+  wrong = "officialy" and right = "officially"
+  or
+  wrong = "offred" and right = "offered"
+  or
+  wrong = "oftenly" and right = "often"
+  or
+  wrong = "oging" and right = "going"
+  or
+  wrong = "oging" and right = "ogling"
+  or
+  wrong = "oject" and right = "object"
+  or
+  wrong = "omision" and right = "omission"
+  or
+  wrong = "omited" and right = "omitted"
+  or
+  wrong = "omiting" and right = "omitting"
+  or
+  wrong = "omlette" and right = "omelette"
+  or
+  wrong = "ommision" and right = "omission"
+  or
+  wrong = "ommited" and right = "omitted"
+  or
+  wrong = "ommiting" and right = "omitting"
+  or
+  wrong = "ommitted" and right = "omitted"
+  or
+  wrong = "ommitting" and right = "omitting"
+  or
+  wrong = "omniverous" and right = "omnivorous"
+  or
+  wrong = "omniverously" and right = "omnivorously"
+  or
+  wrong = "omre" and right = "more"
+  or
+  wrong = "onot" and right = "not"
+  or
+  wrong = "onot" and right = "note"
+  or
+  wrong = "onyl" and right = "only"
+  or
+  wrong = "openess" and right = "openness"
+  or
+  wrong = "oponent" and right = "opponent"
+  or
+  wrong = "oportunity" and right = "opportunity"
+  or
+  wrong = "opose" and right = "oppose"
+  or
+  wrong = "oposite" and right = "opposite"
+  or
+  wrong = "oposition" and right = "opposition"
+  or
+  wrong = "oppenly" and right = "openly"
+  or
+  wrong = "oppinion" and right = "opinion"
+  or
+  wrong = "opponant" and right = "opponent"
+  or
+  wrong = "oppononent" and right = "opponent"
+  or
+  wrong = "oppositition" and right = "opposition"
+  or
+  wrong = "oppossed" and right = "opposed"
+  or
+  wrong = "opprotunity" and right = "opportunity"
+  or
+  wrong = "opression" and right = "oppression"
+  or
+  wrong = "opressive" and right = "oppressive"
+  or
+  wrong = "opthalmic" and right = "ophthalmic"
+  or
+  wrong = "opthalmologist" and right = "ophthalmologist"
+  or
+  wrong = "opthalmology" and right = "ophthalmology"
+  or
+  wrong = "opthamologist" and right = "ophthalmologist"
+  or
+  wrong = "optmizations" and right = "optimizations"
+  or
+  wrong = "optomism" and right = "optimism"
+  or
+  wrong = "orded" and right = "ordered"
+  or
+  wrong = "organim" and right = "organism"
+  or
+  wrong = "organistion" and right = "organisation"
+  or
+  wrong = "organiztion" and right = "organization"
+  or
+  wrong = "orgin" and right = "organ"
+  or
+  wrong = "orgin" and right = "origin"
+  or
+  wrong = "orginal" and right = "original"
+  or
+  wrong = "orginally" and right = "originally"
+  or
+  wrong = "orginize" and right = "organise"
+  or
+  wrong = "oridinarily" and right = "ordinarily"
+  or
+  wrong = "origanaly" and right = "originally"
+  or
+  wrong = "originall" and right = "original"
+  or
+  wrong = "originall" and right = "originally"
+  or
+  wrong = "originaly" and right = "originally"
+  or
+  wrong = "originially" and right = "originally"
+  or
+  wrong = "originnally" and right = "originally"
+  or
+  wrong = "origional" and right = "original"
+  or
+  wrong = "orignally" and right = "originally"
+  or
+  wrong = "orignially" and right = "originally"
+  or
+  wrong = "otehr" and right = "other"
+  or
+  wrong = "oublisher" and right = "publisher"
+  or
+  wrong = "ouevre" and right = "oeuvre"
+  or
+  wrong = "ouput" and right = "output"
+  or
+  wrong = "oustanding" and right = "outstanding"
+  or
+  wrong = "overriden" and right = "overridden"
+  or
+  wrong = "overshaddowed" and right = "overshadowed"
+  or
+  wrong = "overwelming" and right = "overwhelming"
+  or
+  wrong = "overwheliming" and right = "overwhelming"
+  or
+  wrong = "owrk" and right = "work"
+  or
+  wrong = "owudl" and right = "would"
+  or
+  wrong = "oxigen" and right = "oxygen"
+  or
+  wrong = "oximoron" and right = "oxymoron"
+  or
+  wrong = "p0enis" and right = "penis"
+  or
+  wrong = "paide" and right = "paid"
+  or
+  wrong = "paitience" and right = "patience"
+  or
+  wrong = "palce" and right = "palace"
+  or
+  wrong = "palce" and right = "place"
+  or
+  wrong = "paleolitic" and right = "paleolithic"
+  or
+  wrong = "paliamentarian" and right = "parliamentarian"
+  or
+  wrong = "palistian" and right = "palestinian"
+  or
+  wrong = "palistinian" and right = "palestinian"
+  or
+  wrong = "palistinians" and right = "palestinians"
+  or
+  wrong = "pallete" and right = "palette"
+  or
+  wrong = "pamflet" and right = "pamphlet"
+  or
+  wrong = "pamplet" and right = "pamphlet"
+  or
+  wrong = "pantomine" and right = "pantomime"
+  or
+  wrong = "papanicalou" and right = "papanicolaou"
+  or
+  wrong = "paralel" and right = "parallel"
+  or
+  wrong = "paralell" and right = "parallel"
+  or
+  wrong = "paralelly" and right = "parallelly"
+  or
+  wrong = "paralely" and right = "parallelly"
+  or
+  wrong = "parallely" and right = "parallelly"
+  or
+  wrong = "paramater" and right = "parameter"
+  or
+  wrong = "paramters" and right = "parameters"
+  or
+  wrong = "parametarized" and right = "parameterized"
+  or
+  wrong = "paranthesis" and right = "parenthesis"
+  or
+  wrong = "paraphenalia" and right = "paraphernalia"
+  or
+  wrong = "parellels" and right = "parallels"
+  or
+  wrong = "parisitic" and right = "parasitic"
+  or
+  wrong = "parituclar" and right = "particular"
+  or
+  wrong = "parliment" and right = "parliament"
+  or
+  wrong = "parrakeets" and right = "parakeets"
+  or
+  wrong = "parralel" and right = "parallel"
+  or
+  wrong = "parrallel" and right = "parallel"
+  or
+  wrong = "parrallell" and right = "parallel"
+  or
+  wrong = "parrallelly" and right = "parallelly"
+  or
+  wrong = "parrallely" and right = "parallelly"
+  or
+  wrong = "partialy" and right = "partially"
+  or
+  wrong = "particually" and right = "particularly"
+  or
+  wrong = "particualr" and right = "particular"
+  or
+  wrong = "particuarly" and right = "particularly"
+  or
+  wrong = "particularily" and right = "particularly"
+  or
+  wrong = "particulary" and right = "particularly"
+  or
+  wrong = "pary" and right = "party"
+  or
+  wrong = "pased" and right = "passed"
+  or
+  wrong = "pasengers" and right = "passengers"
+  or
+  wrong = "passerbys" and right = "passersby"
+  or
+  wrong = "pasttime" and right = "pastime"
+  or
+  wrong = "pastural" and right = "pastoral"
+  or
+  wrong = "paticular" and right = "particular"
+  or
+  wrong = "pattented" and right = "patented"
+  or
+  wrong = "pavillion" and right = "pavilion"
+  or
+  wrong = "payed" and right = "paid"
+  or
+  wrong = "pblisher" and right = "publisher"
+  or
+  wrong = "pbulisher" and right = "publisher"
+  or
+  wrong = "peageant" and right = "pageant"
+  or
+  wrong = "peaple" and right = "people"
+  or
+  wrong = "peaples" and right = "peoples"
+  or
+  wrong = "peculure" and right = "peculiar"
+  or
+  wrong = "pedestrain" and right = "pedestrian"
+  or
+  wrong = "peformed" and right = "performed"
+  or
+  wrong = "peice" and right = "piece"
+  or
+  wrong = "peloponnes" and right = "peloponnesus"
+  or
+  wrong = "penatly" and right = "penalty"
+  or
+  wrong = "penerator" and right = "penetrator"
+  or
+  wrong = "penisula" and right = "peninsula"
+  or
+  wrong = "penisular" and right = "peninsular"
+  or
+  wrong = "penninsula" and right = "peninsula"
+  or
+  wrong = "penninsular" and right = "peninsular"
+  or
+  wrong = "pennisula" and right = "peninsula"
+  or
+  wrong = "pennyslvania" and right = "pennsylvania"
+  or
+  wrong = "pensinula" and right = "peninsula"
+  or
+  wrong = "pensle" and right = "pencil"
+  or
+  wrong = "peom" and right = "poem"
+  or
+  wrong = "peoms" and right = "poems"
+  or
+  wrong = "peopel" and right = "people"
+  or
+  wrong = "peopels" and right = "peoples"
+  or
+  wrong = "peotry" and right = "poetry"
+  or
+  wrong = "perade" and right = "parade"
+  or
+  wrong = "percepted" and right = "perceived"
+  or
+  wrong = "percieve" and right = "perceive"
+  or
+  wrong = "percieved" and right = "perceived"
+  or
+  wrong = "perenially" and right = "perennially"
+  or
+  wrong = "peretrator" and right = "perpetrator"
+  or
+  wrong = "perfomance" and right = "performance"
+  or
+  wrong = "perfomers" and right = "performers"
+  or
+  wrong = "performence" and right = "performance"
+  or
+  wrong = "performes" and right = "performed"
+  or
+  wrong = "performes" and right = "performs"
+  or
+  wrong = "perhasp" and right = "perhaps"
+  or
+  wrong = "perheaps" and right = "perhaps"
+  or
+  wrong = "perhpas" and right = "perhaps"
+  or
+  wrong = "peripathetic" and right = "peripatetic"
+  or
+  wrong = "peristent" and right = "persistent"
+  or
+  wrong = "perjery" and right = "perjury"
+  or
+  wrong = "perjorative" and right = "pejorative"
+  or
+  wrong = "permanant" and right = "permanent"
+  or
+  wrong = "permenant" and right = "permanent"
+  or
+  wrong = "permenantly" and right = "permanently"
+  or
+  wrong = "permissable" and right = "permissible"
+  or
+  wrong = "perogative" and right = "prerogative"
+  or
+  wrong = "peronal" and right = "personal"
+  or
+  wrong = "perosnality" and right = "personality"
+  or
+  wrong = "perpertrated" and right = "perpetrated"
+  or
+  wrong = "perphas" and right = "perhaps"
+  or
+  wrong = "perpindicular" and right = "perpendicular"
+  or
+  wrong = "persan" and right = "person"
+  or
+  wrong = "perseverence" and right = "perseverance"
+  or
+  wrong = "persistance" and right = "persistence"
+  or
+  wrong = "persistant" and right = "persistent"
+  or
+  wrong = "personel" and right = "personal"
+  or
+  wrong = "personel" and right = "personnel"
+  or
+  wrong = "personell" and right = "personnel"
+  or
+  wrong = "personnell" and right = "personnel"
+  or
+  wrong = "persuded" and right = "persuaded"
+  or
+  wrong = "persue" and right = "pursue"
+  or
+  wrong = "persued" and right = "pursued"
+  or
+  wrong = "persuing" and right = "pursuing"
+  or
+  wrong = "persuit" and right = "pursuit"
+  or
+  wrong = "persuits" and right = "pursuits"
+  or
+  wrong = "pertubation" and right = "perturbation"
+  or
+  wrong = "pertubations" and right = "perturbations"
+  or
+  wrong = "pessiary" and right = "pessary"
+  or
+  wrong = "petetion" and right = "petition"
+  or
+  wrong = "pharoah" and right = "pharaoh"
+  or
+  wrong = "phenomenom" and right = "phenomenon"
+  or
+  wrong = "phenomenonal" and right = "phenomenal"
+  or
+  wrong = "phenomenonly" and right = "phenomenally"
+  or
+  wrong = "phenomonenon" and right = "phenomenon"
+  or
+  wrong = "phenomonon" and right = "phenomenon"
+  or
+  wrong = "phenonmena" and right = "phenomena"
+  or
+  wrong = "philipines" and right = "philippines"
+  or
+  wrong = "philisopher" and right = "philosopher"
+  or
+  wrong = "philisophical" and right = "philosophical"
+  or
+  wrong = "philisophy" and right = "philosophy"
+  or
+  wrong = "phillipine" and right = "philippine"
+  or
+  wrong = "phillipines" and right = "philippines"
+  or
+  wrong = "phillippines" and right = "philippines"
+  or
+  wrong = "phillosophically" and right = "philosophically"
+  or
+  wrong = "philospher" and right = "philosopher"
+  or
+  wrong = "philosphies" and right = "philosophies"
+  or
+  wrong = "philosphy" and right = "philosophy"
+  or
+  wrong = "phonecian" and right = "phoenecian"
+  or
+  wrong = "phongraph" and right = "phonograph"
+  or
+  wrong = "phylosophical" and right = "philosophical"
+  or
+  wrong = "physicaly" and right = "physically"
+  or
+  wrong = "piblisher" and right = "publisher"
+  or
+  wrong = "pich" and right = "pitch"
+  or
+  wrong = "pilgrimmage" and right = "pilgrimage"
+  or
+  wrong = "pilgrimmages" and right = "pilgrimages"
+  or
+  wrong = "pinapple" and right = "pineapple"
+  or
+  wrong = "pinnaple" and right = "pineapple"
+  or
+  wrong = "pinoneered" and right = "pioneered"
+  or
+  wrong = "plagarism" and right = "plagiarism"
+  or
+  wrong = "planation" and right = "plantation"
+  or
+  wrong = "planed" and right = "planned"
+  or
+  wrong = "plantiff" and right = "plaintiff"
+  or
+  wrong = "plateu" and right = "plateau"
+  or
+  wrong = "plausable" and right = "plausible"
+  or
+  wrong = "playright" and right = "playwright"
+  or
+  wrong = "playwrite" and right = "playwright"
+  or
+  wrong = "playwrites" and right = "playwrights"
+  or
+  wrong = "pleasent" and right = "pleasant"
+  or
+  wrong = "plebicite" and right = "plebiscite"
+  or
+  wrong = "plesant" and right = "pleasant"
+  or
+  wrong = "poenis" and right = "penis"
+  or
+  wrong = "poeoples" and right = "peoples"
+  or
+  wrong = "poety" and right = "poetry"
+  or
+  wrong = "poisin" and right = "poison"
+  or
+  wrong = "polical" and right = "political"
+  or
+  wrong = "polinator" and right = "pollinator"
+  or
+  wrong = "polinators" and right = "pollinators"
+  or
+  wrong = "politican" and right = "politician"
+  or
+  wrong = "politicans" and right = "politicians"
+  or
+  wrong = "poltical" and right = "political"
+  or
+  wrong = "polute" and right = "pollute"
+  or
+  wrong = "poluted" and right = "polluted"
+  or
+  wrong = "polutes" and right = "pollutes"
+  or
+  wrong = "poluting" and right = "polluting"
+  or
+  wrong = "polution" and right = "pollution"
+  or
+  wrong = "polyphonyic" and right = "polyphonic"
+  or
+  wrong = "polysaccaride" and right = "polysaccharide"
+  or
+  wrong = "polysaccharid" and right = "polysaccharide"
+  or
+  wrong = "pomegranite" and right = "pomegranate"
+  or
+  wrong = "pomotion" and right = "promotion"
+  or
+  wrong = "poportional" and right = "proportional"
+  or
+  wrong = "popoulation" and right = "population"
+  or
+  wrong = "popularaty" and right = "popularity"
+  or
+  wrong = "populare" and right = "popular"
+  or
+  wrong = "populer" and right = "popular"
+  or
+  wrong = "porshan" and right = "portion"
+  or
+  wrong = "porshon" and right = "portion"
+  or
+  wrong = "portait" and right = "portrait"
+  or
+  wrong = "portayed" and right = "portrayed"
+  or
+  wrong = "portraing" and right = "portraying"
+  or
+  wrong = "portugese" and right = "portuguese"
+  or
+  wrong = "portuguease" and right = "portuguese"
+  or
+  wrong = "portugues" and right = "portuguese"
+  or
+  wrong = "posess" and right = "possess"
+  or
+  wrong = "posessed" and right = "possessed"
+  or
+  wrong = "posesses" and right = "possesses"
+  or
+  wrong = "posessing" and right = "possessing"
+  or
+  wrong = "posession" and right = "possession"
+  or
+  wrong = "posessions" and right = "possessions"
+  or
+  wrong = "posion" and right = "poison"
+  or
+  wrong = "positon" and right = "position"
+  or
+  wrong = "positon" and right = "positron"
+  or
+  wrong = "possable" and right = "possible"
+  or
+  wrong = "possably" and right = "possibly"
+  or
+  wrong = "posseses" and right = "possesses"
+  or
+  wrong = "possesing" and right = "possessing"
+  or
+  wrong = "possesion" and right = "possession"
+  or
+  wrong = "possessess" and right = "possesses"
+  or
+  wrong = "possibile" and right = "possible"
+  or
+  wrong = "possibilty" and right = "possibility"
+  or
+  wrong = "possiblility" and right = "possibility"
+  or
+  wrong = "possiblilty" and right = "possibility"
+  or
+  wrong = "possiblities" and right = "possibilities"
+  or
+  wrong = "possiblity" and right = "possibility"
+  or
+  wrong = "possition" and right = "position"
+  or
+  wrong = "postdam" and right = "potsdam"
+  or
+  wrong = "posthomous" and right = "posthumous"
+  or
+  wrong = "postion" and right = "position"
+  or
+  wrong = "postive" and right = "positive"
+  or
+  wrong = "potatos" and right = "potatoes"
+  or
+  wrong = "potrait" and right = "portrait"
+  or
+  wrong = "potrayed" and right = "portrayed"
+  or
+  wrong = "poulations" and right = "populations"
+  or
+  wrong = "poverful" and right = "powerful"
+  or
+  wrong = "poweful" and right = "powerful"
+  or
+  wrong = "powerfull" and right = "powerful"
+  or
+  wrong = "ppublisher" and right = "publisher"
+  or
+  wrong = "practial" and right = "practical"
+  or
+  wrong = "practially" and right = "practically"
+  or
+  wrong = "practicaly" and right = "practically"
+  or
+  wrong = "practicioner" and right = "practitioner"
+  or
+  wrong = "practicioners" and right = "practitioners"
+  or
+  wrong = "practicly" and right = "practically"
+  or
+  wrong = "practioner" and right = "practitioner"
+  or
+  wrong = "practioners" and right = "practitioners"
+  or
+  wrong = "prairy" and right = "prairie"
+  or
+  wrong = "prarie" and right = "prairie"
+  or
+  wrong = "praries" and right = "prairies"
+  or
+  wrong = "pratice" and right = "practice"
+  or
+  wrong = "preample" and right = "preamble"
+  or
+  wrong = "precedessor" and right = "predecessor"
+  or
+  wrong = "preceed" and right = "precede"
+  or
+  wrong = "preceeded" and right = "preceded"
+  or
+  wrong = "preceeding" and right = "preceding"
+  or
+  wrong = "preceeds" and right = "precedes"
+  or
+  wrong = "precendence" and right = "precedence"
+  or
+  wrong = "precentage" and right = "percentage"
+  or
+  wrong = "precice" and right = "precise"
+  or
+  wrong = "precisly" and right = "precisely"
+  or
+  wrong = "precurser" and right = "precursor"
+  or
+  wrong = "predecesors" and right = "predecessors"
+  or
+  wrong = "predicatble" and right = "predictable"
+  or
+  wrong = "predicitons" and right = "predictions"
+  or
+  wrong = "predomiantly" and right = "predominately"
+  or
+  wrong = "prefered" and right = "preferred"
+  or
+  wrong = "prefering" and right = "preferring"
+  or
+  wrong = "preferrably" and right = "preferably"
+  or
+  wrong = "pregancies" and right = "pregnancies"
+  or
+  wrong = "preiod" and right = "period"
+  or
+  wrong = "preliferation" and right = "proliferation"
+  or
+  wrong = "premeire" and right = "premiere"
+  or
+  wrong = "premeired" and right = "premiered"
+  or
+  wrong = "premillenial" and right = "premillennial"
+  or
+  wrong = "preminence" and right = "preeminence"
+  or
+  wrong = "premission" and right = "permission"
+  or
+  wrong = "premonasterians" and right = "premonstratensians"
+  or
+  wrong = "preocupation" and right = "preoccupation"
+  or
+  wrong = "prepair" and right = "prepare"
+  or
+  wrong = "prepartion" and right = "preparation"
+  or
+  wrong = "prepatory" and right = "preparatory"
+  or
+  wrong = "preperation" and right = "preparation"
+  or
+  wrong = "preperations" and right = "preparations"
+  or
+  wrong = "preriod" and right = "period"
+  or
+  wrong = "presedential" and right = "presidential"
+  or
+  wrong = "presense" and right = "presence"
+  or
+  wrong = "presidenital" and right = "presidential"
+  or
+  wrong = "presidental" and right = "presidential"
+  or
+  wrong = "presitgious" and right = "prestigious"
+  or
+  wrong = "prespective" and right = "perspective"
+  or
+  wrong = "prestigeous" and right = "prestigious"
+  or
+  wrong = "prestigous" and right = "prestigious"
+  or
+  wrong = "presumabely" and right = "presumably"
+  or
+  wrong = "presumibly" and right = "presumably"
+  or
+  wrong = "pretection" and right = "protection"
+  or
+  wrong = "prevelant" and right = "prevalent"
+  or
+  wrong = "preverse" and right = "perverse"
+  or
+  wrong = "previvous" and right = "previous"
+  or
+  wrong = "pricipal" and right = "principal"
+  or
+  wrong = "priciple" and right = "principle"
+  or
+  wrong = "priestood" and right = "priesthood"
+  or
+  wrong = "primarly" and right = "primarily"
+  or
+  wrong = "primative" and right = "primitive"
+  or
+  wrong = "primatively" and right = "primitively"
+  or
+  wrong = "primatives" and right = "primitives"
+  or
+  wrong = "primordal" and right = "primordial"
+  or
+  wrong = "principaly" and right = "principality"
+  or
+  wrong = "principial" and right = "principal"
+  or
+  wrong = "principlaity" and right = "principality"
+  or
+  wrong = "principly" and right = "principally"
+  or
+  wrong = "prinicipal" and right = "principal"
+  or
+  wrong = "privalege" and right = "privilege"
+  or
+  wrong = "privaleges" and right = "privileges"
+  or
+  wrong = "priveledges" and right = "privileges"
+  or
+  wrong = "privelege" and right = "privilege"
+  or
+  wrong = "priveleged" and right = "privileged"
+  or
+  wrong = "priveleges" and right = "privileges"
+  or
+  wrong = "privelige" and right = "privilege"
+  or
+  wrong = "priveliged" and right = "privileged"
+  or
+  wrong = "priveliges" and right = "privileges"
+  or
+  wrong = "privelleges" and right = "privileges"
+  or
+  wrong = "privilage" and right = "privilege"
+  or
+  wrong = "priviledge" and right = "privilege"
+  or
+  wrong = "priviledges" and right = "privileges"
+  or
+  wrong = "privledge" and right = "privilege"
+  or
+  wrong = "privte" and right = "private"
+  or
+  wrong = "probabilaty" and right = "probability"
+  or
+  wrong = "probablistic" and right = "probabilistic"
+  or
+  wrong = "probablly" and right = "probably"
+  or
+  wrong = "probalibity" and right = "probability"
+  or
+  wrong = "probaly" and right = "probably"
+  or
+  wrong = "probelm" and right = "problem"
+  or
+  wrong = "proccess" and right = "process"
+  or
+  wrong = "proccessing" and right = "processing"
+  or
+  wrong = "procede" and right = "precede"
+  or
+  wrong = "procede" and right = "proceed"
+  or
+  wrong = "proceded" and right = "preceded"
+  or
+  wrong = "proceded" and right = "proceeded"
+  or
+  wrong = "procedes" and right = "precedes"
+  or
+  wrong = "procedes" and right = "proceeds"
+  or
+  wrong = "procedger" and right = "procedure"
+  or
+  wrong = "proceding" and right = "preceding"
+  or
+  wrong = "proceding" and right = "proceeding"
+  or
+  wrong = "procedings" and right = "proceedings"
+  or
+  wrong = "proceedure" and right = "procedure"
+  or
+  wrong = "proces" and right = "process"
+  or
+  wrong = "procesed" and right = "processed"
+  or
+  wrong = "processer" and right = "processor"
+  or
+  wrong = "proclaimation" and right = "proclamation"
+  or
+  wrong = "proclamed" and right = "proclaimed"
+  or
+  wrong = "proclaming" and right = "proclaiming"
+  or
+  wrong = "proclomation" and right = "proclamation"
+  or
+  wrong = "profesion" and right = "profession"
+  or
+  wrong = "profesion" and right = "profusion"
+  or
+  wrong = "profesor" and right = "professor"
+  or
+  wrong = "professer" and right = "professor"
+  or
+  wrong = "proffesed" and right = "professed"
+  or
+  wrong = "proffesion" and right = "profession"
+  or
+  wrong = "proffesional" and right = "professional"
+  or
+  wrong = "proffesor" and right = "professor"
+  or
+  wrong = "profilic" and right = "prolific"
+  or
+  wrong = "progessed" and right = "progressed"
+  or
+  wrong = "progidy" and right = "prodigy"
+  or
+  wrong = "programable" and right = "programmable"
+  or
+  wrong = "progrom" and right = "pogrom"
+  or
+  wrong = "progrom" and right = "program"
+  or
+  wrong = "progroms" and right = "pogroms"
+  or
+  wrong = "progroms" and right = "programs"
+  or
+  wrong = "prohabition" and right = "prohibition"
+  or
+  wrong = "prologomena" and right = "prolegomena"
+  or
+  wrong = "prominance" and right = "prominence"
+  or
+  wrong = "prominant" and right = "prominent"
+  or
+  wrong = "prominantly" and right = "prominently"
+  or
+  wrong = "prominately" and right = "predominately"
+  or
+  wrong = "prominately" and right = "prominently"
+  or
+  wrong = "promiscous" and right = "promiscuous"
+  or
+  wrong = "promotted" and right = "promoted"
+  or
+  wrong = "pronomial" and right = "pronominal"
+  or
+  wrong = "pronouced" and right = "pronounced"
+  or
+  wrong = "pronounched" and right = "pronounced"
+  or
+  wrong = "pronounciation" and right = "pronunciation"
+  or
+  wrong = "proove" and right = "prove"
+  or
+  wrong = "prooved" and right = "proved"
+  or
+  wrong = "prophacy" and right = "prophecy"
+  or
+  wrong = "propietary" and right = "proprietary"
+  or
+  wrong = "propmted" and right = "prompted"
+  or
+  wrong = "propoganda" and right = "propaganda"
+  or
+  wrong = "propogate" and right = "propagate"
+  or
+  wrong = "propogates" and right = "propagates"
+  or
+  wrong = "propogation" and right = "propagation"
+  or
+  wrong = "propostion" and right = "proposition"
+  or
+  wrong = "propotions" and right = "proportions"
+  or
+  wrong = "propper" and right = "proper"
+  or
+  wrong = "propperly" and right = "properly"
+  or
+  wrong = "proprietory" and right = "proprietary"
+  or
+  wrong = "proseletyzing" and right = "proselytizing"
+  or
+  wrong = "protaganist" and right = "protagonist"
+  or
+  wrong = "protaganists" and right = "protagonists"
+  or
+  wrong = "protocal" and right = "protocol"
+  or
+  wrong = "protoganist" and right = "protagonist"
+  or
+  wrong = "prototpe" and right = "prototype"
+  or
+  wrong = "protoype" and right = "prototype"
+  or
+  wrong = "protrayed" and right = "portrayed"
+  or
+  wrong = "protruberance" and right = "protuberance"
+  or
+  wrong = "protruberances" and right = "protuberances"
+  or
+  wrong = "prouncements" and right = "pronouncements"
+  or
+  wrong = "provacative" and right = "provocative"
+  or
+  wrong = "provded" and right = "provided"
+  or
+  wrong = "provicial" and right = "provincial"
+  or
+  wrong = "provinicial" and right = "provincial"
+  or
+  wrong = "provisiosn" and right = "provision"
+  or
+  wrong = "provisonal" and right = "provisional"
+  or
+  wrong = "proximty" and right = "proximity"
+  or
+  wrong = "pseudononymous" and right = "pseudonymous"
+  or
+  wrong = "pseudonyn" and right = "pseudonym"
+  or
+  wrong = "psuedo" and right = "pseudo"
+  or
+  wrong = "psycology" and right = "psychology"
+  or
+  wrong = "psyhic" and right = "psychic"
+  or
+  wrong = "pubilsher" and right = "publisher"
+  or
+  wrong = "pubisher" and right = "publisher"
+  or
+  wrong = "publiaher" and right = "publisher"
+  or
+  wrong = "publically" and right = "publicly"
+  or
+  wrong = "publicaly" and right = "publicly"
+  or
+  wrong = "publicher" and right = "publisher"
+  or
+  wrong = "publihser" and right = "publisher"
+  or
+  wrong = "publisehr" and right = "publisher"
+  or
+  wrong = "publiser" and right = "publisher"
+  or
+  wrong = "publisger" and right = "publisher"
+  or
+  wrong = "publisheed" and right = "published"
+  or
+  wrong = "publisherr" and right = "publisher"
+  or
+  wrong = "publishher" and right = "publisher"
+  or
+  wrong = "publishor" and right = "publisher"
+  or
+  wrong = "publishre" and right = "publisher"
+  or
+  wrong = "publissher" and right = "publisher"
+  or
+  wrong = "publlisher" and right = "publisher"
+  or
+  wrong = "publsiher" and right = "publisher"
+  or
+  wrong = "publusher" and right = "publisher"
+  or
+  wrong = "puchasing" and right = "purchasing"
+  or
+  wrong = "pucini" and right = "puccini"
+  or
+  wrong = "pulisher" and right = "publisher"
+  or
+  wrong = "pumkin" and right = "pumpkin"
+  or
+  wrong = "puplisher" and right = "publisher"
+  or
+  wrong = "puritannical" and right = "puritanical"
+  or
+  wrong = "purposedly" and right = "purposely"
+  or
+  wrong = "purpotedly" and right = "purportedly"
+  or
+  wrong = "pursuade" and right = "persuade"
+  or
+  wrong = "pursuaded" and right = "persuaded"
+  or
+  wrong = "pursuades" and right = "persuades"
+  or
+  wrong = "pususading" and right = "persuading"
+  or
+  wrong = "puting" and right = "putting"
+  or
+  wrong = "pwoer" and right = "power"
+  or
+  wrong = "pyscic" and right = "psychic"
+  or
+  wrong = "qtuie" and right = "quiet"
+  or
+  wrong = "qtuie" and right = "quite"
+  or
+  wrong = "quantaty" and right = "quantity"
+  or
+  wrong = "quantitiy" and right = "quantity"
+  or
+  wrong = "quarantaine" and right = "quarantine"
+  or
+  wrong = "queenland" and right = "queensland"
+  or
+  wrong = "questonable" and right = "questionable"
+  or
+  wrong = "quicklyu" and right = "quickly"
+  or
+  wrong = "quinessential" and right = "quintessential"
+  or
+  wrong = "quitted" and right = "quit"
+  or
+  wrong = "quizes" and right = "quizzes"
+  or
+  wrong = "qutie" and right = "quiet"
+  or
+  wrong = "qutie" and right = "quite"
+  or
+  wrong = "rabinnical" and right = "rabbinical"
+  or
+  wrong = "racaus" and right = "raucous"
+  or
+  wrong = "radiactive" and right = "radioactive"
+  or
+  wrong = "radify" and right = "ratify"
+  or
+  wrong = "raelly" and right = "really"
+  or
+  wrong = "rarified" and right = "rarefied"
+  or
+  wrong = "reaccurring" and right = "recurring"
+  or
+  wrong = "reacing" and right = "reaching"
+  or
+  wrong = "reacll" and right = "recall"
+  or
+  wrong = "readmition" and right = "readmission"
+  or
+  wrong = "realitvely" and right = "relatively"
+  or
+  wrong = "realsitic" and right = "realistic"
+  or
+  wrong = "realtions" and right = "relations"
+  or
+  wrong = "realy" and right = "really"
+  or
+  wrong = "realyl" and right = "really"
+  or
+  wrong = "reasearch" and right = "research"
+  or
+  wrong = "rebiulding" and right = "rebuilding"
+  or
+  wrong = "rebllions" and right = "rebellions"
+  or
+  wrong = "rebounce" and right = "rebound"
+  or
+  wrong = "reccomend" and right = "recommend"
+  or
+  wrong = "reccomendations" and right = "recommendations"
+  or
+  wrong = "reccomended" and right = "recommended"
+  or
+  wrong = "reccomending" and right = "recommending"
+  or
+  wrong = "reccommend" and right = "recommend"
+  or
+  wrong = "reccommended" and right = "recommended"
+  or
+  wrong = "reccommending" and right = "recommending"
+  or
+  wrong = "reccuring" and right = "recurring"
+  or
+  wrong = "receeded" and right = "receded"
+  or
+  wrong = "receeding" and right = "receding"
+  or
+  wrong = "recepient" and right = "recipient"
+  or
+  wrong = "recepients" and right = "recipients"
+  or
+  wrong = "receving" and right = "receiving"
+  or
+  wrong = "rechargable" and right = "rechargeable"
+  or
+  wrong = "reched" and right = "reached"
+  or
+  wrong = "recide" and right = "reside"
+  or
+  wrong = "recided" and right = "resided"
+  or
+  wrong = "recident" and right = "resident"
+  or
+  wrong = "recidents" and right = "residents"
+  or
+  wrong = "reciding" and right = "residing"
+  or
+  wrong = "reciepents" and right = "recipients"
+  or
+  wrong = "reciept" and right = "receipt"
+  or
+  wrong = "recieve" and right = "receive"
+  or
+  wrong = "recieved" and right = "received"
+  or
+  wrong = "reciever" and right = "receiver"
+  or
+  wrong = "recievers" and right = "receivers"
+  or
+  wrong = "recieves" and right = "receives"
+  or
+  wrong = "recieving" and right = "receiving"
+  or
+  wrong = "recipiant" and right = "recipient"
+  or
+  wrong = "recipiants" and right = "recipients"
+  or
+  wrong = "recived" and right = "received"
+  or
+  wrong = "recivership" and right = "receivership"
+  or
+  wrong = "recogise" and right = "recognise"
+  or
+  wrong = "recogize" and right = "recognize"
+  or
+  wrong = "recomend" and right = "recommend"
+  or
+  wrong = "recomended" and right = "recommended"
+  or
+  wrong = "recomending" and right = "recommending"
+  or
+  wrong = "recomends" and right = "recommends"
+  or
+  wrong = "recommedations" and right = "recommendations"
+  or
+  wrong = "recompence" and right = "recompense"
+  or
+  wrong = "reconaissance" and right = "reconnaissance"
+  or
+  wrong = "reconcilation" and right = "reconciliation"
+  or
+  wrong = "reconized" and right = "recognized"
+  or
+  wrong = "reconnaisance" and right = "reconnaissance"
+  or
+  wrong = "reconnaissence" and right = "reconnaissance"
+  or
+  wrong = "recontructed" and right = "reconstructed"
+  or
+  wrong = "recquired" and right = "required"
+  or
+  wrong = "recrational" and right = "recreational"
+  or
+  wrong = "recrod" and right = "record"
+  or
+  wrong = "recuiting" and right = "recruiting"
+  or
+  wrong = "recuring" and right = "recurring"
+  or
+  wrong = "recurrance" and right = "recurrence"
+  or
+  wrong = "rediculous" and right = "ridiculous"
+  or
+  wrong = "reedeming" and right = "redeeming"
+  or
+  wrong = "reenforced" and right = "reinforced"
+  or
+  wrong = "refect" and right = "reflect"
+  or
+  wrong = "refedendum" and right = "referendum"
+  or
+  wrong = "referal" and right = "referral"
+  or
+  wrong = "referece" and right = "reference"
+  or
+  wrong = "refereces" and right = "references"
+  or
+  wrong = "refered" and right = "referred"
+  or
+  wrong = "referemce" and right = "reference"
+  or
+  wrong = "referemces" and right = "references"
+  or
+  wrong = "referencs" and right = "references"
+  or
+  wrong = "referenece" and right = "reference"
+  or
+  wrong = "refereneced" and right = "referenced"
+  or
+  wrong = "refereneces" and right = "references"
+  or
+  wrong = "referiang" and right = "referring"
+  or
+  wrong = "refering" and right = "referring"
+  or
+  wrong = "refernce" and right = "reference"
+  or
+  wrong = "refernce" and right = "references"
+  or
+  wrong = "refernces" and right = "references"
+  or
+  wrong = "referrence" and right = "reference"
+  or
+  wrong = "referrences" and right = "references"
+  or
+  wrong = "referrs" and right = "refers"
+  or
+  wrong = "reffered" and right = "referred"
+  or
+  wrong = "refference" and right = "reference"
+  or
+  wrong = "reffering" and right = "referring"
+  or
+  wrong = "refrence" and right = "reference"
+  or
+  wrong = "refrences" and right = "references"
+  or
+  wrong = "refrers" and right = "refers"
+  or
+  wrong = "refridgeration" and right = "refrigeration"
+  or
+  wrong = "refridgerator" and right = "refrigerator"
+  or
+  wrong = "refromist" and right = "reformist"
+  or
+  wrong = "refusla" and right = "refusal"
+  or
+  wrong = "regardes" and right = "regards"
+  or
+  wrong = "regluar" and right = "regular"
+  or
+  wrong = "reguarly" and right = "regularly"
+  or
+  wrong = "regulaion" and right = "regulation"
+  or
+  wrong = "regulaotrs" and right = "regulators"
+  or
+  wrong = "regularily" and right = "regularly"
+  or
+  wrong = "rehersal" and right = "rehearsal"
+  or
+  wrong = "reicarnation" and right = "reincarnation"
+  or
+  wrong = "reigining" and right = "reigning"
+  or
+  wrong = "reknown" and right = "renown"
+  or
+  wrong = "reknowned" and right = "renowned"
+  or
+  wrong = "rela" and right = "real"
+  or
+  wrong = "relaly" and right = "really"
+  or
+  wrong = "relatiopnship" and right = "relationship"
+  or
+  wrong = "relativly" and right = "relatively"
+  or
+  wrong = "relected" and right = "reelected"
+  or
+  wrong = "releive" and right = "relieve"
+  or
+  wrong = "releived" and right = "relieved"
+  or
+  wrong = "releiver" and right = "reliever"
+  or
+  wrong = "releses" and right = "releases"
+  or
+  wrong = "relevence" and right = "relevance"
+  or
+  wrong = "relevent" and right = "relevant"
+  or
+  wrong = "reliablity" and right = "reliability"
+  or
+  wrong = "relient" and right = "reliant"
+  or
+  wrong = "religeous" and right = "religious"
+  or
+  wrong = "religous" and right = "religious"
+  or
+  wrong = "religously" and right = "religiously"
+  or
+  wrong = "relinqushment" and right = "relinquishment"
+  or
+  wrong = "relitavely" and right = "relatively"
+  or
+  wrong = "relized" and right = "realised"
+  or
+  wrong = "relized" and right = "realized"
+  or
+  wrong = "relpacement" and right = "replacement"
+  or
+  wrong = "remaing" and right = "remaining"
+  or
+  wrong = "remeber" and right = "remember"
+  or
+  wrong = "rememberable" and right = "memorable"
+  or
+  wrong = "rememberance" and right = "remembrance"
+  or
+  wrong = "remembrence" and right = "remembrance"
+  or
+  wrong = "remenant" and right = "remnant"
+  or
+  wrong = "remenicent" and right = "reminiscent"
+  or
+  wrong = "reminent" and right = "remnant"
+  or
+  wrong = "reminescent" and right = "reminiscent"
+  or
+  wrong = "reminscent" and right = "reminiscent"
+  or
+  wrong = "reminsicent" and right = "reminiscent"
+  or
+  wrong = "rendevous" and right = "rendezvous"
+  or
+  wrong = "rendezous" and right = "rendezvous"
+  or
+  wrong = "renedered" and right = "rende"
+  or
+  wrong = "renewl" and right = "renewal"
+  or
+  wrong = "rennovate" and right = "renovate"
+  or
+  wrong = "rennovated" and right = "renovated"
+  or
+  wrong = "rennovating" and right = "renovating"
+  or
+  wrong = "rennovation" and right = "renovation"
+  or
+  wrong = "rentors" and right = "renters"
+  or
+  wrong = "reoccurrence" and right = "recurrence"
+  or
+  wrong = "reorganision" and right = "reorganisation"
+  or
+  wrong = "repatition" and right = "repartition"
+  or
+  wrong = "repatition" and right = "repetition"
+  or
+  wrong = "repblic" and right = "republic"
+  or
+  wrong = "repblican" and right = "republican"
+  or
+  wrong = "repblicans" and right = "republicans"
+  or
+  wrong = "repblics" and right = "republics"
+  or
+  wrong = "repectively" and right = "respectively"
+  or
+  wrong = "repeition" and right = "repetition"
+  or
+  wrong = "repentence" and right = "repentance"
+  or
+  wrong = "repentent" and right = "repentant"
+  or
+  wrong = "repeteadly" and right = "repeatedly"
+  or
+  wrong = "repetion" and right = "repetition"
+  or
+  wrong = "repid" and right = "rapid"
+  or
+  wrong = "reponse" and right = "response"
+  or
+  wrong = "reponsible" and right = "responsible"
+  or
+  wrong = "reportadly" and right = "reportedly"
+  or
+  wrong = "represantative" and right = "representative"
+  or
+  wrong = "representive" and right = "representative"
+  or
+  wrong = "representives" and right = "representatives"
+  or
+  wrong = "reproducable" and right = "reproducible"
+  or
+  wrong = "reprtoire" and right = "repertoire"
+  or
+  wrong = "repsectively" and right = "respectively"
+  or
+  wrong = "reptition" and right = "repetition"
+  or
+  wrong = "repubic" and right = "republic"
+  or
+  wrong = "repubican" and right = "republican"
+  or
+  wrong = "repubicans" and right = "republicans"
+  or
+  wrong = "repubics" and right = "republics"
+  or
+  wrong = "republi" and right = "republic"
+  or
+  wrong = "republian" and right = "republican"
+  or
+  wrong = "republians" and right = "republicans"
+  or
+  wrong = "republis" and right = "republics"
+  or
+  wrong = "repulic" and right = "republic"
+  or
+  wrong = "repulican" and right = "republican"
+  or
+  wrong = "repulicans" and right = "republicans"
+  or
+  wrong = "repulics" and right = "republics"
+  or
+  wrong = "requirment" and right = "requirement"
+  or
+  wrong = "requred" and right = "required"
+  or
+  wrong = "resaurant" and right = "restaurant"
+  or
+  wrong = "resembelance" and right = "resemblance"
+  or
+  wrong = "resembes" and right = "resembles"
+  or
+  wrong = "resemblence" and right = "resemblance"
+  or
+  wrong = "resevoir" and right = "reservoir"
+  or
+  wrong = "residental" and right = "residential"
+  or
+  wrong = "resignement" and right = "resignment"
+  or
+  wrong = "resistable" and right = "resistible"
+  or
+  wrong = "resistence" and right = "resistance"
+  or
+  wrong = "resistent" and right = "resistant"
+  or
+  wrong = "respectivly" and right = "respectively"
+  or
+  wrong = "responce" and right = "response"
+  or
+  wrong = "responibilities" and right = "responsibilities"
+  or
+  wrong = "responisble" and right = "responsible"
+  or
+  wrong = "responnsibilty" and right = "responsibility"
+  or
+  wrong = "responsability" and right = "responsibility"
+  or
+  wrong = "responsibile" and right = "responsible"
+  or
+  wrong = "responsibilites" and right = "responsibilities"
+  or
+  wrong = "responsiblities" and right = "responsibilities"
+  or
+  wrong = "responsiblity" and right = "responsibility"
+  or
+  wrong = "ressemblance" and right = "resemblance"
+  or
+  wrong = "ressemble" and right = "resemble"
+  or
+  wrong = "ressembled" and right = "resembled"
+  or
+  wrong = "ressemblence" and right = "resemblance"
+  or
+  wrong = "ressembling" and right = "resembling"
+  or
+  wrong = "resssurecting" and right = "resurrecting"
+  or
+  wrong = "ressurect" and right = "resurrect"
+  or
+  wrong = "ressurected" and right = "resurrected"
+  or
+  wrong = "ressurection" and right = "resurrection"
+  or
+  wrong = "ressurrection" and right = "resurrection"
+  or
+  wrong = "restarant" and right = "restaurant"
+  or
+  wrong = "restarants" and right = "restaurants"
+  or
+  wrong = "restaraunt" and right = "restaurant"
+  or
+  wrong = "restaraunteur" and right = "restaurateur"
+  or
+  wrong = "restaraunteurs" and right = "restaurateurs"
+  or
+  wrong = "restaraunts" and right = "restaurants"
+  or
+  wrong = "restauranteurs" and right = "restaurateurs"
+  or
+  wrong = "restauration" and right = "restoration"
+  or
+  wrong = "restauraunt" and right = "restaurant"
+  or
+  wrong = "resteraunt" and right = "restaurant"
+  or
+  wrong = "resteraunts" and right = "restaurants"
+  or
+  wrong = "resticted" and right = "restricted"
+  or
+  wrong = "restraunt" and right = "restaurant"
+  or
+  wrong = "restraunt" and right = "restraint"
+  or
+  wrong = "resturant" and right = "restaurant"
+  or
+  wrong = "resturants" and right = "restaurants"
+  or
+  wrong = "resturaunt" and right = "restaurant"
+  or
+  wrong = "resturaunts" and right = "restaurants"
+  or
+  wrong = "resurecting" and right = "resurrecting"
+  or
+  wrong = "retalitated" and right = "retaliated"
+  or
+  wrong = "retalitation" and right = "retaliation"
+  or
+  wrong = "retreive" and right = "retrieve"
+  or
+  wrong = "retrive" and right = "retrieve"
+  or
+  wrong = "returnd" and right = "returned"
+  or
+  wrong = "revaluated" and right = "reevaluated"
+  or
+  wrong = "reveiw" and right = "review"
+  or
+  wrong = "reveral" and right = "reversal"
+  or
+  wrong = "reversable" and right = "reversible"
+  or
+  wrong = "revolutionar" and right = "revolutionary"
+  or
+  wrong = "rewitten" and right = "rewritten"
+  or
+  wrong = "rewriet" and right = "rewrite"
+  or
+  wrong = "rference" and right = "reference"
+  or
+  wrong = "rferences" and right = "references"
+  or
+  wrong = "rhymme" and right = "rhyme"
+  or
+  wrong = "rhythem" and right = "rhythm"
+  or
+  wrong = "rhythim" and right = "rhythm"
+  or
+  wrong = "rhytmic" and right = "rhythmic"
+  or
+  wrong = "rigeur" and right = "rigor"
+  or
+  wrong = "rigeur" and right = "rigour"
+  or
+  wrong = "rigeur" and right = "rigueur"
+  or
+  wrong = "rigourous" and right = "rigorous"
+  or
+  wrong = "rininging" and right = "ringing"
+  or
+  wrong = "rised" and right = "raised"
+  or
+  wrong = "rised" and right = "rose"
+  or
+  wrong = "rockerfeller" and right = "rockefeller"
+  or
+  wrong = "rococco" and right = "rococo"
+  or
+  wrong = "rocord" and right = "record"
+  or
+  wrong = "roomate" and right = "roommate"
+  or
+  wrong = "rougly" and right = "roughly"
+  or
+  wrong = "rucuperate" and right = "recuperate"
+  or
+  wrong = "rudimentatry" and right = "rudimentary"
+  or
+  wrong = "rulle" and right = "rule"
+  or
+  wrong = "runing" and right = "running"
+  or
+  wrong = "runnung" and right = "running"
+  or
+  wrong = "russina" and right = "russian"
+  or
+  wrong = "russion" and right = "russian"
+  or
+  wrong = "rwite" and right = "write"
+  or
+  wrong = "rythem" and right = "rhythm"
+  or
+  wrong = "rythim" and right = "rhythm"
+  or
+  wrong = "rythm" and right = "rhythm"
+  or
+  wrong = "rythmic" and right = "rhythmic"
+  or
+  wrong = "rythyms" and right = "rhythms"
+  or
+  wrong = "sacrafice" and right = "sacrifice"
+  or
+  wrong = "sacreligious" and right = "sacrilegious"
+  or
+  wrong = "sacremento" and right = "sacramento"
+  or
+  wrong = "sacrifical" and right = "sacrificial"
+  or
+  wrong = "saftey" and right = "safety"
+  or
+  wrong = "safty" and right = "safety"
+  or
+  wrong = "salery" and right = "salary"
+  or
+  wrong = "sanctionning" and right = "sanctioning"
+  or
+  wrong = "sandwhich" and right = "sandwich"
+  or
+  wrong = "sanhedrim" and right = "sanhedrin"
+  or
+  wrong = "santioned" and right = "sanctioned"
+  or
+  wrong = "sargant" and right = "sergeant"
+  or
+  wrong = "sargeant" and right = "sergeant"
+  or
+  wrong = "sasy" and right = "sassy"
+  or
+  wrong = "sasy" and right = "says"
+  or
+  wrong = "satelite" and right = "satellite"
+  or
+  wrong = "satelites" and right = "satellites"
+  or
+  wrong = "saterday" and right = "saturday"
+  or
+  wrong = "saterdays" and right = "saturdays"
+  or
+  wrong = "satisfactority" and right = "satisfactorily"
+  or
+  wrong = "satric" and right = "satiric"
+  or
+  wrong = "satrical" and right = "satirical"
+  or
+  wrong = "satrically" and right = "satirically"
+  or
+  wrong = "sattelite" and right = "satellite"
+  or
+  wrong = "sattelites" and right = "satellites"
+  or
+  wrong = "saught" and right = "sought"
+  or
+  wrong = "saveing" and right = "saving"
+  or
+  wrong = "saxaphone" and right = "saxophone"
+  or
+  wrong = "scaleable" and right = "scalable"
+  or
+  wrong = "scandanavia" and right = "scandinavia"
+  or
+  wrong = "scaricity" and right = "scarcity"
+  or
+  wrong = "scavanged" and right = "scavenged"
+  or
+  wrong = "schedual" and right = "schedule"
+  or
+  wrong = "scholarhip" and right = "scholarship"
+  or
+  wrong = "scholarstic" and right = "scholarly"
+  or
+  wrong = "scholarstic" and right = "scholastic"
+  or
+  wrong = "scientfic" and right = "scientific"
+  or
+  wrong = "scientifc" and right = "scientific"
+  or
+  wrong = "scientis" and right = "scientist"
+  or
+  wrong = "scince" and right = "science"
+  or
+  wrong = "scinece" and right = "science"
+  or
+  wrong = "scirpt" and right = "script"
+  or
+  wrong = "scoll" and right = "scroll"
+  or
+  wrong = "screenwrighter" and right = "screenwriter"
+  or
+  wrong = "scrutinity" and right = "scrutiny"
+  or
+  wrong = "scuptures" and right = "sculptures"
+  or
+  wrong = "seach" and right = "search"
+  or
+  wrong = "seached" and right = "searched"
+  or
+  wrong = "seaches" and right = "searches"
+  or
+  wrong = "secceeded" and right = "seceded"
+  or
+  wrong = "secceeded" and right = "succeeded"
+  or
+  wrong = "seceed" and right = "secede"
+  or
+  wrong = "seceed" and right = "succeed"
+  or
+  wrong = "seceeded" and right = "seceded"
+  or
+  wrong = "seceeded" and right = "succeeded"
+  or
+  wrong = "secratary" and right = "secretary"
+  or
+  wrong = "secretery" and right = "secretary"
+  or
+  wrong = "sedereal" and right = "sidereal"
+  or
+  wrong = "seeked" and right = "sought"
+  or
+  wrong = "segementation" and right = "segmentation"
+  or
+  wrong = "seguoys" and right = "segues"
+  or
+  wrong = "seige" and right = "siege"
+  or
+  wrong = "seing" and right = "seeing"
+  or
+  wrong = "seinor" and right = "senior"
+  or
+  wrong = "seldomly" and right = "seldom"
+  or
+  wrong = "senarios" and right = "scenarios"
+  or
+  wrong = "sence" and right = "sense"
+  or
+  wrong = "sence" and right = "since"
+  or
+  wrong = "senstive" and right = "sensitive"
+  or
+  wrong = "sensure" and right = "censure"
+  or
+  wrong = "seperate" and right = "separate"
+  or
+  wrong = "seperated" and right = "separated"
+  or
+  wrong = "seperately" and right = "separately"
+  or
+  wrong = "seperates" and right = "separates"
+  or
+  wrong = "seperating" and right = "separating"
+  or
+  wrong = "seperation" and right = "separation"
+  or
+  wrong = "seperatism" and right = "separatism"
+  or
+  wrong = "seperatist" and right = "separatist"
+  or
+  wrong = "seperator" and right = "separator"
+  or
+  wrong = "sepina" and right = "subpoena"
+  or
+  wrong = "sepulchure" and right = "sepulcher"
+  or
+  wrong = "sepulchure" and right = "sepulchre"
+  or
+  wrong = "sepulcre" and right = "sepulcher"
+  or
+  wrong = "sepulcre" and right = "sepulchre"
+  or
+  wrong = "sergent" and right = "sergeant"
+  or
+  wrong = "settelement" and right = "settlement"
+  or
+  wrong = "settlment" and right = "settlement"
+  or
+  wrong = "settting" and right = "setting"
+  or
+  wrong = "severeal" and right = "several"
+  or
+  wrong = "severley" and right = "severely"
+  or
+  wrong = "severly" and right = "severely"
+  or
+  wrong = "sevice" and right = "service"
+  or
+  wrong = "shadasloo" and right = "shadaloo"
+  or
+  wrong = "shaddow" and right = "shadow"
+  or
+  wrong = "shadoloo" and right = "shadaloo"
+  or
+  wrong = "shamen" and right = "shaman"
+  or
+  wrong = "shamen" and right = "shamans"
+  or
+  wrong = "sheat" and right = "cheat"
+  or
+  wrong = "sheat" and right = "sheath"
+  or
+  wrong = "sheat" and right = "sheet"
+  or
+  wrong = "sheild" and right = "shield"
+  or
+  wrong = "sherif" and right = "sheriff"
+  or
+  wrong = "shineing" and right = "shining"
+  or
+  wrong = "shiped" and right = "shipped"
+  or
+  wrong = "shiping" and right = "shipping"
+  or
+  wrong = "shopkeeepers" and right = "shopkeepers"
+  or
+  wrong = "shorly" and right = "shortly"
+  or
+  wrong = "shoudl" and right = "should"
+  or
+  wrong = "shoudln" and right = "should"
+  or
+  wrong = "shreak" and right = "shriek"
+  or
+  wrong = "shrinked" and right = "shrunk"
+  or
+  wrong = "sicne" and right = "since"
+  or
+  wrong = "sideral" and right = "sidereal"
+  or
+  wrong = "sieze" and right = "seize"
+  or
+  wrong = "sieze" and right = "size"
+  or
+  wrong = "siezed" and right = "seized"
+  or
+  wrong = "siezed" and right = "sized"
+  or
+  wrong = "siezing" and right = "seizing"
+  or
+  wrong = "siezing" and right = "sizing"
+  or
+  wrong = "siezure" and right = "seizure"
+  or
+  wrong = "siezures" and right = "seizures"
+  or
+  wrong = "siginificant" and right = "significant"
+  or
+  wrong = "signficant" and right = "significant"
+  or
+  wrong = "signficiant" and right = "significant"
+  or
+  wrong = "signfies" and right = "signifies"
+  or
+  wrong = "signifantly" and right = "significantly"
+  or
+  wrong = "significently" and right = "significantly"
+  or
+  wrong = "signifigant" and right = "significant"
+  or
+  wrong = "signifigantly" and right = "significantly"
+  or
+  wrong = "signitories" and right = "signatories"
+  or
+  wrong = "signitory" and right = "signatory"
+  or
+  wrong = "similarily" and right = "similarly"
+  or
+  wrong = "similiar" and right = "similar"
+  or
+  wrong = "similiarity" and right = "similarity"
+  or
+  wrong = "similiarly" and right = "similarly"
+  or
+  wrong = "simmilar" and right = "similar"
+  or
+  wrong = "simpley" and right = "simply"
+  or
+  wrong = "simplier" and right = "simpler"
+  or
+  wrong = "simultanous" and right = "simultaneous"
+  or
+  wrong = "simultanously" and right = "simultaneously"
+  or
+  wrong = "sincerley" and right = "sincerely"
+  or
+  wrong = "singsog" and right = "singsong"
+  or
+  wrong = "sinse" and right = "since"
+  or
+  wrong = "sinse" and right = "sines"
+  or
+  wrong = "sionist" and right = "zionist"
+  or
+  wrong = "sionists" and right = "zionists"
+  or
+  wrong = "sixtin" and right = "sistine"
+  or
+  wrong = "skagerak" and right = "skagerrak"
+  or
+  wrong = "skateing" and right = "skating"
+  or
+  wrong = "slaugterhouses" and right = "slaughterhouses"
+  or
+  wrong = "slighly" and right = "slightly"
+  or
+  wrong = "slippy" and right = "slippery"
+  or
+  wrong = "slowy" and right = "slowly"
+  or
+  wrong = "smae" and right = "same"
+  or
+  wrong = "smealting" and right = "smelting"
+  or
+  wrong = "smoe" and right = "some"
+  or
+  wrong = "sneeks" and right = "sneaks"
+  or
+  wrong = "snese" and right = "sneeze"
+  or
+  wrong = "socalism" and right = "socialism"
+  or
+  wrong = "socities" and right = "societies"
+  or
+  wrong = "soem" and right = "some"
+  or
+  wrong = "sofware" and right = "software"
+  or
+  wrong = "sohw" and right = "show"
+  or
+  wrong = "soilders" and right = "soldiers"
+  or
+  wrong = "solatary" and right = "solitary"
+  or
+  wrong = "soley" and right = "solely"
+  or
+  wrong = "soliders" and right = "soldiers"
+  or
+  wrong = "soliliquy" and right = "soliloquy"
+  or
+  wrong = "soluable" and right = "soluble"
+  or
+  wrong = "somene" and right = "someone"
+  or
+  wrong = "somtimes" and right = "sometimes"
+  or
+  wrong = "somwhere" and right = "somewhere"
+  or
+  wrong = "sophicated" and right = "sophisticated"
+  or
+  wrong = "sophmore" and right = "sophomore"
+  or
+  wrong = "sorceror" and right = "sorcerer"
+  or
+  wrong = "sorrounding" and right = "surrounding"
+  or
+  wrong = "sotry" and right = "story"
+  or
+  wrong = "sotyr" and right = "satyr"
+  or
+  wrong = "sotyr" and right = "story"
+  or
+  wrong = "soudn" and right = "sound"
+  or
+  wrong = "soudns" and right = "sounds"
+  or
+  wrong = "sould" and right = "could"
+  or
+  wrong = "sould" and right = "should"
+  or
+  wrong = "sould" and right = "sold"
+  or
+  wrong = "sould" and right = "soul"
+  or
+  wrong = "sountrack" and right = "soundtrack"
+  or
+  wrong = "sourth" and right = "south"
+  or
+  wrong = "sourthern" and right = "southern"
+  or
+  wrong = "souvenier" and right = "souvenir"
+  or
+  wrong = "souveniers" and right = "souvenirs"
+  or
+  wrong = "soveits" and right = "soviets"
+  or
+  wrong = "sovereignity" and right = "sovereignty"
+  or
+  wrong = "soverign" and right = "sovereign"
+  or
+  wrong = "soverignity" and right = "sovereignty"
+  or
+  wrong = "soverignty" and right = "sovereignty"
+  or
+  wrong = "spainish" and right = "spanish"
+  or
+  wrong = "speach" and right = "speech"
+  or
+  wrong = "specfic" and right = "specific"
+  or
+  wrong = "speciallized" and right = "specialised"
+  or
+  wrong = "speciallized" and right = "specialized"
+  or
+  wrong = "specif" and right = "specific"
+  or
+  wrong = "specif" and right = "specify"
+  or
+  wrong = "specifiying" and right = "specifying"
+  or
+  wrong = "speciman" and right = "specimen"
+  or
+  wrong = "spectauclar" and right = "spectacular"
+  or
+  wrong = "spectaulars" and right = "spectaculars"
+  or
+  wrong = "spects" and right = "aspects"
+  or
+  wrong = "spects" and right = "expects"
+  or
+  wrong = "spectum" and right = "spectrum"
+  or
+  wrong = "speices" and right = "species"
+  or
+  wrong = "spendour" and right = "splendour"
+  or
+  wrong = "spermatozoan" and right = "spermatozoon"
+  or
+  wrong = "spoace" and right = "space"
+  or
+  wrong = "sponser" and right = "sponsor"
+  or
+  wrong = "sponsered" and right = "sponsored"
+  or
+  wrong = "spontanous" and right = "spontaneous"
+  or
+  wrong = "sponzored" and right = "sponsored"
+  or
+  wrong = "spoonfulls" and right = "spoonfuls"
+  or
+  wrong = "sppeches" and right = "speeches"
+  or
+  wrong = "spreaded" and right = "spread"
+  or
+  wrong = "sprech" and right = "speech"
+  or
+  wrong = "spred" and right = "spread"
+  or
+  wrong = "spriritual" and right = "spiritual"
+  or
+  wrong = "spritual" and right = "spiritual"
+  or
+  wrong = "sqaure" and right = "square"
+  or
+  wrong = "sring" and right = "string"
+  or
+  wrong = "stablility" and right = "stability"
+  or
+  wrong = "stainlees" and right = "stainless"
+  or
+  wrong = "staion" and right = "station"
+  or
+  wrong = "standars" and right = "standards"
+  or
+  wrong = "stange" and right = "strange"
+  or
+  wrong = "startegic" and right = "strategic"
+  or
+  wrong = "startegies" and right = "strategies"
+  or
+  wrong = "startegy" and right = "strategy"
+  or
+  wrong = "stateman" and right = "statesman"
+  or
+  wrong = "statememts" and right = "statements"
+  or
+  wrong = "statment" and right = "statement"
+  or
+  wrong = "steriods" and right = "steroids"
+  or
+  wrong = "sterotypes" and right = "stereotypes"
+  or
+  wrong = "stilus" and right = "stylus"
+  or
+  wrong = "stingent" and right = "stringent"
+  or
+  wrong = "stiring" and right = "stirring"
+  or
+  wrong = "stirrs" and right = "stirs"
+  or
+  wrong = "stlye" and right = "style"
+  or
+  wrong = "stomache" and right = "stomach"
+  or
+  wrong = "stong" and right = "strong"
+  or
+  wrong = "stopry" and right = "story"
+  or
+  wrong = "storeis" and right = "stories"
+  or
+  wrong = "storise" and right = "stories"
+  or
+  wrong = "stornegst" and right = "strongest"
+  or
+  wrong = "stoyr" and right = "story"
+  or
+  wrong = "stpo" and right = "stop"
+  or
+  wrong = "stradegies" and right = "strategies"
+  or
+  wrong = "stradegy" and right = "strategy"
+  or
+  wrong = "strat" and right = "start"
+  or
+  wrong = "strat" and right = "strata"
+  or
+  wrong = "stratagically" and right = "strategically"
+  or
+  wrong = "streemlining" and right = "streamlining"
+  or
+  wrong = "stregth" and right = "strength"
+  or
+  wrong = "strenghen" and right = "strengthen"
+  or
+  wrong = "strenghened" and right = "strengthened"
+  or
+  wrong = "strenghening" and right = "strengthening"
+  or
+  wrong = "strenght" and right = "strength"
+  or
+  wrong = "strenghten" and right = "strengthen"
+  or
+  wrong = "strenghtened" and right = "strengthened"
+  or
+  wrong = "strenghtening" and right = "strengthening"
+  or
+  wrong = "strengtened" and right = "strengthened"
+  or
+  wrong = "strenous" and right = "strenuous"
+  or
+  wrong = "strictist" and right = "strictest"
+  or
+  wrong = "strikely" and right = "strikingly"
+  or
+  wrong = "strnad" and right = "strand"
+  or
+  wrong = "stroy" and right = "destroy"
+  or
+  wrong = "stroy" and right = "story"
+  or
+  wrong = "structual" and right = "structural"
+  or
+  wrong = "stubborness" and right = "stubbornness"
+  or
+  wrong = "stucture" and right = "structure"
+  or
+  wrong = "stuctured" and right = "structured"
+  or
+  wrong = "studdy" and right = "study"
+  or
+  wrong = "studing" and right = "studying"
+  or
+  wrong = "stuggling" and right = "struggling"
+  or
+  wrong = "sturcture" and right = "structure"
+  or
+  wrong = "subcatagories" and right = "subcategories"
+  or
+  wrong = "subcatagory" and right = "subcategory"
+  or
+  wrong = "subconsiously" and right = "subconsciously"
+  or
+  wrong = "subjudgation" and right = "subjugation"
+  or
+  wrong = "submachne" and right = "submachine"
+  or
+  wrong = "subpecies" and right = "subspecies"
+  or
+  wrong = "subsidary" and right = "subsidiary"
+  or
+  wrong = "subsiduary" and right = "subsidiary"
+  or
+  wrong = "subsquent" and right = "subsequent"
+  or
+  wrong = "subsquently" and right = "subsequently"
+  or
+  wrong = "substace" and right = "substance"
+  or
+  wrong = "substancial" and right = "substantial"
+  or
+  wrong = "substatial" and right = "substantial"
+  or
+  wrong = "substituded" and right = "substituted"
+  or
+  wrong = "substract" and right = "subtract"
+  or
+  wrong = "substracted" and right = "subtracted"
+  or
+  wrong = "substracting" and right = "subtracting"
+  or
+  wrong = "substraction" and right = "subtraction"
+  or
+  wrong = "substracts" and right = "subtracts"
+  or
+  wrong = "subtances" and right = "substances"
+  or
+  wrong = "subterranian" and right = "subterranean"
+  or
+  wrong = "suburburban" and right = "suburban"
+  or
+  wrong = "succceeded" and right = "succeeded"
+  or
+  wrong = "succcesses" and right = "successes"
+  or
+  wrong = "succedded" and right = "succeeded"
+  or
+  wrong = "succeded" and right = "succeeded"
+  or
+  wrong = "succeds" and right = "succeeds"
+  or
+  wrong = "succesful" and right = "successful"
+  or
+  wrong = "succesfully" and right = "successfully"
+  or
+  wrong = "succesfuly" and right = "successfully"
+  or
+  wrong = "succesion" and right = "succession"
+  or
+  wrong = "succesive" and right = "successive"
+  or
+  wrong = "successfull" and right = "successful"
+  or
+  wrong = "successully" and right = "successfully"
+  or
+  wrong = "succsess" and right = "success"
+  or
+  wrong = "succsessfull" and right = "successful"
+  or
+  wrong = "suceed" and right = "succeed"
+  or
+  wrong = "suceeded" and right = "succeeded"
+  or
+  wrong = "suceeding" and right = "succeeding"
+  or
+  wrong = "suceeds" and right = "succeeds"
+  or
+  wrong = "sucesful" and right = "successful"
+  or
+  wrong = "sucesfully" and right = "successfully"
+  or
+  wrong = "sucesfuly" and right = "successfully"
+  or
+  wrong = "sucesion" and right = "succession"
+  or
+  wrong = "sucess" and right = "success"
+  or
+  wrong = "sucesses" and right = "successes"
+  or
+  wrong = "sucessful" and right = "successful"
+  or
+  wrong = "sucessfull" and right = "successful"
+  or
+  wrong = "sucessfully" and right = "successfully"
+  or
+  wrong = "sucessfuly" and right = "successfully"
+  or
+  wrong = "sucession" and right = "succession"
+  or
+  wrong = "sucessive" and right = "successive"
+  or
+  wrong = "sucessor" and right = "successor"
+  or
+  wrong = "sucessot" and right = "successor"
+  or
+  wrong = "sucide" and right = "suicide"
+  or
+  wrong = "sucidial" and right = "suicidal"
+  or
+  wrong = "sudent" and right = "student"
+  or
+  wrong = "sudents" and right = "students"
+  or
+  wrong = "sufferage" and right = "suffrage"
+  or
+  wrong = "sufferred" and right = "suffered"
+  or
+  wrong = "sufferring" and right = "suffering"
+  or
+  wrong = "sufficent" and right = "sufficient"
+  or
+  wrong = "sufficently" and right = "sufficiently"
+  or
+  wrong = "sumary" and right = "summary"
+  or
+  wrong = "sunglases" and right = "sunglasses"
+  or
+  wrong = "suop" and right = "soup"
+  or
+  wrong = "superceeded" and right = "superseded"
+  or
+  wrong = "superintendant" and right = "superintendent"
+  or
+  wrong = "suphisticated" and right = "sophisticated"
+  or
+  wrong = "suplimented" and right = "supplemented"
+  or
+  wrong = "suported" and right = "supported"
+  or
+  wrong = "supose" and right = "suppose"
+  or
+  wrong = "suposed" and right = "supposed"
+  or
+  wrong = "suposedly" and right = "supposedly"
+  or
+  wrong = "suposes" and right = "supposes"
+  or
+  wrong = "suposing" and right = "supposing"
+  or
+  wrong = "supplamented" and right = "supplemented"
+  or
+  wrong = "suppliementing" and right = "supplementing"
+  or
+  wrong = "suppoed" and right = "supposed"
+  or
+  wrong = "supposingly" and right = "supposedly"
+  or
+  wrong = "suppy" and right = "supply"
+  or
+  wrong = "suprassing" and right = "surpassing"
+  or
+  wrong = "supress" and right = "suppress"
+  or
+  wrong = "supressed" and right = "suppressed"
+  or
+  wrong = "supresses" and right = "suppresses"
+  or
+  wrong = "supressing" and right = "suppressing"
+  or
+  wrong = "suprise" and right = "surprise"
+  or
+  wrong = "suprised" and right = "surprised"
+  or
+  wrong = "suprising" and right = "surprising"
+  or
+  wrong = "suprisingly" and right = "surprisingly"
+  or
+  wrong = "suprize" and right = "surprise"
+  or
+  wrong = "suprized" and right = "surprised"
+  or
+  wrong = "suprizing" and right = "surprising"
+  or
+  wrong = "suprizingly" and right = "surprisingly"
+  or
+  wrong = "surfce" and right = "surface"
+  or
+  wrong = "surley" and right = "surely"
+  or
+  wrong = "surley" and right = "surly"
+  or
+  wrong = "suround" and right = "surround"
+  or
+  wrong = "surounded" and right = "surrounded"
+  or
+  wrong = "surounding" and right = "surrounding"
+  or
+  wrong = "suroundings" and right = "surroundings"
+  or
+  wrong = "surounds" and right = "surrounds"
+  or
+  wrong = "surplanted" and right = "supplanted"
+  or
+  wrong = "surpress" and right = "suppress"
+  or
+  wrong = "surpressed" and right = "suppressed"
+  or
+  wrong = "surprize" and right = "surprise"
+  or
+  wrong = "surprized" and right = "surprised"
+  or
+  wrong = "surprizing" and right = "surprising"
+  or
+  wrong = "surprizingly" and right = "surprisingly"
+  or
+  wrong = "surrended" and right = "surrendered"
+  or
+  wrong = "surrended" and right = "surrounded"
+  or
+  wrong = "surrepetitious" and right = "surreptitious"
+  or
+  wrong = "surrepetitiously" and right = "surreptitiously"
+  or
+  wrong = "surreptious" and right = "surreptitious"
+  or
+  wrong = "surreptiously" and right = "surreptitiously"
+  or
+  wrong = "surronded" and right = "surrounded"
+  or
+  wrong = "surrouded" and right = "surrounded"
+  or
+  wrong = "surrouding" and right = "surrounding"
+  or
+  wrong = "surrundering" and right = "surrendering"
+  or
+  wrong = "surveilence" and right = "surveillance"
+  or
+  wrong = "surveill" and right = "surveil"
+  or
+  wrong = "surveyer" and right = "surveyor"
+  or
+  wrong = "surviver" and right = "survivor"
+  or
+  wrong = "survivers" and right = "survivors"
+  or
+  wrong = "survivied" and right = "survived"
+  or
+  wrong = "suseptable" and right = "susceptible"
+  or
+  wrong = "suseptible" and right = "susceptible"
+  or
+  wrong = "suspention" and right = "suspension"
+  or
+  wrong = "swaer" and right = "swear"
+  or
+  wrong = "swaers" and right = "swears"
+  or
+  wrong = "swepth" and right = "swept"
+  or
+  wrong = "swiming" and right = "swimming"
+  or
+  wrong = "syas" and right = "says"
+  or
+  wrong = "symetrical" and right = "symmetrical"
+  or
+  wrong = "symetrically" and right = "symmetrically"
+  or
+  wrong = "symetry" and right = "symmetry"
+  or
+  wrong = "symettric" and right = "symmetric"
+  or
+  wrong = "symmetral" and right = "symmetric"
+  or
+  wrong = "symmetricaly" and right = "symmetrically"
+  or
+  wrong = "synagouge" and right = "synagogue"
+  or
+  wrong = "syncronization" and right = "synchronization"
+  or
+  wrong = "synonomous" and right = "synonymous"
+  or
+  wrong = "synonymns" and right = "synonyms"
+  or
+  wrong = "synphony" and right = "symphony"
+  or
+  wrong = "syphyllis" and right = "syphilis"
+  or
+  wrong = "sypmtoms" and right = "symptoms"
+  or
+  wrong = "syrap" and right = "syrup"
+  or
+  wrong = "sysmatically" and right = "systematically"
+  or
+  wrong = "sytem" and right = "system"
+  or
+  wrong = "sytle" and right = "style"
+  or
+  wrong = "tabacco" and right = "tobacco"
+  or
+  wrong = "tahn" and right = "than"
+  or
+  wrong = "taht" and right = "that"
+  or
+  wrong = "talekd" and right = "talked"
+  or
+  wrong = "targetted" and right = "targeted"
+  or
+  wrong = "targetting" and right = "targeting"
+  or
+  wrong = "tast" and right = "taste"
+  or
+  wrong = "tath" and right = "that"
+  or
+  wrong = "tatoo" and right = "tattoo"
+  or
+  wrong = "tattooes" and right = "tattoos"
+  or
+  wrong = "taxanomic" and right = "taxonomic"
+  or
+  wrong = "taxanomy" and right = "taxonomy"
+  or
+  wrong = "teached" and right = "taught"
+  or
+  wrong = "techician" and right = "technician"
+  or
+  wrong = "techicians" and right = "technicians"
+  or
+  wrong = "techiniques" and right = "techniques"
+  or
+  wrong = "technitian" and right = "technician"
+  or
+  wrong = "technnology" and right = "technology"
+  or
+  wrong = "technolgy" and right = "technology"
+  or
+  wrong = "teh" and right = "the"
+  or
+  wrong = "tehy" and right = "they"
+  or
+  wrong = "telelevision" and right = "television"
+  or
+  wrong = "televsion" and right = "television"
+  or
+  wrong = "telphony" and right = "telephony"
+  or
+  wrong = "temerature" and right = "temperature"
+  or
+  wrong = "tempalte" and right = "template"
+  or
+  wrong = "tempaltes" and right = "templates"
+  or
+  wrong = "temparate" and right = "temperate"
+  or
+  wrong = "temperarily" and right = "temporarily"
+  or
+  wrong = "temperment" and right = "temperament"
+  or
+  wrong = "tempertaure" and right = "temperature"
+  or
+  wrong = "temperture" and right = "temperature"
+  or
+  wrong = "temprary" and right = "temporary"
+  or
+  wrong = "tenacle" and right = "tentacle"
+  or
+  wrong = "tenacles" and right = "tentacles"
+  or
+  wrong = "tendacy" and right = "tendency"
+  or
+  wrong = "tendancies" and right = "tendencies"
+  or
+  wrong = "tendancy" and right = "tendency"
+  or
+  wrong = "tepmorarily" and right = "temporarily"
+  or
+  wrong = "terrestial" and right = "terrestrial"
+  or
+  wrong = "terriories" and right = "territories"
+  or
+  wrong = "terriory" and right = "territory"
+  or
+  wrong = "territorist" and right = "terrorist"
+  or
+  wrong = "territoy" and right = "territory"
+  or
+  wrong = "terroist" and right = "terrorist"
+  or
+  wrong = "testiclular" and right = "testicular"
+  or
+  wrong = "testomony" and right = "testimony"
+  or
+  wrong = "tghe" and right = "the"
+  or
+  wrong = "thast" and right = "that"
+  or
+  wrong = "theather" and right = "theater"
+  or
+  wrong = "theese" and right = "these"
+  or
+  wrong = "theif" and right = "thief"
+  or
+  wrong = "theives" and right = "thieves"
+  or
+  wrong = "themselfs" and right = "themselves"
+  or
+  wrong = "themslves" and right = "themselves"
+  or
+  wrong = "ther" and right = "the"
+  or
+  wrong = "ther" and right = "their"
+  or
+  wrong = "ther" and right = "there"
+  or
+  wrong = "therafter" and right = "thereafter"
+  or
+  wrong = "therby" and right = "thereby"
+  or
+  wrong = "theri" and right = "their"
+  or
+  wrong = "thgat" and right = "that"
+  or
+  wrong = "thge" and right = "the"
+  or
+  wrong = "thier" and right = "their"
+  or
+  wrong = "thign" and right = "thing"
+  or
+  wrong = "thigns" and right = "things"
+  or
+  wrong = "thigsn" and right = "things"
+  or
+  wrong = "thikn" and right = "think"
+  or
+  wrong = "thikning" and right = "thickening"
+  or
+  wrong = "thikning" and right = "thinking"
+  or
+  wrong = "thikns" and right = "thinks"
+  or
+  wrong = "thiunk" and right = "think"
+  or
+  wrong = "thn" and right = "then"
+  or
+  wrong = "thna" and right = "than"
+  or
+  wrong = "thne" and right = "then"
+  or
+  wrong = "thnig" and right = "thing"
+  or
+  wrong = "thnigs" and right = "things"
+  or
+  wrong = "thoughout" and right = "throughout"
+  or
+  wrong = "threatend" and right = "threatened"
+  or
+  wrong = "threatning" and right = "threatening"
+  or
+  wrong = "threee" and right = "three"
+  or
+  wrong = "threshhold" and right = "threshold"
+  or
+  wrong = "thrid" and right = "third"
+  or
+  wrong = "throrough" and right = "thorough"
+  or
+  wrong = "throughly" and right = "thoroughly"
+  or
+  wrong = "throught" and right = "thought"
+  or
+  wrong = "throught" and right = "through"
+  or
+  wrong = "throught" and right = "throughout"
+  or
+  wrong = "througout" and right = "throughout"
+  or
+  wrong = "thru" and right = "through"
+  or
+  wrong = "thsi" and right = "this"
+  or
+  wrong = "thsoe" and right = "those"
+  or
+  wrong = "thta" and right = "that"
+  or
+  wrong = "thyat" and right = "that"
+  or
+  wrong = "tiem" and right = "tim"
+  or
+  wrong = "tiem" and right = "time"
+  or
+  wrong = "tihkn" and right = "think"
+  or
+  wrong = "tihs" and right = "this"
+  or
+  wrong = "timne" and right = "time"
+  or
+  wrong = "tiome" and right = "time"
+  or
+  wrong = "tiome" and right = "tome"
+  or
+  wrong = "tje" and right = "the"
+  or
+  wrong = "tjhe" and right = "the"
+  or
+  wrong = "tjpanishad" and right = "upanishad"
+  or
+  wrong = "tkae" and right = "take"
+  or
+  wrong = "tkaes" and right = "takes"
+  or
+  wrong = "tkaing" and right = "taking"
+  or
+  wrong = "tlaking" and right = "talking"
+  or
+  wrong = "tobbaco" and right = "tobacco"
+  or
+  wrong = "todya" and right = "today"
+  or
+  wrong = "toghether" and right = "together"
+  or
+  wrong = "toke" and right = "took"
+  or
+  wrong = "tolerence" and right = "tolerance"
+  or
+  wrong = "tolkein" and right = "tolkien"
+  or
+  wrong = "tomatos" and right = "tomatoes"
+  or
+  wrong = "tommorow" and right = "tomorrow"
+  or
+  wrong = "tommorrow" and right = "tomorrow"
+  or
+  wrong = "tongiht" and right = "tonight"
+  or
+  wrong = "toriodal" and right = "toroidal"
+  or
+  wrong = "tormenters" and right = "tormentors"
+  or
+  wrong = "tornadoe" and right = "tornado"
+  or
+  wrong = "torpeados" and right = "torpedoes"
+  or
+  wrong = "torpedos" and right = "torpedoes"
+  or
+  wrong = "tortise" and right = "tortoise"
+  or
+  wrong = "toubles" and right = "troubles"
+  or
+  wrong = "tounge" and right = "tongue"
+  or
+  wrong = "tourch" and right = "torch"
+  or
+  wrong = "tourch" and right = "touch"
+  or
+  wrong = "towords" and right = "towards"
+  or
+  wrong = "towrad" and right = "toward"
+  or
+  wrong = "tradionally" and right = "traditionally"
+  or
+  wrong = "traditionaly" and right = "traditionally"
+  or
+  wrong = "traditionnal" and right = "traditional"
+  or
+  wrong = "traditition" and right = "tradition"
+  or
+  wrong = "tradtionally" and right = "traditionally"
+  or
+  wrong = "trafficed" and right = "trafficked"
+  or
+  wrong = "trafficing" and right = "trafficking"
+  or
+  wrong = "trafic" and right = "traffic"
+  or
+  wrong = "trancendent" and right = "transcendent"
+  or
+  wrong = "trancending" and right = "transcending"
+  or
+  wrong = "tranform" and right = "transform"
+  or
+  wrong = "tranformed" and right = "transformed"
+  or
+  wrong = "transcendance" and right = "transcendence"
+  or
+  wrong = "transcendant" and right = "transcendent"
+  or
+  wrong = "transcendentational" and right = "transcendental"
+  or
+  wrong = "transcripting" and right = "transcribing"
+  or
+  wrong = "transcripting" and right = "transcription"
+  or
+  wrong = "transending" and right = "transcending"
+  or
+  wrong = "transesxuals" and right = "transsexuals"
+  or
+  wrong = "transfered" and right = "transferred"
+  or
+  wrong = "transfering" and right = "transferring"
+  or
+  wrong = "transformaton" and right = "transformation"
+  or
+  wrong = "transistion" and right = "transition"
+  or
+  wrong = "translater" and right = "translator"
+  or
+  wrong = "translaters" and right = "translators"
+  or
+  wrong = "transmissable" and right = "transmissible"
+  or
+  wrong = "transporation" and right = "transportation"
+  or
+  wrong = "tremelo" and right = "tremolo"
+  or
+  wrong = "tremelos" and right = "tremolos"
+  or
+  wrong = "treshold" and right = "threshold"
+  or
+  wrong = "triguered" and right = "triggered"
+  or
+  wrong = "triology" and right = "trilogy"
+  or
+  wrong = "troling" and right = "trolling"
+  or
+  wrong = "troup" and right = "troupe"
+  or
+  wrong = "troups" and right = "troops"
+  or
+  wrong = "troups" and right = "troupes"
+  or
+  wrong = "truely" and right = "truly"
+  or
+  wrong = "trustworthyness" and right = "trustworthiness"
+  or
+  wrong = "turnk" and right = "trunk"
+  or
+  wrong = "turnk" and right = "turnkey"
+  or
+  wrong = "tuscon" and right = "tucson"
+  or
+  wrong = "tust" and right = "trust"
+  or
+  wrong = "twelth" and right = "twelfth"
+  or
+  wrong = "twon" and right = "town"
+  or
+  wrong = "twpo" and right = "two"
+  or
+  wrong = "tyhat" and right = "that"
+  or
+  wrong = "tyhe" and right = "they"
+  or
+  wrong = "typcial" and right = "typical"
+  or
+  wrong = "typicaly" and right = "typically"
+  or
+  wrong = "tyranies" and right = "tyrannies"
+  or
+  wrong = "tyrany" and right = "tyranny"
+  or
+  wrong = "tyrranies" and right = "tyrannies"
+  or
+  wrong = "tyrrany" and right = "tyranny"
+  or
+  wrong = "ubiquitious" and right = "ubiquitous"
+  or
+  wrong = "ublisher" and right = "publisher"
+  or
+  wrong = "udpate" and right = "update"
+  or
+  wrong = "uise" and right = "use"
+  or
+  wrong = "ukranian" and right = "ukrainian"
+  or
+  wrong = "ultimely" and right = "ultimately"
+  or
+  wrong = "unacompanied" and right = "unaccompanied"
+  or
+  wrong = "unahppy" and right = "unhappy"
+  or
+  wrong = "unanymous" and right = "unanimous"
+  or
+  wrong = "unathorised" and right = "unauthorised"
+  or
+  wrong = "unavailible" and right = "unavailable"
+  or
+  wrong = "unballance" and right = "unbalance"
+  or
+  wrong = "unbeknowst" and right = "unbeknownst"
+  or
+  wrong = "unbeleivable" and right = "unbelievable"
+  or
+  wrong = "uncertainity" and right = "uncertainty"
+  or
+  wrong = "unchallengable" and right = "unchallengeable"
+  or
+  wrong = "unchangable" and right = "unchangeable"
+  or
+  wrong = "uncompetive" and right = "uncompetitive"
+  or
+  wrong = "unconcious" and right = "unconscious"
+  or
+  wrong = "unconciousness" and right = "unconsciousness"
+  or
+  wrong = "unconfortability" and right = "discomfort"
+  or
+  wrong = "uncontitutional" and right = "unconstitutional"
+  or
+  wrong = "unconvential" and right = "unconventional"
+  or
+  wrong = "undecideable" and right = "undecidable"
+  or
+  wrong = "understoon" and right = "understood"
+  or
+  wrong = "undesireable" and right = "undesirable"
+  or
+  wrong = "undetecable" and right = "undetectable"
+  or
+  wrong = "undoubtely" and right = "undoubtedly"
+  or
+  wrong = "undreground" and right = "underground"
+  or
+  wrong = "uneccesary" and right = "unnecessary"
+  or
+  wrong = "unecessary" and right = "unnecessary"
+  or
+  wrong = "unequalities" and right = "inequalities"
+  or
+  wrong = "unforetunately" and right = "unfortunately"
+  or
+  wrong = "unforgetable" and right = "unforgettable"
+  or
+  wrong = "unforgiveable" and right = "unforgivable"
+  or
+  wrong = "unforseen" and right = "unforeseen"
+  or
+  wrong = "unfortunatley" and right = "unfortunately"
+  or
+  wrong = "unfortunatly" and right = "unfortunately"
+  or
+  wrong = "unfourtunately" and right = "unfortunately"
+  or
+  wrong = "unihabited" and right = "uninhabited"
+  or
+  wrong = "unilateraly" and right = "unilaterally"
+  or
+  wrong = "unilatreal" and right = "unilateral"
+  or
+  wrong = "unilatreally" and right = "unilaterally"
+  or
+  wrong = "uninterruped" and right = "uninterrupted"
+  or
+  wrong = "uninterupted" and right = "uninterrupted"
+  or
+  wrong = "unintialized" and right = "uninitialized"
+  or
+  wrong = "unitesstates" and right = "unitedstates"
+  or
+  wrong = "univeral" and right = "universal"
+  or
+  wrong = "univeristies" and right = "universities"
+  or
+  wrong = "univeristy" and right = "university"
+  or
+  wrong = "univerity" and right = "university"
+  or
+  wrong = "universtiy" and right = "university"
+  or
+  wrong = "univesities" and right = "universities"
+  or
+  wrong = "univesity" and right = "university"
+  or
+  wrong = "unkown" and right = "unknown"
+  or
+  wrong = "unlikey" and right = "unlikely"
+  or
+  wrong = "unmanouverable" and right = "unmaneuverable"
+  or
+  wrong = "unmanouverable" and right = "unmanoeuvrable"
+  or
+  wrong = "unmistakeably" and right = "unmistakably"
+  or
+  wrong = "unneccesarily" and right = "unnecessarily"
+  or
+  wrong = "unneccesary" and right = "unnecessary"
+  or
+  wrong = "unneccessarily" and right = "unnecessarily"
+  or
+  wrong = "unneccessary" and right = "unnecessary"
+  or
+  wrong = "unnecesarily" and right = "unnecessarily"
+  or
+  wrong = "unnecesary" and right = "unnecessary"
+  or
+  wrong = "unoffical" and right = "unofficial"
+  or
+  wrong = "unoperational" and right = "nonoperational"
+  or
+  wrong = "unoticeable" and right = "unnoticeable"
+  or
+  wrong = "unplease" and right = "displease"
+  or
+  wrong = "unplesant" and right = "unpleasant"
+  or
+  wrong = "unprecendented" and right = "unprecedented"
+  or
+  wrong = "unprecidented" and right = "unprecedented"
+  or
+  wrong = "unrepentent" and right = "unrepentant"
+  or
+  wrong = "unrepetant" and right = "unrepentant"
+  or
+  wrong = "unrepetent" and right = "unrepentant"
+  or
+  wrong = "unsed" and right = "unsaid"
+  or
+  wrong = "unsed" and right = "unused"
+  or
+  wrong = "unsed" and right = "used"
+  or
+  wrong = "unsubstanciated" and right = "unsubstantiated"
+  or
+  wrong = "unsuccesful" and right = "unsuccessful"
+  or
+  wrong = "unsuccesfully" and right = "unsuccessfully"
+  or
+  wrong = "unsuccessfull" and right = "unsuccessful"
+  or
+  wrong = "unsucesful" and right = "unsuccessful"
+  or
+  wrong = "unsucesfuly" and right = "unsuccessfully"
+  or
+  wrong = "unsucessful" and right = "unsuccessful"
+  or
+  wrong = "unsucessfull" and right = "unsuccessful"
+  or
+  wrong = "unsucessfully" and right = "unsuccessfully"
+  or
+  wrong = "unsuprised" and right = "unsurprised"
+  or
+  wrong = "unsuprising" and right = "unsurprising"
+  or
+  wrong = "unsuprisingly" and right = "unsurprisingly"
+  or
+  wrong = "unsuprized" and right = "unsurprised"
+  or
+  wrong = "unsuprizing" and right = "unsurprising"
+  or
+  wrong = "unsuprizingly" and right = "unsurprisingly"
+  or
+  wrong = "unsurprized" and right = "unsurprised"
+  or
+  wrong = "unsurprizing" and right = "unsurprising"
+  or
+  wrong = "unsurprizingly" and right = "unsurprisingly"
+  or
+  wrong = "untill" and right = "until"
+  or
+  wrong = "untranslateable" and right = "untranslatable"
+  or
+  wrong = "unuseable" and right = "unusable"
+  or
+  wrong = "unusuable" and right = "unusable"
+  or
+  wrong = "unviersity" and right = "university"
+  or
+  wrong = "unwarrented" and right = "unwarranted"
+  or
+  wrong = "unweildly" and right = "unwieldy"
+  or
+  wrong = "unwieldly" and right = "unwieldy"
+  or
+  wrong = "upcomming" and right = "upcoming"
+  or
+  wrong = "upgradded" and right = "upgraded"
+  or
+  wrong = "usally" and right = "usually"
+  or
+  wrong = "useage" and right = "usage"
+  or
+  wrong = "usefull" and right = "useful"
+  or
+  wrong = "usefuly" and right = "usefully"
+  or
+  wrong = "useing" and right = "using"
+  or
+  wrong = "usualy" and right = "usually"
+  or
+  wrong = "ususally" and right = "usually"
+  or
+  wrong = "vaccum" and right = "vacuum"
+  or
+  wrong = "vaccume" and right = "vacuum"
+  or
+  wrong = "vacinity" and right = "vicinity"
+  or
+  wrong = "vaguaries" and right = "vagaries"
+  or
+  wrong = "vaieties" and right = "varieties"
+  or
+  wrong = "vailidty" and right = "validity"
+  or
+  wrong = "valetta" and right = "valletta"
+  or
+  wrong = "valuble" and right = "valuable"
+  or
+  wrong = "valueable" and right = "valuable"
+  or
+  wrong = "varations" and right = "variations"
+  or
+  wrong = "varient" and right = "variant"
+  or
+  wrong = "variey" and right = "variety"
+  or
+  wrong = "varing" and right = "varying"
+  or
+  wrong = "varities" and right = "varieties"
+  or
+  wrong = "varity" and right = "variety"
+  or
+  wrong = "vasall" and right = "vassal"
+  or
+  wrong = "vasalls" and right = "vassals"
+  or
+  wrong = "vaule" and right = "value"
+  or
+  wrong = "vegatarian" and right = "vegetarian"
+  or
+  wrong = "vegitable" and right = "vegetable"
+  or
+  wrong = "vegitables" and right = "vegetables"
+  or
+  wrong = "vegtable" and right = "vegetable"
+  or
+  wrong = "vehicule" and right = "vehicle"
+  or
+  wrong = "vell" and right = "well"
+  or
+  wrong = "venemous" and right = "venomous"
+  or
+  wrong = "vengance" and right = "vengeance"
+  or
+  wrong = "vengence" and right = "vengeance"
+  or
+  wrong = "verfication" and right = "verification"
+  or
+  wrong = "verison" and right = "version"
+  or
+  wrong = "verisons" and right = "versions"
+  or
+  wrong = "vermillion" and right = "vermilion"
+  or
+  wrong = "versitilaty" and right = "versatility"
+  or
+  wrong = "versitlity" and right = "versatility"
+  or
+  wrong = "vetween" and right = "between"
+  or
+  wrong = "veyr" and right = "very"
+  or
+  wrong = "vigeur" and right = "vigor"
+  or
+  wrong = "vigeur" and right = "vigour"
+  or
+  wrong = "vigeur" and right = "vigueur"
+  or
+  wrong = "vigilence" and right = "vigilance"
+  or
+  wrong = "vigourous" and right = "vigorous"
+  or
+  wrong = "villian" and right = "villain"
+  or
+  wrong = "villification" and right = "vilification"
+  or
+  wrong = "villify" and right = "vilify"
+  or
+  wrong = "villin" and right = "villain"
+  or
+  wrong = "villin" and right = "villein"
+  or
+  wrong = "villin" and right = "villi"
+  or
+  wrong = "vincinity" and right = "vicinity"
+  or
+  wrong = "violentce" and right = "violence"
+  or
+  wrong = "virtualy" and right = "virtually"
+  or
+  wrong = "virutal" and right = "virtual"
+  or
+  wrong = "virutally" and right = "virtually"
+  or
+  wrong = "visable" and right = "visible"
+  or
+  wrong = "visably" and right = "visibly"
+  or
+  wrong = "visting" and right = "visiting"
+  or
+  wrong = "vistors" and right = "visitors"
+  or
+  wrong = "vitories" and right = "victories"
+  or
+  wrong = "volcanoe" and right = "volcano"
+  or
+  wrong = "voleyball" and right = "volleyball"
+  or
+  wrong = "volontary" and right = "voluntary"
+  or
+  wrong = "volonteer" and right = "volunteer"
+  or
+  wrong = "volonteered" and right = "volunteered"
+  or
+  wrong = "volonteering" and right = "volunteering"
+  or
+  wrong = "volonteers" and right = "volunteers"
+  or
+  wrong = "volounteer" and right = "volunteer"
+  or
+  wrong = "volounteered" and right = "volunteered"
+  or
+  wrong = "volounteering" and right = "volunteering"
+  or
+  wrong = "volounteers" and right = "volunteers"
+  or
+  wrong = "volumne" and right = "volume"
+  or
+  wrong = "vreity" and right = "variety"
+  or
+  wrong = "vrey" and right = "very"
+  or
+  wrong = "vriety" and right = "variety"
+  or
+  wrong = "vulnerablility" and right = "vulnerability"
+  or
+  wrong = "vyer" and right = "very"
+  or
+  wrong = "vyre" and right = "very"
+  or
+  wrong = "waht" and right = "what"
+  or
+  wrong = "warantee" and right = "warranty"
+  or
+  wrong = "wardobe" and right = "wardrobe"
+  or
+  wrong = "warrent" and right = "warrant"
+  or
+  wrong = "warrriors" and right = "warriors"
+  or
+  wrong = "wass" and right = "was"
+  or
+  wrong = "watn" and right = "want"
+  or
+  wrong = "wayword" and right = "wayward"
+  or
+  wrong = "weaponary" and right = "weaponry"
+  or
+  wrong = "weas" and right = "was"
+  or
+  wrong = "wehn" and right = "when"
+  or
+  wrong = "weild" and right = "wield"
+  or
+  wrong = "weild" and right = "wild"
+  or
+  wrong = "weilded" and right = "wielded"
+  or
+  wrong = "wendsay" and right = "wednesday"
+  or
+  wrong = "wensday" and right = "wednesday"
+  or
+  wrong = "wereabouts" and right = "whereabouts"
+  or
+  wrong = "whant" and right = "want"
+  or
+  wrong = "whants" and right = "wants"
+  or
+  wrong = "whcih" and right = "which"
+  or
+  wrong = "wheras" and right = "whereas"
+  or
+  wrong = "wherease" and right = "whereas"
+  or
+  wrong = "whereever" and right = "wherever"
+  or
+  wrong = "whic" and right = "which"
+  or
+  wrong = "whihc" and right = "which"
+  or
+  wrong = "whith" and right = "with"
+  or
+  wrong = "whlch" and right = "which"
+  or
+  wrong = "whn" and right = "when"
+  or
+  wrong = "wholey" and right = "wholly"
+  or
+  wrong = "wholy" and right = "holy"
+  or
+  wrong = "wholy" and right = "wholly"
+  or
+  wrong = "whta" and right = "what"
+  or
+  wrong = "whther" and right = "whether"
+  or
+  wrong = "wich" and right = "which"
+  or
+  wrong = "wich" and right = "witch"
+  or
+  wrong = "widesread" and right = "widespread"
+  or
+  wrong = "wief" and right = "wife"
+  or
+  wrong = "wierd" and right = "weird"
+  or
+  wrong = "wiew" and right = "view"
+  or
+  wrong = "wih" and right = "with"
+  or
+  wrong = "wiht" and right = "with"
+  or
+  wrong = "wille" and right = "will"
+  or
+  wrong = "willingless" and right = "willingness"
+  or
+  wrong = "willk" and right = "will"
+  or
+  wrong = "wirting" and right = "writing"
+  or
+  wrong = "withdrawl" and right = "withdraw"
+  or
+  wrong = "withdrawl" and right = "withdrawal"
+  or
+  wrong = "witheld" and right = "withheld"
+  or
+  wrong = "withh" and right = "with"
+  or
+  wrong = "withing" and right = "within"
+  or
+  wrong = "withold" and right = "withhold"
+  or
+  wrong = "witht" and right = "with"
+  or
+  wrong = "witn" and right = "with"
+  or
+  wrong = "wiull" and right = "will"
+  or
+  wrong = "wnat" and right = "want"
+  or
+  wrong = "wnated" and right = "wanted"
+  or
+  wrong = "wnats" and right = "wants"
+  or
+  wrong = "wohle" and right = "whole"
+  or
+  wrong = "wokr" and right = "work"
+  or
+  wrong = "wokring" and right = "working"
+  or
+  wrong = "wonderfull" and right = "wonderful"
+  or
+  wrong = "wordlwide" and right = "worldwide"
+  or
+  wrong = "workststion" and right = "workstation"
+  or
+  wrong = "worls" and right = "world"
+  or
+  wrong = "worstened" and right = "worsened"
+  or
+  wrong = "woudl" and right = "would"
+  or
+  wrong = "wresters" and right = "wrestlers"
+  or
+  wrong = "wriet" and right = "write"
+  or
+  wrong = "writen" and right = "written"
+  or
+  wrong = "wroet" and right = "wrote"
+  or
+  wrong = "wrok" and right = "work"
+  or
+  wrong = "wroking" and right = "working"
+  or
+  wrong = "wtih" and right = "with"
+  or
+  wrong = "wupport" and right = "support"
+  or
+  wrong = "xenophoby" and right = "xenophobia"
+  or
+  wrong = "yaching" and right = "yachting"
+  or
+  wrong = "yaer" and right = "year"
+  or
+  wrong = "yaerly" and right = "yearly"
+  or
+  wrong = "yaers" and right = "years"
+  or
+  wrong = "yatch" and right = "yacht"
+  or
+  wrong = "yearm" and right = "year"
+  or
+  wrong = "yeasr" and right = "years"
+  or
+  wrong = "yeild" and right = "yield"
+  or
+  wrong = "yeilding" and right = "yielding"
+  or
+  wrong = "yementite" and right = "yemeni"
+  or
+  wrong = "yementite" and right = "yemenite"
+  or
+  wrong = "yera" and right = "year"
+  or
+  wrong = "yeras" and right = "years"
+  or
+  wrong = "yersa" and right = "years"
+  or
+  wrong = "yotube" and right = "youtube"
+  or
+  wrong = "youseff" and right = "yousef"
+  or
+  wrong = "youself" and right = "yourself"
+  or
+  wrong = "yrea" and right = "year"
+  or
+  wrong = "ytou" and right = "you"
+  or
+  wrong = "yuo" and right = "you"
+  or
+  wrong = "zeebra" and right = "zebra"
+}
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
new file mode 100644
index 00000000000..f915e6407f8
--- /dev/null
+++ b/shared/typos/qlpack.yml
@@ -0,0 +1,4 @@
+name: codeql/typos
+version: 0.0.1-dev
+groups: shared
+library: true
diff --git a/swift/codegen/generators/qlgen.py b/swift/codegen/generators/qlgen.py
index 38c9ee4145d..7305651fd89 100755
--- a/swift/codegen/generators/qlgen.py
+++ b/swift/codegen/generators/qlgen.py
@@ -1,5 +1,24 @@
-#!/usr/bin/env python3
-# TODO this should probably be split in different generators now: ql, qltest, maybe qlipa
+"""
+QL code generation
+
+`generate(opts, renderer)` will generate in the library directory:
+ * generated/Raw.qll with thin class wrappers around DB types
+ * generated/Synth.qll with the base algebraic datatypes for AST entities
+ * generated/<group>/<Class>.qll with generated properties for each class
+ * if not already modified, a elements/<group>/<Class>.qll stub to customize the above classes
+ * elements.qll importing all the above stubs
+ * if not already modified, a elements/<group>/<Class>Constructor.qll stub to customize the algebraic datatype
+   characteristic predicate
+ * generated/SynthConstructors.qll importing all the above constructor stubs
+ * generated/PureSynthConstructors.qll importing constructor stubs for pure synthesized types (that is, not
+   corresponding to raw types)
+Moreover in the test directory for each <Class> in <group> it will generate beneath the
+extractor-tests/generated/<group>/<Class> directory either
+ * a `MISSING_SOURCE.txt` explanation file if no `swift` source is present, or
+ * one `<Class>.ql` test query for all single properties and on `<Class>_<property>.ql` test query for each optional or
+   repeated property
+"""
+# TODO this should probably be split in different generators now: ql, qltest, maybe qlsynth
 
 import logging
 import pathlib
@@ -29,11 +48,15 @@ class ModifiedStubMarkedAsGeneratedError(Error):
     pass
 
 
-def get_ql_property(cls: schema.Class, prop: schema.Property) -> ql.Property:
+class RootElementHasChildren(Error):
+    pass
+
+
+def get_ql_property(cls: schema.Class, prop: schema.Property, prev_child: str = "") -> ql.Property:
     args = dict(
         type=prop.type if not prop.is_predicate else "predicate",
         qltest_skip="qltest_skip" in prop.pragmas,
-        is_child=prop.is_child,
+        prev_child=prev_child if prop.is_child else None,
         is_optional=prop.is_optional,
         is_predicate=prop.is_predicate,
     )
@@ -69,11 +92,18 @@ def get_ql_property(cls: schema.Class, prop: schema.Property) -> ql.Property:
 
 def get_ql_class(cls: schema.Class, lookup: typing.Dict[str, schema.Class]):
     pragmas = {k: True for k in cls.pragmas if k.startswith("ql")}
+    prev_child = ""
+    properties = []
+    for p in cls.properties:
+        prop = get_ql_property(cls, p, prev_child)
+        if prop.is_child:
+            prev_child = prop.singular
+        properties.append(prop)
     return ql.Class(
         name=cls.name,
         bases=cls.bases,
         final=not cls.derived,
-        properties=[get_ql_property(cls, p) for p in cls.properties],
+        properties=properties,
         dir=cls.dir,
         ipa=bool(cls.ipa),
         **pragmas,
@@ -116,14 +146,14 @@ def get_import(file: pathlib.Path, swift_dir: pathlib.Path):
     return str(stem).replace("/", ".")
 
 
-def get_types_used_by(cls: ql.Class):
+def get_types_used_by(cls: ql.Class) -> typing.Iterable[str]:
     for b in cls.bases:
-        yield b
+        yield b.base
     for p in cls.properties:
         yield p.type
 
 
-def get_classes_used_by(cls: ql.Class):
+def get_classes_used_by(cls: ql.Class) -> typing.List[str]:
     return sorted(set(t for t in get_types_used_by(cls) if t[0].isupper()))
 
 
@@ -227,10 +257,15 @@ def generate(opts, renderer):
     data = schema.load(input)
 
     classes = {name: get_ql_class(cls, data.classes) for name, cls in data.classes.items()}
+    # element root is absent in tests
+    if schema.root_class_name in classes and classes[schema.root_class_name].has_children:
+        raise RootElementHasChildren
+
     imports = {}
 
     inheritance_graph = {name: cls.bases for name, cls in data.classes.items()}
-    db_classes = [classes[name] for name in toposort_flatten(inheritance_graph) if not classes[name].ipa]
+    toposorted_names = toposort_flatten(inheritance_graph)
+    db_classes = [classes[name] for name in toposorted_names if not classes[name].ipa]
     renderer.render(ql.DbClasses(db_classes), out / "Raw.qll")
 
     classes_by_dir_and_name = sorted(classes.values(), key=lambda cls: (cls.dir, cls.name))
@@ -251,7 +286,8 @@ def generate(opts, renderer):
     include_file = stub_out.with_suffix(".qll")
     renderer.render(ql.ImportList(list(imports.values())), include_file)
 
-    renderer.render(ql.GetParentImplementation(classes_by_dir_and_name), out / 'GetImmediateParent.qll')
+    toposorted_classes = [classes[name] for name in toposorted_names]
+    renderer.render(ql.GetParentImplementation(toposorted_classes), out / 'ParentChild.qll')
 
     for c in data.classes.values():
         if _should_skip_qltest(c, data.classes):
diff --git a/swift/codegen/lib/ql.py b/swift/codegen/lib/ql.py
index f862d29fdc3..a220b2e25a5 100644
--- a/swift/codegen/lib/ql.py
+++ b/swift/codegen/lib/ql.py
@@ -14,6 +14,7 @@ left behind and must be dealt with by hand.
 
 import pathlib
 from dataclasses import dataclass, field
+import itertools
 from typing import List, ClassVar, Union, Optional
 
 import inflection
@@ -35,7 +36,7 @@ class Property:
     first: bool = False
     is_optional: bool = False
     is_predicate: bool = False
-    is_child: bool = False
+    prev_child: Optional[str] = None
     qltest_skip: bool = False
 
     def __post_init__(self):
@@ -65,13 +66,26 @@ class Property:
     def is_single(self):
         return not (self.is_optional or self.is_repeated or self.is_predicate)
 
+    @property
+    def is_child(self):
+        return self.prev_child is not None
+
+
+@dataclass
+class Base:
+    base: str
+    prev: str = ""
+
+    def __str__(self):
+        return self.base
+
 
 @dataclass
 class Class:
     template: ClassVar = 'ql_class'
 
     name: str
-    bases: List[str] = field(default_factory=list)
+    bases: List[Base] = field(default_factory=list)
     final: bool = False
     properties: List[Property] = field(default_factory=list)
     dir: pathlib.Path = pathlib.Path()
@@ -82,7 +96,7 @@ class Class:
     ipa: bool = False
 
     def __post_init__(self):
-        self.bases = sorted(self.bases)
+        self.bases = [Base(str(b), str(prev)) for b, prev in zip(self.bases, itertools.chain([""], self.bases))]
         if self.properties:
             self.properties[0].first = True
 
@@ -95,9 +109,17 @@ class Class:
         return self.dir / self.name
 
     @property
-    def db_id(self):
+    def db_id(self) -> str:
         return "@" + inflection.underscore(self.name)
 
+    @property
+    def has_children(self) -> bool:
+        return any(p.is_child for p in self.properties)
+
+    @property
+    def last_base(self) -> str:
+        return self.bases[-1].base if self.bases else ""
+
 
 @dataclass
 class Stub:
diff --git a/swift/codegen/lib/schema.py b/swift/codegen/lib/schema.py
index e4ba3e77109..4119325a943 100644
--- a/swift/codegen/lib/schema.py
+++ b/swift/codegen/lib/schema.py
@@ -65,7 +65,7 @@ class IpaInfo:
 @dataclass
 class Class:
     name: str
-    bases: Set[str] = field(default_factory=set)
+    bases: List[str] = field(default_factory=set)
     derived: Set[str] = field(default_factory=set)
     properties: List[Property] = field(default_factory=list)
     dir: pathlib.Path = pathlib.Path()
@@ -150,9 +150,8 @@ def load(path):
             if not k.startswith("_"):
                 cls.properties.append(_parse_property(k, v))
             elif k == "_extends":
-                v = _auto_list(v)
-                for base in v:
-                    cls.bases.add(base)
+                cls.bases = _auto_list(v)
+                for base in cls.bases:
                     classes[base].derived.add(name)
             elif k == "_dir":
                 cls.dir = pathlib.Path(v)
@@ -165,7 +164,7 @@ def load(path):
             else:
                 raise Error(f"unknown metadata {k} for class {name}")
         if not cls.bases and cls.name != root_class_name:
-            cls.bases.add(root_class_name)
+            cls.bases = [root_class_name]
             classes[root_class_name].derived.add(name)
 
     return Schema(classes=classes, includes=set(data.get("_includes", [])))
diff --git a/swift/codegen/schema.yml b/swift/codegen/schema.yml
index 8cf2c8f0f25..e18e2505747 100644
--- a/swift/codegen/schema.yml
+++ b/swift/codegen/schema.yml
@@ -17,6 +17,9 @@ Element:
     _pragma: cpp_skip  # this is emitted using trap entries directly
   _pragma: qltest_skip
 
+UnresolvedElement:
+  _pragma: [ qltest_collapse_hierarchy, qltest_skip ]
+
 File:
   name: string
   _pragma: qltest_collapse_hierarchy
@@ -27,7 +30,7 @@ DbFile:
 UnknownFile:
   _extends: File
   _synth:
-    on: {}
+    on: { }
 
 Locatable:
   location:
@@ -41,7 +44,7 @@ Location:
   start_column: int
   end_line: int
   end_column: int
-  _pragma: [qltest_skip, qltest_collapse_hierarchy]
+  _pragma: [ qltest_skip, qltest_collapse_hierarchy ]
 
 DbLocation:
   _extends: Location
@@ -49,7 +52,7 @@ DbLocation:
 UnknownLocation:
   _extends: Location
   _synth:
-    on: {}
+    on: { }
 
 Comment:
   _extends: Locatable
@@ -60,7 +63,8 @@ Type:
   canonical_type: Type
 
 IterableDeclContext:
-  members: Decl*
+  _children:
+    members: Decl*
 
 ExtensionDecl:
   extended_type_decl: NominalTypeDecl
@@ -71,8 +75,8 @@ ExtensionDecl:
 
 NominalTypeDecl:
   _extends:
-    - IterableDeclContext
     - GenericTypeDecl
+    - IterableDeclContext
   type: Type
 
 AstNode:
@@ -80,8 +84,8 @@ AstNode:
 
 Callable:
   _children:
-    params: ParamDecl*
     self_param: ParamDecl?
+    params: ParamDecl*
     body: BraceStmt?
 
 ConditionElement:
@@ -178,7 +182,9 @@ TypeVariableType:
   _extends: Type
 
 UnresolvedType:
-  _extends: Type
+  _extends:
+    - Type
+    - UnresolvedElement
 
 ClassDecl:
   _extends: NominalTypeDecl
@@ -208,7 +214,7 @@ Stmt:
 
 TypeRepr:
   _extends: AstNode
-  type: Type?  # type can be absent on unresolved entities
+  type: Type
 
 FunctionType:
   _extends: AnyFunctionType
@@ -293,21 +299,12 @@ TypeAliasType:
 
 EnumCaseDecl:
   _extends: Decl
-  _children:
-    elements: EnumElementDecl*
+  elements: EnumElementDecl*
 
 IfConfigDecl:
   _extends: Decl
   _children:
-    clauses: IfConfigClause*
-
-IfConfigClause:
-  _extends: Locatable
-  _children:
-    condition: Expr?
-    elements: AstNode*
-  is_active: predicate
-  _dir: decl
+    active_elements: AstNode*
 
 ImportDecl:
   _extends: Decl
@@ -545,7 +542,7 @@ RebindSelfInConstructorExpr:
   _extends: Expr
   _children:
     sub_expr: Expr
-    self: VarDecl
+  self: VarDecl
 
 SequenceExpr:
   _extends: Expr
@@ -581,28 +578,36 @@ TypeExpr:
     type_repr: TypeRepr?
 
 UnresolvedDeclRefExpr:
-  _extends: Expr
+  _extends:
+    - Expr
+    - UnresolvedElement
   name: string?
 
 UnresolvedDotExpr:
-  _extends: Expr
+  _extends:
+    - Expr
+    - UnresolvedElement
   _children:
     base: Expr
   name: string
 
 UnresolvedMemberExpr:
-  _extends: Expr
+  _extends:
+    - Expr
+    - UnresolvedElement
   name: string
-  _pragma: qltest_skip  # we should really never extract these
 
 UnresolvedPatternExpr:
-  _extends: Expr
+  _extends:
+    - Expr
+    - UnresolvedElement
   _children:
     sub_pattern: Pattern
 
 UnresolvedSpecializeExpr:
-  _extends: Expr
-  _pragma: qltest_skip  # we should really never extract these
+  _extends:
+    - Expr
+    - UnresolvedElement
 
 VarargExpansionExpr:
   _extends: Expr
@@ -836,8 +841,7 @@ PrefixUnaryExpr:
 
 SelfApplyExpr:
   _extends: ApplyExpr
-  _children:
-    base: Expr
+  base: Expr
 
 ArrayExpr:
   _extends: CollectionExpr
@@ -865,7 +869,9 @@ ParenExpr:
   _extends: IdentityExpr
 
 UnresolvedMemberChainResultExpr:
-  _extends: IdentityExpr
+  _extends:
+    - IdentityExpr
+    - UnresolvedElement
 
 AnyHashableErasureExpr:
   _extends: ImplicitConversionExpr
@@ -961,7 +967,9 @@ UnevaluatedInstanceExpr:
   _extends: ImplicitConversionExpr
 
 UnresolvedTypeConversionExpr:
-  _extends: ImplicitConversionExpr
+  _extends:
+    - ImplicitConversionExpr
+    - UnresolvedElement
 
 BuiltinLiteralExpr:
   _extends: LiteralExpr
@@ -1110,7 +1118,8 @@ AbstractTypeParamDecl:
   _extends: TypeDecl
 
 GenericContext:
-  generic_type_params: GenericTypeParamDecl*
+  _children:
+    generic_type_params: GenericTypeParamDecl*
 
 GenericTypeDecl:
   _extends:
@@ -1121,6 +1130,8 @@ ModuleDecl:
   _extends: TypeDecl
   is_builtin_module: predicate
   is_system_module: predicate
+  imported_modules: ModuleDecl*
+  exported_modules: ModuleDecl*
 
 ConstructorRefCallExpr:
   _extends: SelfApplyExpr
diff --git a/swift/codegen/templates/ql_parent.mustache b/swift/codegen/templates/ql_parent.mustache
index d13a47a8ae4..2182d86e6f0 100644
--- a/swift/codegen/templates/ql_parent.mustache
+++ b/swift/codegen/templates/ql_parent.mustache
@@ -2,33 +2,88 @@
 
 import codeql.swift.elements
 
-/**
- * Gets any of the "immediate" children of `e`. "Immediate" means not taking into account node resolution: for example
- * if the AST child is the first of a series of conversions that would normally be hidden away, this will select the
- * next conversion down the hidden AST tree instead of the corresponding fully uncoverted node at the bottom.
- * Outside this module this file is mainly intended to be used to test uniqueness of parents.
- */
+private module Impl {
+{{#classes}}
+    private Element getImmediateChildOf{{name}}({{name}} e, int index, string partialPredicateCall) {
+    {{! avoid unused argument warnings on root element, assuming the root element has no children }}
+    {{#root}}none(){{/root}}
+    {{^root}}
+    {{! b is the base offset 0, for ease of generation }}
+    {{! b<base> is constructed to be strictly greater than the indexes required for children coming from <base> }}
+    {{! n is the base offset for direct children, equal to the last base offset from above }}
+    {{! n<child> is constructed to be strictly greater than the indexes for <child> children }}
+        exists(int b{{#bases}}, int b{{.}}{{/bases}}, int n{{#properties}}{{#is_child}}, int n{{singular}}{{/is_child}}{{/properties}} |
+        b = 0
+        {{#bases}}
+            and
+            b{{.}} = b{{prev}} + 1 + max(int i | i = -1 or exists(getImmediateChildOf{{.}}(e, i, _)) | i)
+        {{/bases}}
+        and
+        n = b{{last_base}}
+        {{#properties}}
+            {{#is_child}}
+            {{! n<child> is defined on top of the previous definition }}
+            {{! for single and optional properties it adds 1 (regardless of whether the optional property exists) }}
+            {{! for repeated it adds 1 + the maximum index (which works for repeated optional as well) }}
+                and
+                n{{singular}} = n{{prev_child}} + 1{{#is_repeated}}+ max(int i | i = -1 or exists(e.getImmediate{{singular}}(i)) | i){{/is_repeated}}
+            {{/is_child}}
+        {{/properties}} and (
+        none()
+        {{#bases}}
+            or
+            result = getImmediateChildOf{{.}}(e, index - b{{prev}}, partialPredicateCall)
+        {{/bases}}
+        {{#properties}}
+            {{#is_child}}
+                or
+                {{#is_repeated}}
+                    result = e.getImmediate{{singular}}(index - n{{prev_child}}) and partialPredicateCall = "{{singular}}(" + (index - n{{prev_child}}).toString() + ")"
+                {{/is_repeated}}
+                {{^is_repeated}}
+                    index = n{{prev_child}} and result = e.getImmediate{{singular}}() and partialPredicateCall = "{{singular}}()"
+                {{/is_repeated}}
+            {{/is_child}}
+        {{/properties}}
+        ))
+    {{/root}}
+    }
+
+{{/classes}}
 cached
-Element getAnImmediateChild(Element e) {
-  // why does this look more complicated than it should?
-  // * none() simplifies generation, as we can append `or ...` without a special case for the first item
-  none()
-  {{#classes}}
-  {{#properties}}
-  {{#is_child}}
-  or
-  result = e.({{name}}).getImmediate{{singular}}({{#is_repeated}}_{{/is_repeated}})
-  {{/is_child}}
-  {{/properties}}
-  {{/classes}}
+Element getImmediateChild(Element e, int index, string partialAccessor) {
+// why does this look more complicated than it should?
+// * none() simplifies generation, as we can append `or ...` without a special case for the first item
+none()
+{{#classes}}
+    {{#final}}
+        or
+        result = getImmediateChildOf{{name}}(e, index, partialAccessor)
+    {{/final}}
+{{/classes}}
+}
 }
 
 /**
- * Gets the "immediate" parent of `e`. "Immediate" means not taking into account node resolution: for example
- * if `e` has conversions, `getImmediateParent(e)` will give the bottom conversion in the hidden AST.
- */
- Element getImmediateParent(Element e) {
-   // `unique` is used here to tell the optimizer that there is in fact only one result
-   // this is tested by the `library-tests/parent/no_double_parents.ql` test
-   result = unique(Element x | e = getAnImmediateChild(x) | x)
+* Gets the "immediate" parent of `e`. "Immediate" means not taking into account node resolution: for example
+* if `e` has conversions, `getImmediateParent(e)` will give the innermost conversion in the hidden AST.
+*/
+Element getImmediateParent(Element e) {
+// `unique` is used here to tell the optimizer that there is in fact only one result
+// this is tested by the `library-tests/parent/no_double_parents.ql` test
+result = unique(Element x | e = Impl::getImmediateChild(x, _, _) | x)
+}
+
+/**
+* Gets the immediate child indexed at `index`. Indexes are not guaranteed to be contiguous, but are guaranteed to be distinct. `accessor` is bound the member predicate call resulting in the given child.
+*/
+Element getImmediateChildAndAccessor(Element e, int index, string accessor) {
+exists(string partialAccessor | result = Impl::getImmediateChild(e, index, partialAccessor) and accessor = "getImmediate" + partialAccessor)
+}
+
+/**
+* Gets the child indexed at `index`. Indexes are not guaranteed to be contiguous, but are guaranteed to be distinct. `accessor` is bound the member predicate call resulting in the given child.
+*/
+Element getChildAndAccessor(Element e, int index, string accessor) {
+exists(string partialAccessor | result = Impl::getImmediateChild(e, index, partialAccessor).resolve() and accessor = "get" + partialAccessor)
 }
diff --git a/swift/codegen/test/test_cppgen.py b/swift/codegen/test/test_cppgen.py
index 95b3b11e276..7ae495a97f5 100644
--- a/swift/codegen/test/test_cppgen.py
+++ b/swift/codegen/test/test_cppgen.py
@@ -49,7 +49,7 @@ def test_two_class_hierarchy(generate):
     base = cpp.Class(name="A")
     assert generate([
         schema.Class(name="A", derived={"B"}),
-        schema.Class(name="B", bases={"A"}),
+        schema.Class(name="B", bases=["A"]),
     ]) == [
         base,
         cpp.Class(name="B", bases=[base], final=True, trap_name="Bs"),
@@ -64,11 +64,11 @@ def test_complex_hierarchy_topologically_ordered(generate):
     e = cpp.Class(name="E", bases=[b, c, d], final=True, trap_name="Es")
     f = cpp.Class(name="F", bases=[c], final=True, trap_name="Fs")
     assert generate([
-        schema.Class(name="F", bases={"C"}),
+        schema.Class(name="F", bases=["C"]),
         schema.Class(name="B", derived={"E"}),
-        schema.Class(name="D", bases={"A"}, derived={"E"}),
-        schema.Class(name="C", bases={"A"}, derived={"E", "F"}),
-        schema.Class(name="E", bases={"B", "C", "D"}),
+        schema.Class(name="D", bases=["A"], derived={"E"}),
+        schema.Class(name="C", bases=["A"], derived={"E", "F"}),
+        schema.Class(name="E", bases=["B", "C", "D"]),
         schema.Class(name="A", derived={"C", "D"}),
     ]) == [a, b, c, d, e, f]
 
@@ -154,7 +154,7 @@ def test_classes_with_dirs(generate_grouped):
     assert generate_grouped([
         schema.Class(name="A"),
         schema.Class(name="B", dir=pathlib.Path("foo")),
-        schema.Class(name="C", bases={"CBase"}, dir=pathlib.Path("bar")),
+        schema.Class(name="C", bases=["CBase"], dir=pathlib.Path("bar")),
         schema.Class(name="CBase", derived={"C"}, dir=pathlib.Path("bar")),
         schema.Class(name="D", dir=pathlib.Path("foo/bar/baz")),
     ]) == {
diff --git a/swift/codegen/test/test_ql.py b/swift/codegen/test/test_ql.py
index 14d555fee03..897410f64ba 100644
--- a/swift/codegen/test/test_ql.py
+++ b/swift/codegen/test/test_ql.py
@@ -78,9 +78,9 @@ def test_property_predicate_getter():
     assert prop.getter == "prop"
 
 
-def test_class_sorts_bases():
+def test_class_processes_bases():
     bases = ["B", "Ab", "C", "Aa"]
-    expected = ["Aa", "Ab", "B", "C"]
+    expected = [ql.Base("B"), ql.Base("Ab", prev="B"), ql.Base("C", prev="Ab"), ql.Base("Aa", prev="C")]
     cls = ql.Class("Foo", bases=bases)
     assert cls.bases == expected
 
@@ -105,5 +105,27 @@ def test_non_root_class():
     assert not cls.root
 
 
+@pytest.mark.parametrize("prev_child,is_child", [(None, False), ("", True), ("x", True)])
+def test_is_child(prev_child, is_child):
+    p = ql.Property("Foo", "int", prev_child=prev_child)
+    assert p.is_child is is_child
+
+
+def test_empty_class_no_children():
+    cls = ql.Class("Class", properties=[])
+    assert cls.has_children is False
+
+
+def test_class_no_children():
+    cls = ql.Class("Class", properties=[ql.Property("Foo", "int"), ql.Property("Bar", "string")])
+    assert cls.has_children is False
+
+
+def test_class_with_children():
+    cls = ql.Class("Class", properties=[ql.Property("Foo", "int"), ql.Property("Child", "x", prev_child=""),
+                                        ql.Property("Bar", "string")])
+    assert cls.has_children is True
+
+
 if __name__ == '__main__':
     sys.exit(pytest.main([__file__] + sys.argv[1:]))
diff --git a/swift/codegen/test/test_qlgen.py b/swift/codegen/test/test_qlgen.py
index 410c65c4479..3897bca2895 100644
--- a/swift/codegen/test/test_qlgen.py
+++ b/swift/codegen/test/test_qlgen.py
@@ -29,7 +29,7 @@ def ql_test_output_path(): return paths.swift_dir / "ql/test/path"
 def import_file(): return stub_path().with_suffix(".qll")
 
 
-def children_file(): return ql_output_path() / "GetImmediateParent.qll"
+def children_file(): return ql_output_path() / "ParentChild.qll"
 
 
 stub_import_prefix = "stub.path."
@@ -149,9 +149,9 @@ def test_one_empty_class(generate_classes):
 
 def test_hierarchy(generate_classes):
     assert generate_classes([
-        schema.Class("D", bases={"B", "C"}),
-        schema.Class("C", bases={"A"}, derived={"D"}),
-        schema.Class("B", bases={"A"}, derived={"D"}),
+        schema.Class("D", bases=["B", "C"]),
+        schema.Class("C", bases=["A"], derived={"D"}),
+        schema.Class("B", bases=["A"], derived={"D"}),
         schema.Class("A", derived={"B", "C"}),
     ]) == {
         "A.qll": (ql.Stub(name="A", base_import=gen_import_prefix + "A"),
@@ -168,18 +168,18 @@ def test_hierarchy(generate_classes):
 
 def test_hierarchy_imports(generate_import_list):
     assert generate_import_list([
-        schema.Class("D", bases={"B", "C"}),
-        schema.Class("C", bases={"A"}, derived={"D"}),
-        schema.Class("B", bases={"A"}, derived={"D"}),
+        schema.Class("D", bases=["B", "C"]),
+        schema.Class("C", bases=["A"], derived={"D"}),
+        schema.Class("B", bases=["A"], derived={"D"}),
         schema.Class("A", derived={"B", "C"}),
     ]) == ql.ImportList([stub_import_prefix + cls for cls in "ABCD"])
 
 
 def test_hierarchy_children(generate_children_implementations):
     assert generate_children_implementations([
-        schema.Class("D", bases={"B", "C"}),
-        schema.Class("C", bases={"A"}, derived={"D"}),
-        schema.Class("B", bases={"A"}, derived={"D"}),
+        schema.Class("D", bases=["B", "C"]),
+        schema.Class("C", bases=["A"], derived={"D"}),
+        schema.Class("B", bases=["A"], derived={"D"}),
         schema.Class("A", derived={"B", "C"}),
     ]) == ql.GetParentImplementation(
         classes=[ql.Class(name="A"),
@@ -207,6 +207,42 @@ def test_single_property(generate_classes):
     }
 
 
+def test_children(generate_classes):
+    assert generate_classes([
+        schema.Class("MyObject", properties=[
+            schema.SingleProperty("a", "int"),
+            schema.SingleProperty("child1", "int", is_child=True),
+            schema.RepeatedProperty("b", "int"),
+            schema.RepeatedProperty("child2", "int", is_child=True),
+            schema.OptionalProperty("c", "int"),
+            schema.OptionalProperty("child3", "int", is_child=True),
+            schema.RepeatedOptionalProperty("d", "int"),
+            schema.RepeatedOptionalProperty("child4", "int", is_child=True),
+        ]),
+    ]) == {
+        "MyObject.qll": (ql.Stub(name="MyObject", base_import=gen_import_prefix + "MyObject"),
+                         ql.Class(name="MyObject", final=True,
+                                  properties=[
+                                      ql.Property(singular="A", type="int", tablename="my_objects",
+                                                  tableparams=["this", "result", "_"]),
+                                      ql.Property(singular="Child1", type="int", tablename="my_objects",
+                                                  tableparams=["this", "_", "result"], prev_child=""),
+                                      ql.Property(singular="B", plural="Bs", type="int", tablename="my_object_bs",
+                                                  tableparams=["this", "index", "result"]),
+                                      ql.Property(singular="Child2", plural="Child2s", type="int", tablename="my_object_child2s",
+                                                  tableparams=["this", "index", "result"], prev_child="Child1"),
+                                      ql.Property(singular="C", type="int", tablename="my_object_cs",
+                                                  tableparams=["this", "result"], is_optional=True),
+                                      ql.Property(singular="Child3", type="int", tablename="my_object_child3s",
+                                                  tableparams=["this", "result"], is_optional=True, prev_child="Child2"),
+                                      ql.Property(singular="D", plural="Ds", type="int", tablename="my_object_ds",
+                                                  tableparams=["this", "index", "result"], is_optional=True),
+                                      ql.Property(singular="Child4", plural="Child4s", type="int", tablename="my_object_child4s",
+                                                  tableparams=["this", "index", "result"], is_optional=True, prev_child="Child3"),
+                                  ])),
+    }
+
+
 def test_single_properties(generate_classes):
     assert generate_classes([
         schema.Class("MyObject", properties=[
@@ -228,8 +264,8 @@ def test_single_properties(generate_classes):
     }
 
 
-@pytest.mark.parametrize("is_child", [False, True])
-def test_optional_property(generate_classes, is_child):
+@pytest.mark.parametrize("is_child,prev_child", [(False, None), (True, "")])
+def test_optional_property(generate_classes, is_child, prev_child):
     assert generate_classes([
         schema.Class("MyObject", properties=[
             schema.OptionalProperty("foo", "bar", is_child=is_child)]),
@@ -238,13 +274,13 @@ def test_optional_property(generate_classes, is_child):
                          ql.Class(name="MyObject", final=True, properties=[
                              ql.Property(singular="Foo", type="bar", tablename="my_object_foos",
                                          tableparams=["this", "result"],
-                                         is_optional=True, is_child=is_child),
+                                         is_optional=True, prev_child=prev_child),
                          ])),
     }
 
 
-@pytest.mark.parametrize("is_child", [False, True])
-def test_repeated_property(generate_classes, is_child):
+@pytest.mark.parametrize("is_child,prev_child", [(False, None), (True, "")])
+def test_repeated_property(generate_classes, is_child, prev_child):
     assert generate_classes([
         schema.Class("MyObject", properties=[
             schema.RepeatedProperty("foo", "bar", is_child=is_child)]),
@@ -252,13 +288,13 @@ def test_repeated_property(generate_classes, is_child):
         "MyObject.qll": (ql.Stub(name="MyObject", base_import=gen_import_prefix + "MyObject"),
                          ql.Class(name="MyObject", final=True, properties=[
                              ql.Property(singular="Foo", plural="Foos", type="bar", tablename="my_object_foos",
-                                         tableparams=["this", "index", "result"], is_child=is_child),
+                                         tableparams=["this", "index", "result"], prev_child=prev_child),
                          ])),
     }
 
 
-@pytest.mark.parametrize("is_child", [False, True])
-def test_repeated_optional_property(generate_classes, is_child):
+@pytest.mark.parametrize("is_child,prev_child", [(False, None), (True, "")])
+def test_repeated_optional_property(generate_classes, is_child, prev_child):
     assert generate_classes([
         schema.Class("MyObject", properties=[
             schema.RepeatedOptionalProperty("foo", "bar", is_child=is_child)]),
@@ -267,7 +303,7 @@ def test_repeated_optional_property(generate_classes, is_child):
                          ql.Class(name="MyObject", final=True, properties=[
                              ql.Property(singular="Foo", plural="Foos", type="bar", tablename="my_object_foos",
                                          tableparams=["this", "index", "result"], is_optional=True,
-                                         is_child=is_child),
+                                         prev_child=prev_child),
                          ])),
     }
 
@@ -286,8 +322,8 @@ def test_predicate_property(generate_classes):
     }
 
 
-@pytest.mark.parametrize("is_child", [False, True])
-def test_single_class_property(generate_classes, is_child):
+@pytest.mark.parametrize("is_child,prev_child", [(False, None), (True, "")])
+def test_single_class_property(generate_classes, is_child, prev_child):
     assert generate_classes([
         schema.Class("MyObject", properties=[
             schema.SingleProperty("foo", "Bar", is_child=is_child)]),
@@ -299,7 +335,7 @@ def test_single_class_property(generate_classes, is_child):
                 ql.Property(singular="Foo", type="Bar", tablename="my_objects",
                             tableparams=[
                                 "this", "result"],
-                            is_child=is_child),
+                            prev_child=prev_child),
             ],
         )),
         "Bar.qll": (ql.Stub(name="Bar", base_import=gen_import_prefix + "Bar"),
@@ -311,7 +347,7 @@ def test_class_dir(generate_classes):
     dir = pathlib.Path("another/rel/path")
     assert generate_classes([
         schema.Class("A", derived={"B"}, dir=dir),
-        schema.Class("B", bases={"A"}),
+        schema.Class("B", bases=["A"]),
     ]) == {
         f"{dir}/A.qll": (ql.Stub(name="A", base_import=gen_import_prefix + "another.rel.path.A"),
                          ql.Class(name="A", dir=dir)),
@@ -321,11 +357,18 @@ def test_class_dir(generate_classes):
     }
 
 
+def test_root_element_cannot_have_children(generate_classes):
+    with pytest.raises(qlgen.RootElementHasChildren):
+        generate_classes([
+            schema.Class(schema.root_class_name, properties=[schema.SingleProperty("x", is_child=True)])
+        ])
+
+
 def test_class_dir_imports(generate_import_list):
     dir = pathlib.Path("another/rel/path")
     assert generate_import_list([
         schema.Class("A", derived={"B"}, dir=dir),
-        schema.Class("B", bases={"A"}),
+        schema.Class("B", bases=["A"]),
     ]) == ql.ImportList([
         stub_import_prefix + "B",
         stub_import_prefix + "another.rel.path.A",
@@ -432,7 +475,7 @@ def test_test_total_properties(opts, generate_tests):
         schema.Class("A", derived={"B"}, properties=[
             schema.SingleProperty("x", "string"),
         ]),
-        schema.Class("B", bases={"A"}, properties=[
+        schema.Class("B", bases=["A"], properties=[
             schema.PredicateProperty("y", "int"),
         ]),
     ]) == {
@@ -451,7 +494,7 @@ def test_test_partial_properties(opts, generate_tests):
         schema.Class("A", derived={"B"}, properties=[
             schema.OptionalProperty("x", "string"),
         ]),
-        schema.Class("B", bases={"A"}, properties=[
+        schema.Class("B", bases=["A"], properties=[
             schema.RepeatedProperty("y", "int"),
         ]),
     ]) == {
@@ -471,9 +514,9 @@ def test_test_properties_deduplicated(opts, generate_tests):
             schema.SingleProperty("x", "string"),
             schema.RepeatedProperty("y", "int"),
         ]),
-        schema.Class("A", bases={"Base"}, derived={"Final"}),
-        schema.Class("B", bases={"Base"}, derived={"Final"}),
-        schema.Class("Final", bases={"A", "B"}),
+        schema.Class("A", bases=["Base"], derived={"Final"}),
+        schema.Class("B", bases=["Base"], derived={"Final"}),
+        schema.Class("Final", bases=["A", "B"]),
     ]) == {
         "Final/Final.ql": ql.ClassTester(class_name="Final", properties=[
             ql.PropertyForTest(
@@ -492,7 +535,7 @@ def test_test_properties_skipped(opts, generate_tests):
             schema.SingleProperty("x", "string", pragmas=["qltest_skip", "foo"]),
             schema.RepeatedProperty("y", "int", pragmas=["bar", "qltest_skip"]),
         ]),
-        schema.Class("Derived", bases={"Base"}, properties=[
+        schema.Class("Derived", bases=["Base"], properties=[
             schema.PredicateProperty("a", pragmas=["qltest_skip"]),
             schema.OptionalProperty(
                 "b", "int", pragmas=["bar", "qltest_skip", "baz"]),
@@ -509,7 +552,7 @@ def test_test_base_class_skipped(opts, generate_tests):
             schema.SingleProperty("x", "string"),
             schema.RepeatedProperty("y", "int"),
         ]),
-        schema.Class("Derived", bases={"Base"}),
+        schema.Class("Derived", bases=["Base"]),
     ]) == {
         "Derived/Derived.ql": ql.ClassTester(class_name="Derived"),
     }
@@ -519,7 +562,7 @@ def test_test_final_class_skipped(opts, generate_tests):
     write(opts.ql_test_output / "Derived" / "test.swift")
     assert generate_tests([
         schema.Class("Base", derived={"Derived"}),
-        schema.Class("Derived", bases={"Base"}, pragmas=["qltest_skip", "foo"], properties=[
+        schema.Class("Derived", bases=["Base"], pragmas=["qltest_skip", "foo"], properties=[
             schema.SingleProperty("x", "string"),
             schema.RepeatedProperty("y", "int"),
         ]),
@@ -530,9 +573,9 @@ def test_test_class_hierarchy_collapse(opts, generate_tests):
     write(opts.ql_test_output / "Base" / "test.swift")
     assert generate_tests([
         schema.Class("Base", derived={"D1", "D2"}, pragmas=["foo", "qltest_collapse_hierarchy"]),
-        schema.Class("D1", bases={"Base"}, properties=[schema.SingleProperty("x", "string")]),
-        schema.Class("D2", bases={"Base"}, derived={"D3"}, properties=[schema.SingleProperty("y", "string")]),
-        schema.Class("D3", bases={"D2"}, properties=[schema.SingleProperty("z", "string")]),
+        schema.Class("D1", bases=["Base"], properties=[schema.SingleProperty("x", "string")]),
+        schema.Class("D2", bases=["Base"], derived={"D3"}, properties=[schema.SingleProperty("y", "string")]),
+        schema.Class("D3", bases=["D2"], properties=[schema.SingleProperty("z", "string")]),
     ]) == {
         "Base/Base.ql": ql.ClassTester(class_name="Base"),
     }
@@ -543,10 +586,10 @@ def test_test_class_hierarchy_uncollapse(opts, generate_tests):
         write(opts.ql_test_output / d / "test.swift")
     assert generate_tests([
         schema.Class("Base", derived={"D1", "D2"}, pragmas=["foo", "qltest_collapse_hierarchy"]),
-        schema.Class("D1", bases={"Base"}, properties=[schema.SingleProperty("x", "string")]),
-        schema.Class("D2", bases={"Base"}, derived={"D3", "D4"}, pragmas=["qltest_uncollapse_hierarchy", "bar"]),
-        schema.Class("D3", bases={"D2"}),
-        schema.Class("D4", bases={"D2"}),
+        schema.Class("D1", bases=["Base"], properties=[schema.SingleProperty("x", "string")]),
+        schema.Class("D2", bases=["Base"], derived={"D3", "D4"}, pragmas=["qltest_uncollapse_hierarchy", "bar"]),
+        schema.Class("D3", bases=["D2"]),
+        schema.Class("D4", bases=["D2"]),
     ]) == {
         "Base/Base.ql": ql.ClassTester(class_name="Base"),
         "D3/D3.ql": ql.ClassTester(class_name="D3"),
@@ -559,9 +602,9 @@ def test_test_class_hierarchy_uncollapse_at_final(opts, generate_tests):
         write(opts.ql_test_output / d / "test.swift")
     assert generate_tests([
         schema.Class("Base", derived={"D1", "D2"}, pragmas=["foo", "qltest_collapse_hierarchy"]),
-        schema.Class("D1", bases={"Base"}, properties=[schema.SingleProperty("x", "string")]),
-        schema.Class("D2", bases={"Base"}, derived={"D3"}),
-        schema.Class("D3", bases={"D2"}, pragmas=["qltest_uncollapse_hierarchy", "bar"]),
+        schema.Class("D1", bases=["Base"], properties=[schema.SingleProperty("x", "string")]),
+        schema.Class("D2", bases=["Base"], derived={"D3"}),
+        schema.Class("D3", bases=["D2"], pragmas=["qltest_uncollapse_hierarchy", "bar"]),
     ]) == {
         "Base/Base.ql": ql.ClassTester(class_name="Base"),
         "D3/D3.ql": ql.ClassTester(class_name="D3"),
diff --git a/swift/codegen/test/test_schema.py b/swift/codegen/test/test_schema.py
index 42c3b18559e..20d527e351b 100644
--- a/swift/codegen/test/test_schema.py
+++ b/swift/codegen/test/test_schema.py
@@ -30,7 +30,7 @@ MyClass: {}
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'MyClass'}),
-        'MyClass': schema.Class('MyClass', bases={root_name}),
+        'MyClass': schema.Class('MyClass', bases=[root_name]),
     }
 
 
@@ -41,8 +41,8 @@ MyClass2: {}
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'MyClass1', 'MyClass2'}),
-        'MyClass1': schema.Class('MyClass1', bases={root_name}),
-        'MyClass2': schema.Class('MyClass2', bases={root_name}),
+        'MyClass1': schema.Class('MyClass1', bases=[root_name]),
+        'MyClass2': schema.Class('MyClass2', bases=[root_name]),
     }
 
 
@@ -54,8 +54,8 @@ MyClass2:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'MyClass1'}),
-        'MyClass1': schema.Class('MyClass1', bases={root_name}, derived={'MyClass2'}),
-        'MyClass2': schema.Class('MyClass2', bases={'MyClass1'}),
+        'MyClass1': schema.Class('MyClass1', bases=[root_name], derived={'MyClass2'}),
+        'MyClass2': schema.Class('MyClass2', bases=['MyClass1']),
     }
 
 
@@ -70,9 +70,9 @@ C:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'A', 'B'}),
-        'A': schema.Class('A', bases={root_name}, derived={'C'}),
-        'B': schema.Class('B', bases={root_name}, derived={'C'}),
-        'C': schema.Class('C', bases={'A', 'B'}),
+        'A': schema.Class('A', bases=[root_name], derived={'C'}),
+        'B': schema.Class('B', bases=[root_name], derived={'C'}),
+        'C': schema.Class('C', bases=['A', 'B']),
     }
 
 
@@ -83,7 +83,7 @@ A:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'A'}),
-        'A': schema.Class('A', bases={root_name}, dir=pathlib.Path("other/dir")),
+        'A': schema.Class('A', bases=[root_name], dir=pathlib.Path("other/dir")),
     }
 
 
@@ -103,13 +103,13 @@ A: {}
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'Afoo', 'Bbar', 'Abar', 'Bfoo', 'Ax', 'Ay', 'A'}),
-        'Afoo': schema.Class('Afoo', bases={root_name}, dir=pathlib.Path("second/dir")),
-        'Bbar': schema.Class('Bbar', bases={root_name}, dir=pathlib.Path("third/dir")),
-        'Abar': schema.Class('Abar', bases={root_name}, dir=pathlib.Path("third/dir")),
-        'Bfoo': schema.Class('Bfoo', bases={root_name}, dir=pathlib.Path("second/dir")),
-        'Ax': schema.Class('Ax', bases={root_name}, dir=pathlib.Path("first/dir")),
-        'Ay': schema.Class('Ay', bases={root_name}, dir=pathlib.Path("first/dir")),
-        'A': schema.Class('A', bases={root_name}, dir=pathlib.Path()),
+        'Afoo': schema.Class('Afoo', bases=[root_name], dir=pathlib.Path("second/dir")),
+        'Bbar': schema.Class('Bbar', bases=[root_name], dir=pathlib.Path("third/dir")),
+        'Abar': schema.Class('Abar', bases=[root_name], dir=pathlib.Path("third/dir")),
+        'Bfoo': schema.Class('Bfoo', bases=[root_name], dir=pathlib.Path("second/dir")),
+        'Ax': schema.Class('Ax', bases=[root_name], dir=pathlib.Path("first/dir")),
+        'Ay': schema.Class('Ay', bases=[root_name], dir=pathlib.Path("first/dir")),
+        'A': schema.Class('A', bases=[root_name], dir=pathlib.Path()),
     }
 
 
@@ -122,7 +122,7 @@ A:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'A'}),
-        'A': schema.Class('A', bases={root_name}, dir=pathlib.Path("other/dir")),
+        'A': schema.Class('A', bases=[root_name], dir=pathlib.Path("other/dir")),
     }
 
 
@@ -147,7 +147,7 @@ A:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'A'}),
-        'A': schema.Class('A', bases={root_name}, properties=[
+        'A': schema.Class('A', bases=[root_name], properties=[
             schema.SingleProperty('one', 'string'),
             schema.OptionalProperty('two', 'int'),
             schema.RepeatedProperty('three', 'bool'),
@@ -182,7 +182,7 @@ A:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'A'}),
-        'A': schema.Class('A', bases={root_name}, properties=[
+        'A': schema.Class('A', bases=[root_name], properties=[
             schema.SingleProperty('a', 'string'),
             schema.RepeatedProperty('b', 'B'),
             schema.SingleProperty('c', 'C', is_child=True),
@@ -211,7 +211,7 @@ A:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'A'}),
-        'A': schema.Class('A', bases={root_name}, properties=[
+        'A': schema.Class('A', bases=[root_name], properties=[
             schema.RepeatedProperty('x', 'string'),
         ]),
     }
@@ -226,7 +226,7 @@ A:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'A'}),
-        'A': schema.Class('A', bases={root_name}, properties=[
+        'A': schema.Class('A', bases=[root_name], properties=[
             schema.RepeatedProperty('x', 'string', pragmas=["foo", "bar"]),
         ]),
     }
@@ -241,7 +241,7 @@ A:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'A'}),
-        'A': schema.Class('A', bases={root_name}, properties=[
+        'A': schema.Class('A', bases=[root_name], properties=[
             schema.RepeatedProperty('x', 'string', pragmas=["foo"]),
         ]),
     }
@@ -274,7 +274,7 @@ A:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'A'}),
-        'A': schema.Class('A', bases={root_name}, properties=[
+        'A': schema.Class('A', bases=[root_name], properties=[
             schema.RepeatedProperty('x', 'string'),
         ], pragmas=["foo", "bar"]),
     }
@@ -288,7 +288,7 @@ A:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'A'}),
-        'A': schema.Class('A', bases={root_name}, properties=[
+        'A': schema.Class('A', bases=[root_name], properties=[
             schema.RepeatedProperty('x', 'string'),
         ], pragmas=["foo"]),
     }
@@ -311,7 +311,7 @@ MyClass:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'MyClass'}),
-        'MyClass': schema.Class('MyClass', bases={root_name}, ipa=schema.IpaInfo(from_class="A")),
+        'MyClass': schema.Class('MyClass', bases=[root_name], ipa=schema.IpaInfo(from_class="A")),
     }
 
 
@@ -325,7 +325,7 @@ MyClass:
 """)
     assert ret.classes == {
         root_name: schema.Class(root_name, derived={'MyClass'}),
-        'MyClass': schema.Class('MyClass', bases={root_name}, ipa=schema.IpaInfo(on_arguments={"x": "A", "y": "int"})),
+        'MyClass': schema.Class('MyClass', bases=[root_name], ipa=schema.IpaInfo(on_arguments={"x": "A", "y": "int"})),
     }
 
 
diff --git a/swift/extractor/BUILD.bazel b/swift/extractor/BUILD.bazel
index bf5c9e65d52..28d89d920de 100644
--- a/swift/extractor/BUILD.bazel
+++ b/swift/extractor/BUILD.bazel
@@ -10,6 +10,7 @@ swift_cc_binary(
     deps = [
         "//swift/extractor/infra",
         "//swift/extractor/visitors",
+        "//swift/extractor/remapping",
         "//swift/tools/prebuilt:swift-llvm-support",
     ],
 )
diff --git a/swift/extractor/SwiftBuiltinSymbols.h b/swift/extractor/SwiftBuiltinSymbols.h
new file mode 100644
index 00000000000..6e912792da2
--- /dev/null
+++ b/swift/extractor/SwiftBuiltinSymbols.h
@@ -0,0 +1,71 @@
+#pragma once
+
+#include <array>
+
+namespace codeql {
+constexpr std::array swiftBuiltins = {
+    "zeroInitializer",
+    "BridgeObject",
+    "Word",
+    "NativeObject",
+    "RawPointer",
+    "Executor",
+    "Job",
+    "RawUnsafeContinuation",
+    "addressof",
+    "initialize",
+    "reinterpretCast",
+    "Int1",
+    "Int8",
+    "Int16",
+    "Int32",
+    "Int64",
+    "IntLiteral",
+    "FPIEEE16",
+    "FPIEEE32",
+    "FPIEEE64",
+    "FPIEEE80",
+    "Vec2xInt8",
+    "Vec4xInt8",
+    "Vec8xInt8",
+    "Vec16xInt8",
+    "Vec32xInt8",
+    "Vec64xInt8",
+    "Vec2xInt16",
+    "Vec4xInt16",
+    "Vec8xInt16",
+    "Vec16xInt16",
+    "Vec32xInt16",
+    "Vec64xInt16",
+    "Vec2xInt32",
+    "Vec4xInt32",
+    "Vec8xInt32",
+    "Vec16xInt32",
+    "Vec32xInt32",
+    "Vec64xInt32",
+    "Vec2xInt64",
+    "Vec4xInt64",
+    "Vec8xInt64",
+    "Vec16xInt64",
+    "Vec32xInt64",
+    "Vec64xInt64",
+    "Vec2xFPIEEE16",
+    "Vec4xFPIEEE16",
+    "Vec8xFPIEEE16",
+    "Vec16xFPIEEE16",
+    "Vec32xFPIEEE16",
+    "Vec64xFPIEEE16",
+    "Vec2xFPIEEE32",
+    "Vec4xFPIEEE32",
+    "Vec8xFPIEEE32",
+    "Vec16xFPIEEE32",
+    "Vec32xFPIEEE32",
+    "Vec64xFPIEEE32",
+    "Vec2xFPIEEE64",
+    "Vec4xFPIEEE64",
+    "Vec8xFPIEEE64",
+    "Vec16xFPIEEE64",
+    "Vec32xFPIEEE64",
+    "Vec64xFPIEEE64",
+};
+}
diff --git a/swift/extractor/SwiftExtractor.cpp b/swift/extractor/SwiftExtractor.cpp
index ecd94ee2211..4d0ec679426 100644
--- a/swift/extractor/SwiftExtractor.cpp
+++ b/swift/extractor/SwiftExtractor.cpp
@@ -6,15 +6,12 @@
 #include <queue>
 
 #include <swift/AST/SourceFile.h>
-#include <swift/Basic/FileTypes.h>
-#include <llvm/ADT/SmallString.h>
-#include <llvm/Support/FileSystem.h>
-#include <llvm/Support/Path.h>
+#include <swift/AST/Builtins.h>
 
-#include "swift/extractor/trap/generated/TrapClasses.h"
 #include "swift/extractor/trap/TrapDomain.h"
 #include "swift/extractor/visitors/SwiftVisitor.h"
 #include "swift/extractor/TargetTrapFile.h"
+#include "swift/extractor/SwiftBuiltinSymbols.h"
 
 using namespace codeql;
 using namespace std::string_literals;
@@ -65,7 +62,40 @@ static std::string getFilename(swift::ModuleDecl& module, swift::SourceFile* pri
     filename += module.getName().str();
     return filename;
   }
-  return module.getModuleFilename().str();
+  if (module.isBuiltinModule()) {
+    // The Builtin module has an empty filename, let's fix that
+    return "/__Builtin__";
+  }
+  auto filename = module.getModuleFilename().str();
+  // there is a special case of a module without an actual filename reporting `<imports>`: in this
+  // case we want to avoid the `<>` characters, in case a dirty DB is imported on Windows
+  if (filename == "<imports>") {
+    return "/__imports__";
+  }
+  return filename;
+}
+
+/* The builtin module is special, as it does not publish any top-level declaration
+ * It creates (and caches) declarations on demand when a lookup is carried out
+ * (see BuiltinUnit in swift/AST/FileUnit.h for the cache details, and getBuiltinValueDecl in
+ * swift/AST/Builtins.h for the creation details)
+ * As we want to create the Builtin trap file once and for all so that it works for other
+ * extraction runs, rather than collecting what we need we pre-populate the builtin trap with
+ * what we expect. This list might need thus to be expanded.
+ * Notice, that while swift/AST/Builtins.def has a list of builtin symbols, it does not contain
+ * all information required to instantiate builtin variants.
+ * Other possible approaches:
+ * * create one trap per builtin declaration when encountered
+ * * expand the list to all possible builtins (of which there are a lot)
+ */
+static void getBuiltinDecls(swift::ModuleDecl& builtinModule,
+                            llvm::SmallVector<swift::Decl*>& decls) {
+  llvm::SmallVector<swift::ValueDecl*> values;
+  for (auto symbol : swiftBuiltins) {
+    builtinModule.lookupValue(builtinModule.getASTContext().getIdentifier(symbol),
+                              swift::NLKind::QualifiedLookup, values);
+  }
+  decls.insert(decls.end(), values.begin(), values.end());
 }
 
 static llvm::SmallVector<swift::Decl*> getTopLevelDecls(swift::ModuleDecl& module,
@@ -74,16 +104,19 @@ static llvm::SmallVector<swift::Decl*> getTopLevelDecls(swift::ModuleDecl& modul
   ret.push_back(&module);
   if (primaryFile) {
     primaryFile->getTopLevelDecls(ret);
+  } else if (module.isBuiltinModule()) {
+    getBuiltinDecls(module, ret);
   } else {
     module.getTopLevelDecls(ret);
   }
   return ret;
 }
 
-static void extractDeclarations(const SwiftExtractorConfiguration& config,
-                                swift::CompilerInstance& compiler,
-                                swift::ModuleDecl& module,
-                                swift::SourceFile* primaryFile = nullptr) {
+static std::unordered_set<swift::ModuleDecl*> extractDeclarations(
+    const SwiftExtractorConfiguration& config,
+    swift::CompilerInstance& compiler,
+    swift::ModuleDecl& module,
+    swift::SourceFile* primaryFile = nullptr) {
   auto filename = getFilename(module, primaryFile);
 
   // The extractor can be called several times from different processes with
@@ -92,7 +125,7 @@ static void extractDeclarations(const SwiftExtractorConfiguration& config,
   auto trapTarget = createTargetTrapFile(config, filename);
   if (!trapTarget) {
     // another process arrived first, nothing to do for us
-    return;
+    return {};
   }
   TrapDomain trap{*trapTarget};
 
@@ -116,6 +149,7 @@ static void extractDeclarations(const SwiftExtractorConfiguration& config,
   for (auto& comment : comments) {
     visitor.extract(comment);
   }
+  return std::move(visitor).getEncounteredModules();
 }
 
 static std::unordered_set<std::string> collectInputFilenames(swift::CompilerInstance& compiler) {
@@ -132,40 +166,26 @@ static std::unordered_set<std::string> collectInputFilenames(swift::CompilerInst
   return sourceFiles;
 }
 
-static std::unordered_set<swift::ModuleDecl*> collectModules(swift::CompilerInstance& compiler) {
-  // getASTContext().getLoadedModules() does not provide all the modules available within the
-  // program.
-  // We need to iterate over all the imported modules (recursively) to see the whole "universe."
-  std::unordered_set<swift::ModuleDecl*> allModules;
-  std::queue<swift::ModuleDecl*> worklist;
-  for (auto& [_, module] : compiler.getASTContext().getLoadedModules()) {
-    worklist.push(module);
-    allModules.insert(module);
+static std::vector<swift::ModuleDecl*> collectLoadedModules(swift::CompilerInstance& compiler) {
+  std::vector<swift::ModuleDecl*> ret;
+  for (const auto& [id, module] : compiler.getASTContext().getLoadedModules()) {
+    std::ignore = id;
+    ret.push_back(module);
   }
-
-  while (!worklist.empty()) {
-    auto module = worklist.front();
-    worklist.pop();
-    llvm::SmallVector<swift::ImportedModule> importedModules;
-    // TODO: we may need more than just Exported ones
-    module->getImportedModules(importedModules, swift::ModuleDecl::ImportFilterKind::Exported);
-    for (auto& imported : importedModules) {
-      if (allModules.count(imported.importedModule) == 0) {
-        worklist.push(imported.importedModule);
-        allModules.insert(imported.importedModule);
-      }
-    }
-  }
-  return allModules;
+  return ret;
 }
 
 void codeql::extractSwiftFiles(const SwiftExtractorConfiguration& config,
                                swift::CompilerInstance& compiler) {
   auto inputFiles = collectInputFilenames(compiler);
-  auto modules = collectModules(compiler);
+  std::vector<swift::ModuleDecl*> todo = collectLoadedModules(compiler);
+  std::unordered_set<swift::ModuleDecl*> seen{todo.begin(), todo.end()};
 
-  for (auto& module : modules) {
+  while (!todo.empty()) {
+    auto module = todo.back();
+    todo.pop_back();
     bool isFromSourceFile = false;
+    std::unordered_set<swift::ModuleDecl*> encounteredModules;
     for (auto file : module->getFiles()) {
       auto sourceFile = llvm::dyn_cast<swift::SourceFile>(file);
       if (!sourceFile) {
@@ -176,10 +196,16 @@ void codeql::extractSwiftFiles(const SwiftExtractorConfiguration& config,
         continue;
       }
       archiveFile(config, *sourceFile);
-      extractDeclarations(config, compiler, *module, sourceFile);
+      encounteredModules = extractDeclarations(config, compiler, *module, sourceFile);
     }
     if (!isFromSourceFile) {
-      extractDeclarations(config, compiler, *module);
+      encounteredModules = extractDeclarations(config, compiler, *module);
+    }
+    for (auto encountered : encounteredModules) {
+      if (seen.count(encountered) == 0) {
+        todo.push_back(encountered);
+        seen.insert(encountered);
+      }
     }
   }
 }
diff --git a/swift/extractor/SwiftOutputRewrite.cpp b/swift/extractor/SwiftOutputRewrite.cpp
deleted file mode 100644
index b09a558d187..00000000000
--- a/swift/extractor/SwiftOutputRewrite.cpp
+++ /dev/null
@@ -1,341 +0,0 @@
-#include "SwiftOutputRewrite.h"
-#include "swift/extractor/SwiftExtractorConfiguration.h"
-#include "swift/extractor/TargetTrapFile.h"
-
-#include <llvm/ADT/SmallString.h>
-#include <llvm/Support/FileSystem.h>
-#include <llvm/Support/Path.h>
-#include <swift/Basic/OutputFileMap.h>
-#include <swift/Basic/Platform.h>
-#include <unistd.h>
-#include <unordered_set>
-#include <optional>
-#include <iostream>
-
-// Creates a copy of the output file map and updates remapping table in place
-// It does not change the original map file as it is depended upon by the original compiler
-// Returns path to the newly created output file map on success, or None in a case of failure
-static std::optional<std::string> rewriteOutputFileMap(
-    const codeql::SwiftExtractorConfiguration& config,
-    const std::string& outputFileMapPath,
-    const std::vector<std::string>& inputs,
-    std::unordered_map<std::string, std::string>& remapping) {
-  auto newMapPath = config.getTempArtifactDir() + '/' + outputFileMapPath;
-
-  // TODO: do not assume absolute path for the second parameter
-  auto outputMapOrError = swift::OutputFileMap::loadFromPath(outputFileMapPath, "");
-  if (!outputMapOrError) {
-    std::cerr << "Cannot load output map: '" << outputFileMapPath << "'\n";
-    return std::nullopt;
-  }
-  auto oldOutputMap = outputMapOrError.get();
-  swift::OutputFileMap newOutputMap;
-  std::vector<llvm::StringRef> keys;
-  for (auto& key : inputs) {
-    auto oldMap = oldOutputMap.getOutputMapForInput(key);
-    if (!oldMap) {
-      continue;
-    }
-    keys.push_back(key);
-    auto& newMap = newOutputMap.getOrCreateOutputMapForInput(key);
-    newMap.copyFrom(*oldMap);
-    for (auto& entry : newMap) {
-      auto oldPath = entry.getSecond();
-      auto newPath = config.getTempArtifactDir() + '/' + oldPath;
-      entry.getSecond() = newPath;
-      remapping[oldPath] = newPath;
-    }
-  }
-  std::error_code ec;
-  llvm::SmallString<PATH_MAX> filepath(newMapPath);
-  llvm::StringRef parent = llvm::sys::path::parent_path(filepath);
-  if (std::error_code ec = llvm::sys::fs::create_directories(parent)) {
-    std::cerr << "Cannot create relocated output map dir: '" << parent.str()
-              << "': " << ec.message() << "\n";
-    return std::nullopt;
-  }
-
-  llvm::raw_fd_ostream fd(newMapPath, ec, llvm::sys::fs::OF_None);
-  newOutputMap.write(fd, keys);
-  return newMapPath;
-}
-
-// This is an Xcode-specific workaround to produce alias names for an existing .swiftmodule file.
-// In the case of Xcode, it calls the Swift compiler and asks it to produce a Swift module.
-// Once it's done, Xcode moves the .swiftmodule file in another location, and the location is
-// rather arbitrary. Here are examples of such locations:
-// Original file produced by the frontend:
-//  DerivedData/<Project>/Build/Intermediates.noindex/<Project>.build/<BuiltType>-<Target>/<Project>.build/Objects-normal/<Arch>/<ModuleName>.swiftmodule
-// where:
-//  Project: name of a project, target, or scheme
-//  BuildType: Debug, Release, etc.
-//  Target: macOS, iphoneos, appletvsimulator, etc.
-//  Arch: arm64, x86_64, etc.
-//
-// So far we observed that Xcode can move the module into different locations, and it's not
-// entirely clear how to deduce the destination from the context available for the extractor.
-// 1. First case:
-//  DerivedData/<Project>/Build/Products/<BuiltType>-<Target>/<ModuleName>.swiftmodule/<Arch>.swiftmodule
-//  DerivedData/<Project>/Build/Products/<BuiltType>-<Target>/<ModuleName>.swiftmodule/<Triple>.swiftmodule
-// 2. Second case:
-//  DerivedData/<Project>/Build/Products/<BuiltType>-<Target>/<ModuleName>/<ModuleName>.swiftmodule/<Arch>.swiftmodule
-//  DerivedData/<Project>/Build/Products/<BuiltType>-<Target>/<ModuleName>/<ModuleName>.swiftmodule/<Triple>.swiftmodule
-// 2. Third case:
-//  DerivedData/<Project>/Build/Products/<BuiltType>-<Target>/<ModuleName>/<ModuleName>.framework/Modules/<ModuleName>.swiftmodule/<Arch>.swiftmodule
-//  DerivedData/<Project>/Build/Products/<BuiltType>-<Target>/<ModuleName>/<ModuleName>.framework/Modules/<ModuleName>.swiftmodule/<Triple>.swiftmodule
-// The <Triple> here is a normalized target triple (e.g. arm64-apple-iphoneos15.4 ->
-// arm64-apple-iphoneos).
-//
-// This method constructs those aliases for a module only if it comes from Xcode, which is detected
-// by the presence of an `Intermediates.noindex` directory in the module path.
-//
-// In the case of the Swift Package Manager (`swift build`) this is not needed.
-static std::vector<std::string> computeModuleAliases(llvm::StringRef modulePath,
-                                                     const std::string& targetTriple) {
-  if (modulePath.empty()) {
-    return {};
-  }
-  if (!modulePath.endswith(".swiftmodule")) {
-    return {};
-  }
-  // Deconstructing the Xcode generated path
-  //
-  // clang-format off
-  //                          intermediatesDirIndex               destinationDir (2)                              arch(5)
-  // DerivedData/FooBar/Build/Intermediates.noindex/FooBar.build/Debug-iphonesimulator/FooBar.build/Objects-normal/x86_64/FooBar.swiftmodule
-  // clang-format on
-  llvm::SmallVector<llvm::StringRef> chunks;
-  modulePath.split(chunks, '/');
-  size_t intermediatesDirIndex = 0;
-  for (size_t i = 0; i < chunks.size(); i++) {
-    if (chunks[i] == "Intermediates.noindex") {
-      intermediatesDirIndex = i;
-      break;
-    }
-  }
-  // Not built by Xcode, skipping
-  if (intermediatesDirIndex == 0) {
-    return {};
-  }
-  size_t destinationDirIndex = intermediatesDirIndex + 2;
-  size_t archIndex = intermediatesDirIndex + 5;
-  if (archIndex >= chunks.size()) {
-    return {};
-  }
-  // e.g. Debug-iphoneos, Release-iphonesimulator, etc.
-  auto destinationDir = chunks[destinationDirIndex].str();
-  auto arch = chunks[archIndex].str();
-  auto moduleNameWithExt = chunks.back();
-  auto moduleName = moduleNameWithExt.substr(0, moduleNameWithExt.find_last_of('.'));
-  std::string relocatedModulePath = chunks[0].str();
-  for (size_t i = 1; i < intermediatesDirIndex; i++) {
-    relocatedModulePath += '/' + chunks[i].str();
-  }
-  relocatedModulePath += "/Products/";
-  relocatedModulePath += destinationDir + '/';
-
-  // clang-format off
-  std::vector<std::string> moduleLocations = {
-    // First case
-    relocatedModulePath + moduleNameWithExt.str() + '/',
-    // Second case
-    relocatedModulePath + moduleName.str() + '/' + moduleNameWithExt.str() + '/',
-    // Third case
-    relocatedModulePath + moduleName.str() + '/' + moduleName.str() + ".framework/Modules/" + moduleNameWithExt.str() + '/',
-  };
-  // clang-format on
-
-  std::vector<std::string> archs({arch});
-  if (!targetTriple.empty()) {
-    llvm::Triple triple(targetTriple);
-    archs.push_back(swift::getTargetSpecificModuleTriple(triple).normalize());
-  }
-
-  std::vector<std::string> aliases;
-  for (auto& location : moduleLocations) {
-    for (auto& a : archs) {
-      aliases.push_back(location + a + ".swiftmodule");
-    }
-  }
-
-  return aliases;
-}
-
-namespace codeql {
-
-std::unordered_map<std::string, std::string> rewriteOutputsInPlace(
-    const SwiftExtractorConfiguration& config,
-    std::vector<std::string>& CLIArgs) {
-  std::unordered_map<std::string, std::string> remapping;
-
-  // TODO: handle filelists?
-  const std::unordered_set<std::string> pathRewriteOptions({
-      "-emit-dependencies-path",
-      "-emit-module-path",
-      "-emit-module-doc-path",
-      "-emit-module-source-info-path",
-      "-emit-objc-header-path",
-      "-emit-reference-dependencies-path",
-      "-index-store-path",
-      "-module-cache-path",
-      "-o",
-      "-pch-output-dir",
-      "-serialize-diagnostics-path",
-  });
-
-  std::unordered_set<std::string> outputFileMaps(
-      {"-supplementary-output-file-map", "-output-file-map"});
-
-  std::vector<size_t> outputFileMapIndexes;
-  std::vector<std::string> maybeInput;
-  std::string targetTriple;
-
-  std::vector<std::string> newLocations;
-  for (size_t i = 0; i < CLIArgs.size(); i++) {
-    if (pathRewriteOptions.count(CLIArgs[i])) {
-      auto oldPath = CLIArgs[i + 1];
-      auto newPath = config.getTempArtifactDir() + '/' + oldPath;
-      CLIArgs[++i] = newPath;
-      newLocations.push_back(newPath);
-
-      remapping[oldPath] = newPath;
-    } else if (outputFileMaps.count(CLIArgs[i])) {
-      // collect output map indexes for further rewriting and skip the following argument
-      // We don't patch the map in place as we need to collect all the input files first
-      outputFileMapIndexes.push_back(++i);
-    } else if (CLIArgs[i] == "-target") {
-      targetTriple = CLIArgs[++i];
-    } else if (CLIArgs[i][0] != '-') {
-      // TODO: add support for input file lists?
-      // We need to collect input file names to later use them to extract information from the
-      // output file maps.
-      maybeInput.push_back(CLIArgs[i]);
-    }
-  }
-
-  for (auto index : outputFileMapIndexes) {
-    auto oldPath = CLIArgs[index];
-    auto maybeNewPath = rewriteOutputFileMap(config, oldPath, maybeInput, remapping);
-    if (maybeNewPath) {
-      auto newPath = maybeNewPath.value();
-      CLIArgs[index] = newPath;
-      remapping[oldPath] = newPath;
-    }
-  }
-
-  // This doesn't really belong here, but we've got Xcode...
-  for (const auto& [oldPath, newPath] : remapping) {
-    llvm::StringRef path(oldPath);
-    auto aliases = computeModuleAliases(path, targetTriple);
-    for (auto& alias : aliases) {
-      remapping[alias] = newPath;
-    }
-  }
-
-  return remapping;
-}
-
-void ensureDirectoriesForNewPathsExist(
-    const std::unordered_map<std::string, std::string>& remapping) {
-  for (auto& [_, newPath] : remapping) {
-    llvm::SmallString<PATH_MAX> filepath(newPath);
-    llvm::StringRef parent = llvm::sys::path::parent_path(filepath);
-    if (std::error_code ec = llvm::sys::fs::create_directories(parent)) {
-      std::cerr << "Cannot create redirected directory: " << ec.message() << "\n";
-    }
-  }
-}
-
-void storeRemappingForVFS(const SwiftExtractorConfiguration& config,
-                          const std::unordered_map<std::string, std::string>& remapping) {
-  // Only create remapping for the .swiftmodule files
-  std::unordered_map<std::string, std::string> modules;
-  for (const auto& [oldPath, newPath] : remapping) {
-    if (llvm::StringRef(oldPath).endswith(".swiftmodule")) {
-      modules.emplace(oldPath, newPath);
-    }
-  }
-
-  if (modules.empty()) {
-    return;
-  }
-
-  if (std::error_code ec = llvm::sys::fs::create_directories(config.getTempVFSDir())) {
-    std::cerr << "Cannot create temp VFS directory: " << ec.message() << "\n";
-    return;
-  }
-
-  if (std::error_code ec = llvm::sys::fs::create_directories(config.getVFSDir())) {
-    std::cerr << "Cannot create VFS directory: " << ec.message() << "\n";
-    return;
-  }
-
-  // Constructing the VFS yaml file in a temp folder so that the other process doesn't read it
-  // while it is not complete
-  // TODO: Pick a more robust way to not collide with files from other processes
-  auto tempVfsPath = config.getTempVFSDir() + '/' + std::to_string(getpid()) + "-vfs.yaml";
-  std::error_code ec;
-  llvm::raw_fd_ostream fd(tempVfsPath, ec, llvm::sys::fs::OF_None);
-  if (ec) {
-    std::cerr << "Cannot create temp VFS file: '" << tempVfsPath << "': " << ec.message() << "\n";
-    return;
-  }
-  // TODO: there must be a better API than this
-  // LLVM expects the version to be 0
-  fd << "{ version: 0,\n";
-  // This tells the FS not to fallback to the physical file system in case the remapped file is not
-  // present
-  fd << "  fallthrough: false,\n";
-  fd << "  roots: [\n";
-  for (auto& [oldPath, newPath] : modules) {
-    fd << "  {\n";
-    fd << "    type: 'file',\n";
-    fd << "    name: '" << oldPath << "\',\n";
-    fd << "    external-contents: '" << newPath << "\'\n";
-    fd << "  },\n";
-  }
-  fd << "  ]\n";
-  fd << "}\n";
-
-  fd.flush();
-  auto vfsPath = config.getVFSDir() + '/' + std::to_string(getpid()) + "-vfs.yaml";
-  if (std::error_code ec = llvm::sys::fs::rename(tempVfsPath, vfsPath)) {
-    std::cerr << "Cannot move temp VFS file '" << tempVfsPath << "' -> '" << vfsPath
-              << "': " << ec.message() << "\n";
-    return;
-  }
-}
-
-std::vector<std::string> collectVFSFiles(const SwiftExtractorConfiguration& config) {
-  auto vfsDir = config.getVFSDir() + '/';
-  if (!llvm::sys::fs::exists(vfsDir)) {
-    return {};
-  }
-  std::vector<std::string> overlays;
-  std::error_code ec;
-  llvm::sys::fs::directory_iterator it(vfsDir, ec);
-  while (!ec && it != llvm::sys::fs::directory_iterator()) {
-    llvm::StringRef path(it->path());
-    if (path.endswith("vfs.yaml")) {
-      overlays.push_back(path.str());
-    }
-    it.increment(ec);
-  }
-
-  return overlays;
-}
-
-void lockOutputSwiftModuleTraps(const SwiftExtractorConfiguration& config,
-                                const std::unordered_map<std::string, std::string>& remapping) {
-  for (const auto& [oldPath, newPath] : remapping) {
-    if (llvm::StringRef(oldPath).endswith(".swiftmodule")) {
-      if (auto target = createTargetTrapFile(config, oldPath)) {
-        *target << "// trap file deliberately empty\n"
-                   "// this swiftmodule was created during the build, so its entities must have"
-                   " been extracted directly from source files";
-      }
-    }
-  }
-}
-
-}  // namespace codeql
diff --git a/swift/extractor/SwiftOutputRewrite.h b/swift/extractor/SwiftOutputRewrite.h
deleted file mode 100644
index 94f1eeb6aaa..00000000000
--- a/swift/extractor/SwiftOutputRewrite.h
+++ /dev/null
@@ -1,35 +0,0 @@
-#pragma once
-
-#include <vector>
-#include <string>
-#include <unordered_map>
-
-namespace codeql {
-
-struct SwiftExtractorConfiguration;
-
-// Rewrites all the output CLI args to point to a scratch dir instead of the actual locations.
-// This is needed to ensure that the artifacts produced by the extractor do not collide with the
-// artifacts produced by the actual Swift compiler.
-// Returns the map containing remapping oldpath -> newPath.
-std::unordered_map<std::string, std::string> rewriteOutputsInPlace(
-    const SwiftExtractorConfiguration& config,
-    std::vector<std::string>& CLIArgs);
-
-// Create directories for all the redirected new paths as the Swift compiler expects them to exist.
-void ensureDirectoriesForNewPathsExist(
-    const std::unordered_map<std::string, std::string>& remapping);
-
-// Stores remapped `.swiftmoduile`s in a YAML file for later consumption by the
-// llvm::RedirectingFileSystem via Swift's VFSOverlayFiles.
-void storeRemappingForVFS(const SwiftExtractorConfiguration& config,
-                          const std::unordered_map<std::string, std::string>& remapping);
-
-// Returns a list of VFS YAML files produced by all the extractor processes.
-// This is separate from storeRemappingForVFS as we also collect files produced by other processes.
-std::vector<std::string> collectVFSFiles(const SwiftExtractorConfiguration& config);
-
-// Creates empty trap files for output swiftmodule files
-void lockOutputSwiftModuleTraps(const SwiftExtractorConfiguration& config,
-                                const std::unordered_map<std::string, std::string>& remapping);
-}  // namespace codeql
diff --git a/swift/extractor/infra/SwiftDispatcher.h b/swift/extractor/infra/SwiftDispatcher.h
index 44424d6f89e..94edd44df44 100644
--- a/swift/extractor/infra/SwiftDispatcher.h
+++ b/swift/extractor/infra/SwiftDispatcher.h
@@ -29,7 +29,6 @@ class SwiftDispatcher {
                                const swift::Pattern*,
                                const swift::TypeRepr*,
                                const swift::TypeBase*,
-                               const swift::IfConfigClause*,
                                FilePath>;
 
   template <typename E>
@@ -55,6 +54,10 @@ class SwiftDispatcher {
     }
   }
 
+  const std::unordered_set<swift::ModuleDecl*> getEncounteredModules() && {
+    return std::move(encounteredModules);
+  }
+
   template <typename Entry>
   void emit(const Entry& entry) {
     trap.emit(entry);
@@ -228,8 +231,16 @@ class SwiftDispatcher {
   //  - extracting a primary source file: in this mode, we extract several files belonging to the
   //    same module one by one. In this mode, we restrict emission only to the same file ignoring
   //    all the other files.
+  // This is also used to register the modules we encounter.
+  // TODO calls to this function should be taken away from `DeclVisitor` and moved around with a
+  // clearer separation between naming entities (some decls, all types), deciding whether to emit
+  // them and finally visiting emitting the contents of the entity (which should remain in the
+  // visitors). Then this double responsibility (carrying out the test and registering encountered
+  // modules) should also be cleared out
   bool shouldEmitDeclBody(const swift::Decl& decl) {
-    if (decl.getModuleContext() != &currentModule) {
+    auto module = decl.getModuleContext();
+    if (module != &currentModule) {
+      encounteredModules.insert(module);
       return false;
     }
     // ModuleDecl is a special case: if it passed the previous test, it is the current module
@@ -311,7 +322,6 @@ class SwiftDispatcher {
   // as we don't expect `nullptr` here. However `swift::ASTVisitor` and `swift::TypeVisitor` do not
   // accept const pointers
   virtual void visit(swift::Decl* decl) = 0;
-  virtual void visit(const swift::IfConfigClause* clause) = 0;
   virtual void visit(swift::Stmt* stmt) = 0;
   virtual void visit(const swift::StmtCondition* cond) = 0;
   virtual void visit(const swift::StmtConditionElement* cond) = 0;
@@ -333,6 +343,7 @@ class SwiftDispatcher {
   Store::Handle waitingForNewLabel{std::monostate{}};
   swift::ModuleDecl& currentModule;
   swift::SourceFile* currentPrimarySourceFile;
+  std::unordered_set<swift::ModuleDecl*> encounteredModules;
 };
 
 }  // namespace codeql
diff --git a/swift/extractor/infra/SwiftTagTraits.h b/swift/extractor/infra/SwiftTagTraits.h
index 05cf8556141..ce8a0ed2c05 100644
--- a/swift/extractor/infra/SwiftTagTraits.h
+++ b/swift/extractor/infra/SwiftTagTraits.h
@@ -49,7 +49,6 @@ MAP_TAG(Argument);
 #include <swift/AST/ExprNodes.def>
 
 MAP_TAG(Decl);
-MAP_TAG(IfConfigClause);
 #define ABSTRACT_DECL(CLASS, PARENT) MAP_SUBTAG(CLASS##Decl, PARENT)
 #define DECL(CLASS, PARENT) ABSTRACT_DECL(CLASS, PARENT)
 #include <swift/AST/DeclNodes.def>
diff --git a/swift/extractor/main.cpp b/swift/extractor/main.cpp
index 5f9afef4e81..d526a4104a1 100644
--- a/swift/extractor/main.cpp
+++ b/swift/extractor/main.cpp
@@ -9,8 +9,10 @@
 #include <swift/Basic/LLVMInitialize.h>
 #include <swift/FrontendTool/FrontendTool.h>
 
-#include "SwiftExtractor.h"
-#include "SwiftOutputRewrite.h"
+#include "swift/extractor/SwiftExtractor.h"
+#include "swift/extractor/TargetTrapFile.h"
+#include "swift/extractor/remapping/SwiftOutputRewrite.h"
+#include "swift/extractor/remapping/SwiftOpenInterception.h"
 
 using namespace std::string_literals;
 
@@ -21,14 +23,6 @@ class Observer : public swift::FrontendObserver {
  public:
   explicit Observer(const codeql::SwiftExtractorConfiguration& config) : config{config} {}
 
-  void parsedArgs(swift::CompilerInvocation& invocation) override {
-    auto& overlays = invocation.getSearchPathOptions().VFSOverlayFiles;
-    auto vfsFiles = codeql::collectVFSFiles(config);
-    for (auto& vfsFile : vfsFiles) {
-      overlays.push_back(vfsFile);
-    }
-  }
-
   void performedSemanticAnalysis(swift::CompilerInstance& compiler) override {
     codeql::extractSwiftFiles(config, compiler);
   }
@@ -44,11 +38,26 @@ static std::string getenv_or(const char* envvar, const std::string& def) {
   return def;
 }
 
+static void lockOutputSwiftModuleTraps(
+    const codeql::SwiftExtractorConfiguration& config,
+    const std::unordered_map<std::string, std::string>& remapping) {
+  for (const auto& [oldPath, newPath] : remapping) {
+    if (llvm::StringRef(oldPath).endswith(".swiftmodule")) {
+      if (auto target = codeql::createTargetTrapFile(config, oldPath)) {
+        *target << "// trap file deliberately empty\n"
+                   "// this swiftmodule was created during the build, so its entities must have"
+                   " been extracted directly from source files";
+      }
+    }
+  }
+}
+
 int main(int argc, char** argv) {
   if (argc == 1) {
     // TODO: print usage
     return 1;
   }
+
   // Required by Swift/LLVM
   PROGRAM_START(argc, argv);
   INITIALIZE_LLVM();
@@ -58,17 +67,18 @@ int main(int argc, char** argv) {
   configuration.sourceArchiveDir = getenv_or("CODEQL_EXTRACTOR_SWIFT_SOURCE_ARCHIVE_DIR", ".");
   configuration.scratchDir = getenv_or("CODEQL_EXTRACTOR_SWIFT_SCRATCH_DIR", ".");
 
+  codeql::initRemapping(configuration.getTempArtifactDir());
+
   configuration.frontendOptions.reserve(argc - 1);
   for (int i = 1; i < argc; i++) {
     configuration.frontendOptions.push_back(argv[i]);
   }
   configuration.patchedFrontendOptions = configuration.frontendOptions;
 
-  auto remapping =
-      codeql::rewriteOutputsInPlace(configuration, configuration.patchedFrontendOptions);
+  auto remapping = codeql::rewriteOutputsInPlace(configuration.getTempArtifactDir(),
+                                                 configuration.patchedFrontendOptions);
   codeql::ensureDirectoriesForNewPathsExist(remapping);
-  codeql::storeRemappingForVFS(configuration, remapping);
-  codeql::lockOutputSwiftModuleTraps(configuration, remapping);
+  lockOutputSwiftModuleTraps(configuration, remapping);
 
   std::vector<const char*> args;
   for (auto& arg : configuration.patchedFrontendOptions) {
@@ -77,5 +87,8 @@ int main(int argc, char** argv) {
 
   Observer observer(configuration);
   int frontend_rc = swift::performFrontend(args, "swift-extractor", (void*)main, &observer);
+
+  codeql::finalizeRemapping(remapping);
+
   return frontend_rc;
 }
diff --git a/swift/extractor/remapping/BUILD.bazel b/swift/extractor/remapping/BUILD.bazel
new file mode 100644
index 00000000000..87c8a5e79f0
--- /dev/null
+++ b/swift/extractor/remapping/BUILD.bazel
@@ -0,0 +1,23 @@
+load("//swift:rules.bzl", "swift_cc_library")
+
+swift_cc_library(
+    name = "remapping",
+    srcs = ['SwiftOutputRewrite.cpp'] + select({
+        "@platforms//os:linux": [
+            "SwiftOpenInterception.Linux.cpp",
+        ],
+        "@platforms//os:macos": [
+            "SwiftOpenInterception.macOS.cpp",
+        ],
+    }),
+    hdrs = glob(["*.h"]),
+    visibility = ["//swift:__subpackages__"],
+    deps = [
+        "//swift/tools/prebuilt:swift-llvm-support",
+    ] + select({
+        "@platforms//os:linux": [],
+        "@platforms//os:macos": [
+            "@fishhook//:fishhook",
+        ],
+    }),
+)
diff --git a/swift/extractor/remapping/SwiftOpenInterception.Linux.cpp b/swift/extractor/remapping/SwiftOpenInterception.Linux.cpp
new file mode 100644
index 00000000000..5afe28efe36
--- /dev/null
+++ b/swift/extractor/remapping/SwiftOpenInterception.Linux.cpp
@@ -0,0 +1,8 @@
+#include "swift/extractor/remapping/SwiftOpenInterception.h"
+
+namespace codeql {
+// TBD
+void initRemapping(const std::string& dir) {}
+void finalizeRemapping(const std::unordered_map<std::string, std::string>& mapping) {}
+
+}  // namespace codeql
diff --git a/swift/extractor/remapping/SwiftOpenInterception.h b/swift/extractor/remapping/SwiftOpenInterception.h
new file mode 100644
index 00000000000..1b22d31ca39
--- /dev/null
+++ b/swift/extractor/remapping/SwiftOpenInterception.h
@@ -0,0 +1,11 @@
+#pragma once
+
+#include <string>
+#include <unordered_map>
+
+namespace codeql {
+
+void initRemapping(const std::string& dir);
+void finalizeRemapping(const std::unordered_map<std::string, std::string>& mapping);
+
+}  // namespace codeql
diff --git a/swift/extractor/remapping/SwiftOpenInterception.macOS.cpp b/swift/extractor/remapping/SwiftOpenInterception.macOS.cpp
new file mode 100644
index 00000000000..a0f306aa4f3
--- /dev/null
+++ b/swift/extractor/remapping/SwiftOpenInterception.macOS.cpp
@@ -0,0 +1,82 @@
+#include "swift/extractor/remapping/SwiftOpenInterception.h"
+#include <fishhook.h>
+#include <llvm/Support/raw_ostream.h>
+#include <llvm/Support/FileSystem.h>
+#include <llvm/Support/Path.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+namespace codeql {
+
+static std::string scratchDir;
+static bool interceptionEnabled = false;
+
+static int (*original_open)(const char*, int, ...) = nullptr;
+
+static std::string fileHash(const std::string& filename) {
+  int fd = original_open(filename.c_str(), O_RDONLY);
+  if (fd == -1) {
+    return {};
+  }
+  auto maybeMD5 = llvm::sys::fs::md5_contents(fd);
+  close(fd);
+  if (!maybeMD5) {
+    return {};
+  }
+  return maybeMD5->digest().str().str();
+}
+
+static int codeql_open(const char* path, int oflag, ...) {
+  va_list ap = {0};
+  mode_t mode = 0;
+  if ((oflag & O_CREAT) != 0) {
+    // mode only applies to O_CREAT
+    va_start(ap, oflag);
+    mode = va_arg(ap, int);
+    va_end(ap);
+  }
+
+  std::string newPath(path);
+
+  if (interceptionEnabled && llvm::sys::fs::exists(newPath)) {
+    // TODO: check file magic instead
+    if (llvm::StringRef(newPath).endswith(".swiftmodule")) {
+      auto hash = fileHash(newPath);
+      auto hashed = scratchDir + "/" + hash;
+      if (!hash.empty() && llvm::sys::fs::exists(hashed)) {
+        newPath = hashed;
+      }
+    }
+  }
+
+  return original_open(newPath.c_str(), oflag, mode);
+}
+
+void finalizeRemapping(const std::unordered_map<std::string, std::string>& mapping) {
+  for (auto& [original, patched] : mapping) {
+    // TODO: Check file magic instead
+    if (!llvm::StringRef(original).endswith(".swiftmodule")) {
+      continue;
+    }
+    auto hash = fileHash(original);
+    auto hashed = scratchDir + "/" + hash;
+    if (!hash.empty() && llvm::sys::fs::exists(patched)) {
+      if (std::error_code ec = llvm::sys::fs::create_link(/* from */ patched, /* to */ hashed)) {
+        llvm::errs() << "Cannot remap file '" << patched << "' -> '" << hashed
+                     << "': " << ec.message() << "\n";
+      }
+    }
+  }
+  interceptionEnabled = false;
+}
+
+void initRemapping(const std::string& dir) {
+  scratchDir = dir;
+
+  struct rebinding binding[] = {
+      {"open", reinterpret_cast<void*>(codeql_open), reinterpret_cast<void**>(&original_open)}};
+  rebind_symbols(binding, 1);
+  interceptionEnabled = true;
+}
+
+}  // namespace codeql
diff --git a/swift/extractor/remapping/SwiftOutputRewrite.cpp b/swift/extractor/remapping/SwiftOutputRewrite.cpp
new file mode 100644
index 00000000000..5603f93f770
--- /dev/null
+++ b/swift/extractor/remapping/SwiftOutputRewrite.cpp
@@ -0,0 +1,137 @@
+#include "swift/extractor/remapping/SwiftOutputRewrite.h"
+
+#include <llvm/ADT/SmallString.h>
+#include <llvm/Support/FileSystem.h>
+#include <llvm/Support/Path.h>
+#include <swift/Basic/OutputFileMap.h>
+#include <swift/Basic/Platform.h>
+#include <unistd.h>
+#include <unordered_set>
+#include <optional>
+#include <iostream>
+
+// Creates a copy of the output file map and updates remapping table in place
+// It does not change the original map file as it is depended upon by the original compiler
+// Returns path to the newly created output file map on success, or None in a case of failure
+static std::optional<std::string> rewriteOutputFileMap(
+    const std::string& scratchDir,
+    const std::string& outputFileMapPath,
+    const std::vector<std::string>& inputs,
+    std::unordered_map<std::string, std::string>& remapping) {
+  auto newMapPath = scratchDir + '/' + outputFileMapPath;
+
+  // TODO: do not assume absolute path for the second parameter
+  auto outputMapOrError = swift::OutputFileMap::loadFromPath(outputFileMapPath, "");
+  if (!outputMapOrError) {
+    std::cerr << "Cannot load output map: '" << outputFileMapPath << "'\n";
+    return std::nullopt;
+  }
+  auto oldOutputMap = outputMapOrError.get();
+  swift::OutputFileMap newOutputMap;
+  std::vector<llvm::StringRef> keys;
+  for (auto& key : inputs) {
+    auto oldMap = oldOutputMap.getOutputMapForInput(key);
+    if (!oldMap) {
+      continue;
+    }
+    keys.push_back(key);
+    auto& newMap = newOutputMap.getOrCreateOutputMapForInput(key);
+    newMap.copyFrom(*oldMap);
+    for (auto& entry : newMap) {
+      auto oldPath = entry.getSecond();
+      auto newPath = scratchDir + '/' + oldPath;
+      entry.getSecond() = newPath;
+      remapping[oldPath] = newPath;
+    }
+  }
+  std::error_code ec;
+  llvm::SmallString<PATH_MAX> filepath(newMapPath);
+  llvm::StringRef parent = llvm::sys::path::parent_path(filepath);
+  if (std::error_code ec = llvm::sys::fs::create_directories(parent)) {
+    std::cerr << "Cannot create relocated output map dir: '" << parent.str()
+              << "': " << ec.message() << "\n";
+    return std::nullopt;
+  }
+
+  llvm::raw_fd_ostream fd(newMapPath, ec, llvm::sys::fs::OF_None);
+  newOutputMap.write(fd, keys);
+  return newMapPath;
+}
+
+namespace codeql {
+
+std::unordered_map<std::string, std::string> rewriteOutputsInPlace(
+    const std::string& scratchDir,
+    std::vector<std::string>& CLIArgs) {
+  std::unordered_map<std::string, std::string> remapping;
+
+  // TODO: handle filelists?
+  const std::unordered_set<std::string> pathRewriteOptions({
+      "-emit-dependencies-path",
+      "-emit-module-path",
+      "-emit-module-doc-path",
+      "-emit-module-source-info-path",
+      "-emit-objc-header-path",
+      "-emit-reference-dependencies-path",
+      "-index-store-path",
+      "-module-cache-path",
+      "-o",
+      "-pch-output-dir",
+      "-serialize-diagnostics-path",
+  });
+
+  std::unordered_set<std::string> outputFileMaps(
+      {"-supplementary-output-file-map", "-output-file-map"});
+
+  std::vector<size_t> outputFileMapIndexes;
+  std::vector<std::string> maybeInput;
+  std::string targetTriple;
+
+  std::vector<std::string> newLocations;
+  for (size_t i = 0; i < CLIArgs.size(); i++) {
+    if (pathRewriteOptions.count(CLIArgs[i])) {
+      auto oldPath = CLIArgs[i + 1];
+      auto newPath = scratchDir + '/' + oldPath;
+      CLIArgs[++i] = newPath;
+      newLocations.push_back(newPath);
+
+      remapping[oldPath] = newPath;
+    } else if (outputFileMaps.count(CLIArgs[i])) {
+      // collect output map indexes for further rewriting and skip the following argument
+      // We don't patch the map in place as we need to collect all the input files first
+      outputFileMapIndexes.push_back(++i);
+    } else if (CLIArgs[i] == "-target") {
+      targetTriple = CLIArgs[++i];
+    } else if (CLIArgs[i][0] != '-') {
+      // TODO: add support for input file lists?
+      // We need to collect input file names to later use them to extract information from the
+      // output file maps.
+      maybeInput.push_back(CLIArgs[i]);
+    }
+  }
+
+  for (auto index : outputFileMapIndexes) {
+    auto oldPath = CLIArgs[index];
+    auto maybeNewPath = rewriteOutputFileMap(scratchDir, oldPath, maybeInput, remapping);
+    if (maybeNewPath) {
+      auto newPath = maybeNewPath.value();
+      CLIArgs[index] = newPath;
+      remapping[oldPath] = newPath;
+    }
+  }
+
+  return remapping;
+}
+
+void ensureDirectoriesForNewPathsExist(
+    const std::unordered_map<std::string, std::string>& remapping) {
+  for (auto& [_, newPath] : remapping) {
+    llvm::SmallString<PATH_MAX> filepath(newPath);
+    llvm::StringRef parent = llvm::sys::path::parent_path(filepath);
+    if (std::error_code ec = llvm::sys::fs::create_directories(parent)) {
+      std::cerr << "Cannot create redirected directory: " << ec.message() << "\n";
+    }
+  }
+}
+
+}  // namespace codeql
diff --git a/swift/extractor/remapping/SwiftOutputRewrite.h b/swift/extractor/remapping/SwiftOutputRewrite.h
new file mode 100644
index 00000000000..6729865b136
--- /dev/null
+++ b/swift/extractor/remapping/SwiftOutputRewrite.h
@@ -0,0 +1,21 @@
+#pragma once
+
+#include <vector>
+#include <string>
+#include <unordered_map>
+
+namespace codeql {
+
+// Rewrites all the output CLI args to point to a scratch dir instead of the actual locations.
+// This is needed to ensure that the artifacts produced by the extractor do not collide with the
+// artifacts produced by the actual Swift compiler.
+// Returns the map containing remapping oldpath -> newPath.
+std::unordered_map<std::string, std::string> rewriteOutputsInPlace(
+    const std::string& scratchDir,
+    std::vector<std::string>& CLIArgs);
+
+// Create directories for all the redirected new paths as the Swift compiler expects them to exist.
+void ensureDirectoriesForNewPathsExist(
+    const std::unordered_map<std::string, std::string>& remapping);
+
+}  // namespace codeql
diff --git a/swift/extractor/visitors/DeclVisitor.cpp b/swift/extractor/visitors/DeclVisitor.cpp
index 1f188406987..92c551b3909 100644
--- a/swift/extractor/visitors/DeclVisitor.cpp
+++ b/swift/extractor/visitors/DeclVisitor.cpp
@@ -22,31 +22,31 @@ std::string constructName(const swift::DeclName& declName) {
 }
 }  // namespace
 
-std::variant<codeql::ConcreteFuncDecl, codeql::ConcreteFuncDeclsTrap>
-DeclVisitor::translateFuncDecl(const swift::FuncDecl& decl) {
-  auto ret = createNamedEntryOr<ConcreteFuncDeclsTrap>(decl);
-  if (auto entry = get_if<ConcreteFuncDecl>(&ret)) {
+std::optional<codeql::ConcreteFuncDecl> DeclVisitor::translateFuncDecl(
+    const swift::FuncDecl& decl) {
+  if (auto entry = createNamedEntry(decl)) {
     fillAbstractFunctionDecl(decl, *entry);
+    return entry;
   }
-  return ret;
+  return std::nullopt;
 }
 
-std::variant<codeql::ConstructorDecl, codeql::ConstructorDeclsTrap>
-DeclVisitor::translateConstructorDecl(const swift::ConstructorDecl& decl) {
-  auto ret = createNamedEntryOr<ConstructorDeclsTrap>(decl);
-  if (auto entry = get_if<ConstructorDecl>(&ret)) {
+std::optional<codeql::ConstructorDecl> DeclVisitor::translateConstructorDecl(
+    const swift::ConstructorDecl& decl) {
+  if (auto entry = createNamedEntry(decl)) {
     fillAbstractFunctionDecl(decl, *entry);
+    return entry;
   }
-  return ret;
+  return std::nullopt;
 }
 
-std::variant<codeql::DestructorDecl, codeql::DestructorDeclsTrap>
-DeclVisitor::translateDestructorDecl(const swift::DestructorDecl& decl) {
-  auto ret = createNamedEntryOr<DestructorDeclsTrap>(decl);
-  if (auto entry = get_if<DestructorDecl>(&ret)) {
+std::optional<codeql::DestructorDecl> DeclVisitor::translateDestructorDecl(
+    const swift::DestructorDecl& decl) {
+  if (auto entry = createNamedEntry(decl)) {
     fillAbstractFunctionDecl(decl, *entry);
+    return entry;
   }
-  return ret;
+  return std::nullopt;
 }
 
 codeql::PrefixOperatorDecl DeclVisitor::translatePrefixOperatorDecl(
@@ -124,40 +124,37 @@ std::optional<codeql::ConcreteVarDecl> DeclVisitor::translateVarDecl(const swift
   return entry;
 }
 
-std::variant<codeql::StructDecl, codeql::StructDeclsTrap> DeclVisitor::translateStructDecl(
-    const swift::StructDecl& decl) {
-  auto ret = createNamedEntryOr<StructDeclsTrap>(decl);
-  if (auto entry = get_if<StructDecl>(&ret)) {
+std::optional<codeql::StructDecl> DeclVisitor::translateStructDecl(const swift::StructDecl& decl) {
+  if (auto entry = createNamedEntry(decl)) {
     fillNominalTypeDecl(decl, *entry);
+    return entry;
   }
-  return ret;
+  return std::nullopt;
 }
 
-std::variant<codeql::ClassDecl, codeql::ClassDeclsTrap> DeclVisitor::translateClassDecl(
-    const swift::ClassDecl& decl) {
-  auto ret = createNamedEntryOr<ClassDeclsTrap>(decl);
-  if (auto entry = get_if<ClassDecl>(&ret)) {
+std::optional<codeql::ClassDecl> DeclVisitor::translateClassDecl(const swift::ClassDecl& decl) {
+  if (auto entry = createNamedEntry(decl)) {
     fillNominalTypeDecl(decl, *entry);
+    return entry;
   }
-  return ret;
+  return std::nullopt;
 }
 
-std::variant<codeql::EnumDecl, codeql::EnumDeclsTrap> DeclVisitor::translateEnumDecl(
-    const swift::EnumDecl& decl) {
-  auto ret = createNamedEntryOr<EnumDeclsTrap>(decl);
-  if (auto entry = get_if<EnumDecl>(&ret)) {
+std::optional<codeql::EnumDecl> DeclVisitor::translateEnumDecl(const swift::EnumDecl& decl) {
+  if (auto entry = createNamedEntry(decl)) {
     fillNominalTypeDecl(decl, *entry);
+    return entry;
   }
-  return ret;
+  return std::nullopt;
 }
 
-std::variant<codeql::ProtocolDecl, codeql::ProtocolDeclsTrap> DeclVisitor::translateProtocolDecl(
+std::optional<codeql::ProtocolDecl> DeclVisitor::translateProtocolDecl(
     const swift::ProtocolDecl& decl) {
-  auto ret = createNamedEntryOr<ProtocolDeclsTrap>(decl);
-  if (auto entry = get_if<ProtocolDecl>(&ret)) {
+  if (auto entry = createNamedEntry(decl)) {
     fillNominalTypeDecl(decl, *entry);
+    return entry;
   }
-  return ret;
+  return std::nullopt;
 }
 
 codeql::EnumCaseDecl DeclVisitor::translateEnumCaseDecl(const swift::EnumCaseDecl& decl) {
@@ -166,17 +163,18 @@ codeql::EnumCaseDecl DeclVisitor::translateEnumCaseDecl(const swift::EnumCaseDec
   return entry;
 }
 
-std::variant<codeql::EnumElementDecl, codeql::EnumElementDeclsTrap>
-DeclVisitor::translateEnumElementDecl(const swift::EnumElementDecl& decl) {
-  auto ret = createNamedEntryOr<EnumElementDeclsTrap>(decl);
-  std::visit([&](auto& entry) { entry.name = decl.getNameStr().str(); }, ret);
-  if (auto entry = get_if<EnumElementDecl>(&ret)) {
-    if (decl.hasParameterList()) {
-      entry->params = dispatcher_.fetchRepeatedLabels(*decl.getParameterList());
-    }
-    fillValueDecl(decl, *entry);
+std::optional<codeql::EnumElementDecl> DeclVisitor::translateEnumElementDecl(
+    const swift::EnumElementDecl& decl) {
+  auto entry = createNamedEntry(decl);
+  if (!entry) {
+    return std::nullopt;
   }
-  return ret;
+  entry->name = decl.getNameStr().str();
+  if (decl.hasParameterList()) {
+    entry->params = dispatcher_.fetchRepeatedLabels(*decl.getParameterList());
+  }
+  fillValueDecl(decl, *entry);
+  return entry;
 }
 
 codeql::GenericTypeParamDecl DeclVisitor::translateGenericTypeParamDecl(
@@ -187,45 +185,46 @@ codeql::GenericTypeParamDecl DeclVisitor::translateGenericTypeParamDecl(
   return entry;
 }
 
-std::variant<codeql::AssociatedTypeDecl, codeql::AssociatedTypeDeclsTrap>
-DeclVisitor::translateAssociatedTypeDecl(const swift::AssociatedTypeDecl& decl) {
-  auto ret = createNamedEntryOr<AssociatedTypeDeclsTrap>(decl);
-  if (auto entry = get_if<AssociatedTypeDecl>(&ret)) {
+std::optional<codeql::AssociatedTypeDecl> DeclVisitor::translateAssociatedTypeDecl(
+    const swift::AssociatedTypeDecl& decl) {
+  if (auto entry = createNamedEntry(decl)) {
     fillTypeDecl(decl, *entry);
+    return entry;
   }
-  return ret;
+  return std::nullopt;
 }
 
-std::variant<codeql::TypeAliasDecl, codeql::TypeAliasDeclsTrap> DeclVisitor::translateTypeAliasDecl(
+std::optional<codeql::TypeAliasDecl> DeclVisitor::translateTypeAliasDecl(
     const swift::TypeAliasDecl& decl) {
-  auto ret = createNamedEntryOr<TypeAliasDeclsTrap>(decl);
-  if (auto entry = get_if<TypeAliasDecl>(&ret)) {
+  if (auto entry = createNamedEntry(decl)) {
     fillTypeDecl(decl, *entry);
+    return entry;
   }
-  return ret;
+  return std::nullopt;
 }
 
-std::variant<codeql::AccessorDecl, codeql::AccessorDeclsTrap> DeclVisitor::translateAccessorDecl(
+std::optional<codeql::AccessorDecl> DeclVisitor::translateAccessorDecl(
     const swift::AccessorDecl& decl) {
-  auto ret = createNamedEntryOr<AccessorDeclsTrap>(decl);
-  if (auto entry = get_if<AccessorDecl>(&ret)) {
-    switch (decl.getAccessorKind()) {
-      case swift::AccessorKind::Get:
-        entry->is_getter = true;
-        break;
-      case swift::AccessorKind::Set:
-        entry->is_setter = true;
-        break;
-      case swift::AccessorKind::WillSet:
-        entry->is_will_set = true;
-        break;
-      case swift::AccessorKind::DidSet:
-        entry->is_did_set = true;
-        break;
-    }
-    fillAbstractFunctionDecl(decl, *entry);
+  auto entry = createNamedEntry(decl);
+  if (!entry) {
+    return std::nullopt;
   }
-  return ret;
+  switch (decl.getAccessorKind()) {
+    case swift::AccessorKind::Get:
+      entry->is_getter = true;
+      break;
+    case swift::AccessorKind::Set:
+      entry->is_setter = true;
+      break;
+    case swift::AccessorKind::WillSet:
+      entry->is_will_set = true;
+      break;
+    case swift::AccessorKind::DidSet:
+      entry->is_did_set = true;
+      break;
+  }
+  fillAbstractFunctionDecl(decl, *entry);
+  return entry;
 }
 
 std::optional<codeql::SubscriptDecl> DeclVisitor::translateSubscriptDecl(
@@ -265,6 +264,17 @@ std::optional<codeql::ModuleDecl> DeclVisitor::translateModuleDecl(const swift::
   }
   entry->is_builtin_module = decl.isBuiltinModule();
   entry->is_system_module = decl.isSystemModule();
+  using K = swift::ModuleDecl::ImportFilterKind;
+  llvm::SmallVector<swift::ImportedModule> imports;
+  decl.getImportedModules(imports, K::Default);
+  for (const auto& import : imports) {
+    entry->imported_modules.push_back(dispatcher_.fetchLabel(import.importedModule));
+  }
+  imports.clear();
+  decl.getImportedModules(imports, K::Exported);
+  for (const auto& import : imports) {
+    entry->exported_modules.push_back(dispatcher_.fetchLabel(import.importedModule));
+  }
   fillTypeDecl(decl, *entry);
   return entry;
 }
@@ -370,15 +380,9 @@ void DeclVisitor::fillAbstractStorageDecl(const swift::AbstractStorageDecl& decl
 
 codeql::IfConfigDecl DeclVisitor::translateIfConfigDecl(const swift::IfConfigDecl& decl) {
   auto entry = createEntry(decl);
-  entry.clauses = dispatcher_.fetchRepeatedLabels(decl.getClauses());
-  return entry;
-}
-
-codeql::IfConfigClause DeclVisitor::translateIfConfigClause(const swift::IfConfigClause& clause) {
-  auto entry = dispatcher_.createEntry(clause);
-  entry.condition = dispatcher_.fetchOptionalLabel(clause.Cond);
-  entry.elements = dispatcher_.fetchRepeatedLabels(clause.Elements);
-  entry.is_active = clause.isActive;
+  if (auto activeClause = decl.getActiveClause()) {
+    entry.active_elements = dispatcher_.fetchRepeatedLabels(activeClause->Elements);
+  }
   return entry;
 }
 
diff --git a/swift/extractor/visitors/DeclVisitor.h b/swift/extractor/visitors/DeclVisitor.h
index 7fe940b985a..ddffcc7cb2b 100644
--- a/swift/extractor/visitors/DeclVisitor.h
+++ b/swift/extractor/visitors/DeclVisitor.h
@@ -16,16 +16,10 @@ class DeclVisitor : public AstVisitorBase<DeclVisitor> {
   using AstVisitorBase<DeclVisitor>::AstVisitorBase;
   using AstVisitorBase<DeclVisitor>::visit;
 
-  void visit(const swift::IfConfigClause* clause) {
-    dispatcher_.emit(translateIfConfigClause(*clause));
-  }
-
-  std::variant<codeql::ConcreteFuncDecl, codeql::ConcreteFuncDeclsTrap> translateFuncDecl(
-      const swift::FuncDecl& decl);
-  std::variant<codeql::ConstructorDecl, codeql::ConstructorDeclsTrap> translateConstructorDecl(
+  std::optional<codeql::ConcreteFuncDecl> translateFuncDecl(const swift::FuncDecl& decl);
+  std::optional<codeql::ConstructorDecl> translateConstructorDecl(
       const swift::ConstructorDecl& decl);
-  std::variant<codeql::DestructorDecl, codeql::DestructorDeclsTrap> translateDestructorDecl(
-      const swift::DestructorDecl& decl);
+  std::optional<codeql::DestructorDecl> translateDestructorDecl(const swift::DestructorDecl& decl);
   codeql::PrefixOperatorDecl translatePrefixOperatorDecl(const swift::PrefixOperatorDecl& decl);
   codeql::PostfixOperatorDecl translatePostfixOperatorDecl(const swift::PostfixOperatorDecl& decl);
   codeql::InfixOperatorDecl translateInfixOperatorDecl(const swift::InfixOperatorDecl& decl);
@@ -34,31 +28,24 @@ class DeclVisitor : public AstVisitorBase<DeclVisitor> {
   codeql::TopLevelCodeDecl translateTopLevelCodeDecl(const swift::TopLevelCodeDecl& decl);
   codeql::PatternBindingDecl translatePatternBindingDecl(const swift::PatternBindingDecl& decl);
   std::optional<codeql::ConcreteVarDecl> translateVarDecl(const swift::VarDecl& decl);
-  std::variant<codeql::StructDecl, codeql::StructDeclsTrap> translateStructDecl(
-      const swift::StructDecl& decl);
-  std::variant<codeql::ClassDecl, codeql::ClassDeclsTrap> translateClassDecl(
-      const swift::ClassDecl& decl);
-  std::variant<codeql::EnumDecl, codeql::EnumDeclsTrap> translateEnumDecl(
-      const swift::EnumDecl& decl);
-  std::variant<codeql::ProtocolDecl, codeql::ProtocolDeclsTrap> translateProtocolDecl(
-      const swift::ProtocolDecl& decl);
+  std::optional<codeql::StructDecl> translateStructDecl(const swift::StructDecl& decl);
+  std::optional<codeql::ClassDecl> translateClassDecl(const swift::ClassDecl& decl);
+  std::optional<codeql::EnumDecl> translateEnumDecl(const swift::EnumDecl& decl);
+  std::optional<codeql::ProtocolDecl> translateProtocolDecl(const swift::ProtocolDecl& decl);
   codeql::EnumCaseDecl translateEnumCaseDecl(const swift::EnumCaseDecl& decl);
-  std::variant<codeql::EnumElementDecl, codeql::EnumElementDeclsTrap> translateEnumElementDecl(
+  std::optional<codeql::EnumElementDecl> translateEnumElementDecl(
       const swift::EnumElementDecl& decl);
   codeql::GenericTypeParamDecl translateGenericTypeParamDecl(
       const swift::GenericTypeParamDecl& decl);
-  std::variant<codeql::AssociatedTypeDecl, codeql::AssociatedTypeDeclsTrap>
-  translateAssociatedTypeDecl(const swift::AssociatedTypeDecl& decl);
-  std::variant<codeql::TypeAliasDecl, codeql::TypeAliasDeclsTrap> translateTypeAliasDecl(
-      const swift::TypeAliasDecl& decl);
-  std::variant<codeql::AccessorDecl, codeql::AccessorDeclsTrap> translateAccessorDecl(
-      const swift::AccessorDecl& decl);
+  std::optional<codeql::AssociatedTypeDecl> translateAssociatedTypeDecl(
+      const swift::AssociatedTypeDecl& decl);
+  std::optional<codeql::TypeAliasDecl> translateTypeAliasDecl(const swift::TypeAliasDecl& decl);
+  std::optional<codeql::AccessorDecl> translateAccessorDecl(const swift::AccessorDecl& decl);
   std::optional<codeql::SubscriptDecl> translateSubscriptDecl(const swift::SubscriptDecl& decl);
   codeql::ExtensionDecl translateExtensionDecl(const swift::ExtensionDecl& decl);
   codeql::ImportDecl translateImportDecl(const swift::ImportDecl& decl);
   std::optional<codeql::ModuleDecl> translateModuleDecl(const swift::ModuleDecl& decl);
   codeql::IfConfigDecl translateIfConfigDecl(const swift::IfConfigDecl& decl);
-  codeql::IfConfigClause translateIfConfigClause(const swift::IfConfigClause& clause);
 
  private:
   std::string mangledName(const swift::ValueDecl& decl);
@@ -86,17 +73,6 @@ class DeclVisitor : public AstVisitorBase<DeclVisitor> {
     return entry;
   }
 
-  template <typename T, typename D, typename... Args>
-  std::variant<TrapClassOf<D>, T> createNamedEntryOr(const D& decl) {
-    auto id = dispatcher_.assignNewLabel(decl, mangledName(decl));
-    if (dispatcher_.shouldEmitDeclBody(decl)) {
-      TrapClassOf<D> entry{id};
-      fillDecl(decl, entry);
-      return entry;
-    }
-    return T{id};
-  }
-
   template <typename D>
   TrapClassOf<D> createEntry(const D& decl) {
     TrapClassOf<D> entry{dispatcher_.template assignNewLabel(decl)};
diff --git a/swift/extractor/visitors/SwiftVisitor.h b/swift/extractor/visitors/SwiftVisitor.h
index f1828c39689..42094fdc586 100644
--- a/swift/extractor/visitors/SwiftVisitor.h
+++ b/swift/extractor/visitors/SwiftVisitor.h
@@ -11,6 +11,7 @@ namespace codeql {
 
 class SwiftVisitor : private SwiftDispatcher {
  public:
+  using SwiftDispatcher::getEncounteredModules;
   using SwiftDispatcher::SwiftDispatcher;
 
   template <typename T>
@@ -21,7 +22,6 @@ class SwiftVisitor : private SwiftDispatcher {
 
  private:
   void visit(swift::Decl* decl) override { declVisitor.visit(decl); }
-  void visit(const swift::IfConfigClause* clause) override { declVisitor.visit(clause); }
   void visit(swift::Stmt* stmt) override { stmtVisitor.visit(stmt); }
   void visit(const swift::StmtCondition* cond) override {
     emit(stmtVisitor.translateStmtCondition(*cond));
diff --git a/swift/extractor/visitors/TypeVisitor.cpp b/swift/extractor/visitors/TypeVisitor.cpp
index d1c499a9a96..842746b3e91 100644
--- a/swift/extractor/visitors/TypeVisitor.cpp
+++ b/swift/extractor/visitors/TypeVisitor.cpp
@@ -11,7 +11,7 @@ void TypeVisitor::visit(swift::TypeBase* type) {
 
 codeql::TypeRepr TypeVisitor::translateTypeRepr(const swift::TypeRepr& typeRepr, swift::Type type) {
   auto entry = dispatcher_.createEntry(typeRepr);
-  entry.type = dispatcher_.fetchOptionalLabel(type);
+  entry.type = dispatcher_.fetchLabel(type);
   return entry;
 }
 
diff --git a/swift/integration-tests/osx-only/frontend-invocations/Makefile b/swift/integration-tests/osx-only/frontend-invocations/Makefile
deleted file mode 100644
index a05c5f1e9f8..00000000000
--- a/swift/integration-tests/osx-only/frontend-invocations/Makefile
+++ /dev/null
@@ -1,10 +0,0 @@
-# TODO: Add linux
-SDK=$(shell xcrun -show-sdk-path)
-FRONTEND=$(shell xcrun -find swift-frontend)
-
-all:
-	$(FRONTEND) -frontend -c A.swift -sdk $(SDK)
-	$(FRONTEND) -frontend -c B.swift -o B.o -sdk $(SDK)
-	$(FRONTEND) -frontend -c -primary-file C.swift -sdk $(SDK)
-	$(FRONTEND) -frontend -c -primary-file D.swift -o D.o -sdk $(SDK)
-	$(FRONTEND) -frontend -c -primary-file E.swift Esup.swift -o E.o -sdk $(SDK)
diff --git a/swift/integration-tests/posix-only/cross-references/Constructors.expected b/swift/integration-tests/posix-only/cross-references/Constructors.expected
index 0afb85bd6ff..3c7349dcd05 100644
--- a/swift/integration-tests/posix-only/cross-references/Constructors.expected
+++ b/swift/integration-tests/posix-only/cross-references/Constructors.expected
@@ -1,3 +1,3 @@
-| Sources/cross-references/lib.swift:4:5:4:13 | init |
-| Sources/cross-references/lib.swift:14:8:14:8 | init |
-| Sources/cross-references/main.swift:11:8:11:8 | init |
+| Sources/cross-references/lib.swift:4:5:4:13 | init() |
+| Sources/cross-references/lib.swift:14:8:14:8 | init() |
+| Sources/cross-references/main.swift:11:8:11:8 | init() |
diff --git a/swift/integration-tests/posix-only/cross-references/Destructors.expected b/swift/integration-tests/posix-only/cross-references/Destructors.expected
index 50bac72ea62..4ec12b15854 100644
--- a/swift/integration-tests/posix-only/cross-references/Destructors.expected
+++ b/swift/integration-tests/posix-only/cross-references/Destructors.expected
@@ -1 +1 @@
-| Sources/cross-references/lib.swift:5:5:5:13 | deinit |
+| Sources/cross-references/lib.swift:5:5:5:13 | deinit() |
diff --git a/swift/integration-tests/posix-only/frontend-invocations/A.swift b/swift/integration-tests/posix-only/frontend-invocations/A.swift
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/integration-tests/posix-only/frontend-invocations/B.swift b/swift/integration-tests/posix-only/frontend-invocations/B.swift
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/integration-tests/posix-only/frontend-invocations/C.swift b/swift/integration-tests/posix-only/frontend-invocations/C.swift
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/integration-tests/posix-only/frontend-invocations/D.swift b/swift/integration-tests/posix-only/frontend-invocations/D.swift
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/integration-tests/posix-only/frontend-invocations/E.swift b/swift/integration-tests/posix-only/frontend-invocations/E.swift
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/integration-tests/posix-only/frontend-invocations/Esup.swift b/swift/integration-tests/posix-only/frontend-invocations/Esup.swift
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/integration-tests/osx-only/frontend-invocations/Files.expected b/swift/integration-tests/posix-only/frontend-invocations/Files.expected
similarity index 100%
rename from swift/integration-tests/osx-only/frontend-invocations/Files.expected
rename to swift/integration-tests/posix-only/frontend-invocations/Files.expected
diff --git a/swift/integration-tests/osx-only/frontend-invocations/Files.ql b/swift/integration-tests/posix-only/frontend-invocations/Files.ql
similarity index 100%
rename from swift/integration-tests/osx-only/frontend-invocations/Files.ql
rename to swift/integration-tests/posix-only/frontend-invocations/Files.ql
diff --git a/swift/integration-tests/posix-only/frontend-invocations/Makefile b/swift/integration-tests/posix-only/frontend-invocations/Makefile
new file mode 100644
index 00000000000..d3ddece6b9f
--- /dev/null
+++ b/swift/integration-tests/posix-only/frontend-invocations/Makefile
@@ -0,0 +1,15 @@
+OS=$(shell uname)
+ifeq ($(OS),Darwin)
+SDK=-sdk $(shell xcrun -show-sdk-path)
+FRONTEND=$(shell xcrun -find swift-frontend)
+else
+SDK=""
+FRONTEND=swiftc
+endif
+
+all:
+	$(FRONTEND) -frontend -c A.swift $(SDK)
+	$(FRONTEND) -frontend -c B.swift -o B.o $(SDK)
+	$(FRONTEND) -frontend -c -primary-file C.swift $(SDK)
+	$(FRONTEND) -frontend -c -primary-file D.swift -o D.o $(SDK)
+	$(FRONTEND) -frontend -c -primary-file E.swift Esup.swift -o E.o $(SDK)
diff --git a/swift/integration-tests/osx-only/frontend-invocations/test.py b/swift/integration-tests/posix-only/frontend-invocations/test.py
similarity index 100%
rename from swift/integration-tests/osx-only/frontend-invocations/test.py
rename to swift/integration-tests/posix-only/frontend-invocations/test.py
diff --git a/swift/integration-tests/posix-only/partial-modules/Modules.expected b/swift/integration-tests/posix-only/partial-modules/Modules.expected
index 3cdcff9b980..7d7000044dc 100644
--- a/swift/integration-tests/posix-only/partial-modules/Modules.expected
+++ b/swift/integration-tests/posix-only/partial-modules/Modules.expected
@@ -1,5 +1,6 @@
 | file://:0:0:0:0 | A |
 | file://:0:0:0:0 | B |
 | file://:0:0:0:0 | PackageDescription |
+| file://:0:0:0:0 | __ObjC |
 | file://:0:0:0:0 | main |
 | file://:0:0:0:0 | partial_modules |
diff --git a/swift/ql/lib/codeql/swift/controlflow/internal/Scope.qll b/swift/ql/lib/codeql/swift/controlflow/internal/Scope.qll
index 1f24e7c7cc7..b74d001cb6a 100644
--- a/swift/ql/lib/codeql/swift/controlflow/internal/Scope.qll
+++ b/swift/ql/lib/codeql/swift/controlflow/internal/Scope.qll
@@ -1,5 +1,5 @@
 private import swift
-private import codeql.swift.generated.GetImmediateParent
+private import codeql.swift.generated.ParentChild
 private import codeql.swift.generated.Synth
 
 module CallableBase {
diff --git a/swift/ql/lib/codeql/swift/dataflow/Ssa.qll b/swift/ql/lib/codeql/swift/dataflow/Ssa.qll
index efa4f373165..92120e9880e 100644
--- a/swift/ql/lib/codeql/swift/dataflow/Ssa.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/Ssa.qll
@@ -1,56 +1,132 @@
 cached
 module Ssa {
   private import swift
-  private import internal.SsaImplCommon as SsaImplCommon
-  private import internal.SsaImplSpecific as SsaImplSpecific
+  private import codeql.ssa.Ssa as SsaImplCommon
   private import codeql.swift.controlflow.CfgNodes
   private import codeql.swift.controlflow.ControlFlowGraph
-  private import codeql.swift.controlflow.BasicBlocks
+  private import codeql.swift.controlflow.BasicBlocks as BasicBlocks
+
+  private module SsaInput implements SsaImplCommon::InputSig {
+    private import internal.DataFlowPrivate
+    private import codeql.swift.controlflow.ControlFlowGraph
+    private import codeql.swift.controlflow.CfgNodes
+
+    class BasicBlock = BasicBlocks::BasicBlock;
+
+    BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) {
+      result = bb.getImmediateDominator()
+    }
+
+    BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+    class ExitBasicBlock = BasicBlocks::ExitBasicBlock;
+
+    class SourceVariable = VarDecl;
+
+    predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+      exists(AssignExpr assign |
+        bb.getNode(i).getNode().asAstNode() = assign and
+        assign.getDest() = v.getAnAccess() and
+        certain = true
+      )
+      or
+      exists(PatternBindingDecl decl, Pattern pattern |
+        bb.getNode(i).getNode().asAstNode() = pattern and
+        decl.getAPattern() = pattern and
+        v.getParentPattern() = pattern and
+        certain = true
+      )
+      or
+      v instanceof ParamDecl and
+      bb.getNode(i).getNode().asAstNode() = v and
+      certain = true
+      or
+      // Mark the subexpression as a write of the local variable declared in the `TapExpr`.
+      exists(TapExpr tap |
+        v = tap.getVar() and
+        bb.getNode(i).getNode().asAstNode() = tap.getSubExpr() and
+        certain = true
+      )
+    }
+
+    predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+      exists(DeclRefExpr ref |
+        not isLValue(ref) and
+        bb.getNode(i).getNode().asAstNode() = ref and
+        v = ref.getDecl() and
+        certain = true
+      )
+      or
+      exists(InOutExpr expr |
+        bb.getNode(i).getNode().asAstNode() = expr and
+        expr.getSubExpr() = v.getAnAccess() and
+        certain = true
+      )
+      or
+      exists(ExitNode exit, AbstractFunctionDecl func |
+        func.getAParam() = v or func.getSelfParam() = v
+      |
+        bb.getNode(i) = exit and
+        modifiableParam(v) and
+        bb.getScope() = func and
+        certain = true
+      )
+      or
+      // Mark the `TapExpr` as a read of the of the local variable.
+      exists(TapExpr tap |
+        v = tap.getVar() and
+        bb.getNode(i).getNode().asAstNode() = tap and
+        certain = true
+      )
+    }
+  }
+
+  private module SsaImpl = SsaImplCommon::Make<SsaInput>;
 
   cached
-  class Definition extends SsaImplCommon::Definition {
+  class Definition extends SsaImpl::Definition {
     cached
     Location getLocation() { none() }
 
     cached
     ControlFlowNode getARead() {
-      exists(VarDecl v, BasicBlock bb, int i |
-        SsaImplCommon::ssaDefReachesRead(v, this, bb, i) and
-        SsaImplSpecific::variableRead(bb, i, v, true) and
+      exists(VarDecl v, SsaInput::BasicBlock bb, int i |
+        SsaImpl::ssaDefReachesRead(v, this, bb, i) and
+        SsaInput::variableRead(bb, i, v, true) and
         result = bb.getNode(i)
       )
     }
 
     cached
     ControlFlowNode getAFirstRead() {
-      exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
+      exists(SsaInput::BasicBlock bb1, int i1, SsaInput::BasicBlock bb2, int i2 |
         this.definesAt(_, bb1, i1) and
-        SsaImplCommon::adjacentDefNoUncertainReads(this, bb1, i1, bb2, i2) and
+        SsaImpl::adjacentDefNoUncertainReads(this, bb1, i1, bb2, i2) and
         result = bb2.getNode(i2)
       )
     }
 
     cached
     predicate adjacentReadPair(ControlFlowNode read1, ControlFlowNode read2) {
-      exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
+      exists(SsaInput::BasicBlock bb1, int i1, SsaInput::BasicBlock bb2, int i2 |
         read1 = bb1.getNode(i1) and
-        SsaImplSpecific::variableRead(bb1, i1, _, true) and
-        SsaImplCommon::adjacentDefNoUncertainReads(this, bb1, i1, bb2, i2) and
+        SsaInput::variableRead(bb1, i1, _, true) and
+        SsaImpl::adjacentDefNoUncertainReads(this, bb1, i1, bb2, i2) and
         read2 = bb2.getNode(i2)
       )
     }
 
     cached
-    predicate lastRefRedef(BasicBlock bb, int i, Definition next) {
-      SsaImplCommon::lastRefRedef(this, bb, i, next)
+    predicate lastRefRedef(SsaInput::BasicBlock bb, int i, Definition next) {
+      SsaImpl::lastRefRedef(this, bb, i, next)
     }
   }
 
   cached
-  class WriteDefinition extends Definition, SsaImplCommon::WriteDefinition {
+  class WriteDefinition extends Definition, SsaImpl::WriteDefinition {
     cached
     override Location getLocation() {
-      exists(BasicBlock bb, int i |
+      exists(SsaInput::BasicBlock bb, int i |
         this.definesAt(_, bb, i) and
         result = bb.getNode(i).getLocation()
       )
@@ -63,14 +139,16 @@ module Ssa {
     cached
     predicate assigns(CfgNode value) {
       exists(
-        AssignExpr a, BasicBlock bb, int i // TODO: use CFG node for assignment expr
+        AssignExpr a, SsaInput::BasicBlock bb, int i // TODO: use CFG node for assignment expr
       |
         this.definesAt(_, bb, i) and
         a = bb.getNode(i).getNode().asAstNode() and
         value.getNode().asAstNode() = a.getSource()
       )
       or
-      exists(VarDecl var, BasicBlock bb, int blockIndex, PatternBindingDecl pbd, Expr init |
+      exists(
+        VarDecl var, SsaInput::BasicBlock bb, int blockIndex, PatternBindingDecl pbd, Expr init
+      |
         this.definesAt(var, bb, blockIndex) and
         pbd.getAPattern() = bb.getNode(blockIndex).getNode().asAstNode() and
         init = var.getParentInitializer()
@@ -81,34 +159,22 @@ module Ssa {
         value.(PropertyGetterCfgNode).getRef() = init
       )
     }
-
-    cached
-    predicate isInoutDef(ExprCfgNode argument) {
-      // TODO: This should probably not be only `ExprCfgNode`s.
-      exists(
-        ApplyExpr c, BasicBlock bb, int blockIndex, VarDecl v, InOutExpr argExpr // TODO: use CFG node for assignment expr
-      |
-        this.definesAt(v, bb, blockIndex) and
-        bb.getNode(blockIndex).getNode().asAstNode() = c and
-        [c.getAnArgument().getExpr(), c.getQualifier()] = argExpr and
-        argExpr = argument.getNode().asAstNode() and
-        argExpr.getSubExpr() = v.getAnAccess() // TODO: fields?
-      )
-    }
   }
 
   cached
-  class PhiDefinition extends Definition, SsaImplCommon::PhiNode {
+  class PhiDefinition extends Definition, SsaImpl::PhiNode {
     cached
     override Location getLocation() {
-      exists(BasicBlock bb, int i |
+      exists(SsaInput::BasicBlock bb, int i |
         this.definesAt(_, bb, i) and
         result = bb.getLocation()
       )
     }
 
     cached
-    Definition getPhiInput(BasicBlock bb) { SsaImplCommon::phiHasInputFromBlock(this, result, bb) }
+    Definition getPhiInput(SsaInput::BasicBlock bb) {
+      SsaImpl::phiHasInputFromBlock(this, result, bb)
+    }
 
     cached
     Definition getAPhiInput() { result = this.getPhiInput(_) }
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll
index 4ca02d97a9a..7cab7c5eee6 100644
--- a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll
@@ -63,17 +63,26 @@ private module Cached {
   newtype TNode =
     TExprNode(CfgNode n, Expr e) { hasExprNode(n, e) } or
     TSsaDefinitionNode(Ssa::Definition def) or
-    TInoutReturnNode(ParamDecl param) { param.isInout() } or
-    TInOutUpdateNode(Argument arg) { arg.getExpr() instanceof InOutExpr } or
-    TSummaryNode(FlowSummary::SummarizedCallable c, FlowSummaryImpl::Private::SummaryNodeState state)
-
-  private predicate hasExprNode(CfgNode n, Expr e) {
-    n.(ExprCfgNode).getExpr() = e
-    or
-    n.(PropertyGetterCfgNode).getRef() = e
-    or
-    n.(PropertySetterCfgNode).getAssignExpr() = e
-  }
+    TInoutReturnNode(ParamDecl param) { modifiableParam(param) } or
+    TSummaryNode(FlowSummary::SummarizedCallable c, FlowSummaryImpl::Private::SummaryNodeState state) or
+    TExprPostUpdateNode(CfgNode n) {
+      // Obviously, the base of setters needs a post-update node
+      n = any(PropertySetterCfgNode setter).getBase()
+      or
+      // The base of getters and observers needs a post-update node to support reverse reads.
+      n = any(PropertyGetterCfgNode getter).getBase()
+      or
+      n = any(PropertyObserverCfgNode getter).getBase()
+      or
+      // Arguments that are `inout` expressions needs a post-update node,
+      // as well as any class-like argument (since a field can be modified).
+      // Finally, qualifiers and bases of member reference need post-update nodes to support reverse reads.
+      hasExprNode(n,
+        [
+          any(Argument arg | modifiable(arg)).getExpr(), any(MemberRefExpr ref).getBase(),
+          any(ApplyExpr apply).getQualifier()
+        ])
+    }
 
   private predicate localSsaFlowStepUseUse(Ssa::Definition def, Node nodeFrom, Node nodeTo) {
     def.adjacentReadPair(nodeFrom.getCfgNode(), nodeTo.getCfgNode()) and
@@ -102,18 +111,12 @@ private module Cached {
       // use-use flow
       localSsaFlowStepUseUse(def, nodeFrom, nodeTo)
       or
-      //localSsaFlowStepUseUse(def, nodeFrom.(PostUpdateNode).getPreUpdateNode(), nodeTo)
-      //or
+      localSsaFlowStepUseUse(def, nodeFrom.(PostUpdateNode).getPreUpdateNode(), nodeTo)
+      or
       // step from previous read to Phi node
       localFlowSsaInput(nodeFrom, def, nodeTo.asDefinition())
     )
     or
-    // flow through writes to inout parameters
-    exists(ParamReturnKind kind, ExprCfgNode arg |
-      arg = nodeFrom.(InOutUpdateNode).getCall(kind).asCall().getArgument(kind.getIndex()) and
-      nodeTo.asDefinition().(Ssa::WriteDefinition).isInoutDef(arg)
-    )
-    or
     // flow through `&` (inout argument)
     nodeFrom.asExpr() = nodeTo.asExpr().(InOutExpr).getSubExpr()
     or
@@ -138,10 +141,36 @@ private module Cached {
   predicate localFlowStepImpl(Node nodeFrom, Node nodeTo) { localFlowStepCommon(nodeFrom, nodeTo) }
 
   cached
-  newtype TContentSet = TODO_TContentSet()
+  newtype TContentSet = TSingletonContent(Content c)
 
   cached
-  newtype TContent = TODO_Content()
+  newtype TContent = TFieldContent(FieldDecl f)
+}
+
+/**
+ * Holds if `arg` can be modified (by overwriting the content completely),
+ * or if any of its fields can be overwritten by a function call.
+ */
+private predicate modifiable(Argument arg) {
+  arg.getExpr() instanceof InOutExpr
+  or
+  arg.getExpr().getType() instanceof NominalType
+}
+
+predicate modifiableParam(ParamDecl param) {
+  param.isInout()
+  or
+  param instanceof SelfParamDecl
+}
+
+private predicate hasExprNode(CfgNode n, Expr e) {
+  n.(ExprCfgNode).getExpr() = e
+  or
+  n.(PropertyGetterCfgNode).getRef() = e
+  or
+  n.(PropertySetterCfgNode).getAssignExpr() = e
+  or
+  n.(PropertyObserverCfgNode).getAssignExpr() = e
 }
 
 import Cached
@@ -341,23 +370,57 @@ private module OutNodes {
     }
   }
 
-  class InOutUpdateNode extends OutNode, TInOutUpdateNode, NodeImpl {
+  class InOutUpdateArgNode extends OutNode, ExprPostUpdateNode {
     Argument arg;
 
-    InOutUpdateNode() { this = TInOutUpdateNode(arg) }
+    InOutUpdateArgNode() {
+      modifiable(arg) and
+      hasExprNode(n, arg.getExpr())
+    }
 
     override DataFlowCall getCall(ReturnKind kind) {
-      result.asCall().getExpr() = arg.getApplyExpr() and
+      result.getAnArgument() = n and
       kind.(ParamReturnKind).getIndex() = arg.getIndex()
     }
+  }
 
-    override DataFlowCallable getEnclosingCallable() {
-      result = this.getCall(_).getEnclosingCallable()
+  class InOutUpdateQualifierNode extends OutNode, ExprPostUpdateNode {
+    InOutUpdateQualifierNode() { hasExprNode(n, any(ApplyExpr apply).getQualifier()) }
+
+    override DataFlowCall getCall(ReturnKind kind) {
+      result.getAnArgument() = n and
+      kind.(ParamReturnKind).getIndex() = -1
     }
+  }
 
-    override Location getLocationImpl() { result = arg.getLocation() }
+  class PropertySetterOutNode extends OutNode, ExprNodeImpl {
+    PropertySetterCfgNode setter;
 
-    override string toStringImpl() { result = arg.toString() }
+    PropertySetterOutNode() { setter = this.getCfgNode() }
+
+    override DataFlowCall getCall(ReturnKind kind) {
+      result.(PropertySetterCall).getSetter() = setter and kind.(ParamReturnKind).getIndex() = -1
+    }
+  }
+
+  class PropertyGetterOutNode extends OutNode, ExprNodeImpl {
+    PropertyGetterCfgNode getter;
+
+    PropertyGetterOutNode() { getter = this.getCfgNode() }
+
+    override DataFlowCall getCall(ReturnKind kind) {
+      result.(PropertyGetterCall).getGetter() = getter and kind instanceof NormalReturnKind
+    }
+  }
+
+  class PropertyObserverOutNode extends OutNode, ExprNodeImpl {
+    PropertyObserverCfgNode observer;
+
+    PropertyObserverOutNode() { observer = this.getCfgNode() }
+
+    override DataFlowCall getCall(ReturnKind kind) {
+      result.(PropertyGetterCall).getGetter() = observer and kind.(ParamReturnKind).getIndex() = -1
+    }
   }
 }
 
@@ -365,16 +428,34 @@ import OutNodes
 
 predicate jumpStep(Node pred, Node succ) { none() }
 
-predicate storeStep(Node node1, ContentSet c, Node node2) { none() }
+predicate storeStep(Node node1, ContentSet c, Node node2) {
+  exists(MemberRefExpr ref, AssignExpr assign |
+    ref = assign.getDest() and
+    node1.asExpr() = assign.getSource() and
+    node2.(PostUpdateNode).getPreUpdateNode().asExpr() = ref.getBase() and
+    c.isSingleton(any(Content::FieldContent ct | ct.getField() = ref.getMember()))
+  )
+}
 
-predicate readStep(Node node1, ContentSet c, Node node2) { none() }
+predicate isLValue(Expr e) { any(AssignExpr assign).getDest() = e }
+
+predicate readStep(Node node1, ContentSet c, Node node2) {
+  exists(MemberRefExpr ref |
+    not isLValue(ref) and
+    node1.asExpr() = ref.getBase() and
+    node2.asExpr() = ref and
+    c.isSingleton(any(Content::FieldContent ct | ct.getField() = ref.getMember()))
+  )
+}
 
 /**
  * Holds if values stored inside content `c` are cleared at node `n`. For example,
  * any value stored inside `f` is cleared at the pre-update node associated with `x`
  * in `x.f = newValue`.
  */
-predicate clearsContent(Node n, ContentSet c) { none() }
+predicate clearsContent(Node n, ContentSet c) {
+  n = any(PostUpdateNode pun | storeStep(_, c, pun)).getPreUpdateNode()
+}
 
 /**
  * Holds if the value that is being tracked is expected to be stored inside content `c`
@@ -408,7 +489,21 @@ abstract class PostUpdateNodeImpl extends Node {
   abstract Node getPreUpdateNode();
 }
 
-private module PostUpdateNodes { }
+private module PostUpdateNodes {
+  class ExprPostUpdateNode extends PostUpdateNodeImpl, NodeImpl, TExprPostUpdateNode {
+    CfgNode n;
+
+    ExprPostUpdateNode() { this = TExprPostUpdateNode(n) }
+
+    override ExprNode getPreUpdateNode() { n = result.getCfgNode() }
+
+    override Location getLocationImpl() { result = n.getLocation() }
+
+    override string toStringImpl() { result = "[post] " + n.toString() }
+
+    override DataFlowCallable getEnclosingCallable() { result = TDataFlowFunc(n.getScope()) }
+  }
+}
 
 private import PostUpdateNodes
 
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPublic.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPublic.qll
index 9dc3809a0c3..22743df2230 100644
--- a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPublic.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPublic.qll
@@ -139,18 +139,43 @@ class Content extends TContent {
   Location getLocation() { none() }
 }
 
+module Content {
+  /** A field of an object, for example an instance variable. */
+  class FieldContent extends Content, TFieldContent {
+    private FieldDecl f;
+
+    FieldContent() { this = TFieldContent(f) }
+
+    /** Gets the name of the field. */
+    FieldDecl getField() { result = f }
+
+    override string toString() { result = f.toString() }
+  }
+}
+
 /**
  * An entity that represents a set of `Content`s.
  *
  * The set may be interpreted differently depending on whether it is
  * stored into (`getAStoreContent`) or read from (`getAReadContent`).
  */
-class ContentSet extends Content {
+class ContentSet extends TContentSet {
+  /** Holds if this content set is the singleton `{c}`. */
+  predicate isSingleton(Content c) { this = TSingletonContent(c) }
+
+  /** Gets a textual representation of this content set. */
+  string toString() {
+    exists(Content c |
+      this.isSingleton(c) and
+      result = c.toString()
+    )
+  }
+
   /** Gets a content that may be stored into when storing into this set. */
-  Content getAStoreContent() { result = this }
+  Content getAStoreContent() { this.isSingleton(result) }
 
   /** Gets a content that may be read from when reading from this set. */
-  Content getAReadContent() { result = this }
+  Content getAReadContent() { this.isSingleton(result) }
 }
 
 /**
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
index e00fc952e1c..d857cdaa359 100644
--- a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
@@ -226,15 +226,6 @@ module Public {
       none()
     }
 
-    /**
-     * Holds if values stored inside `content` are cleared on objects passed as
-     * arguments at position `pos` to this callable.
-     *
-     * TODO: Remove once all languages support `WithoutContent` tokens.
-     */
-    pragma[nomagic]
-    predicate clearsContent(ParameterPosition pos, ContentSet content) { none() }
-
     /**
      * Holds if the summary is auto generated.
      */
@@ -328,23 +319,6 @@ module Private {
           SummaryComponentStack::singleton(TArgumentSummaryComponent(_))) and
       preservesValue = preservesValue1.booleanAnd(preservesValue2)
     )
-    or
-    exists(ParameterPosition ppos, ContentSet cs |
-      c.clearsContent(ppos, cs) and
-      input = SummaryComponentStack::push(SummaryComponent::withoutContent(cs), output) and
-      output = SummaryComponentStack::argument(ppos) and
-      preservesValue = true
-    )
-  }
-
-  private class MkClearStack extends RequiredSummaryComponentStack {
-    override predicate required(SummaryComponent head, SummaryComponentStack tail) {
-      exists(SummarizedCallable sc, ParameterPosition ppos, ContentSet cs |
-        sc.clearsContent(ppos, cs) and
-        head = SummaryComponent::withoutContent(cs) and
-        tail = SummaryComponentStack::argument(ppos)
-      )
-    }
   }
 
   /**
@@ -945,8 +919,7 @@ module Private {
         AccessPath inSpec, AccessPath outSpec, string kind
       ) {
         summaryElement(this, inSpec, outSpec, kind, true) and
-        not summaryElement(this, _, _, _, false) and
-        not this.clearsContent(_, _)
+        not summaryElement(this, _, _, _, false)
       }
 
       private predicate relevantSummaryElement(AccessPath inSpec, AccessPath outSpec, string kind) {
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll
index 726057201d4..fc831054231 100644
--- a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImplSpecific.qll
@@ -27,7 +27,7 @@ Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = TSumma
 SummaryCall summaryDataFlowCall(Node receiver) { receiver = result.getReceiver() }
 
 /** Gets the type of content `c`. */
-DataFlowType getContentType(Content c) { any() }
+DataFlowType getContentType(ContentSet c) { any() }
 
 /** Gets the return type of kind `rk` for callable `c`. */
 bindingset[c]
@@ -109,13 +109,13 @@ SummaryComponent interpretComponentSpecific(AccessPathToken c) {
 }
 
 /** Gets the textual representation of the content in the format used for flow summaries. */
-private string getContentSpecificCsv(Content c) {
+private string getContentSpecificCsv(ContentSet c) {
   none() // TODO once we have field flow
 }
 
 /** Gets the textual representation of a summary component in the format used for flow summaries. */
 string getComponentSpecificCsv(SummaryComponent sc) {
-  exists(Content c | sc = TContentSummaryComponent(c) and result = getContentSpecificCsv(c))
+  exists(ContentSet c | sc = TContentSummaryComponent(c) and result = getContentSpecificCsv(c))
   or
   exists(ReturnKind rk |
     sc = TReturnSummaryComponent(rk) and
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/SsaImplCommon.qll b/swift/ql/lib/codeql/swift/dataflow/internal/SsaImplCommon.qll
deleted file mode 100644
index 659940def50..00000000000
--- a/swift/ql/lib/codeql/swift/dataflow/internal/SsaImplCommon.qll
+++ /dev/null
@@ -1,795 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
-    maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaActualRead() or
-    SsaPhiRead() or
-    SsaDef()
-
-  class SsaRead = SsaActualRead or SsaPhiRead;
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaActualRead() and
-      result = "SsaActualRead"
-      or
-      this = SsaPhiRead() and
-      result = "SsaPhiRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this instanceof SsaRead and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if `bb` is in the dominance frontier of a block containing a
-   * read of `v`.
-   */
-  pragma[nomagic]
-  private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
-    exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
-      lastRefIsRead(readbb, v)
-      or
-      phiRead(readbb, v)
-    )
-  }
-
-  /**
-   * Holds if a phi-read node should be inserted for variable `v` at the beginning
-   * of basic block `bb`.
-   *
-   * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
-   * instead of writes, and only if the dominance-frontier block does not already
-   * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
-   * an internal implementation detail that is not exposed.
-   *
-   * The motivation for adding phi-reads is to improve performance of the use-use
-   * calculation in cases where there is a large number of reads that can reach the
-   * same join-point, and from there reach a large number of basic blocks. Example:
-   *
-   * ```cs
-   * if (a)
-   *   use(x);
-   * else if (b)
-   *   use(x);
-   * else if (c)
-   *   use(x);
-   * else if (d)
-   *   use(x);
-   * // many more ifs ...
-   *
-   * // phi-read for `x` inserted here
-   *
-   * // program not mentioning `x`, with large basic block graph
-   *
-   * use(x);
-   * ```
-   *
-   * Without phi-reads, the analysis has to replicate reachability for each of
-   * the guarded uses of `x`. However, with phi-reads, the analysis will limit
-   * each conditional use of `x` to reach the basic block containing the phi-read
-   * node for `x`, and only that basic block will have to compute reachability
-   * through the remainder of the large program.
-   *
-   * Like normal reads, each phi-read node `phi-read` can be reached from exactly
-   * one SSA definition (without passing through another definition): Assume, for
-   * the sake of contradiction, that there are two reaching definitions `def1` and
-   * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
-   * dominating definition will prevent the other from reaching `phi-read`. So, at
-   * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
-   * Then `def1` must go through one of its dominance-frontier blocks in order to
-   * reach `phi-read`. However, such a block will always start with a (normal) phi
-   * node, which contradicts reachability.
-   *
-   * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
-   * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
-   * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
-   * which contradicts reachability.
-   */
-  pragma[nomagic]
-  predicate phiRead(BasicBlock bb, SourceVariable v) {
-    inReadDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v) and
-    // only if there are no other references to `v` inside `bb`
-    not ref(bb, _, v, _) and
-    not exists(Definition def | def.definesAt(v, bb, _))
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  pragma[nomagic]
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaActualRead()
-    or
-    phiRead(bb, v) and
-    i = -1 and
-    k = SsaPhiRead()
-    or
-    any(Definition def).definesAt(v, bb, i) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, any(SsaRead k))
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, any(SsaRead k))
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
-    exists(ssaDefRank(def, v, bb, _, k))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable(), _)
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
-   * predecessor of `bb2`, and the underlying variable for `def` is neither read
-   * nor written in any block on the path between `bb1` and `bb2`.
-   *
-   * Phi reads are considered as normal reads for this predicate.
-   */
-  pragma[nomagic]
-  private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReachesInclPhiRead(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(def, bb1, bb2) and
-    defOccursInBlock(def, bb2, v, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
-    ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExclPhiRead(def, mid, bb2) and
-      phiReadStep(def, _, bb1, mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * the underlying variable `v` of `def` is accessed in basic block `bb2`
-   * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
-   * `v` is neither read nor written in any block on the path between `bb1`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesExclPhiRead(def, bb1, bb2) and
-    not defOccursInBlock(def, bb1, _, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb` (either a read or a write),
-   * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
-   * and `v` is neither read nor written in any block on the path between `bb`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReachesExit(Definition def, BasicBlock bb) {
-    exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExit(def, mid) and
-      phiReadStep(def, _, bb, mid)
-    )
-  }
-}
-
-predicate phiReadExposedForTesting = phiRead/2;
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last |
-    last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  ssaRef(bb, i, v, any(SsaRead k)) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  // Can reach another definition
-  lastRefRedef(def, bb, i, _)
-  or
-  exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    varBlockReachesExit(def, bb)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-
-  query predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
-      ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      (bb != bbDef or i < iDef)
-      or
-      ssaDefReachesRead(v, def, bb, i) and
-      not ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
-    )
-  }
-}
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/SsaImplSpecific.qll b/swift/ql/lib/codeql/swift/dataflow/internal/SsaImplSpecific.qll
deleted file mode 100644
index 3adc7ba8aaf..00000000000
--- a/swift/ql/lib/codeql/swift/dataflow/internal/SsaImplSpecific.qll
+++ /dev/null
@@ -1,75 +0,0 @@
-/** Provides the Swift specific parameters for `SsaImplCommon.qll`. */
-
-private import swift
-private import codeql.swift.controlflow.BasicBlocks as BasicBlocks
-private import codeql.swift.controlflow.ControlFlowGraph
-private import codeql.swift.controlflow.CfgNodes
-
-class BasicBlock = BasicBlocks::BasicBlock;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock = BasicBlocks::ExitBasicBlock;
-
-class SourceVariable = VarDecl;
-
-predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(AssignExpr assign |
-    bb.getNode(i).getNode().asAstNode() = assign and
-    assign.getDest() = v.getAnAccess() and
-    certain = true
-  )
-  or
-  exists(PatternBindingDecl decl, Pattern pattern |
-    bb.getNode(i).getNode().asAstNode() = pattern and
-    decl.getAPattern() = pattern and
-    v.getParentPattern() = pattern and
-    certain = true
-  )
-  or
-  exists(ApplyExpr call, InOutExpr expr |
-    expr = [call.getAnArgument().getExpr(), call.getQualifier()] and
-    expr.getSubExpr() = v.getAnAccess() and
-    bb.getNode(i).getNode().asAstNode() = call and
-    certain = false
-  )
-  or
-  v instanceof ParamDecl and
-  bb.getNode(i).getNode().asAstNode() = v and
-  certain = true
-  or
-  // Mark the subexpression as a write of the local variable declared in the `TapExpr`.
-  exists(TapExpr tap |
-    v = tap.getVar() and
-    bb.getNode(i).getNode().asAstNode() = tap.getSubExpr() and
-    certain = true
-  )
-}
-
-private predicate isLValue(DeclRefExpr ref) { any(AssignExpr assign).getDest() = ref }
-
-predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(DeclRefExpr ref |
-    not isLValue(ref) and
-    bb.getNode(i).getNode().asAstNode() = ref and
-    v = ref.getDecl() and
-    certain = true
-  )
-  or
-  exists(ExitNode exit, AbstractFunctionDecl func |
-    bb.getNode(i) = exit and
-    v.(ParamDecl).isInout() and
-    func.getAParam() = v and
-    bb.getScope() = func and
-    certain = true
-  )
-  or
-  // Mark the `TapExpr` as a read of the of the local variable.
-  exists(TapExpr tap |
-    v = tap.getVar() and
-    bb.getNode(i).getNode().asAstNode() = tap and
-    certain = true
-  )
-}
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll b/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll
index b7552cb8049..f75266c6f1e 100644
--- a/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll
@@ -32,7 +32,7 @@ private module Cached {
       nodeFrom.asExpr() = [apply.getAnArgument().getExpr(), apply.getQualifier()] and
       apply.getStaticTarget().getName() = ["appendLiteral(_:)", "appendInterpolation(_:)"] and
       e.getExpr() = [apply.getAnArgument().getExpr(), apply.getQualifier()] and
-      nodeTo.asDefinition().(Ssa::WriteDefinition).isInoutDef(e)
+      nodeTo.(PostUpdateNodeImpl).getPreUpdateNode().getCfgNode() = e
     )
     or
     // Flow from the computation of the interpolated string literal to the result of the interpolation.
@@ -53,7 +53,7 @@ private module Cached {
       c.getName() = "URL" and
       c.getAMember() = f and
       f.getName() = ["init(string:)", "init(string:relativeTo:)"] and
-      call.getFunction().(ApplyExpr).getStaticTarget() = f and
+      call.getStaticTarget() = f and
       nodeFrom.asExpr() = call.getAnArgument().getExpr() and
       nodeTo.asExpr() = call
     )
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPublic.qll b/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPublic.qll
index f2b407d0a6c..96e595dba09 100644
--- a/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPublic.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPublic.qll
@@ -26,4 +26,4 @@ predicate localTaintStep = localTaintStepCached/2;
  * of `c` at sinks and inputs to additional taint steps.
  */
 bindingset[node]
-predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::Content c) { none() }
+predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) { none() }
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/tainttracking1/TaintTrackingImpl.qll b/swift/ql/lib/codeql/swift/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
index e6ce1ada8d4..bf937b6de31 100644
--- a/swift/ql/lib/codeql/swift/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/tainttracking1/TaintTrackingImpl.qll
@@ -172,7 +172,12 @@ abstract class Configuration extends DataFlow::Configuration {
   }
 
   override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
+    (
+      this.isSink(node) or
+      this.isSink(node, _) or
+      this.isAdditionalTaintStep(node, _) or
+      this.isAdditionalTaintStep(node, _, _, _)
+    ) and
     defaultImplicitTaintRead(node, c)
   }
 
diff --git a/swift/ql/lib/codeql/swift/elements.qll b/swift/ql/lib/codeql/swift/elements.qll
index 86bd9301c0f..774b6510f49 100644
--- a/swift/ql/lib/codeql/swift/elements.qll
+++ b/swift/ql/lib/codeql/swift/elements.qll
@@ -10,6 +10,7 @@ import codeql.swift.elements.Locatable
 import codeql.swift.elements.Location
 import codeql.swift.elements.UnknownFile
 import codeql.swift.elements.UnknownLocation
+import codeql.swift.elements.UnresolvedElement
 import codeql.swift.elements.decl.AbstractFunctionDecl
 import codeql.swift.elements.decl.AbstractStorageDecl
 import codeql.swift.elements.decl.AbstractTypeParamDecl
@@ -29,7 +30,6 @@ import codeql.swift.elements.decl.FuncDecl
 import codeql.swift.elements.decl.GenericContext
 import codeql.swift.elements.decl.GenericTypeDecl
 import codeql.swift.elements.decl.GenericTypeParamDecl
-import codeql.swift.elements.decl.IfConfigClause
 import codeql.swift.elements.decl.IfConfigDecl
 import codeql.swift.elements.decl.ImportDecl
 import codeql.swift.elements.decl.InfixOperatorDecl
diff --git a/swift/ql/lib/codeql/swift/elements/AstNode.qll b/swift/ql/lib/codeql/swift/elements/AstNode.qll
index 02164b18f80..33b4da963b7 100644
--- a/swift/ql/lib/codeql/swift/elements/AstNode.qll
+++ b/swift/ql/lib/codeql/swift/elements/AstNode.qll
@@ -1,17 +1,30 @@
 private import codeql.swift.generated.AstNode
 private import codeql.swift.elements.decl.AbstractFunctionDecl
-private import codeql.swift.generated.GetImmediateParent
+private import codeql.swift.elements.decl.Decl
+private import codeql.swift.generated.ParentChild
 
-private Element getEnclosingFunctionStep(Element e) {
-  not e instanceof AbstractFunctionDecl and
-  result = getImmediateParent(e)
-}
+private module Cached {
+  private Element getEnclosingDeclStep(Element e) {
+    not e instanceof Decl and
+    result = getImmediateParent(e)
+  }
 
-cached
-private AbstractFunctionDecl getEnclosingFunctionCached(AstNode ast) {
-  result = getEnclosingFunctionStep*(getImmediateParent(ast))
+  cached
+  Decl getEnclosingDecl(AstNode ast) { result = getEnclosingDeclStep*(getImmediateParent(ast)) }
+
+  private Element getEnclosingFunctionStep(Element e) {
+    not e instanceof AbstractFunctionDecl and
+    result = getEnclosingDecl(e)
+  }
+
+  cached
+  AbstractFunctionDecl getEnclosingFunction(AstNode ast) {
+    result = getEnclosingFunctionStep*(getEnclosingDecl(ast))
+  }
 }
 
 class AstNode extends AstNodeBase {
-  final AbstractFunctionDecl getEnclosingFunction() { result = getEnclosingFunctionCached(this) }
+  final AbstractFunctionDecl getEnclosingFunction() { result = Cached::getEnclosingFunction(this) }
+
+  final Decl getEnclosingDecl() { result = Cached::getEnclosingDecl(this) }
 }
diff --git a/swift/ql/lib/codeql/swift/elements/UnresolvedElement.qll b/swift/ql/lib/codeql/swift/elements/UnresolvedElement.qll
new file mode 100644
index 00000000000..0621ab6d599
--- /dev/null
+++ b/swift/ql/lib/codeql/swift/elements/UnresolvedElement.qll
@@ -0,0 +1,4 @@
+// generated by codegen/codegen.py, remove this comment if you wish to edit this file
+private import codeql.swift.generated.UnresolvedElement
+
+class UnresolvedElement extends UnresolvedElementBase { }
diff --git a/swift/ql/lib/codeql/swift/elements/decl/ConstructorDecl.qll b/swift/ql/lib/codeql/swift/elements/decl/ConstructorDecl.qll
index 7386feae21a..375eff6acc3 100644
--- a/swift/ql/lib/codeql/swift/elements/decl/ConstructorDecl.qll
+++ b/swift/ql/lib/codeql/swift/elements/decl/ConstructorDecl.qll
@@ -1,5 +1,4 @@
+// generated by codegen/codegen.py, remove this comment if you wish to edit this file
 private import codeql.swift.generated.decl.ConstructorDecl
 
-class ConstructorDecl extends ConstructorDeclBase {
-  override string toString() { result = "init" }
-}
+class ConstructorDecl extends ConstructorDeclBase { }
diff --git a/swift/ql/lib/codeql/swift/elements/decl/DestructorDecl.qll b/swift/ql/lib/codeql/swift/elements/decl/DestructorDecl.qll
index 300fff46a58..8cc68eaf7c8 100644
--- a/swift/ql/lib/codeql/swift/elements/decl/DestructorDecl.qll
+++ b/swift/ql/lib/codeql/swift/elements/decl/DestructorDecl.qll
@@ -1,5 +1,4 @@
+// generated by codegen/codegen.py, remove this comment if you wish to edit this file
 private import codeql.swift.generated.decl.DestructorDecl
 
-class DestructorDecl extends DestructorDeclBase {
-  override string toString() { result = "deinit" }
-}
+class DestructorDecl extends DestructorDeclBase { }
diff --git a/swift/ql/lib/codeql/swift/elements/decl/IfConfigClause.qll b/swift/ql/lib/codeql/swift/elements/decl/IfConfigClause.qll
deleted file mode 100644
index 6ab22e67989..00000000000
--- a/swift/ql/lib/codeql/swift/elements/decl/IfConfigClause.qll
+++ /dev/null
@@ -1,4 +0,0 @@
-// generated by codegen/codegen.py, remove this comment if you wish to edit this file
-private import codeql.swift.generated.decl.IfConfigClause
-
-class IfConfigClause extends IfConfigClauseBase { }
diff --git a/swift/ql/lib/codeql/swift/elements/decl/IfConfigClauseConstructor.qll b/swift/ql/lib/codeql/swift/elements/decl/IfConfigClauseConstructor.qll
deleted file mode 100644
index e9ba8e26a25..00000000000
--- a/swift/ql/lib/codeql/swift/elements/decl/IfConfigClauseConstructor.qll
+++ /dev/null
@@ -1,4 +0,0 @@
-// generated by codegen/codegen.py, remove this comment if you wish to edit this file
-private import codeql.swift.generated.Raw
-
-predicate constructIfConfigClause(Raw::IfConfigClause id) { any() }
diff --git a/swift/ql/lib/codeql/swift/elements/decl/TypeDecl.qll b/swift/ql/lib/codeql/swift/elements/decl/TypeDecl.qll
index 61012b16023..967a3a81294 100644
--- a/swift/ql/lib/codeql/swift/elements/decl/TypeDecl.qll
+++ b/swift/ql/lib/codeql/swift/elements/decl/TypeDecl.qll
@@ -1,5 +1,15 @@
 private import codeql.swift.generated.decl.TypeDecl
+private import codeql.swift.generated.type.Type
+private import codeql.swift.elements.type.AnyGenericType
 
 class TypeDecl extends TypeDeclBase {
   override string toString() { result = this.getName() }
+
+  TypeDecl getBaseTypeDecl(int i) { result = this.getBaseType(i).(AnyGenericType).getDeclaration() }
+
+  TypeDecl getABaseTypeDecl() { result = this.getBaseTypeDecl(_) }
+
+  TypeDecl getDerivedTypeDecl(int i) { result.getBaseTypeDecl(i) = this }
+
+  TypeDecl getADerivedTypeDecl() { result = this.getDerivedTypeDecl(_) }
 }
diff --git a/swift/ql/lib/codeql/swift/elements/expr/ArgumentConstructor.qll b/swift/ql/lib/codeql/swift/elements/expr/ArgumentConstructor.qll
index f9abd9372c3..dc1cffc8c62 100644
--- a/swift/ql/lib/codeql/swift/elements/expr/ArgumentConstructor.qll
+++ b/swift/ql/lib/codeql/swift/elements/expr/ArgumentConstructor.qll
@@ -1,4 +1,9 @@
-// generated by codegen/codegen.py, remove this comment if you wish to edit this file
 private import codeql.swift.generated.Raw
 
-predicate constructArgument(Raw::Argument id) { any() }
+predicate constructArgument(Raw::Argument id) {
+  // exclude an argument that will be part of a DotSyntaxCallExpr
+  // that will be transformed into a MethodRefCallExpr
+  not exists(Raw::DotSyntaxCallExpr c |
+    c.getFunction() instanceof Raw::DeclRefExpr and id = c.getArgument(0)
+  )
+}
diff --git a/swift/ql/lib/codeql/swift/elements/expr/DeclRefExprConstructor.qll b/swift/ql/lib/codeql/swift/elements/expr/DeclRefExprConstructor.qll
index 0491790ffce..bd5447dfe34 100644
--- a/swift/ql/lib/codeql/swift/elements/expr/DeclRefExprConstructor.qll
+++ b/swift/ql/lib/codeql/swift/elements/expr/DeclRefExprConstructor.qll
@@ -1,4 +1,7 @@
-// generated by codegen/codegen.py, remove this comment if you wish to edit this file
 private import codeql.swift.generated.Raw
 
-predicate constructDeclRefExpr(Raw::DeclRefExpr id) { any() }
+predicate constructDeclRefExpr(Raw::DeclRefExpr id) {
+  // exclude an argument that will be part of a DotSyntaxCallExpr
+  // that will be transformed into a MethodRefCallExpr
+  not exists(Raw::DotSyntaxCallExpr c | id = c.getFunction())
+}
diff --git a/swift/ql/lib/codeql/swift/elements/expr/Expr.qll b/swift/ql/lib/codeql/swift/elements/expr/Expr.qll
index e9e731614bc..994e1c56a64 100644
--- a/swift/ql/lib/codeql/swift/elements/expr/Expr.qll
+++ b/swift/ql/lib/codeql/swift/elements/expr/Expr.qll
@@ -7,6 +7,12 @@ class Expr extends ExprBase {
 
   Expr getConversion() { result.convertsFrom(this) }
 
+  Expr getConversion(int n) {
+    n = 0 and result = this.getConversion()
+    or
+    result = this.getConversion(n - 1).getConversion()
+  }
+
   predicate isConversion() { this.convertsFrom(_) }
 
   predicate hasConversions() { exists(this.getConversion()) }
diff --git a/swift/ql/lib/codeql/swift/generated/Callable.qll b/swift/ql/lib/codeql/swift/generated/Callable.qll
index bd3cd4779b3..4b97524744c 100644
--- a/swift/ql/lib/codeql/swift/generated/Callable.qll
+++ b/swift/ql/lib/codeql/swift/generated/Callable.qll
@@ -6,6 +6,17 @@ import codeql.swift.elements.Element
 import codeql.swift.elements.decl.ParamDecl
 
 class CallableBase extends Synth::TCallable, Element {
+  ParamDecl getImmediateSelfParam() {
+    result =
+      Synth::convertParamDeclFromRaw(Synth::convertCallableToRaw(this)
+            .(Raw::Callable)
+            .getSelfParam())
+  }
+
+  final ParamDecl getSelfParam() { result = getImmediateSelfParam().resolve() }
+
+  final predicate hasSelfParam() { exists(getSelfParam()) }
+
   ParamDecl getImmediateParam(int index) {
     result =
       Synth::convertParamDeclFromRaw(Synth::convertCallableToRaw(this)
@@ -19,17 +30,6 @@ class CallableBase extends Synth::TCallable, Element {
 
   final int getNumberOfParams() { result = count(getAParam()) }
 
-  ParamDecl getImmediateSelfParam() {
-    result =
-      Synth::convertParamDeclFromRaw(Synth::convertCallableToRaw(this)
-            .(Raw::Callable)
-            .getSelfParam())
-  }
-
-  final ParamDecl getSelfParam() { result = getImmediateSelfParam().resolve() }
-
-  final predicate hasSelfParam() { exists(getSelfParam()) }
-
   BraceStmt getImmediateBody() {
     result =
       Synth::convertBraceStmtFromRaw(Synth::convertCallableToRaw(this).(Raw::Callable).getBody())
diff --git a/swift/ql/lib/codeql/swift/generated/GetImmediateParent.qll b/swift/ql/lib/codeql/swift/generated/GetImmediateParent.qll
deleted file mode 100644
index 1bec53f9a9f..00000000000
--- a/swift/ql/lib/codeql/swift/generated/GetImmediateParent.qll
+++ /dev/null
@@ -1,237 +0,0 @@
-// generated by codegen/codegen.py
-import codeql.swift.elements
-
-/**
- * Gets any of the "immediate" children of `e`. "Immediate" means not taking into account node resolution: for example
- * if the AST child is the first of a series of conversions that would normally be hidden away, this will select the
- * next conversion down the hidden AST tree instead of the corresponding fully uncoverted node at the bottom.
- * Outside this module this file is mainly intended to be used to test uniqueness of parents.
- */
-cached
-Element getAnImmediateChild(Element e) {
-  // why does this look more complicated than it should?
-  // * none() simplifies generation, as we can append `or ...` without a special case for the first item
-  none()
-  or
-  result = e.(Callable).getImmediateParam(_)
-  or
-  result = e.(Callable).getImmediateSelfParam()
-  or
-  result = e.(Callable).getImmediateBody()
-  or
-  result = e.(AbstractStorageDecl).getImmediateAccessorDecl(_)
-  or
-  result = e.(EnumCaseDecl).getImmediateElement(_)
-  or
-  result = e.(EnumElementDecl).getImmediateParam(_)
-  or
-  result = e.(IfConfigClause).getImmediateCondition()
-  or
-  result = e.(IfConfigClause).getImmediateElement(_)
-  or
-  result = e.(IfConfigDecl).getImmediateClause(_)
-  or
-  result = e.(PatternBindingDecl).getImmediateInit(_)
-  or
-  result = e.(PatternBindingDecl).getImmediatePattern(_)
-  or
-  result = e.(SubscriptDecl).getImmediateParam(_)
-  or
-  result = e.(TopLevelCodeDecl).getImmediateBody()
-  or
-  result = e.(AnyTryExpr).getImmediateSubExpr()
-  or
-  result = e.(ApplyExpr).getImmediateFunction()
-  or
-  result = e.(ApplyExpr).getImmediateArgument(_)
-  or
-  result = e.(Argument).getImmediateExpr()
-  or
-  result = e.(ArrayExpr).getImmediateElement(_)
-  or
-  result = e.(AssignExpr).getImmediateDest()
-  or
-  result = e.(AssignExpr).getImmediateSource()
-  or
-  result = e.(BindOptionalExpr).getImmediateSubExpr()
-  or
-  result = e.(CaptureListExpr).getImmediateBindingDecl(_)
-  or
-  result = e.(CaptureListExpr).getImmediateClosureBody()
-  or
-  result = e.(DictionaryExpr).getImmediateElement(_)
-  or
-  result = e.(DotSyntaxBaseIgnoredExpr).getImmediateQualifier()
-  or
-  result = e.(DotSyntaxBaseIgnoredExpr).getImmediateSubExpr()
-  or
-  result = e.(DynamicTypeExpr).getImmediateBase()
-  or
-  result = e.(EnumIsCaseExpr).getImmediateSubExpr()
-  or
-  result = e.(ExplicitCastExpr).getImmediateSubExpr()
-  or
-  result = e.(ForceValueExpr).getImmediateSubExpr()
-  or
-  result = e.(IdentityExpr).getImmediateSubExpr()
-  or
-  result = e.(IfExpr).getImmediateCondition()
-  or
-  result = e.(IfExpr).getImmediateThenExpr()
-  or
-  result = e.(IfExpr).getImmediateElseExpr()
-  or
-  result = e.(ImplicitConversionExpr).getImmediateSubExpr()
-  or
-  result = e.(InOutExpr).getImmediateSubExpr()
-  or
-  result = e.(InterpolatedStringLiteralExpr).getImmediateInterpolationCountExpr()
-  or
-  result = e.(InterpolatedStringLiteralExpr).getImmediateLiteralCapacityExpr()
-  or
-  result = e.(InterpolatedStringLiteralExpr).getImmediateAppendingExpr()
-  or
-  result = e.(KeyPathApplicationExpr).getImmediateBase()
-  or
-  result = e.(KeyPathApplicationExpr).getImmediateKeyPath()
-  or
-  result = e.(KeyPathExpr).getImmediateRoot()
-  or
-  result = e.(KeyPathExpr).getImmediateParsedPath()
-  or
-  result = e.(LazyInitializerExpr).getImmediateSubExpr()
-  or
-  result = e.(LookupExpr).getImmediateBase()
-  or
-  result = e.(MakeTemporarilyEscapableExpr).getImmediateEscapingClosure()
-  or
-  result = e.(MakeTemporarilyEscapableExpr).getImmediateNonescapingClosure()
-  or
-  result = e.(MakeTemporarilyEscapableExpr).getImmediateSubExpr()
-  or
-  result = e.(ObjCSelectorExpr).getImmediateSubExpr()
-  or
-  result = e.(OneWayExpr).getImmediateSubExpr()
-  or
-  result = e.(OpenExistentialExpr).getImmediateSubExpr()
-  or
-  result = e.(OpenExistentialExpr).getImmediateExistential()
-  or
-  result = e.(OpenExistentialExpr).getImmediateOpaqueExpr()
-  or
-  result = e.(OptionalEvaluationExpr).getImmediateSubExpr()
-  or
-  result = e.(RebindSelfInConstructorExpr).getImmediateSubExpr()
-  or
-  result = e.(RebindSelfInConstructorExpr).getImmediateSelf()
-  or
-  result = e.(SelfApplyExpr).getImmediateBase()
-  or
-  result = e.(SequenceExpr).getImmediateElement(_)
-  or
-  result = e.(SubscriptExpr).getImmediateArgument(_)
-  or
-  result = e.(TapExpr).getImmediateSubExpr()
-  or
-  result = e.(TapExpr).getImmediateBody()
-  or
-  result = e.(TupleElementExpr).getImmediateSubExpr()
-  or
-  result = e.(TupleExpr).getImmediateElement(_)
-  or
-  result = e.(TypeExpr).getImmediateTypeRepr()
-  or
-  result = e.(UnresolvedDotExpr).getImmediateBase()
-  or
-  result = e.(UnresolvedPatternExpr).getImmediateSubPattern()
-  or
-  result = e.(VarargExpansionExpr).getImmediateSubExpr()
-  or
-  result = e.(BindingPattern).getImmediateSubPattern()
-  or
-  result = e.(EnumElementPattern).getImmediateSubPattern()
-  or
-  result = e.(ExprPattern).getImmediateSubExpr()
-  or
-  result = e.(IsPattern).getImmediateCastTypeRepr()
-  or
-  result = e.(IsPattern).getImmediateSubPattern()
-  or
-  result = e.(OptionalSomePattern).getImmediateSubPattern()
-  or
-  result = e.(ParenPattern).getImmediateSubPattern()
-  or
-  result = e.(TuplePattern).getImmediateElement(_)
-  or
-  result = e.(TypedPattern).getImmediateSubPattern()
-  or
-  result = e.(TypedPattern).getImmediateTypeRepr()
-  or
-  result = e.(BraceStmt).getImmediateElement(_)
-  or
-  result = e.(CaseLabelItem).getImmediatePattern()
-  or
-  result = e.(CaseLabelItem).getImmediateGuard()
-  or
-  result = e.(CaseStmt).getImmediateBody()
-  or
-  result = e.(CaseStmt).getImmediateLabel(_)
-  or
-  result = e.(ConditionElement).getImmediateBoolean()
-  or
-  result = e.(ConditionElement).getImmediatePattern()
-  or
-  result = e.(ConditionElement).getImmediateInitializer()
-  or
-  result = e.(DeferStmt).getImmediateBody()
-  or
-  result = e.(DoCatchStmt).getImmediateBody()
-  or
-  result = e.(DoCatchStmt).getImmediateCatch(_)
-  or
-  result = e.(DoStmt).getImmediateBody()
-  or
-  result = e.(ForEachStmt).getImmediatePattern()
-  or
-  result = e.(ForEachStmt).getImmediateSequence()
-  or
-  result = e.(ForEachStmt).getImmediateWhere()
-  or
-  result = e.(ForEachStmt).getImmediateBody()
-  or
-  result = e.(GuardStmt).getImmediateBody()
-  or
-  result = e.(IfStmt).getImmediateThen()
-  or
-  result = e.(IfStmt).getImmediateElse()
-  or
-  result = e.(LabeledConditionalStmt).getImmediateCondition()
-  or
-  result = e.(RepeatWhileStmt).getImmediateCondition()
-  or
-  result = e.(RepeatWhileStmt).getImmediateBody()
-  or
-  result = e.(ReturnStmt).getImmediateResult()
-  or
-  result = e.(StmtCondition).getImmediateElement(_)
-  or
-  result = e.(SwitchStmt).getImmediateExpr()
-  or
-  result = e.(SwitchStmt).getImmediateCase(_)
-  or
-  result = e.(ThrowStmt).getImmediateSubExpr()
-  or
-  result = e.(WhileStmt).getImmediateBody()
-  or
-  result = e.(YieldStmt).getImmediateResult(_)
-}
-
-/**
- * Gets the "immediate" parent of `e`. "Immediate" means not taking into account node resolution: for example
- * if `e` has conversions, `getImmediateParent(e)` will give the bottom conversion in the hidden AST.
- */
-Element getImmediateParent(Element e) {
-  // `unique` is used here to tell the optimizer that there is in fact only one result
-  // this is tested by the `library-tests/parent/no_double_parents.ql` test
-  result = unique(Element x | e = getAnImmediateChild(x) | x)
-}
diff --git a/swift/ql/lib/codeql/swift/generated/ParentChild.qll b/swift/ql/lib/codeql/swift/generated/ParentChild.qll
new file mode 100644
index 00000000000..502d04b5f05
--- /dev/null
+++ b/swift/ql/lib/codeql/swift/generated/ParentChild.qll
@@ -0,0 +1,5307 @@
+// generated by codegen/codegen.py
+import codeql.swift.elements
+
+private module Impl {
+  private Element getImmediateChildOfElement(Element e, int index, string partialPredicateCall) {
+    none()
+  }
+
+  private Element getImmediateChildOfCallable(Callable e, int index, string partialPredicateCall) {
+    exists(int b, int bElement, int n, int nSelfParam, int nParam, int nBody |
+      b = 0 and
+      bElement = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfElement(e, i, _)) | i) and
+      n = bElement and
+      nSelfParam = n + 1 and
+      nParam = nSelfParam + 1 + max(int i | i = -1 or exists(e.getImmediateParam(i)) | i) and
+      nBody = nParam + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfElement(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSelfParam() and partialPredicateCall = "SelfParam()"
+        or
+        result = e.getImmediateParam(index - nSelfParam) and
+        partialPredicateCall = "Param(" + (index - nSelfParam).toString() + ")"
+        or
+        index = nParam and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfFile(File e, int index, string partialPredicateCall) {
+    exists(int b, int bElement, int n |
+      b = 0 and
+      bElement = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfElement(e, i, _)) | i) and
+      n = bElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfElement(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfGenericContext(
+    GenericContext e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bElement, int n, int nGenericTypeParam |
+      b = 0 and
+      bElement = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfElement(e, i, _)) | i) and
+      n = bElement and
+      nGenericTypeParam =
+        n + 1 + max(int i | i = -1 or exists(e.getImmediateGenericTypeParam(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfElement(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateGenericTypeParam(index - n) and
+        partialPredicateCall = "GenericTypeParam(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfIterableDeclContext(
+    IterableDeclContext e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bElement, int n, int nMember |
+      b = 0 and
+      bElement = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfElement(e, i, _)) | i) and
+      n = bElement and
+      nMember = n + 1 + max(int i | i = -1 or exists(e.getImmediateMember(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfElement(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateMember(index - n) and
+        partialPredicateCall = "Member(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLocatable(Locatable e, int index, string partialPredicateCall) {
+    exists(int b, int bElement, int n |
+      b = 0 and
+      bElement = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfElement(e, i, _)) | i) and
+      n = bElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfElement(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLocation(Location e, int index, string partialPredicateCall) {
+    exists(int b, int bElement, int n |
+      b = 0 and
+      bElement = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfElement(e, i, _)) | i) and
+      n = bElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfElement(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfType(Type e, int index, string partialPredicateCall) {
+    exists(int b, int bElement, int n |
+      b = 0 and
+      bElement = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfElement(e, i, _)) | i) and
+      n = bElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfElement(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnresolvedElement(
+    UnresolvedElement e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bElement, int n |
+      b = 0 and
+      bElement = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfElement(e, i, _)) | i) and
+      n = bElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfElement(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAnyFunctionType(
+    AnyFunctionType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAnyGenericType(
+    AnyGenericType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAnyMetatypeType(
+    AnyMetatypeType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfArgument(Argument e, int index, string partialPredicateCall) {
+    exists(int b, int bLocatable, int n, int nExpr |
+      b = 0 and
+      bLocatable = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLocatable(e, i, _)) | i) and
+      n = bLocatable and
+      nExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfLocatable(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateExpr() and partialPredicateCall = "Expr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAstNode(AstNode e, int index, string partialPredicateCall) {
+    exists(int b, int bLocatable, int n |
+      b = 0 and
+      bLocatable = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLocatable(e, i, _)) | i) and
+      n = bLocatable and
+      (
+        none()
+        or
+        result = getImmediateChildOfLocatable(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinType(
+    BuiltinType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfComment(Comment e, int index, string partialPredicateCall) {
+    exists(int b, int bLocatable, int n |
+      b = 0 and
+      bLocatable = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLocatable(e, i, _)) | i) and
+      n = bLocatable and
+      (
+        none()
+        or
+        result = getImmediateChildOfLocatable(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfConditionElement(
+    ConditionElement e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLocatable, int n, int nBoolean, int nPattern, int nInitializer |
+      b = 0 and
+      bLocatable = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLocatable(e, i, _)) | i) and
+      n = bLocatable and
+      nBoolean = n + 1 and
+      nPattern = nBoolean + 1 and
+      nInitializer = nPattern + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfLocatable(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBoolean() and partialPredicateCall = "Boolean()"
+        or
+        index = nBoolean and result = e.getImmediatePattern() and partialPredicateCall = "Pattern()"
+        or
+        index = nPattern and
+        result = e.getImmediateInitializer() and
+        partialPredicateCall = "Initializer()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDbFile(DbFile e, int index, string partialPredicateCall) {
+    exists(int b, int bFile, int n |
+      b = 0 and
+      bFile = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfFile(e, i, _)) | i) and
+      n = bFile and
+      (
+        none()
+        or
+        result = getImmediateChildOfFile(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDbLocation(DbLocation e, int index, string partialPredicateCall) {
+    exists(int b, int bLocation, int n |
+      b = 0 and
+      bLocation = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLocation(e, i, _)) | i) and
+      n = bLocation and
+      (
+        none()
+        or
+        result = getImmediateChildOfLocation(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDependentMemberType(
+    DependentMemberType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDynamicSelfType(
+    DynamicSelfType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfErrorType(ErrorType e, int index, string partialPredicateCall) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfExistentialType(
+    ExistentialType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfInOutType(InOutType e, int index, string partialPredicateCall) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLValueType(LValueType e, int index, string partialPredicateCall) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfModuleType(ModuleType e, int index, string partialPredicateCall) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPlaceholderType(
+    PlaceholderType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfProtocolCompositionType(
+    ProtocolCompositionType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfReferenceStorageType(
+    ReferenceStorageType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSilBlockStorageType(
+    SilBlockStorageType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSilBoxType(SilBoxType e, int index, string partialPredicateCall) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSilFunctionType(
+    SilFunctionType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSilTokenType(
+    SilTokenType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSubstitutableType(
+    SubstitutableType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSugarType(SugarType e, int index, string partialPredicateCall) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTupleType(TupleType e, int index, string partialPredicateCall) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTypeVariableType(
+    TypeVariableType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      n = bType and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnknownFile(
+    UnknownFile e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bFile, int n |
+      b = 0 and
+      bFile = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfFile(e, i, _)) | i) and
+      n = bFile and
+      (
+        none()
+        or
+        result = getImmediateChildOfFile(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnknownLocation(
+    UnknownLocation e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLocation, int n |
+      b = 0 and
+      bLocation = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLocation(e, i, _)) | i) and
+      n = bLocation and
+      (
+        none()
+        or
+        result = getImmediateChildOfLocation(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnresolvedType(
+    UnresolvedType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bType, int bUnresolvedElement, int n |
+      b = 0 and
+      bType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfType(e, i, _)) | i) and
+      bUnresolvedElement =
+        bType + 1 + max(int i | i = -1 or exists(getImmediateChildOfUnresolvedElement(e, i, _)) | i) and
+      n = bUnresolvedElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfType(e, index - b, partialPredicateCall)
+        or
+        result = getImmediateChildOfUnresolvedElement(e, index - bType, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAnyBuiltinIntegerType(
+    AnyBuiltinIntegerType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfArchetypeType(
+    ArchetypeType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bSubstitutableType, int n |
+      b = 0 and
+      bSubstitutableType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfSubstitutableType(e, i, _)) | i) and
+      n = bSubstitutableType and
+      (
+        none()
+        or
+        result = getImmediateChildOfSubstitutableType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinBridgeObjectType(
+    BuiltinBridgeObjectType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinDefaultActorStorageType(
+    BuiltinDefaultActorStorageType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinExecutorType(
+    BuiltinExecutorType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinFloatType(
+    BuiltinFloatType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinJobType(
+    BuiltinJobType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinNativeObjectType(
+    BuiltinNativeObjectType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinRawPointerType(
+    BuiltinRawPointerType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinRawUnsafeContinuationType(
+    BuiltinRawUnsafeContinuationType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinUnsafeValueBufferType(
+    BuiltinUnsafeValueBufferType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinVectorType(
+    BuiltinVectorType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinType, int n |
+      b = 0 and
+      bBuiltinType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinType(e, i, _)) | i) and
+      n = bBuiltinType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCaseLabelItem(
+    CaseLabelItem e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAstNode, int n, int nPattern, int nGuard |
+      b = 0 and
+      bAstNode = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAstNode(e, i, _)) | i) and
+      n = bAstNode and
+      nPattern = n + 1 and
+      nGuard = nPattern + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfAstNode(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediatePattern() and partialPredicateCall = "Pattern()"
+        or
+        index = nPattern and result = e.getImmediateGuard() and partialPredicateCall = "Guard()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDecl(Decl e, int index, string partialPredicateCall) {
+    exists(int b, int bAstNode, int n |
+      b = 0 and
+      bAstNode = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAstNode(e, i, _)) | i) and
+      n = bAstNode and
+      (
+        none()
+        or
+        result = getImmediateChildOfAstNode(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfExistentialMetatypeType(
+    ExistentialMetatypeType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAnyMetatypeType, int n |
+      b = 0 and
+      bAnyMetatypeType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyMetatypeType(e, i, _)) | i) and
+      n = bAnyMetatypeType and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyMetatypeType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfExpr(Expr e, int index, string partialPredicateCall) {
+    exists(int b, int bAstNode, int n |
+      b = 0 and
+      bAstNode = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAstNode(e, i, _)) | i) and
+      n = bAstNode and
+      (
+        none()
+        or
+        result = getImmediateChildOfAstNode(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfFunctionType(
+    FunctionType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAnyFunctionType, int n |
+      b = 0 and
+      bAnyFunctionType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyFunctionType(e, i, _)) | i) and
+      n = bAnyFunctionType and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyFunctionType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfGenericFunctionType(
+    GenericFunctionType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAnyFunctionType, int n |
+      b = 0 and
+      bAnyFunctionType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyFunctionType(e, i, _)) | i) and
+      n = bAnyFunctionType and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyFunctionType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfGenericTypeParamType(
+    GenericTypeParamType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bSubstitutableType, int n |
+      b = 0 and
+      bSubstitutableType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfSubstitutableType(e, i, _)) | i) and
+      n = bSubstitutableType and
+      (
+        none()
+        or
+        result = getImmediateChildOfSubstitutableType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfMetatypeType(
+    MetatypeType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAnyMetatypeType, int n |
+      b = 0 and
+      bAnyMetatypeType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyMetatypeType(e, i, _)) | i) and
+      n = bAnyMetatypeType and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyMetatypeType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfNominalOrBoundGenericNominalType(
+    NominalOrBoundGenericNominalType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAnyGenericType, int n |
+      b = 0 and
+      bAnyGenericType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyGenericType(e, i, _)) | i) and
+      n = bAnyGenericType and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyGenericType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfParenType(ParenType e, int index, string partialPredicateCall) {
+    exists(int b, int bSugarType, int n |
+      b = 0 and
+      bSugarType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfSugarType(e, i, _)) | i) and
+      n = bSugarType and
+      (
+        none()
+        or
+        result = getImmediateChildOfSugarType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPattern(Pattern e, int index, string partialPredicateCall) {
+    exists(int b, int bAstNode, int n |
+      b = 0 and
+      bAstNode = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAstNode(e, i, _)) | i) and
+      n = bAstNode and
+      (
+        none()
+        or
+        result = getImmediateChildOfAstNode(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfStmt(Stmt e, int index, string partialPredicateCall) {
+    exists(int b, int bAstNode, int n |
+      b = 0 and
+      bAstNode = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAstNode(e, i, _)) | i) and
+      n = bAstNode and
+      (
+        none()
+        or
+        result = getImmediateChildOfAstNode(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfStmtCondition(
+    StmtCondition e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAstNode, int n, int nElement |
+      b = 0 and
+      bAstNode = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAstNode(e, i, _)) | i) and
+      n = bAstNode and
+      nElement = n + 1 + max(int i | i = -1 or exists(e.getImmediateElement(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfAstNode(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateElement(index - n) and
+        partialPredicateCall = "Element(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSyntaxSugarType(
+    SyntaxSugarType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bSugarType, int n |
+      b = 0 and
+      bSugarType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfSugarType(e, i, _)) | i) and
+      n = bSugarType and
+      (
+        none()
+        or
+        result = getImmediateChildOfSugarType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTypeAliasType(
+    TypeAliasType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bSugarType, int n |
+      b = 0 and
+      bSugarType = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfSugarType(e, i, _)) | i) and
+      n = bSugarType and
+      (
+        none()
+        or
+        result = getImmediateChildOfSugarType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTypeRepr(TypeRepr e, int index, string partialPredicateCall) {
+    exists(int b, int bAstNode, int n |
+      b = 0 and
+      bAstNode = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAstNode(e, i, _)) | i) and
+      n = bAstNode and
+      (
+        none()
+        or
+        result = getImmediateChildOfAstNode(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnboundGenericType(
+    UnboundGenericType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAnyGenericType, int n |
+      b = 0 and
+      bAnyGenericType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyGenericType(e, i, _)) | i) and
+      n = bAnyGenericType and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyGenericType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnmanagedStorageType(
+    UnmanagedStorageType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bReferenceStorageType, int n |
+      b = 0 and
+      bReferenceStorageType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfReferenceStorageType(e, i, _)) | i) and
+      n = bReferenceStorageType and
+      (
+        none()
+        or
+        result = getImmediateChildOfReferenceStorageType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnownedStorageType(
+    UnownedStorageType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bReferenceStorageType, int n |
+      b = 0 and
+      bReferenceStorageType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfReferenceStorageType(e, i, _)) | i) and
+      n = bReferenceStorageType and
+      (
+        none()
+        or
+        result = getImmediateChildOfReferenceStorageType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfWeakStorageType(
+    WeakStorageType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bReferenceStorageType, int n |
+      b = 0 and
+      bReferenceStorageType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfReferenceStorageType(e, i, _)) | i) and
+      n = bReferenceStorageType and
+      (
+        none()
+        or
+        result = getImmediateChildOfReferenceStorageType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAbstractClosureExpr(
+    AbstractClosureExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int bCallable, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      bCallable =
+        bExpr + 1 + max(int i | i = -1 or exists(getImmediateChildOfCallable(e, i, _)) | i) and
+      n = bCallable and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        result = getImmediateChildOfCallable(e, index - bExpr, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAnyPattern(AnyPattern e, int index, string partialPredicateCall) {
+    exists(int b, int bPattern, int n |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAnyTryExpr(AnyTryExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAppliedPropertyWrapperExpr(
+    AppliedPropertyWrapperExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfApplyExpr(ApplyExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n, int nFunction, int nArgument |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nFunction = n + 1 and
+      nArgument = nFunction + 1 + max(int i | i = -1 or exists(e.getImmediateArgument(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateFunction() and partialPredicateCall = "Function()"
+        or
+        result = e.getImmediateArgument(index - nFunction) and
+        partialPredicateCall = "Argument(" + (index - nFunction).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfArrowExpr(ArrowExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAssignExpr(AssignExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n, int nDest, int nSource |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nDest = n + 1 and
+      nSource = nDest + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateDest() and partialPredicateCall = "Dest()"
+        or
+        index = nDest and result = e.getImmediateSource() and partialPredicateCall = "Source()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBindOptionalExpr(
+    BindOptionalExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBindingPattern(
+    BindingPattern e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bPattern, int n, int nSubPattern |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      nSubPattern = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubPattern() and partialPredicateCall = "SubPattern()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBoolPattern(
+    BoolPattern e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bPattern, int n |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBoundGenericType(
+    BoundGenericType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bNominalOrBoundGenericNominalType, int n |
+      b = 0 and
+      bNominalOrBoundGenericNominalType =
+        b + 1 +
+          max(int i |
+            i = -1 or exists(getImmediateChildOfNominalOrBoundGenericNominalType(e, i, _))
+          |
+            i
+          ) and
+      n = bNominalOrBoundGenericNominalType and
+      (
+        none()
+        or
+        result =
+          getImmediateChildOfNominalOrBoundGenericNominalType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBraceStmt(BraceStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bStmt, int n, int nElement |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      nElement = n + 1 + max(int i | i = -1 or exists(e.getImmediateElement(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateElement(index - n) and
+        partialPredicateCall = "Element(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBreakStmt(BreakStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bStmt, int n |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinIntegerLiteralType(
+    BuiltinIntegerLiteralType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAnyBuiltinIntegerType, int n |
+      b = 0 and
+      bAnyBuiltinIntegerType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyBuiltinIntegerType(e, i, _)) | i) and
+      n = bAnyBuiltinIntegerType and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyBuiltinIntegerType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinIntegerType(
+    BuiltinIntegerType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAnyBuiltinIntegerType, int n |
+      b = 0 and
+      bAnyBuiltinIntegerType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyBuiltinIntegerType(e, i, _)) | i) and
+      n = bAnyBuiltinIntegerType and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyBuiltinIntegerType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCaptureListExpr(
+    CaptureListExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nBindingDecl, int nClosureBody |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nBindingDecl = n + 1 + max(int i | i = -1 or exists(e.getImmediateBindingDecl(i)) | i) and
+      nClosureBody = nBindingDecl + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateBindingDecl(index - n) and
+        partialPredicateCall = "BindingDecl(" + (index - n).toString() + ")"
+        or
+        index = nBindingDecl and
+        result = e.getImmediateClosureBody() and
+        partialPredicateCall = "ClosureBody()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCaseStmt(CaseStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bStmt, int n, int nBody, int nLabel |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      nBody = n + 1 and
+      nLabel = nBody + 1 + max(int i | i = -1 or exists(e.getImmediateLabel(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+        or
+        result = e.getImmediateLabel(index - nBody) and
+        partialPredicateCall = "Label(" + (index - nBody).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCodeCompletionExpr(
+    CodeCompletionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCollectionExpr(
+    CollectionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfContinueStmt(
+    ContinueStmt e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bStmt, int n |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDeclRefExpr(
+    DeclRefExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDefaultArgumentExpr(
+    DefaultArgumentExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDeferStmt(DeferStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bStmt, int n, int nBody |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      nBody = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDictionaryType(
+    DictionaryType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bSyntaxSugarType, int n |
+      b = 0 and
+      bSyntaxSugarType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfSyntaxSugarType(e, i, _)) | i) and
+      n = bSyntaxSugarType and
+      (
+        none()
+        or
+        result = getImmediateChildOfSyntaxSugarType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDiscardAssignmentExpr(
+    DiscardAssignmentExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDotSyntaxBaseIgnoredExpr(
+    DotSyntaxBaseIgnoredExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nQualifier, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nQualifier = n + 1 and
+      nSubExpr = nQualifier + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateQualifier() and partialPredicateCall = "Qualifier()"
+        or
+        index = nQualifier and
+        result = e.getImmediateSubExpr() and
+        partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDynamicTypeExpr(
+    DynamicTypeExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nBase |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nBase = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBase() and partialPredicateCall = "Base()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfEditorPlaceholderExpr(
+    EditorPlaceholderExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfEnumCaseDecl(
+    EnumCaseDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bDecl, int n |
+      b = 0 and
+      bDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfEnumElementPattern(
+    EnumElementPattern e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bPattern, int n, int nSubPattern |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      nSubPattern = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubPattern() and partialPredicateCall = "SubPattern()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfEnumIsCaseExpr(
+    EnumIsCaseExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfErrorExpr(ErrorExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfExplicitCastExpr(
+    ExplicitCastExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfExprPattern(
+    ExprPattern e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bPattern, int n, int nSubExpr |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfExtensionDecl(
+    ExtensionDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bGenericContext, int bIterableDeclContext, int bDecl, int n |
+      b = 0 and
+      bGenericContext =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfGenericContext(e, i, _)) | i) and
+      bIterableDeclContext =
+        bGenericContext + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfIterableDeclContext(e, i, _)) | i) and
+      bDecl =
+        bIterableDeclContext + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfGenericContext(e, index - b, partialPredicateCall)
+        or
+        result =
+          getImmediateChildOfIterableDeclContext(e, index - bGenericContext, partialPredicateCall)
+        or
+        result = getImmediateChildOfDecl(e, index - bIterableDeclContext, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfFailStmt(FailStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bStmt, int n |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfFallthroughStmt(
+    FallthroughStmt e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bStmt, int n |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfForceValueExpr(
+    ForceValueExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfIdentityExpr(
+    IdentityExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfIfConfigDecl(
+    IfConfigDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bDecl, int n, int nActiveElement |
+      b = 0 and
+      bDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      nActiveElement = n + 1 + max(int i | i = -1 or exists(e.getImmediateActiveElement(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfDecl(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateActiveElement(index - n) and
+        partialPredicateCall = "ActiveElement(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfIfExpr(IfExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n, int nCondition, int nThenExpr, int nElseExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nCondition = n + 1 and
+      nThenExpr = nCondition + 1 and
+      nElseExpr = nThenExpr + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateCondition() and partialPredicateCall = "Condition()"
+        or
+        index = nCondition and
+        result = e.getImmediateThenExpr() and
+        partialPredicateCall = "ThenExpr()"
+        or
+        index = nThenExpr and
+        result = e.getImmediateElseExpr() and
+        partialPredicateCall = "ElseExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfImplicitConversionExpr(
+    ImplicitConversionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfImportDecl(ImportDecl e, int index, string partialPredicateCall) {
+    exists(int b, int bDecl, int n |
+      b = 0 and
+      bDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfInOutExpr(InOutExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfIsPattern(IsPattern e, int index, string partialPredicateCall) {
+    exists(int b, int bPattern, int n, int nCastTypeRepr, int nSubPattern |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      nCastTypeRepr = n + 1 and
+      nSubPattern = nCastTypeRepr + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+        or
+        index = n and
+        result = e.getImmediateCastTypeRepr() and
+        partialPredicateCall = "CastTypeRepr()"
+        or
+        index = nCastTypeRepr and
+        result = e.getImmediateSubPattern() and
+        partialPredicateCall = "SubPattern()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfKeyPathApplicationExpr(
+    KeyPathApplicationExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nBase, int nKeyPath |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nBase = n + 1 and
+      nKeyPath = nBase + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBase() and partialPredicateCall = "Base()"
+        or
+        index = nBase and result = e.getImmediateKeyPath() and partialPredicateCall = "KeyPath()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfKeyPathDotExpr(
+    KeyPathDotExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfKeyPathExpr(
+    KeyPathExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nRoot, int nParsedPath |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nRoot = n + 1 and
+      nParsedPath = nRoot + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateRoot() and partialPredicateCall = "Root()"
+        or
+        index = nRoot and
+        result = e.getImmediateParsedPath() and
+        partialPredicateCall = "ParsedPath()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLabeledStmt(
+    LabeledStmt e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bStmt, int n |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLazyInitializerExpr(
+    LazyInitializerExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLiteralExpr(
+    LiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLookupExpr(LookupExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n, int nBase |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nBase = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBase() and partialPredicateCall = "Base()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfMakeTemporarilyEscapableExpr(
+    MakeTemporarilyEscapableExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nEscapingClosure, int nNonescapingClosure, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nEscapingClosure = n + 1 and
+      nNonescapingClosure = nEscapingClosure + 1 and
+      nSubExpr = nNonescapingClosure + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and
+        result = e.getImmediateEscapingClosure() and
+        partialPredicateCall = "EscapingClosure()"
+        or
+        index = nEscapingClosure and
+        result = e.getImmediateNonescapingClosure() and
+        partialPredicateCall = "NonescapingClosure()"
+        or
+        index = nNonescapingClosure and
+        result = e.getImmediateSubExpr() and
+        partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfMissingMemberDecl(
+    MissingMemberDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bDecl, int n |
+      b = 0 and
+      bDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfNamedPattern(
+    NamedPattern e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bPattern, int n |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfNestedArchetypeType(
+    NestedArchetypeType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bArchetypeType, int n |
+      b = 0 and
+      bArchetypeType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfArchetypeType(e, i, _)) | i) and
+      n = bArchetypeType and
+      (
+        none()
+        or
+        result = getImmediateChildOfArchetypeType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfNominalType(
+    NominalType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bNominalOrBoundGenericNominalType, int n |
+      b = 0 and
+      bNominalOrBoundGenericNominalType =
+        b + 1 +
+          max(int i |
+            i = -1 or exists(getImmediateChildOfNominalOrBoundGenericNominalType(e, i, _))
+          |
+            i
+          ) and
+      n = bNominalOrBoundGenericNominalType and
+      (
+        none()
+        or
+        result =
+          getImmediateChildOfNominalOrBoundGenericNominalType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfObjCSelectorExpr(
+    ObjCSelectorExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOneWayExpr(OneWayExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOpaqueTypeArchetypeType(
+    OpaqueTypeArchetypeType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bArchetypeType, int n |
+      b = 0 and
+      bArchetypeType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfArchetypeType(e, i, _)) | i) and
+      n = bArchetypeType and
+      (
+        none()
+        or
+        result = getImmediateChildOfArchetypeType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOpaqueValueExpr(
+    OpaqueValueExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOpenExistentialExpr(
+    OpenExistentialExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr, int nExistential, int nOpaqueExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      nExistential = nSubExpr + 1 and
+      nOpaqueExpr = nExistential + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+        or
+        index = nSubExpr and
+        result = e.getImmediateExistential() and
+        partialPredicateCall = "Existential()"
+        or
+        index = nExistential and
+        result = e.getImmediateOpaqueExpr() and
+        partialPredicateCall = "OpaqueExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOpenedArchetypeType(
+    OpenedArchetypeType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bArchetypeType, int n |
+      b = 0 and
+      bArchetypeType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfArchetypeType(e, i, _)) | i) and
+      n = bArchetypeType and
+      (
+        none()
+        or
+        result = getImmediateChildOfArchetypeType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOperatorDecl(
+    OperatorDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bDecl, int n |
+      b = 0 and
+      bDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOptionalEvaluationExpr(
+    OptionalEvaluationExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOptionalSomePattern(
+    OptionalSomePattern e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bPattern, int n, int nSubPattern |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      nSubPattern = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubPattern() and partialPredicateCall = "SubPattern()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOtherConstructorDeclRefExpr(
+    OtherConstructorDeclRefExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOverloadSetRefExpr(
+    OverloadSetRefExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfParenPattern(
+    ParenPattern e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bPattern, int n, int nSubPattern |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      nSubPattern = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubPattern() and partialPredicateCall = "SubPattern()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPatternBindingDecl(
+    PatternBindingDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bDecl, int n, int nInit, int nPattern |
+      b = 0 and
+      bDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      nInit = n + 1 + max(int i | i = -1 or exists(e.getImmediateInit(i)) | i) and
+      nPattern = nInit + 1 + max(int i | i = -1 or exists(e.getImmediatePattern(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfDecl(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateInit(index - n) and
+        partialPredicateCall = "Init(" + (index - n).toString() + ")"
+        or
+        result = e.getImmediatePattern(index - nInit) and
+        partialPredicateCall = "Pattern(" + (index - nInit).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPoundAssertStmt(
+    PoundAssertStmt e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bStmt, int n |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPoundDiagnosticDecl(
+    PoundDiagnosticDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bDecl, int n |
+      b = 0 and
+      bDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPrecedenceGroupDecl(
+    PrecedenceGroupDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bDecl, int n |
+      b = 0 and
+      bDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPrimaryArchetypeType(
+    PrimaryArchetypeType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bArchetypeType, int n |
+      b = 0 and
+      bArchetypeType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfArchetypeType(e, i, _)) | i) and
+      n = bArchetypeType and
+      (
+        none()
+        or
+        result = getImmediateChildOfArchetypeType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPropertyWrapperValuePlaceholderExpr(
+    PropertyWrapperValuePlaceholderExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfRebindSelfInConstructorExpr(
+    RebindSelfInConstructorExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfReturnStmt(ReturnStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bStmt, int n, int nResult |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      nResult = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateResult() and partialPredicateCall = "Result()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSequenceArchetypeType(
+    SequenceArchetypeType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bArchetypeType, int n |
+      b = 0 and
+      bArchetypeType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfArchetypeType(e, i, _)) | i) and
+      n = bArchetypeType and
+      (
+        none()
+        or
+        result = getImmediateChildOfArchetypeType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSequenceExpr(
+    SequenceExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nElement |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nElement = n + 1 + max(int i | i = -1 or exists(e.getImmediateElement(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateElement(index - n) and
+        partialPredicateCall = "Element(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSuperRefExpr(
+    SuperRefExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTapExpr(TapExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n, int nSubExpr, int nBody |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      nBody = nSubExpr + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+        or
+        index = nSubExpr and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfThrowStmt(ThrowStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bStmt, int n, int nSubExpr |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTopLevelCodeDecl(
+    TopLevelCodeDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bDecl, int n, int nBody |
+      b = 0 and
+      bDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      nBody = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfDecl(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTupleElementExpr(
+    TupleElementExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTupleExpr(TupleExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n, int nElement |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nElement = n + 1 + max(int i | i = -1 or exists(e.getImmediateElement(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateElement(index - n) and
+        partialPredicateCall = "Element(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTuplePattern(
+    TuplePattern e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bPattern, int n, int nElement |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      nElement = n + 1 + max(int i | i = -1 or exists(e.getImmediateElement(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateElement(index - n) and
+        partialPredicateCall = "Element(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTypeExpr(TypeExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExpr, int n, int nTypeRepr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nTypeRepr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateTypeRepr() and partialPredicateCall = "TypeRepr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTypedPattern(
+    TypedPattern e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bPattern, int n, int nSubPattern, int nTypeRepr |
+      b = 0 and
+      bPattern = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfPattern(e, i, _)) | i) and
+      n = bPattern and
+      nSubPattern = n + 1 and
+      nTypeRepr = nSubPattern + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfPattern(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubPattern() and partialPredicateCall = "SubPattern()"
+        or
+        index = nSubPattern and
+        result = e.getImmediateTypeRepr() and
+        partialPredicateCall = "TypeRepr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnarySyntaxSugarType(
+    UnarySyntaxSugarType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bSyntaxSugarType, int n |
+      b = 0 and
+      bSyntaxSugarType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfSyntaxSugarType(e, i, _)) | i) and
+      n = bSyntaxSugarType and
+      (
+        none()
+        or
+        result = getImmediateChildOfSyntaxSugarType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnresolvedDeclRefExpr(
+    UnresolvedDeclRefExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int bUnresolvedElement, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      bUnresolvedElement =
+        bExpr + 1 + max(int i | i = -1 or exists(getImmediateChildOfUnresolvedElement(e, i, _)) | i) and
+      n = bUnresolvedElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        result = getImmediateChildOfUnresolvedElement(e, index - bExpr, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnresolvedDotExpr(
+    UnresolvedDotExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int bUnresolvedElement, int n, int nBase |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      bUnresolvedElement =
+        bExpr + 1 + max(int i | i = -1 or exists(getImmediateChildOfUnresolvedElement(e, i, _)) | i) and
+      n = bUnresolvedElement and
+      nBase = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        result = getImmediateChildOfUnresolvedElement(e, index - bExpr, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBase() and partialPredicateCall = "Base()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnresolvedMemberExpr(
+    UnresolvedMemberExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int bUnresolvedElement, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      bUnresolvedElement =
+        bExpr + 1 + max(int i | i = -1 or exists(getImmediateChildOfUnresolvedElement(e, i, _)) | i) and
+      n = bUnresolvedElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        result = getImmediateChildOfUnresolvedElement(e, index - bExpr, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnresolvedPatternExpr(
+    UnresolvedPatternExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int bUnresolvedElement, int n, int nSubPattern |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      bUnresolvedElement =
+        bExpr + 1 + max(int i | i = -1 or exists(getImmediateChildOfUnresolvedElement(e, i, _)) | i) and
+      n = bUnresolvedElement and
+      nSubPattern = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        result = getImmediateChildOfUnresolvedElement(e, index - bExpr, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubPattern() and partialPredicateCall = "SubPattern()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnresolvedSpecializeExpr(
+    UnresolvedSpecializeExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int bUnresolvedElement, int n |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      bUnresolvedElement =
+        bExpr + 1 + max(int i | i = -1 or exists(getImmediateChildOfUnresolvedElement(e, i, _)) | i) and
+      n = bUnresolvedElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        result = getImmediateChildOfUnresolvedElement(e, index - bExpr, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfValueDecl(ValueDecl e, int index, string partialPredicateCall) {
+    exists(int b, int bDecl, int n |
+      b = 0 and
+      bDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDecl(e, i, _)) | i) and
+      n = bDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfVarargExpansionExpr(
+    VarargExpansionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExpr, int n, int nSubExpr |
+      b = 0 and
+      bExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExpr(e, i, _)) | i) and
+      n = bExpr and
+      nSubExpr = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateSubExpr() and partialPredicateCall = "SubExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfYieldStmt(YieldStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bStmt, int n, int nResult |
+      b = 0 and
+      bStmt = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfStmt(e, i, _)) | i) and
+      n = bStmt and
+      nResult = n + 1 + max(int i | i = -1 or exists(e.getImmediateResult(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfStmt(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateResult(index - n) and
+        partialPredicateCall = "Result(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAbstractFunctionDecl(
+    AbstractFunctionDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bGenericContext, int bValueDecl, int bCallable, int n |
+      b = 0 and
+      bGenericContext =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfGenericContext(e, i, _)) | i) and
+      bValueDecl =
+        bGenericContext + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfValueDecl(e, i, _)) | i) and
+      bCallable =
+        bValueDecl + 1 + max(int i | i = -1 or exists(getImmediateChildOfCallable(e, i, _)) | i) and
+      n = bCallable and
+      (
+        none()
+        or
+        result = getImmediateChildOfGenericContext(e, index - b, partialPredicateCall)
+        or
+        result = getImmediateChildOfValueDecl(e, index - bGenericContext, partialPredicateCall)
+        or
+        result = getImmediateChildOfCallable(e, index - bValueDecl, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAbstractStorageDecl(
+    AbstractStorageDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bValueDecl, int n, int nAccessorDecl |
+      b = 0 and
+      bValueDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfValueDecl(e, i, _)) | i) and
+      n = bValueDecl and
+      nAccessorDecl = n + 1 + max(int i | i = -1 or exists(e.getImmediateAccessorDecl(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfValueDecl(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateAccessorDecl(index - n) and
+        partialPredicateCall = "AccessorDecl(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAnyHashableErasureExpr(
+    AnyHashableErasureExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfArchetypeToSuperExpr(
+    ArchetypeToSuperExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfArrayExpr(ArrayExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bCollectionExpr, int n, int nElement |
+      b = 0 and
+      bCollectionExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfCollectionExpr(e, i, _)) | i) and
+      n = bCollectionExpr and
+      nElement = n + 1 + max(int i | i = -1 or exists(e.getImmediateElement(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfCollectionExpr(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateElement(index - n) and
+        partialPredicateCall = "Element(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfArraySliceType(
+    ArraySliceType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bUnarySyntaxSugarType, int n |
+      b = 0 and
+      bUnarySyntaxSugarType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfUnarySyntaxSugarType(e, i, _)) | i) and
+      n = bUnarySyntaxSugarType and
+      (
+        none()
+        or
+        result = getImmediateChildOfUnarySyntaxSugarType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfArrayToPointerExpr(
+    ArrayToPointerExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAutoClosureExpr(
+    AutoClosureExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAbstractClosureExpr, int n |
+      b = 0 and
+      bAbstractClosureExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAbstractClosureExpr(e, i, _)) | i) and
+      n = bAbstractClosureExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfAbstractClosureExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAwaitExpr(AwaitExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bIdentityExpr, int n |
+      b = 0 and
+      bIdentityExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfIdentityExpr(e, i, _)) | i) and
+      n = bIdentityExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfIdentityExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBinaryExpr(BinaryExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bApplyExpr, int n |
+      b = 0 and
+      bApplyExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfApplyExpr(e, i, _)) | i) and
+      n = bApplyExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfApplyExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBoundGenericClassType(
+    BoundGenericClassType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBoundGenericType, int n |
+      b = 0 and
+      bBoundGenericType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBoundGenericType(e, i, _)) | i) and
+      n = bBoundGenericType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBoundGenericType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBoundGenericEnumType(
+    BoundGenericEnumType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBoundGenericType, int n |
+      b = 0 and
+      bBoundGenericType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBoundGenericType(e, i, _)) | i) and
+      n = bBoundGenericType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBoundGenericType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBoundGenericStructType(
+    BoundGenericStructType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBoundGenericType, int n |
+      b = 0 and
+      bBoundGenericType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBoundGenericType(e, i, _)) | i) and
+      n = bBoundGenericType and
+      (
+        none()
+        or
+        result = getImmediateChildOfBoundGenericType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBridgeFromObjCExpr(
+    BridgeFromObjCExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBridgeToObjCExpr(
+    BridgeToObjCExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBuiltinLiteralExpr(
+    BuiltinLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLiteralExpr, int n |
+      b = 0 and
+      bLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLiteralExpr(e, i, _)) | i) and
+      n = bLiteralExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfLiteralExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCallExpr(CallExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bApplyExpr, int n |
+      b = 0 and
+      bApplyExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfApplyExpr(e, i, _)) | i) and
+      n = bApplyExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfApplyExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCheckedCastExpr(
+    CheckedCastExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bExplicitCastExpr, int n |
+      b = 0 and
+      bExplicitCastExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExplicitCastExpr(e, i, _)) | i) and
+      n = bExplicitCastExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExplicitCastExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfClassMetatypeToObjectExpr(
+    ClassMetatypeToObjectExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfClassType(ClassType e, int index, string partialPredicateCall) {
+    exists(int b, int bNominalType, int n |
+      b = 0 and
+      bNominalType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfNominalType(e, i, _)) | i) and
+      n = bNominalType and
+      (
+        none()
+        or
+        result = getImmediateChildOfNominalType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfClosureExpr(
+    ClosureExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAbstractClosureExpr, int n |
+      b = 0 and
+      bAbstractClosureExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAbstractClosureExpr(e, i, _)) | i) and
+      n = bAbstractClosureExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfAbstractClosureExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCoerceExpr(CoerceExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bExplicitCastExpr, int n |
+      b = 0 and
+      bExplicitCastExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfExplicitCastExpr(e, i, _)) | i) and
+      n = bExplicitCastExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfExplicitCastExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCollectionUpcastConversionExpr(
+    CollectionUpcastConversionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfConditionalBridgeFromObjCExpr(
+    ConditionalBridgeFromObjCExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCovariantFunctionConversionExpr(
+    CovariantFunctionConversionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfCovariantReturnConversionExpr(
+    CovariantReturnConversionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDerivedToBaseExpr(
+    DerivedToBaseExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDestructureTupleExpr(
+    DestructureTupleExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDictionaryExpr(
+    DictionaryExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bCollectionExpr, int n, int nElement |
+      b = 0 and
+      bCollectionExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfCollectionExpr(e, i, _)) | i) and
+      n = bCollectionExpr and
+      nElement = n + 1 + max(int i | i = -1 or exists(e.getImmediateElement(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfCollectionExpr(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateElement(index - n) and
+        partialPredicateCall = "Element(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDifferentiableFunctionExpr(
+    DifferentiableFunctionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDifferentiableFunctionExtractOriginalExpr(
+    DifferentiableFunctionExtractOriginalExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDoCatchStmt(
+    DoCatchStmt e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLabeledStmt, int n, int nBody, int nCatch |
+      b = 0 and
+      bLabeledStmt =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLabeledStmt(e, i, _)) | i) and
+      n = bLabeledStmt and
+      nBody = n + 1 and
+      nCatch = nBody + 1 + max(int i | i = -1 or exists(e.getImmediateCatch(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfLabeledStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+        or
+        result = e.getImmediateCatch(index - nBody) and
+        partialPredicateCall = "Catch(" + (index - nBody).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDoStmt(DoStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bLabeledStmt, int n, int nBody |
+      b = 0 and
+      bLabeledStmt =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLabeledStmt(e, i, _)) | i) and
+      n = bLabeledStmt and
+      nBody = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfLabeledStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDotSelfExpr(
+    DotSelfExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bIdentityExpr, int n |
+      b = 0 and
+      bIdentityExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfIdentityExpr(e, i, _)) | i) and
+      n = bIdentityExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfIdentityExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDynamicLookupExpr(
+    DynamicLookupExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLookupExpr, int n |
+      b = 0 and
+      bLookupExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLookupExpr(e, i, _)) | i) and
+      n = bLookupExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfLookupExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfEnumElementDecl(
+    EnumElementDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bValueDecl, int n, int nParam |
+      b = 0 and
+      bValueDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfValueDecl(e, i, _)) | i) and
+      n = bValueDecl and
+      nParam = n + 1 + max(int i | i = -1 or exists(e.getImmediateParam(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfValueDecl(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateParam(index - n) and
+        partialPredicateCall = "Param(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfEnumType(EnumType e, int index, string partialPredicateCall) {
+    exists(int b, int bNominalType, int n |
+      b = 0 and
+      bNominalType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfNominalType(e, i, _)) | i) and
+      n = bNominalType and
+      (
+        none()
+        or
+        result = getImmediateChildOfNominalType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfErasureExpr(
+    ErasureExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfExistentialMetatypeToObjectExpr(
+    ExistentialMetatypeToObjectExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfForEachStmt(
+    ForEachStmt e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLabeledStmt, int n, int nPattern, int nSequence, int nWhere, int nBody |
+      b = 0 and
+      bLabeledStmt =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLabeledStmt(e, i, _)) | i) and
+      n = bLabeledStmt and
+      nPattern = n + 1 and
+      nSequence = nPattern + 1 and
+      nWhere = nSequence + 1 and
+      nBody = nWhere + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfLabeledStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediatePattern() and partialPredicateCall = "Pattern()"
+        or
+        index = nPattern and
+        result = e.getImmediateSequence() and
+        partialPredicateCall = "Sequence()"
+        or
+        index = nSequence and result = e.getImmediateWhere() and partialPredicateCall = "Where()"
+        or
+        index = nWhere and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfForceTryExpr(
+    ForceTryExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAnyTryExpr, int n |
+      b = 0 and
+      bAnyTryExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyTryExpr(e, i, _)) | i) and
+      n = bAnyTryExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyTryExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfForeignObjectConversionExpr(
+    ForeignObjectConversionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfFunctionConversionExpr(
+    FunctionConversionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfInOutToPointerExpr(
+    InOutToPointerExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfInfixOperatorDecl(
+    InfixOperatorDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bOperatorDecl, int n |
+      b = 0 and
+      bOperatorDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfOperatorDecl(e, i, _)) | i) and
+      n = bOperatorDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfOperatorDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfInjectIntoOptionalExpr(
+    InjectIntoOptionalExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfInterpolatedStringLiteralExpr(
+    InterpolatedStringLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(
+      int b, int bLiteralExpr, int n, int nInterpolationCountExpr, int nLiteralCapacityExpr,
+      int nAppendingExpr
+    |
+      b = 0 and
+      bLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLiteralExpr(e, i, _)) | i) and
+      n = bLiteralExpr and
+      nInterpolationCountExpr = n + 1 and
+      nLiteralCapacityExpr = nInterpolationCountExpr + 1 and
+      nAppendingExpr = nLiteralCapacityExpr + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfLiteralExpr(e, index - b, partialPredicateCall)
+        or
+        index = n and
+        result = e.getImmediateInterpolationCountExpr() and
+        partialPredicateCall = "InterpolationCountExpr()"
+        or
+        index = nInterpolationCountExpr and
+        result = e.getImmediateLiteralCapacityExpr() and
+        partialPredicateCall = "LiteralCapacityExpr()"
+        or
+        index = nLiteralCapacityExpr and
+        result = e.getImmediateAppendingExpr() and
+        partialPredicateCall = "AppendingExpr()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLabeledConditionalStmt(
+    LabeledConditionalStmt e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLabeledStmt, int n, int nCondition |
+      b = 0 and
+      bLabeledStmt =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLabeledStmt(e, i, _)) | i) and
+      n = bLabeledStmt and
+      nCondition = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfLabeledStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateCondition() and partialPredicateCall = "Condition()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLinearFunctionExpr(
+    LinearFunctionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLinearFunctionExtractOriginalExpr(
+    LinearFunctionExtractOriginalExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLinearToDifferentiableFunctionExpr(
+    LinearToDifferentiableFunctionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfLoadExpr(LoadExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfMemberRefExpr(
+    MemberRefExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLookupExpr, int n |
+      b = 0 and
+      bLookupExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLookupExpr(e, i, _)) | i) and
+      n = bLookupExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfLookupExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfMetatypeConversionExpr(
+    MetatypeConversionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfMethodRefExpr(
+    MethodRefExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLookupExpr, int n |
+      b = 0 and
+      bLookupExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLookupExpr(e, i, _)) | i) and
+      n = bLookupExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfLookupExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfNilLiteralExpr(
+    NilLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLiteralExpr, int n |
+      b = 0 and
+      bLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLiteralExpr(e, i, _)) | i) and
+      n = bLiteralExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfLiteralExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfObjectLiteralExpr(
+    ObjectLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLiteralExpr, int n |
+      b = 0 and
+      bLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLiteralExpr(e, i, _)) | i) and
+      n = bLiteralExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfLiteralExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOptionalTryExpr(
+    OptionalTryExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAnyTryExpr, int n |
+      b = 0 and
+      bAnyTryExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyTryExpr(e, i, _)) | i) and
+      n = bAnyTryExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyTryExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOptionalType(
+    OptionalType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bUnarySyntaxSugarType, int n |
+      b = 0 and
+      bUnarySyntaxSugarType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfUnarySyntaxSugarType(e, i, _)) | i) and
+      n = bUnarySyntaxSugarType and
+      (
+        none()
+        or
+        result = getImmediateChildOfUnarySyntaxSugarType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOverloadedDeclRefExpr(
+    OverloadedDeclRefExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bOverloadSetRefExpr, int n |
+      b = 0 and
+      bOverloadSetRefExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfOverloadSetRefExpr(e, i, _)) | i) and
+      n = bOverloadSetRefExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfOverloadSetRefExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfParenExpr(ParenExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bIdentityExpr, int n |
+      b = 0 and
+      bIdentityExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfIdentityExpr(e, i, _)) | i) and
+      n = bIdentityExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfIdentityExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPointerToPointerExpr(
+    PointerToPointerExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPostfixOperatorDecl(
+    PostfixOperatorDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bOperatorDecl, int n |
+      b = 0 and
+      bOperatorDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfOperatorDecl(e, i, _)) | i) and
+      n = bOperatorDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfOperatorDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPostfixUnaryExpr(
+    PostfixUnaryExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bApplyExpr, int n |
+      b = 0 and
+      bApplyExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfApplyExpr(e, i, _)) | i) and
+      n = bApplyExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfApplyExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPrefixOperatorDecl(
+    PrefixOperatorDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bOperatorDecl, int n |
+      b = 0 and
+      bOperatorDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfOperatorDecl(e, i, _)) | i) and
+      n = bOperatorDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfOperatorDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfPrefixUnaryExpr(
+    PrefixUnaryExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bApplyExpr, int n |
+      b = 0 and
+      bApplyExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfApplyExpr(e, i, _)) | i) and
+      n = bApplyExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfApplyExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfProtocolMetatypeToObjectExpr(
+    ProtocolMetatypeToObjectExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfProtocolType(
+    ProtocolType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bNominalType, int n |
+      b = 0 and
+      bNominalType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfNominalType(e, i, _)) | i) and
+      n = bNominalType and
+      (
+        none()
+        or
+        result = getImmediateChildOfNominalType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfRegexLiteralExpr(
+    RegexLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLiteralExpr, int n |
+      b = 0 and
+      bLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLiteralExpr(e, i, _)) | i) and
+      n = bLiteralExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfLiteralExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfRepeatWhileStmt(
+    RepeatWhileStmt e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLabeledStmt, int n, int nCondition, int nBody |
+      b = 0 and
+      bLabeledStmt =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLabeledStmt(e, i, _)) | i) and
+      n = bLabeledStmt and
+      nCondition = n + 1 and
+      nBody = nCondition + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfLabeledStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateCondition() and partialPredicateCall = "Condition()"
+        or
+        index = nCondition and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSelfApplyExpr(
+    SelfApplyExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bApplyExpr, int n |
+      b = 0 and
+      bApplyExpr = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfApplyExpr(e, i, _)) | i) and
+      n = bApplyExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfApplyExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfStringToPointerExpr(
+    StringToPointerExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfStructType(StructType e, int index, string partialPredicateCall) {
+    exists(int b, int bNominalType, int n |
+      b = 0 and
+      bNominalType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfNominalType(e, i, _)) | i) and
+      n = bNominalType and
+      (
+        none()
+        or
+        result = getImmediateChildOfNominalType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSubscriptExpr(
+    SubscriptExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bLookupExpr, int n, int nArgument |
+      b = 0 and
+      bLookupExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLookupExpr(e, i, _)) | i) and
+      n = bLookupExpr and
+      nArgument = n + 1 + max(int i | i = -1 or exists(e.getImmediateArgument(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfLookupExpr(e, index - b, partialPredicateCall)
+        or
+        result = e.getImmediateArgument(index - n) and
+        partialPredicateCall = "Argument(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSwitchStmt(SwitchStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bLabeledStmt, int n, int nExpr, int nCase |
+      b = 0 and
+      bLabeledStmt =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfLabeledStmt(e, i, _)) | i) and
+      n = bLabeledStmt and
+      nExpr = n + 1 and
+      nCase = nExpr + 1 + max(int i | i = -1 or exists(e.getImmediateCase(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfLabeledStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateExpr() and partialPredicateCall = "Expr()"
+        or
+        result = e.getImmediateCase(index - nExpr) and
+        partialPredicateCall = "Case(" + (index - nExpr).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTryExpr(TryExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bAnyTryExpr, int n |
+      b = 0 and
+      bAnyTryExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAnyTryExpr(e, i, _)) | i) and
+      n = bAnyTryExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfAnyTryExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTypeDecl(TypeDecl e, int index, string partialPredicateCall) {
+    exists(int b, int bValueDecl, int n |
+      b = 0 and
+      bValueDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfValueDecl(e, i, _)) | i) and
+      n = bValueDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfValueDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnderlyingToOpaqueExpr(
+    UnderlyingToOpaqueExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnevaluatedInstanceExpr(
+    UnevaluatedInstanceExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      n = bImplicitConversionExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnresolvedMemberChainResultExpr(
+    UnresolvedMemberChainResultExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bIdentityExpr, int bUnresolvedElement, int n |
+      b = 0 and
+      bIdentityExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfIdentityExpr(e, i, _)) | i) and
+      bUnresolvedElement =
+        bIdentityExpr + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfUnresolvedElement(e, i, _)) | i) and
+      n = bUnresolvedElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfIdentityExpr(e, index - b, partialPredicateCall)
+        or
+        result =
+          getImmediateChildOfUnresolvedElement(e, index - bIdentityExpr, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfUnresolvedTypeConversionExpr(
+    UnresolvedTypeConversionExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bImplicitConversionExpr, int bUnresolvedElement, int n |
+      b = 0 and
+      bImplicitConversionExpr =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfImplicitConversionExpr(e, i, _)) | i) and
+      bUnresolvedElement =
+        bImplicitConversionExpr + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfUnresolvedElement(e, i, _)) | i) and
+      n = bUnresolvedElement and
+      (
+        none()
+        or
+        result = getImmediateChildOfImplicitConversionExpr(e, index - b, partialPredicateCall)
+        or
+        result =
+          getImmediateChildOfUnresolvedElement(e, index - bImplicitConversionExpr,
+            partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfVariadicSequenceType(
+    VariadicSequenceType e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bUnarySyntaxSugarType, int n |
+      b = 0 and
+      bUnarySyntaxSugarType =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfUnarySyntaxSugarType(e, i, _)) | i) and
+      n = bUnarySyntaxSugarType and
+      (
+        none()
+        or
+        result = getImmediateChildOfUnarySyntaxSugarType(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAbstractTypeParamDecl(
+    AbstractTypeParamDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bTypeDecl, int n |
+      b = 0 and
+      bTypeDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfTypeDecl(e, i, _)) | i) and
+      n = bTypeDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfTypeDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfBooleanLiteralExpr(
+    BooleanLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinLiteralExpr, int n |
+      b = 0 and
+      bBuiltinLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinLiteralExpr(e, i, _)) | i) and
+      n = bBuiltinLiteralExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinLiteralExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfConditionalCheckedCastExpr(
+    ConditionalCheckedCastExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bCheckedCastExpr, int n |
+      b = 0 and
+      bCheckedCastExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfCheckedCastExpr(e, i, _)) | i) and
+      n = bCheckedCastExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfCheckedCastExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfConstructorDecl(
+    ConstructorDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAbstractFunctionDecl, int n |
+      b = 0 and
+      bAbstractFunctionDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAbstractFunctionDecl(e, i, _)) | i) and
+      n = bAbstractFunctionDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfAbstractFunctionDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfConstructorRefCallExpr(
+    ConstructorRefCallExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bSelfApplyExpr, int n |
+      b = 0 and
+      bSelfApplyExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfSelfApplyExpr(e, i, _)) | i) and
+      n = bSelfApplyExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfSelfApplyExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDestructorDecl(
+    DestructorDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAbstractFunctionDecl, int n |
+      b = 0 and
+      bAbstractFunctionDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAbstractFunctionDecl(e, i, _)) | i) and
+      n = bAbstractFunctionDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfAbstractFunctionDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDotSyntaxCallExpr(
+    DotSyntaxCallExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bSelfApplyExpr, int n |
+      b = 0 and
+      bSelfApplyExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfSelfApplyExpr(e, i, _)) | i) and
+      n = bSelfApplyExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfSelfApplyExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDynamicMemberRefExpr(
+    DynamicMemberRefExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bDynamicLookupExpr, int n |
+      b = 0 and
+      bDynamicLookupExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDynamicLookupExpr(e, i, _)) | i) and
+      n = bDynamicLookupExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfDynamicLookupExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfDynamicSubscriptExpr(
+    DynamicSubscriptExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bDynamicLookupExpr, int n |
+      b = 0 and
+      bDynamicLookupExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfDynamicLookupExpr(e, i, _)) | i) and
+      n = bDynamicLookupExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfDynamicLookupExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfForcedCheckedCastExpr(
+    ForcedCheckedCastExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bCheckedCastExpr, int n |
+      b = 0 and
+      bCheckedCastExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfCheckedCastExpr(e, i, _)) | i) and
+      n = bCheckedCastExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfCheckedCastExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfFuncDecl(FuncDecl e, int index, string partialPredicateCall) {
+    exists(int b, int bAbstractFunctionDecl, int n |
+      b = 0 and
+      bAbstractFunctionDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAbstractFunctionDecl(e, i, _)) | i) and
+      n = bAbstractFunctionDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfAbstractFunctionDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfGenericTypeDecl(
+    GenericTypeDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bGenericContext, int bTypeDecl, int n |
+      b = 0 and
+      bGenericContext =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfGenericContext(e, i, _)) | i) and
+      bTypeDecl =
+        bGenericContext + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfTypeDecl(e, i, _)) | i) and
+      n = bTypeDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfGenericContext(e, index - b, partialPredicateCall)
+        or
+        result = getImmediateChildOfTypeDecl(e, index - bGenericContext, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfGuardStmt(GuardStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bLabeledConditionalStmt, int n, int nBody |
+      b = 0 and
+      bLabeledConditionalStmt =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfLabeledConditionalStmt(e, i, _)) | i) and
+      n = bLabeledConditionalStmt and
+      nBody = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfLabeledConditionalStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfIfStmt(IfStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bLabeledConditionalStmt, int n, int nThen, int nElse |
+      b = 0 and
+      bLabeledConditionalStmt =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfLabeledConditionalStmt(e, i, _)) | i) and
+      n = bLabeledConditionalStmt and
+      nThen = n + 1 and
+      nElse = nThen + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfLabeledConditionalStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateThen() and partialPredicateCall = "Then()"
+        or
+        index = nThen and result = e.getImmediateElse() and partialPredicateCall = "Else()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfIsExpr(IsExpr e, int index, string partialPredicateCall) {
+    exists(int b, int bCheckedCastExpr, int n |
+      b = 0 and
+      bCheckedCastExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfCheckedCastExpr(e, i, _)) | i) and
+      n = bCheckedCastExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfCheckedCastExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfMagicIdentifierLiteralExpr(
+    MagicIdentifierLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinLiteralExpr, int n |
+      b = 0 and
+      bBuiltinLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinLiteralExpr(e, i, _)) | i) and
+      n = bBuiltinLiteralExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinLiteralExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfModuleDecl(ModuleDecl e, int index, string partialPredicateCall) {
+    exists(int b, int bTypeDecl, int n |
+      b = 0 and
+      bTypeDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfTypeDecl(e, i, _)) | i) and
+      n = bTypeDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfTypeDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfNumberLiteralExpr(
+    NumberLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinLiteralExpr, int n |
+      b = 0 and
+      bBuiltinLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinLiteralExpr(e, i, _)) | i) and
+      n = bBuiltinLiteralExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinLiteralExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfStringLiteralExpr(
+    StringLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bBuiltinLiteralExpr, int n |
+      b = 0 and
+      bBuiltinLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfBuiltinLiteralExpr(e, i, _)) | i) and
+      n = bBuiltinLiteralExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfBuiltinLiteralExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfSubscriptDecl(
+    SubscriptDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAbstractStorageDecl, int bGenericContext, int n, int nParam |
+      b = 0 and
+      bAbstractStorageDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAbstractStorageDecl(e, i, _)) | i) and
+      bGenericContext =
+        bAbstractStorageDecl + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfGenericContext(e, i, _)) | i) and
+      n = bGenericContext and
+      nParam = n + 1 + max(int i | i = -1 or exists(e.getImmediateParam(i)) | i) and
+      (
+        none()
+        or
+        result = getImmediateChildOfAbstractStorageDecl(e, index - b, partialPredicateCall)
+        or
+        result =
+          getImmediateChildOfGenericContext(e, index - bAbstractStorageDecl, partialPredicateCall)
+        or
+        result = e.getImmediateParam(index - n) and
+        partialPredicateCall = "Param(" + (index - n).toString() + ")"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfVarDecl(VarDecl e, int index, string partialPredicateCall) {
+    exists(int b, int bAbstractStorageDecl, int n |
+      b = 0 and
+      bAbstractStorageDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAbstractStorageDecl(e, i, _)) | i) and
+      n = bAbstractStorageDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfAbstractStorageDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfWhileStmt(WhileStmt e, int index, string partialPredicateCall) {
+    exists(int b, int bLabeledConditionalStmt, int n, int nBody |
+      b = 0 and
+      bLabeledConditionalStmt =
+        b + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfLabeledConditionalStmt(e, i, _)) | i) and
+      n = bLabeledConditionalStmt and
+      nBody = n + 1 and
+      (
+        none()
+        or
+        result = getImmediateChildOfLabeledConditionalStmt(e, index - b, partialPredicateCall)
+        or
+        index = n and result = e.getImmediateBody() and partialPredicateCall = "Body()"
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAccessorDecl(
+    AccessorDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bFuncDecl, int n |
+      b = 0 and
+      bFuncDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfFuncDecl(e, i, _)) | i) and
+      n = bFuncDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfFuncDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfAssociatedTypeDecl(
+    AssociatedTypeDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAbstractTypeParamDecl, int n |
+      b = 0 and
+      bAbstractTypeParamDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAbstractTypeParamDecl(e, i, _)) | i) and
+      n = bAbstractTypeParamDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfAbstractTypeParamDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfConcreteFuncDecl(
+    ConcreteFuncDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bFuncDecl, int n |
+      b = 0 and
+      bFuncDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfFuncDecl(e, i, _)) | i) and
+      n = bFuncDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfFuncDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfConcreteVarDecl(
+    ConcreteVarDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bVarDecl, int n |
+      b = 0 and
+      bVarDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfVarDecl(e, i, _)) | i) and
+      n = bVarDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfVarDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfFloatLiteralExpr(
+    FloatLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bNumberLiteralExpr, int n |
+      b = 0 and
+      bNumberLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfNumberLiteralExpr(e, i, _)) | i) and
+      n = bNumberLiteralExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfNumberLiteralExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfGenericTypeParamDecl(
+    GenericTypeParamDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bAbstractTypeParamDecl, int n |
+      b = 0 and
+      bAbstractTypeParamDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfAbstractTypeParamDecl(e, i, _)) | i) and
+      n = bAbstractTypeParamDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfAbstractTypeParamDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfIntegerLiteralExpr(
+    IntegerLiteralExpr e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bNumberLiteralExpr, int n |
+      b = 0 and
+      bNumberLiteralExpr =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfNumberLiteralExpr(e, i, _)) | i) and
+      n = bNumberLiteralExpr and
+      (
+        none()
+        or
+        result = getImmediateChildOfNumberLiteralExpr(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfNominalTypeDecl(
+    NominalTypeDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bGenericTypeDecl, int bIterableDeclContext, int n |
+      b = 0 and
+      bGenericTypeDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfGenericTypeDecl(e, i, _)) | i) and
+      bIterableDeclContext =
+        bGenericTypeDecl + 1 +
+          max(int i | i = -1 or exists(getImmediateChildOfIterableDeclContext(e, i, _)) | i) and
+      n = bIterableDeclContext and
+      (
+        none()
+        or
+        result = getImmediateChildOfGenericTypeDecl(e, index - b, partialPredicateCall)
+        or
+        result =
+          getImmediateChildOfIterableDeclContext(e, index - bGenericTypeDecl, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfOpaqueTypeDecl(
+    OpaqueTypeDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bGenericTypeDecl, int n |
+      b = 0 and
+      bGenericTypeDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfGenericTypeDecl(e, i, _)) | i) and
+      n = bGenericTypeDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfGenericTypeDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfParamDecl(ParamDecl e, int index, string partialPredicateCall) {
+    exists(int b, int bVarDecl, int n |
+      b = 0 and
+      bVarDecl = b + 1 + max(int i | i = -1 or exists(getImmediateChildOfVarDecl(e, i, _)) | i) and
+      n = bVarDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfVarDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfTypeAliasDecl(
+    TypeAliasDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bGenericTypeDecl, int n |
+      b = 0 and
+      bGenericTypeDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfGenericTypeDecl(e, i, _)) | i) and
+      n = bGenericTypeDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfGenericTypeDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfClassDecl(ClassDecl e, int index, string partialPredicateCall) {
+    exists(int b, int bNominalTypeDecl, int n |
+      b = 0 and
+      bNominalTypeDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfNominalTypeDecl(e, i, _)) | i) and
+      n = bNominalTypeDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfNominalTypeDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfEnumDecl(EnumDecl e, int index, string partialPredicateCall) {
+    exists(int b, int bNominalTypeDecl, int n |
+      b = 0 and
+      bNominalTypeDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfNominalTypeDecl(e, i, _)) | i) and
+      n = bNominalTypeDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfNominalTypeDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfProtocolDecl(
+    ProtocolDecl e, int index, string partialPredicateCall
+  ) {
+    exists(int b, int bNominalTypeDecl, int n |
+      b = 0 and
+      bNominalTypeDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfNominalTypeDecl(e, i, _)) | i) and
+      n = bNominalTypeDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfNominalTypeDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  private Element getImmediateChildOfStructDecl(StructDecl e, int index, string partialPredicateCall) {
+    exists(int b, int bNominalTypeDecl, int n |
+      b = 0 and
+      bNominalTypeDecl =
+        b + 1 + max(int i | i = -1 or exists(getImmediateChildOfNominalTypeDecl(e, i, _)) | i) and
+      n = bNominalTypeDecl and
+      (
+        none()
+        or
+        result = getImmediateChildOfNominalTypeDecl(e, index - b, partialPredicateCall)
+      )
+    )
+  }
+
+  cached
+  Element getImmediateChild(Element e, int index, string partialAccessor) {
+    // why does this look more complicated than it should?
+    // * none() simplifies generation, as we can append `or ...` without a special case for the first item
+    none()
+    or
+    result = getImmediateChildOfArgument(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfComment(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfConditionElement(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDbFile(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDbLocation(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDependentMemberType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDynamicSelfType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfErrorType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfExistentialType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfInOutType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfLValueType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfModuleType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPlaceholderType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfProtocolCompositionType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfSilBlockStorageType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfSilBoxType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfSilFunctionType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfSilTokenType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTupleType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTypeVariableType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnknownFile(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnknownLocation(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnresolvedType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinBridgeObjectType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinDefaultActorStorageType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinExecutorType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinFloatType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinJobType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinNativeObjectType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinRawPointerType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinRawUnsafeContinuationType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinUnsafeValueBufferType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinVectorType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfCaseLabelItem(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfExistentialMetatypeType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfFunctionType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfGenericFunctionType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfGenericTypeParamType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfMetatypeType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfParenType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfStmtCondition(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTypeAliasType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTypeRepr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnboundGenericType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnmanagedStorageType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnownedStorageType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfWeakStorageType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfAnyPattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfAppliedPropertyWrapperExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfArrowExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfAssignExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBindOptionalExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBindingPattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBoolPattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBraceStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBreakStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinIntegerLiteralType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBuiltinIntegerType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfCaptureListExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfCaseStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfCodeCompletionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfContinueStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDeclRefExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDefaultArgumentExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDeferStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDictionaryType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDiscardAssignmentExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDotSyntaxBaseIgnoredExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDynamicTypeExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfEditorPlaceholderExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfEnumCaseDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfEnumElementPattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfEnumIsCaseExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfErrorExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfExprPattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfExtensionDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfFailStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfFallthroughStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfForceValueExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfIfConfigDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfIfExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfImportDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfInOutExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfIsPattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfKeyPathApplicationExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfKeyPathDotExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfKeyPathExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfLazyInitializerExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfMakeTemporarilyEscapableExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfMissingMemberDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfNamedPattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfNestedArchetypeType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfObjCSelectorExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOneWayExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOpaqueTypeArchetypeType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOpaqueValueExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOpenExistentialExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOpenedArchetypeType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOptionalEvaluationExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOptionalSomePattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOtherConstructorDeclRefExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfParenPattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPatternBindingDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPoundAssertStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPoundDiagnosticDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPrecedenceGroupDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPrimaryArchetypeType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPropertyWrapperValuePlaceholderExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfRebindSelfInConstructorExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfReturnStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfSequenceArchetypeType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfSequenceExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfSuperRefExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTapExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfThrowStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTopLevelCodeDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTupleElementExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTupleExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTuplePattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTypeExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTypedPattern(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnresolvedDeclRefExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnresolvedDotExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnresolvedMemberExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnresolvedPatternExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnresolvedSpecializeExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfVarargExpansionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfYieldStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfAnyHashableErasureExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfArchetypeToSuperExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfArrayExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfArraySliceType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfArrayToPointerExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfAutoClosureExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfAwaitExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBinaryExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBoundGenericClassType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBoundGenericEnumType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBoundGenericStructType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBridgeFromObjCExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBridgeToObjCExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfCallExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfClassMetatypeToObjectExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfClassType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfClosureExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfCoerceExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfCollectionUpcastConversionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfConditionalBridgeFromObjCExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfCovariantFunctionConversionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfCovariantReturnConversionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDerivedToBaseExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDestructureTupleExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDictionaryExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDifferentiableFunctionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDifferentiableFunctionExtractOriginalExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDoCatchStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDoStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDotSelfExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfEnumElementDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfEnumType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfErasureExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfExistentialMetatypeToObjectExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfForEachStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfForceTryExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfForeignObjectConversionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfFunctionConversionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfInOutToPointerExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfInfixOperatorDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfInjectIntoOptionalExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfInterpolatedStringLiteralExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfLinearFunctionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfLinearFunctionExtractOriginalExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfLinearToDifferentiableFunctionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfLoadExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfMemberRefExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfMetatypeConversionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfMethodRefExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfNilLiteralExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfObjectLiteralExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOptionalTryExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOptionalType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOverloadedDeclRefExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfParenExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPointerToPointerExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPostfixOperatorDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPostfixUnaryExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPrefixOperatorDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfPrefixUnaryExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfProtocolMetatypeToObjectExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfProtocolType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfRegexLiteralExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfRepeatWhileStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfStringToPointerExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfStructType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfSubscriptExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfSwitchStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTryExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnderlyingToOpaqueExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnevaluatedInstanceExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnresolvedMemberChainResultExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfUnresolvedTypeConversionExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfVariadicSequenceType(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfBooleanLiteralExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfConditionalCheckedCastExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfConstructorDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfConstructorRefCallExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDestructorDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDotSyntaxCallExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDynamicMemberRefExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfDynamicSubscriptExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfForcedCheckedCastExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfGuardStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfIfStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfIsExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfMagicIdentifierLiteralExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfModuleDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfStringLiteralExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfSubscriptDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfWhileStmt(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfAccessorDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfAssociatedTypeDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfConcreteFuncDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfConcreteVarDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfFloatLiteralExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfGenericTypeParamDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfIntegerLiteralExpr(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfOpaqueTypeDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfParamDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfTypeAliasDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfClassDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfEnumDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfProtocolDecl(e, index, partialAccessor)
+    or
+    result = getImmediateChildOfStructDecl(e, index, partialAccessor)
+  }
+}
+
+/**
+ * Gets the "immediate" parent of `e`. "Immediate" means not taking into account node resolution: for example
+ * if `e` has conversions, `getImmediateParent(e)` will give the innermost conversion in the hidden AST.
+ */
+Element getImmediateParent(Element e) {
+  // `unique` is used here to tell the optimizer that there is in fact only one result
+  // this is tested by the `library-tests/parent/no_double_parents.ql` test
+  result = unique(Element x | e = Impl::getImmediateChild(x, _, _) | x)
+}
+
+/**
+ * Gets the immediate child indexed at `index`. Indexes are not guaranteed to be contiguous, but are guaranteed to be distinct. `accessor` is bound the member predicate call resulting in the given child.
+ */
+Element getImmediateChildAndAccessor(Element e, int index, string accessor) {
+  exists(string partialAccessor |
+    result = Impl::getImmediateChild(e, index, partialAccessor) and
+    accessor = "getImmediate" + partialAccessor
+  )
+}
+
+/**
+ * Gets the child indexed at `index`. Indexes are not guaranteed to be contiguous, but are guaranteed to be distinct. `accessor` is bound the member predicate call resulting in the given child.
+ */
+Element getChildAndAccessor(Element e, int index, string accessor) {
+  exists(string partialAccessor |
+    result = Impl::getImmediateChild(e, index, partialAccessor).resolve() and
+    accessor = "get" + partialAccessor
+  )
+}
diff --git a/swift/ql/lib/codeql/swift/generated/Raw.qll b/swift/ql/lib/codeql/swift/generated/Raw.qll
index ac0feeac66f..8cb3b6d51d6 100644
--- a/swift/ql/lib/codeql/swift/generated/Raw.qll
+++ b/swift/ql/lib/codeql/swift/generated/Raw.qll
@@ -6,10 +6,10 @@ module Raw {
   }
 
   class Callable extends @callable, Element {
-    ParamDecl getParam(int index) { callable_params(this, index, result) }
-
     ParamDecl getSelfParam() { callable_self_params(this, result) }
 
+    ParamDecl getParam(int index) { callable_params(this, index, result) }
+
     BraceStmt getBody() { callable_bodies(this, result) }
   }
 
@@ -49,6 +49,8 @@ module Raw {
     Type getCanonicalType() { types(this, _, result) }
   }
 
+  class UnresolvedElement extends @unresolved_element, Element { }
+
   class AnyFunctionType extends @any_function_type, Type {
     Type getResult() { any_function_types(this, result) }
 
@@ -129,16 +131,6 @@ module Raw {
     Type getConstraint() { existential_types(this, result) }
   }
 
-  class IfConfigClause extends @if_config_clause, Locatable {
-    override string toString() { result = "IfConfigClause" }
-
-    Expr getCondition() { if_config_clause_conditions(this, result) }
-
-    AstNode getElement(int index) { if_config_clause_elements(this, index, result) }
-
-    predicate isActive() { if_config_clause_is_active(this) }
-  }
-
   class InOutType extends @in_out_type, Type {
     override string toString() { result = "InOutType" }
 
@@ -203,7 +195,7 @@ module Raw {
     override string toString() { result = "TypeVariableType" }
   }
 
-  class UnresolvedType extends @unresolved_type, Type {
+  class UnresolvedType extends @unresolved_type, Type, UnresolvedElement {
     override string toString() { result = "UnresolvedType" }
   }
 
@@ -327,7 +319,7 @@ module Raw {
   class TypeRepr extends @type_repr, AstNode {
     override string toString() { result = "TypeRepr" }
 
-    Type getType() { type_repr_types(this, result) }
+    Type getType() { type_reprs(this, result) }
   }
 
   class UnboundGenericType extends @unbound_generic_type, AnyGenericType {
@@ -346,7 +338,7 @@ module Raw {
     override string toString() { result = "WeakStorageType" }
   }
 
-  class AbstractClosureExpr extends @abstract_closure_expr, Callable, Expr { }
+  class AbstractClosureExpr extends @abstract_closure_expr, Expr, Callable { }
 
   class AnyPattern extends @any_pattern, Pattern {
     override string toString() { result = "AnyPattern" }
@@ -556,7 +548,7 @@ module Raw {
     Expr getSubExpr() { expr_patterns(this, result) }
   }
 
-  class ExtensionDecl extends @extension_decl, Decl, GenericContext, IterableDeclContext {
+  class ExtensionDecl extends @extension_decl, GenericContext, IterableDeclContext, Decl {
     override string toString() { result = "ExtensionDecl" }
 
     NominalTypeDecl getExtendedTypeDecl() { extension_decls(this, result) }
@@ -587,7 +579,7 @@ module Raw {
   class IfConfigDecl extends @if_config_decl, Decl {
     override string toString() { result = "IfConfigDecl" }
 
-    IfConfigClause getClause(int index) { if_config_decl_clauses(this, index, result) }
+    AstNode getActiveElement(int index) { if_config_decl_active_elements(this, index, result) }
   }
 
   class IfExpr extends @if_expr, Expr {
@@ -880,13 +872,13 @@ module Raw {
     Type getBaseType() { unary_syntax_sugar_types(this, result) }
   }
 
-  class UnresolvedDeclRefExpr extends @unresolved_decl_ref_expr, Expr {
+  class UnresolvedDeclRefExpr extends @unresolved_decl_ref_expr, Expr, UnresolvedElement {
     override string toString() { result = "UnresolvedDeclRefExpr" }
 
     string getName() { unresolved_decl_ref_expr_names(this, result) }
   }
 
-  class UnresolvedDotExpr extends @unresolved_dot_expr, Expr {
+  class UnresolvedDotExpr extends @unresolved_dot_expr, Expr, UnresolvedElement {
     override string toString() { result = "UnresolvedDotExpr" }
 
     Expr getBase() { unresolved_dot_exprs(this, result, _) }
@@ -894,19 +886,19 @@ module Raw {
     string getName() { unresolved_dot_exprs(this, _, result) }
   }
 
-  class UnresolvedMemberExpr extends @unresolved_member_expr, Expr {
+  class UnresolvedMemberExpr extends @unresolved_member_expr, Expr, UnresolvedElement {
     override string toString() { result = "UnresolvedMemberExpr" }
 
     string getName() { unresolved_member_exprs(this, result) }
   }
 
-  class UnresolvedPatternExpr extends @unresolved_pattern_expr, Expr {
+  class UnresolvedPatternExpr extends @unresolved_pattern_expr, Expr, UnresolvedElement {
     override string toString() { result = "UnresolvedPatternExpr" }
 
     Pattern getSubPattern() { unresolved_pattern_exprs(this, result) }
   }
 
-  class UnresolvedSpecializeExpr extends @unresolved_specialize_expr, Expr {
+  class UnresolvedSpecializeExpr extends @unresolved_specialize_expr, Expr, UnresolvedElement {
     override string toString() { result = "UnresolvedSpecializeExpr" }
   }
 
@@ -926,7 +918,7 @@ module Raw {
     Expr getResult(int index) { yield_stmt_results(this, index, result) }
   }
 
-  class AbstractFunctionDecl extends @abstract_function_decl, Callable, GenericContext, ValueDecl {
+  class AbstractFunctionDecl extends @abstract_function_decl, GenericContext, ValueDecl, Callable {
     string getName() { abstract_function_decls(this, result) }
   }
 
@@ -1311,12 +1303,13 @@ module Raw {
     override string toString() { result = "UnevaluatedInstanceExpr" }
   }
 
-  class UnresolvedMemberChainResultExpr extends @unresolved_member_chain_result_expr, IdentityExpr {
+  class UnresolvedMemberChainResultExpr extends @unresolved_member_chain_result_expr, IdentityExpr,
+    UnresolvedElement {
     override string toString() { result = "UnresolvedMemberChainResultExpr" }
   }
 
   class UnresolvedTypeConversionExpr extends @unresolved_type_conversion_expr,
-    ImplicitConversionExpr {
+    ImplicitConversionExpr, UnresolvedElement {
     override string toString() { result = "UnresolvedTypeConversionExpr" }
   }
 
@@ -1398,6 +1391,10 @@ module Raw {
     predicate isBuiltinModule() { module_decl_is_builtin_module(this) }
 
     predicate isSystemModule() { module_decl_is_system_module(this) }
+
+    ModuleDecl getImportedModule(int index) { module_decl_imported_modules(this, index, result) }
+
+    ModuleDecl getExportedModule(int index) { module_decl_exported_modules(this, index, result) }
   }
 
   class NumberLiteralExpr extends @number_literal_expr, BuiltinLiteralExpr { }
diff --git a/swift/ql/lib/codeql/swift/generated/Synth.qll b/swift/ql/lib/codeql/swift/generated/Synth.qll
index 1923e661c7b..708b204a481 100644
--- a/swift/ql/lib/codeql/swift/generated/Synth.qll
+++ b/swift/ql/lib/codeql/swift/generated/Synth.qll
@@ -22,7 +22,6 @@ module Synth {
     TEnumElementDecl(Raw::EnumElementDecl id) { constructEnumElementDecl(id) } or
     TExtensionDecl(Raw::ExtensionDecl id) { constructExtensionDecl(id) } or
     TGenericTypeParamDecl(Raw::GenericTypeParamDecl id) { constructGenericTypeParamDecl(id) } or
-    TIfConfigClause(Raw::IfConfigClause id) { constructIfConfigClause(id) } or
     TIfConfigDecl(Raw::IfConfigDecl id) { constructIfConfigDecl(id) } or
     TImportDecl(Raw::ImportDecl id) { constructImportDecl(id) } or
     TInfixOperatorDecl(Raw::InfixOperatorDecl id) { constructInfixOperatorDecl(id) } or
@@ -315,10 +314,15 @@ module Synth {
 
   class TFile = TDbFile or TUnknownFile;
 
-  class TLocatable = TArgument or TAstNode or TComment or TConditionElement or TIfConfigClause;
+  class TLocatable = TArgument or TAstNode or TComment or TConditionElement;
 
   class TLocation = TDbLocation or TUnknownLocation;
 
+  class TUnresolvedElement =
+    TUnresolvedDeclRefExpr or TUnresolvedDotExpr or TUnresolvedMemberChainResultExpr or
+        TUnresolvedMemberExpr or TUnresolvedPatternExpr or TUnresolvedSpecializeExpr or
+        TUnresolvedType or TUnresolvedTypeConversionExpr;
+
   class TAbstractFunctionDecl = TConstructorDecl or TDestructorDecl or TFuncDecl;
 
   class TAbstractStorageDecl = TSubscriptDecl or TVarDecl;
@@ -526,9 +530,6 @@ module Synth {
     result = TGenericTypeParamDecl(e)
   }
 
-  cached
-  TIfConfigClause convertIfConfigClauseFromRaw(Raw::Element e) { result = TIfConfigClause(e) }
-
   cached
   TIfConfigDecl convertIfConfigDeclFromRaw(Raw::Element e) { result = TIfConfigDecl(e) }
 
@@ -1420,6 +1421,8 @@ module Synth {
     result = convertLocationFromRaw(e)
     or
     result = convertTypeFromRaw(e)
+    or
+    result = convertUnresolvedElementFromRaw(e)
   }
 
   cached
@@ -1438,8 +1441,6 @@ module Synth {
     result = convertCommentFromRaw(e)
     or
     result = convertConditionElementFromRaw(e)
-    or
-    result = convertIfConfigClauseFromRaw(e)
   }
 
   cached
@@ -1449,6 +1450,25 @@ module Synth {
     result = convertUnknownLocationFromRaw(e)
   }
 
+  cached
+  TUnresolvedElement convertUnresolvedElementFromRaw(Raw::Element e) {
+    result = convertUnresolvedDeclRefExprFromRaw(e)
+    or
+    result = convertUnresolvedDotExprFromRaw(e)
+    or
+    result = convertUnresolvedMemberChainResultExprFromRaw(e)
+    or
+    result = convertUnresolvedMemberExprFromRaw(e)
+    or
+    result = convertUnresolvedPatternExprFromRaw(e)
+    or
+    result = convertUnresolvedSpecializeExprFromRaw(e)
+    or
+    result = convertUnresolvedTypeFromRaw(e)
+    or
+    result = convertUnresolvedTypeConversionExprFromRaw(e)
+  }
+
   cached
   TAbstractFunctionDecl convertAbstractFunctionDeclFromRaw(Raw::Element e) {
     result = convertConstructorDeclFromRaw(e)
@@ -2188,9 +2208,6 @@ module Synth {
     e = TGenericTypeParamDecl(result)
   }
 
-  cached
-  Raw::Element convertIfConfigClauseToRaw(TIfConfigClause e) { e = TIfConfigClause(result) }
-
   cached
   Raw::Element convertIfConfigDeclToRaw(TIfConfigDecl e) { e = TIfConfigDecl(result) }
 
@@ -3080,6 +3097,8 @@ module Synth {
     result = convertLocationToRaw(e)
     or
     result = convertTypeToRaw(e)
+    or
+    result = convertUnresolvedElementToRaw(e)
   }
 
   cached
@@ -3098,8 +3117,6 @@ module Synth {
     result = convertCommentToRaw(e)
     or
     result = convertConditionElementToRaw(e)
-    or
-    result = convertIfConfigClauseToRaw(e)
   }
 
   cached
@@ -3109,6 +3126,25 @@ module Synth {
     result = convertUnknownLocationToRaw(e)
   }
 
+  cached
+  Raw::Element convertUnresolvedElementToRaw(TUnresolvedElement e) {
+    result = convertUnresolvedDeclRefExprToRaw(e)
+    or
+    result = convertUnresolvedDotExprToRaw(e)
+    or
+    result = convertUnresolvedMemberChainResultExprToRaw(e)
+    or
+    result = convertUnresolvedMemberExprToRaw(e)
+    or
+    result = convertUnresolvedPatternExprToRaw(e)
+    or
+    result = convertUnresolvedSpecializeExprToRaw(e)
+    or
+    result = convertUnresolvedTypeToRaw(e)
+    or
+    result = convertUnresolvedTypeConversionExprToRaw(e)
+  }
+
   cached
   Raw::Element convertAbstractFunctionDeclToRaw(TAbstractFunctionDecl e) {
     result = convertConstructorDeclToRaw(e)
diff --git a/swift/ql/lib/codeql/swift/generated/SynthConstructors.qll b/swift/ql/lib/codeql/swift/generated/SynthConstructors.qll
index 934bee82c1b..db43111269c 100644
--- a/swift/ql/lib/codeql/swift/generated/SynthConstructors.qll
+++ b/swift/ql/lib/codeql/swift/generated/SynthConstructors.qll
@@ -14,7 +14,6 @@ import codeql.swift.elements.decl.EnumDeclConstructor
 import codeql.swift.elements.decl.EnumElementDeclConstructor
 import codeql.swift.elements.decl.ExtensionDeclConstructor
 import codeql.swift.elements.decl.GenericTypeParamDeclConstructor
-import codeql.swift.elements.decl.IfConfigClauseConstructor
 import codeql.swift.elements.decl.IfConfigDeclConstructor
 import codeql.swift.elements.decl.ImportDeclConstructor
 import codeql.swift.elements.decl.InfixOperatorDeclConstructor
diff --git a/swift/ql/lib/codeql/swift/generated/UnresolvedElement.qll b/swift/ql/lib/codeql/swift/generated/UnresolvedElement.qll
new file mode 100644
index 00000000000..74090494867
--- /dev/null
+++ b/swift/ql/lib/codeql/swift/generated/UnresolvedElement.qll
@@ -0,0 +1,6 @@
+// generated by codegen/codegen.py
+private import codeql.swift.generated.Synth
+private import codeql.swift.generated.Raw
+import codeql.swift.elements.Element
+
+class UnresolvedElementBase extends Synth::TUnresolvedElement, Element { }
diff --git a/swift/ql/lib/codeql/swift/generated/decl/AbstractFunctionDecl.qll b/swift/ql/lib/codeql/swift/generated/decl/AbstractFunctionDecl.qll
index 845118b5470..118fb91be79 100644
--- a/swift/ql/lib/codeql/swift/generated/decl/AbstractFunctionDecl.qll
+++ b/swift/ql/lib/codeql/swift/generated/decl/AbstractFunctionDecl.qll
@@ -5,8 +5,8 @@ import codeql.swift.elements.Callable
 import codeql.swift.elements.decl.GenericContext
 import codeql.swift.elements.decl.ValueDecl
 
-class AbstractFunctionDeclBase extends Synth::TAbstractFunctionDecl, Callable, GenericContext,
-  ValueDecl {
+class AbstractFunctionDeclBase extends Synth::TAbstractFunctionDecl, GenericContext, ValueDecl,
+  Callable {
   string getName() {
     result = Synth::convertAbstractFunctionDeclToRaw(this).(Raw::AbstractFunctionDecl).getName()
   }
diff --git a/swift/ql/lib/codeql/swift/generated/decl/ExtensionDecl.qll b/swift/ql/lib/codeql/swift/generated/decl/ExtensionDecl.qll
index 8d845e8c136..4e526560f3b 100644
--- a/swift/ql/lib/codeql/swift/generated/decl/ExtensionDecl.qll
+++ b/swift/ql/lib/codeql/swift/generated/decl/ExtensionDecl.qll
@@ -6,7 +6,7 @@ import codeql.swift.elements.decl.GenericContext
 import codeql.swift.elements.decl.IterableDeclContext
 import codeql.swift.elements.decl.NominalTypeDecl
 
-class ExtensionDeclBase extends Synth::TExtensionDecl, Decl, GenericContext, IterableDeclContext {
+class ExtensionDeclBase extends Synth::TExtensionDecl, GenericContext, IterableDeclContext, Decl {
   override string getAPrimaryQlClass() { result = "ExtensionDecl" }
 
   NominalTypeDecl getImmediateExtendedTypeDecl() {
diff --git a/swift/ql/lib/codeql/swift/generated/decl/IfConfigClause.qll b/swift/ql/lib/codeql/swift/generated/decl/IfConfigClause.qll
deleted file mode 100644
index 58dec51bc63..00000000000
--- a/swift/ql/lib/codeql/swift/generated/decl/IfConfigClause.qll
+++ /dev/null
@@ -1,36 +0,0 @@
-// generated by codegen/codegen.py
-private import codeql.swift.generated.Synth
-private import codeql.swift.generated.Raw
-import codeql.swift.elements.AstNode
-import codeql.swift.elements.expr.Expr
-import codeql.swift.elements.Locatable
-
-class IfConfigClauseBase extends Synth::TIfConfigClause, Locatable {
-  override string getAPrimaryQlClass() { result = "IfConfigClause" }
-
-  Expr getImmediateCondition() {
-    result =
-      Synth::convertExprFromRaw(Synth::convertIfConfigClauseToRaw(this)
-            .(Raw::IfConfigClause)
-            .getCondition())
-  }
-
-  final Expr getCondition() { result = getImmediateCondition().resolve() }
-
-  final predicate hasCondition() { exists(getCondition()) }
-
-  AstNode getImmediateElement(int index) {
-    result =
-      Synth::convertAstNodeFromRaw(Synth::convertIfConfigClauseToRaw(this)
-            .(Raw::IfConfigClause)
-            .getElement(index))
-  }
-
-  final AstNode getElement(int index) { result = getImmediateElement(index).resolve() }
-
-  final AstNode getAnElement() { result = getElement(_) }
-
-  final int getNumberOfElements() { result = count(getAnElement()) }
-
-  predicate isActive() { Synth::convertIfConfigClauseToRaw(this).(Raw::IfConfigClause).isActive() }
-}
diff --git a/swift/ql/lib/codeql/swift/generated/decl/IfConfigDecl.qll b/swift/ql/lib/codeql/swift/generated/decl/IfConfigDecl.qll
index c6dc87fbbff..a2daf391620 100644
--- a/swift/ql/lib/codeql/swift/generated/decl/IfConfigDecl.qll
+++ b/swift/ql/lib/codeql/swift/generated/decl/IfConfigDecl.qll
@@ -1,22 +1,22 @@
 // generated by codegen/codegen.py
 private import codeql.swift.generated.Synth
 private import codeql.swift.generated.Raw
+import codeql.swift.elements.AstNode
 import codeql.swift.elements.decl.Decl
-import codeql.swift.elements.decl.IfConfigClause
 
 class IfConfigDeclBase extends Synth::TIfConfigDecl, Decl {
   override string getAPrimaryQlClass() { result = "IfConfigDecl" }
 
-  IfConfigClause getImmediateClause(int index) {
+  AstNode getImmediateActiveElement(int index) {
     result =
-      Synth::convertIfConfigClauseFromRaw(Synth::convertIfConfigDeclToRaw(this)
+      Synth::convertAstNodeFromRaw(Synth::convertIfConfigDeclToRaw(this)
             .(Raw::IfConfigDecl)
-            .getClause(index))
+            .getActiveElement(index))
   }
 
-  final IfConfigClause getClause(int index) { result = getImmediateClause(index).resolve() }
+  final AstNode getActiveElement(int index) { result = getImmediateActiveElement(index).resolve() }
 
-  final IfConfigClause getAClause() { result = getClause(_) }
+  final AstNode getAnActiveElement() { result = getActiveElement(_) }
 
-  final int getNumberOfClauses() { result = count(getAClause()) }
+  final int getNumberOfActiveElements() { result = count(getAnActiveElement()) }
 }
diff --git a/swift/ql/lib/codeql/swift/generated/decl/ModuleDecl.qll b/swift/ql/lib/codeql/swift/generated/decl/ModuleDecl.qll
index c1997dba254..eb064816333 100644
--- a/swift/ql/lib/codeql/swift/generated/decl/ModuleDecl.qll
+++ b/swift/ql/lib/codeql/swift/generated/decl/ModuleDecl.qll
@@ -1,6 +1,7 @@
 // generated by codegen/codegen.py
 private import codeql.swift.generated.Synth
 private import codeql.swift.generated.Raw
+import codeql.swift.elements.decl.ModuleDecl
 import codeql.swift.elements.decl.TypeDecl
 
 class ModuleDeclBase extends Synth::TModuleDecl, TypeDecl {
@@ -13,4 +14,34 @@ class ModuleDeclBase extends Synth::TModuleDecl, TypeDecl {
   predicate isSystemModule() {
     Synth::convertModuleDeclToRaw(this).(Raw::ModuleDecl).isSystemModule()
   }
+
+  ModuleDecl getImmediateImportedModule(int index) {
+    result =
+      Synth::convertModuleDeclFromRaw(Synth::convertModuleDeclToRaw(this)
+            .(Raw::ModuleDecl)
+            .getImportedModule(index))
+  }
+
+  final ModuleDecl getImportedModule(int index) {
+    result = getImmediateImportedModule(index).resolve()
+  }
+
+  final ModuleDecl getAnImportedModule() { result = getImportedModule(_) }
+
+  final int getNumberOfImportedModules() { result = count(getAnImportedModule()) }
+
+  ModuleDecl getImmediateExportedModule(int index) {
+    result =
+      Synth::convertModuleDeclFromRaw(Synth::convertModuleDeclToRaw(this)
+            .(Raw::ModuleDecl)
+            .getExportedModule(index))
+  }
+
+  final ModuleDecl getExportedModule(int index) {
+    result = getImmediateExportedModule(index).resolve()
+  }
+
+  final ModuleDecl getAnExportedModule() { result = getExportedModule(_) }
+
+  final int getNumberOfExportedModules() { result = count(getAnExportedModule()) }
 }
diff --git a/swift/ql/lib/codeql/swift/generated/expr/AbstractClosureExpr.qll b/swift/ql/lib/codeql/swift/generated/expr/AbstractClosureExpr.qll
index bae5bf771d5..8c4353e513e 100644
--- a/swift/ql/lib/codeql/swift/generated/expr/AbstractClosureExpr.qll
+++ b/swift/ql/lib/codeql/swift/generated/expr/AbstractClosureExpr.qll
@@ -4,4 +4,4 @@ private import codeql.swift.generated.Raw
 import codeql.swift.elements.Callable
 import codeql.swift.elements.expr.Expr
 
-class AbstractClosureExprBase extends Synth::TAbstractClosureExpr, Callable, Expr { }
+class AbstractClosureExprBase extends Synth::TAbstractClosureExpr, Expr, Callable { }
diff --git a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedDeclRefExpr.qll b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedDeclRefExpr.qll
index b418b9c69d0..ab4232dd171 100644
--- a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedDeclRefExpr.qll
+++ b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedDeclRefExpr.qll
@@ -2,8 +2,9 @@
 private import codeql.swift.generated.Synth
 private import codeql.swift.generated.Raw
 import codeql.swift.elements.expr.Expr
+import codeql.swift.elements.UnresolvedElement
 
-class UnresolvedDeclRefExprBase extends Synth::TUnresolvedDeclRefExpr, Expr {
+class UnresolvedDeclRefExprBase extends Synth::TUnresolvedDeclRefExpr, Expr, UnresolvedElement {
   override string getAPrimaryQlClass() { result = "UnresolvedDeclRefExpr" }
 
   string getName() {
diff --git a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedDotExpr.qll b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedDotExpr.qll
index 2fec52004de..0af7123b7c2 100644
--- a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedDotExpr.qll
+++ b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedDotExpr.qll
@@ -2,8 +2,9 @@
 private import codeql.swift.generated.Synth
 private import codeql.swift.generated.Raw
 import codeql.swift.elements.expr.Expr
+import codeql.swift.elements.UnresolvedElement
 
-class UnresolvedDotExprBase extends Synth::TUnresolvedDotExpr, Expr {
+class UnresolvedDotExprBase extends Synth::TUnresolvedDotExpr, Expr, UnresolvedElement {
   override string getAPrimaryQlClass() { result = "UnresolvedDotExpr" }
 
   Expr getImmediateBase() {
diff --git a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedMemberChainResultExpr.qll b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedMemberChainResultExpr.qll
index eb329c3fee4..7d76a2a6e00 100644
--- a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedMemberChainResultExpr.qll
+++ b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedMemberChainResultExpr.qll
@@ -2,8 +2,9 @@
 private import codeql.swift.generated.Synth
 private import codeql.swift.generated.Raw
 import codeql.swift.elements.expr.IdentityExpr
+import codeql.swift.elements.UnresolvedElement
 
 class UnresolvedMemberChainResultExprBase extends Synth::TUnresolvedMemberChainResultExpr,
-  IdentityExpr {
+  IdentityExpr, UnresolvedElement {
   override string getAPrimaryQlClass() { result = "UnresolvedMemberChainResultExpr" }
 }
diff --git a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedMemberExpr.qll b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedMemberExpr.qll
index ae07f506a0b..d3fdef7544b 100644
--- a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedMemberExpr.qll
+++ b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedMemberExpr.qll
@@ -2,8 +2,9 @@
 private import codeql.swift.generated.Synth
 private import codeql.swift.generated.Raw
 import codeql.swift.elements.expr.Expr
+import codeql.swift.elements.UnresolvedElement
 
-class UnresolvedMemberExprBase extends Synth::TUnresolvedMemberExpr, Expr {
+class UnresolvedMemberExprBase extends Synth::TUnresolvedMemberExpr, Expr, UnresolvedElement {
   override string getAPrimaryQlClass() { result = "UnresolvedMemberExpr" }
 
   string getName() {
diff --git a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedPatternExpr.qll b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedPatternExpr.qll
index 3c2d1da001d..92e536c025b 100644
--- a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedPatternExpr.qll
+++ b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedPatternExpr.qll
@@ -3,8 +3,9 @@ private import codeql.swift.generated.Synth
 private import codeql.swift.generated.Raw
 import codeql.swift.elements.expr.Expr
 import codeql.swift.elements.pattern.Pattern
+import codeql.swift.elements.UnresolvedElement
 
-class UnresolvedPatternExprBase extends Synth::TUnresolvedPatternExpr, Expr {
+class UnresolvedPatternExprBase extends Synth::TUnresolvedPatternExpr, Expr, UnresolvedElement {
   override string getAPrimaryQlClass() { result = "UnresolvedPatternExpr" }
 
   Pattern getImmediateSubPattern() {
diff --git a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedSpecializeExpr.qll b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedSpecializeExpr.qll
index e63adb051c4..430bdfcb4ab 100644
--- a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedSpecializeExpr.qll
+++ b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedSpecializeExpr.qll
@@ -2,7 +2,8 @@
 private import codeql.swift.generated.Synth
 private import codeql.swift.generated.Raw
 import codeql.swift.elements.expr.Expr
+import codeql.swift.elements.UnresolvedElement
 
-class UnresolvedSpecializeExprBase extends Synth::TUnresolvedSpecializeExpr, Expr {
+class UnresolvedSpecializeExprBase extends Synth::TUnresolvedSpecializeExpr, Expr, UnresolvedElement {
   override string getAPrimaryQlClass() { result = "UnresolvedSpecializeExpr" }
 }
diff --git a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedTypeConversionExpr.qll b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedTypeConversionExpr.qll
index 3c977796db9..647ae1e72a2 100644
--- a/swift/ql/lib/codeql/swift/generated/expr/UnresolvedTypeConversionExpr.qll
+++ b/swift/ql/lib/codeql/swift/generated/expr/UnresolvedTypeConversionExpr.qll
@@ -2,8 +2,9 @@
 private import codeql.swift.generated.Synth
 private import codeql.swift.generated.Raw
 import codeql.swift.elements.expr.ImplicitConversionExpr
+import codeql.swift.elements.UnresolvedElement
 
 class UnresolvedTypeConversionExprBase extends Synth::TUnresolvedTypeConversionExpr,
-  ImplicitConversionExpr {
+  ImplicitConversionExpr, UnresolvedElement {
   override string getAPrimaryQlClass() { result = "UnresolvedTypeConversionExpr" }
 }
diff --git a/swift/ql/lib/codeql/swift/generated/type/TypeRepr.qll b/swift/ql/lib/codeql/swift/generated/type/TypeRepr.qll
index a8e69639143..10c7008ceae 100644
--- a/swift/ql/lib/codeql/swift/generated/type/TypeRepr.qll
+++ b/swift/ql/lib/codeql/swift/generated/type/TypeRepr.qll
@@ -12,6 +12,4 @@ class TypeReprBase extends Synth::TTypeRepr, AstNode {
   }
 
   final Type getType() { result = getImmediateType().resolve() }
-
-  final predicate hasType() { exists(getType()) }
 }
diff --git a/swift/ql/lib/codeql/swift/generated/type/UnresolvedType.qll b/swift/ql/lib/codeql/swift/generated/type/UnresolvedType.qll
index 983d52ec9b5..f89759e7df7 100644
--- a/swift/ql/lib/codeql/swift/generated/type/UnresolvedType.qll
+++ b/swift/ql/lib/codeql/swift/generated/type/UnresolvedType.qll
@@ -2,7 +2,8 @@
 private import codeql.swift.generated.Synth
 private import codeql.swift.generated.Raw
 import codeql.swift.elements.type.Type
+import codeql.swift.elements.UnresolvedElement
 
-class UnresolvedTypeBase extends Synth::TUnresolvedType, Type {
+class UnresolvedTypeBase extends Synth::TUnresolvedType, Type, UnresolvedElement {
   override string getAPrimaryQlClass() { result = "UnresolvedType" }
 }
diff --git a/swift/ql/lib/codeql/swift/printast/PrintAst.qll b/swift/ql/lib/codeql/swift/printast/PrintAst.qll
new file mode 100644
index 00000000000..267919f951e
--- /dev/null
+++ b/swift/ql/lib/codeql/swift/printast/PrintAst.qll
@@ -0,0 +1,49 @@
+/**
+ * Provides queries to pretty-print a Go AST as a graph.
+ */
+
+import PrintAstNode
+
+cached
+private int getOrder(PrintAstNode node) {
+  node =
+    rank[result](PrintAstNode n, Location loc |
+      loc = n.getLocation()
+    |
+      n
+      order by
+        loc.getFile().getName(), loc.getStartLine(), loc.getStartColumn(), loc.getEndLine(),
+        loc.getEndColumn()
+    )
+}
+
+/** Holds if `node` belongs to the output tree, and its property `key` has the given `value`. */
+query predicate nodes(PrintAstNode node, string key, string value) {
+  node.shouldBePrinted() and
+  (
+    key = "semmle.label" and value = node.toString()
+    or
+    key = "semmle.order" and value = getOrder(node).toString()
+    or
+    value = node.getProperty(key)
+  )
+}
+
+/**
+ * Holds if `target` is a child of `source` in the AST, and property `key` of the edge has the
+ * given `value`.
+ */
+query predicate edges(PrintAstNode source, PrintAstNode target, string key, string value) {
+  source.shouldBePrinted() and
+  target.shouldBePrinted() and
+  exists(int index, string accessor | source.hasChild(target, index, accessor) |
+    key = "semmle.label" and value = accessor
+    or
+    key = "semmle.order" and value = index.toString()
+  )
+}
+
+/** Holds if property `key` of the graph has the given `value`. */
+query predicate graphProperties(string key, string value) {
+  key = "semmle.graphKind" and value = "tree"
+}
diff --git a/swift/ql/lib/codeql/swift/printast/PrintAstNode.qll b/swift/ql/lib/codeql/swift/printast/PrintAstNode.qll
new file mode 100644
index 00000000000..428284ac0b2
--- /dev/null
+++ b/swift/ql/lib/codeql/swift/printast/PrintAstNode.qll
@@ -0,0 +1,137 @@
+/**
+ * Provides classes used to pretty-print a Go AST as a graph.
+ * This is factored out of `PrintAst.qll` for testing purposes.
+ */
+
+import swift
+import codeql.swift.generated.ParentChild
+
+private newtype TPrintAstConfiguration = TMakePrintAstConfiguration()
+
+/**
+ * The hook to customize the files and functions printed by this module.
+ */
+class PrintAstConfiguration extends TPrintAstConfiguration {
+  /**
+   * Gets the string representation of this singleton
+   */
+  string toString() { result = "PrintAstConfiguration" }
+
+  /**
+   * Holds if the AST for `e` should be printed. By default, holds for all.
+   */
+  predicate shouldPrint(Locatable e) { any() }
+}
+
+private predicate shouldPrint(Locatable e) { any(PrintAstConfiguration config).shouldPrint(e) }
+
+/**
+ * An AST node that should be printed.
+ */
+private newtype TPrintAstNode = TLocatable(Locatable ast)
+
+/**
+ * A node in the output tree.
+ */
+class PrintAstNode extends TPrintAstNode {
+  /**
+   * Gets a textual representation of this node.
+   */
+  abstract string toString();
+
+  /**
+   * Gets the child node at index `index`. Child indices must be unique,
+   * but need not be contiguous.
+   */
+  abstract predicate hasChild(PrintAstNode child, int index, string label);
+
+  /**
+   * Holds if this node should be printed in the output.
+   */
+  abstract predicate shouldBePrinted();
+
+  /**
+   * Gets the location of this node in the source code.
+   */
+  abstract Location getLocation();
+
+  /**
+   * Gets the value of an additional property of this node, where the name of
+   * the property is `key`.
+   */
+  string getProperty(string key) { none() }
+}
+
+private string prettyPrint(Locatable e) {
+  result = "[" + concat(e.getPrimaryQlClasses(), ", ") + "] " + e
+}
+
+private class Unresolved extends Locatable {
+  Unresolved() { this != this.resolve() }
+}
+
+/**
+ * A graph node representing a real Locatable node.
+ */
+class PrintLocatable extends PrintAstNode, TLocatable {
+  Locatable ast;
+
+  PrintLocatable() { this = TLocatable(ast) }
+
+  override string toString() { result = prettyPrint(ast) }
+
+  final override predicate shouldBePrinted() { shouldPrint(ast) }
+
+  override predicate hasChild(PrintAstNode child, int index, string label) {
+    exists(Locatable c, int i, string accessor |
+      c = getChildAndAccessor(ast, i, accessor) and
+      (
+        // use even indexes for normal children, leaving odd slots for conversions if any
+        child = TLocatable(c) and index = 2 * i and label = accessor
+        or
+        child = TLocatable(c.getFullyUnresolved().(Unresolved)) and
+        index = 2 * i + 1 and
+        (
+          if c instanceof Expr
+          then label = accessor + ".getFullyConverted()"
+          else label = accessor + ".getFullyUnresolved()"
+        )
+      )
+    )
+  }
+
+  final override Location getLocation() { result = ast.getLocation() }
+}
+
+/**
+ * A specialization of graph node for "unresolved" children, that is nodes in
+ * the parallel conversion AST.
+ */
+class PrintUnresolved extends PrintLocatable {
+  override Unresolved ast;
+
+  override predicate hasChild(PrintAstNode child, int index, string label) {
+    // only print immediate unresolved children from the "parallel" AST
+    child = TLocatable(getImmediateChildAndAccessor(ast, index, label).(Unresolved))
+  }
+}
+
+/**
+ * A specialization of graph node for `VarDecl`, to add typing information.
+ */
+class PrintVarDecl extends PrintLocatable {
+  override VarDecl ast;
+
+  override string getProperty(string key) { key = "Type" and result = ast.getType().toString() }
+}
+
+/**
+ * A specialization of graph node for `AbstractFunctionDecl`, to add typing information.
+ */
+class PrintAbstractFunctionDecl extends PrintLocatable {
+  override AbstractFunctionDecl ast;
+
+  override string getProperty(string key) {
+    key = "InterfaceType" and result = ast.getInterfaceType().toString()
+  }
+}
diff --git a/swift/ql/lib/codeql/swift/security/SensitiveExprs.qll b/swift/ql/lib/codeql/swift/security/SensitiveExprs.qll
new file mode 100644
index 00000000000..59440c27a51
--- /dev/null
+++ b/swift/ql/lib/codeql/swift/security/SensitiveExprs.qll
@@ -0,0 +1,173 @@
+/**
+ * Provides classes for heuristically identifying expressions that contain
+ * 'sensitive' data, meaning that they contain or return a password or other
+ * credential, or sensitive private information.
+ */
+
+import swift
+
+private newtype TSensitiveDataType =
+  TCredential() or
+  TPrivateInfo()
+
+/**
+ * A type of sensitive expression.
+ */
+abstract class SensitiveDataType extends TSensitiveDataType {
+  abstract string toString();
+
+  /**
+   * Gets a regexp for identifying expressions of this type.
+   */
+  abstract string getRegexp();
+}
+
+/**
+ * The type of sensitive expression for passwords and other credentials.
+ */
+class SensitiveCredential extends SensitiveDataType, TCredential {
+  override string toString() { result = "credential" }
+
+  override string getRegexp() {
+    result = ".*(password|passwd|accountid|account.?key|accnt.?key|license.?key|trusted).*"
+  }
+}
+
+/**
+ * The type of sensitive expression for private information.
+ */
+class SensitivePrivateInfo extends SensitiveDataType, TPrivateInfo {
+  override string toString() { result = "private information" }
+
+  override string getRegexp() {
+    result =
+      ".*(" +
+        // Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
+        // Government identifiers, such as Social Security Numbers
+        "social.?security|national.?insurance|" +
+        // Contact information, such as home addresses
+        "post.?code|zip.?code|home.?address|" +
+        // and telephone numbers
+        "telephone|home.?phone|mobile|fax.?no|fax.?number|" +
+        // Geographic location - where the user is (or was)
+        "latitude|longitude|" +
+        // Financial data - such as credit card numbers, salary, bank accounts, and debts
+        "credit.?card|debit.?card|salary|bank.?account|" +
+        // Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
+        "email|" +
+        // Health - medical conditions, insurance status, prescription records
+        "birthday|birth.?date|date.?of.?birth|medical|" +
+        // Relationships - work and family
+        "employer|spouse" +
+        // ---
+        ").*"
+  }
+}
+
+/**
+ * A regexp string to identify variables etc that might be safe because they
+ * contain hashed or encrypted data, or are only a reference to data that is
+ * actually stored elsewhere.
+ */
+private string regexpProbablySafe() { result = ".*(hash|crypt|file|path|invalid).*" }
+
+/**
+ * A `VarDecl` that might be used to contain sensitive data.
+ */
+private class SensitiveVarDecl extends VarDecl {
+  SensitiveDataType sensitiveType;
+
+  SensitiveVarDecl() { this.getName().toLowerCase().regexpMatch(sensitiveType.getRegexp()) }
+
+  predicate hasInfo(string label, SensitiveDataType type) {
+    label = this.getName() and
+    sensitiveType = type
+  }
+}
+
+/**
+ * An `AbstractFunctionDecl` that might be used to contain sensitive data.
+ */
+private class SensitiveFunctionDecl extends AbstractFunctionDecl {
+  SensitiveDataType sensitiveType;
+
+  SensitiveFunctionDecl() { this.getName().toLowerCase().regexpMatch(sensitiveType.getRegexp()) }
+
+  predicate hasInfo(string label, SensitiveDataType type) {
+    label = this.getName() and
+    sensitiveType = type
+  }
+}
+
+/**
+ * An `Argument` that might be used to contain sensitive data.
+ */
+private class SensitiveArgument extends Argument {
+  SensitiveDataType sensitiveType;
+
+  SensitiveArgument() { this.getLabel().toLowerCase().regexpMatch(sensitiveType.getRegexp()) }
+
+  predicate hasInfo(string label, SensitiveDataType type) {
+    label = this.getLabel() and
+    sensitiveType = type
+  }
+}
+
+/**
+ * An expression whose value might be sensitive data.
+ */
+class SensitiveExpr extends Expr {
+  string label;
+  SensitiveDataType sensitiveType;
+
+  SensitiveExpr() {
+    (
+      // variable reference
+      this.(DeclRefExpr).getDecl().(SensitiveVarDecl).hasInfo(label, sensitiveType)
+      or
+      // member variable reference
+      this.(MemberRefExpr).getMember().(SensitiveVarDecl).hasInfo(label, sensitiveType)
+      or
+      // function call
+      this.(ApplyExpr).getStaticTarget().(SensitiveFunctionDecl).hasInfo(label, sensitiveType)
+      or
+      // sensitive argument
+      exists(SensitiveArgument a |
+        a.hasInfo(label, sensitiveType) and
+        a.getExpr() = this
+      )
+    ) and
+    // do not mark as sensitive it if it is probably safe
+    not label.toLowerCase().regexpMatch(regexpProbablySafe())
+  }
+
+  /**
+   * Gets the label associated with this expression.
+   */
+  string getLabel() { result = label }
+
+  /**
+   * Gets the type of sensitive expression this is.
+   */
+  SensitiveDataType getSensitiveType() { result = sensitiveType }
+}
+
+/**
+ * A function that is likely used to encrypt or hash data.
+ */
+private class EncryptionFunction extends AbstractFunctionDecl {
+  EncryptionFunction() { this.getName().regexpMatch(".*(crypt|hash|encode|protect).*") }
+}
+
+/**
+ * An expression that may be protected with encryption, for example an
+ * argument to a function called "encrypt".
+ */
+class EncryptedExpr extends Expr {
+  EncryptedExpr() {
+    exists(CallExpr call |
+      call.getStaticTarget() instanceof EncryptionFunction and
+      call.getAnArgument().getExpr() = this
+    )
+  }
+}
diff --git a/swift/ql/lib/qlpack.lock.yml b/swift/ql/lib/qlpack.lock.yml
new file mode 100644
index 00000000000..06dd07fc7dc
--- /dev/null
+++ b/swift/ql/lib/qlpack.lock.yml
@@ -0,0 +1,4 @@
+---
+dependencies: {}
+compiled: false
+lockVersion: 1.0.0
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index db60683484e..214418df53e 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -5,3 +5,5 @@ extractor: swift
 dbscheme: swift.dbscheme
 upgrades: upgrades
 library: true
+dependencies:
+  codeql/ssa: 0.0.1
diff --git a/swift/ql/lib/swift.dbscheme b/swift/ql/lib/swift.dbscheme
index 74dc5296695..53f43597166 100644
--- a/swift/ql/lib/swift.dbscheme
+++ b/swift/ql/lib/swift.dbscheme
@@ -20,6 +20,7 @@ sourceLocationPrefix(
 | @locatable
 | @location
 | @type
+| @unresolved_element
 ;
 
 #keyset[id]
@@ -27,6 +28,17 @@ element_is_unknown(
   int id: @element ref
 );
 
+@unresolved_element =
+  @unresolved_decl_ref_expr
+| @unresolved_dot_expr
+| @unresolved_member_chain_result_expr
+| @unresolved_member_expr
+| @unresolved_pattern_expr
+| @unresolved_specialize_expr
+| @unresolved_type
+| @unresolved_type_conversion_expr
+;
+
 @file =
   @db_file
 | @unknown_file
@@ -51,7 +63,6 @@ unknown_files(
 | @ast_node
 | @comment
 | @condition_element
-| @if_config_clause
 ;
 
 #keyset[id]
@@ -166,6 +177,12 @@ nominal_type_decls(  //dir=decl
 | @abstract_function_decl
 ;
 
+#keyset[id]
+callable_self_params(
+  int id: @callable ref,
+  int self_param: @param_decl ref
+);
+
 #keyset[id, index]
 callable_params(
   int id: @callable ref,
@@ -173,12 +190,6 @@ callable_params(
   int param: @param_decl ref
 );
 
-#keyset[id]
-callable_self_params(
-  int id: @callable ref,
-  int self_param: @param_decl ref
-);
-
 #keyset[id]
 callable_bodies(
   int id: @callable ref,
@@ -520,12 +531,7 @@ expr_types(  //dir=expr
 ;
 
 type_reprs(  //dir=type
-  unique int id: @type_repr
-);
-
-#keyset[id]
-type_repr_types(  //dir=type
-  int id: @type_repr ref,
+  unique int id: @type_repr,
   int type_: @type ref
 );
 
@@ -680,32 +686,10 @@ if_config_decls(  //dir=decl
 );
 
 #keyset[id, index]
-if_config_decl_clauses(  //dir=decl
+if_config_decl_active_elements(  //dir=decl
   int id: @if_config_decl ref,
   int index: int ref,
-  int clause: @if_config_clause ref
-);
-
-if_config_clauses(  //dir=decl
-  unique int id: @if_config_clause
-);
-
-#keyset[id]
-if_config_clause_conditions(  //dir=decl
-  int id: @if_config_clause ref,
-  int condition: @expr ref
-);
-
-#keyset[id, index]
-if_config_clause_elements(  //dir=decl
-  int id: @if_config_clause ref,
-  int index: int ref,
-  int element: @ast_node ref
-);
-
-#keyset[id]
-if_config_clause_is_active(  //dir=decl
-  int id: @if_config_clause ref
+  int active_element: @ast_node ref
 );
 
 import_decls(  //dir=decl
@@ -2116,6 +2100,20 @@ module_decl_is_system_module(  //dir=decl
   int id: @module_decl ref
 );
 
+#keyset[id, index]
+module_decl_imported_modules(  //dir=decl
+  int id: @module_decl ref,
+  int index: int ref,
+  int imported_module: @module_decl ref
+);
+
+#keyset[id, index]
+module_decl_exported_modules(  //dir=decl
+  int id: @module_decl ref,
+  int index: int ref,
+  int exported_module: @module_decl ref
+);
+
 constructor_ref_call_exprs(  //dir=expr
   unique int id: @constructor_ref_call_expr
 );
diff --git a/swift/ql/src/qlpack.lock.yml b/swift/ql/src/qlpack.lock.yml
new file mode 100644
index 00000000000..06dd07fc7dc
--- /dev/null
+++ b/swift/ql/src/qlpack.lock.yml
@@ -0,0 +1,4 @@
+---
+dependencies: {}
+compiled: false
+lockVersion: 1.0.0
diff --git a/swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql b/swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql
index 552eca23772..ae223d3ee8f 100644
--- a/swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql
+++ b/swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql
@@ -56,44 +56,36 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration {
   StringLengthConflationConfiguration() { this = "StringLengthConflationConfiguration" }
 
   override predicate isSource(DataFlow::Node node, string flowstate) {
-    // result of a call to `String.count`
-    exists(MemberRefExpr member |
-      member.getBase().getType().getName() = "String" and
-      member.getMember().(VarDecl).getName() = "count" and
-      node.asExpr() = member and
-      flowstate = "String"
-    )
-    or
-    // result of a call to `NSString.length`
-    exists(MemberRefExpr member |
-      member.getBase().getType().getName() = ["NSString", "NSMutableString"] and
-      member.getMember().(VarDecl).getName() = "length" and
-      node.asExpr() = member and
-      flowstate = "NSString"
-    )
-    or
-    // result of a call to `String.utf8.count`
-    exists(MemberRefExpr member |
-      member.getBase().getType().getName() = "String.UTF8View" and
-      member.getMember().(VarDecl).getName() = "count" and
-      node.asExpr() = member and
-      flowstate = "String.utf8"
-    )
-    or
-    // result of a call to `String.utf16.count`
-    exists(MemberRefExpr member |
-      member.getBase().getType().getName() = "String.UTF16View" and
-      member.getMember().(VarDecl).getName() = "count" and
-      node.asExpr() = member and
-      flowstate = "String.utf16"
-    )
-    or
-    // result of a call to `String.unicodeScalars.count`
-    exists(MemberRefExpr member |
-      member.getBase().getType().getName() = "String.UnicodeScalarView" and
-      member.getMember().(VarDecl).getName() = "count" and
-      node.asExpr() = member and
-      flowstate = "String.unicodeScalars"
+    exists(MemberRefExpr memberRef, string className, string varName |
+      memberRef.getBase().getType().(NominalType).getABaseType*().getName() = className and
+      memberRef.getMember().(VarDecl).getName() = varName and
+      node.asExpr() = memberRef and
+      (
+        // result of a call to `String.count`
+        className = "String" and
+        varName = "count" and
+        flowstate = "String"
+        or
+        // result of a call to `NSString.length`
+        className = ["NSString", "NSMutableString"] and
+        varName = "length" and
+        flowstate = "NSString"
+        or
+        // result of a call to `String.utf8.count`
+        className = "String.UTF8View" and
+        varName = "count" and
+        flowstate = "String.utf8"
+        or
+        // result of a call to `String.utf16.count`
+        className = "String.UTF16View" and
+        varName = "count" and
+        flowstate = "String.utf16"
+        or
+        // result of a call to `String.unicodeScalars.count`
+        className = "String.UnicodeScalarView" and
+        varName = "count" and
+        flowstate = "String.unicodeScalars"
+      )
     )
   }
 
@@ -135,7 +127,7 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration {
             paramName = "at"
           ) and
           c.getName() = className and
-          c.getAMember() = funcDecl and
+          c.getABaseTypeDecl*().(ClassDecl).getAMember() = funcDecl and
           call.getStaticTarget() = funcDecl and
           flowstate = "NSString"
         )
diff --git a/swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.qhelp b/swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.qhelp
new file mode 100644
index 00000000000..3571499c9cf
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.qhelp
@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+<overview>
+
+<p>Sensitive information that is stored unencrypted in a database is accessible to an attacker who gains access to that database. For example, the information could be accessed by any process or user in a rooted device, or exposed through another vulnerability.</p>
+
+</overview>
+<recommendation>
+
+<p>Either encrypt the entire database, or ensure that each piece of sensitive information is encrypted before being stored. In general, decrypt sensitive information only at the point where it is necessary for it to be used in cleartext. Avoid storing sensitive information at all if you do not need to keep it.</p>
+
+</recommendation>
+<example>
+
+<p>The following example shows three cases of storing information using the Core Data library. In the 'BAD' case, the data that is stored is sensitive (a credit card number) and is not encrypted.  In the 'GOOD' cases, the data is either not sensitive, or is protected with encryption.</p>
+
+<sample src="CleartextStorageDatabase.swift" />
+
+</example>
+<references>
+
+<li>
+  OWASP Top 10:2021:
+  <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">A02:2021 � Cryptographic Failures</a>.
+</li>
+
+</references>
+</qhelp>
diff --git a/swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.ql b/swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.ql
new file mode 100644
index 00000000000..65b9cb8ab56
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.ql
@@ -0,0 +1,109 @@
+/**
+ * @name Cleartext storage of sensitive information in a local database
+ * @description Storing sensitive information in a non-encrypted
+ *              database can expose it to an attacker.
+ * @kind path-problem
+ * @problem.severity warning
+ * @security-severity 7.5
+ * @precision medium
+ * @id swift/cleartext-storage-database
+ * @tags security
+ *       external/cwe/cwe-312
+ */
+
+import swift
+import codeql.swift.security.SensitiveExprs
+import codeql.swift.dataflow.DataFlow
+import codeql.swift.dataflow.TaintTracking
+import DataFlow::PathGraph
+
+/**
+ * A `DataFlow::Node` that is something stored in a local database.
+ */
+abstract class Stored extends DataFlow::Node { }
+
+/**
+ * A `DataFlow::Node` that is an expression stored with the Core Data library.
+ */
+class CoreDataStore extends Stored {
+  CoreDataStore() {
+    // `content` arg to `NWConnection.send` is a sink
+    exists(ClassDecl c, AbstractFunctionDecl f, CallExpr call |
+      c.getName() = "NSManagedObject" and
+      c.getAMember() = f and
+      f.getName() = ["setValue(_:forKey:)", "setPrimitiveValue(_:forKey:)"] and
+      call.getStaticTarget() = f and
+      call.getArgument(0).getExpr() = this.asExpr()
+    )
+  }
+}
+
+/**
+ * A `DataFlow::Node` that is an expression stored with the Realm database
+ * library.
+ */
+class RealmStore extends Stored instanceof DataFlow::PostUpdateNode {
+  RealmStore() {
+    // any write into a class derived from `RealmSwiftObject` is a sink. For
+    // example in `realmObj.data = sensitive` the post-update node corresponding
+    // with `realmObj.data` is a sink.
+    exists(ClassDecl cd, Expr e |
+      cd.getABaseTypeDecl*().getName() = "RealmSwiftObject" and
+      this.getPreUpdateNode().asExpr() = e and
+      e.getFullyConverted().getType() = cd.getType() and
+      not e.(DeclRefExpr).getDecl() instanceof SelfParamDecl
+    )
+  }
+}
+
+/**
+ * A taint configuration from sensitive information to expressions that are
+ * transmitted over a network.
+ */
+class CleartextStorageConfig extends TaintTracking::Configuration {
+  CleartextStorageConfig() { this = "CleartextStorageConfig" }
+
+  override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
+
+  override predicate isSink(DataFlow::Node node) { node instanceof Stored }
+
+  override predicate isSanitizerIn(DataFlow::Node node) {
+    // make sources barriers so that we only report the closest instance
+    isSource(node)
+  }
+
+  override predicate isSanitizer(DataFlow::Node node) {
+    // encryption barrier
+    node.asExpr() instanceof EncryptedExpr
+  }
+
+  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
+    // flow out from fields of a `RealmSwiftObject` at the sink, for example in
+    // `realmObj.data = sensitive`.
+    isSink(node) and
+    exists(ClassDecl cd |
+      c.getAReadContent().(DataFlow::Content::FieldContent).getField() = cd.getAMember() and
+      cd.getABaseTypeDecl*().getName() = "RealmSwiftObject"
+    )
+    or
+    // any default implicit reads
+    super.allowImplicitRead(node, c)
+  }
+}
+
+/**
+ * Gets a prettier node to use in the results.
+ */
+DataFlow::Node cleanupNode(DataFlow::Node n) {
+  result = n.(DataFlow::PostUpdateNode).getPreUpdateNode()
+  or
+  not n instanceof DataFlow::PostUpdateNode and
+  result = n
+}
+
+from CleartextStorageConfig config, DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode
+where config.hasFlowPath(sourceNode, sinkNode)
+select cleanupNode(sinkNode.getNode()), sourceNode, sinkNode,
+  "This operation stores '" + sinkNode.getNode().toString() +
+    "' in a database. It may contain unencrypted sensitive data from $@", sourceNode,
+  sourceNode.getNode().toString()
diff --git a/swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.swift b/swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.swift
new file mode 100644
index 00000000000..bf4ec78527c
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.swift
@@ -0,0 +1,15 @@
+
+func storeMyData(databaseObject : NSManagedObject, faveSong : String, creditCardNo : String) {
+	// ...
+
+	// GOOD: not sensitive information
+	databaseObject.setValue(faveSong, forKey: "myFaveSong")
+
+	// BAD: sensitive information saved in cleartext
+	databaseObject.setValue(creditCardNo, forKey: "myCreditCardNo")
+
+	// GOOD: encrypted sensitive information saved
+	databaseObject.setValue(encrypt(creditCardNo), forKey: "myCreditCardNo")
+
+	// ...
+}
diff --git a/swift/ql/src/queries/Security/CWE-311/CleartextTransmission.qhelp b/swift/ql/src/queries/Security/CWE-311/CleartextTransmission.qhelp
new file mode 100644
index 00000000000..8cce5caa74e
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-311/CleartextTransmission.qhelp
@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+<overview>
+
+<p>Sensitive information that is transmitted without encryption may be accessible to an attacker.</p>
+
+</overview>
+<recommendation>
+
+<p>Ensure that sensitive information is always encrypted before being transmitted over the network. In general, decrypt sensitive information only at the point where it is necessary for it to be used in cleartext. Avoid transmitting sensitive information when it is not necessary to.</p>
+
+</recommendation>
+<example>
+
+<p>The following example shows three cases of transmitting information. In the 'BAD' case, the data transmitted is sensitive (a credit card number) and is not encrypted.  In the 'GOOD' cases, the data is either not sensitive, or is protected with encryption.</p>
+
+<sample src="CleartextTransmission.swift" />
+
+</example>
+<references>
+
+<li>
+  OWASP Top 10:2021:
+  <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">A02:2021 � Cryptographic Failures</a>.
+</li>
+
+</references>
+</qhelp>
diff --git a/swift/ql/src/queries/Security/CWE-311/CleartextTransmission.ql b/swift/ql/src/queries/Security/CWE-311/CleartextTransmission.ql
new file mode 100644
index 00000000000..eb184fc233b
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-311/CleartextTransmission.ql
@@ -0,0 +1,86 @@
+/**
+ * @name Cleartext transmission of sensitive information
+ * @description Transmitting sensitive information across a network in
+ *              cleartext can expose it to an attacker.
+ * @kind path-problem
+ * @problem.severity warning
+ * @security-severity 7.5
+ * @precision high
+ * @id swift/cleartext-transmission
+ * @tags security
+ *       external/cwe/cwe-319
+ */
+
+import swift
+import codeql.swift.security.SensitiveExprs
+import codeql.swift.dataflow.DataFlow
+import codeql.swift.dataflow.TaintTracking
+import DataFlow::PathGraph
+
+/**
+ * An `Expr` that is transmitted over a network.
+ */
+abstract class Transmitted extends Expr { }
+
+/**
+ * An `Expr` that is transmitted with `NWConnection.send`.
+ */
+class NWConnectionSend extends Transmitted {
+  NWConnectionSend() {
+    // `content` arg to `NWConnection.send` is a sink
+    exists(ClassDecl c, AbstractFunctionDecl f, CallExpr call |
+      c.getName() = "NWConnection" and
+      c.getAMember() = f and
+      f.getName() = "send(content:contentContext:isComplete:completion:)" and
+      call.getStaticTarget() = f and
+      call.getArgument(0).getExpr() = this
+    )
+  }
+}
+
+/**
+ * An `Expr` that is used to form a `URL`. Such expressions are very likely to
+ * be transmitted over a network, because that's what URLs are for.
+ */
+class Url extends Transmitted {
+  Url() {
+    // `string` arg in `URL.init` is a sink
+    // (we assume here that the URL goes on to be used in a network operation)
+    exists(ClassDecl c, AbstractFunctionDecl f, CallExpr call |
+      c.getName() = "URL" and
+      c.getAMember() = f and
+      f.getName() = ["init(string:)", "init(string:relativeTo:)"] and
+      call.getStaticTarget() = f and
+      call.getArgument(0).getExpr() = this
+    )
+  }
+}
+
+/**
+ * A taint configuration from sensitive information to expressions that are
+ * transmitted over a network.
+ */
+class CleartextTransmissionConfig extends TaintTracking::Configuration {
+  CleartextTransmissionConfig() { this = "CleartextTransmissionConfig" }
+
+  override predicate isSource(DataFlow::Node node) { node.asExpr() instanceof SensitiveExpr }
+
+  override predicate isSink(DataFlow::Node node) { node.asExpr() instanceof Transmitted }
+
+  override predicate isSanitizerIn(DataFlow::Node node) {
+    // make sources barriers so that we only report the closest instance
+    isSource(node)
+  }
+
+  override predicate isSanitizer(DataFlow::Node node) {
+    // encryption barrier
+    node.asExpr() instanceof EncryptedExpr
+  }
+}
+
+from CleartextTransmissionConfig config, DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode
+where config.hasFlowPath(sourceNode, sinkNode)
+select sinkNode.getNode(), sourceNode, sinkNode,
+  "This operation transmits '" + sinkNode.getNode().toString() +
+    "', which may contain unencrypted sensitive data from $@", sourceNode,
+  sourceNode.getNode().toString()
diff --git a/swift/ql/src/queries/Security/CWE-311/CleartextTransmission.swift b/swift/ql/src/queries/Security/CWE-311/CleartextTransmission.swift
new file mode 100644
index 00000000000..d6f3ede90d9
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-311/CleartextTransmission.swift
@@ -0,0 +1,15 @@
+
+func transmitMyData(connection : NWConnection, faveSong : String, creditCardNo : String) {
+	// ...
+
+	// GOOD: not sensitive information
+	connection.send(content: faveSong, completion: .idempotent)
+
+	// BAD: sensitive information saved in cleartext
+	connection.send(content: creditCardNo, completion: .idempotent)
+
+	// GOOD: encrypted sensitive information saved
+	connection.send(content: encrypt(creditCardNo), completion: .idempotent
+
+	// ...
+}
diff --git a/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.qhelp b/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.qhelp
new file mode 100755
index 00000000000..d6806b2ddcc
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.qhelp
@@ -0,0 +1,84 @@
+<!DOCTYPE qhelp PUBLIC
+        "-//Semmle//qhelp//EN"
+        "qhelp.dtd">
+<qhelp>
+    <overview>
+        <p>
+            Using a broken or weak cryptographic hash function can leave data
+            vulnerable, and should not be used in security related code.
+        </p>
+
+        <p>
+            A strong cryptographic hash function should be resistant to:
+        </p>
+        <ul>
+            <li>
+                <b>Pre-image attacks</b>. If you know a hash value <code>h(x)</code>,
+                you should not be able to easily find the input <code>x</code>.
+            </li>
+            <li>
+                <b>Collision attacks</b>. If you know a hash value <code>h(x)</code>,
+                you should not be able to easily find a different input
+                <code>y</code>
+                with the same hash value <code>h(x) = h(y)</code>.
+            </li>
+        </ul>
+
+        <p>
+            As an example, both MD5 and SHA-1 are known to be vulnerable to collision attacks.
+        </p>
+
+        <p>
+            Since it's OK to use a weak cryptographic hash function in a non-security
+            context, this query only alerts when these are used to hash sensitive
+            data (such as passwords, certificates, usernames).
+        </p>
+
+    </overview>
+    <recommendation>
+
+        <p>
+            Ensure that you use a strong, modern cryptographic hash function, such as:
+        </p>
+
+        <ul>
+            <li>
+                Argon2, scrypt, bcrypt, or PBKDF2 for passwords and other data with limited input space where
+                a dictionary-like attack is feasible.
+            </li>
+            <li>
+                SHA-2, or SHA-3 in other cases.
+            </li>
+        </ul>
+
+    </recommendation>
+    <example>
+
+        <p>
+            The following examples show a function for checking whether the hash
+            of a certificate matches a known value -- to prevent tampering.
+
+            In the first case the MD5 hashing algorithm is used that is known to be vulnerable to collision attacks.
+        </p>
+        <sample src="WeakSensitiveDataHashingBad.swift"/>
+        <p>
+
+            Here is the same function using SHA-512, which is a strong cryptographic hashing function.
+        </p>
+        <sample src="WeakSensitiveDataHashingGood.swift"/>
+
+    </example>
+    <references>
+        <li>
+            OWASP:
+            <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html">Password Storage
+                Cheat Sheet
+            </a>
+            and
+            <a href="https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html#use-strong-cryptographic-hashing-algorithms">
+                Transport Layer Protection Cheat Sheet
+            </a>
+        </li>
+    </references>
+
+</qhelp>
diff --git a/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.ql b/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.ql
new file mode 100755
index 00000000000..b697a9a01dd
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.ql
@@ -0,0 +1,63 @@
+/**
+ * @name Use of a broken or weak cryptographic hashing algorithm on sensitive data
+ * @description Using broken or weak cryptographic hashing algorithms can compromise security.
+ * @kind path-problem
+ * @problem.severity warning
+ * @security-severity 7.5
+ * @precision high
+ * @id swift/weak-sensitive-data-hashing
+ * @tags security
+ *       external/cwe/cwe-327
+ *       external/cwe/cwe-328
+ */
+
+import swift
+import codeql.swift.security.SensitiveExprs
+import codeql.swift.dataflow.DataFlow
+import codeql.swift.dataflow.TaintTracking
+import DataFlow::PathGraph
+
+class WeakHashingConfig extends TaintTracking::Configuration {
+  WeakHashingConfig() { this = "WeakHashingConfig" }
+
+  override predicate isSource(DataFlow::Node node) { node instanceof WeakHashingConfig::Source }
+
+  override predicate isSink(DataFlow::Node node) { node instanceof WeakHashingConfig::Sink }
+}
+
+module WeakHashingConfig {
+  class Source extends DataFlow::Node {
+    Source() { this.asExpr() instanceof SensitiveExpr }
+  }
+
+  abstract class Sink extends DataFlow::Node {
+    abstract string getAlgorithm();
+  }
+
+  class CryptoHash extends Sink {
+    string algorithm;
+
+    CryptoHash() {
+      exists(ApplyExpr call, FuncDecl func |
+        call.getAnArgument().getExpr() = this.asExpr() and
+        call.getStaticTarget() = func and
+        func.getName().matches(["hash(%", "update(%"]) and
+        algorithm = func.getEnclosingDecl().(StructDecl).getName() and
+        algorithm = ["MD5", "SHA1"]
+      )
+    }
+
+    override string getAlgorithm() { result = algorithm }
+  }
+}
+
+from
+  WeakHashingConfig config, DataFlow::PathNode source, DataFlow::PathNode sink, string algorithm,
+  SensitiveExpr expr
+where
+  config.hasFlowPath(source, sink) and
+  algorithm = sink.getNode().(WeakHashingConfig::Sink).getAlgorithm() and
+  expr = source.getNode().asExpr()
+select sink.getNode(), source, sink,
+  "Insecure hashing algorithm (" + algorithm + ") depends on $@.", source.getNode(),
+  "sensitive data (" + expr.getSensitiveType() + " " + expr.getLabel() + ")"
diff --git a/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashingBad.swift b/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashingBad.swift
new file mode 100755
index 00000000000..a39dd47edce
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashingBad.swift
@@ -0,0 +1,5 @@
+typealias Hasher = Crypto.Insecure.MD5
+
+func checkCertificate(cert: Array[UInt8], hash: Array[UInt8]) -> Bool
+  return Hasher.hash(data: cert) == hash  // BAD
+}
diff --git a/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashingGood.swift b/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashingGood.swift
new file mode 100755
index 00000000000..7345b2ea49c
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashingGood.swift
@@ -0,0 +1,4 @@
+typealias Hasher = Crypto.SHA512
+
+func checkCertificate(cert: Array[UInt8], hash: Array[UInt8]) -> Bool
+  return Hasher.hash(data: cert) == hash  // GOOD
diff --git a/swift/ql/src/queries/Security/CWE-757/InsecureTLS.qhelp b/swift/ql/src/queries/Security/CWE-757/InsecureTLS.qhelp
new file mode 100644
index 00000000000..aa403b0153b
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-757/InsecureTLS.qhelp
@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>TLS v1.0 and v1.1 versions are known to be vulnerable.</p>
+</overview>
+<recommendation>
+
+<p>Use <code>tls_protocol_version_t.TLSv12</code> or <code>tls_protocol_version_t.TLSv13</code> when configuring <code>URLSession</code>.</p>
+
+</recommendation>
+<example>
+
+<p>Specify a newer <code>tls_protocol_version_t</code> explicitly, or omit it completely as the OS will use secure defaults.</p>
+
+<sample src="SecureTLS.swift" />
+
+</example>
+<references>
+
+<li>
+  <a href="https://support.apple.com/en-gb/guide/security/sec100a75d12/web">Apple Platform Security - TLS security</a>
+  <a href="https://developer.apple.com/documentation/security/preventing_insecure_network_connections">Preventing Insecure Network Connections</a>
+</li>
+
+</references>
+</qhelp>
diff --git a/swift/ql/src/queries/Security/CWE-757/InsecureTLS.ql b/swift/ql/src/queries/Security/CWE-757/InsecureTLS.ql
new file mode 100644
index 00000000000..375da521dc0
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-757/InsecureTLS.ql
@@ -0,0 +1,55 @@
+/**
+ * @name Insecure TLS configuration
+ * @description TLS v1.0 and v1.1 versions are known to be vulnerable. TLS v1.2 or v1.3 should be used instead.
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 7.5
+ * @precision high
+ * @id swift/insecure-tls
+ * @tags security
+ *       external/cwe/cwe-757
+ */
+
+import swift
+import codeql.swift.dataflow.DataFlow
+import codeql.swift.dataflow.TaintTracking
+import codeql.swift.dataflow.FlowSources
+import DataFlow::PathGraph
+
+/**
+ * A taint config to detect insecure configuration of `NSURLSessionConfiguration`
+ */
+class InsecureTlsConfig extends TaintTracking::Configuration {
+  InsecureTlsConfig() { this = "InsecureTLSConfig" }
+
+  /**
+   * Holds for enum values that represent an insecure version of TLS
+   */
+  override predicate isSource(DataFlow::Node node) {
+    exists(MethodRefExpr expr, EnumElementDecl enum, string enumName |
+      node.asExpr() = expr and
+      expr.getMember() = enum and
+      enumName = enum.getName() and
+      enumName in ["TLSv10", "TLSv11", "tlsProtocol10", "tlsProtocol11"]
+    )
+  }
+
+  /**
+   * Holds for assignment of TLS-related properties of `NSURLSessionConfiguration`
+   */
+  override predicate isSink(DataFlow::Node node) {
+    exists(AssignExpr assign, MemberRefExpr member, string memberName |
+      assign.getSource() = node.asExpr() and
+      assign.getDest() = member and
+      memberName = member.getMember().(ConcreteVarDecl).getName() and
+      memberName in [
+          "tlsMinimumSupportedProtocolVersion", "tlsMinimumSupportedProtocol",
+          "tlsMaximumSupportedProtocolVersion", "tlsMaximumSupportedProtocol"
+        ]
+    )
+  }
+}
+
+from InsecureTlsConfig config, DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode
+where config.hasFlowPath(sourceNode, sinkNode)
+select sinkNode.getNode(), sourceNode, sinkNode, "This TLS configuration is insecure."
diff --git a/swift/ql/src/queries/Security/CWE-757/SecureTLS.swift b/swift/ql/src/queries/Security/CWE-757/SecureTLS.swift
new file mode 100644
index 00000000000..0254638e824
--- /dev/null
+++ b/swift/ql/src/queries/Security/CWE-757/SecureTLS.swift
@@ -0,0 +1,12 @@
+// Set TLS version explicitly
+func createURLSession() -> URLSession {
+  let config = URLSessionConfiguration.default
+  config.tlsMinimumSupportedProtocolVersion = tls_protocol_version_t.TLSv13
+  return URLSession(configuration: config)
+}
+
+// Use the secure OS defaults
+func createURLSession() -> URLSession {
+  let config = URLSessionConfiguration.default
+  return URLSession(configuration: config)
+}
diff --git a/swift/ql/src/queries/ide-contextual-queries/IDEContextual.qll b/swift/ql/src/queries/ide-contextual-queries/IDEContextual.qll
new file mode 100644
index 00000000000..ce87eb1a84b
--- /dev/null
+++ b/swift/ql/src/queries/ide-contextual-queries/IDEContextual.qll
@@ -0,0 +1,22 @@
+/**
+ * Provides shared predicates related to contextual queries in the code viewer.
+ */
+
+import swift
+
+/**
+ * Returns the `File` matching the given source file name as encoded by the VS
+ * Code extension.
+ */
+cached
+File getFileBySourceArchiveName(string name) {
+  // The name provided for a file in the source archive by the VS Code extension
+  // has some differences from the absolute path in the database:
+  // 1. colons are replaced by underscores
+  // 2. there's a leading slash, even for Windows paths: "C:/foo/bar" ->
+  //    "/C_/foo/bar"
+  // 3. double slashes in UNC prefixes are replaced with a single slash
+  // We can handle 2 and 3 together by unconditionally adding a leading slash
+  // before replacing double slashes.
+  name = ("/" + result.getAbsolutePath().replaceAll(":", "_")).replaceAll("//", "/")
+}
diff --git a/swift/ql/src/queries/ide-contextual-queries/printAst.ql b/swift/ql/src/queries/ide-contextual-queries/printAst.ql
new file mode 100644
index 00000000000..26a9df55c1d
--- /dev/null
+++ b/swift/ql/src/queries/ide-contextual-queries/printAst.ql
@@ -0,0 +1,28 @@
+/**
+ * @name Print AST
+ * @description Outputs a representation of a file's Abstract Syntax Tree. This
+ *              query is used by the VS Code extension.
+ * @id swift/print-ast
+ * @kind graph
+ * @tags ide-contextual-queries/print-ast
+ */
+
+import swift
+import codeql.swift.printast.PrintAst
+import IDEContextual
+
+/**
+ * Gets the source file to generate an AST from.
+ */
+external string selectedSourceFile();
+
+class PrintAstConfigurationOverride extends PrintAstConfiguration {
+  /**
+   * Holds if the location matches the selected file in the VS Code extension and
+   * the element is `e`.
+   */
+  override predicate shouldPrint(Locatable e) {
+    super.shouldPrint(e) and
+    e.getFile() = getFileBySourceArchiveName(selectedSourceFile())
+  }
+}
diff --git a/swift/ql/test/extractor-tests/declarations/all.expected b/swift/ql/test/extractor-tests/declarations/all.expected
index 2369c19861b..a189bae010b 100644
--- a/swift/ql/test/extractor-tests/declarations/all.expected
+++ b/swift/ql/test/extractor-tests/declarations/all.expected
@@ -1,6 +1,6 @@
 | declarations.swift:1:1:7:1 | Foo |
-| declarations.swift:1:8:1:8 | init |
-| declarations.swift:1:8:1:8 | init |
+| declarations.swift:1:8:1:8 | init() |
+| declarations.swift:1:8:1:8 | init(x:) |
 | declarations.swift:1:8:1:8 | self |
 | declarations.swift:1:8:1:8 | self |
 | declarations.swift:1:8:1:8 | x |
@@ -23,8 +23,8 @@
 | declarations.swift:5:5:5:38 | set |
 | declarations.swift:5:9:5:9 | newValue |
 | declarations.swift:9:1:9:34 | Bar |
-| declarations.swift:9:7:9:7 | deinit |
-| declarations.swift:9:7:9:7 | init |
+| declarations.swift:9:7:9:7 | deinit() |
+| declarations.swift:9:7:9:7 | init() |
 | declarations.swift:9:7:9:7 | self |
 | declarations.swift:9:7:9:7 | self |
 | declarations.swift:9:13:9:30 | var ... = ... |
@@ -95,9 +95,9 @@
 | declarations.swift:41:7:41:7 | set |
 | declarations.swift:41:7:41:7 | value |
 | declarations.swift:42:3:42:3 | self |
-| declarations.swift:42:3:44:3 | init |
+| declarations.swift:42:3:44:3 | init() |
 | declarations.swift:46:3:46:3 | self |
-| declarations.swift:46:3:48:3 | deinit |
+| declarations.swift:46:3:48:3 | deinit() |
 | declarations.swift:50:3:52:3 | +-(_:) |
 | declarations.swift:50:22:50:22 | self |
 | declarations.swift:50:26:50:33 | other |
@@ -106,7 +106,7 @@
 | declarations.swift:64:7:64:16 | +++ |
 | declarations.swift:66:7:66:21 | *** |
 | declarations.swift:68:18:74:1 | ZeroWrapper |
-| declarations.swift:68:25:68:25 | init |
+| declarations.swift:68:25:68:25 | init() |
 | declarations.swift:68:25:68:25 | self |
 | declarations.swift:69:3:73:3 | var ... = ... |
 | declarations.swift:69:7:69:7 | wrappedValue |
@@ -123,7 +123,7 @@
 | declarations.swift:81:8:81:8 | hasDidSet2 |
 | declarations.swift:81:8:81:8 | hasWillSet1 |
 | declarations.swift:81:8:81:8 | hasWillSet2 |
-| declarations.swift:81:8:81:8 | init |
+| declarations.swift:81:8:81:8 | init(normalField:hasWillSet1:hasWillSet2:hasDidSet1:hasDidSet2:hasBoth:) |
 | declarations.swift:81:8:81:8 | normalField |
 | declarations.swift:81:8:81:8 | self |
 | declarations.swift:82:3:87:3 | var ... = ... |
@@ -235,3 +235,31 @@
 | declarations.swift:139:3:141:3 | id() |
 | declarations.swift:139:8:139:8 | self |
 | declarations.swift:144:1:144:7 | { ... } |
+| declarations.swift:146:1:148:1 | GenericClass |
+| declarations.swift:146:7:146:7 | deinit() |
+| declarations.swift:146:7:146:7 | init() |
+| declarations.swift:146:7:146:7 | self |
+| declarations.swift:146:7:146:7 | self |
+| declarations.swift:146:20:146:20 | A |
+| declarations.swift:146:23:146:26 | B |
+| declarations.swift:146:31:146:34 | C |
+| declarations.swift:147:3:147:41 | genericMethod(_:_:_:) |
+| declarations.swift:147:8:147:8 | self |
+| declarations.swift:147:22:147:25 | _ |
+| declarations.swift:147:28:147:31 | _ |
+| declarations.swift:147:34:147:37 | _ |
+| declarations.swift:150:1:150:63 | genericFunc(_:_:_:) |
+| declarations.swift:150:18:150:18 | A |
+| declarations.swift:150:21:150:24 | B |
+| declarations.swift:150:29:150:32 | C |
+| declarations.swift:150:44:150:47 | _ |
+| declarations.swift:150:50:150:53 | _ |
+| declarations.swift:150:56:150:59 | _ |
+| declarations.swift:152:1:152:22 | Derived |
+| declarations.swift:152:7:152:7 | deinit() |
+| declarations.swift:152:7:152:7 | self |
+| declarations.swift:152:21:152:21 | init() |
+| declarations.swift:152:21:152:21 | self |
+| declarations.swift:155:1:155:28 | var ... = ... |
+| declarations.swift:155:1:155:28 | { ... } |
+| declarations.swift:155:5:155:5 | d |
diff --git a/swift/ql/test/extractor-tests/declarations/declarations.swift b/swift/ql/test/extractor-tests/declarations/declarations.swift
index d44d60902e6..6f208381c34 100644
--- a/swift/ql/test/extractor-tests/declarations/declarations.swift
+++ b/swift/ql/test/extractor-tests/declarations/declarations.swift
@@ -143,3 +143,13 @@ extension Int {
 
 42.id()
 
+class GenericClass<A, B: Baz, C: MyProtocol> {
+  func genericMethod(_: A, _: B, _: C) {}
+}
+
+func genericFunc<A, B: Baz, C: MyProtocol>(_: A, _: B, _: C) {}
+
+class Derived : Baz {}
+
+// multiple conversions
+var d: Baz? = Derived() as Baz
diff --git a/swift/ql/test/extractor-tests/expressions/all.expected b/swift/ql/test/extractor-tests/expressions/all.expected
index 5f368ebb6e9..edb8c16c545 100644
--- a/swift/ql/test/extractor-tests/expressions/all.expected
+++ b/swift/ql/test/extractor-tests/expressions/all.expected
@@ -15,7 +15,6 @@
 | expressions.swift:7:18:7:18 | $interpolation | DeclRefExpr |
 | expressions.swift:7:18:7:18 | &... | InOutExpr |
 | expressions.swift:7:18:7:18 | .appendInterpolation(_:) | MethodRefExpr |
-| expressions.swift:7:18:7:18 | appendInterpolation(_:) | DeclRefExpr |
 | expressions.swift:7:18:7:20 | call to appendInterpolation(_:) | CallExpr |
 | expressions.swift:7:19:7:19 | a | DeclRefExpr |
 | expressions.swift:7:21:7:21 |  | StringLiteralExpr |
@@ -26,14 +25,12 @@
 | expressions.swift:8:15:8:15 | nil | NilLiteralExpr |
 | expressions.swift:15:9:15:9 | x | DeclRefExpr |
 | expressions.swift:15:9:15:14 | ... .!=(_:_:) ... | BinaryExpr |
-| expressions.swift:15:11:15:11 | !=(_:_:) | DeclRefExpr |
 | expressions.swift:15:11:15:11 | .!=(_:_:) | MethodRefExpr |
 | expressions.swift:15:11:15:11 | Int.Type | TypeExpr |
 | expressions.swift:15:14:15:14 | 0 | IntegerLiteralExpr |
 | expressions.swift:16:11:16:11 | AnError.Type | TypeExpr |
 | expressions.swift:16:11:16:19 | (Error) ... | ErasureExpr |
 | expressions.swift:16:11:16:19 | .failed | MethodRefExpr |
-| expressions.swift:16:19:16:19 | failed | DeclRefExpr |
 | expressions.swift:20:1:20:16 | try! ... | ForceTryExpr |
 | expressions.swift:20:6:20:6 | failure(_:) | DeclRefExpr |
 | expressions.swift:20:6:20:16 | call to failure(_:) | CallExpr |
@@ -44,9 +41,9 @@
 | expressions.swift:21:6:21:16 | call to failure(_:) | CallExpr |
 | expressions.swift:21:14:21:14 | 11 | IntegerLiteralExpr |
 | expressions.swift:27:13:27:13 | Klass.Type | TypeExpr |
-| expressions.swift:27:13:27:13 | call to init | ConstructorRefCallExpr |
-| expressions.swift:27:13:27:13 | init | DeclRefExpr |
-| expressions.swift:27:13:27:19 | call to init | CallExpr |
+| expressions.swift:27:13:27:13 | call to init() | ConstructorRefCallExpr |
+| expressions.swift:27:13:27:13 | init() | DeclRefExpr |
+| expressions.swift:27:13:27:19 | call to init() | CallExpr |
 | expressions.swift:29:9:29:19 | [...] | DictionaryExpr |
 | expressions.swift:29:10:29:10 | 1 | StringLiteralExpr |
 | expressions.swift:29:10:29:16 | (...) | TupleExpr |
@@ -89,7 +86,6 @@
 | expressions.swift:41:10:43:1 | { ... } | ClosureExpr |
 | expressions.swift:42:12:42:12 | x | DeclRefExpr |
 | expressions.swift:42:12:42:16 | ... .+(_:_:) ... | BinaryExpr |
-| expressions.swift:42:14:42:14 | +(_:_:) | DeclRefExpr |
 | expressions.swift:42:14:42:14 | .+(_:_:) | MethodRefExpr |
 | expressions.swift:42:14:42:14 | Int.Type | TypeExpr |
 | expressions.swift:42:16:42:16 | y | DeclRefExpr |
@@ -98,7 +94,6 @@
 | expressions.swift:44:10:46:1 | { ... } | ClosureExpr |
 | expressions.swift:45:12:45:12 | x | DeclRefExpr |
 | expressions.swift:45:12:45:16 | ... .+(_:_:) ... | BinaryExpr |
-| expressions.swift:45:14:45:14 | +(_:_:) | DeclRefExpr |
 | expressions.swift:45:14:45:14 | .+(_:_:) | MethodRefExpr |
 | expressions.swift:45:14:45:14 | Int.Type | TypeExpr |
 | expressions.swift:45:16:45:16 | y | DeclRefExpr |
@@ -107,7 +102,6 @@
 | expressions.swift:47:10:47:27 | { ... } | ClosureExpr |
 | expressions.swift:47:19:47:19 | $0 | DeclRefExpr |
 | expressions.swift:47:19:47:24 | ... .+(_:_:) ... | BinaryExpr |
-| expressions.swift:47:22:47:22 | +(_:_:) | DeclRefExpr |
 | expressions.swift:47:22:47:22 | .+(_:_:) | MethodRefExpr |
 | expressions.swift:47:22:47:22 | Int.Type | TypeExpr |
 | expressions.swift:47:24:47:24 | $1 | DeclRefExpr |
@@ -116,7 +110,6 @@
 | expressions.swift:48:10:48:20 | { ... } | ClosureExpr |
 | expressions.swift:48:12:48:12 | $0 | DeclRefExpr |
 | expressions.swift:48:12:48:17 | ... .+(_:_:) ... | BinaryExpr |
-| expressions.swift:48:15:48:15 | +(_:_:) | DeclRefExpr |
 | expressions.swift:48:15:48:15 | .+(_:_:) | MethodRefExpr |
 | expressions.swift:48:15:48:15 | Int.Type | TypeExpr |
 | expressions.swift:48:17:48:17 | $1 | DeclRefExpr |
@@ -141,7 +134,6 @@
 | expressions.swift:64:8:64:8 | x | DeclRefExpr |
 | expressions.swift:64:8:64:12 | ... .<(_:_:) ... | BinaryExpr |
 | expressions.swift:64:10:64:10 | .<(_:_:) | MethodRefExpr |
-| expressions.swift:64:10:64:10 | <(_:_:) | DeclRefExpr |
 | expressions.swift:64:10:64:10 | Int.Type | TypeExpr |
 | expressions.swift:64:12:64:12 | 0 | IntegerLiteralExpr |
 | expressions.swift:73:5:73:5 | .xx | MemberRefExpr |
@@ -159,12 +151,12 @@
 | expressions.swift:79:5:79:11 | call to ... | DotSyntaxCallExpr |
 | expressions.swift:79:5:79:21 | call to ... | CallExpr |
 | expressions.swift:79:5:79:21 | self = ... | RebindSelfInConstructorExpr |
-| expressions.swift:79:11:79:11 | init | OtherConstructorDeclRefExpr |
+| expressions.swift:79:11:79:11 | init(x:) | OtherConstructorDeclRefExpr |
 | expressions.swift:79:19:79:19 | 22 | IntegerLiteralExpr |
 | expressions.swift:83:15:83:15 | Derived.Type | TypeExpr |
-| expressions.swift:83:15:83:15 | call to init | ConstructorRefCallExpr |
-| expressions.swift:83:15:83:15 | init | DeclRefExpr |
-| expressions.swift:83:15:83:23 | call to init | CallExpr |
+| expressions.swift:83:15:83:15 | call to init() | ConstructorRefCallExpr |
+| expressions.swift:83:15:83:15 | init() | DeclRefExpr |
+| expressions.swift:83:15:83:23 | call to init() | CallExpr |
 | expressions.swift:84:1:84:1 | _ | DiscardAssignmentExpr |
 | expressions.swift:84:1:84:13 |  ... = ... | AssignExpr |
 | expressions.swift:84:5:84:5 | (Base) ... | DerivedToBaseExpr |
@@ -181,16 +173,13 @@
 | expressions.swift:92:14:92:44 | call to passRetained(_:) | CallExpr |
 | expressions.swift:92:14:92:46 | .toOpaque() | MethodRefExpr |
 | expressions.swift:92:14:92:55 | call to toOpaque() | CallExpr |
-| expressions.swift:92:24:92:24 | passRetained(_:) | DeclRefExpr |
 | expressions.swift:92:37:92:37 | ToPtr.Type | TypeExpr |
-| expressions.swift:92:37:92:37 | call to init | ConstructorRefCallExpr |
-| expressions.swift:92:37:92:37 | init | DeclRefExpr |
-| expressions.swift:92:37:92:43 | call to init | CallExpr |
-| expressions.swift:92:46:92:46 | toOpaque() | DeclRefExpr |
+| expressions.swift:92:37:92:37 | call to init() | ConstructorRefCallExpr |
+| expressions.swift:92:37:92:37 | init() | DeclRefExpr |
+| expressions.swift:92:37:92:43 | call to init() | CallExpr |
 | expressions.swift:93:1:93:16 | Unmanaged<ToPtr>.Type | TypeExpr |
 | expressions.swift:93:1:93:18 | .fromOpaque(_:) | MethodRefExpr |
 | expressions.swift:93:1:93:35 | call to fromOpaque(_:) | CallExpr |
-| expressions.swift:93:18:93:18 | fromOpaque(_:) | DeclRefExpr |
 | expressions.swift:93:29:93:29 | (UnsafeRawPointer) ... | PointerToPointerExpr |
 | expressions.swift:93:29:93:29 | opaque | DeclRefExpr |
 | expressions.swift:99:14:99:14 | 0 | IntegerLiteralExpr |
diff --git a/swift/ql/test/extractor-tests/expressions/semantics.expected b/swift/ql/test/extractor-tests/expressions/semantics.expected
index 72c760c18e6..52984f6b9be 100644
--- a/swift/ql/test/extractor-tests/expressions/semantics.expected
+++ b/swift/ql/test/extractor-tests/expressions/semantics.expected
@@ -1,33 +1,26 @@
 | expressions.swift:7:11:7:11 | $interpolation | OrdinarySemantics |
 | expressions.swift:7:18:7:18 | $interpolation | OrdinarySemantics |
-| expressions.swift:7:18:7:18 | appendInterpolation(_:) | OrdinarySemantics |
 | expressions.swift:7:19:7:19 | a | OrdinarySemantics |
 | expressions.swift:7:21:7:21 | $interpolation | OrdinarySemantics |
 | expressions.swift:15:9:15:9 | x | OrdinarySemantics |
-| expressions.swift:15:11:15:11 | !=(_:_:) | OrdinarySemantics |
-| expressions.swift:16:19:16:19 | failed | OrdinarySemantics |
 | expressions.swift:20:6:20:6 | failure(_:) | OrdinarySemantics |
 | expressions.swift:21:6:21:6 | failure(_:) | OrdinarySemantics |
-| expressions.swift:27:13:27:13 | init | OrdinarySemantics |
+| expressions.swift:27:13:27:13 | init() | OrdinarySemantics |
 | expressions.swift:35:1:35:1 | print(_:separator:terminator:) | OrdinarySemantics |
 | expressions.swift:35:7:35:7 | d | OrdinarySemantics |
 | expressions.swift:35:7:35:12 | ...[...] | OrdinarySemantics |
 | expressions.swift:38:3:38:3 | closure | OrdinarySemantics |
 | expressions.swift:41:1:41:1 | closured(closure:) | OrdinarySemantics |
 | expressions.swift:42:12:42:12 | x | OrdinarySemantics |
-| expressions.swift:42:14:42:14 | +(_:_:) | OrdinarySemantics |
 | expressions.swift:42:16:42:16 | y | OrdinarySemantics |
 | expressions.swift:44:1:44:1 | closured(closure:) | OrdinarySemantics |
 | expressions.swift:45:12:45:12 | x | OrdinarySemantics |
-| expressions.swift:45:14:45:14 | +(_:_:) | OrdinarySemantics |
 | expressions.swift:45:16:45:16 | y | OrdinarySemantics |
 | expressions.swift:47:1:47:1 | closured(closure:) | OrdinarySemantics |
 | expressions.swift:47:19:47:19 | $0 | OrdinarySemantics |
-| expressions.swift:47:22:47:22 | +(_:_:) | OrdinarySemantics |
 | expressions.swift:47:24:47:24 | $1 | OrdinarySemantics |
 | expressions.swift:48:1:48:1 | closured(closure:) | OrdinarySemantics |
 | expressions.swift:48:12:48:12 | $0 | OrdinarySemantics |
-| expressions.swift:48:15:48:15 | +(_:_:) | OrdinarySemantics |
 | expressions.swift:48:17:48:17 | $1 | OrdinarySemantics |
 | expressions.swift:59:1:59:1 | unsafeFunction(pointer:) | OrdinarySemantics |
 | expressions.swift:59:26:59:26 | myNumber | OrdinarySemantics |
@@ -36,21 +29,17 @@
 | expressions.swift:60:35:60:35 | unsafeFunction(pointer:) | OrdinarySemantics |
 | expressions.swift:60:59:60:59 | $0 | OrdinarySemantics |
 | expressions.swift:64:8:64:8 | x | OrdinarySemantics |
-| expressions.swift:64:10:64:10 | <(_:_:) | OrdinarySemantics |
 | expressions.swift:73:5:73:5 | .xx | DirectToStorage |
 | expressions.swift:73:5:73:5 | self | OrdinarySemantics |
 | expressions.swift:73:10:73:10 | x | OrdinarySemantics |
 | expressions.swift:77:7:77:7 | _unimplementedInitializer(className:initName:file:line:column:) | OrdinarySemantics |
-| expressions.swift:83:15:83:15 | init | OrdinarySemantics |
+| expressions.swift:83:15:83:15 | init() | OrdinarySemantics |
 | expressions.swift:84:5:84:5 | derived | OrdinarySemantics |
 | expressions.swift:84:5:84:13 | .xx | OrdinarySemantics |
 | expressions.swift:87:1:87:1 | opt | OrdinarySemantics |
 | expressions.swift:88:1:88:1 | d | OrdinarySemantics |
 | expressions.swift:88:1:88:6 | ...[...] | OrdinarySemantics |
-| expressions.swift:92:24:92:24 | passRetained(_:) | OrdinarySemantics |
-| expressions.swift:92:37:92:37 | init | OrdinarySemantics |
-| expressions.swift:92:46:92:46 | toOpaque() | OrdinarySemantics |
-| expressions.swift:93:18:93:18 | fromOpaque(_:) | OrdinarySemantics |
+| expressions.swift:92:37:92:37 | init() | OrdinarySemantics |
 | expressions.swift:93:29:93:29 | opaque | OrdinarySemantics |
 | expressions.swift:131:3:131:3 | hp | OrdinarySemantics |
 | expressions.swift:131:3:131:6 | .settableField | OrdinarySemantics |
diff --git a/swift/ql/test/extractor-tests/generated/decl/ClassDecl/ClassDecl_getMember.expected b/swift/ql/test/extractor-tests/generated/decl/ClassDecl/ClassDecl_getMember.expected
index 56c517cf4d3..457d88cf34d 100644
--- a/swift/ql/test/extractor-tests/generated/decl/ClassDecl/ClassDecl_getMember.expected
+++ b/swift/ql/test/extractor-tests/generated/decl/ClassDecl/ClassDecl_getMember.expected
@@ -1,12 +1,12 @@
 | class.swift:1:1:7:1 | Foo | 0 | class.swift:2:5:2:16 | var ... = ... |
 | class.swift:1:1:7:1 | Foo | 1 | class.swift:2:9:2:9 | field |
-| class.swift:1:1:7:1 | Foo | 2 | class.swift:4:5:6:5 | init |
-| class.swift:1:1:7:1 | Foo | 3 | class.swift:1:7:1:7 | deinit |
+| class.swift:1:1:7:1 | Foo | 2 | class.swift:4:5:6:5 | init() |
+| class.swift:1:1:7:1 | Foo | 3 | class.swift:1:7:1:7 | deinit() |
 | class.swift:11:1:14:1 | Generic | 0 | class.swift:12:5:12:13 | var ... = ... |
 | class.swift:11:1:14:1 | Generic | 1 | class.swift:12:9:12:9 | x |
 | class.swift:11:1:14:1 | Generic | 2 | class.swift:13:5:13:13 | var ... = ... |
 | class.swift:11:1:14:1 | Generic | 3 | class.swift:13:9:13:9 | y |
-| class.swift:11:1:14:1 | Generic | 4 | class.swift:11:7:11:7 | deinit |
-| class.swift:11:1:14:1 | Generic | 5 | class.swift:11:7:11:7 | init |
-| class.swift:16:1:17:1 | Baz | 0 | class.swift:16:21:16:21 | init |
-| class.swift:16:1:17:1 | Baz | 1 | class.swift:16:7:16:7 | deinit |
+| class.swift:11:1:14:1 | Generic | 4 | class.swift:11:7:11:7 | deinit() |
+| class.swift:11:1:14:1 | Generic | 5 | class.swift:11:7:11:7 | init() |
+| class.swift:16:1:17:1 | Baz | 0 | class.swift:16:21:16:21 | init() |
+| class.swift:16:1:17:1 | Baz | 1 | class.swift:16:7:16:7 | deinit() |
diff --git a/swift/ql/test/extractor-tests/generated/decl/EnumDecl/EnumDecl_getMember.expected b/swift/ql/test/extractor-tests/generated/decl/EnumDecl/EnumDecl_getMember.expected
index 0d1a4b74117..b8abb3c3985 100644
--- a/swift/ql/test/extractor-tests/generated/decl/EnumDecl/EnumDecl_getMember.expected
+++ b/swift/ql/test/extractor-tests/generated/decl/EnumDecl/EnumDecl_getMember.expected
@@ -16,7 +16,7 @@
 | enums.swift:7:1:10:1 | EnumValuesWithBase | 4 | enums.swift:9:10:9:10 | value3 |
 | enums.swift:7:1:10:1 | EnumValuesWithBase | 5 | enums.swift:9:18:9:18 | value4 |
 | enums.swift:7:1:10:1 | EnumValuesWithBase | 6 | enums.swift:9:26:9:26 | value5 |
-| enums.swift:7:1:10:1 | EnumValuesWithBase | 7 | file://:0:0:0:0 | init |
+| enums.swift:7:1:10:1 | EnumValuesWithBase | 7 | file://:0:0:0:0 | init(rawValue:) |
 | enums.swift:7:1:10:1 | EnumValuesWithBase | 8 | file://:0:0:0:0 | var ... = ... |
 | enums.swift:7:1:10:1 | EnumValuesWithBase | 9 | file://:0:0:0:0 | RawValue |
 | enums.swift:7:1:10:1 | EnumValuesWithBase | 10 | file://:0:0:0:0 | rawValue |
diff --git a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause.expected b/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause.expected
deleted file mode 100644
index d4230ce830c..00000000000
--- a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause.expected
+++ /dev/null
@@ -1,6 +0,0 @@
-| if_config.swift:1:1:1:1 | IfConfigClause | isActive: | no |
-| if_config.swift:4:1:4:1 | IfConfigClause | isActive: | no |
-| if_config.swift:7:1:7:1 | IfConfigClause | isActive: | yes |
-| if_config_active.swift:3:1:3:1 | IfConfigClause | isActive: | yes |
-| if_config_active.swift:6:1:6:1 | IfConfigClause | isActive: | no |
-| if_config_active.swift:9:1:9:1 | IfConfigClause | isActive: | no |
diff --git a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause.ql b/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause.ql
deleted file mode 100644
index 832025712f0..00000000000
--- a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause.ql
+++ /dev/null
@@ -1,10 +0,0 @@
-// generated by codegen/codegen.py
-import codeql.swift.elements
-import TestUtils
-
-from IfConfigClause x, string isActive
-where
-  toBeTested(x) and
-  not x.isUnknown() and
-  if x.isActive() then isActive = "yes" else isActive = "no"
-select x, "isActive:", isActive
diff --git a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getCondition.expected b/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getCondition.expected
deleted file mode 100644
index f4955665acd..00000000000
--- a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getCondition.expected
+++ /dev/null
@@ -1,4 +0,0 @@
-| if_config.swift:1:1:1:1 | IfConfigClause | if_config.swift:1:5:1:5 | FOO (unresolved) |
-| if_config.swift:4:1:4:1 | IfConfigClause | if_config.swift:4:9:4:19 | call to ... |
-| if_config_active.swift:3:1:3:1 | IfConfigClause | if_config_active.swift:3:5:3:5 | FOO (unresolved) |
-| if_config_active.swift:6:1:6:1 | IfConfigClause | if_config_active.swift:6:9:6:17 | call to ... |
diff --git a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getElement.expected b/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getElement.expected
deleted file mode 100644
index 11dd2b54127..00000000000
--- a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getElement.expected
+++ /dev/null
@@ -1,18 +0,0 @@
-| if_config.swift:1:1:1:1 | IfConfigClause | 0 | if_config.swift:2:1:2:16 | { ... } |
-| if_config.swift:1:1:1:1 | IfConfigClause | 1 | if_config.swift:2:5:2:5 | foo |
-| if_config.swift:1:1:1:1 | IfConfigClause | 2 | if_config.swift:3:1:3:12 | { ... } |
-| if_config.swift:4:1:4:1 | IfConfigClause | 0 | if_config.swift:5:1:5:16 | { ... } |
-| if_config.swift:4:1:4:1 | IfConfigClause | 1 | if_config.swift:5:5:5:5 | bar |
-| if_config.swift:4:1:4:1 | IfConfigClause | 2 | if_config.swift:6:1:6:12 | { ... } |
-| if_config.swift:7:1:7:1 | IfConfigClause | 0 | if_config.swift:8:1:8:16 | { ... } |
-| if_config.swift:7:1:7:1 | IfConfigClause | 1 | if_config.swift:8:5:8:5 | baz |
-| if_config.swift:7:1:7:1 | IfConfigClause | 2 | if_config.swift:9:1:9:12 | { ... } |
-| if_config_active.swift:3:1:3:1 | IfConfigClause | 0 | if_config_active.swift:4:1:4:16 | { ... } |
-| if_config_active.swift:3:1:3:1 | IfConfigClause | 1 | if_config_active.swift:4:5:4:5 | foo |
-| if_config_active.swift:3:1:3:1 | IfConfigClause | 2 | if_config_active.swift:5:1:5:12 | { ... } |
-| if_config_active.swift:6:1:6:1 | IfConfigClause | 0 | if_config_active.swift:7:1:7:16 | { ... } |
-| if_config_active.swift:6:1:6:1 | IfConfigClause | 1 | if_config_active.swift:7:5:7:5 | bar |
-| if_config_active.swift:6:1:6:1 | IfConfigClause | 2 | if_config_active.swift:8:1:8:12 | { ... } |
-| if_config_active.swift:9:1:9:1 | IfConfigClause | 0 | if_config_active.swift:10:1:10:16 | { ... } |
-| if_config_active.swift:9:1:9:1 | IfConfigClause | 1 | if_config_active.swift:10:5:10:5 | baz |
-| if_config_active.swift:9:1:9:1 | IfConfigClause | 2 | if_config_active.swift:11:1:11:12 | { ... } |
diff --git a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getElement.ql b/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getElement.ql
deleted file mode 100644
index 02c0eec17c9..00000000000
--- a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getElement.ql
+++ /dev/null
@@ -1,7 +0,0 @@
-// generated by codegen/codegen.py
-import codeql.swift.elements
-import TestUtils
-
-from IfConfigClause x, int index
-where toBeTested(x) and not x.isUnknown()
-select x, index, x.getElement(index)
diff --git a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/if_config.swift b/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/if_config.swift
deleted file mode 100644
index 87cbc8ecd42..00000000000
--- a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/if_config.swift
+++ /dev/null
@@ -1,10 +0,0 @@
-#if FOO
-var foo: Int = 1
-print("foo")
-#elseif os(watchOS)
-var bar: Int = 2
-print("bar")
-#else
-var baz: Int = 3
-print("baz")
-#endif
diff --git a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/if_config_active.swift b/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/if_config_active.swift
deleted file mode 100644
index 89849731bfe..00000000000
--- a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/if_config_active.swift
+++ /dev/null
@@ -1,12 +0,0 @@
-//codeql-extractor-options: -D FOO
-
-#if FOO
-var foo: Int = 1
-print("foo")
-#elseif os(macOS)
-var bar: Int = 2
-print("bar")
-#else
-var baz: Int = 3
-print("baz")
-#endif
diff --git a/swift/ql/test/extractor-tests/generated/decl/IfConfigDecl/IfConfigDecl_getActiveElement.expected b/swift/ql/test/extractor-tests/generated/decl/IfConfigDecl/IfConfigDecl_getActiveElement.expected
new file mode 100644
index 00000000000..93c9f638a8b
--- /dev/null
+++ b/swift/ql/test/extractor-tests/generated/decl/IfConfigDecl/IfConfigDecl_getActiveElement.expected
@@ -0,0 +1,3 @@
+| if_config.swift:1:1:10:1 | #if ... | 0 | if_config.swift:8:1:8:16 | { ... } |
+| if_config.swift:1:1:10:1 | #if ... | 1 | if_config.swift:8:5:8:5 | baz |
+| if_config.swift:1:1:10:1 | #if ... | 2 | if_config.swift:9:1:9:12 | { ... } |
diff --git a/swift/ql/test/extractor-tests/generated/decl/IfConfigDecl/IfConfigDecl_getClause.ql b/swift/ql/test/extractor-tests/generated/decl/IfConfigDecl/IfConfigDecl_getActiveElement.ql
similarity index 78%
rename from swift/ql/test/extractor-tests/generated/decl/IfConfigDecl/IfConfigDecl_getClause.ql
rename to swift/ql/test/extractor-tests/generated/decl/IfConfigDecl/IfConfigDecl_getActiveElement.ql
index 5ffaf75e476..388d517add8 100644
--- a/swift/ql/test/extractor-tests/generated/decl/IfConfigDecl/IfConfigDecl_getClause.ql
+++ b/swift/ql/test/extractor-tests/generated/decl/IfConfigDecl/IfConfigDecl_getActiveElement.ql
@@ -4,4 +4,4 @@ import TestUtils
 
 from IfConfigDecl x, int index
 where toBeTested(x) and not x.isUnknown()
-select x, index, x.getClause(index)
+select x, index, x.getActiveElement(index)
diff --git a/swift/ql/test/extractor-tests/generated/decl/ImportDecl/ImportDecl.expected b/swift/ql/test/extractor-tests/generated/decl/ImportDecl/ImportDecl.expected
index cc7db766458..17bd119059b 100644
--- a/swift/ql/test/extractor-tests/generated/decl/ImportDecl/ImportDecl.expected
+++ b/swift/ql/test/extractor-tests/generated/decl/ImportDecl/ImportDecl.expected
@@ -3,4 +3,3 @@
 | import.swift:3:12:3:32 | import ... | getModule: | file://:0:0:0:0 | import | isExported: | yes |
 | import.swift:4:1:4:19 | import ... | getModule: | file://:0:0:0:0 | import | isExported: | no |
 | import.swift:5:1:5:23 | import ... | getModule: | file://:0:0:0:0 | import | isExported: | no |
-| import.swift:7:1:7:8 | import ... | getModule: | file://:0:0:0:0 | import | isExported: | no |
diff --git a/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl.expected b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl.expected
index 1d8b00ccfa8..068e959b885 100644
--- a/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl.expected
+++ b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl.expected
@@ -1,2 +1,3 @@
 | file://:0:0:0:0 | Foo | getModule: | file://:0:0:0:0 | Foo | getInterfaceType: | module<Foo> | getName: | Foo | isBuiltinModule: | no | isSystemModule: | no |
+| file://:0:0:0:0 | __ObjC | getModule: | file://:0:0:0:0 | __ObjC | getInterfaceType: | module<__ObjC> | getName: | __ObjC | isBuiltinModule: | no | isSystemModule: | no |
 | file://:0:0:0:0 | default_module_name | getModule: | file://:0:0:0:0 | default_module_name | getInterfaceType: | module<default_module_name> | getName: | default_module_name | isBuiltinModule: | no | isSystemModule: | no |
diff --git a/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getDefaultImportedModule.expected b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getDefaultImportedModule.expected
new file mode 100644
index 00000000000..7e29a9ce479
--- /dev/null
+++ b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getDefaultImportedModule.expected
@@ -0,0 +1,7 @@
+| file://:0:0:0:0 | Foo | 0 | file://:0:0:0:0 | Swift |
+| file://:0:0:0:0 | Foo | 1 | file://:0:0:0:0 | _Concurrency |
+| file://:0:0:0:0 | Foo | 2 | file://:0:0:0:0 | SwiftOnoneSupport |
+| file://:0:0:0:0 | __ObjC | 0 | file://:0:0:0:0 | Swift |
+| file://:0:0:0:0 | default_module_name | 0 | file://:0:0:0:0 | Swift |
+| file://:0:0:0:0 | default_module_name | 1 | file://:0:0:0:0 | _Concurrency |
+| file://:0:0:0:0 | default_module_name | 2 | file://:0:0:0:0 | SwiftOnoneSupport |
diff --git a/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getExportedModule.expected b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getExportedModule.expected
new file mode 100644
index 00000000000..a0865f2c40a
--- /dev/null
+++ b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getExportedModule.expected
@@ -0,0 +1 @@
+| file://:0:0:0:0 | Foo | 0 | file://:0:0:0:0 | Swift |
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr.ql b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getExportedModule.ql
similarity index 62%
rename from swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr.ql
rename to swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getExportedModule.ql
index 507d2fcf87d..012f1501665 100644
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr.ql
+++ b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getExportedModule.ql
@@ -2,6 +2,6 @@
 import codeql.swift.elements
 import TestUtils
 
-from UnresolvedDeclRefExpr x
+from ModuleDecl x, int index
 where toBeTested(x) and not x.isUnknown()
-select x
+select x, index, x.getExportedModule(index)
diff --git a/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getImportedModule.expected b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getImportedModule.expected
new file mode 100644
index 00000000000..7e29a9ce479
--- /dev/null
+++ b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getImportedModule.expected
@@ -0,0 +1,7 @@
+| file://:0:0:0:0 | Foo | 0 | file://:0:0:0:0 | Swift |
+| file://:0:0:0:0 | Foo | 1 | file://:0:0:0:0 | _Concurrency |
+| file://:0:0:0:0 | Foo | 2 | file://:0:0:0:0 | SwiftOnoneSupport |
+| file://:0:0:0:0 | __ObjC | 0 | file://:0:0:0:0 | Swift |
+| file://:0:0:0:0 | default_module_name | 0 | file://:0:0:0:0 | Swift |
+| file://:0:0:0:0 | default_module_name | 1 | file://:0:0:0:0 | _Concurrency |
+| file://:0:0:0:0 | default_module_name | 2 | file://:0:0:0:0 | SwiftOnoneSupport |
diff --git a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getCondition.ql b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getImportedModule.ql
similarity index 62%
rename from swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getCondition.ql
rename to swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getImportedModule.ql
index 174c1a4994d..c5c8e83e23b 100644
--- a/swift/ql/test/extractor-tests/generated/decl/IfConfigClause/IfConfigClause_getCondition.ql
+++ b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/ModuleDecl_getImportedModule.ql
@@ -2,6 +2,6 @@
 import codeql.swift.elements
 import TestUtils
 
-from IfConfigClause x
+from ModuleDecl x, int index
 where toBeTested(x) and not x.isUnknown()
-select x, x.getCondition()
+select x, index, x.getImportedModule(index)
diff --git a/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/modules.swift b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/modules.swift
index bb12ed63ddd..e72e772b808 100644
--- a/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/modules.swift
+++ b/swift/ql/test/extractor-tests/generated/decl/ModuleDecl/modules.swift
@@ -1 +1,2 @@
 //codeql-extractor-options: -module-name Foo
+@_exported import Swift
diff --git a/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr.expected b/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr.expected
index 8c15ce5ba22..262953a26f5 100644
--- a/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr.expected
+++ b/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr.expected
@@ -1,3 +1,3 @@
-| constructor_ref_calls.swift:7:9:7:9 | call to init | getFunction: | constructor_ref_calls.swift:7:9:7:9 | init | getBase: | constructor_ref_calls.swift:7:9:7:9 | X.Type |
-| constructor_ref_calls.swift:8:10:8:10 | call to init | getFunction: | constructor_ref_calls.swift:8:10:8:10 | init | getBase: | constructor_ref_calls.swift:8:10:8:10 | Y.Type |
-| constructor_ref_calls.swift:9:10:9:10 | call to init | getFunction: | constructor_ref_calls.swift:9:10:9:10 | init | getBase: | constructor_ref_calls.swift:9:10:9:10 | Y.Type |
+| constructor_ref_calls.swift:7:9:7:9 | call to init() | getFunction: | constructor_ref_calls.swift:7:9:7:9 | init() | getBase: | constructor_ref_calls.swift:7:9:7:9 | X.Type |
+| constructor_ref_calls.swift:8:10:8:10 | call to init(_:) | getFunction: | constructor_ref_calls.swift:8:10:8:10 | init(_:) | getBase: | constructor_ref_calls.swift:8:10:8:10 | Y.Type |
+| constructor_ref_calls.swift:9:10:9:10 | call to init() | getFunction: | constructor_ref_calls.swift:9:10:9:10 | init() | getBase: | constructor_ref_calls.swift:9:10:9:10 | Y.Type |
diff --git a/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr_getArgument.expected b/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr_getArgument.expected
index 08b4c6b531c..b2993dc6413 100644
--- a/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr_getArgument.expected
+++ b/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr_getArgument.expected
@@ -1,3 +1,3 @@
-| constructor_ref_calls.swift:7:9:7:9 | call to init | 0 | constructor_ref_calls.swift:7:9:7:9 | : X.Type |
-| constructor_ref_calls.swift:8:10:8:10 | call to init | 0 | constructor_ref_calls.swift:8:10:8:10 | : Y.Type |
-| constructor_ref_calls.swift:9:10:9:10 | call to init | 0 | constructor_ref_calls.swift:9:10:9:10 | : Y.Type |
+| constructor_ref_calls.swift:7:9:7:9 | call to init() | 0 | constructor_ref_calls.swift:7:9:7:9 | : X.Type |
+| constructor_ref_calls.swift:8:10:8:10 | call to init(_:) | 0 | constructor_ref_calls.swift:8:10:8:10 | : Y.Type |
+| constructor_ref_calls.swift:9:10:9:10 | call to init() | 0 | constructor_ref_calls.swift:9:10:9:10 | : Y.Type |
diff --git a/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr_getType.expected b/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr_getType.expected
index 2808ced5a36..4d33e2008cc 100644
--- a/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr_getType.expected
+++ b/swift/ql/test/extractor-tests/generated/expr/ConstructorRefCallExpr/ConstructorRefCallExpr_getType.expected
@@ -1,3 +1,3 @@
-| constructor_ref_calls.swift:7:9:7:9 | call to init | () -> X |
-| constructor_ref_calls.swift:8:10:8:10 | call to init | (Int) -> Y |
-| constructor_ref_calls.swift:9:10:9:10 | call to init | () -> Y |
+| constructor_ref_calls.swift:7:9:7:9 | call to init() | () -> X |
+| constructor_ref_calls.swift:8:10:8:10 | call to init(_:) | (Int) -> Y |
+| constructor_ref_calls.swift:9:10:9:10 | call to init() | () -> Y |
diff --git a/swift/ql/test/extractor-tests/generated/expr/DotSyntaxCallExpr/DotSyntaxCallExpr.expected b/swift/ql/test/extractor-tests/generated/expr/DotSyntaxCallExpr/DotSyntaxCallExpr.expected
index 6d9c6f210c6..757b781a0da 100644
--- a/swift/ql/test/extractor-tests/generated/expr/DotSyntaxCallExpr/DotSyntaxCallExpr.expected
+++ b/swift/ql/test/extractor-tests/generated/expr/DotSyntaxCallExpr/DotSyntaxCallExpr.expected
@@ -1,3 +1,3 @@
 | dot_syntax_call.swift:7:13:7:13 | call to ... | getFunction: | dot_syntax_call.swift:7:13:7:13 | { ... } | getBase: | dot_syntax_call.swift:7:13:7:13 | self |
 | dot_syntax_call.swift:15:9:15:11 | call to ... | getFunction: | dot_syntax_call.swift:15:11:15:11 | { ... } | getBase: | dot_syntax_call.swift:15:9:15:9 | X.Type |
-| dot_syntax_call.swift:16:9:16:13 | call to ... | getFunction: | dot_syntax_call.swift:16:13:16:13 | { ... } | getBase: | dot_syntax_call.swift:16:9:16:11 | call to init |
+| dot_syntax_call.swift:16:9:16:13 | call to ... | getFunction: | dot_syntax_call.swift:16:13:16:13 | { ... } | getBase: | dot_syntax_call.swift:16:9:16:11 | call to init() |
diff --git a/swift/ql/test/extractor-tests/generated/expr/DotSyntaxCallExpr/DotSyntaxCallExpr_getArgument.expected b/swift/ql/test/extractor-tests/generated/expr/DotSyntaxCallExpr/DotSyntaxCallExpr_getArgument.expected
index a9b9f68dae3..0a825e8e7df 100644
--- a/swift/ql/test/extractor-tests/generated/expr/DotSyntaxCallExpr/DotSyntaxCallExpr_getArgument.expected
+++ b/swift/ql/test/extractor-tests/generated/expr/DotSyntaxCallExpr/DotSyntaxCallExpr_getArgument.expected
@@ -1,3 +1,3 @@
 | dot_syntax_call.swift:7:13:7:13 | call to ... | 0 | dot_syntax_call.swift:7:13:7:13 | : self |
 | dot_syntax_call.swift:15:9:15:11 | call to ... | 0 | dot_syntax_call.swift:15:9:15:9 | : X.Type |
-| dot_syntax_call.swift:16:9:16:13 | call to ... | 0 | dot_syntax_call.swift:16:9:16:11 | : call to init |
+| dot_syntax_call.swift:16:9:16:13 | call to ... | 0 | dot_syntax_call.swift:16:9:16:11 | : call to init() |
diff --git a/swift/ql/test/extractor-tests/generated/expr/EnumIsCaseExpr/EnumIsCaseExpr.expected b/swift/ql/test/extractor-tests/generated/expr/EnumIsCaseExpr/EnumIsCaseExpr.expected
index e11faecf54b..e18f2328244 100644
--- a/swift/ql/test/extractor-tests/generated/expr/EnumIsCaseExpr/EnumIsCaseExpr.expected
+++ b/swift/ql/test/extractor-tests/generated/expr/EnumIsCaseExpr/EnumIsCaseExpr.expected
@@ -7,4 +7,4 @@
 | enum_is_case.swift:21:1:21:5 | ... is some | getSubExpr: | enum_is_case.swift:21:1:21:5 | [...] | getElement: | file://:0:0:0:0 | some |
 | enum_is_case.swift:22:1:22:10 | ... is some | getSubExpr: | enum_is_case.swift:22:1:22:10 | [...] | getElement: | file://:0:0:0:0 | some |
 | enum_is_case.swift:23:1:23:10 | ... is some | getSubExpr: | enum_is_case.swift:23:1:23:10 | [...] | getElement: | file://:0:0:0:0 | some |
-| enum_is_case.swift:24:1:24:8 | ... is some | getSubExpr: | enum_is_case.swift:24:1:24:8 | call to init | getElement: | file://:0:0:0:0 | some |
+| enum_is_case.swift:24:1:24:8 | ... is some | getSubExpr: | enum_is_case.swift:24:1:24:8 | call to init() | getElement: | file://:0:0:0:0 | some |
diff --git a/swift/ql/test/extractor-tests/generated/expr/MethodRefExpr/MethodRefExpr.expected b/swift/ql/test/extractor-tests/generated/expr/MethodRefExpr/MethodRefExpr.expected
index 46343c679be..e13de1855fa 100644
--- a/swift/ql/test/extractor-tests/generated/expr/MethodRefExpr/MethodRefExpr.expected
+++ b/swift/ql/test/extractor-tests/generated/expr/MethodRefExpr/MethodRefExpr.expected
@@ -1,6 +1,6 @@
 | method_refs.swift:7:13:7:13 | .baz(_:) | getBase: | file://:0:0:0:0 | self |
 | method_refs.swift:11:1:11:3 | .foo(_:_:) | getBase: | method_refs.swift:11:1:11:1 | X.Type |
 | method_refs.swift:12:1:12:3 | .bar() | getBase: | method_refs.swift:12:1:12:1 | X.Type |
-| method_refs.swift:13:1:13:5 | .baz(_:) | getBase: | method_refs.swift:13:1:13:3 | call to init |
+| method_refs.swift:13:1:13:5 | .baz(_:) | getBase: | method_refs.swift:13:1:13:3 | call to init() |
 | method_refs.swift:15:11:15:11 | .bar() | getBase: | file://:0:0:0:0 | self |
 | method_refs.swift:16:13:16:13 | .baz(_:) | getBase: | file://:0:0:0:0 | self |
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr.expected b/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr.expected
deleted file mode 100644
index ecf2a57ba5d..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr.expected
+++ /dev/null
@@ -1,10 +0,0 @@
-| unresolved_decl_ref.swift:4:5:4:5 | FOO (unresolved) |
-| unresolved_decl_ref.swift:4:9:4:9 | && (unresolved) |
-| unresolved_decl_ref.swift:4:12:4:12 | os (unresolved) |
-| unresolved_decl_ref.swift:4:15:4:15 | Windows (unresolved) |
-| unresolved_decl_ref.swift:5:1:5:1 | print (unresolved) |
-| unresolved_decl_ref.swift:6:9:6:9 | BAR (unresolved) |
-| unresolved_decl_ref.swift:6:13:6:13 | \|\| (unresolved) |
-| unresolved_decl_ref.swift:6:16:6:16 | arch (unresolved) |
-| unresolved_decl_ref.swift:6:21:6:21 | i386 (unresolved) |
-| unresolved_decl_ref.swift:9:1:9:1 | print (unresolved) |
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getName.expected b/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getName.expected
deleted file mode 100644
index 1ea60aabedc..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getName.expected
+++ /dev/null
@@ -1,10 +0,0 @@
-| unresolved_decl_ref.swift:4:5:4:5 | FOO (unresolved) | FOO |
-| unresolved_decl_ref.swift:4:9:4:9 | && (unresolved) | && |
-| unresolved_decl_ref.swift:4:12:4:12 | os (unresolved) | os |
-| unresolved_decl_ref.swift:4:15:4:15 | Windows (unresolved) | Windows |
-| unresolved_decl_ref.swift:5:1:5:1 | print (unresolved) | print |
-| unresolved_decl_ref.swift:6:9:6:9 | BAR (unresolved) | BAR |
-| unresolved_decl_ref.swift:6:13:6:13 | \|\| (unresolved) | \|\| |
-| unresolved_decl_ref.swift:6:16:6:16 | arch (unresolved) | arch |
-| unresolved_decl_ref.swift:6:21:6:21 | i386 (unresolved) | i386 |
-| unresolved_decl_ref.swift:9:1:9:1 | print (unresolved) | print |
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getName.ql b/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getName.ql
deleted file mode 100644
index 1424e3443d9..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getName.ql
+++ /dev/null
@@ -1,7 +0,0 @@
-// generated by codegen/codegen.py
-import codeql.swift.elements
-import TestUtils
-
-from UnresolvedDeclRefExpr x
-where toBeTested(x) and not x.isUnknown()
-select x, x.getName()
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getType.ql b/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getType.ql
deleted file mode 100644
index 27953cceeb1..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/UnresolvedDeclRefExpr_getType.ql
+++ /dev/null
@@ -1,7 +0,0 @@
-// generated by codegen/codegen.py
-import codeql.swift.elements
-import TestUtils
-
-from UnresolvedDeclRefExpr x
-where toBeTested(x) and not x.isUnknown()
-select x, x.getType()
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/unresolved_decl_ref.swift b/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/unresolved_decl_ref.swift
deleted file mode 100644
index 94dee19d618..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDeclRefExpr/unresolved_decl_ref.swift
+++ /dev/null
@@ -1,10 +0,0 @@
-//codeql-extractor-options: -D BAR
-
-// conditions and inactive branches in conditional compilation blocks are not resolved
-#if FOO && os(Windows)
-print(1)
-#elseif BAR || arch(i386)
-print(2)
-#else
-print(3)
-#endif
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDotExpr/MISSING_SOURCE.txt b/swift/ql/test/extractor-tests/generated/expr/UnresolvedDotExpr/MISSING_SOURCE.txt
deleted file mode 100644
index 0d319d9a669..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedDotExpr/MISSING_SOURCE.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-// generated by codegen/codegen.py
-
-After a swift source file is added in this directory and codegen/codegen.py is run again, test queries
-will appear and this file will be deleted
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedMemberChainResultExpr/MISSING_SOURCE.txt b/swift/ql/test/extractor-tests/generated/expr/UnresolvedMemberChainResultExpr/MISSING_SOURCE.txt
deleted file mode 100644
index 0d319d9a669..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedMemberChainResultExpr/MISSING_SOURCE.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-// generated by codegen/codegen.py
-
-After a swift source file is added in this directory and codegen/codegen.py is run again, test queries
-will appear and this file will be deleted
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr.expected b/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr.expected
deleted file mode 100644
index 3f348092bdb..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr.expected
+++ /dev/null
@@ -1 +0,0 @@
-| unresolved_pattern_expr.swift:2:19:2:19 | UnresolvedPatternExpr | getSubPattern: | unresolved_pattern_expr.swift:2:19:2:19 | x |
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr.ql b/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr.ql
deleted file mode 100644
index 9a5f8e54490..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr.ql
+++ /dev/null
@@ -1,10 +0,0 @@
-// generated by codegen/codegen.py
-import codeql.swift.elements
-import TestUtils
-
-from UnresolvedPatternExpr x, Pattern getSubPattern
-where
-  toBeTested(x) and
-  not x.isUnknown() and
-  getSubPattern = x.getSubPattern()
-select x, "getSubPattern:", getSubPattern
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr_getType.ql b/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr_getType.ql
deleted file mode 100644
index af57d0129a1..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/UnresolvedPatternExpr_getType.ql
+++ /dev/null
@@ -1,7 +0,0 @@
-// generated by codegen/codegen.py
-import codeql.swift.elements
-import TestUtils
-
-from UnresolvedPatternExpr x
-where toBeTested(x) and not x.isUnknown()
-select x, x.getType()
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/unresolved_pattern_expr.swift b/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/unresolved_pattern_expr.swift
deleted file mode 100644
index 2ca1bbb7c24..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedPatternExpr/unresolved_pattern_expr.swift
+++ /dev/null
@@ -1,5 +0,0 @@
-#if FOO
-if case let .some(x) = 42 {
-  print(x)
-}
-#endif
diff --git a/swift/ql/test/extractor-tests/generated/expr/UnresolvedTypeConversionExpr/MISSING_SOURCE.txt b/swift/ql/test/extractor-tests/generated/expr/UnresolvedTypeConversionExpr/MISSING_SOURCE.txt
deleted file mode 100644
index 0d319d9a669..00000000000
--- a/swift/ql/test/extractor-tests/generated/expr/UnresolvedTypeConversionExpr/MISSING_SOURCE.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-// generated by codegen/codegen.py
-
-After a swift source file is added in this directory and codegen/codegen.py is run again, test queries
-will appear and this file will be deleted
diff --git a/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected b/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected
index 5df760136c3..ba77afccac6 100644
--- a/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected
+++ b/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected
@@ -1,5 +1,4 @@
 | Builtin.BridgeObject | getName: | Builtin.BridgeObject | getCanonicalType: | Builtin.BridgeObject |
-| Builtin.DefaultActorStorage | getName: | Builtin.DefaultActorStorage | getCanonicalType: | Builtin.DefaultActorStorage |
 | Builtin.Executor | getName: | Builtin.Executor | getCanonicalType: | Builtin.Executor |
 | Builtin.FPIEEE32 | getName: | Builtin.FPIEEE32 | getCanonicalType: | Builtin.FPIEEE32 |
 | Builtin.FPIEEE64 | getName: | Builtin.FPIEEE64 | getCanonicalType: | Builtin.FPIEEE64 |
@@ -8,4 +7,3 @@
 | Builtin.NativeObject | getName: | Builtin.NativeObject | getCanonicalType: | Builtin.NativeObject |
 | Builtin.RawPointer | getName: | Builtin.RawPointer | getCanonicalType: | Builtin.RawPointer |
 | Builtin.RawUnsafeContinuation | getName: | Builtin.RawUnsafeContinuation | getCanonicalType: | Builtin.RawUnsafeContinuation |
-| Builtin.UnsafeValueBuffer | getName: | Builtin.UnsafeValueBuffer | getCanonicalType: | Builtin.UnsafeValueBuffer |
diff --git a/swift/ql/test/extractor-tests/generated/type/BuiltinType/builtin_types.swift b/swift/ql/test/extractor-tests/generated/type/BuiltinType/builtin_types.swift
index 671a1b8eca7..a5d07267265 100644
--- a/swift/ql/test/extractor-tests/generated/type/BuiltinType/builtin_types.swift
+++ b/swift/ql/test/extractor-tests/generated/type/BuiltinType/builtin_types.swift
@@ -4,11 +4,9 @@ func foo(
   _: Builtin.FPIEEE32,
   _: Builtin.FPIEEE64,
   _: Builtin.BridgeObject,
-  _: Builtin.DefaultActorStorage,
-  _: Builtin.Executor,
-  _: Builtin.Job,
   _: Builtin.NativeObject,
   _: Builtin.RawPointer,
-  _: Builtin.RawUnsafeContinuation,
-  _: Builtin.UnsafeValueBuffer
+  _: Builtin.Executor,
+  _: Builtin.Job,
+  _: Builtin.RawUnsafeContinuation
 ) {}
diff --git a/swift/ql/test/extractor-tests/generated/type/ModuleType/ModuleType.expected b/swift/ql/test/extractor-tests/generated/type/ModuleType/ModuleType.expected
index 3a688c7fbd6..c354ac71377 100644
--- a/swift/ql/test/extractor-tests/generated/type/ModuleType/ModuleType.expected
+++ b/swift/ql/test/extractor-tests/generated/type/ModuleType/ModuleType.expected
@@ -1,2 +1,3 @@
 | module<Foo> | getName: | module<Foo> | getCanonicalType: | module<Foo> | getModule: | file://:0:0:0:0 | Foo |
+| module<__ObjC> | getName: | module<__ObjC> | getCanonicalType: | module<__ObjC> | getModule: | file://:0:0:0:0 | __ObjC |
 | module<default_module_name> | getName: | module<default_module_name> | getCanonicalType: | module<default_module_name> | getModule: | file://:0:0:0:0 | default_module_name |
diff --git a/swift/ql/test/extractor-tests/generated/type/UnresolvedType/MISSING_SOURCE.txt b/swift/ql/test/extractor-tests/generated/type/UnresolvedType/MISSING_SOURCE.txt
deleted file mode 100644
index 0d319d9a669..00000000000
--- a/swift/ql/test/extractor-tests/generated/type/UnresolvedType/MISSING_SOURCE.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-// generated by codegen/codegen.py
-
-After a swift source file is added in this directory and codegen/codegen.py is run again, test queries
-will appear and this file will be deleted
diff --git a/swift/ql/test/extractor-tests/types/Types.expected b/swift/ql/test/extractor-tests/types/Types.expected
index b4685b5ddc2..b4287b765c0 100644
--- a/swift/ql/test/extractor-tests/types/Types.expected
+++ b/swift/ql/test/extractor-tests/types/Types.expected
@@ -8,25 +8,23 @@
 | types.swift:3:7:3:11 | ... .+(_:_:) ... | Int |
 | types.swift:3:7:3:11 | [...] | Any... |
 | types.swift:3:7:3:11 | [...] | Any... |
-| types.swift:3:9:3:9 | +(_:_:) | (Int.Type) -> (Int, Int) -> Int |
 | types.swift:3:9:3:9 | .+(_:_:) | (Int, Int) -> Int |
 | types.swift:3:9:3:9 | Int.Type | Int.Type |
 | types.swift:3:11:3:11 | 10 | Int |
 | types.swift:7:16:7:16 | X.Type | X.Type |
-| types.swift:7:16:7:16 | call to init | () -> X |
-| types.swift:7:16:7:16 | init | (X.Type) -> () -> X |
-| types.swift:7:16:7:18 | call to init | X |
+| types.swift:7:16:7:16 | call to init() | () -> X |
+| types.swift:7:16:7:16 | init() | (X.Type) -> () -> X |
+| types.swift:7:16:7:18 | call to init() | X |
 | types.swift:13:17:13:17 | C.Type | C.Type |
-| types.swift:13:17:13:17 | call to init | () -> C |
-| types.swift:13:17:13:17 | init | (C.Type) -> () -> C |
-| types.swift:13:17:13:19 | call to init | C |
+| types.swift:13:17:13:17 | call to init() | () -> C |
+| types.swift:13:17:13:17 | init() | (C.Type) -> () -> C |
+| types.swift:13:17:13:19 | call to init() | C |
 | types.swift:14:22:14:24 | C.Nested.Type | C.Nested.Type |
-| types.swift:14:22:14:24 | call to init | () -> C.Nested |
-| types.swift:14:22:14:31 | call to init | C.Nested |
-| types.swift:14:24:14:24 | init | (C.Nested.Type) -> () -> C.Nested |
+| types.swift:14:22:14:24 | call to init() | () -> C.Nested |
+| types.swift:14:22:14:31 | call to init() | C.Nested |
+| types.swift:14:24:14:24 | init() | (C.Nested.Type) -> () -> C.Nested |
 | types.swift:17:10:17:10 | x | Int |
 | types.swift:17:10:17:14 | ... .+(_:_:) ... | Int |
-| types.swift:17:12:17:12 | +(_:_:) | (Int.Type) -> (Int, Int) -> Int |
 | types.swift:17:12:17:12 | .+(_:_:) | (Int, Int) -> Int |
 | types.swift:17:12:17:12 | Int.Type | Int.Type |
 | types.swift:17:14:17:14 | y | Int |
diff --git a/swift/ql/test/library-tests/ast/PrintAst.expected b/swift/ql/test/library-tests/ast/PrintAst.expected
new file mode 100644
index 00000000000..96741374307
--- /dev/null
+++ b/swift/ql/test/library-tests/ast/PrintAst.expected
@@ -0,0 +1,2146 @@
+#-----| [ModuleDecl] __ObjC
+#-----| [ModuleDecl] declarations
+#-----| [ModuleDecl] expressions
+#-----| [ModuleDecl] patterns
+#-----| [ModuleDecl] statements
+declarations.swift:
+#    1| [StructDecl] Foo
+#    2|   getMember(0): [PatternBindingDecl] var ... = ...
+#    2|     getInit(0): [IntegerLiteralExpr] 11
+#    2|     getPattern(0): [NamedPattern] x
+#    2|   getMember(1): [ConcreteVarDecl] x
+#    2|       Type = Int
+#    2|     getAccessorDecl(0): [AccessorDecl] get
+#    2|         InterfaceType = (Foo) -> () -> Int
+#    2|       getSelfParam(): [ParamDecl] self
+#    2|           Type = Foo
+#    2|       getBody(): [BraceStmt] { ... }
+#    2|     getAccessorDecl(1): [AccessorDecl] set
+#    2|         InterfaceType = (inout Foo) -> (Int) -> ()
+#    2|       getSelfParam(): [ParamDecl] self
+#    2|           Type = Foo
+#    2|       getParam(0): [ParamDecl] value
+#    2|           Type = Int
+#    2|       getBody(): [BraceStmt] { ... }
+#    2|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#    2|         InterfaceType = (inout Foo) -> () -> ()
+#    2|       getSelfParam(): [ParamDecl] self
+#    2|           Type = Foo
+#    2|       getBody(): [BraceStmt] { ... }
+#    2|         getElement(0): [YieldStmt] yield ...
+#    3|   getMember(2): [PatternBindingDecl] var ... = ...
+#    3|     getPattern(0): [TypedPattern] ... as ...
+#    3|       getSubPattern(): [NamedPattern] next
+#    3|       getTypeRepr(): [TypeRepr] Int
+#    3|   getMember(3): [ConcreteVarDecl] next
+#    3|       Type = Int
+#    4|     getAccessorDecl(0): [AccessorDecl] get
+#    4|         InterfaceType = (Foo) -> () -> Int
+#    4|       getSelfParam(): [ParamDecl] self
+#    4|           Type = Foo
+#    4|       getBody(): [BraceStmt] { ... }
+#    4|         getElement(0): [ReturnStmt] return ...
+#    4|           getResult(): [BinaryExpr] ... .+(_:_:) ...
+#    4|             getFunction(): [MethodRefExpr] .+(_:_:)
+#    4|               getBase(): [TypeExpr] Int.Type
+#    4|                 getTypeRepr(): [TypeRepr] Int
+#    4|             getArgument(0): [Argument] : .x
+#    4|               getExpr(): [MemberRefExpr] .x
+#    4|                 getBase(): [DeclRefExpr] self
+#    4|             getArgument(1): [Argument] : 1
+#    4|               getExpr(): [IntegerLiteralExpr] 1
+#    5|     getAccessorDecl(1): [AccessorDecl] set
+#    5|         InterfaceType = (inout Foo) -> (Int) -> ()
+#    5|       getSelfParam(): [ParamDecl] self
+#    5|           Type = Foo
+#    5|       getParam(0): [ParamDecl] newValue
+#    5|           Type = Int
+#    5|       getBody(): [BraceStmt] { ... }
+#    5|         getElement(0): [AssignExpr]  ... = ...
+#    5|           getDest(): [MemberRefExpr] .x
+#    5|             getBase(): [DeclRefExpr] self
+#    5|           getSource(): [BinaryExpr] ... .-(_:_:) ...
+#    5|             getFunction(): [MethodRefExpr] .-(_:_:)
+#    5|               getBase(): [TypeExpr] Int.Type
+#    5|                 getTypeRepr(): [TypeRepr] Int
+#    5|             getArgument(0): [Argument] : newValue
+#    5|               getExpr(): [DeclRefExpr] newValue
+#    5|             getArgument(1): [Argument] : 1
+#    5|               getExpr(): [IntegerLiteralExpr] 1
+#    3|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#    3|         InterfaceType = (inout Foo) -> () -> ()
+#    3|       getSelfParam(): [ParamDecl] self
+#    3|           Type = Foo
+#    3|       getBody(): [BraceStmt] { ... }
+#    3|         getElement(0): [YieldStmt] yield ...
+#    1|   getMember(4): [ConstructorDecl] init()
+#    1|       InterfaceType = (Foo.Type) -> () -> Foo
+#    1|     getSelfParam(): [ParamDecl] self
+#    1|         Type = Foo
+#    1|     getBody(): [BraceStmt] { ... }
+#    1|       getElement(0): [ReturnStmt] return
+#    1|   getMember(5): [ConstructorDecl] init(x:)
+#    1|       InterfaceType = (Foo.Type) -> (Int) -> Foo
+#    1|     getSelfParam(): [ParamDecl] self
+#    1|         Type = Foo
+#    1|     getParam(0): [ParamDecl] x
+#    1|         Type = Int
+#    9| [ClassDecl] Bar
+#    9|   getMember(0): [PatternBindingDecl] var ... = ...
+#    9|     getInit(0): [FloatLiteralExpr] 1.3
+#    9|     getPattern(0): [TypedPattern] ... as ...
+#    9|       getSubPattern(): [NamedPattern] x
+#    9|       getTypeRepr(): [TypeRepr] Double
+#    9|   getMember(1): [ConcreteVarDecl] x
+#    9|       Type = Double
+#    9|     getAccessorDecl(0): [AccessorDecl] get
+#    9|         InterfaceType = (Bar) -> () -> Double
+#    9|       getSelfParam(): [ParamDecl] self
+#    9|           Type = Bar
+#    9|       getBody(): [BraceStmt] { ... }
+#    9|     getAccessorDecl(1): [AccessorDecl] set
+#    9|         InterfaceType = (Bar) -> (Double) -> ()
+#    9|       getSelfParam(): [ParamDecl] self
+#    9|           Type = Bar
+#    9|       getParam(0): [ParamDecl] value
+#    9|           Type = Double
+#    9|       getBody(): [BraceStmt] { ... }
+#    9|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#    9|         InterfaceType = (Bar) -> () -> ()
+#    9|       getSelfParam(): [ParamDecl] self
+#    9|           Type = Bar
+#    9|       getBody(): [BraceStmt] { ... }
+#    9|         getElement(0): [YieldStmt] yield ...
+#    9|   getMember(2): [DestructorDecl] deinit()
+#    9|       InterfaceType = (Bar) -> () -> ()
+#    9|     getSelfParam(): [ParamDecl] self
+#    9|         Type = Bar
+#    9|     getBody(): [BraceStmt] { ... }
+#    9|   getMember(3): [ConstructorDecl] init()
+#    9|       InterfaceType = (Bar.Type) -> () -> Bar
+#    9|     getSelfParam(): [ParamDecl] self
+#    9|         Type = Bar
+#    9|     getBody(): [BraceStmt] { ... }
+#    9|       getElement(0): [ReturnStmt] return
+#   11| [EnumDecl] EnumValues
+#   12|   getMember(0): [EnumCaseDecl] case ...
+#   12|   getMember(1): [EnumElementDecl] value1
+#   12|   getMember(2): [EnumElementDecl] value2
+#   13|   getMember(3): [EnumCaseDecl] case ...
+#   13|   getMember(4): [EnumElementDecl] value3
+#   13|   getMember(5): [EnumElementDecl] value4
+#   13|   getMember(6): [EnumElementDecl] value5
+#   16| [EnumDecl] EnumWithParams
+#   17|   getMember(0): [EnumCaseDecl] case ...
+#   17|   getMember(1): [EnumElementDecl] nodata1
+#   17|     getParam(0): [ParamDecl] _
+#   17|         Type = Void
+#   18|   getMember(2): [EnumCaseDecl] case ...
+#   18|   getMember(3): [EnumElementDecl] intdata
+#   18|     getParam(0): [ParamDecl] _
+#   18|         Type = Int
+#   19|   getMember(4): [EnumCaseDecl] case ...
+#   19|   getMember(5): [EnumElementDecl] tuple
+#   19|     getParam(0): [ParamDecl] _
+#   19|         Type = Int
+#   19|     getParam(1): [ParamDecl] _
+#   19|         Type = String
+#   19|     getParam(2): [ParamDecl] _
+#   19|         Type = Double
+#   22| [ProtocolDecl] MyProtocol
+#   23|   getMember(0): [PatternBindingDecl] var ... = ...
+#   23|     getPattern(0): [TypedPattern] ... as ...
+#   23|       getSubPattern(): [NamedPattern] mustBeSettable
+#   23|       getTypeRepr(): [TypeRepr] Int
+#   23|   getMember(1): [ConcreteVarDecl] mustBeSettable
+#   23|       Type = Int
+#   23|     getAccessorDecl(0): [AccessorDecl] get
+#   23|         InterfaceType = <Self where Self : MyProtocol> (Self) -> () -> Int
+#   23|       getSelfParam(): [ParamDecl] self
+#   23|           Type = Self
+#   23|     getAccessorDecl(1): [AccessorDecl] set
+#   23|         InterfaceType = <Self where Self : MyProtocol> (inout Self) -> (Int) -> ()
+#   23|       getSelfParam(): [ParamDecl] self
+#   23|           Type = Self
+#   23|       getParam(0): [ParamDecl] newValue
+#   23|           Type = Int
+#   23|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#   23|         InterfaceType = <Self where Self : MyProtocol> (inout Self) -> () -> ()
+#   23|       getSelfParam(): [ParamDecl] self
+#   23|           Type = Self
+#   24|   getMember(2): [PatternBindingDecl] var ... = ...
+#   24|     getPattern(0): [TypedPattern] ... as ...
+#   24|       getSubPattern(): [NamedPattern] doesNotNeedToBeSettable
+#   24|       getTypeRepr(): [TypeRepr] Int
+#   24|   getMember(3): [ConcreteVarDecl] doesNotNeedToBeSettable
+#   24|       Type = Int
+#   24|     getAccessorDecl(0): [AccessorDecl] get
+#   24|         InterfaceType = <Self where Self : MyProtocol> (Self) -> () -> Int
+#   24|       getSelfParam(): [ParamDecl] self
+#   24|           Type = Self
+#   25|   getMember(4): [ConcreteFuncDecl] random()
+#   25|       InterfaceType = <Self where Self : MyProtocol> (Self) -> () -> Double
+#   25|     getSelfParam(): [ParamDecl] self
+#   25|         Type = Self
+#   28| [ConcreteFuncDecl] a_function(a_parameter:)
+#   28|     InterfaceType = (Int) -> ()
+#   28|   getParam(0): [ParamDecl] a_parameter
+#   28|       Type = Int
+#   28|   getBody(): [BraceStmt] { ... }
+#   30| [TopLevelCodeDecl] { ... }
+#   30|   getBody(): [BraceStmt] { ... }
+#   30|     getElement(0): [PatternBindingDecl] var ... = ...
+#   30|       getInit(0): [IntegerLiteralExpr] 42
+#   30|       getPattern(0): [NamedPattern] a_variable
+#   30| [ConcreteVarDecl] a_variable
+#   30|     Type = Int
+#   31| [TopLevelCodeDecl] { ... }
+#   31|   getBody(): [BraceStmt] { ... }
+#   31|     getElement(0): [PatternBindingDecl] var ... = ...
+#   31|       getPattern(0): [TypedPattern] ... as ...
+#   31|         getSubPattern(): [NamedPattern] a_property
+#   31|         getTypeRepr(): [TypeRepr] String
+#   31| [ConcreteVarDecl] a_property
+#   31|     Type = String
+#   32|   getAccessorDecl(0): [AccessorDecl] get
+#   32|       InterfaceType = () -> String
+#   32|     getBody(): [BraceStmt] { ... }
+#   33|       getElement(0): [ReturnStmt] return ...
+#   33|         getResult(): [StringLiteralExpr] here
+#   35|   getAccessorDecl(1): [AccessorDecl] set
+#   35|       InterfaceType = (String) -> ()
+#   35|     getParam(0): [ParamDecl] newValue
+#   35|         Type = String
+#   35|     getBody(): [BraceStmt] { ... }
+#   38| [TopLevelCodeDecl] { ... }
+#   38|   getBody(): [BraceStmt] { ... }
+#   38|     getElement(0): [CallExpr] call to print(_:separator:terminator:)
+#   38|       getFunction(): [DeclRefExpr] print(_:separator:terminator:)
+#   38|       getArgument(0): [Argument] : [...]
+#   38|         getExpr(): [VarargExpansionExpr] [...]
+#   38|           getSubExpr(): [ArrayExpr] [...]
+#   38|             getElement(0): [StringLiteralExpr] some top level statement
+#   38|             getElement(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   38|       getArgument(1): [Argument] separator: default separator
+#   38|         getExpr(): [DefaultArgumentExpr] default separator
+#   38|       getArgument(2): [Argument] terminator: default terminator
+#   38|         getExpr(): [DefaultArgumentExpr] default terminator
+#   40| [ClassDecl] Baz
+#   41|   getMember(0): [PatternBindingDecl] var ... = ...
+#   41|     getPattern(0): [TypedPattern] ... as ...
+#   41|       getSubPattern(): [NamedPattern] field
+#   41|       getTypeRepr(): [TypeRepr] Int
+#   41|   getMember(1): [ConcreteVarDecl] field
+#   41|       Type = Int
+#   41|     getAccessorDecl(0): [AccessorDecl] get
+#   41|         InterfaceType = (Baz) -> () -> Int
+#   41|       getSelfParam(): [ParamDecl] self
+#   41|           Type = Baz
+#   41|       getBody(): [BraceStmt] { ... }
+#   41|     getAccessorDecl(1): [AccessorDecl] set
+#   41|         InterfaceType = (Baz) -> (Int) -> ()
+#   41|       getSelfParam(): [ParamDecl] self
+#   41|           Type = Baz
+#   41|       getParam(0): [ParamDecl] value
+#   41|           Type = Int
+#   41|       getBody(): [BraceStmt] { ... }
+#   41|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#   41|         InterfaceType = (Baz) -> () -> ()
+#   41|       getSelfParam(): [ParamDecl] self
+#   41|           Type = Baz
+#   41|       getBody(): [BraceStmt] { ... }
+#   41|         getElement(0): [YieldStmt] yield ...
+#   42|   getMember(2): [ConstructorDecl] init()
+#   42|       InterfaceType = (Baz.Type) -> () -> Baz
+#   42|     getSelfParam(): [ParamDecl] self
+#   42|         Type = Baz
+#   42|     getBody(): [BraceStmt] { ... }
+#   43|       getElement(0): [AssignExpr]  ... = ...
+#   43|         getDest(): [MemberRefExpr] .field
+#   43|           getBase(): [DeclRefExpr] self
+#   43|         getSource(): [IntegerLiteralExpr] 10
+#   44|       getElement(1): [ReturnStmt] return
+#   46|   getMember(3): [DestructorDecl] deinit()
+#   46|       InterfaceType = (Baz) -> () -> ()
+#   46|     getSelfParam(): [ParamDecl] self
+#   46|         Type = Baz
+#   46|     getBody(): [BraceStmt] { ... }
+#   47|       getElement(0): [AssignExpr]  ... = ...
+#   47|         getDest(): [MemberRefExpr] .field
+#   47|           getBase(): [DeclRefExpr] self
+#   47|         getSource(): [IntegerLiteralExpr] 0
+#   50|   getMember(4): [ConcreteFuncDecl] +-(_:)
+#   50|       InterfaceType = (Baz.Type) -> (Baz) -> Baz
+#   50|     getSelfParam(): [ParamDecl] self
+#   50|         Type = Baz.Type
+#   50|     getParam(0): [ParamDecl] other
+#   50|         Type = Baz
+#   50|     getBody(): [BraceStmt] { ... }
+#   51|       getElement(0): [ReturnStmt] return ...
+#   51|         getResult(): [DeclRefExpr] other
+#   55| [PrefixOperatorDecl] +-
+#   57| [PrecedenceGroupDecl] precedencegroup ...
+#   64| [InfixOperatorDecl] +++
+#   66| [InfixOperatorDecl] ***
+#   68| [StructDecl] ZeroWrapper
+#   69|   getMember(0): [PatternBindingDecl] var ... = ...
+#   69|     getPattern(0): [TypedPattern] ... as ...
+#   69|       getSubPattern(): [NamedPattern] wrappedValue
+#   69|       getTypeRepr(): [TypeRepr] Int
+#   69|   getMember(1): [ConcreteVarDecl] wrappedValue
+#   69|       Type = Int
+#   70|     getAccessorDecl(0): [AccessorDecl] get
+#   70|         InterfaceType = (ZeroWrapper) -> () -> Int
+#   70|       getSelfParam(): [ParamDecl] self
+#   70|           Type = ZeroWrapper
+#   70|       getBody(): [BraceStmt] { ... }
+#   71|         getElement(0): [ReturnStmt] return ...
+#   71|           getResult(): [IntegerLiteralExpr] 0
+#   68|   getMember(2): [ConstructorDecl] init()
+#   68|       InterfaceType = (ZeroWrapper.Type) -> () -> ZeroWrapper
+#   68|     getSelfParam(): [ParamDecl] self
+#   68|         Type = ZeroWrapper
+#   68|     getBody(): [BraceStmt] { ... }
+#   68|       getElement(0): [ReturnStmt] return
+#   76| [ConcreteFuncDecl] foo()
+#   76|     InterfaceType = () -> Int
+#   76|   getBody(): [BraceStmt] { ... }
+#   77|     getElement(0): [PatternBindingDecl] var ... = ...
+#   77|       getPattern(0): [TypedPattern] ... as ...
+#   77|         getSubPattern(): [NamedPattern] x
+#   77|         getTypeRepr(): [TypeRepr] Int
+#   77|     getElement(1): [ConcreteVarDecl] x
+#   77|         Type = Int
+#   77|       getAccessorDecl(0): [AccessorDecl] get
+#   77|           InterfaceType = () -> Int
+#   77|         getBody(): [BraceStmt] { ... }
+#   78|     getElement(2): [ReturnStmt] return ...
+#   78|       getResult(): [DeclRefExpr] x
+#   77| [CallExpr] call to init()
+#   77|   getFunction(): [ConstructorRefCallExpr] call to init()
+#   77|     getFunction(): [DeclRefExpr] init()
+#   77|     getArgument(0): [Argument] : ZeroWrapper.Type
+#   77|       getExpr(): [TypeExpr] ZeroWrapper.Type
+#   77|         getTypeRepr(): [TypeRepr] ZeroWrapper
+#   77| [TypedPattern] ... as ...
+#   77|   getSubPattern(): [NamedPattern] _x
+#   77| [ConcreteVarDecl] _x
+#   77|     Type = ZeroWrapper
+#   81| [StructDecl] HasPropertyAndObserver
+#   82|   getMember(0): [PatternBindingDecl] var ... = ...
+#   82|     getPattern(0): [TypedPattern] ... as ...
+#   82|       getSubPattern(): [NamedPattern] settableField
+#   82|       getTypeRepr(): [TypeRepr] Int
+#   82|   getMember(1): [ConcreteVarDecl] settableField
+#   82|       Type = Int
+#   83|     getAccessorDecl(0): [AccessorDecl] set
+#   83|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#   83|       getSelfParam(): [ParamDecl] self
+#   83|           Type = HasPropertyAndObserver
+#   83|       getParam(0): [ParamDecl] newValue
+#   83|           Type = Int
+#   83|       getBody(): [BraceStmt] { ... }
+#   84|     getAccessorDecl(1): [AccessorDecl] get
+#   84|         InterfaceType = (HasPropertyAndObserver) -> () -> Int
+#   84|       getSelfParam(): [ParamDecl] self
+#   84|           Type = HasPropertyAndObserver
+#   84|       getBody(): [BraceStmt] { ... }
+#   85|         getElement(0): [ReturnStmt] return ...
+#   85|           getResult(): [IntegerLiteralExpr] 0
+#   82|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#   82|         InterfaceType = (inout HasPropertyAndObserver) -> () -> ()
+#   82|       getSelfParam(): [ParamDecl] self
+#   82|           Type = HasPropertyAndObserver
+#   82|       getBody(): [BraceStmt] { ... }
+#   82|         getElement(0): [YieldStmt] yield ...
+#   91|   getMember(2): [PatternBindingDecl] var ... = ...
+#   91|     getPattern(0): [TypedPattern] ... as ...
+#   91|       getSubPattern(): [NamedPattern] readOnlyField1
+#   91|       getTypeRepr(): [TypeRepr] Int
+#   91|   getMember(3): [ConcreteVarDecl] readOnlyField1
+#   91|       Type = Int
+#   91|     getAccessorDecl(0): [AccessorDecl] get
+#   91|         InterfaceType = (HasPropertyAndObserver) -> () -> Int
+#   91|       getSelfParam(): [ParamDecl] self
+#   91|           Type = HasPropertyAndObserver
+#   91|       getBody(): [BraceStmt] { ... }
+#   92|         getElement(0): [ReturnStmt] return ...
+#   92|           getResult(): [IntegerLiteralExpr] 0
+#   96|   getMember(4): [PatternBindingDecl] var ... = ...
+#   96|     getPattern(0): [TypedPattern] ... as ...
+#   96|       getSubPattern(): [NamedPattern] readOnlyField2
+#   96|       getTypeRepr(): [TypeRepr] Int
+#   96|   getMember(5): [ConcreteVarDecl] readOnlyField2
+#   96|       Type = Int
+#   97|     getAccessorDecl(0): [AccessorDecl] get
+#   97|         InterfaceType = (HasPropertyAndObserver) -> () -> Int
+#   97|       getSelfParam(): [ParamDecl] self
+#   97|           Type = HasPropertyAndObserver
+#   97|       getBody(): [BraceStmt] { ... }
+#   98|         getElement(0): [ReturnStmt] return ...
+#   98|           getResult(): [IntegerLiteralExpr] 0
+#  102|   getMember(6): [PatternBindingDecl] var ... = ...
+#  102|     getPattern(0): [TypedPattern] ... as ...
+#  102|       getSubPattern(): [NamedPattern] normalField
+#  102|       getTypeRepr(): [TypeRepr] Int
+#  102|   getMember(7): [ConcreteVarDecl] normalField
+#  102|       Type = Int
+#  102|     getAccessorDecl(0): [AccessorDecl] get
+#  102|         InterfaceType = (HasPropertyAndObserver) -> () -> Int
+#  102|       getSelfParam(): [ParamDecl] self
+#  102|           Type = HasPropertyAndObserver
+#  102|       getBody(): [BraceStmt] { ... }
+#  102|     getAccessorDecl(1): [AccessorDecl] set
+#  102|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  102|       getSelfParam(): [ParamDecl] self
+#  102|           Type = HasPropertyAndObserver
+#  102|       getParam(0): [ParamDecl] value
+#  102|           Type = Int
+#  102|       getBody(): [BraceStmt] { ... }
+#  102|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#  102|         InterfaceType = (inout HasPropertyAndObserver) -> () -> ()
+#  102|       getSelfParam(): [ParamDecl] self
+#  102|           Type = HasPropertyAndObserver
+#  102|       getBody(): [BraceStmt] { ... }
+#  102|         getElement(0): [YieldStmt] yield ...
+#  104|   getMember(8): [SubscriptDecl] subscript ...
+#  105|     getAccessorDecl(0): [AccessorDecl] get
+#  105|         InterfaceType = (HasPropertyAndObserver) -> (Int) -> Int
+#  105|       getSelfParam(): [ParamDecl] self
+#  105|           Type = HasPropertyAndObserver
+#  104|       getParam(0): [ParamDecl] x
+#  104|           Type = Int
+#  105|       getBody(): [BraceStmt] { ... }
+#  106|         getElement(0): [ReturnStmt] return ...
+#  106|           getResult(): [IntegerLiteralExpr] 0
+#  108|     getAccessorDecl(1): [AccessorDecl] set
+#  108|         InterfaceType = (inout HasPropertyAndObserver) -> (Int, Int) -> ()
+#  108|       getSelfParam(): [ParamDecl] self
+#  108|           Type = HasPropertyAndObserver
+#  108|       getParam(0): [ParamDecl] newValue
+#  108|           Type = Int
+#  104|       getParam(1): [ParamDecl] x
+#  104|           Type = Int
+#  108|       getBody(): [BraceStmt] { ... }
+#  104|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#  104|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  104|       getSelfParam(): [ParamDecl] self
+#  104|           Type = HasPropertyAndObserver
+#  104|       getBody(): [BraceStmt] { ... }
+#  104|         getElement(0): [YieldStmt] yield ...
+#  104|     getParam(0): [ParamDecl] x
+#  104|         Type = Int
+#  111|   getMember(9): [SubscriptDecl] subscript ...
+#  111|     getAccessorDecl(0): [AccessorDecl] get
+#  111|         InterfaceType = (HasPropertyAndObserver) -> (Int, Int) -> Int
+#  111|       getSelfParam(): [ParamDecl] self
+#  111|           Type = HasPropertyAndObserver
+#  111|       getParam(0): [ParamDecl] x
+#  111|           Type = Int
+#  111|       getParam(1): [ParamDecl] y
+#  111|           Type = Int
+#  111|       getBody(): [BraceStmt] { ... }
+#  112|         getElement(0): [ReturnStmt] return ...
+#  112|           getResult(): [IntegerLiteralExpr] 0
+#  111|     getParam(0): [ParamDecl] x
+#  111|         Type = Int
+#  111|     getParam(1): [ParamDecl] y
+#  111|         Type = Int
+#  115|   getMember(10): [PatternBindingDecl] var ... = ...
+#  115|     getPattern(0): [TypedPattern] ... as ...
+#  115|       getSubPattern(): [NamedPattern] hasWillSet1
+#  115|       getTypeRepr(): [TypeRepr] Int
+#  115|   getMember(11): [ConcreteVarDecl] hasWillSet1
+#  115|       Type = Int
+#  116|     getAccessorDecl(0): [AccessorDecl] willSet
+#  116|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  116|       getSelfParam(): [ParamDecl] self
+#  116|           Type = HasPropertyAndObserver
+#  116|       getParam(0): [ParamDecl] newValue
+#  116|           Type = Int
+#  116|       getBody(): [BraceStmt] { ... }
+#  115|     getAccessorDecl(1): [AccessorDecl] get
+#  115|         InterfaceType = (HasPropertyAndObserver) -> () -> Int
+#  115|       getSelfParam(): [ParamDecl] self
+#  115|           Type = HasPropertyAndObserver
+#  115|       getBody(): [BraceStmt] { ... }
+#  115|     getAccessorDecl(2): [AccessorDecl] set
+#  115|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  115|       getSelfParam(): [ParamDecl] self
+#  115|           Type = HasPropertyAndObserver
+#  115|       getParam(0): [ParamDecl] value
+#  115|           Type = Int
+#  115|       getBody(): [BraceStmt] { ... }
+#  115|     getAccessorDecl(3): [AccessorDecl] (unnamed function decl)
+#  115|         InterfaceType = (inout HasPropertyAndObserver) -> () -> ()
+#  115|       getSelfParam(): [ParamDecl] self
+#  115|           Type = HasPropertyAndObserver
+#  115|       getBody(): [BraceStmt] { ... }
+#  115|         getElement(0): [YieldStmt] yield ...
+#  119|   getMember(12): [PatternBindingDecl] var ... = ...
+#  119|     getPattern(0): [TypedPattern] ... as ...
+#  119|       getSubPattern(): [NamedPattern] hasWillSet2
+#  119|       getTypeRepr(): [TypeRepr] Int
+#  119|   getMember(13): [ConcreteVarDecl] hasWillSet2
+#  119|       Type = Int
+#  120|     getAccessorDecl(0): [AccessorDecl] willSet
+#  120|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  120|       getSelfParam(): [ParamDecl] self
+#  120|           Type = HasPropertyAndObserver
+#  120|       getParam(0): [ParamDecl] newValue
+#  120|           Type = Int
+#  120|       getBody(): [BraceStmt] { ... }
+#  119|     getAccessorDecl(1): [AccessorDecl] get
+#  119|         InterfaceType = (HasPropertyAndObserver) -> () -> Int
+#  119|       getSelfParam(): [ParamDecl] self
+#  119|           Type = HasPropertyAndObserver
+#  119|       getBody(): [BraceStmt] { ... }
+#  119|     getAccessorDecl(2): [AccessorDecl] set
+#  119|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  119|       getSelfParam(): [ParamDecl] self
+#  119|           Type = HasPropertyAndObserver
+#  119|       getParam(0): [ParamDecl] value
+#  119|           Type = Int
+#  119|       getBody(): [BraceStmt] { ... }
+#  119|     getAccessorDecl(3): [AccessorDecl] (unnamed function decl)
+#  119|         InterfaceType = (inout HasPropertyAndObserver) -> () -> ()
+#  119|       getSelfParam(): [ParamDecl] self
+#  119|           Type = HasPropertyAndObserver
+#  119|       getBody(): [BraceStmt] { ... }
+#  119|         getElement(0): [YieldStmt] yield ...
+#  123|   getMember(14): [PatternBindingDecl] var ... = ...
+#  123|     getPattern(0): [TypedPattern] ... as ...
+#  123|       getSubPattern(): [NamedPattern] hasDidSet1
+#  123|       getTypeRepr(): [TypeRepr] Int
+#  123|   getMember(15): [ConcreteVarDecl] hasDidSet1
+#  123|       Type = Int
+#  124|     getAccessorDecl(0): [AccessorDecl] didSet
+#  124|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  124|       getSelfParam(): [ParamDecl] self
+#  124|           Type = HasPropertyAndObserver
+#  124|       getParam(0): [ParamDecl] oldValue
+#  124|           Type = Int
+#  124|       getBody(): [BraceStmt] { ... }
+#  123|     getAccessorDecl(1): [AccessorDecl] get
+#  123|         InterfaceType = (HasPropertyAndObserver) -> () -> Int
+#  123|       getSelfParam(): [ParamDecl] self
+#  123|           Type = HasPropertyAndObserver
+#  123|       getBody(): [BraceStmt] { ... }
+#  123|     getAccessorDecl(2): [AccessorDecl] set
+#  123|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  123|       getSelfParam(): [ParamDecl] self
+#  123|           Type = HasPropertyAndObserver
+#  123|       getParam(0): [ParamDecl] value
+#  123|           Type = Int
+#  123|       getBody(): [BraceStmt] { ... }
+#  123|     getAccessorDecl(3): [AccessorDecl] (unnamed function decl)
+#  123|         InterfaceType = (inout HasPropertyAndObserver) -> () -> ()
+#  123|       getSelfParam(): [ParamDecl] self
+#  123|           Type = HasPropertyAndObserver
+#  123|       getBody(): [BraceStmt] { ... }
+#  123|         getElement(0): [YieldStmt] yield ...
+#  127|   getMember(16): [PatternBindingDecl] var ... = ...
+#  127|     getPattern(0): [TypedPattern] ... as ...
+#  127|       getSubPattern(): [NamedPattern] hasDidSet2
+#  127|       getTypeRepr(): [TypeRepr] Int
+#  127|   getMember(17): [ConcreteVarDecl] hasDidSet2
+#  127|       Type = Int
+#  128|     getAccessorDecl(0): [AccessorDecl] didSet
+#  128|         InterfaceType = (inout HasPropertyAndObserver) -> () -> ()
+#  128|       getSelfParam(): [ParamDecl] self
+#  128|           Type = HasPropertyAndObserver
+#  128|       getBody(): [BraceStmt] { ... }
+#  127|     getAccessorDecl(1): [AccessorDecl] get
+#  127|         InterfaceType = (HasPropertyAndObserver) -> () -> Int
+#  127|       getSelfParam(): [ParamDecl] self
+#  127|           Type = HasPropertyAndObserver
+#  127|       getBody(): [BraceStmt] { ... }
+#  127|     getAccessorDecl(2): [AccessorDecl] set
+#  127|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  127|       getSelfParam(): [ParamDecl] self
+#  127|           Type = HasPropertyAndObserver
+#  127|       getParam(0): [ParamDecl] value
+#  127|           Type = Int
+#  127|       getBody(): [BraceStmt] { ... }
+#  127|     getAccessorDecl(3): [AccessorDecl] (unnamed function decl)
+#  127|         InterfaceType = (inout HasPropertyAndObserver) -> () -> ()
+#  127|       getSelfParam(): [ParamDecl] self
+#  127|           Type = HasPropertyAndObserver
+#  127|       getBody(): [BraceStmt] { ... }
+#  127|         getElement(0): [YieldStmt] yield ...
+#  131|   getMember(18): [PatternBindingDecl] var ... = ...
+#  131|     getPattern(0): [TypedPattern] ... as ...
+#  131|       getSubPattern(): [NamedPattern] hasBoth
+#  131|       getTypeRepr(): [TypeRepr] Int
+#  131|   getMember(19): [ConcreteVarDecl] hasBoth
+#  131|       Type = Int
+#  132|     getAccessorDecl(0): [AccessorDecl] willSet
+#  132|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  132|       getSelfParam(): [ParamDecl] self
+#  132|           Type = HasPropertyAndObserver
+#  132|       getParam(0): [ParamDecl] newValue
+#  132|           Type = Int
+#  132|       getBody(): [BraceStmt] { ... }
+#  134|     getAccessorDecl(1): [AccessorDecl] didSet
+#  134|         InterfaceType = (inout HasPropertyAndObserver) -> () -> ()
+#  134|       getSelfParam(): [ParamDecl] self
+#  134|           Type = HasPropertyAndObserver
+#  134|       getBody(): [BraceStmt] { ... }
+#  131|     getAccessorDecl(2): [AccessorDecl] get
+#  131|         InterfaceType = (HasPropertyAndObserver) -> () -> Int
+#  131|       getSelfParam(): [ParamDecl] self
+#  131|           Type = HasPropertyAndObserver
+#  131|       getBody(): [BraceStmt] { ... }
+#  131|     getAccessorDecl(3): [AccessorDecl] set
+#  131|         InterfaceType = (inout HasPropertyAndObserver) -> (Int) -> ()
+#  131|       getSelfParam(): [ParamDecl] self
+#  131|           Type = HasPropertyAndObserver
+#  131|       getParam(0): [ParamDecl] value
+#  131|           Type = Int
+#  131|       getBody(): [BraceStmt] { ... }
+#  131|     getAccessorDecl(4): [AccessorDecl] (unnamed function decl)
+#  131|         InterfaceType = (inout HasPropertyAndObserver) -> () -> ()
+#  131|       getSelfParam(): [ParamDecl] self
+#  131|           Type = HasPropertyAndObserver
+#  131|       getBody(): [BraceStmt] { ... }
+#  131|         getElement(0): [YieldStmt] yield ...
+#   81|   getMember(20): [ConstructorDecl] init(normalField:hasWillSet1:hasWillSet2:hasDidSet1:hasDidSet2:hasBoth:)
+#   81|       InterfaceType = (HasPropertyAndObserver.Type) -> (Int, Int, Int, Int, Int, Int) -> HasPropertyAndObserver
+#   81|     getSelfParam(): [ParamDecl] self
+#   81|         Type = HasPropertyAndObserver
+#   81|     getParam(0): [ParamDecl] normalField
+#   81|         Type = Int
+#   81|     getParam(1): [ParamDecl] hasWillSet1
+#   81|         Type = Int
+#   81|     getParam(2): [ParamDecl] hasWillSet2
+#   81|         Type = Int
+#   81|     getParam(3): [ParamDecl] hasDidSet1
+#   81|         Type = Int
+#   81|     getParam(4): [ParamDecl] hasDidSet2
+#   81|         Type = Int
+#   81|     getParam(5): [ParamDecl] hasBoth
+#   81|         Type = Int
+#   89| [Comment] // A field can be marked as read-only by dirctly implementing
+#   89| 
+#   90| [Comment] // the getter between the braces.
+#   90| 
+#   95| [Comment] // Or by adding an access declaration
+#   95| 
+#  138| [ExtensionDecl] extension
+#  139|   getMember(0): [ConcreteFuncDecl] id()
+#  139|       InterfaceType = (Int) -> () -> Int
+#  139|     getSelfParam(): [ParamDecl] self
+#  139|         Type = Int
+#  139|     getBody(): [BraceStmt] { ... }
+#  140|       getElement(0): [ReturnStmt] return ...
+#  140|         getResult(): [DeclRefExpr] self
+#  144| [TopLevelCodeDecl] { ... }
+#  144|   getBody(): [BraceStmt] { ... }
+#  144|     getElement(0): [CallExpr] call to id()
+#  144|       getFunction(): [MethodRefExpr] .id()
+#  144|         getBase(): [IntegerLiteralExpr] 42
+#  146| [ClassDecl] GenericClass
+#  146|   getGenericTypeParam(0): [GenericTypeParamDecl] A
+#  146|   getGenericTypeParam(1): [GenericTypeParamDecl] B
+#  146|   getGenericTypeParam(2): [GenericTypeParamDecl] C
+#  147|   getMember(0): [ConcreteFuncDecl] genericMethod(_:_:_:)
+#  147|       InterfaceType = <A, B, C where B : Baz, C : MyProtocol> (GenericClass<A, B, C>) -> (A, B, C) -> ()
+#  147|     getSelfParam(): [ParamDecl] self
+#  147|         Type = GenericClass<A, B, C>
+#  147|     getParam(0): [ParamDecl] _
+#  147|         Type = A
+#  147|     getParam(1): [ParamDecl] _
+#  147|         Type = B
+#  147|     getParam(2): [ParamDecl] _
+#  147|         Type = C
+#  147|     getBody(): [BraceStmt] { ... }
+#  146|   getMember(1): [DestructorDecl] deinit()
+#  146|       InterfaceType = <A, B, C where B : Baz, C : MyProtocol> (GenericClass<A, B, C>) -> () -> ()
+#  146|     getSelfParam(): [ParamDecl] self
+#  146|         Type = GenericClass<A, B, C>
+#  146|     getBody(): [BraceStmt] { ... }
+#  146|   getMember(2): [ConstructorDecl] init()
+#  146|       InterfaceType = <A, B, C where B : Baz, C : MyProtocol> (GenericClass<A, B, C>.Type) -> () -> GenericClass<A, B, C>
+#  146|     getSelfParam(): [ParamDecl] self
+#  146|         Type = GenericClass<A, B, C>
+#  146|     getBody(): [BraceStmt] { ... }
+#  146|       getElement(0): [ReturnStmt] return
+#  150| [ConcreteFuncDecl] genericFunc(_:_:_:)
+#  150|     InterfaceType = <A, B, C where B : Baz, C : MyProtocol> (A, B, C) -> ()
+#  150|   getGenericTypeParam(0): [GenericTypeParamDecl] A
+#  150|   getGenericTypeParam(1): [GenericTypeParamDecl] B
+#  150|   getGenericTypeParam(2): [GenericTypeParamDecl] C
+#  150|   getParam(0): [ParamDecl] _
+#  150|       Type = A
+#  150|   getParam(1): [ParamDecl] _
+#  150|       Type = B
+#  150|   getParam(2): [ParamDecl] _
+#  150|       Type = C
+#  150|   getBody(): [BraceStmt] { ... }
+#  152| [ClassDecl] Derived
+#  152|   getMember(0): [ConstructorDecl] init()
+#  152|       InterfaceType = (Derived.Type) -> () -> Derived
+#  152|     getSelfParam(): [ParamDecl] self
+#  152|         Type = Derived
+#  152|   getMember(1): [DestructorDecl] deinit()
+#  152|       InterfaceType = (Derived) -> () -> ()
+#  152|     getSelfParam(): [ParamDecl] self
+#  152|         Type = Derived
+#  152|     getBody(): [BraceStmt] { ... }
+#  154| [Comment] // multiple conversions
+#  154| 
+#  155| [TopLevelCodeDecl] { ... }
+#  155|   getBody(): [BraceStmt] { ... }
+#  155|     getElement(0): [PatternBindingDecl] var ... = ...
+#  155|       getInit(0): [CallExpr] call to init()
+#  155|         getFunction(): [ConstructorRefCallExpr] call to init()
+#  155|           getFunction(): [DeclRefExpr] init()
+#  155|           getArgument(0): [Argument] : Derived.Type
+#  155|             getExpr(): [TypeExpr] Derived.Type
+#  155|               getTypeRepr(): [TypeRepr] Derived
+#  155|       getInit(0).getFullyConverted(): [InjectIntoOptionalExpr] (Baz?) ...
+#  155|         getImmediateSubExpr(): [CoerceExpr] (Baz) ...
+#  155|           getImmediateSubExpr(): [DerivedToBaseExpr] (Baz) ...
+#  155|       getPattern(0): [TypedPattern] ... as ...
+#  155|         getSubPattern(): [NamedPattern] d
+#  155|         getTypeRepr(): [TypeRepr] Baz?
+#  155| [ConcreteVarDecl] d
+#  155|     Type = Baz?
+expressions.swift:
+#    1| [TopLevelCodeDecl] { ... }
+#    1|   getBody(): [BraceStmt] { ... }
+#    1|     getElement(0): [PatternBindingDecl] var ... = ...
+#    1|       getInit(0): [IntegerLiteralExpr] 15
+#    1|       getPattern(0): [NamedPattern] a
+#    1| [ConcreteVarDecl] a
+#    1|     Type = Int
+#    2| [TopLevelCodeDecl] { ... }
+#    2|   getBody(): [BraceStmt] { ... }
+#    2|     getElement(0): [PatternBindingDecl] var ... = ...
+#    2|       getInit(0): [FloatLiteralExpr] 15.15
+#    2|       getPattern(0): [NamedPattern] b
+#    2| [ConcreteVarDecl] b
+#    2|     Type = Double
+#    3| [TopLevelCodeDecl] { ... }
+#    3|   getBody(): [BraceStmt] { ... }
+#    3|     getElement(0): [PatternBindingDecl] var ... = ...
+#    3|       getInit(0): [BooleanLiteralExpr] true
+#    3|       getPattern(0): [NamedPattern] b1
+#    3| [ConcreteVarDecl] b1
+#    3|     Type = Bool
+#    4| [TopLevelCodeDecl] { ... }
+#    4|   getBody(): [BraceStmt] { ... }
+#    4|     getElement(0): [PatternBindingDecl] var ... = ...
+#    4|       getInit(0): [BooleanLiteralExpr] false
+#    4|       getPattern(0): [NamedPattern] b2
+#    4| [ConcreteVarDecl] b2
+#    4|     Type = Bool
+#    5| [TopLevelCodeDecl] { ... }
+#    5|   getBody(): [BraceStmt] { ... }
+#    5|     getElement(0): [PatternBindingDecl] var ... = ...
+#    5|       getInit(0): [MagicIdentifierLiteralExpr] #...
+#    5|       getPattern(0): [NamedPattern] m
+#    5| [ConcreteVarDecl] m
+#    5|     Type = String
+#    6| [TopLevelCodeDecl] { ... }
+#    6|   getBody(): [BraceStmt] { ... }
+#    6|     getElement(0): [PatternBindingDecl] var ... = ...
+#    6|       getInit(0): [StringLiteralExpr] hello world
+#    6|       getPattern(0): [NamedPattern] s
+#    6| [ConcreteVarDecl] s
+#    6|     Type = String
+#    7| [TopLevelCodeDecl] { ... }
+#    7|   getBody(): [BraceStmt] { ... }
+#    7|     getElement(0): [PatternBindingDecl] var ... = ...
+#    7|       getInit(0): [InterpolatedStringLiteralExpr] "..."
+#    7|         getAppendingExpr(): [TapExpr] TapExpr
+#    7|           getSubExpr(): [OpaqueValueExpr] OpaqueValueExpr
+#    7|           getBody(): [BraceStmt] { ... }
+#    7|             getElement(1): [CallExpr] call to appendLiteral(_:)
+#    7|               getFunction(): [MethodRefExpr] .appendLiteral(_:)
+#    7|                 getBase(): [InOutExpr] &...
+#    7|                   getSubExpr(): [DeclRefExpr] $interpolation
+#    7|               getArgument(0): [Argument] : hello 
+#    7|                 getExpr(): [StringLiteralExpr] hello 
+#    7|             getElement(2): [CallExpr] call to appendInterpolation(_:)
+#    7|               getFunction(): [MethodRefExpr] .appendInterpolation(_:)
+#    7|                 getBase(): [InOutExpr] &...
+#    7|                   getSubExpr(): [DeclRefExpr] $interpolation
+#    7|               getArgument(0): [Argument] : a
+#    7|                 getExpr(): [DeclRefExpr] a
+#    7|             getElement(3): [CallExpr] call to appendLiteral(_:)
+#    7|               getFunction(): [MethodRefExpr] .appendLiteral(_:)
+#    7|                 getBase(): [InOutExpr] &...
+#    7|                   getSubExpr(): [DeclRefExpr] $interpolation
+#    7|               getArgument(0): [Argument] : 
+#    7|                 getExpr(): [StringLiteralExpr] 
+#    7|       getPattern(0): [NamedPattern] s1
+#    7| [ConcreteVarDecl] s1
+#    7|     Type = String
+#    8| [TopLevelCodeDecl] { ... }
+#    8|   getBody(): [BraceStmt] { ... }
+#    8|     getElement(0): [PatternBindingDecl] var ... = ...
+#    8|       getInit(0): [NilLiteralExpr] nil
+#    8|       getPattern(0): [TypedPattern] ... as ...
+#    8|         getSubPattern(): [NamedPattern] n
+#    8|         getTypeRepr(): [TypeRepr] Int?
+#    8| [ConcreteVarDecl] n
+#    8|     Type = Int?
+#   10| [EnumDecl] AnError
+#   11|   getMember(0): [EnumCaseDecl] case ...
+#   11|   getMember(1): [EnumElementDecl] failed
+#   14| [ConcreteFuncDecl] failure(_:)
+#   14|     InterfaceType = (Int) throws -> ()
+#   14|   getParam(0): [ParamDecl] x
+#   14|       Type = Int
+#   14|   getBody(): [BraceStmt] { ... }
+#   15|     getElement(0): [GuardStmt] guard ... else { ... }
+#   15|       getCondition(): [StmtCondition] StmtCondition
+#   15|         getElement(0): [ConditionElement] ... .!=(_:_:) ...
+#   15|           getBoolean(): [BinaryExpr] ... .!=(_:_:) ...
+#   15|             getFunction(): [MethodRefExpr] .!=(_:_:)
+#   15|               getBase(): [TypeExpr] Int.Type
+#   15|                 getTypeRepr(): [TypeRepr] Int
+#   15|             getArgument(0): [Argument] : x
+#   15|               getExpr(): [DeclRefExpr] x
+#   15|             getArgument(1): [Argument] : 0
+#   15|               getExpr(): [IntegerLiteralExpr] 0
+#   15|       getBody(): [BraceStmt] { ... }
+#   16|         getElement(0): [ThrowStmt] throw ...
+#   16|           getSubExpr(): [MethodRefExpr] .failed
+#   16|             getBase(): [TypeExpr] AnError.Type
+#   16|               getTypeRepr(): [TypeRepr] AnError
+#   16|           getSubExpr().getFullyConverted(): [ErasureExpr] (Error) ...
+#   20| [TopLevelCodeDecl] { ... }
+#   20|   getBody(): [BraceStmt] { ... }
+#   20|     getElement(0): [ForceTryExpr] try! ...
+#   20|       getSubExpr(): [CallExpr] call to failure(_:)
+#   20|         getFunction(): [DeclRefExpr] failure(_:)
+#   20|         getArgument(0): [Argument] : 11
+#   20|           getExpr(): [IntegerLiteralExpr] 11
+#   21| [TopLevelCodeDecl] { ... }
+#   21|   getBody(): [BraceStmt] { ... }
+#   21|     getElement(0): [OptionalTryExpr] try? ...
+#   21|       getSubExpr(): [CallExpr] call to failure(_:)
+#   21|         getFunction(): [DeclRefExpr] failure(_:)
+#   21|         getArgument(0): [Argument] : 11
+#   21|           getExpr(): [IntegerLiteralExpr] 11
+#   21|       getSubExpr().getFullyConverted(): [InjectIntoOptionalExpr] (()?) ...
+#   23| [ClassDecl] Klass
+#   24|   getMember(0): [ConstructorDecl] init()
+#   24|       InterfaceType = (Klass.Type) -> () -> Klass
+#   24|     getSelfParam(): [ParamDecl] self
+#   24|         Type = Klass
+#   24|     getBody(): [BraceStmt] { ... }
+#   24|       getElement(0): [ReturnStmt] return
+#   23|   getMember(1): [DestructorDecl] deinit()
+#   23|       InterfaceType = (Klass) -> () -> ()
+#   23|     getSelfParam(): [ParamDecl] self
+#   23|         Type = Klass
+#   23|     getBody(): [BraceStmt] { ... }
+#   27| [TopLevelCodeDecl] { ... }
+#   27|   getBody(): [BraceStmt] { ... }
+#   27|     getElement(0): [PatternBindingDecl] var ... = ...
+#   27|       getInit(0): [CallExpr] call to init()
+#   27|         getFunction(): [ConstructorRefCallExpr] call to init()
+#   27|           getFunction(): [DeclRefExpr] init()
+#   27|           getArgument(0): [Argument] : Klass.Type
+#   27|             getExpr(): [TypeExpr] Klass.Type
+#   27|               getTypeRepr(): [TypeRepr] Klass
+#   27|       getPattern(0): [NamedPattern] klass
+#   27| [ConcreteVarDecl] klass
+#   27|     Type = Klass
+#   29| [TopLevelCodeDecl] { ... }
+#   29|   getBody(): [BraceStmt] { ... }
+#   29|     getElement(0): [PatternBindingDecl] var ... = ...
+#   29|       getInit(0): [DictionaryExpr] [...]
+#   29|         getElement(0): [TupleExpr] (...)
+#   29|           getElement(0): [StringLiteralExpr] 1
+#   29|           getElement(1): [StringLiteralExpr] 2
+#   29|       getPattern(0): [NamedPattern] d
+#   29| [ConcreteVarDecl] d
+#   29|     Type = [String : String]
+#   30| [TopLevelCodeDecl] { ... }
+#   30|   getBody(): [BraceStmt] { ... }
+#   30|     getElement(0): [AssignExpr]  ... = ...
+#   30|       getDest(): [DiscardAssignmentExpr] _
+#   30|       getSource(): [IntegerLiteralExpr] 15
+#   31| [TopLevelCodeDecl] { ... }
+#   31|   getBody(): [BraceStmt] { ... }
+#   31|     getElement(0): [AssignExpr]  ... = ...
+#   31|       getDest(): [DiscardAssignmentExpr] _
+#   31|       getSource(): [IntegerLiteralExpr] 15
+#   31|       getSource().getFullyConverted(): [IsExpr] ... is ...
+#   32| [TopLevelCodeDecl] { ... }
+#   32|   getBody(): [BraceStmt] { ... }
+#   32|     getElement(0): [AssignExpr]  ... = ...
+#   32|       getDest(): [DiscardAssignmentExpr] _
+#   32|       getSource(): [IntegerLiteralExpr] 15
+#   32|       getSource().getFullyConverted(): [CoerceExpr] (Double) ...
+#   33| [TopLevelCodeDecl] { ... }
+#   33|   getBody(): [BraceStmt] { ... }
+#   33|     getElement(0): [AssignExpr]  ... = ...
+#   33|       getDest(): [DiscardAssignmentExpr] _
+#   33|       getSource(): [IntegerLiteralExpr] 15
+#   33|       getSource().getFullyConverted(): [ConditionalCheckedCastExpr] (Double?) ...
+#   34| [TopLevelCodeDecl] { ... }
+#   34|   getBody(): [BraceStmt] { ... }
+#   34|     getElement(0): [AssignExpr]  ... = ...
+#   34|       getDest(): [DiscardAssignmentExpr] _
+#   34|       getSource(): [IntegerLiteralExpr] 15
+#   34|       getSource().getFullyConverted(): [ForcedCheckedCastExpr] (Double) ...
+#   35| [TopLevelCodeDecl] { ... }
+#   35|   getBody(): [BraceStmt] { ... }
+#   35|     getElement(0): [CallExpr] call to print(_:separator:terminator:)
+#   35|       getFunction(): [DeclRefExpr] print(_:separator:terminator:)
+#   35|       getArgument(0): [Argument] : [...]
+#   35|         getExpr(): [VarargExpansionExpr] [...]
+#   35|           getSubExpr(): [ArrayExpr] [...]
+#   35|             getElement(0): [SubscriptExpr] ...[...]
+#   35|               getBase(): [DeclRefExpr] d
+#   35|               getArgument(0): [Argument] : 1
+#   35|                 getExpr(): [StringLiteralExpr] 1
+#   35|             getElement(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   35|       getArgument(1): [Argument] separator: default separator
+#   35|         getExpr(): [DefaultArgumentExpr] default separator
+#   35|       getArgument(2): [Argument] terminator: default terminator
+#   35|         getExpr(): [DefaultArgumentExpr] default terminator
+#   37| [ConcreteFuncDecl] closured(closure:)
+#   37|     InterfaceType = ((Int, Int) -> Int) -> ()
+#   37|   getParam(0): [ParamDecl] closure
+#   37|       Type = (Int, Int) -> Int
+#   37|   getBody(): [BraceStmt] { ... }
+#   38|     getElement(0): [CallExpr] call to ...
+#   38|       getFunction(): [DeclRefExpr] closure
+#   38|       getArgument(0): [Argument] : 5
+#   38|         getExpr(): [IntegerLiteralExpr] 5
+#   38|       getArgument(1): [Argument] : 7
+#   38|         getExpr(): [IntegerLiteralExpr] 7
+#   41| [TopLevelCodeDecl] { ... }
+#   41|   getBody(): [BraceStmt] { ... }
+#   41|     getElement(0): [CallExpr] call to closured(closure:)
+#   41|       getFunction(): [DeclRefExpr] closured(closure:)
+#   41|       getArgument(0): [Argument] closure: { ... }
+#   41|         getExpr(): [ClosureExpr] { ... }
+#   41|           getParam(0): [ParamDecl] x
+#   41|               Type = Int
+#   41|           getParam(1): [ParamDecl] y
+#   41|               Type = Int
+#   41|           getBody(): [BraceStmt] { ... }
+#   42|             getElement(0): [ReturnStmt] return ...
+#   42|               getResult(): [BinaryExpr] ... .+(_:_:) ...
+#   42|                 getFunction(): [MethodRefExpr] .+(_:_:)
+#   42|                   getBase(): [TypeExpr] Int.Type
+#   42|                     getTypeRepr(): [TypeRepr] Int
+#   42|                 getArgument(0): [Argument] : x
+#   42|                   getExpr(): [DeclRefExpr] x
+#   42|                 getArgument(1): [Argument] : y
+#   42|                   getExpr(): [DeclRefExpr] y
+#   44| [TopLevelCodeDecl] { ... }
+#   44|   getBody(): [BraceStmt] { ... }
+#   44|     getElement(0): [CallExpr] call to closured(closure:)
+#   44|       getFunction(): [DeclRefExpr] closured(closure:)
+#   44|       getArgument(0): [Argument] closure: { ... }
+#   44|         getExpr(): [ClosureExpr] { ... }
+#   44|           getParam(0): [ParamDecl] x
+#   44|               Type = Int
+#   44|           getParam(1): [ParamDecl] y
+#   44|               Type = Int
+#   44|           getBody(): [BraceStmt] { ... }
+#   45|             getElement(0): [ReturnStmt] return ...
+#   45|               getResult(): [BinaryExpr] ... .+(_:_:) ...
+#   45|                 getFunction(): [MethodRefExpr] .+(_:_:)
+#   45|                   getBase(): [TypeExpr] Int.Type
+#   45|                     getTypeRepr(): [TypeRepr] Int
+#   45|                 getArgument(0): [Argument] : x
+#   45|                   getExpr(): [DeclRefExpr] x
+#   45|                 getArgument(1): [Argument] : y
+#   45|                   getExpr(): [DeclRefExpr] y
+#   47| [TopLevelCodeDecl] { ... }
+#   47|   getBody(): [BraceStmt] { ... }
+#   47|     getElement(0): [CallExpr] call to closured(closure:)
+#   47|       getFunction(): [DeclRefExpr] closured(closure:)
+#   47|       getArgument(0): [Argument] closure: { ... }
+#   47|         getExpr(): [ClosureExpr] { ... }
+#   47|           getParam(0): [ParamDecl] $0
+#   47|               Type = Int
+#   47|           getParam(1): [ParamDecl] $1
+#   47|               Type = Int
+#   47|           getBody(): [BraceStmt] { ... }
+#   47|             getElement(0): [ReturnStmt] return ...
+#   47|               getResult(): [BinaryExpr] ... .+(_:_:) ...
+#   47|                 getFunction(): [MethodRefExpr] .+(_:_:)
+#   47|                   getBase(): [TypeExpr] Int.Type
+#   47|                     getTypeRepr(): [TypeRepr] Int
+#   47|                 getArgument(0): [Argument] : $0
+#   47|                   getExpr(): [DeclRefExpr] $0
+#   47|                 getArgument(1): [Argument] : $1
+#   47|                   getExpr(): [DeclRefExpr] $1
+#   48| [TopLevelCodeDecl] { ... }
+#   48|   getBody(): [BraceStmt] { ... }
+#   48|     getElement(0): [CallExpr] call to closured(closure:)
+#   48|       getFunction(): [DeclRefExpr] closured(closure:)
+#   48|       getArgument(0): [Argument] closure: { ... }
+#   48|         getExpr(): [ClosureExpr] { ... }
+#   48|           getParam(0): [ParamDecl] $0
+#   48|               Type = Int
+#   48|           getParam(1): [ParamDecl] $1
+#   48|               Type = Int
+#   48|           getBody(): [BraceStmt] { ... }
+#   48|             getElement(0): [ReturnStmt] return ...
+#   48|               getResult(): [BinaryExpr] ... .+(_:_:) ...
+#   48|                 getFunction(): [MethodRefExpr] .+(_:_:)
+#   48|                   getBase(): [TypeExpr] Int.Type
+#   48|                     getTypeRepr(): [TypeRepr] Int
+#   48|                 getArgument(0): [Argument] : $0
+#   48|                   getExpr(): [DeclRefExpr] $0
+#   48|                 getArgument(1): [Argument] : $1
+#   48|                   getExpr(): [DeclRefExpr] $1
+#   50| [StructDecl] S
+#   51|   getMember(0): [PatternBindingDecl] var ... = ...
+#   51|     getPattern(0): [TypedPattern] ... as ...
+#   51|       getSubPattern(): [NamedPattern] x
+#   51|       getTypeRepr(): [TypeRepr] Int
+#   51|   getMember(1): [ConcreteVarDecl] x
+#   51|       Type = Int
+#   51|     getAccessorDecl(0): [AccessorDecl] get
+#   51|         InterfaceType = (S) -> () -> Int
+#   51|       getSelfParam(): [ParamDecl] self
+#   51|           Type = S
+#   51|       getBody(): [BraceStmt] { ... }
+#   50|   getMember(2): [ConstructorDecl] init(x:)
+#   50|       InterfaceType = (S.Type) -> (Int) -> S
+#   50|     getSelfParam(): [ParamDecl] self
+#   50|         Type = S
+#   50|     getParam(0): [ParamDecl] x
+#   50|         Type = Int
+#   54| [TopLevelCodeDecl] { ... }
+#   54|   getBody(): [BraceStmt] { ... }
+#   54|     getElement(0): [AssignExpr]  ... = ...
+#   54|       getDest(): [DiscardAssignmentExpr] _
+#   54|       getSource(): [KeyPathExpr] #keyPath(...)
+#   54|         getRoot(): [TypeRepr] S
+#   56| [ConcreteFuncDecl] unsafeFunction(pointer:)
+#   56|     InterfaceType = (UnsafePointer<Int>) -> ()
+#   56|   getParam(0): [ParamDecl] pointer
+#   56|       Type = UnsafePointer<Int>
+#   56|   getBody(): [BraceStmt] { ... }
+#   58| [TopLevelCodeDecl] { ... }
+#   58|   getBody(): [BraceStmt] { ... }
+#   58|     getElement(0): [PatternBindingDecl] var ... = ...
+#   58|       getInit(0): [IntegerLiteralExpr] 1234
+#   58|       getPattern(0): [NamedPattern] myNumber
+#   58| [ConcreteVarDecl] myNumber
+#   58|     Type = Int
+#   59| [TopLevelCodeDecl] { ... }
+#   59|   getBody(): [BraceStmt] { ... }
+#   59|     getElement(0): [CallExpr] call to unsafeFunction(pointer:)
+#   59|       getFunction(): [DeclRefExpr] unsafeFunction(pointer:)
+#   59|       getArgument(0): [Argument] pointer: &...
+#   59|         getExpr(): [InOutExpr] &...
+#   59|           getSubExpr(): [DeclRefExpr] myNumber
+#   59|         getExpr().getFullyConverted(): [InOutToPointerExpr] (UnsafePointer<Int>) ...
+#   60| [TopLevelCodeDecl] { ... }
+#   60|   getBody(): [BraceStmt] { ... }
+#   60|     getElement(0): [CallExpr] call to withUnsafePointer(to:_:)
+#   60|       getFunction(): [DeclRefExpr] withUnsafePointer(to:_:)
+#   60|       getArgument(0): [Argument] to: myNumber
+#   60|         getExpr(): [DeclRefExpr] myNumber
+#   60|         getExpr().getFullyConverted(): [LoadExpr] (Int) ...
+#   60|       getArgument(1): [Argument] : { ... }
+#   60|         getExpr(): [ClosureExpr] { ... }
+#   60|           getParam(0): [ParamDecl] $0
+#   60|               Type = UnsafePointer<Int>
+#   60|           getBody(): [BraceStmt] { ... }
+#   60|             getElement(0): [ReturnStmt] return ...
+#   60|               getResult(): [CallExpr] call to unsafeFunction(pointer:)
+#   60|                 getFunction(): [DeclRefExpr] unsafeFunction(pointer:)
+#   60|                 getArgument(0): [Argument] pointer: $0
+#   60|                   getExpr(): [DeclRefExpr] $0
+#   60|         getExpr().getFullyConverted(): [FunctionConversionExpr] ((UnsafePointer<Int>) throws -> ()) ...
+#   62| [ClassDecl] FailingToInit
+#   63|   getMember(0): [ConstructorDecl] init(x:)
+#   63|       InterfaceType = (FailingToInit.Type) -> (Int) -> FailingToInit?
+#   63|     getSelfParam(): [ParamDecl] self
+#   63|         Type = FailingToInit
+#   63|     getParam(0): [ParamDecl] x
+#   63|         Type = Int
+#   63|     getBody(): [BraceStmt] { ... }
+#   64|       getElement(0): [IfStmt] if ... then { ... }
+#   64|         getCondition(): [StmtCondition] StmtCondition
+#   64|           getElement(0): [ConditionElement] ... .<(_:_:) ...
+#   64|             getBoolean(): [BinaryExpr] ... .<(_:_:) ...
+#   64|               getFunction(): [MethodRefExpr] .<(_:_:)
+#   64|                 getBase(): [TypeExpr] Int.Type
+#   64|                   getTypeRepr(): [TypeRepr] Int
+#   64|               getArgument(0): [Argument] : x
+#   64|                 getExpr(): [DeclRefExpr] x
+#   64|               getArgument(1): [Argument] : 0
+#   64|                 getExpr(): [IntegerLiteralExpr] 0
+#   64|         getThen(): [BraceStmt] { ... }
+#   65|           getElement(0): [FailStmt] fail
+#   67|       getElement(1): [ReturnStmt] return
+#   62|   getMember(1): [DestructorDecl] deinit()
+#   62|       InterfaceType = (FailingToInit) -> () -> ()
+#   62|     getSelfParam(): [ParamDecl] self
+#   62|         Type = FailingToInit
+#   62|     getBody(): [BraceStmt] { ... }
+#   70| [ClassDecl] Base
+#   71|   getMember(0): [PatternBindingDecl] var ... = ...
+#   71|     getPattern(0): [TypedPattern] ... as ...
+#   71|       getSubPattern(): [NamedPattern] xx
+#   71|       getTypeRepr(): [TypeRepr] Int
+#   71|   getMember(1): [ConcreteVarDecl] xx
+#   71|       Type = Int
+#   71|     getAccessorDecl(0): [AccessorDecl] get
+#   71|         InterfaceType = (Base) -> () -> Int
+#   71|       getSelfParam(): [ParamDecl] self
+#   71|           Type = Base
+#   71|       getBody(): [BraceStmt] { ... }
+#   72|   getMember(2): [ConstructorDecl] init(x:)
+#   72|       InterfaceType = (Base.Type) -> (Int) -> Base
+#   72|     getSelfParam(): [ParamDecl] self
+#   72|         Type = Base
+#   72|     getParam(0): [ParamDecl] x
+#   72|         Type = Int
+#   72|     getBody(): [BraceStmt] { ... }
+#   73|       getElement(0): [AssignExpr]  ... = ...
+#   73|         getDest(): [MemberRefExpr] .xx
+#   73|           getBase(): [DeclRefExpr] self
+#   73|         getSource(): [DeclRefExpr] x
+#   74|       getElement(1): [ReturnStmt] return
+#   70|   getMember(3): [DestructorDecl] deinit()
+#   70|       InterfaceType = (Base) -> () -> ()
+#   70|     getSelfParam(): [ParamDecl] self
+#   70|         Type = Base
+#   70|     getBody(): [BraceStmt] { ... }
+#   77| [ClassDecl] Derived
+#   78|   getMember(0): [ConstructorDecl] init()
+#   78|       InterfaceType = (Derived.Type) -> () -> Derived
+#   78|     getSelfParam(): [ParamDecl] self
+#   78|         Type = Derived
+#   78|     getBody(): [BraceStmt] { ... }
+#   79|       getElement(0): [RebindSelfInConstructorExpr] self = ...
+#   79|         getSubExpr(): [CallExpr] call to ...
+#   79|           getFunction(): [DotSyntaxCallExpr] call to ...
+#   79|             getFunction(): [OtherConstructorDeclRefExpr] init(x:)
+#   79|             getArgument(0): [Argument] : super
+#   79|               getExpr(): [SuperRefExpr] super
+#   79|           getArgument(0): [Argument] x: 22
+#   79|             getExpr(): [IntegerLiteralExpr] 22
+#   80|       getElement(1): [ReturnStmt] return
+#   77|   getMember(1): [ConstructorDecl] init(x:)
+#   77|       InterfaceType = (Derived.Type) -> (Int) -> Derived
+#   77|     getSelfParam(): [ParamDecl] self
+#   77|         Type = Derived
+#   77|   getMember(2): [DestructorDecl] deinit()
+#   77|       InterfaceType = (Derived) -> () -> ()
+#   77|     getSelfParam(): [ParamDecl] self
+#   77|         Type = Derived
+#   77|     getBody(): [BraceStmt] { ... }
+#   77| [CallExpr] call to _unimplementedInitializer(className:initName:file:line:column:)
+#   77|   getFunction(): [DeclRefExpr] _unimplementedInitializer(className:initName:file:line:column:)
+#   77|   getArgument(0): [Argument] : expressions.Derived
+#   77|     getExpr(): [StringLiteralExpr] expressions.Derived
+#   77|   getArgument(1): [Argument] : #...
+#   77|     getExpr(): [MagicIdentifierLiteralExpr] #...
+#   77|   getArgument(2): [Argument] : #...
+#   77|     getExpr(): [MagicIdentifierLiteralExpr] #...
+#   77|   getArgument(3): [Argument] : #...
+#   77|     getExpr(): [MagicIdentifierLiteralExpr] #...
+#   77|   getArgument(4): [Argument] : #...
+#   77|     getExpr(): [MagicIdentifierLiteralExpr] #...
+#   83| [TopLevelCodeDecl] { ... }
+#   83|   getBody(): [BraceStmt] { ... }
+#   83|     getElement(0): [PatternBindingDecl] var ... = ...
+#   83|       getInit(0): [CallExpr] call to init()
+#   83|         getFunction(): [ConstructorRefCallExpr] call to init()
+#   83|           getFunction(): [DeclRefExpr] init()
+#   83|           getArgument(0): [Argument] : Derived.Type
+#   83|             getExpr(): [TypeExpr] Derived.Type
+#   83|               getTypeRepr(): [TypeRepr] Derived
+#   83|       getPattern(0): [NamedPattern] derived
+#   83| [ConcreteVarDecl] derived
+#   83|     Type = Derived
+#   84| [TopLevelCodeDecl] { ... }
+#   84|   getBody(): [BraceStmt] { ... }
+#   84|     getElement(0): [AssignExpr]  ... = ...
+#   84|       getDest(): [DiscardAssignmentExpr] _
+#   84|       getSource(): [MemberRefExpr] .xx
+#   84|         getBase(): [DeclRefExpr] derived
+#   84|         getBase().getFullyConverted(): [DerivedToBaseExpr] (Base) ...
+#   86| [TopLevelCodeDecl] { ... }
+#   86|   getBody(): [BraceStmt] { ... }
+#   86|     getElement(0): [PatternBindingDecl] var ... = ...
+#   86|       getPattern(0): [TypedPattern] ... as ...
+#   86|         getSubPattern(): [NamedPattern] opt
+#   86|         getTypeRepr(): [TypeRepr] Int?
+#   86| [ConcreteVarDecl] opt
+#   86|     Type = Int?
+#   87| [TopLevelCodeDecl] { ... }
+#   87|   getBody(): [BraceStmt] { ... }
+#   87|     getElement(0): [ForceValueExpr] ...!
+#   87|       getSubExpr(): [DeclRefExpr] opt
+#   88| [TopLevelCodeDecl] { ... }
+#   88|   getBody(): [BraceStmt] { ... }
+#   88|     getElement(0): [ForceValueExpr] ...!
+#   88|       getSubExpr(): [SubscriptExpr] ...[...]
+#   88|         getBase(): [DeclRefExpr] d
+#   88|         getArgument(0): [Argument] : a
+#   88|           getExpr(): [StringLiteralExpr] a
+#   90| [ClassDecl] ToPtr
+#   90|   getMember(0): [DestructorDecl] deinit()
+#   90|       InterfaceType = (ToPtr) -> () -> ()
+#   90|     getSelfParam(): [ParamDecl] self
+#   90|         Type = ToPtr
+#   90|     getBody(): [BraceStmt] { ... }
+#   90|   getMember(1): [ConstructorDecl] init()
+#   90|       InterfaceType = (ToPtr.Type) -> () -> ToPtr
+#   90|     getSelfParam(): [ParamDecl] self
+#   90|         Type = ToPtr
+#   90|     getBody(): [BraceStmt] { ... }
+#   90|       getElement(0): [ReturnStmt] return
+#   92| [TopLevelCodeDecl] { ... }
+#   92|   getBody(): [BraceStmt] { ... }
+#   92|     getElement(0): [PatternBindingDecl] var ... = ...
+#   92|       getInit(0): [CallExpr] call to toOpaque()
+#   92|         getFunction(): [MethodRefExpr] .toOpaque()
+#   92|           getBase(): [CallExpr] call to passRetained(_:)
+#   92|             getFunction(): [MethodRefExpr] .passRetained(_:)
+#   92|               getBase(): [TypeExpr] Unmanaged<ToPtr>.Type
+#   92|                 getTypeRepr(): [TypeRepr] Unmanaged<ToPtr>
+#   92|             getArgument(0): [Argument] : call to init()
+#   92|               getExpr(): [CallExpr] call to init()
+#   92|                 getFunction(): [ConstructorRefCallExpr] call to init()
+#   92|                   getFunction(): [DeclRefExpr] init()
+#   92|                   getArgument(0): [Argument] : ToPtr.Type
+#   92|                     getExpr(): [TypeExpr] ToPtr.Type
+#   92|                       getTypeRepr(): [TypeRepr] ToPtr
+#   92|       getPattern(0): [NamedPattern] opaque
+#   92| [ConcreteVarDecl] opaque
+#   92|     Type = UnsafeMutableRawPointer
+#   93| [TopLevelCodeDecl] { ... }
+#   93|   getBody(): [BraceStmt] { ... }
+#   93|     getElement(0): [CallExpr] call to fromOpaque(_:)
+#   93|       getFunction(): [MethodRefExpr] .fromOpaque(_:)
+#   93|         getBase(): [TypeExpr] Unmanaged<ToPtr>.Type
+#   93|           getTypeRepr(): [TypeRepr] Unmanaged<ToPtr>
+#   93|       getArgument(0): [Argument] : opaque
+#   93|         getExpr(): [DeclRefExpr] opaque
+#   93|         getExpr().getFullyConverted(): [PointerToPointerExpr] (UnsafeRawPointer) ...
+#   95| [StructDecl] HasProperty
+#   96|   getMember(0): [PatternBindingDecl] var ... = ...
+#   96|     getPattern(0): [TypedPattern] ... as ...
+#   96|       getSubPattern(): [NamedPattern] settableField
+#   96|       getTypeRepr(): [TypeRepr] Int
+#   96|   getMember(1): [ConcreteVarDecl] settableField
+#   96|       Type = Int
+#   97|     getAccessorDecl(0): [AccessorDecl] set
+#   97|         InterfaceType = (inout HasProperty) -> (Int) -> ()
+#   97|       getSelfParam(): [ParamDecl] self
+#   97|           Type = HasProperty
+#   97|       getParam(0): [ParamDecl] newValue
+#   97|           Type = Int
+#   97|       getBody(): [BraceStmt] { ... }
+#   98|     getAccessorDecl(1): [AccessorDecl] get
+#   98|         InterfaceType = (HasProperty) -> () -> Int
+#   98|       getSelfParam(): [ParamDecl] self
+#   98|           Type = HasProperty
+#   98|       getBody(): [BraceStmt] { ... }
+#   99|         getElement(0): [ReturnStmt] return ...
+#   99|           getResult(): [IntegerLiteralExpr] 0
+#   96|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#   96|         InterfaceType = (inout HasProperty) -> () -> ()
+#   96|       getSelfParam(): [ParamDecl] self
+#   96|           Type = HasProperty
+#   96|       getBody(): [BraceStmt] { ... }
+#   96|         getElement(0): [YieldStmt] yield ...
+#  105|   getMember(2): [PatternBindingDecl] var ... = ...
+#  105|     getPattern(0): [TypedPattern] ... as ...
+#  105|       getSubPattern(): [NamedPattern] readOnlyField1
+#  105|       getTypeRepr(): [TypeRepr] Int
+#  105|   getMember(3): [ConcreteVarDecl] readOnlyField1
+#  105|       Type = Int
+#  105|     getAccessorDecl(0): [AccessorDecl] get
+#  105|         InterfaceType = (HasProperty) -> () -> Int
+#  105|       getSelfParam(): [ParamDecl] self
+#  105|           Type = HasProperty
+#  105|       getBody(): [BraceStmt] { ... }
+#  106|         getElement(0): [ReturnStmt] return ...
+#  106|           getResult(): [IntegerLiteralExpr] 0
+#  110|   getMember(4): [PatternBindingDecl] var ... = ...
+#  110|     getPattern(0): [TypedPattern] ... as ...
+#  110|       getSubPattern(): [NamedPattern] readOnlyField2
+#  110|       getTypeRepr(): [TypeRepr] Int
+#  110|   getMember(5): [ConcreteVarDecl] readOnlyField2
+#  110|       Type = Int
+#  111|     getAccessorDecl(0): [AccessorDecl] get
+#  111|         InterfaceType = (HasProperty) -> () -> Int
+#  111|       getSelfParam(): [ParamDecl] self
+#  111|           Type = HasProperty
+#  111|       getBody(): [BraceStmt] { ... }
+#  112|         getElement(0): [ReturnStmt] return ...
+#  112|           getResult(): [IntegerLiteralExpr] 0
+#  116|   getMember(6): [PatternBindingDecl] var ... = ...
+#  116|     getPattern(0): [TypedPattern] ... as ...
+#  116|       getSubPattern(): [NamedPattern] normalField
+#  116|       getTypeRepr(): [TypeRepr] Int
+#  116|   getMember(7): [ConcreteVarDecl] normalField
+#  116|       Type = Int
+#  116|     getAccessorDecl(0): [AccessorDecl] get
+#  116|         InterfaceType = (HasProperty) -> () -> Int
+#  116|       getSelfParam(): [ParamDecl] self
+#  116|           Type = HasProperty
+#  116|       getBody(): [BraceStmt] { ... }
+#  116|     getAccessorDecl(1): [AccessorDecl] set
+#  116|         InterfaceType = (inout HasProperty) -> (Int) -> ()
+#  116|       getSelfParam(): [ParamDecl] self
+#  116|           Type = HasProperty
+#  116|       getParam(0): [ParamDecl] value
+#  116|           Type = Int
+#  116|       getBody(): [BraceStmt] { ... }
+#  116|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#  116|         InterfaceType = (inout HasProperty) -> () -> ()
+#  116|       getSelfParam(): [ParamDecl] self
+#  116|           Type = HasProperty
+#  116|       getBody(): [BraceStmt] { ... }
+#  116|         getElement(0): [YieldStmt] yield ...
+#  118|   getMember(8): [SubscriptDecl] subscript ...
+#  119|     getAccessorDecl(0): [AccessorDecl] get
+#  119|         InterfaceType = (HasProperty) -> (Int) -> Int
+#  119|       getSelfParam(): [ParamDecl] self
+#  119|           Type = HasProperty
+#  118|       getParam(0): [ParamDecl] x
+#  118|           Type = Int
+#  119|       getBody(): [BraceStmt] { ... }
+#  120|         getElement(0): [ReturnStmt] return ...
+#  120|           getResult(): [IntegerLiteralExpr] 0
+#  122|     getAccessorDecl(1): [AccessorDecl] set
+#  122|         InterfaceType = (inout HasProperty) -> (Int, Int) -> ()
+#  122|       getSelfParam(): [ParamDecl] self
+#  122|           Type = HasProperty
+#  122|       getParam(0): [ParamDecl] newValue
+#  122|           Type = Int
+#  118|       getParam(1): [ParamDecl] x
+#  118|           Type = Int
+#  122|       getBody(): [BraceStmt] { ... }
+#  118|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#  118|         InterfaceType = (inout HasProperty) -> (Int) -> ()
+#  118|       getSelfParam(): [ParamDecl] self
+#  118|           Type = HasProperty
+#  118|       getBody(): [BraceStmt] { ... }
+#  118|         getElement(0): [YieldStmt] yield ...
+#  118|     getParam(0): [ParamDecl] x
+#  118|         Type = Int
+#  125|   getMember(9): [SubscriptDecl] subscript ...
+#  125|     getAccessorDecl(0): [AccessorDecl] get
+#  125|         InterfaceType = (HasProperty) -> (Int, Int) -> Int
+#  125|       getSelfParam(): [ParamDecl] self
+#  125|           Type = HasProperty
+#  125|       getParam(0): [ParamDecl] x
+#  125|           Type = Int
+#  125|       getParam(1): [ParamDecl] y
+#  125|           Type = Int
+#  125|       getBody(): [BraceStmt] { ... }
+#  126|         getElement(0): [ReturnStmt] return ...
+#  126|           getResult(): [IntegerLiteralExpr] 0
+#  125|     getParam(0): [ParamDecl] x
+#  125|         Type = Int
+#  125|     getParam(1): [ParamDecl] y
+#  125|         Type = Int
+#   95|   getMember(10): [ConstructorDecl] init(normalField:)
+#   95|       InterfaceType = (HasProperty.Type) -> (Int) -> HasProperty
+#   95|     getSelfParam(): [ParamDecl] self
+#   95|         Type = HasProperty
+#   95|     getParam(0): [ParamDecl] normalField
+#   95|         Type = Int
+#  103| [Comment] // A field can be marked as read-only by dirctly implementing
+#  103| 
+#  104| [Comment] // the getter between the braces.
+#  104| 
+#  109| [Comment] // Or by adding an access declaration
+#  109| 
+#  130| [ConcreteFuncDecl] testProperties(hp:)
+#  130|     InterfaceType = (inout HasProperty) -> Int
+#  130|   getParam(0): [ParamDecl] hp
+#  130|       Type = HasProperty
+#  130|   getBody(): [BraceStmt] { ... }
+#  131|     getElement(0): [AssignExpr]  ... = ...
+#  131|       getDest(): [MemberRefExpr] .settableField
+#  131|         getBase(): [DeclRefExpr] hp
+#  131|       getSource(): [IntegerLiteralExpr] 42
+#  132|     getElement(1): [PatternBindingDecl] var ... = ...
+#  132|       getInit(0): [MemberRefExpr] .settableField
+#  132|         getBase(): [DeclRefExpr] hp
+#  132|       getInit(0).getFullyConverted(): [LoadExpr] (Int) ...
+#  132|       getPattern(0): [NamedPattern] x
+#  132|     getElement(2): [ConcreteVarDecl] x
+#  132|         Type = Int
+#  133|     getElement(3): [PatternBindingDecl] var ... = ...
+#  133|       getInit(0): [MemberRefExpr] .readOnlyField1
+#  133|         getBase(): [DeclRefExpr] hp
+#  133|         getBase().getFullyConverted(): [LoadExpr] (HasProperty) ...
+#  133|       getPattern(0): [NamedPattern] y
+#  133|     getElement(4): [ConcreteVarDecl] y
+#  133|         Type = Int
+#  134|     getElement(5): [PatternBindingDecl] var ... = ...
+#  134|       getInit(0): [MemberRefExpr] .readOnlyField2
+#  134|         getBase(): [DeclRefExpr] hp
+#  134|         getBase().getFullyConverted(): [LoadExpr] (HasProperty) ...
+#  134|       getPattern(0): [NamedPattern] z
+#  134|     getElement(6): [ConcreteVarDecl] z
+#  134|         Type = Int
+#  135|     getElement(7): [AssignExpr]  ... = ...
+#  135|       getDest(): [MemberRefExpr] .normalField
+#  135|         getBase(): [DeclRefExpr] hp
+#  135|       getSource(): [IntegerLiteralExpr] 99
+#  136|     getElement(8): [PatternBindingDecl] var ... = ...
+#  136|       getInit(0): [MemberRefExpr] .normalField
+#  136|         getBase(): [DeclRefExpr] hp
+#  136|       getInit(0).getFullyConverted(): [LoadExpr] (Int) ...
+#  136|       getPattern(0): [NamedPattern] w
+#  136|     getElement(9): [ConcreteVarDecl] w
+#  136|         Type = Int
+#  137|     getElement(10): [AssignExpr]  ... = ...
+#  137|       getDest(): [SubscriptExpr] ...[...]
+#  137|         getBase(): [InOutExpr] &...
+#  137|           getSubExpr(): [DeclRefExpr] hp
+#  137|         getArgument(0): [Argument] : 1
+#  137|           getExpr(): [IntegerLiteralExpr] 1
+#  137|       getSource(): [IntegerLiteralExpr] 2
+#  138|     getElement(11): [ReturnStmt] return ...
+#  138|       getResult(): [SubscriptExpr] ...[...]
+#  138|         getBase(): [DeclRefExpr] hp
+#  138|         getBase().getFullyConverted(): [LoadExpr] (HasProperty) ...
+#  138|         getArgument(0): [Argument] : 3
+#  138|           getExpr(): [IntegerLiteralExpr] 3
+#  138|         getArgument(1): [Argument] : 4
+#  138|           getExpr(): [IntegerLiteralExpr] 4
+#  141| [StructDecl] B
+#  142|   getMember(0): [PatternBindingDecl] var ... = ...
+#  142|     getPattern(0): [TypedPattern] ... as ...
+#  142|       getSubPattern(): [NamedPattern] x
+#  142|       getTypeRepr(): [TypeRepr] Int
+#  142|   getMember(1): [ConcreteVarDecl] x
+#  142|       Type = Int
+#  142|     getAccessorDecl(0): [AccessorDecl] get
+#  142|         InterfaceType = (B) -> () -> Int
+#  142|       getSelfParam(): [ParamDecl] self
+#  142|           Type = B
+#  142|       getBody(): [BraceStmt] { ... }
+#  142|     getAccessorDecl(1): [AccessorDecl] set
+#  142|         InterfaceType = (inout B) -> (Int) -> ()
+#  142|       getSelfParam(): [ParamDecl] self
+#  142|           Type = B
+#  142|       getParam(0): [ParamDecl] value
+#  142|           Type = Int
+#  142|       getBody(): [BraceStmt] { ... }
+#  142|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#  142|         InterfaceType = (inout B) -> () -> ()
+#  142|       getSelfParam(): [ParamDecl] self
+#  142|           Type = B
+#  142|       getBody(): [BraceStmt] { ... }
+#  142|         getElement(0): [YieldStmt] yield ...
+#  141|   getMember(2): [ConstructorDecl] init(x:)
+#  141|       InterfaceType = (B.Type) -> (Int) -> B
+#  141|     getSelfParam(): [ParamDecl] self
+#  141|         Type = B
+#  141|     getParam(0): [ParamDecl] x
+#  141|         Type = Int
+#  145| [StructDecl] A
+#  146|   getMember(0): [PatternBindingDecl] var ... = ...
+#  146|     getPattern(0): [TypedPattern] ... as ...
+#  146|       getSubPattern(): [NamedPattern] b
+#  146|       getTypeRepr(): [TypeRepr] B
+#  146|   getMember(1): [ConcreteVarDecl] b
+#  146|       Type = B
+#  146|     getAccessorDecl(0): [AccessorDecl] get
+#  146|         InterfaceType = (A) -> () -> B
+#  146|       getSelfParam(): [ParamDecl] self
+#  146|           Type = A
+#  146|       getBody(): [BraceStmt] { ... }
+#  146|     getAccessorDecl(1): [AccessorDecl] set
+#  146|         InterfaceType = (inout A) -> (B) -> ()
+#  146|       getSelfParam(): [ParamDecl] self
+#  146|           Type = A
+#  146|       getParam(0): [ParamDecl] value
+#  146|           Type = B
+#  146|       getBody(): [BraceStmt] { ... }
+#  146|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#  146|         InterfaceType = (inout A) -> () -> ()
+#  146|       getSelfParam(): [ParamDecl] self
+#  146|           Type = A
+#  146|       getBody(): [BraceStmt] { ... }
+#  146|         getElement(0): [YieldStmt] yield ...
+#  147|   getMember(2): [PatternBindingDecl] var ... = ...
+#  147|     getPattern(0): [TypedPattern] ... as ...
+#  147|       getSubPattern(): [NamedPattern] bs
+#  147|       getTypeRepr(): [TypeRepr] [B]
+#  147|   getMember(3): [ConcreteVarDecl] bs
+#  147|       Type = [B]
+#  147|     getAccessorDecl(0): [AccessorDecl] get
+#  147|         InterfaceType = (A) -> () -> [B]
+#  147|       getSelfParam(): [ParamDecl] self
+#  147|           Type = A
+#  147|       getBody(): [BraceStmt] { ... }
+#  147|     getAccessorDecl(1): [AccessorDecl] set
+#  147|         InterfaceType = (inout A) -> ([B]) -> ()
+#  147|       getSelfParam(): [ParamDecl] self
+#  147|           Type = A
+#  147|       getParam(0): [ParamDecl] value
+#  147|           Type = [B]
+#  147|       getBody(): [BraceStmt] { ... }
+#  147|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#  147|         InterfaceType = (inout A) -> () -> ()
+#  147|       getSelfParam(): [ParamDecl] self
+#  147|           Type = A
+#  147|       getBody(): [BraceStmt] { ... }
+#  147|         getElement(0): [YieldStmt] yield ...
+#  148|   getMember(4): [PatternBindingDecl] var ... = ...
+#  148|     getPattern(0): [TypedPattern] ... as ...
+#  148|       getSubPattern(): [NamedPattern] mayB
+#  148|       getTypeRepr(): [TypeRepr] B?
+#  148|   getMember(5): [ConcreteVarDecl] mayB
+#  148|       Type = B?
+#  148|     getAccessorDecl(0): [AccessorDecl] get
+#  148|         InterfaceType = (A) -> () -> B?
+#  148|       getSelfParam(): [ParamDecl] self
+#  148|           Type = A
+#  148|       getBody(): [BraceStmt] { ... }
+#  148|     getAccessorDecl(1): [AccessorDecl] set
+#  148|         InterfaceType = (inout A) -> (B?) -> ()
+#  148|       getSelfParam(): [ParamDecl] self
+#  148|           Type = A
+#  148|       getParam(0): [ParamDecl] value
+#  148|           Type = B?
+#  148|       getBody(): [BraceStmt] { ... }
+#  148|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#  148|         InterfaceType = (inout A) -> () -> ()
+#  148|       getSelfParam(): [ParamDecl] self
+#  148|           Type = A
+#  148|       getBody(): [BraceStmt] { ... }
+#  148|         getElement(0): [YieldStmt] yield ...
+#  145|   getMember(6): [ConstructorDecl] init(b:bs:mayB:)
+#  145|       InterfaceType = (A.Type) -> (B, [B], B?) -> A
+#  145|     getSelfParam(): [ParamDecl] self
+#  145|         Type = A
+#  145|     getParam(0): [ParamDecl] b
+#  145|         Type = B
+#  145|     getParam(1): [ParamDecl] bs
+#  145|         Type = [B]
+#  145|     getParam(2): [ParamDecl] mayB
+#  145|         Type = B?
+#  151| [ConcreteFuncDecl] test(a:keyPathInt:keyPathB:)
+#  151|     InterfaceType = (A, WritableKeyPath<A, Int>, WritableKeyPath<A, B>) -> ()
+#  151|   getParam(0): [ParamDecl] a
+#  151|       Type = A
+#  151|   getParam(1): [ParamDecl] keyPathInt
+#  151|       Type = WritableKeyPath<A, Int>
+#  151|   getParam(2): [ParamDecl] keyPathB
+#  151|       Type = WritableKeyPath<A, B>
+#  151|   getBody(): [BraceStmt] { ... }
+#  152|     getElement(0): [PatternBindingDecl] var ... = ...
+#  152|       getInit(0): [KeyPathApplicationExpr] \...[...]
+#  152|         getBase(): [DeclRefExpr] a
+#  152|         getKeyPath(): [DeclRefExpr] keyPathInt
+#  152|       getPattern(0): [NamedPattern] apply_keyPathInt
+#  152|     getElement(1): [ConcreteVarDecl] apply_keyPathInt
+#  152|         Type = Int
+#  153|     getElement(2): [PatternBindingDecl] var ... = ...
+#  153|       getInit(0): [KeyPathApplicationExpr] \...[...]
+#  153|         getBase(): [DeclRefExpr] a
+#  153|         getKeyPath(): [DeclRefExpr] keyPathB
+#  153|       getPattern(0): [NamedPattern] apply_keyPathB
+#  153|     getElement(3): [ConcreteVarDecl] apply_keyPathB
+#  153|         Type = B
+#  154|     getElement(4): [PatternBindingDecl] var ... = ...
+#  154|       getInit(0): [KeyPathApplicationExpr] \...[...]
+#  154|         getBase(): [KeyPathApplicationExpr] \...[...]
+#  154|           getBase(): [DeclRefExpr] a
+#  154|           getKeyPath(): [DeclRefExpr] keyPathB
+#  154|         getKeyPath(): [KeyPathExpr] #keyPath(...)
+#  154|           getRoot(): [TypeRepr] B
+#  154|       getPattern(0): [NamedPattern] nested_apply
+#  154|     getElement(5): [ConcreteVarDecl] nested_apply
+#  154|         Type = Int
+patterns.swift:
+#    1| [ConcreteFuncDecl] basic_patterns()
+#    1|     InterfaceType = () -> ()
+#    1|   getBody(): [BraceStmt] { ... }
+#    2|     getElement(0): [PatternBindingDecl] var ... = ...
+#    2|       getInit(0): [IntegerLiteralExpr] 42
+#    2|       getPattern(0): [NamedPattern] an_int
+#    2|     getElement(1): [ConcreteVarDecl] an_int
+#    2|         Type = Int
+#    3|     getElement(2): [PatternBindingDecl] var ... = ...
+#    3|       getInit(0): [StringLiteralExpr] here
+#    3|       getPattern(0): [TypedPattern] ... as ...
+#    3|         getSubPattern(): [NamedPattern] a_string
+#    3|         getTypeRepr(): [TypeRepr] String
+#    3|     getElement(3): [ConcreteVarDecl] a_string
+#    3|         Type = String
+#    4|     getElement(4): [PatternBindingDecl] var ... = ...
+#    4|       getInit(0): [TupleExpr] (...)
+#    4|         getElement(0): [IntegerLiteralExpr] 1
+#    4|         getElement(1): [IntegerLiteralExpr] 2
+#    4|         getElement(2): [IntegerLiteralExpr] 3
+#    4|       getPattern(0): [TuplePattern] (...)
+#    4|         getElement(0): [NamedPattern] x
+#    4|         getElement(1): [NamedPattern] y
+#    4|         getElement(2): [NamedPattern] z
+#    4|     getElement(5): [ConcreteVarDecl] x
+#    4|         Type = Int
+#    4|     getElement(6): [ConcreteVarDecl] y
+#    4|         Type = Int
+#    4|     getElement(7): [ConcreteVarDecl] z
+#    4|         Type = Int
+#    5|     getElement(8): [PatternBindingDecl] var ... = ...
+#    5|       getInit(0): [StringLiteralExpr] any
+#    5|       getPattern(0): [AnyPattern] _
+#    6|     getElement(9): [PatternBindingDecl] var ... = ...
+#    6|       getInit(0): [StringLiteralExpr] paren
+#    6|       getPattern(0): [AnyPattern] _
+#    6|       getPattern(0).getFullyUnresolved(): [ParenPattern] (...)
+#    9| [ConcreteFuncDecl] switch_patterns()
+#    9|     InterfaceType = () -> ()
+#    9|   getBody(): [BraceStmt] { ... }
+#   10|     getElement(0): [PatternBindingDecl] var ... = ...
+#   10|       getInit(0): [TupleExpr] (...)
+#   10|         getElement(0): [IntegerLiteralExpr] 1
+#   10|         getElement(1): [IntegerLiteralExpr] 2
+#   10|       getPattern(0): [NamedPattern] point
+#   10|     getElement(1): [ConcreteVarDecl] point
+#   10|         Type = (Int, Int)
+#   11|     getElement(2): [SwitchStmt] switch point { ... }
+#   11|       getExpr(): [DeclRefExpr] point
+#   12|       getCase(0): [CaseStmt] case ...
+#   12|         getBody(): [BraceStmt] { ... }
+#   12|           getElement(0): [StringLiteralExpr] binding
+#   12|         getLabel(0): [CaseLabelItem] let ...
+#   12|           getPattern(): [BindingPattern] let ...
+#   12|             getSubPattern(): [TuplePattern] (...)
+#   12|               getElement(0): [NamedPattern] xx
+#   12|               getElement(1): [NamedPattern] yy
+#   15|     getElement(3): [SwitchStmt] switch 3 { ... }
+#   15|       getExpr(): [IntegerLiteralExpr] 3
+#   16|       getCase(0): [CaseStmt] case ...
+#   16|         getBody(): [BraceStmt] { ... }
+#   16|           getElement(0): [StringLiteralExpr] expr
+#   16|         getLabel(0): [CaseLabelItem] =~ ...
+#   16|           getPattern(): [ExprPattern] =~ ...
+#   16|             getSubExpr(): [SequenceExpr] SequenceExpr
+#   16|               getElement(0): [IntegerLiteralExpr] 1
+#   16|               getElement(1): [OverloadedDeclRefExpr] OverloadedDeclRefExpr
+#   16|               getElement(2): [IntegerLiteralExpr] 2
+#   17|       getCase(1): [CaseStmt] case ...
+#   17|         getBody(): [BraceStmt] { ... }
+#   17|           getElement(0): [StringLiteralExpr] 
+#   17|         getLabel(0): [CaseLabelItem] _
+#   17|           getPattern(): [AnyPattern] _
+#   20|     getElement(4): [EnumDecl] Foo
+#   21|       getMember(0): [EnumCaseDecl] case ...
+#   21|       getMember(1): [EnumElementDecl] bar
+#   21|       getMember(2): [EnumElementDecl] baz
+#   21|         getParam(0): [ParamDecl] _
+#   21|             Type = Int
+#   21|         getParam(1): [ParamDecl] _
+#   21|             Type = String
+#   24|     getElement(5): [PatternBindingDecl] var ... = ...
+#   24|       getInit(0): [MethodRefExpr] .bar
+#   24|         getBase(): [TypeExpr] Foo.Type
+#   24|           getTypeRepr(): [TypeRepr] Foo
+#   24|       getPattern(0): [TypedPattern] ... as ...
+#   24|         getSubPattern(): [NamedPattern] v
+#   24|         getTypeRepr(): [TypeRepr] Foo
+#   24|     getElement(6): [ConcreteVarDecl] v
+#   24|         Type = Foo
+#   26|     getElement(7): [SwitchStmt] switch v { ... }
+#   26|       getExpr(): [DeclRefExpr] v
+#   27|       getCase(0): [CaseStmt] case ...
+#   27|         getBody(): [BraceStmt] { ... }
+#   27|           getElement(0): [StringLiteralExpr] bar
+#   27|         getLabel(0): [CaseLabelItem] .bar
+#   27|           getPattern(): [EnumElementPattern] .bar
+#   28|       getCase(1): [CaseStmt] case ...
+#   28|         getBody(): [BraceStmt] { ... }
+#   28|           getElement(0): [DeclRefExpr] i
+#   28|         getLabel(0): [CaseLabelItem] let ...
+#   28|           getPattern(): [BindingPattern] let ...
+#   28|             getSubPattern(): [EnumElementPattern] .baz(...)
+#   28|               getSubPattern(): [TuplePattern] (...)
+#   28|                 getElement(0): [NamedPattern] i
+#   28|                 getElement(1): [NamedPattern] s
+#   31|     getElement(8): [PatternBindingDecl] var ... = ...
+#   31|       getInit(0): [NilLiteralExpr] nil
+#   31|       getPattern(0): [TypedPattern] ... as ...
+#   31|         getSubPattern(): [NamedPattern] w
+#   31|         getTypeRepr(): [TypeRepr] Int?
+#   31|     getElement(9): [ConcreteVarDecl] w
+#   31|         Type = Int?
+#   33|     getElement(10): [SwitchStmt] switch w { ... }
+#   33|       getExpr(): [DeclRefExpr] w
+#   34|       getCase(0): [CaseStmt] case ...
+#   34|         getBody(): [BraceStmt] { ... }
+#   34|           getElement(0): [DeclRefExpr] n
+#   34|         getLabel(0): [CaseLabelItem] let ...
+#   34|           getPattern(): [BindingPattern] let ...
+#   34|             getSubPattern(): [OptionalSomePattern] let ...?
+#   34|               getSubPattern(): [NamedPattern] n
+#   35|       getCase(1): [CaseStmt] case ...
+#   35|         getBody(): [BraceStmt] { ... }
+#   35|           getElement(0): [StringLiteralExpr] none
+#   35|         getLabel(0): [CaseLabelItem] _
+#   35|           getPattern(): [AnyPattern] _
+#   38|     getElement(11): [PatternBindingDecl] var ... = ...
+#   38|       getInit(0): [StringLiteralExpr] any
+#   38|       getInit(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   38|       getPattern(0): [TypedPattern] ... as ...
+#   38|         getSubPattern(): [NamedPattern] a
+#   38|         getTypeRepr(): [TypeRepr] Any
+#   38|     getElement(12): [ConcreteVarDecl] a
+#   38|         Type = Any
+#   40|     getElement(13): [SwitchStmt] switch a { ... }
+#   40|       getExpr(): [DeclRefExpr] a
+#   41|       getCase(0): [CaseStmt] case ...
+#   41|         getBody(): [BraceStmt] { ... }
+#   41|           getElement(0): [StringLiteralExpr] is pattern
+#   41|         getLabel(0): [CaseLabelItem] ... is ...
+#   41|           getPattern(): [IsPattern] ... is ...
+#   41|             getCastTypeRepr(): [TypeRepr] Int
+#   42|       getCase(1): [CaseStmt] case ...
+#   42|         getBody(): [BraceStmt] { ... }
+#   42|           getElement(0): [StringLiteralExpr] as pattern
+#   42|         getLabel(0): [CaseLabelItem] let ...
+#   42|           getPattern(): [BindingPattern] let ...
+#   42|             getSubPattern(): [IsPattern] ... is ...
+#   42|               getCastTypeRepr(): [TypeRepr] String
+#   42|               getSubPattern(): [NamedPattern] x
+#   43|       getCase(2): [CaseStmt] case ...
+#   43|         getBody(): [BraceStmt] { ... }
+#   43|           getElement(0): [StringLiteralExpr] other
+#   43|         getLabel(0): [CaseLabelItem] _
+#   43|           getPattern(): [AnyPattern] _
+#   46|     getElement(14): [PatternBindingDecl] var ... = ...
+#   46|       getInit(0): [BooleanLiteralExpr] true
+#   46|       getPattern(0): [NamedPattern] b
+#   46|     getElement(15): [ConcreteVarDecl] b
+#   46|         Type = Bool
+#   48|     getElement(16): [SwitchStmt] switch b { ... }
+#   48|       getExpr(): [DeclRefExpr] b
+#   49|       getCase(0): [CaseStmt] case ...
+#   49|         getBody(): [BraceStmt] { ... }
+#   49|           getElement(0): [StringLiteralExpr] true
+#   49|         getLabel(0): [CaseLabelItem] true
+#   49|           getPattern(): [BoolPattern] true
+#   50|       getCase(1): [CaseStmt] case ...
+#   50|         getBody(): [BraceStmt] { ... }
+#   50|           getElement(0): [StringLiteralExpr] false
+#   50|         getLabel(0): [CaseLabelItem] false
+#   50|           getPattern(): [BoolPattern] false
+#   12| [ConcreteVarDecl] xx
+#   12|     Type = Int
+#   12| [ConcreteVarDecl] yy
+#   12|     Type = Int
+#   28| [ConcreteVarDecl] i
+#   28|     Type = Int
+#   28| [ConcreteVarDecl] s
+#   28|     Type = String
+#   34| [ConcreteVarDecl] n
+#   34|     Type = Int
+#   42| [ConcreteVarDecl] x
+#   42|     Type = String
+statements.swift:
+#    1| [ConcreteFuncDecl] loop()
+#    1|     InterfaceType = () -> ()
+#    1|   getBody(): [BraceStmt] { ... }
+#    2|     getElement(0): [ForEachStmt] for ... in ... { ... }
+#    2|       getPattern(): [NamedPattern] i
+#    2|       getSequence(): [BinaryExpr] ... ....(_:_:) ...
+#    2|         getFunction(): [MethodRefExpr] ....(_:_:)
+#    2|           getBase(): [TypeExpr] Int.Type
+#    2|             getTypeRepr(): [TypeRepr] Int
+#    2|         getArgument(0): [Argument] : 1
+#    2|           getExpr(): [IntegerLiteralExpr] 1
+#    2|         getArgument(1): [Argument] : 5
+#    2|           getExpr(): [IntegerLiteralExpr] 5
+#    2|       getBody(): [BraceStmt] { ... }
+#    3|         getElement(0): [IfStmt] if ... then { ... } else { ... }
+#    3|           getCondition(): [StmtCondition] StmtCondition
+#    3|             getElement(0): [ConditionElement] ... .==(_:_:) ...
+#    3|               getBoolean(): [BinaryExpr] ... .==(_:_:) ...
+#    3|                 getFunction(): [MethodRefExpr] .==(_:_:)
+#    3|                   getBase(): [TypeExpr] Int.Type
+#    3|                     getTypeRepr(): [TypeRepr] Int
+#    3|                 getArgument(0): [Argument] : i
+#    3|                   getExpr(): [DeclRefExpr] i
+#    3|                 getArgument(1): [Argument] : 3
+#    3|                   getExpr(): [IntegerLiteralExpr] 3
+#    3|           getThen(): [BraceStmt] { ... }
+#    4|             getElement(0): [BreakStmt] break
+#    5|           getElse(): [BraceStmt] { ... }
+#    6|             getElement(0): [ContinueStmt] continue
+#    9|     getElement(1): [PatternBindingDecl] var ... = ...
+#    9|       getInit(0): [IntegerLiteralExpr] 0
+#    9|       getPattern(0): [NamedPattern] i
+#    9|     getElement(2): [ConcreteVarDecl] i
+#    9|         Type = Int
+#   10|     getElement(3): [WhileStmt] while ... { ... }
+#   10|       getCondition(): [StmtCondition] StmtCondition
+#   10|         getElement(0): [ConditionElement] ... .<(_:_:) ...
+#   10|           getBoolean(): [BinaryExpr] ... .<(_:_:) ...
+#   10|             getFunction(): [MethodRefExpr] .<(_:_:)
+#   10|               getBase(): [TypeExpr] Int.Type
+#   10|                 getTypeRepr(): [TypeRepr] Int
+#   10|             getArgument(0): [Argument] : i
+#   10|               getExpr(): [DeclRefExpr] i
+#   10|               getExpr().getFullyConverted(): [LoadExpr] (Int) ...
+#   10|             getArgument(1): [Argument] : 12
+#   10|               getExpr(): [IntegerLiteralExpr] 12
+#   10|           getBoolean().getFullyConverted(): [ParenExpr] (...)
+#   10|       getBody(): [BraceStmt] { ... }
+#   11|         getElement(0): [AssignExpr]  ... = ...
+#   11|           getDest(): [DeclRefExpr] i
+#   11|           getSource(): [BinaryExpr] ... .+(_:_:) ...
+#   11|             getFunction(): [MethodRefExpr] .+(_:_:)
+#   11|               getBase(): [TypeExpr] Int.Type
+#   11|                 getTypeRepr(): [TypeRepr] Int
+#   11|             getArgument(0): [Argument] : i
+#   11|               getExpr(): [DeclRefExpr] i
+#   11|               getExpr().getFullyConverted(): [LoadExpr] (Int) ...
+#   11|             getArgument(1): [Argument] : 1
+#   11|               getExpr(): [IntegerLiteralExpr] 1
+#   14|     getElement(4): [AssignExpr]  ... = ...
+#   14|       getDest(): [DeclRefExpr] i
+#   14|       getSource(): [IntegerLiteralExpr] 0
+#   15|     getElement(5): [RepeatWhileStmt] repeat { ... } while ... 
+#   17|       getCondition(): [BinaryExpr] ... .<(_:_:) ...
+#   17|         getFunction(): [MethodRefExpr] .<(_:_:)
+#   17|           getBase(): [TypeExpr] Int.Type
+#   17|             getTypeRepr(): [TypeRepr] Int
+#   17|         getArgument(0): [Argument] : i
+#   17|           getExpr(): [DeclRefExpr] i
+#   17|           getExpr().getFullyConverted(): [LoadExpr] (Int) ...
+#   17|         getArgument(1): [Argument] : 12
+#   17|           getExpr(): [IntegerLiteralExpr] 12
+#   17|       getCondition().getFullyConverted(): [ParenExpr] (...)
+#   15|       getBody(): [BraceStmt] { ... }
+#   16|         getElement(0): [AssignExpr]  ... = ...
+#   16|           getDest(): [DeclRefExpr] i
+#   16|           getSource(): [BinaryExpr] ... .+(_:_:) ...
+#   16|             getFunction(): [MethodRefExpr] .+(_:_:)
+#   16|               getBase(): [TypeExpr] Int.Type
+#   16|                 getTypeRepr(): [TypeRepr] Int
+#   16|             getArgument(0): [Argument] : i
+#   16|               getExpr(): [DeclRefExpr] i
+#   16|               getExpr().getFullyConverted(): [LoadExpr] (Int) ...
+#   16|             getArgument(1): [Argument] : 1
+#   16|               getExpr(): [IntegerLiteralExpr] 1
+#   19|     getElement(6): [DoCatchStmt] do { ... } catch { ... }
+#   19|       getBody(): [BraceStmt] { ... }
+#   20|         getElement(0): [TryExpr] try ...
+#   20|           getSubExpr(): [CallExpr] call to failure(_:)
+#   20|             getFunction(): [DeclRefExpr] failure(_:)
+#   20|             getArgument(0): [Argument] : 11
+#   20|               getExpr(): [IntegerLiteralExpr] 11
+#   21|       getCatch(0): [CaseStmt] case ...
+#   21|         getBody(): [BraceStmt] { ... }
+#   22|           getElement(0): [CallExpr] call to print(_:separator:terminator:)
+#   22|             getFunction(): [DeclRefExpr] print(_:separator:terminator:)
+#   22|             getArgument(0): [Argument] : [...]
+#   22|               getExpr(): [VarargExpansionExpr] [...]
+#   22|                 getSubExpr(): [ArrayExpr] [...]
+#   22|                   getElement(0): [StringLiteralExpr] error
+#   22|                   getElement(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   22|             getArgument(1): [Argument] separator: default separator
+#   22|               getExpr(): [DefaultArgumentExpr] default separator
+#   22|             getArgument(2): [Argument] terminator: default terminator
+#   22|               getExpr(): [DefaultArgumentExpr] default terminator
+#   21|         getLabel(0): [CaseLabelItem] let ...
+#   21|           getPattern(): [BindingPattern] let ...
+#   21|             getSubPattern(): [NamedPattern] error
+#   25|     getElement(7): [DoCatchStmt] do { ... } catch { ... }
+#   25|       getBody(): [BraceStmt] { ... }
+#   26|         getElement(0): [TryExpr] try ...
+#   26|           getSubExpr(): [CallExpr] call to failure(_:)
+#   26|             getFunction(): [DeclRefExpr] failure(_:)
+#   26|             getArgument(0): [Argument] : 11
+#   26|               getExpr(): [IntegerLiteralExpr] 11
+#   27|       getCatch(0): [CaseStmt] case ...
+#   27|         getBody(): [BraceStmt] { ... }
+#   28|           getElement(0): [CallExpr] call to print(_:separator:terminator:)
+#   28|             getFunction(): [DeclRefExpr] print(_:separator:terminator:)
+#   28|             getArgument(0): [Argument] : [...]
+#   28|               getExpr(): [VarargExpansionExpr] [...]
+#   28|                 getSubExpr(): [ArrayExpr] [...]
+#   28|                   getElement(0): [StringLiteralExpr] AnError.failed
+#   28|                   getElement(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   28|             getArgument(1): [Argument] separator: default separator
+#   28|               getExpr(): [DefaultArgumentExpr] default separator
+#   28|             getArgument(2): [Argument] terminator: default terminator
+#   28|               getExpr(): [DefaultArgumentExpr] default terminator
+#   27|         getLabel(0): [CaseLabelItem] ... is ...
+#   27|           getPattern(): [IsPattern] ... is ...
+#   27|             getSubPattern(): [EnumElementPattern] .failed
+#   29|       getCatch(1): [CaseStmt] case ...
+#   29|         getBody(): [BraceStmt] { ... }
+#   30|           getElement(0): [CallExpr] call to print(_:separator:terminator:)
+#   30|             getFunction(): [DeclRefExpr] print(_:separator:terminator:)
+#   30|             getArgument(0): [Argument] : [...]
+#   30|               getExpr(): [VarargExpansionExpr] [...]
+#   30|                 getSubExpr(): [ArrayExpr] [...]
+#   30|                   getElement(0): [StringLiteralExpr] error
+#   30|                   getElement(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   30|             getArgument(1): [Argument] separator: default separator
+#   30|               getExpr(): [DefaultArgumentExpr] default separator
+#   30|             getArgument(2): [Argument] terminator: default terminator
+#   30|               getExpr(): [DefaultArgumentExpr] default terminator
+#   29|         getLabel(0): [CaseLabelItem] let ...
+#   29|           getPattern(): [BindingPattern] let ...
+#   29|             getSubPattern(): [NamedPattern] error
+#    2| [ConcreteVarDecl] i
+#    2|     Type = Int
+#   21| [ConcreteVarDecl] error
+#   21|     Type = Error
+#   29| [ConcreteVarDecl] error
+#   29|     Type = Error
+#   34| [EnumDecl] AnError
+#   35|   getMember(0): [EnumCaseDecl] case ...
+#   35|   getMember(1): [EnumElementDecl] failed
+#   38| [ConcreteFuncDecl] failure(_:)
+#   38|     InterfaceType = (Int) throws -> ()
+#   38|   getParam(0): [ParamDecl] x
+#   38|       Type = Int
+#   38|   getBody(): [BraceStmt] { ... }
+#   39|     getElement(0): [GuardStmt] guard ... else { ... }
+#   39|       getCondition(): [StmtCondition] StmtCondition
+#   39|         getElement(0): [ConditionElement] ... .!=(_:_:) ...
+#   39|           getBoolean(): [BinaryExpr] ... .!=(_:_:) ...
+#   39|             getFunction(): [MethodRefExpr] .!=(_:_:)
+#   39|               getBase(): [TypeExpr] Int.Type
+#   39|                 getTypeRepr(): [TypeRepr] Int
+#   39|             getArgument(0): [Argument] : x
+#   39|               getExpr(): [DeclRefExpr] x
+#   39|             getArgument(1): [Argument] : 0
+#   39|               getExpr(): [IntegerLiteralExpr] 0
+#   39|       getBody(): [BraceStmt] { ... }
+#   40|         getElement(0): [ThrowStmt] throw ...
+#   40|           getSubExpr(): [MethodRefExpr] .failed
+#   40|             getBase(): [TypeExpr] AnError.Type
+#   40|               getTypeRepr(): [TypeRepr] AnError
+#   40|           getSubExpr().getFullyConverted(): [ErasureExpr] (Error) ...
+#   44| [TopLevelCodeDecl] { ... }
+#   44|   getBody(): [BraceStmt] { ... }
+#   44|     getElement(0): [DeferStmt] defer { ... }
+#   44|       getBody(): [BraceStmt] { ... }
+#   45|         getElement(0): [CallExpr] call to print(_:separator:terminator:)
+#   45|           getFunction(): [DeclRefExpr] print(_:separator:terminator:)
+#   45|           getArgument(0): [Argument] : [...]
+#   45|             getExpr(): [VarargExpansionExpr] [...]
+#   45|               getSubExpr(): [ArrayExpr] [...]
+#   45|                 getElement(0): [StringLiteralExpr] done
+#   45|                 getElement(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   45|           getArgument(1): [Argument] separator: default separator
+#   45|             getExpr(): [DefaultArgumentExpr] default separator
+#   45|           getArgument(2): [Argument] terminator: default terminator
+#   45|             getExpr(): [DefaultArgumentExpr] default terminator
+#   48| [TopLevelCodeDecl] { ... }
+#   48|   getBody(): [BraceStmt] { ... }
+#   48|     getElement(0): [DoStmt] do { ... }
+#   48|       getBody(): [BraceStmt] { ... }
+#   49|         getElement(0): [CallExpr] call to print(_:separator:terminator:)
+#   49|           getFunction(): [DeclRefExpr] print(_:separator:terminator:)
+#   49|           getArgument(0): [Argument] : [...]
+#   49|             getExpr(): [VarargExpansionExpr] [...]
+#   49|               getSubExpr(): [ArrayExpr] [...]
+#   49|                 getElement(0): [StringLiteralExpr] doing
+#   49|                 getElement(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   49|           getArgument(1): [Argument] separator: default separator
+#   49|             getExpr(): [DefaultArgumentExpr] default separator
+#   49|           getArgument(2): [Argument] terminator: default terminator
+#   49|             getExpr(): [DefaultArgumentExpr] default terminator
+#   52| [TopLevelCodeDecl] { ... }
+#   52|   getBody(): [BraceStmt] { ... }
+#   52|     getElement(0): [PatternBindingDecl] var ... = ...
+#   52|       getInit(0): [IntegerLiteralExpr] 42
+#   52|       getPattern(0): [NamedPattern] index
+#   52| [ConcreteVarDecl] index
+#   52|     Type = Int
+#   53| [TopLevelCodeDecl] { ... }
+#   53|   getBody(): [BraceStmt] { ... }
+#   53|     getElement(0): [SwitchStmt] switch index { ... }
+#   53|       getExpr(): [DeclRefExpr] index
+#   54|       getCase(0): [CaseStmt] case ...
+#   55|         getBody(): [BraceStmt] { ... }
+#   55|           getElement(0): [CallExpr] call to print(_:separator:terminator:)
+#   55|             getFunction(): [DeclRefExpr] print(_:separator:terminator:)
+#   55|             getArgument(0): [Argument] : [...]
+#   55|               getExpr(): [VarargExpansionExpr] [...]
+#   55|                 getSubExpr(): [ArrayExpr] [...]
+#   55|                   getElement(0): [StringLiteralExpr] 1
+#   55|                   getElement(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   55|             getArgument(1): [Argument] separator: default separator
+#   55|               getExpr(): [DefaultArgumentExpr] default separator
+#   55|             getArgument(2): [Argument] terminator: default terminator
+#   55|               getExpr(): [DefaultArgumentExpr] default terminator
+#   56|           getElement(1): [FallthroughStmt] fallthrough
+#   54|         getLabel(0): [CaseLabelItem] =~ ...
+#   54|           getPattern(): [ExprPattern] =~ ...
+#   54|             getSubExpr(): [IntegerLiteralExpr] 1
+#   57|       getCase(1): [CaseStmt] case ...
+#   58|         getBody(): [BraceStmt] { ... }
+#   58|           getElement(0): [CallExpr] call to print(_:separator:terminator:)
+#   58|             getFunction(): [DeclRefExpr] print(_:separator:terminator:)
+#   58|             getArgument(0): [Argument] : [...]
+#   58|               getExpr(): [VarargExpansionExpr] [...]
+#   58|                 getSubExpr(): [ArrayExpr] [...]
+#   58|                   getElement(0): [StringLiteralExpr] 5, 10
+#   58|                   getElement(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   58|             getArgument(1): [Argument] separator: default separator
+#   58|               getExpr(): [DefaultArgumentExpr] default separator
+#   58|             getArgument(2): [Argument] terminator: default terminator
+#   58|               getExpr(): [DefaultArgumentExpr] default terminator
+#   59|           getElement(1): [BreakStmt] break
+#   57|         getLabel(0): [CaseLabelItem] =~ ...
+#   57|           getPattern(): [ExprPattern] =~ ...
+#   57|             getSubExpr(): [IntegerLiteralExpr] 5
+#   57|         getLabel(1): [CaseLabelItem] =~ ...
+#   57|           getPattern(): [ExprPattern] =~ ...
+#   57|             getSubExpr(): [IntegerLiteralExpr] 10
+#   60|       getCase(2): [CaseStmt] case ...
+#   61|         getBody(): [BraceStmt] { ... }
+#   61|           getElement(0): [CallExpr] call to print(_:separator:terminator:)
+#   61|             getFunction(): [DeclRefExpr] print(_:separator:terminator:)
+#   61|             getArgument(0): [Argument] : [...]
+#   61|               getExpr(): [VarargExpansionExpr] [...]
+#   61|                 getSubExpr(): [ArrayExpr] [...]
+#   61|                   getElement(0): [StringLiteralExpr] default
+#   61|                   getElement(0).getFullyConverted(): [ErasureExpr] (Any) ...
+#   61|             getArgument(1): [Argument] separator: default separator
+#   61|               getExpr(): [DefaultArgumentExpr] default separator
+#   61|             getArgument(2): [Argument] terminator: default terminator
+#   61|               getExpr(): [DefaultArgumentExpr] default terminator
+#   60|         getLabel(0): [CaseLabelItem] _
+#   60|           getPattern(): [AnyPattern] _
+#   64| [TopLevelCodeDecl] { ... }
+#   64|   getBody(): [BraceStmt] { ... }
+#   64|     getElement(0): [PatternBindingDecl] var ... = ...
+#   64|       getInit(0): [IntegerLiteralExpr] 4
+#   64|       getInit(0).getFullyConverted(): [InjectIntoOptionalExpr] (Int?) ...
+#   64|       getPattern(0): [TypedPattern] ... as ...
+#   64|         getSubPattern(): [NamedPattern] x
+#   64|         getTypeRepr(): [TypeRepr] Int?
+#   64| [ConcreteVarDecl] x
+#   64|     Type = Int?
+#   65| [TopLevelCodeDecl] { ... }
+#   65|   getBody(): [BraceStmt] { ... }
+#   65|     getElement(0): [IfStmt] if ... then { ... }
+#   65|       getCondition(): [StmtCondition] StmtCondition
+#   65|         getElement(0): [ConditionElement] let ... = ... 
+#   65|           getPattern(): [BindingPattern] let ...
+#   65|             getSubPattern(): [OptionalSomePattern] let ...?
+#   65|               getSubPattern(): [NamedPattern] xx
+#   65|           getInitializer(): [DeclRefExpr] x
+#   65|       getThen(): [BraceStmt] { ... }
+#   67| [TopLevelCodeDecl] { ... }
+#   67|   getBody(): [BraceStmt] { ... }
+#   67|     getElement(0): [IfStmt] if ... then { ... }
+#   67|       getCondition(): [StmtCondition] StmtCondition
+#   67|         getElement(0): [ConditionElement] .some(...) = ... 
+#   67|           getPattern(): [EnumElementPattern] .some(...)
+#   67|             getSubPattern(): [AnyPattern] _
+#   67|             getSubPattern().getFullyUnresolved(): [ParenPattern] (...)
+#   67|           getInitializer(): [DeclRefExpr] x
+#   67|       getThen(): [BraceStmt] { ... }
+#   70| [TopLevelCodeDecl] { ... }
+#   70|   getBody(): [BraceStmt] { ... }
+#   70|     getElement(0): [PatternBindingDecl] var ... = ...
+#   70|       getInit(0): [ArrayExpr] [...]
+#   70|         getElement(0): [IntegerLiteralExpr] 1
+#   70|         getElement(1): [IntegerLiteralExpr] 2
+#   70|         getElement(2): [IntegerLiteralExpr] 3
+#   70|       getPattern(0): [NamedPattern] numbers
+#   70| [ConcreteVarDecl] numbers
+#   70|     Type = [Int]
+#   71| [TopLevelCodeDecl] { ... }
+#   71|   getBody(): [BraceStmt] { ... }
+#   71|     getElement(0): [ForEachStmt] for ... in ... where ... { ... }
+#   71|       getPattern(): [NamedPattern] number
+#   71|       getSequence(): [DeclRefExpr] numbers
+#   71|       getWhere(): [BinaryExpr] ... .==(_:_:) ...
+#   71|         getFunction(): [MethodRefExpr] .==(_:_:)
+#   71|           getBase(): [TypeExpr] Int.Type
+#   71|             getTypeRepr(): [TypeRepr] Int
+#   71|         getArgument(0): [Argument] : ... .%(_:_:) ...
+#   71|           getExpr(): [BinaryExpr] ... .%(_:_:) ...
+#   71|             getFunction(): [MethodRefExpr] .%(_:_:)
+#   71|               getBase(): [TypeExpr] Int.Type
+#   71|                 getTypeRepr(): [TypeRepr] Int
+#   71|             getArgument(0): [Argument] : number
+#   71|               getExpr(): [DeclRefExpr] number
+#   71|             getArgument(1): [Argument] : 2
+#   71|               getExpr(): [IntegerLiteralExpr] 2
+#   71|         getArgument(1): [Argument] : 0
+#   71|           getExpr(): [IntegerLiteralExpr] 0
+#   71|       getBody(): [BraceStmt] { ... }
+#   71| [ConcreteVarDecl] number
+#   71|     Type = Int
+#   74| [StructDecl] HasModifyAccessorDecl
+#   75|   getMember(0): [PatternBindingDecl] var ... = ...
+#   75|     getPattern(0): [TypedPattern] ... as ...
+#   75|       getSubPattern(): [NamedPattern] x
+#   75|       getTypeRepr(): [TypeRepr] Int
+#   75|   getMember(1): [ConcreteVarDecl] x
+#   75|       Type = Int
+#   75|     getAccessorDecl(0): [AccessorDecl] get
+#   75|         InterfaceType = (HasModifyAccessorDecl) -> () -> Int
+#   75|       getSelfParam(): [ParamDecl] self
+#   75|           Type = HasModifyAccessorDecl
+#   75|       getBody(): [BraceStmt] { ... }
+#   75|     getAccessorDecl(1): [AccessorDecl] set
+#   75|         InterfaceType = (inout HasModifyAccessorDecl) -> (Int) -> ()
+#   75|       getSelfParam(): [ParamDecl] self
+#   75|           Type = HasModifyAccessorDecl
+#   75|       getParam(0): [ParamDecl] value
+#   75|           Type = Int
+#   75|       getBody(): [BraceStmt] { ... }
+#   75|     getAccessorDecl(2): [AccessorDecl] (unnamed function decl)
+#   75|         InterfaceType = (inout HasModifyAccessorDecl) -> () -> ()
+#   75|       getSelfParam(): [ParamDecl] self
+#   75|           Type = HasModifyAccessorDecl
+#   75|       getBody(): [BraceStmt] { ... }
+#   75|         getElement(0): [YieldStmt] yield ...
+#   76|   getMember(2): [PatternBindingDecl] var ... = ...
+#   76|     getPattern(0): [TypedPattern] ... as ...
+#   76|       getSubPattern(): [NamedPattern] hasModify
+#   76|       getTypeRepr(): [TypeRepr] Int
+#   76|   getMember(3): [ConcreteVarDecl] hasModify
+#   76|       Type = Int
+#   77|     getAccessorDecl(0): [AccessorDecl] (unnamed function decl)
+#   77|         InterfaceType = (inout HasModifyAccessorDecl) -> () -> ()
+#   77|       getSelfParam(): [ParamDecl] self
+#   77|           Type = HasModifyAccessorDecl
+#   77|       getBody(): [BraceStmt] { ... }
+#   78|         getElement(0): [YieldStmt] yield ...
+#   78|           getResult(0): [InOutExpr] &...
+#   78|             getSubExpr(): [MemberRefExpr] .x
+#   78|               getBase(): [DeclRefExpr] self
+#   81|     getAccessorDecl(1): [AccessorDecl] get
+#   81|         InterfaceType = (HasModifyAccessorDecl) -> () -> Int
+#   81|       getSelfParam(): [ParamDecl] self
+#   81|           Type = HasModifyAccessorDecl
+#   81|       getBody(): [BraceStmt] { ... }
+#   82|         getElement(0): [ReturnStmt] return ...
+#   82|           getResult(): [IntegerLiteralExpr] 0
+#   76|     getAccessorDecl(2): [AccessorDecl] set
+#   76|         InterfaceType = (inout HasModifyAccessorDecl) -> (Int) -> ()
+#   76|       getSelfParam(): [ParamDecl] self
+#   76|           Type = HasModifyAccessorDecl
+#   76|       getParam(0): [ParamDecl] value
+#   76|           Type = Int
+#   76|       getBody(): [BraceStmt] { ... }
+#   74|   getMember(4): [ConstructorDecl] init(x:)
+#   74|       InterfaceType = (HasModifyAccessorDecl.Type) -> (Int) -> HasModifyAccessorDecl
+#   74|     getSelfParam(): [ParamDecl] self
+#   74|         Type = HasModifyAccessorDecl
+#   74|     getParam(0): [ParamDecl] x
+#   74|         Type = Int
diff --git a/swift/ql/test/library-tests/ast/PrintAst.ql b/swift/ql/test/library-tests/ast/PrintAst.ql
new file mode 100644
index 00000000000..245e9ebdb12
--- /dev/null
+++ b/swift/ql/test/library-tests/ast/PrintAst.ql
@@ -0,0 +1,14 @@
+/**
+ * @kind graph
+ */
+
+import swift
+import codeql.swift.printast.PrintAst
+import TestUtils
+
+/**
+ * The hook to customize the entities printed by this query.
+ */
+class PrintAstConfigurationOverride extends PrintAstConfiguration {
+  override predicate shouldPrint(Locatable e) { super.shouldPrint(e) and toBeTested(e) }
+}
diff --git a/swift/ql/test/library-tests/parent/declarations.swift b/swift/ql/test/library-tests/ast/declarations.swift
similarity index 89%
rename from swift/ql/test/library-tests/parent/declarations.swift
rename to swift/ql/test/library-tests/ast/declarations.swift
index d44d60902e6..6f208381c34 100644
--- a/swift/ql/test/library-tests/parent/declarations.swift
+++ b/swift/ql/test/library-tests/ast/declarations.swift
@@ -143,3 +143,13 @@ extension Int {
 
 42.id()
 
+class GenericClass<A, B: Baz, C: MyProtocol> {
+  func genericMethod(_: A, _: B, _: C) {}
+}
+
+func genericFunc<A, B: Baz, C: MyProtocol>(_: A, _: B, _: C) {}
+
+class Derived : Baz {}
+
+// multiple conversions
+var d: Baz? = Derived() as Baz
diff --git a/swift/ql/test/library-tests/parent/expressions.swift b/swift/ql/test/library-tests/ast/expressions.swift
similarity index 100%
rename from swift/ql/test/library-tests/parent/expressions.swift
rename to swift/ql/test/library-tests/ast/expressions.swift
diff --git a/swift/ql/test/library-tests/ast/no_double_children.expected b/swift/ql/test/library-tests/ast/no_double_children.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/ql/test/library-tests/ast/no_double_children.ql b/swift/ql/test/library-tests/ast/no_double_children.ql
new file mode 100644
index 00000000000..ffd27bedb03
--- /dev/null
+++ b/swift/ql/test/library-tests/ast/no_double_children.ql
@@ -0,0 +1,8 @@
+private import codeql.swift.printast.PrintAstNode
+
+from PrintAstNode parent, int index, PrintAstNode child1, PrintAstNode child2
+where
+  child1 != child2 and
+  parent.hasChild(child1, index, _) and
+  parent.hasChild(child2, index, _)
+select parent, index, child1, child2
diff --git a/swift/ql/test/library-tests/ast/no_double_indexes.expected b/swift/ql/test/library-tests/ast/no_double_indexes.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/ql/test/library-tests/ast/no_double_indexes.ql b/swift/ql/test/library-tests/ast/no_double_indexes.ql
new file mode 100644
index 00000000000..c6308a99100
--- /dev/null
+++ b/swift/ql/test/library-tests/ast/no_double_indexes.ql
@@ -0,0 +1,8 @@
+private import codeql.swift.printast.PrintAstNode
+
+from PrintAstNode parent, int index1, int index2, PrintAstNode child
+where
+  index1 != index2 and
+  parent.hasChild(child, index1, _) and
+  parent.hasChild(child, index2, _)
+select parent, child, index1, index2
diff --git a/swift/ql/test/library-tests/ast/no_double_parents.expected b/swift/ql/test/library-tests/ast/no_double_parents.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/ql/test/library-tests/ast/no_double_parents.ql b/swift/ql/test/library-tests/ast/no_double_parents.ql
new file mode 100644
index 00000000000..5a62076a9ea
--- /dev/null
+++ b/swift/ql/test/library-tests/ast/no_double_parents.ql
@@ -0,0 +1,8 @@
+private import codeql.swift.printast.PrintAstNode
+
+from PrintAstNode parent1, PrintAstNode parent2, PrintAstNode child
+where
+  parent1 != parent2 and
+  parent1.hasChild(child, _, _) and
+  parent2.hasChild(child, _, _)
+select parent1, parent2, child
diff --git a/swift/ql/test/library-tests/ast/no_parent_child_loops.expected b/swift/ql/test/library-tests/ast/no_parent_child_loops.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/ql/test/library-tests/ast/no_parent_child_loops.ql b/swift/ql/test/library-tests/ast/no_parent_child_loops.ql
new file mode 100644
index 00000000000..e7ffea56cc7
--- /dev/null
+++ b/swift/ql/test/library-tests/ast/no_parent_child_loops.ql
@@ -0,0 +1,7 @@
+private import codeql.swift.printast.PrintAstNode
+
+predicate isChildOf(PrintAstNode parent, PrintAstNode child) { parent.hasChild(child, _, _) }
+
+from PrintAstNode parent, PrintAstNode child
+where isChildOf(parent, child) and isChildOf*(child, parent)
+select parent, child
diff --git a/swift/ql/test/library-tests/parent/patterns.swift b/swift/ql/test/library-tests/ast/patterns.swift
similarity index 100%
rename from swift/ql/test/library-tests/parent/patterns.swift
rename to swift/ql/test/library-tests/ast/patterns.swift
diff --git a/swift/ql/test/library-tests/parent/statements.swift b/swift/ql/test/library-tests/ast/statements.swift
similarity index 100%
rename from swift/ql/test/library-tests/parent/statements.swift
rename to swift/ql/test/library-tests/ast/statements.swift
diff --git a/swift/ql/test/library-tests/controlflow/graph/Cfg.expected b/swift/ql/test/library-tests/controlflow/graph/Cfg.expected
index 6236222443d..e2a2ae511af 100644
--- a/swift/ql/test/library-tests/controlflow/graph/Cfg.expected
+++ b/swift/ql/test/library-tests/controlflow/graph/Cfg.expected
@@ -683,22 +683,22 @@ cfg.swift:
 #-----| match -> ... as ...
 
 #   71| ... as ...
-#-----| match -> init
+#-----| match -> init(_:)
 
 #   71| Int.Type
-#-----|  -> call to init
+#-----|  -> call to init(_:)
 
-#   71| call to init
+#   71| call to init(_:)
 #-----|  -> s
 
-#   71| init
+#   71| init(_:)
 #-----|  -> Int.Type
 
-#   71| call to init
+#   71| call to init(_:)
 #-----|  -> var ... = ...
 
 #   71| s
-#-----|  -> call to init
+#-----|  -> call to init(_:)
 
 #   72| return ...
 #-----| return -> exit maybeParseInt(s:) (normal)
@@ -948,22 +948,22 @@ cfg.swift:
 #   95| ...!
 #-----|  -> ... .+(_:_:) ...
 
-#   98| deinit
+#   98| deinit()
 #-----|  -> self
 
-#   98| enter deinit
-#-----|  -> deinit
+#   98| enter deinit()
+#-----|  -> deinit()
 
-#   98| exit deinit
+#   98| exit deinit()
 
-#   98| exit deinit (normal)
-#-----|  -> exit deinit
+#   98| exit deinit() (normal)
+#-----|  -> exit deinit()
 
 #   98| self
 #-----|  -> { ... }
 
 #   98| { ... }
-#-----|  -> exit deinit (normal)
+#-----|  -> exit deinit() (normal)
 
 #   99| enter get
 #-----|  -> get
@@ -981,15 +981,15 @@ cfg.swift:
 #  100| self
 #-----|  -> n
 
-#  100| enter init
-#-----|  -> init
+#  100| enter init(n:)
+#-----|  -> init(n:)
 
-#  100| exit init
+#  100| exit init(n:)
 
-#  100| exit init (normal)
-#-----|  -> exit init
+#  100| exit init(n:) (normal)
+#-----|  -> exit init(n:)
 
-#  100| init
+#  100| init(n:)
 #-----|  -> self
 
 #  100| n
@@ -1008,7 +1008,7 @@ cfg.swift:
 #-----|  ->  ... = ...
 
 #  102| return
-#-----| return -> exit init (normal)
+#-----| return -> exit init(n:) (normal)
 
 #  104| enter getMyInt()
 #-----|  -> getMyInt()
@@ -1060,22 +1060,22 @@ cfg.swift:
 #-----|  -> n1
 
 #  110| c
-#-----| match -> init
+#-----| match -> init(n:)
 
 #  110| C.Type
-#-----|  -> call to init
+#-----|  -> call to init(n:)
 
-#  110| call to init
+#  110| call to init(n:)
 #-----|  -> 42
 
-#  110| init
+#  110| init(n:)
 #-----|  -> C.Type
 
-#  110| call to init
+#  110| call to init(n:)
 #-----|  -> var ... = ...
 
 #  110| 42
-#-----|  -> call to init
+#-----|  -> call to init(n:)
 
 #  111| var ... = ...
 #-----|  -> n1
@@ -4689,22 +4689,22 @@ cfg.swift:
 #  348| 1
 #-----|  -> ... .+=(_:_:) ...
 
-#  352| deinit
+#  352| deinit()
 #-----|  -> self
 
-#  352| enter deinit
-#-----|  -> deinit
+#  352| enter deinit()
+#-----|  -> deinit()
 
-#  352| exit deinit
+#  352| exit deinit()
 
-#  352| exit deinit (normal)
-#-----|  -> exit deinit
+#  352| exit deinit() (normal)
+#-----|  -> exit deinit()
 
 #  352| self
 #-----|  -> { ... }
 
 #  352| { ... }
-#-----|  -> exit deinit (normal)
+#-----|  -> exit deinit() (normal)
 
 #  353| enter get
 #-----|  -> get
@@ -4722,15 +4722,15 @@ cfg.swift:
 #  354| self
 #-----|  -> arg
 
-#  354| enter init
-#-----|  -> init
+#  354| enter init(arg:)
+#-----|  -> init(arg:)
 
-#  354| exit init
+#  354| exit init(arg:)
 
-#  354| exit init (normal)
-#-----|  -> exit init
+#  354| exit init(arg:) (normal)
+#-----|  -> exit init(arg:)
 
-#  354| init
+#  354| init(arg:)
 #-----|  -> self
 
 #  354| arg
@@ -4749,7 +4749,7 @@ cfg.swift:
 #-----|  ->  ... = ...
 
 #  356| return
-#-----| return -> exit init (normal)
+#-----| return -> exit init(arg:) (normal)
 
 #  358| enter getOptional()
 #-----|  -> getOptional()
@@ -4988,48 +4988,48 @@ cfg.swift:
 #  377| cfg.Derived
 #-----|  -> #...
 
-#  377| deinit
+#  377| deinit()
 #-----|  -> self
 
-#  377| enter deinit
-#-----|  -> deinit
+#  377| enter deinit()
+#-----|  -> deinit()
 
-#  377| exit deinit
+#  377| exit deinit()
 
-#  377| exit deinit (normal)
-#-----|  -> exit deinit
+#  377| exit deinit() (normal)
+#-----|  -> exit deinit()
 
 #  377| self
 #-----|  -> { ... }
 
 #  377| { ... }
-#-----|  -> exit deinit (normal)
+#-----|  -> exit deinit() (normal)
 
-#  377| enter init
-#-----|  -> init
+#  377| enter init(n:)
+#-----|  -> init(n:)
 
-#  377| exit init
+#  377| exit init(n:)
 
-#  377| exit init (normal)
-#-----|  -> exit init
+#  377| exit init(n:) (normal)
+#-----|  -> exit init(n:)
 
-#  377| init
+#  377| init(n:)
 #-----|  -> self
 
 #  377| self
 
 #  378| self
-#-----|  -> init
+#-----|  -> init(n:)
 
-#  378| enter init
-#-----|  -> init
+#  378| enter init()
+#-----|  -> init()
 
-#  378| exit init
+#  378| exit init()
 
-#  378| exit init (normal)
-#-----|  -> exit init
+#  378| exit init() (normal)
+#-----|  -> exit init()
 
-#  378| init
+#  378| init()
 #-----|  -> self
 
 #  379| super
@@ -5044,14 +5044,14 @@ cfg.swift:
 #  379| self = ...
 #-----|  -> return
 
-#  379| init
+#  379| init(n:)
 #-----|  -> super
 
 #  379| 0
 #-----|  -> call to ...
 
 #  380| return
-#-----| return -> exit init (normal)
+#-----| return -> exit init() (normal)
 
 #  383| doWithoutCatch(x:)
 #-----|  -> x
@@ -5198,15 +5198,15 @@ cfg.swift:
 #  395| self
 #-----|  -> self
 
-#  395| enter init
-#-----|  -> init
+#  395| enter init()
+#-----|  -> init()
 
-#  395| exit init
+#  395| exit init()
 
-#  395| exit init (normal)
-#-----|  -> exit init
+#  395| exit init() (normal)
+#-----|  -> exit init()
 
-#  395| init
+#  395| init()
 #-----|  -> self
 
 #  396| .field
@@ -5222,21 +5222,21 @@ cfg.swift:
 #-----|  ->  ... = ...
 
 #  397| return
-#-----| return -> exit init (normal)
+#-----| return -> exit init() (normal)
 
 #  399| self
 #-----|  -> self
 
-#  399| deinit
+#  399| deinit()
 #-----|  -> self
 
-#  399| enter deinit
-#-----|  -> deinit
+#  399| enter deinit()
+#-----|  -> deinit()
 
-#  399| exit deinit
+#  399| exit deinit()
 
-#  399| exit deinit (normal)
-#-----|  -> exit deinit
+#  399| exit deinit() (normal)
+#-----|  -> exit deinit()
 
 #  400| .field
 #-----|  -> 0
@@ -5245,7 +5245,7 @@ cfg.swift:
 #-----|  -> .field
 
 #  400|  ... = ...
-#-----|  -> exit deinit (normal)
+#-----|  -> exit deinit() (normal)
 
 #  400| 0
 #-----|  ->  ... = ...
@@ -5305,22 +5305,22 @@ cfg.swift:
 #  409| MyLocalClass
 #-----|  -> MyLocalStruct
 
-#  409| deinit
+#  409| deinit()
 #-----|  -> self
 
-#  409| enter deinit
-#-----|  -> deinit
+#  409| enter deinit()
+#-----|  -> deinit()
 
-#  409| exit deinit
+#  409| exit deinit()
 
-#  409| exit deinit (normal)
-#-----|  -> exit deinit
+#  409| exit deinit() (normal)
+#-----|  -> exit deinit()
 
 #  409| self
 #-----|  -> { ... }
 
 #  409| { ... }
-#-----|  -> exit deinit (normal)
+#-----|  -> exit deinit() (normal)
 
 #  410| (unnamed function decl)
 #-----|  -> self
@@ -5370,15 +5370,15 @@ cfg.swift:
 #  411| self
 #-----|  -> self
 
-#  411| enter init
-#-----|  -> init
+#  411| enter init()
+#-----|  -> init()
 
-#  411| exit init
+#  411| exit init()
 
-#  411| exit init (normal)
-#-----|  -> exit init
+#  411| exit init() (normal)
+#-----|  -> exit init()
 
-#  411| init
+#  411| init()
 #-----|  -> self
 
 #  412| .x
@@ -5394,7 +5394,7 @@ cfg.swift:
 #-----|  ->  ... = ...
 
 #  413| return
-#-----| return -> exit init (normal)
+#-----| return -> exit init() (normal)
 
 #  416| MyLocalStruct
 #-----|  -> MyLocalEnum
@@ -5447,15 +5447,15 @@ cfg.swift:
 #  418| self
 #-----|  -> self
 
-#  418| enter init
-#-----|  -> init
+#  418| enter init()
+#-----|  -> init()
 
-#  418| exit init
+#  418| exit init()
 
-#  418| exit init (normal)
-#-----|  -> exit init
+#  418| exit init() (normal)
+#-----|  -> exit init()
 
-#  418| init
+#  418| init()
 #-----|  -> self
 
 #  419| .x
@@ -5471,7 +5471,7 @@ cfg.swift:
 #-----|  ->  ... = ...
 
 #  420| return
-#-----| return -> exit init (normal)
+#-----| return -> exit init() (normal)
 
 #  423| MyLocalEnum
 #-----|  -> myLocalVar
diff --git a/swift/ql/test/library-tests/dataflow/dataflow/DataFlow.expected b/swift/ql/test/library-tests/dataflow/dataflow/DataFlow.expected
index 3f01a59c57b..2c9a273825f 100644
--- a/swift/ql/test/library-tests/dataflow/dataflow/DataFlow.expected
+++ b/swift/ql/test/library-tests/dataflow/dataflow/DataFlow.expected
@@ -1,4 +1,7 @@
 edges
+| file://:0:0:0:0 | self [a, x] :  | file://:0:0:0:0 | .a [x] :  |
+| file://:0:0:0:0 | self [x] :  | file://:0:0:0:0 | .x :  |
+| file://:0:0:0:0 | value :  | file://:0:0:0:0 | [post] self [x] :  |
 | test.swift:6:19:6:26 | call to source() :  | test.swift:7:15:7:15 | t1 |
 | test.swift:6:19:6:26 | call to source() :  | test.swift:9:15:9:15 | t1 |
 | test.swift:6:19:6:26 | call to source() :  | test.swift:10:15:10:15 | t2 |
@@ -8,21 +11,22 @@ edges
 | test.swift:29:26:29:29 | y :  | test.swift:31:15:31:15 | y |
 | test.swift:35:12:35:19 | call to source() :  | test.swift:39:15:39:29 | call to callee_source() |
 | test.swift:43:19:43:26 | call to source() :  | test.swift:50:15:50:15 | t |
-| test.swift:53:1:56:1 | arg[return] :  | test.swift:61:17:61:23 | arg: &... :  |
+| test.swift:53:1:56:1 | arg[return] :  | test.swift:61:22:61:23 | [post] &... :  |
 | test.swift:54:11:54:18 | call to source() :  | test.swift:53:1:56:1 | arg[return] :  |
-| test.swift:61:17:61:23 | arg: &... :  | test.swift:62:15:62:15 | x |
+| test.swift:61:22:61:23 | [post] &... :  | test.swift:62:15:62:15 | x |
 | test.swift:65:16:65:28 | arg1 :  | test.swift:65:1:70:1 | arg2[return] :  |
 | test.swift:73:18:73:25 | call to source() :  | test.swift:75:21:75:22 | &... :  |
+| test.swift:73:18:73:25 | call to source() :  | test.swift:76:15:76:15 | x |
 | test.swift:75:21:75:22 | &... :  | test.swift:65:16:65:28 | arg1 :  |
-| test.swift:75:21:75:22 | &... :  | test.swift:75:25:75:32 | arg2: &... :  |
-| test.swift:75:25:75:32 | arg2: &... :  | test.swift:77:15:77:15 | y |
-| test.swift:80:1:82:1 | arg[return] :  | test.swift:97:34:97:40 | arg: &... :  |
+| test.swift:75:21:75:22 | &... :  | test.swift:75:31:75:32 | [post] &... :  |
+| test.swift:75:31:75:32 | [post] &... :  | test.swift:77:15:77:15 | y |
+| test.swift:80:1:82:1 | arg[return] :  | test.swift:97:39:97:40 | [post] &... :  |
 | test.swift:81:11:81:18 | call to source() :  | test.swift:80:1:82:1 | arg[return] :  |
-| test.swift:84:1:91:1 | arg[return] :  | test.swift:104:35:104:41 | arg: &... :  |
+| test.swift:84:1:91:1 | arg[return] :  | test.swift:104:40:104:41 | [post] &... :  |
 | test.swift:86:15:86:22 | call to source() :  | test.swift:84:1:91:1 | arg[return] :  |
 | test.swift:89:15:89:22 | call to source() :  | test.swift:84:1:91:1 | arg[return] :  |
-| test.swift:97:34:97:40 | arg: &... :  | test.swift:98:19:98:19 | x |
-| test.swift:104:35:104:41 | arg: &... :  | test.swift:105:19:105:19 | x |
+| test.swift:97:39:97:40 | [post] &... :  | test.swift:98:19:98:19 | x |
+| test.swift:104:40:104:41 | [post] &... :  | test.swift:105:19:105:19 | x |
 | test.swift:109:9:109:14 | arg :  | test.swift:110:12:110:12 | arg :  |
 | test.swift:113:14:113:19 | arg :  | test.swift:114:19:114:19 | arg :  |
 | test.swift:113:14:113:19 | arg :  | test.swift:114:19:114:19 | arg :  |
@@ -46,7 +50,61 @@ edges
 | test.swift:154:10:154:13 | i :  | test.swift:155:19:155:19 | i |
 | test.swift:157:16:157:23 | call to source() :  | test.swift:154:10:154:13 | i :  |
 | test.swift:159:16:159:29 | call to ... :  | test.swift:154:10:154:13 | i :  |
+| test.swift:163:7:163:7 | self [x] :  | file://:0:0:0:0 | self [x] :  |
+| test.swift:163:7:163:7 | value :  | file://:0:0:0:0 | value :  |
+| test.swift:169:12:169:22 | value :  | test.swift:170:9:170:9 | value :  |
+| test.swift:170:5:170:5 | [post] self [x] :  | test.swift:169:3:171:3 | self[return] [x] :  |
+| test.swift:170:9:170:9 | value :  | test.swift:163:7:163:7 | value :  |
+| test.swift:170:9:170:9 | value :  | test.swift:170:5:170:5 | [post] self [x] :  |
+| test.swift:173:8:173:8 | self [x] :  | test.swift:174:12:174:12 | self [x] :  |
+| test.swift:174:12:174:12 | self [x] :  | test.swift:163:7:163:7 | self [x] :  |
+| test.swift:174:12:174:12 | self [x] :  | test.swift:174:12:174:12 | .x :  |
+| test.swift:180:3:180:3 | [post] a [x] :  | test.swift:181:13:181:13 | a [x] :  |
+| test.swift:180:9:180:16 | call to source() :  | test.swift:163:7:163:7 | value :  |
+| test.swift:180:9:180:16 | call to source() :  | test.swift:180:3:180:3 | [post] a [x] :  |
+| test.swift:181:13:181:13 | a [x] :  | test.swift:163:7:163:7 | self [x] :  |
+| test.swift:181:13:181:13 | a [x] :  | test.swift:181:13:181:15 | .x |
+| test.swift:185:7:185:7 | self [a, x] :  | file://:0:0:0:0 | self [a, x] :  |
+| test.swift:194:3:194:3 | [post] b [a, x] :  | test.swift:195:13:195:13 | b [a, x] :  |
+| test.swift:194:3:194:5 | [post] getter for .a [x] :  | test.swift:194:3:194:3 | [post] b [a, x] :  |
+| test.swift:194:11:194:18 | call to source() :  | test.swift:163:7:163:7 | value :  |
+| test.swift:194:11:194:18 | call to source() :  | test.swift:194:3:194:5 | [post] getter for .a [x] :  |
+| test.swift:195:13:195:13 | b [a, x] :  | test.swift:185:7:185:7 | self [a, x] :  |
+| test.swift:195:13:195:13 | b [a, x] :  | test.swift:195:13:195:15 | .a [x] :  |
+| test.swift:195:13:195:15 | .a [x] :  | test.swift:163:7:163:7 | self [x] :  |
+| test.swift:195:13:195:15 | .a [x] :  | test.swift:195:13:195:17 | .x |
+| test.swift:200:3:200:3 | [post] a [x] :  | test.swift:201:13:201:13 | a [x] :  |
+| test.swift:200:9:200:16 | call to source() :  | test.swift:169:12:169:22 | value :  |
+| test.swift:200:9:200:16 | call to source() :  | test.swift:200:3:200:3 | [post] a [x] :  |
+| test.swift:201:13:201:13 | a [x] :  | test.swift:163:7:163:7 | self [x] :  |
+| test.swift:201:13:201:13 | a [x] :  | test.swift:201:13:201:15 | .x |
+| test.swift:206:3:206:3 | [post] a [x] :  | test.swift:207:13:207:13 | a [x] :  |
+| test.swift:206:9:206:16 | call to source() :  | test.swift:163:7:163:7 | value :  |
+| test.swift:206:9:206:16 | call to source() :  | test.swift:206:3:206:3 | [post] a [x] :  |
+| test.swift:207:13:207:13 | a [x] :  | test.swift:173:8:173:8 | self [x] :  |
+| test.swift:207:13:207:13 | a [x] :  | test.swift:207:13:207:19 | call to get() |
+| test.swift:212:3:212:3 | [post] a [x] :  | test.swift:213:13:213:13 | a [x] :  |
+| test.swift:212:9:212:16 | call to source() :  | test.swift:169:12:169:22 | value :  |
+| test.swift:212:9:212:16 | call to source() :  | test.swift:212:3:212:3 | [post] a [x] :  |
+| test.swift:213:13:213:13 | a [x] :  | test.swift:173:8:173:8 | self [x] :  |
+| test.swift:213:13:213:13 | a [x] :  | test.swift:213:13:213:19 | call to get() |
+| test.swift:218:3:218:3 | [post] b [a, x] :  | test.swift:219:13:219:13 | b [a, x] :  |
+| test.swift:218:3:218:5 | [post] getter for .a [x] :  | test.swift:218:3:218:3 | [post] b [a, x] :  |
+| test.swift:218:11:218:18 | call to source() :  | test.swift:169:12:169:22 | value :  |
+| test.swift:218:11:218:18 | call to source() :  | test.swift:218:3:218:5 | [post] getter for .a [x] :  |
+| test.swift:219:13:219:13 | b [a, x] :  | test.swift:185:7:185:7 | self [a, x] :  |
+| test.swift:219:13:219:13 | b [a, x] :  | test.swift:219:13:219:15 | .a [x] :  |
+| test.swift:219:13:219:15 | .a [x] :  | test.swift:163:7:163:7 | self [x] :  |
+| test.swift:219:13:219:15 | .a [x] :  | test.swift:219:13:219:17 | .x |
+| test.swift:225:14:225:21 | call to source() :  | test.swift:235:13:235:15 | .source_value |
+| test.swift:225:14:225:21 | call to source() :  | test.swift:238:13:238:15 | .source_value |
 nodes
+| file://:0:0:0:0 | .a [x] :  | semmle.label | .a [x] :  |
+| file://:0:0:0:0 | .x :  | semmle.label | .x :  |
+| file://:0:0:0:0 | [post] self [x] :  | semmle.label | [post] self [x] :  |
+| file://:0:0:0:0 | self [a, x] :  | semmle.label | self [a, x] :  |
+| file://:0:0:0:0 | self [x] :  | semmle.label | self [x] :  |
+| file://:0:0:0:0 | value :  | semmle.label | value :  |
 | test.swift:6:19:6:26 | call to source() :  | semmle.label | call to source() :  |
 | test.swift:7:15:7:15 | t1 | semmle.label | t1 |
 | test.swift:9:15:9:15 | t1 | semmle.label | t1 |
@@ -63,22 +121,23 @@ nodes
 | test.swift:50:15:50:15 | t | semmle.label | t |
 | test.swift:53:1:56:1 | arg[return] :  | semmle.label | arg[return] :  |
 | test.swift:54:11:54:18 | call to source() :  | semmle.label | call to source() :  |
-| test.swift:61:17:61:23 | arg: &... :  | semmle.label | arg: &... :  |
+| test.swift:61:22:61:23 | [post] &... :  | semmle.label | [post] &... :  |
 | test.swift:62:15:62:15 | x | semmle.label | x |
 | test.swift:65:1:70:1 | arg2[return] :  | semmle.label | arg2[return] :  |
 | test.swift:65:16:65:28 | arg1 :  | semmle.label | arg1 :  |
 | test.swift:73:18:73:25 | call to source() :  | semmle.label | call to source() :  |
 | test.swift:75:21:75:22 | &... :  | semmle.label | &... :  |
-| test.swift:75:25:75:32 | arg2: &... :  | semmle.label | arg2: &... :  |
+| test.swift:75:31:75:32 | [post] &... :  | semmle.label | [post] &... :  |
+| test.swift:76:15:76:15 | x | semmle.label | x |
 | test.swift:77:15:77:15 | y | semmle.label | y |
 | test.swift:80:1:82:1 | arg[return] :  | semmle.label | arg[return] :  |
 | test.swift:81:11:81:18 | call to source() :  | semmle.label | call to source() :  |
 | test.swift:84:1:91:1 | arg[return] :  | semmle.label | arg[return] :  |
 | test.swift:86:15:86:22 | call to source() :  | semmle.label | call to source() :  |
 | test.swift:89:15:89:22 | call to source() :  | semmle.label | call to source() :  |
-| test.swift:97:34:97:40 | arg: &... :  | semmle.label | arg: &... :  |
+| test.swift:97:39:97:40 | [post] &... :  | semmle.label | [post] &... :  |
 | test.swift:98:19:98:19 | x | semmle.label | x |
-| test.swift:104:35:104:41 | arg: &... :  | semmle.label | arg: &... :  |
+| test.swift:104:40:104:41 | [post] &... :  | semmle.label | [post] &... :  |
 | test.swift:105:19:105:19 | x | semmle.label | x |
 | test.swift:109:9:109:14 | arg :  | semmle.label | arg :  |
 | test.swift:110:12:110:12 | arg :  | semmle.label | arg :  |
@@ -108,13 +167,73 @@ nodes
 | test.swift:155:19:155:19 | i | semmle.label | i |
 | test.swift:157:16:157:23 | call to source() :  | semmle.label | call to source() :  |
 | test.swift:159:16:159:29 | call to ... :  | semmle.label | call to ... :  |
+| test.swift:163:7:163:7 | self [x] :  | semmle.label | self [x] :  |
+| test.swift:163:7:163:7 | value :  | semmle.label | value :  |
+| test.swift:169:3:171:3 | self[return] [x] :  | semmle.label | self[return] [x] :  |
+| test.swift:169:12:169:22 | value :  | semmle.label | value :  |
+| test.swift:170:5:170:5 | [post] self [x] :  | semmle.label | [post] self [x] :  |
+| test.swift:170:9:170:9 | value :  | semmle.label | value :  |
+| test.swift:173:8:173:8 | self [x] :  | semmle.label | self [x] :  |
+| test.swift:174:12:174:12 | .x :  | semmle.label | .x :  |
+| test.swift:174:12:174:12 | self [x] :  | semmle.label | self [x] :  |
+| test.swift:180:3:180:3 | [post] a [x] :  | semmle.label | [post] a [x] :  |
+| test.swift:180:9:180:16 | call to source() :  | semmle.label | call to source() :  |
+| test.swift:181:13:181:13 | a [x] :  | semmle.label | a [x] :  |
+| test.swift:181:13:181:15 | .x | semmle.label | .x |
+| test.swift:185:7:185:7 | self [a, x] :  | semmle.label | self [a, x] :  |
+| test.swift:194:3:194:3 | [post] b [a, x] :  | semmle.label | [post] b [a, x] :  |
+| test.swift:194:3:194:5 | [post] getter for .a [x] :  | semmle.label | [post] getter for .a [x] :  |
+| test.swift:194:11:194:18 | call to source() :  | semmle.label | call to source() :  |
+| test.swift:195:13:195:13 | b [a, x] :  | semmle.label | b [a, x] :  |
+| test.swift:195:13:195:15 | .a [x] :  | semmle.label | .a [x] :  |
+| test.swift:195:13:195:17 | .x | semmle.label | .x |
+| test.swift:200:3:200:3 | [post] a [x] :  | semmle.label | [post] a [x] :  |
+| test.swift:200:9:200:16 | call to source() :  | semmle.label | call to source() :  |
+| test.swift:201:13:201:13 | a [x] :  | semmle.label | a [x] :  |
+| test.swift:201:13:201:15 | .x | semmle.label | .x |
+| test.swift:206:3:206:3 | [post] a [x] :  | semmle.label | [post] a [x] :  |
+| test.swift:206:9:206:16 | call to source() :  | semmle.label | call to source() :  |
+| test.swift:207:13:207:13 | a [x] :  | semmle.label | a [x] :  |
+| test.swift:207:13:207:19 | call to get() | semmle.label | call to get() |
+| test.swift:212:3:212:3 | [post] a [x] :  | semmle.label | [post] a [x] :  |
+| test.swift:212:9:212:16 | call to source() :  | semmle.label | call to source() :  |
+| test.swift:213:13:213:13 | a [x] :  | semmle.label | a [x] :  |
+| test.swift:213:13:213:19 | call to get() | semmle.label | call to get() |
+| test.swift:218:3:218:3 | [post] b [a, x] :  | semmle.label | [post] b [a, x] :  |
+| test.swift:218:3:218:5 | [post] getter for .a [x] :  | semmle.label | [post] getter for .a [x] :  |
+| test.swift:218:11:218:18 | call to source() :  | semmle.label | call to source() :  |
+| test.swift:219:13:219:13 | b [a, x] :  | semmle.label | b [a, x] :  |
+| test.swift:219:13:219:15 | .a [x] :  | semmle.label | .a [x] :  |
+| test.swift:219:13:219:17 | .x | semmle.label | .x |
+| test.swift:225:14:225:21 | call to source() :  | semmle.label | call to source() :  |
+| test.swift:235:13:235:15 | .source_value | semmle.label | .source_value |
+| test.swift:238:13:238:15 | .source_value | semmle.label | .source_value |
 subpaths
-| test.swift:75:21:75:22 | &... :  | test.swift:65:16:65:28 | arg1 :  | test.swift:65:1:70:1 | arg2[return] :  | test.swift:75:25:75:32 | arg2: &... :  |
+| test.swift:75:21:75:22 | &... :  | test.swift:65:16:65:28 | arg1 :  | test.swift:65:1:70:1 | arg2[return] :  | test.swift:75:31:75:32 | [post] &... :  |
 | test.swift:114:19:114:19 | arg :  | test.swift:109:9:109:14 | arg :  | test.swift:110:12:110:12 | arg :  | test.swift:114:12:114:22 | call to ... :  |
 | test.swift:114:19:114:19 | arg :  | test.swift:123:10:123:13 | i :  | test.swift:124:16:124:16 | i :  | test.swift:114:12:114:22 | call to ... :  |
 | test.swift:119:31:119:31 | x :  | test.swift:113:14:113:19 | arg :  | test.swift:114:12:114:22 | call to ... :  | test.swift:119:18:119:44 | call to forward(arg:lambda:) :  |
 | test.swift:122:31:122:38 | call to source() :  | test.swift:113:14:113:19 | arg :  | test.swift:114:12:114:22 | call to ... :  | test.swift:122:18:125:6 | call to forward(arg:lambda:) :  |
 | test.swift:145:23:145:30 | call to source() :  | test.swift:142:10:142:13 | i :  | test.swift:143:16:143:16 | i :  | test.swift:145:15:145:31 | call to ... |
+| test.swift:170:9:170:9 | value :  | test.swift:163:7:163:7 | value :  | file://:0:0:0:0 | [post] self [x] :  | test.swift:170:5:170:5 | [post] self [x] :  |
+| test.swift:174:12:174:12 | self [x] :  | test.swift:163:7:163:7 | self [x] :  | file://:0:0:0:0 | .x :  | test.swift:174:12:174:12 | .x :  |
+| test.swift:180:9:180:16 | call to source() :  | test.swift:163:7:163:7 | value :  | file://:0:0:0:0 | [post] self [x] :  | test.swift:180:3:180:3 | [post] a [x] :  |
+| test.swift:181:13:181:13 | a [x] :  | test.swift:163:7:163:7 | self [x] :  | file://:0:0:0:0 | .x :  | test.swift:181:13:181:15 | .x |
+| test.swift:194:11:194:18 | call to source() :  | test.swift:163:7:163:7 | value :  | file://:0:0:0:0 | [post] self [x] :  | test.swift:194:3:194:5 | [post] getter for .a [x] :  |
+| test.swift:195:13:195:13 | b [a, x] :  | test.swift:185:7:185:7 | self [a, x] :  | file://:0:0:0:0 | .a [x] :  | test.swift:195:13:195:15 | .a [x] :  |
+| test.swift:195:13:195:15 | .a [x] :  | test.swift:163:7:163:7 | self [x] :  | file://:0:0:0:0 | .x :  | test.swift:195:13:195:17 | .x |
+| test.swift:200:9:200:16 | call to source() :  | test.swift:169:12:169:22 | value :  | test.swift:169:3:171:3 | self[return] [x] :  | test.swift:200:3:200:3 | [post] a [x] :  |
+| test.swift:200:9:200:16 | call to source() :  | test.swift:169:12:169:22 | value :  | test.swift:170:5:170:5 | [post] self [x] :  | test.swift:200:3:200:3 | [post] a [x] :  |
+| test.swift:201:13:201:13 | a [x] :  | test.swift:163:7:163:7 | self [x] :  | file://:0:0:0:0 | .x :  | test.swift:201:13:201:15 | .x |
+| test.swift:206:9:206:16 | call to source() :  | test.swift:163:7:163:7 | value :  | file://:0:0:0:0 | [post] self [x] :  | test.swift:206:3:206:3 | [post] a [x] :  |
+| test.swift:207:13:207:13 | a [x] :  | test.swift:173:8:173:8 | self [x] :  | test.swift:174:12:174:12 | .x :  | test.swift:207:13:207:19 | call to get() |
+| test.swift:212:9:212:16 | call to source() :  | test.swift:169:12:169:22 | value :  | test.swift:169:3:171:3 | self[return] [x] :  | test.swift:212:3:212:3 | [post] a [x] :  |
+| test.swift:212:9:212:16 | call to source() :  | test.swift:169:12:169:22 | value :  | test.swift:170:5:170:5 | [post] self [x] :  | test.swift:212:3:212:3 | [post] a [x] :  |
+| test.swift:213:13:213:13 | a [x] :  | test.swift:173:8:173:8 | self [x] :  | test.swift:174:12:174:12 | .x :  | test.swift:213:13:213:19 | call to get() |
+| test.swift:218:11:218:18 | call to source() :  | test.swift:169:12:169:22 | value :  | test.swift:169:3:171:3 | self[return] [x] :  | test.swift:218:3:218:5 | [post] getter for .a [x] :  |
+| test.swift:218:11:218:18 | call to source() :  | test.swift:169:12:169:22 | value :  | test.swift:170:5:170:5 | [post] self [x] :  | test.swift:218:3:218:5 | [post] getter for .a [x] :  |
+| test.swift:219:13:219:13 | b [a, x] :  | test.swift:185:7:185:7 | self [a, x] :  | file://:0:0:0:0 | .a [x] :  | test.swift:219:13:219:15 | .a [x] :  |
+| test.swift:219:13:219:15 | .a [x] :  | test.swift:163:7:163:7 | self [x] :  | file://:0:0:0:0 | .x :  | test.swift:219:13:219:17 | .x |
 #select
 | test.swift:7:15:7:15 | t1 | test.swift:6:19:6:26 | call to source() :  | test.swift:7:15:7:15 | t1 | result |
 | test.swift:9:15:9:15 | t1 | test.swift:6:19:6:26 | call to source() :  | test.swift:9:15:9:15 | t1 | result |
@@ -124,6 +243,7 @@ subpaths
 | test.swift:39:15:39:29 | call to callee_source() | test.swift:35:12:35:19 | call to source() :  | test.swift:39:15:39:29 | call to callee_source() | result |
 | test.swift:50:15:50:15 | t | test.swift:43:19:43:26 | call to source() :  | test.swift:50:15:50:15 | t | result |
 | test.swift:62:15:62:15 | x | test.swift:54:11:54:18 | call to source() :  | test.swift:62:15:62:15 | x | result |
+| test.swift:76:15:76:15 | x | test.swift:73:18:73:25 | call to source() :  | test.swift:76:15:76:15 | x | result |
 | test.swift:77:15:77:15 | y | test.swift:73:18:73:25 | call to source() :  | test.swift:77:15:77:15 | y | result |
 | test.swift:98:19:98:19 | x | test.swift:81:11:81:18 | call to source() :  | test.swift:98:19:98:19 | x | result |
 | test.swift:105:19:105:19 | x | test.swift:86:15:86:22 | call to source() :  | test.swift:105:19:105:19 | x | result |
@@ -135,3 +255,11 @@ subpaths
 | test.swift:151:15:151:28 | call to ... | test.swift:149:16:149:23 | call to source() :  | test.swift:151:15:151:28 | call to ... | result |
 | test.swift:155:19:155:19 | i | test.swift:149:16:149:23 | call to source() :  | test.swift:155:19:155:19 | i | result |
 | test.swift:155:19:155:19 | i | test.swift:157:16:157:23 | call to source() :  | test.swift:155:19:155:19 | i | result |
+| test.swift:181:13:181:15 | .x | test.swift:180:9:180:16 | call to source() :  | test.swift:181:13:181:15 | .x | result |
+| test.swift:195:13:195:17 | .x | test.swift:194:11:194:18 | call to source() :  | test.swift:195:13:195:17 | .x | result |
+| test.swift:201:13:201:15 | .x | test.swift:200:9:200:16 | call to source() :  | test.swift:201:13:201:15 | .x | result |
+| test.swift:207:13:207:19 | call to get() | test.swift:206:9:206:16 | call to source() :  | test.swift:207:13:207:19 | call to get() | result |
+| test.swift:213:13:213:19 | call to get() | test.swift:212:9:212:16 | call to source() :  | test.swift:213:13:213:19 | call to get() | result |
+| test.swift:219:13:219:17 | .x | test.swift:218:11:218:18 | call to source() :  | test.swift:219:13:219:17 | .x | result |
+| test.swift:235:13:235:15 | .source_value | test.swift:225:14:225:21 | call to source() :  | test.swift:235:13:235:15 | .source_value | result |
+| test.swift:238:13:238:15 | .source_value | test.swift:225:14:225:21 | call to source() :  | test.swift:238:13:238:15 | .source_value | result |
diff --git a/swift/ql/test/library-tests/dataflow/dataflow/LocalFlow.expected b/swift/ql/test/library-tests/dataflow/dataflow/LocalFlow.expected
index d9c85949cca..f26a3f61f19 100644
--- a/swift/ql/test/library-tests/dataflow/dataflow/LocalFlow.expected
+++ b/swift/ql/test/library-tests/dataflow/dataflow/LocalFlow.expected
@@ -1,11 +1,3 @@
-| file://:0:0:0:0 | .a | file://:0:0:0:0 | &... |
-| file://:0:0:0:0 | .source_value | file://:0:0:0:0 | &... |
-| file://:0:0:0:0 | .wrappedValue | file://:0:0:0:0 | &... |
-| file://:0:0:0:0 | .x | file://:0:0:0:0 | &... |
-| file://:0:0:0:0 | self | file://:0:0:0:0 | &... |
-| file://:0:0:0:0 | self | file://:0:0:0:0 | &... |
-| file://:0:0:0:0 | self | file://:0:0:0:0 | self |
-| file://:0:0:0:0 | self | file://:0:0:0:0 | self |
 | test.swift:6:9:6:13 | WriteDef | test.swift:7:15:7:15 | t1 |
 | test.swift:6:19:6:26 | call to source() | test.swift:6:9:6:13 | WriteDef |
 | test.swift:7:15:7:15 | t1 | test.swift:8:10:8:10 | t1 |
@@ -33,8 +25,8 @@
 | test.swift:59:9:59:12 | WriteDef | test.swift:60:15:60:15 | x |
 | test.swift:59:18:59:18 | 0 | test.swift:59:9:59:12 | WriteDef |
 | test.swift:60:15:60:15 | x | test.swift:61:23:61:23 | x |
-| test.swift:61:5:61:24 | WriteDef | test.swift:62:15:62:15 | x |
-| test.swift:61:17:61:23 | arg: &... | test.swift:61:5:61:24 | WriteDef |
+| test.swift:61:22:61:23 | &... | test.swift:62:15:62:15 | x |
+| test.swift:61:22:61:23 | [post] &... | test.swift:62:15:62:15 | x |
 | test.swift:61:23:61:23 | x | test.swift:61:22:61:23 | &... |
 | test.swift:65:16:65:28 | arg1 | test.swift:66:21:66:21 | arg1 |
 | test.swift:65:33:65:45 | arg2 | test.swift:67:12:67:12 | arg2 |
@@ -48,11 +40,11 @@
 | test.swift:73:18:73:25 | call to source() | test.swift:73:9:73:12 | WriteDef |
 | test.swift:74:9:74:12 | WriteDef | test.swift:75:32:75:32 | y |
 | test.swift:74:18:74:18 | 0 | test.swift:74:9:74:12 | WriteDef |
-| test.swift:75:5:75:33 | WriteDef | test.swift:76:15:76:15 | x |
-| test.swift:75:5:75:33 | WriteDef | test.swift:77:15:77:15 | y |
-| test.swift:75:15:75:22 | arg1: &... | test.swift:75:5:75:33 | WriteDef |
+| test.swift:75:21:75:22 | &... | test.swift:76:15:76:15 | x |
+| test.swift:75:21:75:22 | [post] &... | test.swift:76:15:76:15 | x |
 | test.swift:75:22:75:22 | x | test.swift:75:21:75:22 | &... |
-| test.swift:75:25:75:32 | arg2: &... | test.swift:75:5:75:33 | WriteDef |
+| test.swift:75:31:75:32 | &... | test.swift:77:15:77:15 | y |
+| test.swift:75:31:75:32 | [post] &... | test.swift:77:15:77:15 | y |
 | test.swift:75:32:75:32 | y | test.swift:75:31:75:32 | &... |
 | test.swift:81:5:81:18 | WriteDef | test.swift:80:1:82:1 | arg[return] |
 | test.swift:81:11:81:18 | call to source() | test.swift:81:5:81:18 | WriteDef |
@@ -66,14 +58,14 @@
 | test.swift:95:13:95:16 | WriteDef | test.swift:96:19:96:19 | x |
 | test.swift:95:22:95:22 | 0 | test.swift:95:13:95:16 | WriteDef |
 | test.swift:96:19:96:19 | x | test.swift:97:40:97:40 | x |
-| test.swift:97:9:97:41 | WriteDef | test.swift:98:19:98:19 | x |
-| test.swift:97:34:97:40 | arg: &... | test.swift:97:9:97:41 | WriteDef |
+| test.swift:97:39:97:40 | &... | test.swift:98:19:98:19 | x |
+| test.swift:97:39:97:40 | [post] &... | test.swift:98:19:98:19 | x |
 | test.swift:97:40:97:40 | x | test.swift:97:39:97:40 | &... |
 | test.swift:102:13:102:16 | WriteDef | test.swift:103:19:103:19 | x |
 | test.swift:102:22:102:22 | 0 | test.swift:102:13:102:16 | WriteDef |
 | test.swift:103:19:103:19 | x | test.swift:104:41:104:41 | x |
-| test.swift:104:9:104:54 | WriteDef | test.swift:105:19:105:19 | x |
-| test.swift:104:35:104:41 | arg: &... | test.swift:104:9:104:54 | WriteDef |
+| test.swift:104:40:104:41 | &... | test.swift:105:19:105:19 | x |
+| test.swift:104:40:104:41 | [post] &... | test.swift:105:19:105:19 | x |
 | test.swift:104:41:104:41 | x | test.swift:104:40:104:41 | &... |
 | test.swift:109:9:109:14 | arg | test.swift:110:12:110:12 | arg |
 | test.swift:113:14:113:19 | arg | test.swift:114:19:114:19 | arg |
@@ -97,46 +89,58 @@
 | test.swift:153:22:156:5 | { ... } | test.swift:153:9:153:9 | WriteDef |
 | test.swift:154:10:154:13 | i | test.swift:155:19:155:19 | i |
 | test.swift:157:5:157:5 | lambdaSink | test.swift:159:5:159:5 | lambdaSink |
-| test.swift:163:7:163:7 | self | file://:0:0:0:0 | self |
-| test.swift:163:7:163:7 | self | file://:0:0:0:0 | self |
-| test.swift:163:7:163:7 | self | file://:0:0:0:0 | self |
-| test.swift:163:7:163:7 | value | file://:0:0:0:0 | value |
+| test.swift:162:7:162:7 | self | test.swift:162:7:162:7 | self[return] |
 | test.swift:165:3:165:3 | self | test.swift:166:5:166:5 | self |
+| test.swift:166:5:166:5 | [post] self | test.swift:165:3:167:3 | self[return] |
+| test.swift:166:5:166:5 | self | test.swift:165:3:167:3 | self[return] |
 | test.swift:169:8:169:8 | self | test.swift:170:5:170:5 | self |
 | test.swift:169:12:169:22 | value | test.swift:170:9:170:9 | value |
+| test.swift:170:5:170:5 | [post] self | test.swift:169:3:171:3 | self[return] |
+| test.swift:170:5:170:5 | self | test.swift:169:3:171:3 | self[return] |
 | test.swift:173:8:173:8 | self | test.swift:174:12:174:12 | self |
+| test.swift:174:12:174:12 | [post] self | test.swift:173:3:175:3 | self[return] |
+| test.swift:174:12:174:12 | self | test.swift:173:3:175:3 | self[return] |
 | test.swift:179:7:179:7 | WriteDef | test.swift:180:3:180:3 | a |
-| test.swift:179:11:179:13 | call to init | test.swift:179:7:179:7 | WriteDef |
+| test.swift:179:11:179:13 | call to init() | test.swift:179:7:179:7 | WriteDef |
+| test.swift:180:3:180:3 | [post] a | test.swift:181:13:181:13 | a |
 | test.swift:180:3:180:3 | a | test.swift:181:13:181:13 | a |
-| test.swift:185:7:185:7 | self | file://:0:0:0:0 | self |
-| test.swift:185:7:185:7 | self | file://:0:0:0:0 | self |
-| test.swift:185:7:185:7 | self | file://:0:0:0:0 | self |
-| test.swift:185:7:185:7 | value | file://:0:0:0:0 | value |
+| test.swift:184:7:184:7 | self | test.swift:184:7:184:7 | self[return] |
 | test.swift:187:3:187:3 | self | test.swift:188:5:188:5 | self |
+| test.swift:188:5:188:5 | [post] self | test.swift:187:3:189:3 | self[return] |
+| test.swift:188:5:188:5 | self | test.swift:187:3:189:3 | self[return] |
 | test.swift:193:7:193:7 | WriteDef | test.swift:194:3:194:3 | b |
-| test.swift:193:11:193:13 | call to init | test.swift:193:7:193:7 | WriteDef |
+| test.swift:193:11:193:13 | call to init() | test.swift:193:7:193:7 | WriteDef |
+| test.swift:194:3:194:3 | [post] b | test.swift:195:13:195:13 | b |
 | test.swift:194:3:194:3 | b | test.swift:195:13:195:13 | b |
 | test.swift:199:7:199:7 | WriteDef | test.swift:200:3:200:3 | a |
-| test.swift:199:11:199:13 | call to init | test.swift:199:7:199:7 | WriteDef |
+| test.swift:199:11:199:13 | call to init() | test.swift:199:7:199:7 | WriteDef |
+| test.swift:200:3:200:3 | [post] a | test.swift:201:13:201:13 | a |
 | test.swift:200:3:200:3 | a | test.swift:201:13:201:13 | a |
 | test.swift:205:7:205:7 | WriteDef | test.swift:206:3:206:3 | a |
-| test.swift:205:11:205:13 | call to init | test.swift:205:7:205:7 | WriteDef |
+| test.swift:205:11:205:13 | call to init() | test.swift:205:7:205:7 | WriteDef |
+| test.swift:206:3:206:3 | [post] a | test.swift:207:13:207:13 | a |
 | test.swift:206:3:206:3 | a | test.swift:207:13:207:13 | a |
 | test.swift:211:7:211:7 | WriteDef | test.swift:212:3:212:3 | a |
-| test.swift:211:11:211:13 | call to init | test.swift:211:7:211:7 | WriteDef |
+| test.swift:211:11:211:13 | call to init() | test.swift:211:7:211:7 | WriteDef |
+| test.swift:212:3:212:3 | [post] a | test.swift:213:13:213:13 | a |
 | test.swift:212:3:212:3 | a | test.swift:213:13:213:13 | a |
 | test.swift:217:7:217:7 | WriteDef | test.swift:218:3:218:3 | b |
-| test.swift:217:11:217:13 | call to init | test.swift:217:7:217:7 | WriteDef |
+| test.swift:217:11:217:13 | call to init() | test.swift:217:7:217:7 | WriteDef |
+| test.swift:218:3:218:3 | [post] b | test.swift:219:13:219:13 | b |
 | test.swift:218:3:218:3 | b | test.swift:219:13:219:13 | b |
-| test.swift:223:7:223:7 | self | file://:0:0:0:0 | self |
+| test.swift:222:7:222:7 | self | test.swift:222:7:222:7 | self[return] |
+| test.swift:222:7:222:7 | self | test.swift:222:7:222:7 | self[return] |
+| test.swift:224:5:224:5 | self | test.swift:224:5:226:5 | self[return] |
+| test.swift:227:5:227:5 | self | test.swift:227:5:229:5 | self[return] |
 | test.swift:234:7:234:7 | WriteDef | test.swift:235:13:235:13 | a |
-| test.swift:234:11:234:31 | call to init | test.swift:234:7:234:7 | WriteDef |
+| test.swift:234:11:234:31 | call to init() | test.swift:234:7:234:7 | WriteDef |
+| test.swift:235:13:235:13 | [post] a | test.swift:237:3:237:3 | a |
 | test.swift:235:13:235:13 | a | test.swift:237:3:237:3 | a |
+| test.swift:237:3:237:3 | [post] a | test.swift:238:13:238:13 | a |
 | test.swift:237:3:237:3 | a | test.swift:238:13:238:13 | a |
-| test.swift:242:9:242:9 | self | file://:0:0:0:0 | self |
-| test.swift:242:9:242:9 | self | file://:0:0:0:0 | self |
-| test.swift:242:9:242:9 | self | file://:0:0:0:0 | self |
-| test.swift:242:9:242:9 | value | file://:0:0:0:0 | value |
 | test.swift:243:9:243:9 | self | test.swift:243:18:243:18 | self |
+| test.swift:243:18:243:18 | [post] self | test.swift:243:9:243:42 | self[return] |
+| test.swift:243:18:243:18 | self | test.swift:243:9:243:42 | self[return] |
 | test.swift:246:5:246:5 | self | test.swift:247:9:247:9 | self |
-| test.swift:252:23:252:23 | value | file://:0:0:0:0 | value |
+| test.swift:247:9:247:9 | [post] self | test.swift:246:5:248:5 | self[return] |
+| test.swift:247:9:247:9 | self | test.swift:246:5:248:5 | self[return] |
diff --git a/swift/ql/test/library-tests/dataflow/dataflow/LocalFlow.ql b/swift/ql/test/library-tests/dataflow/dataflow/LocalFlow.ql
index 04a547b939d..6572eca06a3 100644
--- a/swift/ql/test/library-tests/dataflow/dataflow/LocalFlow.ql
+++ b/swift/ql/test/library-tests/dataflow/dataflow/LocalFlow.ql
@@ -2,5 +2,8 @@ import swift
 import codeql.swift.dataflow.DataFlow
 
 from DataFlow::Node pred, DataFlow::Node succ
-where DataFlow::localFlowStep(pred, succ)
+where
+  DataFlow::localFlowStep(pred, succ) and
+  not pred.getLocation() instanceof UnknownLocation and
+  not succ.getLocation() instanceof UnknownLocation
 select pred, succ
diff --git a/swift/ql/test/library-tests/dataflow/dataflow/test.swift b/swift/ql/test/library-tests/dataflow/dataflow/test.swift
index 204223baa56..bdbb3b28efb 100644
--- a/swift/ql/test/library-tests/dataflow/dataflow/test.swift
+++ b/swift/ql/test/library-tests/dataflow/dataflow/test.swift
@@ -73,7 +73,7 @@ func swapUser() {
     var x: Int = source()
     var y: Int = 0
     inoutSwap(arg1: &x, arg2: &y)
-    sink(arg: x) // clean
+    sink(arg: x) // $ SPURIOUS: flow=73
     sink(arg: y) // $ flow=73
 }
 
@@ -178,7 +178,7 @@ class A {
 func simple_field_flow() {
   var a = A()
   a.x = source()
-  sink(arg: a.x) // $ MISSING: flow=180
+  sink(arg: a.x) // $ flow=180
 }
 
 class B {
@@ -192,31 +192,31 @@ class B {
 func reverse_read() {
   var b = B()
   b.a.x = source()
-  sink(arg: b.a.x) // $ MISSING: flow=194
+  sink(arg: b.a.x) // $ flow=194
 }
 
 func test_setter() {
   var a = A()
   a.set(source())
-  sink(arg: a.x) // $ MISSING: flow=200
+  sink(arg: a.x) // $ flow=200
 }
 
 func test_getter() {
   var a = A()
   a.x = source()
-  sink(arg: a.get()) // $ MISSING: flow=206
+  sink(arg: a.get()) // $ flow=206
 }
 
 func test_setter_getter() {
   var a = A()
   a.set(source())
-  sink(arg: a.get()) // $ MISSING: flow=212
+  sink(arg: a.get()) // $ flow=212
 }
 
 func flow_through(b : B) {
   var b = B()
   b.a.set(source())
-  sink(arg: b.a.x) // $ MISSING: flow=218
+  sink(arg: b.a.x) // $ flow=218
 }
 
 class HasComputedProperty {
@@ -232,10 +232,10 @@ class HasComputedProperty {
 
 func test_computed_property() {
   var a = HasComputedProperty()
-  sink(arg: a.source_value) // $ MISSING: flow=225
+  sink(arg: a.source_value) // $ flow=225
 
   a.source_value = 0
-  sink(arg: a.source_value) // $ MISSING: flow=225
+  sink(arg: a.source_value) // $ flow=225
 }
 
 @propertyWrapper struct DidSetSource {
diff --git a/swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected b/swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected
index e734b36c2dc..f454e5e4445 100644
--- a/swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected
+++ b/swift/ql/test/library-tests/dataflow/taint/LocalTaint.expected
@@ -1,188 +1,139 @@
-| data.swift:12:6:12:6 | WriteDef | data.swift:16:12:16:12 | dataClean |
-| data.swift:12:18:12:36 | call to init | data.swift:12:6:12:6 | WriteDef |
-| data.swift:13:6:13:6 | WriteDef | data.swift:14:26:14:26 | dataTainted |
-| data.swift:13:20:13:38 | call to init | data.swift:13:6:13:6 | WriteDef |
-| data.swift:14:6:14:6 | WriteDef | data.swift:18:12:18:12 | dataTainted2 |
-| data.swift:14:21:14:37 | call to init | data.swift:14:6:14:6 | WriteDef |
-| data.swift:14:26:14:26 | dataTainted | data.swift:17:12:17:12 | dataTainted |
-| data.swift:16:12:16:12 | dataClean | data.swift:20:33:20:33 | dataClean |
-| string.swift:5:7:5:7 | WriteDef | string.swift:7:16:7:16 | x |
-| string.swift:5:11:5:18 | call to source() | string.swift:5:7:5:7 | WriteDef |
-| string.swift:7:13:7:13 | WriteDef | string.swift:7:14:7:14 | Phi |
-| string.swift:7:14:7:13 | WriteDef | string.swift:7:15:7:15 | $interpolation |
-| string.swift:7:14:7:14 | $interpolation | string.swift:7:14:7:14 | &... |
-| string.swift:7:14:7:14 | Phi | string.swift:7:14:7:14 | $interpolation |
-| string.swift:7:15:7:15 | $interpolation | string.swift:7:15:7:15 | &... |
-| string.swift:7:15:7:17 | WriteDef | string.swift:7:18:7:18 | $interpolation |
-| string.swift:7:16:7:16 | x | string.swift:9:16:9:16 | x |
-| string.swift:7:18:7:18 | $interpolation | string.swift:7:18:7:18 | &... |
-| string.swift:7:18:7:18 | WriteDef | string.swift:7:13:7:13 | TapExpr |
-| string.swift:9:13:9:13 | WriteDef | string.swift:9:14:9:14 | Phi |
-| string.swift:9:14:9:13 | WriteDef | string.swift:9:15:9:15 | $interpolation |
-| string.swift:9:14:9:14 | $interpolation | string.swift:9:14:9:14 | &... |
-| string.swift:9:14:9:14 | Phi | string.swift:9:14:9:14 | $interpolation |
-| string.swift:9:15:9:15 | $interpolation | string.swift:9:15:9:15 | &... |
-| string.swift:9:15:9:17 | WriteDef | string.swift:9:18:9:18 | $interpolation |
-| string.swift:9:16:9:16 | x | string.swift:9:21:9:21 | x |
-| string.swift:9:18:9:18 | $interpolation | string.swift:9:18:9:18 | &... |
-| string.swift:9:18:9:18 | WriteDef | string.swift:9:20:9:20 | $interpolation |
-| string.swift:9:20:9:20 | $interpolation | string.swift:9:20:9:20 | &... |
-| string.swift:9:20:9:22 | WriteDef | string.swift:9:23:9:23 | $interpolation |
-| string.swift:9:21:9:21 | x | string.swift:11:16:11:16 | x |
-| string.swift:9:23:9:23 | $interpolation | string.swift:9:23:9:23 | &... |
-| string.swift:9:23:9:23 | WriteDef | string.swift:9:13:9:13 | TapExpr |
-| string.swift:11:13:11:13 | WriteDef | string.swift:11:14:11:14 | Phi |
-| string.swift:11:14:11:13 | WriteDef | string.swift:11:15:11:15 | $interpolation |
-| string.swift:11:14:11:14 | $interpolation | string.swift:11:14:11:14 | &... |
-| string.swift:11:14:11:14 | Phi | string.swift:11:14:11:14 | $interpolation |
-| string.swift:11:15:11:15 | $interpolation | string.swift:11:15:11:15 | &... |
-| string.swift:11:15:11:17 | WriteDef | string.swift:11:18:11:18 | $interpolation |
-| string.swift:11:16:11:16 | x | string.swift:11:26:11:26 | x |
-| string.swift:11:18:11:18 | $interpolation | string.swift:11:18:11:18 | &... |
-| string.swift:11:18:11:18 | WriteDef | string.swift:11:20:11:20 | $interpolation |
-| string.swift:11:20:11:20 | $interpolation | string.swift:11:20:11:20 | &... |
-| string.swift:11:20:11:22 | WriteDef | string.swift:11:23:11:23 | $interpolation |
-| string.swift:11:23:11:23 | $interpolation | string.swift:11:23:11:23 | &... |
-| string.swift:11:23:11:23 | WriteDef | string.swift:11:25:11:25 | $interpolation |
-| string.swift:11:25:11:25 | $interpolation | string.swift:11:25:11:25 | &... |
-| string.swift:11:25:11:27 | WriteDef | string.swift:11:28:11:28 | $interpolation |
-| string.swift:11:26:11:26 | x | string.swift:16:16:16:16 | x |
-| string.swift:11:28:11:28 | $interpolation | string.swift:11:28:11:28 | &... |
-| string.swift:11:28:11:28 | WriteDef | string.swift:11:13:11:13 | TapExpr |
-| string.swift:13:7:13:7 | WriteDef | string.swift:14:16:14:16 | y |
-| string.swift:13:11:13:11 | 42 | string.swift:13:7:13:7 | WriteDef |
-| string.swift:14:13:14:13 | WriteDef | string.swift:14:14:14:14 | Phi |
-| string.swift:14:14:14:13 | WriteDef | string.swift:14:15:14:15 | $interpolation |
-| string.swift:14:14:14:14 | $interpolation | string.swift:14:14:14:14 | &... |
-| string.swift:14:14:14:14 | Phi | string.swift:14:14:14:14 | $interpolation |
-| string.swift:14:15:14:15 | $interpolation | string.swift:14:15:14:15 | &... |
-| string.swift:14:15:14:17 | WriteDef | string.swift:14:18:14:18 | $interpolation |
-| string.swift:14:16:14:16 | y | string.swift:16:27:16:27 | y |
-| string.swift:14:18:14:18 | $interpolation | string.swift:14:18:14:18 | &... |
-| string.swift:14:18:14:18 | WriteDef | string.swift:14:13:14:13 | TapExpr |
-| string.swift:16:13:16:13 | WriteDef | string.swift:16:14:16:14 | Phi |
-| string.swift:16:14:16:13 | WriteDef | string.swift:16:15:16:15 | $interpolation |
-| string.swift:16:14:16:14 | $interpolation | string.swift:16:14:16:14 | &... |
-| string.swift:16:14:16:14 | Phi | string.swift:16:14:16:14 | $interpolation |
-| string.swift:16:15:16:15 | $interpolation | string.swift:16:15:16:15 | &... |
-| string.swift:16:15:16:17 | WriteDef | string.swift:16:18:16:18 | $interpolation |
-| string.swift:16:16:16:16 | x | string.swift:18:27:18:27 | x |
-| string.swift:16:18:16:18 | $interpolation | string.swift:16:18:16:18 | &... |
-| string.swift:16:18:16:18 | WriteDef | string.swift:16:26:16:26 | $interpolation |
-| string.swift:16:26:16:26 | $interpolation | string.swift:16:26:16:26 | &... |
-| string.swift:16:26:16:28 | WriteDef | string.swift:16:29:16:29 | $interpolation |
-| string.swift:16:27:16:27 | y | string.swift:18:16:18:16 | y |
-| string.swift:16:29:16:29 | $interpolation | string.swift:16:29:16:29 | &... |
-| string.swift:16:29:16:29 | WriteDef | string.swift:16:13:16:13 | TapExpr |
-| string.swift:18:13:18:13 | WriteDef | string.swift:18:14:18:14 | Phi |
-| string.swift:18:14:18:13 | WriteDef | string.swift:18:15:18:15 | $interpolation |
-| string.swift:18:14:18:14 | $interpolation | string.swift:18:14:18:14 | &... |
-| string.swift:18:14:18:14 | Phi | string.swift:18:14:18:14 | $interpolation |
-| string.swift:18:15:18:15 | $interpolation | string.swift:18:15:18:15 | &... |
-| string.swift:18:15:18:17 | WriteDef | string.swift:18:18:18:18 | $interpolation |
-| string.swift:18:18:18:18 | $interpolation | string.swift:18:18:18:18 | &... |
-| string.swift:18:18:18:18 | WriteDef | string.swift:18:26:18:26 | $interpolation |
-| string.swift:18:26:18:26 | $interpolation | string.swift:18:26:18:26 | &... |
-| string.swift:18:26:18:28 | WriteDef | string.swift:18:29:18:29 | $interpolation |
-| string.swift:18:29:18:29 | $interpolation | string.swift:18:29:18:29 | &... |
-| string.swift:18:29:18:29 | WriteDef | string.swift:18:13:18:13 | TapExpr |
-| string.swift:20:3:20:7 | WriteDef | string.swift:21:16:21:16 | x |
-| string.swift:20:7:20:7 | 0 | string.swift:20:3:20:7 | WriteDef |
-| string.swift:21:13:21:13 | WriteDef | string.swift:21:14:21:14 | Phi |
-| string.swift:21:14:21:13 | WriteDef | string.swift:21:15:21:15 | $interpolation |
-| string.swift:21:14:21:14 | $interpolation | string.swift:21:14:21:14 | &... |
-| string.swift:21:14:21:14 | Phi | string.swift:21:14:21:14 | $interpolation |
-| string.swift:21:15:21:15 | $interpolation | string.swift:21:15:21:15 | &... |
-| string.swift:21:15:21:17 | WriteDef | string.swift:21:18:21:18 | $interpolation |
-| string.swift:21:18:21:18 | $interpolation | string.swift:21:18:21:18 | &... |
-| string.swift:21:18:21:18 | WriteDef | string.swift:21:13:21:13 | TapExpr |
-| string.swift:27:7:27:7 | WriteDef | string.swift:30:13:30:13 | clean |
-| string.swift:27:15:27:15 | abcdef | string.swift:27:7:27:7 | WriteDef |
-| string.swift:28:7:28:7 | WriteDef | string.swift:31:13:31:13 | tainted |
-| string.swift:28:17:28:25 | call to source2() | string.swift:28:7:28:7 | WriteDef |
-| string.swift:30:13:30:13 | clean | string.swift:33:13:33:13 | clean |
-| string.swift:31:13:31:13 | tainted | string.swift:34:21:34:21 | tainted |
-| string.swift:33:13:33:13 | clean | string.swift:33:21:33:21 | clean |
-| string.swift:33:21:33:21 | clean | string.swift:34:13:34:13 | clean |
-| string.swift:34:13:34:13 | clean | string.swift:35:23:35:23 | clean |
-| string.swift:34:21:34:21 | tainted | string.swift:35:13:35:13 | tainted |
-| string.swift:35:13:35:13 | tainted | string.swift:36:13:36:13 | tainted |
-| string.swift:35:23:35:23 | clean | string.swift:38:19:38:19 | clean |
-| string.swift:36:13:36:13 | tainted | string.swift:36:23:36:23 | tainted |
-| string.swift:36:23:36:23 | tainted | string.swift:39:19:39:19 | tainted |
-| string.swift:41:7:41:7 | WriteDef | string.swift:43:13:43:13 | str |
-| string.swift:41:13:41:13 | abc | string.swift:41:7:41:7 | WriteDef |
-| string.swift:43:13:43:13 | str | string.swift:45:3:45:3 | str |
-| string.swift:45:3:45:3 | : &... | string.swift:45:3:45:10 | WriteDef |
-| string.swift:45:3:45:3 | str | string.swift:45:3:45:3 | &... |
-| string.swift:45:3:45:10 | WriteDef | string.swift:46:13:46:13 | str |
-| string.swift:46:13:46:13 | str | string.swift:48:3:48:3 | str |
-| string.swift:48:3:48:3 | : &... | string.swift:48:3:48:18 | WriteDef |
-| string.swift:48:3:48:3 | str | string.swift:48:3:48:3 | &... |
-| string.swift:48:3:48:18 | WriteDef | string.swift:49:13:49:13 | str |
-| string.swift:51:7:51:7 | WriteDef | string.swift:53:13:53:13 | str2 |
-| string.swift:51:14:51:14 | abc | string.swift:51:7:51:7 | WriteDef |
-| string.swift:53:13:53:13 | str2 | string.swift:55:3:55:3 | str2 |
-| string.swift:55:3:55:3 | str2 | string.swift:55:3:55:3 | &... |
-| string.swift:55:3:55:20 | WriteDef | string.swift:56:13:56:13 | str2 |
-| string.swift:56:13:56:13 | str2 | string.swift:58:3:58:3 | str2 |
-| string.swift:58:3:58:3 | str2 | string.swift:58:3:58:3 | &... |
-| string.swift:58:3:58:24 | WriteDef | string.swift:59:13:59:13 | str2 |
-| string.swift:59:13:59:13 | str2 | string.swift:69:13:69:13 | str2 |
-| string.swift:61:7:61:7 | WriteDef | string.swift:63:13:63:13 | str3 |
-| string.swift:61:14:61:14 | abc | string.swift:61:7:61:7 | WriteDef |
-| string.swift:63:13:63:13 | str3 | string.swift:65:3:65:3 | str3 |
-| string.swift:65:3:65:3 | str3 | string.swift:65:3:65:3 | &... |
-| string.swift:65:3:65:32 | WriteDef | string.swift:66:13:66:13 | str3 |
-| string.swift:66:13:66:13 | str3 | string.swift:68:3:68:3 | str3 |
-| string.swift:68:3:68:3 | str3 | string.swift:68:3:68:3 | &... |
-| string.swift:73:7:73:7 | WriteDef | string.swift:77:20:77:20 | clean |
-| string.swift:73:15:73:15 |  | string.swift:73:7:73:7 | WriteDef |
-| string.swift:74:7:74:7 | WriteDef | string.swift:78:20:78:20 | tainted |
-| string.swift:74:17:74:25 | call to source2() | string.swift:74:7:74:7 | WriteDef |
-| string.swift:75:7:75:7 | WriteDef | string.swift:79:20:79:20 | taintedInt |
-| string.swift:75:20:75:27 | call to source() | string.swift:75:7:75:7 | WriteDef |
-| string.swift:77:20:77:20 | clean | string.swift:81:31:81:31 | clean |
-| string.swift:78:20:78:20 | tainted | string.swift:82:31:82:31 | tainted |
-| string.swift:81:31:81:31 | clean | string.swift:84:13:84:13 | clean |
-| string.swift:82:31:82:31 | tainted | string.swift:85:13:85:13 | tainted |
-| string.swift:84:13:84:13 | clean | string.swift:87:13:87:13 | clean |
-| string.swift:85:13:85:13 | tainted | string.swift:88:13:88:13 | tainted |
-| try.swift:8:17:8:23 | call to clean() | try.swift:8:13:8:23 | try ... |
-| try.swift:9:17:9:24 | call to source() | try.swift:9:13:9:24 | try ... |
-| try.swift:14:17:14:23 | call to clean() | try.swift:14:12:14:23 | try! ... |
-| try.swift:15:17:15:24 | call to source() | try.swift:15:12:15:24 | try! ... |
-| try.swift:17:13:17:24 | try? ... | try.swift:17:12:17:26 | ...! |
-| try.swift:17:18:17:24 | call to clean() | try.swift:17:13:17:24 | try? ... |
-| try.swift:18:13:18:25 | try? ... | try.swift:18:12:18:27 | ...! |
-| try.swift:18:18:18:25 | call to source() | try.swift:18:13:18:25 | try? ... |
-| url.swift:12:6:12:6 | WriteDef | url.swift:14:29:14:29 | clean |
-| url.swift:12:14:12:14 | http://example.com/ | url.swift:12:6:12:6 | WriteDef |
-| url.swift:13:6:13:6 | WriteDef | url.swift:15:31:15:31 | tainted |
-| url.swift:13:16:13:23 | call to source() | url.swift:13:6:13:6 | WriteDef |
-| url.swift:14:6:14:6 | WriteDef | url.swift:17:12:17:12 | urlClean |
-| url.swift:14:17:14:34 | call to init | url.swift:14:17:14:35 | ...! |
-| url.swift:14:17:14:35 | ...! | url.swift:14:6:14:6 | WriteDef |
-| url.swift:14:29:14:29 | clean | url.swift:20:24:20:24 | clean |
-| url.swift:15:6:15:6 | WriteDef | url.swift:18:12:18:12 | urlTainted |
-| url.swift:15:19:15:38 | call to init | url.swift:15:19:15:39 | ...! |
-| url.swift:15:19:15:39 | ...! | url.swift:15:6:15:6 | WriteDef |
-| url.swift:15:31:15:31 | tainted | url.swift:21:24:21:24 | tainted |
-| url.swift:17:12:17:12 | urlClean | url.swift:22:43:22:43 | urlClean |
-| url.swift:18:12:18:12 | urlTainted | url.swift:23:43:23:43 | urlTainted |
-| url.swift:20:12:20:46 | call to init | url.swift:20:12:20:47 | ...! |
-| url.swift:20:24:20:24 | clean | url.swift:22:24:22:24 | clean |
-| url.swift:21:12:21:48 | call to init | url.swift:21:12:21:49 | ...! |
-| url.swift:21:24:21:24 | tainted | url.swift:29:25:29:25 | tainted |
-| url.swift:22:12:22:51 | call to init | url.swift:22:12:22:52 | ...! |
-| url.swift:22:24:22:24 | clean | url.swift:23:24:23:24 | clean |
-| url.swift:23:12:23:53 | call to init | url.swift:23:12:23:54 | ...! |
-| url.swift:23:24:23:24 | clean | url.swift:25:25:25:25 | clean |
-| url.swift:25:25:25:25 | clean | url.swift:34:26:34:26 | clean |
-| url.swift:29:25:29:25 | tainted | url.swift:38:28:38:28 | tainted |
-| url.swift:34:2:34:31 | WriteDef | url.swift:35:12:35:12 | urlClean2 |
-| url.swift:34:14:34:31 | call to init | url.swift:34:2:34:31 | WriteDef |
-| url.swift:35:12:35:12 | urlClean2 | url.swift:35:12:35:12 | ...! |
-| url.swift:38:2:38:35 | WriteDef | url.swift:39:12:39:12 | urlTainted2 |
-| url.swift:38:16:38:35 | call to init | url.swift:38:2:38:35 | WriteDef |
-| url.swift:39:12:39:12 | urlTainted2 | url.swift:39:12:39:12 | ...! |
+| string.swift:7:13:7:13 |  | string.swift:7:13:7:13 | [post]  |
+| string.swift:7:13:7:13 |  | string.swift:7:14:7:14 | [post] &... |
+| string.swift:7:13:7:13 | TapExpr | string.swift:7:13:7:13 | "..." |
+| string.swift:7:14:7:14 | &... | string.swift:7:13:7:13 | [post]  |
+| string.swift:7:14:7:14 | &... | string.swift:7:14:7:14 | [post] &... |
+| string.swift:7:15:7:15 | &... | string.swift:7:15:7:15 | [post] &... |
+| string.swift:7:16:7:16 | x | string.swift:7:15:7:15 | [post] &... |
+| string.swift:7:18:7:18 |  | string.swift:7:18:7:18 | [post]  |
+| string.swift:7:18:7:18 |  | string.swift:7:18:7:18 | [post] &... |
+| string.swift:7:18:7:18 | &... | string.swift:7:18:7:18 | [post]  |
+| string.swift:7:18:7:18 | &... | string.swift:7:18:7:18 | [post] &... |
+| string.swift:9:13:9:13 |  | string.swift:9:13:9:13 | [post]  |
+| string.swift:9:13:9:13 |  | string.swift:9:14:9:14 | [post] &... |
+| string.swift:9:13:9:13 | TapExpr | string.swift:9:13:9:13 | "..." |
+| string.swift:9:14:9:14 | &... | string.swift:9:13:9:13 | [post]  |
+| string.swift:9:14:9:14 | &... | string.swift:9:14:9:14 | [post] &... |
+| string.swift:9:15:9:15 | &... | string.swift:9:15:9:15 | [post] &... |
+| string.swift:9:16:9:16 | x | string.swift:9:15:9:15 | [post] &... |
+| string.swift:9:18:9:18 |   | string.swift:9:18:9:18 | [post]   |
+| string.swift:9:18:9:18 |   | string.swift:9:18:9:18 | [post] &... |
+| string.swift:9:18:9:18 | &... | string.swift:9:18:9:18 | [post]   |
+| string.swift:9:18:9:18 | &... | string.swift:9:18:9:18 | [post] &... |
+| string.swift:9:20:9:20 | &... | string.swift:9:20:9:20 | [post] &... |
+| string.swift:9:21:9:21 | x | string.swift:9:20:9:20 | [post] &... |
+| string.swift:9:23:9:23 |  | string.swift:9:23:9:23 | [post]  |
+| string.swift:9:23:9:23 |  | string.swift:9:23:9:23 | [post] &... |
+| string.swift:9:23:9:23 | &... | string.swift:9:23:9:23 | [post]  |
+| string.swift:9:23:9:23 | &... | string.swift:9:23:9:23 | [post] &... |
+| string.swift:11:13:11:13 |  | string.swift:11:13:11:13 | [post]  |
+| string.swift:11:13:11:13 |  | string.swift:11:14:11:14 | [post] &... |
+| string.swift:11:13:11:13 | TapExpr | string.swift:11:13:11:13 | "..." |
+| string.swift:11:14:11:14 | &... | string.swift:11:13:11:13 | [post]  |
+| string.swift:11:14:11:14 | &... | string.swift:11:14:11:14 | [post] &... |
+| string.swift:11:15:11:15 | &... | string.swift:11:15:11:15 | [post] &... |
+| string.swift:11:16:11:16 | x | string.swift:11:15:11:15 | [post] &... |
+| string.swift:11:18:11:18 |   | string.swift:11:18:11:18 | [post]   |
+| string.swift:11:18:11:18 |   | string.swift:11:18:11:18 | [post] &... |
+| string.swift:11:18:11:18 | &... | string.swift:11:18:11:18 | [post]   |
+| string.swift:11:18:11:18 | &... | string.swift:11:18:11:18 | [post] &... |
+| string.swift:11:20:11:20 | &... | string.swift:11:20:11:20 | [post] &... |
+| string.swift:11:20:11:20 | &... | string.swift:11:21:11:21 | [post] 0 |
+| string.swift:11:21:11:21 | 0 | string.swift:11:20:11:20 | [post] &... |
+| string.swift:11:21:11:21 | 0 | string.swift:11:21:11:21 | [post] 0 |
+| string.swift:11:23:11:23 |   | string.swift:11:23:11:23 | [post]   |
+| string.swift:11:23:11:23 |   | string.swift:11:23:11:23 | [post] &... |
+| string.swift:11:23:11:23 | &... | string.swift:11:23:11:23 | [post]   |
+| string.swift:11:23:11:23 | &... | string.swift:11:23:11:23 | [post] &... |
+| string.swift:11:25:11:25 | &... | string.swift:11:25:11:25 | [post] &... |
+| string.swift:11:26:11:26 | x | string.swift:11:25:11:25 | [post] &... |
+| string.swift:11:28:11:28 |  | string.swift:11:28:11:28 | [post]  |
+| string.swift:11:28:11:28 |  | string.swift:11:28:11:28 | [post] &... |
+| string.swift:11:28:11:28 | &... | string.swift:11:28:11:28 | [post]  |
+| string.swift:11:28:11:28 | &... | string.swift:11:28:11:28 | [post] &... |
+| string.swift:14:13:14:13 |  | string.swift:14:13:14:13 | [post]  |
+| string.swift:14:13:14:13 |  | string.swift:14:14:14:14 | [post] &... |
+| string.swift:14:13:14:13 | TapExpr | string.swift:14:13:14:13 | "..." |
+| string.swift:14:14:14:14 | &... | string.swift:14:13:14:13 | [post]  |
+| string.swift:14:14:14:14 | &... | string.swift:14:14:14:14 | [post] &... |
+| string.swift:14:15:14:15 | &... | string.swift:14:15:14:15 | [post] &... |
+| string.swift:14:16:14:16 | y | string.swift:14:15:14:15 | [post] &... |
+| string.swift:14:18:14:18 |  | string.swift:14:18:14:18 | [post]  |
+| string.swift:14:18:14:18 |  | string.swift:14:18:14:18 | [post] &... |
+| string.swift:14:18:14:18 | &... | string.swift:14:18:14:18 | [post]  |
+| string.swift:14:18:14:18 | &... | string.swift:14:18:14:18 | [post] &... |
+| string.swift:16:13:16:13 |  | string.swift:16:13:16:13 | [post]  |
+| string.swift:16:13:16:13 |  | string.swift:16:14:16:14 | [post] &... |
+| string.swift:16:13:16:13 | TapExpr | string.swift:16:13:16:13 | "..." |
+| string.swift:16:14:16:14 | &... | string.swift:16:13:16:13 | [post]  |
+| string.swift:16:14:16:14 | &... | string.swift:16:14:16:14 | [post] &... |
+| string.swift:16:15:16:15 | &... | string.swift:16:15:16:15 | [post] &... |
+| string.swift:16:16:16:16 | x | string.swift:16:15:16:15 | [post] &... |
+| string.swift:16:18:16:18 |  hello  | string.swift:16:18:16:18 | [post]  hello  |
+| string.swift:16:18:16:18 |  hello  | string.swift:16:18:16:18 | [post] &... |
+| string.swift:16:18:16:18 | &... | string.swift:16:18:16:18 | [post]  hello  |
+| string.swift:16:18:16:18 | &... | string.swift:16:18:16:18 | [post] &... |
+| string.swift:16:26:16:26 | &... | string.swift:16:26:16:26 | [post] &... |
+| string.swift:16:27:16:27 | y | string.swift:16:26:16:26 | [post] &... |
+| string.swift:16:29:16:29 |  | string.swift:16:29:16:29 | [post]  |
+| string.swift:16:29:16:29 |  | string.swift:16:29:16:29 | [post] &... |
+| string.swift:16:29:16:29 | &... | string.swift:16:29:16:29 | [post]  |
+| string.swift:16:29:16:29 | &... | string.swift:16:29:16:29 | [post] &... |
+| string.swift:18:13:18:13 |  | string.swift:18:13:18:13 | [post]  |
+| string.swift:18:13:18:13 |  | string.swift:18:14:18:14 | [post] &... |
+| string.swift:18:13:18:13 | TapExpr | string.swift:18:13:18:13 | "..." |
+| string.swift:18:14:18:14 | &... | string.swift:18:13:18:13 | [post]  |
+| string.swift:18:14:18:14 | &... | string.swift:18:14:18:14 | [post] &... |
+| string.swift:18:15:18:15 | &... | string.swift:18:15:18:15 | [post] &... |
+| string.swift:18:16:18:16 | y | string.swift:18:15:18:15 | [post] &... |
+| string.swift:18:18:18:18 |  world  | string.swift:18:18:18:18 | [post]  world  |
+| string.swift:18:18:18:18 |  world  | string.swift:18:18:18:18 | [post] &... |
+| string.swift:18:18:18:18 | &... | string.swift:18:18:18:18 | [post]  world  |
+| string.swift:18:18:18:18 | &... | string.swift:18:18:18:18 | [post] &... |
+| string.swift:18:26:18:26 | &... | string.swift:18:26:18:26 | [post] &... |
+| string.swift:18:27:18:27 | x | string.swift:18:26:18:26 | [post] &... |
+| string.swift:18:29:18:29 |  | string.swift:18:29:18:29 | [post]  |
+| string.swift:18:29:18:29 |  | string.swift:18:29:18:29 | [post] &... |
+| string.swift:18:29:18:29 | &... | string.swift:18:29:18:29 | [post]  |
+| string.swift:18:29:18:29 | &... | string.swift:18:29:18:29 | [post] &... |
+| string.swift:21:13:21:13 |  | string.swift:21:13:21:13 | [post]  |
+| string.swift:21:13:21:13 |  | string.swift:21:14:21:14 | [post] &... |
+| string.swift:21:13:21:13 | TapExpr | string.swift:21:13:21:13 | "..." |
+| string.swift:21:14:21:14 | &... | string.swift:21:13:21:13 | [post]  |
+| string.swift:21:14:21:14 | &... | string.swift:21:14:21:14 | [post] &... |
+| string.swift:21:15:21:15 | &... | string.swift:21:15:21:15 | [post] &... |
+| string.swift:21:16:21:16 | x | string.swift:21:15:21:15 | [post] &... |
+| string.swift:21:18:21:18 |  | string.swift:21:18:21:18 | [post]  |
+| string.swift:21:18:21:18 |  | string.swift:21:18:21:18 | [post] &... |
+| string.swift:21:18:21:18 | &... | string.swift:21:18:21:18 | [post]  |
+| string.swift:21:18:21:18 | &... | string.swift:21:18:21:18 | [post] &... |
+| string.swift:33:13:33:13 | clean | string.swift:33:13:33:21 | ... .+(_:_:) ... |
+| string.swift:33:21:33:21 | clean | string.swift:33:13:33:21 | ... .+(_:_:) ... |
+| string.swift:34:13:34:13 | clean | string.swift:34:13:34:21 | ... .+(_:_:) ... |
+| string.swift:34:21:34:21 | tainted | string.swift:34:13:34:21 | ... .+(_:_:) ... |
+| string.swift:35:13:35:13 | tainted | string.swift:35:13:35:23 | ... .+(_:_:) ... |
+| string.swift:35:23:35:23 | clean | string.swift:35:13:35:23 | ... .+(_:_:) ... |
+| string.swift:36:13:36:13 | tainted | string.swift:36:13:36:23 | ... .+(_:_:) ... |
+| string.swift:36:23:36:23 | tainted | string.swift:36:13:36:23 | ... .+(_:_:) ... |
+| string.swift:38:13:38:13 | > | string.swift:38:13:38:19 | ... .+(_:_:) ... |
+| string.swift:38:13:38:19 | ... .+(_:_:) ... | string.swift:38:13:38:27 | ... .+(_:_:) ... |
+| string.swift:38:19:38:19 | clean | string.swift:38:13:38:19 | ... .+(_:_:) ... |
+| string.swift:38:27:38:27 | < | string.swift:38:13:38:27 | ... .+(_:_:) ... |
+| string.swift:39:13:39:13 | > | string.swift:39:13:39:19 | ... .+(_:_:) ... |
+| string.swift:39:13:39:19 | ... .+(_:_:) ... | string.swift:39:13:39:29 | ... .+(_:_:) ... |
+| string.swift:39:19:39:19 | tainted | string.swift:39:13:39:19 | ... .+(_:_:) ... |
+| string.swift:39:29:39:29 | < | string.swift:39:13:39:29 | ... .+(_:_:) ... |
+| url.swift:14:29:14:29 | clean | url.swift:14:17:14:34 | call to init(string:) |
+| url.swift:15:31:15:31 | tainted | url.swift:15:19:15:38 | call to init(string:) |
+| url.swift:20:24:20:24 | clean | url.swift:20:12:20:46 | call to init(string:relativeTo:) |
+| url.swift:20:43:20:43 | nil | url.swift:20:12:20:46 | call to init(string:relativeTo:) |
+| url.swift:21:24:21:24 | tainted | url.swift:21:12:21:48 | call to init(string:relativeTo:) |
+| url.swift:21:45:21:45 | nil | url.swift:21:12:21:48 | call to init(string:relativeTo:) |
+| url.swift:22:24:22:24 | clean | url.swift:22:12:22:51 | call to init(string:relativeTo:) |
+| url.swift:22:43:22:43 | urlClean | url.swift:22:12:22:51 | call to init(string:relativeTo:) |
+| url.swift:23:24:23:24 | clean | url.swift:23:12:23:53 | call to init(string:relativeTo:) |
+| url.swift:23:43:23:43 | urlTainted | url.swift:23:12:23:53 | call to init(string:relativeTo:) |
+| url.swift:25:25:25:25 | clean | url.swift:25:13:25:30 | call to init(string:) |
+| url.swift:29:25:29:25 | tainted | url.swift:29:13:29:32 | call to init(string:) |
+| url.swift:34:26:34:26 | clean | url.swift:34:14:34:31 | call to init(string:) |
+| url.swift:38:28:38:28 | tainted | url.swift:38:16:38:35 | call to init(string:) |
diff --git a/swift/ql/test/library-tests/dataflow/taint/LocalTaint.ql b/swift/ql/test/library-tests/dataflow/taint/LocalTaint.ql
index 04a547b939d..e25a188a43a 100644
--- a/swift/ql/test/library-tests/dataflow/taint/LocalTaint.ql
+++ b/swift/ql/test/library-tests/dataflow/taint/LocalTaint.ql
@@ -1,6 +1,10 @@
 import swift
 import codeql.swift.dataflow.DataFlow
+import codeql.swift.dataflow.TaintTracking
 
 from DataFlow::Node pred, DataFlow::Node succ
-where DataFlow::localFlowStep(pred, succ)
+where
+  TaintTracking::localTaintStep(pred, succ) and
+  not pred.getLocation() instanceof UnknownLocation and
+  not succ.getLocation() instanceof UnknownLocation
 select pred, succ
diff --git a/swift/ql/test/library-tests/parent/no_double_parents.expected b/swift/ql/test/library-tests/parent/no_double_parents.expected
deleted file mode 100644
index 015ff37dc4b..00000000000
--- a/swift/ql/test/library-tests/parent/no_double_parents.expected
+++ /dev/null
@@ -1,2 +0,0 @@
-| ConstructorDecl | RebindSelfInConstructorExpr | ParamDecl |
-| RebindSelfInConstructorExpr | ConstructorDecl | ParamDecl |
diff --git a/swift/ql/test/library-tests/parent/no_double_parents.ql b/swift/ql/test/library-tests/parent/no_double_parents.ql
deleted file mode 100644
index 5377ca7ebc2..00000000000
--- a/swift/ql/test/library-tests/parent/no_double_parents.ql
+++ /dev/null
@@ -1,9 +0,0 @@
-import swift
-import codeql.swift.generated.GetImmediateParent
-
-from AstNode parent1, AstNode parent2, AstNode child
-where
-  parent1 != parent2 and
-  child = getAnImmediateChild(parent1) and
-  child = getAnImmediateChild(parent2)
-select parent1.getPrimaryQlClasses(), parent2.getPrimaryQlClasses(), child.getPrimaryQlClasses()
diff --git a/swift/ql/test/library-tests/parent/parent.expected b/swift/ql/test/library-tests/parent/parent.expected
deleted file mode 100644
index e94ce274c7b..00000000000
--- a/swift/ql/test/library-tests/parent/parent.expected
+++ /dev/null
@@ -1,1286 +0,0 @@
-| declarations.swift:1:8:1:8 | init | ConstructorDecl | declarations.swift:1:8:1:8 | self | ParamDecl |
-| declarations.swift:1:8:1:8 | init | ConstructorDecl | declarations.swift:1:8:1:8 | self | ParamDecl |
-| declarations.swift:1:8:1:8 | init | ConstructorDecl | declarations.swift:1:8:1:8 | x | ParamDecl |
-| declarations.swift:1:8:1:8 | init | ConstructorDecl | declarations.swift:1:8:1:8 | { ... } | BraceStmt |
-| declarations.swift:1:8:1:8 | { ... } | BraceStmt | declarations.swift:1:8:1:8 | return | ReturnStmt |
-| declarations.swift:2:3:2:11 | var ... = ... | PatternBindingDecl | declarations.swift:2:7:2:7 | x | NamedPattern |
-| declarations.swift:2:3:2:11 | var ... = ... | PatternBindingDecl | declarations.swift:2:11:2:11 | 11 | IntegerLiteralExpr |
-| declarations.swift:2:7:2:7 | (unnamed function decl) | AccessorDecl | declarations.swift:2:7:2:7 | self | ParamDecl |
-| declarations.swift:2:7:2:7 | (unnamed function decl) | AccessorDecl | declarations.swift:2:7:2:7 | { ... } | BraceStmt |
-| declarations.swift:2:7:2:7 | get | AccessorDecl | declarations.swift:2:7:2:7 | self | ParamDecl |
-| declarations.swift:2:7:2:7 | get | AccessorDecl | declarations.swift:2:7:2:7 | { ... } | BraceStmt |
-| declarations.swift:2:7:2:7 | set | AccessorDecl | declarations.swift:2:7:2:7 | self | ParamDecl |
-| declarations.swift:2:7:2:7 | set | AccessorDecl | declarations.swift:2:7:2:7 | value | ParamDecl |
-| declarations.swift:2:7:2:7 | set | AccessorDecl | declarations.swift:2:7:2:7 | { ... } | BraceStmt |
-| declarations.swift:2:7:2:7 | x | ConcreteVarDecl | declarations.swift:2:7:2:7 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:2:7:2:7 | x | ConcreteVarDecl | declarations.swift:2:7:2:7 | get | AccessorDecl |
-| declarations.swift:2:7:2:7 | x | ConcreteVarDecl | declarations.swift:2:7:2:7 | set | AccessorDecl |
-| declarations.swift:2:7:2:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:2:7:2:7 | { ... } | BraceStmt | declarations.swift:2:7:2:7 | yield ... | YieldStmt |
-| declarations.swift:2:7:2:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| declarations.swift:2:7:2:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| declarations.swift:3:3:6:3 | var ... = ... | PatternBindingDecl | declarations.swift:3:7:3:14 | ... as ... | TypedPattern |
-| declarations.swift:3:7:3:7 | (unnamed function decl) | AccessorDecl | declarations.swift:3:7:3:7 | self | ParamDecl |
-| declarations.swift:3:7:3:7 | (unnamed function decl) | AccessorDecl | declarations.swift:3:7:3:7 | { ... } | BraceStmt |
-| declarations.swift:3:7:3:7 | next | ConcreteVarDecl | declarations.swift:3:7:3:7 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:3:7:3:7 | next | ConcreteVarDecl | declarations.swift:4:5:4:24 | get | AccessorDecl |
-| declarations.swift:3:7:3:7 | next | ConcreteVarDecl | declarations.swift:5:5:5:38 | set | AccessorDecl |
-| declarations.swift:3:7:3:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:3:7:3:7 | { ... } | BraceStmt | declarations.swift:3:7:3:7 | yield ... | YieldStmt |
-| declarations.swift:3:7:3:14 | ... as ... | TypedPattern | declarations.swift:3:7:3:7 | next | NamedPattern |
-| declarations.swift:3:7:3:14 | ... as ... | TypedPattern | declarations.swift:3:14:3:14 | Int | TypeRepr |
-| declarations.swift:4:5:4:24 | get | AccessorDecl | declarations.swift:4:5:4:5 | self | ParamDecl |
-| declarations.swift:4:5:4:24 | get | AccessorDecl | declarations.swift:4:9:4:24 | { ... } | BraceStmt |
-| declarations.swift:4:9:4:24 | { ... } | BraceStmt | declarations.swift:4:11:4:22 | return ... | ReturnStmt |
-| declarations.swift:4:11:4:22 | return ... | ReturnStmt | declarations.swift:4:18:4:22 | ... .+(_:_:) ... | BinaryExpr |
-| declarations.swift:4:18:4:18 | .x | MemberRefExpr | declarations.swift:4:18:4:18 | self | DeclRefExpr |
-| declarations.swift:4:18:4:22 | ... .+(_:_:) ... | BinaryExpr | declarations.swift:4:20:4:20 | .+(_:_:) | MethodRefExpr |
-| declarations.swift:4:20:4:20 | Int.Type | TypeExpr | declarations.swift:4:20:4:20 | Int | TypeRepr |
-| declarations.swift:5:5:5:38 | set | AccessorDecl | declarations.swift:5:5:5:5 | self | ParamDecl |
-| declarations.swift:5:5:5:38 | set | AccessorDecl | declarations.swift:5:9:5:9 | newValue | ParamDecl |
-| declarations.swift:5:5:5:38 | set | AccessorDecl | declarations.swift:5:19:5:38 | { ... } | BraceStmt |
-| declarations.swift:5:19:5:38 | { ... } | BraceStmt | declarations.swift:5:21:5:36 |  ... = ... | AssignExpr |
-| declarations.swift:5:21:5:21 | .x | MemberRefExpr | declarations.swift:5:21:5:21 | self | DeclRefExpr |
-| declarations.swift:5:21:5:36 |  ... = ... | AssignExpr | declarations.swift:5:21:5:21 | .x | MemberRefExpr |
-| declarations.swift:5:21:5:36 |  ... = ... | AssignExpr | declarations.swift:5:25:5:36 | ... .-(_:_:) ... | BinaryExpr |
-| declarations.swift:5:25:5:36 | ... .-(_:_:) ... | BinaryExpr | declarations.swift:5:34:5:34 | .-(_:_:) | MethodRefExpr |
-| declarations.swift:5:34:5:34 | Int.Type | TypeExpr | declarations.swift:5:34:5:34 | Int | TypeRepr |
-| declarations.swift:9:7:9:7 | deinit | DestructorDecl | declarations.swift:9:7:9:7 | self | ParamDecl |
-| declarations.swift:9:7:9:7 | deinit | DestructorDecl | declarations.swift:9:7:9:7 | { ... } | BraceStmt |
-| declarations.swift:9:7:9:7 | init | ConstructorDecl | declarations.swift:9:7:9:7 | self | ParamDecl |
-| declarations.swift:9:7:9:7 | init | ConstructorDecl | declarations.swift:9:7:9:7 | { ... } | BraceStmt |
-| declarations.swift:9:7:9:7 | { ... } | BraceStmt | declarations.swift:9:7:9:7 | return | ReturnStmt |
-| declarations.swift:9:13:9:30 | var ... = ... | PatternBindingDecl | declarations.swift:9:17:9:21 | ... as ... | TypedPattern |
-| declarations.swift:9:13:9:30 | var ... = ... | PatternBindingDecl | declarations.swift:9:30:9:30 | 1.3 | FloatLiteralExpr |
-| declarations.swift:9:17:9:17 | (unnamed function decl) | AccessorDecl | declarations.swift:9:17:9:17 | self | ParamDecl |
-| declarations.swift:9:17:9:17 | (unnamed function decl) | AccessorDecl | declarations.swift:9:17:9:17 | { ... } | BraceStmt |
-| declarations.swift:9:17:9:17 | get | AccessorDecl | declarations.swift:9:17:9:17 | self | ParamDecl |
-| declarations.swift:9:17:9:17 | get | AccessorDecl | declarations.swift:9:17:9:17 | { ... } | BraceStmt |
-| declarations.swift:9:17:9:17 | set | AccessorDecl | declarations.swift:9:17:9:17 | self | ParamDecl |
-| declarations.swift:9:17:9:17 | set | AccessorDecl | declarations.swift:9:17:9:17 | value | ParamDecl |
-| declarations.swift:9:17:9:17 | set | AccessorDecl | declarations.swift:9:17:9:17 | { ... } | BraceStmt |
-| declarations.swift:9:17:9:17 | x | ConcreteVarDecl | declarations.swift:9:17:9:17 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:9:17:9:17 | x | ConcreteVarDecl | declarations.swift:9:17:9:17 | get | AccessorDecl |
-| declarations.swift:9:17:9:17 | x | ConcreteVarDecl | declarations.swift:9:17:9:17 | set | AccessorDecl |
-| declarations.swift:9:17:9:17 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:9:17:9:17 | { ... } | BraceStmt | declarations.swift:9:17:9:17 | yield ... | YieldStmt |
-| declarations.swift:9:17:9:17 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| declarations.swift:9:17:9:17 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| declarations.swift:9:17:9:21 | ... as ... | TypedPattern | declarations.swift:9:17:9:17 | x | NamedPattern |
-| declarations.swift:9:17:9:21 | ... as ... | TypedPattern | declarations.swift:9:21:9:21 | Double | TypeRepr |
-| declarations.swift:12:5:12:18 | case ... | EnumCaseDecl | declarations.swift:12:10:12:10 | value1 | EnumElementDecl |
-| declarations.swift:12:5:12:18 | case ... | EnumCaseDecl | declarations.swift:12:18:12:18 | value2 | EnumElementDecl |
-| declarations.swift:13:5:13:26 | case ... | EnumCaseDecl | declarations.swift:13:10:13:10 | value3 | EnumElementDecl |
-| declarations.swift:13:5:13:26 | case ... | EnumCaseDecl | declarations.swift:13:18:13:18 | value4 | EnumElementDecl |
-| declarations.swift:13:5:13:26 | case ... | EnumCaseDecl | declarations.swift:13:26:13:26 | value5 | EnumElementDecl |
-| declarations.swift:17:5:17:22 | case ... | EnumCaseDecl | declarations.swift:17:10:17:22 | nodata1 | EnumElementDecl |
-| declarations.swift:17:10:17:22 | nodata1 | EnumElementDecl | declarations.swift:17:18:17:18 | _ | ParamDecl |
-| declarations.swift:18:5:18:21 | case ... | EnumCaseDecl | declarations.swift:18:10:18:21 | intdata | EnumElementDecl |
-| declarations.swift:18:10:18:21 | intdata | EnumElementDecl | declarations.swift:18:18:18:18 | _ | ParamDecl |
-| declarations.swift:19:5:19:35 | case ... | EnumCaseDecl | declarations.swift:19:10:19:35 | tuple | EnumElementDecl |
-| declarations.swift:19:10:19:35 | tuple | EnumElementDecl | declarations.swift:19:16:19:16 | _ | ParamDecl |
-| declarations.swift:19:10:19:35 | tuple | EnumElementDecl | declarations.swift:19:21:19:21 | _ | ParamDecl |
-| declarations.swift:19:10:19:35 | tuple | EnumElementDecl | declarations.swift:19:29:19:29 | _ | ParamDecl |
-| declarations.swift:23:5:23:39 | var ... = ... | PatternBindingDecl | declarations.swift:23:9:23:25 | ... as ... | TypedPattern |
-| declarations.swift:23:9:23:9 | (unnamed function decl) | AccessorDecl | declarations.swift:23:9:23:9 | self | ParamDecl |
-| declarations.swift:23:9:23:9 | mustBeSettable | ConcreteVarDecl | declarations.swift:23:9:23:9 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:23:9:23:9 | mustBeSettable | ConcreteVarDecl | declarations.swift:23:31:23:31 | get | AccessorDecl |
-| declarations.swift:23:9:23:9 | mustBeSettable | ConcreteVarDecl | declarations.swift:23:35:23:35 | set | AccessorDecl |
-| declarations.swift:23:9:23:25 | ... as ... | TypedPattern | declarations.swift:23:9:23:9 | mustBeSettable | NamedPattern |
-| declarations.swift:23:9:23:25 | ... as ... | TypedPattern | declarations.swift:23:25:23:25 | Int | TypeRepr |
-| declarations.swift:23:31:23:31 | get | AccessorDecl | declarations.swift:23:31:23:31 | self | ParamDecl |
-| declarations.swift:23:35:23:35 | set | AccessorDecl | declarations.swift:23:35:23:35 | newValue | ParamDecl |
-| declarations.swift:23:35:23:35 | set | AccessorDecl | declarations.swift:23:35:23:35 | self | ParamDecl |
-| declarations.swift:24:5:24:44 | var ... = ... | PatternBindingDecl | declarations.swift:24:9:24:34 | ... as ... | TypedPattern |
-| declarations.swift:24:9:24:9 | doesNotNeedToBeSettable | ConcreteVarDecl | declarations.swift:24:40:24:40 | get | AccessorDecl |
-| declarations.swift:24:9:24:34 | ... as ... | TypedPattern | declarations.swift:24:9:24:9 | doesNotNeedToBeSettable | NamedPattern |
-| declarations.swift:24:9:24:34 | ... as ... | TypedPattern | declarations.swift:24:34:24:34 | Int | TypeRepr |
-| declarations.swift:24:40:24:40 | get | AccessorDecl | declarations.swift:24:40:24:40 | self | ParamDecl |
-| declarations.swift:25:5:25:22 | random() | ConcreteFuncDecl | declarations.swift:25:10:25:10 | self | ParamDecl |
-| declarations.swift:28:1:28:37 | a_function(a_parameter:) | ConcreteFuncDecl | declarations.swift:28:17:28:31 | a_parameter | ParamDecl |
-| declarations.swift:28:1:28:37 | a_function(a_parameter:) | ConcreteFuncDecl | declarations.swift:28:36:28:37 | { ... } | BraceStmt |
-| declarations.swift:30:1:30:18 | var ... = ... | PatternBindingDecl | declarations.swift:30:5:30:5 | a_variable | NamedPattern |
-| declarations.swift:30:1:30:18 | var ... = ... | PatternBindingDecl | declarations.swift:30:18:30:18 | 42 | IntegerLiteralExpr |
-| declarations.swift:30:1:30:18 | { ... } | BraceStmt | declarations.swift:30:1:30:18 | var ... = ... | PatternBindingDecl |
-| declarations.swift:30:1:30:18 | { ... } | TopLevelCodeDecl | declarations.swift:30:1:30:18 | { ... } | BraceStmt |
-| declarations.swift:31:1:36:1 | var ... = ... | PatternBindingDecl | declarations.swift:31:5:31:18 | ... as ... | TypedPattern |
-| declarations.swift:31:1:36:1 | { ... } | BraceStmt | declarations.swift:31:1:36:1 | var ... = ... | PatternBindingDecl |
-| declarations.swift:31:1:36:1 | { ... } | TopLevelCodeDecl | declarations.swift:31:1:36:1 | { ... } | BraceStmt |
-| declarations.swift:31:5:31:5 | a_property | ConcreteVarDecl | declarations.swift:32:3:34:3 | get | AccessorDecl |
-| declarations.swift:31:5:31:5 | a_property | ConcreteVarDecl | declarations.swift:35:3:35:18 | set | AccessorDecl |
-| declarations.swift:31:5:31:18 | ... as ... | TypedPattern | declarations.swift:31:5:31:5 | a_property | NamedPattern |
-| declarations.swift:31:5:31:18 | ... as ... | TypedPattern | declarations.swift:31:18:31:18 | String | TypeRepr |
-| declarations.swift:32:3:34:3 | get | AccessorDecl | declarations.swift:32:7:34:3 | { ... } | BraceStmt |
-| declarations.swift:32:7:34:3 | { ... } | BraceStmt | declarations.swift:33:5:33:12 | return ... | ReturnStmt |
-| declarations.swift:33:5:33:12 | return ... | ReturnStmt | declarations.swift:33:12:33:12 | here | StringLiteralExpr |
-| declarations.swift:35:3:35:18 | set | AccessorDecl | declarations.swift:35:7:35:7 | newValue | ParamDecl |
-| declarations.swift:35:3:35:18 | set | AccessorDecl | declarations.swift:35:17:35:18 | { ... } | BraceStmt |
-| declarations.swift:38:1:38:33 | call to print(_:separator:terminator:) | CallExpr | declarations.swift:38:1:38:1 | print(_:separator:terminator:) | DeclRefExpr |
-| declarations.swift:38:1:38:33 | { ... } | BraceStmt | declarations.swift:38:1:38:33 | call to print(_:separator:terminator:) | CallExpr |
-| declarations.swift:38:1:38:33 | { ... } | TopLevelCodeDecl | declarations.swift:38:1:38:33 | { ... } | BraceStmt |
-| declarations.swift:38:7:38:7 | (Any) ... | ErasureExpr | declarations.swift:38:7:38:7 | some top level statement | StringLiteralExpr |
-| declarations.swift:38:7:38:7 | [...] | ArrayExpr | declarations.swift:38:7:38:7 | (Any) ... | ErasureExpr |
-| declarations.swift:38:7:38:7 | [...] | VarargExpansionExpr | declarations.swift:38:7:38:7 | [...] | ArrayExpr |
-| declarations.swift:41:3:41:14 | var ... = ... | PatternBindingDecl | declarations.swift:41:7:41:14 | ... as ... | TypedPattern |
-| declarations.swift:41:7:41:7 | (unnamed function decl) | AccessorDecl | declarations.swift:41:7:41:7 | self | ParamDecl |
-| declarations.swift:41:7:41:7 | (unnamed function decl) | AccessorDecl | declarations.swift:41:7:41:7 | { ... } | BraceStmt |
-| declarations.swift:41:7:41:7 | field | ConcreteVarDecl | declarations.swift:41:7:41:7 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:41:7:41:7 | field | ConcreteVarDecl | declarations.swift:41:7:41:7 | get | AccessorDecl |
-| declarations.swift:41:7:41:7 | field | ConcreteVarDecl | declarations.swift:41:7:41:7 | set | AccessorDecl |
-| declarations.swift:41:7:41:7 | get | AccessorDecl | declarations.swift:41:7:41:7 | self | ParamDecl |
-| declarations.swift:41:7:41:7 | get | AccessorDecl | declarations.swift:41:7:41:7 | { ... } | BraceStmt |
-| declarations.swift:41:7:41:7 | set | AccessorDecl | declarations.swift:41:7:41:7 | self | ParamDecl |
-| declarations.swift:41:7:41:7 | set | AccessorDecl | declarations.swift:41:7:41:7 | value | ParamDecl |
-| declarations.swift:41:7:41:7 | set | AccessorDecl | declarations.swift:41:7:41:7 | { ... } | BraceStmt |
-| declarations.swift:41:7:41:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:41:7:41:7 | { ... } | BraceStmt | declarations.swift:41:7:41:7 | yield ... | YieldStmt |
-| declarations.swift:41:7:41:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| declarations.swift:41:7:41:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| declarations.swift:41:7:41:14 | ... as ... | TypedPattern | declarations.swift:41:7:41:7 | field | NamedPattern |
-| declarations.swift:41:7:41:14 | ... as ... | TypedPattern | declarations.swift:41:14:41:14 | Int | TypeRepr |
-| declarations.swift:42:3:44:3 | init | ConstructorDecl | declarations.swift:42:3:42:3 | self | ParamDecl |
-| declarations.swift:42:3:44:3 | init | ConstructorDecl | declarations.swift:42:10:44:3 | { ... } | BraceStmt |
-| declarations.swift:42:10:44:3 | { ... } | BraceStmt | declarations.swift:43:5:43:13 |  ... = ... | AssignExpr |
-| declarations.swift:42:10:44:3 | { ... } | BraceStmt | declarations.swift:44:3:44:3 | return | ReturnStmt |
-| declarations.swift:43:5:43:5 | .field | MemberRefExpr | declarations.swift:43:5:43:5 | self | DeclRefExpr |
-| declarations.swift:43:5:43:13 |  ... = ... | AssignExpr | declarations.swift:43:5:43:5 | .field | MemberRefExpr |
-| declarations.swift:43:5:43:13 |  ... = ... | AssignExpr | declarations.swift:43:13:43:13 | 10 | IntegerLiteralExpr |
-| declarations.swift:46:3:48:3 | deinit | DestructorDecl | declarations.swift:46:3:46:3 | self | ParamDecl |
-| declarations.swift:46:3:48:3 | deinit | DestructorDecl | declarations.swift:46:10:48:3 | { ... } | BraceStmt |
-| declarations.swift:46:10:48:3 | { ... } | BraceStmt | declarations.swift:47:5:47:13 |  ... = ... | AssignExpr |
-| declarations.swift:47:5:47:5 | .field | MemberRefExpr | declarations.swift:47:5:47:5 | self | DeclRefExpr |
-| declarations.swift:47:5:47:13 |  ... = ... | AssignExpr | declarations.swift:47:5:47:5 | .field | MemberRefExpr |
-| declarations.swift:47:5:47:13 |  ... = ... | AssignExpr | declarations.swift:47:13:47:13 | 0 | IntegerLiteralExpr |
-| declarations.swift:50:3:52:3 | +-(_:) | ConcreteFuncDecl | declarations.swift:50:22:50:22 | self | ParamDecl |
-| declarations.swift:50:3:52:3 | +-(_:) | ConcreteFuncDecl | declarations.swift:50:26:50:33 | other | ParamDecl |
-| declarations.swift:50:3:52:3 | +-(_:) | ConcreteFuncDecl | declarations.swift:50:45:52:3 | { ... } | BraceStmt |
-| declarations.swift:50:45:52:3 | { ... } | BraceStmt | declarations.swift:51:5:51:12 | return ... | ReturnStmt |
-| declarations.swift:51:5:51:12 | return ... | ReturnStmt | declarations.swift:51:12:51:12 | other | DeclRefExpr |
-| declarations.swift:68:25:68:25 | init | ConstructorDecl | declarations.swift:68:25:68:25 | self | ParamDecl |
-| declarations.swift:68:25:68:25 | init | ConstructorDecl | declarations.swift:68:25:68:25 | { ... } | BraceStmt |
-| declarations.swift:68:25:68:25 | { ... } | BraceStmt | declarations.swift:68:25:68:25 | return | ReturnStmt |
-| declarations.swift:69:3:73:3 | var ... = ... | PatternBindingDecl | declarations.swift:69:7:69:21 | ... as ... | TypedPattern |
-| declarations.swift:69:7:69:7 | wrappedValue | ConcreteVarDecl | declarations.swift:70:5:72:5 | get | AccessorDecl |
-| declarations.swift:69:7:69:21 | ... as ... | TypedPattern | declarations.swift:69:7:69:7 | wrappedValue | NamedPattern |
-| declarations.swift:69:7:69:21 | ... as ... | TypedPattern | declarations.swift:69:21:69:21 | Int | TypeRepr |
-| declarations.swift:70:5:72:5 | get | AccessorDecl | declarations.swift:70:5:70:5 | self | ParamDecl |
-| declarations.swift:70:5:72:5 | get | AccessorDecl | declarations.swift:70:9:72:5 | { ... } | BraceStmt |
-| declarations.swift:70:9:72:5 | { ... } | BraceStmt | declarations.swift:71:7:71:14 | return ... | ReturnStmt |
-| declarations.swift:71:7:71:14 | return ... | ReturnStmt | declarations.swift:71:14:71:14 | 0 | IntegerLiteralExpr |
-| declarations.swift:76:1:79:1 | foo() | ConcreteFuncDecl | declarations.swift:76:19:79:1 | { ... } | BraceStmt |
-| declarations.swift:76:19:79:1 | { ... } | BraceStmt | declarations.swift:77:16:77:23 | var ... = ... | PatternBindingDecl |
-| declarations.swift:76:19:79:1 | { ... } | BraceStmt | declarations.swift:77:20:77:20 | x | ConcreteVarDecl |
-| declarations.swift:76:19:79:1 | { ... } | BraceStmt | declarations.swift:78:3:78:10 | return ... | ReturnStmt |
-| declarations.swift:77:4:77:4 | ZeroWrapper.Type | TypeExpr | declarations.swift:77:4:77:4 | ZeroWrapper | TypeRepr |
-| declarations.swift:77:4:77:4 | call to init | CallExpr | declarations.swift:77:4:77:4 | call to init | ConstructorRefCallExpr |
-| declarations.swift:77:4:77:4 | call to init | ConstructorRefCallExpr | declarations.swift:77:4:77:4 | init | DeclRefExpr |
-| declarations.swift:77:16:77:23 | var ... = ... | PatternBindingDecl | declarations.swift:77:20:77:23 | ... as ... | TypedPattern |
-| declarations.swift:77:20:77:20 | ... as ... | TypedPattern | declarations.swift:77:20:77:20 | _x | NamedPattern |
-| declarations.swift:77:20:77:20 | get | AccessorDecl | declarations.swift:77:20:77:20 | { ... } | BraceStmt |
-| declarations.swift:77:20:77:20 | x | ConcreteVarDecl | declarations.swift:77:20:77:20 | get | AccessorDecl |
-| declarations.swift:77:20:77:20 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| declarations.swift:77:20:77:23 | ... as ... | TypedPattern | declarations.swift:77:20:77:20 | x | NamedPattern |
-| declarations.swift:77:20:77:23 | ... as ... | TypedPattern | declarations.swift:77:23:77:23 | Int | TypeRepr |
-| declarations.swift:78:3:78:10 | return ... | ReturnStmt | declarations.swift:78:10:78:10 | x | DeclRefExpr |
-| declarations.swift:81:8:81:8 | init | ConstructorDecl | declarations.swift:81:8:81:8 | hasBoth | ParamDecl |
-| declarations.swift:81:8:81:8 | init | ConstructorDecl | declarations.swift:81:8:81:8 | hasDidSet1 | ParamDecl |
-| declarations.swift:81:8:81:8 | init | ConstructorDecl | declarations.swift:81:8:81:8 | hasDidSet2 | ParamDecl |
-| declarations.swift:81:8:81:8 | init | ConstructorDecl | declarations.swift:81:8:81:8 | hasWillSet1 | ParamDecl |
-| declarations.swift:81:8:81:8 | init | ConstructorDecl | declarations.swift:81:8:81:8 | hasWillSet2 | ParamDecl |
-| declarations.swift:81:8:81:8 | init | ConstructorDecl | declarations.swift:81:8:81:8 | normalField | ParamDecl |
-| declarations.swift:81:8:81:8 | init | ConstructorDecl | declarations.swift:81:8:81:8 | self | ParamDecl |
-| declarations.swift:82:3:87:3 | var ... = ... | PatternBindingDecl | declarations.swift:82:7:82:22 | ... as ... | TypedPattern |
-| declarations.swift:82:7:82:7 | (unnamed function decl) | AccessorDecl | declarations.swift:82:7:82:7 | self | ParamDecl |
-| declarations.swift:82:7:82:7 | (unnamed function decl) | AccessorDecl | declarations.swift:82:7:82:7 | { ... } | BraceStmt |
-| declarations.swift:82:7:82:7 | settableField | ConcreteVarDecl | declarations.swift:82:7:82:7 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:82:7:82:7 | settableField | ConcreteVarDecl | declarations.swift:83:5:83:11 | set | AccessorDecl |
-| declarations.swift:82:7:82:7 | settableField | ConcreteVarDecl | declarations.swift:84:5:86:5 | get | AccessorDecl |
-| declarations.swift:82:7:82:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:82:7:82:7 | { ... } | BraceStmt | declarations.swift:82:7:82:7 | yield ... | YieldStmt |
-| declarations.swift:82:7:82:22 | ... as ... | TypedPattern | declarations.swift:82:7:82:7 | settableField | NamedPattern |
-| declarations.swift:82:7:82:22 | ... as ... | TypedPattern | declarations.swift:82:22:82:22 | Int | TypeRepr |
-| declarations.swift:83:5:83:11 | set | AccessorDecl | declarations.swift:83:5:83:5 | newValue | ParamDecl |
-| declarations.swift:83:5:83:11 | set | AccessorDecl | declarations.swift:83:5:83:5 | self | ParamDecl |
-| declarations.swift:83:5:83:11 | set | AccessorDecl | declarations.swift:83:9:83:11 | { ... } | BraceStmt |
-| declarations.swift:84:5:86:5 | get | AccessorDecl | declarations.swift:84:5:84:5 | self | ParamDecl |
-| declarations.swift:84:5:86:5 | get | AccessorDecl | declarations.swift:84:9:86:5 | { ... } | BraceStmt |
-| declarations.swift:84:9:86:5 | { ... } | BraceStmt | declarations.swift:85:7:85:14 | return ... | ReturnStmt |
-| declarations.swift:85:7:85:14 | return ... | ReturnStmt | declarations.swift:85:14:85:14 | 0 | IntegerLiteralExpr |
-| declarations.swift:91:3:93:3 | var ... = ... | PatternBindingDecl | declarations.swift:91:7:91:23 | ... as ... | TypedPattern |
-| declarations.swift:91:7:91:7 | readOnlyField1 | ConcreteVarDecl | declarations.swift:91:27:93:3 | get | AccessorDecl |
-| declarations.swift:91:7:91:23 | ... as ... | TypedPattern | declarations.swift:91:7:91:7 | readOnlyField1 | NamedPattern |
-| declarations.swift:91:7:91:23 | ... as ... | TypedPattern | declarations.swift:91:23:91:23 | Int | TypeRepr |
-| declarations.swift:91:27:93:3 | get | AccessorDecl | declarations.swift:91:27:91:27 | self | ParamDecl |
-| declarations.swift:91:27:93:3 | get | AccessorDecl | declarations.swift:91:27:93:3 | { ... } | BraceStmt |
-| declarations.swift:91:27:93:3 | { ... } | BraceStmt | declarations.swift:92:5:92:12 | return ... | ReturnStmt |
-| declarations.swift:92:5:92:12 | return ... | ReturnStmt | declarations.swift:92:12:92:12 | 0 | IntegerLiteralExpr |
-| declarations.swift:96:3:100:3 | var ... = ... | PatternBindingDecl | declarations.swift:96:7:96:23 | ... as ... | TypedPattern |
-| declarations.swift:96:7:96:7 | readOnlyField2 | ConcreteVarDecl | declarations.swift:97:5:99:5 | get | AccessorDecl |
-| declarations.swift:96:7:96:23 | ... as ... | TypedPattern | declarations.swift:96:7:96:7 | readOnlyField2 | NamedPattern |
-| declarations.swift:96:7:96:23 | ... as ... | TypedPattern | declarations.swift:96:23:96:23 | Int | TypeRepr |
-| declarations.swift:97:5:99:5 | get | AccessorDecl | declarations.swift:97:5:97:5 | self | ParamDecl |
-| declarations.swift:97:5:99:5 | get | AccessorDecl | declarations.swift:97:9:99:5 | { ... } | BraceStmt |
-| declarations.swift:97:9:99:5 | { ... } | BraceStmt | declarations.swift:98:7:98:14 | return ... | ReturnStmt |
-| declarations.swift:98:7:98:14 | return ... | ReturnStmt | declarations.swift:98:14:98:14 | 0 | IntegerLiteralExpr |
-| declarations.swift:102:3:102:21 | var ... = ... | PatternBindingDecl | declarations.swift:102:7:102:21 | ... as ... | TypedPattern |
-| declarations.swift:102:7:102:7 | (unnamed function decl) | AccessorDecl | declarations.swift:102:7:102:7 | self | ParamDecl |
-| declarations.swift:102:7:102:7 | (unnamed function decl) | AccessorDecl | declarations.swift:102:7:102:7 | { ... } | BraceStmt |
-| declarations.swift:102:7:102:7 | get | AccessorDecl | declarations.swift:102:7:102:7 | self | ParamDecl |
-| declarations.swift:102:7:102:7 | get | AccessorDecl | declarations.swift:102:7:102:7 | { ... } | BraceStmt |
-| declarations.swift:102:7:102:7 | normalField | ConcreteVarDecl | declarations.swift:102:7:102:7 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:102:7:102:7 | normalField | ConcreteVarDecl | declarations.swift:102:7:102:7 | get | AccessorDecl |
-| declarations.swift:102:7:102:7 | normalField | ConcreteVarDecl | declarations.swift:102:7:102:7 | set | AccessorDecl |
-| declarations.swift:102:7:102:7 | set | AccessorDecl | declarations.swift:102:7:102:7 | self | ParamDecl |
-| declarations.swift:102:7:102:7 | set | AccessorDecl | declarations.swift:102:7:102:7 | value | ParamDecl |
-| declarations.swift:102:7:102:7 | set | AccessorDecl | declarations.swift:102:7:102:7 | { ... } | BraceStmt |
-| declarations.swift:102:7:102:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:102:7:102:7 | { ... } | BraceStmt | declarations.swift:102:7:102:7 | yield ... | YieldStmt |
-| declarations.swift:102:7:102:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| declarations.swift:102:7:102:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| declarations.swift:102:7:102:21 | ... as ... | TypedPattern | declarations.swift:102:7:102:7 | normalField | NamedPattern |
-| declarations.swift:102:7:102:21 | ... as ... | TypedPattern | declarations.swift:102:21:102:21 | Int | TypeRepr |
-| declarations.swift:104:3:104:3 | (unnamed function decl) | AccessorDecl | declarations.swift:104:3:104:3 | self | ParamDecl |
-| declarations.swift:104:3:104:3 | (unnamed function decl) | AccessorDecl | declarations.swift:104:3:104:3 | { ... } | BraceStmt |
-| declarations.swift:104:3:104:3 | (unnamed function decl) | AccessorDecl | file://:0:0:0:0 | x | ParamDecl |
-| declarations.swift:104:3:104:3 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:104:3:104:3 | { ... } | BraceStmt | declarations.swift:104:3:104:3 | yield ... | YieldStmt |
-| declarations.swift:104:3:109:3 | subscript ... | SubscriptDecl | declarations.swift:104:3:104:3 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:104:3:109:3 | subscript ... | SubscriptDecl | declarations.swift:104:13:104:16 | x | ParamDecl |
-| declarations.swift:104:3:109:3 | subscript ... | SubscriptDecl | declarations.swift:105:5:107:5 | get | AccessorDecl |
-| declarations.swift:104:3:109:3 | subscript ... | SubscriptDecl | declarations.swift:108:5:108:11 | set | AccessorDecl |
-| declarations.swift:105:5:107:5 | get | AccessorDecl | declarations.swift:104:13:104:13 | x | ParamDecl |
-| declarations.swift:105:5:107:5 | get | AccessorDecl | declarations.swift:105:5:105:5 | self | ParamDecl |
-| declarations.swift:105:5:107:5 | get | AccessorDecl | declarations.swift:105:9:107:5 | { ... } | BraceStmt |
-| declarations.swift:105:9:107:5 | { ... } | BraceStmt | declarations.swift:106:7:106:14 | return ... | ReturnStmt |
-| declarations.swift:106:7:106:14 | return ... | ReturnStmt | declarations.swift:106:14:106:14 | 0 | IntegerLiteralExpr |
-| declarations.swift:108:5:108:11 | set | AccessorDecl | declarations.swift:104:13:104:13 | x | ParamDecl |
-| declarations.swift:108:5:108:11 | set | AccessorDecl | declarations.swift:108:5:108:5 | newValue | ParamDecl |
-| declarations.swift:108:5:108:11 | set | AccessorDecl | declarations.swift:108:5:108:5 | self | ParamDecl |
-| declarations.swift:108:5:108:11 | set | AccessorDecl | declarations.swift:108:9:108:11 | { ... } | BraceStmt |
-| declarations.swift:111:3:113:3 | subscript ... | SubscriptDecl | declarations.swift:111:13:111:16 | x | ParamDecl |
-| declarations.swift:111:3:113:3 | subscript ... | SubscriptDecl | declarations.swift:111:21:111:25 | y | ParamDecl |
-| declarations.swift:111:3:113:3 | subscript ... | SubscriptDecl | declarations.swift:111:37:113:3 | get | AccessorDecl |
-| declarations.swift:111:37:113:3 | get | AccessorDecl | declarations.swift:111:13:111:13 | x | ParamDecl |
-| declarations.swift:111:37:113:3 | get | AccessorDecl | declarations.swift:111:21:111:21 | y | ParamDecl |
-| declarations.swift:111:37:113:3 | get | AccessorDecl | declarations.swift:111:37:111:37 | self | ParamDecl |
-| declarations.swift:111:37:113:3 | get | AccessorDecl | declarations.swift:111:37:113:3 | { ... } | BraceStmt |
-| declarations.swift:111:37:113:3 | { ... } | BraceStmt | declarations.swift:112:5:112:12 | return ... | ReturnStmt |
-| declarations.swift:112:5:112:12 | return ... | ReturnStmt | declarations.swift:112:12:112:12 | 0 | IntegerLiteralExpr |
-| declarations.swift:115:3:117:3 | var ... = ... | PatternBindingDecl | declarations.swift:115:7:115:21 | ... as ... | TypedPattern |
-| declarations.swift:115:7:115:7 | (unnamed function decl) | AccessorDecl | declarations.swift:115:7:115:7 | self | ParamDecl |
-| declarations.swift:115:7:115:7 | (unnamed function decl) | AccessorDecl | declarations.swift:115:7:115:7 | { ... } | BraceStmt |
-| declarations.swift:115:7:115:7 | get | AccessorDecl | declarations.swift:115:7:115:7 | self | ParamDecl |
-| declarations.swift:115:7:115:7 | get | AccessorDecl | declarations.swift:115:7:115:7 | { ... } | BraceStmt |
-| declarations.swift:115:7:115:7 | hasWillSet1 | ConcreteVarDecl | declarations.swift:115:7:115:7 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:115:7:115:7 | hasWillSet1 | ConcreteVarDecl | declarations.swift:115:7:115:7 | get | AccessorDecl |
-| declarations.swift:115:7:115:7 | hasWillSet1 | ConcreteVarDecl | declarations.swift:115:7:115:7 | set | AccessorDecl |
-| declarations.swift:115:7:115:7 | hasWillSet1 | ConcreteVarDecl | declarations.swift:116:5:116:25 | willSet | AccessorDecl |
-| declarations.swift:115:7:115:7 | set | AccessorDecl | declarations.swift:115:7:115:7 | self | ParamDecl |
-| declarations.swift:115:7:115:7 | set | AccessorDecl | declarations.swift:115:7:115:7 | value | ParamDecl |
-| declarations.swift:115:7:115:7 | set | AccessorDecl | declarations.swift:115:7:115:7 | { ... } | BraceStmt |
-| declarations.swift:115:7:115:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:115:7:115:7 | { ... } | BraceStmt | declarations.swift:115:7:115:7 | yield ... | YieldStmt |
-| declarations.swift:115:7:115:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| declarations.swift:115:7:115:7 | { ... } | BraceStmt | file://:0:0:0:0 | call to willSet | CallExpr |
-| declarations.swift:115:7:115:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| declarations.swift:115:7:115:21 | ... as ... | TypedPattern | declarations.swift:115:7:115:7 | hasWillSet1 | NamedPattern |
-| declarations.swift:115:7:115:21 | ... as ... | TypedPattern | declarations.swift:115:21:115:21 | Int | TypeRepr |
-| declarations.swift:116:5:116:25 | willSet | AccessorDecl | declarations.swift:116:5:116:5 | self | ParamDecl |
-| declarations.swift:116:5:116:25 | willSet | AccessorDecl | declarations.swift:116:13:116:13 | newValue | ParamDecl |
-| declarations.swift:116:5:116:25 | willSet | AccessorDecl | declarations.swift:116:23:116:25 | { ... } | BraceStmt |
-| declarations.swift:119:3:121:3 | var ... = ... | PatternBindingDecl | declarations.swift:119:7:119:21 | ... as ... | TypedPattern |
-| declarations.swift:119:7:119:7 | (unnamed function decl) | AccessorDecl | declarations.swift:119:7:119:7 | self | ParamDecl |
-| declarations.swift:119:7:119:7 | (unnamed function decl) | AccessorDecl | declarations.swift:119:7:119:7 | { ... } | BraceStmt |
-| declarations.swift:119:7:119:7 | get | AccessorDecl | declarations.swift:119:7:119:7 | self | ParamDecl |
-| declarations.swift:119:7:119:7 | get | AccessorDecl | declarations.swift:119:7:119:7 | { ... } | BraceStmt |
-| declarations.swift:119:7:119:7 | hasWillSet2 | ConcreteVarDecl | declarations.swift:119:7:119:7 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:119:7:119:7 | hasWillSet2 | ConcreteVarDecl | declarations.swift:119:7:119:7 | get | AccessorDecl |
-| declarations.swift:119:7:119:7 | hasWillSet2 | ConcreteVarDecl | declarations.swift:119:7:119:7 | set | AccessorDecl |
-| declarations.swift:119:7:119:7 | hasWillSet2 | ConcreteVarDecl | declarations.swift:120:5:120:15 | willSet | AccessorDecl |
-| declarations.swift:119:7:119:7 | set | AccessorDecl | declarations.swift:119:7:119:7 | self | ParamDecl |
-| declarations.swift:119:7:119:7 | set | AccessorDecl | declarations.swift:119:7:119:7 | value | ParamDecl |
-| declarations.swift:119:7:119:7 | set | AccessorDecl | declarations.swift:119:7:119:7 | { ... } | BraceStmt |
-| declarations.swift:119:7:119:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:119:7:119:7 | { ... } | BraceStmt | declarations.swift:119:7:119:7 | yield ... | YieldStmt |
-| declarations.swift:119:7:119:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| declarations.swift:119:7:119:7 | { ... } | BraceStmt | file://:0:0:0:0 | call to willSet | CallExpr |
-| declarations.swift:119:7:119:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| declarations.swift:119:7:119:21 | ... as ... | TypedPattern | declarations.swift:119:7:119:7 | hasWillSet2 | NamedPattern |
-| declarations.swift:119:7:119:21 | ... as ... | TypedPattern | declarations.swift:119:21:119:21 | Int | TypeRepr |
-| declarations.swift:120:5:120:15 | willSet | AccessorDecl | declarations.swift:120:5:120:5 | newValue | ParamDecl |
-| declarations.swift:120:5:120:15 | willSet | AccessorDecl | declarations.swift:120:5:120:5 | self | ParamDecl |
-| declarations.swift:120:5:120:15 | willSet | AccessorDecl | declarations.swift:120:13:120:15 | { ... } | BraceStmt |
-| declarations.swift:123:3:125:3 | var ... = ... | PatternBindingDecl | declarations.swift:123:7:123:20 | ... as ... | TypedPattern |
-| declarations.swift:123:7:123:7 | (unnamed function decl) | AccessorDecl | declarations.swift:123:7:123:7 | self | ParamDecl |
-| declarations.swift:123:7:123:7 | (unnamed function decl) | AccessorDecl | declarations.swift:123:7:123:7 | { ... } | BraceStmt |
-| declarations.swift:123:7:123:7 | get | AccessorDecl | declarations.swift:123:7:123:7 | self | ParamDecl |
-| declarations.swift:123:7:123:7 | get | AccessorDecl | declarations.swift:123:7:123:7 | { ... } | BraceStmt |
-| declarations.swift:123:7:123:7 | hasDidSet1 | ConcreteVarDecl | declarations.swift:123:7:123:7 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:123:7:123:7 | hasDidSet1 | ConcreteVarDecl | declarations.swift:123:7:123:7 | get | AccessorDecl |
-| declarations.swift:123:7:123:7 | hasDidSet1 | ConcreteVarDecl | declarations.swift:123:7:123:7 | set | AccessorDecl |
-| declarations.swift:123:7:123:7 | hasDidSet1 | ConcreteVarDecl | declarations.swift:124:5:124:24 | didSet | AccessorDecl |
-| declarations.swift:123:7:123:7 | set | AccessorDecl | declarations.swift:123:7:123:7 | self | ParamDecl |
-| declarations.swift:123:7:123:7 | set | AccessorDecl | declarations.swift:123:7:123:7 | value | ParamDecl |
-| declarations.swift:123:7:123:7 | set | AccessorDecl | declarations.swift:123:7:123:7 | { ... } | BraceStmt |
-| declarations.swift:123:7:123:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:123:7:123:7 | { ... } | BraceStmt | declarations.swift:123:7:123:7 | yield ... | YieldStmt |
-| declarations.swift:123:7:123:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| declarations.swift:123:7:123:7 | { ... } | BraceStmt | file://:0:0:0:0 | call to didSet | CallExpr |
-| declarations.swift:123:7:123:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| declarations.swift:123:7:123:7 | { ... } | BraceStmt | file://:0:0:0:0 | tmp | ConcreteVarDecl |
-| declarations.swift:123:7:123:7 | { ... } | BraceStmt | file://:0:0:0:0 | var ... = ... | PatternBindingDecl |
-| declarations.swift:123:7:123:20 | ... as ... | TypedPattern | declarations.swift:123:7:123:7 | hasDidSet1 | NamedPattern |
-| declarations.swift:123:7:123:20 | ... as ... | TypedPattern | declarations.swift:123:20:123:20 | Int | TypeRepr |
-| declarations.swift:124:5:124:24 | didSet | AccessorDecl | declarations.swift:124:5:124:5 | self | ParamDecl |
-| declarations.swift:124:5:124:24 | didSet | AccessorDecl | declarations.swift:124:12:124:12 | oldValue | ParamDecl |
-| declarations.swift:124:5:124:24 | didSet | AccessorDecl | declarations.swift:124:22:124:24 | { ... } | BraceStmt |
-| declarations.swift:127:3:129:3 | var ... = ... | PatternBindingDecl | declarations.swift:127:7:127:20 | ... as ... | TypedPattern |
-| declarations.swift:127:7:127:7 | (unnamed function decl) | AccessorDecl | declarations.swift:127:7:127:7 | self | ParamDecl |
-| declarations.swift:127:7:127:7 | (unnamed function decl) | AccessorDecl | declarations.swift:127:7:127:7 | { ... } | BraceStmt |
-| declarations.swift:127:7:127:7 | get | AccessorDecl | declarations.swift:127:7:127:7 | self | ParamDecl |
-| declarations.swift:127:7:127:7 | get | AccessorDecl | declarations.swift:127:7:127:7 | { ... } | BraceStmt |
-| declarations.swift:127:7:127:7 | hasDidSet2 | ConcreteVarDecl | declarations.swift:127:7:127:7 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:127:7:127:7 | hasDidSet2 | ConcreteVarDecl | declarations.swift:127:7:127:7 | get | AccessorDecl |
-| declarations.swift:127:7:127:7 | hasDidSet2 | ConcreteVarDecl | declarations.swift:127:7:127:7 | set | AccessorDecl |
-| declarations.swift:127:7:127:7 | hasDidSet2 | ConcreteVarDecl | declarations.swift:128:5:128:14 | didSet | AccessorDecl |
-| declarations.swift:127:7:127:7 | set | AccessorDecl | declarations.swift:127:7:127:7 | self | ParamDecl |
-| declarations.swift:127:7:127:7 | set | AccessorDecl | declarations.swift:127:7:127:7 | value | ParamDecl |
-| declarations.swift:127:7:127:7 | set | AccessorDecl | declarations.swift:127:7:127:7 | { ... } | BraceStmt |
-| declarations.swift:127:7:127:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:127:7:127:7 | { ... } | BraceStmt | declarations.swift:127:7:127:7 | yield ... | YieldStmt |
-| declarations.swift:127:7:127:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| declarations.swift:127:7:127:7 | { ... } | BraceStmt | file://:0:0:0:0 | call to didSet | CallExpr |
-| declarations.swift:127:7:127:7 | { ... } | BraceStmt | file://:0:0:0:0 | call to didSet | CallExpr |
-| declarations.swift:127:7:127:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| declarations.swift:127:7:127:20 | ... as ... | TypedPattern | declarations.swift:127:7:127:7 | hasDidSet2 | NamedPattern |
-| declarations.swift:127:7:127:20 | ... as ... | TypedPattern | declarations.swift:127:20:127:20 | Int | TypeRepr |
-| declarations.swift:128:5:128:14 | didSet | AccessorDecl | declarations.swift:128:5:128:5 | self | ParamDecl |
-| declarations.swift:128:5:128:14 | didSet | AccessorDecl | declarations.swift:128:12:128:14 | { ... } | BraceStmt |
-| declarations.swift:131:3:135:3 | var ... = ... | PatternBindingDecl | declarations.swift:131:7:131:17 | ... as ... | TypedPattern |
-| declarations.swift:131:7:131:7 | (unnamed function decl) | AccessorDecl | declarations.swift:131:7:131:7 | self | ParamDecl |
-| declarations.swift:131:7:131:7 | (unnamed function decl) | AccessorDecl | declarations.swift:131:7:131:7 | { ... } | BraceStmt |
-| declarations.swift:131:7:131:7 | get | AccessorDecl | declarations.swift:131:7:131:7 | self | ParamDecl |
-| declarations.swift:131:7:131:7 | get | AccessorDecl | declarations.swift:131:7:131:7 | { ... } | BraceStmt |
-| declarations.swift:131:7:131:7 | hasBoth | ConcreteVarDecl | declarations.swift:131:7:131:7 | (unnamed function decl) | AccessorDecl |
-| declarations.swift:131:7:131:7 | hasBoth | ConcreteVarDecl | declarations.swift:131:7:131:7 | get | AccessorDecl |
-| declarations.swift:131:7:131:7 | hasBoth | ConcreteVarDecl | declarations.swift:131:7:131:7 | set | AccessorDecl |
-| declarations.swift:131:7:131:7 | hasBoth | ConcreteVarDecl | declarations.swift:132:5:132:15 | willSet | AccessorDecl |
-| declarations.swift:131:7:131:7 | hasBoth | ConcreteVarDecl | declarations.swift:134:5:134:14 | didSet | AccessorDecl |
-| declarations.swift:131:7:131:7 | set | AccessorDecl | declarations.swift:131:7:131:7 | self | ParamDecl |
-| declarations.swift:131:7:131:7 | set | AccessorDecl | declarations.swift:131:7:131:7 | value | ParamDecl |
-| declarations.swift:131:7:131:7 | set | AccessorDecl | declarations.swift:131:7:131:7 | { ... } | BraceStmt |
-| declarations.swift:131:7:131:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| declarations.swift:131:7:131:7 | { ... } | BraceStmt | declarations.swift:131:7:131:7 | yield ... | YieldStmt |
-| declarations.swift:131:7:131:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| declarations.swift:131:7:131:7 | { ... } | BraceStmt | file://:0:0:0:0 | call to didSet | CallExpr |
-| declarations.swift:131:7:131:7 | { ... } | BraceStmt | file://:0:0:0:0 | call to willSet | CallExpr |
-| declarations.swift:131:7:131:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| declarations.swift:131:7:131:17 | ... as ... | TypedPattern | declarations.swift:131:7:131:7 | hasBoth | NamedPattern |
-| declarations.swift:131:7:131:17 | ... as ... | TypedPattern | declarations.swift:131:17:131:17 | Int | TypeRepr |
-| declarations.swift:132:5:132:15 | willSet | AccessorDecl | declarations.swift:132:5:132:5 | newValue | ParamDecl |
-| declarations.swift:132:5:132:15 | willSet | AccessorDecl | declarations.swift:132:5:132:5 | self | ParamDecl |
-| declarations.swift:132:5:132:15 | willSet | AccessorDecl | declarations.swift:132:13:132:15 | { ... } | BraceStmt |
-| declarations.swift:134:5:134:14 | didSet | AccessorDecl | declarations.swift:134:5:134:5 | self | ParamDecl |
-| declarations.swift:134:5:134:14 | didSet | AccessorDecl | declarations.swift:134:12:134:14 | { ... } | BraceStmt |
-| declarations.swift:139:3:141:3 | id() | ConcreteFuncDecl | declarations.swift:139:8:139:8 | self | ParamDecl |
-| declarations.swift:139:3:141:3 | id() | ConcreteFuncDecl | declarations.swift:139:20:141:3 | { ... } | BraceStmt |
-| declarations.swift:139:20:141:3 | { ... } | BraceStmt | declarations.swift:140:5:140:12 | return ... | ReturnStmt |
-| declarations.swift:140:5:140:12 | return ... | ReturnStmt | declarations.swift:140:12:140:12 | self | DeclRefExpr |
-| declarations.swift:144:1:144:7 | call to id() | CallExpr | declarations.swift:144:1:144:4 | .id() | MethodRefExpr |
-| declarations.swift:144:1:144:7 | { ... } | BraceStmt | declarations.swift:144:1:144:7 | call to id() | CallExpr |
-| declarations.swift:144:1:144:7 | { ... } | TopLevelCodeDecl | declarations.swift:144:1:144:7 | { ... } | BraceStmt |
-| expressions.swift:1:1:1:9 | var ... = ... | PatternBindingDecl | expressions.swift:1:5:1:5 | a | NamedPattern |
-| expressions.swift:1:1:1:9 | var ... = ... | PatternBindingDecl | expressions.swift:1:9:1:9 | 15 | IntegerLiteralExpr |
-| expressions.swift:1:1:1:9 | { ... } | BraceStmt | expressions.swift:1:1:1:9 | var ... = ... | PatternBindingDecl |
-| expressions.swift:1:1:1:9 | { ... } | TopLevelCodeDecl | expressions.swift:1:1:1:9 | { ... } | BraceStmt |
-| expressions.swift:2:1:2:9 | var ... = ... | PatternBindingDecl | expressions.swift:2:5:2:5 | b | NamedPattern |
-| expressions.swift:2:1:2:9 | var ... = ... | PatternBindingDecl | expressions.swift:2:9:2:9 | 15.15 | FloatLiteralExpr |
-| expressions.swift:2:1:2:9 | { ... } | BraceStmt | expressions.swift:2:1:2:9 | var ... = ... | PatternBindingDecl |
-| expressions.swift:2:1:2:9 | { ... } | TopLevelCodeDecl | expressions.swift:2:1:2:9 | { ... } | BraceStmt |
-| expressions.swift:3:1:3:10 | var ... = ... | PatternBindingDecl | expressions.swift:3:5:3:5 | b1 | NamedPattern |
-| expressions.swift:3:1:3:10 | var ... = ... | PatternBindingDecl | expressions.swift:3:10:3:10 | true | BooleanLiteralExpr |
-| expressions.swift:3:1:3:10 | { ... } | BraceStmt | expressions.swift:3:1:3:10 | var ... = ... | PatternBindingDecl |
-| expressions.swift:3:1:3:10 | { ... } | TopLevelCodeDecl | expressions.swift:3:1:3:10 | { ... } | BraceStmt |
-| expressions.swift:4:1:4:10 | var ... = ... | PatternBindingDecl | expressions.swift:4:5:4:5 | b2 | NamedPattern |
-| expressions.swift:4:1:4:10 | var ... = ... | PatternBindingDecl | expressions.swift:4:10:4:10 | false | BooleanLiteralExpr |
-| expressions.swift:4:1:4:10 | { ... } | BraceStmt | expressions.swift:4:1:4:10 | var ... = ... | PatternBindingDecl |
-| expressions.swift:4:1:4:10 | { ... } | TopLevelCodeDecl | expressions.swift:4:1:4:10 | { ... } | BraceStmt |
-| expressions.swift:5:1:5:9 | var ... = ... | PatternBindingDecl | expressions.swift:5:5:5:5 | m | NamedPattern |
-| expressions.swift:5:1:5:9 | var ... = ... | PatternBindingDecl | expressions.swift:5:9:5:9 | #... | MagicIdentifierLiteralExpr |
-| expressions.swift:5:1:5:9 | { ... } | BraceStmt | expressions.swift:5:1:5:9 | var ... = ... | PatternBindingDecl |
-| expressions.swift:5:1:5:9 | { ... } | TopLevelCodeDecl | expressions.swift:5:1:5:9 | { ... } | BraceStmt |
-| expressions.swift:6:1:6:9 | var ... = ... | PatternBindingDecl | expressions.swift:6:5:6:5 | s | NamedPattern |
-| expressions.swift:6:1:6:9 | var ... = ... | PatternBindingDecl | expressions.swift:6:9:6:9 | hello world | StringLiteralExpr |
-| expressions.swift:6:1:6:9 | { ... } | BraceStmt | expressions.swift:6:1:6:9 | var ... = ... | PatternBindingDecl |
-| expressions.swift:6:1:6:9 | { ... } | TopLevelCodeDecl | expressions.swift:6:1:6:9 | { ... } | BraceStmt |
-| expressions.swift:7:1:7:10 | var ... = ... | PatternBindingDecl | expressions.swift:7:5:7:5 | s1 | NamedPattern |
-| expressions.swift:7:1:7:10 | var ... = ... | PatternBindingDecl | expressions.swift:7:10:7:10 | "..." | InterpolatedStringLiteralExpr |
-| expressions.swift:7:1:7:10 | { ... } | BraceStmt | expressions.swift:7:1:7:10 | var ... = ... | PatternBindingDecl |
-| expressions.swift:7:1:7:10 | { ... } | TopLevelCodeDecl | expressions.swift:7:1:7:10 | { ... } | BraceStmt |
-| expressions.swift:7:10:7:10 | "..." | InterpolatedStringLiteralExpr | expressions.swift:7:10:7:10 | TapExpr | TapExpr |
-| expressions.swift:7:10:7:10 | "..." | InterpolatedStringLiteralExpr | file://:0:0:0:0 | 1 | IntegerLiteralExpr |
-| expressions.swift:7:10:7:10 | "..." | InterpolatedStringLiteralExpr | file://:0:0:0:0 | 6 | IntegerLiteralExpr |
-| expressions.swift:7:10:7:10 | TapExpr | TapExpr | expressions.swift:7:10:7:10 | OpaqueValueExpr | OpaqueValueExpr |
-| expressions.swift:7:10:7:10 | TapExpr | TapExpr | expressions.swift:7:10:7:10 | { ... } | BraceStmt |
-| expressions.swift:7:10:7:10 | { ... } | BraceStmt | expressions.swift:7:11:7:10 | call to appendLiteral(_:) | CallExpr |
-| expressions.swift:7:10:7:10 | { ... } | BraceStmt | expressions.swift:7:18:7:20 | call to appendInterpolation(_:) | CallExpr |
-| expressions.swift:7:10:7:10 | { ... } | BraceStmt | expressions.swift:7:21:7:21 | call to appendLiteral(_:) | CallExpr |
-| expressions.swift:7:10:7:10 | { ... } | BraceStmt | file://:0:0:0:0 | $interpolation | ConcreteVarDecl |
-| expressions.swift:7:11:7:10 | call to appendLiteral(_:) | CallExpr | expressions.swift:7:11:7:11 | .appendLiteral(_:) | MethodRefExpr |
-| expressions.swift:7:11:7:11 | &... | InOutExpr | expressions.swift:7:11:7:11 | $interpolation | DeclRefExpr |
-| expressions.swift:7:18:7:18 | &... | InOutExpr | expressions.swift:7:18:7:18 | $interpolation | DeclRefExpr |
-| expressions.swift:7:18:7:20 | call to appendInterpolation(_:) | CallExpr | expressions.swift:7:18:7:18 | .appendInterpolation(_:) | MethodRefExpr |
-| expressions.swift:7:21:7:21 | &... | InOutExpr | expressions.swift:7:21:7:21 | $interpolation | DeclRefExpr |
-| expressions.swift:7:21:7:21 | call to appendLiteral(_:) | CallExpr | expressions.swift:7:21:7:21 | .appendLiteral(_:) | MethodRefExpr |
-| expressions.swift:8:1:8:15 | var ... = ... | PatternBindingDecl | expressions.swift:8:5:8:11 | ... as ... | TypedPattern |
-| expressions.swift:8:1:8:15 | var ... = ... | PatternBindingDecl | expressions.swift:8:15:8:15 | nil | NilLiteralExpr |
-| expressions.swift:8:1:8:15 | { ... } | BraceStmt | expressions.swift:8:1:8:15 | var ... = ... | PatternBindingDecl |
-| expressions.swift:8:1:8:15 | { ... } | TopLevelCodeDecl | expressions.swift:8:1:8:15 | { ... } | BraceStmt |
-| expressions.swift:8:5:8:11 | ... as ... | TypedPattern | expressions.swift:8:5:8:5 | n | NamedPattern |
-| expressions.swift:8:5:8:11 | ... as ... | TypedPattern | expressions.swift:8:8:8:11 | Int? | TypeRepr |
-| expressions.swift:11:3:11:8 | case ... | EnumCaseDecl | expressions.swift:11:8:11:8 | failed | EnumElementDecl |
-| expressions.swift:14:1:18:1 | failure(_:) | ConcreteFuncDecl | expressions.swift:14:14:14:19 | x | ParamDecl |
-| expressions.swift:14:1:18:1 | failure(_:) | ConcreteFuncDecl | expressions.swift:14:31:18:1 | { ... } | BraceStmt |
-| expressions.swift:14:31:18:1 | { ... } | BraceStmt | expressions.swift:15:3:17:3 | guard ... else { ... } | GuardStmt |
-| expressions.swift:15:3:17:3 | guard ... else { ... } | GuardStmt | expressions.swift:15:9:15:14 | StmtCondition | StmtCondition |
-| expressions.swift:15:3:17:3 | guard ... else { ... } | GuardStmt | expressions.swift:15:21:17:3 | { ... } | BraceStmt |
-| expressions.swift:15:9:15:14 | ... .!=(_:_:) ... | BinaryExpr | expressions.swift:15:11:15:11 | .!=(_:_:) | MethodRefExpr |
-| expressions.swift:15:11:15:11 | Int.Type | TypeExpr | expressions.swift:15:11:15:11 | Int | TypeRepr |
-| expressions.swift:15:21:17:3 | { ... } | BraceStmt | expressions.swift:16:5:16:19 | throw ... | ThrowStmt |
-| expressions.swift:16:5:16:19 | throw ... | ThrowStmt | expressions.swift:16:11:16:19 | (Error) ... | ErasureExpr |
-| expressions.swift:16:11:16:11 | AnError.Type | TypeExpr | expressions.swift:16:11:16:11 | AnError | TypeRepr |
-| expressions.swift:16:11:16:19 | (Error) ... | ErasureExpr | expressions.swift:16:11:16:19 | .failed | MethodRefExpr |
-| expressions.swift:20:1:20:16 | try! ... | ForceTryExpr | expressions.swift:20:6:20:16 | call to failure(_:) | CallExpr |
-| expressions.swift:20:1:20:16 | { ... } | BraceStmt | expressions.swift:20:1:20:16 | try! ... | ForceTryExpr |
-| expressions.swift:20:1:20:16 | { ... } | TopLevelCodeDecl | expressions.swift:20:1:20:16 | { ... } | BraceStmt |
-| expressions.swift:20:6:20:16 | call to failure(_:) | CallExpr | expressions.swift:20:6:20:6 | failure(_:) | DeclRefExpr |
-| expressions.swift:21:1:21:16 | try? ... | OptionalTryExpr | expressions.swift:21:6:21:16 | (()?) ... | InjectIntoOptionalExpr |
-| expressions.swift:21:1:21:16 | { ... } | BraceStmt | expressions.swift:21:1:21:16 | try? ... | OptionalTryExpr |
-| expressions.swift:21:1:21:16 | { ... } | TopLevelCodeDecl | expressions.swift:21:1:21:16 | { ... } | BraceStmt |
-| expressions.swift:21:6:21:16 | (()?) ... | InjectIntoOptionalExpr | expressions.swift:21:6:21:16 | call to failure(_:) | CallExpr |
-| expressions.swift:21:6:21:16 | call to failure(_:) | CallExpr | expressions.swift:21:6:21:6 | failure(_:) | DeclRefExpr |
-| expressions.swift:23:7:23:7 | deinit | DestructorDecl | expressions.swift:23:7:23:7 | self | ParamDecl |
-| expressions.swift:23:7:23:7 | deinit | DestructorDecl | expressions.swift:23:7:23:7 | { ... } | BraceStmt |
-| expressions.swift:24:3:24:11 | init | ConstructorDecl | expressions.swift:24:3:24:3 | self | ParamDecl |
-| expressions.swift:24:3:24:11 | init | ConstructorDecl | expressions.swift:24:10:24:11 | { ... } | BraceStmt |
-| expressions.swift:24:10:24:11 | { ... } | BraceStmt | expressions.swift:24:11:24:11 | return | ReturnStmt |
-| expressions.swift:27:1:27:19 | var ... = ... | PatternBindingDecl | expressions.swift:27:5:27:5 | klass | NamedPattern |
-| expressions.swift:27:1:27:19 | var ... = ... | PatternBindingDecl | expressions.swift:27:13:27:19 | call to init | CallExpr |
-| expressions.swift:27:1:27:19 | { ... } | BraceStmt | expressions.swift:27:1:27:19 | var ... = ... | PatternBindingDecl |
-| expressions.swift:27:1:27:19 | { ... } | TopLevelCodeDecl | expressions.swift:27:1:27:19 | { ... } | BraceStmt |
-| expressions.swift:27:13:27:13 | Klass.Type | TypeExpr | expressions.swift:27:13:27:13 | Klass | TypeRepr |
-| expressions.swift:27:13:27:13 | call to init | ConstructorRefCallExpr | expressions.swift:27:13:27:13 | init | DeclRefExpr |
-| expressions.swift:27:13:27:19 | call to init | CallExpr | expressions.swift:27:13:27:13 | call to init | ConstructorRefCallExpr |
-| expressions.swift:29:1:29:19 | var ... = ... | PatternBindingDecl | expressions.swift:29:5:29:5 | d | NamedPattern |
-| expressions.swift:29:1:29:19 | var ... = ... | PatternBindingDecl | expressions.swift:29:9:29:19 | [...] | DictionaryExpr |
-| expressions.swift:29:1:29:19 | { ... } | BraceStmt | expressions.swift:29:1:29:19 | var ... = ... | PatternBindingDecl |
-| expressions.swift:29:1:29:19 | { ... } | TopLevelCodeDecl | expressions.swift:29:1:29:19 | { ... } | BraceStmt |
-| expressions.swift:29:9:29:19 | [...] | DictionaryExpr | expressions.swift:29:10:29:16 | (...) | TupleExpr |
-| expressions.swift:29:10:29:16 | (...) | TupleExpr | expressions.swift:29:10:29:10 | 1 | StringLiteralExpr |
-| expressions.swift:29:10:29:16 | (...) | TupleExpr | expressions.swift:29:16:29:16 | 2 | StringLiteralExpr |
-| expressions.swift:30:1:30:5 |  ... = ... | AssignExpr | expressions.swift:30:1:30:1 | _ | DiscardAssignmentExpr |
-| expressions.swift:30:1:30:5 |  ... = ... | AssignExpr | expressions.swift:30:5:30:5 | 15 | IntegerLiteralExpr |
-| expressions.swift:30:1:30:5 | { ... } | BraceStmt | expressions.swift:30:1:30:5 |  ... = ... | AssignExpr |
-| expressions.swift:30:1:30:5 | { ... } | TopLevelCodeDecl | expressions.swift:30:1:30:5 | { ... } | BraceStmt |
-| expressions.swift:31:1:31:11 |  ... = ... | AssignExpr | expressions.swift:31:1:31:1 | _ | DiscardAssignmentExpr |
-| expressions.swift:31:1:31:11 |  ... = ... | AssignExpr | expressions.swift:31:5:31:11 | ... is ... | IsExpr |
-| expressions.swift:31:1:31:11 | { ... } | BraceStmt | expressions.swift:31:1:31:11 |  ... = ... | AssignExpr |
-| expressions.swift:31:1:31:11 | { ... } | TopLevelCodeDecl | expressions.swift:31:1:31:11 | { ... } | BraceStmt |
-| expressions.swift:31:5:31:11 | ... is ... | IsExpr | expressions.swift:31:5:31:5 | 15 | IntegerLiteralExpr |
-| expressions.swift:32:1:32:11 |  ... = ... | AssignExpr | expressions.swift:32:1:32:1 | _ | DiscardAssignmentExpr |
-| expressions.swift:32:1:32:11 |  ... = ... | AssignExpr | expressions.swift:32:5:32:11 | (Double) ... | CoerceExpr |
-| expressions.swift:32:1:32:11 | { ... } | BraceStmt | expressions.swift:32:1:32:11 |  ... = ... | AssignExpr |
-| expressions.swift:32:1:32:11 | { ... } | TopLevelCodeDecl | expressions.swift:32:1:32:11 | { ... } | BraceStmt |
-| expressions.swift:32:5:32:11 | (Double) ... | CoerceExpr | expressions.swift:32:5:32:5 | 15 | IntegerLiteralExpr |
-| expressions.swift:33:1:33:12 |  ... = ... | AssignExpr | expressions.swift:33:1:33:1 | _ | DiscardAssignmentExpr |
-| expressions.swift:33:1:33:12 |  ... = ... | AssignExpr | expressions.swift:33:5:33:12 | (Double?) ... | ConditionalCheckedCastExpr |
-| expressions.swift:33:1:33:12 | { ... } | BraceStmt | expressions.swift:33:1:33:12 |  ... = ... | AssignExpr |
-| expressions.swift:33:1:33:12 | { ... } | TopLevelCodeDecl | expressions.swift:33:1:33:12 | { ... } | BraceStmt |
-| expressions.swift:33:5:33:12 | (Double?) ... | ConditionalCheckedCastExpr | expressions.swift:33:5:33:5 | 15 | IntegerLiteralExpr |
-| expressions.swift:34:1:34:12 |  ... = ... | AssignExpr | expressions.swift:34:1:34:1 | _ | DiscardAssignmentExpr |
-| expressions.swift:34:1:34:12 |  ... = ... | AssignExpr | expressions.swift:34:5:34:12 | (Double) ... | ForcedCheckedCastExpr |
-| expressions.swift:34:1:34:12 | { ... } | BraceStmt | expressions.swift:34:1:34:12 |  ... = ... | AssignExpr |
-| expressions.swift:34:1:34:12 | { ... } | TopLevelCodeDecl | expressions.swift:34:1:34:12 | { ... } | BraceStmt |
-| expressions.swift:34:5:34:12 | (Double) ... | ForcedCheckedCastExpr | expressions.swift:34:5:34:5 | 15 | IntegerLiteralExpr |
-| expressions.swift:35:1:35:13 | call to print(_:separator:terminator:) | CallExpr | expressions.swift:35:1:35:1 | print(_:separator:terminator:) | DeclRefExpr |
-| expressions.swift:35:1:35:13 | { ... } | BraceStmt | expressions.swift:35:1:35:13 | call to print(_:separator:terminator:) | CallExpr |
-| expressions.swift:35:1:35:13 | { ... } | TopLevelCodeDecl | expressions.swift:35:1:35:13 | { ... } | BraceStmt |
-| expressions.swift:35:7:35:12 | (Any) ... | ErasureExpr | expressions.swift:35:7:35:12 | ...[...] | SubscriptExpr |
-| expressions.swift:35:7:35:12 | ...[...] | SubscriptExpr | expressions.swift:35:7:35:7 | d | DeclRefExpr |
-| expressions.swift:35:7:35:12 | [...] | ArrayExpr | expressions.swift:35:7:35:12 | (Any) ... | ErasureExpr |
-| expressions.swift:35:7:35:12 | [...] | VarargExpansionExpr | expressions.swift:35:7:35:12 | [...] | ArrayExpr |
-| expressions.swift:37:1:39:1 | closured(closure:) | ConcreteFuncDecl | expressions.swift:37:15:37:38 | closure | ParamDecl |
-| expressions.swift:37:1:39:1 | closured(closure:) | ConcreteFuncDecl | expressions.swift:37:43:39:1 | { ... } | BraceStmt |
-| expressions.swift:37:43:39:1 | { ... } | BraceStmt | expressions.swift:38:3:38:15 | call to ... | CallExpr |
-| expressions.swift:38:3:38:15 | call to ... | CallExpr | expressions.swift:38:3:38:3 | closure | DeclRefExpr |
-| expressions.swift:41:1:43:1 | call to closured(closure:) | CallExpr | expressions.swift:41:1:41:1 | closured(closure:) | DeclRefExpr |
-| expressions.swift:41:1:43:1 | { ... } | BraceStmt | expressions.swift:41:1:43:1 | call to closured(closure:) | CallExpr |
-| expressions.swift:41:1:43:1 | { ... } | TopLevelCodeDecl | expressions.swift:41:1:43:1 | { ... } | BraceStmt |
-| expressions.swift:41:10:43:1 | { ... } | BraceStmt | expressions.swift:42:5:42:16 | return ... | ReturnStmt |
-| expressions.swift:41:10:43:1 | { ... } | ClosureExpr | expressions.swift:41:10:43:1 | { ... } | BraceStmt |
-| expressions.swift:41:10:43:1 | { ... } | ClosureExpr | expressions.swift:41:13:41:16 | x | ParamDecl |
-| expressions.swift:41:10:43:1 | { ... } | ClosureExpr | expressions.swift:41:21:41:24 | y | ParamDecl |
-| expressions.swift:42:5:42:16 | return ... | ReturnStmt | expressions.swift:42:12:42:16 | ... .+(_:_:) ... | BinaryExpr |
-| expressions.swift:42:12:42:16 | ... .+(_:_:) ... | BinaryExpr | expressions.swift:42:14:42:14 | .+(_:_:) | MethodRefExpr |
-| expressions.swift:42:14:42:14 | Int.Type | TypeExpr | expressions.swift:42:14:42:14 | Int | TypeRepr |
-| expressions.swift:44:1:46:1 | call to closured(closure:) | CallExpr | expressions.swift:44:1:44:1 | closured(closure:) | DeclRefExpr |
-| expressions.swift:44:1:46:1 | { ... } | BraceStmt | expressions.swift:44:1:46:1 | call to closured(closure:) | CallExpr |
-| expressions.swift:44:1:46:1 | { ... } | TopLevelCodeDecl | expressions.swift:44:1:46:1 | { ... } | BraceStmt |
-| expressions.swift:44:10:46:1 | { ... } | BraceStmt | expressions.swift:45:5:45:16 | return ... | ReturnStmt |
-| expressions.swift:44:10:46:1 | { ... } | ClosureExpr | expressions.swift:44:10:46:1 | { ... } | BraceStmt |
-| expressions.swift:44:10:46:1 | { ... } | ClosureExpr | expressions.swift:44:12:44:12 | x | ParamDecl |
-| expressions.swift:44:10:46:1 | { ... } | ClosureExpr | expressions.swift:44:15:44:15 | y | ParamDecl |
-| expressions.swift:45:5:45:16 | return ... | ReturnStmt | expressions.swift:45:12:45:16 | ... .+(_:_:) ... | BinaryExpr |
-| expressions.swift:45:12:45:16 | ... .+(_:_:) ... | BinaryExpr | expressions.swift:45:14:45:14 | .+(_:_:) | MethodRefExpr |
-| expressions.swift:45:14:45:14 | Int.Type | TypeExpr | expressions.swift:45:14:45:14 | Int | TypeRepr |
-| expressions.swift:47:1:47:27 | call to closured(closure:) | CallExpr | expressions.swift:47:1:47:1 | closured(closure:) | DeclRefExpr |
-| expressions.swift:47:1:47:27 | { ... } | BraceStmt | expressions.swift:47:1:47:27 | call to closured(closure:) | CallExpr |
-| expressions.swift:47:1:47:27 | { ... } | TopLevelCodeDecl | expressions.swift:47:1:47:27 | { ... } | BraceStmt |
-| expressions.swift:47:10:47:27 | { ... } | BraceStmt | expressions.swift:47:12:47:24 | return ... | ReturnStmt |
-| expressions.swift:47:10:47:27 | { ... } | ClosureExpr | expressions.swift:47:10:47:10 | $0 | ParamDecl |
-| expressions.swift:47:10:47:27 | { ... } | ClosureExpr | expressions.swift:47:10:47:10 | $1 | ParamDecl |
-| expressions.swift:47:10:47:27 | { ... } | ClosureExpr | expressions.swift:47:10:47:27 | { ... } | BraceStmt |
-| expressions.swift:47:12:47:24 | return ... | ReturnStmt | expressions.swift:47:19:47:24 | ... .+(_:_:) ... | BinaryExpr |
-| expressions.swift:47:19:47:24 | ... .+(_:_:) ... | BinaryExpr | expressions.swift:47:22:47:22 | .+(_:_:) | MethodRefExpr |
-| expressions.swift:47:22:47:22 | Int.Type | TypeExpr | expressions.swift:47:22:47:22 | Int | TypeRepr |
-| expressions.swift:48:1:48:20 | call to closured(closure:) | CallExpr | expressions.swift:48:1:48:1 | closured(closure:) | DeclRefExpr |
-| expressions.swift:48:1:48:20 | { ... } | BraceStmt | expressions.swift:48:1:48:20 | call to closured(closure:) | CallExpr |
-| expressions.swift:48:1:48:20 | { ... } | TopLevelCodeDecl | expressions.swift:48:1:48:20 | { ... } | BraceStmt |
-| expressions.swift:48:10:48:20 | { ... } | BraceStmt | expressions.swift:48:12:48:17 | return ... | ReturnStmt |
-| expressions.swift:48:10:48:20 | { ... } | ClosureExpr | expressions.swift:48:10:48:10 | $0 | ParamDecl |
-| expressions.swift:48:10:48:20 | { ... } | ClosureExpr | expressions.swift:48:10:48:10 | $1 | ParamDecl |
-| expressions.swift:48:10:48:20 | { ... } | ClosureExpr | expressions.swift:48:10:48:20 | { ... } | BraceStmt |
-| expressions.swift:48:12:48:17 | ... .+(_:_:) ... | BinaryExpr | expressions.swift:48:15:48:15 | .+(_:_:) | MethodRefExpr |
-| expressions.swift:48:12:48:17 | return ... | ReturnStmt | expressions.swift:48:12:48:17 | ... .+(_:_:) ... | BinaryExpr |
-| expressions.swift:48:15:48:15 | Int.Type | TypeExpr | expressions.swift:48:15:48:15 | Int | TypeRepr |
-| expressions.swift:50:8:50:8 | init | ConstructorDecl | expressions.swift:50:8:50:8 | self | ParamDecl |
-| expressions.swift:50:8:50:8 | init | ConstructorDecl | expressions.swift:50:8:50:8 | x | ParamDecl |
-| expressions.swift:51:3:51:10 | var ... = ... | PatternBindingDecl | expressions.swift:51:7:51:10 | ... as ... | TypedPattern |
-| expressions.swift:51:7:51:7 | get | AccessorDecl | expressions.swift:51:7:51:7 | self | ParamDecl |
-| expressions.swift:51:7:51:7 | get | AccessorDecl | expressions.swift:51:7:51:7 | { ... } | BraceStmt |
-| expressions.swift:51:7:51:7 | x | ConcreteVarDecl | expressions.swift:51:7:51:7 | get | AccessorDecl |
-| expressions.swift:51:7:51:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| expressions.swift:51:7:51:10 | ... as ... | TypedPattern | expressions.swift:51:7:51:7 | x | NamedPattern |
-| expressions.swift:51:7:51:10 | ... as ... | TypedPattern | expressions.swift:51:10:51:10 | Int | TypeRepr |
-| expressions.swift:54:1:54:8 |  ... = ... | AssignExpr | expressions.swift:54:1:54:1 | _ | DiscardAssignmentExpr |
-| expressions.swift:54:1:54:8 |  ... = ... | AssignExpr | expressions.swift:54:5:54:8 | #keyPath(...) | KeyPathExpr |
-| expressions.swift:54:1:54:8 | { ... } | BraceStmt | expressions.swift:54:1:54:8 |  ... = ... | AssignExpr |
-| expressions.swift:54:1:54:8 | { ... } | TopLevelCodeDecl | expressions.swift:54:1:54:8 | { ... } | BraceStmt |
-| expressions.swift:54:5:54:8 | #keyPath(...) | KeyPathExpr | expressions.swift:54:6:54:6 | S | TypeRepr |
-| expressions.swift:56:1:57:1 | unsafeFunction(pointer:) | ConcreteFuncDecl | expressions.swift:56:21:56:47 | pointer | ParamDecl |
-| expressions.swift:56:1:57:1 | unsafeFunction(pointer:) | ConcreteFuncDecl | expressions.swift:56:50:57:1 | { ... } | BraceStmt |
-| expressions.swift:58:1:58:16 | var ... = ... | PatternBindingDecl | expressions.swift:58:5:58:5 | myNumber | NamedPattern |
-| expressions.swift:58:1:58:16 | var ... = ... | PatternBindingDecl | expressions.swift:58:16:58:16 | 1234 | IntegerLiteralExpr |
-| expressions.swift:58:1:58:16 | { ... } | BraceStmt | expressions.swift:58:1:58:16 | var ... = ... | PatternBindingDecl |
-| expressions.swift:58:1:58:16 | { ... } | TopLevelCodeDecl | expressions.swift:58:1:58:16 | { ... } | BraceStmt |
-| expressions.swift:59:1:59:34 | call to unsafeFunction(pointer:) | CallExpr | expressions.swift:59:1:59:1 | unsafeFunction(pointer:) | DeclRefExpr |
-| expressions.swift:59:1:59:34 | { ... } | BraceStmt | expressions.swift:59:1:59:34 | call to unsafeFunction(pointer:) | CallExpr |
-| expressions.swift:59:1:59:34 | { ... } | TopLevelCodeDecl | expressions.swift:59:1:59:34 | { ... } | BraceStmt |
-| expressions.swift:59:25:59:26 | &... | InOutExpr | expressions.swift:59:26:59:26 | myNumber | DeclRefExpr |
-| expressions.swift:59:25:59:26 | (UnsafePointer<Int>) ... | InOutToPointerExpr | expressions.swift:59:25:59:26 | &... | InOutExpr |
-| expressions.swift:60:1:60:63 | call to withUnsafePointer(to:_:) | CallExpr | expressions.swift:60:1:60:1 | withUnsafePointer(to:_:) | DeclRefExpr |
-| expressions.swift:60:1:60:63 | { ... } | BraceStmt | expressions.swift:60:1:60:63 | call to withUnsafePointer(to:_:) | CallExpr |
-| expressions.swift:60:1:60:63 | { ... } | TopLevelCodeDecl | expressions.swift:60:1:60:63 | { ... } | BraceStmt |
-| expressions.swift:60:23:60:23 | (Int) ... | LoadExpr | expressions.swift:60:23:60:23 | myNumber | DeclRefExpr |
-| expressions.swift:60:33:60:63 | ((UnsafePointer<Int>) throws -> ()) ... | FunctionConversionExpr | expressions.swift:60:33:60:63 | { ... } | ClosureExpr |
-| expressions.swift:60:33:60:63 | { ... } | BraceStmt | expressions.swift:60:35:60:61 | return ... | ReturnStmt |
-| expressions.swift:60:33:60:63 | { ... } | ClosureExpr | expressions.swift:60:33:60:33 | $0 | ParamDecl |
-| expressions.swift:60:33:60:63 | { ... } | ClosureExpr | expressions.swift:60:33:60:63 | { ... } | BraceStmt |
-| expressions.swift:60:35:60:61 | call to unsafeFunction(pointer:) | CallExpr | expressions.swift:60:35:60:35 | unsafeFunction(pointer:) | DeclRefExpr |
-| expressions.swift:60:35:60:61 | return ... | ReturnStmt | expressions.swift:60:35:60:61 | call to unsafeFunction(pointer:) | CallExpr |
-| expressions.swift:62:7:62:7 | deinit | DestructorDecl | expressions.swift:62:7:62:7 | self | ParamDecl |
-| expressions.swift:62:7:62:7 | deinit | DestructorDecl | expressions.swift:62:7:62:7 | { ... } | BraceStmt |
-| expressions.swift:63:3:67:3 | init | ConstructorDecl | expressions.swift:63:3:63:3 | self | ParamDecl |
-| expressions.swift:63:3:67:3 | init | ConstructorDecl | expressions.swift:63:9:63:12 | x | ParamDecl |
-| expressions.swift:63:3:67:3 | init | ConstructorDecl | expressions.swift:63:17:67:3 | { ... } | BraceStmt |
-| expressions.swift:63:17:67:3 | { ... } | BraceStmt | expressions.swift:64:5:66:5 | if ... then { ... } | IfStmt |
-| expressions.swift:63:17:67:3 | { ... } | BraceStmt | expressions.swift:67:3:67:3 | return | ReturnStmt |
-| expressions.swift:64:5:66:5 | if ... then { ... } | IfStmt | expressions.swift:64:8:64:12 | StmtCondition | StmtCondition |
-| expressions.swift:64:5:66:5 | if ... then { ... } | IfStmt | expressions.swift:64:14:66:5 | { ... } | BraceStmt |
-| expressions.swift:64:8:64:12 | ... .<(_:_:) ... | BinaryExpr | expressions.swift:64:10:64:10 | .<(_:_:) | MethodRefExpr |
-| expressions.swift:64:10:64:10 | Int.Type | TypeExpr | expressions.swift:64:10:64:10 | Int | TypeRepr |
-| expressions.swift:64:14:66:5 | { ... } | BraceStmt | expressions.swift:65:7:65:14 | fail | FailStmt |
-| expressions.swift:70:7:70:7 | deinit | DestructorDecl | expressions.swift:70:7:70:7 | self | ParamDecl |
-| expressions.swift:70:7:70:7 | deinit | DestructorDecl | expressions.swift:70:7:70:7 | { ... } | BraceStmt |
-| expressions.swift:71:3:71:11 | var ... = ... | PatternBindingDecl | expressions.swift:71:7:71:11 | ... as ... | TypedPattern |
-| expressions.swift:71:7:71:7 | get | AccessorDecl | expressions.swift:71:7:71:7 | self | ParamDecl |
-| expressions.swift:71:7:71:7 | get | AccessorDecl | expressions.swift:71:7:71:7 | { ... } | BraceStmt |
-| expressions.swift:71:7:71:7 | xx | ConcreteVarDecl | expressions.swift:71:7:71:7 | get | AccessorDecl |
-| expressions.swift:71:7:71:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| expressions.swift:71:7:71:11 | ... as ... | TypedPattern | expressions.swift:71:7:71:7 | xx | NamedPattern |
-| expressions.swift:71:7:71:11 | ... as ... | TypedPattern | expressions.swift:71:11:71:11 | Int | TypeRepr |
-| expressions.swift:72:3:74:3 | init | ConstructorDecl | expressions.swift:72:3:72:3 | self | ParamDecl |
-| expressions.swift:72:3:74:3 | init | ConstructorDecl | expressions.swift:72:8:72:11 | x | ParamDecl |
-| expressions.swift:72:3:74:3 | init | ConstructorDecl | expressions.swift:72:16:74:3 | { ... } | BraceStmt |
-| expressions.swift:72:16:74:3 | { ... } | BraceStmt | expressions.swift:73:5:73:10 |  ... = ... | AssignExpr |
-| expressions.swift:72:16:74:3 | { ... } | BraceStmt | expressions.swift:74:3:74:3 | return | ReturnStmt |
-| expressions.swift:73:5:73:5 | .xx | MemberRefExpr | expressions.swift:73:5:73:5 | self | DeclRefExpr |
-| expressions.swift:73:5:73:10 |  ... = ... | AssignExpr | expressions.swift:73:5:73:5 | .xx | MemberRefExpr |
-| expressions.swift:73:5:73:10 |  ... = ... | AssignExpr | expressions.swift:73:10:73:10 | x | DeclRefExpr |
-| expressions.swift:77:7:77:7 | call to _unimplementedInitializer(className:initName:file:line:column:) | CallExpr | expressions.swift:77:7:77:7 | _unimplementedInitializer(className:initName:file:line:column:) | DeclRefExpr |
-| expressions.swift:77:7:77:7 | deinit | DestructorDecl | expressions.swift:77:7:77:7 | self | ParamDecl |
-| expressions.swift:77:7:77:7 | deinit | DestructorDecl | expressions.swift:77:7:77:7 | { ... } | BraceStmt |
-| expressions.swift:77:21:77:21 | init | ConstructorDecl | expressions.swift:77:21:77:21 | self | ParamDecl |
-| expressions.swift:77:21:77:21 | init | ConstructorDecl | file://:0:0:0:0 | x | ParamDecl |
-| expressions.swift:77:21:77:21 | init | ConstructorDecl | file://:0:0:0:0 | { ... } | BraceStmt |
-| expressions.swift:78:3:80:3 | init | ConstructorDecl | expressions.swift:78:10:80:3 | { ... } | BraceStmt |
-| expressions.swift:78:10:80:3 | { ... } | BraceStmt | expressions.swift:79:5:79:21 | self = ... | RebindSelfInConstructorExpr |
-| expressions.swift:78:10:80:3 | { ... } | BraceStmt | expressions.swift:80:3:80:3 | return | ReturnStmt |
-| expressions.swift:79:5:79:11 | call to ... | DotSyntaxCallExpr | expressions.swift:79:11:79:11 | init | OtherConstructorDeclRefExpr |
-| expressions.swift:79:5:79:21 | call to ... | CallExpr | expressions.swift:79:5:79:11 | call to ... | DotSyntaxCallExpr |
-| expressions.swift:79:5:79:21 | self = ... | RebindSelfInConstructorExpr | expressions.swift:79:5:79:21 | call to ... | CallExpr |
-| expressions.swift:83:1:83:23 | var ... = ... | PatternBindingDecl | expressions.swift:83:5:83:5 | derived | NamedPattern |
-| expressions.swift:83:1:83:23 | var ... = ... | PatternBindingDecl | expressions.swift:83:15:83:23 | call to init | CallExpr |
-| expressions.swift:83:1:83:23 | { ... } | BraceStmt | expressions.swift:83:1:83:23 | var ... = ... | PatternBindingDecl |
-| expressions.swift:83:1:83:23 | { ... } | TopLevelCodeDecl | expressions.swift:83:1:83:23 | { ... } | BraceStmt |
-| expressions.swift:83:15:83:15 | Derived.Type | TypeExpr | expressions.swift:83:15:83:15 | Derived | TypeRepr |
-| expressions.swift:83:15:83:15 | call to init | ConstructorRefCallExpr | expressions.swift:83:15:83:15 | init | DeclRefExpr |
-| expressions.swift:83:15:83:23 | call to init | CallExpr | expressions.swift:83:15:83:15 | call to init | ConstructorRefCallExpr |
-| expressions.swift:84:1:84:13 |  ... = ... | AssignExpr | expressions.swift:84:1:84:1 | _ | DiscardAssignmentExpr |
-| expressions.swift:84:1:84:13 |  ... = ... | AssignExpr | expressions.swift:84:5:84:13 | .xx | MemberRefExpr |
-| expressions.swift:84:1:84:13 | { ... } | BraceStmt | expressions.swift:84:1:84:13 |  ... = ... | AssignExpr |
-| expressions.swift:84:1:84:13 | { ... } | TopLevelCodeDecl | expressions.swift:84:1:84:13 | { ... } | BraceStmt |
-| expressions.swift:84:5:84:5 | (Base) ... | DerivedToBaseExpr | expressions.swift:84:5:84:5 | derived | DeclRefExpr |
-| expressions.swift:84:5:84:13 | .xx | MemberRefExpr | expressions.swift:84:5:84:5 | (Base) ... | DerivedToBaseExpr |
-| expressions.swift:86:1:86:13 | var ... = ... | PatternBindingDecl | expressions.swift:86:5:86:13 | ... as ... | TypedPattern |
-| expressions.swift:86:1:86:13 | var ... = ... | PatternBindingDecl | file://:0:0:0:0 | nil | NilLiteralExpr |
-| expressions.swift:86:1:86:13 | { ... } | BraceStmt | expressions.swift:86:1:86:13 | var ... = ... | PatternBindingDecl |
-| expressions.swift:86:1:86:13 | { ... } | TopLevelCodeDecl | expressions.swift:86:1:86:13 | { ... } | BraceStmt |
-| expressions.swift:86:5:86:13 | ... as ... | TypedPattern | expressions.swift:86:5:86:5 | opt | NamedPattern |
-| expressions.swift:86:5:86:13 | ... as ... | TypedPattern | expressions.swift:86:10:86:13 | Int? | TypeRepr |
-| expressions.swift:87:1:87:4 | ...! | ForceValueExpr | expressions.swift:87:1:87:1 | opt | DeclRefExpr |
-| expressions.swift:87:1:87:4 | { ... } | BraceStmt | expressions.swift:87:1:87:4 | ...! | ForceValueExpr |
-| expressions.swift:87:1:87:4 | { ... } | TopLevelCodeDecl | expressions.swift:87:1:87:4 | { ... } | BraceStmt |
-| expressions.swift:88:1:88:6 | ...[...] | SubscriptExpr | expressions.swift:88:1:88:1 | d | DeclRefExpr |
-| expressions.swift:88:1:88:7 | ...! | ForceValueExpr | expressions.swift:88:1:88:6 | ...[...] | SubscriptExpr |
-| expressions.swift:88:1:88:7 | { ... } | BraceStmt | expressions.swift:88:1:88:7 | ...! | ForceValueExpr |
-| expressions.swift:88:1:88:7 | { ... } | TopLevelCodeDecl | expressions.swift:88:1:88:7 | { ... } | BraceStmt |
-| expressions.swift:90:7:90:7 | deinit | DestructorDecl | expressions.swift:90:7:90:7 | self | ParamDecl |
-| expressions.swift:90:7:90:7 | deinit | DestructorDecl | expressions.swift:90:7:90:7 | { ... } | BraceStmt |
-| expressions.swift:90:7:90:7 | init | ConstructorDecl | expressions.swift:90:7:90:7 | self | ParamDecl |
-| expressions.swift:90:7:90:7 | init | ConstructorDecl | expressions.swift:90:7:90:7 | { ... } | BraceStmt |
-| expressions.swift:90:7:90:7 | { ... } | BraceStmt | expressions.swift:90:7:90:7 | return | ReturnStmt |
-| expressions.swift:92:1:92:55 | var ... = ... | PatternBindingDecl | expressions.swift:92:5:92:5 | opaque | NamedPattern |
-| expressions.swift:92:1:92:55 | var ... = ... | PatternBindingDecl | expressions.swift:92:14:92:55 | call to toOpaque() | CallExpr |
-| expressions.swift:92:1:92:55 | { ... } | BraceStmt | expressions.swift:92:1:92:55 | var ... = ... | PatternBindingDecl |
-| expressions.swift:92:1:92:55 | { ... } | TopLevelCodeDecl | expressions.swift:92:1:92:55 | { ... } | BraceStmt |
-| expressions.swift:92:14:92:14 | Unmanaged<ToPtr>.Type | TypeExpr | expressions.swift:92:14:92:14 | Unmanaged<ToPtr> | TypeRepr |
-| expressions.swift:92:14:92:44 | call to passRetained(_:) | CallExpr | expressions.swift:92:14:92:24 | .passRetained(_:) | MethodRefExpr |
-| expressions.swift:92:14:92:55 | call to toOpaque() | CallExpr | expressions.swift:92:14:92:46 | .toOpaque() | MethodRefExpr |
-| expressions.swift:92:37:92:37 | ToPtr.Type | TypeExpr | expressions.swift:92:37:92:37 | ToPtr | TypeRepr |
-| expressions.swift:92:37:92:37 | call to init | ConstructorRefCallExpr | expressions.swift:92:37:92:37 | init | DeclRefExpr |
-| expressions.swift:92:37:92:43 | call to init | CallExpr | expressions.swift:92:37:92:37 | call to init | ConstructorRefCallExpr |
-| expressions.swift:93:1:93:16 | Unmanaged<ToPtr>.Type | TypeExpr | expressions.swift:93:1:93:16 | Unmanaged<ToPtr> | TypeRepr |
-| expressions.swift:93:1:93:35 | call to fromOpaque(_:) | CallExpr | expressions.swift:93:1:93:18 | .fromOpaque(_:) | MethodRefExpr |
-| expressions.swift:93:1:93:35 | { ... } | BraceStmt | expressions.swift:93:1:93:35 | call to fromOpaque(_:) | CallExpr |
-| expressions.swift:93:1:93:35 | { ... } | TopLevelCodeDecl | expressions.swift:93:1:93:35 | { ... } | BraceStmt |
-| expressions.swift:93:29:93:29 | (UnsafeRawPointer) ... | PointerToPointerExpr | expressions.swift:93:29:93:29 | opaque | DeclRefExpr |
-| expressions.swift:95:8:95:8 | init | ConstructorDecl | expressions.swift:95:8:95:8 | normalField | ParamDecl |
-| expressions.swift:95:8:95:8 | init | ConstructorDecl | expressions.swift:95:8:95:8 | self | ParamDecl |
-| expressions.swift:96:3:101:3 | var ... = ... | PatternBindingDecl | expressions.swift:96:7:96:22 | ... as ... | TypedPattern |
-| expressions.swift:96:7:96:7 | (unnamed function decl) | AccessorDecl | expressions.swift:96:7:96:7 | self | ParamDecl |
-| expressions.swift:96:7:96:7 | (unnamed function decl) | AccessorDecl | expressions.swift:96:7:96:7 | { ... } | BraceStmt |
-| expressions.swift:96:7:96:7 | settableField | ConcreteVarDecl | expressions.swift:96:7:96:7 | (unnamed function decl) | AccessorDecl |
-| expressions.swift:96:7:96:7 | settableField | ConcreteVarDecl | expressions.swift:97:5:97:11 | set | AccessorDecl |
-| expressions.swift:96:7:96:7 | settableField | ConcreteVarDecl | expressions.swift:98:5:100:5 | get | AccessorDecl |
-| expressions.swift:96:7:96:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| expressions.swift:96:7:96:7 | { ... } | BraceStmt | expressions.swift:96:7:96:7 | yield ... | YieldStmt |
-| expressions.swift:96:7:96:22 | ... as ... | TypedPattern | expressions.swift:96:7:96:7 | settableField | NamedPattern |
-| expressions.swift:96:7:96:22 | ... as ... | TypedPattern | expressions.swift:96:22:96:22 | Int | TypeRepr |
-| expressions.swift:97:5:97:11 | set | AccessorDecl | expressions.swift:97:5:97:5 | newValue | ParamDecl |
-| expressions.swift:97:5:97:11 | set | AccessorDecl | expressions.swift:97:5:97:5 | self | ParamDecl |
-| expressions.swift:97:5:97:11 | set | AccessorDecl | expressions.swift:97:9:97:11 | { ... } | BraceStmt |
-| expressions.swift:98:5:100:5 | get | AccessorDecl | expressions.swift:98:5:98:5 | self | ParamDecl |
-| expressions.swift:98:5:100:5 | get | AccessorDecl | expressions.swift:98:9:100:5 | { ... } | BraceStmt |
-| expressions.swift:98:9:100:5 | { ... } | BraceStmt | expressions.swift:99:7:99:14 | return ... | ReturnStmt |
-| expressions.swift:99:7:99:14 | return ... | ReturnStmt | expressions.swift:99:14:99:14 | 0 | IntegerLiteralExpr |
-| expressions.swift:105:3:107:3 | var ... = ... | PatternBindingDecl | expressions.swift:105:7:105:23 | ... as ... | TypedPattern |
-| expressions.swift:105:7:105:7 | readOnlyField1 | ConcreteVarDecl | expressions.swift:105:27:107:3 | get | AccessorDecl |
-| expressions.swift:105:7:105:23 | ... as ... | TypedPattern | expressions.swift:105:7:105:7 | readOnlyField1 | NamedPattern |
-| expressions.swift:105:7:105:23 | ... as ... | TypedPattern | expressions.swift:105:23:105:23 | Int | TypeRepr |
-| expressions.swift:105:27:107:3 | get | AccessorDecl | expressions.swift:105:27:105:27 | self | ParamDecl |
-| expressions.swift:105:27:107:3 | get | AccessorDecl | expressions.swift:105:27:107:3 | { ... } | BraceStmt |
-| expressions.swift:105:27:107:3 | { ... } | BraceStmt | expressions.swift:106:5:106:12 | return ... | ReturnStmt |
-| expressions.swift:106:5:106:12 | return ... | ReturnStmt | expressions.swift:106:12:106:12 | 0 | IntegerLiteralExpr |
-| expressions.swift:110:3:114:3 | var ... = ... | PatternBindingDecl | expressions.swift:110:7:110:23 | ... as ... | TypedPattern |
-| expressions.swift:110:7:110:7 | readOnlyField2 | ConcreteVarDecl | expressions.swift:111:5:113:5 | get | AccessorDecl |
-| expressions.swift:110:7:110:23 | ... as ... | TypedPattern | expressions.swift:110:7:110:7 | readOnlyField2 | NamedPattern |
-| expressions.swift:110:7:110:23 | ... as ... | TypedPattern | expressions.swift:110:23:110:23 | Int | TypeRepr |
-| expressions.swift:111:5:113:5 | get | AccessorDecl | expressions.swift:111:5:111:5 | self | ParamDecl |
-| expressions.swift:111:5:113:5 | get | AccessorDecl | expressions.swift:111:9:113:5 | { ... } | BraceStmt |
-| expressions.swift:111:9:113:5 | { ... } | BraceStmt | expressions.swift:112:7:112:14 | return ... | ReturnStmt |
-| expressions.swift:112:7:112:14 | return ... | ReturnStmt | expressions.swift:112:14:112:14 | 0 | IntegerLiteralExpr |
-| expressions.swift:116:3:116:21 | var ... = ... | PatternBindingDecl | expressions.swift:116:7:116:21 | ... as ... | TypedPattern |
-| expressions.swift:116:7:116:7 | (unnamed function decl) | AccessorDecl | expressions.swift:116:7:116:7 | self | ParamDecl |
-| expressions.swift:116:7:116:7 | (unnamed function decl) | AccessorDecl | expressions.swift:116:7:116:7 | { ... } | BraceStmt |
-| expressions.swift:116:7:116:7 | get | AccessorDecl | expressions.swift:116:7:116:7 | self | ParamDecl |
-| expressions.swift:116:7:116:7 | get | AccessorDecl | expressions.swift:116:7:116:7 | { ... } | BraceStmt |
-| expressions.swift:116:7:116:7 | normalField | ConcreteVarDecl | expressions.swift:116:7:116:7 | (unnamed function decl) | AccessorDecl |
-| expressions.swift:116:7:116:7 | normalField | ConcreteVarDecl | expressions.swift:116:7:116:7 | get | AccessorDecl |
-| expressions.swift:116:7:116:7 | normalField | ConcreteVarDecl | expressions.swift:116:7:116:7 | set | AccessorDecl |
-| expressions.swift:116:7:116:7 | set | AccessorDecl | expressions.swift:116:7:116:7 | self | ParamDecl |
-| expressions.swift:116:7:116:7 | set | AccessorDecl | expressions.swift:116:7:116:7 | value | ParamDecl |
-| expressions.swift:116:7:116:7 | set | AccessorDecl | expressions.swift:116:7:116:7 | { ... } | BraceStmt |
-| expressions.swift:116:7:116:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| expressions.swift:116:7:116:7 | { ... } | BraceStmt | expressions.swift:116:7:116:7 | yield ... | YieldStmt |
-| expressions.swift:116:7:116:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| expressions.swift:116:7:116:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| expressions.swift:116:7:116:21 | ... as ... | TypedPattern | expressions.swift:116:7:116:7 | normalField | NamedPattern |
-| expressions.swift:116:7:116:21 | ... as ... | TypedPattern | expressions.swift:116:21:116:21 | Int | TypeRepr |
-| expressions.swift:118:3:118:3 | (unnamed function decl) | AccessorDecl | expressions.swift:118:3:118:3 | self | ParamDecl |
-| expressions.swift:118:3:118:3 | (unnamed function decl) | AccessorDecl | expressions.swift:118:3:118:3 | { ... } | BraceStmt |
-| expressions.swift:118:3:118:3 | (unnamed function decl) | AccessorDecl | file://:0:0:0:0 | x | ParamDecl |
-| expressions.swift:118:3:118:3 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| expressions.swift:118:3:118:3 | { ... } | BraceStmt | expressions.swift:118:3:118:3 | yield ... | YieldStmt |
-| expressions.swift:118:3:123:3 | subscript ... | SubscriptDecl | expressions.swift:118:3:118:3 | (unnamed function decl) | AccessorDecl |
-| expressions.swift:118:3:123:3 | subscript ... | SubscriptDecl | expressions.swift:118:13:118:16 | x | ParamDecl |
-| expressions.swift:118:3:123:3 | subscript ... | SubscriptDecl | expressions.swift:119:5:121:5 | get | AccessorDecl |
-| expressions.swift:118:3:123:3 | subscript ... | SubscriptDecl | expressions.swift:122:5:122:11 | set | AccessorDecl |
-| expressions.swift:119:5:121:5 | get | AccessorDecl | expressions.swift:118:13:118:13 | x | ParamDecl |
-| expressions.swift:119:5:121:5 | get | AccessorDecl | expressions.swift:119:5:119:5 | self | ParamDecl |
-| expressions.swift:119:5:121:5 | get | AccessorDecl | expressions.swift:119:9:121:5 | { ... } | BraceStmt |
-| expressions.swift:119:9:121:5 | { ... } | BraceStmt | expressions.swift:120:7:120:14 | return ... | ReturnStmt |
-| expressions.swift:120:7:120:14 | return ... | ReturnStmt | expressions.swift:120:14:120:14 | 0 | IntegerLiteralExpr |
-| expressions.swift:122:5:122:11 | set | AccessorDecl | expressions.swift:118:13:118:13 | x | ParamDecl |
-| expressions.swift:122:5:122:11 | set | AccessorDecl | expressions.swift:122:5:122:5 | newValue | ParamDecl |
-| expressions.swift:122:5:122:11 | set | AccessorDecl | expressions.swift:122:5:122:5 | self | ParamDecl |
-| expressions.swift:122:5:122:11 | set | AccessorDecl | expressions.swift:122:9:122:11 | { ... } | BraceStmt |
-| expressions.swift:125:3:127:3 | subscript ... | SubscriptDecl | expressions.swift:125:13:125:16 | x | ParamDecl |
-| expressions.swift:125:3:127:3 | subscript ... | SubscriptDecl | expressions.swift:125:21:125:25 | y | ParamDecl |
-| expressions.swift:125:3:127:3 | subscript ... | SubscriptDecl | expressions.swift:125:37:127:3 | get | AccessorDecl |
-| expressions.swift:125:37:127:3 | get | AccessorDecl | expressions.swift:125:13:125:13 | x | ParamDecl |
-| expressions.swift:125:37:127:3 | get | AccessorDecl | expressions.swift:125:21:125:21 | y | ParamDecl |
-| expressions.swift:125:37:127:3 | get | AccessorDecl | expressions.swift:125:37:125:37 | self | ParamDecl |
-| expressions.swift:125:37:127:3 | get | AccessorDecl | expressions.swift:125:37:127:3 | { ... } | BraceStmt |
-| expressions.swift:125:37:127:3 | { ... } | BraceStmt | expressions.swift:126:5:126:12 | return ... | ReturnStmt |
-| expressions.swift:126:5:126:12 | return ... | ReturnStmt | expressions.swift:126:12:126:12 | 0 | IntegerLiteralExpr |
-| expressions.swift:130:1:139:1 | testProperties(hp:) | ConcreteFuncDecl | expressions.swift:130:21:130:32 | hp | ParamDecl |
-| expressions.swift:130:1:139:1 | testProperties(hp:) | ConcreteFuncDecl | expressions.swift:130:52:139:1 | { ... } | BraceStmt |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:131:3:131:22 |  ... = ... | AssignExpr |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:132:3:132:14 | var ... = ... | PatternBindingDecl |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:132:7:132:7 | x | ConcreteVarDecl |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:133:3:133:14 | var ... = ... | PatternBindingDecl |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:133:7:133:7 | y | ConcreteVarDecl |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:134:3:134:14 | var ... = ... | PatternBindingDecl |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:134:7:134:7 | z | ConcreteVarDecl |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:135:3:135:20 |  ... = ... | AssignExpr |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:136:3:136:14 | var ... = ... | PatternBindingDecl |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:136:7:136:7 | w | ConcreteVarDecl |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:137:3:137:11 |  ... = ... | AssignExpr |
-| expressions.swift:130:52:139:1 | { ... } | BraceStmt | expressions.swift:138:3:138:17 | return ... | ReturnStmt |
-| expressions.swift:131:3:131:6 | .settableField | MemberRefExpr | expressions.swift:131:3:131:3 | hp | DeclRefExpr |
-| expressions.swift:131:3:131:22 |  ... = ... | AssignExpr | expressions.swift:131:3:131:6 | .settableField | MemberRefExpr |
-| expressions.swift:131:3:131:22 |  ... = ... | AssignExpr | expressions.swift:131:22:131:22 | 42 | IntegerLiteralExpr |
-| expressions.swift:132:3:132:14 | var ... = ... | PatternBindingDecl | expressions.swift:132:7:132:7 | x | NamedPattern |
-| expressions.swift:132:3:132:14 | var ... = ... | PatternBindingDecl | expressions.swift:132:11:132:14 | (Int) ... | LoadExpr |
-| expressions.swift:132:11:132:14 | (Int) ... | LoadExpr | expressions.swift:132:11:132:14 | .settableField | MemberRefExpr |
-| expressions.swift:132:11:132:14 | .settableField | MemberRefExpr | expressions.swift:132:11:132:11 | hp | DeclRefExpr |
-| expressions.swift:133:3:133:14 | var ... = ... | PatternBindingDecl | expressions.swift:133:7:133:7 | y | NamedPattern |
-| expressions.swift:133:3:133:14 | var ... = ... | PatternBindingDecl | expressions.swift:133:11:133:14 | .readOnlyField1 | MemberRefExpr |
-| expressions.swift:133:11:133:11 | (HasProperty) ... | LoadExpr | expressions.swift:133:11:133:11 | hp | DeclRefExpr |
-| expressions.swift:133:11:133:14 | .readOnlyField1 | MemberRefExpr | expressions.swift:133:11:133:11 | (HasProperty) ... | LoadExpr |
-| expressions.swift:134:3:134:14 | var ... = ... | PatternBindingDecl | expressions.swift:134:7:134:7 | z | NamedPattern |
-| expressions.swift:134:3:134:14 | var ... = ... | PatternBindingDecl | expressions.swift:134:11:134:14 | .readOnlyField2 | MemberRefExpr |
-| expressions.swift:134:11:134:11 | (HasProperty) ... | LoadExpr | expressions.swift:134:11:134:11 | hp | DeclRefExpr |
-| expressions.swift:134:11:134:14 | .readOnlyField2 | MemberRefExpr | expressions.swift:134:11:134:11 | (HasProperty) ... | LoadExpr |
-| expressions.swift:135:3:135:6 | .normalField | MemberRefExpr | expressions.swift:135:3:135:3 | hp | DeclRefExpr |
-| expressions.swift:135:3:135:20 |  ... = ... | AssignExpr | expressions.swift:135:3:135:6 | .normalField | MemberRefExpr |
-| expressions.swift:135:3:135:20 |  ... = ... | AssignExpr | expressions.swift:135:20:135:20 | 99 | IntegerLiteralExpr |
-| expressions.swift:136:3:136:14 | var ... = ... | PatternBindingDecl | expressions.swift:136:7:136:7 | w | NamedPattern |
-| expressions.swift:136:3:136:14 | var ... = ... | PatternBindingDecl | expressions.swift:136:11:136:14 | (Int) ... | LoadExpr |
-| expressions.swift:136:11:136:14 | (Int) ... | LoadExpr | expressions.swift:136:11:136:14 | .normalField | MemberRefExpr |
-| expressions.swift:136:11:136:14 | .normalField | MemberRefExpr | expressions.swift:136:11:136:11 | hp | DeclRefExpr |
-| expressions.swift:137:3:137:3 | &... | InOutExpr | expressions.swift:137:3:137:3 | hp | DeclRefExpr |
-| expressions.swift:137:3:137:7 | ...[...] | SubscriptExpr | expressions.swift:137:3:137:3 | &... | InOutExpr |
-| expressions.swift:137:3:137:11 |  ... = ... | AssignExpr | expressions.swift:137:3:137:7 | ...[...] | SubscriptExpr |
-| expressions.swift:137:3:137:11 |  ... = ... | AssignExpr | expressions.swift:137:11:137:11 | 2 | IntegerLiteralExpr |
-| expressions.swift:138:3:138:17 | return ... | ReturnStmt | expressions.swift:138:10:138:17 | ...[...] | SubscriptExpr |
-| expressions.swift:138:10:138:10 | (HasProperty) ... | LoadExpr | expressions.swift:138:10:138:10 | hp | DeclRefExpr |
-| expressions.swift:138:10:138:17 | ...[...] | SubscriptExpr | expressions.swift:138:10:138:10 | (HasProperty) ... | LoadExpr |
-| expressions.swift:141:8:141:8 | init | ConstructorDecl | expressions.swift:141:8:141:8 | self | ParamDecl |
-| expressions.swift:141:8:141:8 | init | ConstructorDecl | expressions.swift:141:8:141:8 | x | ParamDecl |
-| expressions.swift:142:3:142:11 | var ... = ... | PatternBindingDecl | expressions.swift:142:7:142:11 | ... as ... | TypedPattern |
-| expressions.swift:142:7:142:7 | (unnamed function decl) | AccessorDecl | expressions.swift:142:7:142:7 | self | ParamDecl |
-| expressions.swift:142:7:142:7 | (unnamed function decl) | AccessorDecl | expressions.swift:142:7:142:7 | { ... } | BraceStmt |
-| expressions.swift:142:7:142:7 | get | AccessorDecl | expressions.swift:142:7:142:7 | self | ParamDecl |
-| expressions.swift:142:7:142:7 | get | AccessorDecl | expressions.swift:142:7:142:7 | { ... } | BraceStmt |
-| expressions.swift:142:7:142:7 | set | AccessorDecl | expressions.swift:142:7:142:7 | self | ParamDecl |
-| expressions.swift:142:7:142:7 | set | AccessorDecl | expressions.swift:142:7:142:7 | value | ParamDecl |
-| expressions.swift:142:7:142:7 | set | AccessorDecl | expressions.swift:142:7:142:7 | { ... } | BraceStmt |
-| expressions.swift:142:7:142:7 | x | ConcreteVarDecl | expressions.swift:142:7:142:7 | (unnamed function decl) | AccessorDecl |
-| expressions.swift:142:7:142:7 | x | ConcreteVarDecl | expressions.swift:142:7:142:7 | get | AccessorDecl |
-| expressions.swift:142:7:142:7 | x | ConcreteVarDecl | expressions.swift:142:7:142:7 | set | AccessorDecl |
-| expressions.swift:142:7:142:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| expressions.swift:142:7:142:7 | { ... } | BraceStmt | expressions.swift:142:7:142:7 | yield ... | YieldStmt |
-| expressions.swift:142:7:142:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| expressions.swift:142:7:142:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| expressions.swift:142:7:142:11 | ... as ... | TypedPattern | expressions.swift:142:7:142:7 | x | NamedPattern |
-| expressions.swift:142:7:142:11 | ... as ... | TypedPattern | expressions.swift:142:11:142:11 | Int | TypeRepr |
-| expressions.swift:145:8:145:8 | init | ConstructorDecl | expressions.swift:145:8:145:8 | b | ParamDecl |
-| expressions.swift:145:8:145:8 | init | ConstructorDecl | expressions.swift:145:8:145:8 | bs | ParamDecl |
-| expressions.swift:145:8:145:8 | init | ConstructorDecl | expressions.swift:145:8:145:8 | mayB | ParamDecl |
-| expressions.swift:145:8:145:8 | init | ConstructorDecl | expressions.swift:145:8:145:8 | self | ParamDecl |
-| expressions.swift:146:3:146:11 | var ... = ... | PatternBindingDecl | expressions.swift:146:7:146:11 | ... as ... | TypedPattern |
-| expressions.swift:146:7:146:7 | (unnamed function decl) | AccessorDecl | expressions.swift:146:7:146:7 | self | ParamDecl |
-| expressions.swift:146:7:146:7 | (unnamed function decl) | AccessorDecl | expressions.swift:146:7:146:7 | { ... } | BraceStmt |
-| expressions.swift:146:7:146:7 | b | ConcreteVarDecl | expressions.swift:146:7:146:7 | (unnamed function decl) | AccessorDecl |
-| expressions.swift:146:7:146:7 | b | ConcreteVarDecl | expressions.swift:146:7:146:7 | get | AccessorDecl |
-| expressions.swift:146:7:146:7 | b | ConcreteVarDecl | expressions.swift:146:7:146:7 | set | AccessorDecl |
-| expressions.swift:146:7:146:7 | get | AccessorDecl | expressions.swift:146:7:146:7 | self | ParamDecl |
-| expressions.swift:146:7:146:7 | get | AccessorDecl | expressions.swift:146:7:146:7 | { ... } | BraceStmt |
-| expressions.swift:146:7:146:7 | set | AccessorDecl | expressions.swift:146:7:146:7 | self | ParamDecl |
-| expressions.swift:146:7:146:7 | set | AccessorDecl | expressions.swift:146:7:146:7 | value | ParamDecl |
-| expressions.swift:146:7:146:7 | set | AccessorDecl | expressions.swift:146:7:146:7 | { ... } | BraceStmt |
-| expressions.swift:146:7:146:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| expressions.swift:146:7:146:7 | { ... } | BraceStmt | expressions.swift:146:7:146:7 | yield ... | YieldStmt |
-| expressions.swift:146:7:146:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| expressions.swift:146:7:146:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| expressions.swift:146:7:146:11 | ... as ... | TypedPattern | expressions.swift:146:7:146:7 | b | NamedPattern |
-| expressions.swift:146:7:146:11 | ... as ... | TypedPattern | expressions.swift:146:11:146:11 | B | TypeRepr |
-| expressions.swift:147:3:147:14 | var ... = ... | PatternBindingDecl | expressions.swift:147:7:147:14 | ... as ... | TypedPattern |
-| expressions.swift:147:7:147:7 | (unnamed function decl) | AccessorDecl | expressions.swift:147:7:147:7 | self | ParamDecl |
-| expressions.swift:147:7:147:7 | (unnamed function decl) | AccessorDecl | expressions.swift:147:7:147:7 | { ... } | BraceStmt |
-| expressions.swift:147:7:147:7 | bs | ConcreteVarDecl | expressions.swift:147:7:147:7 | (unnamed function decl) | AccessorDecl |
-| expressions.swift:147:7:147:7 | bs | ConcreteVarDecl | expressions.swift:147:7:147:7 | get | AccessorDecl |
-| expressions.swift:147:7:147:7 | bs | ConcreteVarDecl | expressions.swift:147:7:147:7 | set | AccessorDecl |
-| expressions.swift:147:7:147:7 | get | AccessorDecl | expressions.swift:147:7:147:7 | self | ParamDecl |
-| expressions.swift:147:7:147:7 | get | AccessorDecl | expressions.swift:147:7:147:7 | { ... } | BraceStmt |
-| expressions.swift:147:7:147:7 | set | AccessorDecl | expressions.swift:147:7:147:7 | self | ParamDecl |
-| expressions.swift:147:7:147:7 | set | AccessorDecl | expressions.swift:147:7:147:7 | value | ParamDecl |
-| expressions.swift:147:7:147:7 | set | AccessorDecl | expressions.swift:147:7:147:7 | { ... } | BraceStmt |
-| expressions.swift:147:7:147:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| expressions.swift:147:7:147:7 | { ... } | BraceStmt | expressions.swift:147:7:147:7 | yield ... | YieldStmt |
-| expressions.swift:147:7:147:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| expressions.swift:147:7:147:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| expressions.swift:147:7:147:14 | ... as ... | TypedPattern | expressions.swift:147:7:147:7 | bs | NamedPattern |
-| expressions.swift:147:7:147:14 | ... as ... | TypedPattern | expressions.swift:147:12:147:14 | [B] | TypeRepr |
-| expressions.swift:148:3:148:15 | var ... = ... | PatternBindingDecl | expressions.swift:148:7:148:15 | ... as ... | TypedPattern |
-| expressions.swift:148:3:148:15 | var ... = ... | PatternBindingDecl | file://:0:0:0:0 | nil | NilLiteralExpr |
-| expressions.swift:148:7:148:7 | (unnamed function decl) | AccessorDecl | expressions.swift:148:7:148:7 | self | ParamDecl |
-| expressions.swift:148:7:148:7 | (unnamed function decl) | AccessorDecl | expressions.swift:148:7:148:7 | { ... } | BraceStmt |
-| expressions.swift:148:7:148:7 | get | AccessorDecl | expressions.swift:148:7:148:7 | self | ParamDecl |
-| expressions.swift:148:7:148:7 | get | AccessorDecl | expressions.swift:148:7:148:7 | { ... } | BraceStmt |
-| expressions.swift:148:7:148:7 | mayB | ConcreteVarDecl | expressions.swift:148:7:148:7 | (unnamed function decl) | AccessorDecl |
-| expressions.swift:148:7:148:7 | mayB | ConcreteVarDecl | expressions.swift:148:7:148:7 | get | AccessorDecl |
-| expressions.swift:148:7:148:7 | mayB | ConcreteVarDecl | expressions.swift:148:7:148:7 | set | AccessorDecl |
-| expressions.swift:148:7:148:7 | set | AccessorDecl | expressions.swift:148:7:148:7 | self | ParamDecl |
-| expressions.swift:148:7:148:7 | set | AccessorDecl | expressions.swift:148:7:148:7 | value | ParamDecl |
-| expressions.swift:148:7:148:7 | set | AccessorDecl | expressions.swift:148:7:148:7 | { ... } | BraceStmt |
-| expressions.swift:148:7:148:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| expressions.swift:148:7:148:7 | { ... } | BraceStmt | expressions.swift:148:7:148:7 | yield ... | YieldStmt |
-| expressions.swift:148:7:148:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| expressions.swift:148:7:148:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| expressions.swift:148:7:148:15 | ... as ... | TypedPattern | expressions.swift:148:7:148:7 | mayB | NamedPattern |
-| expressions.swift:148:7:148:15 | ... as ... | TypedPattern | expressions.swift:148:14:148:15 | B? | TypeRepr |
-| expressions.swift:151:1:155:1 | test(a:keyPathInt:keyPathB:) | ConcreteFuncDecl | expressions.swift:151:11:151:15 | a | ParamDecl |
-| expressions.swift:151:1:155:1 | test(a:keyPathInt:keyPathB:) | ConcreteFuncDecl | expressions.swift:151:18:151:53 | keyPathInt | ParamDecl |
-| expressions.swift:151:1:155:1 | test(a:keyPathInt:keyPathB:) | ConcreteFuncDecl | expressions.swift:151:56:151:87 | keyPathB | ParamDecl |
-| expressions.swift:151:1:155:1 | test(a:keyPathInt:keyPathB:) | ConcreteFuncDecl | expressions.swift:151:90:155:1 | { ... } | BraceStmt |
-| expressions.swift:151:90:155:1 | { ... } | BraceStmt | expressions.swift:152:3:152:47 | var ... = ... | PatternBindingDecl |
-| expressions.swift:151:90:155:1 | { ... } | BraceStmt | expressions.swift:152:7:152:7 | apply_keyPathInt | ConcreteVarDecl |
-| expressions.swift:151:90:155:1 | { ... } | BraceStmt | expressions.swift:153:3:153:43 | var ... = ... | PatternBindingDecl |
-| expressions.swift:151:90:155:1 | { ... } | BraceStmt | expressions.swift:153:7:153:7 | apply_keyPathB | ConcreteVarDecl |
-| expressions.swift:151:90:155:1 | { ... } | BraceStmt | expressions.swift:154:3:154:56 | var ... = ... | PatternBindingDecl |
-| expressions.swift:151:90:155:1 | { ... } | BraceStmt | expressions.swift:154:7:154:7 | nested_apply | ConcreteVarDecl |
-| expressions.swift:152:3:152:47 | var ... = ... | PatternBindingDecl | expressions.swift:152:7:152:7 | apply_keyPathInt | NamedPattern |
-| expressions.swift:152:3:152:47 | var ... = ... | PatternBindingDecl | expressions.swift:152:26:152:47 | \\...[...] | KeyPathApplicationExpr |
-| expressions.swift:152:26:152:47 | \\...[...] | KeyPathApplicationExpr | expressions.swift:152:26:152:26 | a | DeclRefExpr |
-| expressions.swift:152:26:152:47 | \\...[...] | KeyPathApplicationExpr | expressions.swift:152:37:152:37 | keyPathInt | DeclRefExpr |
-| expressions.swift:153:3:153:43 | var ... = ... | PatternBindingDecl | expressions.swift:153:7:153:7 | apply_keyPathB | NamedPattern |
-| expressions.swift:153:3:153:43 | var ... = ... | PatternBindingDecl | expressions.swift:153:24:153:43 | \\...[...] | KeyPathApplicationExpr |
-| expressions.swift:153:24:153:43 | \\...[...] | KeyPathApplicationExpr | expressions.swift:153:24:153:24 | a | DeclRefExpr |
-| expressions.swift:153:24:153:43 | \\...[...] | KeyPathApplicationExpr | expressions.swift:153:35:153:35 | keyPathB | DeclRefExpr |
-| expressions.swift:154:3:154:56 | var ... = ... | PatternBindingDecl | expressions.swift:154:7:154:7 | nested_apply | NamedPattern |
-| expressions.swift:154:3:154:56 | var ... = ... | PatternBindingDecl | expressions.swift:154:22:154:56 | \\...[...] | KeyPathApplicationExpr |
-| expressions.swift:154:22:154:41 | \\...[...] | KeyPathApplicationExpr | expressions.swift:154:22:154:22 | a | DeclRefExpr |
-| expressions.swift:154:22:154:41 | \\...[...] | KeyPathApplicationExpr | expressions.swift:154:33:154:33 | keyPathB | DeclRefExpr |
-| expressions.swift:154:22:154:56 | \\...[...] | KeyPathApplicationExpr | expressions.swift:154:22:154:41 | \\...[...] | KeyPathApplicationExpr |
-| expressions.swift:154:22:154:56 | \\...[...] | KeyPathApplicationExpr | expressions.swift:154:52:154:55 | #keyPath(...) | KeyPathExpr |
-| expressions.swift:154:52:154:55 | #keyPath(...) | KeyPathExpr | expressions.swift:154:53:154:53 | B | TypeRepr |
-| patterns.swift:1:1:7:1 | basic_patterns() | ConcreteFuncDecl | patterns.swift:1:23:7:1 | { ... } | BraceStmt |
-| patterns.swift:1:23:7:1 | { ... } | BraceStmt | patterns.swift:2:5:2:18 | var ... = ... | PatternBindingDecl |
-| patterns.swift:1:23:7:1 | { ... } | BraceStmt | patterns.swift:2:9:2:9 | an_int | ConcreteVarDecl |
-| patterns.swift:1:23:7:1 | { ... } | BraceStmt | patterns.swift:3:5:3:28 | var ... = ... | PatternBindingDecl |
-| patterns.swift:1:23:7:1 | { ... } | BraceStmt | patterns.swift:3:9:3:9 | a_string | ConcreteVarDecl |
-| patterns.swift:1:23:7:1 | { ... } | BraceStmt | patterns.swift:4:5:4:29 | var ... = ... | PatternBindingDecl |
-| patterns.swift:1:23:7:1 | { ... } | BraceStmt | patterns.swift:4:10:4:10 | x | ConcreteVarDecl |
-| patterns.swift:1:23:7:1 | { ... } | BraceStmt | patterns.swift:4:13:4:13 | y | ConcreteVarDecl |
-| patterns.swift:1:23:7:1 | { ... } | BraceStmt | patterns.swift:4:16:4:16 | z | ConcreteVarDecl |
-| patterns.swift:1:23:7:1 | { ... } | BraceStmt | patterns.swift:5:5:5:13 | var ... = ... | PatternBindingDecl |
-| patterns.swift:1:23:7:1 | { ... } | BraceStmt | patterns.swift:6:5:6:15 | var ... = ... | PatternBindingDecl |
-| patterns.swift:2:5:2:18 | var ... = ... | PatternBindingDecl | patterns.swift:2:9:2:9 | an_int | NamedPattern |
-| patterns.swift:2:5:2:18 | var ... = ... | PatternBindingDecl | patterns.swift:2:18:2:18 | 42 | IntegerLiteralExpr |
-| patterns.swift:3:5:3:28 | var ... = ... | PatternBindingDecl | patterns.swift:3:9:3:19 | ... as ... | TypedPattern |
-| patterns.swift:3:5:3:28 | var ... = ... | PatternBindingDecl | patterns.swift:3:28:3:28 | here | StringLiteralExpr |
-| patterns.swift:3:9:3:19 | ... as ... | TypedPattern | patterns.swift:3:9:3:9 | a_string | NamedPattern |
-| patterns.swift:3:9:3:19 | ... as ... | TypedPattern | patterns.swift:3:19:3:19 | String | TypeRepr |
-| patterns.swift:4:5:4:29 | var ... = ... | PatternBindingDecl | patterns.swift:4:9:4:17 | (...) | TuplePattern |
-| patterns.swift:4:5:4:29 | var ... = ... | PatternBindingDecl | patterns.swift:4:21:4:29 | (...) | TupleExpr |
-| patterns.swift:4:9:4:17 | (...) | TuplePattern | patterns.swift:4:10:4:10 | x | NamedPattern |
-| patterns.swift:4:9:4:17 | (...) | TuplePattern | patterns.swift:4:13:4:13 | y | NamedPattern |
-| patterns.swift:4:9:4:17 | (...) | TuplePattern | patterns.swift:4:16:4:16 | z | NamedPattern |
-| patterns.swift:4:21:4:29 | (...) | TupleExpr | patterns.swift:4:22:4:22 | 1 | IntegerLiteralExpr |
-| patterns.swift:4:21:4:29 | (...) | TupleExpr | patterns.swift:4:25:4:25 | 2 | IntegerLiteralExpr |
-| patterns.swift:4:21:4:29 | (...) | TupleExpr | patterns.swift:4:28:4:28 | 3 | IntegerLiteralExpr |
-| patterns.swift:5:5:5:13 | var ... = ... | PatternBindingDecl | patterns.swift:5:9:5:9 | _ | AnyPattern |
-| patterns.swift:5:5:5:13 | var ... = ... | PatternBindingDecl | patterns.swift:5:13:5:13 | any | StringLiteralExpr |
-| patterns.swift:6:5:6:15 | var ... = ... | PatternBindingDecl | patterns.swift:6:9:6:11 | (...) | ParenPattern |
-| patterns.swift:6:5:6:15 | var ... = ... | PatternBindingDecl | patterns.swift:6:15:6:15 | paren | StringLiteralExpr |
-| patterns.swift:6:9:6:11 | (...) | ParenPattern | patterns.swift:6:10:6:10 | _ | AnyPattern |
-| patterns.swift:9:1:52:1 | switch_patterns() | ConcreteFuncDecl | patterns.swift:9:24:52:1 | { ... } | BraceStmt |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:10:5:10:22 | var ... = ... | PatternBindingDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:10:9:10:9 | point | ConcreteVarDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:11:5:13:5 | switch point { ... } | SwitchStmt |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:15:5:18:5 | switch 3 { ... } | SwitchStmt |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:20:5:22:5 | Foo | EnumDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:24:5:24:19 | var ... = ... | PatternBindingDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:24:9:24:9 | v | ConcreteVarDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:26:5:29:5 | switch v { ... } | SwitchStmt |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:31:5:31:19 | var ... = ... | PatternBindingDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:31:9:31:9 | w | ConcreteVarDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:33:5:36:5 | switch w { ... } | SwitchStmt |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:38:5:38:18 | var ... = ... | PatternBindingDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:38:9:38:9 | a | ConcreteVarDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:40:5:44:5 | switch a { ... } | SwitchStmt |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:46:5:46:13 | var ... = ... | PatternBindingDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:46:9:46:9 | b | ConcreteVarDecl |
-| patterns.swift:9:24:52:1 | { ... } | BraceStmt | patterns.swift:48:5:51:5 | switch b { ... } | SwitchStmt |
-| patterns.swift:10:5:10:22 | var ... = ... | PatternBindingDecl | patterns.swift:10:9:10:9 | point | NamedPattern |
-| patterns.swift:10:5:10:22 | var ... = ... | PatternBindingDecl | patterns.swift:10:17:10:22 | (...) | TupleExpr |
-| patterns.swift:10:17:10:22 | (...) | TupleExpr | patterns.swift:10:18:10:18 | 1 | IntegerLiteralExpr |
-| patterns.swift:10:17:10:22 | (...) | TupleExpr | patterns.swift:10:21:10:21 | 2 | IntegerLiteralExpr |
-| patterns.swift:11:5:13:5 | switch point { ... } | SwitchStmt | patterns.swift:11:12:11:12 | point | DeclRefExpr |
-| patterns.swift:11:5:13:5 | switch point { ... } | SwitchStmt | patterns.swift:12:5:12:24 | case ... | CaseStmt |
-| patterns.swift:12:5:12:24 | case ... | CaseStmt | patterns.swift:12:10:12:21 | let ... | CaseLabelItem |
-| patterns.swift:12:5:12:24 | case ... | CaseStmt | patterns.swift:12:24:12:24 | { ... } | BraceStmt |
-| patterns.swift:12:10:12:21 | let ... | BindingPattern | patterns.swift:12:14:12:21 | (...) | TuplePattern |
-| patterns.swift:12:10:12:21 | let ... | CaseLabelItem | patterns.swift:12:10:12:21 | let ... | BindingPattern |
-| patterns.swift:12:14:12:21 | (...) | TuplePattern | patterns.swift:12:15:12:15 | xx | NamedPattern |
-| patterns.swift:12:14:12:21 | (...) | TuplePattern | patterns.swift:12:19:12:19 | yy | NamedPattern |
-| patterns.swift:12:24:12:24 | { ... } | BraceStmt | patterns.swift:12:24:12:24 | binding | StringLiteralExpr |
-| patterns.swift:15:5:18:5 | switch 3 { ... } | SwitchStmt | patterns.swift:15:12:15:12 | 3 | IntegerLiteralExpr |
-| patterns.swift:15:5:18:5 | switch 3 { ... } | SwitchStmt | patterns.swift:16:5:16:17 | case ... | CaseStmt |
-| patterns.swift:15:5:18:5 | switch 3 { ... } | SwitchStmt | patterns.swift:17:5:17:13 | case ... | CaseStmt |
-| patterns.swift:16:5:16:17 | case ... | CaseStmt | patterns.swift:16:10:16:14 | =~ ... | CaseLabelItem |
-| patterns.swift:16:5:16:17 | case ... | CaseStmt | patterns.swift:16:17:16:17 | { ... } | BraceStmt |
-| patterns.swift:16:10:16:14 | =~ ... | CaseLabelItem | patterns.swift:16:10:16:14 | =~ ... | ExprPattern |
-| patterns.swift:16:10:16:14 | =~ ... | ExprPattern | patterns.swift:16:10:16:14 | SequenceExpr | SequenceExpr |
-| patterns.swift:16:10:16:14 | SequenceExpr | SequenceExpr | patterns.swift:16:10:16:10 | 1 | IntegerLiteralExpr |
-| patterns.swift:16:10:16:14 | SequenceExpr | SequenceExpr | patterns.swift:16:12:16:12 | OverloadedDeclRefExpr | OverloadedDeclRefExpr |
-| patterns.swift:16:10:16:14 | SequenceExpr | SequenceExpr | patterns.swift:16:14:16:14 | 2 | IntegerLiteralExpr |
-| patterns.swift:16:17:16:17 | { ... } | BraceStmt | patterns.swift:16:17:16:17 | expr | StringLiteralExpr |
-| patterns.swift:17:5:17:13 | case ... | CaseStmt | patterns.swift:17:10:17:10 | _ | CaseLabelItem |
-| patterns.swift:17:5:17:13 | case ... | CaseStmt | patterns.swift:17:13:17:13 | { ... } | BraceStmt |
-| patterns.swift:17:10:17:10 | _ | CaseLabelItem | patterns.swift:17:10:17:10 | _ | AnyPattern |
-| patterns.swift:17:13:17:13 | { ... } | BraceStmt | patterns.swift:17:13:17:13 |  | StringLiteralExpr |
-| patterns.swift:21:9:21:34 | case ... | EnumCaseDecl | patterns.swift:21:14:21:14 | bar | EnumElementDecl |
-| patterns.swift:21:9:21:34 | case ... | EnumCaseDecl | patterns.swift:21:19:21:34 | baz | EnumElementDecl |
-| patterns.swift:21:19:21:34 | baz | EnumElementDecl | patterns.swift:21:23:21:23 | _ | ParamDecl |
-| patterns.swift:21:19:21:34 | baz | EnumElementDecl | patterns.swift:21:28:21:28 | _ | ParamDecl |
-| patterns.swift:24:5:24:19 | var ... = ... | PatternBindingDecl | patterns.swift:24:9:24:12 | ... as ... | TypedPattern |
-| patterns.swift:24:5:24:19 | var ... = ... | PatternBindingDecl | patterns.swift:24:18:24:19 | .bar | MethodRefExpr |
-| patterns.swift:24:9:24:12 | ... as ... | TypedPattern | patterns.swift:24:9:24:9 | v | NamedPattern |
-| patterns.swift:24:9:24:12 | ... as ... | TypedPattern | patterns.swift:24:12:24:12 | Foo | TypeRepr |
-| patterns.swift:24:18:24:18 | Foo.Type | TypeExpr | patterns.swift:24:18:24:18 | Foo | TypeRepr |
-| patterns.swift:26:5:29:5 | switch v { ... } | SwitchStmt | patterns.swift:26:12:26:12 | v | DeclRefExpr |
-| patterns.swift:26:5:29:5 | switch v { ... } | SwitchStmt | patterns.swift:27:5:27:16 | case ... | CaseStmt |
-| patterns.swift:26:5:29:5 | switch v { ... } | SwitchStmt | patterns.swift:28:5:28:26 | case ... | CaseStmt |
-| patterns.swift:27:5:27:16 | case ... | CaseStmt | patterns.swift:27:10:27:11 | .bar | CaseLabelItem |
-| patterns.swift:27:5:27:16 | case ... | CaseStmt | patterns.swift:27:16:27:16 | { ... } | BraceStmt |
-| patterns.swift:27:10:27:11 | .bar | CaseLabelItem | patterns.swift:27:10:27:11 | .bar | EnumElementPattern |
-| patterns.swift:27:16:27:16 | { ... } | BraceStmt | patterns.swift:27:16:27:16 | bar | StringLiteralExpr |
-| patterns.swift:28:5:28:26 | case ... | CaseStmt | patterns.swift:28:10:28:23 | let ... | CaseLabelItem |
-| patterns.swift:28:5:28:26 | case ... | CaseStmt | patterns.swift:28:26:28:26 | { ... } | BraceStmt |
-| patterns.swift:28:10:28:23 | let ... | BindingPattern | patterns.swift:28:14:28:23 | .baz(...) | EnumElementPattern |
-| patterns.swift:28:10:28:23 | let ... | CaseLabelItem | patterns.swift:28:10:28:23 | let ... | BindingPattern |
-| patterns.swift:28:14:28:23 | .baz(...) | EnumElementPattern | patterns.swift:28:18:28:23 | (...) | TuplePattern |
-| patterns.swift:28:18:28:23 | (...) | TuplePattern | patterns.swift:28:19:28:19 | i | NamedPattern |
-| patterns.swift:28:18:28:23 | (...) | TuplePattern | patterns.swift:28:22:28:22 | s | NamedPattern |
-| patterns.swift:28:26:28:26 | { ... } | BraceStmt | patterns.swift:28:26:28:26 | i | DeclRefExpr |
-| patterns.swift:31:5:31:19 | var ... = ... | PatternBindingDecl | patterns.swift:31:9:31:15 | ... as ... | TypedPattern |
-| patterns.swift:31:5:31:19 | var ... = ... | PatternBindingDecl | patterns.swift:31:19:31:19 | nil | NilLiteralExpr |
-| patterns.swift:31:9:31:15 | ... as ... | TypedPattern | patterns.swift:31:9:31:9 | w | NamedPattern |
-| patterns.swift:31:9:31:15 | ... as ... | TypedPattern | patterns.swift:31:12:31:15 | Int? | TypeRepr |
-| patterns.swift:33:5:36:5 | switch w { ... } | SwitchStmt | patterns.swift:33:12:33:12 | w | DeclRefExpr |
-| patterns.swift:33:5:36:5 | switch w { ... } | SwitchStmt | patterns.swift:34:5:34:18 | case ... | CaseStmt |
-| patterns.swift:33:5:36:5 | switch w { ... } | SwitchStmt | patterns.swift:35:5:35:13 | case ... | CaseStmt |
-| patterns.swift:34:5:34:18 | case ... | CaseStmt | patterns.swift:34:10:34:15 | let ... | CaseLabelItem |
-| patterns.swift:34:5:34:18 | case ... | CaseStmt | patterns.swift:34:18:34:18 | { ... } | BraceStmt |
-| patterns.swift:34:10:34:15 | let ... | BindingPattern | patterns.swift:34:14:34:15 | let ...? | OptionalSomePattern |
-| patterns.swift:34:10:34:15 | let ... | CaseLabelItem | patterns.swift:34:10:34:15 | let ... | BindingPattern |
-| patterns.swift:34:14:34:15 | let ...? | OptionalSomePattern | patterns.swift:34:14:34:14 | n | NamedPattern |
-| patterns.swift:34:18:34:18 | { ... } | BraceStmt | patterns.swift:34:18:34:18 | n | DeclRefExpr |
-| patterns.swift:35:5:35:13 | case ... | CaseStmt | patterns.swift:35:10:35:10 | _ | CaseLabelItem |
-| patterns.swift:35:5:35:13 | case ... | CaseStmt | patterns.swift:35:13:35:13 | { ... } | BraceStmt |
-| patterns.swift:35:10:35:10 | _ | CaseLabelItem | patterns.swift:35:10:35:10 | _ | AnyPattern |
-| patterns.swift:35:13:35:13 | { ... } | BraceStmt | patterns.swift:35:13:35:13 | none | StringLiteralExpr |
-| patterns.swift:38:5:38:18 | var ... = ... | PatternBindingDecl | patterns.swift:38:9:38:12 | ... as ... | TypedPattern |
-| patterns.swift:38:5:38:18 | var ... = ... | PatternBindingDecl | patterns.swift:38:18:38:18 | (Any) ... | ErasureExpr |
-| patterns.swift:38:9:38:12 | ... as ... | TypedPattern | patterns.swift:38:9:38:9 | a | NamedPattern |
-| patterns.swift:38:9:38:12 | ... as ... | TypedPattern | patterns.swift:38:12:38:12 | Any | TypeRepr |
-| patterns.swift:38:18:38:18 | (Any) ... | ErasureExpr | patterns.swift:38:18:38:18 | any | StringLiteralExpr |
-| patterns.swift:40:5:44:5 | switch a { ... } | SwitchStmt | patterns.swift:40:12:40:12 | a | DeclRefExpr |
-| patterns.swift:40:5:44:5 | switch a { ... } | SwitchStmt | patterns.swift:41:5:41:18 | case ... | CaseStmt |
-| patterns.swift:40:5:44:5 | switch a { ... } | SwitchStmt | patterns.swift:42:5:42:27 | case ... | CaseStmt |
-| patterns.swift:40:5:44:5 | switch a { ... } | SwitchStmt | patterns.swift:43:5:43:13 | case ... | CaseStmt |
-| patterns.swift:41:5:41:18 | case ... | CaseStmt | patterns.swift:41:10:41:13 | ... is ... | CaseLabelItem |
-| patterns.swift:41:5:41:18 | case ... | CaseStmt | patterns.swift:41:18:41:18 | { ... } | BraceStmt |
-| patterns.swift:41:10:41:13 | ... is ... | CaseLabelItem | patterns.swift:41:10:41:13 | ... is ... | IsPattern |
-| patterns.swift:41:10:41:13 | ... is ... | IsPattern | patterns.swift:41:13:41:13 | Int | TypeRepr |
-| patterns.swift:41:18:41:18 | { ... } | BraceStmt | patterns.swift:41:18:41:18 | is pattern | StringLiteralExpr |
-| patterns.swift:42:5:42:27 | case ... | CaseStmt | patterns.swift:42:10:42:19 | let ... | CaseLabelItem |
-| patterns.swift:42:5:42:27 | case ... | CaseStmt | patterns.swift:42:27:42:27 | { ... } | BraceStmt |
-| patterns.swift:42:10:42:19 | let ... | BindingPattern | patterns.swift:42:14:42:19 | ... is ... | IsPattern |
-| patterns.swift:42:10:42:19 | let ... | CaseLabelItem | patterns.swift:42:10:42:19 | let ... | BindingPattern |
-| patterns.swift:42:14:42:19 | ... is ... | IsPattern | patterns.swift:42:14:42:14 | x | NamedPattern |
-| patterns.swift:42:14:42:19 | ... is ... | IsPattern | patterns.swift:42:19:42:19 | String | TypeRepr |
-| patterns.swift:42:27:42:27 | { ... } | BraceStmt | patterns.swift:42:27:42:27 | as pattern | StringLiteralExpr |
-| patterns.swift:43:5:43:13 | case ... | CaseStmt | patterns.swift:43:10:43:10 | _ | CaseLabelItem |
-| patterns.swift:43:5:43:13 | case ... | CaseStmt | patterns.swift:43:13:43:13 | { ... } | BraceStmt |
-| patterns.swift:43:10:43:10 | _ | CaseLabelItem | patterns.swift:43:10:43:10 | _ | AnyPattern |
-| patterns.swift:43:13:43:13 | { ... } | BraceStmt | patterns.swift:43:13:43:13 | other | StringLiteralExpr |
-| patterns.swift:46:5:46:13 | var ... = ... | PatternBindingDecl | patterns.swift:46:9:46:9 | b | NamedPattern |
-| patterns.swift:46:5:46:13 | var ... = ... | PatternBindingDecl | patterns.swift:46:13:46:13 | true | BooleanLiteralExpr |
-| patterns.swift:48:5:51:5 | switch b { ... } | SwitchStmt | patterns.swift:48:12:48:12 | b | DeclRefExpr |
-| patterns.swift:48:5:51:5 | switch b { ... } | SwitchStmt | patterns.swift:49:5:49:16 | case ... | CaseStmt |
-| patterns.swift:48:5:51:5 | switch b { ... } | SwitchStmt | patterns.swift:50:5:50:17 | case ... | CaseStmt |
-| patterns.swift:49:5:49:16 | case ... | CaseStmt | patterns.swift:49:10:49:10 | true | CaseLabelItem |
-| patterns.swift:49:5:49:16 | case ... | CaseStmt | patterns.swift:49:16:49:16 | { ... } | BraceStmt |
-| patterns.swift:49:10:49:10 | true | CaseLabelItem | patterns.swift:49:10:49:10 | true | BoolPattern |
-| patterns.swift:49:16:49:16 | { ... } | BraceStmt | patterns.swift:49:16:49:16 | true | StringLiteralExpr |
-| patterns.swift:50:5:50:17 | case ... | CaseStmt | patterns.swift:50:10:50:10 | false | CaseLabelItem |
-| patterns.swift:50:5:50:17 | case ... | CaseStmt | patterns.swift:50:17:50:17 | { ... } | BraceStmt |
-| patterns.swift:50:10:50:10 | false | CaseLabelItem | patterns.swift:50:10:50:10 | false | BoolPattern |
-| patterns.swift:50:17:50:17 | { ... } | BraceStmt | patterns.swift:50:17:50:17 | false | StringLiteralExpr |
-| statements.swift:1:1:32:1 | loop() | ConcreteFuncDecl | statements.swift:1:13:32:1 | { ... } | BraceStmt |
-| statements.swift:1:13:32:1 | { ... } | BraceStmt | statements.swift:2:3:8:3 | for ... in ... { ... } | ForEachStmt |
-| statements.swift:1:13:32:1 | { ... } | BraceStmt | statements.swift:9:3:9:11 | var ... = ... | PatternBindingDecl |
-| statements.swift:1:13:32:1 | { ... } | BraceStmt | statements.swift:9:7:9:7 | i | ConcreteVarDecl |
-| statements.swift:1:13:32:1 | { ... } | BraceStmt | statements.swift:10:3:12:3 | while ... { ... } | WhileStmt |
-| statements.swift:1:13:32:1 | { ... } | BraceStmt | statements.swift:14:3:14:7 |  ... = ... | AssignExpr |
-| statements.swift:1:13:32:1 | { ... } | BraceStmt | statements.swift:15:3:17:18 | repeat { ... } while ...  | RepeatWhileStmt |
-| statements.swift:1:13:32:1 | { ... } | BraceStmt | statements.swift:19:3:23:3 | do { ... } catch { ... } | DoCatchStmt |
-| statements.swift:1:13:32:1 | { ... } | BraceStmt | statements.swift:25:3:31:3 | do { ... } catch { ... } | DoCatchStmt |
-| statements.swift:2:3:8:3 | for ... in ... { ... } | ForEachStmt | statements.swift:2:15:2:15 | i | NamedPattern |
-| statements.swift:2:3:8:3 | for ... in ... { ... } | ForEachStmt | statements.swift:2:20:2:24 | ... ....(_:_:) ... | BinaryExpr |
-| statements.swift:2:3:8:3 | for ... in ... { ... } | ForEachStmt | statements.swift:2:26:8:3 | { ... } | BraceStmt |
-| statements.swift:2:20:2:24 | ... ....(_:_:) ... | BinaryExpr | statements.swift:2:21:2:21 | ....(_:_:) | MethodRefExpr |
-| statements.swift:2:21:2:21 | Int.Type | TypeExpr | statements.swift:2:21:2:21 | Int | TypeRepr |
-| statements.swift:2:26:8:3 | { ... } | BraceStmt | statements.swift:3:5:7:5 | if ... then { ... } else { ... } | IfStmt |
-| statements.swift:3:5:7:5 | if ... then { ... } else { ... } | IfStmt | statements.swift:3:8:3:13 | StmtCondition | StmtCondition |
-| statements.swift:3:5:7:5 | if ... then { ... } else { ... } | IfStmt | statements.swift:3:15:5:5 | { ... } | BraceStmt |
-| statements.swift:3:5:7:5 | if ... then { ... } else { ... } | IfStmt | statements.swift:5:12:7:5 | { ... } | BraceStmt |
-| statements.swift:3:8:3:13 | ... .==(_:_:) ... | BinaryExpr | statements.swift:3:10:3:10 | .==(_:_:) | MethodRefExpr |
-| statements.swift:3:10:3:10 | Int.Type | TypeExpr | statements.swift:3:10:3:10 | Int | TypeRepr |
-| statements.swift:3:15:5:5 | { ... } | BraceStmt | statements.swift:4:9:4:9 | break | BreakStmt |
-| statements.swift:5:12:7:5 | { ... } | BraceStmt | statements.swift:6:9:6:9 | continue | ContinueStmt |
-| statements.swift:9:3:9:11 | var ... = ... | PatternBindingDecl | statements.swift:9:7:9:7 | i | NamedPattern |
-| statements.swift:9:3:9:11 | var ... = ... | PatternBindingDecl | statements.swift:9:11:9:11 | 0 | IntegerLiteralExpr |
-| statements.swift:10:3:12:3 | while ... { ... } | WhileStmt | statements.swift:10:17:10:24 | StmtCondition | StmtCondition |
-| statements.swift:10:3:12:3 | while ... { ... } | WhileStmt | statements.swift:10:26:12:3 | { ... } | BraceStmt |
-| statements.swift:10:17:10:24 | (...) | ParenExpr | statements.swift:10:18:10:22 | ... .<(_:_:) ... | BinaryExpr |
-| statements.swift:10:18:10:18 | (Int) ... | LoadExpr | statements.swift:10:18:10:18 | i | DeclRefExpr |
-| statements.swift:10:18:10:22 | ... .<(_:_:) ... | BinaryExpr | statements.swift:10:20:10:20 | .<(_:_:) | MethodRefExpr |
-| statements.swift:10:20:10:20 | Int.Type | TypeExpr | statements.swift:10:20:10:20 | Int | TypeRepr |
-| statements.swift:10:26:12:3 | { ... } | BraceStmt | statements.swift:11:5:11:13 |  ... = ... | AssignExpr |
-| statements.swift:11:5:11:13 |  ... = ... | AssignExpr | statements.swift:11:5:11:5 | i | DeclRefExpr |
-| statements.swift:11:5:11:13 |  ... = ... | AssignExpr | statements.swift:11:9:11:13 | ... .+(_:_:) ... | BinaryExpr |
-| statements.swift:11:9:11:9 | (Int) ... | LoadExpr | statements.swift:11:9:11:9 | i | DeclRefExpr |
-| statements.swift:11:9:11:13 | ... .+(_:_:) ... | BinaryExpr | statements.swift:11:11:11:11 | .+(_:_:) | MethodRefExpr |
-| statements.swift:11:11:11:11 | Int.Type | TypeExpr | statements.swift:11:11:11:11 | Int | TypeRepr |
-| statements.swift:14:3:14:7 |  ... = ... | AssignExpr | statements.swift:14:3:14:3 | i | DeclRefExpr |
-| statements.swift:14:3:14:7 |  ... = ... | AssignExpr | statements.swift:14:7:14:7 | 0 | IntegerLiteralExpr |
-| statements.swift:15:3:17:18 | repeat { ... } while ...  | RepeatWhileStmt | statements.swift:15:18:17:3 | { ... } | BraceStmt |
-| statements.swift:15:3:17:18 | repeat { ... } while ...  | RepeatWhileStmt | statements.swift:17:11:17:18 | (...) | ParenExpr |
-| statements.swift:15:18:17:3 | { ... } | BraceStmt | statements.swift:16:5:16:13 |  ... = ... | AssignExpr |
-| statements.swift:16:5:16:13 |  ... = ... | AssignExpr | statements.swift:16:5:16:5 | i | DeclRefExpr |
-| statements.swift:16:5:16:13 |  ... = ... | AssignExpr | statements.swift:16:9:16:13 | ... .+(_:_:) ... | BinaryExpr |
-| statements.swift:16:9:16:9 | (Int) ... | LoadExpr | statements.swift:16:9:16:9 | i | DeclRefExpr |
-| statements.swift:16:9:16:13 | ... .+(_:_:) ... | BinaryExpr | statements.swift:16:11:16:11 | .+(_:_:) | MethodRefExpr |
-| statements.swift:16:11:16:11 | Int.Type | TypeExpr | statements.swift:16:11:16:11 | Int | TypeRepr |
-| statements.swift:17:11:17:18 | (...) | ParenExpr | statements.swift:17:12:17:16 | ... .<(_:_:) ... | BinaryExpr |
-| statements.swift:17:12:17:12 | (Int) ... | LoadExpr | statements.swift:17:12:17:12 | i | DeclRefExpr |
-| statements.swift:17:12:17:16 | ... .<(_:_:) ... | BinaryExpr | statements.swift:17:14:17:14 | .<(_:_:) | MethodRefExpr |
-| statements.swift:17:14:17:14 | Int.Type | TypeExpr | statements.swift:17:14:17:14 | Int | TypeRepr |
-| statements.swift:19:3:23:3 | do { ... } catch { ... } | DoCatchStmt | statements.swift:19:6:21:3 | { ... } | BraceStmt |
-| statements.swift:19:3:23:3 | do { ... } catch { ... } | DoCatchStmt | statements.swift:21:5:23:3 | case ... | CaseStmt |
-| statements.swift:19:6:21:3 | { ... } | BraceStmt | statements.swift:20:5:20:19 | try ... | TryExpr |
-| statements.swift:20:5:20:19 | try ... | TryExpr | statements.swift:20:9:20:19 | call to failure(_:) | CallExpr |
-| statements.swift:20:9:20:19 | call to failure(_:) | CallExpr | statements.swift:20:9:20:9 | failure(_:) | DeclRefExpr |
-| statements.swift:21:5:23:3 | case ... | CaseStmt | statements.swift:21:11:21:11 | let ... | CaseLabelItem |
-| statements.swift:21:5:23:3 | case ... | CaseStmt | statements.swift:21:11:23:3 | { ... } | BraceStmt |
-| statements.swift:21:11:21:11 | let ... | BindingPattern | statements.swift:21:11:21:11 | error | NamedPattern |
-| statements.swift:21:11:21:11 | let ... | CaseLabelItem | statements.swift:21:11:21:11 | let ... | BindingPattern |
-| statements.swift:21:11:23:3 | { ... } | BraceStmt | statements.swift:22:5:22:18 | call to print(_:separator:terminator:) | CallExpr |
-| statements.swift:22:5:22:18 | call to print(_:separator:terminator:) | CallExpr | statements.swift:22:5:22:5 | print(_:separator:terminator:) | DeclRefExpr |
-| statements.swift:22:11:22:11 | (Any) ... | ErasureExpr | statements.swift:22:11:22:11 | error | StringLiteralExpr |
-| statements.swift:22:11:22:11 | [...] | ArrayExpr | statements.swift:22:11:22:11 | (Any) ... | ErasureExpr |
-| statements.swift:22:11:22:11 | [...] | VarargExpansionExpr | statements.swift:22:11:22:11 | [...] | ArrayExpr |
-| statements.swift:25:3:31:3 | do { ... } catch { ... } | DoCatchStmt | statements.swift:25:6:27:3 | { ... } | BraceStmt |
-| statements.swift:25:3:31:3 | do { ... } catch { ... } | DoCatchStmt | statements.swift:27:5:29:3 | case ... | CaseStmt |
-| statements.swift:25:3:31:3 | do { ... } catch { ... } | DoCatchStmt | statements.swift:29:5:31:3 | case ... | CaseStmt |
-| statements.swift:25:6:27:3 | { ... } | BraceStmt | statements.swift:26:5:26:19 | try ... | TryExpr |
-| statements.swift:26:5:26:19 | try ... | TryExpr | statements.swift:26:9:26:19 | call to failure(_:) | CallExpr |
-| statements.swift:26:9:26:19 | call to failure(_:) | CallExpr | statements.swift:26:9:26:9 | failure(_:) | DeclRefExpr |
-| statements.swift:27:5:29:3 | case ... | CaseStmt | statements.swift:27:11:27:11 | ... is ... | CaseLabelItem |
-| statements.swift:27:5:29:3 | case ... | CaseStmt | statements.swift:27:26:29:3 | { ... } | BraceStmt |
-| statements.swift:27:11:27:11 | ... is ... | CaseLabelItem | statements.swift:27:11:27:11 | ... is ... | IsPattern |
-| statements.swift:27:11:27:11 | ... is ... | IsPattern | statements.swift:27:11:27:19 | .failed | EnumElementPattern |
-| statements.swift:27:26:29:3 | { ... } | BraceStmt | statements.swift:28:5:28:27 | call to print(_:separator:terminator:) | CallExpr |
-| statements.swift:28:5:28:27 | call to print(_:separator:terminator:) | CallExpr | statements.swift:28:5:28:5 | print(_:separator:terminator:) | DeclRefExpr |
-| statements.swift:28:11:28:11 | (Any) ... | ErasureExpr | statements.swift:28:11:28:11 | AnError.failed | StringLiteralExpr |
-| statements.swift:28:11:28:11 | [...] | ArrayExpr | statements.swift:28:11:28:11 | (Any) ... | ErasureExpr |
-| statements.swift:28:11:28:11 | [...] | VarargExpansionExpr | statements.swift:28:11:28:11 | [...] | ArrayExpr |
-| statements.swift:29:5:31:3 | case ... | CaseStmt | statements.swift:29:11:29:11 | let ... | CaseLabelItem |
-| statements.swift:29:5:31:3 | case ... | CaseStmt | statements.swift:29:11:31:3 | { ... } | BraceStmt |
-| statements.swift:29:11:29:11 | let ... | BindingPattern | statements.swift:29:11:29:11 | error | NamedPattern |
-| statements.swift:29:11:29:11 | let ... | CaseLabelItem | statements.swift:29:11:29:11 | let ... | BindingPattern |
-| statements.swift:29:11:31:3 | { ... } | BraceStmt | statements.swift:30:5:30:18 | call to print(_:separator:terminator:) | CallExpr |
-| statements.swift:30:5:30:18 | call to print(_:separator:terminator:) | CallExpr | statements.swift:30:5:30:5 | print(_:separator:terminator:) | DeclRefExpr |
-| statements.swift:30:11:30:11 | (Any) ... | ErasureExpr | statements.swift:30:11:30:11 | error | StringLiteralExpr |
-| statements.swift:30:11:30:11 | [...] | ArrayExpr | statements.swift:30:11:30:11 | (Any) ... | ErasureExpr |
-| statements.swift:30:11:30:11 | [...] | VarargExpansionExpr | statements.swift:30:11:30:11 | [...] | ArrayExpr |
-| statements.swift:35:3:35:8 | case ... | EnumCaseDecl | statements.swift:35:8:35:8 | failed | EnumElementDecl |
-| statements.swift:38:1:42:1 | failure(_:) | ConcreteFuncDecl | statements.swift:38:14:38:19 | x | ParamDecl |
-| statements.swift:38:1:42:1 | failure(_:) | ConcreteFuncDecl | statements.swift:38:31:42:1 | { ... } | BraceStmt |
-| statements.swift:38:31:42:1 | { ... } | BraceStmt | statements.swift:39:3:41:3 | guard ... else { ... } | GuardStmt |
-| statements.swift:39:3:41:3 | guard ... else { ... } | GuardStmt | statements.swift:39:9:39:14 | StmtCondition | StmtCondition |
-| statements.swift:39:3:41:3 | guard ... else { ... } | GuardStmt | statements.swift:39:21:41:3 | { ... } | BraceStmt |
-| statements.swift:39:9:39:14 | ... .!=(_:_:) ... | BinaryExpr | statements.swift:39:11:39:11 | .!=(_:_:) | MethodRefExpr |
-| statements.swift:39:11:39:11 | Int.Type | TypeExpr | statements.swift:39:11:39:11 | Int | TypeRepr |
-| statements.swift:39:21:41:3 | { ... } | BraceStmt | statements.swift:40:5:40:19 | throw ... | ThrowStmt |
-| statements.swift:40:5:40:19 | throw ... | ThrowStmt | statements.swift:40:11:40:19 | (Error) ... | ErasureExpr |
-| statements.swift:40:11:40:11 | AnError.Type | TypeExpr | statements.swift:40:11:40:11 | AnError | TypeRepr |
-| statements.swift:40:11:40:19 | (Error) ... | ErasureExpr | statements.swift:40:11:40:19 | .failed | MethodRefExpr |
-| statements.swift:44:1:46:1 | defer { ... } | DeferStmt | statements.swift:44:7:46:1 | { ... } | BraceStmt |
-| statements.swift:44:1:46:1 | { ... } | BraceStmt | statements.swift:44:1:46:1 | defer { ... } | DeferStmt |
-| statements.swift:44:1:46:1 | { ... } | TopLevelCodeDecl | statements.swift:44:1:46:1 | { ... } | BraceStmt |
-| statements.swift:44:7:46:1 | { ... } | BraceStmt | statements.swift:45:3:45:15 | call to print(_:separator:terminator:) | CallExpr |
-| statements.swift:45:3:45:15 | call to print(_:separator:terminator:) | CallExpr | statements.swift:45:3:45:3 | print(_:separator:terminator:) | DeclRefExpr |
-| statements.swift:45:9:45:9 | (Any) ... | ErasureExpr | statements.swift:45:9:45:9 | done | StringLiteralExpr |
-| statements.swift:45:9:45:9 | [...] | ArrayExpr | statements.swift:45:9:45:9 | (Any) ... | ErasureExpr |
-| statements.swift:45:9:45:9 | [...] | VarargExpansionExpr | statements.swift:45:9:45:9 | [...] | ArrayExpr |
-| statements.swift:48:1:50:1 | do { ... } | DoStmt | statements.swift:48:4:50:1 | { ... } | BraceStmt |
-| statements.swift:48:1:50:1 | { ... } | BraceStmt | statements.swift:48:1:50:1 | do { ... } | DoStmt |
-| statements.swift:48:1:50:1 | { ... } | TopLevelCodeDecl | statements.swift:48:1:50:1 | { ... } | BraceStmt |
-| statements.swift:48:4:50:1 | { ... } | BraceStmt | statements.swift:49:3:49:16 | call to print(_:separator:terminator:) | CallExpr |
-| statements.swift:49:3:49:16 | call to print(_:separator:terminator:) | CallExpr | statements.swift:49:3:49:3 | print(_:separator:terminator:) | DeclRefExpr |
-| statements.swift:49:9:49:9 | (Any) ... | ErasureExpr | statements.swift:49:9:49:9 | doing | StringLiteralExpr |
-| statements.swift:49:9:49:9 | [...] | ArrayExpr | statements.swift:49:9:49:9 | (Any) ... | ErasureExpr |
-| statements.swift:49:9:49:9 | [...] | VarargExpansionExpr | statements.swift:49:9:49:9 | [...] | ArrayExpr |
-| statements.swift:52:1:52:13 | var ... = ... | PatternBindingDecl | statements.swift:52:5:52:5 | index | NamedPattern |
-| statements.swift:52:1:52:13 | var ... = ... | PatternBindingDecl | statements.swift:52:13:52:13 | 42 | IntegerLiteralExpr |
-| statements.swift:52:1:52:13 | { ... } | BraceStmt | statements.swift:52:1:52:13 | var ... = ... | PatternBindingDecl |
-| statements.swift:52:1:52:13 | { ... } | TopLevelCodeDecl | statements.swift:52:1:52:13 | { ... } | BraceStmt |
-| statements.swift:53:1:62:1 | switch index { ... } | SwitchStmt | statements.swift:53:8:53:8 | index | DeclRefExpr |
-| statements.swift:53:1:62:1 | switch index { ... } | SwitchStmt | statements.swift:54:4:56:7 | case ... | CaseStmt |
-| statements.swift:53:1:62:1 | switch index { ... } | SwitchStmt | statements.swift:57:4:59:7 | case ... | CaseStmt |
-| statements.swift:53:1:62:1 | switch index { ... } | SwitchStmt | statements.swift:60:4:61:22 | case ... | CaseStmt |
-| statements.swift:53:1:62:1 | { ... } | BraceStmt | statements.swift:53:1:62:1 | switch index { ... } | SwitchStmt |
-| statements.swift:53:1:62:1 | { ... } | TopLevelCodeDecl | statements.swift:53:1:62:1 | { ... } | BraceStmt |
-| statements.swift:54:4:56:7 | case ... | CaseStmt | statements.swift:54:9:54:9 | =~ ... | CaseLabelItem |
-| statements.swift:54:4:56:7 | case ... | CaseStmt | statements.swift:55:7:56:7 | { ... } | BraceStmt |
-| statements.swift:54:9:54:9 | =~ ... | CaseLabelItem | statements.swift:54:9:54:9 | =~ ... | ExprPattern |
-| statements.swift:54:9:54:9 | =~ ... | ExprPattern | statements.swift:54:9:54:9 | 1 | IntegerLiteralExpr |
-| statements.swift:55:7:55:16 | call to print(_:separator:terminator:) | CallExpr | statements.swift:55:7:55:7 | print(_:separator:terminator:) | DeclRefExpr |
-| statements.swift:55:7:56:7 | { ... } | BraceStmt | statements.swift:55:7:55:16 | call to print(_:separator:terminator:) | CallExpr |
-| statements.swift:55:7:56:7 | { ... } | BraceStmt | statements.swift:56:7:56:7 | fallthrough | FallthroughStmt |
-| statements.swift:55:13:55:13 | (Any) ... | ErasureExpr | statements.swift:55:13:55:13 | 1 | StringLiteralExpr |
-| statements.swift:55:13:55:13 | [...] | ArrayExpr | statements.swift:55:13:55:13 | (Any) ... | ErasureExpr |
-| statements.swift:55:13:55:13 | [...] | VarargExpansionExpr | statements.swift:55:13:55:13 | [...] | ArrayExpr |
-| statements.swift:57:4:59:7 | case ... | CaseStmt | statements.swift:57:9:57:9 | =~ ... | CaseLabelItem |
-| statements.swift:57:4:59:7 | case ... | CaseStmt | statements.swift:57:12:57:12 | =~ ... | CaseLabelItem |
-| statements.swift:57:4:59:7 | case ... | CaseStmt | statements.swift:58:7:59:7 | { ... } | BraceStmt |
-| statements.swift:57:9:57:9 | =~ ... | CaseLabelItem | statements.swift:57:9:57:9 | =~ ... | ExprPattern |
-| statements.swift:57:9:57:9 | =~ ... | ExprPattern | statements.swift:57:9:57:9 | 5 | IntegerLiteralExpr |
-| statements.swift:57:12:57:12 | =~ ... | CaseLabelItem | statements.swift:57:12:57:12 | =~ ... | ExprPattern |
-| statements.swift:57:12:57:12 | =~ ... | ExprPattern | statements.swift:57:12:57:12 | 10 | IntegerLiteralExpr |
-| statements.swift:58:7:58:20 | call to print(_:separator:terminator:) | CallExpr | statements.swift:58:7:58:7 | print(_:separator:terminator:) | DeclRefExpr |
-| statements.swift:58:7:59:7 | { ... } | BraceStmt | statements.swift:58:7:58:20 | call to print(_:separator:terminator:) | CallExpr |
-| statements.swift:58:7:59:7 | { ... } | BraceStmt | statements.swift:59:7:59:7 | break | BreakStmt |
-| statements.swift:58:13:58:13 | (Any) ... | ErasureExpr | statements.swift:58:13:58:13 | 5, 10 | StringLiteralExpr |
-| statements.swift:58:13:58:13 | [...] | ArrayExpr | statements.swift:58:13:58:13 | (Any) ... | ErasureExpr |
-| statements.swift:58:13:58:13 | [...] | VarargExpansionExpr | statements.swift:58:13:58:13 | [...] | ArrayExpr |
-| statements.swift:60:4:60:4 | _ | CaseLabelItem | statements.swift:60:4:60:4 | _ | AnyPattern |
-| statements.swift:60:4:61:22 | case ... | CaseStmt | statements.swift:60:4:60:4 | _ | CaseLabelItem |
-| statements.swift:60:4:61:22 | case ... | CaseStmt | statements.swift:61:7:61:22 | { ... } | BraceStmt |
-| statements.swift:61:7:61:22 | call to print(_:separator:terminator:) | CallExpr | statements.swift:61:7:61:7 | print(_:separator:terminator:) | DeclRefExpr |
-| statements.swift:61:7:61:22 | { ... } | BraceStmt | statements.swift:61:7:61:22 | call to print(_:separator:terminator:) | CallExpr |
-| statements.swift:61:13:61:13 | (Any) ... | ErasureExpr | statements.swift:61:13:61:13 | default | StringLiteralExpr |
-| statements.swift:61:13:61:13 | [...] | ArrayExpr | statements.swift:61:13:61:13 | (Any) ... | ErasureExpr |
-| statements.swift:61:13:61:13 | [...] | VarargExpansionExpr | statements.swift:61:13:61:13 | [...] | ArrayExpr |
-| statements.swift:64:1:64:15 | var ... = ... | PatternBindingDecl | statements.swift:64:5:64:11 | ... as ... | TypedPattern |
-| statements.swift:64:1:64:15 | var ... = ... | PatternBindingDecl | statements.swift:64:15:64:15 | (Int?) ... | InjectIntoOptionalExpr |
-| statements.swift:64:1:64:15 | { ... } | BraceStmt | statements.swift:64:1:64:15 | var ... = ... | PatternBindingDecl |
-| statements.swift:64:1:64:15 | { ... } | TopLevelCodeDecl | statements.swift:64:1:64:15 | { ... } | BraceStmt |
-| statements.swift:64:5:64:11 | ... as ... | TypedPattern | statements.swift:64:5:64:5 | x | NamedPattern |
-| statements.swift:64:5:64:11 | ... as ... | TypedPattern | statements.swift:64:8:64:11 | Int? | TypeRepr |
-| statements.swift:64:15:64:15 | (Int?) ... | InjectIntoOptionalExpr | statements.swift:64:15:64:15 | 4 | IntegerLiteralExpr |
-| statements.swift:65:1:66:1 | if ... then { ... } | IfStmt | statements.swift:65:4:65:19 | StmtCondition | StmtCondition |
-| statements.swift:65:1:66:1 | if ... then { ... } | IfStmt | statements.swift:65:21:66:1 | { ... } | BraceStmt |
-| statements.swift:65:1:66:1 | { ... } | BraceStmt | statements.swift:65:1:66:1 | if ... then { ... } | IfStmt |
-| statements.swift:65:1:66:1 | { ... } | TopLevelCodeDecl | statements.swift:65:1:66:1 | { ... } | BraceStmt |
-| statements.swift:65:9:65:15 | let ... | BindingPattern | statements.swift:65:13:65:15 | let ...? | OptionalSomePattern |
-| statements.swift:65:13:65:15 | let ...? | OptionalSomePattern | statements.swift:65:13:65:13 | xx | NamedPattern |
-| statements.swift:67:1:68:1 | if ... then { ... } | IfStmt | statements.swift:67:4:67:20 | StmtCondition | StmtCondition |
-| statements.swift:67:1:68:1 | if ... then { ... } | IfStmt | statements.swift:67:22:68:1 | { ... } | BraceStmt |
-| statements.swift:67:1:68:1 | { ... } | BraceStmt | statements.swift:67:1:68:1 | if ... then { ... } | IfStmt |
-| statements.swift:67:1:68:1 | { ... } | TopLevelCodeDecl | statements.swift:67:1:68:1 | { ... } | BraceStmt |
-| statements.swift:67:9:67:16 | .some(...) | EnumElementPattern | statements.swift:67:14:67:16 | (...) | ParenPattern |
-| statements.swift:67:14:67:16 | (...) | ParenPattern | statements.swift:67:15:67:15 | _ | AnyPattern |
-| statements.swift:70:1:70:23 | var ... = ... | PatternBindingDecl | statements.swift:70:5:70:5 | numbers | NamedPattern |
-| statements.swift:70:1:70:23 | var ... = ... | PatternBindingDecl | statements.swift:70:15:70:23 | [...] | ArrayExpr |
-| statements.swift:70:1:70:23 | { ... } | BraceStmt | statements.swift:70:1:70:23 | var ... = ... | PatternBindingDecl |
-| statements.swift:70:1:70:23 | { ... } | TopLevelCodeDecl | statements.swift:70:1:70:23 | { ... } | BraceStmt |
-| statements.swift:70:15:70:23 | [...] | ArrayExpr | statements.swift:70:16:70:16 | 1 | IntegerLiteralExpr |
-| statements.swift:70:15:70:23 | [...] | ArrayExpr | statements.swift:70:19:70:19 | 2 | IntegerLiteralExpr |
-| statements.swift:70:15:70:23 | [...] | ArrayExpr | statements.swift:70:22:70:22 | 3 | IntegerLiteralExpr |
-| statements.swift:71:1:72:1 | for ... in ... where ... { ... } | ForEachStmt | statements.swift:71:5:71:5 | number | NamedPattern |
-| statements.swift:71:1:72:1 | for ... in ... where ... { ... } | ForEachStmt | statements.swift:71:15:71:15 | numbers | DeclRefExpr |
-| statements.swift:71:1:72:1 | for ... in ... where ... { ... } | ForEachStmt | statements.swift:71:29:71:43 | ... .==(_:_:) ... | BinaryExpr |
-| statements.swift:71:1:72:1 | for ... in ... where ... { ... } | ForEachStmt | statements.swift:71:45:72:1 | { ... } | BraceStmt |
-| statements.swift:71:1:72:1 | { ... } | BraceStmt | statements.swift:71:1:72:1 | for ... in ... where ... { ... } | ForEachStmt |
-| statements.swift:71:1:72:1 | { ... } | TopLevelCodeDecl | statements.swift:71:1:72:1 | { ... } | BraceStmt |
-| statements.swift:71:29:71:38 | ... .%(_:_:) ... | BinaryExpr | statements.swift:71:36:71:36 | .%(_:_:) | MethodRefExpr |
-| statements.swift:71:29:71:43 | ... .==(_:_:) ... | BinaryExpr | statements.swift:71:40:71:40 | .==(_:_:) | MethodRefExpr |
-| statements.swift:71:36:71:36 | Int.Type | TypeExpr | statements.swift:71:36:71:36 | Int | TypeRepr |
-| statements.swift:71:40:71:40 | Int.Type | TypeExpr | statements.swift:71:40:71:40 | Int | TypeRepr |
-| statements.swift:74:8:74:8 | init | ConstructorDecl | statements.swift:74:8:74:8 | self | ParamDecl |
-| statements.swift:74:8:74:8 | init | ConstructorDecl | statements.swift:74:8:74:8 | x | ParamDecl |
-| statements.swift:75:3:75:11 | var ... = ... | PatternBindingDecl | statements.swift:75:7:75:11 | ... as ... | TypedPattern |
-| statements.swift:75:7:75:7 | (unnamed function decl) | AccessorDecl | statements.swift:75:7:75:7 | self | ParamDecl |
-| statements.swift:75:7:75:7 | (unnamed function decl) | AccessorDecl | statements.swift:75:7:75:7 | { ... } | BraceStmt |
-| statements.swift:75:7:75:7 | get | AccessorDecl | statements.swift:75:7:75:7 | self | ParamDecl |
-| statements.swift:75:7:75:7 | get | AccessorDecl | statements.swift:75:7:75:7 | { ... } | BraceStmt |
-| statements.swift:75:7:75:7 | set | AccessorDecl | statements.swift:75:7:75:7 | self | ParamDecl |
-| statements.swift:75:7:75:7 | set | AccessorDecl | statements.swift:75:7:75:7 | value | ParamDecl |
-| statements.swift:75:7:75:7 | set | AccessorDecl | statements.swift:75:7:75:7 | { ... } | BraceStmt |
-| statements.swift:75:7:75:7 | x | ConcreteVarDecl | statements.swift:75:7:75:7 | (unnamed function decl) | AccessorDecl |
-| statements.swift:75:7:75:7 | x | ConcreteVarDecl | statements.swift:75:7:75:7 | get | AccessorDecl |
-| statements.swift:75:7:75:7 | x | ConcreteVarDecl | statements.swift:75:7:75:7 | set | AccessorDecl |
-| statements.swift:75:7:75:7 | yield ... | YieldStmt | file://:0:0:0:0 | &... | InOutExpr |
-| statements.swift:75:7:75:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| statements.swift:75:7:75:7 | { ... } | BraceStmt | file://:0:0:0:0 | return ... | ReturnStmt |
-| statements.swift:75:7:75:7 | { ... } | BraceStmt | statements.swift:75:7:75:7 | yield ... | YieldStmt |
-| statements.swift:75:7:75:11 | ... as ... | TypedPattern | statements.swift:75:7:75:7 | x | NamedPattern |
-| statements.swift:75:7:75:11 | ... as ... | TypedPattern | statements.swift:75:11:75:11 | Int | TypeRepr |
-| statements.swift:76:3:84:3 | var ... = ... | PatternBindingDecl | statements.swift:76:7:76:19 | ... as ... | TypedPattern |
-| statements.swift:76:7:76:7 | hasModify | ConcreteVarDecl | statements.swift:76:7:76:7 | set | AccessorDecl |
-| statements.swift:76:7:76:7 | hasModify | ConcreteVarDecl | statements.swift:77:5:79:5 | (unnamed function decl) | AccessorDecl |
-| statements.swift:76:7:76:7 | hasModify | ConcreteVarDecl | statements.swift:81:5:83:5 | get | AccessorDecl |
-| statements.swift:76:7:76:7 | set | AccessorDecl | statements.swift:76:7:76:7 | self | ParamDecl |
-| statements.swift:76:7:76:7 | set | AccessorDecl | statements.swift:76:7:76:7 | value | ParamDecl |
-| statements.swift:76:7:76:7 | set | AccessorDecl | statements.swift:76:7:76:7 | { ... } | BraceStmt |
-| statements.swift:76:7:76:7 | { ... } | BraceStmt | file://:0:0:0:0 |  ... = ... | AssignExpr |
-| statements.swift:76:7:76:19 | ... as ... | TypedPattern | statements.swift:76:7:76:7 | hasModify | NamedPattern |
-| statements.swift:76:7:76:19 | ... as ... | TypedPattern | statements.swift:76:19:76:19 | Int | TypeRepr |
-| statements.swift:77:5:79:5 | (unnamed function decl) | AccessorDecl | statements.swift:77:5:77:5 | self | ParamDecl |
-| statements.swift:77:5:79:5 | (unnamed function decl) | AccessorDecl | statements.swift:77:13:79:5 | { ... } | BraceStmt |
-| statements.swift:77:13:79:5 | { ... } | BraceStmt | statements.swift:78:7:78:14 | yield ... | YieldStmt |
-| statements.swift:78:7:78:14 | yield ... | YieldStmt | statements.swift:78:13:78:14 | &... | InOutExpr |
-| statements.swift:78:13:78:14 | &... | InOutExpr | statements.swift:78:14:78:14 | .x | MemberRefExpr |
-| statements.swift:78:14:78:14 | .x | MemberRefExpr | statements.swift:78:14:78:14 | self | DeclRefExpr |
-| statements.swift:81:5:83:5 | get | AccessorDecl | statements.swift:81:5:81:5 | self | ParamDecl |
-| statements.swift:81:5:83:5 | get | AccessorDecl | statements.swift:81:9:83:5 | { ... } | BraceStmt |
-| statements.swift:81:9:83:5 | { ... } | BraceStmt | statements.swift:82:7:82:14 | return ... | ReturnStmt |
-| statements.swift:82:7:82:14 | return ... | ReturnStmt | statements.swift:82:14:82:14 | 0 | IntegerLiteralExpr |
diff --git a/swift/ql/test/library-tests/parent/parent.ql b/swift/ql/test/library-tests/parent/parent.ql
deleted file mode 100644
index 56a40e53f43..00000000000
--- a/swift/ql/test/library-tests/parent/parent.ql
+++ /dev/null
@@ -1,8 +0,0 @@
-import swift
-import codeql.swift.generated.GetImmediateParent
-
-from AstNode parent, AstNode child
-where
-  parent = getImmediateParent(child) and
-  parent.getLocation().getFile().getName().matches("%swift/ql/test%")
-select parent, parent.getPrimaryQlClasses(), child, child.getPrimaryQlClasses()
diff --git a/swift/ql/test/query-tests/Security/CWE-079/UnsafeWebViewFetch.expected b/swift/ql/test/query-tests/Security/CWE-079/UnsafeWebViewFetch.expected
index cd0f9af67e7..0fc232db90b 100644
--- a/swift/ql/test/query-tests/Security/CWE-079/UnsafeWebViewFetch.expected
+++ b/swift/ql/test/query-tests/Security/CWE-079/UnsafeWebViewFetch.expected
@@ -4,10 +4,10 @@ edges
 | UnsafeWebViewFetch.swift:94:10:94:37 | try ... :  | UnsafeWebViewFetch.swift:164:21:164:35 | call to getRemoteData() :  |
 | UnsafeWebViewFetch.swift:94:10:94:37 | try ... :  | UnsafeWebViewFetch.swift:167:25:167:39 | call to getRemoteData() |
 | UnsafeWebViewFetch.swift:94:10:94:37 | try ... :  | UnsafeWebViewFetch.swift:206:17:206:31 | call to getRemoteData() :  |
-| UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:94:10:94:37 | try ... :  |
-| UnsafeWebViewFetch.swift:103:30:103:84 | call to init :  | UnsafeWebViewFetch.swift:103:25:103:84 | try! ... |
-| UnsafeWebViewFetch.swift:105:18:105:72 | call to init :  | UnsafeWebViewFetch.swift:106:25:106:25 | data |
-| UnsafeWebViewFetch.swift:109:30:109:53 | call to init :  | UnsafeWebViewFetch.swift:109:25:109:53 | try! ... |
+| UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:94:10:94:37 | try ... :  |
+| UnsafeWebViewFetch.swift:103:30:103:84 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:103:25:103:84 | try! ... |
+| UnsafeWebViewFetch.swift:105:18:105:72 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:106:25:106:25 | data |
+| UnsafeWebViewFetch.swift:109:30:109:53 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:109:25:109:53 | try! ... |
 | UnsafeWebViewFetch.swift:117:21:117:35 | call to getRemoteData() :  | UnsafeWebViewFetch.swift:121:25:121:25 | remoteString |
 | UnsafeWebViewFetch.swift:117:21:117:35 | call to getRemoteData() :  | UnsafeWebViewFetch.swift:124:25:124:51 | ... .+(_:_:) ... |
 | UnsafeWebViewFetch.swift:117:21:117:35 | call to getRemoteData() :  | UnsafeWebViewFetch.swift:127:25:127:25 | "..." |
@@ -38,13 +38,13 @@ edges
 | UnsafeWebViewFetch.swift:206:17:206:31 | call to getRemoteData() :  | UnsafeWebViewFetch.swift:211:25:211:25 | htmlData |
 nodes
 | UnsafeWebViewFetch.swift:94:10:94:37 | try ... :  | semmle.label | try ... :  |
-| UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | semmle.label | call to init :  |
+| UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | semmle.label | call to init(contentsOf:) :  |
 | UnsafeWebViewFetch.swift:103:25:103:84 | try! ... | semmle.label | try! ... |
-| UnsafeWebViewFetch.swift:103:30:103:84 | call to init :  | semmle.label | call to init :  |
-| UnsafeWebViewFetch.swift:105:18:105:72 | call to init :  | semmle.label | call to init :  |
+| UnsafeWebViewFetch.swift:103:30:103:84 | call to init(contentsOf:) :  | semmle.label | call to init(contentsOf:) :  |
+| UnsafeWebViewFetch.swift:105:18:105:72 | call to init(contentsOf:) :  | semmle.label | call to init(contentsOf:) :  |
 | UnsafeWebViewFetch.swift:106:25:106:25 | data | semmle.label | data |
 | UnsafeWebViewFetch.swift:109:25:109:53 | try! ... | semmle.label | try! ... |
-| UnsafeWebViewFetch.swift:109:30:109:53 | call to init :  | semmle.label | call to init :  |
+| UnsafeWebViewFetch.swift:109:30:109:53 | call to init(contentsOf:) :  | semmle.label | call to init(contentsOf:) :  |
 | UnsafeWebViewFetch.swift:117:21:117:35 | call to getRemoteData() :  | semmle.label | call to getRemoteData() :  |
 | UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() | semmle.label | call to getRemoteData() |
 | UnsafeWebViewFetch.swift:121:25:121:25 | remoteString | semmle.label | remoteString |
@@ -80,19 +80,19 @@ nodes
 | UnsafeWebViewFetch.swift:211:25:211:25 | htmlData | semmle.label | htmlData |
 subpaths
 #select
-| UnsafeWebViewFetch.swift:103:25:103:84 | try! ... | UnsafeWebViewFetch.swift:103:30:103:84 | call to init :  | UnsafeWebViewFetch.swift:103:25:103:84 | try! ... | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:106:25:106:25 | data | UnsafeWebViewFetch.swift:105:18:105:72 | call to init :  | UnsafeWebViewFetch.swift:106:25:106:25 | data | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:109:25:109:53 | try! ... | UnsafeWebViewFetch.swift:109:30:109:53 | call to init :  | UnsafeWebViewFetch.swift:109:25:109:53 | try! ... | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:121:25:121:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:121:25:121:25 | remoteString | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:124:25:124:51 | ... .+(_:_:) ... | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:124:25:124:51 | ... .+(_:_:) ... | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:127:25:127:25 | "..." | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:127:25:127:25 | "..." | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:139:25:139:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:139:25:139:25 | remoteString | Tainted data is used in a WebView fetch with a tainted base URL. |
-| UnsafeWebViewFetch.swift:141:25:141:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:141:25:141:25 | remoteString | Tainted data is used in a WebView fetch with a tainted base URL. |
-| UnsafeWebViewFetch.swift:167:25:167:39 | call to getRemoteData() | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:167:25:167:39 | call to getRemoteData() | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:168:25:168:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:168:25:168:25 | remoteString | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:171:25:171:51 | ... .+(_:_:) ... | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:171:25:171:51 | ... .+(_:_:) ... | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:174:25:174:25 | "..." | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:174:25:174:25 | "..." | Tainted data is used in a WebView fetch without restricting the base URL. |
-| UnsafeWebViewFetch.swift:186:25:186:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:186:25:186:25 | remoteString | Tainted data is used in a WebView fetch with a tainted base URL. |
-| UnsafeWebViewFetch.swift:188:25:188:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:188:25:188:25 | remoteString | Tainted data is used in a WebView fetch with a tainted base URL. |
-| UnsafeWebViewFetch.swift:210:25:210:25 | htmlData | UnsafeWebViewFetch.swift:94:14:94:37 | call to init :  | UnsafeWebViewFetch.swift:210:25:210:25 | htmlData | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:103:25:103:84 | try! ... | UnsafeWebViewFetch.swift:103:30:103:84 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:103:25:103:84 | try! ... | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:106:25:106:25 | data | UnsafeWebViewFetch.swift:105:18:105:72 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:106:25:106:25 | data | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:109:25:109:53 | try! ... | UnsafeWebViewFetch.swift:109:30:109:53 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:109:25:109:53 | try! ... | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:120:25:120:39 | call to getRemoteData() | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:121:25:121:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:121:25:121:25 | remoteString | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:124:25:124:51 | ... .+(_:_:) ... | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:124:25:124:51 | ... .+(_:_:) ... | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:127:25:127:25 | "..." | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:127:25:127:25 | "..." | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:139:25:139:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:139:25:139:25 | remoteString | Tainted data is used in a WebView fetch with a tainted base URL. |
+| UnsafeWebViewFetch.swift:141:25:141:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:141:25:141:25 | remoteString | Tainted data is used in a WebView fetch with a tainted base URL. |
+| UnsafeWebViewFetch.swift:167:25:167:39 | call to getRemoteData() | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:167:25:167:39 | call to getRemoteData() | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:168:25:168:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:168:25:168:25 | remoteString | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:171:25:171:51 | ... .+(_:_:) ... | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:171:25:171:51 | ... .+(_:_:) ... | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:174:25:174:25 | "..." | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:174:25:174:25 | "..." | Tainted data is used in a WebView fetch without restricting the base URL. |
+| UnsafeWebViewFetch.swift:186:25:186:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:186:25:186:25 | remoteString | Tainted data is used in a WebView fetch with a tainted base URL. |
+| UnsafeWebViewFetch.swift:188:25:188:25 | remoteString | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:188:25:188:25 | remoteString | Tainted data is used in a WebView fetch with a tainted base URL. |
+| UnsafeWebViewFetch.swift:210:25:210:25 | htmlData | UnsafeWebViewFetch.swift:94:14:94:37 | call to init(contentsOf:) :  | UnsafeWebViewFetch.swift:210:25:210:25 | htmlData | Tainted data is used in a WebView fetch without restricting the base URL. |
diff --git a/swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation.expected b/swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation.expected
index 2b27b7a88db..b8983944811 100644
--- a/swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation.expected
+++ b/swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation.expected
@@ -1,4 +1,5 @@
 edges
+| StringLengthConflation2.swift:35:36:35:38 | .count :  | StringLengthConflation2.swift:35:36:35:46 | ... .-(_:_:) ... |
 | StringLengthConflation2.swift:37:34:37:36 | .count :  | StringLengthConflation2.swift:37:34:37:44 | ... .-(_:_:) ... |
 | StringLengthConflation.swift:36:30:36:37 | len :  | StringLengthConflation.swift:36:93:36:93 | len |
 | StringLengthConflation.swift:60:47:60:50 | .length :  | StringLengthConflation.swift:60:47:60:59 | ... ./(_:_:) ... |
@@ -17,7 +18,18 @@ edges
 | StringLengthConflation.swift:137:34:137:36 | .count :  | StringLengthConflation.swift:137:34:137:44 | ... .-(_:_:) ... |
 | StringLengthConflation.swift:138:36:138:38 | .count :  | StringLengthConflation.swift:138:36:138:46 | ... .-(_:_:) ... |
 | StringLengthConflation.swift:144:28:144:30 | .count :  | StringLengthConflation.swift:144:28:144:38 | ... .-(_:_:) ... |
+| file://:0:0:0:0 | .length :  | StringLengthConflation.swift:53:43:53:46 | .length |
+| file://:0:0:0:0 | .length :  | StringLengthConflation.swift:60:47:60:50 | .length :  |
+| file://:0:0:0:0 | .length :  | StringLengthConflation.swift:66:33:66:36 | .length :  |
+| file://:0:0:0:0 | .length :  | StringLengthConflation.swift:96:28:96:31 | .length :  |
+| file://:0:0:0:0 | .length :  | StringLengthConflation.swift:100:27:100:30 | .length :  |
+| file://:0:0:0:0 | .length :  | StringLengthConflation.swift:104:25:104:28 | .length :  |
+| file://:0:0:0:0 | .length :  | StringLengthConflation.swift:108:25:108:28 | .length :  |
+| file://:0:0:0:0 | .length :  | StringLengthConflation.swift:114:23:114:26 | .length :  |
+| file://:0:0:0:0 | .length :  | StringLengthConflation.swift:120:22:120:25 | .length :  |
 nodes
+| StringLengthConflation2.swift:35:36:35:38 | .count :  | semmle.label | .count :  |
+| StringLengthConflation2.swift:35:36:35:46 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
 | StringLengthConflation2.swift:37:34:37:36 | .count :  | semmle.label | .count :  |
 | StringLengthConflation2.swift:37:34:37:44 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
 | StringLengthConflation.swift:36:30:36:37 | len :  | semmle.label | len :  |
@@ -61,26 +73,37 @@ nodes
 | StringLengthConflation.swift:138:36:138:46 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
 | StringLengthConflation.swift:144:28:144:30 | .count :  | semmle.label | .count :  |
 | StringLengthConflation.swift:144:28:144:38 | ... .-(_:_:) ... | semmle.label | ... .-(_:_:) ... |
+| file://:0:0:0:0 | .length :  | semmle.label | .length :  |
 subpaths
 #select
+| StringLengthConflation2.swift:35:36:35:46 | ... .-(_:_:) ... | StringLengthConflation2.swift:35:36:35:38 | .count :  | StringLengthConflation2.swift:35:36:35:46 | ... .-(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
 | StringLengthConflation2.swift:37:34:37:44 | ... .-(_:_:) ... | StringLengthConflation2.swift:37:34:37:36 | .count :  | StringLengthConflation2.swift:37:34:37:44 | ... .-(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
 | StringLengthConflation.swift:36:93:36:93 | len | StringLengthConflation.swift:72:33:72:35 | .count :  | StringLengthConflation.swift:36:93:36:93 | len | This String length is used in an NSString, but it may not be equivalent. |
 | StringLengthConflation.swift:53:43:53:46 | .length | StringLengthConflation.swift:53:43:53:46 | .length | StringLengthConflation.swift:53:43:53:46 | .length | This NSString length is used in a String, but it may not be equivalent. |
+| StringLengthConflation.swift:53:43:53:46 | .length | file://:0:0:0:0 | .length :  | StringLengthConflation.swift:53:43:53:46 | .length | This NSString length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:54:43:54:50 | .count | StringLengthConflation.swift:54:43:54:50 | .count | StringLengthConflation.swift:54:43:54:50 | .count | This String.utf8 length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:55:43:55:51 | .count | StringLengthConflation.swift:55:43:55:51 | .count | StringLengthConflation.swift:55:43:55:51 | .count | This String.utf16 length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:56:43:56:60 | .count | StringLengthConflation.swift:56:43:56:60 | .count | StringLengthConflation.swift:56:43:56:60 | .count | This String.unicodeScalars length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:60:47:60:59 | ... ./(_:_:) ... | StringLengthConflation.swift:60:47:60:50 | .length :  | StringLengthConflation.swift:60:47:60:59 | ... ./(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
+| StringLengthConflation.swift:60:47:60:59 | ... ./(_:_:) ... | file://:0:0:0:0 | .length :  | StringLengthConflation.swift:60:47:60:59 | ... ./(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:66:33:66:45 | ... ./(_:_:) ... | StringLengthConflation.swift:66:33:66:36 | .length :  | StringLengthConflation.swift:66:33:66:45 | ... ./(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
+| StringLengthConflation.swift:66:33:66:45 | ... ./(_:_:) ... | file://:0:0:0:0 | .length :  | StringLengthConflation.swift:66:33:66:45 | ... ./(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:72:33:72:35 | .count | StringLengthConflation.swift:72:33:72:35 | .count | StringLengthConflation.swift:72:33:72:35 | .count | This String length is used in an NSString, but it may not be equivalent. |
 | StringLengthConflation.swift:78:47:78:49 | .count | StringLengthConflation.swift:78:47:78:49 | .count | StringLengthConflation.swift:78:47:78:49 | .count | This String length is used in an NSString, but it may not be equivalent. |
 | StringLengthConflation.swift:79:47:79:54 | .count | StringLengthConflation.swift:79:47:79:54 | .count | StringLengthConflation.swift:79:47:79:54 | .count | This String.utf8 length is used in an NSString, but it may not be equivalent. |
 | StringLengthConflation.swift:81:47:81:64 | .count | StringLengthConflation.swift:81:47:81:64 | .count | StringLengthConflation.swift:81:47:81:64 | .count | This String.unicodeScalars length is used in an NSString, but it may not be equivalent. |
 | StringLengthConflation.swift:96:28:96:40 | ... .-(_:_:) ... | StringLengthConflation.swift:96:28:96:31 | .length :  | StringLengthConflation.swift:96:28:96:40 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
+| StringLengthConflation.swift:96:28:96:40 | ... .-(_:_:) ... | file://:0:0:0:0 | .length :  | StringLengthConflation.swift:96:28:96:40 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:100:27:100:39 | ... .-(_:_:) ... | StringLengthConflation.swift:100:27:100:30 | .length :  | StringLengthConflation.swift:100:27:100:39 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
+| StringLengthConflation.swift:100:27:100:39 | ... .-(_:_:) ... | file://:0:0:0:0 | .length :  | StringLengthConflation.swift:100:27:100:39 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:104:25:104:37 | ... .-(_:_:) ... | StringLengthConflation.swift:104:25:104:28 | .length :  | StringLengthConflation.swift:104:25:104:37 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
+| StringLengthConflation.swift:104:25:104:37 | ... .-(_:_:) ... | file://:0:0:0:0 | .length :  | StringLengthConflation.swift:104:25:104:37 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:108:25:108:37 | ... .-(_:_:) ... | StringLengthConflation.swift:108:25:108:28 | .length :  | StringLengthConflation.swift:108:25:108:37 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
+| StringLengthConflation.swift:108:25:108:37 | ... .-(_:_:) ... | file://:0:0:0:0 | .length :  | StringLengthConflation.swift:108:25:108:37 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:114:23:114:35 | ... .-(_:_:) ... | StringLengthConflation.swift:114:23:114:26 | .length :  | StringLengthConflation.swift:114:23:114:35 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
+| StringLengthConflation.swift:114:23:114:35 | ... .-(_:_:) ... | file://:0:0:0:0 | .length :  | StringLengthConflation.swift:114:23:114:35 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:120:22:120:34 | ... .-(_:_:) ... | StringLengthConflation.swift:120:22:120:25 | .length :  | StringLengthConflation.swift:120:22:120:34 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
+| StringLengthConflation.swift:120:22:120:34 | ... .-(_:_:) ... | file://:0:0:0:0 | .length :  | StringLengthConflation.swift:120:22:120:34 | ... .-(_:_:) ... | This NSString length is used in a String, but it may not be equivalent. |
 | StringLengthConflation.swift:125:34:125:44 | ... .-(_:_:) ... | StringLengthConflation.swift:125:34:125:36 | .count :  | StringLengthConflation.swift:125:34:125:44 | ... .-(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
 | StringLengthConflation.swift:126:36:126:46 | ... .-(_:_:) ... | StringLengthConflation.swift:126:36:126:38 | .count :  | StringLengthConflation.swift:126:36:126:46 | ... .-(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
 | StringLengthConflation.swift:131:36:131:46 | ... .-(_:_:) ... | StringLengthConflation.swift:131:36:131:38 | .count :  | StringLengthConflation.swift:131:36:131:46 | ... .-(_:_:) ... | This String length is used in an NSString, but it may not be equivalent. |
diff --git a/swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation2.swift b/swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation2.swift
index 39b1456e604..1a0fbfdb638 100644
--- a/swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation2.swift
+++ b/swift/ql/test/query-tests/Security/CWE-135/StringLengthConflation2.swift
@@ -32,7 +32,7 @@ func test(s: String) {
     let ns = NSString(string: s)
 
     let nstr1 = ns.substring(from: ns.length - 1) // GOOD
-    let nstr2 = ns.substring(from: s.count - 1) // BAD: String length used in NSString [NOT DETECTED]
+    let nstr2 = ns.substring(from: s.count - 1) // BAD: String length used in NSString
     let nstr3 = ns.substring(to: ns.length - 1) // GOOD
     let nstr4 = ns.substring(to: s.count - 1) // BAD: String length used in NSString
     print("substrings '\(nstr1)' '\(nstr2)' / '\(nstr3)' '\(nstr4)'")
diff --git a/swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected b/swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected
new file mode 100644
index 00000000000..e37f518c126
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.expected
@@ -0,0 +1,81 @@
+edges
+| file://:0:0:0:0 | value :  | file://:0:0:0:0 | [post] self [data] :  |
+| testCoreData.swift:18:19:18:26 | value :  | testCoreData.swift:19:12:19:12 | value |
+| testCoreData.swift:31:3:31:3 | newValue :  | testCoreData.swift:32:13:32:13 | newValue |
+| testCoreData.swift:61:25:61:25 | password :  | testCoreData.swift:18:19:18:26 | value :  |
+| testCoreData.swift:64:16:64:16 | password :  | testCoreData.swift:31:3:31:3 | newValue :  |
+| testCoreData.swift:77:24:77:24 | x :  | testCoreData.swift:78:15:78:15 | x |
+| testCoreData.swift:80:10:80:22 | call to getPassword() :  | testCoreData.swift:81:15:81:15 | y |
+| testCoreData.swift:91:10:91:10 | passwd :  | testCoreData.swift:95:15:95:15 | x |
+| testCoreData.swift:92:10:92:10 | passwd :  | testCoreData.swift:96:15:96:15 | y |
+| testCoreData.swift:93:10:93:10 | passwd :  | testCoreData.swift:97:15:97:15 | z |
+| testRealm.swift:16:6:16:6 | value :  | file://:0:0:0:0 | value :  |
+| testRealm.swift:34:2:34:2 | [post] a [data] :  | testRealm.swift:34:2:34:2 | [post] a |
+| testRealm.swift:34:11:34:11 | myPassword :  | testRealm.swift:16:6:16:6 | value :  |
+| testRealm.swift:34:11:34:11 | myPassword :  | testRealm.swift:34:2:34:2 | [post] a [data] :  |
+| testRealm.swift:42:2:42:2 | [post] c [data] :  | testRealm.swift:42:2:42:2 | [post] c |
+| testRealm.swift:42:11:42:11 | myPassword :  | testRealm.swift:16:6:16:6 | value :  |
+| testRealm.swift:42:11:42:11 | myPassword :  | testRealm.swift:42:2:42:2 | [post] c [data] :  |
+| testRealm.swift:52:2:52:3 | [post] ...! [data] :  | testRealm.swift:52:2:52:3 | [post] ...! |
+| testRealm.swift:52:12:52:12 | myPassword :  | testRealm.swift:16:6:16:6 | value :  |
+| testRealm.swift:52:12:52:12 | myPassword :  | testRealm.swift:52:2:52:3 | [post] ...! [data] :  |
+| testRealm.swift:59:2:59:2 | [post] g [data] :  | testRealm.swift:59:2:59:2 | [post] g |
+| testRealm.swift:59:11:59:11 | myPassword :  | testRealm.swift:16:6:16:6 | value :  |
+| testRealm.swift:59:11:59:11 | myPassword :  | testRealm.swift:59:2:59:2 | [post] g [data] :  |
+nodes
+| file://:0:0:0:0 | [post] self [data] :  | semmle.label | [post] self [data] :  |
+| file://:0:0:0:0 | value :  | semmle.label | value :  |
+| testCoreData.swift:18:19:18:26 | value :  | semmle.label | value :  |
+| testCoreData.swift:19:12:19:12 | value | semmle.label | value |
+| testCoreData.swift:31:3:31:3 | newValue :  | semmle.label | newValue :  |
+| testCoreData.swift:32:13:32:13 | newValue | semmle.label | newValue |
+| testCoreData.swift:48:15:48:15 | password | semmle.label | password |
+| testCoreData.swift:51:24:51:24 | password | semmle.label | password |
+| testCoreData.swift:58:15:58:15 | password | semmle.label | password |
+| testCoreData.swift:61:25:61:25 | password :  | semmle.label | password :  |
+| testCoreData.swift:64:16:64:16 | password :  | semmle.label | password :  |
+| testCoreData.swift:77:24:77:24 | x :  | semmle.label | x :  |
+| testCoreData.swift:78:15:78:15 | x | semmle.label | x |
+| testCoreData.swift:80:10:80:22 | call to getPassword() :  | semmle.label | call to getPassword() :  |
+| testCoreData.swift:81:15:81:15 | y | semmle.label | y |
+| testCoreData.swift:85:15:85:17 | .password | semmle.label | .password |
+| testCoreData.swift:91:10:91:10 | passwd :  | semmle.label | passwd :  |
+| testCoreData.swift:92:10:92:10 | passwd :  | semmle.label | passwd :  |
+| testCoreData.swift:93:10:93:10 | passwd :  | semmle.label | passwd :  |
+| testCoreData.swift:95:15:95:15 | x | semmle.label | x |
+| testCoreData.swift:96:15:96:15 | y | semmle.label | y |
+| testCoreData.swift:97:15:97:15 | z | semmle.label | z |
+| testRealm.swift:16:6:16:6 | value :  | semmle.label | value :  |
+| testRealm.swift:34:2:34:2 | [post] a | semmle.label | [post] a |
+| testRealm.swift:34:2:34:2 | [post] a [data] :  | semmle.label | [post] a [data] :  |
+| testRealm.swift:34:11:34:11 | myPassword :  | semmle.label | myPassword :  |
+| testRealm.swift:42:2:42:2 | [post] c | semmle.label | [post] c |
+| testRealm.swift:42:2:42:2 | [post] c [data] :  | semmle.label | [post] c [data] :  |
+| testRealm.swift:42:11:42:11 | myPassword :  | semmle.label | myPassword :  |
+| testRealm.swift:52:2:52:3 | [post] ...! | semmle.label | [post] ...! |
+| testRealm.swift:52:2:52:3 | [post] ...! [data] :  | semmle.label | [post] ...! [data] :  |
+| testRealm.swift:52:12:52:12 | myPassword :  | semmle.label | myPassword :  |
+| testRealm.swift:59:2:59:2 | [post] g | semmle.label | [post] g |
+| testRealm.swift:59:2:59:2 | [post] g [data] :  | semmle.label | [post] g [data] :  |
+| testRealm.swift:59:11:59:11 | myPassword :  | semmle.label | myPassword :  |
+subpaths
+| testRealm.swift:34:11:34:11 | myPassword :  | testRealm.swift:16:6:16:6 | value :  | file://:0:0:0:0 | [post] self [data] :  | testRealm.swift:34:2:34:2 | [post] a [data] :  |
+| testRealm.swift:42:11:42:11 | myPassword :  | testRealm.swift:16:6:16:6 | value :  | file://:0:0:0:0 | [post] self [data] :  | testRealm.swift:42:2:42:2 | [post] c [data] :  |
+| testRealm.swift:52:12:52:12 | myPassword :  | testRealm.swift:16:6:16:6 | value :  | file://:0:0:0:0 | [post] self [data] :  | testRealm.swift:52:2:52:3 | [post] ...! [data] :  |
+| testRealm.swift:59:11:59:11 | myPassword :  | testRealm.swift:16:6:16:6 | value :  | file://:0:0:0:0 | [post] self [data] :  | testRealm.swift:59:2:59:2 | [post] g [data] :  |
+#select
+| testCoreData.swift:19:12:19:12 | value | testCoreData.swift:61:25:61:25 | password :  | testCoreData.swift:19:12:19:12 | value | This operation stores 'value' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:61:25:61:25 | password :  | password |
+| testCoreData.swift:32:13:32:13 | newValue | testCoreData.swift:64:16:64:16 | password :  | testCoreData.swift:32:13:32:13 | newValue | This operation stores 'newValue' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:64:16:64:16 | password :  | password |
+| testCoreData.swift:48:15:48:15 | password | testCoreData.swift:48:15:48:15 | password | testCoreData.swift:48:15:48:15 | password | This operation stores 'password' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:48:15:48:15 | password | password |
+| testCoreData.swift:51:24:51:24 | password | testCoreData.swift:51:24:51:24 | password | testCoreData.swift:51:24:51:24 | password | This operation stores 'password' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:51:24:51:24 | password | password |
+| testCoreData.swift:58:15:58:15 | password | testCoreData.swift:58:15:58:15 | password | testCoreData.swift:58:15:58:15 | password | This operation stores 'password' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:58:15:58:15 | password | password |
+| testCoreData.swift:78:15:78:15 | x | testCoreData.swift:77:24:77:24 | x :  | testCoreData.swift:78:15:78:15 | x | This operation stores 'x' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:77:24:77:24 | x :  | x |
+| testCoreData.swift:81:15:81:15 | y | testCoreData.swift:80:10:80:22 | call to getPassword() :  | testCoreData.swift:81:15:81:15 | y | This operation stores 'y' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:80:10:80:22 | call to getPassword() :  | call to getPassword() |
+| testCoreData.swift:85:15:85:17 | .password | testCoreData.swift:85:15:85:17 | .password | testCoreData.swift:85:15:85:17 | .password | This operation stores '.password' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:85:15:85:17 | .password | .password |
+| testCoreData.swift:95:15:95:15 | x | testCoreData.swift:91:10:91:10 | passwd :  | testCoreData.swift:95:15:95:15 | x | This operation stores 'x' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:91:10:91:10 | passwd :  | passwd |
+| testCoreData.swift:96:15:96:15 | y | testCoreData.swift:92:10:92:10 | passwd :  | testCoreData.swift:96:15:96:15 | y | This operation stores 'y' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:92:10:92:10 | passwd :  | passwd |
+| testCoreData.swift:97:15:97:15 | z | testCoreData.swift:93:10:93:10 | passwd :  | testCoreData.swift:97:15:97:15 | z | This operation stores 'z' in a database. It may contain unencrypted sensitive data from $@ | testCoreData.swift:93:10:93:10 | passwd :  | passwd |
+| testRealm.swift:34:2:34:2 | a | testRealm.swift:34:11:34:11 | myPassword :  | testRealm.swift:34:2:34:2 | [post] a | This operation stores '[post] a' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:34:11:34:11 | myPassword :  | myPassword |
+| testRealm.swift:42:2:42:2 | c | testRealm.swift:42:11:42:11 | myPassword :  | testRealm.swift:42:2:42:2 | [post] c | This operation stores '[post] c' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:42:11:42:11 | myPassword :  | myPassword |
+| testRealm.swift:52:2:52:3 | ...! | testRealm.swift:52:12:52:12 | myPassword :  | testRealm.swift:52:2:52:3 | [post] ...! | This operation stores '[post] ...!' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:52:12:52:12 | myPassword :  | myPassword |
+| testRealm.swift:59:2:59:2 | g | testRealm.swift:59:11:59:11 | myPassword :  | testRealm.swift:59:2:59:2 | [post] g | This operation stores '[post] g' in a database. It may contain unencrypted sensitive data from $@ | testRealm.swift:59:11:59:11 | myPassword :  | myPassword |
diff --git a/swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.qlref b/swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.qlref
new file mode 100644
index 00000000000..d73f4fc4bc2
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-311/CleartextStorageDatabase.qlref
@@ -0,0 +1 @@
+queries/Security/CWE-311/CleartextStorageDatabase.ql
\ No newline at end of file
diff --git a/swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected b/swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected
new file mode 100644
index 00000000000..84fe2a6259e
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.expected
@@ -0,0 +1,35 @@
+edges
+| testSend.swift:41:10:41:18 | data :  | testSend.swift:41:45:41:45 | data :  |
+| testSend.swift:45:13:45:13 | password :  | testSend.swift:52:27:52:27 | str1 |
+| testSend.swift:46:13:46:13 | password :  | testSend.swift:53:27:53:27 | str2 |
+| testSend.swift:47:13:47:25 | call to pad(_:) :  | testSend.swift:54:27:54:27 | str3 |
+| testSend.swift:47:17:47:17 | password :  | testSend.swift:41:10:41:18 | data :  |
+| testSend.swift:47:17:47:17 | password :  | testSend.swift:47:13:47:25 | call to pad(_:) :  |
+| testURL.swift:13:54:13:54 | passwd :  | testURL.swift:13:22:13:54 | ... .+(_:_:) ... |
+| testURL.swift:16:55:16:55 | credit_card_no :  | testURL.swift:16:22:16:55 | ... .+(_:_:) ... |
+nodes
+| testSend.swift:29:19:29:19 | passwordPlain | semmle.label | passwordPlain |
+| testSend.swift:41:10:41:18 | data :  | semmle.label | data :  |
+| testSend.swift:41:45:41:45 | data :  | semmle.label | data :  |
+| testSend.swift:45:13:45:13 | password :  | semmle.label | password :  |
+| testSend.swift:46:13:46:13 | password :  | semmle.label | password :  |
+| testSend.swift:47:13:47:25 | call to pad(_:) :  | semmle.label | call to pad(_:) :  |
+| testSend.swift:47:17:47:17 | password :  | semmle.label | password :  |
+| testSend.swift:52:27:52:27 | str1 | semmle.label | str1 |
+| testSend.swift:53:27:53:27 | str2 | semmle.label | str2 |
+| testSend.swift:54:27:54:27 | str3 | semmle.label | str3 |
+| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
+| testURL.swift:13:54:13:54 | passwd :  | semmle.label | passwd :  |
+| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | semmle.label | ... .+(_:_:) ... |
+| testURL.swift:16:55:16:55 | credit_card_no :  | semmle.label | credit_card_no :  |
+| testURL.swift:20:22:20:22 | passwd | semmle.label | passwd |
+subpaths
+| testSend.swift:47:17:47:17 | password :  | testSend.swift:41:10:41:18 | data :  | testSend.swift:41:45:41:45 | data :  | testSend.swift:47:13:47:25 | call to pad(_:) :  |
+#select
+| testSend.swift:29:19:29:19 | passwordPlain | testSend.swift:29:19:29:19 | passwordPlain | testSend.swift:29:19:29:19 | passwordPlain | This operation transmits 'passwordPlain', which may contain unencrypted sensitive data from $@ | testSend.swift:29:19:29:19 | passwordPlain | passwordPlain |
+| testSend.swift:52:27:52:27 | str1 | testSend.swift:45:13:45:13 | password :  | testSend.swift:52:27:52:27 | str1 | This operation transmits 'str1', which may contain unencrypted sensitive data from $@ | testSend.swift:45:13:45:13 | password :  | password |
+| testSend.swift:53:27:53:27 | str2 | testSend.swift:46:13:46:13 | password :  | testSend.swift:53:27:53:27 | str2 | This operation transmits 'str2', which may contain unencrypted sensitive data from $@ | testSend.swift:46:13:46:13 | password :  | password |
+| testSend.swift:54:27:54:27 | str3 | testSend.swift:47:17:47:17 | password :  | testSend.swift:54:27:54:27 | str3 | This operation transmits 'str3', which may contain unencrypted sensitive data from $@ | testSend.swift:47:17:47:17 | password :  | password |
+| testURL.swift:13:22:13:54 | ... .+(_:_:) ... | testURL.swift:13:54:13:54 | passwd :  | testURL.swift:13:22:13:54 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@ | testURL.swift:13:54:13:54 | passwd :  | passwd |
+| testURL.swift:16:22:16:55 | ... .+(_:_:) ... | testURL.swift:16:55:16:55 | credit_card_no :  | testURL.swift:16:22:16:55 | ... .+(_:_:) ... | This operation transmits '... .+(_:_:) ...', which may contain unencrypted sensitive data from $@ | testURL.swift:16:55:16:55 | credit_card_no :  | credit_card_no |
+| testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | testURL.swift:20:22:20:22 | passwd | This operation transmits 'passwd', which may contain unencrypted sensitive data from $@ | testURL.swift:20:22:20:22 | passwd | passwd |
diff --git a/swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.qlref b/swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.qlref
new file mode 100644
index 00000000000..f4c5a561e61
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-311/CleartextTransmission.qlref
@@ -0,0 +1 @@
+queries/Security/CWE-311/CleartextTransmission.ql
\ No newline at end of file
diff --git a/swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected b/swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected
new file mode 100644
index 00000000000..9e359b62e27
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.expected
@@ -0,0 +1,27 @@
+| testCoreData.swift:48:15:48:15 | password | label:password, type:credential |
+| testCoreData.swift:51:24:51:24 | password | label:password, type:credential |
+| testCoreData.swift:58:15:58:15 | password | label:password, type:credential |
+| testCoreData.swift:61:25:61:25 | password | label:password, type:credential |
+| testCoreData.swift:64:16:64:16 | password | label:password, type:credential |
+| testCoreData.swift:77:2:77:25 | call to doSomething(password:) | label:doSomething(password:), type:credential |
+| testCoreData.swift:77:24:77:24 | x | label:password, type:credential |
+| testCoreData.swift:80:10:80:22 | call to getPassword() | label:getPassword(), type:credential |
+| testCoreData.swift:85:15:85:17 | .password | label:password, type:credential |
+| testCoreData.swift:91:10:91:10 | passwd | label:passwd, type:credential |
+| testCoreData.swift:92:10:92:10 | passwd | label:passwd, type:credential |
+| testCoreData.swift:93:10:93:10 | passwd | label:passwd, type:credential |
+| testRealm.swift:34:11:34:11 | myPassword | label:myPassword, type:credential |
+| testRealm.swift:42:11:42:11 | myPassword | label:myPassword, type:credential |
+| testRealm.swift:52:12:52:12 | myPassword | label:myPassword, type:credential |
+| testRealm.swift:59:11:59:11 | myPassword | label:myPassword, type:credential |
+| testSend.swift:29:19:29:19 | passwordPlain | label:passwordPlain, type:credential |
+| testSend.swift:33:19:33:19 | passwordPlain | label:passwordPlain, type:credential |
+| testSend.swift:45:13:45:13 | password | label:password, type:credential |
+| testSend.swift:46:13:46:13 | password | label:password, type:credential |
+| testSend.swift:47:17:47:17 | password | label:password, type:credential |
+| testSend.swift:48:23:48:23 | password | label:password, type:credential |
+| testSend.swift:49:27:49:27 | password | label:password, type:credential |
+| testSend.swift:50:27:50:27 | password | label:password, type:credential |
+| testURL.swift:13:54:13:54 | passwd | label:passwd, type:credential |
+| testURL.swift:16:55:16:55 | credit_card_no | label:credit_card_no, type:private information |
+| testURL.swift:20:22:20:22 | passwd | label:passwd, type:credential |
diff --git a/swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.ql b/swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.ql
new file mode 100644
index 00000000000..3694468b130
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-311/SensitiveExprs.ql
@@ -0,0 +1,12 @@
+import swift
+import codeql.swift.security.SensitiveExprs
+
+string describe(SensitiveExpr e) {
+  result = "label:" + e.getLabel()
+  or
+  result = "type:" + e.getSensitiveType().toString()
+}
+
+from SensitiveExpr e
+where e.getFile().getBaseName() != ""
+select e, concat(describe(e), ", ")
diff --git a/swift/ql/test/query-tests/Security/CWE-311/testCoreData.swift b/swift/ql/test/query-tests/Security/CWE-311/testCoreData.swift
new file mode 100644
index 00000000000..60ee3147018
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-311/testCoreData.swift
@@ -0,0 +1,106 @@
+
+// --- stubs ---
+
+class NSObject
+{
+}
+
+class NSManagedObject : NSObject
+{
+	func value(forKey key: String) -> Any? { return "" }
+	func setValue(_ value: Any?, forKey key: String) {}
+	func primitiveValue(forKey key: String) -> Any? { return "" }
+	func setPrimitiveValue(_ value: Any?, forKey key: String) {}
+}
+
+class MyManagedObject : NSManagedObject
+{
+	func setIndirect(value: String) {
+		setValue(value, forKey: "myKey")
+	}
+
+	var myValue: String {
+		get {
+			if let v = value(forKey: "myKey") as? String
+			{
+				return v
+			} else {
+				return ""
+			}
+		}
+		set {
+			setValue(newValue, forKey: "myKey")
+		}
+	}
+}
+
+func encrypt(_ data: String) -> String { return data }
+func hash(data: inout String) { }
+
+func getPassword() -> String { return "" }
+func doSomething(password: String) { }
+
+// --- tests ---
+
+func test1(obj : NSManagedObject, password : String, password_hash : String) {
+	// NSManagedObject methods...
+
+	obj.setValue(password, forKey: "myKey") // BAD
+	obj.setValue(password_hash, forKey: "myKey") // GOOD (not sensitive)
+
+	obj.setPrimitiveValue(password, forKey: "myKey") // BAD
+	obj.setPrimitiveValue(password_hash, forKey: "myKey") // GOOD (not sensitive)
+}
+
+func test2(obj : MyManagedObject, password : String, password_file : String) {
+	// MyManagedObject methods...
+
+	obj.setValue(password, forKey: "myKey") // BAD
+	obj.setValue(password_file, forKey: "myKey") // GOOD (not sensitive)
+
+	obj.setIndirect(value: password) // BAD [reported on line 19]
+	obj.setIndirect(value: password_file) // GOOD (not sensitive)
+
+	obj.myValue = password // BAD [reported on line 32]
+	obj.myValue = password_file // GOOD (not sensitive)
+}
+
+class MyClass {
+	var harmless = "abc"
+	var password = "123"
+}
+
+func test3(obj : NSManagedObject, x : String) {
+	// alternative evidence of sensitivity...
+
+	obj.setValue(x, forKey: "myKey") // BAD [NOT REPORTED]
+	doSomething(password: x);
+	obj.setValue(x, forKey: "myKey") // BAD
+
+	var y = getPassword();
+	obj.setValue(y, forKey: "myKey") // BAD
+
+	var z = MyClass()
+	obj.setValue(z.harmless, forKey: "myKey") // GOOD (not sensitive)
+	obj.setValue(z.password, forKey: "myKey") // BAD
+}
+
+func test4(obj : NSManagedObject, passwd : String) {
+	// sanitizers...
+
+	var x = passwd;
+	var y = passwd;
+	var z = passwd;
+
+	obj.setValue(x, forKey: "myKey") // BAD
+	obj.setValue(y, forKey: "myKey") // BAD
+	obj.setValue(z, forKey: "myKey") // BAD
+
+	x = encrypt(x);
+	hash(data: &y);
+	z = "";
+
+	obj.setValue(x, forKey: "myKey") // GOOD (not sensitive)
+	obj.setValue(y, forKey: "myKey") // GOOD (not sensitive)
+	obj.setValue(z, forKey: "myKey") // GOOD (not sensitive)
+}
diff --git a/swift/ql/test/query-tests/Security/CWE-311/testRealm.swift b/swift/ql/test/query-tests/Security/CWE-311/testRealm.swift
new file mode 100644
index 00000000000..61ed4d9c2b6
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-311/testRealm.swift
@@ -0,0 +1,64 @@
+
+// --- stubs ---
+
+enum UpdatePolicy : Int {
+	case error = 1
+}
+
+class RealmSwiftObject {
+}
+
+typealias Object = RealmSwiftObject
+
+class MyRealmSwiftObject : RealmSwiftObject {
+	override init() { data = "" }
+
+	var data: String
+}
+
+class Realm {
+	func add(_ object: Object, update: UpdatePolicy = .error) {}
+
+	func create<T>(_ type : T.Type, value: Any = [:], update: UpdatePolicy = .error) where T : RealmSwiftObject { }
+
+	func object<Element, KeyType>(ofType type: Element.Type, forPrimaryKey key: KeyType) -> Element? where Element : RealmSwiftObject { return nil }
+
+}
+
+// --- tests ---
+
+func test1(realm : Realm, myPassword : String, myHashedPassword : String) {
+	// add objects (within a transaction) ...
+
+	let a = MyRealmSwiftObject()
+	a.data = myPassword // BAD
+	realm.add(a)
+
+	let b = MyRealmSwiftObject()
+	b.data = myHashedPassword
+	realm.add(b) // GOOD (not sensitive)
+
+	let c = MyRealmSwiftObject()
+	c.data = myPassword // BAD
+	realm.create(MyRealmSwiftObject.self, value: c)
+
+	let d = MyRealmSwiftObject()
+	d.data = myHashedPassword
+	realm.create(MyRealmSwiftObject.self, value: d) // GOOD (not sensitive)
+
+	// retrieve objects ...
+
+	var e = realm.object(ofType: MyRealmSwiftObject.self, forPrimaryKey: "key")
+	e!.data = myPassword // BAD
+
+	var f = realm.object(ofType: MyRealmSwiftObject.self, forPrimaryKey: "key")
+	f!.data = myHashedPassword // GOOD (not sensitive)
+
+	let g = MyRealmSwiftObject()
+	g.data = "" // GOOD (not sensitive)
+	g.data = myPassword // BAD
+	g.data = "" // GOOD (not sensitive)
+}
+
+// limitation: its possible to configure a Realm DB to be stored encrypted, if this is done correctly
+// (taking care with the encryption key) then storing otherwise plaintext sensitive data would be OK.
diff --git a/swift/ql/test/query-tests/Security/CWE-311/testSend.swift b/swift/ql/test/query-tests/Security/CWE-311/testSend.swift
new file mode 100644
index 00000000000..87d140b1eea
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-311/testSend.swift
@@ -0,0 +1,58 @@
+
+// --- stubs ---
+
+class Data {
+    init<S>(_ elements: S) {}
+}
+
+class NWConnection {
+	enum SendCompletion {
+		case idempotent
+	}
+
+	class ContentContext {
+        static let defaultMessage = ContentContext()
+    }
+	
+	func send(content: Data?, contentContext: NWConnection.ContentContext = .defaultMessage, isComplete: Bool = true, completion: NWConnection.SendCompletion) { }
+	func send<Content>(content: Content?, contentContext: NWConnection.ContentContext = .defaultMessage, isComplete: Bool = true, completion: NWConnection.SendCompletion) { }
+}
+
+// --- tests ---
+
+func test1(passwordPlain : String, passwordHash : String) {
+	let nw = NWConnection()
+
+	// ...
+
+	nw.send(content: "123456", completion: .idempotent) // GOOD (not sensitive)
+	nw.send(content: passwordPlain, completion: .idempotent) // BAD
+	nw.send(content: passwordHash, completion: .idempotent) // GOOD (not sensitive)
+
+	let data1 = Data("123456")
+	let data2 = Data(passwordPlain)
+	let data3 = Data(passwordHash)
+
+	nw.send(content: data1, completion: .idempotent) // GOOD (not sensitive)
+	nw.send(content: data2, completion: .idempotent) // BAD [NOT DETECTED]
+	nw.send(content: data3, completion: .idempotent) // GOOD (not sensitive)
+}
+
+func pad(_ data: String) -> String { return data }
+func aes_crypt(_ data: String) -> String { return data }
+
+func test2(password : String, connection : NWConnection) {
+	let str1 = password
+	let str2 = password + " "
+	let str3 = pad(password)
+	let str4 = aes_crypt(password)
+	let str5 = pad(aes_crypt(password))
+	let str6 = aes_crypt(pad(password))
+
+	connection.send(content: str1, completion: .idempotent) // BAD
+	connection.send(content: str2, completion: .idempotent) // BAD
+	connection.send(content: str3, completion: .idempotent) // BAD
+	connection.send(content: str4, completion: .idempotent) // GOOD (encrypted)
+	connection.send(content: str5, completion: .idempotent) // GOOD (encrypted)
+	connection.send(content: str6, completion: .idempotent) // GOOD (encrypted)
+}
diff --git a/swift/ql/test/query-tests/Security/CWE-311/testURL.swift b/swift/ql/test/query-tests/Security/CWE-311/testURL.swift
new file mode 100644
index 00000000000..2fe008f0b6f
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-311/testURL.swift
@@ -0,0 +1,22 @@
+
+// --- stubs ---
+
+class URL
+{
+	init?(string: String) {}
+	init?(string: String, relativeTo: URL?) {}
+}
+
+// --- tests ---
+
+func test1(passwd : String, encrypted_passwd : String, account_no : String, credit_card_no : String) {
+	let a = URL(string: "http://example.com/login?p=" + passwd); // BAD
+	let b = URL(string: "http://example.com/login?p=" + encrypted_passwd); // GOOD (not sensitive)
+	let c = URL(string: "http://example.com/login?ac=" + account_no); // BAD [NOT DETECTED]
+	let d = URL(string: "http://example.com/login?cc=" + credit_card_no); // BAD
+
+	let base = URL(string: "http://example.com/"); // GOOD (not sensitive)
+	let e = URL(string: "abc", relativeTo: base); // GOOD (not sensitive)
+	let f = URL(string: passwd, relativeTo: base); // BAD
+	let g = URL(string: "abc", relativeTo: f); // BAD (reported on line above)
+}
diff --git a/swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.expected b/swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.expected
new file mode 100644
index 00000000000..06ee4968d01
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.expected
@@ -0,0 +1,42 @@
+edges
+| testCrypto.swift:56:47:56:47 | passwd :  | testCrypto.swift:63:44:63:44 | passwd |
+| testCrypto.swift:60:43:60:43 | credit_card_no :  | testCrypto.swift:61:43:61:43 | credit_card_no |
+| testCrypto.swift:60:43:60:43 | credit_card_no :  | testCrypto.swift:61:43:61:43 | credit_card_no :  |
+| testCrypto.swift:60:43:60:43 | credit_card_no :  | testCrypto.swift:67:44:67:44 | credit_card_no |
+| testCrypto.swift:61:43:61:43 | credit_card_no :  | testCrypto.swift:67:44:67:44 | credit_card_no |
+nodes
+| testCrypto.swift:56:47:56:47 | passwd | semmle.label | passwd |
+| testCrypto.swift:56:47:56:47 | passwd :  | semmle.label | passwd :  |
+| testCrypto.swift:60:43:60:43 | credit_card_no | semmle.label | credit_card_no |
+| testCrypto.swift:60:43:60:43 | credit_card_no :  | semmle.label | credit_card_no :  |
+| testCrypto.swift:61:43:61:43 | credit_card_no | semmle.label | credit_card_no |
+| testCrypto.swift:61:43:61:43 | credit_card_no :  | semmle.label | credit_card_no :  |
+| testCrypto.swift:63:44:63:44 | passwd | semmle.label | passwd |
+| testCrypto.swift:67:44:67:44 | credit_card_no | semmle.label | credit_card_no |
+| testCrypto.swift:90:23:90:23 | passwd | semmle.label | passwd |
+| testCrypto.swift:94:23:94:23 | credit_card_no | semmle.label | credit_card_no |
+| testCrypto.swift:99:23:99:23 | passwd | semmle.label | passwd |
+| testCrypto.swift:103:23:103:23 | credit_card_no | semmle.label | credit_card_no |
+| testCrypto.swift:132:32:132:32 | passwd | semmle.label | passwd |
+| testCrypto.swift:136:32:136:32 | credit_card_no | semmle.label | credit_card_no |
+| testCrypto.swift:141:32:141:32 | passwd | semmle.label | passwd |
+| testCrypto.swift:145:32:145:32 | credit_card_no | semmle.label | credit_card_no |
+subpaths
+#select
+| testCrypto.swift:56:47:56:47 | passwd | testCrypto.swift:56:47:56:47 | passwd | testCrypto.swift:56:47:56:47 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCrypto.swift:56:47:56:47 | passwd | sensitive data (credential passwd) |
+| testCrypto.swift:60:43:60:43 | credit_card_no | testCrypto.swift:60:43:60:43 | credit_card_no | testCrypto.swift:60:43:60:43 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCrypto.swift:60:43:60:43 | credit_card_no | sensitive data (private information credit_card_no) |
+| testCrypto.swift:61:43:61:43 | credit_card_no | testCrypto.swift:60:43:60:43 | credit_card_no :  | testCrypto.swift:61:43:61:43 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCrypto.swift:60:43:60:43 | credit_card_no | sensitive data (private information credit_card_no) |
+| testCrypto.swift:61:43:61:43 | credit_card_no | testCrypto.swift:61:43:61:43 | credit_card_no | testCrypto.swift:61:43:61:43 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCrypto.swift:61:43:61:43 | credit_card_no | sensitive data (private information credit_card_no) |
+| testCrypto.swift:63:44:63:44 | passwd | testCrypto.swift:56:47:56:47 | passwd :  | testCrypto.swift:63:44:63:44 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCrypto.swift:56:47:56:47 | passwd | sensitive data (credential passwd) |
+| testCrypto.swift:63:44:63:44 | passwd | testCrypto.swift:63:44:63:44 | passwd | testCrypto.swift:63:44:63:44 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCrypto.swift:63:44:63:44 | passwd | sensitive data (credential passwd) |
+| testCrypto.swift:67:44:67:44 | credit_card_no | testCrypto.swift:60:43:60:43 | credit_card_no :  | testCrypto.swift:67:44:67:44 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCrypto.swift:60:43:60:43 | credit_card_no | sensitive data (private information credit_card_no) |
+| testCrypto.swift:67:44:67:44 | credit_card_no | testCrypto.swift:61:43:61:43 | credit_card_no :  | testCrypto.swift:67:44:67:44 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCrypto.swift:61:43:61:43 | credit_card_no | sensitive data (private information credit_card_no) |
+| testCrypto.swift:67:44:67:44 | credit_card_no | testCrypto.swift:67:44:67:44 | credit_card_no | testCrypto.swift:67:44:67:44 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCrypto.swift:67:44:67:44 | credit_card_no | sensitive data (private information credit_card_no) |
+| testCrypto.swift:90:23:90:23 | passwd | testCrypto.swift:90:23:90:23 | passwd | testCrypto.swift:90:23:90:23 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCrypto.swift:90:23:90:23 | passwd | sensitive data (credential passwd) |
+| testCrypto.swift:94:23:94:23 | credit_card_no | testCrypto.swift:94:23:94:23 | credit_card_no | testCrypto.swift:94:23:94:23 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCrypto.swift:94:23:94:23 | credit_card_no | sensitive data (private information credit_card_no) |
+| testCrypto.swift:99:23:99:23 | passwd | testCrypto.swift:99:23:99:23 | passwd | testCrypto.swift:99:23:99:23 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCrypto.swift:99:23:99:23 | passwd | sensitive data (credential passwd) |
+| testCrypto.swift:103:23:103:23 | credit_card_no | testCrypto.swift:103:23:103:23 | credit_card_no | testCrypto.swift:103:23:103:23 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCrypto.swift:103:23:103:23 | credit_card_no | sensitive data (private information credit_card_no) |
+| testCrypto.swift:132:32:132:32 | passwd | testCrypto.swift:132:32:132:32 | passwd | testCrypto.swift:132:32:132:32 | passwd | Insecure hashing algorithm (MD5) depends on $@. | testCrypto.swift:132:32:132:32 | passwd | sensitive data (credential passwd) |
+| testCrypto.swift:136:32:136:32 | credit_card_no | testCrypto.swift:136:32:136:32 | credit_card_no | testCrypto.swift:136:32:136:32 | credit_card_no | Insecure hashing algorithm (MD5) depends on $@. | testCrypto.swift:136:32:136:32 | credit_card_no | sensitive data (private information credit_card_no) |
+| testCrypto.swift:141:32:141:32 | passwd | testCrypto.swift:141:32:141:32 | passwd | testCrypto.swift:141:32:141:32 | passwd | Insecure hashing algorithm (SHA1) depends on $@. | testCrypto.swift:141:32:141:32 | passwd | sensitive data (credential passwd) |
+| testCrypto.swift:145:32:145:32 | credit_card_no | testCrypto.swift:145:32:145:32 | credit_card_no | testCrypto.swift:145:32:145:32 | credit_card_no | Insecure hashing algorithm (SHA1) depends on $@. | testCrypto.swift:145:32:145:32 | credit_card_no | sensitive data (private information credit_card_no) |
diff --git a/swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.qlref b/swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.qlref
new file mode 100644
index 00000000000..85270fde299
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-328/WeakSensitiveDataHashing.qlref
@@ -0,0 +1 @@
+queries/Security/CWE-328/WeakSensitiveDataHashing.ql
diff --git a/swift/ql/test/query-tests/Security/CWE-328/testCrypto.swift b/swift/ql/test/query-tests/Security/CWE-328/testCrypto.swift
new file mode 100644
index 00000000000..a97eab7501d
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-328/testCrypto.swift
@@ -0,0 +1,170 @@
+//codeql-extractor-options: -module-name Crypto
+
+struct SHA256 {
+    static func hash<D>(data: D) -> [UInt8] {
+        return []
+    }
+
+    func update<D>(data: D) {}
+    func update(bufferPointer: UnsafeRawBufferPointer) {}
+    func finalize() -> [UInt8] { return [] }
+}
+
+struct SHA384 {
+    static func hash<D>(data: D) -> [UInt8] {
+        return []
+    }
+
+    func update<D>(data: D) {}
+    func update(bufferPointer: UnsafeRawBufferPointer) {}
+    func finalize() -> [UInt8] { return [] }
+}
+
+struct SHA512 {
+    static func hash<D>(data: D) -> [UInt8] {
+        return []
+    }
+
+    func update<D>(data: D) {}
+    func update(bufferPointer: UnsafeRawBufferPointer) {}
+    func finalize() -> [UInt8] { return [] }
+}
+
+
+enum Insecure {
+    struct MD5 {
+        static func hash<D>(data: D) -> [UInt8] {
+            return []
+        }
+
+        func update<D>(data: D) {}
+        func update(bufferPointer: UnsafeRawBufferPointer) {}
+        func finalize() -> [UInt8] { return [] }
+    }
+    struct SHA1 {
+        static func hash<D>(data: D) -> [UInt8] {
+            return []
+        }
+
+        func update<D>(data: D) {}
+        func update(bufferPointer: UnsafeRawBufferPointer) {}
+        func finalize() -> [UInt8] { return [] }
+    }
+}
+
+func testHashMethods(passwd : UnsafeRawBufferPointer, cert: String, encrypted_passwd : String, account_no : String, credit_card_no : String) {
+    var hash = Crypto.Insecure.MD5.hash(data: passwd)  // BAD
+    hash = Crypto.Insecure.MD5.hash(data: cert)   // BAD [NOT DETECTED]
+    hash = Crypto.Insecure.MD5.hash(data: encrypted_passwd)  // GOOD  (not sensitive)
+    hash = Crypto.Insecure.MD5.hash(data: account_no)   // BAD [NOT DETECTED]
+    hash = Crypto.Insecure.MD5.hash(data: credit_card_no)   // BAD
+    hash = Crypto.Insecure.MD5.hash(data: credit_card_no)   // BAD
+
+    hash = Crypto.Insecure.SHA1.hash(data: passwd)  // BAD
+    hash = Crypto.Insecure.SHA1.hash(data: cert)   // BAD [NOT DETECTED]
+    hash = Crypto.Insecure.SHA1.hash(data: encrypted_passwd)  // GOOD  (not sensitive)
+    hash = Crypto.Insecure.SHA1.hash(data: account_no)   // BAD [NOT DETECTED]
+    hash = Crypto.Insecure.SHA1.hash(data: credit_card_no)   // BAD
+
+    hash = Crypto.SHA256.hash(data: passwd)   // BAD [NOT DETECTED] not a computationally expensive hash
+    hash = Crypto.SHA256.hash(data: cert)   // GOOD, computationally expensive hash not required
+    hash = Crypto.SHA256.hash(data: account_no)   // GOOD, computationally expensive hash not required
+    hash = Crypto.SHA256.hash(data: credit_card_no)   // GOOD, computationally expensive hash not required
+    hash = Crypto.SHA256.hash(data: credit_card_no)   // GOOD, computationally expensive hash not required
+
+    hash = Crypto.SHA384.hash(data: passwd)   // BAD [NOT DETECTED] not a computationally expensive hash
+    hash = Crypto.SHA384.hash(data: cert)   // GOOD, computationally expensive hash not required
+    hash = Crypto.SHA384.hash(data: account_no)   // GOOD, computationally expensive hash not required
+    hash = Crypto.SHA384.hash(data: credit_card_no)   // GOOD, computationally expensive hash not required
+    hash = Crypto.SHA384.hash(data: credit_card_no)   // GOOD, computationally expensive hash not required
+
+    hash = Crypto.SHA512.hash(data: passwd)   // BAD [NOT DETECTED] not a computationally expensive hash
+    hash = Crypto.SHA512.hash(data: cert)   // GOOD, computationally expensive hash not required
+    hash = Crypto.SHA512.hash(data: account_no)   // GOOD, computationally expensive hash not required
+    hash = Crypto.SHA512.hash(data: credit_card_no)   // GOOD, computationally expensive hash not required
+    hash = Crypto.SHA512.hash(data: credit_card_no)   // GOOD, computationally expensive hash not required
+}
+
+func testMD5UpdateWithData(passwd : String, cert: String, encrypted_passwd : String, account_no : String, credit_card_no : String) {
+    var hash = Crypto.Insecure.MD5()
+    hash.update(data: passwd)  // BAD
+    hash.update(data: cert)  // BAD [NOT DETECTED]
+    hash.update(data: encrypted_passwd)  // GOOD  (not sensitive)
+    hash.update(data: account_no)   // BAD [NOT DETECTED]
+    hash.update(data: credit_card_no)   // BAD
+}
+
+func testSHA1UpdateWithData(passwd : String, cert: String, encrypted_passwd : String, account_no : String, credit_card_no : String) {
+    var hash = Crypto.Insecure.SHA1()
+    hash.update(data: passwd)  // BAD
+    hash.update(data: cert)  // BAD [NOT DETECTED]
+    hash.update(data: encrypted_passwd)  // GOOD  (not sensitive)
+    hash.update(data: account_no)   // BAD [NOT DETECTED]
+    hash.update(data: credit_card_no)   // BAD
+}
+
+func testSHA256UpdateWithData(passwd : String, cert: String, encrypted_passwd : String, account_no : String, credit_card_no : String) {
+    var hash = Crypto.SHA256()
+    hash.update(data: passwd)  // BAD [NOT DETECTED] not a computationally expensive hash
+    hash.update(data: cert)  // GOOD
+    hash.update(data: account_no)   // GOOD
+    hash.update(data: credit_card_no)   // GOOD
+}
+
+func testSHA384UpdateWithData(passwd : String, cert: String, encrypted_passwd : String, account_no : String, credit_card_no : String) {
+    var hash = Crypto.SHA384()
+    hash.update(data: passwd)  // BAD [NOT DETECTED] not a computationally expensive hash
+    hash.update(data: cert)  // GOOD
+    hash.update(data: account_no)   // GOOD
+    hash.update(data: credit_card_no)   // GOOD
+}
+
+func testSHA512UpdateWithData(passwd : String, cert: String, encrypted_passwd : String, account_no : String, credit_card_no : String) {
+    var hash = Crypto.SHA512()
+    hash.update(data: passwd)  // BAD [NOT DETECTED] not a computationally expensive hash
+    hash.update(data: cert)  // GOOD
+    hash.update(data: account_no)   // GOOD
+    hash.update(data: credit_card_no)   // GOOD
+}
+
+func testMD5UpdateWithUnsafeRawBufferPointer(passwd : UnsafeRawBufferPointer, cert: UnsafeRawBufferPointer, encrypted_passwd : UnsafeRawBufferPointer, account_no : UnsafeRawBufferPointer, credit_card_no : UnsafeRawBufferPointer) {
+    var hash = Crypto.Insecure.MD5()
+    hash.update(bufferPointer: passwd)  // BAD
+    hash.update(bufferPointer: cert)  // BAD [NOT DETECTED]
+    hash.update(bufferPointer: encrypted_passwd)  // GOOD  (not sensitive)
+    hash.update(bufferPointer: account_no)   // BAD [NOT DETECTED]
+    hash.update(bufferPointer: credit_card_no)   // BAD
+}
+
+func testSHA1UpdateWithUnsafeRawBufferPointer(passwd : UnsafeRawBufferPointer, cert: UnsafeRawBufferPointer, encrypted_passwd : UnsafeRawBufferPointer, account_no : UnsafeRawBufferPointer, credit_card_no : UnsafeRawBufferPointer) {
+    var hash = Crypto.Insecure.SHA1()
+    hash.update(bufferPointer: passwd)  // BAD
+    hash.update(bufferPointer: cert)  // BAD [NOT DETECTED]
+    hash.update(bufferPointer: encrypted_passwd)  // GOOD  (not sensitive)
+    hash.update(bufferPointer: account_no)   // BAD [NOT DETECTED]
+    hash.update(bufferPointer: credit_card_no)   // BAD
+}
+
+func testSHA256UpdateWithUnsafeRawBufferPointer(passwd : UnsafeRawBufferPointer, cert: UnsafeRawBufferPointer, encrypted_passwd : UnsafeRawBufferPointer, account_no : UnsafeRawBufferPointer, credit_card_no : UnsafeRawBufferPointer) {
+    var hash = Crypto.SHA256()
+    hash.update(bufferPointer: passwd)  // BAD [NOT DETECTED] not a computationally expensive hash
+    hash.update(bufferPointer: cert)  // GOOD
+    hash.update(bufferPointer: account_no)   // GOOD
+    hash.update(bufferPointer: credit_card_no)   // GOOD
+}
+
+func testSHA384UpdateWithUnsafeRawBufferPointer(passwd : UnsafeRawBufferPointer, cert: UnsafeRawBufferPointer, encrypted_passwd : UnsafeRawBufferPointer, account_no : UnsafeRawBufferPointer, credit_card_no : UnsafeRawBufferPointer) {
+    var hash = Crypto.SHA384()
+    hash.update(bufferPointer: passwd)  // BAD [NOT DETECTED] not a computationally expensive hash
+    hash.update(bufferPointer: cert)  // GOOD
+    hash.update(bufferPointer: account_no)   // GOOD
+    hash.update(bufferPointer: credit_card_no)   // GOOD
+}
+
+func testSHA512UpdateWithUnsafeRawBufferPointer(passwd : UnsafeRawBufferPointer, cert: UnsafeRawBufferPointer, encrypted_passwd : UnsafeRawBufferPointer, account_no : UnsafeRawBufferPointer, credit_card_no : UnsafeRawBufferPointer) {
+    var hash = Crypto.SHA512()
+    hash.update(bufferPointer: passwd)  // BAD [NOT DETECTED] not a computationally expensive hash
+    hash.update(bufferPointer: cert)  // GOOD
+    hash.update(bufferPointer: account_no)   // GOOD
+    hash.update(bufferPointer: credit_card_no)   // GOOD
+}
diff --git a/swift/ql/test/query-tests/Security/CWE-757/InsecureTLS.expected b/swift/ql/test/query-tests/Security/CWE-757/InsecureTLS.expected
new file mode 100644
index 00000000000..c6d2599be5e
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-757/InsecureTLS.expected
@@ -0,0 +1,86 @@
+edges
+| InsecureTLS.swift:19:7:19:7 | value :  | file://:0:0:0:0 | value |
+| InsecureTLS.swift:20:7:20:7 | value :  | file://:0:0:0:0 | value |
+| InsecureTLS.swift:22:7:22:7 | value :  | file://:0:0:0:0 | value |
+| InsecureTLS.swift:23:7:23:7 | value :  | file://:0:0:0:0 | value |
+| InsecureTLS.swift:40:47:40:70 | .TLSv10 :  | InsecureTLS.swift:19:7:19:7 | value :  |
+| InsecureTLS.swift:45:47:45:70 | .TLSv11 :  | InsecureTLS.swift:19:7:19:7 | value :  |
+| InsecureTLS.swift:57:47:57:70 | .TLSv10 :  | InsecureTLS.swift:20:7:20:7 | value :  |
+| InsecureTLS.swift:64:40:64:52 | .tlsProtocol10 :  | InsecureTLS.swift:22:7:22:7 | value :  |
+| InsecureTLS.swift:76:40:76:52 | .tlsProtocol10 :  | InsecureTLS.swift:23:7:23:7 | value :  |
+| InsecureTLS.swift:102:10:102:33 | .TLSv10 :  | InsecureTLS.swift:111:47:111:64 | call to getBadTLSVersion() |
+| InsecureTLS.swift:102:10:102:33 | .TLSv10 :  | InsecureTLS.swift:111:47:111:64 | call to getBadTLSVersion() :  |
+| InsecureTLS.swift:111:47:111:64 | call to getBadTLSVersion() :  | InsecureTLS.swift:19:7:19:7 | value :  |
+| InsecureTLS.swift:121:55:121:66 | version :  | InsecureTLS.swift:122:47:122:47 | version |
+| InsecureTLS.swift:121:55:121:66 | version :  | InsecureTLS.swift:122:47:122:47 | version :  |
+| InsecureTLS.swift:122:47:122:47 | version :  | InsecureTLS.swift:19:7:19:7 | value :  |
+| InsecureTLS.swift:127:25:127:48 | .TLSv11 :  | InsecureTLS.swift:121:55:121:66 | version :  |
+| InsecureTLS.swift:158:7:158:7 | self [TLSVersion] :  | file://:0:0:0:0 | self [TLSVersion] :  |
+| InsecureTLS.swift:158:7:158:7 | value :  | file://:0:0:0:0 | value :  |
+| InsecureTLS.swift:163:3:163:3 | [post] def [TLSVersion] :  | InsecureTLS.swift:165:47:165:47 | def [TLSVersion] :  |
+| InsecureTLS.swift:163:20:163:43 | .TLSv10 :  | InsecureTLS.swift:158:7:158:7 | value :  |
+| InsecureTLS.swift:163:20:163:43 | .TLSv10 :  | InsecureTLS.swift:163:3:163:3 | [post] def [TLSVersion] :  |
+| InsecureTLS.swift:165:47:165:47 | def [TLSVersion] :  | InsecureTLS.swift:158:7:158:7 | self [TLSVersion] :  |
+| InsecureTLS.swift:165:47:165:47 | def [TLSVersion] :  | InsecureTLS.swift:165:47:165:51 | .TLSVersion |
+| InsecureTLS.swift:165:47:165:47 | def [TLSVersion] :  | InsecureTLS.swift:165:47:165:51 | .TLSVersion :  |
+| InsecureTLS.swift:165:47:165:51 | .TLSVersion :  | InsecureTLS.swift:19:7:19:7 | value :  |
+| file://:0:0:0:0 | self [TLSVersion] :  | file://:0:0:0:0 | .TLSVersion :  |
+| file://:0:0:0:0 | value :  | file://:0:0:0:0 | [post] self [TLSVersion] :  |
+nodes
+| InsecureTLS.swift:19:7:19:7 | value :  | semmle.label | value :  |
+| InsecureTLS.swift:20:7:20:7 | value :  | semmle.label | value :  |
+| InsecureTLS.swift:22:7:22:7 | value :  | semmle.label | value :  |
+| InsecureTLS.swift:23:7:23:7 | value :  | semmle.label | value :  |
+| InsecureTLS.swift:40:47:40:70 | .TLSv10 | semmle.label | .TLSv10 |
+| InsecureTLS.swift:40:47:40:70 | .TLSv10 :  | semmle.label | .TLSv10 :  |
+| InsecureTLS.swift:45:47:45:70 | .TLSv11 | semmle.label | .TLSv11 |
+| InsecureTLS.swift:45:47:45:70 | .TLSv11 :  | semmle.label | .TLSv11 :  |
+| InsecureTLS.swift:57:47:57:70 | .TLSv10 | semmle.label | .TLSv10 |
+| InsecureTLS.swift:57:47:57:70 | .TLSv10 :  | semmle.label | .TLSv10 :  |
+| InsecureTLS.swift:64:40:64:52 | .tlsProtocol10 | semmle.label | .tlsProtocol10 |
+| InsecureTLS.swift:64:40:64:52 | .tlsProtocol10 :  | semmle.label | .tlsProtocol10 :  |
+| InsecureTLS.swift:76:40:76:52 | .tlsProtocol10 | semmle.label | .tlsProtocol10 |
+| InsecureTLS.swift:76:40:76:52 | .tlsProtocol10 :  | semmle.label | .tlsProtocol10 :  |
+| InsecureTLS.swift:102:10:102:33 | .TLSv10 :  | semmle.label | .TLSv10 :  |
+| InsecureTLS.swift:111:47:111:64 | call to getBadTLSVersion() | semmle.label | call to getBadTLSVersion() |
+| InsecureTLS.swift:111:47:111:64 | call to getBadTLSVersion() :  | semmle.label | call to getBadTLSVersion() :  |
+| InsecureTLS.swift:121:55:121:66 | version :  | semmle.label | version :  |
+| InsecureTLS.swift:122:47:122:47 | version | semmle.label | version |
+| InsecureTLS.swift:122:47:122:47 | version :  | semmle.label | version :  |
+| InsecureTLS.swift:127:25:127:48 | .TLSv11 :  | semmle.label | .TLSv11 :  |
+| InsecureTLS.swift:158:7:158:7 | self [TLSVersion] :  | semmle.label | self [TLSVersion] :  |
+| InsecureTLS.swift:158:7:158:7 | value :  | semmle.label | value :  |
+| InsecureTLS.swift:163:3:163:3 | [post] def [TLSVersion] :  | semmle.label | [post] def [TLSVersion] :  |
+| InsecureTLS.swift:163:20:163:43 | .TLSv10 :  | semmle.label | .TLSv10 :  |
+| InsecureTLS.swift:165:47:165:47 | def [TLSVersion] :  | semmle.label | def [TLSVersion] :  |
+| InsecureTLS.swift:165:47:165:51 | .TLSVersion | semmle.label | .TLSVersion |
+| InsecureTLS.swift:165:47:165:51 | .TLSVersion :  | semmle.label | .TLSVersion :  |
+| file://:0:0:0:0 | .TLSVersion :  | semmle.label | .TLSVersion :  |
+| file://:0:0:0:0 | [post] self [TLSVersion] :  | semmle.label | [post] self [TLSVersion] :  |
+| file://:0:0:0:0 | self [TLSVersion] :  | semmle.label | self [TLSVersion] :  |
+| file://:0:0:0:0 | value | semmle.label | value |
+| file://:0:0:0:0 | value | semmle.label | value |
+| file://:0:0:0:0 | value | semmle.label | value |
+| file://:0:0:0:0 | value | semmle.label | value |
+| file://:0:0:0:0 | value :  | semmle.label | value :  |
+subpaths
+| InsecureTLS.swift:163:20:163:43 | .TLSv10 :  | InsecureTLS.swift:158:7:158:7 | value :  | file://:0:0:0:0 | [post] self [TLSVersion] :  | InsecureTLS.swift:163:3:163:3 | [post] def [TLSVersion] :  |
+| InsecureTLS.swift:165:47:165:47 | def [TLSVersion] :  | InsecureTLS.swift:158:7:158:7 | self [TLSVersion] :  | file://:0:0:0:0 | .TLSVersion :  | InsecureTLS.swift:165:47:165:51 | .TLSVersion |
+| InsecureTLS.swift:165:47:165:47 | def [TLSVersion] :  | InsecureTLS.swift:158:7:158:7 | self [TLSVersion] :  | file://:0:0:0:0 | .TLSVersion :  | InsecureTLS.swift:165:47:165:51 | .TLSVersion :  |
+#select
+| InsecureTLS.swift:40:47:40:70 | .TLSv10 | InsecureTLS.swift:40:47:40:70 | .TLSv10 | InsecureTLS.swift:40:47:40:70 | .TLSv10 | This TLS configuration is insecure. |
+| InsecureTLS.swift:45:47:45:70 | .TLSv11 | InsecureTLS.swift:45:47:45:70 | .TLSv11 | InsecureTLS.swift:45:47:45:70 | .TLSv11 | This TLS configuration is insecure. |
+| InsecureTLS.swift:57:47:57:70 | .TLSv10 | InsecureTLS.swift:57:47:57:70 | .TLSv10 | InsecureTLS.swift:57:47:57:70 | .TLSv10 | This TLS configuration is insecure. |
+| InsecureTLS.swift:64:40:64:52 | .tlsProtocol10 | InsecureTLS.swift:64:40:64:52 | .tlsProtocol10 | InsecureTLS.swift:64:40:64:52 | .tlsProtocol10 | This TLS configuration is insecure. |
+| InsecureTLS.swift:76:40:76:52 | .tlsProtocol10 | InsecureTLS.swift:76:40:76:52 | .tlsProtocol10 | InsecureTLS.swift:76:40:76:52 | .tlsProtocol10 | This TLS configuration is insecure. |
+| InsecureTLS.swift:111:47:111:64 | call to getBadTLSVersion() | InsecureTLS.swift:102:10:102:33 | .TLSv10 :  | InsecureTLS.swift:111:47:111:64 | call to getBadTLSVersion() | This TLS configuration is insecure. |
+| InsecureTLS.swift:122:47:122:47 | version | InsecureTLS.swift:127:25:127:48 | .TLSv11 :  | InsecureTLS.swift:122:47:122:47 | version | This TLS configuration is insecure. |
+| InsecureTLS.swift:165:47:165:51 | .TLSVersion | InsecureTLS.swift:163:20:163:43 | .TLSv10 :  | InsecureTLS.swift:165:47:165:51 | .TLSVersion | This TLS configuration is insecure. |
+| file://:0:0:0:0 | value | InsecureTLS.swift:40:47:40:70 | .TLSv10 :  | file://:0:0:0:0 | value | This TLS configuration is insecure. |
+| file://:0:0:0:0 | value | InsecureTLS.swift:45:47:45:70 | .TLSv11 :  | file://:0:0:0:0 | value | This TLS configuration is insecure. |
+| file://:0:0:0:0 | value | InsecureTLS.swift:57:47:57:70 | .TLSv10 :  | file://:0:0:0:0 | value | This TLS configuration is insecure. |
+| file://:0:0:0:0 | value | InsecureTLS.swift:64:40:64:52 | .tlsProtocol10 :  | file://:0:0:0:0 | value | This TLS configuration is insecure. |
+| file://:0:0:0:0 | value | InsecureTLS.swift:76:40:76:52 | .tlsProtocol10 :  | file://:0:0:0:0 | value | This TLS configuration is insecure. |
+| file://:0:0:0:0 | value | InsecureTLS.swift:102:10:102:33 | .TLSv10 :  | file://:0:0:0:0 | value | This TLS configuration is insecure. |
+| file://:0:0:0:0 | value | InsecureTLS.swift:127:25:127:48 | .TLSv11 :  | file://:0:0:0:0 | value | This TLS configuration is insecure. |
+| file://:0:0:0:0 | value | InsecureTLS.swift:163:20:163:43 | .TLSv10 :  | file://:0:0:0:0 | value | This TLS configuration is insecure. |
diff --git a/swift/ql/test/query-tests/Security/CWE-757/InsecureTLS.qlref b/swift/ql/test/query-tests/Security/CWE-757/InsecureTLS.qlref
new file mode 100644
index 00000000000..af89770b496
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-757/InsecureTLS.qlref
@@ -0,0 +1 @@
+queries/Security/CWE-757/InsecureTLS.ql
diff --git a/swift/ql/test/query-tests/Security/CWE-757/InsecureTLS.swift b/swift/ql/test/query-tests/Security/CWE-757/InsecureTLS.swift
new file mode 100644
index 00000000000..d06c9614ac3
--- /dev/null
+++ b/swift/ql/test/query-tests/Security/CWE-757/InsecureTLS.swift
@@ -0,0 +1,173 @@
+// Stubs
+
+enum tls_protocol_version_t : UInt16 {
+  case TLSv10
+  case TLSv11
+  case TLSv12
+  case TLSv13
+}
+
+enum SSLProtocol {
+  case tlsProtocol10
+  case tlsProtocol11
+  case tlsProtocol12
+  case tlsProtocol13
+}
+
+class URLSessionConfiguration {
+  init() {}
+  var tlsMinimumSupportedProtocolVersion: tls_protocol_version_t = tls_protocol_version_t.TLSv12
+  var tlsMaximumSupportedProtocolVersion: tls_protocol_version_t = tls_protocol_version_t.TLSv13
+
+  var tlsMinimumSupportedProtocol: SSLProtocol = SSLProtocol.tlsProtocol12
+  var tlsMaximumSupportedProtocol: SSLProtocol = SSLProtocol.tlsProtocol13
+}
+
+/// tlsMinimumSupportedProtocolVersion
+
+func case_0() {
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = tls_protocol_version_t.TLSv12 // GOOD
+}
+
+func case_1() {
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = tls_protocol_version_t.TLSv13 // GOOD
+}
+
+func case_2() {
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = tls_protocol_version_t.TLSv10 // BAD
+}
+
+func case_3() {
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = tls_protocol_version_t.TLSv11 // BAD
+}
+
+/// tlsMaximumSupportedProtocolVersion
+
+func case_4() {
+  let config = URLSessionConfiguration()
+  config.tlsMaximumSupportedProtocolVersion = tls_protocol_version_t.TLSv12 // GOOD
+}
+
+func case_5() {
+  let config = URLSessionConfiguration()
+  config.tlsMaximumSupportedProtocolVersion = tls_protocol_version_t.TLSv10 // BAD
+}
+
+/// tlsMinimumSupportedProtocol
+
+func case_6() {
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocol = SSLProtocol.tlsProtocol10 // BAD
+}
+
+func case_7() {
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocol = SSLProtocol.tlsProtocol12 // GOOD
+}
+
+/// tlsMaximumSupportedProtocol
+
+func case_8() {
+  let config = URLSessionConfiguration()
+  config.tlsMaximumSupportedProtocol = SSLProtocol.tlsProtocol10 // BAD
+}
+
+func case_9() {
+  let config = URLSessionConfiguration()
+  config.tlsMaximumSupportedProtocol = SSLProtocol.tlsProtocol12 // GOOD
+}
+
+/// Indirect assignment (global vars)
+
+let badGlobalVersion = tls_protocol_version_t.TLSv10
+let goodGlobalVersion = tls_protocol_version_t.TLSv12
+
+func case_10() {
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = badGlobalVersion // BAD [not detected]
+}
+
+func case_11() {
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = goodGlobalVersion // GOOD
+}
+
+/// Indirect assignment (function calls)
+
+func getBadTLSVersion() -> tls_protocol_version_t {
+  return tls_protocol_version_t.TLSv10
+}
+
+func getGoodTLSVersion() -> tls_protocol_version_t {
+  return tls_protocol_version_t.TLSv13
+}
+
+func case_12() {
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = getBadTLSVersion() // BAD
+}
+
+func case_13() {
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = getGoodTLSVersion() // GOOD
+}
+
+/// Indirect assignment (via call arguments)
+
+func setTLSVersion(_ config: URLSessionConfiguration, _ version: tls_protocol_version_t) {
+  config.tlsMinimumSupportedProtocolVersion = version
+}
+
+func case_14() {
+  let config = URLSessionConfiguration()
+  setTLSVersion(config, tls_protocol_version_t.TLSv11) // BAD
+}
+
+func case_15() {
+  let config = URLSessionConfiguration()
+  setTLSVersion(config, tls_protocol_version_t.TLSv13) // GOOD
+}
+
+/// Indirect assignment (via external entity)
+
+struct BadDefault {
+  let TLSVersion: tls_protocol_version_t = tls_protocol_version_t.TLSv11
+}
+
+func case_16() {
+  let def = BadDefault()
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = def.TLSVersion // BAD [not detected]
+}
+
+struct GoodDefault {
+  let TLSVersion: tls_protocol_version_t = tls_protocol_version_t.TLSv12
+}
+
+func case_17() {
+  let def = GoodDefault()
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = def.TLSVersion // GOOD
+}
+
+struct VarDefault {
+  var TLSVersion: tls_protocol_version_t = tls_protocol_version_t.TLSv12
+}
+
+func case_18() {
+  var def = VarDefault()
+  def.TLSVersion = tls_protocol_version_t.TLSv10
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = def.TLSVersion // BAD
+}
+
+func case_19() {
+  var def = VarDefault()
+  def.TLSVersion = tls_protocol_version_t.TLSv13
+  let config = URLSessionConfiguration()
+  config.tlsMinimumSupportedProtocolVersion = def.TLSVersion // GOOD
+}
diff --git a/swift/tools/fishhook/BUILD.bazel b/swift/tools/fishhook/BUILD.bazel
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/swift/tools/fishhook/BUILD.fishhook.bazel b/swift/tools/fishhook/BUILD.fishhook.bazel
new file mode 100644
index 00000000000..5919f608d65
--- /dev/null
+++ b/swift/tools/fishhook/BUILD.fishhook.bazel
@@ -0,0 +1,7 @@
+cc_library(
+    name = "fishhook",
+    srcs = glob(["*.c"]),
+    hdrs = glob(["*.h"]),
+    strip_include_prefix = ".",
+    visibility = ["//visibility:public"],
+)
diff --git a/swift/tools/tracing-config.lua b/swift/tools/tracing-config.lua
index d9343285099..4644457515e 100644
--- a/swift/tools/tracing-config.lua
+++ b/swift/tools/tracing-config.lua
@@ -29,6 +29,8 @@ function RegisterExtractorPack(id)
       strip_unsupported_arg(args, '-emit-localized-strings', 0)
       strip_unsupported_arg(args, '-emit-localized-strings-path', 1)
       strip_unsupported_arg(args, '-stack-check', 0)
+      strip_unsupported_arg(args, '-disable-clang-spi', 0)
+      strip_unsupported_arg(args, '-empty-abi-descriptor', 0)
     end
 
     -- xcodebuild does not always specify the -resource-dir in which case the compiler falls back